superbee 0.4.4-pre.12 → 0.4.4-pre.13

package/dist/superbee.mjs

@@ -44,7 +44,7 @@ var __toESM = (mod, isNodeMode, target3) => (target3 = mod != null ? __create(__
 var define_SUPERBEE_BUILD_IDENTITY_default;
 var init_define_SUPERBEE_BUILD_IDENTITY = __esm({
   "<define:__SUPERBEE_BUILD_IDENTITY__>"() {
-    define_SUPERBEE_BUILD_IDENTITY_default = { schema: "superbee.build-identity.v1", package: { name: "superbee", version: "0.4.4-pre.12" }, source: { commit: "2923b36b32c6cf1a2ffafe048ded867a1484d839", dirty: false }, artifact: { channel: "npm-package" }, compatibility_contracts: { skill: 1, hook: 1, mcp: 1 } };
+    define_SUPERBEE_BUILD_IDENTITY_default = { schema: "superbee.build-identity.v1", package: { name: "superbee", version: "0.4.4-pre.13" }, source: { commit: "18c0655ead4adfea98f94b9bcf5224cf1e88e2ce", dirty: false }, artifact: { channel: "npm-package" }, compatibility_contracts: { skill: 1, hook: 1, mcp: 1 } };
   }
 });
 
@@ -29323,7 +29323,7 @@ var init_command_spec = __esm({
           {
             id: "workloadExec",
             leaves: [publicLeaf("workloadExec", "workload exec", workloadCommandArity, void 0, { flags: pathFlags({ flag: "request-file", role: "ingress" }) })],
-            usage: "workload exec --request-file <file> --url <HTTPS workspace origin> --workspace <slug> -- <command> [args...]",
+            usage: "workload exec --request-file <file> --url <HTTPS workspace origin> --workspace <slug> [--host <HTTPS gateway origin>] -- <command> [args...]",
             summary: "In GitHub Actions, request or discover exactly the access in a bounded version1 intent file, without Portal config or an app ID; pending approval returns FORBIDDEN (exit 2) with a workspace administrator review link before the child starts; approved access passes a fresh masked bearer only to the child and removes its GitHub OIDC minting environment"
           },
           {
@@ -158083,6 +158083,18 @@ import { spawn as spawn6 } from "node:child_process";
 import { constants as constants10, homedir as homedir57 } from "node:os";
 import path70 from "node:path";
 import { parseArgs as parseArgs52 } from "node:util";
+function canonicalHttpsOrigin(value, flag) {
+  const reason = flag === "url" ? "workload_origin_invalid" : "workload_host_invalid";
+  let origin;
+  try {
+    origin = new URL(value);
+  } catch {
+    throw usage4(reason, `--${flag} must be one canonical HTTPS origin`);
+  }
+  if (origin.protocol !== "https:" || origin.username || origin.password || origin.port || origin.origin !== value || origin.pathname !== "/")
+    throw usage4(reason, `--${flag} must be one canonical HTTPS origin`);
+  return origin;
+}
 function intent(value) {
   if (!object12(value) || Object.keys(value).some((k) => !["version", "displayName", "events", "bundles", "sites"].includes(k)) || value.version !== 1 || typeof value.displayName !== "string" || value.displayName !== value.displayName.trim() || value.displayName.length < 1 || value.displayName.length > 80 || /[\u0000-\u001f\u007f]/.test(value.displayName) || !Array.isArray(value.events) || value.events.length < 1 || value.events.length > 3 || !value.events.every((x) => typeof x === "string" && EVENTS.has(x)) || new Set(value.events).size !== value.events.length || !object12(value.bundles) || Object.keys(value.bundles).length < 1 || Object.keys(value.bundles).length > 50 || !Object.entries(value.bundles).every(([k, v]) => isHostedBundleId(k) && (v === "read" || v === "write")) || value.sites !== void 0 && (!Array.isArray(value.sites) || value.sites.length > 5 || !value.sites.every(site) || new Set(value.sites).size !== value.sites.length)) {
     throw usage4("workload_request_invalid", "request file must contain only the bounded version1 display name, events, bundle capabilities and optional sites");
@@ -158149,6 +158161,7 @@ async function workloadExec(argv2, partial2 = {}) {
   const { values, positionals } = parseLeafOrUsage(() => parseArgs52({ args: argv2, strict: true, allowPositionals: true, options: {
     "request-file": { type: "string" },
     url: { type: "string" },
+    host: { type: "string" },
     workspace: { type: "string" },
     help: { type: "boolean", short: "h" }
   } }), CLI_LEAVES.workloadExec);
@@ -158159,13 +158172,8 @@ async function workloadExec(argv2, partial2 = {}) {
   const separator = argv2.indexOf("--");
   if (separator < 0 || positionals.length !== argv2.length - separator - 1 || !positionals[0] || positionals.some((x) => x.includes("\0"))) throw usage4("workload_command_invalid", "place the command and its arguments after --");
   if (!values["request-file"] || !values.url || !isWorkspaceSlug(values.workspace)) throw usage4("workload_arguments_missing", "--request-file, --url and --workspace are required");
-  let origin;
-  try {
-    origin = new URL(values.url);
-  } catch {
-    throw usage4("workload_origin_invalid", "--url must be one canonical HTTPS workspace origin");
-  }
-  if (origin.protocol !== "https:" || origin.username || origin.password || origin.port || origin.origin !== values.url || origin.pathname !== "/") throw usage4("workload_origin_invalid", "--url must be one canonical HTTPS workspace origin");
+  const origin = canonicalHttpsOrigin(values.url, "url");
+  const explicitHost = values.host === void 0 ? void 0 : canonicalHttpsOrigin(values.host, "host");
   const acquired = await readExternalFileBytesNoFollowWithin(path70.resolve(deps2.cwd, values["request-file"]), 16 * 1024, deps2.home);
   if (acquired.state !== "present") throw usage4("workload_request_unreadable", "request file must be an ordinary readable file of at most 16 KiB outside private state");
   let parsed2;
@@ -158186,8 +158194,12 @@ async function workloadExec(argv2, partial2 = {}) {
   if (oidcUrl.protocol !== "https:" || oidcUrl.username || oidcUrl.password || oidcUrl.hash) throw unavailable2("github_oidc_invalid");
   let selected2;
   try {
-    selected2 = await followWorkspaceOrigin(deps2.fetch, resolveHostedTarget(origin.origin));
-    if (!selected2 || selected2.requestedOrigin !== origin.origin || selected2.workspaceSlug !== values.workspace) throw unavailable2("workspace_discovery_mismatch");
+    if (explicitHost) {
+      selected2 = { requestedOrigin: origin.origin, workspaceSlug: values.workspace, target: resolveHostedTarget(explicitHost.origin) };
+    } else {
+      selected2 = await followWorkspaceOrigin(deps2.fetch, resolveHostedTarget(origin.origin));
+      if (!selected2 || selected2.requestedOrigin !== origin.origin || selected2.workspaceSlug !== values.workspace) throw unavailable2("workspace_discovery_mismatch");
+    }
     await discoverHosted(deps2.fetch, selected2.target);
   } catch {
     throw unavailable2("workspace_discovery_unavailable");
@@ -158248,13 +158260,18 @@ var init_workload_exec = __esm({
     WORKLOAD_EXEC_USAGE = `superbee workload exec \u2014 run with exactly the workload access requested
 
