@superblocksteam/gateway 2.0.165-next.0 → 2.0.166-next.0

package/dist/agents/resolve-orchestrator-url.d.ts

@@ -19,8 +19,12 @@ export type OrchestratorAgentCandidate = {
 export type PickOrchestratorBaseUrlInput = {
     agentType: number;
     agents: OrchestratorAgentCandidate[];
-    profileKey: string;
+    controlPlaneUrl?: string;
+    profileKey?: string;
 };
+/** Matches `@superblocksteam/shared` `AgentType.ONPREMISE`. */
+export declare const AGENT_TYPE_ONPREMISE = 2;
+export declare function cloudOrchestratorBaseUrlFromControlPlane(url: string | undefined): string | undefined;
 /**
  * Rewrites a Superblocks control-plane `/agent` URL to the dedicated
  * orchestrator host. Leaves on-prem, ephemeral `agent-<host>`, and already
@@ -32,6 +36,20 @@ export type PickOrchestratorBaseUrlInput = {
  * prefix. DEDICATED agents advertise a real URL; do not invent a host.
  */
 export declare function canonicalizeOrchestratorBaseUrl(url: string, agentType?: number): string;
+/**
+ * Whether moving between two profile keys can move the orchestrator URL.
+ *
+ * Only on-prem inventories tag agents by profile. Cloud resolves to one agent
+ * host per control plane. A key changing value there picks the same URL
+ * so no need to evict the cache.
+ *
+ * When agent is undefined, the profile key is changing from unset to a value.
+ */
+export declare function orchestratorUrlDependsOnProfile(input: {
+    agentType?: number;
+    nextProfileKey?: string;
+    previousProfileKey?: string;
+}): boolean;
 /**
  * Returns a single orchestrator base URL from Server-reported agents.
  * Throws when none are eligible — same failure mode as the browser's

package/dist/agents/resolve-orchestrator-url.js

@@ -1,18 +1,9 @@
-/**
- * Picks an orchestrator (agent) base URL the way the browser does: from the
- * Server's agent inventory for the org, filtered by org agent type, Active
- * status, and profile tags. Operators never set this URL.
- *
- * Cloud editor execute then ignores that inventory URL and posts to
- * SUPERBLOCKS_UI_AGENT_BASE_URL (`https://agent.<env>.superblocks.com/` on
- * SaaS, `https://agent.<zone>/` on cloud-prem). The cloud sentinel still
- * advertises `https://<control-plane>/agent`, and nginx on that path returns
- * 405 for POST /v2/execute and /v3/execute. Canonicalize those known-broken
- * paths so Gateway hits the same host the browser uses.
- */
+import { isIP } from "node:net";
 const ACTIVE_STATUS = "Active";
 /** Matches `@superblocksteam/shared` `AgentType.MULTITENANT`. */
 const AGENT_TYPE_MULTITENANT = 0;
+/** Matches `@superblocksteam/shared` `AgentType.ONPREMISE`. */
+export const AGENT_TYPE_ONPREMISE = 2;
 /**
  * Control-plane hosts whose `/agent` path is not the orchestrator. US prod is
  * the exception to `agent.<control-plane>` (`app.` → `agent.superblocks.com`).
@@ -25,6 +16,26 @@ const CLOUD_ORCHESTRATOR_URL_BY_CONTROL_PLANE_HOST = {
     "staging.superblocks.com": "https://agent.staging.superblocks.com/",
     "dev.superblocks.com": "https://agent.dev.superblocks.com/",
 };
+export function cloudOrchestratorBaseUrlFromControlPlane(url) {
+    if (!url) {
+        return undefined;
+    }
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed.protocol !== "https:" ||
+        parsed.port ||
+        parsed.hostname === "localhost" ||
+        parsed.hostname.endsWith(".localhost") ||
+        isIP(parsed.hostname) !== 0) {
+        return undefined;
+    }
+    return CLOUD_ORCHESTRATOR_URL_BY_CONTROL_PLANE_HOST[parsed.hostname];
+}
 function matchesProfile(tags, profileKey) {
     const profiles = tags.profile;
     if (!profiles || profiles.length === 0) {
@@ -33,6 +44,10 @@ function matchesProfile(tags, profileKey) {
     }
     return profiles.includes("*") || profiles.includes(profileKey);
 }
+function isUniversalProfile(tags) {
+    const profiles = tags.profile;
+    return !profiles || profiles.length === 0 || profiles.includes("*");
+}
 function withTrailingSlash(url) {
     return url.endsWith("/") ? url : `${url}/`;
 }
@@ -44,6 +59,14 @@ function withTrailingSlash(url) {
 function isAgentPath(pathname) {
     return pathname === "/agent" || pathname === "/agent/";
 }
+function hasAgentPath(url) {
+    try {
+        return isAgentPath(new URL(url).pathname);
+    }
+    catch {
+        return false;
+    }
+}
 function isAlreadyDedicatedAgentHost(hostname) {
     return hostname === "agent" || hostname.startsWith("agent.");
 }
@@ -78,23 +101,51 @@ export function canonicalizeOrchestratorBaseUrl(url, agentType) {
     }
     return url;
 }
+/**
+ * Whether moving between two profile keys can move the orchestrator URL.
