@growthub/cli 0.14.0 → 0.14.2

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/adapters/sandboxes/default-local-agent-host.js

@@ -34,28 +34,97 @@ import path from "node:path";
 import { registerSandboxAdapter } from "./sandbox-adapter-registry.js";
 
 const MAX_OUTPUT_BYTES = 1024 * 256;
+const TELEMETRY_MARKER = "GROWTHUB_AGENT_TELEMETRY:";
+
+/**
+ * Browser access — the product's OWN agent browser primitive, surfaced.
+ *
+ * The upstream Paperclip server already gives every agent browser access
+ * through one boolean: the agent config's `chrome` primitive (see
+ * `ui/src/components/agent-config-primitives.tsx` — "Enable Claude's Chrome
+ * integration by passing --chrome") gated by the chrome-lease service in
+ * `server/src/services/chrome-lease.ts` before `adapter.execute()`. The
+ * sandbox row's `browserAccess` is the SAME bit on the governed Data Model
+ * side, so a row stays portable to the upstream adapter registry without
+ * translation — exactly like the host slugs themselves.
+ *
+ * When `browserAccess` is on, each host engages its FIRST-PARTY browser
+ * integration — nothing is invented or injected by this adapter:
+ *
+ *   native-flag   the host CLI has a first-party browser flag and
+ *                 argv(request) appends it (Claude Code `--chrome`,
+ *                 Codex `--enable browser_use --enable in_app_browser`).
+ *   env-signal    the host CLI has no documented one-shot browser flag; it
+ *                 receives GROWTHUB_SANDBOX_BROWSER_ACCESS=1 (mirroring the
+ *                 upstream browser-isolation context) and its own browser
+ *                 integration — whatever the operator has configured in that
+ *                 host — honors the row's setting. We never fabricate a flag
+ *                 or write host config we cannot verify against the upstream
+ *                 tool, the same rule the auth catalog follows for login
+ *                 subcommands.
+ *
+ * In the orchestration graph this is what makes browser access node-level
+ * and host-agnostic: thinAdapter / ai-agent nodes execute through this same
+ * catalog, so every node inherits the row's browser grant regardless of
+ * which host runs it.
+ */
 