 Usage:
-  superbee workload exec --request-file <file> --url <HTTPS workspace origin> --workspace <slug> -- <command> [args...]
+  superbee workload exec --request-file <file> --url <HTTPS workspace origin> --workspace <slug> [--host <HTTPS gateway origin>] -- <command> [args...]
 
 GitHub Actions only: the existing exchange derives identity from the job's signed GitHub token.
 The UTF-8 JSON intent is at most 16 KiB: {version:1,displayName,events,bundles,sites?}. It contains
 only requested capabilities, never repository IDs, workflow refs, environment or credentials.
 No release.config.json, person login, app UUID or copied GitHub variable is required.
 
+Without --host, the workspace pointer must name its own parent-domain gateway. An explicit --host
+selects the receiving gateway after its normal protected-resource and issuer discovery; no pointer
+or environment fallback is used. That selected host receives the signed job token. --url remains
+the exact workspace audience and returned workspace authority; selecting a host grants no access.
+
 Pending approval returns FORBIDDEN (exit 2), details.reason workload_approval_pending and the
 workspace administrator's review URL; no child starts and no bearer is emitted. Run the workflow
 again after approval. Denied or expired requests remain terminal; there is no polling or retry.
@@ -158267,7 +158284,8 @@ The child exit status is preserved. At most 128 command/argument tokens are acce
 Options:
   --request-file <file>  Required bounded version1 JSON capability intent
   --url <origin>         Required canonical HTTPS workspace origin, no path/query/fragment
-  --workspace <slug>     Required workspace slug matching the origin's discovery
+  --workspace <slug>     Required workspace slug, matched by the hosted exchange
+  --host <origin>        Optional explicit canonical HTTPS receiving gateway, no path/query/fragment
   -h, --help             Show this help`;
     object12 = (x) => x !== null && typeof x === "object" && !Array.isArray(x);
     uuid3 = (x) => typeof x === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(x);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superbee",
-  "version": "0.4.4-pre.12",
+  "version": "0.4.4-pre.13",
   "type": "module",
   "description": "Agent-facing Superbee CLI for reading and writing local OKF knowledge bundles: context notes, docs, cross-links, and live bundle Views.",
   "keywords": [

package/references/hosted-checkout.md

@@ -101,6 +101,13 @@ bundle read/write capabilities and optional fixed sites. It contains no reposito
 refs, environment, credentials or app UUID. Each requested site must have its matching Read bundle
 capability. A protected main-only GitHub environment and `id-token: write` are required by the host.
 This works for custom research or documentation workflows without `release.config.json`.
+By default, the workspace pointer must name its own parent-domain gateway. Optional explicit
+`--host <HTTPS gateway origin>` selects the receiving service through ordinary protected-resource
+and issuer discovery, without pointer or environment fallback. That service receives the signed
+job token. In explicit mode, `--url` is the logical browser approval/audience origin (including a
+shared neutral origin), and `--workspace` independently names the exact workspace: no first-label
+inference is made. The server still decides current authority, and the CLI still checks returned
+workspace, exact capabilities and expiry. Selecting a service grants no access.
 
 The existing exchange verifies the job's GitHub identity and resolves exactly approved access.
 Pending approval is `FORBIDDEN` (exit 2) with `details.reason: workload_approval_pending`, an opaque