robotrock 1.3.2 → 1.3.4

package/dist/eve/agent/index.d.ts

@@ -7,13 +7,14 @@ import { TaskPriority } from '../../schemas/index.js';
 import { HookDefinition } from 'eve/hooks';
 export { AgentAdminApi, createAgentAdminApi, createBoundAgentAdminClient, requireBoundAgentAdminClient } from '../../agent-admin.js';
 export { ROBOTROCK_PLATFORM_USER_CONTEXT_PUBLIC_KEY_URL } from '@robotrock/core/eve/platform-user-context-public-key';
-export { R as ROBOTROCK_READY_HOOK_SLUG } from '../../index-DePyAbTI.js';
+export { R as ROBOTROCK_READY_HOOK_SLUG } from '../../index-Blq0XoAr.js';
 export { ROBOTROCK_USER_CONTEXT_AUDIENCE, ROBOTROCK_USER_CONTEXT_ISSUER } from '@robotrock/core/eve/user-context-jwt';
 import '@robotrock/core';
 import 'zod';
 import '../../chat-correlation-BsHD-tOQ.js';
 import '@robotrock/core/schemas';
 import '../../tool-reply-guidance-C3qrT1In.js';
+import '../../tool-ui-hint-CMpug5sC.js';
 
 /** Header carrying the dashboard user-context JWT on proxied Eve requests. */
 declare const ROBOTROCK_USER_CONTEXT_HEADER = "x-robotrock-user-token";
@@ -33,9 +34,72 @@ declare function robotrockUserContextAuth(options?: RobotrockUserContextAuthOpti
  * (`GET /eve/v1/info` during verify and tenant connect).
  */
 declare function robotrockAgentServiceAuth(): AuthFn<Request>;
-/** Bearer token used by the RobotRock webhook resume self-call. */
+/**
+ * Bearer token for RobotRock platform reachability and dashboard proxy calls.
+ *
+ * When a workspace admin connects a protected single-tenant deployment, they
+ * enter a Bearer token in **Settings → Agents**. RobotRock stores it in
+ * WorkOS Vault and sends `Authorization: Bearer <token>` on:
+ *
+ * - `GET /eve/v1/info` and `GET /eve/v1/health` (connect / re-sync)
+ * - `POST /eve/v1/session` and `POST /eve/v1/session/:sessionId` (chat + resume)
+ * - `GET /eve/v1/session/:sessionId/stream` (chat streaming)
+ * - optional icon paths (`/favicon.ico`, `/icon.svg`, `/icon.png`)
+ *
+ * Set `EVE_SELF_AUTH_TOKEN` on the agent to the same value. Use
+ * `robotrockEveChannel()` so this authenticator is registered on the Eve channel.
+ */
 declare function eveSelfServiceAuth(): AuthFn<Request>;
 
