@usabledev/usable-chat 1.214.0 → 1.215.1

package/cli.js

@@ -91866,6 +91866,35 @@ var init_emitter = __esm({
   }
 });
 
+// src/core/orchestrator/interactive-capabilities-prompt.ts
+function buildInteractiveCapabilitiesPrompt(input) {
+  const tools = new Set(input.tools);
+  const lines = [];
+  if (tools.has("ask-subagent") && input.searchExpertAvailable) {
+    lines.push(
+      "Public web research, news, documentation and ordinary URL extraction: delegate to search-expert using ask-subagent. The expert returns sources; synthesize them for the user."
+    );
+  }
+  if (tools.has("browser")) {
+    lines.push(
+      "You, the main agent, can use `browser` for live page inspection, authenticated pages, navigation, clicks, typing and other browser input. Keep the stateful browser session under main-agent control. Public research remains with the search expert when available; a mixed task can research first, then interact with the returned site.",
+      'For website sign-in call browser with action "login". The user selects or enters credentials in a secure card; you receive status only. Use action "handoff" for captchas, 2FA, user takeover and irreversible-action confirmation. After hand back, read a fresh snapshot. Never request passwords or codes in chat, or type them yourself. These tools also work in signed-in Work mode when present.'
+    );
+  }
+  if (tools.has("vault_secret_request")) {
+    lines.push(
+      "When a credential/API key is missing, call `vault_secret_request` to open a trusted secure form. Prefer an existing suitable secret from vault_secret_list. The user submits directly to Vault; you only receive the full secret UUID, name/reference and status. Never ask for secret values in chat or an ordinary question form.",
+      "Saving a secret does not grant access to an integration or Work command. Follow the separate consumer approval/grant flow. A declined or expired request is not permission to retry automatically."
+    );
+  }
+  return lines.length ? ["## Research, browser and secure input", ...lines].join("\n\n") : null;
+}
+var init_interactive_capabilities_prompt = __esm({
+  "src/core/orchestrator/interactive-capabilities-prompt.ts"() {
+    "use strict";
+  }
+});
+
 // src/components/chat/language-prompt.ts
 var LANGUAGE_PROMPT;
 var init_language_prompt = __esm({
@@ -163655,6 +163684,36 @@ var init_store = __esm({
   }
 });
 
