fruxon 0.21.2__tar.gz → 1.0.0__tar.gz

{fruxon-0.21.2 → fruxon-1.0.0}/HISTORY.md

@@ -1,5 +1,28 @@
 # History
 
+## Unreleased — edit and publish an integration config from the CLI
+
+`integrations configs` could only `list` and `get`, so changing a config
+(clearing Agentit's BAFI egress pin, 2026-10-19) meant the dashboard. Uses the
+backend's existing `PATCH …/configs/{config}` and `POST …/configs/{config}:publish`.
+
+- **`fruxon integrations configs update <integration> <config> --file <patch.json>`**
+  patches the config's draft. The file holds only the fields to change
+  (`{"egressCountry": ""}` clears an egress pin); `--schema` prints the shape.
+  The server ignores fields it doesn't know and reads `null` as "unchanged",
+  so an empty patch, an unknown field or a `null` exits 12 before anything is
+  sent. Prints the config with secrets masked by the server, never the values
+  sent.
+- **`fruxon integrations configs publish <integration> <config> [--note T]`**
+  makes the draft the revision tool calls resolve. Shows what is live now and
+  asks; `--yes` skips it and is required in agent mode (exit 16 without).
+  Prints the new revision's `id` and `version`.
+- `FruxonClient.update_integration_config(integration, config_id, body)` and
+  `publish_integration_config(integration, config_id, note=None)`. The
+  publish response is the snapshot with its credentials decrypted; the client
+  returns only `id`, `configId`, `version`, `note`, `sandboxMode`,
+  `egressCountry`, `createdBy` and `createdAt`.
+
 ## Unreleased — telemetry names the command, the person and the workspace
 
 CLI usage in Mixpanel had three gaps. The command name stopped at two

{fruxon-0.21.2 → fruxon-1.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: fruxon
-Version: 0.21.2
+Version: 1.0.0
 Summary: The Fruxon SDK is a lightweight Python client for integrating with the Fruxon platform.
 Project-URL: bugs, https://github.com/fruxon-ai/fruxon-sdk/issues
 Project-URL: changelog, https://github.com/fruxon-ai/fruxon-sdk/blob/main/HISTORY.md
@@ -139,7 +139,7 @@ Integrations + tools:
 | Command | What it does |
 | --- | --- |
 | `fruxon integrations list/get/create/update/verify/open` | Manage external integrations — the connections agents draw tools from. `create`/`update`/`verify` take a `--file` JSON body; `open` opens the dashboard. |
-| `fruxon integrations configs list/get` | Inspect the per-integration auth/config records. |
+| `fruxon integrations configs list/get/update/publish` | The per-integration auth/config records. `update --file` patches a config's draft (only the fields sent; `{"egressCountry": ""}` clears an egress pin) and prints it with secrets masked; `publish` makes the draft the revision tool calls resolve, asks first (`--yes` in agent mode), and prints the new revision's `id` and `version`, never the credentials. |
 | `fruxon integrations authorize <integration>` | Mint an application-level OAuth authorization URL to **connect** an integration — auto-detects its OAuth2 method (`--auth-method` to pick, `--scope`/`--config-param` to tune). OAuth needs a browser consent step, so the CLI hands you the link; a human clicks it, and the connection is saved as a tenant config a slot can pin. |
 | `fruxon integrations triggers <integration>` | List the event types an integration can fire an agent on — each descriptor's `id` is the `eventType` a trigger listens for, plus the `payloadFields` (dotted paths) a binding's `parameterMappings` can read. Discovery for wiring an inbound-event trigger without guessing. |
 | `fruxon integrations mcp …` | Inspect and enable the MCP server for an integration. |

