@runtypelabs/cli 2.42.3 → 2.43.0

package/dist/index.js

@@ -11312,7 +11312,7 @@ function isDataConnectionToolId(toolId) {
 	return toolId.startsWith("dc:");
 }
 //#endregion
-//#region ../shared/dist/chunk-DTCym20H.mjs
+//#region ../shared/dist/chunk-CN8mv6N6.mjs
 /**
 * Maps model families to provider-specific model IDs.
 * Use for routing: family + provider → exact model ID
@@ -11745,6 +11745,11 @@ const MODEL_FAMILY_PROVIDER_IDS = {
 		"vercel": "openai/gpt-5.6-terra"
 	},
 	"gpt-5.6-terra-fast": { "vercel": "openai/gpt-5.6-terra-fast" },
+	"gpt-6-1-sol": {
+		"openai": "gpt-6.1-sol",
+		"vercel": "openai/gpt-6.1-sol"
+	},
+	"gpt-6-1-sol-fast": { "vercel": "openai/gpt-6.1-sol-fast" },
 	"gpt-6-astra": {
 		"openai": "gpt-6-astra",
 		"vercel": "openai/gpt-6-astra"
@@ -11760,6 +11765,11 @@ const MODEL_FAMILY_PROVIDER_IDS = {
 		"vercel": "openai/gpt-6-sol"
 	},
 	"gpt-6-sol-fast": { "vercel": "openai/gpt-6-sol-fast" },
+	"gpt-6.1-sol": {
+		"openai": "gpt-6.1-sol",
+		"vercel": "openai/gpt-6.1-sol"
+	},
+	"gpt-6.1-sol-fast": { "vercel": "openai/gpt-6.1-sol-fast" },
 	"gpt-image-1-5": { "openai": "gpt-image-1.5" },
 	"gpt-image-1-mini": { "openai": "gpt-image-1-mini" },
 	"gpt-image-1.5": { "openai": "gpt-image-1.5" },
@@ -11848,10 +11858,14 @@ const MODEL_FAMILY_PROVIDER_IDS = {
 	"ling-3-0-flash-sante": { "vercel": "inclusionai/ling-3.0-flash-sante" },
 	"ling-3-0-flash-sante-free": { "vercel": "inclusionai/ling-3.0-flash-sante-free" },
 	"ling-3-0-flash-vl": { "vercel": "inclusionai/ling-3.0-flash-vl" },
+	"ling-3-1-flash": { "vercel": "inclusionai/ling-3.1-flash" },
+	"ling-3-1-flash-free": { "vercel": "inclusionai/ling-3.1-flash-free" },
 	"ling-3.0-flash": { "vercel": "inclusionai/ling-3.0-flash" },
 	"ling-3.0-flash-sante": { "vercel": "inclusionai/ling-3.0-flash-sante" },
 	"ling-3.0-flash-sante-free": { "vercel": "inclusionai/ling-3.0-flash-sante-free" },
 	"ling-3.0-flash-vl": { "vercel": "inclusionai/ling-3.0-flash-vl" },
+	"ling-3.1-flash": { "vercel": "inclusionai/ling-3.1-flash" },
+	"ling-3.1-flash-free": { "vercel": "inclusionai/ling-3.1-flash-free" },
 	"llama-3.1-70b": { "vercel": "meta/llama-3.1-70b" },
 	"llama-3.1-8b": { "vercel": "meta/llama-3.1-8b" },
 	"llama-3.3-70b": { "vercel": "meta/llama-3.3-70b" },
@@ -12265,7 +12279,7 @@ const CREATOR_TO_PROVIDER = {
 	"unknown": "openai"
 };
 //#endregion
-//#region ../shared/dist/chunk-CZWIfVCf.mjs
+//#region ../shared/dist/chunk-AzlYBwl7.mjs
 /**
 * The reserved model-facing name of the agent state write tool
 * (`packages/runtime/src/engine/state-write-tool.ts`). The model is told to call
@@ -12464,7 +12478,7 @@ const GEN_AI_ATTRIBUTES = {
 	toolCallId: "gen_ai.tool.call.id"
 };
 //#endregion
-//#region ../shared/dist/chunk-DEoSlEa_.mjs
+//#region ../shared/dist/chunk-B1SxgkWd.mjs
 /**
 * GenAI semconv content attributes, set by a customer's own instrumentation when it opts into content export.
 * Two first-party producers write them: @runtypelabs/runtime's OTLP tracer for exported agents (content on by default), and @runtypelabs/flue-otel (opt-in).
@@ -14828,6 +14842,11 @@ _enum([
 	"pending"
 ]);
 /**
+* Pattern enforced by `SecretStoreService.validateSecretKey`:
+* `/^[A-Z][A-Z0-9_]{0,98}[A-Z0-9]$/`. Keep in sync if that validator changes.
