@proagentstore/cli 0.4.127 → 0.4.129

package/dist/browser-runner/local-apply/runtime.js

@@ -129,7 +129,7 @@ export function parseApplyEnvelope(raw) {
         workspace: o.workspace,
         sources,
         artifacts,
-        policy: { mode: p.mode, allowDomains, ...(p.mode === "auto_submit" && gateId ? { submitGate: { gateId } } : {}) },
+        policy: { mode: p.mode, allowDomains, ...(p.mode === "auto_submit" && gateId ? { submitGate: { gateId } } : {}), ...(p.screenshots === false ? { screenshots: false } : {}) },
         limits,
     };
 }
@@ -310,7 +310,8 @@ export class LocalApplyRuntime {
             token: randomBytes(24).toString("hex"),
             state: "running",
             events: [],
-            shots: new ShotRecorder(APPLY_SHOT_CAP, () => this.now()),
+            // Screenshots off (#1064): zero cap for `/shots`, and no recorder handed to the bridge below.
+            shots: new ShotRecorder(envelope.policy.screenshots === false ? 0 : APPLY_SHOT_CAP, () => this.now()),
             seq: 0,
             allow: new Set(envelope.policy.allowDomains),
             grounding: [],
@@ -396,7 +397,7 @@ export class LocalApplyRuntime {
             limits: e.limits,
             mode: e.policy.mode,
             gateId: e.policy.submitGate?.gateId,
-        }, run.shots);
+        }, e.policy.screenshots === false ? undefined : run.shots);
         if (spec.mcpConfig)
             writeFileSync(spec.mcpConfig.path, spec.mcpConfig.json, { mode: 0o600 });
         const child = this.spawn(spec.command, spec.args, { cwd: join(run.dir, "scratch"), env: spec.env, stdio: ["ignore", "pipe", "pipe"] });

package/dist/browser-runner/local-artifact/contract.js

@@ -28,6 +28,12 @@ export const LOCAL_ARTIFACT_ENGINES = ["claude", "codex"];
 export const LOCAL_ARTIFACT_AUTH_MODES = ["machine", "subscription"];
 export const LOCAL_ARTIFACT_SOURCE_ROLES = ["resume", "profile", "answers"];
 export const REQUIRED_SOURCE_ROLES = ["resume", "profile"];
+/**
+ * The owner's saved answers to earlier blocking questions (#1066), sent by PAGS from the owner's
+ * Profile and given to the CLI as one more citable source under this role. Not a file source: it
+ * never appears in `sources`, `sourceHashes` or a path, and an older runner simply ignores it.
+ */
+export const OWNER_ANSWERS_ROLE = "owner_answers";
 export const LOCAL_ARTIFACT_BLOCK_REASONS = [
     "missing_source",
     "malformed_lead",
@@ -52,7 +58,7 @@ export const LOCAL_ARTIFACT_EVENT_TYPES = [
 ];
 export const LOCAL_ARTIFACT_ENGINE_AUTHS = ["machine-login", "subscription", "api-key", "missing_login", "unknown"];
 export const LOCAL_ARTIFACT_PARSE_ATTEMPTS = ["fenced_json", "balanced_object"];
-export const LOCAL_ARTIFACT_CAPS = { questions: 20, questionChars: 300, sources: 6, sourceBytes: 256 * 1024 };
+export const LOCAL_ARTIFACT_CAPS = { questions: 20, questionChars: 300, sources: 6, sourceBytes: 256 * 1024, ownerAnswers: 30, ownerAnswerChars: 500 };
 /** An id used as a folder name: no separators, no dots, nothing a path could be built out of. */
 export const PATH_SEGMENT = /^[A-Za-z0-9_-]{1,100}$/;
 /** A source path inside the workspace: relative, no `..`, no absolute, no NUL, no backslash. */

