@claudexor/schema 3.6.0 → 3.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/agent-capabilities.d.ts +32 -0
- package/dist/agent-capabilities.d.ts.map +1 -1
- package/dist/agent-capabilities.js +4 -0
- package/dist/agent-capabilities.js.map +1 -1
- package/dist/config.d.ts +10 -8
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +7 -6
- package/dist/config.js.map +1 -1
- package/dist/control-harness-list.d.ts +197 -1
- package/dist/control-harness-list.d.ts.map +1 -1
- package/dist/credential-profile-snapshot.d.ts +408 -16
- package/dist/credential-profile-snapshot.d.ts.map +1 -1
- package/dist/credential-profile.d.ts +69 -42
- package/dist/credential-profile.d.ts.map +1 -1
- package/dist/credential-profile.js +47 -30
- package/dist/credential-profile.js.map +1 -1
- package/dist/harness.d.ts +247 -54
- package/dist/harness.d.ts.map +1 -1
- package/dist/harness.js +2 -32
- package/dist/harness.js.map +1 -1
- package/dist/platform-auth.d.ts +196 -0
- package/dist/platform-auth.d.ts.map +1 -0
- package/dist/platform-auth.js +142 -0
- package/dist/platform-auth.js.map +1 -0
- package/dist/quota.d.ts +9 -9
- package/dist/quota.d.ts.map +1 -1
- package/dist/quota.js +3 -0
- package/dist/quota.js.map +1 -1
- package/dist/readiness.d.ts +178 -1
- package/dist/readiness.d.ts.map +1 -1
- package/dist/readiness.js +12 -0
- package/dist/readiness.js.map +1 -1
- package/dist/setup-login.d.ts +5 -5
- package/dist/setup.d.ts +102 -95
- package/dist/setup.d.ts.map +1 -1
- package/dist/setup.js +29 -5
- package/dist/setup.js.map +1 -1
- package/generated/AgentCapabilityCatalog.schema.json +26 -0
- package/generated/ControlCredentialProfileCreateRequest.schema.json +1 -1
- package/generated/ControlCredentialProfileCreateResponse.schema.json +4 -4
- package/generated/ControlCredentialProfileDeleteResponse.schema.json +27 -3
- package/generated/ControlCredentialProfileUpdateResponse.schema.json +4 -4
- package/generated/ControlCredentialProfilesQueryResponse.schema.json +130 -5
- package/generated/ControlCredentialProfilesResponse.schema.json +4 -4
- package/generated/ControlCredentialProfilesSnapshotResponse.schema.json +130 -5
- package/generated/ControlHarnessListResponse.schema.json +124 -0
- package/generated/ControlQuotaResponse.schema.json +2 -1
- package/generated/ControlSetupJob.schema.json +5 -1
- package/generated/ControlSetupJobCreateRequest.schema.json +1 -1
- package/generated/ControlSetupJobEvent.schema.json +5 -1
- package/generated/ControlSetupJobListResponse.schema.json +5 -1
- package/generated/ControlSetupJobSnapshot.schema.json +5 -1
- package/generated/CredentialProfile.schema.json +3 -3
- package/generated/CredentialProfileStatus.schema.json +1 -1
- package/generated/GlobalConfig.schema.json +4 -4
- package/generated/HarnessManifest.schema.json +98 -0
- package/generated/HarnessStatusDto.schema.json +124 -0
- package/package.json +2 -2
|
@@ -34,7 +34,7 @@
|
|
|
34
34
|
"oauth_token",
|
|
35
35
|
"api_key"
|
|
36
36
|
],
|
|
37
|
-
"description": "
|
|
37
|
+
"description": "Binding kind for a profile: Claudexor-owned scoped vendor state, a managed OAuth secret, or a managed API-key secret; a vendor OS-user credential may remain outside that state."
|
|
38
38
|
},
|
|
39
39
|
"isolation_locator": {
|
|
40
40
|
"type": [
|
|
@@ -42,7 +42,7 @@
|
|
|
42
42
|
"null"
|
|
43
43
|
],
|
|
44
44
|
"default": null,
|
|
45
|
-
"description": "Canonical absolute
|
|
45
|
+
"description": "Canonical absolute path to Claudexor-owned scoped vendor state for config_dir_login bindings; null for secret-ref kinds."