+/**
+ * Eve HTTP routes RobotRock reaches when connecting, re-syncing, or proxying
+ * dashboard chat. Use these paths when smoke-testing a protected deployment.
+ *
+ * Self-hosted agents that require deployment access: set `EVE_SELF_AUTH_TOKEN` on
+ * the agent to the same value the workspace admin enters under **Settings →
+ * Agents → Deployment access → Bearer token**. RobotRock stores that token in
+ * WorkOS Vault and sends it as `Authorization: Bearer <token>` on every call
+ * below (plus `X-RobotRock-User-Token` during inbox chat).
+ */
+/** Routes RobotRock calls directly from the dashboard backend (connect / re-sync). */
+declare const ROBOTROCK_EVE_CONNECT_ROUTES: {
+    /** Agent manifest + `robotrock-ready` hook detection. */
+    readonly info: {
+        readonly method: "GET";
+        readonly path: "/eve/v1/info";
+    };
+    /** Optional health probe (same auth as `/info` when the channel is protected). */
+    readonly health: {
+        readonly method: "GET";
+        readonly path: "/eve/v1/health";
+    };
+};
+/** Static assets RobotRock may HEAD/GET for the agent avatar in Settings. */
+declare const ROBOTROCK_EVE_ICON_PATHS: readonly ["/favicon.ico", "/icon.svg", "/icon.png"];
+/**
+ * Routes proxied through `/{tenant}/api/eve/{connectionId}/…` during inbox chat
+ * and task-handled resume. The Eve client issues these against the proxy host;
+ * the proxy forwards them to the deployment with vault credentials attached.
+ */
+declare const ROBOTROCK_EVE_CHAT_ROUTES: {
+    readonly createSession: {
+        readonly method: "POST";
+        readonly path: "/eve/v1/session";
+    };
+    readonly continueSession: {
+        readonly method: "POST";
+        readonly path: "/eve/v1/session/:sessionId";
+    };
+    readonly messageStream: {
+        readonly method: "GET";
+        readonly path: "/eve/v1/session/:sessionId/stream";
+    };
+};
+/** Env var on the Eve agent that must match the dashboard Bearer token. */
+declare const EVE_SELF_AUTH_TOKEN_ENV_VAR = "EVE_SELF_AUTH_TOKEN";
+/** All Eve route paths that should accept the dashboard Bearer token on protected deployments. */
+declare const ROBOTROCK_EVE_BEARER_PROTECTED_PATHS: readonly ["/eve/v1/info", "/eve/v1/health", "/eve/v1/session", "/eve/v1/session/:sessionId", "/eve/v1/session/:sessionId/stream", "/favicon.ico", "/icon.svg", "/icon.png"];
+
 /** Resolve the platform RS256 public key used to verify dashboard user-context JWTs. */
 declare function resolvePlatformUserContextPublicKeyPem(): Promise<string | null>;
 
@@ -161,4 +225,4 @@ declare const robotrockChatAuditHook: HookDefinition;
 /** Alias for agents that prefer a factory name. */
 declare function defineRobotRockChatAuditHook(): HookDefinition;
 
-export { type CreateRobotRockCronChatInput, type CreateRobotRockTaskInput, ROBOTROCK_USER_CONTEXT_HEADER, type RobotRockChatAuditPayload, type RobotRockTaskActionInput, type RobotRockTaskAssignToInput, type RobotRockTaskContextInput, type RobotRockTaskToolInput, type RobotrockEveChannelOptions, type RobotrockUserContextAuthOptions, buildRobotRockTaskPayload, createRobotRockCronChat, createRobotRockTask, defineRobotRockChatAuditHook, defineRobotRockReadyHook, eveSelfServiceAuth, fetchRobotRockStagedHitl, postRobotRockChatInputAudit, postRobotRockLinkChatTask, postRobotRockStageHitl, resetBoundClientAuthWarning, resetChatAuditWarnings, resetRobotrockChatAuditIdempotencyKeys, resolvePlatformUserContextPublicKeyPem, resolveTaskHandledWebhookUrl, robotrockAgentServiceAuth, robotrockChatAuditHook, robotrockEveChannel, robotrockReadyHook, robotrockUserContextAuth, tryCreateBoundRobotRockClient };
+export { type CreateRobotRockCronChatInput, type CreateRobotRockTaskInput, EVE_SELF_AUTH_TOKEN_ENV_VAR, ROBOTROCK_EVE_BEARER_PROTECTED_PATHS, ROBOTROCK_EVE_CHAT_ROUTES, ROBOTROCK_EVE_CONNECT_ROUTES, ROBOTROCK_EVE_ICON_PATHS, ROBOTROCK_USER_CONTEXT_HEADER, type RobotRockChatAuditPayload, type RobotRockTaskActionInput, type RobotRockTaskAssignToInput, type RobotRockTaskContextInput, type RobotRockTaskToolInput, type RobotrockEveChannelOptions, type RobotrockUserContextAuthOptions, buildRobotRockTaskPayload, createRobotRockCronChat, createRobotRockTask, defineRobotRockChatAuditHook, defineRobotRockReadyHook, eveSelfServiceAuth, fetchRobotRockStagedHitl, postRobotRockChatInputAudit, postRobotRockLinkChatTask, postRobotRockStageHitl, resetBoundClientAuthWarning, resetChatAuditWarnings, resetRobotrockChatAuditIdempotencyKeys, resolvePlatformUserContextPublicKeyPem, resolveTaskHandledWebhookUrl, robotrockAgentServiceAuth, robotrockChatAuditHook, robotrockEveChannel, robotrockReadyHook, robotrockUserContextAuth, tryCreateBoundRobotRockClient };

package/dist/eve/agent/index.js

@@ -118,6 +118,158 @@ function verifyRobotRockPlatformUserContextJwt(args) {
 // ../core/src/eve/platform-user-context-public-key.ts
 var ROBOTROCK_PLATFORM_USER_CONTEXT_PUBLIC_KEY_URL = "https://app.robotrock.io/.well-known/robotrock-user-context-public-key";
 
