@vm0/cli 9.212.4 → 9.213.1

package/index.js

@@ -78,7 +78,7 @@ import {
   uo,
   volumeConfigSchema,
   withErrorHandler
-} from "./chunk-DNXUAGZZ.js";
+} from "./chunk-AFQMB63J.js";
 import "./chunk-NR42YJMI.js";
 import {
   __toESM,
@@ -412,7 +412,7 @@ function getConfigPath() {
   return join(os.homedir(), ".vm0", "config.json");
 }
 var infoCommand = new Command().name("info").description("Display environment and debug information").action(async () => {
-  console.log(source_default.bold(`VM0 CLI v${"9.212.4"}`));
+  console.log(source_default.bold(`VM0 CLI v${"9.213.1"}`));
   console.log();
   const config = await loadConfig();
   const hasEnvToken = !!process.env.VM0_TOKEN;
@@ -1114,7 +1114,7 @@ var composeCommand = new Command().name("compose").description("Create or update
         options.autoUpdate = false;
       }
       if (options.autoUpdate !== false) {
-        await startSilentUpgrade("9.212.4");
+        await startSilentUpgrade("9.213.1");
       }
       try {
         const { config, agentName, agent, basePath } = await loadAndValidateConfig(resolvedConfigFile);
@@ -1211,7 +1211,7 @@ var mainRunCommand = new Command().name("run").description("Run an agent").argum
   withErrorHandler(
     async (identifier, prompt, options) => {
       if (options.autoUpdate !== false) {
-        await startSilentUpgrade("9.212.4");
+        await startSilentUpgrade("9.213.1");
       }
       const { name, version } = parseIdentifier(identifier);
       let composeId;
@@ -3070,13 +3070,13 @@ var upgradeCommand = new Command().name("upgrade").description("Upgrade vm0 CLI
     if (latestVersion === null) {
       throw new Error("Could not check for updates. Please try again later.");
     }
-    if (latestVersion === "9.212.4") {
-      console.log(source_default.green(`\u2713 Already up to date (${"9.212.4"})`));
+    if (latestVersion === "9.213.1") {
+      console.log(source_default.green(`\u2713 Already up to date (${"9.213.1"})`));
       return;
     }
     console.log(
       source_default.yellow(
-        `Current version: ${"9.212.4"} -> Latest version: ${latestVersion}`
+        `Current version: ${"9.213.1"} -> Latest version: ${latestVersion}`
       )
     );
     console.log();
@@ -3103,7 +3103,7 @@ var upgradeCommand = new Command().name("upgrade").description("Upgrade vm0 CLI
     const success = await performUpgrade(packageManager);
     if (success) {
       console.log(
-        source_default.green(`\u2713 Upgraded from ${"9.212.4"} to ${latestVersion}`)
+        source_default.green(`\u2713 Upgraded from ${"9.213.1"} to ${latestVersion}`)
       );
       return;
     }
@@ -3170,7 +3170,7 @@ var whoamiCommand = new Command().name("whoami").description("Show current ident
 
 // src/index.ts
 var program = new Command();
-program.name("vm0").description("VM0 CLI - Build and run agents with natural language").version("9.212.4");
+program.name("vm0").description("VM0 CLI - Build and run agents with natural language").version("9.213.1");
 program.addCommand(authCommand);
 program.addCommand(infoCommand);
 program.addCommand(composeCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vm0/cli",
-  "version": "9.212.4",
+  "version": "9.213.1",
   "description": "CLI application",
   "repository": {
     "type": "git",

package/zero.js

@@ -109,6 +109,7 @@ import {
   getZeroRunAgentEvents,
   getZeroRunContext,
   getZeroUserPreferences,
+  getZeroWorkflowUserConnectors,
   hasAuthMethods,
   hasRequiredConnectorAuthMethodScopes,
   hostedArtifactKindSchema,
@@ -190,7 +191,7 @@ import {
   uploadWebFile,
   upsertZeroOrgModelProvider,
   withErrorHandler
-} from "./chunk-DNXUAGZZ.js";
+} from "./chunk-AFQMB63J.js";
 import "./chunk-NR42YJMI.js";
 import {
   __toESM,
@@ -12948,39 +12949,22 @@ async function getCurrentRunContext() {
   if (!runId) return null;
   return await getZeroRunContext(runId);
 }
-function checkEnvName(ctx) {
-  console.log("## Step 1: Sandbox environment name");
-  console.log("");
-  const envPresent = Boolean(process.env[ctx.envName]);
-  console.log(
-    `Checking process.env.${ctx.envName}: ${envPresent ? "present" : "not present"}`
-  );
-  if (envPresent) {
-    console.log(
-      "A placeholder value is present in the sandbox environment. This value is not the real credential \u2014 it is a stand-in that gets replaced at the network boundary when requests are sent to registered base URLs."
