@runtypelabs/cli 2.42.3 → 2.42.4

package/dist/index.js

@@ -14828,6 +14828,11 @@ _enum([
 	"pending"
 ]);
 /**
+* Pattern enforced by `SecretStoreService.validateSecretKey`:
+* `/^[A-Z][A-Z0-9_]{0,98}[A-Z0-9]$/`. Keep in sync if that validator changes.
+*/
+const SECRET_KEY_PATTERN = /^[A-Z][A-Z0-9_]{0,98}[A-Z0-9]$/;
+/**
 * Operator allowlist for a single filter condition. No raw SQL passthrough —
 * the SQL compiler maps each operator to a parameterized fragment.
 */
@@ -15221,7 +15226,7 @@ const memoryConfigSchema = object({
 * With 'open', a prompt-injected agent can exfiltrate context to any host; no separate plan entitlement restricts it.
 * Revisit with a Schematic entitlement if/when sandbox egress becomes plan-differentiated.
 */
-const sandboxNetworkAccessSchema = union([_enum([
+const sandboxNetworkAccessSchema$1 = union([_enum([
 	"none",
 	"essentials",
 	"open"
@@ -15253,7 +15258,7 @@ const sandboxConfigSchema = object({
 		"standard-3",
 		"standard-4"
 	]).optional().describe("Only standard-4 is supported on the hosted Agent Sandbox path; other sizes cannot be enabled."),
-	networkAccess: sandboxNetworkAccessSchema.optional(),
+	networkAccess: sandboxNetworkAccessSchema$1.optional(),
 	ttl: _enum([
 		"5m",
 		"1h",
@@ -15428,6 +15433,288 @@ const agentRuntimeConfigSchema = object({
 	durability: agentDurabilityConfigSchema.optional(),
 	state: agentStateChannelSchema.optional()
 }).strict();
+const injectionModeSchema = _enum([
+	"bearer_header",
+	"api_key_header",
+	"query_param",
+	"basic_auth"
+]);
+const credentialProxyConfigSchema = object({
+	secretKey: string().min(1),
+	hostnamePattern: string().min(1),
+	pathPattern: string().default("/*"),
+	injectionMode: injectionModeSchema,
+	injectionConfig: record(string(), unknown()).default({}),
+	envVarName: string().optional()
+});
+/**
+* Sandbox provider capability table, the single source of truth for which `transform-data` sandbox provider runs which language.
+* #6521 needed the same provider/language relation in four places; the first draft forked it into four unpinned hand-copies.
+* This module is a pure leaf (no imports, no I/O) so every layer can depend on it; the table MIRRORS `TransformSandboxRouter`, asserted entry-for-entry by `apps/api/tests/flow-eligibility-facts.test.ts`.
+* Since `transform-data` continues on error by default, anything this table cannot vouch for must route to the legacy engine rather than silently produce wrong data.
+*/
+/**
+* The provider a `transform-data` step gets when `config.sandboxProvider` is
+* unset. Mirrors the default in `TransformSandboxRouter.selectExecutor` and in
+* the legacy `ApiContextStepExecutor.executeJavaScriptTransform`.
+*/
+const DEFAULT_SANDBOX_PROVIDER = "cloudflare-worker";
+/**
+* Every routable provider mapped to the languages its executor declares.
+* PROTOTYPE-LESS ON PURPOSE: the provider string is attacker-controlled on unauthenticated validation routes with no enum check in front.
+* On a normal object literal, `SANDBOX_PROVIDER_LANGUAGES['constructor']` resolves truthy and the following `.includes` throws, surfacing as a 500.
+* `Object.create(null)` plus an `Object.hasOwn` gate in `lookupLanguages` both close it; kept together since this table is read from four packages.
