@the-open-engine/zeroshot 6.32.1 → 6.33.0

package/lib/target/discovery.cjs

@@ -33,52 +33,27 @@ const ROOT_FIELDS = [
     'transport',
     'extensions',
 ];
-async function readBoundedJson(response) {
-    return (0, bounded_response_js_1.readBoundedResponseJson)(response, MAX_DISCOVERY_BYTES, (kind) => new discovery_errors_js_1.TargetDiscoveryError(kind === 'size' ? 'response exceeds the size limit' : 'response is not valid UTF-8 JSON'));
-}
-async function fetchDocument(http, url) {
-    const response = await http.fetch(url, {
-        method: 'GET',
-        headers: { Accept: 'application/json' },
-        redirect: 'error',
-    });
-    if (response.url && new URL(response.url).href !== url) {
-        await response.body?.cancel().catch(() => undefined);
-        throw new discovery_errors_js_1.TargetDiscoveryError('request changed target route or authority');
-    }
-    if (!response.ok) {
-        await response.body?.cancel().catch(() => undefined);
-        throw new discovery_errors_js_1.TargetDiscoveryError(`request failed with status ${response.status}`);
-    }
-    return (0, discovery_validation_js_1.record)(await readBoundedJson(response), 'response');
-}
-async function discoverTarget(targetUrl, http) {
-    const target = new URL(targetUrl);
-    const origin = target.origin;
-    const discovery = await fetchDocument(http, new URL(DISCOVERY_PATH, target).href);
+const FLAGS = [
+    'capsule_allocate',
+    'capsule_read',
+    'capsule_terminate',
+    'capsule_access',
+    'connections_onboarding',
+];
+const SIZE_ERROR = 'response exceeds the size limit';
+const JSON_ERROR = 'response is not valid UTF-8 JSON';
+function parseDiscoveryDocument(discovery, origin) {
     (0, discovery_validation_js_1.exact)(discovery.kind, 'openengine.hosted-target/v1', 'kind');
     const adapter = (0, discovery_sections_js_1.parseAdapter)(discovery);
     const endpoint = (0, discovery_sections_js_1.parseEndpoint)(discovery, origin);
     const capsule = (0, discovery_sections_js_1.parseCapsule)(discovery, origin);
     const oauth = (0, discovery_sections_js_1.parseOAuth)(discovery, origin);
     (0, discovery_validation_js_1.exact)(discovery.organization_binding, 'device_approval', 'organization_binding');
-    const capabilityFlags = (0, discovery_validation_js_1.exactStringSet)(discovery.capability_flags, 'capability_flags', [
-        'capsule_allocate',
-        'capsule_read',
-        'capsule_terminate',
-        'capsule_access',
-        'connections_onboarding',
-    ]);
+    const capabilityFlags = (0, discovery_validation_js_1.exactStringSet)(discovery.capability_flags, 'capability_flags', FLAGS);
     const sizes = (0, discovery_sections_js_1.parseSizes)(discovery);
     const session = (0, discovery_sections_js_1.parseSession)(discovery);
     const transport = (0, discovery_sections_js_1.parseTransport)(discovery);
-    const credentialInstall = (0, discovery_sections_js_1.parseExtensions)(discovery, origin);
-    const metadata = await fetchDocument(http, oauth.metadataUrl);
-    (0, discovery_sections_js_1.validateOAuthMetadata)(metadata, origin, [
-        oauth.deviceAuthorizationEndpoint,
-        oauth.tokenEndpoint,
-        oauth.revocationEndpoint,
-    ]);
+    const extensions = (0, discovery_sections_js_1.parseExtensions)(discovery, origin);
     const additional = Object.freeze(Object.fromEntries(Object.entries(discovery).filter(([key]) => !ROOT_FIELDS.includes(key))));
     return Object.freeze({
         origin,
@@ -92,10 +67,24 @@ async function discoverTarget(targetUrl, http) {
         capsule,
         transport,
         capabilityFlags,
-        credentialInstall,
+        credentialInstall: extensions.credentialInstall,
+        runIntent: extensions.runIntent,
         additional,
     });
 }
+async function discoverTarget(targetUrl, http) {
+    const target = new URL(targetUrl);
+    const origin = target.origin;
+    const discovery = await fetchDocument(http, new URL(DISCOVERY_PATH, target).href);
+    const descriptor = parseDiscoveryDocument(discovery, origin);
+    const metadata = await fetchDocument(http, descriptor.oauth.metadataUrl);
+    (0, discovery_sections_js_1.validateOAuthMetadata)(metadata, origin, [
+        descriptor.oauth.deviceAuthorizationEndpoint,
+        descriptor.oauth.tokenEndpoint,
+        descriptor.oauth.revocationEndpoint,
+    ]);
+    return descriptor;
+}
 async function discoverTargetSessionEndpoints(targetUrl, http) {
     const descriptor = await discoverTarget(targetUrl, http);
     return Object.freeze({
@@ -110,3 +99,25 @@ async function discoverTargetSessionEndpoints(targetUrl, http) {
         descriptor,
     });
 }
+function boundedResponseError(kind) {
+    return new discovery_errors_js_1.TargetDiscoveryError(kind === 'size' ? SIZE_ERROR : JSON_ERROR);
+}
+async function readBoundedJson(response) {
+    return (0, bounded_response_js_1.readBoundedResponseJson)(response, MAX_DISCOVERY_BYTES, boundedResponseError);
+}
+async function fetchDocument(http, url) {
+    const response = await http.fetch(url, {
+        method: 'GET',
+        headers: { Accept: 'application/json' },
+        redirect: 'error',
+    });
+    if (response.url && new URL(response.url).href !== url) {
+        await response.body?.cancel().catch(() => undefined);
+        throw new discovery_errors_js_1.TargetDiscoveryError('request changed target route or authority');
+    }
+    if (!response.ok) {
+        await response.body?.cancel().catch(() => undefined);
+        throw new discovery_errors_js_1.TargetDiscoveryError(`request failed with status ${response.status}`);
+    }
+    return (0, discovery_validation_js_1.record)(await readBoundedJson(response), 'response');
+}