+// src/core/secret-request/contracts.ts
+var secretRequestSchema, secretRequestDescriptorSchema, secretRequestSubmissionSchema, secretRequestResumeSchema;
+var init_contracts = __esm({
+  "src/core/secret-request/contracts.ts"() {
+    "use strict";
+    init_zod();
+    secretRequestSchema = external_exports.object({
+      suggestedName: external_exports.string().min(1).max(255),
+      type: external_exports.enum(["generic", "env-var", "api-key", "git-ssh"]),
+      provider: external_exports.string().min(1).max(64),
+      reason: external_exports.string().min(1).max(280).refine((value) => !/https?:\/\/|www\./i.test(value), "Use plain text without links")
+    }).strict();
+    secretRequestDescriptorSchema = secretRequestSchema.extend({
+      requestId: external_exports.string().uuid(),
+      resumeToken: external_exports.string().uuid(),
+      expiresAt: external_exports.string().datetime()
+    }).strict();
+    secretRequestSubmissionSchema = external_exports.discriminatedUnion("choice", [
+      external_exports.object({
+        choice: external_exports.literal("create"),
+        name: external_exports.string().min(1).max(255),
+        value: external_exports.string().min(1).max(1e4)
+      }).strict(),
+      external_exports.object({ choice: external_exports.literal("existing"), secretId: external_exports.string().uuid() }).strict(),
+      external_exports.object({ choice: external_exports.literal("decline") }).strict()
+    ]);
+    secretRequestResumeSchema = external_exports.object({ resumeToken: external_exports.string().uuid() }).strict();
+  }
+});
+
 // src/core/ask-question/tool.ts
 function isAskQuestionPause(output) {
   if (!output || typeof output !== "object") return false;
@@ -163695,6 +163754,20 @@ function isMcpApprovalPause(output) {
   return pause !== void 0 && pause.kind === MCP_APPROVAL_PAUSE_KIND && typeof pause.resumeToken === "string" && typeof pause.mcpApproval?.profileId === "string" && typeof pause.mcpApproval.fingerprint === "string";
 }
 function detectPause(toolResult, toolCallId) {
+  if (toolResult && typeof toolResult === "object") {
+    const pause = toolResult.__pause;
+    if (pause?.kind === "secret-request") {
+      const parsed = secretRequestDescriptorSchema.safeParse(pause.secretRequest);
+      if (parsed.success && parsed.data.resumeToken === pause.resumeToken) {
+        return {
+          kind: "secret-request",
+          resumeToken: parsed.data.resumeToken,
+          secretRequest: parsed.data,
+          toolCallId
+        };
+      }
+    }
+  }
   if (isAskQuestionPause(toolResult)) {
     return {
       resumeToken: toolResult.__pause.resumeToken,
@@ -163726,6 +163799,7 @@ var MCP_APPROVAL_PAUSE_KIND, BROWSER_HANDOFF_PAUSE_KIND;
 var init_envelope = __esm({
   "src/core/pause/envelope.ts"() {
     "use strict";
+    init_contracts();
     init_tool();
     MCP_APPROVAL_PAUSE_KIND = "mcp-approval";
     BROWSER_HANDOFF_PAUSE_KIND = "browser-handoff";
@@ -207852,7 +207926,6 @@ var init_search_expert = __esm({
       "current information",
       "recent updates",
       "what's new",
-      "search for",
       "find information about",
       "context7",
       "documentation for",
@@ -207886,6 +207959,9 @@ You search the web and documentation, then return STRUCTURED DATA to the main as
 - **WebSearch**: General web search
 - **Context7 tools**: Library documentation lookup (use resolve-library-id first, then query-docs)
 
+## Browser boundary
+You research public sources. The main agent owns interactive/authenticated browser sessions, Secure Login, user takeover and secret requests. If a page requires interaction or sign-in, return its URL and the required action to the main agent. Never request credentials.
+
 ## Search Strategy
 1. For library docs \u2192 Use Context7 tools first
 2. For general info \u2192 Use exa-search or WebSearch
@@ -207924,6 +208000,10 @@ You MUST respond with a JSON object. Do NOT write long explanations. Your respon
       temperature: 0.5,
       canHandle: (query, _context) => {
         const lowerQuery = query.toLowerCase();
+        if (/\b(sign[ -]?in|log[ -]?in|click|type into|fill (?:in |out )?|take over|checkout)\b/i.test(
+          query
+        ))
+          return false;
         for (const keyword of SEARCH_KEYWORDS) {
           if (lowerQuery.includes(keyword)) {
             return true;
@@ -208470,6 +208550,7 @@ var init_tool_categories = __esm({
       "browser_folder__edit_file",
       "browser_folder__create_directory",
       "browser_folder__delete_entry",
+      "vault_secret_request",
       "update_todo_list",
       "update_agent_personalization"
     ];
@@ -209857,7 +209938,7 @@ Each expert has access to specific tools and knowledge for their domain.
 ${getExpertsDescription()}
 
 **When to use:**
-- **search-expert**: For web searches, online research, and library documentation
+- **search-expert**: Public web searches, online research, ordinary URL extraction and library documentation. Keep authenticated browser interaction, clicking/typing, Secure Login, takeover and secret requests with the main agent.
 - **image-expert**: For generating **photorealistic / artistic imagery** or analyzing images (ALWAYS use targetFileIds for image analysis!)
 