{fruxon-0.21.2 → fruxon-1.0.0}/README.md

@@ -106,7 +106,7 @@ Integrations + tools:
 | Command | What it does |
 | --- | --- |
 | `fruxon integrations list/get/create/update/verify/open` | Manage external integrations — the connections agents draw tools from. `create`/`update`/`verify` take a `--file` JSON body; `open` opens the dashboard. |
-| `fruxon integrations configs list/get` | Inspect the per-integration auth/config records. |
+| `fruxon integrations configs list/get/update/publish` | The per-integration auth/config records. `update --file` patches a config's draft (only the fields sent; `{"egressCountry": ""}` clears an egress pin) and prints it with secrets masked; `publish` makes the draft the revision tool calls resolve, asks first (`--yes` in agent mode), and prints the new revision's `id` and `version`, never the credentials. |
 | `fruxon integrations authorize <integration>` | Mint an application-level OAuth authorization URL to **connect** an integration — auto-detects its OAuth2 method (`--auth-method` to pick, `--scope`/`--config-param` to tune). OAuth needs a browser consent step, so the CLI hands you the link; a human clicks it, and the connection is saved as a tenant config a slot can pin. |
 | `fruxon integrations triggers <integration>` | List the event types an integration can fire an agent on — each descriptor's `id` is the `eventType` a trigger listens for, plus the `payloadFields` (dotted paths) a binding's `parameterMappings` can read. Discovery for wiring an inbound-event trigger without guessing. |
 | `fruxon integrations mcp …` | Inspect and enable the MCP server for an integration. |

{fruxon-0.21.2 → fruxon-1.0.0}/pyproject.toml

@@ -117,6 +117,13 @@ fruxon = "fruxon.cli:app"
 [tool.ruff]
 line-length = 120
 
+[tool.ruff.format]
+# Ruff 0.17 formats the Python code blocks inside Markdown too. Ours are
+# illustrations, not code: hand-aligned comments, one-line calls and
+# pseudo-signatures (``def f(...): ...  # POST /route``) that the formatter
+# would explode. Leave the docs as written.
+exclude = ["*.md"]
+
 [tool.ruff.lint]
 select = [
     "E",   # pycodestyle errors

{fruxon-0.21.2 → fruxon-1.0.0}/src/fruxon/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.21.2'
-__version_tuple__ = version_tuple = (0, 21, 2)
+__version__ = version = '1.0.0'
+__version_tuple__ = version_tuple = (1, 0, 0)
 
 __commit_id__ = commit_id = None

{fruxon-0.21.2 → fruxon-1.0.0}/src/fruxon/cli/_crash.py

@@ -72,8 +72,9 @@ def is_success_exit(exc: BaseException) -> bool:
     """Whether Click/Typer stopped successfully after help or version.
 
     ``--help`` and ``--version`` use a zero-code ``Exit`` instead of returning
-    normally. Match both Click namespaces because current Typer vendors its
-    own copy while older releases use the top-level package.
+    normally. Which class that is depends on the Typer release: the top-level
+    Click one, the vendored ``typer._click`` copy (0.26), or ``typer.exceptions``
+    (0.27, which moved ``Exit`` and ``Abort`` out of the vendored Click).
     """
     return _is_click_exception(exc, class_name="Exit") and getattr(exc, "exit_code", 1) == 0
 
@@ -84,22 +85,24 @@ def is_no_args_help(exc: BaseException) -> bool:
 
 
 def _is_click_exception(exc: BaseException, *, class_name: str = "ClickException") -> bool:
-    """Match Click's public exceptions and Typer's vendored equivalents."""
-    import click
+    """Match Click's public exceptions and Typer's vendored equivalents.
 
-    classes: list[type[BaseException]] = []
-    external = getattr(click.exceptions, class_name, None)
-    if isinstance(external, type) and issubclass(external, BaseException):
-        classes.append(external)
-
-    try:
-        from typer._click import exceptions as typer_click_exceptions
+    Typer 0.27 keeps ``Exit`` and ``Abort`` in :mod:`typer.exceptions` rather
+    than in its vendored Click, so a ``--help`` raised there matched neither
+    Click namespace and was reported as a failed command.
+    """
+    import importlib
 
-        vendored = getattr(typer_click_exceptions, class_name, None)
-        if isinstance(vendored, type) and issubclass(vendored, BaseException):
-            classes.append(vendored)
-    except ImportError:  # Older Typer releases use the top-level Click package.
-        pass
+    classes: list[type[BaseException]] = []
+    # Older Typer releases have neither of the last two and use top-level Click.
+    for module_name in ("click.exceptions", "typer._click.exceptions", "typer.exceptions"):
+        try:
+            module = importlib.import_module(module_name)
+        except ImportError:
+            continue
+        found = getattr(module, class_name, None)
+        if isinstance(found, type) and issubclass(found, BaseException):
+            classes.append(found)
 
     return bool(classes) and isinstance(exc, tuple(classes))
 

