@proagentstore/cli 0.4.129 → 0.4.131

package/dist/browser-runner/crash-reports.js

@@ -0,0 +1,287 @@
+/**
+ * Durable crash reports for the local runner and the CLI that supervises it (#1087).
+ *
+ * Kept BYTE-IDENTICAL at
+ *
+ *   packages/browser-runner/src/crash-reports.ts
+ *   packages/cli/src/crash-reports.ts
+ *
+ * (`packages/cli/src/crash-reports.test.ts` fails the moment they differ) and imports only Node
+ * built-ins, so the CLI — which bundles the runner but cannot import its source — carries a copy.
+ *
+ * ── What it is for
+ *
+ * A runner crash used to be a line on stderr and nothing else: the runtime's `uncaughtException`
+ * handler printed and moved on, a request that threw answered 500 and was forgotten, and a runtime
+ * killed by a signal made `runner connect` exit with no record of the signal. This keeps a BOUNDED,
+ * SANITIZED record of each on disk — so it survives the process, an offline stretch and a restart —
+ * until the CLI, which holds the account token, has delivered it to the platform (`deliver.ts`
+ * there; `POST /v1/runner/crash-reports`, idempotent by `id`). There it is an `error_log` row that
+ * MCP `list_errors(source: "runner-crash")` reads.
+ *
+ * ── One writer per file
+ *
+ * The runtime writes `<dataDir>/crash-reports.json`; the CLI writes its own file. Nobody else writes
+ * either: the CLI records what it has DELIVERED in its own ledger rather than editing the runtime's
+ * file, so two processes never race on one file. A report delivered twice is harmless — the
+ * platform keeps one row per id.
+ *
+ * ── Atomic writes, and what they do not cover
+ *
+ * Every write goes to a temp file in the same directory, is fsync'd, then renamed over the target.
+ * A rename within one filesystem is atomic, so a reader sees the old file or the new one, never half
+ * of either; an interrupted write leaves a stray `*.tmp`, which is removed the next time the file is
+ * opened. LIMITS, stated rather than hidden:
+ *   - a hard kill or power loss BEFORE the rename loses that one write (the file keeps its previous
+ *     contents) — a crash that kills the process before `record` returns is not recorded;
+ *   - the directory entry is not fsync'd, so a power loss just after the rename can still roll the
+ *     file back to its previous version on some filesystems;
+ *   - SIGKILL and an OOM kill run no handler in the dying process at all — only its PARENT can see
+ *     the signal, which is why the CLI records `runner_exit` itself.
+ *
+ * ── Corruption is evidence, not an empty file
+ *
+ * A file that cannot be parsed is MOVED to `<file>.corrupt-<timestamp>` and reported, never read as
+ * empty and overwritten. Quarantined copies are bounded too ({@link MAX_QUARANTINED}).
+ *
+ * ── Bounds
+ *
+ * At most {@link MAX_REPORTS} reports per file (oldest dropped first, and COUNTED in `dropped`);
+ * a message is clipped to 1000 characters and a stack to 4000, marked as cut; credential-shaped
+ * text is masked. Metadata only (ADR 0004): no request or response bodies, no environment.