|
|
46
46
|
},
|
|
47
47
|
"secret_ref": {
|
|
48
48
|
"type": [
|
|
@@ -79,7 +79,7 @@
|
|
|
79
79
|
"credential_kind"
|
|
80
80
|
],
|
|
81
81
|
"additionalProperties": false,
|
|
82
|
-
"description": "Durable non-secret
|
|
82
|
+
"description": "Durable non-secret named binding for one harness; credential material may live in Claudexor-owned scoped state, a managed secret store, or a platform-declared vendor/OS-user store, never in this row."
|
|
83
83
|
},
|
|
84
84
|
"status": {
|
|
85
85
|
"type": "object",
|
|
@@ -115,7 +115,7 @@
|
|
|
115
115
|
"vendor"
|
|
116
116
|
],
|
|
117
117
|
"default": "local_store",
|
|
118
|
-
"description": "How the verification verdict was reached: local_store = the
|
|
118
|
+
"description": "How the verification verdict was reached: local_store = the binding's required local state or managed secret is present (says nothing about a token being live); vendor = the vendor answered under the exact binding environment and effective platform credential policy."
|
|
119
119
|
},
|
|
120
120
|
"detail": {
|
|
121
121
|
"type": "string",
|
|
@@ -34,7 +34,7 @@
|
|
|
34
34
|
"oauth_token",
|
|
35
35
|
"api_key"
|
|
36
36
|
],
|
|
37
|
-
"description": "
|
|
37
|
+
"description": "Binding kind for a profile: Claudexor-owned scoped vendor state, a managed OAuth secret, or a managed API-key secret; a vendor OS-user credential may remain outside that state."
|
|
38
38
|
},
|
|
39
39
|
"isolation_locator": {
|
|
40
40
|
"type": [
|
|
@@ -42,7 +42,7 @@
|
|
|
42
42
|
"null"
|
|
43
43
|
],
|
|
44
44
|
"default": null,
|
|
45
|
-
"description": "Canonical absolute
|
|
45
|
+
"description": "Canonical absolute path to Claudexor-owned scoped vendor state for config_dir_login bindings; null for secret-ref kinds."
|
|
46
46
|
},
|
|
47
47
|
"secret_ref": {
|
|
48
48
|
"type": [
|
|
@@ -79,7 +79,7 @@
|
|
|
79
79
|
"credential_kind"
|
|
80
80
|
],
|
|
81
81
|
"additionalProperties": false,
|
|
82
|
-
"description": "Durable non-secret
|
|
82
|
+
"description": "Durable non-secret named binding for one harness; credential material may live in Claudexor-owned scoped state, a managed secret store, or a platform-declared vendor/OS-user store, never in this row."
|
|
83
83
|
},
|
|
84
84
|
"status": {
|
|
85
85
|
"type": "object",
|
|
@@ -115,7 +115,7 @@
|
|
|
115
115
|
"vendor"
|
|
116
116
|
],
|
|
117
117
|
"default": "local_store",
|
|
118
|
-
"description": "How the verification verdict was reached: local_store = the
|
|
118
|
+
"description": "How the verification verdict was reached: local_store = the binding's required local state or managed secret is present (says nothing about a token being live); vendor = the vendor answered under the exact binding environment and effective platform credential policy."
|
|
119
119
|
},
|
|
120
120
|
"detail": {
|
|
121
121
|
"type": "string",
|
|
@@ -493,6 +493,20 @@
|
|
|
493
493
|
},
|
|
494
494
|
"default": [],
|
|
495
495
|
"description": "Relocation levers that can move this transport into a scoped environment."
|
|
496
|
+
},
|
|
497
|
+
"platforms": {
|
|
498
|
+
"type": "array",
|
|
499
|
+
"items": {
|
|
500
|
+
"type": "string",
|
|
501
|
+
"enum": [
|
|
502
|
+
"darwin",
|
|
503
|
+
"linux",
|
|
504
|
+
"win32"
|
|
505
|
+
],
|
|
506
|
+
"description": "Host platform used to resolve credential and managed-login policy."
|
|
507
|
+
},
|
|
508
|
+
"minItems": 1,
|
|
509
|
+
"description": "Host platforms on which this physical credential transport applies; absent means every supported platform for backward compatibility."
|
|
496
510
|
}
|
|
497
511
|
},
|
|
498
512
|
"required": [
|
|
@@ -504,6 +518,90 @@
|
|
|
504
518
|
},
|
|
505
519
|
"default": [],
|
|
506
520
|
"description": "Declared credential transports per auth source."