+// ../core/src/utils/decode-html-entities.ts
+function decodeHtmlEntities(value) {
+  return value.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#039;/g, "'").replace(/&apos;/g, "'").replace(/&#(\d+);/g, (_, code) => String.fromCharCode(Number(code))).replace(
+    /&#x([0-9a-f]+);/gi,
+    (_, code) => String.fromCharCode(parseInt(code, 16))
+  );
+}
+
+// ../core/src/utils/safe-url.ts
+var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
+  "localhost",
+  "metadata.google.internal",
+  "metadata.goog"
+]);
+function normalizeHostname(hostname) {
+  return hostname.toLowerCase().replace(/^\[|\]$/g, "");
+}
+function isBlockedIpv4(host) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!match) {
+    return false;
+  }
+  const octets = match.slice(1, 5).map((part) => Number(part));
+  if (octets.some((octet) => Number.isNaN(octet) || octet < 0 || octet > 255)) {
+    return true;
+  }
+  const [a, b, _c, _d] = octets;
+  if (a === void 0 || b === void 0) {
+    return true;
+  }
+  if (a === 127 || a === 0) return true;
+  if (a === 10) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  return false;
+}
+function ipv4FromNumericHost(host) {
+  if (/^\d+$/.test(host)) {
+    const num = Number(host);
+    if (!Number.isFinite(num) || num < 0 || num > 4294967295) {
+      return null;
+    }
+    const a = num >>> 24 & 255;
+    const b = num >>> 16 & 255;
+    const c = num >>> 8 & 255;
+    const d = num & 255;
+    return `${a}.${b}.${c}.${d}`;
+  }
+  const hexMatch = /^0x([0-9a-f]{1,8})$/i.exec(host);
+  if (hexMatch) {
+    const num = Number.parseInt(hexMatch[1], 16);
+    if (!Number.isFinite(num) || num < 0 || num > 4294967295) {
+      return null;
+    }
+    const a = num >>> 24 & 255;
+    const b = num >>> 16 & 255;
+    const c = num >>> 8 & 255;
+    const d = num & 255;
+    return `${a}.${b}.${c}.${d}`;
+  }
+  return null;
+}
+function isBlockedIpv4Mapped(host) {
+  const mappedDotted = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(host);
+  if (mappedDotted) {
+    return isBlockedIpv4(mappedDotted[1]);
+  }
+  const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+  if (mappedHex) {
+    const high = Number.parseInt(mappedHex[1], 16);
+    const low = Number.parseInt(mappedHex[2], 16);
+    if (Number.isFinite(high) && Number.isFinite(low)) {
+      const a = high >> 8 & 255;
+      const b = high & 255;
+      const c = low >> 8 & 255;
+      const d = low & 255;
+      return isBlockedIpv4(`${a}.${b}.${c}.${d}`);
+    }
+  }
+  return false;
+}
+function isBlockedIpv6(host) {
+  if (host === "::1" || host === "0:0:0:0:0:0:0:1") {
+    return true;
+  }
+  if (host.startsWith("fc") || host.startsWith("fd")) {
+    return true;
+  }
+  if (host.startsWith("fe80:")) {
+    return true;
+  }
+  if (isBlockedIpv4Mapped(host)) {
+    return true;
+  }
+  return false;
+}
+function isBlockedHostname(hostname) {
+  const host = normalizeHostname(hostname);
+  if (!host) {
+    return true;
+  }
+  if (BLOCKED_HOSTNAMES.has(host)) {
+    return true;
+  }
+  if (host.endsWith(".localhost") || host.endsWith(".local")) {
+    return true;
+  }
+  const numericIpv4 = ipv4FromNumericHost(host);
+  if (numericIpv4 && isBlockedIpv4(numericIpv4)) {
+    return true;
+  }
+  return isBlockedIpv4(host) || isBlockedIpv6(host);
+}
+function isLoopbackHandlerUrl(urlString) {
+  let url;
+  try {
+    url = new URL(urlString);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return false;
+  }
+  if (url.username || url.password) {
+    return false;
+  }
+  const host = url.hostname.toLowerCase();
+  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]" || host.endsWith(".localhost");
+}
+function isAllowedHandlerUrl(urlString) {
+  return isPublicHttpUrl(urlString) || isLoopbackHandlerUrl(urlString);
+}
+function isPublicHttpUrl(urlString) {
+  let url;
+  try {
+    url = new URL(urlString);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return false;
+  }
+  if (url.username || url.password) {
