@proagentstore/cli 0.3.1 → 0.3.3

package/dist/browser-runner/index.js

@@ -55,6 +55,17 @@ Endpoints:
     process.exit(0);
 }
 const config = configFromArgs();
+// SECURITY: the runner's endpoints spawn CLIs and drive a browser as the user.
+// Without a token, `authorize()` allows every request, so a tokenless runner must
+// never be reachable off the local machine. Refuse to start if bound to a
+// non-loopback address without a token. (`pags up` always generates one; this
+// only guards the low-level binary run manually with --host 0.0.0.0 and no token.)
+const LOOPBACK = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+if (!config.token && !LOOPBACK.has(config.host)) {
+    process.stderr.write(`Refusing to start: --host ${config.host} exposes the runner off-machine with no --token. ` +
+        `Set --token (or PAGS_RUNNER_TOKEN), or bind to 127.0.0.1.\n`);
+    process.exit(1);
+}
 const started = await startRunnerServer(config);
 process.stdout.write(`FAGS browser runtime listening at ${started.url}\n`);
 process.stdout.write(`Data dir: ${config.dataDir}\n`);

package/dist/index.js

@@ -379,7 +379,6 @@ import { Command as Command3 } from "commander";
 var CONFIG_DIR = join3(homedir(), ".config", "proagentstore");
 var TOKEN_FILE = join3(CONFIG_DIR, "session.json");
 var API_BASE = "https://api.proagentstore.online";
-var FAS_API = "https://api.freeappstore.online";
 function loadSession() {
   try {
     if (!existsSync3(TOKEN_FILE)) return null;
@@ -422,34 +421,32 @@ var loginCommand = new Command3("login").description("Sign in with Google or Git
         res.end();
         return;
       }
-      const fasSession = url.searchParams.get("fas_session");
-      if (!fasSession) {
+      const session = url.searchParams.get("session");
+      if (!session) {
         res.writeHead(400, { "Content-Type": "text/html" });
         res.end("<h1>Sign-in failed</h1><p>No session received.</p>");
         clearTimeout(timeout);
         server.close();
-        reject(new Error("No fas_session in callback"));
+        reject(new Error("No session in callback"));
         return;
       }
       try {
-        const exchangeRes = await fetch(`${API_BASE}/v1/auth/exchange`, {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ fas_session: fasSession })
+        const meRes = await fetch(`${API_BASE}/v1/auth/me`, {
+          headers: { Authorization: `Bearer ${session}` }
         });
-        const data = await exchangeRes.json();
-        if (!data.token) throw new Error(data.error || "Exchange failed");
+        if (!meRes.ok) throw new Error("Session validation failed");
+        const me = await meRes.json();
         saveSession({
-          token: data.token,
-          user: data.user,
+          token: session,
+          user: { id: me.id, login: me.login, avatar: me.avatar },
           expiresAt: Date.now() + 29 * 24 * 60 * 60 * 1e3
           // ~29 days
         });
         res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(`<h1>Signed in as ${data.user?.login}</h1><p>You can close this tab and return to the terminal.</p><script>window.close()</script>`);
+        res.end(`<h1>Signed in as ${me.login}</h1><p>You can close this tab and return to the terminal.</p><script>window.close()</script>`);
         clearTimeout(timeout);
         server.close();
-        resolve5(data.token);
+        resolve5(session);
       } catch (err) {
         res.writeHead(500, { "Content-Type": "text/html" });
         res.end(`<h1>Sign-in failed</h1><p>${err instanceof Error ? err.message : String(err)}</p>`);
@@ -460,8 +457,8 @@ var loginCommand = new Command3("login").description("Sign in with Google or Git
     });
     server.listen(port, "127.0.0.1");
   });
-  const oauthBase = provider === "google" ? `${FAS_API}/v1/auth/google/start` : `${FAS_API}/v1/auth/github/start`;
-  const oauthUrl = `${oauthBase}?app_id=pags-cli&response_mode=query&return_to=${encodeURIComponent(callbackUrl)}`;
+  const oauthBase = provider === "google" ? `${API_BASE}/v1/auth/google/start` : `${API_BASE}/v1/auth/github/start`;
+  const oauthUrl = `${oauthBase}?return_to=${encodeURIComponent(callbackUrl)}`;
   const open = (await import("child_process")).exec;
   const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
   open(`${cmd} "${oauthUrl}"`);
@@ -827,7 +824,8 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
     }
   }
   for (const id of instanceIds) {
-    openRelaySocket(id, apiBase, pagsToken, localUrl, runnerToken, force);
+    const mintToken = () => requestPags("POST", `/v1/relay/${apiPathSegment(id)}/token`, { ...opts, pagsToken }, {}).then((r) => r.token);
+    openRelaySocket(id, apiBase, mintToken, localUrl, runnerToken, force);
   }
   writeLine("Runtime registered with PAGS \u2713");
   writeLine("");
@@ -847,11 +845,24 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
   };
   heartbeat();
 }
-function openRelaySocket(instanceId, wsBase, pagsToken, localUrl, runnerToken, force = false) {
+function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, force = false) {
   let backoffMs = 1e3;
   let reconnecting = false;
-  const connect = () => {
-    const url = `${wsBase}/v1/relay/${encodeURIComponent(instanceId)}/connect?token=${encodeURIComponent(pagsToken)}${force ? "&force=1" : ""}`;
+  const connect = async () => {
+    let relayToken;
+    try {
+      relayToken = await mintToken();
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      const hint = /401|token|sign/i.test(msg) ? " (run `pags login`)" : "";
+      writeLine(`Relay token mint failed: ${instanceId.slice(0, 8)}\u2026${hint} \u2014 retrying in ${Math.round(backoffMs / 1e3)}s`);
+      setTimeout(() => {
+        connect();
+      }, backoffMs);
+      backoffMs = Math.min(backoffMs * 2, 3e4);
+      return;
+    }
+    const url = `${wsBase}/v1/relay/${encodeURIComponent(instanceId)}/connect?token=${encodeURIComponent(relayToken)}${force ? "&force=1" : ""}`;
     const ws = new WebSocket(url);
     ws.onopen = () => {
       backoffMs = 1e3;

