@proagentstore/cli 0.1.18 → 0.1.20

package/dist/browser-runner/server.js

@@ -84,6 +84,62 @@ async function route(runner, req, res) {
         const limit = clampLimit(url.searchParams.get("limit"), 100, 500);
         return json(res, 200, { events: runner.store.listEvents(limit) });
     }
+    // ── Brain-driven browser control (remote LLM acts on the live page) ─────
+    if (req.method === "POST" && path === "/browser/snapshot") {
+        const b = await readJson(req).catch(() => ({}));
+        return json(res, 200, await runner.browserSnapshot(b.taskId));
+    }
+    if (req.method === "POST" && path === "/browser/act") {
+        const body = await readJson(req);
+        return json(res, 200, await runner.browserAct(body, body.resumePath));
+    }
+    if (req.method === "POST" && path === "/browser/event") {
+        const b = await readJson(req);
+        return json(res, 200, runner.browserEvent(b.taskId, b.type, b.message, b.data));
+    }
+    if (req.method === "POST" && path === "/browser/handoff") {
+        const b = await readJson(req);
+        return json(res, 200, await runner.browserHandoff(b.taskId, b.label ?? b.challenge ?? "this step", b.reason ?? "challenge"));
+    }
+    if (req.method === "POST" && path === "/browser/handoff-status") {
+        const b = await readJson(req);
+        return json(res, 200, await runner.browserHandoffStatus(b.taskId));
+    }
+    if (req.method === "POST" && path === "/browser/resume") {
+        const b = await readJson(req);
+        return json(res, 200, await runner.browserResume(b.taskId));
+    }
+    if (req.method === "POST" && path === "/browser/input") {
+        const b = await readJson(req);
+        return json(res, 200, runner.browserSubmitInput(b.taskId, String(b.value ?? "")));
+    }
+    if (req.method === "POST" && path === "/browser/complete") {
+        const b = await readJson(req);
+        return json(res, 200, await runner.browserComplete(b.taskId, b.outcome, b.detail));
+    }
+    // ── Human takeover (remote view + control) ──────────────────────────────
+    if (req.method === "GET" && path === "/takeover") {
+        return json(res, 200, { takeovers: runner.listTakeovers() });
+    }
+    const frameMatch = path.match(/^\/takeover\/([^/]+)\/frame$/);
+    if (req.method === "GET" && frameMatch) {
+        return json(res, 200, await runner.takeoverFrame(frameMatch[1]));
+    }
+    const inputMatch = path.match(/^\/takeover\/([^/]+)\/input$/);
+    if (req.method === "POST" && inputMatch) {
+        const body = await readJson(req);
+        await runner.takeoverInput(inputMatch[1], body);
+        return json(res, 200, { ok: true });
+    }
+    const resumeMatch = path.match(/^\/takeover\/([^/]+)\/resume$/);
+    if (req.method === "POST" && resumeMatch) {
+        return json(res, 200, await runner.resumeTakeover(resumeMatch[1]));
+    }
+    const endMatch = path.match(/^\/takeover\/([^/]+)\/end$/);
+    if (req.method === "POST" && endMatch) {
+        await runner.endTakeover(endMatch[1]);
+        return json(res, 200, { ok: true });
+    }
     return json(res, 404, { error: "Not found" });
 }
 function authorize(req, config) {

package/dist/browser-runner/store.js

@@ -33,6 +33,30 @@ export class RunnerStore {
     getTask(id) {
         return this.read().tasks.find((task) => task.id === id) || null;
     }
+    /**
+     * On process startup, any persisted task still in an in-flight state
+     * (needs_human / running) is orphaned — its live browser page and takeover
+     * session died with the previous process and can't be resumed. Fail them so
+     * they don't linger as stale "Needs you" cards. Returns the count expired.
+     */
+    expireInFlightTasks() {
+        const data = this.read();
+        const now = new Date().toISOString();
+        let expired = 0;
+        for (const task of data.tasks) {
+            if (task.status === "needs_human" || task.status === "running") {
+                task.status = "failed";
+                task.error =
+                    "Runner restarted — this paused task was orphaned (its browser session is gone). Re-run it to try again.";
+                task.updatedAt = now;
+                task.completedAt = now;
+                expired += 1;
+            }
+        }
+        if (expired > 0)
+            this.write(data);
+        return expired;
+    }
     putTask(task) {
         const data = this.read();
         const index = data.tasks.findIndex((row) => row.id === task.id);