+    return false;
+  }
+  return !isBlockedHostname(url.hostname);
+}
+var PUBLIC_HTTP_URL_ERROR = "URL must be a public http:// or https:// address";
+var HANDLER_URL_ERROR = "Handler URL must be a public or loopback http:// or https:// address";
+
 // src/eve/input-request.ts
 var EVE_INPUT_SUBMIT_ACTION_ID = "submit";
 var EVE_INPUT_OTHER_CHOICE_ID = "__other__";
@@ -127,6 +279,9 @@ var CONFIRMATION_DEFAULT_OPTIONS = [
   { id: "deny", label: "Deny", style: "danger" }
 ];
 var SELECT_PER_OPTION_THRESHOLD = 6;
+function decodeDisplayText(value) {
+  return decodeHtmlEntities(value);
+}
 function resolveEveInputDisplay(request, toolName) {
   if (request.display) {
     return request.display;
@@ -143,11 +298,12 @@ function confirmationActions(request) {
   const options = request.options && request.options.length > 0 ? request.options : CONFIRMATION_DEFAULT_OPTIONS;
   return options.map((option) => ({
     id: option.id,
-    title: option.label,
-    ...option.description ? { description: option.description } : {}
+    title: decodeDisplayText(option.label),
+    ...option.description ? { description: decodeDisplayText(option.description) } : {}
   }));
 }
 function textSubmitAction(prompt) {
+  const decodedPrompt = decodeDisplayText(prompt);
   return {
     id: EVE_INPUT_SUBMIT_ACTION_ID,
     title: "Submit",
@@ -163,7 +319,7 @@ function textSubmitAction(prompt) {
     },
     ui: {
       answer: {
-        "ui:title": prompt.trim() || "Your answer",
+        "ui:title": decodedPrompt.trim() || "Your answer",
         "ui:widget": "textarea"
       }
     }
@@ -172,15 +328,15 @@ function textSubmitAction(prompt) {
 function selectPerOptionActions(options) {
   return options.map((option) => ({
     id: option.id,
-    title: option.label,
-    ...option.description ? { description: option.description } : {}
+    title: decodeDisplayText(option.label),
+    ...option.description ? { description: decodeDisplayText(option.description) } : {}
   }));
 }
 function selectFormAction(request) {
   const options = request.options ?? [];
   const allowFreeform = request.allowFreeform === true;
   const enumValues = options.map((option) => option.id);
-  const enumNames = options.map((option) => option.label);
+  const enumNames = options.map((option) => decodeDisplayText(option.label));
   if (allowFreeform) {
     enumValues.push(EVE_INPUT_OTHER_CHOICE_ID);
     enumNames.push(EVE_INPUT_OTHER_CHOICE_LABEL);
@@ -303,6 +459,12 @@ function isEveApprovalInputRequest(request) {
   const options = request.options ?? [];
   return options.length === 2 && options[0]?.id === "approve" && options[1]?.id === "deny";
 }
+function buildOptionIdFormData(display, optionId) {
+  if (display === "select" || display === "confirmation") {
+    return { choice: optionId };
+  }
+  return {};
+}
 function eveInputResponseToActionSubmission(request, response, options) {
   const display = resolveEveInputDisplay(request, options?.toolName);
   const actions = eveInputRequestToActions(request, options);
@@ -312,7 +474,7 @@ function eveInputResponseToActionSubmission(request, response, options) {
       return {
         actionId: response.optionId,
         actionTitle: action.title,
-        formData: {}
+        formData: buildOptionIdFormData(display, response.optionId)
       };
     }
     const option = request.options?.find((entry) => entry.id === response.optionId);
@@ -320,13 +482,13 @@ function eveInputResponseToActionSubmission(request, response, options) {
       return {
         actionId: response.optionId,
         actionTitle: option.label,
-        formData: {}
+        formData: buildOptionIdFormData(display, response.optionId)
       };
     }
     return {
       actionId: response.optionId,
       actionTitle: response.optionId,
-      formData: {}
+      formData: buildOptionIdFormData(display, response.optionId)
     };
   }
   const text = response.text?.trim();
@@ -638,6 +800,39 @@ function eveSelfServiceAuth() {
   };
 }
 
