@dam-agents/cli 0.2.11 → 0.2.12

package/dist/bin.js

@@ -26767,7 +26767,11 @@ var skillRefSchema = external_exports.object({
 var localSkillSchema = external_exports.object({
   name: external_exports.string(),
   description: external_exports.string(),
-  skillPath: external_exports.string()
+  skillPath: external_exports.string(),
+  /** Provenance vs. the image's pristine copy: shipped untouched, shipped
+   *  but diverged, or created at runtime. Absent on pre-provenance pods —
+   *  treat as `user`. */
+  origin: external_exports.enum(["system", "system-modified", "user"]).optional()
 });
 var skillPublishRecordSchema = external_exports.object({
   skillName: external_exports.string(),
@@ -26829,6 +26833,24 @@ var skillListLocalInputSchema = external_exports.object({
 var skillStateInputSchema = external_exports.object({
   agentId: external_exports.string().min(1)
 });
+var skillDeleteLocalInputSchema = external_exports.object({
+  agentId: external_exports.string().min(1),
+  name: external_exports.string().min(1)
+});
+var skillReadLocalInputSchema = external_exports.object({
+  agentId: external_exports.string().min(1),
+  name: external_exports.string().min(1)
+});
+var skillLocalFilesSchema = external_exports.object({
+  dir: external_exports.string(),
+  files: external_exports.array(
+    external_exports.object({
+      relPath: external_exports.string(),
+      content: external_exports.string(),
+      base64: external_exports.literal(true).optional()
+    })
+  )
+});
 var skillPublishInputSchema = external_exports.object({
   agentId: external_exports.string().min(1),
   sourceId: external_exports.string().min(1),
@@ -26897,6 +26919,10 @@ var templateSpecSchema = external_exports.object({
   // explicit choice at create time still wins over this.
   hibernationTimeout: external_exports.string().optional(),
   storageSize: external_exports.string().optional(),
+  backend: external_exports.object({
+    type: external_exports.enum(["container", "vm"]),
+    vm: external_exports.object({}).passthrough().optional()
+  }).optional(),
   runtimeClassName: external_exports.string().optional(),
   nodeSelector: external_exports.record(external_exports.string(), external_exports.string()).optional(),
   skillSources: external_exports.array(skillSourceSeedSchema).optional()
@@ -27010,7 +27036,10 @@ var skillPublishInputSchema2 = external_exports.object({
   // subdir source's own scan finds what was published back to it.
   path: external_exports.string().optional()
 });
-var skillReadLocalInputSchema = external_exports.object({
+var skillReadLocalInputSchema2 = external_exports.object({
+  name: external_exports.string().min(1)
+});
+var skillDeleteLocalInputSchema2 = external_exports.object({
   name: external_exports.string().min(1)
 });
 var skillWriteLocalInputSchema = external_exports.object({
@@ -27361,7 +27390,6 @@ var agentCreateInputSchema = external_exports.object({
     username: external_exports.string().min(1),
     password: external_exports.string().min(1)
   }).optional(),
-  allowedUserEmails: external_exports.array(external_exports.email()).optional(),
   egressPreset: egressPresetSchema.optional(),
   // Per-agent idle timeout override in minutes (0 = never hibernate); omit to inherit the global default.
   hibernationTimeoutMin: external_exports.number().int().min(0).optional(),
@@ -27404,7 +27432,6 @@ var agentUpdateInputSchema = external_exports.object({
   description: external_exports.string().optional(),
   env: external_exports.array(envVarSchema).max(64).optional(),
   secretRef: external_exports.string().optional(),
-  allowedUserEmails: external_exports.array(external_exports.email()).optional(),
   // Per-agent idle timeout override in minutes (0 = never hibernate); null clears it back to the global default.
   hibernationTimeoutMin: external_exports.number().int().min(0).nullable().optional(),
   // Resize (#1900). On a sleeping sandbox the new Size rides the next start
@@ -27415,14 +27442,8 @@ var agentUpdateInputSchema = external_exports.object({
 var agentConnectSlackInputSchema = external_exports.object({
   id: external_exports.string().min(1),
   slackChannelId: external_exports.string().min(1),
-  // Access mode; absent = person-scoped.
-  mode: external_exports.enum(["shared", "person-scoped"]).optional(),
-  // Ambient mode; absent = off. Unlike mode it is mutable: re-connecting
-  // with the same mode updates it in place.
+  // Ambient mode; absent = off. Mutable: re-connecting updates it in place.
   ambient: external_exports.boolean().optional()
-}).refine((v2) => !v2.ambient || v2.mode === "shared", {
-  message: "Ambient mode requires a shared binding",
-  path: ["ambient"]
 });
 var agentListTelegramChatsInputSchema = external_exports.object({
   agentId: external_exports.string().min(1)
@@ -27730,7 +27751,7 @@ var folderUpdateInputSchema = external_exports.object({
 var folderIdInputSchema = external_exports.object({ id: external_exports.string().min(1) });
 