{fruxon-0.21.2 → fruxon-1.0.0}/src/fruxon/cli/examples.py

@@ -700,6 +700,15 @@ _EXAMPLES: dict[str, list[tuple[str, str]]] = {
         ("fruxon integrations create -f config.json", "Wire up a new external service"),
         ("fruxon integrations open my-integration", "Open the dashboard config page"),
         ("fruxon integrations verify my-integration -f auth.json", "Test credentials"),
+        ("fruxon integrations configs list my-integration", "Saved credentials — the tenantConfigId a slot pins"),
+        (
+            'echo \'{"egressCountry": ""}\' | fruxon integrations configs update my-integration e71e… -f -',
+            "Patch a config's draft (only the fields you send)",
+        ),
+        (
+            "fruxon integrations configs publish my-integration e71e… --note '…'",
+            "Make the draft live for every tool call",
+        ),
     ],
     "tools": [
         ("fruxon tools list my-integration", "List tools under an integration"),

{fruxon-0.21.2 → fruxon-1.0.0}/src/fruxon/cli/integrations.py

@@ -11,6 +11,10 @@ Read commands (``list`` / ``get``) take simple flags; write commands
 because the payloads (``CreateIntegration``, ``VerifyAuthConfigRequest``)
 carry structured ``configMetadata`` / ``authConfig`` objects, not
 key=value pairs — same pattern as ``fruxon agents test``.
+
+``configs`` covers a tenant's saved credentials for an integration:
+``configs update`` patches a config's draft from a ``--file`` JSON body,
+and ``configs publish`` ships the draft as the revision tool calls resolve.
 """
 
 from __future__ import annotations
@@ -19,9 +23,10 @@ import json
 from typing import Annotated
 
 import typer
+from rich.markup import escape
 
 from fruxon.cli import app
-from fruxon.cli._shared import build_client, load_json_body, print_connect_nudge
+from fruxon.cli._shared import build_client, confirm_or_die, load_json_body, print_connect_nudge
 from fruxon.exceptions import FruxonError
 from fruxon.fruxon import Integration
 from fruxon.ui import (
@@ -30,10 +35,12 @@ from fruxon.ui import (
     fail_from_api_error,
     integration_connect_url,
     print_banner,
+    require_yes_in_agent_mode,
     resolve_output_format,
     say_err,
     say_info,
     say_ok,
+    say_warn,
     stderr,
 )
 
@@ -674,7 +681,7 @@ def integrations_authorize(
 # ─────────────────────────────────────────────────────────────────────────────
 
 configs_app = typer.Typer(
-    help="List and inspect tenant-level integration configs (reusable auth + connection settings).",
+    help="List, inspect, update and publish tenant-level integration configs (reusable auth + connection settings).",
     no_args_is_help=True,
 )
 integrations_app.add_typer(configs_app, name="configs")
@@ -781,6 +788,270 @@ def integration_configs_get(
     print(json.dumps(body, indent=2))
 
