@muxoai/platform 1.4.1 → 1.4.3

package/.agents/plugins/marketplace.json

@@ -6,7 +6,7 @@
   "plugins": [
     {
       "name": "muxo",
-      "version": "1.4.1",
+      "version": "1.4.3",
       "description": "Governed execution across 1,000+ Connected Apps, Instant Tools (search, scrape, crawl, SEO audit), Cloud Infrastructure provisioning, Workspace Memory recall, and cryptographic execution receipts.",
       "source": {
         "source": "local",

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
   },
   "metadata": {
     "description": "Official Muxo plugin marketplace for governed execution across Connected Apps, Instant Tools, Cloud Infrastructure, and Workspace Memory.",
-    "version": "1.4.1"
+    "version": "1.4.3"
   },
   "plugins": [
     {
@@ -19,7 +19,7 @@
       },
       "strict": false,
       "description": "Governed execution across 1,000+ Connected Apps, Instant Tools (search, scrape, crawl, SEO audit), Cloud Infrastructure provisioning, Workspace Memory recall, and verifiable audit records.",
-      "version": "1.4.1",
+      "version": "1.4.3",
       "category": "Productivity",
       "skills": [
         "./plugins/muxo/skills/muxo",

package/README.md

@@ -1,6 +1,6 @@
 # Muxo (`@muxoai/platform` / `@muxoai/cli` / `@muxoai/sdk`)
 
-Muxo (`v1.4.0`) is the unified execution, cloud infrastructure provisioning, contextual memory, and cryptographic governance platform for AI agents and applications. Customers and their agents interact exclusively with **Muxo** — either via structured tool slugs or free-form **Natural Language** (`muxo do`, `POST /api/v1/do`, `client.do()`, and MCP `plan_action`).
+Muxo (`v1.4.3`) is the unified execution, cloud infrastructure provisioning, contextual memory, and cryptographic governance platform for AI agents and applications. Customers and their agents interact exclusively with **Muxo** — either via structured tool slugs or free-form **Natural Language** (`muxo do`, `POST /api/v1/do`, `client.do()`, and MCP `plan_action`).
 
 See [`ARCHITECTURE.md`](./ARCHITECTURE.md) for the complete internal engineering blueprint, open-source ecosystem Keep/Adopt/Drop matrix, and 4-pillar architecture.
 