 // ../api-server-api/src/modules/features/schemas.ts
-var featureIdSchema = external_exports.enum(["advanced-connections"]);
+var featureIdSchema = external_exports.enum(["advanced-connections", "vm-sandboxes"]);
 var featureSetFlagInputSchema = external_exports.object({
   feature: featureIdSchema,
   enabled: external_exports.boolean()
@@ -33883,10 +33904,6 @@ function renderAgent(agent) {
   ];
   if (agent.description) entries.push(["DESCRIPTION", agent.description]);
   entries.push(["CHANNELS", renderChannels(agent.channels)]);
-  entries.push([
-    "ALLOWED",
-    agent.allowedUserEmails.length === 0 ? "<none>" : agent.allowedUserEmails.join(", ")
-  ]);
   if (agent.state === "error" && agent.error)
     entries.push(["ERROR", agent.error]);
   const pad = Math.max(...entries.map(([k2]) => k2.length)) + 2;
@@ -34149,24 +34166,6 @@ function createAgentService(deps) {
       } catch (e2) {
         return notFoundOnMutate(e2, id);
       }
-    },
-    async updateAllowedUserEmails(id, emails) {
-      try {
-        return ok2(
-          await deps.trpc.agents.update.mutate({
-            id,
-            allowedUserEmails: [...emails]
-          })
-        );
-      } catch (e2) {
-        if (e2?.data?.code === "BAD_REQUEST") {
-          return err2({
-            kind: "invalid-input",
-            message: e2 instanceof Error ? e2.message : String(e2)
-          });
-        }
-        return notFoundOnMutate(e2, id);
-      }
     }
   };
 }
@@ -34330,20 +34329,6 @@ function buildDenyCommand(deps) {
   );
 }
 
-// src/modules/agent/domain/allowed-users.ts
-function mergeAllowedUserEmails(current, opts) {
-  const removeSet = new Set((opts.remove ?? []).map((e2) => e2.toLowerCase()));
-  const seen = /* @__PURE__ */ new Set();
-  const result = [];
-  for (const email3 of [...current, ...opts.add ?? []]) {
-    const key = email3.toLowerCase();
-    if (removeSet.has(key) || seen.has(key)) continue;
-    seen.add(key);
-    result.push(email3);
-  }
-  return result;
-}
-
 // src/modules/shared/relative-time.ts
 var MINUTE_MS = 6e4;
 var HOUR_MS = 36e5;
@@ -37420,94 +37405,6 @@ function composeAuthModule(opts) {
   };
 }
 