|
|
521
|
+
},
|
|
522
|
+
"credential_profile_policies": {
|
|
523
|
+
"type": "array",
|
|
524
|
+
"items": {
|
|
525
|
+
"type": "object",
|
|
526
|
+
"properties": {
|
|
527
|
+
"source": {
|
|
528
|
+
"$ref": "#/definitions/ControlCredentialProfilesSnapshotResponse/properties/harnesses/items/properties/manifest/anyOf/0/properties/capability_profile/properties/auth/properties/supported_sources/items"
|
|
529
|
+
},
|
|
530
|
+
"platforms": {
|
|
531
|
+
"type": "array",
|
|
532
|
+
"items": {
|
|
533
|
+
"$ref": "#/definitions/ControlCredentialProfilesSnapshotResponse/properties/harnesses/items/properties/manifest/anyOf/0/properties/capability_profile/properties/auth/properties/credential_transports/items/properties/platforms/items"
|
|
534
|
+
},
|
|
535
|
+
"minItems": 1,
|
|
536
|
+
"description": "Nonempty host-platform set governed by this policy row."
|
|
537
|
+
},
|
|
538
|
+
"identity_scope": {
|
|
539
|
+
"type": "string",
|
|
540
|
+
"enum": [
|
|
541
|
+
"profile",
|
|
542
|
+
"os_user"
|
|
543
|
+
],
|
|
544
|
+
"description": "Identity boundary selected by a credential profile: the named profile itself or the host OS user/login vault."
|
|
545
|
+
},
|
|
546
|
+
"max_enabled_profiles": {
|
|
547
|
+
"anyOf": [
|
|
548
|
+
{
|
|
549
|
+
"type": "integer",
|
|
550
|
+
"exclusiveMinimum": 0
|
|
551
|
+
},
|
|
552
|
+
{
|
|
553
|
+
"type": "null"
|
|
554
|
+
}
|
|
555
|
+
],
|
|
556
|
+
"description": "Maximum enabled profile bindings on these platforms; null means unbounded."
|
|
557
|
+
},
|
|
558
|
+
"cleanup_owner": {
|
|
559
|
+
"type": "string",
|
|
560
|
+
"enum": [
|
|
561
|
+
"claudexor",
|
|
562
|
+
"vendor"
|
|
563
|
+
],
|
|
564
|
+
"description": "Who owns cleanup of the credential when its Claudexor profile binding is removed."
|
|
565
|
+
}
|
|
566
|
+
},
|
|
567
|
+
"required": [
|
|
568
|
+
"source",
|
|
569
|
+
"platforms",
|
|
570
|
+
"identity_scope",
|
|
571
|
+
"max_enabled_profiles",
|
|
572
|
+
"cleanup_owner"
|
|
573
|
+
],
|
|
574
|
+
"additionalProperties": false,
|
|
575
|
+
"description": "Platform-specific identity scope, enabled-profile cardinality, and credential cleanup ownership for one auth source."
|
|
576
|
+
},
|
|
577
|
+
"description": "Platform-specific profile identity/cardinality/cleanup policy; absent uses the backward-compatible profile-scoped, unbounded, Claudexor-owned defaults."
|
|
578
|
+
},
|
|
579
|
+
"managed_login": {
|
|
580
|
+
"anyOf": [
|
|
581
|
+
{
|
|
582
|
+
"type": "object",
|
|
583
|
+
"properties": {
|
|
584
|
+
"stdin": {
|
|
585
|
+
"type": "string",
|
|
586
|
+
"enum": [
|
|
587
|
+
"none",
|
|
588
|
+
"pipe",
|
|
589
|
+
"terminal"
|
|
590
|
+
],
|
|
591
|
+
"description": "Input transport the vendor login command requires."
|
|
592
|
+
}
|
|
593
|
+
},
|
|
594
|
+
"required": [
|
|
595
|
+
"stdin"
|
|
596
|
+
],
|
|
597
|
+
"additionalProperties": false,
|
|
598
|
+
"description": "Managed-login input requirement; command, argv, flow, and time window remain owned by the native-login registry."
|
|
599
|
+
},
|
|
600
|
+
{
|
|
601
|
+
"type": "null"
|
|
602
|
+
}
|
|
603
|
+
],
|
|
604
|
+
"description": "Managed subscription-login input requirement; null means this harness defines no managed login, absent is a legacy manifest."
