@executor-js/sdk 1.5.17 → 1.5.18

package/dist/{chunk-5Q35SELN.js → chunk-UWBP7WLB.js}

@@ -3167,7 +3167,14 @@ var ConnectionCreateInput = Schema2.Struct({
 }).check(
   Schema2.makeFilter((payload) => {
     const originCount = (payload.from === void 0 ? 0 : 1) + (payload.inputs === void 0 ? 0 : 1);
-    if (originCount !== 1) return "Expected exactly one provider credential origin";
+    const isNoAuth = String(payload.template) === String(NO_AUTH_TEMPLATE);
+    if (isNoAuth) {
+      if (originCount > 0) {
+        return 'A no-auth connection (template "none") takes no provider credential origin';
+      }
+    } else if (originCount !== 1) {
+      return "Expected exactly one provider credential origin";
+    }
     if (payload.inputs !== void 0 && Object.keys(payload.inputs).length === 0) {
       return "Expected at least one provider credential input";
     }
@@ -3251,9 +3258,23 @@ var OAuthCreateClientInput = Schema2.Struct({
   tokenUrl: Schema2.String,
   grant: OAuthGrantSchema,
   clientId: Schema2.String,
-  clientSecret: Schema2.String,
   resource: Schema2.optional(Schema2.NullOr(Schema2.String))
 });
+var OAuthCreateClientHandoffInput = Schema2.Struct({
+  integration: Schema2.String,
+  owner: Schema2.optional(OwnerSchema),
+  slug: Schema2.optional(Schema2.String),
+  grant: Schema2.optional(OAuthGrantSchema),
+  clientId: Schema2.optional(Schema2.String),
+  authorizationUrl: Schema2.optional(Schema2.String),
+  tokenUrl: Schema2.optional(Schema2.String),
+  resource: Schema2.optional(Schema2.NullOr(Schema2.String)),
+  label: Schema2.optional(Schema2.String)
+});
+var OAuthCreateClientHandoffOutput = Schema2.Struct({
+  url: Schema2.String,
+  instructions: Schema2.String
+});
 var OAuthClientOutputRef = Schema2.Struct({
   client: Schema2.String
 });
@@ -3332,6 +3353,8 @@ var PolicyUpdateInputStd = schemaToStandard(PolicyUpdateInput);
 var PolicyRemoveInputStd = schemaToStandard(PolicyRemoveInput);
 var OAuthClientsListOutputStd = schemaToStandard(OAuthClientsListOutput);
 var OAuthCreateClientInputStd = schemaToStandard(OAuthCreateClientInput);
+var OAuthCreateClientHandoffInputStd = schemaToStandard(OAuthCreateClientHandoffInput);
+var OAuthCreateClientHandoffOutputStd = schemaToStandard(OAuthCreateClientHandoffOutput);
 var OAuthClientOutputRefStd = schemaToStandard(OAuthClientOutputRef);
 var OAuthRegisterDynamicInputStd = schemaToStandard(OAuthRegisterDynamicInput);
 var OAuthRemoveClientInputStd = schemaToStandard(OAuthRemoveClientInput);
@@ -3417,12 +3440,28 @@ var createConnectionInputFromTool = (input) => {
     )
   };
 };
-var connectionCreateHandoffUrl = (webBaseUrl, input) => {
+var connectionCreateHandoffUrl = (webBaseUrl, orgSlug, input) => {
   const search = new URLSearchParams({ addAccount: "1" });
   if (input.owner !== void 0) search.set("owner", input.owner);
   if (input.template !== void 0) search.set("template", input.template);
   if (input.label !== void 0) search.set("label", input.label);
-  const path = `/integrations/${encodeURIComponent(input.integration)}?${search.toString()}`;
+  const orgPrefix = orgSlug !== void 0 && orgSlug.length > 0 ? `/${orgSlug}` : "";
+  const path = `${orgPrefix}/integrations/${encodeURIComponent(input.integration)}?${search.toString()}`;
+  if (webBaseUrl === void 0 || webBaseUrl.length === 0) return path;
+  return new URL(path, webBaseUrl.endsWith("/") ? webBaseUrl : `${webBaseUrl}/`).toString();
+};
+var oauthClientCreateHandoffUrl = (webBaseUrl, orgSlug, input) => {
+  const search = new URLSearchParams({ addAccount: "1", oauthClient: "1" });
+  if (input.owner !== void 0) search.set("owner", input.owner);
+  if (input.slug !== void 0) search.set("clientSlug", input.slug);
+  if (input.grant !== void 0) search.set("grant", input.grant);
+  if (input.clientId !== void 0) search.set("clientId", input.clientId);
+  if (input.authorizationUrl !== void 0) search.set("authorizationUrl", input.authorizationUrl);
+  if (input.tokenUrl !== void 0) search.set("tokenUrl", input.tokenUrl);
