@vm0/cli 9.215.1 → 9.215.3

package/{chunk-INN5SRMT.js → chunk-WL7EL2UG.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   UNKNOWN_PERMISSION_GRANT
-} from "./chunk-L6GC6AUS.js";
+} from "./chunk-DMAXHLSM.js";
 import {
   init_esm_shims
 } from "./chunk-DIRAZ3YX.js";
@@ -3078,4 +3078,4 @@ export {
   resolveFirewallMetadataPolicies,
   permissionGrantsToFirewallPolicies
 };
-//# sourceMappingURL=chunk-INN5SRMT.js.map
+//# sourceMappingURL=chunk-WL7EL2UG.js.map

package/{computer-use-ZKUBXP6V.js → computer-use-AZPPQK7I.js}

@@ -6,7 +6,7 @@ import {
   createComputerUseWriteCommand,
   fetchComputerUseScreenshot,
   getComputerUseCommand
-} from "./chunk-L6GC6AUS.js";
+} from "./chunk-DMAXHLSM.js";
 import {
   ApiRequestError,
   withErrorHandler
@@ -472,4 +472,4 @@ export {
   formatComputerUseResultForConsole,
   zeroComputerUseCommand
 };
-//# sourceMappingURL=computer-use-ZKUBXP6V.js.map
+//# sourceMappingURL=computer-use-AZPPQK7I.js.map

package/{connector-ZSGIGADY.js → connector-NADUUXPW.js}

@@ -13,7 +13,7 @@ import {
   getConnectorAuthMethodScopeDiff,
   getConnectorEnvBindingEntries,
   hasRequiredConnectorAuthMethodScopes
-} from "./chunk-LRUD7ROI.js";
+} from "./chunk-2MYK53HJ.js";
 import {
   CONNECTOR_TYPES,
   CONNECTOR_TYPE_KEYS,
@@ -28,7 +28,7 @@ import {
   listZeroConnectors,
   listZeroCustomConnectors,
   searchZeroConnectors
-} from "./chunk-L6GC6AUS.js";
+} from "./chunk-DMAXHLSM.js";
 import "./chunk-LTDQISD7.js";
 import {
   withErrorHandler
@@ -845,4 +845,4 @@ var zeroConnectorCommand = new Command().name("connector").description("Check th
 export {
   zeroConnectorCommand
 };
-//# sourceMappingURL=connector-ZSGIGADY.js.map
+//# sourceMappingURL=connector-NADUUXPW.js.map

package/{credit-VMJYM4DD.js → credit-JHOMWMFK.js}

@@ -7,7 +7,7 @@ import {
 import {
   createZeroCreditCheckout,
   getZeroOrgMembers
-} from "./chunk-L6GC6AUS.js";
+} from "./chunk-DMAXHLSM.js";
 import "./chunk-LTDQISD7.js";
 import {
   withErrorHandler
@@ -87,4 +87,4 @@ var zeroCreditCommand = new Command().name("credit").description("Create a Strip
 export {
   zeroCreditCommand
 };
-//# sourceMappingURL=credit-VMJYM4DD.js.map
+//# sourceMappingURL=credit-JHOMWMFK.js.map

package/{developer-support-EVU3TTCS.js → developer-support-U7JULAYC.js}

@@ -4,7 +4,7 @@ const require = __createRequire(import.meta.url);
 import {
   requestDeveloperSupportConsent,
   submitDeveloperSupport
-} from "./chunk-L6GC6AUS.js";
+} from "./chunk-DMAXHLSM.js";
 import "./chunk-LTDQISD7.js";
 import {
   withErrorHandler
@@ -61,4 +61,4 @@ Notes:
 export {
   zeroDeveloperSupportCommand
 };
-//# sourceMappingURL=developer-support-EVU3TTCS.js.map
+//# sourceMappingURL=developer-support-U7JULAYC.js.map

