@proagentstore/cli 0.4.114 → 0.4.116

package/dist/browser-runner/coding/engine-check.js

@@ -1,20 +1,10 @@
 import { spawnSync } from "node:child_process";
-import { accessSync, constants, statSync } from "node:fs";
+import { statSync } from "node:fs";
 import { homedir } from "node:os";
-import { delimiter, isAbsolute, join, resolve } from "node:path";
+import { join } from "node:path";
 import { handlerFor } from "./handlers.js";
 import { parseCommand } from "./headless.js";
-function defaultIsExecutable(p) {
-    try {
-        if (!statSync(p).isFile())
-            return false;
-        accessSync(p, constants.X_OK);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
+import { resolveEngineSpawn } from "./engine-spawn.js";
 function defaultExists(p) {
     try {
         statSync(p);
@@ -29,28 +19,6 @@ function defaultKeychainItemStatus(service) {
     const r = spawnSync("security", ["find-generic-password", "-s", service], { stdio: "ignore", timeout: 5_000 });
     return r.error ? null : r.status;
 }
-/** The same resolution `spawn(bin)` does: a path is taken as-is, a bare name is searched on PATH. */
-export function resolveBinary(bin, deps = {}) {
-    const isExec = deps.isExecutable ?? defaultIsExecutable;
-    if (!bin)
-        return null;
-    if (bin.includes("/") || isAbsolute(bin)) {
-        const p = resolve(bin);
-        return isExec(p) ? p : null;
-    }
-    const env = deps.env ?? process.env;
-    const exts = (deps.platform ?? process.platform) === "win32" ? (env.PATHEXT || ".EXE;.CMD;.BAT").split(";") : [""];
-    for (const dir of (env.PATH || "").split(delimiter)) {
-        if (!dir)
-            continue;
-        for (const ext of exts) {
-            const p = join(dir, bin + ext);
-            if (isExec(p))
-                return p;
-        }
-    }
-    return null;
-}
 /** Does this engine have a stored interactive login on the machine? */
 export function detectEngineLogin(engine, deps = {}) {
     const env = deps.env ?? process.env;
@@ -100,14 +68,14 @@ export function checkEngine(input, deps = {}) {
     const engine = (["claude", "gemini", "codex", "grok", "generic"].includes(input.clientType ?? "") ? input.clientType : "claude");
     const parsed = parseCommand(input.command);
     const bin = parsed.bin || parseCommand(handlerFor(engine).cliCommand).bin || engine;
-    const binaryPath = resolveBinary(bin, deps);
+    const { binaryPath, via } = resolveEngineSpawn(bin, [], deps);
     const login = input.credentialInjected ? { login: "found", where: "platform" } : detectEngineLogin(engine, deps);
     return {
         checked: true,
         engine,
         bin,
         binaryFound: binaryPath !== null,
-        ...(binaryPath ? { binaryPath } : {}),
+        ...(binaryPath ? { binaryPath, binaryVia: via } : {}),
         login: login.login,
         ...(login.where ? { loginWhere: login.where } : {}),
     };

package/dist/browser-runner/coding/engine-env.js

@@ -7,9 +7,11 @@
  * getting a raise. `engine-auth.ts` READS this env; this builds it.
  *
  *  1. {@link mergeEnv} — the platform's overlay over the machine's, where empty means REMOVE.
- *  2. {@link engineSpawnEnv} — that, plus the `gh` guard ahead of the real binary on `PATH`.
+ *  2. {@link engineSpawnEnv} — that, plus the `gh` guard ahead of the real binary on `PATH`, and the
+ *     `git` stash guard (#1021) ahead of both.
  */
 import { ghGuardEnv } from "./gh-guard.js";
+import { gitGuardEnv } from "./git-guard.js";
 /**
  * Merge the platform's resolved engine env over the machine's, where an EMPTY value means
  * REMOVE rather than "set to empty".
@@ -41,6 +43,7 @@ export function mergeEnv(base, overlay) {
  * `ghGuardEnv` returns its input untouched whenever the guard cannot be installed, so this is safe
  * in front of every spawn: the failure mode is the machine's own `gh`, never a missing one.
  */
-export function engineSpawnEnv(overlay, ghScope, ghGuardRoot) {
-    return ghGuardEnv(mergeEnv(process.env, overlay), ghScope, ghGuardRoot);
+export function engineSpawnEnv(overlay, ghScope, ghGuardRoot, gitGuardRoot) {
+    // The git guard needs no scope: no session may restore or discard the stash by position (#1021).
+    return gitGuardEnv(ghGuardEnv(mergeEnv(process.env, overlay), ghScope, ghGuardRoot), gitGuardRoot);
 }