+*/
+const SECRET_KEY_PATTERN = /^[A-Z][A-Z0-9_]{0,98}[A-Z0-9]$/;
+/**
 * Operator allowlist for a single filter condition. No raw SQL passthrough —
 * the SQL compiler maps each operator to a parameterized fragment.
 */
@@ -15221,7 +15240,7 @@ const memoryConfigSchema = object({
 * With 'open', a prompt-injected agent can exfiltrate context to any host; no separate plan entitlement restricts it.
 * Revisit with a Schematic entitlement if/when sandbox egress becomes plan-differentiated.
 */
-const sandboxNetworkAccessSchema = union([_enum([
+const sandboxNetworkAccessSchema$1 = union([_enum([
 	"none",
 	"essentials",
 	"open"
@@ -15253,7 +15272,7 @@ const sandboxConfigSchema = object({
 		"standard-3",
 		"standard-4"
 	]).optional().describe("Only standard-4 is supported on the hosted Agent Sandbox path; other sizes cannot be enabled."),
-	networkAccess: sandboxNetworkAccessSchema.optional(),
+	networkAccess: sandboxNetworkAccessSchema$1.optional(),
 	ttl: _enum([
 		"5m",
 		"1h",
@@ -15428,6 +15447,288 @@ const agentRuntimeConfigSchema = object({
 	durability: agentDurabilityConfigSchema.optional(),
 	state: agentStateChannelSchema.optional()
 }).strict();
+const injectionModeSchema = _enum([
+	"bearer_header",
+	"api_key_header",
+	"query_param",
+	"basic_auth"
+]);
+const credentialProxyConfigSchema = object({
+	secretKey: string().min(1),
+	hostnamePattern: string().min(1),
+	pathPattern: string().default("/*"),
+	injectionMode: injectionModeSchema,
+	injectionConfig: record(string(), unknown()).default({}),
+	envVarName: string().optional()
+});
+/**
+* Sandbox provider capability table, the single source of truth for which `transform-data` sandbox provider runs which language.
+* #6521 needed the same provider/language relation in four places; the first draft forked it into four unpinned hand-copies.
+* This module is a pure leaf (no imports, no I/O) so every layer can depend on it; the table MIRRORS `TransformSandboxRouter`, asserted entry-for-entry by `apps/api/tests/flow-eligibility-facts.test.ts`.
+* Since `transform-data` continues on error by default, anything this table cannot vouch for must route to the legacy engine rather than silently produce wrong data.
+*/
+/**
+* The provider a `transform-data` step gets when `config.sandboxProvider` is
+* unset. Mirrors the default in `TransformSandboxRouter.selectExecutor` and in
+* the legacy `ApiContextStepExecutor.executeJavaScriptTransform`.
+*/
+const DEFAULT_SANDBOX_PROVIDER = "cloudflare-worker";
+/**
+* Every routable provider mapped to the languages its executor declares.
+* PROTOTYPE-LESS ON PURPOSE: the provider string is attacker-controlled on unauthenticated validation routes with no enum check in front.
+* On a normal object literal, `SANDBOX_PROVIDER_LANGUAGES['constructor']` resolves truthy and the following `.includes` throws, surfacing as a 500.
+* `Object.create(null)` plus an `Object.hasOwn` gate in `lookupLanguages` both close it; kept together since this table is read from four packages.
+*/
+const SANDBOX_PROVIDER_LANGUAGES = Object.assign(Object.create(null), {
+	quickjs: ["javascript"],
+	"cloudflare-worker": ["javascript"],
+	"runtype-sandbox": [
+		"javascript",
+		"typescript",
+		"python"
+	],
+	"cloudflare-sandbox": [
+		"javascript",
+		"typescript",
+		"python"
+	],
+	daytona: [
+		"javascript",
+		"typescript",
+		"python"
+	]
+});
+/** Normalize an unset / non-string provider to the documented default. */
+function resolveSandboxProvider(provider) {
+	return typeof provider === "string" ? provider : DEFAULT_SANDBOX_PROVIDER;
+}
+/**
+* The one lookup every predicate below goes through. Returns `undefined` for
+* anything that is not an OWN entry, so an inherited key can never be mistaken
+* for a provider — see the note on {@link SANDBOX_PROVIDER_LANGUAGES}.
+*/
+function lookupLanguages(provider) {
+	const resolved = resolveSandboxProvider(provider);
+	if (!Object.prototype.hasOwnProperty.call(SANDBOX_PROVIDER_LANGUAGES, resolved)) return void 0;
+	const languages = SANDBOX_PROVIDER_LANGUAGES[resolved];
+	return Array.isArray(languages) ? languages : void 0;
+}
+/** Providers whose executor runs JavaScript and nothing else — the Cloudflare Worker Loader and in-process QuickJS. */
+function isJsOnlySandboxProvider(provider) {
+	const languages = lookupLanguages(provider);
+	return languages !== void 0 && languages.length === 1 && languages[0] === "javascript";
+}
+/**
+* Can a `transform-data` step on this provider bind a code-mode tool pool? ONLY `cloudflare-worker`.