package/dist/browser-runner/test-job-server.js

@@ -32,7 +32,12 @@ async function route(req, res, submissions) {
         return;
     }
     if (req.method === "GET" && url.pathname === "/jobs/software-engineer") {
-        html(res, 200, jobPage());
+        html(res, 200, jobPage({
+            challenge: url.searchParams.get("challenge") === "1",
+            hcaptcha: url.searchParams.get("hcaptcha") === "1",
+            invisibleRecaptcha: url.searchParams.get("invisible_recaptcha") === "1",
+            recaptcha: url.searchParams.get("recaptcha") === "1",
+        }));
         return;
     }
     if (req.method === "POST" && url.pathname === "/apply") {
@@ -57,7 +62,28 @@ async function route(req, res, submissions) {
     }
     html(res, 404, "<h1>Not found</h1>");
 }
-function jobPage() {
+function jobPage(opts = {}) {
+    let challenge = "";
+    if (opts.hcaptcha) {
+        // Real hCaptcha widget using hCaptcha's official always-passes TEST sitekey
+        // — lets a human actually solve a challenge end-to-end with zero real-world impact.
+        challenge =
+            '<div class="h-captcha" data-sitekey="10000000-ffff-ffff-ffff-000000000001"></div>\n        <script src="https://js.hcaptcha.com/1/api.js" async defer></script>';
+    }
+    else if (opts.invisibleRecaptcha) {
+        // The invisible v3 badge — present on countless pages, needs NO human. Must
+        // NOT be treated as a challenge (the false positive that bailed to the user).
+        challenge =
+            '<div class="grecaptcha-badge"><iframe title="reCAPTCHA" src="https://example.test/recaptcha/api2/anchor?size=invisible&k=x" style="width:256px;height:60px;display:block"></iframe></div>';
+    }
+    else if (opts.recaptcha) {
+        // A VISIBLE "I'm not a robot" checkbox — a real human challenge.
+        challenge =
+            '<div class="g-recaptcha"><iframe title="reCAPTCHA" src="https://example.test/recaptcha/api2/anchor?k=x" style="width:304px;height:78px;display:block"></iframe></div>';
+    }
+    else if (opts.challenge) {
+        challenge = '<div class="cf-turnstile" data-sitekey="test">Verify you are human</div>';
+    }
     return page("Senior Software Engineer", `
     <main>
       <section class="job">
@@ -82,6 +108,7 @@ function jobPage() {
         </label>
         <label>Resume <input name="resume" type="file" accept=".pdf,.txt,.doc,.docx" required /></label>
         <label>Cover note <textarea name="coverNote" rows="5" required></textarea></label>
+        ${challenge}
         <button type="submit">Submit application</button>
       </form>
     </main>

