@kosuke-ai/cli 6.8.0 → 6.10.0

package/dist/program.js

@@ -1,6 +1,7 @@
 import { Command } from 'commander';
 import { attachAgentCommands } from './commands/agent.js';
 import { attachAuthCommands } from './commands/auth.js';
+import { attachIntegrationsCommands } from './commands/integrations.js';
 import { attachWatchCommand } from './commands/watch.js';
 import { operations } from './generated/commands/index.js';
 import { attachOperation } from './runtime/attach.js';
@@ -8,8 +9,8 @@ import { isCronToken, isLeadToken, isOrchestratorToken, isSandboxAgentToken, } f
 import { createRuntime, ExitSignal } from './runtime/runtime.js';
 import { version } from './runtime/version.js';
 /**
- * The command tree: `auth`, `agent` and `sessions watch` by hand, everything else
- * from the generated descriptors. Global flags are read before any subcommand runs, so the
+ * The command tree: `auth`, `agent`, `integrations list|describe|call` and `sessions watch` by
+ * hand, everything else from the generated descriptors. Global flags are read before any subcommand runs, so the
  * runtime the subcommands share is built once, from them.
  */
 export function createProgram(options = {}) {
@@ -55,6 +56,8 @@ export function createProgram(options = {}) {
     // member's own key and their Lead may mark Activity seen, so the others
     // read it with `--peek`.
     attachAgentCommands(program, lazy, options.agent);
+    // Beside the generated `integrations tools` and `execute`, which stay raw passthroughs.
+    attachIntegrationsCommands(program, lazy, options.integrations);
     // The job stream admits a member's API key only; it closes 4401 on every narrower token.
     if (narrowedTo === null)
         attachWatchCommand(program, lazy, options.watch);

package/dist/runtime/client.js

@@ -99,6 +99,57 @@ function withTransportRetry(fetchImpl) {
         }
     };
 }
+/** The most of one integration answer the CLI reads; its listings are bounded well below it. */
+const MAX_INTEGRATION_RESPONSE_BYTES = 512 * 1024;
+const INTEGRATIONS_PREFIX = '/api/agent-integrations/';
+/** An integration answer past the cap; a call that got one may still have run. */
+export class ResponseTooLarge extends Error {
+    constructor() {
+        super('Integration response was too large');
+        this.name = 'ResponseTooLarge';
+    }
+}
+/**
+ * Caps what an integration route can make the CLI buffer, error bodies included. The body is
+ * counted as it streams, so nothing past the cap is held or parsed. Other routes are untouched.
+ */
+function withIntegrationCap(fetchImpl) {
+    return async (...args) => {
+        const response = await fetchImpl(...args);
+        const [input] = args;
+        try {
+            const href = input instanceof Request ? input.url : String(input);
+            if (!new URL(href, 'http://localhost').pathname.startsWith(INTEGRATIONS_PREFIX)) {
+                return response;
+            }
+        }
+        catch {
+            return response;
+        }
+        if (!response.body)
+            return response;
+        const declared = Number(response.headers.get('content-length'));
+        if (Number.isFinite(declared) && declared > MAX_INTEGRATION_RESPONSE_BYTES) {
+            await response.body.cancel().catch(() => undefined);
+            throw new ResponseTooLarge();
+        }
+        let total = 0;
+        const counted = response.body.pipeThrough(new TransformStream({
+            transform(chunk, controller) {
+                total += chunk.byteLength;
+                if (total > MAX_INTEGRATION_RESPONSE_BYTES)
+                    controller.error(new ResponseTooLarge());
+                else
+                    controller.enqueue(chunk);
+            },
+        }));
+        return new Response(counted, {
+            status: response.status,
+            statusText: response.statusText,
+            headers: response.headers,
+        });
+    };
+}
 export function createApiClient({ apiUrl, apiKey, fetch }) {
     return createClient({
         baseUrl: apiUrl,
@@ -106,6 +157,6 @@ export function createApiClient({ apiUrl, apiKey, fetch }) {
             ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
             'User-Agent': `@kosuke-ai/cli/${version}`,
         },
-        fetch: withTransportRetry(fetch ?? globalThis.fetch),
+        fetch: withIntegrationCap(withTransportRetry(fetch ?? globalThis.fetch)),
     });
 }

package/dist/runtime/credentials.js

@@ -37,6 +37,13 @@ const LEAD_TOKEN_PREFIX = 'kosuke_lead_';
 export function isLeadToken(token) {
     return token?.startsWith(LEAD_TOKEN_PREFIX) ?? false;
 }
+/** A credential that decides its own workspace: any of the four agent tokens. */
+export function isTurnToken(token) {
+    return (isSandboxAgentToken(token ?? undefined) ||
+        isOrchestratorToken(token ?? undefined) ||
+        isCronToken(token ?? undefined) ||
+        isLeadToken(token ?? undefined));
+}
 export function resolveCredentials(flags, env = process.env) {
     const stored = readCredentials(env);
     const apiKey = flags.apiKey

