@lasso-ai/cli 2.1.14 → 2.1.15

package/dist/cli/local-runtime.js

@@ -101,9 +101,7 @@ class LocalRuntime {
         try {
             // Fresh capture per run — corrective re-runs capture the post-apply state.
             const guard = await index_js_1.WorkspaceGuard.capture(projectPath);
-            record.backend =
-                record.backend ||
-                    (await (0, index_js_1.createLocalAgentBackend)({ ...record.backendConfig, type: "local_agent", projectPath }));
+            record.backend = record.backend || (await (0, index_js_1.createLocalAgentBackend)({ ...record.backendConfig, type: "local_agent", projectPath }));
             const previousErrors = (record.errors || []);
             const externalSessionId = typeof record.metadata.backendSessionId === "string" ? record.metadata.backendSessionId : undefined;
             const runner = new index_js_1.LocalSessionRunner({
@@ -173,8 +171,7 @@ class LocalRuntime {
                 pendingChanges: outcome.changes,
                 binaryChanges: outcome.binaryPaths,
             };
-            record.status =
-                outcome.status === "waiting" ? "waiting" : outcome.status === "completed" ? "completed" : "failed";
+            record.status = outcome.status === "waiting" ? "waiting" : outcome.status === "completed" ? "completed" : "failed";
             record.phase = "complete";
             record.updatedAt = new Date();
         }
@@ -257,9 +254,7 @@ class LocalRuntime {
                 previousErrors: [],
                 currentPhase: "execute",
                 constraints: {},
-                sessionRef: typeof record.metadata.backendSessionId === "string"
-                    ? { id: record.metadata.backendSessionId }
-                    : undefined,
+                sessionRef: typeof record.metadata.backendSessionId === "string" ? { id: record.metadata.backendSessionId } : undefined,
             });
         }
         record.backend = nextBackend;

package/dist/cli/project.js

@@ -29,7 +29,10 @@ exports.LASSO_CONFIG_FILE = "lasso.config.json";
 const PROJECT_STATE_FILE = ".lasso-project.json";
 function readEnvFile(filename, cwd) {
     try {
-        return node_fs_1.default.readFileSync(node_path_1.default.join(cwd, filename), "utf8").split(/\r?\n/).reduce((values, line) => {
+        return node_fs_1.default
+            .readFileSync(node_path_1.default.join(cwd, filename), "utf8")
+            .split(/\r?\n/)
+            .reduce((values, line) => {
             const match = line.match(/^\s*(?:export\s+)?([A-Z0-9_]+)\s*=\s*(.*)\s*$/);
             if (match) {
                 let value = match[2].trim();
@@ -202,7 +205,7 @@ async function initProject(cwd, fileEnv, forcedDomain) {
     }
     const registry = (0, registry_1.loadRegistry)();
     const existingHost = (0, registry_1.findByDirectory)(registry, cwd);
-    const domain = forcedDomain || (existingConfig?.domain ? existingConfig.domain : (existingHost ? existingHost.domain : (0, registry_1.generateUniqueDomain)(cwd, registry)));
+    const domain = forcedDomain || (existingConfig?.domain ? existingConfig.domain : existingHost ? existingHost.domain : (0, registry_1.generateUniqueDomain)(cwd, registry));
     payload.domain = domain;
     let apiKey = resolveLassoApiKey(fileEnv);
     if (!apiKey)
@@ -322,11 +325,7 @@ async function resolveCollabSession(cwd, fileEnv, projectId) {
         }
         if (!response || !response.ok) {
             const status = response?.status;
-            const reason = status === 401
-                ? "Your Lasso API key is invalid or inactive."
-                : status === 403
-                    ? "This project belongs to another workspace."
-                    : `The server rejected the project session (${status || "unreachable"}).`;
+            const reason = status === 401 ? "Your Lasso API key is invalid or inactive." : status === 403 ? "This project belongs to another workspace." : `The server rejected the project session (${status || "unreachable"}).`;
             console.warn(chalk_1.default.yellow("!") + ` Realtime collaboration unavailable: ${reason}`);
             return config;
         }
@@ -341,10 +340,7 @@ async function resolveCollabSession(cwd, fileEnv, projectId) {
         config.registeredAt = new Date().toISOString();
         config.plan = body.project?.plan || "free";
         config.configuredProviders = body.project?.configuredProviders || [];
-        console.log(chalk_1.default.green("✓") +
-            " Project session opened " +
-            chalk_1.default.cyan(config.name || projectId) +
-            `${config.workspaceId ? ` · workspace ${config.workspaceId}` : ""}`);
+        console.log(chalk_1.default.green("✓") + " Project session opened " + chalk_1.default.cyan(config.name || projectId) + `${config.workspaceId ? ` · workspace ${config.workspaceId}` : ""}`);
         return config;
     }
     catch (error) {
@@ -425,7 +421,7 @@ async function fetchModels(fileEnv) {
         if (!response.ok) {
             return { anthropic: [], openai: [], google: [], nvidia: [] };
         }
-        const body = await response.json();
+        const body = (await response.json());
         return body;
     }
     catch {