-// src/modules/channel/commands/allow.ts
-var collect = (v2, acc) => [...acc, v2];
-var emailSchema = external_exports.email();
-function buildAllowCommand(deps) {
-  return new Command("allow").description(
-    "Add one or more users to an Agent's allowed-user list (gates Slack drivers)"
-  ).argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
-    "--user <email>",
-    "user email to allow (repeatable)",
-    collect,
-    []
-  ).option(
-    "--server <url>",
-    "override the configured server URL for this call"
-  ).option("--json", "emit { ok, agentId, allowedUserEmails } as JSON").addHelpText(
-    "after",
-    "\nExamples:\n  dam channel allow my-agent --user teammate@example.com\n  dam channel allow my-agent --user a@x.com --user b@y.com\n"
-  ).action(
-    async (ref, opts) => {
-      const users = opts.user;
-      if (users.length === 0) {
-        process.stderr.write("error: pass at least one --user <email>\n");
-        process.exit(EXIT_INVALID_INPUT);
-      }
-      const invalid = users.filter((u) => !emailSchema.safeParse(u).success);
-      if (invalid.length > 0) {
-        process.stderr.write(
-          `error: invalid email(s): ${invalid.join(", ")}
-`
-        );
-        process.exit(EXIT_INVALID_INPUT);
-      }
-      const host = await resolveActiveHost(deps, {
-        flag: opts.server ? { server: opts.server } : void 0,
-        exitCodes: {
-          runtimeFailure: EXIT_RUNTIME_FAILURE,
-          belowFloor: EXIT_BELOW_FLOOR
-        }
-      });
-      const svc = deps.createAgentService(host);
-      const resolver = createAgentResolver({ agentService: svc });
-      const resolved = await resolver.resolve(ref);
-      if (!resolved.ok) {
-        printResolveError(resolved.error, host);
-        process.exit(exitCodeForResolveError(resolved.error));
-      }
-      const merged = mergeAllowedUserEmails(
-        resolved.value.allowedUserEmails,
-        {
-          add: users
-        }
-      );
-      const res = await svc.updateAllowedUserEmails(
-        resolved.value.id,
-        merged
-      );
-      if (!res.ok) {
-        if (res.error.kind === "invalid-input") {
-          process.stderr.write(`error: ${res.error.message}
-`);
-          process.exit(EXIT_INVALID_INPUT);
-        }
-        if (res.error.kind === "not-found") {
-          process.stderr.write(
-            `error: no agent with id \`${resolved.value.id}\`
-`
-          );
-          process.exit(EXIT_AGENT_NOT_RESOLVED);
-        }
-        printServiceError(res.error, host);
-        process.exit(EXIT_RUNTIME_FAILURE);
-      }
-      if (opts.json) {
-        process.stdout.write(
-          `${JSON.stringify({ ok: true, agentId: resolved.value.id, allowedUserEmails: res.value.allowedUserEmails })}
-`
-        );
-      } else {
-        process.stdout.write(
-          `\u2713 Allowed ${users.length} user(s) on ${resolved.value.name}. Agent now has ${res.value.allowedUserEmails.length} allowed user(s).
-`
-        );
-      }
-      process.exit(EXIT_SUCCESS);
-    }
-  );
-}
-
 // src/modules/channel/commands/available.ts
 var PROVIDER_ORDER = [
   "slack" /* Slack */,
@@ -37554,115 +37451,24 @@ function buildAvailableCommand(deps) {
   });
 }
 