+ */
+import { closeSync, copyFileSync, existsSync, fsyncSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, unlinkSync, writeSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+export const MAX_REPORTS = 100;
+export const MAX_QUARANTINED = 5;
+const MAX_MESSAGE = 1000;
+const MAX_STACK = 4000;
+/** Mask credential-shaped text: bearer tokens, API keys, JWTs, `token=…` pairs. */
+export function maskSecrets(text) {
+    return text
+        .replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi, "$1 [redacted]")
+        .replace(/\b(sk-[A-Za-z0-9_-]{8,}|ghp_[A-Za-z0-9]{8,}|gho_[A-Za-z0-9]{8,}|github_pat_[A-Za-z0-9_]{8,}|xox[abp]-[A-Za-z0-9-]{8,}|pags_runner_[A-Za-z0-9-]{8,})/g, "[redacted]")
+        .replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, "[redacted-jwt]")
+        .replace(/\b((?:api[_-]?key|token|secret|password|authorization)\s*[=:]\s*)("?)[^\s"&]{4,}\2/gi, "$1[redacted]");
+}
+/** A stable, non-identifying key for an account — the same as the runner lock's (`runner-lock.ts`). */
+export function crashAccountKey(login) {
+    return createHash("sha256").update(login.trim().toLowerCase()).digest("hex").substring(0, 12);
+}
+/** Clip VISIBLY: a cut value says it was cut and by how much. */
+function clip(text, max) {
+    if (text.length <= max)
+        return text;
+    return `${text.substring(0, max)}\n[cut: showing the first ${max} of ${text.length} characters]`;
+}
+const clean = (value, max) => clip(maskSecrets(String(value ?? "")), max);
+const shortId = (value) => (typeof value === "string" && /^[A-Za-z0-9._:-]{1,128}$/.test(value) ? value : undefined);
+/** The error's message, stack and cause, sanitized and bounded. */
+export function describeError(error) {
+    if (error instanceof Error) {
+        const cause = error.cause;
+        return {
+            message: clean(`${error.name}: ${error.message}`, MAX_MESSAGE),
+            stack: error.stack ? clean(error.stack, MAX_STACK) : undefined,
+            cause: cause === undefined ? undefined : clean(cause instanceof Error ? `${cause.name}: ${cause.message}` : cause, MAX_MESSAGE),
+        };
+    }
+    return { message: clean(error, MAX_MESSAGE) };
+}
+/**
+ * The runtime's own identity for its reports: the build and account `runner connect` passes it in
+ * `PAGS_RUNNER_BUILD` / `PAGS_RUNNER_ACCOUNT`. Absent for a bare `pags runner start`.
+ */
+export function runtimeCrashIdentity(env = process.env) {
+    return { source: "runtime", build: env.PAGS_RUNNER_BUILD || undefined, account: env.PAGS_RUNNER_ACCOUNT || undefined };
+}
+/** Build a report from what is known — every field bounded, ids id-shaped or dropped. */
+export function crashReport(input) {
+    return {
+        id: shortId(input.id) ?? `crash_${randomUUID()}`,
+        at: input.at ?? new Date().toISOString(),
+        source: input.source,
+        kind: input.kind,
+        message: clean(input.message, MAX_MESSAGE),
+        ...(input.stack ? { stack: clean(input.stack, MAX_STACK) } : {}),
+        ...(input.cause ? { cause: clean(input.cause, MAX_MESSAGE) } : {}),
+        ...(input.exitCode !== undefined ? { exitCode: input.exitCode } : {}),
+        ...(input.signal !== undefined ? { signal: input.signal } : {}),
+        ...(shortId(input.build) ? { build: input.build } : {}),
+        ...(shortId(input.account) ? { account: input.account } : {}),
+        ...(shortId(input.instanceId) ? { instanceId: input.instanceId } : {}),
+        ...(shortId(input.sessionId) ? { sessionId: input.sessionId } : {}),
+        ...(shortId(input.taskId) ? { taskId: input.taskId } : {}),
+        ...(input.route ? { route: clean(input.route, 200) } : {}),
+        ...(input.tail?.length ? { tail: input.tail.slice(-20).map((line) => clean(line, 300)) } : {}),
+    };
+}
+/**
+ * Write `data` as JSON atomically: temp file in the same directory, fsync, rename. Throws on
+ * failure — the caller decides whether that may surface.
+ */
+export function writeJsonAtomic(path, data, mode = 0o600) {
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    const fd = openSync(tmp, "w", mode);
+    try {
+        writeSync(fd, `${JSON.stringify(data, null, 2)}\n`);
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    try {
+        renameSync(tmp, path);
+    }
+    catch (error) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            // The temp file is already gone; the rename's own error is the one that matters.
+        }
+        throw error;
+    }
+}
+/** Remove temp files an interrupted {@link writeJsonAtomic} left beside `path`. */
+export function removeStaleTemps(path) {
+    const dir = dirname(path);
+    const prefix = `${basename(path)}.`;
+    if (!existsSync(dir))
+        return;
+    for (const name of readdirSync(dir)) {
+        if (!name.startsWith(prefix) || !name.endsWith(".tmp"))
+            continue;
+        try {
+            unlinkSync(join(dir, name));
+        }
+        catch {
+            // Another process may own it; a temp file is never read, so leaving it is safe.
+        }
+    }
+}
+/**
+ * Read a JSON file. A file that does not parse is MOVED aside to `<path>.corrupt-<timestamp>` —
+ * kept as evidence, and out of the way so the next write cannot overwrite it — and reported as
+ * `quarantined`. At most {@link MAX_QUARANTINED} quarantined copies are kept per file.