package/dist/index.js

@@ -618,8 +618,21 @@ import { chmod, mkdir, writeFile } from "fs/promises";
 import { gunzipSync } from "zlib";
 import { arch, homedir as homedir2, platform } from "os";
 import { resolve as resolve4 } from "path";
+import { createServer as createServer2 } from "net";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { Command as Command6 } from "commander";
+async function findFreePort2(start) {
+  for (let p = start; p < start + 25; p++) {
+    const free = await new Promise((res) => {
+      const s = createServer2();
+      s.once("error", () => res(false));
+      s.once("listening", () => s.close(() => res(true)));
+      s.listen(p, "127.0.0.1");
+    });
+    if (free) return p;
+  }
+  return start;
+}
 var runnerCommand = createRunnerCommand();
 function runnerBaseUrl(url) {
   return (clean(url) || clean(process.env.PAGS_RUNNER_URL) || "http://127.0.0.1:49171").replace(/\/$/, "");
@@ -628,7 +641,7 @@ function pagsApiBase(url) {
   return (clean(url) || clean(process.env.PAGS_API_BASE) || "https://api.proagentstore.online").replace(/\/$/, "");
 }
 function pagsHeaders(token) {
-  const resolved = clean(token) || clean(process.env.PAGS_TOKEN);
+  const resolved = clean(token) || clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token);
   return resolved ? { Authorization: `Bearer ${resolved}` } : {};
 }
 function runnerRequestHeaders(opts) {
@@ -898,7 +911,7 @@ function createRunnerCommand() {
   command.command("connect <instanceId>").description("Start the local FAGS runtime, open a Cloudflare quick tunnel, and register it with PAGS").option("--host <host>", "Host to bind", "127.0.0.1").option("--port <port>", "Port to bind", "49171").option("--data-dir <path>", "Runner data directory").option("--token <token>", "Runner bearer token. Defaults to PAGS_RUNNER_TOKEN or a generated token").option("--headless", "Run Playwright headless").option("--api-base <url>", "PAGS API base URL").option("--pags-token <token>", "PAGS session token. Defaults to PAGS_TOKEN").option("--cloudflared <path>", "cloudflared executable").option("--runner-version <version>", "Runner version").option("--skip-probe", "Skip PAGS FAGS-runtime probe after registration").action(async (instanceId, opts) => {
     const runnerToken = clean(opts.token) || clean(process.env.PAGS_RUNNER_TOKEN) || `pags_runner_${randomUUID()}`;
     const host = clean(opts.host) || "127.0.0.1";
-    const port = clean(opts.port) || "49171";
+    const port = clean(opts.port) || String(await findFreePort2(49171));
     const localUrl = `http://${host}:${port}`;
     const runnerOpts = {
       ...opts,
@@ -934,55 +947,86 @@ function createRunnerCommand() {
     try {
       await waitForLocalRunner({ url: localUrl, token: runnerToken, instanceId });
       writeLine(`Local FAGS runtime healthy at ${localUrl}`);
-      const tunnelUrl = await new Promise((resolveTunnel, reject) => {
+      const cloudflaredPath = await resolveCloudflaredCommand(opts.cloudflared);
+      const openTunnel = () => new Promise((resolveTunnel, reject) => {
         let output = "";
-        resolveCloudflaredCommand(opts.cloudflared).then((cloudflared) => {
-          tunnel = spawn2(cloudflared, buildCloudflaredArgs(localUrl), {
-            stdio: ["ignore", "pipe", "pipe"],
-            shell: process.platform === "win32"
-          });
-          const onData = (data) => {
-            const text = data.toString("utf-8");
-            output += text;
-            process.stderr.write(text);
-            const parsed = parseCloudflaredTunnelUrl(output);
-            if (parsed) resolveTunnel(parsed);
-          };
-          tunnel.stdout?.on("data", onData);
-          tunnel.stderr?.on("data", onData);
-          tunnel.on("error", reject);
-          tunnel.on("exit", (code) => {
-            if (code && code !== 0) reject(new Error(`cloudflared exited with code ${code}`));
-          });
-        }).catch(reject);
+        const proc = spawn2(cloudflaredPath, buildCloudflaredArgs(localUrl), {
+          stdio: ["ignore", "pipe", "pipe"],
+          shell: process.platform === "win32"
+        });
+        const onData = (data) => {
+          output += data.toString("utf-8");