+// src/eve/agent/deployment-access.ts
+var ROBOTROCK_EVE_CONNECT_ROUTES = {
+  /** Agent manifest + `robotrock-ready` hook detection. */
+  info: { method: "GET", path: "/eve/v1/info" },
+  /** Optional health probe (same auth as `/info` when the channel is protected). */
+  health: { method: "GET", path: "/eve/v1/health" }
+};
+var ROBOTROCK_EVE_ICON_PATHS = [
+  "/favicon.ico",
+  "/icon.svg",
+  "/icon.png"
+];
+var ROBOTROCK_EVE_CHAT_ROUTES = {
+  createSession: { method: "POST", path: "/eve/v1/session" },
+  continueSession: {
+    method: "POST",
+    path: "/eve/v1/session/:sessionId"
+  },
+  messageStream: {
+    method: "GET",
+    path: "/eve/v1/session/:sessionId/stream"
+  }
+};
+var EVE_SELF_AUTH_TOKEN_ENV_VAR = "EVE_SELF_AUTH_TOKEN";
+var ROBOTROCK_EVE_BEARER_PROTECTED_PATHS = [
+  ROBOTROCK_EVE_CONNECT_ROUTES.info.path,
+  ROBOTROCK_EVE_CONNECT_ROUTES.health.path,
+  ROBOTROCK_EVE_CHAT_ROUTES.createSession.path,
+  ROBOTROCK_EVE_CHAT_ROUTES.continueSession.path,
+  ROBOTROCK_EVE_CHAT_ROUTES.messageStream.path,
+  ...ROBOTROCK_EVE_ICON_PATHS
+];
+
 // src/eve/agent/channel.ts
 import { eveChannel } from "eve/channels/eve";
 import { localDev, vercelOidc } from "eve/channels/auth";
@@ -672,150 +867,6 @@ function robotrockEveChannel(options) {
 // src/schemas/index.ts
 import { z as z4 } from "zod";
 
