lua-cli 3.42.0-beta.2 → 3.42.0-beta.3

package/dist/workflow-builder.js

@@ -536,7 +536,19 @@ var SUPERVISION_OPS = {
   * SV — `Agents.notifyOwner(id, { message })`: post a message (no model turn) to the TARGET OWNER's home thread with
   * the caller. Needs the owner's opt-in recorded on the grant (`ownerNotify`) and `LUA_SUPERVISION_OWNER_NOTIFY_ENABLED`.
   */
-  "owner.notify": "observe"
+  "owner.notify": "observe",
+  /**
+  * SV — `Agents.connections(id).assign(connectionId, { approval })`: mount one of the target OWNER's personal
+  * connections on the target, consented by the owner's own signed-in decision on Lua's approval card
+  * (`supervised-connection-handover.types.ts`). Needs `LUA_SUPERVISED_CONNECTION_HANDOVER_ENABLED`.
+  */
+  "connections.assign": "act",
+  /**
+  * SV — `Agents.secrets(id).attach(requestIds)`: attach U9 requests HELD for this existing agent (`{ pendingFor,
+  * agentId }`) to its env. `act`, on a turn whose platform-picked user is the target's owner, never overwriting a
+  * key (`LUA_SECRET_ATTACH_EXISTING_ENABLED`).
+  */
+  "secrets.attach": "act"
 };
 function isSupervisionOp(op) {
   return typeof op === "string" && Object.prototype.hasOwnProperty.call(SUPERVISION_OPS, op);
@@ -705,6 +717,18 @@ var SUPERVISION_OPS_WAVE2 = {
     gate: "observe",
     targeted: true,
     item: "SV"
+  },
+  /** SV — `Agents.connections(id).assign(connectionId, { approval })` (the owner's signed-in approval). */
+  "connections.assign": {
+    gate: "act",
+    targeted: true,
+    item: "SV"
+  },
+  /** SV — `Agents.secrets(id).attach(requestIds)`: held U9 requests onto an existing agent (owner's turn). */
+  "secrets.attach": {
+    gate: "act",
+    targeted: true,
+    item: "SV"
   }
 };
 var SUPERVISION_UNTARGETED_OPS = [
@@ -798,6 +822,7 @@ var AGENT_PROVISIONING_LIMITS = {
   nameMax: 80,
   personaMax: 2e4,
   connectionsMax: 20,
+  pendingSecretsMax: 20,
   maxAgentsPerUserCeiling: 50
 };
 var AGENT_PROVISIONING_APPROVAL_PAYLOAD_KEY = "agentProvisioning";
@@ -811,8 +836,13 @@ var AGENT_PROVISIONING_ERRORS = {
   MODEL_NOT_ALLOWED: "agent_provisioning_model_not_allowed",
   ACTIONS_NOT_ALLOWED: "agent_provisioning_actions_not_allowed",
   WORKFLOW_IDS_INVALID: "agent_provisioning_workflow_ids_invalid",
-  /** Until U9 lands, a non-empty `pendingSecretRequestIds` is refused with this code. */
+  /** A non-empty `pendingSecretRequestIds` while `LUA_SECRET_REQUESTS_ENABLED` is off (or over the limit). */
   PENDING_SECRETS_UNSUPPORTED: "agent_provisioning_pending_secrets_unsupported",
+  /**
+  * A pending secret request is not attachable to this create (unknown, another org / member / provisioner,
+  * not `ok`-tested, already attached or purged). Checked before the agent exists.
+  */
+  PENDING_SECRET_NOT_ATTACHABLE: "agent_provisioning_pending_secret_not_attachable",
   /** The `Agents.create` input is malformed (name, model, persona, list shapes or limits). */
   INVALID_INPUT: "agent_provisioning_invalid_input",
   /** `PUT …/agent-provisioning-policy` body is malformed (`*`, unknown action, out-of-range quota…). */
@@ -1014,10 +1044,16 @@ function decideAgentProvisioning(params) {
   if (input.unattendedWorkflowIds.length) {
     return wf("unattendedWorkflowIds are not allowed on a provisioning grant (the member\u2019s consent does not cover them)");
   }
-  if (input.pendingSecretRequestIds.length) {
+  if (input.pendingSecretRequestIds.length && !params.pendingSecretsEnabled) {
     return {
       code: AGENT_PROVISIONING_ERRORS.PENDING_SECRETS_UNSUPPORTED,
-      message: "Pending secret requests cannot be attached yet"
+      message: "Pending secret requests are not enabled in this environment"
+    };
+  }
+  if (input.pendingSecretRequestIds.length > AGENT_PROVISIONING_LIMITS.pendingSecretsMax) {
+    return {
+      code: AGENT_PROVISIONING_ERRORS.PENDING_SECRETS_UNSUPPORTED,
+      message: `At most ${AGENT_PROVISIONING_LIMITS.pendingSecretsMax} pending secret requests can be attached`
     };
   }
   return null;
@@ -1032,7 +1068,7 @@ var sameSet = /* @__PURE__ */ __name3((a, b) => {
   ].every((v) => sb.has(v));
 }, "sameSet");
 function consentCoversProvisioning(consent, request) {