package/lib/target/discovery.d.cts

@@ -1,7 +1,9 @@
 import type { HttpTransport } from './device-flow.js';
 import type { RouteTemplate } from './route-template.js';
 import { type CredentialInstallDescriptor } from './discovery-validation.js';
+import type { RunIntentDescriptor } from './run-intent-discovery.js';
 export type { CredentialInstallDescriptor } from './discovery-validation.js';
+export type { RunIntentDescriptor } from './run-intent-discovery.js';
 export { TargetDiscoveryError } from './discovery-errors.js';
 export { expandRoute, type RouteTemplate } from './route-template.js';
 declare const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
@@ -56,6 +58,7 @@ export interface TargetDiscoveryDescriptor {
     };
     readonly capabilityFlags: readonly string[];
     readonly credentialInstall: CredentialInstallDescriptor | null;
+    readonly runIntent: RunIntentDescriptor | null;
     readonly additional: Readonly<Record<string, unknown>>;
 }
 /** Compatibility projection. New callers should retain the complete descriptor. */

package/lib/target/discovery.d.mts

@@ -1,7 +1,9 @@
 import type { HttpTransport } from './device-flow.js';
 import type { RouteTemplate } from './route-template.js';
 import { type CredentialInstallDescriptor } from './discovery-validation.js';
+import type { RunIntentDescriptor } from './run-intent-discovery.js';
 export type { CredentialInstallDescriptor } from './discovery-validation.js';
+export type { RunIntentDescriptor } from './run-intent-discovery.js';
 export { TargetDiscoveryError } from './discovery-errors.js';
 export { expandRoute, type RouteTemplate } from './route-template.js';
 declare const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
@@ -56,6 +58,7 @@ export interface TargetDiscoveryDescriptor {
     };
     readonly capabilityFlags: readonly string[];
     readonly credentialInstall: CredentialInstallDescriptor | null;
+    readonly runIntent: RunIntentDescriptor | null;
     readonly additional: Readonly<Record<string, unknown>>;
 }
 /** Compatibility projection. New callers should retain the complete descriptor. */

