@dam-agents/cli 0.2.14-rc1 → 0.2.15-rc1

package/dist/bin.js

@@ -26787,6 +26787,8 @@ var scanFailureCodes = [
   "needs_sandbox",
   "repo_unreachable",
   "agent_unreachable",
+  "source_path_not_found",
+  "source_path_empty",
   "other"
 ];
 var scanFailureSchema = external_exports.object({
@@ -26991,6 +26993,7 @@ var templateSpecSchema = external_exports.object({
   category: templateCategorySchema,
   tags: external_exports.array(external_exports.string()).optional(),
   docsUrl: external_exports.string().optional(),
+  releaseNotesUrl: external_exports.string().optional(),
   setupNote: external_exports.object({ title: external_exports.string(), body: external_exports.string() }).optional(),
   experimental: external_exports.boolean().optional(),
   mounts: external_exports.array(mountSchema).optional(),
@@ -27042,7 +27045,8 @@ var spawnInvocationResponseSchema = external_exports.object({
 });
 var invocationViewSchema = external_exports.object({
   status: external_exports.enum(["running", "done", "failed"]),
-  result: external_exports.unknown()
+  result: external_exports.unknown(),
+  errorReason: external_exports.string().optional()
 });
 
 // ../agent-runtime-api/src/modules/files/schemas.ts
@@ -27126,6 +27130,10 @@ var skillWriteLocalInputSchema = external_exports.object({
   ).min(1).max(50)
 });
 
+// ../agent-runtime-api/src/modules/workspace/paths.ts
+var AGENT_HOME_DIR = "/home/agent";
+var AGENT_WORK_DIR = `${AGENT_HOME_DIR}/work`;
+
 // ../agent-runtime-api/src/modules/ssh/schemas.ts
 var sshAuthorizeKeyInputSchema = external_exports.object({
   publicKey: external_exports.string().min(1).max(8192).refine((s) => !/[\r\n]/.test(s), "must be a single line")
@@ -27433,6 +27441,9 @@ var egressRuleUpdateInputSchema = external_exports.object({
   pathPattern: external_exports.string().min(1).optional(),
   verdict: ruleVerdictSchema.optional()
 });
+var egressRuleGetInputSchema = external_exports.object({
+  id: external_exports.string().min(1)
+});
 var egressRuleRevokeInputSchema = external_exports.object({
   id: external_exports.string().min(1)
 });
@@ -27529,6 +27540,7 @@ var quietWindowSchema = external_exports.object({
 }).refine((w3) => w3.startTime !== w3.endTime, {
   message: "startTime and endTime must differ"
 });
+var scheduleListForOwnerInputSchema = external_exports.object({ limit: external_exports.number().int().positive().max(200).optional() }).optional();
 var scheduleListInputSchema = external_exports.object({
   agentId: external_exports.string().min(1)
 });
@@ -27616,13 +27628,15 @@ var skeletonSchema = external_exports.object({
   stages: external_exports.array(
     external_exports.object({
       id: stageIdSchema,
-      after: external_exports.array(stageIdSchema).max(20).default([])
+      after: external_exports.array(stageIdSchema).max(20).default([]),
+      description: external_exports.string().trim().min(1).max(300).optional()
     })
   ).max(50).default([]),
   loops: external_exports.array(
     external_exports.object({
       id: stageIdSchema,
-      stages: external_exports.array(stageIdSchema).min(1).max(50)
+      stages: external_exports.array(stageIdSchema).min(1).max(50),
+      description: external_exports.string().trim().min(1).max(300).optional()
     })
   ).max(10).default([])
 });
@@ -27735,7 +27749,8 @@ var artifactKindSchema = external_exports.enum([
   "binary"
 ]);
 var artifactVisibilitySchema = external_exports.enum(["private", "public"]);
-var titleSchema = external_exports.string().trim().min(1, "title is required").max(300);
+var ARTIFACT_TITLE_MAX_LENGTH = 300;
+var titleSchema = external_exports.string().trim().min(1, "title is required").max(ARTIFACT_TITLE_MAX_LENGTH);
 var fileNameSchema = external_exports.string().trim().min(1).max(255);
 var expiresInHoursSchema = external_exports.number().int().positive().max(24 * 365 * 10);
 var artifactIdInputSchema = external_exports.object({ id: external_exports.string().min(1) });
@@ -31379,7 +31394,7 @@ function describeApprovalPayload(payload) {
 // ../api-server-api/src/modules/egress-rules/format.ts
 function formatEgressRuleSource(source) {
   if (source === "manual") return "manual";
-  if (source === "inbox") return "from inbox";
+  if (source === "inbox") return "from an approval";
   if (source === "preset:trusted") return "preset: trusted";
   if (source === "preset:all") return "preset: all";
   if (source.startsWith("connection:")) {
@@ -31405,6 +31420,32 @@ function stripTrailingSlashes(s) {
   return s.slice(0, end);
 }
 