+ */
+export function readJsonOrQuarantine(path) {
+    removeStaleTemps(path);
+    if (!existsSync(path))
+        return { status: "missing" };
+    try {
+        return { status: "ok", value: JSON.parse(readFileSync(path, "utf-8")) };
+    }
+    catch (error) {
+        const quarantinedTo = `${path}.corrupt-${new Date().toISOString().replace(/[:.]/g, "-")}`;
+        try {
+            renameSync(path, quarantinedTo);
+        }
+        catch {
+            // Could not move it: keep a COPY instead, so the caller's next write cannot destroy the
+            // only evidence. If even that fails the report says so.
+            try {
+                copyFileSync(path, quarantinedTo);
+            }
+            catch (copyError) {
+                return { status: "quarantined", quarantinedTo: "(not preserved)", error: `${describeError(error).message}; preserving it failed: ${describeError(copyError).message}` };
+            }
+        }
+        pruneQuarantine(path);
+        return { status: "quarantined", quarantinedTo, error: describeError(error).message };
+    }
+}
+function pruneQuarantine(path) {
+    const dir = dirname(path);
+    const prefix = `${basename(path)}.corrupt-`;
+    const copies = readdirSync(dir).filter((name) => name.startsWith(prefix)).sort();
+    const excess = copies.length - MAX_QUARANTINED;
+    for (const name of excess > 0 ? copies.slice(0, excess) : []) {
+        try {
+            unlinkSync(join(dir, name));
+        }
+        catch {
+            // Best-effort pruning; an extra copy is a bounded cost.
+        }
+    }
+}
+/**
+ * One process's crash-report file. Synchronous throughout: it is called from `uncaughtException`
+ * and from an `exit` listener, where nothing asynchronous is guaranteed to run.
+ */
+export class CrashLog {
+    path;
+    base;
+    /** `base` stamps the reports this log writes about ITSELF (a quarantined file). */
+    constructor(path, base = { source: "runtime" }) {
+        this.path = path;
+        this.base = base;
+    }
+    /** Everything still on disk, oldest first. A corrupt file is quarantined and reported, then read as a fresh file. */
+    read() {
+        const got = readJsonOrQuarantine(this.path);
+        if (got.status === "ok") {
+            const reports = Array.isArray(got.value.reports) ? got.value.reports.filter((r) => !!r && typeof r.id === "string") : [];
+            return { reports, dropped: Number(got.value.dropped) || 0 };
+        }
+        if (got.status === "missing")
+            return { reports: [], dropped: 0 };
+        // The quarantine itself is a report in the fresh file, so the evidence is pointed at, not lost.
+        const file = {
+            reports: [crashReport({ ...this.base, kind: "store_corrupt", message: `crash-report file was unreadable and was moved to ${basename(got.quarantinedTo)}: ${got.error}` })],
+            dropped: 0,
+        };
+        this.write(file);
+        return file;
+    }
+    /** Append a report (bounded). Never throws: a crash path must not crash on its own record. */
+    record(report) {
+        try {
+            const file = this.read();
+            if (file.reports.some((r) => r.id === report.id))
+                return true;
+            file.reports.push(report);
+            const over = file.reports.length - MAX_REPORTS;
+            if (over > 0) {
+                file.reports = file.reports.slice(over);
+                file.dropped += over;
+            }
+            this.write(file);
+            return true;
+        }
+        catch (error) {
+            process.stderr.write(`[crash-reports] could not record ${report.kind}: ${describeError(error).message}\n`);
+            return false;
+        }
+    }
+    /** Drop reports by id — only by this file's own writer. */
+    remove(ids) {
+        if (!ids.length)
+            return;
+        const file = this.read();
+        const gone = new Set(ids);
+        file.reports = file.reports.filter((r) => !gone.has(r.id));
+        this.write(file);
+    }
+    write(file) {
+        writeJsonAtomic(this.path, file);
+    }
+}
+/**
+ * Record process-level crashes in `log`. The process keeps running afterwards (a runner that died on
+ * every stray error would drop its relay), so `onCrash` is where a caller adds its own line.