 /**
  * Canonical Paperclip host catalog — slugs mirror `AGENT_ADAPTER_TYPES`.
  *
  * Each entry declares the binary the operator must have on PATH and how to
- * invoke it for one-shot prompt execution. `argv` returns the argv array the
- * adapter should pass; `inputMode` chooses whether the user's command is sent
- * via stdin or as a positional argument. `installHint` is surfaced verbatim
- * when the binary is not found, so operators get an actionable error.
+ * invoke it for one-shot prompt execution. `argv(request)` receives the sealed
+ * RunRequest and returns the argv array the adapter should pass — hosts with
+ * native capability flags (network sandbox mode, browser access) derive them
+ * deterministically from the governed row's saved settings. `inputMode`
+ * chooses whether the user's command is sent via stdin or as a positional
+ * argument. `installHint` is surfaced verbatim when the binary is not found,
+ * so operators get an actionable error. `browser` declares how the host's
+ * first-party browser integration is engaged (see above).
  */
 const HOST_CATALOG = {
   claude_local: {
     label: "Claude Code (local)",
     binary: "claude",
-    argv: () => ["-p", "--output-format", "text"],
+    argv: (request = {}) => {
+      const args = ["-p", "--output-format", "text"];
+      if (request.browserAccess) {
+        // Claude Code's first-party Chrome integration — the same flag the
+        // upstream server adapter passes when the agent config's `chrome`
+        // primitive is on.
+        args.push("--chrome");
+      }
+      return args;
+    },
+    browser: { lane: "native-flag", flags: ["--chrome"] },
     inputMode: "stdin",
     installHint: "Install Claude Code: npm i -g @anthropic-ai/claude-code"
   },
   codex_local: {
     label: "Codex CLI (local)",
     binary: "codex",
-    argv: () => ["exec", "--skip-git-repo-check", "--sandbox", "read-only", "-"],
+    argv: (request = {}) => {
+      // INTENTIONAL: networkAllow alone selects `workspace-write`. Codex's
+      // `read-only` sandbox blocks ALL outbound network, so workspace-write is
+      // the least-privileged Codex mode where the row's network grant can take
+      // effect — and writes are confined to the sealed ephemeral workdir the
+      // adapter spawns into (cwd), never the operator's repo. Browser flags
+      // remain gated on browserAccess only; network alone never opens a browser.
+      const netOn = Boolean(request.networkAllow);
+      const browserOn = Boolean(request.browserAccess);
+      const args = [
+        "exec",
+        "--skip-git-repo-check",
+        "--sandbox",
+        netOn ? "workspace-write" : "read-only",
+      ];
+      if (browserOn) {
+        args.push("--enable", "browser_use", "--enable", "in_app_browser");
+      }
+      args.push("-");
+      return args;
+    },
+    browser: { lane: "native-flag", flags: ["--enable", "browser_use", "--enable", "in_app_browser"] },
     inputMode: "stdin",
     installHint: "Install Codex CLI: npm i -g @openai/codex"
   },
@@ -63,6 +132,7 @@ const HOST_CATALOG = {
     label: "Cursor Agent (local)",
     binary: "cursor-agent",
     argv: () => ["--print"],
+    browser: { lane: "env-signal" },
     inputMode: "stdin",
     installHint: "Install Cursor Agent CLI: curl https://cursor.com/install -fsS | bash"
   },
@@ -70,6 +140,7 @@ const HOST_CATALOG = {
     label: "Gemini CLI (local)",
     binary: "gemini",
     argv: () => ["-p", "-"],
+    browser: { lane: "env-signal" },
     inputMode: "stdin",
     installHint: "Install Gemini CLI: npm i -g @google/gemini-cli"
   },
@@ -77,6 +148,7 @@ const HOST_CATALOG = {
     label: "OpenCode (local)",
     binary: "opencode",
     argv: () => ["run", "--quiet"],
+    browser: { lane: "env-signal" },
     inputMode: "stdin",
     installHint: "Install OpenCode: npm i -g opencode-ai"
   },
@@ -84,6 +156,7 @@ const HOST_CATALOG = {
     label: "Pi (local)",
     binary: "pi",
     argv: () => ["run", "--stdin"],
+    browser: { lane: "env-signal" },
     inputMode: "stdin",
     installHint: "Install Pi CLI: refer to your Paperclip Pi distribution"
   },
@@ -91,6 +164,7 @@ const HOST_CATALOG = {
     label: "Qwen Code (local)",
     binary: "qwen",
     argv: () => ["-p"],
+    browser: { lane: "env-signal" },
     inputMode: "stdin",
     installHint: "Install Qwen Code CLI: refer to your Qwen distribution"
   },
@@ -98,6 +172,7 @@ const HOST_CATALOG = {
     label: "Hermes Paperclip (local)",
     binary: "hermes",
     argv: () => ["run", "--stdin"],
+    browser: { lane: "env-signal" },
     inputMode: "stdin",
     installHint: "Install Hermes Paperclip adapter: npm i -g hermes-paperclip-adapter"
   },
@@ -105,6 +180,7 @@ const HOST_CATALOG = {
     label: "OpenClaw Gateway (local)",
     binary: "openclaw",
     argv: () => ["gateway", "exec", "--stdin"],
+    browser: { lane: "env-signal" },
     inputMode: "stdin",
     installHint: "Install OpenClaw Gateway: refer to your Paperclip distribution"
   }
@@ -118,6 +194,134 @@ function clampStream(buffer) {
   return `${head.toString("utf8")}\n…\n[output truncated at ${MAX_OUTPUT_BYTES} bytes]`;
 }
 