+ *
+ * Only on-prem inventories tag agents by profile. Cloud resolves to one agent
+ * host per control plane. A key changing value there picks the same URL
+ * so no need to evict the cache.
+ *
+ * When agent is undefined, the profile key is changing from unset to a value.
+ */
+export function orchestratorUrlDependsOnProfile(input) {
+    if (input.agentType === undefined ||
+        input.agentType === AGENT_TYPE_ONPREMISE) {
+        return true;
+    }
+    return Boolean(input.previousProfileKey) !== Boolean(input.nextProfileKey);
+}
 /**
  * Returns a single orchestrator base URL from Server-reported agents.
  * Throws when none are eligible — same failure mode as the browser's
  * "No active agent found".
  */
 export function pickOrchestratorBaseUrl(input) {
-    const eligible = input.agents.filter((candidate) => candidate.type === input.agentType &&
+    const active = input.agents.filter((candidate) => candidate.type === input.agentType &&
         candidate.status === ACTIVE_STATUS &&
-        Boolean(candidate.url) &&
-        matchesProfile(candidate.tags ?? {}, input.profileKey));
-    if (eligible.length === 0) {
-        throw new Error(`No active agent found for agentType=${input.agentType} profile=${input.profileKey}`);
+        Boolean(candidate.url));
+    let chosen;
+    if (input.agentType !== AGENT_TYPE_ONPREMISE) {
+        const mapped = cloudOrchestratorBaseUrlFromControlPlane(input.controlPlaneUrl);
+        if (mapped) {
+            return mapped;
+        }
+        chosen = active.find((candidate) => hasAgentPath(candidate.url));
+    }
+    else if (input.profileKey) {
+        const profileKey = input.profileKey;
+        chosen = active.find((candidate) => matchesProfile(candidate.tags ?? {}, profileKey));
+    }
+    if (!chosen && !input.profileKey) {
+        chosen = active.find((candidate) => isUniversalProfile(candidate.tags ?? {}));
+    }
+    if (input.agentType !== AGENT_TYPE_ONPREMISE) {
+        chosen ??= active[0];
     }
-    // Browser picks randomly among matches; stable first is fine for gateway.
-    const chosen = eligible[0];
     if (!chosen) {
-        throw new Error(`No active agent found for agentType=${input.agentType} profile=${input.profileKey}`);
+        throw new Error(`No active agent found for agentType=${input.agentType} profile=${input.profileKey ?? "<unset>"}`);
     }
     return withTrailingSlash(canonicalizeOrchestratorBaseUrl(chosen.url, input.agentType));
 }

package/dist/agents/resolve-orchestrator-url.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-orchestrator-url.js","sourceRoot":"","sources":["../../src/agents/resolve-orchestrator-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAeH,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B,iEAAiE;AACjE,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,4CAA4C,GAA2B;IAC3E,qBAAqB,EAAE,gCAAgC;IACvD,oBAAoB,EAAE,mCAAmC;IACzD,yBAAyB,EAAE,wCAAwC;IACnE,qBAAqB,EAAE,oCAAoC;CAC5D,CAAC;AAEF,SAAS,cAAc,CACrB,IAA8B,EAC9B,UAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,mEAAmE;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,QAAgB;IACnC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,SAAS,CAAC;AACzD,CAAC;AAED,SAAS,2BAA2B,CAAC,QAAgB;IACnD,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAC7C,GAAW,EACX,SAAkB;IAElB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,4CAA4C,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7E,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IACE,SAAS,KAAK,sBAAsB;QACpC,CAAC,2BAA2B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC7C,CAAC;QACD,OAAO,iBAAiB,MAAM,CAAC,QAAQ,GAAG,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAmC;IAEnC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAClC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,SAAS;QAClC,SAAS,CAAC,MAAM,KAAK,aAAa;QAClC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC;QACtB,cAAc,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,CACzD,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,CAAC,SAAS,YAAY,KAAK,CAAC,UAAU,EAAE,CACrF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,CAAC,SAAS,YAAY,KAAK,CAAC,UAAU,EAAE,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CACtB,+BAA+B,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAC7D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"resolve-orchestrator-url.js","sourceRoot":"","sources":["../../src/agents/resolve-orchestrator-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AA6BhC,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B,iEAAiE;AACjE,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,4CAA4C,GAA2B;IAC3E,qBAAqB,EAAE,gCAAgC;IACvD,oBAAoB,EAAE,mCAAmC;IACzD,yBAAyB,EAAE,wCAAwC;IACnE,qBAAqB,EAAE,oCAAoC;CAC5D,CAAC;AAEF,MAAM,UAAU,wCAAwC,CACtD,GAAuB;IAEvB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAC5B,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,QAAQ,KAAK,WAAW;QAC/B,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC3B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,4CAA4C,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,cAAc,CACrB,IAA8B,EAC9B,UAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,mEAAmE;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA8B;