@vm0/cli 9.274.10 → 9.274.12

package/{computer-use-RQFEXMNN.js → computer-use-EX7NUHO6.js}

@@ -12,12 +12,12 @@ import {
   fetchComputerUseScreenshot,
   getComputerUseCommand,
   listComputerUseHosts
-} from "./chunk-Y7RLOQPB.js";
-import "./chunk-T7KKAPXV.js";
+} from "./chunk-UST46T62.js";
+import "./chunk-NU4QI6YS.js";
 import {
   ApiRequestError,
   withErrorHandler
-} from "./chunk-EUZGV3TS.js";
+} from "./chunk-R6YSBKNW.js";
 import "./chunk-KLI6K4VO.js";
 import {
   Command
@@ -970,4 +970,4 @@ export {
   formatComputerUseResultForConsole,
   zeroComputerUseCommand
 };
-//# sourceMappingURL=computer-use-RQFEXMNN.js.map
+//# sourceMappingURL=computer-use-EX7NUHO6.js.map

package/{connector-6X7OUT7E.js → connector-CJAQUQ2Y.js}

@@ -1,9 +1,6 @@
 #!/usr/bin/env node
 import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
-import {
-  hasConnectorFirewallMetadataPermission
-} from "./chunk-SS35GZL5.js";
 import {
   CALLBACK_PROMPT_PLACEHOLDER,
   addRequestedCallbackSearchParams,
@@ -18,7 +15,7 @@ import {
   resolveConnectorDiscoveryAgentContext,
   resolveManualGrantAuthMethod,
   searchConnectorCatalog
-} from "./chunk-WHGCJQBT.js";
+} from "./chunk-PTH6CS2U.js";
 import {
   UNKNOWN_PERMISSION_GRANT,
   addZeroAgentCustomConnector,
@@ -34,26 +31,25 @@ import {
   getZeroAgentCustomConnectors,
   getZeroAgentUserConnectors,
   getZeroConnector,
-  getZeroConnectorCatalogPermissions,
   getZeroCustomConnector,
   listZeroConnectorCatalogStatus,
   listZeroCustomConnectors,
   setZeroCustomConnectorValues,
   startZeroCustomConnectorOAuth2,
   updateCustomConnectorBodySchema
-} from "./chunk-Y7RLOQPB.js";
-import "./chunk-T7KKAPXV.js";
+} from "./chunk-UST46T62.js";
+import "./chunk-NU4QI6YS.js";
 import {
   getPlatformOrigin,
   toPlatformUrl
-} from "./chunk-55OOIO3Y.js";
+} from "./chunk-3C4OVVAG.js";
 import "./chunk-IPJJ6SPP.js";
 import {
   ApiRequestError,
   getApiUrl,
   source_default,
   withErrorHandler
-} from "./chunk-EUZGV3TS.js";
+} from "./chunk-R6YSBKNW.js";
 import {
   decodeZeroTokenPayload
 } from "./chunk-KLI6K4VO.js";
@@ -171,15 +167,26 @@ function validateCheckConnectorOptions(opts, command) {
     );
   }
 }
+function buildConnectorUrlDiagnosticRequest(args) {
+  if (rawUrlAuthorityHasUserinfo(args.url)) {
+    throw unsafeInputError("invalid-url");
+  }
+  return {
+    mode: "url",
+    method: args.method.toUpperCase(),
+    url: stripUrlQueryAndFragment(args.url),
+    ...args.connectorSlug !== void 0 ? { connectorSlug: args.connectorSlug } : {},
+    ...args.environmentName !== void 0 ? { environmentName: args.environmentName } : {}
+  };
+}
 function buildDiagnosticRequest(opts, method) {
   if (opts.url !== void 0) {
-    return {
-      mode: "url",
+    return buildConnectorUrlDiagnosticRequest({
       method,
-      url: stripUrlQueryAndFragment(opts.url),
-      ...opts.connector !== void 0 ? { connectorSlug: opts.connector } : {},
-      ...opts.envName !== void 0 ? { environmentName: opts.envName } : {}
-    };
+      url: opts.url,
+      connectorSlug: opts.connector,
+      environmentName: opts.envName
+    });
   }
   return {
     mode: "environment",
@@ -267,7 +274,7 @@ function environmentNotUsedError(request, result) {
     `${environmentName} is not used by the matched API route. Expected one of: ${result.environmentNames.join(", ") || "none"}. Remove --env-name to use the matched route metadata.`
   );
 }
-function resolvedDiagnostic(request, result) {
+function resolveConnectorCheckDiagnostic(request, result) {
   switch (result.outcome) {
     case "resolved":
       return result;
@@ -517,7 +524,7 @@ function printUnavailablePolicy(policy) {
       return;
   }
 }
-function printNamedPolicyResult(connectorSlug, permission, policy, agentId) {
+function printNamedPolicyResult(connectorSlug, permission, policy, agentId, request) {
   switch (policy.outcome) {
     case "allow": {
       switch (policy.basis) {
@@ -552,7 +559,8 @@ function printNamedPolicyResult(connectorSlug, permission, policy, agentId) {
         connectorSlug,
         permission,
         agentId,
-        "To request this permission, run"