package/lib/target/discovery.d.ts

@@ -1,7 +1,9 @@
 import type { HttpTransport } from './device-flow.js';
 import type { RouteTemplate } from './route-template.js';
 import { type CredentialInstallDescriptor } from './discovery-validation.js';
+import type { RunIntentDescriptor } from './run-intent-discovery.js';
 export type { CredentialInstallDescriptor } from './discovery-validation.js';
+export type { RunIntentDescriptor } from './run-intent-discovery.js';
 export { TargetDiscoveryError } from './discovery-errors.js';
 export { expandRoute, type RouteTemplate } from './route-template.js';
 declare const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
@@ -56,6 +58,7 @@ export interface TargetDiscoveryDescriptor {
     };
     readonly capabilityFlags: readonly string[];
     readonly credentialInstall: CredentialInstallDescriptor | null;
+    readonly runIntent: RunIntentDescriptor | null;
     readonly additional: Readonly<Record<string, unknown>>;
 }
 /** Compatibility projection. New callers should retain the complete descriptor. */

package/lib/target/discovery.js

@@ -33,52 +33,27 @@ const ROOT_FIELDS = [
     'transport',
     'extensions',
 ];
-async function readBoundedJson(response) {
-    return (0, bounded_response_js_1.readBoundedResponseJson)(response, MAX_DISCOVERY_BYTES, (kind) => new discovery_errors_js_1.TargetDiscoveryError(kind === 'size' ? 'response exceeds the size limit' : 'response is not valid UTF-8 JSON'));
-}
-async function fetchDocument(http, url) {
-    const response = await http.fetch(url, {
-        method: 'GET',
-        headers: { Accept: 'application/json' },
-        redirect: 'error',
-    });
-    if (response.url && new URL(response.url).href !== url) {
-        await response.body?.cancel().catch(() => undefined);
-        throw new discovery_errors_js_1.TargetDiscoveryError('request changed target route or authority');
-    }
-    if (!response.ok) {
-        await response.body?.cancel().catch(() => undefined);
-        throw new discovery_errors_js_1.TargetDiscoveryError(`request failed with status ${response.status}`);
-    }
-    return (0, discovery_validation_js_1.record)(await readBoundedJson(response), 'response');
-}
-async function discoverTarget(targetUrl, http) {
-    const target = new URL(targetUrl);
-    const origin = target.origin;
-    const discovery = await fetchDocument(http, new URL(DISCOVERY_PATH, target).href);
+const FLAGS = [
+    'capsule_allocate',
+    'capsule_read',
+    'capsule_terminate',
+    'capsule_access',
+    'connections_onboarding',
+];
+const SIZE_ERROR = 'response exceeds the size limit';
+const JSON_ERROR = 'response is not valid UTF-8 JSON';
+function parseDiscoveryDocument(discovery, origin) {
     (0, discovery_validation_js_1.exact)(discovery.kind, 'openengine.hosted-target/v1', 'kind');
     const adapter = (0, discovery_sections_js_1.parseAdapter)(discovery);
     const endpoint = (0, discovery_sections_js_1.parseEndpoint)(discovery, origin);
     const capsule = (0, discovery_sections_js_1.parseCapsule)(discovery, origin);
     const oauth = (0, discovery_sections_js_1.parseOAuth)(discovery, origin);
     (0, discovery_validation_js_1.exact)(discovery.organization_binding, 'device_approval', 'organization_binding');
-    const capabilityFlags = (0, discovery_validation_js_1.exactStringSet)(discovery.capability_flags, 'capability_flags', [
