@vm0/cli 9.237.2 → 9.237.3

package/{agent-2NTLUZ3Q.js → agent-JHPWN2VR.js}

@@ -4,10 +4,10 @@ const require = __createRequire(import.meta.url);
 import {
   loadConnectorPermissionInfos,
   policyIcon
-} from "./chunk-2JZ66FKH.js";
+} from "./chunk-R562IE6B.js";
 import {
   permissionGrantsToFirewallPolicies
-} from "./chunk-AEL2XKIL.js";
+} from "./chunk-QONRYB2R.js";
 import {
   isInteractive,
   promptConfirm
@@ -24,10 +24,10 @@ import {
   listZeroUserPermissionGrants,
   updateZeroAgent,
   updateZeroAgentInstructions
-} from "./chunk-GPZFXJF6.js";
+} from "./chunk-K7GO6MVZ.js";
 import {
   withErrorHandler
-} from "./chunk-NPC4JKK2.js";
+} from "./chunk-XL2OLDVB.js";
 import {
   source_default
 } from "./chunk-JUTUEPIR.js";
@@ -595,4 +595,4 @@ Notes:
 export {
   zeroAgentCommand
 };
-//# sourceMappingURL=agent-2NTLUZ3Q.js.map
+//# sourceMappingURL=agent-JHPWN2VR.js.map

package/{banking-GYL2ITBM.js → banking-DBSX5BDX.js}

@@ -4,10 +4,10 @@ const require = __createRequire(import.meta.url);
 import "./chunk-LTDQISD7.js";
 import {
   callZeroBanking
-} from "./chunk-GPZFXJF6.js";
+} from "./chunk-K7GO6MVZ.js";
 import {
   withErrorHandler
-} from "./chunk-NPC4JKK2.js";
+} from "./chunk-XL2OLDVB.js";
 import {
   source_default
 } from "./chunk-JUTUEPIR.js";
@@ -115,4 +115,4 @@ Notes:
 export {
   zeroBankingCommand
 };
-//# sourceMappingURL=banking-GYL2ITBM.js.map
+//# sourceMappingURL=banking-DBSX5BDX.js.map

package/{chat-6UAO4EJO.js → chat-THI2OQL2.js}

@@ -3,17 +3,17 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   formatModelProviderRoute
-} from "./chunk-MBQ64I5M.js";
+} from "./chunk-EY5A7AIB.js";
 import "./chunk-LTDQISD7.js";
 import {
   getZeroChatThread,
   listZeroModelPolicies,
   renameZeroChatThread,
   updateZeroChatThreadModelSelection
-} from "./chunk-GPZFXJF6.js";
+} from "./chunk-K7GO6MVZ.js";
 import {
   withErrorHandler
-} from "./chunk-NPC4JKK2.js";
+} from "./chunk-XL2OLDVB.js";
 import {
   source_default
 } from "./chunk-JUTUEPIR.js";
@@ -244,4 +244,4 @@ Examples:
 export {
   zeroChatCommand
 };
-//# sourceMappingURL=chat-6UAO4EJO.js.map
+//# sourceMappingURL=chat-THI2OQL2.js.map

package/{chunk-2J262TOD.js → chunk-5EV2TAHQ.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   getApiUrl
-} from "./chunk-NPC4JKK2.js";
+} from "./chunk-XL2OLDVB.js";
 import {
   init_esm_shims
 } from "./chunk-DIRAZ3YX.js";
@@ -32,4 +32,4 @@ export {
   toPlatformUrl,
   getPlatformOrigin
 };
-//# sourceMappingURL=chunk-2J262TOD.js.map
+//# sourceMappingURL=chunk-5EV2TAHQ.js.map