|
|
507
605
|
}
|
|
508
606
|
},
|
|
509
607
|
"additionalProperties": false,
|
|
@@ -1113,6 +1211,32 @@
|
|
|
1113
1211
|
],
|
|
1114
1212
|
"description": "Engine-owned Delegate capability for this harness and installed runtime; null on legacy status rows.",
|
|
1115
1213
|
"default": null
|
|
1214
|
+
},
|
|
1215
|
+
"setupLogin": {
|
|
1216
|
+
"anyOf": [
|
|
1217
|
+
{
|
|
1218
|
+
"type": "object",
|
|
1219
|
+
"properties": {
|
|
1220
|
+
"mode": {
|
|
1221
|
+
"type": "string",
|
|
1222
|
+
"enum": [
|
|
1223
|
+
"in_app",
|
|
1224
|
+
"external_terminal"
|
|
1225
|
+
],
|
|
1226
|
+
"description": "in_app requests the daemon-hosted login flow; external_terminal requests the existing client PTY flow."
|
|
1227
|
+
}
|
|
1228
|
+
},
|
|
1229
|
+
"required": [
|
|
1230
|
+
"mode"
|
|
1231
|
+
],
|
|
1232
|
+
"additionalProperties": false,
|
|
1233
|
+
"description": "Effective setup-login flow for this harness on the current host."
|
|
1234
|
+
},
|
|
1235
|
+
{
|
|
1236
|
+
"type": "null"
|
|
1237
|
+
}
|
|
1238
|
+
],
|
|
1239
|
+
"description": "Effective setup-login flow for this harness on the current host; current producers emit null or an object, while omission identifies a legacy row."
|
|
1116
1240
|
}
|
|
1117
1241
|
},
|
|
1118
1242
|
"required": [
|
|
@@ -1426,7 +1550,8 @@
|
|
|
1426
1550
|
"platform_unsupported",
|
|
1427
1551
|
"refresh_failed",
|
|
1428
1552
|
"no_source",
|
|
1429
|
-
"auth_revoked"
|
|
1553
|
+
"auth_revoked",
|
|
1554
|
+
"credential_profile_ambiguous"
|
|
1430
1555
|
],
|
|
1431
1556
|
"description": "Why a registered subject has no quota snapshot, in the source's own vocabulary."
|
|
1432
1557
|
},
|
|
@@ -137,6 +137,20 @@
|
|
|
137
137
|
},
|
|
138
138
|
"default": [],
|
|
139
139
|
"description": "Relocation levers that can move this transport into a scoped environment."
|
|
140
|
+
},
|
|
141
|
+
"platforms": {
|
|
142
|
+
"type": "array",
|
|
143
|
+
"items": {
|
|
144
|
+
"type": "string",
|
|
145
|
+
"enum": [
|
|
146
|
+
"darwin",
|
|
147
|
+
"linux",
|
|
148
|
+
"win32"
|
|
149
|
+
],
|
|
150
|
+
"description": "Host platform used to resolve credential and managed-login policy."
|
|
151
|
+
},
|
|
152
|
+
"minItems": 1,
|
|
153
|
+
"description": "Host platforms on which this physical credential transport applies; absent means every supported platform for backward compatibility."
|
|
140
154
|
}
|
|
141
155
|
},
|
|
142
156
|
"required": [
|
|
@@ -148,6 +162,90 @@
|
|
|
148
162
|
},
|
|
149
163
|
"default": [],
|
|
150
164
|
"description": "Declared credential transports per auth source."
|
|
165
|
+
},
|
|
166
|
+
"credential_profile_policies": {
|
|
167
|
+
"type": "array",
|
|
168
|
+
"items": {
|
|
169
|
+
"type": "object",
|
|
170
|
+
"properties": {
|
|
171
|
+
"source": {
|
|
172
|
+
"$ref": "#/definitions/ControlHarnessListResponse/properties/harnesses/items/properties/manifest/anyOf/0/properties/capability_profile/properties/auth/properties/supported_sources/items"
|
|
173
|
+
},
|
|
174
|
+
"platforms": {
|
|
175
|
+
"type": "array",
|
|
176
|
+
"items": {
|
|
177
|
+
"$ref": "#/definitions/ControlHarnessListResponse/properties/harnesses/items/properties/manifest/anyOf/0/properties/capability_profile/properties/auth/properties/credential_transports/items/properties/platforms/items"
|
|
178
|
+
},
|
|
179
|
+
"minItems": 1,
|
|
180
|
+
"description": "Nonempty host-platform set governed by this policy row."