+          const parsed = parseCloudflaredTunnelUrl(output);
+          if (parsed) resolveTunnel({ url: parsed, proc });
+        };
+        proc.stdout?.on("data", onData);
+        proc.stderr?.on("data", onData);
+        proc.on("error", reject);
         setTimeout(() => reject(new Error("timed out waiting for cloudflared tunnel URL")), 45e3).unref();
       });
-      writeLine(`Tunnel ready: ${tunnelUrl}`);
-      const capabilities = await requestRunner("GET", "/capabilities", {
-        url: localUrl,
-        token: runnerToken,
-        instanceId
-      });
-      await requestPags("POST", `/v1/instances/${apiPathSegment(instanceId)}/runtime`, opts, {
-        endpointUrl: tunnelUrl,
-        token: runnerToken,
-        placement: "local",
-        capabilities: Array.isArray(capabilities.capabilities) ? capabilities.capabilities.filter((item) => typeof item === "string") : [],
-        runnerVersion: clean(opts.runnerVersion) || ""
-      });
+      const registerRuntime = async (url) => {
+        const capabilities = await requestRunner("GET", "/capabilities", { url: localUrl, token: runnerToken, instanceId });
+        await requestPags("POST", `/v1/instances/${apiPathSegment(instanceId)}/runtime`, opts, {
+          endpointUrl: url,
+          token: runnerToken,
+          placement: "local",
+          capabilities: Array.isArray(capabilities.capabilities) ? capabilities.capabilities.filter((item) => typeof item === "string") : [],
+          runnerVersion: clean(opts.runnerVersion) || ""
+        });
+      };
+      const first = await openTunnel();
+      tunnel = first.proc;
+      let tunnelUrl = first.url;
+      await registerRuntime(tunnelUrl);
       writeLine("Runtime registered with PAGS \u2713");
       writeLine("");
       writeLine("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
       writeLine("  \u2705 CONNECTED \u2014 Browser runner is live");
       writeLine(`  Instance: ${instanceId.slice(0, 8)}...`);
       writeLine(`  Tunnel:   ${tunnelUrl}`);
-      writeLine("  The agent can now submit applications via browser.");
-      writeLine("  Keep this terminal open. Press Ctrl+C to disconnect.");
+      writeLine("  Auto-reconnect is on \u2014 keep this terminal open. Ctrl+C to disconnect.");
       writeLine("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+      let stopped = false;
+      const heartbeatPath = `/v1/instances/${apiPathSegment(instanceId)}/runtime/heartbeat`;
+      const probeTunnel = async (url) => {
+        try {
+          const res = await fetch(`${url.replace(/\/$/, "")}/health`, {
+            headers: { Authorization: `Bearer ${runnerToken}`, "X-PAGS-Instance-Id": instanceId },
+            signal: AbortSignal.timeout(8e3)
+          });
+          return res.ok;
+        } catch {
+          return false;
+        }
+      };
+      void (async () => {
+        while (!stopped) {
+          await new Promise((r) => setTimeout(r, 3e4));
+          if (stopped) break;
+          if (await probeTunnel(tunnelUrl)) {
+            await requestPags("POST", heartbeatPath, opts, {}).catch(() => void 0);
+            continue;
+          }
+          writeLine("\u26A0 Tunnel unreachable \u2014 reconnecting\u2026");
+          try {
+            if (tunnel && !tunnel.killed) tunnel.kill("SIGTERM");
+          } catch {
+          }
+          try {
+            const next = await openTunnel();
+            tunnel = next.proc;
+            tunnelUrl = next.url;
+            await registerRuntime(tunnelUrl);
+            writeLine(`\u2705 Reconnected: ${tunnelUrl}`);
+          } catch (error) {
+            writeError(`reconnect failed (${error instanceof Error ? error.message : String(error)}); retrying in 30s`);
+          }
+        }
+      })();
       await new Promise((resolvePromise) => {
         runner.on("exit", () => resolvePromise());
-        tunnel?.on("exit", () => resolvePromise());
       });
+      stopped = true;
     } catch (error) {
       shutdown();
       throw error;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@proagentstore/cli",
-	"version": "0.1.18",
+	"version": "0.1.20",
 	"description": "CLI for creating, publishing, and running ProAgentStore agents",
 	"license": "MIT",
 	"type": "module",