lua-cli 3.23.1 → 3.24.0

package/dist/index.js

@@ -12890,17 +12890,42 @@ var init_custom_data_api_service = __esm({
         this.agentId = agentId;
       }
       /**
+      * Lists the agent's data collections with entry counts, timestamps, and —
+      * when declared — managed index status (fields, pending/building/ready/
+      * failed/rejected, error reason). The place to diagnose index declarations.
+      * @returns Promise resolving to the collections listing
+      */
+      async collections() {
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/custom-data`, {
+          Authorization: `Bearer ${this.apiKey}`
+        });
+        if (response.success && response.data) {
+          return response.data;
+        }
+        throw new Error(response.error?.message || "Failed to list custom data collections");
+      }
+      /**
       * Creates a new custom data entry in a specified collection
       * @param collectionName - The name of the collection to create the entry in
       * @param data - The data object to store in the entry
-      * @param searchText - Optional text to be used for semantic search indexing
+      * @param optionsOrSearchText - Either a searchText string (legacy form) or an
+      *   options object: `searchText` for semantic search indexing, and `index` to
+      *   declare data fields this agent filters on (e.g. `['business_id']` or
+      *   compounds like `[['country', 'business_id']]`). Declared fields get
+      *   agent-scoped database indexes maintained by the platform: created when
+      *   first declared, removed automatically ~14 days after the code stops
+      *   declaring them. Declaring on every write is the intended, idempotent use.
       * @returns Promise resolving to a DataEntryInstance representing the created entry
       * @throws Error if the entry creation fails or the API request is unsuccessful
       */
-      async create(collectionName, data, searchText) {
+      async create(collectionName, data, optionsOrSearchText) {
+        const options = typeof optionsOrSearchText === "string" ? {
+          searchText: optionsOrSearchText
+        } : optionsOrSearchText ?? {};
         const response = await this.httpPost(`/developer/agents/${this.agentId}/custom-data/${collectionName}`, {
           data,
-          searchText
+          searchText: options.searchText,
+          index: options.index
         }, {
           Authorization: `Bearer ${this.apiKey}`
         });
@@ -12953,14 +12978,19 @@ var init_custom_data_api_service = __esm({
       * @param collectionName - The name of the collection containing the entry
       * @param entryId - The unique identifier of the entry to update
       * @param data - The data object to update
-      * @param searchText - Optional text to be used for semantic search indexing
+      * @param optionsOrSearchText - searchText string (legacy) or { searchText?, index? };
+      *   `index` refreshes this agent's index declarations (same semantics as create)
       * @returns Promise resolving to an UpdateCustomDataResponse with the updated entry details
       * @throws Error if the entry is not found or the update fails
       */
-      async update(collectionName, entryId, data, searchText) {
+      async update(collectionName, entryId, data, optionsOrSearchText) {
+        const options = typeof optionsOrSearchText === "string" ? {
+          searchText: optionsOrSearchText
+        } : optionsOrSearchText ?? {};
         const response = await this.httpPut(`/developer/agents/${this.agentId}/custom-data/${collectionName}/${entryId}`, {
           data,
-          searchText
+          searchText: options.searchText,
+          index: options.index
         }, {
           Authorization: `Bearer ${this.apiKey}`
         });
@@ -20723,6 +20753,14 @@ var DEFAULT_BLOCK_CIDRS = [
   "fe80::/10",
   "fc00::/7"
 ];