+ */
+export function installCrashHandlers(log, base, onCrash) {
+    process.on("uncaughtException", (error) => {
+        const report = crashReport({ ...base, kind: "uncaught_exception", ...describeError(error) });
+        log.record(report);
+        onCrash?.(report);
+    });
+    process.on("unhandledRejection", (reason) => {
+        const report = crashReport({ ...base, kind: "unhandled_rejection", ...describeError(reason) });
+        log.record(report);
+        onCrash?.(report);
+    });
+}

package/dist/browser-runner/index.js

@@ -1,19 +1,10 @@
 #!/usr/bin/env node
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { CrashLog, crashReport, describeError, installCrashHandlers, runtimeCrashIdentity } from "./crash-reports.js";
 import { startRunnerServer } from "./server.js";
 import { reapOnStartup } from "./reaper.js";
 import { randomUUID } from "node:crypto";
-// Resilience: a stray error in any runtime must NOT take the whole runner down —
-// that drops the tunnel and forces the user to restart `pags up` (and lose their
-// session). Log it and keep serving. Per-component handlers catch most things;
-// this is the last-resort backstop.
-process.on("uncaughtException", (err) => {
-    process.stderr.write(`[runner] uncaught: ${err?.stack || String(err)}\n`);
-});
-process.on("unhandledRejection", (reason) => {
-    process.stderr.write(`[runner] unhandled rejection: ${String(reason)}\n`);
-});
 function arg(name, fallback) {
     const index = process.argv.indexOf(name);
     if (index === -1)
@@ -67,6 +58,18 @@ Endpoints:
     process.exit(0);
 }
 const config = configFromArgs();
+// Resilience: a stray error in any runtime must NOT take the whole runner down —
+// that drops the tunnel and forces the user to restart `pags up` (and lose their
+// session). Keep serving. Per-component handlers catch most things; this is the
+// last-resort backstop — and since #1087 it leaves a DURABLE record, which the CLI
+// delivers to the platform (MCP `list_errors`), instead of a stderr line only.
+// Build and account come from `runner connect` (`runtimeCrashIdentity`); the CLI delivers a report
+// only under the account that wrote it.
+const IDENTITY = runtimeCrashIdentity();
+const crashLog = new CrashLog(join(config.dataDir, "crash-reports.json"), IDENTITY);
+installCrashHandlers(crashLog, IDENTITY, (report) => {
+    process.stderr.write(`[runner] ${report.kind === "uncaught_exception" ? "uncaught" : "unhandled rejection"}: ${report.stack || report.message}\n`);
+});
 // SECURITY: the runner's endpoints spawn CLIs and drive a browser as the user.
 // Without a token, `authorize()` allows every request, so a tokenless runner must
 // never be reachable off the local machine. Refuse to start if bound to a
@@ -83,8 +86,27 @@ if (!config.token && !LOOPBACK.has(config.host)) {
 // machine to load 253. Nothing in-process can clean those up, so we do it here,
 // before we start competing for the same CPU. Narrow by construction: see the
 // SAFETY block in reaper.ts for why the user's real Chrome can never match.
-reapOnStartup((line) => process.stderr.write(`${line}\n`));
-const started = await startRunnerServer(config);
+/** A failure before the runtime serves anything: recorded, said, and the process exits non-zero. */
+function startupFailed(stage, error) {
+    const report = crashReport({ ...IDENTITY, kind: "startup_failure", instanceId: config.instanceId, ...describeError(error), route: stage });
+    crashLog.record(report);
+    process.stderr.write(`[runner] could not start (${stage}): ${report.message}\n`);
+    process.exit(1);
+}
+try {
+    reapOnStartup((line) => process.stderr.write(`${line}\n`));
+}
+catch (error) {
+    // The reaper is housekeeping: its failure is recorded, and the runtime still starts.
+    crashLog.record(crashReport({ ...IDENTITY, kind: "startup_failure", ...describeError(error), route: "reap" }));
+}
+let started;
+try {
+    started = await startRunnerServer(config);
+}
+catch (error) {
+    startupFailed("listen", error);
+}
 process.stdout.write(`ProAgentStore browser runtime listening at ${started.url}\n`);
 process.stdout.write(`Data dir: ${config.dataDir}\n`);
 process.stdout.write("Control plane: PAGS; runtime plane: PAGS; brain placement: PAGS; runner role: tool-executor\n");

package/dist/browser-runner/local-apply/bridge.js

@@ -30,6 +30,7 @@ import { CONFIRMATION_INTERVAL_SECONDS, CONFIRMATION_LOOKS, CONFIRMATION_TEXT_RE
 import { ELEMENT_PROBE_FN } from "../commit-guard.js";
 import { normalize } from "../local-artifact/engine.js";
 import { evaluateResult, hostOf, refRole } from "../local-browser/bridge.js";
+import { looksLikeSignIn, siteKeyOf } from "./site-session.js";
 const READ_TOOLS = new Set(["browser_navigate", "browser_navigate_back", "browser_snapshot", "browser_wait_for"]);
 const FILL_TOOLS = new Set(["browser_type", "browser_select_option"]);
 const BRIDGE_TOOLS = ["upload_artifact", "request_answer", "ready_for_review", "supervisor_checkpoint"];
@@ -314,10 +315,16 @@ export class ApplyBridge {
         if (!blocker)
             return text(toolText);
         this.host.emit({ type: "browser.blocked", url: state.url, domain: host, detail: { reason: blocker } });
+        const site = blocker === "login_required" && host ? siteKeyOf(host) : null;
+        if (site)
+            await this.host.sessions?.beginSignIn(site).catch(() => undefined);
         const ok = await this.pauseFor({ reason: blocker, url: state.url, domain: host }, async () => {
             const after = await this.inspect();
             return !!after && this.blockerOf(after) === null;
         });
+        // A sign-in the owner completed here is remembered for this browser profile (#1094).