-        'capsule_allocate',
-        'capsule_read',
-        'capsule_terminate',
-        'capsule_access',
-        'connections_onboarding',
-    ]);
+    const capabilityFlags = (0, discovery_validation_js_1.exactStringSet)(discovery.capability_flags, 'capability_flags', FLAGS);
     const sizes = (0, discovery_sections_js_1.parseSizes)(discovery);
     const session = (0, discovery_sections_js_1.parseSession)(discovery);
     const transport = (0, discovery_sections_js_1.parseTransport)(discovery);
-    const credentialInstall = (0, discovery_sections_js_1.parseExtensions)(discovery, origin);
-    const metadata = await fetchDocument(http, oauth.metadataUrl);
-    (0, discovery_sections_js_1.validateOAuthMetadata)(metadata, origin, [
-        oauth.deviceAuthorizationEndpoint,
-        oauth.tokenEndpoint,
-        oauth.revocationEndpoint,
-    ]);
+    const extensions = (0, discovery_sections_js_1.parseExtensions)(discovery, origin);
     const additional = Object.freeze(Object.fromEntries(Object.entries(discovery).filter(([key]) => !ROOT_FIELDS.includes(key))));
     return Object.freeze({
         origin,
@@ -92,10 +67,24 @@ async function discoverTarget(targetUrl, http) {
         capsule,
         transport,
         capabilityFlags,
-        credentialInstall,
+        credentialInstall: extensions.credentialInstall,
+        runIntent: extensions.runIntent,
         additional,
     });
 }
+async function discoverTarget(targetUrl, http) {
+    const target = new URL(targetUrl);
+    const origin = target.origin;
+    const discovery = await fetchDocument(http, new URL(DISCOVERY_PATH, target).href);
+    const descriptor = parseDiscoveryDocument(discovery, origin);
+    const metadata = await fetchDocument(http, descriptor.oauth.metadataUrl);
+    (0, discovery_sections_js_1.validateOAuthMetadata)(metadata, origin, [
+        descriptor.oauth.deviceAuthorizationEndpoint,
+        descriptor.oauth.tokenEndpoint,
+        descriptor.oauth.revocationEndpoint,
+    ]);
+    return descriptor;
+}
 async function discoverTargetSessionEndpoints(targetUrl, http) {
     const descriptor = await discoverTarget(targetUrl, http);
     return Object.freeze({
@@ -110,3 +99,25 @@ async function discoverTargetSessionEndpoints(targetUrl, http) {
         descriptor,
     });
 }
+function boundedResponseError(kind) {
+    return new discovery_errors_js_1.TargetDiscoveryError(kind === 'size' ? SIZE_ERROR : JSON_ERROR);
+}
+async function readBoundedJson(response) {
+    return (0, bounded_response_js_1.readBoundedResponseJson)(response, MAX_DISCOVERY_BYTES, boundedResponseError);
+}
+async function fetchDocument(http, url) {
+    const response = await http.fetch(url, {
+        method: 'GET',
+        headers: { Accept: 'application/json' },
+        redirect: 'error',
+    });
+    if (response.url && new URL(response.url).href !== url) {
+        await response.body?.cancel().catch(() => undefined);
+        throw new discovery_errors_js_1.TargetDiscoveryError('request changed target route or authority');
+    }
+    if (!response.ok) {
+        await response.body?.cancel().catch(() => undefined);
+        throw new discovery_errors_js_1.TargetDiscoveryError(`request failed with status ${response.status}`);
+    }
+    return (0, discovery_validation_js_1.record)(await readBoundedJson(response), 'response');
+}

