@vm0/cli 9.222.2 → 9.222.4

package/{agent-MAPPQJ6T.js → agent-NSDEHR65.js}

@@ -4,10 +4,10 @@ const require = __createRequire(import.meta.url);
 import {
   loadConnectorPermissionInfos,
   policyIcon
-} from "./chunk-UX5MX23W.js";
+} from "./chunk-JOA7DGTQ.js";
 import {
   permissionGrantsToFirewallPolicies
-} from "./chunk-KA6H24H6.js";
+} from "./chunk-RL4GCAFR.js";
 import {
   isInteractive,
   promptConfirm
@@ -24,7 +24,7 @@ import {
   listZeroUserPermissionGrants,
   updateZeroAgent,
   updateZeroAgentInstructions
-} from "./chunk-E2O7MDL7.js";
+} from "./chunk-CADK5TVM.js";
 import {
   withErrorHandler
 } from "./chunk-3F4RFLPX.js";
@@ -595,4 +595,4 @@ Notes:
 export {
   zeroAgentCommand
 };
-//# sourceMappingURL=agent-MAPPQJ6T.js.map
+//# sourceMappingURL=agent-NSDEHR65.js.map

package/{automation-Z4A56FZU.js → automation-IOEAD5X4.js}

@@ -8,10 +8,10 @@ import {
 } from "./chunk-HQFETCZ6.js";
 import {
   isUUID
-} from "./chunk-TTPLNGWS.js";
-import "./chunk-YRZ6VZJR.js";
-import "./chunk-ODQBZESC.js";
-import "./chunk-IH5XFOOD.js";
+} from "./chunk-DUZLFJLB.js";
+import "./chunk-D2NRNECU.js";
+import "./chunk-WLRVHNMC.js";
+import "./chunk-LRS4PGVY.js";
 import {
   isInteractive,
   promptConfirm
@@ -28,7 +28,7 @@ import {
   showAutomation,
   updateAutomation,
   updateAutomationTrigger
-} from "./chunk-E2O7MDL7.js";
+} from "./chunk-CADK5TVM.js";
 import {
   withErrorHandler
 } from "./chunk-3F4RFLPX.js";
@@ -498,4 +498,4 @@ Examples:
 export {
   zeroAutomationCommand
 };
-//# sourceMappingURL=automation-Z4A56FZU.js.map
+//# sourceMappingURL=automation-IOEAD5X4.js.map

package/{banking-EI7CVZ5K.js → banking-FQBUMOSN.js}

@@ -4,7 +4,7 @@ const require = __createRequire(import.meta.url);
 import "./chunk-LTDQISD7.js";
 import {
   callZeroBanking
-} from "./chunk-E2O7MDL7.js";
+} from "./chunk-CADK5TVM.js";
 import {
   withErrorHandler
 } from "./chunk-3F4RFLPX.js";
@@ -115,4 +115,4 @@ Notes:
 export {
   zeroBankingCommand
 };
-//# sourceMappingURL=banking-EI7CVZ5K.js.map
+//# sourceMappingURL=banking-FQBUMOSN.js.map

package/{chat-2C6KFXSA.js → chat-ALNLKLA7.js}

@@ -5,7 +5,7 @@ import "./chunk-LTDQISD7.js";
 import {
   getZeroChatThread,
   renameZeroChatThread
-} from "./chunk-E2O7MDL7.js";
+} from "./chunk-CADK5TVM.js";
 import {
   withErrorHandler
 } from "./chunk-3F4RFLPX.js";
@@ -120,4 +120,4 @@ Examples:
 export {
   zeroChatCommand
 };
-//# sourceMappingURL=chat-2C6KFXSA.js.map
+//# sourceMappingURL=chat-ALNLKLA7.js.map