+*/
+const SANDBOX_PROVIDER_LANGUAGES = Object.assign(Object.create(null), {
+	quickjs: ["javascript"],
+	"cloudflare-worker": ["javascript"],
+	"runtype-sandbox": [
+		"javascript",
+		"typescript",
+		"python"
+	],
+	"cloudflare-sandbox": [
+		"javascript",
+		"typescript",
+		"python"
+	],
+	daytona: [
+		"javascript",
+		"typescript",
+		"python"
+	]
+});
+/** Normalize an unset / non-string provider to the documented default. */
+function resolveSandboxProvider(provider) {
+	return typeof provider === "string" ? provider : DEFAULT_SANDBOX_PROVIDER;
+}
+/**
+* The one lookup every predicate below goes through. Returns `undefined` for
+* anything that is not an OWN entry, so an inherited key can never be mistaken
+* for a provider — see the note on {@link SANDBOX_PROVIDER_LANGUAGES}.
+*/
+function lookupLanguages(provider) {
+	const resolved = resolveSandboxProvider(provider);
+	if (!Object.prototype.hasOwnProperty.call(SANDBOX_PROVIDER_LANGUAGES, resolved)) return void 0;
+	const languages = SANDBOX_PROVIDER_LANGUAGES[resolved];
+	return Array.isArray(languages) ? languages : void 0;
+}
+/** Providers whose executor runs JavaScript and nothing else — the Cloudflare Worker Loader and in-process QuickJS. */
+function isJsOnlySandboxProvider(provider) {
+	const languages = lookupLanguages(provider);
+	return languages !== void 0 && languages.length === 1 && languages[0] === "javascript";
+}
+/**
+* Can a `transform-data` step on this provider bind a code-mode tool pool? ONLY `cloudflare-worker`.
+* This is narrower than `isJsOnlySandboxProvider` and the gap is deliberate: the seam is the api's `SANDBOX.workerLoaderExecuteTransformWithTools` RPC, which exists for Worker Loader alone.
+* Legacy and the dashboard both gate on this same single provider.
+*/
+function supportsCodeModeToolPool(provider) {
+	return resolveSandboxProvider(provider) === "cloudflare-worker";
+}
+/**
+* Sandbox egress posture shared by `transform-data` steps and `custom` tools:
+* `'off'` (the default when omitted), `'on'`, or an explicit hostname allowlist.
+*/
+const sandboxNetworkAccessSchema = union([
+	literal("off"),
+	literal("on"),
+	object({ allowedHostnames: array(string()).min(1) })
+]);
+/**
+* One managed secret a `custom` tool may send, and where. Code sees only the
+* phantom token as `secrets.<key>`; the sandbox egress proxy swaps in the real
+* credential for requests that match `hostnamePattern` and `pathPattern`.
+*/
+const customToolSecretSchema = object({
+	key: string().regex(SECRET_KEY_PATTERN, "key must be a managed secret name, e.g. GITHUB_TOKEN"),
+	hostnamePattern: string().min(1),
+	pathPattern: string().min(1).optional(),
+	injectionMode: injectionModeSchema,
+	injectionConfig: record(string(), unknown()).optional()
+});
+/** Every code {@link collectCustomToolEgressIssues} can emit, for validators that forward core codes. */
+const CUSTOM_TOOL_EGRESS_ISSUE_CODES = [
+	"CUSTOM_TOOL_EGRESS_CONFIG_INVALID",
+	"CUSTOM_TOOL_EGRESS_PROVIDER_UNSUPPORTED",
+	"CUSTOM_TOOL_SECRET_HOST_NOT_ALLOWED"
+];
+/**
+* Shared-hosting suffixes where every subdomain belongs to a different tenant, so
+* `*.<suffix>` would send a credential to strangers. Curated from the Public Suffix
+* List's private section; extend it when a new host platform shows up.