package/dist/browser-runner/local-artifact/engine.js

@@ -20,6 +20,7 @@
 import { mergeEnv } from "../coding/engine-env.js";
 import { resolveEngineAuth } from "../coding/engine-auth.js";
 import { finalText as finalTextFromEngine, missingLogin } from "../local-browser/engine.js";
+import { OWNER_ANSWERS_ROLE } from "./contract.js";
 export { missingLogin };
 const PROVIDER_KEYS = ["ANTHROPIC_API_KEY", "OPENAI_API_KEY"];
 const SUBSCRIPTION_TOKEN = "CLAUDE_CODE_OAUTH_TOKEN";
@@ -51,6 +52,10 @@ export function buildArtifactEngineSpec(input) {
     };
 }
 /** The brief. The rules are stated, but the checks in `checkDraft` are what enforce them. */
+/** The owner's saved answers as one source text: a question and its answer per pair (#1066). */
+export function ownerAnswersText(answers) {
+    return answers.map((a) => `Q: ${a.question}\nA: ${a.answer}`).join("\n\n");
+}
 export function tailorPrompt(lead, sources) {
     const l = lead.lead;
     const job = [
@@ -78,6 +83,9 @@ export function tailorPrompt(lead, sources) {
         '- For EVERY factual claim about the owner in either document, add an entry to "claims" with the claim, the source role it comes from, and a short VERBATIM quote copied exactly from that source.',
         "- Every year, email address and phone number you write must appear in the sources.",
         "- Reword and reorder to fit the job; do not add what the sources do not say. Leave out what does not fit.",
+        ...(sources.some((x) => x.role === OWNER_ANSWERS_ROLE)
+            ? [`- <source role="${OWNER_ANSWERS_ROLE}"> holds the owner's own answers to questions asked on earlier applications. They are the owner's facts and preferences: use them, cite them like any source, and do not ask again a question they already answer.`]
+            : []),
         '- If something the application needs is missing or uncertain, do not guess: answer {"status":"needs_human","questions":["…"]} instead.',
         "",
         "Answer shape when you can do it:",

package/dist/browser-runner/local-artifact/runtime.js

@@ -28,8 +28,8 @@ import { join, resolve, sep } from "node:path";
 import { RunnerInputError } from "../errors.js";
 import { redactText, secretEnvValues } from "../local-browser/contract.js";
 import { resolveWorkspacePath } from "../local-browser/runtime.js";
-import { LOCAL_ARTIFACT_AUTH_MODES, LOCAL_ARTIFACT_CAPS, LOCAL_ARTIFACT_ENGINES, LOCAL_ARTIFACT_SOURCE_ROLES, LOCAL_ARTIFACT_TASK_TYPE, PATH_SEGMENT, REQUIRED_SOURCE_ROLES, isHomeRelative, isWorkspaceRelative, parseLocalArtifactLead, } from "./contract.js";
-import { buildArtifactEngineSpec, checkDraft, finalText, missingLogin, observedArtifactAuth, parseDraft, tailorPrompt } from "./engine.js";
+import { LOCAL_ARTIFACT_AUTH_MODES, LOCAL_ARTIFACT_CAPS, OWNER_ANSWERS_ROLE, LOCAL_ARTIFACT_ENGINES, LOCAL_ARTIFACT_SOURCE_ROLES, LOCAL_ARTIFACT_TASK_TYPE, PATH_SEGMENT, REQUIRED_SOURCE_ROLES, isHomeRelative, isWorkspaceRelative, parseLocalArtifactLead, } from "./contract.js";
+import { buildArtifactEngineSpec, checkDraft, finalText, missingLogin, observedArtifactAuth, ownerAnswersText, parseDraft, tailorPrompt } from "./engine.js";
 /** The manifest in every generated folder — what retention reads, and proof the folder is ours. */
 export const ARTIFACT_MANIFEST = ".pags-artifact.json";
 const MAX_EVENTS = 200;
@@ -87,6 +87,18 @@ export function parseArtifactEnvelope(raw) {
         if (uploadedSources.length !== 2 || !uploadedSources.some((s) => s.role === "resume") || !uploadedSources.some((s) => s.role === "profile"))
             throw bad("uploaded sources need one resume and one profile");
     }
+    // The owner's saved answers to earlier questions (#1066): optional, bounded, plain text only.
+    const ownerAnswers = [];
+    if (o.ownerAnswers !== undefined) {
+        if (!Array.isArray(o.ownerAnswers) || o.ownerAnswers.length > LOCAL_ARTIFACT_CAPS.ownerAnswers)
+            throw bad(`ownerAnswers must be a list of at most ${LOCAL_ARTIFACT_CAPS.ownerAnswers}`);
+        for (const a of o.ownerAnswers) {
+            const r = (a && typeof a === "object" ? a : {});
+            if (typeof r.question !== "string" || !r.question.trim() || r.question.length > LOCAL_ARTIFACT_CAPS.questionChars || typeof r.answer !== "string" || !r.answer.trim() || r.answer.length > LOCAL_ARTIFACT_CAPS.ownerAnswerChars)
+                throw bad("each owner answer needs a question and an answer within their caps");
+            ownerAnswers.push({ question: r.question.trim(), answer: r.answer.trim() });
+        }
+    }
     const p = (o.policy && typeof o.policy === "object" ? o.policy : {});
     const retainDays = intIn(p.retainDays, 0, 3650);
     const maxMinutes = intIn(p.maxMinutes, 1, 60);
@@ -104,6 +116,7 @@ export function parseArtifactEnvelope(raw) {
         workspace: o.workspace,
         sources,
         ...(uploadedSources.length ? { uploadedSources } : {}),
+        ...(ownerAnswers.length ? { ownerAnswers } : {}),
         policy: { retainDays, maxMinutes, maxConcurrent },
         ...("lead" in lead ? { lead: lead.lead } : { lead: null, leadError: lead.error }),
     };
@@ -235,6 +248,12 @@ export class LocalArtifactRuntime {
         }
         if (missing.length)
             throw new Pause("missing_source", missing);
+        // The owner's saved answers go in as one more source the CLI may cite (#1066). Not a file, so no
+        // source hash or path; the count alone is recorded, never the text.
+        if (e.ownerAnswers?.length) {
+            texts.push({ role: OWNER_ANSWERS_ROLE, text: ownerAnswersText(e.ownerAnswers) });
+            this.emit(run, { type: "source.read", detail: { role: OWNER_ANSWERS_ROLE, count: e.ownerAnswers.length } });
+        }
         const outRel = `applications/${lead.leadId}/${e.runId}`;
         const outDir = join(workspace, "applications", lead.leadId, e.runId);
         try {