 
+# The top-level fields of ``UpdateTenantIntegrationConfigRequest``. The server
+# drops a key it doesn't know without a word, so a typo (``egress_country``)
+# would "succeed" and change nothing; checking here turns that into an error.
+# It binds case-insensitively, so this matches that way too.
+_CONFIG_UPDATE_FIELDS = (
+    "displayName",
+    "parameters",
+    "auth",
+    "authMap",
+    "sandboxMode",
+    "sandboxVariant",
+    "egressCountry",
+    "oAuthCredentialKey",
+)
+_PUBLISH_CONFIG_ACTION = "publish an integration config"
+
+
+@configs_app.command("update")
+def integration_configs_update(
+    integration: Annotated[str, typer.Argument(help="Integration the config belongs to.")],
+    config_id: Annotated[str, typer.Argument(help="Config UUID to update.")],
+    file: Annotated[
+        str | None,
+        typer.Option(
+            "--file",
+            "-f",
+            help="UpdateTenantIntegrationConfigRequest JSON body: only the fields to change. `-` reads stdin.",
+        ),
+    ] = None,
+    schema: Annotated[
+        bool,
+        typer.Option(
+            "--schema", help="Print the JSON schema for --file (UpdateTenantIntegrationConfigRequest) and exit."
+        ),
+    ] = False,
+    workspace: Annotated[str | None, typer.Option("--workspace", help="Workspace identifier override.")] = None,
+    base_url: Annotated[str | None, typer.Option("--base-url", help="API base URL override.")] = None,
+    output: Annotated[
+        str | None,
+        typer.Option("--output", "-o", help="Output format: text (default for humans), json (default in agent mode)."),
+    ] = None,
+):
+    """Update a config's draft from a JSON patch. Nothing changes at run time until `publish`.
+
+    `--file` holds only the fields to change. Fields you leave out keep their
+    saved values; `parameters`, `auth` and `authMap` replace the saved value
+    whole when present, so copy them from `configs get` and send a secret's
+    masked value back unchanged to keep it. `"egressCountry": ""` clears the
+    egress pin; `null` means "leave unchanged", so it is refused here rather
+    than silently doing nothing.
+
+    Tool calls resolve the config's *published* revision, not its draft:
+    follow with `configs publish` to make the change live.
+
+    Prints the updated config with secrets masked by the server, the same
+    shape as `configs get` — never the values you sent. Prefer the dashboard
+    for entering new credentials: a secret in `--file` sits on disk.
+
+    Needs the `integrations:write` scope.
+
+    Examples:
+        echo '{"egressCountry": ""}' | fruxon integrations configs update bafi <config-id> --file -
+        fruxon integrations configs update github <config-id> --file ./patch.json
+        fruxon integrations configs update github <config-id> --schema > schema.json
+    """
+    from fruxon.cli._schema import print_schema
+
+    if schema:
+        print_schema("UpdateTenantIntegrationConfigRequest", workspace=workspace, base_url=base_url)
+        return
+    if not file:
+        fail(
+            "Missing required option [bold]--file[/bold].",
+            hint="Pass a JSON file with the fields to change, or [bold]--schema[/bold] to see the shape.",
+            code=EXIT_VALIDATION,
+        )
+
+    output = _resolve_write_output(output)
+    body = load_json_body(file, what="an UpdateTenantIntegrationConfigRequest object (the fields to change)")
+    _check_config_patch(body)
+
+    client = build_client(workspace, base_url)
+    try:
+        config = client.update_integration_config(integration, config_id, body)
+    except FruxonError as e:
+        fail_from_api_error(e, hint=_hint_for_config_error(e, integration))
+
+    publish_cmd = f"fruxon integrations configs publish {integration} {config_id}"
+    published = config.get("publishedRevisionId")
+    not_live = (
+        f"Not live yet: tool calls still resolve published revision {published}."
+        if published
+        else "This config has never been published, so no tool call resolves it yet."
+    )
+    if output == "json":
+        print(json.dumps(config, indent=2))
+        stderr.print(f"[dim]Draft updated. {not_live} Publish with: {publish_cmd}[/dim]")
+        return
+
+    name = config.get("displayName") or config_id
+    if stderr.is_terminal:
+        print_banner(subtitle=f"config · {integration}")
+    stderr.print()
+    say_ok(
+        f"Updated the draft of [bold]{escape(name)}[/bold] ({config_id}) · changed: {', '.join(body)}",
+        hint=f"{not_live} Publish with [bold]{publish_cmd}[/bold].",
+    )
+
+
+@configs_app.command("publish")
+def integration_configs_publish(
+    integration: Annotated[str, typer.Argument(help="Integration the config belongs to.")],
+    config_id: Annotated[str, typer.Argument(help="Config UUID to publish.")],
+    note: Annotated[
+        str | None,
+        typer.Option("--note", help="Publish note stored on the new revision (e.g. 'cleared egress pin')."),
+    ] = None,
+    yes: Annotated[
+        bool,
+        typer.Option("--yes", "-y", help="Skip the confirmation prompt. REQUIRED under agent mode (CLAUDECODE / CI)."),
+    ] = False,
+    workspace: Annotated[str | None, typer.Option("--workspace", help="Workspace identifier override.")] = None,
+    base_url: Annotated[str | None, typer.Option("--base-url", help="API base URL override.")] = None,
+    output: Annotated[
+        str | None,
+        typer.Option("--output", "-o", help="Output format: text (default for humans), json (default in agent mode)."),
+    ] = None,
+):
+    """Publish a config's draft as a new revision. Tool calls switch to it immediately.
+
+    Snapshots the draft (parameters, auth, authMap, sandbox routing, egress
+    country) into a new, immutable revision and points the config's
+    `publishedRevisionId` at it. Every agent and trigger resolving this config