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,QAAgB;IACnC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,SAAS,CAAC;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,QAAgB;IACnD,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAC7C,GAAW,EACX,SAAkB;IAElB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,4CAA4C,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7E,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IACE,SAAS,KAAK,sBAAsB;QACpC,CAAC,2BAA2B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC7C,CAAC;QACD,OAAO,iBAAiB,MAAM,CAAC,QAAQ,GAAG,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAI/C;IACC,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;QAC7B,KAAK,CAAC,SAAS,KAAK,oBAAoB,EACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAmC;IAEnC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAChC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,SAAS;QAClC,SAAS,CAAC,MAAM,KAAK,aAAa;QAClC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CACzB,CAAC;IAEF,IAAI,MAA8C,CAAC;IACnD,IAAI,KAAK,CAAC,SAAS,KAAK,oBAAoB,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,wCAAwC,CACrD,KAAK,CAAC,eAAe,CACtB,CAAC;QACF,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjC,cAAc,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,EAAE,UAAU,CAAC,CACjD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjC,kBAAkB,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CACzC,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,oBAAoB,EAAE,CAAC;QAC7C,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,CAAC,SAAS,YACpD,KAAK,CAAC,UAAU,IAAI,SACtB,EAAE,CACH,CAAC;IACJ,CAAC;IAED,OAAO,iBAAiB,CACtB,+BAA+B,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAC7D,CAAC;AACJ,CAAC"}

package/dist/capabilities/integration-metadata.d.ts

@@ -1,3 +1,4 @@
+import { type ResolvedProfileSummary } from "../integrations/resolve-profile.js";
 import { type CapabilityContext } from "./lifecycle.js";
 import type { CapabilityResult } from "./types.js";
 export type GetIntegrationMetadataInput = {
@@ -21,6 +22,8 @@ export type GetIntegrationMetadataResult = {
     nextOffset: number | null;
     offset: number;
     pluginId: string;
+    /** Which profile's data this is, so a later change of profile is explainable. */
+    profile: ResolvedProfileSummary;
     returnedCount: number;
     totalCount: number;
 };

package/dist/capabilities/integration-metadata.js

@@ -1,7 +1,7 @@
-import { pickOrchestratorBaseUrl } from "../agents/resolve-orchestrator-url.js";
+import { AGENT_TYPE_ONPREMISE, pickOrchestratorBaseUrl, } from "../agents/resolve-orchestrator-url.js";
 import { integrationIsToolSupported } from "../integrations/filters.js";
 import { hasBuildPermission } from "../integrations/map.js";
-import { pickEditorProfileKey } from "../integrations/profile-key.js";
+import { describeProfile, profileSummary, profileUnresolvedMessage, resolveProfileForApplication, } from "../integrations/resolve-profile.js";
 import { HttpOrchestratorClient } from "../orchestrator/client.js";
 import { sanitizeAgentFacingText, sanitizeAgentFacingValue, } from "../sabs/agent-facing-text.js";
 import { ensurePrincipal, resolveApplicationId, } from "./lifecycle.js";
@@ -59,6 +59,7 @@ export async function getIntegrationMetadata(context, input) {
         return principal;
     }
     let applicationId;
+    let profileResolution;
     // Named for the agent before the integration resolves, so a failure on the
     // way to the metadata still reports which integration it was reaching for.
     let label = sanitizeAgentFacingText(input.integrationId);
@@ -105,20 +106,41 @@ export async function getIntegrationMetadata(context, input) {
                 message: `${integrationName} is a ${pluginId} integration, which this tool cannot inspect.`,
             };
         }
-        const profiles = await context.server.getOrganizationProfiles({
+        ({ resolution: profileResolution } = await resolveProfileForApplication({
             apiKey: principal.value.apiKey,
+            applicationId,
+            configuredKey: context.config.profileKey,
             organizationId: principal.value.organizationId,
-        });
-        const profileKey = pickEditorProfileKey(context.config.profileKey, profiles);
+            scope: "integration_metadata",
+            server: context.server,
+        }));
+        const profileKey = profileResolution.key;
         const inventory = await context.server.getAgentInventory({
             apiKey: principal.value.apiKey,
             organizationId: principal.value.organizationId,
         });
-        const orchestratorUrl = pickOrchestratorBaseUrl({
-            agentType: inventory.agentType,
-            agents: inventory.agents,
-            profileKey,
-        });
+        let orchestratorUrl;
+        try {
+            orchestratorUrl = pickOrchestratorBaseUrl({
+                agentType: inventory.agentType,
+                agents: inventory.agents,
+                controlPlaneUrl: inventory.controlPlaneUrl,
+                profileKey,
+            });
+        }
+        catch (error) {
+            // Only on-prem agents are picked by profile tag, so only there does a
+            // missing profile explain a missing agent.