package/dist/browser-runner/local-browser/runtime.js

@@ -104,6 +104,7 @@ export function parseEnvelope(raw) {
             consentedDomains: strList(p.consentedDomains),
             profileConsented: p.profileConsented === true,
             consentIds: consentIdMap(p.consentIds),
+            ...(p.screenshots === false ? { screenshots: false } : {}),
         },
         limits,
         resultSchema: { id: typeof schema.id === "string" ? schema.id : "findings", version: typeof schema.version === "number" ? schema.version : 1 },
@@ -185,7 +186,9 @@ export class LocalBrowserRuntime {
             token: randomBytes(24).toString("hex"),
             state: "running",
             events: [],
-            shots: new ShotRecorder(SCOUT_SHOT_CAP, () => this.now()),
+            // Screenshots off (#1064): a zero-cap recorder, so `/shots` answers with nothing — and the bridge
+            // below is given NO recorder at all, so no frame is ever attempted.
+            shots: new ShotRecorder(envelope.policy.screenshots === false ? 0 : SCOUT_SHOT_CAP, () => this.now()),
             seq: 0,
             consented: new Set(envelope.policy.consentedDomains),
             deny: new Set(envelope.policy.denyDomains),
@@ -230,7 +233,7 @@ export class LocalBrowserRuntime {
             allowListOnly: () => e.policy.allowDomains.length > 0,
             overTime: () => this.activeMs(run) >= e.limits.maxMinutes * 60_000,
             limits: e.limits,
-        }, run.shots);
+        }, e.policy.screenshots === false ? undefined : run.shots);
         const bridgeScript = this.deps.bridgeScript ?? fileURLToPath(new URL("./bridge-stdio.js", import.meta.url));
         const spec = buildEngineSpec({
             engine: e.engine,

package/dist/browser-runner/runner.js

@@ -1109,7 +1109,7 @@ export class LocalRunner {
                 url: active.url(),
                 title: await active.title().catch(() => ""),
                 challenge: await detectHumanChallenge(active),
-                screenshot: await this.shot(active),
+                screenshot: action.screenshot === false ? undefined : await this.shot(active),
                 commitGuard: { supported: true, mode: guard?.mode },
             };
         }
@@ -1143,7 +1143,7 @@ export class LocalRunner {
                 title: await settled.title().catch(() => ""),
                 challenge: await detectHumanChallenge(settled),
                 feedback: dialogMsg ? `a native dialog was accepted: "${dialogMsg}"` : "a native dialog was accepted",
-                screenshot: await this.shot(settled),
+                screenshot: action.screenshot === false ? undefined : await this.shot(settled),
                 commitGuard: { supported: true, mode: guard?.mode },
             };
         }
@@ -1177,7 +1177,7 @@ export class LocalRunner {
             title: await active.title().catch(() => ""),
             challenge: await detectHumanChallenge(active),
             feedback: feedback || undefined,
-            screenshot: await this.shot(active),
+            screenshot: action.screenshot === false ? undefined : await this.shot(active),
             commitGuard: { supported: true, mode: guard?.mode },
         };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.127",
+  "version": "0.4.129",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",