-// src/modules/channel/commands/disallow.ts
-var collect2 = (v2, acc) => [...acc, v2];
-function buildDisallowCommand(deps) {
-  return new Command("disallow").description(
-    "Remove one or more users from an Agent's allowed-user list. Idempotent."
-  ).argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
-    "--user <email>",
-    "user email to remove (repeatable)",
-    collect2,
-    []
-  ).option(
-    "--server <url>",
-    "override the configured server URL for this call"
-  ).option("--json", "emit { ok, agentId, allowedUserEmails } as JSON").addHelpText(
-    "after",
-    "\nExamples:\n  dam channel disallow my-agent --user teammate@example.com\n"
-  ).action(
-    async (ref, opts) => {
-      const users = opts.user;
-      if (users.length === 0) {
-        process.stderr.write("error: pass at least one --user <email>\n");
-        process.exit(EXIT_INVALID_INPUT);
-      }
-      const host = await resolveActiveHost(deps, {
-        flag: opts.server ? { server: opts.server } : void 0,
-        exitCodes: {
-          runtimeFailure: EXIT_RUNTIME_FAILURE,
-          belowFloor: EXIT_BELOW_FLOOR
-        }
-      });
-      const svc = deps.createAgentService(host);
-      const resolver = createAgentResolver({ agentService: svc });
-      const resolved = await resolver.resolve(ref);
-      if (!resolved.ok) {
-        printResolveError(resolved.error, host);
-        process.exit(exitCodeForResolveError(resolved.error));
-      }
-      const merged = mergeAllowedUserEmails(
-        resolved.value.allowedUserEmails,
-        {
-          remove: users
-        }
-      );
-      const res = await svc.updateAllowedUserEmails(
-        resolved.value.id,
-        merged
-      );
-      if (!res.ok) {
-        if (res.error.kind === "invalid-input") {
-          process.stderr.write(`error: ${res.error.message}
-`);
-          process.exit(EXIT_INVALID_INPUT);
-        }
-        if (res.error.kind === "not-found") {
-          process.stderr.write(
-            `error: no agent with id \`${resolved.value.id}\`
-`
-          );
-          process.exit(EXIT_AGENT_NOT_RESOLVED);
-        }
-        printServiceError(res.error, host);
-        process.exit(EXIT_RUNTIME_FAILURE);
-      }
-      if (opts.json) {
-        process.stdout.write(
-          `${JSON.stringify({ ok: true, agentId: resolved.value.id, allowedUserEmails: res.value.allowedUserEmails })}
-`
-        );
-      } else {
-        process.stdout.write(
-          `\u2713 Disallowed ${users.length} user(s) from ${resolved.value.name}. Agent now has ${res.value.allowedUserEmails.length} allowed user(s).
-`
-        );
-      }
-      process.exit(EXIT_SUCCESS);
-    }
-  );
-}
-
 // src/modules/channel/commands/list.ts
-function renderHuman(channels, allowedUserEmails) {
-  const channelsBlock = channels.length === 0 ? "No channels connected.\n" : renderTable([
-    ["TYPE", "IDENTIFIER", "MODE"],
+function renderHuman(channels) {
+  return channels.length === 0 ? "No channels connected.\n" : renderTable([
+    ["TYPE", "IDENTIFIER", "AMBIENT"],
     ...channels.map(
       (c2) => (
         // Telegram has no readable identifier — the bot token is write-only.
-        // Telegram is structurally shared-only.
-        c2.type === "slack" /* Slack */ ? [
-          "slack",
-          c2.slackChannelId,
-          c2.ambient ? "shared (ambient)" : c2.mode ?? "person-scoped"
-        ] : ["telegram", "\u2014", "shared"]
+        // Ambient is Slack-only.
+        c2.type === "slack" /* Slack */ ? ["slack", c2.slackChannelId, c2.ambient ? "on" : "off"] : ["telegram", "\u2014", "\u2014"]
       )
     )
   ]);
-  const allowed = allowedUserEmails.length === 0 ? "  (unrestricted)\n" : `${allowedUserEmails.map((e2) => `  ${e2}`).join("\n")}
-`;
-  return `${channelsBlock}
-Allowed users:
-${allowed}`;
 }
 function buildListCommand3(deps) {
-  return new Command("list").description("List an Agent's connected channels and its Slack allow-list").argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
+  return new Command("list").description("List an Agent's connected channels").argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
     "--server <url>",
     "override the configured server URL for this call"
-  ).option(
-    "--json",
-    "emit { channels, allowedUserEmails } as JSON instead of the default tables"
-  ).addHelpText(
+  ).option("--json", "emit { channels } as JSON instead of the default table").addHelpText(
     "after",
     "\nExamples:\n  dam channel list my-agent\n  dam channel list my-agent --json\n"
   ).action(async (ref, opts) => {
@@ -37681,18 +37487,15 @@ function buildListCommand3(deps) {
       printResolveError(resolved.error, host);
       process.exit(exitCodeForResolveError(resolved.error));
     }
-    const { channels, allowedUserEmails } = resolved.value;
+    const { channels } = resolved.value;
     if (opts.json) {
       return writeStdoutAndExit(
-        `${JSON.stringify({ channels, allowedUserEmails })}
+        `${JSON.stringify({ channels })}
 `,
         EXIT_SUCCESS
       );
     }
-    return writeStdoutAndExit(
-      renderHuman(channels, allowedUserEmails),
-      EXIT_SUCCESS
-    );
+    return writeStdoutAndExit(renderHuman(channels), EXIT_SUCCESS);
   });
 }
 