-    );
-  } else {
-    console.log(
-      "No value found for this environment name. Note: credential replacement at the network boundary is independent of this name \u2014 the proxy injects auth headers based on the destination URL."
-    );
+function resolveTriggerContext() {
+  const workflowId = process.env.ZERO_WORKFLOW_ID;
+  const triggerId = process.env.ZERO_WORKFLOW_TRIGGER_ID;
+  return workflowId && triggerId ? { workflowId, triggerId } : void 0;
+}
+function workflowPermissionUrl(ctx) {
+  if (!ctx.agentId || !ctx.triggerContext) {
+    return null;
   }
-  console.log("");
-  return envPresent;
+  const params = new URLSearchParams({
+    ref: ctx.connectorType,
+    triggerId: ctx.triggerContext.triggerId
+  });
+  return `${ctx.platformOrigin}/agents/${ctx.agentId}/workflows/${ctx.triggerContext.workflowId}/permissions?${params.toString()}`;
 }
-async function checkConnectorStatus(ctx) {
-  console.log("## Step 2: Connector configuration");
-  console.log("");
-  console.log(
-    "A Connector holds the real credentials (OAuth tokens or API keys) for an external service. These credentials are never injected into the sandbox. Instead, when the sandbox sends an HTTP request to a base URL registered by the Connector, the network boundary intercepts the request and replaces the auth headers with real credentials. For this to work, three conditions must be met:"
-  );
-  console.log("");
-  const [connector, enabledTypes] = await Promise.all([
-    getZeroConnector(ctx.connectorType),
-    ctx.agentId ? getZeroAgentUserConnectors(ctx.agentId) : Promise.resolve(null)
-  ]);
-  const isConnected = connector !== null;
-  const isExpired = connector?.connectionStatus === "reconnect-required";
-  const hasPermission = enabledTypes !== null && enabledTypes.includes(ctx.connectorType);
+function printConnectorConnectionStatus(ctx, isConnected, isExpired, hasPermission) {
   console.log(
     `### 2a: Connector status (user must configure via OAuth login or API key)`
   );
@@ -12991,7 +12975,10 @@ async function checkConnectorStatus(ctx) {
     );
   } else if (!isConnected) {
     console.log(`The ${ctx.label} connector is not connected.`);
-    if (ctx.agentId && hasPermission) {
+    if (ctx.triggerContext) {
+      const connectUrl = `${ctx.platformOrigin}/connectors/${ctx.connectorType}/connect`;
+      console.log(`Connect it at: [Connect ${ctx.label}](${connectUrl})`);
+    } else if (ctx.agentId && hasPermission) {
       const connectUrl = `${ctx.platformOrigin}/connectors/${ctx.connectorType}/connect?agentId=${ctx.agentId}`;
       console.log(`Connect it at: [Connect ${ctx.label}](${connectUrl})`);
     } else if (!ctx.agentId) {
@@ -13008,15 +12995,28 @@ async function checkConnectorStatus(ctx) {
     console.log(`The ${ctx.label} connector is connected and active.`);
   }
   console.log("");
+}
+function printWorkflowAuthorizationStatus(ctx, isConnected, hasPermission) {
+  const url = workflowPermissionUrl(ctx);
+  if (hasPermission) {
+    console.log(
+      isConnected ? `The ${ctx.label} connector is authorized for this workflow (${ctx.triggerContext.workflowId}).` : `The ${ctx.label} connector is authorized for this workflow (${ctx.triggerContext.workflowId}), but it is not connected.`
+    );
+    return;
+  }
   console.log(
-    `### 2b: Agent authorization (user must authorize agent to use this connector)`
+    isConnected ? `The ${ctx.label} connector is not authorized for this workflow (${ctx.triggerContext.workflowId}).` : `The ${ctx.label} connector needs to be connected and authorized for this workflow (${ctx.triggerContext.workflowId}).`
   );
-  console.log("");
-  if (!ctx.connectorAvailable) {
+  if (url) {
+    console.log(`Authorize it at: [Authorize ${ctx.label}](${url})`);
+  } else {
     console.log(
-      `Skipped \u2014 the ${ctx.label} connector is not available for this account.`
+      "ZERO_AGENT_ID is not set \u2014 cannot build a workflow authorization link."