+        if (ok && site)
+            await this.recordSignIn(site);
         if (!ok)
             return text(`${host} needs a person (${blocker.replace(/_/g, " ")}) and it was not resolved. Do not work around it. Stop now.`, true);
         return text("Resumed after the owner handled it. Take a browser_snapshot to read the page.");
@@ -664,6 +671,9 @@ export class ApplyBridge {
         const domain = hostOf(before.url) ?? "";
         if (!this.host.isAllowed(domain))
             return this.refuse("browser_click", "submit", `${domain} is not one of this application's sites; nothing was submitted.`, domain);
+        const gate = await this.sessionGate(before.url, domain);
+        if (gate)
+            return gate;
         this.submitAttempted = true;
         this.host.emit({ type: "submit.attempted", url: before.url, domain, detail: { class: "submit", gateId: this.host.gateId } });
         const res = await this.browser.callTool("browser_click", forward);
@@ -681,7 +691,19 @@ export class ApplyBridge {
             this.host.emit({ type: "submit.confirmed", url: at.url, domain: hostOf(at.url) ?? domain, detail: { gateId: this.host.gateId, marker: seen.marker, ...evidence } });
             return text("Submitted, and the site confirmed it. Stop now.");
         }
-        this.blocked = { reason: "submit_unconfirmed", questions: ["The application was submitted but the site did not confirm it. Check the employer's site or your email before anything is retried."] };
+        // Landed on a sign-in page (#1094): the outcome stays `submit_unconfirmed` (#1013 never infers
+        // "not sent" from a redirect), but this profile now knows the site needs a sign-in, so the next
+        // run asks the owner to sign in BEFORE pressing instead of bouncing again.
+        const wall = after && looksLikeSignIn(after.url, after.login) ? this.host.sessions?.learnSignInWall(before.url, after.url) : null;
+        if (wall)
+            this.host.emit({ type: "policy.decision", domain, detail: { tool: "browser_click", class: "session", decision: "learned", reason: "bounced_to_sign_in", site: wall } });
+        this.blocked = {
+            reason: "submit_unconfirmed",
+            questions: [
+                "The application was submitted but the site did not confirm it. Check the employer's site or your email before anything is retried." +
+                    (wall ? ` The site asked for a sign-in, so the next run on this machine will ask you to sign in to ${wall} first.` : ""),
+            ],
+        };
         this.host.emit({ type: "submit.unconfirmed", ...(after ? { url: after.url } : {}), domain, detail: { gateId: this.host.gateId, ...evidence } });
         return text("The submit was pressed but no confirmation was seen. Do not press it again. Stop now.", true);
     }
@@ -705,6 +727,43 @@ export class ApplyBridge {
         }
         return { after, looks: CONFIRMATION_LOOKS };
     }
+    /**
+     * Before an uncertain press (#1094): is this browser profile signed in to the site? If the ledger
+     * says it is not, or its session cookies are gone, the run pauses `login_required` so the owner
+     * signs in ONCE in this same browser (the existing handoff) — and nothing has been pressed, so
+     * there is no submit to be uncertain about. Returns null when the press may go ahead.