+  if (input.resource != null && input.resource.length > 0) search.set("resource", input.resource);
+  if (input.label !== void 0) search.set("label", input.label);
+  const orgPrefix = orgSlug !== void 0 && orgSlug.length > 0 ? `/${orgSlug}` : "";
+  const path = `${orgPrefix}/integrations/${encodeURIComponent(input.integration)}?${search.toString()}`;
   if (webBaseUrl === void 0 || webBaseUrl.length === 0) return path;
   return new URL(path, webBaseUrl.endsWith("/") ? webBaseUrl : `${webBaseUrl}/`).toString();
 };
@@ -3485,9 +3524,16 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
         }),
         tool({
           name: "connections.create",
-          description: "Low-level create or replace for a saved connection from provider item references. For normal API keys/tokens, use `connections.createHandoff` so the user enters the credential in the web UI. OAuth credentials should use `oauth.start`.",
+          description: 'Low-level create or replace for a saved connection from provider item references. For a no-auth integration (public MCP server, public REST API), pass `template: "none"` with no `from`/`inputs` to wire it up directly. For normal API keys/tokens, use `connections.createHandoff` so the user enters the credential in the web UI. OAuth credentials should use `oauth.start`.',
           inputSchema: ConnectionCreateInputStd,
           outputSchema: ConnectionOutputStd,
+          // Creating a connection binds a credential reference and roots a new
+          // tool catalog: every tool that connection produces then becomes
+          // callable. Even the no-auth (`template: "none"`) path pulls tools
+          // from an arbitrary endpoint. Prompt-injected code could silently
+          // wire an attacker-chosen integration or credential, so this is
+          // approval-gated (the v1 `sources.configure` carried the same guard).
+          annotations: { requiresApproval: true },
           execute: (input, { ctx }) => Effect5.map(
             ctx.connections.create(createConnectionInputFromTool(input)),
             connectionToOutput
@@ -3499,7 +3545,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           inputSchema: ConnectionCreateHandoffInputStd,
           outputSchema: ConnectionCreateHandoffOutputStd,
           execute: (input) => {
-            const url = connectionCreateHandoffUrl(options.webBaseUrl, input);
+            const url = connectionCreateHandoffUrl(options.webBaseUrl, options.orgSlug, input);
             return Effect5.succeed({
               url,
               instructions: "Ask the user to open this URL and add the account in the Executor web UI. Do not ask them to paste the credential value into chat. After they finish, call connections.list for the integration to discover the created connection."
@@ -3511,6 +3557,10 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Remove a saved connection and its produced tools by owner, integration, and connection name.",
           inputSchema: ConnectionRefInputStd,
           outputSchema: RemovedOutputStd,
+          // Deleting a connection drops it and every tool it produced, which
+          // prompt-injected code could use to disrupt an integration or force a
+          // re-add flow. Approval-gated, matching v1 `sources.remove`.
+          annotations: { requiresApproval: true },
           execute: (input, { ctx }) => Effect5.map(ctx.connections.remove(connectionRefFromInput(input)), () => ({
             removed: true
           }))
@@ -3520,6 +3570,11 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Re-run an integration's tool production for a saved connection, replacing that connection's persisted tools.",
           inputSchema: ConnectionRefInputStd,
           outputSchema: ConnectionsRefreshOutputStd,
+          // Refresh replaces a connection's persisted tool set; for a mutable
+          // upstream (an MCP server whose catalog can change) this can swap in
+          // different tools without confirmation. Approval-gated, matching v1
+          // `sources.refresh`.