+    uses the new revision from its next tool call. To revert, roll back to an
+    earlier revision on the config's dashboard page.
+
+    Prints the new revision's `id` and `version` (plus `configId`, `note`,
+    `sandboxMode`, `egressCountry`, `createdBy`, `createdAt`). The server's
+    response also carries the snapshotted credentials; they are dropped, never
+    printed.
+
+    Asks for confirmation; `--yes` skips it and is required in agent mode.
+    Needs the `integrations:write` scope.
+
+    Examples:
+        fruxon integrations configs publish bafi <config-id> --note 'cleared egress pin'
+        fruxon integrations configs publish github <config-id> --yes -o json
+    """
+    output = _resolve_write_output(output)
+    # Before any network call: an agent without --yes can't be asked.
+    require_yes_in_agent_mode(yes, action=_PUBLISH_CONFIG_ACTION)
+    client = build_client(workspace, base_url)
+    # Read it first, so the prompt names the config and what is live now —
+    # and so a wrong id fails before anyone is asked to confirm anything.
+    try:
+        config = client.get_integration_config(integration, config_id)
+    except FruxonError as e:
+        fail_from_api_error(e, hint=_hint_for_config_error(e, integration))
+
+    name = config.get("displayName") or config_id
+    if output == "text" or not yes:
+        if output == "text" and stderr.is_terminal:
+            print_banner(subtitle=f"config publish · {integration}")
+        stderr.print()
+        _render_config_publish_preview(config, integration, config_id)
+
+    confirm_or_die(
+        f"Publish the draft of [bold]{escape(name)}[/bold] as a new revision? "
+        "Every tool call using this config switches to it immediately.",
+        yes=yes,
+        action=_PUBLISH_CONFIG_ACTION,
+    )
+
+    try:
+        if stderr.is_terminal and output == "text":
+            with stderr.status(f"[bold]Publishing [cyan]{escape(name)}[/cyan]…[/bold]"):
+                revision = client.publish_integration_config(integration, config_id, note=note)
+        else:
+            revision = client.publish_integration_config(integration, config_id, note=note)
+    except FruxonError as e:
+        fail_from_api_error(e, hint=_hint_for_config_error(e, integration))
+
+    if output == "json":
+        print(json.dumps(revision, indent=2))
+        return
+
+    version = revision.get("version")
+    stderr.print()
+    say_ok(
+        f"Published [bold]{escape(name)}[/bold] ({config_id}) as revision "
+        f"[bold]v{version if version is not None else '?'}[/bold] [dim]{revision.get('id') or '—'}[/dim]",
+        hint=(
+            "Tool calls resolving this config use it from their next call. "
+            "To revert, roll back to an earlier revision on the config's dashboard page."
+        ),
+    )
+
+
+def _check_config_patch(body: dict) -> None:
+    """Refuse a patch the server would accept and then ignore, before sending it."""
+    known = {field.lower() for field in _CONFIG_UPDATE_FIELDS}
+    fields = ", ".join(_CONFIG_UPDATE_FIELDS)
+    if not body:
+        fail(
+            "Nothing to update: the patch is an empty object.",
+            hint=f'Send only the fields to change, e.g. {{"egressCountry": ""}}. Fields: {fields}.',
+            code=EXIT_VALIDATION,
+        )
+    unknown = [key for key in body if key.lower() not in known]
+    if unknown:
+        them = "them" if len(unknown) != 1 else "it"
+        fail(
+            f"Unknown field(s) in the patch: {escape(', '.join(unknown))}.",
+            hint=(
+                f"The server would ignore {them} and change nothing. Fields: {fields}. "
+                "Read-only fields from `configs get` (id, hasAuth, …) don't belong here."
+            ),
+            code=EXIT_VALIDATION,
+        )
+    nulls = [key for key, value in body.items() if value is None]
+    if nulls:
+        them = "them" if len(nulls) != 1 else "it"
+        clear = ' Send "" to clear egressCountry.' if "egresscountry" in {key.lower() for key in nulls} else ""
+        fail(
+            f"null leaves a field unchanged, so this would do nothing for: {escape(', '.join(nulls))}.",
+            hint=f"Drop {them} from the patch.{clear}",
+            code=EXIT_VALIDATION,
+        )
+
+
+def _render_config_publish_preview(config: dict, integration: str, config_id: str) -> None:
+    """What is about to be published, and what is live now."""
+    say_info(f"[bold]{escape(config.get('displayName') or config_id)}[/bold] [dim]{config_id} · {integration}[/dim]")
+    published = config.get("publishedRevisionId")
+    _say_kv(
+        "live now",
+        f"revision [bold]{published}[/bold]"
+        if published
+        else "[yellow]nothing — never published, so no tool call resolves it yet[/yellow]",
+    )
+    if config.get("egressCountry"):
+        _say_kv("egress", f"{escape(str(config['egressCountry']))} [dim](draft)[/dim]")
+    health = config.get("credentialHealth")
+    if isinstance(health, str) and health and health.upper() != "HEALTHY":
+        detail = config.get("credentialHealthDetail")
+        say_warn(f"Credential health: {escape(health)}", hint=escape(str(detail)) if detail else None)
+
+
+def _hint_for_config_error(error: FruxonError, integration: str) -> str | None:
+    from fruxon.exceptions import NotFoundError
+    from fruxon.ui import hint_for_forbidden
+
+    if isinstance(error, NotFoundError):
+        return (
+            f"No such config under [bold]{integration}[/bold] — list them with "
+            f"[bold]fruxon integrations configs list {integration}[/bold]."
+        )
+    # Before _hint_for_error, whose generic 403 line would hide the missing scope.
+    forbidden_hint = hint_for_forbidden(error)
+    if forbidden_hint is not None:
+        return forbidden_hint
+    return _hint_for_error(error)
+
+
 def _build_configs_table(configs: list[dict]):
     from rich.table import Table
 