+            if (profileKey || inventory.agentType !== AGENT_TYPE_ONPREMISE) {
+                throw error;
+            }
+            return {
+                ...(applicationId && { applicationId }),
+                kind: "error",
+                code: "integration_profile_unresolved",
+                message: profileUnresolvedMessage(integrationName, profileResolution),
+            };
+        }
         const scopedToken = await context.server.issueScopedToken(applicationId
             ? {
                 apiKey: principal.value.apiKey,
@@ -156,6 +178,7 @@ export async function getIntegrationMetadata(context, input) {
                 nextOffset,
                 offset,
                 pluginId,
+                profile: profileSummary(profileResolution),
                 returnedCount: entries.length,
                 totalCount: matched.length,
             },
@@ -167,7 +190,7 @@ export async function getIntegrationMetadata(context, input) {
             ...(applicationId && { applicationId }),
             kind: "error",
             code: "integration_metadata_unavailable",
-            message: `Could not load metadata for ${label}: ${detail}`,
+            message: `Could not load metadata for ${label}${profileResolution ? ` (${describeProfile(profileResolution)})` : ""}: ${detail}`,
         };
     }
 }

package/dist/capabilities/integration-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"integration-metadata.js","sourceRoot":"","sources":["../../src/capabilities/integration-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,eAAe,EACf,oBAAoB,GAErB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,aAAa,GAAG,GAAG,CAAC;AA6B1B,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa;IACpD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,eAAe,CACtB,KAAc,EACd,IAAI,GAAG,EAAE,EACT,UAA2B,EAAE;IAE7B,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,SAAS;QAC1B,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,QAAQ,EACzB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5C,uEAAuE;YACvE,4CAA4C;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YAC7D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjB,eAAe,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA0B,EAC1B,KAAkC;IAElC,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,aAAiC,CAAC;IACtC,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAEzD,IAAI,CAAC;QACH,0EAA0E;QAC1E,uEAAuE;QACvE,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CACzC,OAAO,EACP,SAAS,CAAC,KAAK,EACf,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,aAAa,GAAG,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpE,wEAAwE;QACxE,yEAAyE;QACzE,sBAAsB;QACtB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,uBAAuB,CAAC;YACxD,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM;YAC9B,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;YACvC,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC,cAAc;SAC/C,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,aAAa,CAAC,CAAC;QACvE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;gBACvC,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,eAAe,KAAK,sCAAsC;aACpE,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,uBAAuB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC/D,KAAK,GAAG,eAAe,CAAC;QAExB,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;gBACvC,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,uCAAuC,eAAe,GAAG;aACnE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,0BAA0B,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,OAAO;gBACL,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;gBACvC,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,GAAG,eAAe,SAAS,QAAQ,+CAA+C;aAC5F,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,uBAAuB,CAAC;YAC5D,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM;YAC9B,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC,cAAc;SAC/C,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,oBAAoB,CACrC,OAAO,CAAC,MAAM,CAAC,UAAU,EACzB,QAAQ,CACT,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACvD,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM;YAC9B,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC,cAAc;SAC/C,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,uBAAuB,CAAC;YAC9C,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,UAAU;SACX,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,gBAAgB,CACvD,aAAa;YACX,CAAC,CAAC;gBACE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM;gBAC9B,aAAa;gBACb,KAAK,EAAE,aAAa;aACrB;YACH,CAAC,CAAC;gBACE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM;gBAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,KAAK,EAAE,oBAAoB;aAC5B,CACN,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAI,sBAAsB,CAC/C,eAAe,CAChB,CAAC,WAAW,CAAC;YACZ,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,UAAU;YACV,WAAW;SACZ,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC,MAAM,CAC/C,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,MAAM;YACP,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CACrD,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,aAAa,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;QACtD,MAAM,UAAU,GACd,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAE5E,OAAO;YACL,IAAI,EAAE,IAAI;YACV,KAAK,EAAE;gBACL,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;gBACvC,OAAO;gBACP,OAAO,EAAE,UAAU,KAAK,IAAI;gBAC5B,aAAa,EAAE,WAAW,CAAC,EAAE;gBAC7B,eAAe;gBACf,UAAU;gBACV,MAAM;gBACN,QAAQ;gBACR,aAAa,EAAE,OAAO,CAAC,MAAM;gBAC7B,UAAU,EAAE,OAAO,CAAC,MAAM;aAC3B;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,uBAAuB,CACpC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAClE,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5B,OAAO;YACL,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;YACvC,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,kCAAkC;YACxC,OAAO,EAAE,+BAA+B,KAAK,KAAK,MAAM,EAAE;SAC3D,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"integration-metadata.js","sourceRoot":"","sources":["../../src/capabilities/integration-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,OAAO,EACL,eAAe,EACf,cAAc,EACd,wBAAwB,EACxB,4BAA4B,GAE7B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,eAAe,EACf,oBAAoB,GAErB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,aAAa,GAAG,GAAG,CAAC;AA+B1B,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa;IACpD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,eAAe,CACtB,KAAc,EACd,IAAI,GAAG,EAAE,EACT,UAA2B,EAAE;IAE7B,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,SAAS;QAC1B,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,QAAQ,EACzB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5C,uEAAuE;YACvE,4CAA4C;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YAC7D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjB,eAAe,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA0B,EAC1B,KAAkC;IAElC,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,aAAiC,CAAC;IACtC,IAAI,iBAAgD,CAAC;IACrD,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAEzD,IAAI,CAAC;QACH,0EAA0E;QAC1E,uEAAuE;QACvE,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CACzC,OAAO,EACP,SAAS,CAAC,KAAK,EACf,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,aAAa,GAAG,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpE,wEAAwE;QACxE,yEAAyE;QACzE,sBAAsB;QACtB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,uBAAuB,CAAC;YACxD,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM;YAC9B,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;YACvC,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC,cAAc;SAC/C,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,aAAa,CAAC,CAAC;QACvE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;gBACvC,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,eAAe,KAAK,sCAAsC;aACpE,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,uBAAuB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC/D,KAAK,GAAG,eAAe,CAAC;QAExB,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;gBACvC,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,uCAAuC,eAAe,GAAG;aACnE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,0BAA0B,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,OAAO;gBACL,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;gBACvC,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,GAAG,eAAe,SAAS,QAAQ,+CAA+C;aAC5F,CAAC;QACJ,CAAC;QAED,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,MAAM,4BAA4B,CAAC;YACtE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM;YAC9B,aAAa;YACb,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU;YACxC,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC,cAAc;YAC9C,KAAK,EAAE,sBAAsB;YAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC,CAAC;QACJ,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACvD,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM;YAC9B,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC,cAAc;SAC/C,CAAC,CAAC;QACH,IAAI,eAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,eAAe,GAAG,uBAAuB,CAAC;gBACxC,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,eAAe,EAAE,SAAS,CAAC,eAAe;gBAC1C,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,2CAA2C;YAC3C,IAAI,UAAU,IAAI,SAAS,CAAC,SAAS,KAAK,oBAAoB,EAAE,CAAC;gBAC/D,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO;gBACL,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;gBACvC,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EAAE,wBAAwB,CAAC,eAAe,EAAE,iBAAiB,CAAC;aACtE,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,gBAAgB,CACvD,aAAa;YACX,CAAC,CAAC;gBACE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM;gBAC9B,aAAa;gBACb,KAAK,EAAE,aAAa;aACrB;YACH,CAAC,CAAC;gBACE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM;gBAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,KAAK,EAAE,oBAAoB;aAC5B,CACN,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAI,sBAAsB,CAC/C,eAAe,CAChB,CAAC,WAAW,CAAC;YACZ,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,UAAU;YACV,WAAW;SACZ,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC,MAAM,CAC/C,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,MAAM;YACP,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CACrD,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,aAAa,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;QACtD,MAAM,UAAU,GACd,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAE5E,OAAO;YACL,IAAI,EAAE,IAAI;YACV,KAAK,EAAE;gBACL,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;gBACvC,OAAO;gBACP,OAAO,EAAE,UAAU,KAAK,IAAI;gBAC5B,aAAa,EAAE,WAAW,CAAC,EAAE;gBAC7B,eAAe;gBACf,UAAU;gBACV,MAAM;gBACN,QAAQ;gBACR,OAAO,EAAE,cAAc,CAAC,iBAAiB,CAAC;gBAC1C,aAAa,EAAE,OAAO,CAAC,MAAM;gBAC7B,UAAU,EAAE,OAAO,CAAC,MAAM;aAC3B;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,uBAAuB,CACpC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAClE,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5B,OAAO;YACL,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;YACvC,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,kCAAkC;YACxC,OAAO,EAAE,+BAA+B,KAAK,GAC3C,iBAAiB,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EACnE,KAAK,MAAM,EAAE;SACd,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/capabilities/lifecycle.d.ts

@@ -60,10 +60,25 @@ export declare function resolveApplicationId(ctx: CapabilityContext, principal:
 options?: {
     unambiguous?: boolean;
 }): Promise<CapabilityResult<string>>;
+/**
+ * Settles a user's plan approval against what became of the prompt it
+ * approved.
+ *
+ * The approval is claimed before the prompt goes out and spent only once
+ * Superblocks accepts it. A prompt that never went out hands the approval
+ * back, so the retry builds the plan the user already approved instead of
+ * failing with `approval_not_from_user`. A prompt that may have reached
+ * Superblocks settles neither way: handing the approval back could build the
+ * plan twice.
+ */
+export type ApprovalSettlement = {
+    onAccepted(): void;
+    onNotSent(): void;
+};
 export declare function startApp(ctx: CapabilityContext, input: StartAppInput): Promise<CapabilityResult<StartAppResult>>;
 export declare function uploadArtifact(ctx: CapabilityContext, input: UploadArtifactInput): Promise<CapabilityResult<UploadArtifactResult>>;
 export declare function checkAppProgress(ctx: CapabilityContext, input: CheckAppProgressInput): Promise<CapabilityResult<CheckAppProgressResult>>;
-export declare function editApp(ctx: CapabilityContext, input: EditAppInput, approvedPlan?: object): Promise<CapabilityResult<EditAppResult>>;
+export declare function editApp(ctx: CapabilityContext, input: EditAppInput, approvedPlan?: object, approvalSettlement?: ApprovalSettlement): Promise<CapabilityResult<EditAppResult>>;
 /**
  * Shows the app's current work on a real URL without deploying it - the
  * editor's Preview button, driven from here.