+* This is narrower than `isJsOnlySandboxProvider` and the gap is deliberate: the seam is the api's `SANDBOX.workerLoaderExecuteTransformWithTools` RPC, which exists for Worker Loader alone.
+* Legacy and the dashboard both gate on this same single provider.
+*/
+function supportsCodeModeToolPool(provider) {
+	return resolveSandboxProvider(provider) === "cloudflare-worker";
+}
+/**
+* Sandbox egress posture shared by `transform-data` steps and `custom` tools:
+* `'off'` (the default when omitted), `'on'`, or an explicit hostname allowlist.
+*/
+const sandboxNetworkAccessSchema = union([
+	literal("off"),
+	literal("on"),
+	object({ allowedHostnames: array(string()).min(1) })
+]);
+/**
+* One managed secret a `custom` tool may send, and where. Code sees only the
+* phantom token as `secrets.<key>`; the sandbox egress proxy swaps in the real
+* credential for requests that match `hostnamePattern` and `pathPattern`.
+*/
+const customToolSecretSchema = object({
+	key: string().regex(SECRET_KEY_PATTERN, "key must be a managed secret name, e.g. GITHUB_TOKEN"),
+	hostnamePattern: string().min(1),
+	pathPattern: string().min(1).optional(),
+	injectionMode: injectionModeSchema,
+	injectionConfig: record(string(), unknown()).optional()
+});
+/** Every code {@link collectCustomToolEgressIssues} can emit, for validators that forward core codes. */
+const CUSTOM_TOOL_EGRESS_ISSUE_CODES = [
+	"CUSTOM_TOOL_EGRESS_CONFIG_INVALID",
+	"CUSTOM_TOOL_EGRESS_PROVIDER_UNSUPPORTED",
+	"CUSTOM_TOOL_SECRET_HOST_NOT_ALLOWED"
+];
+/**
+* Shared-hosting suffixes where every subdomain belongs to a different tenant, so
+* `*.<suffix>` would send a credential to strangers. Curated from the Public Suffix
+* List's private section; extend it when a new host platform shows up.
+*/
+const SHARED_HOSTING_SUFFIXES = /* @__PURE__ */ new Set([
+	"github.io",
+	"gitlab.io",
+	"pages.dev",
+	"workers.dev",
+	"vercel.app",
+	"netlify.app",
+	"herokuapp.com",
+	"azurewebsites.net",
+	"cloudfront.net",
+	"appspot.com",
+	"firebaseapp.com",
+	"web.app",
+	"onrender.com",
+	"fly.dev",
+	"glitch.me",
+	"repl.co",
+	"replit.app",
+	"deno.dev",
+	"railway.app",
+	"ngrok.io",
+	"ngrok-free.app",
+	"trycloudflare.com",
+	"blogspot.com",
+	"wordpress.com",
+	"s3.amazonaws.com",
+	"amplifyapp.com",
+	"azurestaticapps.net",
+	"surge.sh",
+	"myshopify.com"
+]);
+/** Second-level labels that registries sell under a two-letter country code (co.uk, com.au, ne.jp). */
+const COUNTRY_SECOND_LEVELS = /* @__PURE__ */ new Set([
+	"ac",
+	"co",
+	"com",
+	"edu",
+	"gov",
+	"go",
+	"ne",
+	"net",
+	"or",
+	"org",
+	"ltd",
+	"plc",
+	"nom",
+	"gob",
+	"mil"
+]);
+/** Is `domain` a public suffix (a registry or shared-hosting zone), not one owner's domain? */
+function isPublicSuffixDomain(domain) {
+	const host = domain.toLowerCase().replace(/\.+$/, "");
+	if (SHARED_HOSTING_SUFFIXES.has(host)) return true;
+	const labels = host.split(".");
+	if (labels.length === 1) return true;
+	if (labels.length !== 2) return false;
+	const [second = "", top = ""] = labels;
+	return top.length === 2 && COUNTRY_SECOND_LEVELS.has(second);
+}
+/**
+* A secret's hostname pattern must name one public DNS host (`api.github.com`) or one
+* domain's subdomains (`*.github.com`): never a TLD, a public suffix (`*.co.uk`,
+* `*.github.io`), everything, an IP literal, `localhost`, or an `.internal` name.