package/dist/browser-runner/coding/engine-spawn.js

@@ -0,0 +1,99 @@
+import { accessSync, constants, readFileSync, statSync } from "node:fs";
+import { posix, win32 } from "node:path";
+function defaultIsExecutable(p) {
+    try {
+        if (!statSync(p).isFile())
+            return false;
+        accessSync(p, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function defaultReadText(p) {
+    try {
+        return readFileSync(p, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+/** Windows env names are case-insensitive, but a copied env object is not (`Path`, `ComSpec`). */
+function envVar(env, name, windows) {
+    if (!windows)
+        return env[name];
+    const key = Object.keys(env).find((k) => k.toUpperCase() === name);
+    return key ? env[key] : undefined;
+}
+const isPathLike = (bin, windows) => bin.includes("/") || (windows ? bin.includes("\\") || win32.isAbsolute(bin) : posix.isAbsolute(bin));
+/** The same resolution `spawn(bin)` does: a path is taken as-is, a bare name is searched on PATH (with PATHEXT on Windows). */
+export function resolveBinary(bin, deps = {}) {
+    const isExec = deps.isExecutable ?? defaultIsExecutable;
+    if (!bin)
+        return null;
+    const windows = (deps.platform ?? process.platform) === "win32";
+    const path = windows ? win32 : posix;
+    if (isPathLike(bin, windows)) {
+        const p = path.resolve(bin);
+        return isExec(p) ? p : null;
+    }
+    const env = deps.env ?? process.env;
+    const exts = windows ? (envVar(env, "PATHEXT", true) || ".EXE;.CMD;.BAT").split(";") : [""];
+    for (const dir of (envVar(env, "PATH", windows) || "").split(path.delimiter)) {
+        if (!dir)
+            continue;
+        for (const ext of exts) {
+            const p = path.join(dir, bin + ext);
+            if (isExec(p))
+                return p;
+        }
+    }
+    return null;
+}
+/** The first `%dp0%\node_modules\…` target an npm (cmd-shim) `.cmd` launches, absolute. */
+export function shimTarget(shimPath, text) {
+    const m = /"%~?dp0%?\\(node_modules\\[^"]+)"/i.exec(text);
+    return m ? win32.join(win32.dirname(shimPath), m[1]) : null;
+}
+// cmd.exe metacharacters (cross-spawn's set). A caret makes the next one literal for one parse.
+const CMD_META = /([()\][%!^"`<>&|;, *?])/g;
+/**
+ * One argument for `cmd.exe /s /c "<shim> <args>"`: quoted for the CRT's argv parser, then
+ * caret-escaped twice — once for cmd's own parse, once more for the shim's `%*` re-parse.
+ */
+export function quoteCmdArg(arg) {
+    let a = arg.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\*)$/, "$1$1");
+    a = `"${a}"`;
+    return a.replace(CMD_META, "^$1").replace(CMD_META, "^$1");
+}
+export function resolveEngineSpawn(bin, args, deps = {}) {
+    const windows = (deps.platform ?? process.platform) === "win32";
+    if (!windows)
+        return { command: bin, args, binaryPath: resolveBinary(bin, deps), via: "direct" };
+    const env = deps.env ?? process.env;
+    // Real executables first: PATHEXT order would otherwise pick `.CMD` over a later `.EXE` in no order we chose.
+    const exe = resolveBinary(bin, { ...deps, env: { ...env, PATHEXT: ".exe;.com" } });
+    const found = exe ?? resolveBinary(bin, { ...deps, env: { ...env, PATHEXT: ".cmd;.bat" } });
+    if (!found)
+        return { command: bin, args, binaryPath: null, via: "direct" };
+    if (!/\.(cmd|bat)$/i.test(found))
+        return { command: found, args, binaryPath: found, via: "direct" };
+    const isExec = deps.isExecutable ?? defaultIsExecutable;
+    const text = (deps.readText ?? defaultReadText)(found);
+    const target = text ? shimTarget(found, text) : null;
+    if (target && isExec(target)) {
+        if (/\.(exe|com)$/i.test(target))
+            return { command: target, args, binaryPath: target, via: "direct" };
+        if (/\.[cm]?js$/i.test(target))
+            return { command: deps.nodePath ?? process.execPath, args: [target, ...args], binaryPath: target, via: "node" };
+    }
+    const line = [found.replace(CMD_META, "^$1"), ...args.map(quoteCmdArg)].join(" ");
+    return {
+        command: envVar(env, "COMSPEC", true) || "cmd.exe",
+        args: ["/d", "/s", "/c", `"${line}"`],
+        windowsVerbatimArguments: true,
+        binaryPath: found,
+        via: "cmd",
+    };
+}