+var HOSTNAME_NON_OVERRIDABLE_CIDRS = [
+  "127.0.0.0/8",
+  "169.254.0.0/16",
+  "0.0.0.0/8",
+  "::1/128",
+  "fe80::/10",
+  "fd00:ec2::254/128"
+];
 function ipv4ToInt(ip) {
   const parts = ip.split(".").map(Number);
   if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255)) {
@@ -20824,24 +20862,50 @@ function ipInCidr(ip, cidrs) {
 }
 __name(ipInCidr, "ipInCidr");
 __name4(ipInCidr, "ipInCidr");
+function normalizeHostname(hostname) {
+  return stripBrackets(hostname.trim()).toLowerCase().replace(/\.$/, "");
+}
+__name(normalizeHostname, "normalizeHostname");
+__name4(normalizeHostname, "normalizeHostname");
+function parseAllowedHostname(value) {
+  const hostname = normalizeHostname(value);
+  if (!hostname || net.isIP(hostname) || /[\s*/:\\?#]/.test(hostname)) {
+    throw new Error(`Invalid sandbox egress hostname allowlist entry: ${JSON.stringify(value)}. Use an exact hostname without a wildcard, URL, port, or IP literal.`);
+  }
+  return hostname;
+}
+__name(parseAllowedHostname, "parseAllowedHostname");
+__name4(parseAllowedHostname, "parseAllowedHostname");
 function compile2(opts) {
   return {
     blockCidrs: DEFAULT_BLOCK_CIDRS.map(parseCidr),
     allowCidrs: (opts.extraAllowedCidrs ?? []).map(parseCidr),
+    allowHostnames: new Set((opts.extraAllowedHostnames ?? []).map(parseAllowedHostname)),
+    hostnameNonOverridableCidrs: HOSTNAME_NON_OVERRIDABLE_CIDRS.map(parseCidr),
     mode: opts.mode,
     onEvent: opts.onSecurityEvent
   };
 }
 __name(compile2, "compile");
 __name4(compile2, "compile");
-function checkAddress(address, guard) {
-  if (ipInCidr(address, guard.allowCidrs)) return null;
+function isAllowedHostname(hostname, guard) {
+  return !net.isIP(hostname) && guard.allowHostnames.has(normalizeHostname(hostname));
+}
+__name(isAllowedHostname, "isAllowedHostname");
+__name4(isAllowedHostname, "isAllowedHostname");
+function checkAddress(address, guard, allowedByHostname = false) {
+  const v4 = ipv4MappedFromIpv6(address);
+  if (ipInCidr(address, guard.allowCidrs) || v4 !== null && ipInCidr(v4, guard.allowCidrs)) return null;
+  if (allowedByHostname) {
+    if (ipInCidr(address, guard.hostnameNonOverridableCidrs) || v4 !== null && ipInCidr(v4, guard.hostnameNonOverridableCidrs)) {
+      return `address ${address} is protected from sandbox hostname allowances`;
+    }
+    return null;
+  }
   if (ipInCidr(address, guard.blockCidrs)) {
     return `address ${address} is in the sandbox egress block list`;
   }
-  const v4 = ipv4MappedFromIpv6(address);
   if (v4) {
-    if (ipInCidr(v4, guard.allowCidrs)) return null;
     if (ipInCidr(v4, guard.blockCidrs)) {
       return `address ${address} (IPv4-mapped: ${v4}) is in the sandbox egress block list`;
     }
@@ -20866,8 +20930,9 @@ async function resolveAndCheck(hostname, guard) {
   } catch {
     return null;
   }
+  const allowedByHostname = isAllowedHostname(hostname, guard);
   for (const { address } of addresses) {
-    const reason = checkAddress(address, guard);
+    const reason = checkAddress(address, guard, allowedByHostname);
     if (reason) return {
       reason,
       address
@@ -20978,8 +21043,9 @@ function buildBlockingLookup(guard, target) {
     }, (err, addresses) => {
       if (err) return cb(err);
       const list = addresses;
+      const allowedByHostname = isAllowedHostname(hostname, guard);
       for (const { address } of list) {
-        const reason = checkAddress(address, guard);
+        const reason = checkAddress(address, guard, allowedByHostname);
         if (reason) {
           emit(guard, target, reason, address);
           if (guard.mode === "enforce") {
@@ -21275,6 +21341,7 @@ function createBaseSandboxContext(opts) {
   const egressOpts = {
     mode: egressMode,
     extraAllowedCidrs: opts.egressExtraAllowedCidrs,
+    extraAllowedHostnames: opts.egressExtraAllowedHostnames,