+*/
+function isConcreteSecretHostnamePattern(pattern) {
+	const wildcard = pattern.startsWith("*.");
+	const host = (wildcard ? pattern.slice(2) : pattern).toLowerCase();
+	if (host.includes("*")) return false;
+	const labels = host.split(".");
+	if (labels.length < 2) return false;
+	if (labels.some((label) => !/^[a-z0-9-]+$/.test(label))) return false;
+	const topLevel = labels[labels.length - 1] ?? "";
+	if (!/[a-z]/.test(topLevel)) return false;
+	if (topLevel === "internal" || topLevel === "local" || topLevel === "localhost") return false;
+	return !(wildcard && isPublicSuffixDomain(host));
+}
+/** Is every host `secretPattern` can match also allowed by the tool's network posture? */
+function networkAccessCoversHostnamePattern(networkAccess, secretPattern) {
+	if (networkAccess === "on") return true;
+	if (networkAccess === "off") return false;
+	return networkAccess.allowedHostnames.some((allowed) => {
+		if (allowed === secretPattern) return true;
+		if (!allowed.startsWith("*.")) return false;
+		const suffix = allowed.slice(1);
+		return (secretPattern.startsWith("*.") ? secretPattern.slice(1) : secretPattern).endsWith(suffix);
+	});
+}
+const PROVIDERS_WITHOUT_EGRESS_PROXY = /* @__PURE__ */ new Set(["quickjs"]);
+const PROVIDERS_WITHOUT_SECRET_PROXY = /* @__PURE__ */ new Set(["quickjs", "daytona"]);
+const EGRESS_PROVIDER_REMEDIATION = "Set sandboxProvider to \"cloudflare-worker\" (JavaScript) or \"runtype-sandbox\" (JavaScript, TypeScript, Python).";
+/**
+* Pure checks on a custom tool's `networkAccess` / `secrets` against its provider.
+* Returns every issue so validators can surface them together.
+*/
+function collectCustomToolEgressIssues(config) {
+	if (!isRecord$1(config)) return [];
+	const issues = [];
+	const provider = resolveSandboxProvider(config.sandboxProvider);
+	const networkParse = config.networkAccess === void 0 ? void 0 : sandboxNetworkAccessSchema.safeParse(config.networkAccess);
+	if (networkParse && !networkParse.success) issues.push({
+		code: "CUSTOM_TOOL_EGRESS_CONFIG_INVALID",
+		message: `networkAccess must be 'off', 'on', or { allowedHostnames: [...] } with at least one hostname.`,
+		path: "networkAccess"
+	});
+	const networkAccess = networkParse?.success === true ? networkParse.data : "off";
+	if (networkAccess !== "off" && PROVIDERS_WITHOUT_EGRESS_PROXY.has(provider)) issues.push({
+		code: "CUSTOM_TOOL_EGRESS_PROVIDER_UNSUPPORTED",
+		message: `sandboxProvider "${provider}" has no fetch and no egress proxy, so networkAccess cannot be enabled. ${EGRESS_PROVIDER_REMEDIATION}`,
+		path: "networkAccess"
+	});
+	if (typeof networkAccess === "object" && provider === "daytona") issues.push({
+		code: "CUSTOM_TOOL_EGRESS_PROVIDER_UNSUPPORTED",
+		message: `sandboxProvider "daytona" manages its own egress and cannot enforce an allowedHostnames list. ${EGRESS_PROVIDER_REMEDIATION}`,
+		path: "networkAccess"
+	});
+	if (config.secrets === void 0) return issues;
+	if (!Array.isArray(config.secrets)) {
+		issues.push({
+			code: "CUSTOM_TOOL_EGRESS_CONFIG_INVALID",
+			message: "secrets must be an array of { key, hostnamePattern, injectionMode } entries.",
+			path: "secrets"
+		});
+		return issues;
+	}
+	if (config.secrets.length === 0) return issues;
+	if (PROVIDERS_WITHOUT_SECRET_PROXY.has(provider)) issues.push({
+		code: "CUSTOM_TOOL_EGRESS_PROVIDER_UNSUPPORTED",
+		message: `sandboxProvider "${provider}" has no credential proxy, so managed secrets cannot be injected. ${EGRESS_PROVIDER_REMEDIATION}`,
+		path: "secrets"
+	});
+	if (config.secrets.length > 10) issues.push({
+		code: "CUSTOM_TOOL_EGRESS_CONFIG_INVALID",
+		message: `A custom tool can declare at most 10 secrets.`,
+		path: "secrets"
+	});
+	const seenKeys = /* @__PURE__ */ new Set();
+	config.secrets.forEach((entry, index) => {
+		const path = `secrets[${index}]`;
+		const parsed = customToolSecretSchema.safeParse(entry);
+		if (!parsed.success) {
+			const first = parsed.error.issues[0];
+			issues.push({
+				code: "CUSTOM_TOOL_EGRESS_CONFIG_INVALID",
+				message: `Invalid secret entry: ${first?.path.join(".") || "entry"} ${first?.message ?? "is invalid"}. Use the bare secret name as key (GITHUB_TOKEN, not {{secret:GITHUB_TOKEN}}).`,
+				path
+			});
+			return;
+		}
+		const secret = parsed.data;
+		if (seenKeys.has(secret.key)) issues.push({
+			code: "CUSTOM_TOOL_EGRESS_CONFIG_INVALID",
+			message: `Secret "${secret.key}" is declared twice. Declare each secret once; it is injected for one hostname pattern.`,
+			path: `${path}.key`
+		});
+		seenKeys.add(secret.key);
+		if (!isConcreteSecretHostnamePattern(secret.hostnamePattern)) {
+			issues.push({
+				code: "CUSTOM_TOOL_EGRESS_CONFIG_INVALID",
+				message: `Secret "${secret.key}" hostnamePattern "${secret.hostnamePattern}" is not a single public host. Name the API host (api.github.com) or one domain's subdomains (*.github.com); public suffixes (*.co.uk, *.github.io), IP literals, localhost and internal names are refused.`,
+				path: `${path}.hostnamePattern`
+			});
+			return;
+		}
+		if (!networkAccessCoversHostnamePattern(networkAccess, secret.hostnamePattern)) issues.push({
+			code: "CUSTOM_TOOL_SECRET_HOST_NOT_ALLOWED",
+			message: `Secret "${secret.key}" is sent to "${secret.hostnamePattern}", but networkAccess does not allow that host. Add it to networkAccess.allowedHostnames.`,
+			path: `${path}.hostnamePattern`
+		});
+	});
+	return issues;
+}
 /**
 * A single entry in a context-step fallback chain. Mirrors `ContextFallback`
 * (`retry` | `step` | `flow`) in `error-handling.ts`. Discriminated by `type`.