@@ -37717,17 +37520,14 @@ async function ensureProviderAvailable(svc, provider, host) {
 // src/modules/channel/commands/slack-connect.ts
 function buildSlackConnectCommand(deps) {
   return new Command("connect").description("Bind a Slack channel to an Agent").argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").requiredOption("--channel-id <id>", "Slack channel id (e.g. C0123ABCD)").option(
-    "--mode <mode>",
-    "access mode: 'person-scoped' (default) or 'shared'"
-  ).option(
     "--ambient",
-    "ambient mode (shared only): the agent reads along and may chime in without being mentioned"
+    "ambient mode: the agent reads along and may chime in without being mentioned"
   ).option(
     "--server <url>",
     "override the configured server URL for this call"
   ).option("--json", "emit the updated ChannelConfig[] as JSON").addHelpText(
     "after",
-    "\nExamples:\n  dam channel slack connect my-agent --channel-id C0123ABCD\n  dam channel slack connect my-agent --channel-id C0123ABCD --mode shared\n  dam channel slack connect my-agent --channel-id C0123ABCD --mode shared --ambient\n"
+    "\nExamples:\n  dam channel slack connect my-agent --channel-id C0123ABCD\n  dam channel slack connect my-agent --channel-id C0123ABCD --ambient\n"
   ).action(
     async (ref, opts) => {
       const channelId = opts.channelId.trim();
@@ -37735,17 +37535,6 @@ function buildSlackConnectCommand(deps) {
         process.stderr.write("error: --channel-id must not be empty\n");
         process.exit(EXIT_INVALID_INPUT);
       }
-      if (opts.mode !== void 0 && opts.mode !== "shared" && opts.mode !== "person-scoped") {
-        process.stderr.write(
-          "error: --mode must be 'shared' or 'person-scoped'\n"
-        );
-        process.exit(EXIT_INVALID_INPUT);
-      }
-      const mode = opts.mode;
-      if (opts.ambient && mode !== "shared") {
-        process.stderr.write("error: --ambient requires --mode shared\n");
-        process.exit(EXIT_INVALID_INPUT);
-      }
       const host = await resolveActiveHost(deps, {
         flag: opts.server ? { server: opts.server } : void 0,
         exitCodes: {
@@ -37766,7 +37555,6 @@ function buildSlackConnectCommand(deps) {
       const res = await svc.connectSlack(
         resolved.value.id,
         channelId,
-        mode,
         opts.ambient
       );
       if (!res.ok) {
@@ -37784,28 +37572,11 @@ function buildSlackConnectCommand(deps) {
         printServiceError(res.error, host);
         process.exit(EXIT_RUNTIME_FAILURE);
       }
-      if (mode === "shared") {
-        const slackCh = res.value.find((c2) => c2.type === "slack" /* Slack */);
-        if (!slackCh || slackCh.mode !== "shared") {
-          const rolledBack = await svc.disconnectSlack(resolved.value.id);
-          if (rolledBack.ok) {
-            process.stderr.write(
-              "error: this server does not support shared access mode \u2014 binding rolled back\n"
-            );
-          } else {
-            process.stderr.write(
-              "error: this server does not support shared access mode, and rolling the binding back failed \u2014 the channel is still bound in person-scoped mode; disconnect it manually\n"
-            );
-            printServiceError(rolledBack.error, host);
-          }
-          process.exit(EXIT_RUNTIME_FAILURE);
-        }
-      }
       if (opts.ambient) {
         const slackCh = res.value.find((c2) => c2.type === "slack" /* Slack */);
-        if (slackCh?.type === "slack" /* Slack */ && !slackCh.ambient) {
+        if (!slackCh?.ambient) {
           process.stderr.write(
-            "error: this server does not support ambient mode \u2014 the channel is connected in shared mode without it\n"
+            "error: this server does not support ambient mode \u2014 the channel is connected without it\n"
           );
           process.exit(EXIT_RUNTIME_FAILURE);
         }
@@ -37815,7 +37586,7 @@ function buildSlackConnectCommand(deps) {
 `);
       } else {
         process.stdout.write(
-          `\u2713 Slack channel ${channelId} connected to ${resolved.value.name}${mode === "shared" ? opts.ambient ? " in shared mode with ambient on" : " in shared mode" : ""}.
+          `\u2713 Slack channel ${channelId} connected to ${resolved.value.name}${opts.ambient ? " with ambient on" : ""}.
 `
         );
         if (opts.ambient) {
@@ -37823,15 +37594,9 @@ function buildSlackConnectCommand(deps) {
             "note: the agent reads along in this channel and may chime in without being mentioned; the channel gets a visible notice\n"
           );
         }
-        if (mode === "shared") {
-          process.stderr.write(
-            "note: everyone in the channel drives this agent under its credentials; your Terms-of-Use acceptance covers every turn\n"
-          );
-        } else {
-          process.stderr.write(
-            "hint: users must run `/platform login` inside Slack before they can drive this agent\n"
-          );
-        }
+        process.stderr.write(
+          "note: everyone in the channel drives this agent under its credentials; your Terms-of-Use acceptance covers every turn\n"
+        );
       }
       process.exit(EXIT_SUCCESS);
     }
@@ -37889,12 +37654,11 @@ function createChannelService(deps) {
     async available() {
       return trpcCall(() => deps.trpc.channels.available.query());
     },
-    async connectSlack(id, slackChannelId, mode, ambient) {
+    async connectSlack(id, slackChannelId, ambient) {
       try {
         const agent = await deps.trpc.agents.connectSlack.mutate({
           id,
           slackChannelId,
-          ...mode ? { mode } : {},
           ...ambient ? { ambient: true } : {}
         });
         return ok2(agent.channels);
@@ -37952,13 +37716,6 @@ function composeChannelModule(opts) {
   slack.addCommand(buildSlackConnectCommand(agentScoped));
   slack.addCommand(buildSlackDisconnectCommand(agentScoped));
   parent.addCommand(slack);
-  const allowScoped = {
-    compatService: opts.compatService,
-    configService: opts.configService,
-    createAgentService: opts.createAgentService
-  };
-  parent.addCommand(buildAllowCommand(allowScoped));
-  parent.addCommand(buildDisallowCommand(allowScoped));
   return { commands: [parent], exports: { createService } };
 }
 