package/{chunk-E2O7MDL7.js → chunk-CADK5TVM.js}

@@ -2012,12 +2012,15 @@ var c2 = initContract();
 var sendModeSchema = external_exports.enum(["enter", "cmd-enter"]);
 var userPreferencesResponseSchema = external_exports.object({
   timezone: external_exports.string().nullable(),
+  // Pinned agents are exposed as membership only. The API returns a stable
+  // canonical order and ignores client-provided order on writes.
   pinnedAgentIds: external_exports.array(external_exports.string()),
   sendMode: sendModeSchema,
   captureNetworkBodiesRemaining: external_exports.number().int().min(0)
 });
 var updateUserPreferencesRequestSchema = external_exports.object({
   timezone: external_exports.string().min(1).optional(),
+  // Membership update only; request order is not used for display ordering.
   pinnedAgentIds: external_exports.array(external_exports.string()).optional(),
   sendMode: sendModeSchema.optional(),
   captureNetworkBodiesRemaining: external_exports.number().int().min(0).optional()
@@ -3712,6 +3715,7 @@ var AUTH_REFERENCE_PATTERN_G = new RegExp(AUTH_REFERENCE_PATTERN.source, "g");
 var AUTH_REFERENCE_PREFIX_PATTERN = new RegExp(
   `^${AUTH_REFERENCE_PATTERN.source}`
 );
+var AUTH_TEMPLATE_START = "${{";
 var AUTH_TEMPLATE_URL_PLACEHOLDER = "placeholder";
 var IPV4_MAX_OCTET = 255;
 var IPV4_OCTET_BASE = IPV4_MAX_OCTET + 1;
@@ -5174,6 +5178,129 @@ function validateBaseUrl(base, serviceName) {
     );
   }
 }
+function authBaseForStaticUrlValidation(authBase) {
+  if (!authBase.includes(AUTH_TEMPLATE_START)) {
+    return { url: authBase, dynamicPrefixSuffix: "" };
+  }
+  const replaced = authBase.replace(
+    AUTH_REFERENCE_PATTERN_G,
+    AUTH_TEMPLATE_URL_PLACEHOLDER
+  );
+  if (replaced.includes(AUTH_TEMPLATE_START)) {
+    return { url: authBase, dynamicPrefixSuffix: "" };
+  }
+  const prefixMatch = AUTH_REFERENCE_PREFIX_PATTERN.exec(authBase);
+  if (prefixMatch) {
+    return {
+      url: null,
+      dynamicPrefixSuffix: authBase.slice(prefixMatch[0].length).replace(AUTH_REFERENCE_PATTERN_G, AUTH_TEMPLATE_URL_PLACEHOLDER)
+    };
+  }
+  return { url: replaced, dynamicPrefixSuffix: "" };
+}
+function validateDynamicAuthBaseSuffix(authBase, suffix, serviceName) {
+  if (suffix.includes(AUTH_TEMPLATE_START)) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": contains unsupported template reference`
+    );
+  }
+  if (hasRawWhitespace(suffix)) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain whitespace`
+    );
+  }
+  if (hasUnsafeUrlCodepoint(suffix)) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain control characters or invalid Unicode`
+    );
+  }
+  if (suffix.includes("#")) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain fragment`
+    );
+  }
+  if (suffix !== "" && !suffix.startsWith("/") && !suffix.startsWith("?")) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": dynamic URL suffix must start with "/" or "?"`
+    );
+  }
+}
+function validateAuthBaseUrl(authBase, serviceName) {
+  if (authBase.includes("\\")) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain backslash`
+    );
+  }
+  const target = authBaseForStaticUrlValidation(authBase);
+  validateDynamicAuthBaseSuffix(
+    authBase,
+    target.dynamicPrefixSuffix,
+    serviceName
+  );
+  const validationUrl = target.url;
+  if (validationUrl === null) return;
+  if (validationUrl.includes(AUTH_TEMPLATE_START)) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": contains unsupported template reference`
+    );
+  }
+  if (hasRawWhitespace(validationUrl)) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain whitespace`
+    );
+  }
+  if (hasUnsafeUrlCodepoint(validationUrl)) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain control characters or invalid Unicode`
+    );
+  }
+  validateUrlSchemeDelimiter(
+    validationUrl,
+    serviceName,
+    "auth.base URL",
+    authBase
+  );
+  let url;
+  try {
+    url = new URL(validationUrl);
+  } catch {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": not a valid URL`
+    );
+  }
+  if (url.protocol.slice(0, -1).toLowerCase() !== REQUIRED_AUTH_BASE_URL_SCHEME) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": scheme must be https`
+    );
+  }
+  if (url.hash) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain fragment`
+    );
+  }
+  const authority = rawAuthorityFromBaseUrl(validationUrl);
+  if (authority !== null) {
+    if (authority === "") {
+      throw new Error(
+        `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": not a valid URL authority`
+      );
+    }
+    if (authorityHasEmptyPort(authority)) {
+      throw new Error(
+        `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": not a valid URL authority`
+      );
+    }
+    if (authority.includes("@")) {
+      throw new Error(
+        `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain userinfo`
+      );
+    }
+    validateHostPercentEncoding(authority, validationUrl, serviceName);
+    validateHostHasCanonicalIpv4Syntax(authority, validationUrl, serviceName);
+    validateHostHasNoUnsafeIdnaMappings(authority, validationUrl, serviceName);
+  }
+  validateStaticHostLabels(url.hostname, validationUrl, serviceName);
+}
 
 // ../../packages/api-contracts/src/contracts/logs.ts
 init_esm_shims();
@@ -6578,6 +6705,18 @@ var chatThreadsContract = c15.router({
     },
     summary: "List chat thread lifecycle events after an optional event id cursor."
   },
+  activeIds: {
+    method: "GET",
+    path: "/api/zero/chat-threads/active-ids",
+    headers: authHeadersSchema,
+    responses: {
+      200: external_exports.object({
+        threadIds: external_exports.array(external_exports.string().uuid())
+      }),
+      401: apiErrorSchema
+    },
+    summary: "List chat thread ids that currently have queued, pending, or running runs."
+  },
   create: {
     method: "POST",
     path: "/api/zero/chat-threads",
@@ -28370,6 +28509,7 @@ export {
   resolveFirewallBaseUrlTemplate,
   hasBaseUrlParams,
   validateBaseUrl,
+  validateAuthBaseUrl,
   runnerGroupSchema,
   volumeConfigSchema,
   agentDefinitionSchema,
@@ -28531,4 +28671,4 @@ export {
   completeHostedSite,
   getHostedSiteFiles
 };
-//# sourceMappingURL=chunk-E2O7MDL7.js.map
+//# sourceMappingURL=chunk-CADK5TVM.js.map