+// ../api-server-api/src/modules/egress-rules/promotion.ts
+function needsL7Promotion(method, pathPattern, port) {
+  return method !== "*" || pathPattern !== "*" || port != null;
+}
+function promotedHosts(rules) {
+  const hosts = rules.filter((r) => r.host !== "*").filter((r) => !r.source.startsWith("connection:")).filter((r) => needsL7Promotion(r.method, r.pathPattern, r.port)).map((r) => r.host);
+  return [...new Set(hosts)].sort();
+}
+function gatewayRestartImpact(input) {
+  const removed = new Set(input.removeIds ?? []);
+  const before = promotedHosts(input.current);
+  const after = promotedHosts([
+    ...input.current.filter((r) => !removed.has(r.id)),
+    ...input.adds ?? []
+  ]);
+  const beforeSet = new Set(before);
+  const afterSet = new Set(after);
+  const promoted = after.filter((h2) => !beforeSet.has(h2));
+  const demoted = before.filter((h2) => !afterSet.has(h2));
+  return {
+    promoted,
+    demoted,
+    willRestart: promoted.length > 0 || demoted.length > 0
+  };
+}
+
 // ../api-server-api/src/modules/acp/types.ts
 var platformTurnEndedParamsSchema = external_exports.object({
   sessionId: external_exports.string().min(1)
@@ -31414,6 +31455,9 @@ var platformTurnEndedNotificationSchema = external_exports.object({
   method: external_exports.literal("platform/turnEnded"),
   params: platformTurnEndedParamsSchema
 });
+var platformClippedReplayMetaSchema = external_exports.object({
+  older: external_exports.string().min(1).optional()
+});
 var platformPromptAcceptedParamsSchema = external_exports.object({
   sessionId: external_exports.string().min(1),
   promptId: external_exports.string().min(1),
@@ -31439,6 +31483,7 @@ var brandSchema = external_exports.object({
   name: external_exports.string(),
   short: external_exports.string(),
   title: external_exports.string(),
+  vendor: external_exports.string(),
   theme: external_exports.object({
     light: external_exports.object({
       accent: external_exports.string(),
@@ -31453,6 +31498,16 @@ var brandSchema = external_exports.object({
   })
 });
 
+// ../api-server-api/src/modules/agents/public-agent.ts
+var publicAgentViewSchema = external_exports.object({
+  agentId: external_exports.string(),
+  name: external_exports.string(),
+  ownerName: external_exports.string().nullable()
+});
+var publicAgentResponseSchema = external_exports.object({
+  agent: publicAgentViewSchema.nullable()
+});
+
 // ../api-server-api/src/modules/terms/schemas.ts
 var termsCurrentSchema = external_exports.object({
   version: external_exports.string().min(1),
@@ -31477,6 +31532,16 @@ var termsLatestAcceptanceSchema = external_exports.object({
   acceptedAt: external_exports.date()
 }).nullable();
 
+// ../api-server-api/src/modules/usage/schemas.ts
+var entryPointChoiceSchema = external_exports.enum([
+  "sandbox",
+  "experiment",
+  "knowledge-base"
+]);
+var entryPointChosenInputSchema = external_exports.object({
+  choice: entryPointChoiceSchema
+});
+
 // ../api-server-api/src/modules/auth/types.ts
 var authConfigSchema = external_exports.object({
   issuer: external_exports.string().url(),
@@ -37639,7 +37704,7 @@ function buildSlackConnectCommand(deps) {
       if (!res.ok) {
         if (res.error.kind === "channel-conflict") {
           process.stderr.write(
-            "error: Slack channel already bound to another agent\n"
+            "error: this agent is already connected to that Slack channel\n"
           );
           process.exit(EXIT_INVALID_INPUT);
         }
@@ -37672,7 +37737,7 @@ function buildSlackConnectCommand(deps) {
         );
         if (opts.ambient) {
           process.stderr.write(
-            "note: the agent reads along in this channel and may chime in without being mentioned; the channel gets a visible notice\n"
+            "note: the agent reads along in this channel and may chime in without being mentioned; ambient is per agent, so others connected here are unaffected\n"
           );
         }
         process.stderr.write(
@@ -40345,7 +40410,7 @@ function createProcessEnvReader() {
 