+     */
+    async sessionGate(url, domain) {
+        const ledger = this.host.sessions;
+        if (!ledger)
+            return null;
+        const check = await ledger.check(url).catch(() => null);
+        if (!check || check.state === "ok")
+            return null;
+        const site = check.site;
+        this.host.emit({ type: "policy.decision", domain, detail: { tool: "browser_click", class: "session", decision: "paused", reason: `session_${check.reason}`, site } });
+        await ledger.beginSignIn(site).catch(() => undefined);
+        const ok = await this.pauseFor({
+            reason: "login_required",
+            url,
+            domain,
+            question: `Sign in to ${site} in this browser. It is remembered on this machine, so later applications reuse it. Nothing has been submitted.`,
+        });
+        if (!ok) {
+            this.blocked = { reason: "login_required", questions: [`Sign in to ${site} on this machine's application browser, then retry. Nothing was submitted.`] };
+            return this.refuse("browser_click", "submit", `${site} needs a sign-in in this browser and the owner did not complete one. Nothing was submitted. Stop now.`, domain);
+        }
+        await this.recordSignIn(site);
+        return text(`The owner signed in to ${site}; this browser remembers it. Nothing has been submitted. Open the job page again with browser_navigate (${url.split(/[?#]/, 1)[0]}), take a browser_snapshot, and continue from there.`);
+    }
+    async recordSignIn(site) {
+        const ledger = this.host.sessions;
+        if (!ledger)
+            return;
+        const result = await ledger.completeSignIn(site).catch(() => null);
+        if (result)
+            this.host.emit({ type: "policy.decision", detail: { tool: "sign_in", class: "session", decision: "recorded", site, count: result.fingerprint, basis: result.verifiable ? "cookies" : "unverifiable" } });
+    }
     /** A cloud-persisted checkpoint, not a prompt instruction, authorizes each page's writes. */
     requireSupervisor(tool, actionClass) {
         if (this.supervisorApproved)

package/dist/browser-runner/local-apply/contract.js

@@ -179,7 +179,20 @@ const isHttpUrl = (v) => /^https?:\/\/[^\s/]+/i.test(v);
 // from `LOCAL_APPLY_CONFIRMATION_MARKERS`, how many times the page was read, and whether it moved.
 // Each is an id, a count or a boolean — the same whitelist rule as everything else here, so no page
 // text and no typed value can ride along on a `submit.confirmed` / `submit.unconfirmed` event.
-const DETAIL_KEYS = new Set(["engine", "authMode", "engineAuth", "mode", "class", "tool", "decision", "reason", "rule", "role", "kind", "path", "sha256", "bytes", "gateId", "exitCode", "count", "status", "basis", "source", "checkpointId", "directive", "phase", "actions", "filled", "uploaded", "marker", "looks", "urlChanged", "titleChanged", "shot", "point"]);
+const DETAIL_KEYS = new Set(["engine", "authMode", "engineAuth", "mode", "class", "tool", "decision", "reason", "rule", "role", "kind", "path", "sha256", "bytes", "gateId", "exitCode", "count", "status", "basis", "source", "checkpointId", "directive", "phase", "actions", "filled", "uploaded", "marker", "looks", "urlChanged", "titleChanged", "shot", "point", "site"]);
+/**
+ * A page URL as a trace may keep it (#1069): origin and path, no query or fragment — a sign-in page's
+ * carry OAuth state, PKCE values and session ids. "" when it is not an http(s) URL.
+ */
+export function traceUrl(raw) {
+    try {
+        const u = new URL(raw);
+        return u.protocol === "http:" || u.protocol === "https:" ? `${u.origin}${u.pathname}` : "";
+    }
+    catch {
+        return "";
+    }
+}
 /** A validated event, or null. Detail keeps only whitelisted, primitive, bounded values. */
 export function parseLocalApplyEvent(raw) {
     if (!raw || typeof raw !== "object")
@@ -190,9 +203,15 @@ export function parseLocalApplyEvent(raw) {
     if (!type || !at || Number.isNaN(Date.parse(at)))
         return null;
     const event = { type, at };
+    // Origin and path only (#1069): a sign-in page's query and fragment carry OAuth state and session
+    // ids, and the trace is read back verbatim by `application_run` and the console. Same rule as the
+    // #1063 artifact captions, so an older runner that still sends the full URL is covered here too.
