@proagentstore/cli 0.4.115 → 0.4.117

package/dist/bootstrap.js

@@ -8,7 +8,7 @@ import {
   newestPayload,
   olderThan,
   payloadAt
-} from "./chunk-RGNU4W6B.js";
+} from "./chunk-LQ57ADUG.js";
 
 // src/bootstrap.ts
 import { existsSync } from "fs";

package/dist/browser-runner/coding/engine-env.js

@@ -7,9 +7,11 @@
  * getting a raise. `engine-auth.ts` READS this env; this builds it.
  *
  *  1. {@link mergeEnv} — the platform's overlay over the machine's, where empty means REMOVE.
- *  2. {@link engineSpawnEnv} — that, plus the `gh` guard ahead of the real binary on `PATH`.
+ *  2. {@link engineSpawnEnv} — that, plus the `gh` guard ahead of the real binary on `PATH`, and the
+ *     `git` stash guard (#1021) ahead of both.
  */
 import { ghGuardEnv } from "./gh-guard.js";
+import { gitGuardEnv } from "./git-guard.js";
 /**
  * Merge the platform's resolved engine env over the machine's, where an EMPTY value means
  * REMOVE rather than "set to empty".
@@ -41,6 +43,7 @@ export function mergeEnv(base, overlay) {
  * `ghGuardEnv` returns its input untouched whenever the guard cannot be installed, so this is safe
  * in front of every spawn: the failure mode is the machine's own `gh`, never a missing one.
  */
-export function engineSpawnEnv(overlay, ghScope, ghGuardRoot) {
-    return ghGuardEnv(mergeEnv(process.env, overlay), ghScope, ghGuardRoot);
+export function engineSpawnEnv(overlay, ghScope, ghGuardRoot, gitGuardRoot) {
+    // The git guard needs no scope: no session may restore or discard the stash by position (#1021).
+    return gitGuardEnv(ghGuardEnv(mergeEnv(process.env, overlay), ghScope, ghGuardRoot), gitGuardRoot);
 }