+function safeNonNegativeInt(value) {
+  if (value === null || value === undefined || value === "") return null;
+  const n = Number(value);
+  if (!Number.isFinite(n) || n < 0) return null;
+  return Math.floor(n);
+}
+
+function pickFirstNumber(...values) {
+  for (const value of values) {
+    const n = safeNonNegativeInt(value);
+    if (n != null) return n;
+  }
+  return null;
+}
+
+function sumNumbers(...values) {
+  let total = 0;
+  let seen = false;
+  for (const value of values) {
+    const n = safeNonNegativeInt(value);
+    if (n == null) continue;
+    total += n;
+    seen = true;
+  }
+  return seen ? total : null;
+}
+
+function extractUsageFromObject(obj) {
+  if (!obj || typeof obj !== "object" || Array.isArray(obj)) return { tokens: null, tools: null };
+  const usage = (obj.usage && typeof obj.usage === "object" && !Array.isArray(obj.usage))
+    ? obj.usage
+    : (obj.token_usage && typeof obj.token_usage === "object" && !Array.isArray(obj.token_usage))
+      ? obj.token_usage
+      : (obj.metadata?.usage && typeof obj.metadata.usage === "object" && !Array.isArray(obj.metadata.usage))
+        ? obj.metadata.usage
+        : (obj.result?.usage && typeof obj.result.usage === "object" && !Array.isArray(obj.result.usage))
+          ? obj.result.usage
+          : null;
+  const tokens = usage
+    ? pickFirstNumber(
+        usage.total_tokens,
+        usage.totalTokens,
+        usage.tokens,
+        sumNumbers(usage.input_tokens, usage.output_tokens),
+        sumNumbers(usage.prompt_tokens, usage.completion_tokens),
+        sumNumbers(usage.inputTokens, usage.outputTokens),
+      )
+    : pickFirstNumber(obj.total_tokens, obj.totalTokens, obj.tokens);
+  const toolArrays = [
+    obj.tool_calls,
+    obj.toolCalls,
+    obj.toolInvocations,
+    obj.message?.tool_calls,
+    obj.choices?.[0]?.message?.tool_calls,
+    obj.result?.tool_calls,
+    obj.result?.toolCalls,
+  ].filter(Array.isArray);
+  const tools = pickFirstNumber(
+    obj.tools,
+    obj.tool_count,
+    obj.toolCount,
+    ...toolArrays.map((items) => items.length),
+  );
+  return { tokens, tools };
+}
+
+function mergeTelemetry(base, next) {
+  return {
+    tokens: base.tokens ?? next.tokens ?? null,
+    tools: base.tools ?? next.tools ?? null,
+  };
+}
+
+function parseJsonMaybe(text) {
+  const value = String(text || "").trim();
+  if (!value || !/^[\[{]/.test(value)) return null;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+}
+
+function extractMarkedTelemetry(text) {
+  let out = { tokens: null, tools: null };
+  for (const line of String(text || "").split(/\r?\n/)) {
+    const idx = line.indexOf(TELEMETRY_MARKER);
+    if (idx === -1) continue;
+    const json = line.slice(idx + TELEMETRY_MARKER.length).trim();
+    const parsed = parseJsonMaybe(json);
+    out = mergeTelemetry(out, extractUsageFromObject(parsed));
+  }
+  return out;
+}
+
+function extractJsonLineTelemetry(text) {
+  let out = { tokens: null, tools: null };
+  for (const line of String(text || "").split(/\r?\n/)) {
+    const parsed = parseJsonMaybe(line);
+    if (!parsed) continue;
+    out = mergeTelemetry(out, extractUsageFromObject(parsed));
+  }
+  return out;
+}
+
+function extractStderrTextTelemetry(stderrText) {
+  const text = String(stderrText || "");
+  const total = text.match(/\b(?:total\s+tokens|tokens\s+used)\s*(?:[:=]|\r?\n)\s*([0-9][0-9,]*)/i);
+  const input = text.match(/\b(?:input|prompt)\s+tokens\s*[:=]\s*([0-9][0-9,]*)/i);
+  const output = text.match(/\b(?:output|completion)\s+tokens\s*[:=]\s*([0-9][0-9,]*)/i);
+  const tools = text.match(/\b(?:tool\s+calls?|tools\s+used)\s*[:=]\s*([0-9][0-9,]*)/i);
+  const tokens = pickFirstNumber(total?.[1]?.replace(/,/g, ""), sumNumbers(input?.[1]?.replace(/,/g, ""), output?.[1]?.replace(/,/g, "")));
+  return {
+    tokens,
+    tools: pickFirstNumber(tools?.[1]?.replace(/,/g, ""), tokens != null ? 0 : null),
+  };
+}
+
+function extractAgentHostTelemetry({ stdout, stderr }) {
+  let out = { tokens: null, tools: null };
+  const stdoutJson = parseJsonMaybe(stdout);
+  if (stdoutJson && !Array.isArray(stdoutJson)) out = mergeTelemetry(out, extractUsageFromObject(stdoutJson));
+  out = mergeTelemetry(out, extractMarkedTelemetry(stderr));
+  out = mergeTelemetry(out, extractJsonLineTelemetry(stderr));
+  out = mergeTelemetry(out, extractStderrTextTelemetry(stderr));
+  return out;
+}
+
 async function run(request) {
   const hostSlug = typeof request.agentHost === "string" ? request.agentHost.trim() : "";
   const host = HOST_CATALOG[hostSlug];
@@ -163,12 +367,13 @@ async function run(request) {
     GROWTHUB_SANDBOX_AGENT_HOST: hostSlug,
     GROWTHUB_SANDBOX_NET_ALLOW: request.networkAllow ? "1" : "0",
     GROWTHUB_SANDBOX_NET_ALLOWLIST: Array.isArray(request.allowList) ? request.allowList.join(",") : "",
+    GROWTHUB_SANDBOX_BROWSER_ACCESS: request.browserAccess ? "1" : "0",
     ...(request.env || {})
   };
 
   const timeoutMs = Number.isFinite(request.timeoutMs) && request.timeoutMs > 0 ? request.timeoutMs : 60000;
   const startedAt = Date.now();
-  const argv = host.argv(command);
+  const argv = host.argv(request);
 