     const url = str(o.url, 2000);
-    if (url && isHttpUrl(url))
-        event.url = url;
+    if (url && isHttpUrl(url)) {
+        const kept = traceUrl(url);
+        if (kept)
+            event.url = kept;
+    }
     const domain = str(o.domain, 253);
     if (domain)
         event.domain = domain.toLowerCase();

package/dist/browser-runner/local-apply/live-run-browser.js

@@ -1,18 +1,38 @@
-import { existsSync } from "node:fs";
+import { existsSync, mkdirSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { McpRuntime } from "../mcp-runtime.js";
+import { SiteSessionLedger } from "./site-session.js";
+/**
+ * Where an application profile lives on this machine (#1094) — documented in
+ * `APPLICATION_PROFILES.md` so the owner can find and inspect it:
+ *
+ *   <dataDir>/application-profiles/<profile>/site-sessions.json   which sites it is signed in to (no values)
+ *   <dataDir>/application-profiles/isolated/browser/              the `isolated` profile's browser data
+ *
+ * The `default` profile's browser data is the runner's own browser (`<dataDir>/chrome-profile`, or
+ * the private real-profile copy), which already persisted; only its ledger lives here.
+ */
+export function applicationProfileDir(dataDir, profile) {
+    return join(dataDir, "application-profiles", profile);
+}
+/**
+ * One run at a time per on-disk profile. Chrome locks a user-data-dir to one process, so a second
+ * launch on the same directory would fail obscurely; this says what is happening instead.
+ */
+const inUse = new Set();
 /** Bind application handoff to the run browser, not to the runner-wide active page. */
 export function createLocalApplyBrowserFactory(options) {
     return async (profile, runDir) => {
+        const ledgerPath = join(applicationProfileDir(options.dataDir, profile), "site-sessions.json");
         if (profile === "isolated")
-            return createIsolatedApplyBrowser(runDir, options.headless);
+            return createPersistentApplyBrowser(join(applicationProfileDir(options.dataDir, profile), "browser"), ledgerPath, options.headless);
         const browser = await options.defaultBrowser(profile, runDir);
-        return { ...browser, handoffPage: options.sharedPage };
+        return { ...browser, handoffPage: options.sharedPage, sessions: new SiteSessionLedger(ledgerPath, options.defaultCookies) };
     };
 }
 /**
  * Keep local-apply's browser construction out of `runner.ts`: research uses the generic factory,
- * while application runs get a page-owning isolated context for the scoped handoff.
+ * while application runs get a page-owning persistent context for the scoped handoff.
  */
 export function createRunnerBrowserFactories(options) {
     const browserFor = async (profile, runDir) => {
@@ -22,21 +42,40 @@ export function createRunnerBrowserFactories(options) {
         await mcp.start({ userDataDir: join(runDir, "profile"), headless: options.headless });
         return { tools: mcp, stop: () => mcp.stop() };
     };
-    return { browserFor, applyBrowserFor: createLocalApplyBrowserFactory({ headless: options.headless, defaultBrowser: browserFor, sharedPage: options.sharedPage }) };
+    return {
+        browserFor,
+        applyBrowserFor: createLocalApplyBrowserFactory({
+            headless: options.headless,
+            dataDir: options.dataDir,
+            defaultBrowser: browserFor,
+            defaultCookies: options.defaultCookies,
+            sharedPage: options.sharedPage,
+        }),
+    };
 }
 /**
- * Start the disposable browser context for one application run and retain only its current live
- * page for the bounded takeover adapter.  This deliberately does not seed, copy, or persist an
- * owner profile: the profile remains the run's existing throwaway `runDir/profile` directory.
+ * Start the application browser on this machine's PERSISTENT `isolated` profile (#1094) and retain
+ * only its current live page for the bounded takeover adapter.
+ *
+ * Until #1094 this was the run's throwaway `runDir/profile`, deleted with the run, so a sign-in the
+ * owner completed in one run was gone by the next and every SEEK run bounced to its sign-in page.
+ * The profile is still never seeded from, copied to, or shared with the owner's everyday browser: it
+ * is a dedicated application browser that now remembers its own sign-ins, like a normal browser.
  */
-export async function createIsolatedApplyBrowser(runDir, headless) {
+export async function createPersistentApplyBrowser(profileDir, ledgerPath, headless) {
+    if (inUse.has(profileDir))
+        throw new Error("This machine's application browser profile is in use by another run; try again when it ends.");
+    inUse.add(profileDir);
     const playwright = await import("playwright");
-    const profileDir = join(runDir, "profile");
     let context;
     let mcp;
     let activePage = null;
     let stopped = false;
     try {
+        mkdirSync(profileDir, { recursive: true, mode: 0o700 });
+        // A persistent profile keeps the LAST launch's port file; read before Chrome rewrites it, the
+        // tools would attach to a dead port. Chrome writes a fresh one on every start.