package/dist/cli/runtime-client.d.ts

@@ -316,6 +316,8 @@ export declare class RuntimeClient {
         providerApiKey?: string;
         browserContextProvider?: BrowserContextProvider;
     }): Promise<void>;
+    /** Parse and dispatch one complete SSE frame. */
+    private processSseFrame;
     /** Execute a tool_call request locally against the real project. */
     private executeToolCallLocally;
     /** Post a tool result back to the server (resolves its pending request). */

package/dist/cli/runtime-client.js

@@ -36,7 +36,7 @@ class RuntimeClient {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
-                ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
+                ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
             },
             body: JSON.stringify(input),
         });
@@ -53,13 +53,13 @@ class RuntimeClient {
     async getSession(sessionId) {
         const response = await fetch(`${this.serverUrl}/api/v1/agent-runtime/sessions/${sessionId}`, {
             headers: {
-                ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
+                ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
             },
         });
         if (!response.ok) {
             throw new Error(`Failed to get session: ${response.statusText}`);
         }
-        const data = await response.json();
+        const data = (await response.json());
         const local = this.localReviewCache.get(sessionId);
         if (local && local.length > 0) {
             data.metadata = { ...(data.metadata || {}), pendingChanges: local };
@@ -79,20 +79,16 @@ class RuntimeClient {
      */
     async runSession(sessionId, projectPath, onEvent, signal, opts) {
         // CLI-side snapshot: nothing the agent does is left on disk before review.
-        let guard = null;
-        try {
-            guard = await index_js_1.WorkspaceGuard.capture(projectPath);
-        }
-        catch (error) {
-            console.error("WorkspaceGuard capture failed:", error);
-        }
+        // Review safety is mandatory. Never allow an agent to run if the
+        // pre-run workspace capture could not be established.
+        const guard = await index_js_1.WorkspaceGuard.capture(projectPath);
         const executor = new index_js_1.ActionExecutor(projectPath, opts?.browserContextProvider);
         const verifier = new index_js_1.VerificationEngine(projectPath);
         // Idempotent: called on agent_completed AND on stream failure, so the
         // diff is always cached before the safety-net restore wipes the edits.
         let finalized = false;
         const finalizeGuard = async () => {
-            if (!guard || finalized)
+            if (finalized)
                 return;
             finalized = true;
             try {
@@ -100,8 +96,8 @@ class RuntimeClient {
                 const applyable = changes.filter((c) => !c.binary);
                 const pending = applyable.map((change) => ({
                     filePath: change.filePath,
-                    oldString: change.operation === "created" ? "" : change.oldContent ?? "",
-                    newString: change.operation === "deleted" ? "" : change.newContent ?? "",
+                    oldString: change.operation === "created" ? "" : (change.oldContent ?? ""),
+                    newString: change.operation === "deleted" ? "" : (change.newContent ?? ""),
                     operation: change.operation,
                 }));
                 this.localReviewCache.set(sessionId, pending);
@@ -125,59 +121,46 @@ class RuntimeClient {
             const result = await this.executeToolCallLocally(request, executor, verifier);
             await this.postToolResult(sessionId, result);
         };
-        const response = await fetch(`${this.serverUrl}/api/v1/agent-runtime/sessions/${sessionId}/run`, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
-            },
-            // providerApiKey is the user's own model-provider key (BYOK): the
-            // server calls the hosted model with it and never stores it.
-            body: JSON.stringify({ projectPath, apiKey: opts?.providerApiKey }),
-            signal,
-        });
-        if (!response.ok) {
-            throw new Error(`Failed to run session: ${response.statusText}`);
-        }
-        const reader = response.body?.getReader();
-        if (!reader) {
-            throw new Error("No response body");
-        }
-        const decoder = new TextDecoder();
+        let reader;
         try {
+            const response = await fetch(`${this.serverUrl}/api/v1/agent-runtime/sessions/${sessionId}/run`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
+                },
+                // providerApiKey is the user's own model-provider key (BYOK): the
+                // server calls the hosted model with it and never stores it.
+                body: JSON.stringify({ projectPath, apiKey: opts?.providerApiKey }),
+                signal,
+            });
+            if (!response.ok) {
+                throw new Error(`Failed to run session: ${response.statusText}`);
+            }
+            reader = response.body?.getReader();
+            if (!reader) {
+                throw new Error("No response body");
+            }
+            const decoder = new TextDecoder();
+            let buffer = "";
             while (true) {
                 const { done, value } = await reader.read();
                 if (done)
                     break;
-                const chunk = decoder.decode(value);
-                const lines = chunk.split("\n");
-                for (const line of lines) {
-                    if (!line.trim() || !line.startsWith("data: "))
-                        continue;
-                    const data = line.slice(6);
-                    if (data === "[DONE]")
-                        continue;