package/lib/target/discovery.mjs

@@ -26,52 +26,27 @@ const ROOT_FIELDS = [
     'transport',
     'extensions',
 ];
-async function readBoundedJson(response) {
-    return readBoundedResponseJson(response, MAX_DISCOVERY_BYTES, (kind) => new TargetDiscoveryError(kind === 'size' ? 'response exceeds the size limit' : 'response is not valid UTF-8 JSON'));
-}
-async function fetchDocument(http, url) {
-    const response = await http.fetch(url, {
-        method: 'GET',
-        headers: { Accept: 'application/json' },
-        redirect: 'error',
-    });
-    if (response.url && new URL(response.url).href !== url) {
-        await response.body?.cancel().catch(() => undefined);
-        throw new TargetDiscoveryError('request changed target route or authority');
-    }
-    if (!response.ok) {
-        await response.body?.cancel().catch(() => undefined);
-        throw new TargetDiscoveryError(`request failed with status ${response.status}`);
-    }
-    return record(await readBoundedJson(response), 'response');
-}
-export async function discoverTarget(targetUrl, http) {
-    const target = new URL(targetUrl);
-    const origin = target.origin;
-    const discovery = await fetchDocument(http, new URL(DISCOVERY_PATH, target).href);
+const FLAGS = [
+    'capsule_allocate',
+    'capsule_read',
+    'capsule_terminate',
+    'capsule_access',
+    'connections_onboarding',
+];
+const SIZE_ERROR = 'response exceeds the size limit';
+const JSON_ERROR = 'response is not valid UTF-8 JSON';
+function parseDiscoveryDocument(discovery, origin) {
     exact(discovery.kind, 'openengine.hosted-target/v1', 'kind');
     const adapter = parseAdapter(discovery);
     const endpoint = parseEndpoint(discovery, origin);
     const capsule = parseCapsule(discovery, origin);
     const oauth = parseOAuth(discovery, origin);
     exact(discovery.organization_binding, 'device_approval', 'organization_binding');
-    const capabilityFlags = exactStringSet(discovery.capability_flags, 'capability_flags', [
-        'capsule_allocate',
-        'capsule_read',
-        'capsule_terminate',
-        'capsule_access',
-        'connections_onboarding',
-    ]);
+    const capabilityFlags = exactStringSet(discovery.capability_flags, 'capability_flags', FLAGS);
     const sizes = parseSizes(discovery);
     const session = parseSession(discovery);
     const transport = parseTransport(discovery);
-    const credentialInstall = parseExtensions(discovery, origin);
-    const metadata = await fetchDocument(http, oauth.metadataUrl);
-    validateOAuthMetadata(metadata, origin, [
-        oauth.deviceAuthorizationEndpoint,
-        oauth.tokenEndpoint,
-        oauth.revocationEndpoint,
-    ]);
+    const extensions = parseExtensions(discovery, origin);
     const additional = Object.freeze(Object.fromEntries(Object.entries(discovery).filter(([key]) => !ROOT_FIELDS.includes(key))));
     return Object.freeze({
         origin,
@@ -85,10 +60,24 @@ export async function discoverTarget(targetUrl, http) {
         capsule,
         transport,
         capabilityFlags,
-        credentialInstall,
+        credentialInstall: extensions.credentialInstall,
+        runIntent: extensions.runIntent,
         additional,
     });
 }
+export async function discoverTarget(targetUrl, http) {
+    const target = new URL(targetUrl);
+    const origin = target.origin;
+    const discovery = await fetchDocument(http, new URL(DISCOVERY_PATH, target).href);
+    const descriptor = parseDiscoveryDocument(discovery, origin);
+    const metadata = await fetchDocument(http, descriptor.oauth.metadataUrl);
+    validateOAuthMetadata(metadata, origin, [
+        descriptor.oauth.deviceAuthorizationEndpoint,
+        descriptor.oauth.tokenEndpoint,
+        descriptor.oauth.revocationEndpoint,
+    ]);
+    return descriptor;
+}
 export async function discoverTargetSessionEndpoints(targetUrl, http) {
     const descriptor = await discoverTarget(targetUrl, http);
     return Object.freeze({
@@ -103,3 +92,25 @@ export async function discoverTargetSessionEndpoints(targetUrl, http) {
         descriptor,
     });
 }
+function boundedResponseError(kind) {
+    return new TargetDiscoveryError(kind === 'size' ? SIZE_ERROR : JSON_ERROR);
+}
+async function readBoundedJson(response) {
+    return readBoundedResponseJson(response, MAX_DISCOVERY_BYTES, boundedResponseError);
+}
+async function fetchDocument(http, url) {
+    const response = await http.fetch(url, {
+        method: 'GET',
+        headers: { Accept: 'application/json' },
+        redirect: 'error',
+    });
+    if (response.url && new URL(response.url).href !== url) {
+        await response.body?.cancel().catch(() => undefined);
+        throw new TargetDiscoveryError('request changed target route or authority');
+    }
+    if (!response.ok) {
+        await response.body?.cancel().catch(() => undefined);
+        throw new TargetDiscoveryError(`request failed with status ${response.status}`);
+    }
+    return record(await readBoundedJson(response), 'response');
+}