+        "To request this permission, run",
+        request
       );
       return;
     case "ask":
@@ -563,7 +571,8 @@ function printNamedPolicyResult(connectorSlug, permission, policy, agentId) {
         connectorSlug,
         permission,
         agentId,
-        "To request this permission, run"
+        "To request this permission, run",
+        request
       );
       return;
     case "unavailable":
@@ -571,11 +580,17 @@ function printNamedPolicyResult(connectorSlug, permission, policy, agentId) {
       return;
   }
 }
-function permissionRequestCommand(connectorSlug, permission) {
-  return `zero connector permission-request ${connectorSlug} --permission ${permission}`;
+function permissionRequestCommand(connectorSlug, permission, request) {
+  return `zero connector permission-request ${shellQuoteArg(connectorSlug)} --permission ${shellQuoteArg(permission)} --url ${shellQuoteArg(request.url)} --method ${shellQuoteArg(request.method)}`;
 }
-function printPermissionRequestCommands(connectorSlug, permission, agentId, introduction) {
-  const command = permissionRequestCommand(connectorSlug, permission);
+function printPermissionRequestCommands(connectorSlug, permission, agentId, introduction, request) {
+  if (request === void 0) {
+    console.log(
+      "Diagnose the failed request with zero connector check --url <FAILED_URL> --method <METHOD> before requesting this permission."
+    );
+    return;
+  }
+  const command = permissionRequestCommand(connectorSlug, permission, request);
   console.log(`${introduction}: ${command}`);
   if (!currentChatSupportsActionCallback(agentId)) {
     return;
@@ -586,7 +601,7 @@ function printPermissionRequestCommands(connectorSlug, permission, agentId, intr
   );
   console.log(`${command} --callback-prompt "${CALLBACK_PROMPT_PLACEHOLDER}"`);
 }
-function printUnknownEndpointPolicy(connectorSlug, policy, agentId) {
+function printUnknownEndpointPolicy(connectorSlug, policy, agentId, request) {
   switch (policy.outcome) {
     case "allow":
       console.log(
@@ -601,7 +616,8 @@ function printUnknownEndpointPolicy(connectorSlug, policy, agentId) {
         connectorSlug,
         "__unknown__",
         agentId,
-        "To request access to unknown endpoints, run"
+        "To request access to unknown endpoints, run",
+        request
       );
       return;
     case "ask":
@@ -612,7 +628,8 @@ function printUnknownEndpointPolicy(connectorSlug, policy, agentId) {
         connectorSlug,
         "__unknown__",
         agentId,
-        "To request access to unknown endpoints, run"
+        "To request access to unknown endpoints, run",
+        request
       );
       return;
     case "unavailable":
@@ -620,7 +637,7 @@ function printUnknownEndpointPolicy(connectorSlug, policy, agentId) {
       return;
   }
 }
-function printUrlPermissionDiagnostic(result, agentId) {
+function printUrlPermissionDiagnostic(request, result, agentId) {
   console.log("## Step 3: Permission policy check (auto-detected from URL)");
   console.log("");
   console.log(
@@ -639,7 +656,8 @@ function printUrlPermissionDiagnostic(result, agentId) {
         result.connector.connectorSlug,
         permission.name,
         permission.policy,
-        agentId
+        agentId,
+        request
       );
     }
   } else {
@@ -650,7 +668,8 @@ function printUrlPermissionDiagnostic(result, agentId) {
     printUnknownEndpointPolicy(
       result.connector.connectorSlug,
       result.permission.policy,
-      agentId
+      agentId,
+      request
     );
   }
   console.log("");
@@ -674,7 +693,8 @@ function printEnvironmentPermissionDiagnostic(result, permissionName, agentId) {
     result.connector.connectorSlug,
     permissionName,
     result.permission,
-    agentId
+    agentId,
+    void 0
   );
   console.log("");
 }
@@ -755,7 +775,7 @@ How connectors work:
     const method = opts.method.toUpperCase();
     const request = buildDiagnosticRequest(opts, method);
     const diagnostic = await diagnoseZeroConnectorCheck(request);
-    const result = resolvedDiagnostic(request, diagnostic);
+    const result = resolveConnectorCheckDiagnostic(request, diagnostic);