package/dist/capabilities/lifecycle.js

@@ -2,7 +2,8 @@ import { randomUUID } from "node:crypto";
 import { readFile, realpath, stat } from "node:fs/promises";
 import path from "node:path";
 import { detectAttachmentArchiveType, getAttachmentMimeTypeFromFileName, getTextAttachmentType, isSupportedAttachmentUploadType, } from "@superblocksteam/shared";
-import { buildBrowserDriverContract, needsBrowserDriverError, } from "../capture/browser-contract.js";
+import { buildBrowserDriverContract, HOST_BROWSER_TOOLS_COWORK, needsBrowserDriverError, } from "../capture/browser-contract.js";
+import { withCoworkEditorHost } from "../capture/cowork-editor-url.js";
 import { resolveCaptureMode } from "../capture/mode.js";
 import { gatewayDebug } from "../debug.js";
 import { playwrightChromiumPresent } from "../playwright/ensure-chromium.js";
@@ -30,18 +31,25 @@ const RECENT_APP_FALLBACK_WINDOW_MS = 30 * 60 * 1000;
  * the UI serves from `/code-mode` — the legacy `/applications/:id/edit` route
  * does not open it.
  */
-function editUrl(config, applicationId, branch) {
-    const base = `${config.uiBaseUrl.replace(/\/$/, "")}/code-mode/applications/edit/${applicationId}`;
-    return branch
+function editorBaseUrl(config, applicationId) {
+    return `${config.uiBaseUrl.replace(/\/$/, "")}/code-mode/applications/edit/${applicationId}`;
+}
+/** The editor URL handed to the caller, in the host mode its client renders. */
+function editUrl(ctx, applicationId, branch) {
+    const base = editorBaseUrl(ctx.config, applicationId);
+    const url = branch
         ? `${base}?${new URLSearchParams({ branch }).toString()}`
         : base;
+    return ctx.hostBrowserTools === HOST_BROWSER_TOOLS_COWORK
+        ? withCoworkEditorHost(url)
+        : url;
 }
 function fullscreenPreviewUrl(config, applicationId, branch) {
     const params = new URLSearchParams({ fullscreen: "true" });
     if (branch) {
         params.set("branch", branch);
     }
-    return `${editUrl(config, applicationId)}?${params.toString()}`;
+    return `${editorBaseUrl(config, applicationId)}?${params.toString()}`;
 }
 function uiOrigin(config) {
     return config.uiBaseUrl.replace(/\/$/, "");
@@ -237,7 +245,7 @@ function publishUrl(config, applicationId) {
     return `${config.uiBaseUrl.replace(/\/$/, "")}/code-mode/applications/${applicationId}`;
 }
 function publishDetailsUrl(config, applicationId, commitId) {
-    return `${editUrl(config, applicationId)}?${new URLSearchParams({ commitId }).toString()}`;
+    return `${editorBaseUrl(config, applicationId)}?${new URLSearchParams({ commitId }).toString()}`;
 }
 /**
  * Where a built, undeployed commit can be opened — what the editor's Preview
@@ -380,7 +388,7 @@ async function elicitStepUp(ctx, idempotencyKey, applicationId, branch) {
             message: "Step-up authentication completed. Re-invoke the capability to continue.",
         };
     }
-    const browser = await browserContractFor(ctx, editUrl(ctx.config, applicationId, branch));
+    const browser = await browserContractFor(ctx, editUrl(ctx, applicationId, branch));
     if (existing?.status === "pending") {
         return {
             kind: "auth_required",
@@ -838,7 +846,7 @@ async function forwardClarkPrompt(ctx, input) {
         return {
             kind: "error",
             code: "superblocks_turn_timeout",
-            message: `Superblocks reported that the turn timed out.${forward.reply ? ` Partial reply: ${forward.reply.slice(0, 500)}` : ""} Continue in the editor at ${editUrl(ctx.config, input.applicationId, input.branch)}.`,
+            message: `Superblocks reported that the turn timed out.${forward.reply ? ` Partial reply: ${forward.reply.slice(0, 500)}` : ""} Continue in the editor at ${editUrl(ctx, input.applicationId, input.branch)}.`,
             pendingAction: "retry_build",
         };
     }
@@ -1170,7 +1178,7 @@ async function promptNewApplication(ctx, args) {
                 activity: started.value.activity,
                 applicationId,
                 ...(branch ? { branch } : {}),
-                editUrl: editUrl(ctx.config, applicationId, branch),
+                editUrl: editUrl(ctx, applicationId, branch),
                 liveEditId: started.value.liveEditId ?? session.liveEditId,
                 mode: promptArgs.mode,
                 name: await named(),
@@ -1196,7 +1204,7 @@ async function promptNewApplication(ctx, args) {
             : {}),
         reply: forward.value.reply,
         ...(forward.value.decision ? { decision: forward.value.decision } : {}),
-        editUrl: editUrl(ctx.config, applicationId, branch),
+        editUrl: editUrl(ctx, applicationId, branch),
         generationStatus: forward.value.generationStatus,
         liveEditId: forward.value.liveEditId ?? session.liveEditId,
         mode: promptArgs.mode,
@@ -1216,6 +1224,13 @@ async function promptNewApplication(ctx, args) {
     });
     return { kind: "ok", value: await withBrowser(ctx, result) };
 }
+/** Whether a result is {@link elicitStepUp} turning the prompt back. */
+function isStepUp(result) {
+    return (result.kind === "auth_required" ||
+        (result.kind === "error" &&
+            (result.code === "needs_browser_driver" ||
+                result.code === "reinvoke_required")));
+}
 async function runAcknowledgedStart(ctx, args) {
     const scope = {
         applicationId: args.applicationId,
@@ -1241,23 +1256,33 @@ async function runAcknowledgedStart(ctx, args) {
     });
     try {
         const result = await args.start();
+        if (result.kind === "ok") {
+            args.approvalSettlement?.onAccepted();
+        }
+        else {
+            // An acknowledged start sends from here and nowhere else, and a send
+            // that fails throws instead, so any other answer came back before the
+            // prompt went out.