|
|
181
|
+
},
|
|
182
|
+
"identity_scope": {
|
|
183
|
+
"type": "string",
|
|
184
|
+
"enum": [
|
|
185
|
+
"profile",
|
|
186
|
+
"os_user"
|
|
187
|
+
],
|
|
188
|
+
"description": "Identity boundary selected by a credential profile: the named profile itself or the host OS user/login vault."
|
|
189
|
+
},
|
|
190
|
+
"max_enabled_profiles": {
|
|
191
|
+
"anyOf": [
|
|
192
|
+
{
|
|
193
|
+
"type": "integer",
|
|
194
|
+
"exclusiveMinimum": 0
|
|
195
|
+
},
|
|
196
|
+
{
|
|
197
|
+
"type": "null"
|
|
198
|
+
}
|
|
199
|
+
],
|
|
200
|
+
"description": "Maximum enabled profile bindings on these platforms; null means unbounded."
|
|
201
|
+
},
|
|
202
|
+
"cleanup_owner": {
|
|
203
|
+
"type": "string",
|
|
204
|
+
"enum": [
|
|
205
|
+
"claudexor",
|
|
206
|
+
"vendor"
|
|
207
|
+
],
|
|
208
|
+
"description": "Who owns cleanup of the credential when its Claudexor profile binding is removed."
|
|
209
|
+
}
|
|
210
|
+
},
|
|
211
|
+
"required": [
|
|
212
|
+
"source",
|
|
213
|
+
"platforms",
|
|
214
|
+
"identity_scope",
|
|
215
|
+
"max_enabled_profiles",
|
|
216
|
+
"cleanup_owner"
|
|
217
|
+
],
|
|
218
|
+
"additionalProperties": false,
|
|
219
|
+
"description": "Platform-specific identity scope, enabled-profile cardinality, and credential cleanup ownership for one auth source."
|
|
220
|
+
},
|
|
221
|
+
"description": "Platform-specific profile identity/cardinality/cleanup policy; absent uses the backward-compatible profile-scoped, unbounded, Claudexor-owned defaults."
|
|
222
|
+
},
|
|
223
|
+
"managed_login": {
|
|
224
|
+
"anyOf": [
|
|
225
|
+
{
|
|
226
|
+
"type": "object",
|
|
227
|
+
"properties": {
|
|
228
|
+
"stdin": {
|
|
229
|
+
"type": "string",
|
|
230
|
+
"enum": [
|
|
231
|
+
"none",
|
|
232
|
+
"pipe",
|
|
233
|
+
"terminal"
|
|
234
|
+
],
|
|
235
|
+
"description": "Input transport the vendor login command requires."
|
|
236
|
+
}
|
|
237
|
+
},
|
|
238
|
+
"required": [
|
|
239
|
+
"stdin"
|
|
240
|
+
],
|
|
241
|
+
"additionalProperties": false,
|
|
242
|
+
"description": "Managed-login input requirement; command, argv, flow, and time window remain owned by the native-login registry."
|
|
243
|
+
},
|
|
244
|
+
{
|
|
245
|
+
"type": "null"
|
|
246
|
+
}
|
|
247
|
+
],
|
|
248
|
+
"description": "Managed subscription-login input requirement; null means this harness defines no managed login, absent is a legacy manifest."
|
|
151
249
|
}
|
|
152
250
|
},
|
|
153
251
|
"additionalProperties": false,
|
|
@@ -767,6 +865,32 @@
|
|
|
767
865
|
],
|
|
768
866
|
"description": "Engine-owned Delegate capability for this harness and installed runtime; null on legacy status rows.",
|
|
769
867
|
"default": null
|
|
868
|
+
},
|
|
869
|
+
"setupLogin": {
|
|
870
|
+
"anyOf": [
|
|
871
|
+
{
|
|
872
|
+
"type": "object",
|
|
873
|
+
"properties": {
|
|
874
|
+
"mode": {
|
|
875
|
+
"type": "string",
|
|
876
|
+
"enum": [
|
|
877
|
+
"in_app",
|
|
878
|
+
"external_terminal"
|
|
879
|
+
],
|
|
880
|
+
"description": "in_app requests the daemon-hosted login flow; external_terminal requests the existing client PTY flow."
|
|
881
|
+
}
|
|
882
|
+
},
|
|
883
|
+
"required": [
|
|
884
|
+
"mode"
|
|
885
|
+
],
|
|
886
|
+
"additionalProperties": false,
|
|
887
|
+
"description": "Effective setup-login flow for this harness on the current host."