-                    try {
-                        const event = JSON.parse(data);
-                        if (event.type === "tool_call") {
-                            // Execute locally and answer the server — never forwarded raw.
-                            await handleToolCall(event.data);
-                            continue;
-                        }
-                        if (event.type === "agent_completed") {
-                            // Diff + rollback BEFORE the review flow reads the session.
-                            await finalizeGuard();
-                        }
-                        await onEvent(event);
-                    }
-                    catch (error) {
-                        console.error("Failed to parse SSE event:", error);
-                    }
+                buffer += decoder.decode(value, { stream: true });
+                const frames = buffer.split(/\r?\n\r?\n/);
+                buffer = frames.pop() || "";
+                for (const frame of frames) {
+                    await this.processSseFrame(frame, handleToolCall, finalizeGuard, onEvent);
                 }
             }
+            buffer += decoder.decode();
+            if (buffer.trim()) {
+                await this.processSseFrame(buffer, handleToolCall, finalizeGuard, onEvent);
+            }
         }
         finally {
-            reader.releaseLock();
+            reader?.releaseLock();
             // Stream died before agent_completed (network cut, server crash, model
             // error surfaced as an error event): cache the diff first so the user's
             // changes are recoverable, then restore the workspace. On the normal
@@ -185,6 +168,29 @@ class RuntimeClient {
             await finalizeGuard();
         }
     }
+    /** Parse and dispatch one complete SSE frame. */
+    async processSseFrame(frame, handleToolCall, finalizeGuard, onEvent) {
+        const data = frame
+            .split(/\r?\n/)
+            .filter((line) => line.startsWith("data:"))
+            .map((line) => line.slice(5).trimStart())
+            .join("\n");
+        if (!data || data === "[DONE]")
+            return;
+        try {
+            const event = JSON.parse(data);
+            if (event.type === "tool_call") {
+                await handleToolCall(event.data);
+                return;
+            }
+            if (event.type === "agent_completed")
+                await finalizeGuard();
+            await onEvent(event);
+        }
+        catch (error) {
+            console.error("Failed to process SSE event:", error);
+        }
+    }
     /** Execute a tool_call request locally against the real project. */
     async executeToolCallLocally(request, executor, verifier) {
         try {
@@ -207,7 +213,8 @@ class RuntimeClient {
                 output: result.output,
                 error: result.error,
                 observations: result.observation
-                    ? [{
+                    ? [
+                        {
                             id: node_crypto_1.default.randomUUID(),
                             type: result.observation.type,
                             summary: result.observation.summary,
@@ -215,7 +222,8 @@ class RuntimeClient {
                             timestamp: Date.now(),
                             phase: "execute",
                             actionId: request.action.id,
-                        }]
+                        },
+                    ]
                     : undefined,
             };
         }
@@ -234,7 +242,7 @@ class RuntimeClient {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/json",
-                    ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
+                    ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
                 },
                 body: JSON.stringify(result),
             });
@@ -253,7 +261,7 @@ class RuntimeClient {
         const response = await fetch(`${this.serverUrl}/api/v1/agent-runtime/sessions/${sessionId}/cancel`, {
             method: "POST",
             headers: {
-                ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
+                ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
             },
         });
         if (!response.ok) {
@@ -268,7 +276,7 @@ class RuntimeClient {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
-                ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
+                ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
             },
             body: JSON.stringify({ ...model, apiKey, backendConfig }),
         });
@@ -295,7 +303,7 @@ class RuntimeClient {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/json",
-                    ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
+                    ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
                 },
                 body: JSON.stringify({ projectPath, localResults: { passed, errors, observations } }),
             });
@@ -317,7 +325,7 @@ class RuntimeClient {
         const url = `${this.serverUrl}/api/v1/agent-runtime/backends${projectPath ? `?projectPath=${encodeURIComponent(projectPath)}` : ""}`;
         const response = await fetch(url, {
             headers: {
-                ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
+                ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
             },
         });
         if (!response.ok) {
@@ -332,7 +340,7 @@ class RuntimeClient {
         const response = await fetch(`${this.serverUrl}/api/v1/agent-runtime/sessions/${sessionId}`, {
             method: "DELETE",
             headers: {
-                ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
+                ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
             },
         });
         if (!response.ok) {

