@peakflo/agent-harness 0.2.14-rc.2 → 0.2.14-rc.3

package/dist/node-floor.d.ts

@@ -1,18 +1,15 @@
 /**
  * THE NODE.JS FLOOR, CHECKED AT START.
  *
- * `package.json` says `engines.node: ">=22.19"`. npm treats that as advice: on
+ * `package.json` declares the patched supported Node lines. npm treats that as advice: on
  * an older Node it prints EBADENGINE and installs anyway, and `npx` then starts
  * the runner as if nothing was wrong. So the floor was a line in a manifest
  * that nothing enforced.
  *
- * WHERE THE FLOOR COMES FROM. Not from this package's own code — that needs
- * `node:sqlite` without a flag (Node 22.13). It comes from Pi, the one backend
- * this runner runs turns with: `@earendil-works/pi-coding-agent` declares
- * `engines.node >=22.19.0`, and Pi's launcher is `#!/usr/bin/env node`, so Pi
- * normally runs on the same Node as the runner. Pi 1.1.0 was seen to start on
- * 22.14 (`--version`, `--list-models`), and nobody has shown that a full turn
- * works there. An upstream requirement that is not proven false is kept.
+ * WHERE THE FLOOR COMES FROM. The October 2026 Node.js security release sets
+ * the current minimum for each supported line. The prior 22.19 floor came
+ * from Pi: `@earendil-works/pi-coding-agent` declares `engines.node >=22.19.0`,
+ * and its launcher uses the same Node as the runner.
  *
  * WHAT HAPPENS BELOW THE FLOOR. A desktop or self-hosted runner refuses to
  * start, with one line that says what to do. `PF_ALLOW_UNSUPPORTED_NODE=1`
@@ -27,6 +24,8 @@
 /** Parse `22.19`, `v22.19.0`, `>=22.19` into numbers. Null when it is none of those. */
 export declare function parseNodeVersion(text: string): number[] | null;
 export declare function isNodeVersionAtLeast(current: string, floor: string): boolean;
+/** Match the supported-line range in engines.node without accepting an unpatched major. */
+export declare function isNodeVersionInEngineRange(current: string, range: string): boolean;
 export type NodeFloorVerdict = {
     action: 'start';
 } | {

package/dist/node-floor.js

@@ -2,18 +2,15 @@
 /**
  * THE NODE.JS FLOOR, CHECKED AT START.
  *
- * `package.json` says `engines.node: ">=22.19"`. npm treats that as advice: on
+ * `package.json` declares the patched supported Node lines. npm treats that as advice: on
  * an older Node it prints EBADENGINE and installs anyway, and `npx` then starts
  * the runner as if nothing was wrong. So the floor was a line in a manifest
  * that nothing enforced.
  *
- * WHERE THE FLOOR COMES FROM. Not from this package's own code — that needs
- * `node:sqlite` without a flag (Node 22.13). It comes from Pi, the one backend
- * this runner runs turns with: `@earendil-works/pi-coding-agent` declares
- * `engines.node >=22.19.0`, and Pi's launcher is `#!/usr/bin/env node`, so Pi
- * normally runs on the same Node as the runner. Pi 1.1.0 was seen to start on
- * 22.14 (`--version`, `--list-models`), and nobody has shown that a full turn
- * works there. An upstream requirement that is not proven false is kept.
+ * WHERE THE FLOOR COMES FROM. The October 2026 Node.js security release sets
+ * the current minimum for each supported line. The prior 22.19 floor came
+ * from Pi: `@earendil-works/pi-coding-agent` declares `engines.node >=22.19.0`,
+ * and its launcher uses the same Node as the runner.
  *
  * WHAT HAPPENS BELOW THE FLOOR. A desktop or self-hosted runner refuses to
  * start, with one line that says what to do. `PF_ALLOW_UNSUPPORTED_NODE=1`
@@ -28,6 +25,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseNodeVersion = parseNodeVersion;
 exports.isNodeVersionAtLeast = isNodeVersionAtLeast;
+exports.isNodeVersionInEngineRange = isNodeVersionInEngineRange;
 exports.checkNodeFloor = checkNodeFloor;
 /** Parse `22.19`, `v22.19.0`, `>=22.19` into numbers. Null when it is none of those. */
 function parseNodeVersion(text) {
@@ -50,12 +48,41 @@ function isNodeVersionAtLeast(current, floor) {
     }
     return true;
 }
+/** Match the supported-line range in engines.node without accepting an unpatched major. */
+function isNodeVersionInEngineRange(current, range) {
+    if (!range.includes('||'))
+        return isNodeVersionAtLeast(current, range);
+    const have = parseNodeVersion(current);
+    if (!have)
+        return true;
+    const clauses = range.split('||').map((clause) => clause.trim());
+    const matches = clauses.map((clause) => {
+        const caret = /^\^(\d+\.\d+\.\d+)$/.exec(clause);
+        if (caret) {
+            const minimum = parseNodeVersion(caret[1]);
+            return (minimum !== null &&
+                have[0] === minimum[0] &&
+                isNodeVersionAtLeast(current, caret[1]));
+        }
+        const bounded = /^>=(\d+\.\d+\.\d+)\s+<(\d+)$/.exec(clause);
+        if (bounded) {
+            return (have[0] < Number(bounded[2]) &&
+                isNodeVersionAtLeast(current, bounded[1]));
+        }
+        return null;
+    });
+    // An unreadable manifest range should not refuse a runner, as with an unreadable version.
+    return matches.includes(null) || matches.some(Boolean);
+}
 function checkNodeFloor(input) {
-    if (!input.floor || isNodeVersionAtLeast(input.current, input.floor)) {
+    if (!input.floor || isNodeVersionInEngineRange(input.current, input.floor)) {
         return { action: 'start' };
     }
     const need = (parseNodeVersion(input.floor) ?? []).slice(0, 2).join('.');
-    const problem = `pf-agent-harness needs Node.js ${need} or newer; this is Node.js ${input.current}.`;
+    const requirement = input.floor.includes('||')
+        ? `a patched Node.js release (${input.floor})`
+        : `Node.js ${need} or newer`;
+    const problem = `pf-agent-harness needs ${requirement}; this is Node.js ${input.current}.`;
     const allowed = /^(1|true|yes|on)$/i.test((input.env.PF_ALLOW_UNSUPPORTED_NODE ?? '').trim());
     if (allowed) {
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peakflo/agent-harness",
-  "version": "0.2.14-rc.2",
+  "version": "0.2.14-rc.3",
   "description": "Headless Peakflo coding-agent harness. One codebase, three hosting modes: a Daytona cloud sandbox, a customer VM, and the 20x desktop.",
   "license": "MIT",
   "type": "commonjs",
@@ -18,7 +18,7 @@
     "credentialHandoff": "ipc"
   },
   "engines": {
-    "node": ">=22.19"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1 <27"
   },
   "publishConfig": {
     "access": "public",
@@ -36,7 +36,7 @@
     "@types/node": "^22.10.0",
     "tsx": "^4.19.3",
     "typescript": "^5.7.2",
-    "undici": "^7.21.0"
+    "undici": "^7.30.1"
   },
   "dependencies": {
     "@modelcontextprotocol/client": "2.0.0",