|
|
888
|
+
},
|
|
889
|
+
{
|
|
890
|
+
"type": "null"
|
|
891
|
+
}
|
|
892
|
+
],
|
|
893
|
+
"description": "Effective setup-login flow for this harness on the current host; current producers emit null or an object, while omission identifies a legacy row."
|
|
770
894
|
}
|
|
771
895
|
},
|
|
772
896
|
"required": [
|
|
@@ -265,7 +265,8 @@
|
|
|
265
265
|
"platform_unsupported",
|
|
266
266
|
"refresh_failed",
|
|
267
267
|
"no_source",
|
|
268
|
-
"auth_revoked"
|
|
268
|
+
"auth_revoked",
|
|
269
|
+
"credential_profile_ambiguous"
|
|
269
270
|
],
|
|
270
271
|
"description": "Why a registered subject has no quota snapshot, in the source's own vocabulary."
|
|
271
272
|
},
|
|
@@ -811,7 +811,11 @@
|
|
|
811
811
|
"enum": [
|
|
812
812
|
"permit_timeout",
|
|
813
813
|
"spawn_failed",
|
|
814
|
-
"device_auth_unsupported"
|
|
814
|
+
"device_auth_unsupported",
|
|
815
|
+
"terminal_transport_unavailable",
|
|
816
|
+
"terminal_transport_unsupported",
|
|
817
|
+
"terminal_transport_probe_failed",
|
|
818
|
+
"terminal_transport_failed"
|
|
815
819
|
]
|
|
816
820
|
},
|
|
817
821
|
"finishedAt": {
|
|
@@ -26,7 +26,7 @@
|
|
|
26
26
|
"profileId": {
|
|
27
27
|
"type": "string",
|
|
28
28
|
"minLength": 1,
|
|
29
|
-
"description": "Registered config_dir_login
|
|
29
|
+
"description": "Registered config_dir_login binding to log in under its exact scoped environment; absent = the default session."
|
|
30
30
|
},
|
|
31
31
|
"loginFlow": {
|
|
32
32
|
"type": "string",
|
|
@@ -866,7 +866,11 @@
|
|
|
866
866
|
"enum": [
|
|
867
867
|
"permit_timeout",
|
|
868
868
|
"spawn_failed",
|
|
869
|
-
"device_auth_unsupported"
|
|
869
|
+
"device_auth_unsupported",
|
|
870
|
+
"terminal_transport_unavailable",
|
|
871
|
+
"terminal_transport_unsupported",
|
|
872
|
+
"terminal_transport_probe_failed",
|
|
873
|
+
"terminal_transport_failed"
|
|
870
874
|
]
|
|
871
875
|
},
|
|
872
876
|
"finishedAt": {
|
|
@@ -816,7 +816,11 @@
|
|
|
816
816
|
"enum": [
|
|
817
817
|
"permit_timeout",
|
|
818
818
|
"spawn_failed",
|
|
819
|
-
"device_auth_unsupported"
|
|
819
|
+
"device_auth_unsupported",
|
|
820
|
+
"terminal_transport_unavailable",
|
|
821
|
+
"terminal_transport_unsupported",
|
|
822
|
+
"terminal_transport_probe_failed",
|
|
823
|
+
"terminal_transport_failed"
|
|
820
824
|
]
|
|
821
825
|
},
|
|
822
826
|
"finishedAt": {
|
|
@@ -816,7 +816,11 @@
|
|
|
816
816
|
"enum": [
|
|
817
817
|
"permit_timeout",
|
|
818
818
|
"spawn_failed",
|
|
819
|
-
"device_auth_unsupported"
|
|
819
|
+
"device_auth_unsupported",
|
|
820
|
+
"terminal_transport_unavailable",
|
|
821
|
+
"terminal_transport_unsupported",
|
|
822
|
+
"terminal_transport_probe_failed",
|
|
823
|
+
"terminal_transport_failed"
|
|
820
824
|
]
|
|
821
825
|
},
|
|
822
826
|
"finishedAt": {
|
|
@@ -26,7 +26,7 @@
|
|
|
26
26
|
"oauth_token",
|
|
27
27
|
"api_key"
|
|
28
28
|
],
|
|
29
|
-
"description": "
|
|
29
|
+
"description": "Binding kind for a profile: Claudexor-owned scoped vendor state, a managed OAuth secret, or a managed API-key secret; a vendor OS-user credential may remain outside that state."
