@isomorph.ai/app-sdk 1.45.0 → 1.46.0

package/README.md

@@ -410,8 +410,8 @@ Options the app passes, never the model:
 - `session`: the name of a runtime secret a sign-in was saved under (`finishSignIn`'s `saveAs`, below). The task starts signed in and can use only that sign-in's websites. When the task is `done` the refreshed session is saved back to the same secret. A missing one fails with `No saved sign-in named <name>.` Run one task per saved sign-in at a time: two tasks would both save back, and some websites sign out the older copy.
 - `secrets`: `{ name: value }`, at most 10, names `^[A-Za-z][A-Za-z0-9_-]{0,63}$`, values up to 4096 bytes. The computer types a value into a password field by its name, and only there: it refuses to type a secret into a visible field, since the model reads the page after every step. The model sees only the names. Never put a password or any other credential in the task text; pass it here and say "sign in with the `password` secret". A user ID, customer ID or email is not a secret: give it in the task text.
 - `maxQueueMs`: how long the task may wait for a free computer before the tool cancels it (20 minutes unless set).
-- `allowedHosts`: the websites (1 to 10 lower-case hostnames) a task with `secrets` and no `session` may use. A saved sign-in carries its own.
-- The sign-in options are one of three shapes, and the compiler refuses the others, so `isomorph check` (which runs tsc) catches them before a run: `session` (with or without `secrets`), `secrets` with `allowedHosts`, or neither. `allowedHosts` alone is refused: a task without secrets may use any website, and a task without a session or hosts has nowhere to type secrets. A wrong option at run time throws a `VALIDATION_FAILED` error, which the job runner fails at once rather than retrying.
+- `allowedHosts`: the websites (1 to 10 lower-case hostnames) the browser may use; without it a task with no sign-in may use any website. A task with `secrets` and no `session` needs it: the websites the secrets may be typed into. A saved sign-in carries its own.
+- The sign-in options are one of three shapes, and the compiler refuses the others, so `isomorph check` (which runs tsc) catches them before a run: `session` (with or without `secrets`), `secrets` with `allowedHosts`, or no sign-in (with or without `allowedHosts`). `secrets` without a session or hosts has nowhere to be typed, and `session` with `allowedHosts` names websites twice. A wrong option at run time throws a `VALIDATION_FAILED` error, which the job runner fails at once rather than retrying.
 - `onDownload({ name, contentType, size, blob })`: called once for each file a `done` task downloaded, one at a time, before the tool returns (at most 10 files, 100 MiB each). Store the `blob` yourself; the CUA keeps the files for a day at most. Without it nothing is fetched. A link that does not answer 200 fails the tool. The model only sees `downloads: [{ name, size }]`.
 
 A task with `session` or `secrets` works the page through clicks and typing only. `connectionId` is gone: pass `session`.

package/dist/computer-use.d.ts

@@ -42,8 +42,9 @@ interface ComputerUseCommonOptions {
 export type ComputerUseSecrets = Readonly<Record<string, string>>;
 /**
  * How the task signs in, one of three shapes so the compiler refuses the others (`isomorph check` runs it):
- * a saved `session`, `secrets` with the `allowedHosts` they may be typed into, or neither.
- * `allowedHosts` alone and `secrets` alone are refused; a session carries its own websites.
+ * a saved `session`; `secrets` with the `allowedHosts` they may be typed into; or no sign-in, with or
+ * without `allowedHosts`. A session carries its own websites, so `session` with `allowedHosts` is refused,
+ * and `secrets` without `session` or `allowedHosts` has nowhere to be typed.
  */
 export type ComputerUseSignIn = {
     /**
@@ -55,13 +56,14 @@ export type ComputerUseSignIn = {
     allowedHosts?: never;
 } | {
     secrets: ComputerUseSecrets;
-    /** The websites a task with `secrets` and no `session` may use. */
+    /** The websites (1 to 10 lower-case hostnames) the browser may use and type the secrets into. */
     allowedHosts: readonly string[];
     session?: never;
 } | {
-    session?: never;
+    /** The websites (1 to 10 lower-case hostnames) the browser may use; none means any website. */
+    allowedHosts?: readonly string[];
     secrets?: never;
-    allowedHosts?: never;
+    session?: never;
 };
 export type ComputerUseOptions = ComputerUseCommonOptions & ComputerUseSignIn;
 export interface ComputerUseFinished {

package/dist/computer-use.js

@@ -61,8 +61,6 @@ export function createComputerUseTool(options) {
     const { session } = options;
     if (session !== undefined && options.allowedHosts !== undefined)
         throw invalid('Pass session or allowedHosts, not both: a saved sign-in carries its own websites.');
-    if (options.allowedHosts !== undefined && options.secrets === undefined)
-        throw invalid('allowedHosts is only for a task with secrets and no session.');
     if (options.secrets !== undefined && session === undefined && options.allowedHosts === undefined)
         throw invalid('A task with secrets needs session or allowedHosts: the websites the computer may type them into.');
     const allowedHosts = options.allowedHosts === undefined ? undefined : allowedHostsOf(options.allowedHosts);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isomorph.ai/app-sdk",
-  "version": "1.45.0",
+  "version": "1.46.0",
   "type": "module",
   "repository": {
     "type": "git",