+            args.approvalSettlement?.onNotSent();
+        }
         if (result.kind === "error" && result.code === "reinvoke_required") {
             failed(new Error(result.message), `Authentication completed before Superblocks accepted the prompt for application ${args.applicationId}. Call edit_app with that applicationId and the same prompt to continue.`, "live_edit_terminated", "retry_build");
         }
         else if (result.kind === "auth_required" ||
             (result.kind === "error" && result.code === "needs_browser_driver")) {
-            failed(new Error("authentication required"), `Authentication is required before the prompt can continue. Open ${editUrl(ctx.config, args.applicationId, args.branch)} and authenticate, then call edit_app with that applicationId and the same prompt.`, "live_edit_terminated", "retry_build");
+            failed(new Error("authentication required"), `Authentication is required before the prompt can continue. Open ${editUrl(ctx, args.applicationId, args.branch)} and authenticate, then call edit_app with that applicationId and the same prompt.`, "live_edit_terminated", "retry_build");
         }
     }
     catch (error) {
         if (error instanceof PromptNotSentError) {
+            args.approvalSettlement?.onNotSent();
             const retryable = error.retryable !== false;
             failed(error, retryable
                 ? `The prompt was not sent, so nothing was built. Call edit_app for application ${args.applicationId} with the same instruction to retry. (${error.message})`
                 : `The replacement live-edit session also stopped responding, so Gateway cannot safely retry this build. Start a new application instead. (${error.message})`, "live_edit_terminated", retryable ? "retry_build" : undefined, error.retryable, error.recoveryAction);
         }
         else {
-            failed(error, `The prompt acknowledgement was lost and the prompt may have reached Superblocks. Do not resend it; open ${editUrl(ctx.config, args.applicationId, args.branch)} to check the existing application. (${error instanceof Error ? error.message : String(error)})`, "detached");
+            failed(error, `The prompt acknowledgement was lost and the prompt may have reached Superblocks. Do not resend it; open ${editUrl(ctx, args.applicationId, args.branch)} to check the existing application. (${error instanceof Error ? error.message : String(error)})`, "detached");
         }
     }
     finally {
@@ -1355,7 +1380,7 @@ export async function startApp(ctx, input) {
             value: await withBrowser(ctx, {
                 applicationId: app.id,
                 ...(branch ? { branch } : {}),
-                editUrl: editUrl(ctx.config, app.id, branch),
+                editUrl: editUrl(ctx, app.id, branch),
                 mode: input.mode ?? "PLAN",
                 name,
                 status: "building",
@@ -1892,7 +1917,7 @@ export async function checkAppProgress(ctx, input) {
         activity,
         applicationId,
         ...(branch ? { branch } : {}),
-        editUrl: editUrl(ctx.config, applicationId, branch),
+        editUrl: editUrl(ctx, applicationId, branch),
         elapsedSeconds,
         ...(update.viewStatus ? { viewStatus: update.viewStatus } : {}),
         ...("recentRuns" in update &&
@@ -2024,7 +2049,7 @@ async function recordTurnSignals(ctx, input) {
     }
     return stallHint ? { stallHint } : {};
 }
-export async function editApp(ctx, input, approvedPlan) {
+export async function editApp(ctx, input, approvedPlan, approvalSettlement) {
     const principalResult = await ensurePrincipal(ctx);
     if (principalResult.kind !== "ok") {
         return principalResult;
@@ -2038,6 +2063,7 @@ export async function editApp(ctx, input, approvedPlan) {
     return namingApplication(applicationId, await promptExistingApplication(ctx, {
         applicationId,
         approvedPlan,
+        ...(approvalSettlement ? { approvalSettlement } : {}),
         input,
         principal,
     }));
@@ -2104,14 +2130,18 @@ async function promptExistingApplication(ctx, args) {
             userId: principal.userId,
         });
         const { signal: _requestSignal, ...backgroundContext } = ctx;
+        // Settled by the background start alone, which is the only part that
+        // learns whether the prompt went out.