|
|
30
30
|
},
|
|
31
31
|
"isolation_locator": {
|
|
32
32
|
"type": [
|
|
@@ -34,7 +34,7 @@
|
|
|
34
34
|
"null"
|
|
35
35
|
],
|
|
36
36
|
"default": null,
|
|
37
|
-
"description": "Canonical absolute
|
|
37
|
+
"description": "Canonical absolute path to Claudexor-owned scoped vendor state for config_dir_login bindings; null for secret-ref kinds."
|
|
38
38
|
},
|
|
39
39
|
"secret_ref": {
|
|
40
40
|
"type": [
|
|
@@ -71,7 +71,7 @@
|
|
|
71
71
|
"credential_kind"
|
|
72
72
|
],
|
|
73
73
|
"additionalProperties": false,
|
|
74
|
-
"description": "Durable non-secret
|
|
74
|
+
"description": "Durable non-secret named binding for one harness; credential material may live in Claudexor-owned scoped state, a managed secret store, or a platform-declared vendor/OS-user store, never in this row."
|
|
75
75
|
}
|
|
76
76
|
},
|
|
77
77
|
"$schema": "http://json-schema.org/draft-07/schema#"
|
|
@@ -35,7 +35,7 @@
|
|
|
35
35
|
"vendor"
|
|
36
36
|
],
|
|
37
37
|
"default": "local_store",
|
|
38
|
-
"description": "How the verification verdict was reached: local_store = the
|
|
38
|
+
"description": "How the verification verdict was reached: local_store = the binding's required local state or managed secret is present (says nothing about a token being live); vendor = the vendor answered under the exact binding environment and effective platform credential policy."
|
|
39
39
|
},
|
|
40
40
|
"detail": {
|
|
41
41
|
"type": "string",
|
|
@@ -296,7 +296,7 @@
|
|
|
296
296
|
"oauth_token",
|
|
297
297
|
"api_key"
|
|
298
298
|
],
|
|
299
|
-
"description": "
|
|
299
|
+
"description": "Binding kind for a profile: Claudexor-owned scoped vendor state, a managed OAuth secret, or a managed API-key secret; a vendor OS-user credential may remain outside that state."
|
|
300
300
|
},
|
|
301
301
|
"isolation_locator": {
|
|
302
302
|
"type": [
|
|
@@ -304,7 +304,7 @@
|
|
|
304
304
|
"null"
|
|
305
305
|
],
|
|
306
306
|
"default": null,
|
|
307
|
-
"description": "Canonical absolute
|
|
307
|
+
"description": "Canonical absolute path to Claudexor-owned scoped vendor state for config_dir_login bindings; null for secret-ref kinds."
|
|
308
308
|
},
|
|
309
309
|
"secret_ref": {
|
|
310
310
|
"type": [
|
|
@@ -341,10 +341,10 @@
|
|
|
341
341
|
"credential_kind"
|
|
342
342
|
],
|
|
343
343
|
"additionalProperties": false,
|
|
344
|
-
"description": "Durable non-secret
|
|
344
|
+
"description": "Durable non-secret named binding for one harness; credential material may live in Claudexor-owned scoped state, a managed secret store, or a platform-declared vendor/OS-user store, never in this row."
|
|
345
345
|
},
|
|
346
346
|
"default": [],
|
|
347
|
-
"description": "Durable non-secret
|
|
347
|
+
"description": "Durable non-secret named-binding registry; credential material may live in Claudexor-owned scoped state, a managed secret store, or a platform-declared vendor/OS-user store, never in config."
|
|
348
348
|
},
|
|
349
349
|
"harnesses": {
|
|
350
350
|
"type": "object",
|
|
@@ -114,6 +114,20 @@
|
|
|
114
114
|
},
|
|
115
115
|
"default": [],
|
|
116
116
|
"description": "Relocation levers that can move this transport into a scoped environment."
|
|
117
|
+
},
|
|
118
|
+
"platforms": {
|
|
119
|
+
"type": "array",
|
|
120
|
+
"items": {
|
|
121
|
+
"type": "string",
|
|
122
|
+
"enum": [
|
|
123
|
+
"darwin",
|
|
124
|
+
"linux",
|
|
125
|
+
"win32"
|
|
126
|
+
],
|
|
127
|
+
"description": "Host platform used to resolve credential and managed-login policy."
|
|
128
|
+
},
|
|
129
|
+
"minItems": 1,
|
|
130
|
+
"description": "Host platforms on which this physical credential transport applies; absent means every supported platform for backward compatibility."