package/dist/browser-runner/coding/git-guard.js

@@ -0,0 +1,146 @@
+/**
+ * The Engine may not restore or discard the repo-global stash by POSITION (#1021).
+ *
+ * ── The incident
+ *
+ * Setting up a fail-before comparison, an Engine composed `SRC="a.ts b.ts"; git stash push -- $SRC;
+ * …; git stash pop`. zsh passed `$SRC` as ONE pathspec, so the save failed and created nothing — and
+ * the chained `pop` restored the top of the stack anyway: someone else's retained recovery stash,
+ * applied into the active checkout as merge conflicts. The stash is repo-global; `pop`, `drop` and
+ * `stash@{n}` name a position in everyone's stack, not the thing this command saved.
+ *
+ * The Pilot's `no_stash_restore` refusal (`workers/api/src/lib/coding-scope-constraints.ts`) only
+ * screens what the PILOT sends. The incident command was composed by the Engine itself, which
+ * runs with `--dangerously-skip-permissions`, so the only enforcement point it cannot talk its way
+ * past is the `git` it executes. This is that point.
+ *
+ * ── What the shim does
+ *
+ * A POSIX `sh` script named `git`, first on every Engine's `PATH` (all engines, every session —
+ * unlike the `gh` guard it needs no scope). For `git [global options] stash <action> …`:
+ *
+ *   pop, drop, clear     refused — each consumes or discards by position, and there is no form of
+ *                        them that names an exact object.
+ *   apply, branch        allowed only with an exact object id (40 or 64 hex) — what `git stash
+ *                        create` printed — so a restore is tied to an object this command made.
+ *
+ * Refusal exits {@link GIT_REFUSED_EXIT} BEFORE git runs, with {@link GIT_REFUSED_MARKER} on stderr.
+ * Everything else — including `git stash push`, `list`, `show`, `create` — is `exec`'d to the real
+ * git with its own exit status. Its tests run THIS text against real temporary repositories.
+ *
+ * ── What it does not stop, stated rather than hidden
+ *
+ * {@link GIT_GUARD_GAPS}: a PATH shim is bypassed by an absolute `/usr/bin/git` or a rewritten PATH,
+ * and a git alias that expands to `stash pop` is resolved inside git, past the shim.
+ */
+import { createHash } from "node:crypto";
+import { accessSync, constants, existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+/** Distinct from git's own 1/128/129, so a refusal is recognisable from its status alone. */
+export const GIT_REFUSED_EXIT = 3;
+export const GIT_REFUSED_MARKER = "pags: refused";
+export const GIT_GUARD_GAPS = [
+    "A PATH shim is bypassable: invoking git by absolute path (/usr/bin/git), or rewriting PATH, skips it.",
+    "A git alias that expands to `stash pop`/`drop`/`clear` is expanded inside git, past the shim.",
+];
+export function gitGuardRoot() {
+    return join(homedir(), ".config", "proagentstore", "git-guard");
+}
+/** The first executable `git` on `path` that is not one of our own shims. */
+export function findRealGit(path, guardRoot) {
+    for (const dir of (path ?? "").split(":")) {
+        if (!dir || dir.startsWith(guardRoot))
+            continue;
+        const candidate = join(dir, "git");
+        try {
+            accessSync(candidate, constants.X_OK);
+            return candidate;
+        }
+        catch {
+            /* not here — keep looking */
+        }
+    }
+    return null;
+}
+const sq = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
+export function renderGitShim(realGit) {
+    return `#!/bin/sh
+# ProAgentStore git stash guard (#1021) — GENERATED. Source of truth:
+# packages/browser-runner/src/coding/git-guard.ts. Editing this file lets an agent restore or discard
+# someone else's stash; that is a bypass, not a configuration.
+REAL=${sq(realGit)}
+
+state=global; skip=0; sub=""; action=""; ref1=""; ref2=""
+for a in "$@"; do
+  if [ "$skip" = 1 ]; then skip=0; continue; fi
+  if [ "$state" = global ]; then
+    case "$a" in
+      -C|-c|--git-dir|--work-tree|--namespace|--config-env|--super-prefix) skip=1 ;;
+      -*) : ;;
+      *) sub="$a"; state=args ;;
+    esac
+    continue
+  fi
+  [ "$sub" = stash ] || break
+  case "$a" in
+    -*) : ;;
+    *) if [ -z "$action" ]; then action="$a"; elif [ -z "$ref1" ]; then ref1="$a"; elif [ -z "$ref2" ]; then ref2="$a"; fi ;;
+  esac
+done
+
+refuse() {
+  echo "${GIT_REFUSED_MARKER}: \\\`git stash $action\\\` $1 The stash is shared by everyone working in this repository, so a position in it is not what you saved." >&2
+  echo "Restore only an exact object you just created: S=\\$(git stash create) && [ -n \\"\\$S\\" ] && … && git stash apply \\"\\$S\\" — or compare in an isolated \\\`git worktree add --detach\\\` checkout, which never touches the stash." >&2
+  exit ${GIT_REFUSED_EXIT}
+}
+
+exact_object() {
+  case "$1" in ""|*[!0-9a-f]*) return 1 ;; esac
+  [ \${#1} -eq 40 ] || [ \${#1} -eq 64 ]
+}
+
+if [ "$sub" = stash ]; then
+  case "$action" in
+    pop) refuse "restores and DROPS the top of the stack, whoever saved it." ;;
+    drop) refuse "discards a stack entry by position." ;;
+    clear) refuse "discards every entry, including other people's recovery work." ;;
+    apply) exact_object "$ref1" || refuse "needs an exact object id, not a stack position (got '\${ref1:-top of stack}')." ;;
+    branch) exact_object "$ref2" || refuse "needs an exact object id, not a stack position (got '\${ref2:-top of stack}')." ;;
+  esac
+fi
+
+exec "$REAL" "$@"
+`;
+}
+const installed = new Map();
+/** Install (idempotently) the shim and return its directory, or null when it cannot be. */
+export function installGitGuard(env, root = gitGuardRoot()) {
+    const realGit = findRealGit(env.PATH, root);
+    if (!realGit)
+        return null;
+    const script = renderGitShim(realGit);
+    const key = createHash("sha256").update(`${root} ${script}`).digest("hex").slice(0, 16);
+    const cached = installed.get(key);
+    if (cached)
+        return cached;
+    const dir = join(root, key);
+    try {
+        mkdirSync(dir, { recursive: true });
+        const shim = join(dir, "git");
+        if (!existsSync(shim))
+            writeFileSync(shim, script, { mode: 0o755 });
+        installed.set(key, dir);
+        return dir;
+    }
+    catch {
+        // The gh guard's rule: a runner that cannot write its own config dir still runs the Engine,
+        // with the machine's git — never with a `git` that does not exist.
+        return null;
+    }
+}
+/** `env` with the guard first on PATH; untouched when it could not be installed. */
+export function gitGuardEnv(env, root) {
+    const dir = installGitGuard(env, root);
+    return dir ? { ...env, PATH: `${dir}:${env.PATH ?? ""}` } : env;
+}

