@vm0/cli 9.237.2 → 9.237.4

package/{chunk-AEL2XKIL.js → chunk-G6T3JLQE.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   UNKNOWN_PERMISSION_GRANT
-} from "./chunk-GPZFXJF6.js";
+} from "./chunk-JYENHNFY.js";
 import {
   init_esm_shims
 } from "./chunk-DIRAZ3YX.js";
@@ -1251,4 +1251,4 @@ export {
   getFirewallPermissionSummary,
   loadFirewallPermissionMetadata
 };
-//# sourceMappingURL=chunk-AEL2XKIL.js.map
+//# sourceMappingURL=chunk-G6T3JLQE.js.map

package/{chunk-2JZ66FKH.js → chunk-HDK3YMNH.js}

@@ -4,7 +4,7 @@ const require = __createRequire(import.meta.url);
 import {
   loadFirewallPermissionMetadata,
   resolveFirewallMetadataPolicies
-} from "./chunk-AEL2XKIL.js";
+} from "./chunk-G6T3JLQE.js";
 import {
   source_default
 } from "./chunk-JUTUEPIR.js";
@@ -87,4 +87,4 @@ export {
   policyIcon,
   loadConnectorPermissionInfos
 };
-//# sourceMappingURL=chunk-2JZ66FKH.js.map
+//# sourceMappingURL=chunk-HDK3YMNH.js.map

package/{chunk-OHQONXKG.js → chunk-IPQFR5CI.js}

@@ -50,7 +50,7 @@ if (DSN) {
   Sentry.init({
     dsn: DSN,
     environment: process.env.SENTRY_ENVIRONMENT ?? "production",
-    release: "9.237.2",
+    release: "9.237.4",
     sendDefaultPii: false,
     tracesSampleRate: 0,
     shutdownTimeout: 500,
@@ -69,7 +69,7 @@ if (DSN) {
     }
   });
   Sentry.setContext("cli", {
-    version: "9.237.2",
+    version: "9.237.4",
     command: process.argv.slice(2).join(" ")
   });
   Sentry.setContext("runtime", {
@@ -146,4 +146,4 @@ async function configureGlobalProxyFromEnv() {
 export {
   configureGlobalProxyFromEnv
 };
-//# sourceMappingURL=chunk-OHQONXKG.js.map
+//# sourceMappingURL=chunk-IPQFR5CI.js.map

package/{chunk-GPZFXJF6.js → chunk-JYENHNFY.js}

@@ -14,7 +14,7 @@ import {
   headersWithCliClientHeaders,
   initClient,
   initContract
-} from "./chunk-NPC4JKK2.js";
+} from "./chunk-COF3OOMK.js";
 import {
   init_esm_shims
 } from "./chunk-DIRAZ3YX.js";
@@ -3050,8 +3050,8 @@ function rawPathFromBaseUrl(value) {
   const schemeEnd = value.indexOf("://");
   if (schemeEnd === -1) return "";
   const afterScheme = value.slice(schemeEnd + 3);
-  const pathStart = afterScheme.indexOf("/");
-  if (pathStart === -1) return "";
+  const pathStart = afterScheme.search(/[/?#]/);
+  if (pathStart === -1 || afterScheme[pathStart] !== "/") return "";
   const pathAndAfter = afterScheme.slice(pathStart);
   const pathEnd = pathAndAfter.search(/[?#]/);
   return pathEnd === -1 ? pathAndAfter : pathAndAfter.slice(0, pathEnd);
@@ -3062,6 +3062,15 @@ function validateBaseUrlPrefixVariable({
   name,
   value
 }) {
+  const rawPath = rawPathFromBaseUrl(value);
+  if (hasUnsafeFirewallPath(rawPath)) {
+    throw baseUrlVariableError(
+      base,
+      serviceName,
+      name,
+      "must not contain unsafe path segments before a fixed path suffix"
+    );
+  }
   validateBaseUrl(value, serviceName);
   const url = new URL(value);
   if (url.search || url.hash) {
@@ -3072,17 +3081,6 @@ function validateBaseUrlPrefixVariable({
       "must not contain query or fragment before a fixed path suffix"
     );
   }
-  const rawPath = rawPathFromBaseUrl(value);
-  for (const segment2 of rawPath.split("/")) {
-    if (pathSegmentHasUnsafeSyntax(segment2, false)) {
-      throw baseUrlVariableError(
-        base,
-        serviceName,
-        name,
-        "must not contain unsafe path segments before a fixed path suffix"
-      );
-    }
-  }
 }
 function validateResolvedBaseUrlPathSafety(templateBase, serviceName, resolved) {
   const rawPath = rawPathFromBaseUrl(resolved);
@@ -4216,6 +4214,7 @@ function validateBaseUrl(base, serviceName) {
       `Invalid base URL "${base}" in firewall "${serviceName}": must not contain backslash`
     );
   }
+  const hasTemplateVars = hasBaseUrlVars(base);
   const rawSyntaxTarget = baseUrlRawSyntaxTarget(base);
   if (hasRawWhitespace(rawSyntaxTarget)) {
     throw new Error(
@@ -4227,7 +4226,16 @@ function validateBaseUrl(base, serviceName) {
       `Invalid base URL "${base}" in firewall "${serviceName}": must not contain control characters or invalid Unicode`
     );
   }
-  if (hasBaseUrlVars(base)) return;
+  let knownRawPath = rawPathFromBaseUrl(rawSyntaxTarget);
+  if (knownRawPath === "" && hasTemplateVars && rawSyntaxTarget.startsWith(`${AUTH_TEMPLATE_URL_PLACEHOLDER}/`)) {
+    knownRawPath = rawSyntaxTarget.slice(AUTH_TEMPLATE_URL_PLACEHOLDER.length);
+  }
+  if (hasUnsafeFirewallPath(knownRawPath)) {
+    throw new Error(
+      errMsg(base, serviceName, "must not contain unsafe path segments")
+    );
+  }
+  if (hasTemplateVars) return;
   validateUrlSchemeDelimiter(base, serviceName, "base URL");
   if (hasBaseUrlParams(base)) {
     validateBaseUrlParams(base, serviceName);
@@ -22389,10 +22397,10 @@ var storedExecutionContextSchema = external_exports.object({
   storageManifest: storageManifestSchema.nullable(),
   environment: external_exports.record(external_exports.string(), external_exports.string()).nullable(),
   // API-only references used to reconstruct runner masking values from the
-  // stored environment. Missing means legacy/stripped data, null means no
-  // persistent secret map, and array order/repetition follows secret-map values.
+  // stored environment. Null means no persistent secret map, and array
+  // order/repetition follows secret-map values.
   // This field must not be included in the runner-facing ExecutionContext.
-  secretValueEnvironmentKeys: external_exports.array(external_exports.string()).nullable().optional(),
+  secretValueEnvironmentKeys: external_exports.array(external_exports.string()).nullable(),
   // Connector-owned runtime vars used by proxy/firewall template resolution.
   // User-provided run vars stay in agent_runs.vars and are merged at claim time.
   vars: external_exports.record(external_exports.string(), external_exports.string()).nullable().optional(),
@@ -29641,4 +29649,4 @@ export {
   completeHostedSite,
   getHostedSiteFiles
 };
-//# sourceMappingURL=chunk-GPZFXJF6.js.map
+//# sourceMappingURL=chunk-JYENHNFY.js.map