{fruxon-0.21.2 → fruxon-1.0.0}/src/fruxon/fruxon.py

@@ -217,6 +217,21 @@ _MAX_PAGE_SIZE = 100
 # :meth:`FruxonClient.list_participants`.
 _VALID_PARTICIPANT_TIER = frozenset({"CURATED", "AMBIENT"})
 
+# What :meth:`FruxonClient.publish_integration_config` keeps of the revision
+# the server returns. That response is the snapshot itself, credentials
+# decrypted, so this lists what may leave rather than what may not: a field
+# the server adds later stays out until someone decides it is safe.
+_PUBLISHED_INTEGRATION_REVISION_FIELDS = (
+    "id",
+    "configId",
+    "version",
+    "note",
+    "sandboxMode",
+    "egressCountry",
+    "createdBy",
+    "createdAt",
+)
+
 _STATUS_EXCEPTIONS: dict[int, type[FruxonAPIError]] = {
     400: ValidationError,
     401: AuthenticationError,
@@ -2565,6 +2580,60 @@ class FruxonClient:
             )
         return raw
 
+    def update_integration_config(self, integration: str, config_id: str, body: dict[str, object]) -> dict:
+        """Patch a tenant-level integration config's draft.
+
+        Hits ``PATCH /v1/tenants/{tenant}/integrations/{integration}/configs/{configId}``
+        with an ``UpdateTenantIntegrationConfigRequest`` (scope
+        ``integrations:write``). Only the draft changes: tool calls keep
+        resolving the published revision until :meth:`publish_integration_config`.
+
+        Top-level fields left out of ``body`` keep their saved values.
+        ``parameters``, ``auth`` and ``authMap`` replace the saved value whole
+        when present; send a secret's masked value from
+        :meth:`get_integration_config` back unchanged to keep it.
+        ``egressCountry: ""`` clears the egress pin.
+
+        Returns the updated config in the shape :meth:`get_integration_config`
+        returns, secrets masked by the server.
+        """
+        url = self._integration_url(integration, f"/configs/{config_id}")
+        raw = self._put_or_patch(url, body, method="PATCH")
+        if not isinstance(raw, dict):
+            raise FruxonAPIError(
+                status=200,
+                title="Unexpected response",
+                detail="Expected an integration config object.",
+            )
+        return raw
+
+    def publish_integration_config(self, integration: str, config_id: str, *, note: str | None = None) -> dict:
+        """Publish a config's current draft as a new revision.
+
+        Hits ``POST /v1/tenants/{tenant}/integrations/{integration}/configs/{configId}:publish``
+        (scope ``integrations:write``). Snapshots the draft into a new,
+        immutable revision and points the config's ``publishedRevisionId`` at
+        it; tool calls resolving this config use it from their next call.
+
+        The server echoes the whole snapshot back, credentials included and
+        unmasked. This returns only the revision's identity and non-secret
+        fields: ``id``, ``configId``, ``version``, ``note``, ``sandboxMode``,
+        ``egressCountry``, ``createdBy`` and ``createdAt``, each when the
+        server sent it.
+        """
+        url = self._integration_url(integration, f"/configs/{config_id}:publish")
+        body: dict[str, object] = {}
+        if note:
+            body["note"] = note
+        result = self._post_json(url, body)
+        if not isinstance(result, dict):
+            raise FruxonAPIError(
+                status=200,
+                title="Unexpected response",
+                detail="Expected an integration config revision object.",
+            )
+        return {key: result[key] for key in _PUBLISHED_INTEGRATION_REVISION_FIELDS if key in result}
+
     # -------------------------------------------------------------------- mcp
 