package/{doctor-NL5HUJ6F.js → doctor-A7V3ZJEY.js}

@@ -5,7 +5,7 @@ import {
   findFirewallMetadataPermission,
   getFirewallPermissionSummary,
   loadFirewallPermissionMetadata
-} from "./chunk-INN5SRMT.js";
+} from "./chunk-WL7EL2UG.js";
 import {
   getPlatformOrigin,
   toPlatformUrl
@@ -13,11 +13,11 @@ import {
 import {
   findMatchingRoutingPermissions,
   matchFirewallBaseUrl
-} from "./chunk-A6UR5VOC.js";
+} from "./chunk-LCMCP2WQ.js";
 import {
   getConnectorEnvBindingEntries,
   getDiagnosticConnectorTypeForRuntimeEnvName
-} from "./chunk-LRUD7ROI.js";
+} from "./chunk-2MYK53HJ.js";
 import {
   CONNECTOR_TYPES,
   UNKNOWN_PERMISSION_GRANT,
@@ -28,9 +28,10 @@ import {
   getZeroOrg,
   getZeroOrgMembers,
   getZeroRunContext,
+  hasUnsafeFirewallPath,
   resolveFirewallBaseUrlTemplate,
   searchZeroConnectors
-} from "./chunk-L6GC6AUS.js";
+} from "./chunk-DMAXHLSM.js";
 import "./chunk-LTDQISD7.js";
 import {
   ApiRequestError,
@@ -7803,8 +7804,9 @@ init_esm_shims();
 var COMPUTER_USE_CONNECTOR_REF = "computer-use";
 var COMPUTER_USE_CAPABILITY = "computer-use:write";
 var COMPUTER_USE_PATH_PREFIX = "/computer-use";
+var COMPUTER_USE_PATH_PREFIX_WITH_SLASH = `${COMPUTER_USE_PATH_PREFIX}/`;
 function isComputerUsePermissionTarget(target) {
-  return target.connectorRef === COMPUTER_USE_CONNECTOR_REF || target.permission === COMPUTER_USE_CAPABILITY || target.path?.startsWith(COMPUTER_USE_PATH_PREFIX) === true;
+  return target.connectorRef === COMPUTER_USE_CONNECTOR_REF || target.permission === COMPUTER_USE_CAPABILITY || target.path === COMPUTER_USE_PATH_PREFIX || target.path?.startsWith(COMPUTER_USE_PATH_PREFIX_WITH_SLASH) === true;
 }
 function printComputerUsePermissionGuidance() {
   console.log("Computer Use access is not managed as a connector permission.");
@@ -7823,6 +7825,226 @@ function printComputerUsePermissionGuidance() {
 function unknownPermissionChangeCommand2(connectorRef) {
   return `zero doctor permission-change ${connectorRef} --permission ${UNKNOWN_PERMISSION_GRANT} --enable --duration 1h`;
 }
+var BASE_URL_VAR_PATTERN = /\$\{\{\s*vars\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/g;
+var WHOLE_BASE_URL_VAR_PATTERN = /^\$\{\{\s*vars\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}$/;
+var VALID_DENIED_METHODS = /* @__PURE__ */ new Set([
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "HEAD",
+  "OPTIONS"
+]);
+function pathOnlyError() {
+  return new Error(
+    "permission-deny now requires --url because method/path alone can match the wrong API base."
+  );
+}
+function invalidUrlError() {
+  return new Error(
+    "permission-deny requires --url to be a valid absolute http or https URL."
+  );
+}
+function invalidMethodError() {
+  return new Error(
+    "permission-deny requires --method to be one of GET, POST, PUT, PATCH, DELETE, HEAD, or OPTIONS."
+  );
+}
+function unsafePathError() {
+  return new Error(
+    "permission-deny cannot diagnose unsafe URL paths because they are blocked before permission policy evaluation."
+  );
+}
+function parseDeniedMethod(method) {
+  const upperMethod = method.toUpperCase();
+  if (!VALID_DENIED_METHODS.has(upperMethod)) {
+    throw invalidMethodError();
+  }
+  return upperMethod;
+}
+function rawAuthorityFromDeniedUrl(url) {
+  const schemeEnd = url.indexOf("://");
+  if (schemeEnd === -1) return null;
+  const authorityStart = schemeEnd + 3;
+  let authorityEnd = url.length;
+  for (const delimiter of ["/", "?", "#"]) {
+    const index = url.indexOf(delimiter, authorityStart);
+    if (index !== -1) authorityEnd = Math.min(authorityEnd, index);
+  }