package/package.json

@@ -1,46 +1,46 @@
 {
-  "name": "@proagentstore/cli",
-  "version": "0.3.1",
-  "description": "CLI for creating, publishing, and running ProAgentStore agents",
-  "license": "MIT",
-  "type": "module",
-  "bin": {
-    "pags": "dist/index.js"
-  },
-  "homepage": "https://github.com/ProAgentStore/platform#readme",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/ProAgentStore/platform.git",
-    "directory": "packages/cli"
-  },
-  "keywords": [
-    "proagentstore",
-    "pags",
-    "cli",
-    "agents",
-    "mcp",
-    "browser-runner"
-  ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "scripts": {
-    "build": "pnpm --filter @proagentstore/browser-runner build && tsup src/index.ts --format esm --dts && node scripts/copy-browser-runner.mjs",
-    "dev": "tsx src/index.ts",
-    "typecheck": "tsc --noEmit"
-  },
-  "dependencies": {
-    "chalk": "^5.6.2",
-    "commander": "^13.0.0",
-    "playwright": "^1.60.0"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "tsup": "^8.4.0",
-    "tsx": "^4.21.0",
-    "typescript": "^5.7.0"
-  },
-  "files": [
-    "dist"
-  ]
+	"name": "@proagentstore/cli",
+	"version": "0.3.3",
+	"description": "CLI for creating, publishing, and running ProAgentStore agents",
+	"license": "MIT",
+	"type": "module",
+	"bin": {
+		"pags": "dist/index.js"
+	},
+	"homepage": "https://github.com/ProAgentStore/platform#readme",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/ProAgentStore/platform.git",
+		"directory": "packages/cli"
+	},
+	"keywords": [
+		"proagentstore",
+		"pags",
+		"cli",
+		"agents",
+		"mcp",
+		"browser-runner"
+	],
+	"publishConfig": {
+		"access": "public"
+	},
+	"scripts": {
+		"build": "pnpm --filter @proagentstore/browser-runner build && tsup src/index.ts --format esm --dts && node scripts/copy-browser-runner.mjs",
+		"dev": "tsx src/index.ts",
+		"typecheck": "tsc --noEmit"
+	},
+	"dependencies": {
+		"chalk": "^5.6.2",
+		"commander": "^13.0.0",
+		"playwright": "^1.60.0"
+	},
+	"devDependencies": {
+		"@types/node": "^22.0.0",
+		"tsup": "^8.4.0",
+		"tsx": "^4.21.0",
+		"typescript": "^5.7.0"
+	},
+	"files": [
+		"dist"
+	]
 }