+          annotations: { requiresApproval: true },
           execute: (input, { ctx }) => Effect5.map(ctx.connections.refresh(connectionRefFromInput(input)), (tools) => ({
             tools: tools.map(toolToOutput)
           }))
@@ -3563,9 +3618,20 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
         }),
         tool({
           name: "oauth.clients.create",
-          description: "Register or replace an owner-scoped OAuth client from explicit client credentials. Use grant `client_credentials` for machine OAuth or `authorization_code` for browser consent flows.",
+          description: "Register or replace an owner-scoped OAuth client WITHOUT a client secret: a PUBLIC client (PKCE / authorization_code) or a discovery-prefill placeholder. To register a CONFIDENTIAL client that has a secret, call `oauth.clients.createHandoff` instead so the human enters the secret in the web UI; never pass a client secret through this tool.",
           inputSchema: OAuthCreateClientInputStd,
           outputSchema: OAuthClientOutputRefStd,
+          // This persists an OAuth client and REPLACES on slug collision. It
+          // takes NO client secret: a secret would have to travel through the
+          // agent's context window, so a confidential app is registered by the
+          // human via `oauth.clients.createHandoff`. An empty secret registers a
+          // PUBLIC client. The remaining risk is the write itself: prompt-injected
+          // code could register a client with an attacker-controlled
+          // authorizationUrl/tokenUrl, then drive `oauth.start` to mint a
+          // connection and route the user's tokens to the attacker. The
+          // highest-value gate here; matches v1 `sources.bindings.set`, which
+          // guarded credential writes.
+          annotations: { requiresApproval: true },
           execute: (input, { ctx }) => Effect5.map(
             ctx.oauth.createClient({
               owner: input.owner,
@@ -3574,17 +3640,40 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
               tokenUrl: input.tokenUrl,
               grant: input.grant,
               clientId: input.clientId,
-              clientSecret: input.clientSecret,
+              // No secret crosses the agent boundary; an empty secret registers
+              // a public client. Confidential clients go through
+              // `oauth.clients.createHandoff`.
+              clientSecret: "",
               resource: input.resource ?? null
             }),
             (client) => ({ client: String(client) })
           )
         }),
+        tool({
+          name: "oauth.clients.createHandoff",
+          description: "Return a browser URL that opens the Register-OAuth-app form for one integration, pre-filled with the non-secret fields (client id, endpoints, grant). Use this for any CONFIDENTIAL OAuth app: the user types the client secret directly in the web UI instead of sending it through the agent. After they register the app, call `oauth.clients.list` to discover its owner and slug, then `oauth.start`.",
+          inputSchema: OAuthCreateClientHandoffInputStd,
+          outputSchema: OAuthCreateClientHandoffOutputStd,
+          // Pure URL builder: no DB write, no token, no secret. This is the SAFE
+          // path (it routes the secret to the human in the browser), so it is
+          // deliberately NOT approval-gated, mirroring `connections.createHandoff`.
+          execute: (input) => {
+            const url = oauthClientCreateHandoffUrl(options.webBaseUrl, options.orgSlug, input);
+            return Effect5.succeed({
+              url,
+              instructions: "Ask the user to open this URL and register the OAuth app in the Executor web UI, entering the client secret there. Do not ask them to paste the client secret into chat. After they finish, call oauth.clients.list to find the registered client (owner + slug), then oauth.start."
+            });
+          }
+        }),
         tool({
           name: "oauth.clients.registerDynamic",
           description: "Register an OAuth client through RFC 7591 Dynamic Client Registration and save the minted client for later `oauth.start` calls.",
           inputSchema: OAuthRegisterDynamicInputStd,
           outputSchema: OAuthClientOutputRefStd,
+          // Same risk class as `oauth.clients.create`: registers a client at a
+          // caller-supplied endpoint and persists the minted credentials for
+          // later `oauth.start` abuse. Approval-gated. See `oauth.clients.create`.