+  return url.slice(authorityStart, authorityEnd);
+}
+function rawAuthorityHasUnsafeSyntax(url) {
+  const authority = rawAuthorityFromDeniedUrl(url);
+  if (authority === null) return false;
+  return authority === "" || authority.includes("\\") || authority.includes("%") || [...authority].some((char) => {
+    return char.charCodeAt(0) > 127;
+  });
+}
+function parseDeniedUrl(url) {
+  if (!url.includes("://") || /\s/.test(url) || rawAuthorityHasUnsafeSyntax(url)) {
+    throw invalidUrlError();
+  }
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      throw invalidUrlError();
+    }
+    if (parsed.username !== "" || parsed.password !== "") {
+      throw invalidUrlError();
+    }
+    return parsed;
+  } catch {
+    throw invalidUrlError();
+  }
+}
+function baseUrlTemplateVarNames(base) {
+  return [...base.matchAll(BASE_URL_VAR_PATTERN)].map((match) => {
+    return match[1];
+  });
+}
+function wholeBaseUrlTemplateVarName(base) {
+  return WHOLE_BASE_URL_VAR_PATTERN.exec(base)?.[1] ?? null;
+}
+function resolveBaseUrlTemplateFromEnv(base) {
+  const names = baseUrlTemplateVarNames(base);
+  if (names.length === 0) return base;
+  let missing = false;
+  const resolved = base.replace(
+    BASE_URL_VAR_PATTERN,
+    (_match, name) => {
+      const value = process.env[name];
+      if (!value) {
+        missing = true;
+        return "";
+      }
+      return value;
+    }
+  );
+  return missing ? null : resolved;
+}
+function baseUrlTemplateToPattern(base) {
+  if (baseUrlTemplateVarNames(base).length === 0) return null;
+  const pattern = base.replace(BASE_URL_VAR_PATTERN, (_match, name) => {
+    return `{${name}}`;
+  });
+  return pattern.includes("://") ? pattern : null;
+}
+function connectorRefHostToken(connectorRef) {
+  return connectorRef.toLowerCase().replaceAll(/[^a-z0-9]/g, "");
+}
+function hostLabelToken(label) {
+  return label.toLowerCase().replaceAll(/[^a-z0-9]/g, "");
+}
+function hostLabelMatchesConnectorRef(label, connectorRef) {
+  const normalizedConnectorRef = connectorRef.toLowerCase();
+  const token = connectorRefHostToken(connectorRef);
+  const normalizedLabel = label.toLowerCase();
+  if (normalizedConnectorRef === token) {
+    return normalizedLabel === token;
+  }
+  return hostLabelToken(normalizedLabel) === token;
+}
+function hostnameMatchesConnectorRef(url, connectorRef) {
+  const token = connectorRefHostToken(connectorRef);
+  if (token.length < 3) return false;
+  const labels = (url.hostname || "").toLowerCase().replace(/\.$/, "").split(".").filter((part) => {
+    return part !== "";
+  });
+  if (labels.length < 2) return false;
+  return hostLabelMatchesConnectorRef(labels[labels.length - 2], connectorRef);
+}
+function stripUrlQueryAndFragment(url) {
+  const queryIndex = url.indexOf("?");
+  const fragmentIndex = url.indexOf("#");
+  let end = url.length;
+  if (queryIndex !== -1) end = Math.min(end, queryIndex);
+  if (fragmentIndex !== -1) end = Math.min(end, fragmentIndex);
+  return url.slice(0, end);
+}
+function rawPathFromDeniedUrl(url) {
+  const urlWithoutQuery = stripUrlQueryAndFragment(url);
+  const schemeEnd = urlWithoutQuery.indexOf("://");
+  const authorityStart = schemeEnd === -1 ? 0 : schemeEnd + 3;
+  const pathStart = urlWithoutQuery.indexOf("/", authorityStart);
+  return pathStart === -1 ? "/" : urlWithoutQuery.slice(pathStart);
+}
+function matchApiBaseUrl(url, apiBase) {
+  const directMatch = matchFirewallBaseUrl(url, apiBase);
+  if (directMatch) {
+    return {
+      apiBase,
+      displayBase: directMatch.displayBase,
+      relativePath: directMatch.relativePath,
+      score: directMatch.score
+    };