     printDiagnosticSummary(request, result);
     console.log("");
     const platformUrl = toPlatformUrl(await getApiUrl());
@@ -783,7 +803,11 @@ How connectors work:
     }
     console.log("");
     if (result.mode === "url") {
-      printUrlPermissionDiagnostic(result, ctx.agentId);
+      printUrlPermissionDiagnostic(
+        requireUrlRequest(request),
+        result,
+        ctx.agentId
+      );
     } else {
       printEnvironmentPermissionDiagnostic(
         result,
@@ -1634,6 +1658,74 @@ function printBrowserPermissionGuidance() {
 function permissionDescription(permission) {
   return permission === UNKNOWN_PERMISSION_GRANT ? "unknown endpoints" : `the "${permission}" permission`;
 }
+function permissionPolicyForDiagnostic(args) {
+  if (args.result.mode !== "url") {
+    throw new Error(
+      "Connector diagnostic returned an environment result for a URL request."
+    );
+  }
+  if (args.permission === UNKNOWN_PERMISSION_GRANT) {
+    if (args.result.permission.kind === "unknown-endpoint") {
+      return args.result.permission.policy;
+    }
+    throw permissionMismatchError({
+      permission: args.permission,
+      method: args.method,
+      url: args.url,
+      matchedPermissions: args.result.permission.permissions.map(
+        (permission) => {
+          return permission.name;
+        }
+      )
+    });
+  }
+  if (args.result.permission.kind === "unknown-endpoint") {
+    throw permissionMismatchError({
+      permission: args.permission,
+      method: args.method,
+      url: args.url,
+      matchedPermissions: [UNKNOWN_PERMISSION_GRANT]
+    });
+  }
+  const matchedPermission = args.result.permission.permissions.find(
+    (permission) => {
+      return permission.name === args.permission;
+    }
+  );
+  if (matchedPermission === void 0) {
+    throw permissionMismatchError({
+      permission: args.permission,
+      method: args.method,
+      url: args.url,
+      matchedPermissions: args.result.permission.permissions.map(
+        (permission) => {
+          return permission.name;
+        }
+      )
+    });
+  }
+  return matchedPermission.policy;
+}
+function permissionMismatchError(args) {
+  return new Error(
+    `Permission "${args.permission}" does not match ${args.method} ${args.url}. The request maps to: ${args.matchedPermissions.join(", ")}. Use the exact permission-request command printed by zero connector check; provider OAuth scopes and missing_scope/needed values cannot be granted here.`
+  );
+}
+function assertRequestablePolicy(args) {
+  switch (args.policy.outcome) {
+    case "deny":
+    case "ask":
+      return;
+    case "allow":
+      throw new Error(
+        `${permissionDescription(args.permission)} is already allowed by Zero for ${args.method} ${args.url}. Provider authorization failures cannot be fixed with a Zero permission request.`
+      );
+    case "unavailable":
+      throw new Error(
+        `Zero permission policy is unavailable for ${args.method} ${args.url}. Retry zero connector check from an active run before requesting access.`
+      );
+  }
+}
 function printSensitivePermissionGuidance(connectorSlug, permission) {
   if (connectorSlug === "slack" && permission === "chat:write") {
     console.log("");
@@ -1764,7 +1856,7 @@ var callbackPromptAvailable = connectorActionCallbackAvailable();
 if (!callbackPromptAvailable) {
   callbackPromptOption.hideHelp();
 }
-var callbackPromptExample = callbackPromptAvailable ? '  zero connector permission-request github --permission contents:write --callback-prompt "Re-check the permission, then continue the previous task"\n' : "";
+var callbackPromptExample = callbackPromptAvailable ? '  zero connector permission-request github --permission contents:write --url https://api.github.com/repos/vm0-ai/vm0 --method POST --callback-prompt "Re-check the permission, then continue the previous task"\n' : "";
 var callbackPromptNotes = callbackPromptAvailable ? "  - Use --callback-prompt only when this turn needs exactly one connector or permission action\n  - Callback prompts are included in the URL; keep them concise and do not include secrets\n" : "";