 // src/modules/cli/infrastructure/package-version.ts
 function readPackageVersion() {
-  return true ? "0.2.14-rc1" : DEV_VERSION;
+  return true ? "0.2.15-rc1" : DEV_VERSION;
 }
 
 // src/modules/cli/infrastructure/version-probe.ts
@@ -41838,6 +41903,17 @@ function buildApplyPresetCommand(deps) {
   );
 }
 
+// src/modules/egress/domain/restart-notice.ts
+function gatewayRestartNotice(impact) {
+  const clauses = [
+    impact.promoted.length > 0 && `start inspecting requests to ${impact.promoted.join(", ")}`,
+    impact.demoted.length > 0 && `stop inspecting requests to ${impact.demoted.join(", ")}`
+  ].filter((c2) => c2 !== false);
+  return `The network gateway will restart (~5\u201315s) to ${clauses.join(" and ")}.
+The sandbox keeps running \u2014 its outbound requests are briefly interrupted.
+`;
+}
+
 // src/modules/egress/commands/create.ts
 function buildCreateCommand2(deps) {
   return new Command("create").description("Add a network access rule to an Agent").argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").requiredOption("--host <h>", "host the rule applies to").option("--method <m>", "HTTP method; default '*'", "*").option("--path <p>", "path pattern; default '*'", "*").addOption(
@@ -41845,7 +41921,7 @@ function buildCreateCommand2(deps) {
   ).option(
     "--server <url>",
     "override the configured server URL for this call"
-  ).option("-y, --yes", "skip the path-level restart confirmation").option("--json", "emit the created rule as JSON").addHelpText(
+  ).option("-y, --yes", "skip the gateway restart confirmation").option("--json", "emit the created rule as JSON").addHelpText(
     "after",
     "\nExamples:\n  dam network create my-agent --host api.example.com\n  dam network create my-agent --host api.example.com --method GET --path /v1/* --yes\n"
   ).action(
@@ -41865,20 +41941,36 @@ function buildCreateCommand2(deps) {
         printResolveError(resolved.error, host);
         process.exit(exitCodeForResolveError(resolved.error));
       }
-      const requiresRestart = opts.method !== "*" || opts.path !== "*";
-      if (requiresRestart && !opts.yes) {
-        if (!process.stdin.isTTY) {
-          process.stderr.write(
-            "error: path-level rules require --yes on non-interactive stdin\n"
-          );
-          process.exit(EXIT_INVALID_INPUT);
+      const egress = deps.createEgressService(host);
+      if (!opts.yes) {
+        const existing = await egress.listForAgent(resolved.value.id);
+        if (!existing.ok) {
+          printServiceError(existing.error, host);
+          process.exit(EXIT_RUNTIME_FAILURE);
+        }
+        const impact = gatewayRestartImpact({
+          current: existing.value,
+          adds: [
+            {
+              host: opts.host,
+              method: opts.method,
+              pathPattern: opts.path,
+              source: "manual"
+            }
+          ]
+        });
+        if (impact.willRestart) {
+          if (!process.stdin.isTTY) {
+            process.stderr.write(
+              "error: this rule restarts the network gateway; pass --yes on non-interactive stdin\n"
+            );
+            process.exit(EXIT_INVALID_INPUT);
+          }
+          process.stderr.write(gatewayRestartNotice(impact));
+          if (!await confirm("Continue?")) exitCancelled(opts);
         }
-        process.stderr.write(
-          "This rule requires path-level enforcement (non-wildcard method/path) and will restart the agent (~5\u201315s).\n"
-        );
-        if (!await confirm("Continue?")) exitCancelled(opts);
       }