+  }
+  const resolvedBase = resolveBaseUrlTemplateFromEnv(apiBase);
+  if (resolvedBase !== null && resolvedBase !== apiBase) {
+    const resolvedMatch = matchFirewallBaseUrl(url, resolvedBase);
+    if (resolvedMatch) {
+      return {
+        apiBase,
+        displayBase: resolvedMatch.displayBase,
+        relativePath: resolvedMatch.relativePath,
+        score: resolvedMatch.score
+      };
+    }
+    return null;
+  }
+  const patternBase = baseUrlTemplateToPattern(apiBase);
+  if (patternBase === null) return null;
+  const patternMatch = matchFirewallBaseUrl(url, patternBase);
+  if (!patternMatch) return null;
+  return {
+    apiBase,
+    displayBase: apiBase,
+    relativePath: patternMatch.relativePath,
+    score: patternMatch.score
+  };
+}
+function findBestBaseMatch(url, deniedUrl, connectorRef, apis) {
+  let bestMatch = null;
+  for (const api2 of apis) {
+    const match = matchApiBaseUrl(url, api2.base);
+    if (match && (!bestMatch || match.score > bestMatch.score)) {
+      bestMatch = match;
+    }
+  }
+  if (bestMatch !== null) return bestMatch;
+  const unresolvedWholeBaseApis = apis.filter((api2) => {
+    const name = wholeBaseUrlTemplateVarName(api2.base);
+    return name !== null && !process.env[name];
+  });
+  if (unresolvedWholeBaseApis.length !== 1) return null;
+  if (!hostnameMatchesConnectorRef(deniedUrl, connectorRef)) return null;
+  const api = unresolvedWholeBaseApis[0];
+  return {
+    apiBase: api.base,
+    displayBase: api.base,
+    relativePath: rawPathFromDeniedUrl(url),
+    score: 0
+  };
+}
+function printPermissionChangeGuidance(connectorRef, permissions) {
+  const sortedPermissions = [...permissions].sort();
+  if (sortedPermissions.length === 1) {
+    const permission = sortedPermissions[0];
+    console.log(`This is covered by the "${permission}" permission.`);
+    console.log(
+      `To allow this permission, run: zero doctor permission-change ${connectorRef} --permission ${permission} --enable --duration 1h`
+    );
+    return;
+  }
+  console.log(
+    `This is covered by these permissions: ${sortedPermissions.join(", ")}.`
+  );
+  for (const permission of sortedPermissions) {
+    console.log(
+      `To allow ${permission}, run: zero doctor permission-change ${connectorRef} --permission ${permission} --enable --duration 1h`
+    );
+  }
+}
 var permissionDenyCommand = new Command().name("permission-deny").description(
   "Diagnose a permission denial and find the permission that covers it"
 ).argument("<connector-ref>", "The connector type (e.g. github)").addOption(
@@ -7831,23 +8053,44 @@ var permissionDenyCommand = new Command().name("permission-deny").description(
     "The denied HTTP method"
   ).makeOptionMandatory()
 ).addOption(
-  new Option("--path <path>", "The denied path").makeOptionMandatory()
-).addHelpText(
+  new Option(
+    "--url <url>",
+    "The denied request URL; query strings are ignored (required)"
+  )
+).addOption(new Option("--path <path>", "Deprecated: use --url").hideHelp()).addHelpText(
   "after",
   `
 Examples:
-  zero doctor permission-deny github --method GET --path /repos/owner/repo/pulls
-  zero doctor permission-deny slack --method POST --path /chat.postMessage
-  zero doctor permission-deny computer-use --method POST --path /computer-use/list-apps
+  zero doctor permission-deny github --method GET --url https://api.github.com/repos/owner/repo/pulls
+  zero doctor permission-deny slack --method POST --url https://slack.com/api/chat.postMessage
+  zero doctor permission-deny youtube --method PUT --url https://youtube.googleapis.com/upload/youtube/v3/videos
 