package/dist/browser-runner/coding/git-guard.js

@@ -0,0 +1,146 @@
+/**
+ * The Engine may not restore or discard the repo-global stash by POSITION (#1021).
+ *
+ * ── The incident
+ *
+ * Setting up a fail-before comparison, an Engine composed `SRC="a.ts b.ts"; git stash push -- $SRC;
+ * …; git stash pop`. zsh passed `$SRC` as ONE pathspec, so the save failed and created nothing — and
+ * the chained `pop` restored the top of the stack anyway: someone else's retained recovery stash,
+ * applied into the active checkout as merge conflicts. The stash is repo-global; `pop`, `drop` and
+ * `stash@{n}` name a position in everyone's stack, not the thing this command saved.
+ *
+ * The Pilot's `no_stash_restore` refusal (`workers/api/src/lib/coding-scope-constraints.ts`) only
+ * screens what the PILOT sends. The incident command was composed by the Engine itself, which
+ * runs with `--dangerously-skip-permissions`, so the only enforcement point it cannot talk its way
+ * past is the `git` it executes. This is that point.
+ *
+ * ── What the shim does
+ *
+ * A POSIX `sh` script named `git`, first on every Engine's `PATH` (all engines, every session —
+ * unlike the `gh` guard it needs no scope). For `git [global options] stash <action> …`:
+ *
+ *   pop, drop, clear     refused — each consumes or discards by position, and there is no form of
+ *                        them that names an exact object.
+ *   apply, branch        allowed only with an exact object id (40 or 64 hex) — what `git stash
+ *                        create` printed — so a restore is tied to an object this command made.
+ *
+ * Refusal exits {@link GIT_REFUSED_EXIT} BEFORE git runs, with {@link GIT_REFUSED_MARKER} on stderr.
+ * Everything else — including `git stash push`, `list`, `show`, `create` — is `exec`'d to the real
+ * git with its own exit status. Its tests run THIS text against real temporary repositories.
+ *
+ * ── What it does not stop, stated rather than hidden
+ *
+ * {@link GIT_GUARD_GAPS}: a PATH shim is bypassed by an absolute `/usr/bin/git` or a rewritten PATH,
+ * and a git alias that expands to `stash pop` is resolved inside git, past the shim.
+ */
+import { createHash } from "node:crypto";
+import { accessSync, constants, existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+/** Distinct from git's own 1/128/129, so a refusal is recognisable from its status alone. */
+export const GIT_REFUSED_EXIT = 3;
+export const GIT_REFUSED_MARKER = "pags: refused";
+export const GIT_GUARD_GAPS = [
+    "A PATH shim is bypassable: invoking git by absolute path (/usr/bin/git), or rewriting PATH, skips it.",
+    "A git alias that expands to `stash pop`/`drop`/`clear` is expanded inside git, past the shim.",
+];
+export function gitGuardRoot() {
+    return join(homedir(), ".config", "proagentstore", "git-guard");
+}
+/** The first executable `git` on `path` that is not one of our own shims. */
+export function findRealGit(path, guardRoot) {
+    for (const dir of (path ?? "").split(":")) {
+        if (!dir || dir.startsWith(guardRoot))
+            continue;
+        const candidate = join(dir, "git");
+        try {
+            accessSync(candidate, constants.X_OK);
+            return candidate;
+        }
+        catch {
+            /* not here — keep looking */
+        }
+    }
+    return null;
+}
+const sq = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
+export function renderGitShim(realGit) {
+    return `#!/bin/sh
+# ProAgentStore git stash guard (#1021) — GENERATED. Source of truth:
+# packages/browser-runner/src/coding/git-guard.ts. Editing this file lets an agent restore or discard
+# someone else's stash; that is a bypass, not a configuration.
+REAL=${sq(realGit)}
+
+state=global; skip=0; sub=""; action=""; ref1=""; ref2=""
+for a in "$@"; do
+  if [ "$skip" = 1 ]; then skip=0; continue; fi
+  if [ "$state" = global ]; then
+    case "$a" in
+      -C|-c|--git-dir|--work-tree|--namespace|--config-env|--super-prefix) skip=1 ;;
+      -*) : ;;
+      *) sub="$a"; state=args ;;
+    esac
+    continue
+  fi
+  [ "$sub" = stash ] || break
+  case "$a" in
+    -*) : ;;
+    *) if [ -z "$action" ]; then action="$a"; elif [ -z "$ref1" ]; then ref1="$a"; elif [ -z "$ref2" ]; then ref2="$a"; fi ;;
+  esac
+done
+
+refuse() {
+  echo "${GIT_REFUSED_MARKER}: \\\`git stash $action\\\` $1 The stash is shared by everyone working in this repository, so a position in it is not what you saved." >&2
+  echo "Restore only an exact object you just created: S=\\$(git stash create) && [ -n \\"\\$S\\" ] && … && git stash apply \\"\\$S\\" — or compare in an isolated \\\`git worktree add --detach\\\` checkout, which never touches the stash." >&2
+  exit ${GIT_REFUSED_EXIT}
+}
+
+exact_object() {
+  case "$1" in ""|*[!0-9a-f]*) return 1 ;; esac
+  [ \${#1} -eq 40 ] || [ \${#1} -eq 64 ]
+}
+
+if [ "$sub" = stash ]; then
+  case "$action" in
+    pop) refuse "restores and DROPS the top of the stack, whoever saved it." ;;
+    drop) refuse "discards a stack entry by position." ;;
+    clear) refuse "discards every entry, including other people's recovery work." ;;
+    apply) exact_object "$ref1" || refuse "needs an exact object id, not a stack position (got '\${ref1:-top of stack}')." ;;
+    branch) exact_object "$ref2" || refuse "needs an exact object id, not a stack position (got '\${ref2:-top of stack}')." ;;
+  esac
+fi
+
+exec "$REAL" "$@"
+`;
+}
+const installed = new Map();
+/** Install (idempotently) the shim and return its directory, or null when it cannot be. */
+export function installGitGuard(env, root = gitGuardRoot()) {
+    const realGit = findRealGit(env.PATH, root);
+    if (!realGit)
+        return null;
+    const script = renderGitShim(realGit);
+    const key = createHash("sha256").update(`${root} ${script}`).digest("hex").slice(0, 16);
+    const cached = installed.get(key);
+    if (cached)
+        return cached;
+    const dir = join(root, key);
+    try {
+        mkdirSync(dir, { recursive: true });
+        const shim = join(dir, "git");
+        if (!existsSync(shim))
+            writeFileSync(shim, script, { mode: 0o755 });
+        installed.set(key, dir);
+        return dir;
+    }
+    catch {
+        // The gh guard's rule: a runner that cannot write its own config dir still runs the Engine,
+        // with the machine's git — never with a `git` that does not exist.
+        return null;
+    }
+}
+/** `env` with the guard first on PATH; untouched when it could not be installed. */
+export function gitGuardEnv(env, root) {
+    const dir = installGitGuard(env, root);
+    return dir ? { ...env, PATH: `${dir}:${env.PATH ?? ""}` } : env;
+}