+        rmSync(join(profileDir, "DevToolsActivePort"), { force: true });
         context = await playwright.chromium.launchPersistentContext(profileDir, {
             headless,
             acceptDownloads: true,
@@ -67,9 +106,11 @@ export async function createIsolatedApplyBrowser(runDir, headless) {
         track(initial);
         mcp = new McpRuntime();
         await mcp.start({ cdpEndpoint: await cdpEndpoint(profileDir) });
+        const ctx = context;
         return {
             tools: mcp,
             handoffPage: () => activePage && !activePage.isClosed() ? activePage : null,
+            sessions: new SiteSessionLedger(ledgerPath, async () => (await ctx.cookies()).map((c) => ({ name: c.name, domain: c.domain, expires: c.expires }))),
             stop: async () => {
                 if (stopped)
                     return;
@@ -77,12 +118,14 @@ export async function createIsolatedApplyBrowser(runDir, headless) {
                 activePage = null;
                 await mcp.stop().catch(() => undefined);
                 await context.close().catch(() => undefined);
+                inUse.delete(profileDir);
             },
         };
     }
     catch (error) {
         await mcp?.stop().catch(() => undefined);
         await context?.close().catch(() => undefined);
+        inUse.delete(profileDir);
         throw error;
     }
 }

package/dist/browser-runner/local-apply/runtime.js

@@ -37,7 +37,7 @@ import { ApplyBridge } from "./bridge.js";
 import { APPLY_SHOT_CAP, ShotRecorder } from "../local-browser/replay.js";
 import { confirmationSignals } from "./confirmation.js";
 import { listingUnavailableReason } from "./unavailable.js";
-import { LOCAL_APPLY_AUTH_MODES, LOCAL_APPLY_CAPS, LOCAL_APPLY_ENGINES, LOCAL_APPLY_MODES, LOCAL_APPLY_TASK_TYPE, parseLocalApplyResult, } from "./contract.js";
+import { LOCAL_APPLY_AUTH_MODES, LOCAL_APPLY_CAPS, LOCAL_APPLY_ENGINES, LOCAL_APPLY_MODES, LOCAL_APPLY_TASK_TYPE, parseLocalApplyResult, traceUrl, } from "./contract.js";
 import { applyPrompt, buildApplyEngineSpec, observedApplyAuth } from "./engine.js";
 import { LocalApplyHandoffRuntime } from "./runtime-handoff.js";
 const MAX_EVENTS = 1000;
@@ -397,6 +397,7 @@ export class LocalApplyRuntime {
             limits: e.limits,
             mode: e.policy.mode,
             gateId: e.policy.submitGate?.gateId,
+            sessions: run.browser.sessions,
         }, e.policy.screenshots === false ? undefined : run.shots);
         if (spec.mcpConfig)
             writeFileSync(spec.mcpConfig.path, spec.mcpConfig.json, { mode: 0o600 });
@@ -527,7 +528,10 @@ export class LocalApplyRuntime {
     emit(run, ev) {
         if (run.events.length >= MAX_EVENTS)
             return;
-        run.events.push({ ...ev, at: new Date(this.now()).toISOString(), seq: ++run.seq });
+        // Origin and path only (#1069): a sign-in page's query carries OAuth state and session ids.
+        const url = ev.url ? traceUrl(ev.url) : "";
+        const { url: _raw, ...rest } = ev;
+        run.events.push({ ...rest, ...(url ? { url } : {}), at: new Date(this.now()).toISOString(), seq: ++run.seq });
     }
     pause(run, p) {
         if (run.state === "ended" || run.cancelled)
@@ -535,8 +539,10 @@ export class LocalApplyRuntime {
         if (run.state === "running") {
             run.activeMs += this.now() - run.activeSince;
             run.state = "paused";
-            run.pause = p;
-            this.emit(run, { type: "run.paused", pauseReason: p.reason, ...(p.url ? { url: p.url } : {}), ...(p.domain ? { domain: p.domain } : {}) });
+            const url = p.url ? traceUrl(p.url) : "";
+            const { url: _raw, ...rest } = p;
+            run.pause = { ...rest, ...(url ? { url } : {}) };
+            this.emit(run, { type: "run.paused", pauseReason: p.reason, ...(url ? { url } : {}), ...(p.domain ? { domain: p.domain } : {}) });
         }
         return new Promise((done) => run.waiters.push(done));
     }