@@ -16220,16 +16521,6 @@ const updateRecordConfigSchema = object({
 	defaultValue: any().optional()
 });
 /**
-* Network-access policy for sandboxed transform-data execution (cloudflare-worker/runtype-sandbox providers).
-* Mirrors the inline union on TransformDataStep.config.networkAccess: 'off' (default), 'on', or an explicit allowlist.
-* Lives here rather than the api validator because it's transform-data-specific.
-*/
-const transformDataNetworkAccessSchema = union([
-	literal("off"),
-	literal("on"),
-	object({ allowedHostnames: array(string()).min(1) })
-]);
-/**
 * Canonical transform-data config, the strict field set only; superset of the prior validator and TransformDataStep.config.
 * errorHandling tightens to the canonical union (prod-verified safe: of 1654 steps, only 4 carry it, all valid).
 * inputMode/packageJson/persistSandbox/reuseSandboxId are recovered fields the validator silently stripped.
@@ -16256,7 +16547,7 @@ const transformDataConfigSchema = object({
 	packageJson: string().optional(),
 	persistSandbox: boolean().optional(),
 	reuseSandboxId: string().optional(),
-	networkAccess: transformDataNetworkAccessSchema.optional(),
+	networkAccess: sandboxNetworkAccessSchema.optional(),
 	inference: boolean().optional(),
 	errorHandling: contextErrorHandlingConfigSchema.optional(),
 	defaultValue: any().optional(),
@@ -18302,71 +18593,6 @@ function sanitizeCodeToolIdentifier(name) {
 	return safe;
 }
 /**
-* Sandbox provider capability table, the single source of truth for which `transform-data` sandbox provider runs which language.
-* #6521 needed the same provider/language relation in four places; the first draft forked it into four unpinned hand-copies.
-* This module is a pure leaf (no imports, no I/O) so every layer can depend on it; the table MIRRORS `TransformSandboxRouter`, asserted entry-for-entry by `apps/api/tests/flow-eligibility-facts.test.ts`.
-* Since `transform-data` continues on error by default, anything this table cannot vouch for must route to the legacy engine rather than silently produce wrong data.
-*/
-/**
-* The provider a `transform-data` step gets when `config.sandboxProvider` is
-* unset. Mirrors the default in `TransformSandboxRouter.selectExecutor` and in
-* the legacy `ApiContextStepExecutor.executeJavaScriptTransform`.
-*/
-const DEFAULT_SANDBOX_PROVIDER = "cloudflare-worker";
-/**
-* Every routable provider mapped to the languages its executor declares.
-* PROTOTYPE-LESS ON PURPOSE: the provider string is attacker-controlled on unauthenticated validation routes with no enum check in front.
-* On a normal object literal, `SANDBOX_PROVIDER_LANGUAGES['constructor']` resolves truthy and the following `.includes` throws, surfacing as a 500.
-* `Object.create(null)` plus an `Object.hasOwn` gate in `lookupLanguages` both close it; kept together since this table is read from four packages.
-*/
-const SANDBOX_PROVIDER_LANGUAGES = Object.assign(Object.create(null), {
-	quickjs: ["javascript"],
-	"cloudflare-worker": ["javascript"],
-	"runtype-sandbox": [
-		"javascript",
-		"typescript",
-		"python"
-	],
-	"cloudflare-sandbox": [
-		"javascript",
-		"typescript",
-		"python"
-	],
-	daytona: [
-		"javascript",
-		"typescript",
-		"python"
-	]
-});
-/** Normalize an unset / non-string provider to the documented default. */
-function resolveSandboxProvider(provider) {
-	return typeof provider === "string" ? provider : DEFAULT_SANDBOX_PROVIDER;
-}
-/**
-* The one lookup every predicate below goes through. Returns `undefined` for
-* anything that is not an OWN entry, so an inherited key can never be mistaken
-* for a provider — see the note on {@link SANDBOX_PROVIDER_LANGUAGES}.