     def get_mcp_config(self, integration: str) -> dict:

{fruxon-0.21.2 → fruxon-1.0.0}/src/fruxon/skills/fruxon-agent-mode/SKILL.md

@@ -103,6 +103,7 @@ the bypass flag.
 | `triggers fire` (no --yes) | Pass `--yes` — it runs the bound agent(s) now (cost + side effects). |
 | `triggers ledger walk` (no --yes) | Pass `--yes` — every step is a paid model run on the agent's test budget (up to `--max-steps`, default 10). It writes nothing; read `stopped.code` in the JSON, since it exits 0 whenever it ran. |
 | `triggers delete` / `unbind` (no --yes) | Pass `--yes` — removes the trigger / its agent wiring. |
+| `integrations configs publish` (no --yes) | Pass `--yes` — **but only on the human's say-so.** Every tool call that resolves the config switches to the new revision immediately. |
 | `participants delete` (no --yes) | Pass `--yes` — removes the participant from the network. |
 | `capabilities delete` (no --yes) | Pass `--yes` — removes the capability from the routing vocabulary. |
 | `participants unbind` (no --yes) | Pass `--yes` — removes the participant from the agent's consult roster. |

{fruxon-0.21.2 → fruxon-1.0.0}/src/fruxon/skills/fruxon-meet/SKILL.md

@@ -64,6 +64,7 @@ fruxon agents sandbox test <file|dir>  # run scenario e2e tests of an agent (exi
 fruxon integrations list / create
 fruxon integrations authorize <integration>  # mint an OAuth connect link for a human to click (auto-detects the method)
 fruxon integrations triggers <integration>  # event types (+ payload paths) an integration can fire an agent on
+fruxon integrations configs list / get / update / publish <integration>  # saved credentials; update edits the draft, publish makes it live
 fruxon tools list <integration> / create
 fruxon assets create/list/get/wait/delete  # the indexed RAG assets an agent's assetConfig attaches
 fruxon assets search/documents/chunks <a>  # what the INDEX holds — distinct from the authored corpus below

{fruxon-0.21.2 → fruxon-1.0.0}/src/fruxon/skills/fruxon-use-integrations/SKILL.md

@@ -27,6 +27,14 @@ You are now operating as a Fruxon integrations specialist.
   needs. `fruxon integrations configs get <integration> <config>`
   prints one config's full payload (auth shape, `publishedRevisionId`)
   — use it to confirm a config is published before pointing a slot at it.
+- `fruxon integrations configs update <integration> <config> --file <patch.json>`
+  changes a config's **draft**: the file holds only the fields to change
+  (e.g. `{"egressCountry": ""}` clears an egress pin). Tool calls keep
+  resolving the **published** revision, so follow with
+  `fruxon integrations configs publish <integration> <config> --yes`, which
+  every agent using the config picks up on its next call — ask the human
+  first. Don't collect secrets in chat to put in a patch: credentials are
+  entered in the dashboard.
 - `fruxon integrations get <id>` — catalog metadata for one
   integration (description, tags). (It does not report auth status —
   use `configs list` for that.)

{fruxon-0.21.2 → fruxon-1.0.0}/tests/test_docs_commands_exist.py

@@ -194,6 +194,9 @@ def test_the_doc_documents_something():
     # expanded — the blind spot that hid `agents test`.
     assert "knowledge-bases source preview" in documented
     assert "agents executions trace" in documented
+    # Expanded from the meet guide's `list / get / update / publish`.
+    assert "integrations configs update" in documented
+    assert "integrations configs publish" in documented
     # The three removed commands must not come back into the page.
     assert not any(d.split()[0] in {"run", "chat"} for d in documented), documented
     assert not any(d == "agents test" or d.startswith("agents test ") for d in documented), documented