package/dist/{chunk-RGNU4W6B.js → chunk-LQ57ADUG.js}

@@ -2,7 +2,7 @@
 import { execFile } from "child_process";
 import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, renameSync, rmSync } from "fs";
 import { homedir } from "os";
-import { join } from "path";
+import { join, win32 } from "path";
 import { promisify } from "util";
 var run = promisify(execFile);
 var CLI_PACKAGE = "@proagentstore/cli";
@@ -47,9 +47,32 @@ function cachedPayloads(root = payloadRoot()) {
 function newestPayload(payloads) {
   return payloads.reduce((best, p) => !best || olderThan(best.version, p.version) ? p : best, null);
 }
+var CMD_META = /([()\][%!^"`<>&|;, *?])/g;
+function quoteCmdArg(arg) {
+  const quoted = `"${arg.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\*)$/, "$1$1")}"`;
+  return quoted.replace(CMD_META, "^$1").replace(CMD_META, "^$1");
+}
+var envVar = (env, name) => env[Object.keys(env).find((k) => k.toUpperCase() === name) ?? name];
+function npmInvocation(args, deps = {}) {
+  if ((deps.platform ?? process.platform) !== "win32") return { file: "npm", args };
+  const env = deps.env ?? process.env;
+  const exists = deps.exists ?? existsSync;
+  const execPath = deps.execPath ?? process.execPath;
+  const cli = (dir) => win32.join(dir, "node_modules", "npm", "bin", "npm-cli.js");
+  const onPath = (envVar(env, "PATH") ?? "").split(";").filter((dir) => dir && exists(win32.join(dir, "npm.cmd")));
+  for (const dir of [...onPath, win32.dirname(execPath)]) {
+    if (exists(cli(dir))) return { file: execPath, args: [cli(dir), ...args] };
+  }
+  const line = ["npm", ...args.map(quoteCmdArg)].join(" ");
+  return { file: envVar(env, "COMSPEC") || "cmd.exe", args: ["/d", "/s", "/c", `"${line}"`], windowsVerbatimArguments: true };
+}
+function runNpm(args, options) {
+  const npm = npmInvocation(args);
+  return run(npm.file, npm.args, { ...options, ...npm.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {} });
+}
 async function latestPublishedVersion(timeoutMs = 3e4, signal) {
   try {
-    const { stdout } = await run("npm", ["view", CLI_PACKAGE, "version"], { timeout: timeoutMs, signal });
+    const { stdout } = await runNpm(["view", CLI_PACKAGE, "version"], { timeout: timeoutMs, signal });
     return stdout.trim() || null;
   } catch {
     return null;
@@ -57,7 +80,7 @@ async function latestPublishedVersion(timeoutMs = 3e4, signal) {
 }
 async function npmInstallInto(dir, version) {
   try {
-    await run("npm", ["install", "--prefix", dir, "--omit=dev", "--no-audit", "--no-fund", "--no-save", `${CLI_PACKAGE}@${version}`], { timeout: 5 * 6e4 });
+    await runNpm(["install", "--prefix", dir, "--omit=dev", "--no-audit", "--no-fund", "--no-save", `${CLI_PACKAGE}@${version}`], { timeout: 5 * 6e4 });
   } catch (e) {
     const stderr = String(e.stderr ?? "").trim();
     throw new Error((stderr || (e instanceof Error ? e.message : String(e))).slice(-400));
@@ -96,6 +119,7 @@ export {
   payloadAt,
   cachedPayloads,
   newestPayload,
+  runNpm,
   latestPublishedVersion,
   installPayload
 };

package/dist/index.js

@@ -5,8 +5,9 @@ import {
   installPayload,
   isVersion,
   latestPublishedVersion,
-  olderThan
-} from "./chunk-RGNU4W6B.js";
+  olderThan,
+  runNpm
+} from "./chunk-LQ57ADUG.js";
 
 // src/index.ts
 import { createRequire as createRequire3 } from "module";
@@ -1256,9 +1257,7 @@ function sampleResources(read = os, now = Date.now(), extra = {}) {
 }
 