-*/
-function lookupLanguages(provider) {
-	const resolved = resolveSandboxProvider(provider);
-	if (!Object.prototype.hasOwnProperty.call(SANDBOX_PROVIDER_LANGUAGES, resolved)) return void 0;
-	const languages = SANDBOX_PROVIDER_LANGUAGES[resolved];
-	return Array.isArray(languages) ? languages : void 0;
-}
-/** Providers whose executor runs JavaScript and nothing else — the Cloudflare Worker Loader and in-process QuickJS. */
-function isJsOnlySandboxProvider(provider) {
-	const languages = lookupLanguages(provider);
-	return languages !== void 0 && languages.length === 1 && languages[0] === "javascript";
-}
-/**
-* Can a `transform-data` step on this provider bind a code-mode tool pool? ONLY `cloudflare-worker`.
-* This is narrower than `isJsOnlySandboxProvider` and the gap is deliberate: the seam is the api's `SANDBOX.workerLoaderExecuteTransformWithTools` RPC, which exists for Worker Loader alone.
-* Legacy and the dashboard both gate on this same single provider.
-*/
-function supportsCodeModeToolPool(provider) {
-	return resolveSandboxProvider(provider) === "cloudflare-worker";
-}
-/**
 * Convert snake_case string to camelCase
 * @example snakeToCamel('flow_name') // 'flowName'
 * @example snakeToCamel('user_id') // 'userId'
@@ -20825,6 +21051,25 @@ function validateCodeModeConfig(value, stepTools, stepIndex, stepRef) {
 	}
 	return null;
 }
+/**
+* Pure half of the custom-tool egress rules (#8103): a runtime `custom` tool whose
+* `networkAccess` / `secrets` its provider cannot honor, or whose secret is sent to
+* a host its own networkAccess blocks. The api's validateRuntimeTools enforces the same rules at dispatch.
+*/
+function validateCustomToolEgress(tools, stepIndex, stepRef, buckets) {
+	if (!Array.isArray(tools.runtimeTools)) return;
+	tools.runtimeTools.forEach((tool, toolIndex) => {
+		if (!isRecord$1(tool) || tool.toolType !== "custom") return;
+		const toolName = typeof tool.name === "string" ? tool.name : `#${toolIndex}`;
+		for (const issue of collectCustomToolEgressIssues(tool.config)) addIssue("error", {
+			code: issue.code,
+			message: `Custom tool "${toolName}": ${issue.message}`,
+			path: `flowSteps[${stepIndex}].config.tools.runtimeTools[${toolIndex}].config.${issue.path}`,
+			step: stepRef,
+			details: { toolName }
+		}, buckets);
+	});
+}
 function validateTransformDataCodeTools(toolsConfig, stepIndex, stepRef, buckets) {
 	const runtimeTools = Array.isArray(toolsConfig.runtimeTools) ? toolsConfig.runtimeTools : [];
 	const runtimeToolNames = [];
@@ -21008,6 +21253,7 @@ function collectFlowStructureIssues(flowData, deps, buckets) {
 					step: stepRef
 				}, buckets);
 			}
+			validateCustomToolEgress(step.config.tools, stepIndex, stepRef, buckets);
 			if (step.type === "transform-data") validateTransformDataCodeTools(step.config.tools, stepIndex, stepRef, buckets);
 			const subagentCfg = step.config.tools.subagentConfig;
 			if (subagentCfg !== void 0) {
@@ -23204,7 +23450,8 @@ const FORWARDED_CORE_CODES = /* @__PURE__ */ new Set([
 	TOOL_CALL_ERROR_HANDLING_IGNORED_CODE,
 	EXECUTE_AGENT_TEMPLATED_REF_UNRUNNABLE_CODE,
 	PROVIDER_TOOLS_MIXED_OWNERS_CODE,
-	FLOW_TOOL_OUTPUT_VARIABLE_RESERVED_CODE
+	FLOW_TOOL_OUTPUT_VARIABLE_RESERVED_CODE,
+	...CUSTOM_TOOL_EGRESS_ISSUE_CODES
 ]);
 function validateFlowDefinition(flow, capIndex, context) {
 	const result = emptyResult();
@@ -23408,6 +23655,10 @@ function memoryPointerIssues(memory, context, path) {
 * v2 nested-`config` shape. The v2 branch reads the equivalent fields from
 * `agent.config` and reports them under `.config.*` paths.