-      const result = await deps.createEgressService(host).create({
+      const result = await egress.create({
         agentId: resolved.value.id,
         host: opts.host,
         method: opts.method,
@@ -42017,31 +42109,72 @@ function buildRevokeCommand2(deps) {
   ).argument("<rule-id>", "Rule UUID (copy from `dam network list`)").option(
     "--server <url>",
     "override the configured server URL for this call"
-  ).option("--json", "emit { ok, id } as JSON").addHelpText(
+  ).option("-y, --yes", "skip the gateway restart confirmation").option("--json", "emit { ok, id } as JSON").addHelpText(
     "after",
     "\nExamples:\n  dam network revoke 3f2a8c0e-2b91-4d6a-9c1b-7e8a1f0a2b3c\n"
-  ).action(async (id, opts) => {
-    const host = await resolveActiveHost(deps, {
-      flag: opts.server ? { server: opts.server } : void 0,
-      exitCodes: {
-        runtimeFailure: EXIT_RUNTIME_FAILURE,
-        belowFloor: EXIT_BELOW_FLOOR
+  ).action(
+    async (id, opts) => {
+      const host = await resolveActiveHost(deps, {
+        flag: opts.server ? { server: opts.server } : void 0,
+        exitCodes: {
+          runtimeFailure: EXIT_RUNTIME_FAILURE,
+          belowFloor: EXIT_BELOW_FLOOR
+        }
+      });
+      const egress = deps.createEgressService(host);
+      const current = await egress.get(id);
+      if (!current.ok) {
+        const failure = current.error;
+        if (failure.kind === "rule-lookup-unsupported") {
+          if (!opts.yes) {
+            process.stderr.write(
+              "error: this server is too old to report whether revoking restarts the network gateway; re-run with --yes to revoke anyway\n"
+            );
+            process.exit(EXIT_INVALID_INPUT);
+          }
+        } else if (failure.kind !== "rule-not-found") {
+          printServiceError(failure, host);
+          process.exit(EXIT_RUNTIME_FAILURE);
+        }
       }
-    });
-    const result = await deps.createEgressService(host).revoke(id);
-    if (!result.ok) {
-      printServiceError(result.error, host);
-      process.exit(EXIT_RUNTIME_FAILURE);
-    }
-    if (opts.json) {
-      process.stdout.write(`${JSON.stringify({ ok: true, id })}
+      if (current.ok && !opts.yes) {
+        const siblings = await egress.listForAgent(current.value.agentId);
+        if (!siblings.ok) {
+          process.stderr.write(
+            "error: could not read the sandbox's rules to tell whether revoking restarts the network gateway; re-run with --yes to revoke anyway\n"
+          );
+          process.exit(EXIT_INVALID_INPUT);
+        }
+        const impact = gatewayRestartImpact({
+          current: siblings.value,
+          removeIds: [id]
+        });
+        if (impact.willRestart) {
+          if (!process.stdin.isTTY) {
+            process.stderr.write(
+              "error: this revoke restarts the network gateway; pass --yes on non-interactive stdin\n"
+            );
+            process.exit(EXIT_INVALID_INPUT);
+          }
+          process.stderr.write(gatewayRestartNotice(impact));
+          if (!await confirm("Continue?")) exitCancelled(opts);
+        }
+      }
+      const result = await egress.revoke(id);
+      if (!result.ok) {
+        printServiceError(result.error, host);
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ ok: true, id })}
 `);
-    } else {
-      process.stdout.write(`\u2713 Revoked rule ${id}.
+      } else {
+        process.stdout.write(`\u2713 Revoked rule ${id}.
 `);
+      }
+      process.exit(EXIT_SUCCESS);
     }
-    process.exit(EXIT_SUCCESS);
-  });
+  );
 }
 