     );
-  } else if (!ctx.agentId) {
+  }
+}
+function printAgentAuthorizationStatus(ctx, isConnected, isExpired, hasPermission) {
+  if (!ctx.agentId) {
     console.log("ZERO_AGENT_ID is not set \u2014 cannot check agent authorization.");
   } else if (isExpired) {
     console.log(
@@ -13033,7 +13033,65 @@ async function checkConnectorStatus(ctx) {
     );
     console.log(`Authorize it at: [Authorize ${ctx.label}](${url})`);
   }
+}
+function printConnectorAuthorizationStatus(ctx, isConnected, isExpired, hasPermission) {
+  console.log(
+    ctx.triggerContext ? `### 2b: Workflow authorization (user must authorize workflow to use this connector)` : `### 2b: Agent authorization (user must authorize agent to use this connector)`
+  );
   console.log("");
+  if (!ctx.connectorAvailable) {
+    console.log(
+      `Skipped \u2014 the ${ctx.label} connector is not available for this account.`
+    );
+  } else if (ctx.triggerContext) {
+    printWorkflowAuthorizationStatus(
+      { ...ctx, triggerContext: ctx.triggerContext },
+      isConnected,
+      hasPermission
+    );
+  } else {
+    printAgentAuthorizationStatus(ctx, isConnected, isExpired, hasPermission);
+  }
+  console.log(
+    ctx.triggerContext ? `This is a workflow-triggered run, so ${ctx.label} access is scoped by the workflow's authorization settings, not the agent's connector authorization.` : `This is an interactive/agent-scoped run, so ${ctx.label} access is scoped by the agent's connector authorization.`
+  );
+  console.log("");
+}
+function checkEnvName(ctx) {
+  console.log("## Step 1: Sandbox environment name");
+  console.log("");
+  const envPresent = Boolean(process.env[ctx.envName]);
+  console.log(
+    `Checking process.env.${ctx.envName}: ${envPresent ? "present" : "not present"}`
+  );
+  if (envPresent) {
+    console.log(
+      "A placeholder value is present in the sandbox environment. This value is not the real credential \u2014 it is a stand-in that gets replaced at the network boundary when requests are sent to registered base URLs."
+    );
+  } else {
+    console.log(
+      "No value found for this environment name. Note: credential replacement at the network boundary is independent of this name \u2014 the proxy injects auth headers based on the destination URL."
+    );
+  }
+  console.log("");
+  return envPresent;
+}
+async function checkConnectorStatus(ctx) {
+  console.log("## Step 2: Connector configuration");
+  console.log("");
+  console.log(
+    "A Connector holds the real credentials (OAuth tokens or API keys) for an external service. These credentials are never injected into the sandbox. Instead, when the sandbox sends an HTTP request to a base URL registered by the Connector, the network boundary intercepts the request and replaces the auth headers with real credentials. For this to work, three conditions must be met:"
+  );
+  console.log("");
+  const [connector, enabledTypes] = await Promise.all([
+    getZeroConnector(ctx.connectorType),
+    ctx.triggerContext ? getZeroWorkflowUserConnectors(ctx.triggerContext.workflowId) : ctx.agentId ? getZeroAgentUserConnectors(ctx.agentId) : Promise.resolve(null)
+  ]);
+  const isConnected = connector !== null;
+  const isExpired = connector?.connectionStatus === "reconnect-required";
+  const hasPermission = enabledTypes !== null && enabledTypes.includes(ctx.connectorType);
+  printConnectorConnectionStatus(ctx, isConnected, isExpired, hasPermission);
+  printConnectorAuthorizationStatus(ctx, isConnected, isExpired, hasPermission);
   return { isConnected, isExpired, hasPermission };
 }
 async function checkConnectorDomains(ctx, preloadedRunContext) {
@@ -13047,11 +13105,11 @@ async function checkConnectorDomains(ctx, preloadedRunContext) {
       "Cannot determine run ID from ZERO_TOKEN \u2014 skipping base URL check."