@@ -40488,7 +40245,7 @@ function createProcessEnvReader() {
 
 // src/modules/cli/infrastructure/package-version.ts
 function readPackageVersion() {
-  return true ? "0.2.11" : DEV_VERSION;
+  return true ? "0.2.12" : DEV_VERSION;
 }
 
 // src/modules/cli/infrastructure/version-probe.ts
@@ -41247,12 +41004,12 @@ function buildDisconnectCommand(deps) {
 }
 
 // src/modules/connection/commands/grant.ts
-var collect3 = (v2, acc) => [...acc, v2];
+var collect = (v2, acc) => [...acc, v2];
 function buildGrantCommand(deps) {
   return new Command("grant").description("Grant one or more connections to an Agent").argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
     "--connection <id-or-name>",
     "connection id or unique name to grant (repeatable)",
-    collect3,
+    collect,
     []
   ).option(
     "--server <url>",
@@ -41448,14 +41205,14 @@ function buildListCommand4(deps) {
 }
 
 // src/modules/connection/commands/revoke.ts
-var collect4 = (v2, acc) => [...acc, v2];
+var collect2 = (v2, acc) => [...acc, v2];
 function buildRevokeCommand(deps) {
   return new Command("revoke").description(
     "Revoke one or more connections from an Agent. Idempotent \u2014 revoking an ungranted id exits 0."
   ).argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
     "--connection <id-or-name>",
     "connection id or unique name to revoke (repeatable)",
-    collect4,
+    collect2,
     []
   ).option(
     "--server <url>",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dam-agents/cli",
   "author": "IBM Corp.",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "type": "module",
   "license": "Apache-2.0",
   "homepage": "https://github.com/dam-agents/dam/tree/main/packages/cli#readme",