+          annotations: { requiresApproval: true },
           execute: (input, { ctx }) => Effect5.map(
             ctx.oauth.registerDynamicClient({
               owner: input.owner,
@@ -3607,6 +3696,11 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Remove an owner-scoped OAuth client by owner and slug. Existing connections are not cascaded.",
           inputSchema: OAuthRemoveClientInputStd,
           outputSchema: RemovedOutputStd,
+          // Removing a client breaks token refresh for every connection that
+          // depends on it (a silent DoS) and can force re-auth through an
+          // attacker-supplied replacement. Approval-gated, matching v1
+          // `sources.bindings.remove`.
+          annotations: { requiresApproval: true },
           execute: (input, { ctx }) => Effect5.map(
             ctx.oauth.removeClient(input.owner, OAuthClientSlug.make(input.slug)),
             () => ({ removed: true })
@@ -3631,6 +3725,14 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Start OAuth through a registered client to mint a connection for an integration. `client_credentials` clients return `connected`; authorization-code clients return an authorization URL and state.",
           inputSchema: OAuthStartInputStd,
           outputSchema: OAuthStartOutputStd,
+          // This is the materialization step that turns a registered client
+          // into a live connection. For `client_credentials` it completes
+          // synchronously (status `connected`) with no browser step, so a
+          // prompt-injected call against an attacker-registered client mints a
+          // credentialed connection with no human in the loop. The
+          // authorization-code path already returns a URL the user must visit,
+          // but one gate on the whole tool covers the silent path cleanly.
+          annotations: { requiresApproval: true },
           execute: (input, { ctx }) => Effect5.map(
             ctx.oauth.start({
               client: OAuthClientSlug.make(input.client),
@@ -3678,6 +3780,11 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Create a tool policy. `pattern` matches a tool address tail (`integration.connection.tool`, `integration.*`, `*`); `action` is approve/require_approval/block. `owner` is org (workspace guardrail) or user (personal).",
           inputSchema: PolicyCreateInputStd,
           outputSchema: PolicyOutputStd,
+          // A policy decides which tools run without confirmation, so creating
+          // one can silence every other approval gate (e.g. `approve *`). It
+          // must itself require approval, otherwise prompt-injected code could
+          // disable approvals by writing its own bypass policy.
+          annotations: { requiresApproval: true },
           execute: (input, { ctx }) => Effect5.map(
             ctx.core.policies.create({
               owner: input.owner,
@@ -3698,6 +3805,10 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Update a tool policy's pattern and/or action by id + owner.",
           inputSchema: PolicyUpdateInputStd,
           outputSchema: PolicyOutputStd,
+          // Editing a policy can broaden a pattern or flip an action to
+          // `approve`, weakening an approval gate just as creation can, so it
+          // requires approval too. See `policies.create`.
+          annotations: { requiresApproval: true },
           execute: (input, { ctx }) => Effect5.map(
             ctx.core.policies.update({
               id: input.id,
@@ -3719,6 +3830,10 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Remove a tool policy by id + owner.",
           inputSchema: PolicyRemoveInputStd,
           outputSchema: RemovedOutputStd,
+          // Removing a policy can drop a `block` or `require_approval`
+          // guardrail, so deletion is also approval-gated. See
+          // `policies.create`.
+          annotations: { requiresApproval: true },
           execute: (input, { ctx }) => Effect5.map(
             ctx.core.policies.remove({
               id: input.id,
@@ -5178,6 +5293,7 @@ var createExecutor = (config) => Effect8.gen(function* () {
   const plugins = config.coreTools ? [
     coreToolsPlugin({
       webBaseUrl: config.coreTools.webBaseUrl,
+      orgSlug: config.coreTools.orgSlug,
       includeProviders: config.coreTools.includeProviders
     }),
     ...userPlugins
@@ -6739,4 +6855,4 @@ export {
   collectTables,
   createExecutor
 };
-//# sourceMappingURL=chunk-5Q35SELN.js.map
+//# sourceMappingURL=chunk-UWBP7WLB.js.map