package/dist/browser-runner/coding/headless.js

@@ -7,6 +7,7 @@ import { appendTurnTail, turnReportFromExit, turnReportFromResult } from "./engi
 import { renderToolResult, shortInput, stripAnsi } from "./transcript-lines.js";
 import { authoredTurn, authorTag } from "./turn-author.js";
 import { engineSpawnEnv, mergeEnv } from "./engine-env.js";
+import { resolveEngineSpawn } from "./engine-spawn.js";
 import { ghGuardStatus } from "./gh-guard.js";
 import { handlerFor } from "./handlers.js";
 import { resolveEngineAuth } from "./engine-auth.js";
@@ -426,10 +427,13 @@ export class HeadlessSession {
         this.inputs.newEngine();
         this.buf = "";
         const args = this.adapter.buildLaunchArgs(this.cmdArgs, this.claudeSessionId);
-        const proc = spawn(this.cmdBin, args, {
+        const env = this.spawnEnv;
+        const launch = resolveEngineSpawn(this.cmdBin, args, { env });
+        const proc = spawn(launch.command, launch.args, {
             cwd: this.config.workDir,
-            env: this.spawnEnv,
+            env,
             stdio: ["pipe", "pipe", "pipe"],
+            windowsVerbatimArguments: launch.windowsVerbatimArguments,
         });
         this.proc = proc;
         this.run = "idle";
@@ -582,10 +586,13 @@ export class HeadlessSession {
         const turnArgs = resumedCodexThreadId
             ? buildCodexResumeArgs(this.cmdArgs, resumedCodexThreadId, text)
             : this.adapter.buildTurnArgs(this.cmdArgs, text);
-        const proc = spawn(this.cmdBin, turnArgs, {
+        const env = this.spawnEnv;
+        const launch = resolveEngineSpawn(this.cmdBin, turnArgs, { env });
+        const proc = spawn(launch.command, launch.args, {
             cwd: this.config.workDir,
-            env: this.spawnEnv,
+            env,
             stdio: ["ignore", "pipe", "pipe"],
+            windowsVerbatimArguments: launch.windowsVerbatimArguments,
         });
         // A turn already running is aborted before its replacement starts: `input()` accepts a turn
         // at any time — a human typing in the console, a takeover, a Loop that stopped waiting —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.114",
+  "version": "0.4.116",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",