package/dist/cli/server/vite.js

@@ -26,7 +26,7 @@ function lassoInjectPlugin(bridgePort = 3056, cwd) {
                 res.setHeader("Content-Type", "application/javascript");
                 res.end((0, node_fs_1.readFileSync)(bundlePath, "utf-8"));
             });
-        }
+        },
     };
 }
 async function startViteServer(cwd) {

package/dist/cli/snapshot.js

@@ -20,6 +20,16 @@ const node_crypto_1 = __importDefault(require("node:crypto"));
 const SNAPSHOTS_DIR = ".lasso/snapshots";
 const TIMELINE_FILE = ".lasso/timeline.json";
 const MAX_SNAPSHOTS = 50;
+function resolveSnapshotPath(cwd, filePath) {
+    if (!filePath || node_path_1.default.isAbsolute(filePath))
+        throw new Error(`Invalid snapshot path: ${filePath}`);
+    const root = node_path_1.default.resolve(cwd);
+    const fullPath = node_path_1.default.resolve(root, filePath);
+    if (fullPath !== root && !fullPath.startsWith(`${root}${node_path_1.default.sep}`)) {
+        throw new Error(`Snapshot path escapes workspace: ${filePath}`);
+    }
+    return fullPath;
+}
 // Ensure snapshots directory exists
 function ensureSnapshotsDir(cwd) {
     const dir = node_path_1.default.join(cwd, SNAPSHOTS_DIR);
@@ -66,7 +76,7 @@ function createSnapshot(cwd, taskId, summary, filePaths, parentSnapshotId, sessi
     const files = [];
     const timestamp = new Date().toISOString();
     for (const filePath of filePaths) {
-        const fullPath = node_path_1.default.resolve(cwd, filePath);
+        const fullPath = resolveSnapshotPath(cwd, filePath);
         let content = null;
         let hash = "";
         try {
@@ -118,7 +128,7 @@ function restoreSnapshot(cwd, snapshotId) {
     }
     try {
         for (const file of snapshot.files) {
-            const fullPath = node_path_1.default.resolve(cwd, file.filePath);
+            const fullPath = resolveSnapshotPath(cwd, file.filePath);
             if (file.content === null) {
                 // File didn't exist, delete if it exists now
                 if (node_fs_1.default.existsSync(fullPath)) {
@@ -143,7 +153,7 @@ function restoreSnapshot(cwd, snapshotId) {
 function detectConflicts(cwd, expectedFiles) {
     const conflicts = [];
     for (const expected of expectedFiles) {
-        const fullPath = node_path_1.default.resolve(cwd, expected.filePath);
+        const fullPath = resolveSnapshotPath(cwd, expected.filePath);
         const expectedHash = expected.hash || (expected.content ? hashContent(expected.content) : "");
         try {
             if (!node_fs_1.default.existsSync(fullPath)) {