package/lib/target/index.d.ts

@@ -3,4 +3,4 @@ export { acquireTargetLock } from './credential-lock.js';
 export { requestDeviceCode, pollForToken, parseTokenResponse, DeviceFlowDeniedError, DeviceFlowExpiredError, UnboundSessionError, type DeviceCodeResponse, type DeviceExchangeContext, type TokenResponse, type HttpTransport, type Clock, } from './device-flow.js';
 export { addTarget, removeTarget, getTarget, listTargets, updateTargetOrganization, validateTargetName, normalizeAndValidateUrl, TargetNameInvalidError, TargetNameExistsError, TargetNotFoundError, TargetUrlInvalidError, type TargetRecord, type SettingsPort, } from './target-registry.js';
 export { TargetSessionManager, LoginRequiredError, type BrowserOpener, type TargetSessionDeps, type TargetSessionManagerInit, } from './target-session.js';
-export { discoverTarget, discoverTargetSessionEndpoints, expandRoute, TargetDiscoveryError, type CredentialInstallDescriptor, type RouteTemplate, type TargetDiscoveryDescriptor, type TargetSessionEndpoints, } from './discovery.js';
+export { discoverTarget, discoverTargetSessionEndpoints, expandRoute, TargetDiscoveryError, type CredentialInstallDescriptor, type RunIntentDescriptor, type RouteTemplate, type TargetDiscoveryDescriptor, type TargetSessionEndpoints, } from './discovery.js';

package/lib/target/run-intent-discovery.cjs

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseRunIntent = parseRunIntent;
+const route_template_js_1 = require("./route-template.cjs");
+const discovery_validation_js_1 = require("./discovery-validation.cjs");
+function parseRunIntent(value, origin) {
+    if (value === undefined || value === null)
+        return null;
+    const extension = (0, discovery_validation_js_1.closedRecord)(value, 'extensions.run_intent', [
+        'kind',
+        'base_url',
+        'route_templates',
+    ]);
+    (0, discovery_validation_js_1.exact)(extension.kind, 'zeroshot.run-intent/v2', 'extensions.run_intent.kind');
+    const routes = (0, discovery_validation_js_1.closedRecord)(extension.route_templates, 'extensions.run_intent.route_templates', [
+        'submit',
+        'status',
+        'cancel',
+    ]);
+    const route = (name, variables) => (0, route_template_js_1.routeTemplate)(routes[name], `extensions.run_intent.route_templates.${name}`, variables);
+    return Object.freeze({
+        kind: 'zeroshot.run-intent/v2',
+        baseUrl: (0, discovery_validation_js_1.sameOriginUrl)(extension.base_url, 'extensions.run_intent.base_url', origin),
+        routes: Object.freeze({
+            submit: route('submit', ['org_id']),
+            status: route('status', ['org_id', 'intent_id']),
+            cancel: route('cancel', ['org_id', 'intent_id']),
+        }),
+    });
+}

package/lib/target/run-intent-discovery.d.cts

@@ -0,0 +1,11 @@
+import type { RouteTemplate } from './route-template.js';
+export interface RunIntentDescriptor {
+    readonly kind: 'zeroshot.run-intent/v2';
+    readonly baseUrl: string;
+    readonly routes: {
+        readonly submit: RouteTemplate;
+        readonly status: RouteTemplate;
+        readonly cancel: RouteTemplate;
+    };
+}
+export declare function parseRunIntent(value: unknown, origin: string): RunIntentDescriptor | null;

package/lib/target/run-intent-discovery.d.mts

@@ -0,0 +1,11 @@
+import type { RouteTemplate } from './route-template.js';
+export interface RunIntentDescriptor {
+    readonly kind: 'zeroshot.run-intent/v2';
+    readonly baseUrl: string;
+    readonly routes: {
+        readonly submit: RouteTemplate;
+        readonly status: RouteTemplate;
+        readonly cancel: RouteTemplate;
+    };
+}
+export declare function parseRunIntent(value: unknown, origin: string): RunIntentDescriptor | null;