package/openapi.json

@@ -141,6 +141,226 @@
         }
       }
     },
+    "/api/agent-integrations/execute": {
+      "post": {
+        "operationId": "integrationsExecute",
+        "summary": "Run one integration tool. An agent runs it for its own workspace, or on the member’s personal connection when that member started the turn; the Slack Bot’s agent runs only the workspace’s. With an API key, name a workspace you belong to: the call runs only on your own personal connections, and one on a workspace connection is refused. The answer names the connection it ran on, or lists the connections to choose from when the call needs one. A tool failure answers 200 with isError true. A Connector Token or a browser session is refused.",
+        "tags": ["integrations"],
+        "x-kosuke-command": ["integrations", "execute"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
+        "parameters": [
+          {
+            "name": "workspace",
+            "in": "query",
+            "required": false,
+            "description": "The workspace the call is made in. Required with an API key, which is refused with 403 when you are not a member of it. An agent credential reaches its own workspace and refuses another.",
+            "schema": {
+              "description": "The workspace the call is made in. Required with an API key, which is refused with 403 when you are not a member of it. An agent credential reaches its own workspace and refuses another.",
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 100
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 80,
+                    "description": "The tool to run, as the tools list names it."
+                  },
+                  "arguments": {
+                    "type": "object",
+                    "propertyNames": {
+                      "type": "string"
+                    },
+                    "additionalProperties": {},
+                    "description": "The tool's arguments, as its input schema describes them."
+                  },
+                  "account": {
+                    "description": "The connection to run on: its short id, its alias such as notion-personal, or scope:label. Needed when several can run the tool.",
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 100
+                  }
+                },
+                "required": ["name", "arguments"],
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "2XX": {
+            "description": "Success envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiSuccess"
+                }
+              }
+            }
+          },
+          "4XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "5XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/agent-integrations/tools": {
+      "get": {
+        "operationId": "integrationsTools",
+        "summary": "List the integration tools you can run now, with the connections that run them. An agent reads its own workspace; the Slack Bot’s agent sees the workspace’s connections only. With an API key, name a workspace you belong to: it shows that workspace’s connections and your own personal ones. A Connector Token or a browser session is refused.",
+        "tags": ["integrations"],
+        "x-kosuke-command": ["integrations", "tools"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
+        "parameters": [
+          {
+            "name": "workspace",
+            "in": "query",
+            "required": false,
+            "description": "The workspace to list for. Required with an API key, which is refused with 403 when you are not a member of it. An agent credential reaches its own workspace and refuses another.",
+            "schema": {
+              "description": "The workspace to list for. Required with an API key, which is refused with 403 when you are not a member of it. An agent credential reaches its own workspace and refuses another.",
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 100
+            }
+          },
+          {
+            "name": "view",
+            "in": "query",
+            "required": false,
+            "description": "overview: the connections per toolkit with tool counts, and the matching tools once toolkit or search is set. summary: tool names and short descriptions, cut at 300. Without it, full definitions cut at a size budget, which is what older clients read.",
+            "schema": {
+              "description": "overview: the connections per toolkit with tool counts, and the matching tools once toolkit or search is set. summary: tool names and short descriptions, cut at 300. Without it, full definitions cut at a size budget, which is what older clients read.",
+              "type": "string",
+              "enum": ["summary", "overview"]
+            }
+          },
+          {
+            "name": "toolkit",
+            "in": "query",
+            "required": false,
+            "description": "Only this toolkit, by slug, such as gmail.",
+            "schema": {
+              "description": "Only this toolkit, by slug, such as gmail.",
+              "type": "string",
+              "pattern": "^[a-z0-9_]{1,64}$"
+            }
+          },
+          {
+            "name": "search",
+            "in": "query",
+            "required": false,
+            "description": "Only tools whose name, description or toolkit contains this text, in any case.",
+            "schema": {
+              "description": "Only tools whose name, description or toolkit contains this text, in any case.",
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 100
+            }
+          },
+          {
+            "name": "name",
+            "in": "query",
+            "required": false,
+            "description": "One tool by exact name, with its full input schema. 404 when you are not offered it.",
+            "schema": {
+              "description": "One tool by exact name, with its full input schema. 404 when you are not offered it.",
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 80
+            }
+          },
+          {
+            "name": "account",
+            "in": "query",
+            "required": false,
+            "description": "Only one connection: its short id, its alias such as notion-personal, or scope:label. Needed for a name that several connections can run.",
+            "schema": {
+              "description": "Only one connection: its short id, its alias such as notion-personal, or scope:label. Needed for a name that several connections can run.",
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 100
+            }
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "required": false,
+            "description": "With view overview, how many tools to list when toolkit or search is set. 40 by default.",
+            "schema": {
+              "description": "With view overview, how many tools to list when toolkit or search is set. 40 by default.",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 100
+            }
+          }
+        ],
+        "responses": {
+          "2XX": {
+            "description": "Success envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiSuccess"
+                }
+              }
+            }
+          },
+          "4XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "5XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/api/auth/github/repositories": {
       "get": {
         "operationId": "githubRepositories",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kosuke-ai/cli",
-  "version": "6.8.0",
+  "version": "6.10.0",
   "description": "Kosuke platform CLI. The client customers install to drive app.kosuke.ai from their own machine.",
   "license": "MIT",
   "repository": {