-  return consent.orgId === request.orgId && consent.userId === request.onBehalfOf && consent.provisionerAgentId === request.provisionerAgentId && consent.agentName.trim() === request.input.name && sameSet(consent.supervise ?? [], request.input.supervise) && sameSet(consent.connections ?? [], request.input.connections);
+  return consent.orgId === request.orgId && consent.userId === request.onBehalfOf && consent.provisionerAgentId === request.provisionerAgentId && consent.agentName.trim() === request.input.name && sameSet(consent.supervise ?? [], request.input.supervise) && sameSet(consent.connections ?? [], request.input.connections) && sameSet(consent.pendingSecretRequestIds ?? [], request.input.pendingSecretRequestIds);
 }
 __name(consentCoversProvisioning, "consentCoversProvisioning");
 __name3(consentCoversProvisioning, "consentCoversProvisioning");
@@ -1764,7 +1800,13 @@ var SECRET_REQUEST_ERRORS = {
   /** The input's `fields` do not match the provider's catalogue bundle. */
   FIELDS_INVALID: "secret_fields_invalid",
   /** `Secrets.test(key)` / status on a key with no request on record (the provider is unknown). */
-  KEY_NOT_FOUND: "secret_key_not_found"
+  KEY_NOT_FOUND: "secret_key_not_found",
+  /** A held request for an existing agent while `LUA_SECRET_ATTACH_EXISTING_ENABLED` is off. */
+  ATTACH_EXISTING_DISABLED: "secret_attach_existing_disabled",
+  /** `secrets.attach` would set an env key the agent already has: never overwritten (remove or rotate it first). */
+  KEY_EXISTS: "secret_key_exists",
+  /** A request held for an existing agent submitted on the public token page: its owner submits it signed in. */
+  OWNER_SUBMIT_REQUIRED: "secret_submit_requires_owner"
 };
 var SECRET_OUTCOME_STATUSES = [
   ...SECRET_TEST_RESULTS,
@@ -3071,6 +3113,110 @@ function supervisionAccessBindingViolation(merged) {
 }
 __name(supervisionAccessBindingViolation, "supervisionAccessBindingViolation");
 __name3(supervisionAccessBindingViolation, "supervisionAccessBindingViolation");
+var CONNECTION_HANDOVER_APPROVAL_PAYLOAD_KEY = "connectionAssignment";
+var CONNECTION_HANDOVER_APPROVAL_CARD_MAX_CHARS = 1200;
+var CONNECTION_HANDOVER_LIMITS = {
+  idMax: 128,
+  agentNameMax: 200,
+  integrationMax: 60,
+  accountMax: 200
+};
+var MEMBERS = [
+  "connectionId",
+  "agentId",
+  "agentName",
+  "supervisorName",
+  "integration",
+  "account"
+];
+var FORMAT_CHARS = /[\p{Cf}\u200b-\u200d\u202a-\u202e\u2066-\u2069\ufeff]/u;
+function hasFormatCharacters(text) {
+  return FORMAT_CHARS.test(text);
+}
+__name(hasFormatCharacters, "hasFormatCharacters");
+__name3(hasFormatCharacters, "hasFormatCharacters");
+var oneLine = /* @__PURE__ */ __name3((text) => text.replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029"\u201c\u201d]/g, " ").replace(/\s+/g, " ").trim(), "oneLine");
+function normalizedHandoverName(name) {
+  return oneLine(name.normalize("NFKC")).toLowerCase();
+}
+__name(normalizedHandoverName, "normalizedHandoverName");
+__name3(normalizedHandoverName, "normalizedHandoverName");
+function handoverAgentIdSuffix(agentId) {
+  return agentId.slice(-6);
+}
+__name(handoverAgentIdSuffix, "handoverAgentIdSuffix");
+__name3(handoverAgentIdSuffix, "handoverAgentIdSuffix");
+var boundedString = /* @__PURE__ */ __name3((v, max) => typeof v === "string" && v.trim().length > 0 && v.length <= max && !hasFormatCharacters(v), "boundedString");
+function parseConnectionHandoverApprovalPayload(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return null;
+  const top = Object.keys(payload);
+  if (top.length !== 1 || top[0] !== CONNECTION_HANDOVER_APPROVAL_PAYLOAD_KEY) return null;
+  const p = payload[CONNECTION_HANDOVER_APPROVAL_PAYLOAD_KEY];
+  if (!p || typeof p !== "object" || Array.isArray(p)) return null;
+  const r = p;
+  if (Object.keys(r).some((k) => !MEMBERS.includes(k))) return null;
+  const L = CONNECTION_HANDOVER_LIMITS;
+  if (!boundedString(r.connectionId, L.idMax) || !boundedString(r.agentId, L.idMax) || !boundedString(r.agentName, L.agentNameMax) || !boundedString(r.supervisorName, L.agentNameMax) || !boundedString(r.integration, L.integrationMax) || r.account !== void 0 && !boundedString(r.account, L.accountMax)) {
+    return null;
+  }
+  return {
+    connectionId: r.connectionId.trim(),
+    agentId: r.agentId.trim(),
+    agentName: r.agentName.trim(),
+    supervisorName: r.supervisorName.trim(),
+    integration: r.integration.trim(),