+*/
+const SHARED_HOSTING_SUFFIXES = /* @__PURE__ */ new Set([
+	"github.io",
+	"gitlab.io",
+	"pages.dev",
+	"workers.dev",
+	"vercel.app",
+	"netlify.app",
+	"herokuapp.com",
+	"azurewebsites.net",
+	"cloudfront.net",
+	"appspot.com",
+	"firebaseapp.com",
+	"web.app",
+	"onrender.com",
+	"fly.dev",
+	"glitch.me",
+	"repl.co",
+	"replit.app",
+	"deno.dev",
+	"railway.app",
+	"ngrok.io",
+	"ngrok-free.app",
+	"trycloudflare.com",
+	"blogspot.com",
+	"wordpress.com",
+	"s3.amazonaws.com",
+	"amplifyapp.com",
+	"azurestaticapps.net",
+	"surge.sh",
+	"myshopify.com"
+]);
+/** Second-level labels that registries sell under a two-letter country code (co.uk, com.au, ne.jp). */
+const COUNTRY_SECOND_LEVELS = /* @__PURE__ */ new Set([
+	"ac",
+	"co",
+	"com",
+	"edu",
+	"gov",
+	"go",
+	"ne",
+	"net",
+	"or",
+	"org",
+	"ltd",
+	"plc",
+	"nom",
+	"gob",
+	"mil"
+]);
+/** Is `domain` a public suffix (a registry or shared-hosting zone), not one owner's domain? */
+function isPublicSuffixDomain(domain) {
+	const host = domain.toLowerCase().replace(/\.+$/, "");
+	if (SHARED_HOSTING_SUFFIXES.has(host)) return true;
+	const labels = host.split(".");
+	if (labels.length === 1) return true;
+	if (labels.length !== 2) return false;
+	const [second = "", top = ""] = labels;
+	return top.length === 2 && COUNTRY_SECOND_LEVELS.has(second);
+}
+/**
+* A secret's hostname pattern must name one public DNS host (`api.github.com`) or one
+* domain's subdomains (`*.github.com`): never a TLD, a public suffix (`*.co.uk`,
+* `*.github.io`), everything, an IP literal, `localhost`, or an `.internal` name.
+*/
+function isConcreteSecretHostnamePattern(pattern) {
+	const wildcard = pattern.startsWith("*.");
+	const host = (wildcard ? pattern.slice(2) : pattern).toLowerCase();
+	if (host.includes("*")) return false;
+	const labels = host.split(".");
+	if (labels.length < 2) return false;
+	if (labels.some((label) => !/^[a-z0-9-]+$/.test(label))) return false;
+	const topLevel = labels[labels.length - 1] ?? "";
+	if (!/[a-z]/.test(topLevel)) return false;
+	if (topLevel === "internal" || topLevel === "local" || topLevel === "localhost") return false;
+	return !(wildcard && isPublicSuffixDomain(host));
+}
+/** Is every host `secretPattern` can match also allowed by the tool's network posture? */
+function networkAccessCoversHostnamePattern(networkAccess, secretPattern) {
+	if (networkAccess === "on") return true;
+	if (networkAccess === "off") return false;
+	return networkAccess.allowedHostnames.some((allowed) => {
+		if (allowed === secretPattern) return true;
+		if (!allowed.startsWith("*.")) return false;
+		const suffix = allowed.slice(1);
+		return (secretPattern.startsWith("*.") ? secretPattern.slice(1) : secretPattern).endsWith(suffix);
+	});
+}
+const PROVIDERS_WITHOUT_EGRESS_PROXY = /* @__PURE__ */ new Set(["quickjs"]);
+const PROVIDERS_WITHOUT_SECRET_PROXY = /* @__PURE__ */ new Set(["quickjs", "daytona"]);
+const EGRESS_PROVIDER_REMEDIATION = "Set sandboxProvider to \"cloudflare-worker\" (JavaScript) or \"runtype-sandbox\" (JavaScript, TypeScript, Python).";
+/**
+* Pure checks on a custom tool's `networkAccess` / `secrets` against its provider.
+* Returns every issue so validators can surface them together.