package/{chunk-HEGJPPBN.js → chunk-6AAJJUD4.js}

@@ -10,7 +10,7 @@ import {
   splitPathSegments,
   validateAuthBaseUrl,
   validateBaseUrl
-} from "./chunk-GPZFXJF6.js";
+} from "./chunk-K7GO6MVZ.js";
 import {
   init_esm_shims
 } from "./chunk-DIRAZ3YX.js";
@@ -1176,4 +1176,4 @@ export {
   matchFirewallBaseUrl,
   matchFirewallRequestDecision
 };
-//# sourceMappingURL=chunk-HEGJPPBN.js.map
+//# sourceMappingURL=chunk-6AAJJUD4.js.map

package/{chunk-OHQONXKG.js → chunk-AKVJGOYO.js}

@@ -50,7 +50,7 @@ if (DSN) {
   Sentry.init({
     dsn: DSN,
     environment: process.env.SENTRY_ENVIRONMENT ?? "production",
-    release: "9.237.2",
+    release: "9.237.3",
     sendDefaultPii: false,
     tracesSampleRate: 0,
     shutdownTimeout: 500,
@@ -69,7 +69,7 @@ if (DSN) {
     }
   });
   Sentry.setContext("cli", {
-    version: "9.237.2",
+    version: "9.237.3",
     command: process.argv.slice(2).join(" ")
   });
   Sentry.setContext("runtime", {
@@ -146,4 +146,4 @@ async function configureGlobalProxyFromEnv() {
 export {
   configureGlobalProxyFromEnv
 };
-//# sourceMappingURL=chunk-OHQONXKG.js.map
+//# sourceMappingURL=chunk-AKVJGOYO.js.map

package/{chunk-HU44PZDH.js → chunk-C24KF42N.js}

@@ -10,13 +10,13 @@ import {
   parseBoundedLogCount,
   parseSearchQuery,
   parseTime
-} from "./chunk-E5VVOBJ4.js";
+} from "./chunk-N5OIJGEA.js";
 import {
   searchZeroLogs
-} from "./chunk-GPZFXJF6.js";
+} from "./chunk-K7GO6MVZ.js";
 import {
   withErrorHandler
-} from "./chunk-NPC4JKK2.js";
+} from "./chunk-XL2OLDVB.js";
 import {
   source_default
 } from "./chunk-JUTUEPIR.js";
@@ -176,4 +176,4 @@ export {
   runLogsSearch,
   searchCommand
 };
-//# sourceMappingURL=chunk-HU44PZDH.js.map
+//# sourceMappingURL=chunk-C24KF42N.js.map

package/{chunk-MBQ64I5M.js → chunk-EY5A7AIB.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   MODEL_PROVIDER_TYPES
-} from "./chunk-GPZFXJF6.js";
+} from "./chunk-K7GO6MVZ.js";
 import {
   init_esm_shims
 } from "./chunk-DIRAZ3YX.js";
@@ -40,4 +40,4 @@ export {
   formatModelProviderRoute,
   formatModelPolicyStatus
 };
-//# sourceMappingURL=chunk-MBQ64I5M.js.map
+//# sourceMappingURL=chunk-EY5A7AIB.js.map

