@runtypelabs/cli 2.53.1 → 2.53.3

package/dist/index.js

@@ -10675,6 +10675,26 @@ function parseRecordCollectionSchema(input) {
 		}))
 	};
 }
+//#endregion
+//#region ../shared/dist/browser-domain-policy.mjs
+function canonicalHostname(hostname) {
+	let end = hostname.length;
+	while (end > 0 && hostname.charCodeAt(end - 1) === 46) end--;
+	return hostname.slice(0, end).toLowerCase();
+}
+const DOMAIN_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const MAX_HOSTNAME_LENGTH = 253;
+/** Trim, lowercase and strip trailing dots, as Stagehand canonicalizes both patterns and hostnames. */
+function canonicalBrowserDomainPattern(pattern) {
+	return canonicalHostname(pattern.trim());
+}
+/** Exactly what Stagehand's `normalizeDomainPattern` accepts, for an already-canonical pattern. */
+function isValidBrowserDomainPattern(pattern) {
+	const hostname = pattern.startsWith("*.") ? pattern.slice(2) : pattern;
+	if (!hostname || hostname.length > MAX_HOSTNAME_LENGTH) return false;
+	const labels = hostname.split(".");
+	return labels.length >= 2 && labels.every((label) => DOMAIN_LABEL.test(label));
+}
 /** Compaction strategies; the config schema's zod enum derives from this tuple so the two cannot drift. */
 const COMPACTION_STRATEGIES = [
 	"auto",
@@ -10796,7 +10816,9 @@ object({
 	schemaTokens: number$1().int().min(0).optional(),
 	passes: number$1().int().min(0).optional()
 });
-const FLOW_STEP_TYPES = ["prompt", ...[
+//#endregion
+//#region ../shared/dist/chunk-BQYclXzM.mjs
+const CONTEXT_STEP_TYPES = [
 	"crawl",
 	"fetch-url",
 	"retrieve-record",
@@ -10827,7 +10849,8 @@ const FLOW_STEP_TYPES = ["prompt", ...[
 	"recall-memory",
 	"memory-summary",
 	"extract"
-]];
+];
+const FLOW_STEP_TYPES = ["prompt", ...CONTEXT_STEP_TYPES];
 //#endregion
 //#region ../shared/dist/durable-poll-limits.mjs
 /**
@@ -11520,7 +11543,7 @@ object({
 	importedAt: string().datetime({ offset: true }).optional()
 });
 //#endregion
-//#region ../shared/dist/chunk-DYf4FR-s.mjs
+//#region ../shared/dist/chunk-DPqK6XE9.mjs
 const voiceInterruptionModeSchema = _enum([
 	"none",
 	"cancel",
@@ -12520,6 +12543,53 @@ function validateBrowserToolConfigsAuth(toolConfigs, ctx) {
 		});
 	});
 }
+const BROWSER_DOMAIN_POLICY_MESSAGES = {
+	notObject: "\"domainPolicy\" must be an object with \"allowedDomains\" and/or \"blockedDomains\" arrays.",
+	empty: "\"domainPolicy\" must list at least one domain in \"allowedDomains\" or \"blockedDomains\".",
+	listEmpty: "\"domainPolicy\" lists must not be empty; omit the key instead (an empty list does not mean \"allow nothing\").",
+	patternShape: "\"domainPolicy\" entries must be bare hostnames such as \"example.com\" or \"*.example.com\" (no scheme, port, path or inner wildcard).",
+	patternIp: "\"domainPolicy\" entries must be DNS hostnames, not IP addresses.",
+	allowedTooMany: "\"domainPolicy.allowedDomains\" accepts at most 50 entries (the Browser Run guardrails limit).",
+	noBrowsing: (toolId) => `"domainPolicy" has no effect on ${toolId}, which takes no browsing action; set it on browser:open, and the session keeps it.`
+};
+/** Session tools that never load a URL; a policy on them would be accepted and silently do nothing. */
+const BROWSER_TOOLS_WITHOUT_DOMAIN_POLICY = /* @__PURE__ */ new Set([
+	"browser:session-info",
+	"browser:close",
+	"browser:get_live_view",
+	"browser:request_handoff",
+	"browser:get_handoff_state"
+]);
+const domainListSchema = array(string({ error: BROWSER_DOMAIN_POLICY_MESSAGES.patternShape }).transform(canonicalBrowserDomainPattern).refine(isValidBrowserDomainPattern, {
+	message: BROWSER_DOMAIN_POLICY_MESSAGES.patternShape,
+	abort: true