+        const { approvalSettlement, ...startArgs } = args;
         void runAcknowledgedStart(backgroundContext, {
             applicationId,
+            ...(approvalSettlement ? { approvalSettlement } : {}),
             branch,
             idempotencyKey: input.idempotencyKey,
             pendingStartToken,
             principal,
             start: () => promptExistingApplication(backgroundContext, {
-                ...args,
+                ...startArgs,
                 ...(approvingUncapturedPlan ? { approvingUncapturedPlan } : {}),
                 input: { ...input, ...(branch ? { branch } : {}) },
                 pendingStartToken,
@@ -2126,7 +2156,7 @@ async function promptExistingApplication(ctx, args) {
             value: await withBrowser(ctx, {
                 applicationId,
                 ...(branch ? { branch } : {}),
-                editUrl: editUrl(ctx.config, applicationId, branch),
+                editUrl: editUrl(ctx, applicationId, branch),
                 mode,
                 status: "building",
             }),
@@ -2310,13 +2340,30 @@ async function promptExistingApplication(ctx, args) {
                 activity: started.value.activity,
                 applicationId,
                 ...(branch ? { branch } : {}),
-                editUrl: editUrl(ctx.config, applicationId, branch),
+                editUrl: editUrl(ctx, applicationId, branch),
                 mode: promptArgs.mode,
                 status: "building",
             }),
         };
     }
-    const forward = await forwardClarkPrompt(ctx, promptArgs);
+    let forward;
+    try {
+        forward = await forwardClarkPrompt(ctx, promptArgs);
+    }
+    catch (error) {
+        if (error instanceof PromptNotSentError) {
+            args.approvalSettlement?.onNotSent();
+        }
+        throw error;
+    }
+    // A blocking forward returns only once Superblocks took the prompt and ran
+    // the turn, so any answer but a step-up means the approval was used.
+    if (isStepUp(forward)) {
+        args.approvalSettlement?.onNotSent();
+    }
+    else {
+        args.approvalSettlement?.onAccepted();
+    }
     if (forward.kind !== "ok") {
         return forward;
     }
@@ -2335,7 +2382,7 @@ async function promptExistingApplication(ctx, args) {
             : {}),
         reply: forward.value.reply,
         ...(forward.value.decision ? { decision: forward.value.decision } : {}),
-        editUrl: editUrl(ctx.config, applicationId, branch),
+        editUrl: editUrl(ctx, applicationId, branch),
         generationStatus: forward.value.generationStatus,
         mode: promptArgs.mode,
         ...(forward.value.recentRuns && forward.value.recentRuns.length > 0
@@ -2545,7 +2592,7 @@ export async function previewApp(ctx, input) {
             ...(input.branch ? { branch: input.branch } : {}),
             commitId: commit.commitId,
             directoryHash,
-            editUrl: editUrl(ctx.config, applicationId, input.branch),
+            editUrl: editUrl(ctx, applicationId, input.branch),
             ...(name ? { name } : {}),
             ...(needsBrowserDriver ? { needsBrowserDriver: true } : {}),
             openableViaHttps: openable.openableViaHttps,
@@ -2616,7 +2663,7 @@ export async function getPreviewStatus(ctx, input) {
         kind: "ok",
         value: {
             ...preview,
-            editUrl: editUrl(ctx.config, input.applicationId, input.branch),
+            editUrl: editUrl(ctx, input.applicationId, input.branch),
             status,
         },
     };
@@ -2773,7 +2820,7 @@ async function unbuiltApp(ctx, principal, applicationId, requestedBranch) {
     const app = await withBrowser(ctx, {
         applicationId,
         ...(actualBranch ? { branch: actualBranch } : {}),
-        editUrl: editUrl(ctx.config, applicationId, actualBranch),
+        editUrl: editUrl(ctx, applicationId, actualBranch),
         ...(name ? { name } : {}),
     });
     if (reason.kind === "awaiting_decision") {
@@ -2872,7 +2919,7 @@ export async function askUser(ctx, input) {
     const app = {
         applicationId,
         ...(branch ? { branch } : {}),
-        editUrl: editUrl(ctx.config, applicationId, branch),
+        editUrl: editUrl(ctx, applicationId, branch),
         ...(unbuilt?.value.name ? { name: unbuilt.value.name } : {}),
     };
     if (!unbuilt || unbuilt.value.status !== "needs_decision") {
@@ -2959,7 +3006,7 @@ export async function getApp(ctx, input) {
         value: await withBrowser(ctx, {
             applicationId,
             ...(branch ? { branch } : {}),
-            editUrl: editUrl(ctx.config, applicationId, branch),
+            editUrl: editUrl(ctx, applicationId, branch),
             ...(name ? { name } : {}),
             ...(liveShot.needsBrowserDriver ? { needsBrowserDriver: true } : {}),
             openableViaHttps: isHttpsUrl(previewUrl),