 **\u26A0\uFE0F Do NOT delegate diagrams / flowcharts / sequence diagrams / SVG illustrations to image-expert.** Emit a \`<visualization>\` block yourself instead \u2014 the sandboxed iframe renders Chart.js, D3, Plotly, Three.js, and raw SVG directly. The image-expert is reserved for pixel imagery that cannot be produced with inline SVG or CDN JS libraries.
@@ -221158,6 +221239,7 @@ __export2(store_exports, {
   claimConsume: () => claimConsume,
   deletePauseState: () => deletePauseState,
   getPauseState: () => getPauseState,
+  releaseConsumeClaim: () => releaseConsumeClaim,
   setInFlightStreamKey: () => setInFlightStreamKey,
   storePauseState: () => storePauseState
 });
@@ -221288,6 +221370,10 @@ async function setInFlightStreamKey(resumeToken, streamKey) {
   }
   throw new Error("Redis unavailable; cannot register resumable stream");
 }
+async function releaseConsumeClaim(resumeToken) {
+  const redis = getRedis();
+  if (redis) await redis.del(consumedKey(resumeToken));
+}
 var KEY_PREFIX;
 var init_store2 = __esm({
   "src/core/ask-question/store.ts"() {
@@ -342881,7 +342967,7 @@ var init_image_content_resolver = __esm({
 
 // src/core/work-runtime/contracts.ts
 var workVisitorPrincipalSchema, workIdentityBindingSchema, workRunBindingSchema, workCapabilitySchema, workAdmissionLeaseSchema, workAdmissionRequestSchema, workResumeRequestSchema, workCredentialResolutionRequestSchema, workCredentialResolutionResultSchema, workEventSchema, workProviderStreamRequestSchema, workProviderStreamEventSchema, workSnapshotBarrierSchema, workDescendantFenceSchema, workAdmissionResultSchema, workRecoveryQualificationSchema, dataProcessLaunchRequestSchema, dataProcessLaunchReceiptSchema, workDataTransferSchema, dataProcessSessionSchema, dataProcessDispatchRequestSchema, dataProcessDispatchReceiptSchema, workLocalBridgeRequestSchema, workLocalBridgeResultSchema;
-var init_contracts = __esm({
+var init_contracts2 = __esm({
   "src/core/work-runtime/contracts.ts"() {
     "use strict";
     init_zod();
@@ -343055,7 +343141,7 @@ var init_artifacts = __esm({
   "src/core/work-runtime/artifacts.ts"() {
     "use strict";
     init_zod();
-    init_contracts();
+    init_contracts2();
     workArtifactSchema = external_exports.object({
       fileId: external_exports.string().uuid(),
       conversationId: external_exports.string().uuid(),
@@ -362549,7 +362635,7 @@ var claimsSchema;
 var init_resume_proof = __esm({
   "src/lib/work-runtime/resume-proof.ts"() {
     "use strict";
-    init_contracts();
+    init_contracts2();
     init_zod();
     claimsSchema = external_exports.object({
       proofId: external_exports.string().uuid(),
@@ -362681,7 +362767,7 @@ var init_visitor_authority = __esm({
     init_embed_key_service();
     init_embed_config_service();
     init_pat_validation_service();
-    init_contracts();
+    init_contracts2();
     init_host_jwt();
     init_resume_proof();
     init_storage_client();
@@ -362954,7 +363040,7 @@ var init_credit_preflight_service = __esm({
 var init_broker = __esm({
   "src/core/work-runtime/broker.ts"() {
     "use strict";
-    init_contracts();
+    init_contracts2();
   }
 });
 