package/{chunk-GPZFXJF6.js → chunk-K7GO6MVZ.js}

@@ -14,7 +14,7 @@ import {
   headersWithCliClientHeaders,
   initClient,
   initContract
-} from "./chunk-NPC4JKK2.js";
+} from "./chunk-XL2OLDVB.js";
 import {
   init_esm_shims
 } from "./chunk-DIRAZ3YX.js";
@@ -3050,8 +3050,8 @@ function rawPathFromBaseUrl(value) {
   const schemeEnd = value.indexOf("://");
   if (schemeEnd === -1) return "";
   const afterScheme = value.slice(schemeEnd + 3);
-  const pathStart = afterScheme.indexOf("/");
-  if (pathStart === -1) return "";
+  const pathStart = afterScheme.search(/[/?#]/);
+  if (pathStart === -1 || afterScheme[pathStart] !== "/") return "";
   const pathAndAfter = afterScheme.slice(pathStart);
   const pathEnd = pathAndAfter.search(/[?#]/);
   return pathEnd === -1 ? pathAndAfter : pathAndAfter.slice(0, pathEnd);
@@ -3062,6 +3062,15 @@ function validateBaseUrlPrefixVariable({
   name,
   value
 }) {
+  const rawPath = rawPathFromBaseUrl(value);
+  if (hasUnsafeFirewallPath(rawPath)) {
+    throw baseUrlVariableError(
+      base,
+      serviceName,
+      name,
+      "must not contain unsafe path segments before a fixed path suffix"
+    );
+  }
   validateBaseUrl(value, serviceName);
   const url = new URL(value);
   if (url.search || url.hash) {
@@ -3072,17 +3081,6 @@ function validateBaseUrlPrefixVariable({
       "must not contain query or fragment before a fixed path suffix"
     );
   }
-  const rawPath = rawPathFromBaseUrl(value);
-  for (const segment2 of rawPath.split("/")) {
-    if (pathSegmentHasUnsafeSyntax(segment2, false)) {
-      throw baseUrlVariableError(
-        base,
-        serviceName,
-        name,
-        "must not contain unsafe path segments before a fixed path suffix"
-      );
-    }
-  }
 }
 function validateResolvedBaseUrlPathSafety(templateBase, serviceName, resolved) {
   const rawPath = rawPathFromBaseUrl(resolved);
@@ -4216,6 +4214,7 @@ function validateBaseUrl(base, serviceName) {
       `Invalid base URL "${base}" in firewall "${serviceName}": must not contain backslash`
     );
   }
+  const hasTemplateVars = hasBaseUrlVars(base);
   const rawSyntaxTarget = baseUrlRawSyntaxTarget(base);
   if (hasRawWhitespace(rawSyntaxTarget)) {
     throw new Error(
@@ -4227,7 +4226,16 @@ function validateBaseUrl(base, serviceName) {
       `Invalid base URL "${base}" in firewall "${serviceName}": must not contain control characters or invalid Unicode`
     );
   }
-  if (hasBaseUrlVars(base)) return;
+  let knownRawPath = rawPathFromBaseUrl(rawSyntaxTarget);
+  if (knownRawPath === "" && hasTemplateVars && rawSyntaxTarget.startsWith(`${AUTH_TEMPLATE_URL_PLACEHOLDER}/`)) {
+    knownRawPath = rawSyntaxTarget.slice(AUTH_TEMPLATE_URL_PLACEHOLDER.length);
+  }
+  if (hasUnsafeFirewallPath(knownRawPath)) {
+    throw new Error(
+      errMsg(base, serviceName, "must not contain unsafe path segments")
+    );
+  }
+  if (hasTemplateVars) return;
   validateUrlSchemeDelimiter(base, serviceName, "base URL");
   if (hasBaseUrlParams(base)) {
     validateBaseUrlParams(base, serviceName);
@@ -22389,10 +22397,10 @@ var storedExecutionContextSchema = external_exports.object({
   storageManifest: storageManifestSchema.nullable(),
   environment: external_exports.record(external_exports.string(), external_exports.string()).nullable(),
   // API-only references used to reconstruct runner masking values from the
-  // stored environment. Missing means legacy/stripped data, null means no
-  // persistent secret map, and array order/repetition follows secret-map values.
+  // stored environment. Null means no persistent secret map, and array
+  // order/repetition follows secret-map values.
   // This field must not be included in the runner-facing ExecutionContext.
-  secretValueEnvironmentKeys: external_exports.array(external_exports.string()).nullable().optional(),
+  secretValueEnvironmentKeys: external_exports.array(external_exports.string()).nullable(),
   // Connector-owned runtime vars used by proxy/firewall template resolution.
   // User-provided run vars stay in agent_runs.vars and are merged at claim time.
   vars: external_exports.record(external_exports.string(), external_exports.string()).nullable().optional(),
@@ -29641,4 +29649,4 @@ export {
   completeHostedSite,
   getHostedSiteFiles
 };
-//# sourceMappingURL=chunk-GPZFXJF6.js.map
+//# sourceMappingURL=chunk-K7GO6MVZ.js.map