 // src/modules/egress/commands/trusted-hosts.ts
@@ -42081,7 +42214,7 @@ function buildUpdateCommand2(deps) {
   ).option(
     "--server <url>",
     "override the configured server URL for this call"
-  ).option("-y, --yes", "skip the path-level restart confirmation").option("--json", "emit the updated rule as JSON").addHelpText(
+  ).option("-y, --yes", "skip the gateway restart confirmation").option("--json", "emit the updated rule as JSON").addHelpText(
     "after",
     "\nExamples:\n  dam network update 3f2a8c0e-... --verdict deny\n  dam network update 3f2a8c0e-... --method GET --path /v1/* --yes\n"
   ).action(
@@ -42099,20 +42232,60 @@ function buildUpdateCommand2(deps) {
           belowFloor: EXIT_BELOW_FLOOR
         }
       });
-      const requiresRestart = opts.method !== void 0 && opts.method !== "*" || opts.path !== void 0 && opts.path !== "*";
-      if (requiresRestart && !opts.yes) {
-        if (!process.stdin.isTTY) {
+      const egress = deps.createEgressService(host);
+      const current = await egress.get(id);
+      if (!current.ok) {
+        const failure = current.error;
+        if (failure.kind === "rule-not-found") {
           process.stderr.write(
-            "error: path-level rules require --yes on non-interactive stdin\n"
+            `error: network access rule not found: ${failure.id}
+`
           );
-          process.exit(EXIT_INVALID_INPUT);
+          process.exit(EXIT_RULE_NOT_FOUND);
+        } else if (failure.kind === "rule-lookup-unsupported") {
+          if (!opts.yes) {
+            process.stderr.write(
+              "error: this server is too old to report whether this change restarts the network gateway; re-run with --yes to apply it anyway\n"
+            );
+            process.exit(EXIT_INVALID_INPUT);
+          }
+        } else {
+          printServiceError(failure, host);
+          process.exit(EXIT_RUNTIME_FAILURE);
+        }
+      }
+      if (current.ok) {
+        const rule = current.value;
+        const siblings = await egress.listForAgent(rule.agentId);
+        if (!siblings.ok) {
+          printServiceError(siblings.error, host);
+          process.exit(EXIT_RUNTIME_FAILURE);
+        }
+        const impact = gatewayRestartImpact({
+          current: siblings.value,
+          removeIds: [id],
+          adds: [
+            {
+              host: rule.host,
+              ...rule.port ? { port: rule.port } : {},
+              method: opts.method ?? rule.method,
+              pathPattern: opts.path ?? rule.pathPattern,
+              source: "manual"
+            }
+          ]
+        });
+        if (impact.willRestart && !opts.yes) {
+          if (!process.stdin.isTTY) {
+            process.stderr.write(
+              "error: this change restarts the network gateway; pass --yes on non-interactive stdin\n"
+            );
+            process.exit(EXIT_INVALID_INPUT);
+          }
+          process.stderr.write(gatewayRestartNotice(impact));
+          if (!await confirm("Continue?")) exitCancelled(opts);
         }
-        process.stderr.write(
-          "This rule requires path-level enforcement (non-wildcard method/path) and will restart the agent (~5\u201315s).\n"
-        );
-        if (!await confirm("Continue?")) exitCancelled(opts);
       }
-      const result = await deps.createEgressService(host).update({
+      const result = await egress.update({
         id,
         method: opts.method,
         pathPattern: opts.path,
@@ -42151,6 +42324,18 @@ function createEgressService(deps) {
         () => deps.trpc.egressRules.listForAgent.query({ agentId })
       );
     },
+    async get(id) {
+      try {
+        const view = await deps.trpc.egressRules.get.query({ id });
+        return ok2(view);
+      } catch (e2) {
+        if (e2?.data?.code === "NOT_FOUND") {
+          const reason = e2 instanceof Error ? e2.message : String(e2);
+          return /egress rule not found/i.test(reason) ? err2({ kind: "rule-not-found", id }) : err2({ kind: "rule-lookup-unsupported", reason });
+        }
+        return classifyTrpcError(e2);
+      }
+    },
     async currentPreset(agentId) {
       return trpcCall(
         () => deps.trpc.egressRules.currentPreset.query({ agentId })

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dam-agents/cli",
   "author": "IBM Corp.",
-  "version": "0.2.14-rc1",
+  "version": "0.2.15-rc1",
   "type": "module",
   "license": "Apache-2.0",
   "homepage": "https://github.com/dam-agents/dam/tree/main/packages/cli#readme",
@@ -43,8 +43,8 @@
     "vitest": "^4.1.3",
     "ws": "^8.20.0",
     "zod": "^4.4.3",
-    "api-server-api": "0.0.1",
+    "agent-runtime-api": "0.0.1",
     "dev-config": "0.0.1",
-    "agent-runtime-api": "0.0.1"
+    "api-server-api": "0.0.1"
   }
 }