@@ -363026,7 +363112,7 @@ var init_broker_session = __esm({
     "use strict";
     init_config();
     init_redis();
-    init_contracts();
+    init_contracts2();
     init_api2();
   }
 });
@@ -363222,7 +363308,7 @@ var init_storage_authorization = __esm({
     init_schema3();
     init_schema_work_identity();
     init_schema_work_storage();
-    init_contracts();
+    init_contracts2();
     init_work_eligibility_service();
     init_credit_preflight_service();
     init_broker_session();
@@ -364733,7 +364819,10 @@ function createPauseCallback({
       data2.kind === "mcp-approval" ? "Pause detected \u2014 MCP approval (deferred persist)" : data2.kind === "browser-handoff" ? "Pause detected \u2014 browser handoff (deferred persist)" : "Pause detected \u2014 askUserQuestion (deferred persist)",
       {
         resumeToken: data2.resumeToken,
-        ...data2.kind === "mcp-approval" ? { profileId: data2.mcpApproval.profileId } : data2.kind === "browser-handoff" ? { browserSessionId: data2.browserHandoff.sessionId, reason: data2.browserHandoff.reason } : { questionCount: data2.questions.length }
+        ...data2.kind === "mcp-approval" ? { profileId: data2.mcpApproval.profileId } : data2.kind === "browser-handoff" ? {
+          browserSessionId: data2.browserHandoff.sessionId,
+          reason: data2.browserHandoff.reason
+        } : data2.kind === "secret-request" ? { requestId: data2.secretRequest.requestId } : { questionCount: data2.questions.length }
       }
     );
     pendingPauseRef.current = { data: data2 };
@@ -364776,7 +364865,7 @@ async function drainPendingPause({
   resolveStreamComplete
 }) {
   const { data: data2 } = pending;
-  if (data2.kind === "browser-handoff") {
+  if (data2.kind === "browser-handoff" || data2.kind === "secret-request") {
     return drainBrowserHandoffPause({
       data: data2,
       toolCalls,
@@ -364947,12 +365036,14 @@ async function drainBrowserHandoffPause({
   resolveStreamComplete
 }) {
   const { buildBrowserHandoffPlaceholder: buildBrowserHandoffPlaceholder2 } = await Promise.resolve().then(() => (init_browser_handoff(), browser_handoff_exports));
-  const pausedToolUseId = toolCalls.find((tc) => tc.id === data2.toolCallId)?.id ?? [...toolCalls].reverse().find((tc) => tc.name === "browser" || tc.name === "computer")?.id;
+  const pausedToolUseId = toolCalls.find((tc) => tc.id === data2.toolCallId)?.id ?? [...toolCalls].reverse().find(
+    (tc) => tc.name === "browser" || tc.name === "computer" || tc.name === "vault_secret_request"
+  )?.id;
   if (pausedToolUseId) {
     replacePauseToolResultPlaceholder(
       conversationMessages,
       pausedToolUseId,
-      buildBrowserHandoffPlaceholder2(data2.browserHandoff)
+      data2.kind === "secret-request" ? "[Awaiting secure Vault input from the user]" : buildBrowserHandoffPlaceholder2(data2.browserHandoff)
     );
   } else {
     orchestrationLogger.warn("Browser handoff pause signaled but its tool_call was not found");
@@ -364962,9 +365053,9 @@ async function drainBrowserHandoffPause({
   const now2 = /* @__PURE__ */ new Date();
   try {
     const { storePauseState: storePauseState2 } = await Promise.resolve().then(() => (init_store2(), store_exports));
-    await storePauseState2({
-      kind: "browser-handoff",
-      browserHandoff: data2.browserHandoff,
+    const state4 = {
+      kind: data2.kind,
+      ...data2.kind === "secret-request" ? { secretRequest: data2.secretRequest } : { browserHandoff: data2.browserHandoff },
       resumeToken: data2.resumeToken,
       userId: context3.session?.user?.id || "",
       conversationId: context3.metadata?.conversationId,
@@ -364980,14 +365071,17 @@ async function drainBrowserHandoffPause({
       embedSnapshot,
       pausedAt: now2.toISOString(),
       expiresAt: new Date(now2.getTime() + 60 * 60 * 1e3).toISOString()
-    });
+    };
+    if (context3.persistPauseState) await context3.persistPauseState(state4);