 Notes:
   - Identifies which named permission covers a denied request
+  - If the firewall denial response includes a url field, pass that value to --url
+  - Requires the denied URL origin and path because method/path alone can match the wrong API base
+  - Query strings and fragments are ignored for matching; omit them when they may contain secrets
   - Use permission-change to request or enable the permission
   - Permission-change enable requests default to --duration 1h; pick 24h, 7d, or always only when appropriate`
 ).action(
   withErrorHandler(
     async (connectorRef, opts) => {
-      if (isComputerUsePermissionTarget({ connectorRef, path: opts.path })) {
+      if (opts.path !== void 0) {
+        throw pathOnlyError();
+      }
+      if (!opts.url) {
+        throw pathOnlyError();
+      }
+      const method = parseDeniedMethod(opts.method);
+      const deniedUrl = parseDeniedUrl(opts.url);
+      const deniedPath = rawPathFromDeniedUrl(opts.url);
+      if (hasUnsafeFirewallPath(deniedPath)) {
+        throw unsafePathError();
+      }
+      if (isComputerUsePermissionTarget({
+        connectorRef,
+        path: deniedPath
+      })) {
         printComputerUsePermissionGuidance();
         return;
       }
@@ -7856,14 +8099,25 @@ Notes:
         throw new Error(`Unknown connector type: ${connectorRef}`);
       }
       const label = getFirewallPermissionSummary(connectorRef)?.label ?? connectorRef;
+      const match = findBestBaseMatch(
+        opts.url,
+        deniedUrl,
+        connectorRef,
+        metadata.apis
+      );
+      if (!match) {
+        throw new Error(
+          `No registered ${label} base URL matches the provided URL.`
+        );
+      }
       const permissions = findMatchingRoutingPermissions(
-        opts.method,
-        opts.path,
+        method,
+        match.relativePath,
         metadata.apis,
-        { serviceName: connectorRef }
+        { apiBase: match.apiBase, serviceName: connectorRef }
       );
       console.log(
-        `The ${label} permission filtered ${opts.method} ${opts.path}.`
+        `The ${label} permission filtered ${method} ${match.relativePath} relative to base URL ${match.displayBase}.`
       );
       if (permissions.length === 0) {
         console.log("No named permission was found covering this request.");
@@ -7875,22 +8129,7 @@ Notes:
         );
         return;
       }
-      const ruleCount = /* @__PURE__ */ new Map();
-      for (const api of metadata.apis) {
-        for (const route of api.routes) {
-          ruleCount.set(
-            route.permissionName,
-            (ruleCount.get(route.permissionName) ?? 0) + 1
-          );
-        }
-      }
-      const permission = permissions.reduce((narrowest, current) => {
-        return (ruleCount.get(current) ?? Infinity) < (ruleCount.get(narrowest) ?? Infinity) ? current : narrowest;
-      });
-      console.log(`This is covered by the "${permission}" permission.`);
-      console.log(
-        `To allow this permission, run: zero doctor permission-change ${connectorRef} --permission ${permission} --enable --duration 1h`
-      );
+      printPermissionChangeGuidance(connectorRef, permissions);
     }
   )
 );
@@ -8161,7 +8400,7 @@ Examples:
   Check a URL?           zero doctor check-connector --url https://api.github.com/repos/owner/repo
   Check credits?         zero doctor credit
   Check with permission? zero doctor check-connector --env-name SLACK_TOKEN --check-permission chat:write
-  Permission denied?     zero doctor permission-deny github --method GET --path /repos/owner/repo
+  Permission denied?     zero doctor permission-deny github --method GET --url https://api.github.com/repos/owner/repo
   Change a permission?   zero doctor permission-change github --permission contents:read --enable --duration 1h
   Disable unknown URLs?  zero doctor permission-change cloudflare --permission __unknown__ --disable
 
@@ -8174,4 +8413,4 @@ Notes:
 export {
   zeroDoctorCommand
 };
-//# sourceMappingURL=doctor-NL5HUJ6F.js.map
+//# sourceMappingURL=doctor-A7V3ZJEY.js.map