@lasso-ai/cli 2.1.14 → 2.1.16

package/dist/cli/host/install.js

@@ -51,7 +51,7 @@ function spawnDaemon(env) {
                 console.log(chalk_1.default.yellow(`!`) + ` Lasso Host is running version ${health.version} but installed version is ${CURRENT_VERSION}. Restarting...`);
                 await stopDaemon(env);
                 // Wait a moment for the daemon to stop
-                await new Promise(resolve => setTimeout(resolve, 1000));
+                await new Promise((resolve) => setTimeout(resolve, 1000));
             }
             else {
                 return { ok: true, alreadyRunning: true };

package/dist/cli/host/next-host-entry.js

@@ -109,9 +109,7 @@ void (async () => {
         }
         const forward = (attempt = 0) => {
             proxy.web(req, res, { headers: { "accept-encoding": "identity" } }, (error) => {
-                const retryable = error.code === "ECONNREFUSED" ||
-                    error.code === "ECONNRESET" ||
-                    error.code === "EPIPE";
+                const retryable = error.code === "ECONNREFUSED" || error.code === "ECONNRESET" || error.code === "EPIPE";
                 if (!res.headersSent && req.method !== "POST" && retryable && attempt < 12) {
                     setTimeout(() => forward(attempt + 1), 250);
                     return;

package/dist/cli/host/vite-host-entry.js

@@ -37,13 +37,7 @@ void (async () => {
             host: "127.0.0.1",
             port,
             strictPort: true,
-            allowedHosts: [
-                ".lasso",
-                "lasso",
-                "localhost",
-                "127.0.0.1",
-                ...(process.env.LASSO_HOST_ALLOWED_HOSTS ? process.env.LASSO_HOST_ALLOWED_HOSTS.split(",") : []),
-            ],
+            allowedHosts: [".lasso", "lasso", "localhost", "127.0.0.1", ...(process.env.LASSO_HOST_ALLOWED_HOSTS ? process.env.LASSO_HOST_ALLOWED_HOSTS.split(",") : [])],
         },
         plugins: [lassoOverlayPlugin()],
     });

package/dist/cli/index.js

@@ -30,7 +30,8 @@ function projectEnv() {
     return (0, project_1.readProjectEnv)(process.cwd());
 }
 const bridge = program.command("bridge").description("Manage the Lasso overlay bridge");
-bridge.command("restart")
+bridge
+    .command("restart")
     .description("Reset the active bridge connection and reconnect the overlay")
     .option("--port <port>", "Bridge port", "3056")
     .action(async (options) => {

package/dist/cli/local-runtime.js

@@ -101,9 +101,7 @@ class LocalRuntime {
         try {
             // Fresh capture per run — corrective re-runs capture the post-apply state.
             const guard = await index_js_1.WorkspaceGuard.capture(projectPath);
-            record.backend =
-                record.backend ||
-                    (await (0, index_js_1.createLocalAgentBackend)({ ...record.backendConfig, type: "local_agent", projectPath }));
+            record.backend = record.backend || (await (0, index_js_1.createLocalAgentBackend)({ ...record.backendConfig, type: "local_agent", projectPath }));
             const previousErrors = (record.errors || []);
             const externalSessionId = typeof record.metadata.backendSessionId === "string" ? record.metadata.backendSessionId : undefined;
             const runner = new index_js_1.LocalSessionRunner({
@@ -173,8 +171,7 @@ class LocalRuntime {
                 pendingChanges: outcome.changes,
                 binaryChanges: outcome.binaryPaths,
             };
-            record.status =
-                outcome.status === "waiting" ? "waiting" : outcome.status === "completed" ? "completed" : "failed";
+            record.status = outcome.status === "waiting" ? "waiting" : outcome.status === "completed" ? "completed" : "failed";
             record.phase = "complete";
             record.updatedAt = new Date();
         }
@@ -257,9 +254,7 @@ class LocalRuntime {
                 previousErrors: [],
                 currentPhase: "execute",
                 constraints: {},
-                sessionRef: typeof record.metadata.backendSessionId === "string"
-                    ? { id: record.metadata.backendSessionId }
-                    : undefined,
+                sessionRef: typeof record.metadata.backendSessionId === "string" ? { id: record.metadata.backendSessionId } : undefined,
             });
         }
         record.backend = nextBackend;