     );
     console.log("");
-    return null;
+    return { networkPolicies: null, configuredForRun: null };
   }
-  await printConnectorDomains(ctx, runContext);
+  const configuredForRun = await printConnectorDomains(ctx, runContext);
   console.log("");
-  return runContext.networkPolicies;
+  return { networkPolicies: runContext.networkPolicies, configuredForRun };
 }
 async function printConnectorDomains(ctx, runContext) {
   const matchingEntry = runContext.firewalls.find((fw) => {
@@ -13064,7 +13122,7 @@ async function printConnectorDomains(ctx, runContext) {
     console.log(
       "This means no base URLs are registered for credential replacement for this connector."
     );
-    return;
+    return false;
   }
   const routingConfig = await runContextFirewallRoutingConfig(matchingEntry);
   if (!routingConfig) {
@@ -13074,7 +13132,7 @@ async function printConnectorDomains(ctx, runContext) {
     console.log(
       "This means no base URLs are registered for credential replacement for this connector."
     );
-    return;
+    return false;
   }
   console.log(
     `The ${ctx.label} connector is configured for this run with the following base URLs:`
@@ -13090,8 +13148,9 @@ async function printConnectorDomains(ctx, runContext) {
   if (secretNames.length > 0) {
     console.log(`Credentials resolved from: ${secretNames.join(", ")}`);
   }
+  return true;
 }
-function checkPermissionPolicy(connectorType, label, permissionName, networkPolicies) {
+function checkPermissionPolicy(connectorType, label, permissionName, networkPolicies, configuredForRun) {
   console.log("## Step 3: Permission policy check");
   console.log("");
   console.log(
@@ -13110,6 +13169,16 @@ function checkPermissionPolicy(connectorType, label, permissionName, networkPoli
   }
   const connectorPolicies = networkPolicies[connectorType];
   if (!connectorPolicies) {
+    if (configuredForRun === false) {
+      console.log(
+        `No policy entry found because the ${label} connector is not configured for this run.`
+      );
+      console.log(
+        "Requests for this connector cannot receive credentials in the current run."
+      );
+      console.log("");
+      return;
+    }
     console.log(
       `No policy entry found for the ${label} connector in this run's network policies.`
     );
@@ -13144,7 +13213,7 @@ function checkPermissionPolicy(connectorType, label, permissionName, networkPoli
 function unknownPermissionChangeCommand(connectorRef) {
   return `zero doctor permission-change ${connectorRef} --permission ${UNKNOWN_PERMISSION_GRANT} --enable --duration 1h`;
 }
-async function resolvePermissionFromUrl(connectorType, label, method, relativePath, matchedBase, routingConfig, networkPolicies) {
+async function resolvePermissionFromUrl(connectorType, label, method, relativePath, matchedBase, routingConfig, networkPolicies, configuredForRun) {
   console.log("## Step 3: Permission policy check (auto-detected from URL)");
   console.log("");
   console.log(
@@ -13186,6 +13255,16 @@ async function resolvePermissionFromUrl(connectorType, label, method, relativePa
   }
   const connectorPolicies = networkPolicies[connectorType];
   if (!connectorPolicies) {
+    if (configuredForRun === false) {
+      console.log(
+        `No policy entry found because the ${label} connector is not configured for this run.`
+      );
+      console.log(
+        "Requests for this connector cannot receive credentials in the current run."