 */
+/** Same egress rules the pure flow validator's validateCustomToolEgress applies (#8103), for AGENT-level runtimeTools. */
+function pushCustomToolEgressIssues(config, configPath, result) {
+	for (const issue of collectCustomToolEgressIssues(config)) result.errors.push(createIssue("error", issue.code, issue.message, `${configPath}.${issue.path}`));
+}
 function validateAgentDefinition(agent, capIndex) {
 	const result = emptyResult();
 	const base = `capabilities[${capIndex}].agent`;
@@ -23451,6 +23702,7 @@ function validateFlatAgent(agent, base, result) {
 			const outputVariableIssue = flowToolOutputVariableIssue(tool.config?.outputVariable, `${base}.toolsConfig.runtimeTools[${i}].config.outputVariable`);
 			if (outputVariableIssue) result.errors.push(outputVariableIssue);
 		}
+		if (tool.toolType === "custom") pushCustomToolEgressIssues(tool.config, `${base}.toolsConfig.runtimeTools[${i}].config`, result);
 	}
 }
 function validateNestedAgent(agent, base, result) {
@@ -23476,6 +23728,7 @@ function validateNestedAgent(agent, base, result) {
 			const outputVariableIssue = flowToolOutputVariableIssue(tool.config?.outputVariable, `${base}.config.tools.runtimeTools[${i}].config.outputVariable`);
 			if (outputVariableIssue) result.errors.push(outputVariableIssue);
 		}
+		if (tool.toolType === "custom") pushCustomToolEgressIssues(tool.config, `${base}.config.tools.runtimeTools[${i}].config`, result);
 	}
 }
 const KEBAB_CASE_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
@@ -24226,20 +24479,6 @@ function isNonAIProvider(id) {
 	if (colonIndex > 0) return NON_AI_PROVIDER_IDS.has(normalized.slice(0, colonIndex));
 	return false;
 }
-const injectionModeSchema = _enum([
-	"bearer_header",
-	"api_key_header",
-	"query_param",
-	"basic_auth"
-]);
-const credentialProxyConfigSchema = object({
-	secretKey: string().min(1),
-	hostnamePattern: string().min(1),
-	pathPattern: string().default("/*"),
-	injectionMode: injectionModeSchema,
-	injectionConfig: record(string(), unknown()).default({}),
-	envVarName: string().optional()
-});
 const LocalInferenceSurfaceSchema = _enum([
 	"playground",
 	"flows",
@@ -24874,7 +25113,11 @@ object({
 	externalAgent: object({
 		contextId: string().optional(),
 		taskId: string().optional()
-	}).optional()
+	}).optional(),
+	/** The published agent version the run executed; absent when no stored version ran. */
+	agentVersionId: string().optional(),
+	/** The release alias the version was resolved through (`live`, `staging`, ...), when one was. */
+	alias: string().optional()
 });
 object({
 	recordId: string().optional(),
@@ -36925,7 +37168,7 @@ function createSandboxInstructions(provider) {
 		"{ \"code\": \"...\", \"parameters\": { ... }, \"language\": \"javascript|typescript|python\", \"timeoutMs\": 30000 }",
 		"Runtype Sandbox rules:",
 		"1. Choose one language: javascript, typescript, or python.",
-		"2. Each session is a full Linux container (Node 22, Python 3.12, pnpm, tsx, uv, git).",
+		"2. Each session is a full Linux container (Node 24, Python 3.13 with numpy/pandas/matplotlib, pnpm, tsx, uv, git).",
 		"3. Inputs are available as the `parameters` object (JS/TS) or `parameters` dict (Python).",
 		"4. async/await, Promises, and long-running processes are fully supported.",
 		"5. Write the final result to stdout (JSON string is preferred for structured output).",
@@ -54201,6 +54444,9 @@ function collectExportedExecutionInventory(definition) {
 			walkTools(agent.config.tools);
 		}
 		if (isObject(agent.claudeManagedConfig)) addModel(agent.claudeManagedConfig.model);
+		if (Array.isArray(agent.skills)) {
+			for (const skill of agent.skills) if (isObject(skill)) walkRuntimeTools(skill.resolvedTools);
+		}
 		if (Array.isArray(agent.capabilities)) for (const capability of agent.capabilities) {
 			if (!isObject(capability)) continue;
 			if (isObject(capability.flow)) walkFlow(capability.flow);
@@ -54260,16 +54506,41 @@ function describeAgentExportFailure(err) {
 		if ((err.data && typeof err.data === "object" && "code" in err.data ? err.data.code : void 0) === "BYOC_PLAN_REQUIRED") return ["Self-hosting (BYOC) requires an Enterprise plan. Contact support to enable it for your account.", "The API key also needs the RUNTIME:EXPORT scope."];
 		return ["The API key needs the RUNTIME:EXPORT scope, and self-hosting (BYOC) requires an Enterprise plan."];
 	}
-	if (err.statusCode === 404) return ["Agent not found, or not owned by this account."];
+	if (err.statusCode === 404) {
+		const code = err.data && typeof err.data === "object" && "code" in err.data ? err.data.code : void 0;
+		if (typeof code === "string" && RELEASE_SELECTOR_NOT_FOUND_CODES.has(code)) return ["The requested --alias or --version-id does not exist on this agent, or the alias is archived or expired."];