package/dist/cli/project.js

@@ -29,7 +29,10 @@ exports.LASSO_CONFIG_FILE = "lasso.config.json";
 const PROJECT_STATE_FILE = ".lasso-project.json";
 function readEnvFile(filename, cwd) {
     try {
-        return node_fs_1.default.readFileSync(node_path_1.default.join(cwd, filename), "utf8").split(/\r?\n/).reduce((values, line) => {
+        return node_fs_1.default
+            .readFileSync(node_path_1.default.join(cwd, filename), "utf8")
+            .split(/\r?\n/)
+            .reduce((values, line) => {
             const match = line.match(/^\s*(?:export\s+)?([A-Z0-9_]+)\s*=\s*(.*)\s*$/);
             if (match) {
                 let value = match[2].trim();
@@ -202,7 +205,7 @@ async function initProject(cwd, fileEnv, forcedDomain) {
     }
     const registry = (0, registry_1.loadRegistry)();
     const existingHost = (0, registry_1.findByDirectory)(registry, cwd);
-    const domain = forcedDomain || (existingConfig?.domain ? existingConfig.domain : (existingHost ? existingHost.domain : (0, registry_1.generateUniqueDomain)(cwd, registry)));
+    const domain = forcedDomain || (existingConfig?.domain ? existingConfig.domain : existingHost ? existingHost.domain : (0, registry_1.generateUniqueDomain)(cwd, registry));
     payload.domain = domain;
     let apiKey = resolveLassoApiKey(fileEnv);
     if (!apiKey)
@@ -322,11 +325,7 @@ async function resolveCollabSession(cwd, fileEnv, projectId) {
         }
         if (!response || !response.ok) {
             const status = response?.status;
-            const reason = status === 401
-                ? "Your Lasso API key is invalid or inactive."
-                : status === 403
-                    ? "This project belongs to another workspace."
-                    : `The server rejected the project session (${status || "unreachable"}).`;
+            const reason = status === 401 ? "Your Lasso API key is invalid or inactive." : status === 403 ? "This project belongs to another workspace." : `The server rejected the project session (${status || "unreachable"}).`;
             console.warn(chalk_1.default.yellow("!") + ` Realtime collaboration unavailable: ${reason}`);
             return config;
         }
@@ -341,10 +340,7 @@ async function resolveCollabSession(cwd, fileEnv, projectId) {
         config.registeredAt = new Date().toISOString();
         config.plan = body.project?.plan || "free";
         config.configuredProviders = body.project?.configuredProviders || [];
-        console.log(chalk_1.default.green("✓") +
-            " Project session opened " +
-            chalk_1.default.cyan(config.name || projectId) +
-            `${config.workspaceId ? ` · workspace ${config.workspaceId}` : ""}`);
+        console.log(chalk_1.default.green("✓") + " Project session opened " + chalk_1.default.cyan(config.name || projectId) + `${config.workspaceId ? ` · workspace ${config.workspaceId}` : ""}`);
         return config;
     }
     catch (error) {
@@ -425,7 +421,7 @@ async function fetchModels(fileEnv) {
         if (!response.ok) {
             return { anthropic: [], openai: [], google: [], nvidia: [] };
         }
-        const body = await response.json();
+        const body = (await response.json());
         return body;
     }
     catch {

package/dist/cli/runtime-client.d.ts

@@ -157,6 +157,7 @@ export interface RuntimeFacade {
     runSession(sessionId: string, projectPath: string, onEvent: RuntimeEventHandler, signal?: AbortSignal, opts?: {
         providerApiKey?: string;
         browserContextProvider?: BrowserContextProvider;
+        devServerUrl?: string;
     }): Promise<void>;
     getSession(sessionId: string): Promise<RuntimeSession>;
     verifySession(sessionId: string, projectPath: string): Promise<SessionVerificationResult>;
@@ -166,6 +167,8 @@ export interface RuntimeFacade {
         name?: string;
     }, apiKey?: string, backendConfig?: RuntimeSessionInput["backendConfig"]): Promise<void>;
     cancelSession(sessionId: string): Promise<void>;
+    respondToPrompt?(sessionId: string, response: string): Promise<void>;
+    steerSession?(sessionId: string, prompt: string): Promise<void>;
 }
 export type RuntimeEvent = {
     type: "agent_started";
@@ -315,7 +318,10 @@ export declare class RuntimeClient {
     runSession(sessionId: string, projectPath: string, onEvent: RuntimeEventHandler, signal?: AbortSignal, opts?: {
         providerApiKey?: string;
         browserContextProvider?: BrowserContextProvider;
+        devServerUrl?: string;
     }): Promise<void>;
+    /** Parse and dispatch one complete SSE frame. */
+    private processSseFrame;
     /** Execute a tool_call request locally against the real project. */
     private executeToolCallLocally;
     /** Post a tool result back to the server (resolves its pending request). */
@@ -324,6 +330,10 @@ export declare class RuntimeClient {
      * Cancel a running session
      */
     cancelSession(sessionId: string): Promise<void>;
+    /** Resume a hosted runtime that is waiting for an answer from the user. */
+    respondToPrompt(sessionId: string, response: string): Promise<void>;
+    /** Queue a prompt for the next turn of an active hosted runtime. */
+    steerSession(sessionId: string, prompt: string): Promise<void>;
     /**
      * Switch model/backend for a session
      */