package/lib/target/run-intent-discovery.d.ts

@@ -0,0 +1,11 @@
+import type { RouteTemplate } from './route-template.js';
+export interface RunIntentDescriptor {
+    readonly kind: 'zeroshot.run-intent/v2';
+    readonly baseUrl: string;
+    readonly routes: {
+        readonly submit: RouteTemplate;
+        readonly status: RouteTemplate;
+        readonly cancel: RouteTemplate;
+    };
+}
+export declare function parseRunIntent(value: unknown, origin: string): RunIntentDescriptor | null;

package/lib/target/run-intent-discovery.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseRunIntent = parseRunIntent;
+const route_template_js_1 = require("./route-template.js");
+const discovery_validation_js_1 = require("./discovery-validation.js");
+function parseRunIntent(value, origin) {
+    if (value === undefined || value === null)
+        return null;
+    const extension = (0, discovery_validation_js_1.closedRecord)(value, 'extensions.run_intent', [
+        'kind',
+        'base_url',
+        'route_templates',
+    ]);
+    (0, discovery_validation_js_1.exact)(extension.kind, 'zeroshot.run-intent/v2', 'extensions.run_intent.kind');
+    const routes = (0, discovery_validation_js_1.closedRecord)(extension.route_templates, 'extensions.run_intent.route_templates', [
+        'submit',
+        'status',
+        'cancel',
+    ]);
+    const route = (name, variables) => (0, route_template_js_1.routeTemplate)(routes[name], `extensions.run_intent.route_templates.${name}`, variables);
+    return Object.freeze({
+        kind: 'zeroshot.run-intent/v2',
+        baseUrl: (0, discovery_validation_js_1.sameOriginUrl)(extension.base_url, 'extensions.run_intent.base_url', origin),
+        routes: Object.freeze({
+            submit: route('submit', ['org_id']),
+            status: route('status', ['org_id', 'intent_id']),
+            cancel: route('cancel', ['org_id', 'intent_id']),
+        }),
+    });
+}

package/lib/target/run-intent-discovery.mjs

@@ -0,0 +1,27 @@
+import { routeTemplate } from './route-template.mjs';
+import { closedRecord, exact, sameOriginUrl } from './discovery-validation.mjs';
+export function parseRunIntent(value, origin) {
+    if (value === undefined || value === null)
+        return null;
+    const extension = closedRecord(value, 'extensions.run_intent', [
+        'kind',
+        'base_url',
+        'route_templates',
+    ]);
+    exact(extension.kind, 'zeroshot.run-intent/v2', 'extensions.run_intent.kind');
+    const routes = closedRecord(extension.route_templates, 'extensions.run_intent.route_templates', [
+        'submit',
+        'status',
+        'cancel',
+    ]);
+    const route = (name, variables) => routeTemplate(routes[name], `extensions.run_intent.route_templates.${name}`, variables);
+    return Object.freeze({
+        kind: 'zeroshot.run-intent/v2',
+        baseUrl: sameOriginUrl(extension.base_url, 'extensions.run_intent.base_url', origin),
+        routes: Object.freeze({
+            submit: route('submit', ['org_id']),
+            status: route('status', ['org_id', 'intent_id']),
+            cancel: route('cancel', ['org_id', 'intent_id']),
+        }),
+    });
+}

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@the-open-engine/zeroshot",
-  "version": "6.32.1",
+  "version": "6.33.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@the-open-engine/zeroshot",
-      "version": "6.32.1",
+      "version": "6.33.0",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-open-engine/zeroshot",
-  "version": "6.32.1",
+  "version": "6.33.0",
   "description": "Independent executor–verifier orchestration for software changes.",
   "main": "src/orchestrator.js",
   "bin": {
@@ -77,7 +77,6 @@
     "protocol:generate": "node scripts/generate-cluster-types.js",
     "protocol:check": "cargo run -p openengine-cluster-testkit --bin generate-cluster-protocol -- --check && node scripts/generate-cluster-types.js --check",
     "rust:distribution:check": "node scripts/rust-distribution.js check-repository",
-    "hosted-oecp:image:check": "node scripts/hosted-oecp-image.js check",
     "rust:check": "cargo fmt --all -- --check && cargo clippy --workspace --all-targets -- -D warnings && cargo test --workspace",
     "deadcode": "ts-prune --skip node_modules",
     "deadcode:files": "unimported",
@@ -177,8 +176,8 @@
     "!scripts/hosted-oecp-ci-relevance.js",
     "!scripts/hosted-oecp-image.js",
     "!scripts/hosted-oecp-image-commands.js",
+    "!scripts/hosted-oecp-image-inspection.js",
     "!scripts/hosted-oecp-image-smoke.js",
-    "!scripts/hosted-oecp-manifest.js",
     "!scripts/hosted-oecp-smoke-capability.js",
     "!scripts/hosted-oecp-smoke-client.js",
     "!scripts/hosted-oecp-smoke-codex.mjs",