+		return ["Agent not found, or not owned by this account."];
+	}
 	return [];
 }
+const RELEASE_SELECTOR_NOT_FOUND_CODES = /* @__PURE__ */ new Set([
+	"alias_not_found",
+	"alias_archived",
+	"alias_expired",
+	"version_not_found"
+]);
+/** The export-runtime query for a release selector; errors when both selectors are given. */
+function agentReleaseSelectorParams(options, agentCount) {
+	if (options.alias !== void 0 && options.versionId !== void 0) return { error: "Pass either --alias or --version-id, not both." };
+	if (options.versionId !== void 0 && agentCount !== 1) return { error: "--version-id names one agent version, so pass exactly one --agent with it." };
+	return { params: {
+		...options.alias !== void 0 ? { alias: options.alias } : {},
+		...options.versionId !== void 0 ? { versionId: options.versionId } : {}
+	} };
+}
+function describeExportedRelease(def) {
+	const release = def.release;
+	if (!release?.versionId) return "";
+	const via = release.alias ? ` via ${release.alias}${release.aliasRevision !== void 0 ? ` r${release.aliasRevision}` : ""}` : "";
+	return chalk.dim(` (${release.versionId}${via})`);
+}
 const deployCommand = new Command("deploy").description("Export an agent and scaffold a deployment (cloud-run, cloudflare, or vercel)").option("--agent <id>", "Agent ID to export (may be repeated)", (v, acc) => {
 	acc.push(v);
 	return acc;
 }, []).option("--flow <id>", "Removed (ADR 0024): export the agent that runs the flow instead", (v, acc) => {
 	acc.push(v);
 	return acc;
-}, []).option("--output <dir>", "Output directory for the scaffold (default: ./runtype-deploy)", "./runtype-deploy").option("--name <name>", "Project name used in package.json (default: derived from output dir)").option("--target <target>", "Deployment target: cloud-run, cloudflare, or vercel (default: cloud-run)", "cloud-run").action(async (options) => {
+}, []).option("--output <dir>", "Output directory for the scaffold (default: ./runtype-deploy)", "./runtype-deploy").option("--name <name>", "Project name used in package.json (default: derived from output dir)").option("--target <target>", "Deployment target: cloud-run, cloudflare, or vercel (default: cloud-run)", "cloud-run").option("--alias <name>", "Export the version each agent's release alias points at (e.g. staging, live, pr-42)").option("--version-id <id>", "Export this published agent version (requires exactly one --agent)").action(async (options) => {
 	const agentIds = options.agent;
 	if (options.flow.length > 0) {
 		for (const line of RETIRED_DEPLOY_FLOW_MESSAGE) console.error(chalk.yellow(line));
@@ -54279,6 +54550,11 @@ const deployCommand = new Command("deploy").description("Export an agent and sca
 		console.error(chalk.red("Error: provide at least one --agent <id>"));
 		process.exit(1);
 	}
+	const selector = agentReleaseSelectorParams(options, agentIds.length);
+	if ("error" in selector) {
+		console.error(chalk.red(`Error: ${selector.error}`));
+		process.exit(1);
+	}
 	const target = options.target;
 	if (target !== "cloud-run" && target !== "cloudflare" && target !== "vercel") {
 		console.error(chalk.red(`Error: unknown --target "${target}". Must be one of: cloud-run, cloudflare, vercel`));
@@ -54294,13 +54570,13 @@ const deployCommand = new Command("deploy").description("Export an agent and sca
 	for (const id of agentIds) {
 		process.stdout.write(`  Exporting agent ${chalk.green(id)}... `);
 		try {
-			const def = await client.get(`/agents/${id}/export-runtime`);
+			const def = await client.get(`/agents/${id}/export-runtime`, selector.params);
 			agentDefs.push({
 				id,
 				name: String(def.name ?? id),
 				def
 			});
-			process.stdout.write(chalk.green("✓\n"));
+			process.stdout.write(chalk.green("✓") + describeExportedRelease(def) + "\n");
 		} catch (err) {
 			const msg = err instanceof RuntypeApiError ? err.message : String(err);
 			process.stdout.write(chalk.red(`✗\n`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runtypelabs/cli",
-  "version": "2.42.3",
+  "version": "2.43.0",
   "description": "Command-line interface for Runtype AI platform",
   "type": "module",
   "main": "dist/index.js",
@@ -11,7 +11,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/core": "2.0.0",
     "@runtypelabs/ink-components": "0.3.9",
-    "@runtypelabs/sdk": "10.5.3",
+    "@runtypelabs/sdk": "10.7.0",
     "@runtypelabs/terminal-animations": "0.2.4",
     "add-mcp": "2.0.0",
     "chalk": "^5.3.0",
@@ -33,7 +33,7 @@
   "devDependencies": {
     "@modelcontextprotocol/server": "2.0.0",
     "@runtypelabs/persona": "4.24.0",
-    "@runtypelabs/shared": "3.66.0",
+    "@runtypelabs/shared": "3.68.0",
     "@types/express": "^5.0.6",
     "@types/micromatch": "^4.0.9",
     "@types/node": "^25.3.3",