 // src/commands/runner/self-update.ts
-import { execFile, spawn as spawn3 } from "child_process";
-import { promisify } from "util";
-var run = promisify(execFile);
+import { spawn as spawn3 } from "child_process";
 var RUNNER_UPDATE_PATH = "/pags/runner/update";
 var RUNNER_RESTART_PATH = "/pags/runner/restart";
 var RUNNER_RESTART_EXIT_CODE = 75;
@@ -1306,7 +1305,7 @@ function restartUpArgs(opts) {
 }
 function planRunnerUpdate(f) {
   if (f.fromSource) return { action: "refused", current: f.current, reason: "This runner runs from a source checkout \u2014 update it with `git pull` there, not npm." };
-  if (!f.latest) return { action: "refused", current: f.current, reason: `npm could not be asked for the latest ${CLI_PACKAGE} from this machine.` };
+  if (!f.latest) return { action: "refused", current: f.current, reason: `npm could not be asked for the latest ${CLI_PACKAGE} from this machine.`, retryable: true };
   if (!olderThan(f.current, f.latest)) return { action: "up-to-date", current: f.current };
   if (!f.restarter) {
     return {
@@ -1346,7 +1345,7 @@ async function installVersion(version2) {
     return;
   }
   try {
-    await run("npm", ["i", "-g", `${CLI_PACKAGE}@${version2}`], { timeout: 5 * 6e4 });
+    await runNpm(["i", "-g", `${CLI_PACKAGE}@${version2}`], { timeout: 5 * 6e4 });
   } catch (e) {
     const stderr = String(e.stderr ?? "").trim();
     throw new Error((stderr || (e instanceof Error ? e.message : String(e))).slice(-400));
@@ -1984,7 +1983,8 @@ var AutomaticUpdateController = class {
       return;
     }
     if (plan.action === "refused") {
-      this.deps.status("unsupported", { reason: plan.reason });
+      if (plan.retryable) this.failures++;
+      this.deps.status(plan.retryable ? "failure" : "unsupported", { reason: plan.reason });
       this.schedule();
       return;
     }
@@ -2073,16 +2073,35 @@ function isWorkShape(work) {
   const w2 = work;
   return count(w2.codingTurns) && count(w2.localRuns) && Array.isArray(w2.detail) && w2.detail.every((item) => typeof item === "string");
 }
+function sessionStateOf(session) {
+  if (!session || typeof session !== "object") return "unknown";
+  const s = session;
+  if (s.alive === false) return "stopped";
+  const state = typeof s.runState === "string" && s.runState ? s.runState : null;
+  if (s.alive !== true || !state) return "unknown";
+  return state === "idle" ? "idle_retained" : "active_turn";
+}
+function sessionStateCounts(sessions) {
+  const counts = { activeTurns: 0, idleRetained: 0, stopped: 0, unknown: 0 };
+  for (const session of sessions) {
+    const state = sessionStateOf(session);
+    if (state === "active_turn") counts.activeTurns++;
+    else if (state === "idle_retained") counts.idleRetained++;
+    else if (state === "stopped") counts.stopped++;
+    else counts.unknown++;
+  }
+  return counts;
+}
 function observedRunnerWork(observation) {
   const sessions = observation.sessions;
   const work = observation.work;
   if (!Array.isArray(sessions) || !isWorkShape(work)) return ["runner-work-observation-unavailable"];
   const { codingTurns, localRuns, detail } = work;
   const activeCoding = sessions.flatMap((session) => {
-    if (session?.alive === false) return [];
+    const kind = sessionStateOf(session);
+    if (kind === "stopped" || kind === "idle_retained") return [];
     const id = typeof session?.sessionId === "string" && session.sessionId ? session.sessionId : "unidentified-session";
     const state = typeof session?.runState === "string" && session.runState ? session.runState : "unknown";
-    if (session?.alive === true && state === "idle") return [];
     return [`coding session ${id} (${state})`];
   });
   const unmatchedCodingTurns = Math.max(0, codingTurns - activeCoding.length);
@@ -2100,7 +2119,14 @@ function readWorkLook(sessions, health, sampledAt) {
   return {
     busy,
     observations: [
-      { source: "sessions", success: sessionsOk, sampledAt, ...sessions.status === "fulfilled" && !sessionsOk ? { malformed: true } : {} },
+      {
+        source: "sessions",
+        success: sessionsOk,
+        sampledAt,
+        ...sessions.status === "fulfilled" && !sessionsOk ? { malformed: true } : {},
+        // What the readable list held, by lifecycle state — counts only (#1020).
+        ...sessions.status === "fulfilled" && sessionsOk ? { sessionStates: sessionStateCounts(sessions.value.sessions) } : {}
+      },
       { source: "health", success: healthOk, sampledAt, ...health.status === "fulfilled" && !healthOk ? { malformed: true } : {} }
     ]
   };
@@ -2193,7 +2219,7 @@ function createInstallBridge(deps) {
     release(drained);
     throw new BoundExpired(`${what} did not answer within ${(deps.bound?.ms ?? 3e4) / 1e3}s; nothing restarted, and it will be retried.`);
   };
-  const run2 = async (plan, automatic = false, lease) => {
+  const run = async (plan, automatic = false, lease) => {
     if (inFlight || lease && !deps.leaseActive(lease)) return false;
     inFlight = true;
     if (automatic) {
@@ -2240,7 +2266,7 @@ function createInstallBridge(deps) {
     deps.detachAll();
     return true;
   };
-  return { run: run2, inFlight: () => inFlight, installedPendingRestart: () => installedPendingRestart };
+  return { run, inFlight: () => inFlight, installedPendingRestart: () => installedPendingRestart };
 }
 
 // src/commands/runner/relay.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.115",
+  "version": "0.4.117",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",