+    ...r.account !== void 0 ? {
+      account: r.account.trim()
+    } : {}
+  };
+}
+__name(parseConnectionHandoverApprovalPayload, "parseConnectionHandoverApprovalPayload");
+__name3(parseConnectionHandoverApprovalPayload, "parseConnectionHandoverApprovalPayload");
+function describeConnectionHandoverApproval(payload) {
+  const parsed = parseConnectionHandoverApprovalPayload(payload);
+  if (!parsed) return null;
+  const agent = `"${oneLine(parsed.agentName)}" (\u2026${handoverAgentIdSuffix(parsed.agentId)})`;
+  const supervisor = `"${oneLine(parsed.supervisorName)}"`;
+  const integration = oneLine(parsed.integration);
+  const account = parsed.account ? ` (${oneLine(parsed.account)})` : "";
+  return [
+    `Give your ${integration} connection${account} to your agent ${agent}.`,
+    "It can then use this account through its tools.",
+    `${supervisor}, the agent asking, supervises it, so it can also reach this account through it: in test runs, previews and the actions its supervision rights allow.`,
+    "You can remove it at any time from the agent's connections."
+  ].join("\n");
+}
+__name(describeConnectionHandoverApproval, "describeConnectionHandoverApproval");
+__name3(describeConnectionHandoverApproval, "describeConnectionHandoverApproval");
+function connectionHandoverApprovalTitle(facts) {
+  return `Give your ${oneLine(facts.integration)} connection to "${oneLine(facts.agentName)}"?`;
+}
+__name(connectionHandoverApprovalTitle, "connectionHandoverApprovalTitle");
+__name3(connectionHandoverApprovalTitle, "connectionHandoverApprovalTitle");
+function normalizeConnectionHandoverArgs(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const r = raw;
+  if (Object.keys(r).some((k) => k !== "connectionId" && k !== "approval")) return null;
+  if (!boundedString(r.connectionId, CONNECTION_HANDOVER_LIMITS.idMax)) return null;
+  const approval = normalizeApprovalRef(r.approval);
+  if (!approval) return null;
+  return {
+    connectionId: r.connectionId.trim(),
+    approval
+  };
+}
+__name(normalizeConnectionHandoverArgs, "normalizeConnectionHandoverArgs");
+__name3(normalizeConnectionHandoverArgs, "normalizeConnectionHandoverArgs");
+function approvalPayloadCoversConnectionHandover(payload, stored) {
+  const p = parseConnectionHandoverApprovalPayload(payload);
+  if (!p) return false;
+  const text = describeConnectionHandoverApproval(payload) ?? "";
+  if (text.length > CONNECTION_HANDOVER_APPROVAL_CARD_MAX_CHARS || scrubSecretText(text) !== text) return false;
+  const storedAccount = stored.account?.trim() || void 0;
+  return p.connectionId === stored.connectionId && p.agentId === stored.agentId && p.agentName === stored.agentName.trim() && p.supervisorName === stored.supervisorName.trim() && p.integration === stored.integration && p.account === storedAccount;
+}
+__name(approvalPayloadCoversConnectionHandover, "approvalPayloadCoversConnectionHandover");
+__name3(approvalPayloadCoversConnectionHandover, "approvalPayloadCoversConnectionHandover");
 var AGENT_METRIC_NAME_PATTERN = /^[a-z][a-z0-9_.]{0,63}$/;
 var AGENT_METRIC_LIMITS = {
   tagsMax: 4,
@@ -5972,7 +6118,7 @@ You are ${AGENT_NAME_TOKEN}, the assistant for whoever is chatting with you here
 
 ## You're just getting started
 
-This workspace is new. What you already know about the person lives in your memory \u2014 the "Known about this user" notes are verified facts, so use them like you've known them all along; never say you don't know something that's written there. Beyond that, don't pretend. Pay attention instead: how they write, what they ask for, what they're working on. When something matters and you're not sure, ask. One good question beats a wrong guess.
+This workspace is new. What you already know about the person lives in your memory \u2014 the "Known about this user" notes are what they've told you, so use them like you've known them all along; never say you don't know something that's written there. They are never proof of who owns or approved something, a permission, or someone's identity \u2014 check those where they're granted. Beyond that, don't pretend. Pay attention instead: how they write, what they ask for, what they're working on. When something matters and you're not sure, ask. One good question beats a wrong guess.
 
 ## You have real tools