+}).refine((pattern) => !isIpLiteralHost(pattern.replace(/^\*\./, "")), { message: BROWSER_DOMAIN_POLICY_MESSAGES.patternIp }), { error: BROWSER_DOMAIN_POLICY_MESSAGES.notObject }).min(1, { message: BROWSER_DOMAIN_POLICY_MESSAGES.listEmpty }).transform((patterns) => [...new Set(patterns)]);
+/** The `domainPolicy` block of a browser tool's config; operator-owned, never set from call arguments. */
+const browserDomainPolicySchema = strictObject({
+	allowedDomains: domainListSchema.refine((patterns) => patterns.length <= 50, { message: BROWSER_DOMAIN_POLICY_MESSAGES.allowedTooMany }).optional(),
+	blockedDomains: domainListSchema.optional()
+}, { error: BROWSER_DOMAIN_POLICY_MESSAGES.notObject }).refine((policy) => policy.allowedDomains !== void 0 || policy.blockedDomains !== void 0, { message: BROWSER_DOMAIN_POLICY_MESSAGES.empty });
+/** Save-time check for every browser tool config that carries a `domainPolicy` block. */
+function validateBrowserToolConfigsDomainPolicy(toolConfigs, ctx) {
+	Object.entries(toolConfigs).filter(([key]) => isBrowserToolConfigKey(key)).filter(([, config]) => "domainPolicy" in config).forEach(([key, config]) => {
+		const toolId = getBuiltInToolById(parseToolInstanceId(key).baseId)?.id ?? key;
+		if (BROWSER_TOOLS_WITHOUT_DOMAIN_POLICY.has(toolId)) {
+			ctx.addIssue({
+				code: "custom",
+				path: [key, "domainPolicy"],
+				message: BROWSER_DOMAIN_POLICY_MESSAGES.noBrowsing(toolId)
+			});
+			return;
+		}
+		browserDomainPolicySchema.safeParse(config.domainPolicy).error?.issues.slice(0, 1).forEach((issue) => {
+			ctx.addIssue({
+				code: "custom",
+				path: [key, "domainPolicy"],
+				message: issue.message
+			});
+		});
+	});
+}
 /** How a conversation is reduced when it approaches the model's context window. */
 const compactionStrategySchema = _enum(COMPACTION_STRATEGIES);
 /**
@@ -12857,7 +12927,7 @@ const agentRuntimeConfigSchema = object({
 	...samplingConfigSchema,
 	tools: object({
 		toolIds: array(string()).optional(),
-		toolConfigs: record(string(), record(string(), unknown())).superRefine(validateBrowserToolConfigsAuth).optional(),
+		toolConfigs: record(string(), record(string(), unknown())).superRefine(validateBrowserToolConfigsAuth).superRefine(validateBrowserToolConfigsDomainPolicy).optional(),
 		runtimeTools: array(object({
 			name: string(),
 			description: string(),
@@ -14586,13 +14656,39 @@ function validateAndNormalizeErrorHandling(value, fieldName, stepType) {
 	}
 	return normalizeErrorHandling(value);
 }
-/**
-* Normalize a context step from API format (snake_case) to internal format (camelCase)
-* Only normalizes known API structure fields, preserves all user data
-* @throws {NormalizationError} If validation fails
-*/
-function normalizeContextStep(apiStep, options = {}) {
-	if (!apiStep || typeof apiStep !== "object") throw new NormalizationError("Step must be a valid object", "unknown", "apiStep", "object", typeof apiStep);
+/** The config normalizer for every step type whose normalized step is just the envelope plus its config. */
+const CONTEXT_STEP_CONFIG_NORMALIZERS = {
+	"crawl": normalizeCrawlConfig,
+	"fetch-url": normalizeFetchUrlConfig,
+	"get-record": normalizeGetRecordConfig,
+	"list-records": normalizeListRecordsConfig,
+	"api-call": normalizeApiCallConfig,
+	"transform-data": normalizeTransformDataConfig,
+	"template": normalizeTemplateConfig,
+	"conditional": normalizeConditionalConfig,
+	"set-variable": normalizeSetVariableConfig,
+	"upsert-record": normalizeUpsertRecordConfig,
+	"send-email": normalizeSendEmailConfig,
+	"send-event": normalizeSendEventConfig,
+	"send-stream": normalizeSendStreamConfig,