package/dist/cli/runtime-client.js

@@ -36,7 +36,7 @@ class RuntimeClient {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
-                ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
+                ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
             },
             body: JSON.stringify(input),
         });
@@ -53,13 +53,13 @@ class RuntimeClient {
     async getSession(sessionId) {
         const response = await fetch(`${this.serverUrl}/api/v1/agent-runtime/sessions/${sessionId}`, {
             headers: {
-                ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
+                ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
             },
         });
         if (!response.ok) {
             throw new Error(`Failed to get session: ${response.statusText}`);
         }
-        const data = await response.json();
+        const data = (await response.json());
         const local = this.localReviewCache.get(sessionId);
         if (local && local.length > 0) {
             data.metadata = { ...(data.metadata || {}), pendingChanges: local };
@@ -79,20 +79,19 @@ class RuntimeClient {
      */
     async runSession(sessionId, projectPath, onEvent, signal, opts) {
         // CLI-side snapshot: nothing the agent does is left on disk before review.
-        let guard = null;
-        try {
-            guard = await index_js_1.WorkspaceGuard.capture(projectPath);
-        }
-        catch (error) {
-            console.error("WorkspaceGuard capture failed:", error);
-        }
+        // Review safety is mandatory. Never allow an agent to run if the
+        // pre-run workspace capture could not be established.
+        const guard = await index_js_1.WorkspaceGuard.capture(projectPath);
         const executor = new index_js_1.ActionExecutor(projectPath, opts?.browserContextProvider);
-        const verifier = new index_js_1.VerificationEngine(projectPath);
+        const verifier = new index_js_1.VerificationEngine(projectPath, {
+            devServerUrl: opts?.devServerUrl || process.env.LASSO_DEV_SERVER_URL,
+            browserContextProvider: opts?.browserContextProvider,
+        });
         // Idempotent: called on agent_completed AND on stream failure, so the
         // diff is always cached before the safety-net restore wipes the edits.
         let finalized = false;
         const finalizeGuard = async () => {
-            if (!guard || finalized)
+            if (finalized)
                 return;
             finalized = true;
             try {
@@ -100,8 +99,8 @@ class RuntimeClient {
                 const applyable = changes.filter((c) => !c.binary);
                 const pending = applyable.map((change) => ({
                     filePath: change.filePath,
-                    oldString: change.operation === "created" ? "" : change.oldContent ?? "",
-                    newString: change.operation === "deleted" ? "" : change.newContent ?? "",
+                    oldString: change.operation === "created" ? "" : (change.oldContent ?? ""),
+                    newString: change.operation === "deleted" ? "" : (change.newContent ?? ""),
                     operation: change.operation,
                 }));
                 this.localReviewCache.set(sessionId, pending);
@@ -125,59 +124,46 @@ class RuntimeClient {
             const result = await this.executeToolCallLocally(request, executor, verifier);
             await this.postToolResult(sessionId, result);
         };
-        const response = await fetch(`${this.serverUrl}/api/v1/agent-runtime/sessions/${sessionId}/run`, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
-            },
-            // providerApiKey is the user's own model-provider key (BYOK): the
-            // server calls the hosted model with it and never stores it.
-            body: JSON.stringify({ projectPath, apiKey: opts?.providerApiKey }),
-            signal,
-        });
-        if (!response.ok) {
-            throw new Error(`Failed to run session: ${response.statusText}`);
-        }
-        const reader = response.body?.getReader();
-        if (!reader) {
-            throw new Error("No response body");
-        }
-        const decoder = new TextDecoder();
+        let reader;
         try {
+            const response = await fetch(`${this.serverUrl}/api/v1/agent-runtime/sessions/${sessionId}/run`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
+                },
+                // providerApiKey is the user's own model-provider key (BYOK): the
+                // server calls the hosted model with it and never stores it.
+                body: JSON.stringify({ projectPath, apiKey: opts?.providerApiKey }),
+                signal,
+            });
+            if (!response.ok) {
+                throw new Error(`Failed to run session: ${response.statusText}`);
+            }
+            reader = response.body?.getReader();
+            if (!reader) {
+                throw new Error("No response body");
+            }
+            const decoder = new TextDecoder();
+            let buffer = "";
             while (true) {
                 const { done, value } = await reader.read();
                 if (done)
                     break;
-                const chunk = decoder.decode(value);
-                const lines = chunk.split("\n");
-                for (const line of lines) {
-                    if (!line.trim() || !line.startsWith("data: "))
-                        continue;
-                    const data = line.slice(6);
-                    if (data === "[DONE]")
-                        continue;
-                    try {
-                        const event = JSON.parse(data);
-                        if (event.type === "tool_call") {
-                            // Execute locally and answer the server — never forwarded raw.
-                            await handleToolCall(event.data);
-                            continue;
-                        }
-                        if (event.type === "agent_completed") {
-                            // Diff + rollback BEFORE the review flow reads the session.
-                            await finalizeGuard();
-                        }
-                        await onEvent(event);
-                    }
-                    catch (error) {
-                        console.error("Failed to parse SSE event:", error);