+    else await storePauseState2(state4);
   } catch (error41) {
+    if (context3.persistPauseState || data2.kind === "secret-request") throw error41;
     orchestrationLogger.warn("Browser handoff pause cache unavailable; hand back still works", {
       resumeToken: data2.resumeToken,
       error: error41 instanceof Error ? error41.message : String(error41)
     });
   }
-  const handoffEvent = emitter.emit(
+  const handoffEvent = data2.kind === "secret-request" ? emitter.emit("secret-request", data2.secretRequest) : emitter.emit(
     "browser-handoff-request",
     {
       interactionId: data2.resumeToken,
@@ -364996,12 +365090,6 @@ async function drainBrowserHandoffPause({
     }
   );
   multiplexer.send(handoffEvent);
-  orchestrationLogger.info("Browser handoff requested, closing stream", {
-    resumeToken: data2.resumeToken,
-    browserSessionId: data2.browserHandoff.sessionId,
-    pausedToolUseId,
-    lastSequence
-  });
   multiplexer.close();
   resolveStreamComplete();
 }
@@ -367571,25 +367659,11 @@ ${f20.content}`);
   } else if (persona.system) {
     systemMessageParts.push(persona.system);
   }
-  if (mcpTools && ("exa-search" in mcpTools || "exa-get-contents" in mcpTools)) {
-    const capabilities = [];
-    if ("exa-search" in mcpTools) {
-      capabilities.push("Exa.ai neural web search for finding current information, news, or facts");
-    }
-    if ("exa-get-contents" in mcpTools) {
-      capabilities.push(
-        "Exa.ai URL content extraction for reading full articles from specific URLs"
-      );
-    }
-    systemMessageParts.push(
-      `
-You have access to ${capabilities.join(" and ")}. Use exa-search when you need to find information, and use exa-get-contents when you have a specific URL and need to read its full content (e.g., news articles, government portals, blog posts).`
-    );
-    orchestrationLogger.info("Web search enabled - Exa.ai tools available", {
-      hasSearch: "exa-search" in mcpTools,
-      hasContentExtraction: "exa-get-contents" in mcpTools
-    });
-  }
+  const interactiveGuidance = buildInteractiveCapabilitiesPrompt({
+    tools: Object.keys(aiTools),
+    searchExpertAvailable: experts.some((expert) => expert.id === "search-expert")
+  });
+  if (interactiveGuidance) systemMessageParts.push(interactiveGuidance);
   if (shouldInjectVisualizationPrompt(config3)) {
     systemMessageParts.push(VISUALIZATION_PROMPT);
   }
@@ -369272,7 +369346,11 @@ Continue once without hiding or replacing your prior response.`
                       { type: "text", text: toolResult.summarizedContent },
                       {
                         type: "image",
-                        source: { type: "base64", media_type: shot.mimeType, data: shot.base64 }
+                        source: {
+                          type: "base64",
+                          media_type: shot.mimeType,
+                          data: shot.base64
+                        }
                       }
                     ] : toolResult.summarizedContent,
                     // Use summarized content for history
@@ -369675,6 +369753,7 @@ var HARNESS_COMPACT_RATIO, HARNESS_KEEP_RECENT_RATIO, KEEP_ALL_TOOL_TURNS, HARD_
 var init_orchestrator = __esm({
   "src/core/orchestrator/index.ts"() {
     "use strict";
+    init_interactive_capabilities_prompt();
     init_language_prompt();
     init_visualization_prompt();
     init_data_staging_prompt();
@@ -392999,7 +393078,7 @@ init_tui_select();
 init_model_registry();
 
 // package.json
-var version2 = "1.214.0";
+var version2 = "1.215.1";
 
 // src/adapters/cli/model-catalog.ts
 init_codex_auth();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usabledev/usable-chat",
-  "version": "1.214.0",
+  "version": "1.215.1",
   "description": "usable-chat — terminal harness for usable-chat (headless + TUI)",
   "type": "module",
   "bin": {