+	"update-record": normalizeUpdateRecordConfig,
+	"search": normalizeSearchConfig,
+	"generate-embedding": normalizeGenerateEmbeddingConfig,
+	"vector-search": normalizeVectorSearchConfig,
+	"paginate-api": normalizePaginateApiConfig,
+	"store-vector": normalizeStoreVectorConfig,
+	"tool-call": normalizeToolCallConfig,
+	"wait-until": normalizeWaitUntilConfig,
+	"execute-agent": normalizeExecuteAgentConfig,
+	"store-asset": normalizeStoreAssetConfig,
+	"generate-pdf": normalizeGeneratePdfConfig,
+	"save-memory": normalizeSaveMemoryConfig,
+	"recall-memory": normalizeRecallMemoryConfig,
+	"memory-summary": normalizeMemorySummaryConfig,
+	"extract": normalizeExtractConfig
+};
+/** Envelope validation: a usable id, type, name and order, and a known step type. */
+function validateContextStepEnvelope(apiStep) {
 	validateRequired(apiStep.id, "id", apiStep.type || "unknown");
 	validateRequired(apiStep.type, "type", "step");
 	validateRequired(apiStep.name, "name", apiStep.type || "unknown");
@@ -14601,39 +14697,38 @@ function normalizeContextStep(apiStep, options = {}) {
 	validateString(apiStep.type, "type", "step", true);
 	validateString(apiStep.name, "name", apiStep.type, true);
 	validateNumber(apiStep.order, "order", apiStep.type, true);
-	const validStepTypes = [
-		"crawl",
-		"fetch-url",
-		"retrieve-record",
-		"get-record",
-		"list-records",
-		"api-call",
-		"transform-data",
-		"template",
-		"conditional",
-		"loop",
-		"set-variable",
-		"upsert-record",
-		"send-email",
-		"send-event",
-		"send-stream",
-		"update-record",
-		"search",
-		"generate-embedding",
-		"vector-search",
-		"tool-call",
-		"wait-until",
-		"paginate-api",
-		"store-vector",
-		"execute-agent",
-		"store-asset",
-		"generate-pdf",
-		"save-memory",
-		"recall-memory",
-		"memory-summary",
-		"extract"
-	];
-	if (!validStepTypes.includes(apiStep.type)) throw new NormalizationError(`Unknown context step type: ${apiStep.type}. Must be one of: ${validStepTypes.join(", ")}`, apiStep.type, "type", `one of [${validStepTypes.join(", ")}]`, apiStep.type);
+	if (!CONTEXT_STEP_TYPES.includes(apiStep.type)) throw new NormalizationError(`Unknown context step type: ${apiStep.type}. Must be one of: ${CONTEXT_STEP_TYPES.join(", ")}`, apiStep.type, "type", `one of [${CONTEXT_STEP_TYPES.join(", ")}]`, apiStep.type);
+}
+function normalizeContextStepByType(apiStep, baseStep, options) {
+	switch (apiStep.type) {
+		case "retrieve-record": {
+			const aliased = resolveRetrieveRecordAlias(normalizeRetrieveRecordConfig(apiStep.config));
+			return {
+				...baseStep,
+				type: aliased.type,
+				config: aliased.config
+			};
+		}
+		case "loop": return lowerLoopToConditional(baseStep, apiStep.config);
+		default: {
+			const normalizeConfig = CONTEXT_STEP_CONFIG_NORMALIZERS[apiStep.type];
+			if (!normalizeConfig) throw new NormalizationError(`Unknown context step type: ${apiStep.type}`, apiStep.type, "type", "valid step type", apiStep.type);
+			return {
+				...baseStep,
+				type: apiStep.type,
+				config: normalizeConfig(apiStep.config, options)
+			};
+		}
+	}
+}
+/**
+* Normalize a context step from API format (snake_case) to internal format (camelCase)
+* Only normalizes known API structure fields, preserves all user data
+* @throws {NormalizationError} If validation fails
+*/
+function normalizeContextStep(apiStep, options = {}) {
+	if (!apiStep || typeof apiStep !== "object") throw new NormalizationError("Step must be a valid object", "unknown", "apiStep", "object", typeof apiStep);
+	validateContextStepEnvelope(apiStep);
 	const baseStep = {
 		id: apiStep.id,
 		type: apiStep.type,