-                    }
+                buffer += decoder.decode(value, { stream: true });
+                const frames = buffer.split(/\r?\n\r?\n/);
+                buffer = frames.pop() || "";
+                for (const frame of frames) {
+                    await this.processSseFrame(frame, handleToolCall, finalizeGuard, onEvent);
                 }
             }
+            buffer += decoder.decode();
+            if (buffer.trim()) {
+                await this.processSseFrame(buffer, handleToolCall, finalizeGuard, onEvent);
+            }
         }
         finally {
-            reader.releaseLock();
+            reader?.releaseLock();
             // Stream died before agent_completed (network cut, server crash, model
             // error surfaced as an error event): cache the diff first so the user's
             // changes are recoverable, then restore the workspace. On the normal
@@ -185,6 +171,29 @@ class RuntimeClient {
             await finalizeGuard();
         }
     }
+    /** Parse and dispatch one complete SSE frame. */
+    async processSseFrame(frame, handleToolCall, finalizeGuard, onEvent) {
+        const data = frame
+            .split(/\r?\n/)
+            .filter((line) => line.startsWith("data:"))
+            .map((line) => line.slice(5).trimStart())
+            .join("\n");
+        if (!data || data === "[DONE]")
+            return;
+        try {
+            const event = JSON.parse(data);
+            if (event.type === "tool_call") {
+                await handleToolCall(event.data);
+                return;
+            }
+            if (event.type === "agent_completed")
+                await finalizeGuard();
+            await onEvent(event);
+        }
+        catch (error) {
+            console.error("Failed to process SSE event:", error);
+        }
+    }
     /** Execute a tool_call request locally against the real project. */
     async executeToolCallLocally(request, executor, verifier) {
         try {
@@ -207,7 +216,8 @@ class RuntimeClient {
                 output: result.output,
                 error: result.error,
                 observations: result.observation
-                    ? [{
+                    ? [
+                        {
                             id: node_crypto_1.default.randomUUID(),
                             type: result.observation.type,
                             summary: result.observation.summary,
@@ -215,7 +225,8 @@ class RuntimeClient {
                             timestamp: Date.now(),
                             phase: "execute",
                             actionId: request.action.id,
-                        }]
+                        },
+                    ]
                     : undefined,
             };
         }
@@ -234,7 +245,7 @@ class RuntimeClient {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/json",
-                    ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
+                    ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
                 },
                 body: JSON.stringify(result),
             });
@@ -253,13 +264,43 @@ class RuntimeClient {
         const response = await fetch(`${this.serverUrl}/api/v1/agent-runtime/sessions/${sessionId}/cancel`, {
             method: "POST",
             headers: {
-                ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
+                ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
             },
         });
         if (!response.ok) {
             throw new Error(`Failed to cancel session: ${response.statusText}`);
         }
     }
+    /** Resume a hosted runtime that is waiting for an answer from the user. */
+    async respondToPrompt(sessionId, response) {
+        const result = await fetch(`${this.serverUrl}/api/v1/agent-runtime/sessions/${sessionId}/user-response`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
+            },
+            body: JSON.stringify({ response }),
+        });
+        if (!result.ok) {
+            const body = (await result.json().catch(() => ({})));
+            throw new Error(body.error || `Failed to submit agent response: ${result.statusText}`);
+        }
+    }
+    /** Queue a prompt for the next turn of an active hosted runtime. */
+    async steerSession(sessionId, prompt) {
+        const result = await fetch(`${this.serverUrl}/api/v1/agent-runtime/sessions/${sessionId}/steer`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
+            },
+            body: JSON.stringify({ prompt }),
+        });
+        if (!result.ok) {
+            const body = (await result.json().catch(() => ({})));
+            throw new Error(body.error || `Failed to queue steering prompt: ${result.statusText}`);
+        }
+    }
     /**
      * Switch model/backend for a session
      */
@@ -268,7 +309,7 @@ class RuntimeClient {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
-                ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
+                ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
             },
             body: JSON.stringify({ ...model, apiKey, backendConfig }),
         });
@@ -295,7 +336,7 @@ class RuntimeClient {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/json",
-                    ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
+                    ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
                 },
                 body: JSON.stringify({ projectPath, localResults: { passed, errors, observations } }),
             });
@@ -317,7 +358,7 @@ class RuntimeClient {
         const url = `${this.serverUrl}/api/v1/agent-runtime/backends${projectPath ? `?projectPath=${encodeURIComponent(projectPath)}` : ""}`;
         const response = await fetch(url, {
             headers: {
-                ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
+                ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
             },
         });
         if (!response.ok) {
@@ -332,7 +373,7 @@ class RuntimeClient {
         const response = await fetch(`${this.serverUrl}/api/v1/agent-runtime/sessions/${sessionId}`, {
             method: "DELETE",
             headers: {
-                ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
+                ...(this.apiKey && { Authorization: `Bearer ${this.apiKey}` }),
             },
         });
         if (!response.ok) {