   return await new Promise((resolve) => {
     let stdout = Buffer.alloc(0);
@@ -238,12 +443,15 @@ async function run(request) {
       clearTimeout(timer);
       const durationMs = Date.now() - startedAt;
       const ok = !timedOut && exitCode === 0;
+      const stdoutText = clampStream(stdout);
+      const stderrText = clampStream(stderr);
+      const telemetry = extractAgentHostTelemetry({ stdout: stdoutText, stderr: stderrText });
       resolve({
         ok,
         exitCode: typeof exitCode === "number" ? exitCode : null,
         durationMs,
-        stdout: clampStream(stdout),
-        stderr: clampStream(stderr),
+        stdout: stdoutText,
+        stderr: stderrText,
         error: timedOut
           ? `timed out after ${timeoutMs}ms`
           : (ok ? undefined : `exit ${exitCode ?? signal ?? "unknown"}`),
@@ -253,8 +461,13 @@ async function run(request) {
           binary: host.binary,
           argv,
           inputMode: host.inputMode,
+          browserAccess: Boolean(request.browserAccess),
+          browserLane: request.browserAccess ? host.browser.lane : null,
           timedOut,
-          signal: signal || null
+          signal: signal || null,
+          tokens: telemetry.tokens,
+          tools: telemetry.tools,
+          telemetrySource: telemetry.tokens != null || telemetry.tools != null ? "agent-host-reported" : "unreported"
         }
       });
     });
@@ -281,4 +494,4 @@ registerSandboxAdapter({
   run
 });
 
-export { HOST_CATALOG, SUPPORTED_HOSTS };
+export { HOST_CATALOG, SUPPORTED_HOSTS, extractAgentHostTelemetry };

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/adapters/sandboxes/default-local-intelligence.js

@@ -190,6 +190,10 @@ async function run(request) {
         endpoint,
         model,
         locality: "local",
+        // Truthful telemetry only — taken from the completion's usage block
+        // when the endpoint reports one, never estimated. Null means unknown.
+        tokens: Number.isFinite(outer?.usage?.total_tokens) ? outer.usage.total_tokens : null,
+        tools: Array.isArray(parsed.toolIntents) ? parsed.toolIntents.length : null,
       },
     };
   } catch (err) {

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/adapters/sandboxes/default-local-process.js

@@ -108,6 +108,7 @@ async function run(request) {
     GROWTHUB_SANDBOX_RUN_ID: request.runId || "",
     GROWTHUB_SANDBOX_NET_ALLOW: request.networkAllow ? "1" : "0",
     GROWTHUB_SANDBOX_NET_ALLOWLIST: Array.isArray(request.allowList) ? request.allowList.join(",") : "",
+    GROWTHUB_SANDBOX_BROWSER_ACCESS: request.browserAccess ? "1" : "0",
     ...(request.env || {})
   };
 
@@ -177,7 +178,8 @@ async function run(request) {
           timedOut,
           signal: signal || null,
           networkAllow: Boolean(request.networkAllow),
-          allowList: Array.isArray(request.allowList) ? request.allowList : []
+          allowList: Array.isArray(request.allowList) ? request.allowList : [],
+          browserAccess: Boolean(request.browserAccess)
         }
       });
     });

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/adapters/sandboxes/index.js

@@ -10,6 +10,7 @@
 import "./default-local-process.js";
 import "./default-local-agent-host.js";
 import "./default-local-intelligence.js";
+import "./adapters/local-intelligence-browser-access.js";
 import { loadAllSandboxAdapters } from "./adapter-loader.js";
 
 let baseLoaded = true; // default-local-process registered via static import

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/adapters/sandboxes/sandbox-adapter-registry.js

@@ -27,6 +27,9 @@
  *     timeoutMs:       number,            // hard cap, capped at SANDBOX_MAX_TIMEOUT_MS
  *     networkAllow:    boolean,           // allow outbound network from inside the sandbox
  *     allowList:       string[],          // hostnames the user explicitly allowed
+ *     browserAccess:   boolean,           // row-level browser capability (implies networkAllow);
+ *                                         // adapters surface it natively where the target supports
+ *                                         // it and always publish GROWTHUB_SANDBOX_BROWSER_ACCESS
  *     env:             Record<string,string>, // server-resolved env (NEVER sent to browser)
  *     envRefSlugs:     string[],          // ref slugs resolved (kept for record metadata)
  *     envRefsMissing:  string[],          // slugs the server could not resolve (audit-only)
@@ -99,7 +102,8 @@ function describeRegisteredSandboxAdapters() {
           slug,
           label: host?.label || slug,
           binary: host?.binary || null,
-          installHint: host?.installHint || null
+          installHint: host?.installHint || null,
+          browserLane: host?.browser?.lane || "env-signal"
         }))
       : null
   }));

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/data-model/field-contracts.js

@@ -11,6 +11,7 @@ const SANDBOX_ENVIRONMENT_FIELDS = {
     options: ["local", "serverless"]
   },
   networkAllow: { editor: "boolean-toggle" },
+  browserAccess: { editor: "boolean-toggle" },
   lifecycleStatus: {
     editor: "select",
     options: ["draft", "live"]