@@ -14643,158 +14738,7 @@ function normalizeContextStep(apiStep, options = {}) {
 		...typeof apiStep.when === "string" ? { when: apiStep.when } : {}
 	};
 	try {
-		switch (apiStep.type) {
-			case "crawl": return {
-				...baseStep,
-				type: "crawl",
-				config: normalizeCrawlConfig(apiStep.config)
-			};
-			case "fetch-url": return {
-				...baseStep,
-				type: "fetch-url",
-				config: normalizeFetchUrlConfig(apiStep.config)
-			};
-			case "retrieve-record": {
-				const aliased = resolveRetrieveRecordAlias(normalizeRetrieveRecordConfig(apiStep.config));
-				return {
-					...baseStep,
-					type: aliased.type,
-					config: aliased.config
-				};
-			}
-			case "get-record": return {
-				...baseStep,
-				type: "get-record",
-				config: normalizeGetRecordConfig(apiStep.config)
-			};
-			case "list-records": return {
-				...baseStep,
-				type: "list-records",
-				config: normalizeListRecordsConfig(apiStep.config)
-			};
-			case "api-call": return {
-				...baseStep,
-				type: "api-call",
-				config: normalizeApiCallConfig(apiStep.config)
-			};
-			case "transform-data": return {
-				...baseStep,
-				type: "transform-data",
-				config: normalizeTransformDataConfig(apiStep.config)
-			};
-			case "template": return {
-				...baseStep,
-				type: "template",
-				config: normalizeTemplateConfig(apiStep.config)
-			};
-			case "conditional": return {
-				...baseStep,
-				type: "conditional",
-				config: normalizeConditionalConfig(apiStep.config)
-			};
-			case "loop": return lowerLoopToConditional(baseStep, apiStep.config);
-			case "set-variable": return {
-				...baseStep,
-				type: "set-variable",
-				config: normalizeSetVariableConfig(apiStep.config)
-			};
-			case "upsert-record": return {
-				...baseStep,
-				type: "upsert-record",
-				config: normalizeUpsertRecordConfig(apiStep.config)
-			};
-			case "send-email": return {
-				...baseStep,
-				type: "send-email",
-				config: normalizeSendEmailConfig(apiStep.config, options)
-			};
-			case "send-event": return {
-				...baseStep,
-				type: "send-event",
-				config: normalizeSendEventConfig(apiStep.config)
-			};
-			case "send-stream": return {
-				...baseStep,
-				type: "send-stream",
-				config: normalizeSendStreamConfig(apiStep.config)
-			};
-			case "update-record": return {
-				...baseStep,
-				type: "update-record",
-				config: normalizeUpdateRecordConfig(apiStep.config)
-			};
-			case "search": return {
-				...baseStep,
-				type: "search",
-				config: normalizeSearchConfig(apiStep.config)
-			};
-			case "generate-embedding": return {
-				...baseStep,
-				type: "generate-embedding",
-				config: normalizeGenerateEmbeddingConfig(apiStep.config)
-			};
-			case "vector-search": return {
-				...baseStep,
-				type: "vector-search",
-				config: normalizeVectorSearchConfig(apiStep.config)
-			};
-			case "paginate-api": return {
-				...baseStep,
-				type: "paginate-api",
-				config: normalizePaginateApiConfig(apiStep.config)
-			};
-			case "store-vector": return {
-				...baseStep,
-				type: "store-vector",
-				config: normalizeStoreVectorConfig(apiStep.config)
-			};
-			case "tool-call": return {
-				...baseStep,
-				type: "tool-call",
-				config: normalizeToolCallConfig(apiStep.config)
-			};
-			case "wait-until": return {
-				...baseStep,
-				type: "wait-until",
-				config: normalizeWaitUntilConfig(apiStep.config)
-			};
-			case "execute-agent": return {
-				...baseStep,
-				type: "execute-agent",
-				config: normalizeExecuteAgentConfig(apiStep.config)
-			};
-			case "store-asset": return {
-				...baseStep,
-				type: "store-asset",
-				config: normalizeStoreAssetConfig(apiStep.config)
-			};
-			case "generate-pdf": return {
-				...baseStep,
-				type: "generate-pdf",
-				config: normalizeGeneratePdfConfig(apiStep.config)
-			};
-			case "save-memory": return {
-				...baseStep,
-				type: "save-memory",
-				config: normalizeSaveMemoryConfig(apiStep.config)
-			};
-			case "recall-memory": return {
-				...baseStep,
-				type: "recall-memory",
-				config: normalizeRecallMemoryConfig(apiStep.config)
-			};
-			case "memory-summary": return {
-				...baseStep,
-				type: "memory-summary",
-				config: normalizeMemorySummaryConfig(apiStep.config)
-			};
-			case "extract": return {
-				...baseStep,
-				type: "extract",
-				config: normalizeExtractConfig(apiStep.config)
-			};
-			default: throw new NormalizationError(`Unknown context step type: ${apiStep.type}`, apiStep.type, "type", "valid step type", apiStep.type);
-		}
+		return normalizeContextStepByType(apiStep, baseStep, options);
 	} catch (error) {
 		if (error instanceof NormalizationError) throw error;
 		throw new NormalizationError(`Failed to normalize ${apiStep.type} step: ${error instanceof Error ? error.message : String(error)}`, apiStep.type, void 0, void 0, error);
@@ -25974,7 +25918,7 @@ function loadBrandConfig(env) {
 loadBrandConfig();
 BRAND_CONFIGS[DEFAULT_BRAND_NAME];
 //#endregion
-//#region ../shared/dist/chunk-BXwQFtLl.mjs
+//#region ../shared/dist/chunk-CNTixTjk.mjs
 const ARCHITECTURE_PREVIEW_SURFACE_TYPES = [
 	"chat",
 	"api",
@@ -41496,7 +41440,7 @@ function createSandboxInstructions(provider) {
 		"{ \"code\": \"...\", \"parameters\": { ... }, \"language\": \"javascript|typescript|python\", \"timeoutMs\": 30000 }",
 		"Runtype Sandbox rules:",
 		"1. Choose one language: javascript, typescript, or python.",
-		"2. Each session is a full Linux container (Node 24, Python 3.13 with numpy/pandas/matplotlib, pnpm, tsx, uv, git).",
+		"2. Each session is a full Linux container (Node 26, Python 3.15 with numpy/pandas/matplotlib, pnpm, tsx, uv, git).",
 		"3. Inputs are available as the `parameters` object (JS/TS) or `parameters` dict (Python).",
 		"4. async/await, Promises, and long-running processes are fully supported.",
 		"5. Write the final result to stdout (JSON string is preferred for structured output).",
@@ -63826,7 +63770,7 @@ const productKindSchema = _enum([
 	"spec_only"
 ]);
 //#endregion
-//#region ../shared/dist/chunk-Bvkm1pLW.mjs
+//#region ../shared/dist/chunk-D0CW0BS7.mjs
 /** The manifest file at the root of a candidate's source bundle. */
 const CANDIDATE_MANIFEST_FILENAME = "runtype-candidate.json";
 const candidateRuntimeSchema = _enum([
@@ -65106,6 +65050,7 @@ const servedBySchema = _enum([
 	"composite",
 	"synthesized",
 	"stub",
+	"rejected",
 	"fault"
 ]);
 /** Calls per ladder rung; a rung with no calls is absent. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runtypelabs/cli",
-  "version": "2.53.1",
+  "version": "2.53.3",
   "description": "Command-line interface for Runtype AI platform",
   "type": "module",
   "main": "dist/index.js",
@@ -12,7 +12,7 @@
     "@modelcontextprotocol/core": "2.3.1",
     "@napi-rs/keyring": "2.1.0",
     "@runtypelabs/ink-components": "0.3.12",
-    "@runtypelabs/sdk": "11.6.0",
+    "@runtypelabs/sdk": "11.7.0",
     "@runtypelabs/terminal-animations": "0.2.4",
     "add-mcp": "2.0.0",
     "chalk": "^5.3.0",
@@ -36,7 +36,7 @@
     "@modelcontextprotocol/server": "2.3.1",
     "@runtypelabs/device-bridge": "0.2.4",
     "@runtypelabs/persona": "4.29.2",
-    "@runtypelabs/shared": "3.94.0",
+    "@runtypelabs/shared": "3.95.1",
     "@types/express": "^5.0.6",
     "@types/micromatch": "^4.0.9",
     "@types/node": "^25.3.3",