package/dist/cli/server/vite.js

@@ -26,7 +26,7 @@ function lassoInjectPlugin(bridgePort = 3056, cwd) {
                 res.setHeader("Content-Type", "application/javascript");
                 res.end((0, node_fs_1.readFileSync)(bundlePath, "utf-8"));
             });
-        }
+        },
     };
 }
 async function startViteServer(cwd) {

package/dist/cli/snapshot.js

@@ -20,6 +20,16 @@ const node_crypto_1 = __importDefault(require("node:crypto"));
 const SNAPSHOTS_DIR = ".lasso/snapshots";
 const TIMELINE_FILE = ".lasso/timeline.json";
 const MAX_SNAPSHOTS = 50;
+function resolveSnapshotPath(cwd, filePath) {
+    if (!filePath || node_path_1.default.isAbsolute(filePath))
+        throw new Error(`Invalid snapshot path: ${filePath}`);
+    const root = node_path_1.default.resolve(cwd);
+    const fullPath = node_path_1.default.resolve(root, filePath);
+    if (fullPath !== root && !fullPath.startsWith(`${root}${node_path_1.default.sep}`)) {
+        throw new Error(`Snapshot path escapes workspace: ${filePath}`);
+    }
+    return fullPath;
+}
 // Ensure snapshots directory exists
 function ensureSnapshotsDir(cwd) {
     const dir = node_path_1.default.join(cwd, SNAPSHOTS_DIR);
@@ -66,7 +76,7 @@ function createSnapshot(cwd, taskId, summary, filePaths, parentSnapshotId, sessi
     const files = [];
     const timestamp = new Date().toISOString();
     for (const filePath of filePaths) {
-        const fullPath = node_path_1.default.resolve(cwd, filePath);
+        const fullPath = resolveSnapshotPath(cwd, filePath);
         let content = null;
         let hash = "";
         try {
@@ -118,7 +128,7 @@ function restoreSnapshot(cwd, snapshotId) {
     }
     try {
         for (const file of snapshot.files) {
-            const fullPath = node_path_1.default.resolve(cwd, file.filePath);
+            const fullPath = resolveSnapshotPath(cwd, file.filePath);
             if (file.content === null) {
                 // File didn't exist, delete if it exists now
                 if (node_fs_1.default.existsSync(fullPath)) {
@@ -143,7 +153,7 @@ function restoreSnapshot(cwd, snapshotId) {
 function detectConflicts(cwd, expectedFiles) {
     const conflicts = [];
     for (const expected of expectedFiles) {
-        const fullPath = node_path_1.default.resolve(cwd, expected.filePath);
+        const fullPath = resolveSnapshotPath(cwd, expected.filePath);
         const expectedHash = expected.hash || (expected.content ? hashContent(expected.content) : "");
         try {
             if (!node_fs_1.default.existsSync(fullPath)) {