@proagentstore/cli 0.4.126 → 0.4.127

package/dist/browser-runner/coding/engine-check.js

@@ -1,4 +1,5 @@
 import { spawnSync } from "node:child_process";
+import { unwrapLauncher } from "./launcher-wrapper.js";
 import { statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -66,7 +67,9 @@ export function detectEngineLogin(engine, deps = {}) {
  */
 export function checkEngine(input, deps = {}) {
     const engine = (["claude", "gemini", "codex", "grok", "generic"].includes(input.clientType ?? "") ? input.clientType : "claude");
-    const parsed = parseCommand(input.command);
+    // The ENGINE is what must be installed — after a `pas mcp-auth exec --` wrapper (#1006), not the wrapper.
+    const command = parseCommand(input.command);
+    const parsed = unwrapLauncher(command.bin, command.args);
     const bin = parsed.bin || parseCommand(handlerFor(engine).cliCommand).bin || engine;
     const { binaryPath, via } = resolveEngineSpawn(bin, [], deps);
     const login = input.credentialInjected ? { login: "found", where: "platform" } : detectEngineLogin(engine, deps);

package/dist/browser-runner/coding/headless.js

@@ -1,4 +1,5 @@
 import { InputLedger } from "./input-ledger.js";
+import { spawnTarget, unwrapLauncher } from "./launcher-wrapper.js";
 import { runObjectiveBlock } from "./run-objective.js";
 import { spawn } from "node:child_process";
 import { classifyCommand, commandFromToolInput, fillTargetFromResult, toolCallOk, toolResultMark } from "./engine-acts.js";
@@ -83,6 +84,8 @@ export class HeadlessSession {
     mode;
     adapter;
     cmdBin;
+    /** A launcher wrapper spawned in front of the engine (`pas mcp-auth exec --`), or empty. */
+    cmdPrefix;
     cmdArgs;
     binName;
     /** Wall-clock of the last stdout/stderr byte — drives the persistent-raw idle heuristic. */
@@ -242,7 +245,10 @@ export class HeadlessSession {
     constructor(config) {
         this.config = config;
         this.engineLabel = `${config.clientType}:${config.id}`;
-        const { bin, args } = parseCommand(config.command);
+        // `pas mcp-auth exec -- codex …` (#1006): spawn the wrapper, but drive the engine after `--`.
+        const parsed = parseCommand(config.command);
+        const { prefix, bin, args } = unwrapLauncher(parsed.bin, parsed.args);
+        this.cmdPrefix = prefix;
         // When no explicit command is configured, fall back to THIS engine's default
         // command (codex/gemini/grok/…) — not a hard-coded "claude", which would drive a
         // non-Claude session with the wrong CLI (and mode is already "raw" for it).
@@ -428,7 +434,8 @@ export class HeadlessSession {
         this.buf = "";
         const args = this.adapter.buildLaunchArgs(this.cmdArgs, this.claudeSessionId);
         const env = this.spawnEnv;
-        const launch = resolveEngineSpawn(this.cmdBin, args, { env });
+        const target = spawnTarget(this.cmdPrefix, this.cmdBin, args);
+        const launch = resolveEngineSpawn(target.command, target.args, { env });
         const proc = spawn(launch.command, launch.args, {
             cwd: this.config.workDir,
             env,
@@ -587,7 +594,8 @@ export class HeadlessSession {
             ? buildCodexResumeArgs(this.cmdArgs, resumedCodexThreadId, text)
             : this.adapter.buildTurnArgs(this.cmdArgs, text);
         const env = this.spawnEnv;
-        const launch = resolveEngineSpawn(this.cmdBin, turnArgs, { env });
+        const target = spawnTarget(this.cmdPrefix, this.cmdBin, turnArgs);
+        const launch = resolveEngineSpawn(target.command, target.args, { env });
         const proc = spawn(launch.command, launch.args, {
             cwd: this.config.workDir,
             env,

package/dist/browser-runner/coding/launcher-wrapper.js

@@ -0,0 +1,25 @@
+/**
+ * `pas mcp-auth exec -- <engine …>` (#1006, PAS #356) on the runner.
+ *
+ * The ProAppStore CLI runs a command with the owner's remote PAS MCP credential in that process's
+ * environment only. So the runner must SPAWN the wrapper (it is what supplies the token) while
+ * everything that understands an engine — the adapter choice (`codex exec` → structured), the turn
+ * and resume argument builders, the engine-installed check — works on the ENGINE command after `--`.
+ *
+ * Matched exactly, as in the API (`workers/api/src/lib/coding-command.ts`) and the SDK
+ * (`packages/sdk/src/engine-posture.ts`): `pas` followed by anything other than `mcp-auth exec --`
+ * is not a wrapper, and stays the binary.
+ */
+export const PAS_MCP_AUTH_WRAPPER = ["mcp-auth", "exec", "--"];
+export function unwrapLauncher(bin, args) {
+    const isPas = (bin.split("/").pop() || "").toLowerCase() === "pas";
+    if (!isPas || !PAS_MCP_AUTH_WRAPPER.every((t, k) => args[k] === t) || args.length <= PAS_MCP_AUTH_WRAPPER.length) {
+        return { prefix: [], bin, args: [...args] };
+    }
+    const rest = args.slice(PAS_MCP_AUTH_WRAPPER.length);
+    return { prefix: [bin, ...PAS_MCP_AUTH_WRAPPER], bin: rest[0], args: rest.slice(1) };
+}
+/** What to actually spawn: the wrapper (if any) carrying the engine and its built args. */
+export function spawnTarget(prefix, bin, args) {
+    return prefix.length ? { command: prefix[0], args: [...prefix.slice(1), bin, ...args] } : { command: bin, args: [...args] };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.126",
+  "version": "0.4.127",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",