-// ../core/src/utils/safe-url.ts
-var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
-  "localhost",
-  "metadata.google.internal",
-  "metadata.goog"
-]);
-function normalizeHostname(hostname) {
-  return hostname.toLowerCase().replace(/^\[|\]$/g, "");
-}
-function isBlockedIpv4(host) {
-  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
-  if (!match) {
-    return false;
-  }
-  const octets = match.slice(1, 5).map((part) => Number(part));
-  if (octets.some((octet) => Number.isNaN(octet) || octet < 0 || octet > 255)) {
-    return true;
-  }
-  const [a, b, _c, _d] = octets;
-  if (a === void 0 || b === void 0) {
-    return true;
-  }
-  if (a === 127 || a === 0) return true;
-  if (a === 10) return true;
-  if (a === 169 && b === 254) return true;
-  if (a === 192 && b === 168) return true;
-  if (a === 172 && b >= 16 && b <= 31) return true;
-  if (a === 100 && b >= 64 && b <= 127) return true;
-  return false;
-}
-function ipv4FromNumericHost(host) {
-  if (/^\d+$/.test(host)) {
-    const num = Number(host);
-    if (!Number.isFinite(num) || num < 0 || num > 4294967295) {
-      return null;
-    }
-    const a = num >>> 24 & 255;
-    const b = num >>> 16 & 255;
-    const c = num >>> 8 & 255;
-    const d = num & 255;
-    return `${a}.${b}.${c}.${d}`;
-  }
-  const hexMatch = /^0x([0-9a-f]{1,8})$/i.exec(host);
-  if (hexMatch) {
-    const num = Number.parseInt(hexMatch[1], 16);
-    if (!Number.isFinite(num) || num < 0 || num > 4294967295) {
-      return null;
-    }
-    const a = num >>> 24 & 255;
-    const b = num >>> 16 & 255;
-    const c = num >>> 8 & 255;
-    const d = num & 255;
-    return `${a}.${b}.${c}.${d}`;
-  }
-  return null;
-}
-function isBlockedIpv4Mapped(host) {
-  const mappedDotted = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(host);
-  if (mappedDotted) {
-    return isBlockedIpv4(mappedDotted[1]);
-  }
-  const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
-  if (mappedHex) {
-    const high = Number.parseInt(mappedHex[1], 16);
-    const low = Number.parseInt(mappedHex[2], 16);
-    if (Number.isFinite(high) && Number.isFinite(low)) {
-      const a = high >> 8 & 255;
-      const b = high & 255;
-      const c = low >> 8 & 255;
-      const d = low & 255;
-      return isBlockedIpv4(`${a}.${b}.${c}.${d}`);
-    }
-  }
-  return false;
-}
-function isBlockedIpv6(host) {
-  if (host === "::1" || host === "0:0:0:0:0:0:0:1") {
-    return true;
-  }
-  if (host.startsWith("fc") || host.startsWith("fd")) {
-    return true;
-  }
-  if (host.startsWith("fe80:")) {
-    return true;
-  }
-  if (isBlockedIpv4Mapped(host)) {
-    return true;
-  }
-  return false;
-}
-function isBlockedHostname(hostname) {
-  const host = normalizeHostname(hostname);
-  if (!host) {
-    return true;
-  }
-  if (BLOCKED_HOSTNAMES.has(host)) {
-    return true;
-  }
-  if (host.endsWith(".localhost") || host.endsWith(".local")) {
-    return true;
-  }
-  const numericIpv4 = ipv4FromNumericHost(host);
-  if (numericIpv4 && isBlockedIpv4(numericIpv4)) {
-    return true;
-  }
-  return isBlockedIpv4(host) || isBlockedIpv6(host);
-}
-function isLoopbackHandlerUrl(urlString) {
-  let url;
-  try {
-    url = new URL(urlString);
-  } catch {
-    return false;
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    return false;
-  }
-  if (url.username || url.password) {
-    return false;
-  }
-  const host = url.hostname.toLowerCase();
-  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]" || host.endsWith(".localhost");
-}
-function isAllowedHandlerUrl(urlString) {
-  return isPublicHttpUrl(urlString) || isLoopbackHandlerUrl(urlString);
-}
-function isPublicHttpUrl(urlString) {
-  let url;
-  try {
-    url = new URL(urlString);
-  } catch {
-    return false;
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    return false;
-  }
-  if (url.username || url.password) {
-    return false;
-  }
-  return !isBlockedHostname(url.hostname);
-}
-var PUBLIC_HTTP_URL_ERROR = "URL must be a public http:// or https:// address";
-var HANDLER_URL_ERROR = "Handler URL must be a public or loopback http:// or https:// address";
-
 // ../core/src/schemas/task.ts
 import { z } from "zod";
 
@@ -2706,6 +2757,11 @@ function requireBoundAgentAdminClient(ctx) {
   return createBoundAgentAdminClient(ctx);
 }
 export {
+  EVE_SELF_AUTH_TOKEN_ENV_VAR,
+  ROBOTROCK_EVE_BEARER_PROTECTED_PATHS,
+  ROBOTROCK_EVE_CHAT_ROUTES,
+  ROBOTROCK_EVE_CONNECT_ROUTES,
+  ROBOTROCK_EVE_ICON_PATHS,
   ROBOTROCK_PLATFORM_USER_CONTEXT_PUBLIC_KEY_URL,
   ROBOTROCK_READY_HOOK_SLUG,
   ROBOTROCK_USER_CONTEXT_AUDIENCE,