package/dist/cli.js

@@ -5,7 +5,7 @@ import path from "node:path";
 import readline from "node:readline";
 import { getConfig } from "./config.js";
 import { MuxoEngine } from "./engine.js";
-import { handleJsonRpcMcpRequest } from "./mcp.js";
+import { handleJsonRpcMcpRequest, LATEST_MCP_PROTOCOL_VERSION } from "./mcp.js";
 import { DEFAULT_WORKSPACE_POLICY, describePolicyInPlainEnglish, sanitizePolicyPatch, } from "./policy.js";
 import { RING_LABELS } from "./providers/microsoft-governance.js";
 import { BYOK_PROVIDER_CATALOG, MuxoStore } from "./store.js";
@@ -532,6 +532,9 @@ async function runCli() {
                         if (mcpSessionId) {
                             headers["Mcp-Session-Id"] = mcpSessionId;
                         }
+                        if (typeof rpc.method === "string" && rpc.method.trim()) {
+                            headers["Mcp-Method"] = rpc.method.trim();
+                        }
                         const res = await fetch(`${remoteUrl}/mcp`, {
                             method: "POST",
                             headers,
@@ -654,7 +657,7 @@ async function runCli() {
             });
             await runCheck("mcp_initialize", "MCP server accepts a session", async () => {
                 const result = await mcpCall(1, "initialize", {
-                    protocolVersion: "2025-06-18",
+                    protocolVersion: LATEST_MCP_PROTOCOL_VERSION,
                     capabilities: {},
                     clientInfo: { name: "muxo-cli-harness", version: MUXO_VERSION },
                 });
@@ -710,7 +713,7 @@ async function runCli() {
                     jsonrpc: "2.0",
                     id: 1,
                     method: "initialize",
-                    params: { protocolVersion: "2025-06-18", capabilities: {} },
+                    params: { protocolVersion: LATEST_MCP_PROTOCOL_VERSION, capabilities: {} },
                 });
                 const info = res?.result?.serverInfo;
                 assertCheck(info?.name, "initialize returned no serverInfo");
@@ -2318,6 +2321,90 @@ async function runCli() {
         console.log(JSON.stringify(result, null, 2));
         return;
     }
+    if (cmd === "playbooks" || cmd === "playbook") {
+        const sub = positional[1];
+        if (sub === "run") {
+            const slug = positional[2] ||
+                flags.slug ||
+                "fullstack-cloud-bootstrap";
+            const input = flags.input
+                ? JSON.parse(String(flags.input))
+                : {};
+            if (remoteUrl) {
+                const res = await remoteFetch(`/api/v1/playbooks/${encodeURIComponent(slug)}/run`, {
+                    method: "POST",
+                    body: { input },
+                });
+                console.log(JSON.stringify(res, null, 2));
+                return;
+            }
+            const { engine, ctx } = getLocalContext();
+            const res = engine.runCommercialPlaybook(ctx, { slug, input });
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        if (remoteUrl) {
+            const res = await remoteFetch("/api/v1/playbooks");
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        const { engine } = getLocalContext();
+        const playbooks = engine.listCommercialPlaybooks();
+        console.log(JSON.stringify({ ok: true, count: playbooks.length, playbooks }, null, 2));
+        return;
+    }
+    if (cmd === "roi") {
+        if (remoteUrl) {
+            const res = await remoteFetch("/api/v1/analytics/roi");
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        const { engine, ctx } = getLocalContext();
+        console.log(JSON.stringify({ ok: true, ...engine.getCommercialRoiReport(ctx) }, null, 2));
+        return;
+    }
+    if (cmd === "cedar") {
+        const sub = positional[1];
+        if (sub === "evaluate" || sub === "eval") {
+            const toolSlug = positional[2] || flags.tool || "instant.web.search";
+            const input = flags.input
+                ? JSON.parse(String(flags.input))
+                : {};
+            if (remoteUrl) {
+                const res = await remoteFetch("/api/v1/governance/cedar/evaluate", {
+                    method: "POST",
+                    body: { toolSlug, input },
+                });
+                console.log(JSON.stringify(res, null, 2));
+                return;
+            }
+            const { engine, ctx } = getLocalContext();
+            console.log(JSON.stringify({
+                ok: true,
+                ...engine.evaluatePolicyAsCode(ctx, { toolSlug, input }),
+            }, null, 2));
+            return;
+        }
+        if (remoteUrl) {
+            const res = await remoteFetch("/api/v1/governance/cedar");
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        const { engine, ctx } = getLocalContext();
+        console.log(JSON.stringify({ ok: true, ...engine.getPolicyAsCodeBundle(ctx) }, null, 2));
+        return;
+    }
+    if (cmd === "telemetry" || cmd === "otel") {
+        const limit = flags.limit ? Number(flags.limit) : 25;
+        if (remoteUrl) {
+            const res = await remoteFetch(`/api/v1/telemetry/otlp?limit=${limit}`);
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        const { engine, ctx } = getLocalContext();
+        console.log(JSON.stringify({ ok: true, ...engine.exportOtelTraces(ctx, limit) }, null, 2));
+        return;
+    }
     console.log(`
 Muxo CLI — Unified Agent Execution, Cloud Infrastructure, Memory & Safety Platform
 
@@ -2362,6 +2449,10 @@ Core Commands:
   muxo governance scan <text>                  Check text for prompt injection before storing or sending it
   muxo governance policy [--mode enforce|monitor] [--ring 0-3] [--require-approval write,admin|none]
                          [--block-destructive-sql true|false] [--max-credits <n>]
+  muxo cedar [evaluate <tool_slug>]            Compile or evaluate AWS Cedar 4.x & OPA Rego v1 policy-as-code
+  muxo telemetry [--limit 25]                  Export OpenTelemetry GenAI / MCP OTLP & Langfuse trace spans
+  muxo playbooks [run <slug>]                  List or execute Temporal-compatible commercial Saga playbooks
+  muxo roi                                     Compute FinOps unit economics, BYOK savings, and engineering ROI
   muxo harness                                 Check API, MCP, auth, governance and catalog; print MCP config
   muxo serve [--port 4310]                     Start unified HTTP Console, Landing, OAuth Callback & MCP server
   muxo mcp                                     Run stdio MCP server (19 canonical tools)

package/dist/composio-catalog.d.ts

@@ -8,29 +8,44 @@ export interface ComposioToolkitMetadata {
     pinnedVersion: string;
     readOnlyScopes: string[];
     fullAccessScopes: string[];
+    lane?: "composio_sdk" | "stripe_projects" | "composio_instant" | "stripe_billing";
     sampleActions: Array<{
         upstreamSlug: string;
         muxoSlug: string;
         name: string;
-        riskLevel: "read" | "write" | "destructive" | "financial";
+        riskLevel: "read" | "write" | "destructive" | "financial" | "provisioning" | "admin";
     }>;
 }
+export type ComposioWebhookEventType = "composio.trigger.message" | "composio.trigger.disabled" | "composio.connected_account.expired" | "composio.connected_account.activated";
+export declare const COMPOSIO_V3_WEBHOOK_EVENTS: ComposioWebhookEventType[];
 export interface ComposioTriggerSubscription {
     id: string;
+    upstreamTriggerId?: string;
     workspaceId: string;
+    userId?: string;
     triggerSlug: string;
     providerSlug: string;
     connectedAccountId: string;
     webhookUrl: string;
     config: Record<string, unknown>;
     status: "active" | "paused" | "disabled";
+    source?: "composio_v3_sdk" | "muxo_managed";
     createdAt: string;
 }
 export interface ComposioTriggerEventRecord {
     id: string;
     workspaceId: string;
+    eventType?: ComposioWebhookEventType | string;
+    webhookVersion?: "V3" | "V2" | "V1" | "direct";
+    signatureVerified?: boolean;
+    webhookId?: string;
+    triggerId?: string;
     triggerSlug: string;
     providerSlug: string;
+    connectedAccountId?: string;
+    userId?: string;
+    projectId?: string;
+    orgId?: string;
     receivedAt: string;
     promptInjectionScan: {
         safe: boolean;
@@ -47,12 +62,173 @@ export interface ComposioTriggerType {
     providerSlug: string;
     name: string;
     description: string;
+    config: Record<string, unknown>;
 }
 export declare const COMPOSIO_TRIGGER_CATALOGUE: ComposioTriggerType[];
 export declare function listComposioTriggerTypes(providerSlug?: string): ComposioTriggerType[];
+export declare function getComposioTriggerType(slug: string): ComposioTriggerType | null;
+/**
+ * Verifies a Composio V3 webhook HMAC-SHA256 signature (`v1,<base64>`) across Node and Cloudflare Workers.
+ * Signing input: `${webhookId}.${webhookTimestamp}.${rawPayload}`
+ */
+export declare function verifyComposioWebhookSignature(params: {
+    rawPayload: string;
+    signatureHeader?: string | null;
+    webhookIdHeader?: string | null;
+    webhookTimestampHeader?: string | null;
+    secret?: string | null;
+    toleranceSeconds?: number;
+}): Promise<{
+    verified: boolean;
+    reason?: string;
+}>;
+export interface ParsedComposioWebhookEnvelope {
+    eventType: ComposioWebhookEventType | string;
+    webhookVersion: "V3" | "V2" | "V1" | "direct";
+    webhookId?: string;
+    timestamp?: string;
+    triggerId?: string;
+    triggerSlug: string;
+    providerSlug: string;
+    connectedAccountId?: string;
+    connectionStatus?: "active" | "expired" | "disabled";
+    userId?: string;
+    projectId?: string;
+    orgId?: string;
+    payloadObj: Record<string, unknown>;
+}
+/**
+ * Normalizes Composio V3 webhook events (`composio.trigger.message`, `composio.trigger.disabled`,
+ * `composio.connected_account.expired`, `composio.connected_account.activated`) as well as direct
+ * trigger webhook payloads into a single canonical envelope.
+ */
+export declare function parseComposioWebhookEnvelope(body: Record<string, unknown>, headers?: {
+    webhookId?: string | null;
+    webhookTimestamp?: string | null;
+    webhookVersion?: string | null;
+}): ParsedComposioWebhookEnvelope;
 export declare function filterComposioToolkits(params?: {
     category?: string;
     search?: string;
 }): ComposioToolkitMetadata[];
 /** Least-privilege scopes for a custom auth config: explicit scopes win, then the toolkit's read-only or full set. */
 export declare function composioAuthConfigScopes(toolkitSlug: string, scopeMode: "read_only" | "full_access", customScopes?: string[]): string[];
+export interface MuxoConnectInputField {
+    name: string;
+    type?: string;
+    label?: string;
+    description?: string;
+    required?: boolean;
+    default?: string | null;
+}
+export interface MuxoConnectLinkMetadata {
+    token: string;
+    toolkitSlug: string;
+    toolkitName: string;
+    connectedAccountId: string | null;
+    authMode: string;
+    status: string;
+    callbackUrl: string | null;
+    expectedInputFields: MuxoConnectInputField[];
+}
+export declare function ensureOAuthCallbackParams(callbackUrl: string, workspaceId: string, providerSlug: string): string;
+/**
+ * Normalizes upstream Composio hosted link URLs (`connect.composio.dev/link/lk_...`,
+ * `dashboard.composio.dev/link/lk_...`, `backend.composio.dev/api/v3/s/...`, or
+ * legacy `/oauth/connect/lk_...`) directly to Composio's native hosted OAuth URL
+ * (`https://connect.composio.dev/link/<token>`), avoiding intermediate custom pages.
+ */
+export declare function wrapMuxoConnectUrl(rawUrl: string | null | undefined, _baseUrl?: string, _params?: {
+    workspaceId?: string;
+    providerSlug?: string;
+    callbackUrl?: string | null;
+    externalAccountId?: string | null;
+}): string | null;
+export declare function fetchMuxoConnectLinkMetadata(token: string, fallback?: {
+    workspaceId?: string;
+    providerSlug?: string;
+    callbackUrl?: string | null;
+    connectedAccountId?: string | null;
+}): Promise<MuxoConnectLinkMetadata>;
+export declare function submitMuxoConnectLink(token: string, input?: Record<string, unknown>, fallback?: {
+    workspaceId?: string;
+    providerSlug?: string;
+    callbackUrl?: string | null;
+    connectedAccountId?: string | null;
+}): Promise<{
+    ok: boolean;
+    status: string;
+    redirectUrl: string | null;
+    connectedAccountId: string | null;
+    error?: string;
+}>;
+/**
+ * Canonical Stripe Projects Cloud Infrastructure providers (`stripe_projects` lane).
+ * These providers are provisioned and deployed directly through Stripe Projects
+ * (and/or Muxo instant cloud provisioning) without Composio OAuth handoffs.
+ */
+export declare const STRIPE_PROJECTS_PROVIDER_SLUGS: Set<string>;
+export declare const STRIPE_PROJECTS_HOSTING_PROVIDERS: Set<string>;
+export declare const STRIPE_PROJECTS_DATABASE_PROVIDERS: ReadonlySet<string>;
+export declare const STRIPE_PROJECTS_MESSAGING_PROVIDERS: ReadonlySet<string>;
+export declare const STRIPE_PROJECTS_AI_SEARCH_PROVIDERS: ReadonlySet<string>;
+export declare const STRIPE_PROJECTS_SANDBOX_BROWSER_PROVIDERS: ReadonlySet<string>;
+export declare const STRIPE_PROJECTS_CANONICAL_RESOURCE_SLUG: Record<string, string>;
+/**
+ * Multi-service deployable slugs supported per Stripe Projects provider.
+ */
+export declare const STRIPE_PROJECTS_MULTI_SERVICE_MAP: Record<string, Record<string, string>>;
+export interface StripeProjectsDeployableCatalogEntry {
+    slug: string;
+    upstreamSlug: string;
+    providerSlug: string;
+    providerName: string;
+    serviceId: string;
+    name: string;
+    description: string;
+    categories: string[];
+    defaultPlan: string;
+    availablePlans: string[];
+    providerUrl: string;
+    llmContextUrl?: string;
+}
+export declare const STRIPE_PROJECTS_DEPLOYABLE_CATALOG: StripeProjectsDeployableCatalogEntry[];
+/**
+ * Stripe Projects Toolkits Catalog exposed alongside Enterprise Connected Apps in `/api/v1/toolkits`
+ * and `filterComposioToolkits` so every Stripe Projects provider and its services are discoverable as toolkits.
+ */
+export declare const STRIPE_PROJECTS_TOOLKITS_CATALOG: ComposioToolkitMetadata[];
+export declare function normalizeStripeProjectsProviderSlug(raw: string): string;
+export declare function isStripeProjectsExclusiveProvider(rawSlug: string): boolean;
+export declare function isStripeProjectsHostingProvider(rawSlug: string): boolean;
+export declare function isStripeProjectsDatabaseProvider(rawSlug: string): boolean;
+/**
+ * Resolves any tool or provider reference targeting a Stripe Projects provider
+ * (including `app.vercel.deploy`, `app.vercel.create_deployment`, `resource.vercel.deploy`,
+ * `vercel/deploy`, `app.netlify.deploy`, `app.turso.create_database`, `supabase_migration`,
+ * `resource.cloudflare.d1`, `resource.upstash.vector`, `resource.railway.postgres`, etc.)
+ * to its canonical `resource.<provider>.<service>` tool slug on the `stripe_projects` lane.
+ */
+export declare function resolveStripeProjectsCanonicalToolSlug(rawSlug: string): string | null;
+export declare function extractHostedHtmlFromInput(input: Record<string, unknown>): {
+    html: string | null;
+    files: Record<string, string>;
+    envVars: Record<string, string>;
+};
+export declare function extractDatabaseMigrationsFromInput(input: Record<string, unknown>): {
+    hasMigrations: boolean;
+    sqlStatements: string[];
+    tablesCreated: string[];
+};
+export declare function buildStandardStripeProjectsSecrets(params: {
+    providerSlug: string;
+    resourceName: string;
+    workspaceSlug?: string;
+    liveUrl?: string;
+}): Record<string, string>;
+export declare function renderDefaultHostedSiteHtml(params: {
+    resourceName: string;
+    providerName: string;
+    providerSlug: string;
+    liveUrl: string;
+}): string;