     onSecurityEvent: onSecurityEvent ? (evt) => onSecurityEvent(evt) : void 0
   };
   const wrappedModuleCache = /* @__PURE__ */ new Map();
@@ -21338,6 +21405,13 @@ function resolveExtraAllowedCidrs() {
 }
 __name(resolveExtraAllowedCidrs, "resolveExtraAllowedCidrs");
 __name4(resolveExtraAllowedCidrs, "resolveExtraAllowedCidrs");
+function resolveExtraAllowedHostnames() {
+  const csv = process.env.LUA_ALLOWED_EGRESS_HOSTNAMES;
+  if (!csv) return [];
+  return csv.split(",").map((s) => s.trim()).filter(Boolean);
+}
+__name(resolveExtraAllowedHostnames, "resolveExtraAllowedHostnames");
+__name4(resolveExtraAllowedHostnames, "resolveExtraAllowedHostnames");
 function wrapBundleAsCjsModule(source) {
   return "(function(module, exports, require) {\n" + source + "\n})(module, module.exports, require);";
 }
@@ -21571,6 +21645,12 @@ function resolveExtraAllowedCidrs2() {
   return csv.split(",").map((s) => s.trim()).filter(Boolean);
 }
 __name(resolveExtraAllowedCidrs2, "resolveExtraAllowedCidrs");
+function resolveExtraAllowedHostnames2() {
+  const csv = process.env.LUA_ALLOWED_EGRESS_HOSTNAMES;
+  if (!csv) return [];
+  return csv.split(",").map((s) => s.trim()).filter(Boolean);
+}
+__name(resolveExtraAllowedHostnames2, "resolveExtraAllowedHostnames");
 function defaultSecurityEventLogger(evt) {
   console.warn("[sandbox]", JSON.stringify(evt));
 }
@@ -21759,6 +21839,7 @@ function createSandbox(options) {
     requireMode: resolveRequireMode(),
     egressMode: resolveEgressMode(),
     egressExtraAllowedCidrs: resolveExtraAllowedCidrs2(),
+    egressExtraAllowedHostnames: resolveExtraAllowedHostnames2(),
     onSecurityEvent: defaultSecurityEventLogger
   });
 }
@@ -26261,15 +26342,18 @@ var ChatApi = class extends HttpClient {
     }
   }
   /**
-  * Clears the authenticated user's conversation history for an agent
+  * Clears conversation history for an agent. Without targetIdentifier this is
+  * self-scoped; cross-user clears require org:manage for the agent on the server.
   * @param agentId - The unique identifier of the agent
   * @param threadId - Optional thread ID to clear a specific conversation thread
+  * @param targetIdentifier - Optional target user ID, email, or mobile number
   * @returns Promise resolving to an ApiResponse with confirmation
   * @throws Error if the agent is not found or the clear operation fails
   */
-  async clearHistory(agentId, threadId) {
+  async clearHistory(agentId, threadId, targetIdentifier) {
     const params = new URLSearchParams();
     if (threadId) params.set("threadId", threadId);
+    if (targetIdentifier !== void 0) params.set("targetIdentifier", targetIdentifier);
     const query = params.toString() ? `?${params.toString()}` : "";
     const url = `/chat/history/${agentId}${query}`;
     return this.httpDelete(url, {
@@ -27701,22 +27785,24 @@ init_analytics();
 async function chatClearCommand(options, command) {
   return withErrorHandling(async () => {
     const resolvedOptions = options ?? {};
-    if (resolvedOptions.user) {
-      throw new Error("The --user option was removed: cross-user history clear is no longer supported. This command only clears your own chat history \u2014 re-run it without --user.");
+    const targetIdentifier = resolvedOptions.user?.trim();
+    if (resolvedOptions.user !== void 0 && !targetIdentifier) {
+      throw new Error("--user requires a non-empty user ID, email address, or mobile number.");
     }
     const { agentId, apiKey } = await initializeCommand();
     const threadId = resolvedOptions.thread ?? command?.parent?.opts()?.thread;
     const force = !!resolvedOptions.force;
     const threadContext = threadId ? ` in thread "${threadId}"` : "";
+    const targetContext = targetIdentifier ? ` for user "${targetIdentifier}"` : "";
     if (!force) {
       console.log(`
-\u26A0\uFE0F  WARNING: This will clear your conversation history${threadContext}!`);