+*/
+function collectCustomToolEgressIssues(config) {
+	if (!isRecord$1(config)) return [];
+	const issues = [];
+	const provider = resolveSandboxProvider(config.sandboxProvider);
+	const networkParse = config.networkAccess === void 0 ? void 0 : sandboxNetworkAccessSchema.safeParse(config.networkAccess);
+	if (networkParse && !networkParse.success) issues.push({
+		code: "CUSTOM_TOOL_EGRESS_CONFIG_INVALID",
+		message: `networkAccess must be 'off', 'on', or { allowedHostnames: [...] } with at least one hostname.`,
+		path: "networkAccess"
+	});
+	const networkAccess = networkParse?.success === true ? networkParse.data : "off";
+	if (networkAccess !== "off" && PROVIDERS_WITHOUT_EGRESS_PROXY.has(provider)) issues.push({
+		code: "CUSTOM_TOOL_EGRESS_PROVIDER_UNSUPPORTED",
+		message: `sandboxProvider "${provider}" has no fetch and no egress proxy, so networkAccess cannot be enabled. ${EGRESS_PROVIDER_REMEDIATION}`,
+		path: "networkAccess"
+	});
+	if (typeof networkAccess === "object" && provider === "daytona") issues.push({
+		code: "CUSTOM_TOOL_EGRESS_PROVIDER_UNSUPPORTED",
+		message: `sandboxProvider "daytona" manages its own egress and cannot enforce an allowedHostnames list. ${EGRESS_PROVIDER_REMEDIATION}`,
+		path: "networkAccess"
+	});
+	if (config.secrets === void 0) return issues;
+	if (!Array.isArray(config.secrets)) {
+		issues.push({
+			code: "CUSTOM_TOOL_EGRESS_CONFIG_INVALID",
+			message: "secrets must be an array of { key, hostnamePattern, injectionMode } entries.",
+			path: "secrets"
+		});
+		return issues;
+	}
+	if (config.secrets.length === 0) return issues;
+	if (PROVIDERS_WITHOUT_SECRET_PROXY.has(provider)) issues.push({
+		code: "CUSTOM_TOOL_EGRESS_PROVIDER_UNSUPPORTED",
+		message: `sandboxProvider "${provider}" has no credential proxy, so managed secrets cannot be injected. ${EGRESS_PROVIDER_REMEDIATION}`,
+		path: "secrets"
+	});
+	if (config.secrets.length > 10) issues.push({
+		code: "CUSTOM_TOOL_EGRESS_CONFIG_INVALID",
+		message: `A custom tool can declare at most 10 secrets.`,
+		path: "secrets"
+	});
+	const seenKeys = /* @__PURE__ */ new Set();
+	config.secrets.forEach((entry, index) => {
+		const path = `secrets[${index}]`;
+		const parsed = customToolSecretSchema.safeParse(entry);
+		if (!parsed.success) {
+			const first = parsed.error.issues[0];
+			issues.push({
+				code: "CUSTOM_TOOL_EGRESS_CONFIG_INVALID",
+				message: `Invalid secret entry: ${first?.path.join(".") || "entry"} ${first?.message ?? "is invalid"}. Use the bare secret name as key (GITHUB_TOKEN, not {{secret:GITHUB_TOKEN}}).`,
+				path
+			});
+			return;
+		}
+		const secret = parsed.data;
+		if (seenKeys.has(secret.key)) issues.push({
+			code: "CUSTOM_TOOL_EGRESS_CONFIG_INVALID",
+			message: `Secret "${secret.key}" is declared twice. Declare each secret once; it is injected for one hostname pattern.`,
+			path: `${path}.key`
+		});
+		seenKeys.add(secret.key);
+		if (!isConcreteSecretHostnamePattern(secret.hostnamePattern)) {
+			issues.push({
+				code: "CUSTOM_TOOL_EGRESS_CONFIG_INVALID",
+				message: `Secret "${secret.key}" hostnamePattern "${secret.hostnamePattern}" is not a single public host. Name the API host (api.github.com) or one domain's subdomains (*.github.com); public suffixes (*.co.uk, *.github.io), IP literals, localhost and internal names are refused.`,
+				path: `${path}.hostnamePattern`
+			});
+			return;
+		}
+		if (!networkAccessCoversHostnamePattern(networkAccess, secret.hostnamePattern)) issues.push({
+			code: "CUSTOM_TOOL_SECRET_HOST_NOT_ALLOWED",
+			message: `Secret "${secret.key}" is sent to "${secret.hostnamePattern}", but networkAccess does not allow that host. Add it to networkAccess.allowedHostnames.`,
+			path: `${path}.hostnamePattern`
+		});
+	});
+	return issues;
+}
 /**
 * A single entry in a context-step fallback chain. Mirrors `ContextFallback`
 * (`retry` | `step` | `flow`) in `error-handling.ts`. Discriminated by `type`.
@@ -16220,16 +16507,6 @@ const updateRecordConfigSchema = object({
 	defaultValue: any().optional()
 });
 /**
-* Network-access policy for sandboxed transform-data execution (cloudflare-worker/runtype-sandbox providers).
-* Mirrors the inline union on TransformDataStep.config.networkAccess: 'off' (default), 'on', or an explicit allowlist.
-* Lives here rather than the api validator because it's transform-data-specific.
-*/
-const transformDataNetworkAccessSchema = union([
-	literal("off"),
-	literal("on"),
-	object({ allowedHostnames: array(string()).min(1) })
-]);
-/**
 * Canonical transform-data config, the strict field set only; superset of the prior validator and TransformDataStep.config.
 * errorHandling tightens to the canonical union (prod-verified safe: of 1654 steps, only 4 carry it, all valid).
 * inputMode/packageJson/persistSandbox/reuseSandboxId are recovered fields the validator silently stripped.
@@ -16256,7 +16533,7 @@ const transformDataConfigSchema = object({
 	packageJson: string().optional(),
 	persistSandbox: boolean().optional(),
 	reuseSandboxId: string().optional(),
-	networkAccess: transformDataNetworkAccessSchema.optional(),
+	networkAccess: sandboxNetworkAccessSchema.optional(),
 	inference: boolean().optional(),
 	errorHandling: contextErrorHandlingConfigSchema.optional(),
 	defaultValue: any().optional(),
@@ -18302,71 +18579,6 @@ function sanitizeCodeToolIdentifier(name) {
 	return safe;
 }
 /**
-* Sandbox provider capability table, the single source of truth for which `transform-data` sandbox provider runs which language.
-* #6521 needed the same provider/language relation in four places; the first draft forked it into four unpinned hand-copies.
-* This module is a pure leaf (no imports, no I/O) so every layer can depend on it; the table MIRRORS `TransformSandboxRouter`, asserted entry-for-entry by `apps/api/tests/flow-eligibility-facts.test.ts`.
-* Since `transform-data` continues on error by default, anything this table cannot vouch for must route to the legacy engine rather than silently produce wrong data.
-*/
-/**
-* The provider a `transform-data` step gets when `config.sandboxProvider` is
-* unset. Mirrors the default in `TransformSandboxRouter.selectExecutor` and in
-* the legacy `ApiContextStepExecutor.executeJavaScriptTransform`.
-*/
-const DEFAULT_SANDBOX_PROVIDER = "cloudflare-worker";
-/**
-* Every routable provider mapped to the languages its executor declares.
-* PROTOTYPE-LESS ON PURPOSE: the provider string is attacker-controlled on unauthenticated validation routes with no enum check in front.
-* On a normal object literal, `SANDBOX_PROVIDER_LANGUAGES['constructor']` resolves truthy and the following `.includes` throws, surfacing as a 500.
-* `Object.create(null)` plus an `Object.hasOwn` gate in `lookupLanguages` both close it; kept together since this table is read from four packages.
-*/
-const SANDBOX_PROVIDER_LANGUAGES = Object.assign(Object.create(null), {
-	quickjs: ["javascript"],
-	"cloudflare-worker": ["javascript"],
-	"runtype-sandbox": [
-		"javascript",
-		"typescript",
-		"python"
-	],
-	"cloudflare-sandbox": [
-		"javascript",
-		"typescript",
-		"python"
-	],
-	daytona: [
-		"javascript",
-		"typescript",
-		"python"
-	]
-});
-/** Normalize an unset / non-string provider to the documented default. */
-function resolveSandboxProvider(provider) {
-	return typeof provider === "string" ? provider : DEFAULT_SANDBOX_PROVIDER;
-}
-/**
-* The one lookup every predicate below goes through. Returns `undefined` for
-* anything that is not an OWN entry, so an inherited key can never be mistaken
-* for a provider — see the note on {@link SANDBOX_PROVIDER_LANGUAGES}.
-*/
-function lookupLanguages(provider) {
-	const resolved = resolveSandboxProvider(provider);
-	if (!Object.prototype.hasOwnProperty.call(SANDBOX_PROVIDER_LANGUAGES, resolved)) return void 0;
-	const languages = SANDBOX_PROVIDER_LANGUAGES[resolved];
-	return Array.isArray(languages) ? languages : void 0;
-}
-/** Providers whose executor runs JavaScript and nothing else — the Cloudflare Worker Loader and in-process QuickJS. */
-function isJsOnlySandboxProvider(provider) {
-	const languages = lookupLanguages(provider);
-	return languages !== void 0 && languages.length === 1 && languages[0] === "javascript";
-}
-/**
-* Can a `transform-data` step on this provider bind a code-mode tool pool? ONLY `cloudflare-worker`.
-* This is narrower than `isJsOnlySandboxProvider` and the gap is deliberate: the seam is the api's `SANDBOX.workerLoaderExecuteTransformWithTools` RPC, which exists for Worker Loader alone.
-* Legacy and the dashboard both gate on this same single provider.
-*/
-function supportsCodeModeToolPool(provider) {
-	return resolveSandboxProvider(provider) === "cloudflare-worker";
-}
-/**
 * Convert snake_case string to camelCase
 * @example snakeToCamel('flow_name') // 'flowName'
 * @example snakeToCamel('user_id') // 'userId'
@@ -20825,6 +21037,25 @@ function validateCodeModeConfig(value, stepTools, stepIndex, stepRef) {
 	}
 	return null;
 }
+/**
+* Pure half of the custom-tool egress rules (#8103): a runtime `custom` tool whose
+* `networkAccess` / `secrets` its provider cannot honor, or whose secret is sent to
+* a host its own networkAccess blocks. The api's validateRuntimeTools enforces the same rules at dispatch.
+*/
+function validateCustomToolEgress(tools, stepIndex, stepRef, buckets) {
+	if (!Array.isArray(tools.runtimeTools)) return;
+	tools.runtimeTools.forEach((tool, toolIndex) => {
+		if (!isRecord$1(tool) || tool.toolType !== "custom") return;
+		const toolName = typeof tool.name === "string" ? tool.name : `#${toolIndex}`;
+		for (const issue of collectCustomToolEgressIssues(tool.config)) addIssue("error", {
+			code: issue.code,
+			message: `Custom tool "${toolName}": ${issue.message}`,
+			path: `flowSteps[${stepIndex}].config.tools.runtimeTools[${toolIndex}].config.${issue.path}`,
+			step: stepRef,
+			details: { toolName }
+		}, buckets);
+	});
+}
 function validateTransformDataCodeTools(toolsConfig, stepIndex, stepRef, buckets) {
 	const runtimeTools = Array.isArray(toolsConfig.runtimeTools) ? toolsConfig.runtimeTools : [];
 	const runtimeToolNames = [];
@@ -21008,6 +21239,7 @@ function collectFlowStructureIssues(flowData, deps, buckets) {
 					step: stepRef
 				}, buckets);
 			}
+			validateCustomToolEgress(step.config.tools, stepIndex, stepRef, buckets);
 			if (step.type === "transform-data") validateTransformDataCodeTools(step.config.tools, stepIndex, stepRef, buckets);
 			const subagentCfg = step.config.tools.subagentConfig;
 			if (subagentCfg !== void 0) {
@@ -23204,7 +23436,8 @@ const FORWARDED_CORE_CODES = /* @__PURE__ */ new Set([
 	TOOL_CALL_ERROR_HANDLING_IGNORED_CODE,
 	EXECUTE_AGENT_TEMPLATED_REF_UNRUNNABLE_CODE,
 	PROVIDER_TOOLS_MIXED_OWNERS_CODE,
-	FLOW_TOOL_OUTPUT_VARIABLE_RESERVED_CODE
+	FLOW_TOOL_OUTPUT_VARIABLE_RESERVED_CODE,
+	...CUSTOM_TOOL_EGRESS_ISSUE_CODES
 ]);
 function validateFlowDefinition(flow, capIndex, context) {
 	const result = emptyResult();
@@ -23408,6 +23641,10 @@ function memoryPointerIssues(memory, context, path) {
 * v2 nested-`config` shape. The v2 branch reads the equivalent fields from
 * `agent.config` and reports them under `.config.*` paths.