|
|
117
131
|
}
|
|
118
132
|
},
|
|
119
133
|
"required": [
|
|
@@ -125,6 +139,90 @@
|
|
|
125
139
|
},
|
|
126
140
|
"default": [],
|
|
127
141
|
"description": "Declared credential transports per auth source."
|
|
142
|
+
},
|
|
143
|
+
"credential_profile_policies": {
|
|
144
|
+
"type": "array",
|
|
145
|
+
"items": {
|
|
146
|
+
"type": "object",
|
|
147
|
+
"properties": {
|
|
148
|
+
"source": {
|
|
149
|
+
"$ref": "#/definitions/HarnessManifest/properties/capability_profile/properties/auth/properties/supported_sources/items"
|
|
150
|
+
},
|
|
151
|
+
"platforms": {
|
|
152
|
+
"type": "array",
|
|
153
|
+
"items": {
|
|
154
|
+
"$ref": "#/definitions/HarnessManifest/properties/capability_profile/properties/auth/properties/credential_transports/items/properties/platforms/items"
|
|
155
|
+
},
|
|
156
|
+
"minItems": 1,
|
|
157
|
+
"description": "Nonempty host-platform set governed by this policy row."
|
|
158
|
+
},
|
|
159
|
+
"identity_scope": {
|
|
160
|
+
"type": "string",
|
|
161
|
+
"enum": [
|
|
162
|
+
"profile",
|
|
163
|
+
"os_user"
|
|
164
|
+
],
|
|
165
|
+
"description": "Identity boundary selected by a credential profile: the named profile itself or the host OS user/login vault."
|
|
166
|
+
},
|
|
167
|
+
"max_enabled_profiles": {
|
|
168
|
+
"anyOf": [
|
|
169
|
+
{
|
|
170
|
+
"type": "integer",
|
|
171
|
+
"exclusiveMinimum": 0
|
|
172
|
+
},
|
|
173
|
+
{
|
|
174
|
+
"type": "null"
|
|
175
|
+
}
|
|
176
|
+
],
|
|
177
|
+
"description": "Maximum enabled profile bindings on these platforms; null means unbounded."
|
|
178
|
+
},
|
|
179
|
+
"cleanup_owner": {
|
|
180
|
+
"type": "string",
|
|
181
|
+
"enum": [
|
|
182
|
+
"claudexor",
|
|
183
|
+
"vendor"
|
|
184
|
+
],
|
|
185
|
+
"description": "Who owns cleanup of the credential when its Claudexor profile binding is removed."
|
|
186
|
+
}
|
|
187
|
+
},
|
|
188
|
+
"required": [
|
|
189
|
+
"source",
|
|
190
|
+
"platforms",
|
|
191
|
+
"identity_scope",
|
|
192
|
+
"max_enabled_profiles",
|
|
193
|
+
"cleanup_owner"
|
|
194
|
+
],
|
|
195
|
+
"additionalProperties": false,
|
|
196
|
+
"description": "Platform-specific identity scope, enabled-profile cardinality, and credential cleanup ownership for one auth source."
|
|
197
|
+
},
|
|
198
|
+
"description": "Platform-specific profile identity/cardinality/cleanup policy; absent uses the backward-compatible profile-scoped, unbounded, Claudexor-owned defaults."
|
|
199
|
+
},
|
|
200
|
+
"managed_login": {
|
|
201
|
+
"anyOf": [
|
|
202
|
+
{
|
|
203
|
+
"type": "object",
|
|
204
|
+
"properties": {
|
|
205
|
+
"stdin": {
|
|
206
|
+
"type": "string",
|
|
207
|
+
"enum": [
|
|
208
|
+
"none",
|
|
209
|
+
"pipe",
|
|
210
|
+
"terminal"
|
|
211
|
+
],
|
|
212
|
+
"description": "Input transport the vendor login command requires."
|
|
213
|
+
}
|
|
214
|
+
},
|
|
215
|
+
"required": [
|
|
216
|
+
"stdin"
|
|
217
|
+
],
|
|
218
|
+
"additionalProperties": false,
|
|
219
|
+
"description": "Managed-login input requirement; command, argv, flow, and time window remain owned by the native-login registry."
|
|
220
|
+
},
|
|
221
|
+
{
|
|
222
|
+
"type": "null"
|
|
223
|
+
}
|
|
224
|
+
],
|
|
225
|
+
"description": "Managed subscription-login input requirement; null means this harness defines no managed login, absent is a legacy manifest."
|
|
128
226
|
}
|
|
129
227
|
},
|
|
130
228
|
"additionalProperties": false,
|