package/src/agent-cli-provider/adapters/codex.ts

@@ -55,11 +55,12 @@ function detectCliFeatures(
   const help = helpText ?? '';
   const unknown = !help;
   const supportsConfigOverride = supports(help, /--config\b/);
+  const supportsSandbox = !unknown && /--sandbox\b/.test(help);
   return {
     provider: 'codex',
     supportsJson: supports(help, /--json\b/),
     supportsOutputSchema: supports(help, /--output-schema\b/),
-    supportsAutoApprove: supports(help, /--dangerously-bypass-approvals-and-sandbox\b/),
+    supportsAutoApprove: !unknown && supportsConfigOverride && supportsSandbox,
     supportsCwd: supports(help, /\s-C\b/) || supports(help, /--cwd\b/),
     supportsConfigOverride,
     supportsModel: supports(help, /\s-m\b/) || supports(help, /--model\b/),
@@ -67,7 +68,7 @@ function detectCliFeatures(
     supportsResume: supports(help, /\bresume\b/),
     supportsWebSearch:
       !unknown && supportsConfigOverride && isCliVersionAtLeast(versionText, '0.146.0'),
-    supportsSandbox: !unknown && /--sandbox\b/.test(help),
+    supportsSandbox,
     supportsEphemeral: !unknown && /--ephemeral\b/.test(help),
     supportsIgnoreUserConfig: !unknown && /--ignore-user-config\b/.test(help),
     supportsIgnoreRules: !unknown && /--ignore-rules\b/.test(help),
@@ -113,7 +114,9 @@ function addCwdArgs(args: string[], options: BuildProviderCommandOptions): void
 function addAutoApproveArgs(args: string[], options: BuildProviderCommandOptions): void {
   const features = optionFeatures(options);
   if (options.autoApprove && features.supportsAutoApprove) {
-    args.push('--dangerously-bypass-approvals-and-sandbox');
+    const sandboxMode =
+      options.executionContext === 'docker' ? 'danger-full-access' : 'workspace-write';
+    args.push('--sandbox', sandboxMode, '--config', 'approval_policy="never"');
   }
 }
 
@@ -166,7 +169,7 @@ function collectWarnings(options: BuildProviderCommandOptions): WarningMetadata[
       warning(
         'codex',
         'codex-auto-approve',
-        'Codex CLI does not support auto-approve; continuing without bypass flag.'
+        'Codex CLI does not support unattended workspace-write mode; continuing without it.'
       )
     );
   }

package/src/hosted-target/adapter-request.ts

@@ -19,9 +19,14 @@ export type ExecuteArguments<T> = [
 ];
 
 export function requestUrl(path: string, descriptor: TargetDiscoveryDescriptor): URL {
-  const url = new globalThis.URL(path, descriptor.capsule.baseUrl);
-  if (url.origin !== descriptor.origin || url.hash ||
-      `${url.pathname}${url.search}` !== path) {
+  const baseUrl = new globalThis.URL(descriptor.capsule.baseUrl);
+  const requestPath = `${baseUrl.pathname.replace(/\/$/, '')}${path}`;
+  const url = new globalThis.URL(requestPath, baseUrl.origin);
+  if (
+    url.origin !== descriptor.origin ||
+    url.hash ||
+    `${url.pathname}${url.search}` !== requestPath
+  ) {
     throw new TargetProtocolError('Capsule route changed during URL canonicalization');
   }
   return url;