+\u26A0\uFE0F  WARNING: This will clear conversation history${targetContext}${threadContext}!`);
       console.log("\u26A0\uFE0F  This action cannot be undone.\n");
       const confirmAnswer = await safePrompt([
         {
           type: "confirm",
           name: "confirm",
-          message: `Are you sure you want to clear your conversation history${threadContext}?`,
+          message: `Are you sure you want to clear conversation history${targetContext}${threadContext}?`,
           default: false
         }
       ]);
@@ -27726,16 +27812,17 @@ async function chatClearCommand(options, command) {
     }
     writeProgress("\u{1F504} Clearing conversation history...");
     const chatApi = new ChatApi(BASE_URLS.CHAT, apiKey);
-    const response = await chatApi.clearHistory(agentId, threadId);
+    const response = await chatApi.clearHistory(agentId, threadId, targetIdentifier);
     if (!response.success) {
       throw new Error(response.error?.message || "Failed to clear conversation history");
     }
-    writeSuccess(`\u2705 Your conversation history has been cleared${threadContext}`);
-    console.log(`\u{1F4A1} Your chat history has been completely removed${threadContext}.
+    writeSuccess(`\u2705 Conversation history has been cleared${targetContext}${threadContext}`);
+    console.log(`\u{1F4A1} Chat history has been completely removed${targetContext}${threadContext}.
 `);
     trackEvent("cli_chat_cleared", {
       force_mode: force,
-      has_thread_target: !!threadId
+      has_thread_target: !!threadId,
+      has_user_target: !!targetIdentifier
     });
   }, "chat clear");
 }
@@ -46380,16 +46467,19 @@ Examples:
   $ lua chat -b "Hello" "What is the weather?" "Tell me a joke" -d 2000 -e sandbox  Batch test
   $ lua chat --agent-version 3 -m "test"         Preview agent version 3 in an isolated thread
 `).action(chatCommand);
-  chatCmd.command("clear").description("Clear your conversation history").option("--user <identifier>", "[removed] cross-user history clear is no longer supported").option("-t, --thread <id>", "Clear a specific thread's history instead of all history").option("--force", "Skip confirmation prompt").addHelpText("after", `
+  chatCmd.command("clear").description("Clear your own or an administered user's conversation history").option("--user <identifier>", "Clear another user by ID, email, or mobile (requires org:manage)").option("-t, --thread <id>", "Clear a specific thread's history instead of all history").option("--force", "Skip confirmation prompt").addHelpText("after", `
 Examples:
   $ lua chat clear                                   Clear your history
   $ lua chat clear --force                           Clear your history without confirmation
+  $ lua chat clear --user user@example.com           Clear another user's history (requires org:manage)
+  $ lua chat clear --user +1234567890 --force        Clear another user's history without confirmation
   $ lua chat clear --thread <threadId>               Clear a specific thread's history
   $ lua chat clear --thread <threadId> --force       Clear a specific thread's history without confirmation
 
 Notes:
-  - This command only clears YOUR OWN conversation history
-  - The --user option was removed: cross-user history clear is no longer supported
+  - Without --user, this command clears only YOUR OWN conversation history
+  - --user requires org:manage for the agent
+  - Org-admin grants do not cascade to private agents; org owners and explicit agent grants follow shared authorization rules
 `).action(chatClearCommand);
   program2.command("env [environment]").description("\u2699\uFE0F  Manage environment variables").option("-k, --key <name>", "Environment variable key").option("-v, --value <value>", "Environment variable value").option("-d, --delete", "Delete the specified key").option("--list", "List all environment variables").addHelpText("after", `
 Arguments: