@runtypelabs/cli 2.11.0 → 2.11.1

package/dist/index.js

@@ -19803,7 +19803,11 @@ var require_fpo_schema = __commonJS({
     var setupInstructionsSchema = zod_1.z.object({
       summary: zod_1.z.string().min(1),
       steps: zod_1.z.array(zod_1.z.string()),
-      docsUrl: zod_1.z.string().optional()
+      // Constrained to an absolute URL because this lands in the rendered
+      // `<a href={…}>` in the secret intake and quick-start preview UIs —
+      // `javascript:` / `data:` schemes in an unrestricted string would be a
+      // live XSS vector when a malicious template is imported.
+      docsUrl: zod_1.z.string().url().optional()
     });
     var toolAuthSchema = zod_1.z.object({
       type: zod_1.z.enum(["oauth", "api_key", "none", "user_provided"]),
@@ -20073,12 +20077,59 @@ var require_capability_validator = __commonJS({
   }
 });
 
+// ../shared/dist/product-generation/secret-ref.js
+var require_secret_ref = __commonJS({
+  "../shared/dist/product-generation/secret-ref.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.extractSecretReferences = extractSecretReferences;
+    exports.extractSecretReferencesFromAnyValue = extractSecretReferencesFromAnyValue;
+    var SECRET_REF_PATTERN = /\{\{secret:([A-Z][A-Z0-9_]*[A-Z0-9])\}\}/g;
+    function extractSecretReferences(template) {
+      const keys = /* @__PURE__ */ new Set();
+      let match;
+      const regex = new RegExp(SECRET_REF_PATTERN.source, "g");
+      while ((match = regex.exec(template)) !== null) {
+        const key = match[1];
+        if (key)
+          keys.add(key);
+      }
+      return Array.from(keys);
+    }
+    function extractSecretReferencesFromAnyValue(value, maxDepth = 10) {
+      const keys = /* @__PURE__ */ new Set();
+      walk(value, 0);
+      return Array.from(keys);
+      function walk(v, depth) {
+        if (depth > maxDepth)
+          return;
+        if (typeof v === "string") {
+          for (const key of extractSecretReferences(v))
+            keys.add(key);
+          return;
+        }
+        if (Array.isArray(v)) {
+          for (const item of v)
+            walk(item, depth + 1);
+          return;
+        }
+        if (v && typeof v === "object") {
+          for (const inner of Object.values(v)) {
+            walk(inner, depth + 1);
+          }
+        }
+      }
+    }
+  }
+});
+
 // ../shared/dist/product-generation/validators/tool-validator.js
 var require_tool_validator = __commonJS({
   "../shared/dist/product-generation/validators/tool-validator.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.validateToolDefinition = validateToolDefinition;
+    var secret_ref_1 = require_secret_ref();
     var types_1 = require_types2();
     function validateToolDefinition(tool, index) {
       const result = (0, types_1.emptyResult)();
@@ -20090,13 +20141,30 @@ var require_tool_validator = __commonJS({
         result.errors.push((0, types_1.createIssue)("error", "INTEGRATION_NO_PROVIDER", "Integration tools must have a provider", `${base}.provider`));
       }
       if (tool.auth) {
+        const declaredKeys = /* @__PURE__ */ new Set();
         if (tool.auth.secrets) {
           for (const [i, secret] of tool.auth.secrets.entries()) {
             if (!secret.key || secret.key.trim() === "") {
               result.errors.push((0, types_1.createIssue)("error", "SECRET_KEY_EMPTY", "Secret key is required", `${base}.auth.secrets[${i}].key`));
+              continue;
             }
+            declaredKeys.add(secret.key);
+          }
+        }
+        const referencedKeys = new Set((0, secret_ref_1.extractSecretReferencesFromAnyValue)(tool.config));
+        for (const key of referencedKeys) {
+          if (!declaredKeys.has(key)) {
+            result.errors.push((0, types_1.createIssue)("error", "SECRET_REFERENCE_UNDECLARED", `Tool config references \`{{secret:${key}}}\` but this tool does not declare it in \`auth.secrets\`.`, `${base}.auth.secrets`, `Add \`{ key: '${key}', required: true }\` to this tool's \`auth.secrets\`.`));
           }
         }
+        for (const key of declaredKeys) {
+          if (!referencedKeys.has(key)) {
+            result.warnings.push((0, types_1.createIssue)("warning", "SECRET_DECLARED_BUT_UNREFERENCED", `Secret \`${key}\` is declared in \`auth.secrets\` but never referenced as \`{{secret:${key}}}\` in this tool's config.`, `${base}.auth.secrets`, `Either reference \`{{secret:${key}}}\` in the tool config or remove it from \`auth.secrets\`. Integrations that consume secrets outside the config (e.g. MCP servers) can ignore this warning.`));
+          }
+        }
+        if (declaredKeys.size > 0 && tool.auth.setupRequired === false) {
+          result.recommendations.push((0, types_1.createIssue)("recommendation", "SETUP_REQUIRED_IMPLIED", `Tool declares ${declaredKeys.size} secret(s) in \`auth.secrets\` but \`auth.setupRequired\` is false \u2014 pending secrets will not be surfaced in the intake flow.`, `${base}.auth.setupRequired`, "Set `auth.setupRequired: true` so these secrets are materialized as pending bindings and shown to the user after import."));
+        }
       }
       result.valid = result.errors.length === 0;
       return result;
@@ -20321,8 +20389,21 @@ var require_fpo_template = __commonJS({
       version: zod_1.z.literal(exports.FULL_PRODUCT_OBJECT_TEMPLATE_VERSION),
       productObject: fpo_schema_1.fullProductObjectSchema,
       template: zod_1.z.object({
-        variables: zod_1.z.array(exports.fpoTemplateVariableSchema).min(1, "Template must declare at least one variable")
+        variables: zod_1.z.array(exports.fpoTemplateVariableSchema).max(50)
       })
+    }).superRefine((doc, ctx) => {
+      const hasVariables = doc.template.variables.length > 0;
+      const hasPendingSecretTool = doc.productObject.tools.some((tool) => {
+        var _a, _b;
+        return ((_a = tool.auth) === null || _a === void 0 ? void 0 : _a.setupRequired) === true && Array.isArray((_b = tool.auth) === null || _b === void 0 ? void 0 : _b.secrets) && tool.auth.secrets.length > 0;
+      });
+      if (!hasVariables && !hasPendingSecretTool) {
+        ctx.addIssue({
+          code: "custom",
+          message: "Template must declare at least one template variable or at least one tool with `auth.setupRequired: true` and pending secrets.",
+          path: ["template", "variables"]
+        });
+      }
     });
     function collectStringLeafPaths(value, path14 = []) {
       if (typeof value === "string") {
@@ -20352,7 +20433,7 @@ var require_fpo_template = __commonJS({
         const inner = value.slice(start + 2, end);
         const separatorIndex = inner.indexOf("|");
         const key = (separatorIndex === -1 ? inner : inner.slice(0, separatorIndex)).trim();
-        if (key.length > 0) {
+        if (key.length > 0 && !key.startsWith("secret:")) {
           references.push({
             key,
             defaultValue: separatorIndex === -1 ? void 0 : inner.slice(separatorIndex + 1).trim(),
@@ -20534,6 +20615,9 @@ var require_fpo_template = __commonJS({
         if (!referencedKeys.has(variable.key)) {
           result.warnings.push((0, types_1.createIssue)("warning", "UNUSED_TEMPLATE_VARIABLE", `Template variable "${variable.key}" is declared but not used`, `template.variables.${variable.key}`));
         }
+        if (variable.inputType === "secret") {
+          result.warnings.push((0, types_1.createIssue)("warning", "TEMPLATE_VARIABLE_SECRET_IS_UNSAFE", `Template variable "${variable.key}" uses \`inputType: 'secret'\`, which substitutes the supplied value literally into the product record at resolve time \u2014 the value ends up persisted in the database.`, `template.variables.${variable.key}.inputType`, `Prefer declaring pending secrets via the target tool's \`auth.secrets\` array and referencing the value as \`{{secret:${variable.key.toUpperCase()}}}\` so the secret is stored in the secrets vault instead of in the product object.`));
+        }
       }
       const defaultsResolution = (_a = options.defaultsResolution) !== null && _a !== void 0 ? _a : resolveFPOTemplate(template);
       const defaultsValidation = (0, types_1.mergeResults)((0, fpo_validator_1.validateFPO)(defaultsResolution.resolved), defaultsResolution.missingVariables.length > 0 ? {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runtypelabs/cli",
-  "version": "2.11.0",
+  "version": "2.11.1",
   "description": "Command-line interface for Runtype AI platform",
   "type": "module",
   "main": "dist/index.js",
@@ -23,7 +23,7 @@
     "micromatch": "^4.0.8",
     "yaml": "^2.8.3",
     "@runtypelabs/ink-components": "0.3.1",
-    "@runtypelabs/sdk": "1.17.0",
+    "@runtypelabs/sdk": "1.17.1",
     "@runtypelabs/terminal-animations": "0.2.0"
   },
   "devDependencies": {