+      );
+      console.log("");
+      return;
+    }
     console.log(
       `No policy entry found for the ${label} connector. All requests are fully permissive (allowed).`
     );
@@ -13322,12 +13401,21 @@ How connectors work:
       label,
       connectorAvailable,
       platformOrigin: platformUrl.origin,
-      agentId: process.env.ZERO_AGENT_ID || void 0
+      agentId: process.env.ZERO_AGENT_ID || void 0,
+      triggerContext: resolveTriggerContext()
     };
     checkEnvName(ctx);
     const { isConnected, isExpired, hasPermission } = await checkConnectorStatus(ctx);
-    const networkPolicies = await checkConnectorDomains(ctx, runContext);
-    if (isConnected && !isExpired && hasPermission) {
+    const { networkPolicies, configuredForRun } = await checkConnectorDomains(
+      ctx,
+      runContext
+    );
+    if (configuredForRun === false) {
+      const scope = ctx.triggerContext ? "workflow" : "agent";
+      console.log(
+        `Steps 1-2 summary: The ${label} connector is not configured for this run. Check the ${scope} authorization settings, then start a new run after updating them.`
+      );
+    } else if (isConnected && !isExpired && hasPermission) {
       console.log(
         `Steps 1-2 summary: The ${label} connector is connected, active, and authorized. Outbound requests to the registered base URLs will have credentials injected at the network boundary.`
       );
@@ -13341,14 +13429,16 @@ How connectors work:
         urlLookup.relativePath,
         urlLookup.matchedBase,
         urlLookup.routingConfig,
-        networkPolicies
+        networkPolicies,
+        configuredForRun
       );
     } else if (opts.checkPermission) {
       checkPermissionPolicy(
         connectorType,
         label,
         opts.checkPermission,
-        networkPolicies
+        networkPolicies,
+        configuredForRun
       );
     }
     const args = [];
@@ -13561,7 +13651,7 @@ async function printComputerUsePermissionChangeMessage(action) {
     printComputerUsePermissionGuidance();
   }
 }
-function resolveTriggerContext() {
+function resolveTriggerContext2() {
   const triggerId = process.env.ZERO_WORKFLOW_TRIGGER_ID;
   const workflowId = process.env.ZERO_WORKFLOW_ID;
   return triggerId && workflowId ? { workflowId, triggerId } : void 0;
@@ -13570,10 +13660,10 @@ async function outputPermissionChangeMessage(connectorRef, label, permission, ac
   const platformOrigin = await getPlatformOrigin();
   if (triggerContext && agentId) {
     const workflowUrlParams = new URLSearchParams({
-      tab: "authorization",
       ref: connectorRef,
       permission,
-      action: action === "enable" ? "allow" : "deny"
+      action: action === "enable" ? "allow" : "deny",
+      triggerId: triggerContext.triggerId
     });
     if (action === "enable") {
       workflowUrlParams.set(
@@ -13581,7 +13671,7 @@ async function outputPermissionChangeMessage(connectorRef, label, permission, ac
         duration ?? DEFAULT_PERMISSION_GRANT_DURATION
       );
     }
-    const workflowUrl = `${platformOrigin}/agents/${agentId}/workflows/${triggerContext.workflowId}?${workflowUrlParams.toString()}`;
+    const workflowUrl = `${platformOrigin}/agents/${agentId}/workflows/${triggerContext.workflowId}/permissions?${workflowUrlParams.toString()}`;
     printSensitivePermissionGuidance(connectorRef, permission, action);
     printPermissionActionMessage({
       action,
@@ -13691,7 +13781,7 @@ Notes:
         action,
         opts.duration,
         opts.agent ?? process.env.ZERO_AGENT_ID,
-        resolveTriggerContext()
+        resolveTriggerContext2()
       );
     }
   )
@@ -22393,7 +22483,7 @@ function registerZeroCommands(prog, commands) {
 var program = new Command();
 program.name("zero").description(
   "Zero CLI \u2014 interact with the zero platform from inside the sandbox"
-).version("9.212.4").addHelpText("after", () => {
+).version("9.213.1").addHelpText("after", () => {
   return buildZeroHelpText();
 });
 if (process.argv[1]?.endsWith("zero.js") || process.argv[1]?.endsWith("zero.ts") || process.argv[1]?.endsWith("zero")) {