 var permissionRequestCommand2 = new Command().name("permission-request").description("Request permission to use a connector capability").argument("<slug>", "The connector slug (e.g. github)").addOption(
   new Option(
@@ -1776,18 +1868,29 @@ var permissionRequestCommand2 = new Command().name("permission-request").descrip
     "--agent <id>",
     "Agent ID whose permission page should be opened (defaults to ZERO_AGENT_ID)"
   )
+).addOption(
+  new Option(
+    "--url <URL>",
+    "The failed request URL reported to zero connector check"
+  )
+).addOption(
+  new Option("--method <METHOD>", "The failed request HTTP method").default(
+    "GET"
+  )
 ).addOption(callbackPromptOption).addHelpText(
   "after",
   `
 Examples:
-  zero connector permission-request github --permission contents:read
-${callbackPromptExample}  zero connector permission-request gmail --permission messages.write --agent <agent-id>
-  zero connector permission-request cloudflare --permission __unknown__
+  zero connector permission-request github --permission contents:read --url https://api.github.com/repos/vm0-ai/vm0 --method GET
+${callbackPromptExample}  zero connector permission-request gmail --permission messages.write --url https://gmail.googleapis.com/gmail/v1/users/me/messages --method POST --agent <agent-id>
+  zero connector permission-request cloudflare --permission __unknown__ --url https://api.cloudflare.com/client/v4/example --method POST
   zero connector permission-request computer-use --permission computer-use:write
   zero connector permission-request browser --permission browser:write
 
 Notes:
-  - Outputs a platform URL for the user to allow the permission
+  - First run zero connector check --url <FAILED_URL> --method <METHOD>
+  - Use the exact permission-request command printed by connector check
+  - A platform URL is output only when that request maps to a denied or approval-required permission
   - Use --permission __unknown__ to request access to unknown endpoints
   - Use --agent to request a permission for another agent; defaults to ZERO_AGENT_ID
   - The user chooses the permission duration on the confirmation page
@@ -1820,18 +1923,36 @@ ${callbackPromptNotes}  - Permission requests update the current user's connecto
         return;
       }
       const agentId = opts.agent ?? process.env.ZERO_AGENT_ID;
-      const metadata = await getZeroConnectorCatalogPermissions(connectorSlug);
-      if (!metadata) {
-        throw new Error(`Unknown connector slug: ${connectorSlug}`);
-      }
-      if (opts.permission !== UNKNOWN_PERMISSION_GRANT && !hasConnectorFirewallMetadataPermission(metadata, opts.permission)) {
+      if (opts.url === void 0) {
         throw new Error(
-          `Unknown permission "${opts.permission}" for ${connectorSlug}`
+          "--url is required for connector permission requests. Run zero connector check --url <FAILED_URL> --method <METHOD> and use the permission-request command it prints."
         );
       }
+      const diagnosticRequest = buildConnectorUrlDiagnosticRequest({
+        url: opts.url,
+        method: opts.method,
+        connectorSlug
+      });
+      const diagnostic = await diagnoseZeroConnectorCheck(diagnosticRequest);
+      const result = resolveConnectorCheckDiagnostic(
+        diagnosticRequest,
+        diagnostic
+      );
+      const policy = permissionPolicyForDiagnostic({
+        result,
+        permission: opts.permission,
+        method: diagnosticRequest.method,
+        url: diagnosticRequest.url
+      });
+      assertRequestablePolicy({
+        policy,
+        permission: opts.permission,
+        method: diagnosticRequest.method,
+        url: diagnosticRequest.url
+      });
       await outputPermissionRequestMessage(
-        connectorSlug,
-        metadata.label,
+        result.connector.connectorSlug,
+        result.connector.label,
         opts.permission,
         agentId,
         opts.callbackPrompt
@@ -1845,4 +1966,4 @@ var zeroConnectorCommand = new Command().name("connector").description("Manage a
 export {
   zeroConnectorCommand
 };
-//# sourceMappingURL=connector-6X7OUT7E.js.map
+//# sourceMappingURL=connector-CJAQUQ2Y.js.map