 */
+/** Same egress rules the pure flow validator's validateCustomToolEgress applies (#8103), for AGENT-level runtimeTools. */
+function pushCustomToolEgressIssues(config, configPath, result) {
+	for (const issue of collectCustomToolEgressIssues(config)) result.errors.push(createIssue("error", issue.code, issue.message, `${configPath}.${issue.path}`));
+}
 function validateAgentDefinition(agent, capIndex) {
 	const result = emptyResult();
 	const base = `capabilities[${capIndex}].agent`;
@@ -23451,6 +23688,7 @@ function validateFlatAgent(agent, base, result) {
 			const outputVariableIssue = flowToolOutputVariableIssue(tool.config?.outputVariable, `${base}.toolsConfig.runtimeTools[${i}].config.outputVariable`);
 			if (outputVariableIssue) result.errors.push(outputVariableIssue);
 		}
+		if (tool.toolType === "custom") pushCustomToolEgressIssues(tool.config, `${base}.toolsConfig.runtimeTools[${i}].config`, result);
 	}
 }
 function validateNestedAgent(agent, base, result) {
@@ -23476,6 +23714,7 @@ function validateNestedAgent(agent, base, result) {
 			const outputVariableIssue = flowToolOutputVariableIssue(tool.config?.outputVariable, `${base}.config.tools.runtimeTools[${i}].config.outputVariable`);
 			if (outputVariableIssue) result.errors.push(outputVariableIssue);
 		}
+		if (tool.toolType === "custom") pushCustomToolEgressIssues(tool.config, `${base}.config.tools.runtimeTools[${i}].config`, result);
 	}
 }
 const KEBAB_CASE_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
@@ -24226,20 +24465,6 @@ function isNonAIProvider(id) {
 	if (colonIndex > 0) return NON_AI_PROVIDER_IDS.has(normalized.slice(0, colonIndex));
 	return false;
 }
-const injectionModeSchema = _enum([
-	"bearer_header",
-	"api_key_header",
-	"query_param",
-	"basic_auth"
-]);
-const credentialProxyConfigSchema = object({
-	secretKey: string().min(1),
-	hostnamePattern: string().min(1),
-	pathPattern: string().default("/*"),
-	injectionMode: injectionModeSchema,
-	injectionConfig: record(string(), unknown()).default({}),
-	envVarName: string().optional()
-});
 const LocalInferenceSurfaceSchema = _enum([
 	"playground",
 	"flows",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runtypelabs/cli",
-  "version": "2.42.3",
+  "version": "2.42.4",
   "description": "Command-line interface for Runtype AI platform",
   "type": "module",
   "main": "dist/index.js",
@@ -11,7 +11,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/core": "2.0.0",
     "@runtypelabs/ink-components": "0.3.9",
-    "@runtypelabs/sdk": "10.5.3",
+    "@runtypelabs/sdk": "10.6.0",
     "@runtypelabs/terminal-animations": "0.2.4",
     "add-mcp": "2.0.0",
     "chalk": "^5.3.0",
@@ -33,7 +33,7 @@
   "devDependencies": {
     "@modelcontextprotocol/server": "2.0.0",
     "@runtypelabs/persona": "4.24.0",
-    "@runtypelabs/shared": "3.66.0",
+    "@runtypelabs/shared": "3.67.0",
     "@types/express": "^5.0.6",
     "@types/micromatch": "^4.0.9",
     "@types/node": "^25.3.3",