@proagentstore/cli 0.4.129 → 0.4.131

package/dist/browser-runner/local-apply/site-session.js

@@ -0,0 +1,141 @@
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+/**
+ * Sites whose one-click apply only works for a signed-in user. SEEK is listed from the verified
+ * failure in #1094 (two fill runs, two machines, both bounced to `login.seek.com`). A site not listed
+ * here joins the ledger the first time a press bounces to its sign-in page.
+ */
+export const SIGN_IN_REQUIRED_SITES = ["seek.com", "seek.com.au", "seek.co.nz"];
+const SECOND_LEVEL = new Set(["com", "co", "net", "org", "gov", "edu", "ac", "id"]);
+/** `au.seek.com` → `seek.com`; `www.seek.com.au` → `seek.com.au`. Good enough for a site key, not a PSL. */
+export function siteKeyOf(host) {
+    const labels = host.toLowerCase().replace(/\.$/, "").split(".").filter(Boolean);
+    if (labels.length <= 2)
+        return labels.join(".");
+    const tld = labels[labels.length - 1];
+    const sld = labels[labels.length - 2];
+    return labels.slice(tld.length === 2 && SECOND_LEVEL.has(sld) ? -3 : -2).join(".");
+}
+/** Does this page look like a sign-in page? A password field, or a login/SSO host or path. */
+export function looksLikeSignIn(url, hasPassword) {
+    if (hasPassword)
+        return true;
+    try {
+        const u = new URL(url);
+        return /^(login|signin|sign-in|auth|accounts?|sso|id)\./i.test(u.hostname) || /\/(login|log-in|signin|sign-in|oauth2?|authorize)(\/|$)/i.test(u.pathname);
+    }
+    catch {
+        return false;
+    }
+}
+function cookieSite(c) {
+    return siteKeyOf(c.domain.replace(/^\./, ""));
+}
+function live(c, nowMs) {
+    return c.expires === -1 || c.expires * 1000 > nowMs;
+}
+export class SiteSessionLedger {
+    path;
+    cookies;
+    now;
+    file;
+    /** Cookie names (with expiry) seen per site when a sign-in pause began, to diff on resume. */
+    before = new Map();
+    constructor(path, cookies, now = Date.now) {
+        this.path = path;
+        this.cookies = cookies;
+        this.now = now;
+        this.file = SiteSessionLedger.read(path);
+    }
+    static read(path) {
+        try {
+            const parsed = JSON.parse(readFileSync(path, "utf8"));
+            if (parsed && parsed.version === 1 && parsed.sites && typeof parsed.sites === "object")
+                return parsed;
+        }
+        catch {
+            // Missing or unreadable: start empty. The worst case is one extra sign-in prompt.
+        }
+        return { version: 1, sites: {} };
+    }
+    entries() {
+        return Object.values(this.file.sites);
+    }
+    /** Is this profile signed in to the site that `url` is on, as far as can be shown? */
+    async check(url) {
+        const host = hostname(url);
+        if (!host)
+            return { state: "ok", site: null };
+        const site = siteKeyOf(host);
+        const entry = this.file.sites[site];
+        if (!entry)
+            return SIGN_IN_REQUIRED_SITES.includes(site) ? { state: "missing", site, reason: "never_signed_in" } : { state: "ok", site: null };
+        if (entry.state === "sign_in_needed")
+            return { state: "missing", site, reason: entry.basis === "bounced_to_sign_in" ? "bounced_to_sign_in" : "never_signed_in" };
+        if (!entry.verifiable || !entry.cookieNames?.length)
+            return { state: "ok", site };
+        const now = this.now();
+        const present = new Set((await this.cookies()).filter((c) => cookieSite(c) === site && live(c, now)).map((c) => c.name));
+        return entry.cookieNames.every((n) => present.has(n)) ? { state: "ok", site } : { state: "missing", site, reason: "expired" };
+    }
+    /** A sign-in pause is starting for `site`: remember which of its cookies exist now. */
+    async beginSignIn(site) {
+        const now = this.now();
+        const seen = new Map();
+        for (const c of await this.cookies())
+            if (cookieSite(c) === site && live(c, now))
+                seen.set(c.name, c.expires);
+        this.before.set(site, seen);
+    }
+    /** The owner resumed after signing in: record the cookies that appeared or were renewed. Names only. */
+    async completeSignIn(site) {
+        const before = this.before.get(site) ?? new Map();
+        this.before.delete(site);
+        const now = this.now();
+        const names = (await this.cookies())
+            .filter((c) => cookieSite(c) === site && live(c, now) && (!before.has(c.name) || before.get(c.name) !== c.expires))
+            .map((c) => c.name);
+        const cookieNames = [...new Set(names)].sort().slice(0, 50);
+        const at = new Date(now).toISOString();
+        const prior = this.file.sites[site];
+        this.file.sites[site] = {
+            site,
+            state: "signed_in",
+            basis: "owner_signed_in",
+            ...(prior?.loginHost ? { loginHost: prior.loginHost } : {}),
+            cookieNames,
+            verifiable: cookieNames.length > 0,
+            signedInAt: at,
+            updatedAt: at,
+        };
+        this.save();
+        return { fingerprint: cookieNames.length, verifiable: cookieNames.length > 0 };
+    }
+    /** A press on `fromUrl` landed on a sign-in page: the next run must ask for a sign-in first. */
+    learnSignInWall(fromUrl, signInUrl) {
+        const from = hostname(fromUrl);
+        if (!from)
+            return null;
+        const site = siteKeyOf(from);
+        const at = new Date(this.now()).toISOString();
+        const loginHost = hostname(signInUrl) ?? undefined;
+        this.file.sites[site] = { site, state: "sign_in_needed", basis: "bounced_to_sign_in", ...(loginHost ? { loginHost } : {}), updatedAt: at };
+        this.save();
+        return site;
+    }
+    save() {
+        mkdirSync(dirname(this.path), { recursive: true });
+        const tmp = `${this.path}.tmp`;
+        writeFileSync(tmp, `${JSON.stringify(this.file, null, 2)}\n`, { mode: 0o600 });
+        renameSync(tmp, this.path);
+    }
+}
+function hostname(url) {
+    try {
+        const u = new URL(url);
+        return u.protocol === "http:" || u.protocol === "https:" ? u.hostname.toLowerCase() : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/browser-runner/request-failure.js

@@ -0,0 +1,19 @@
+import { crashReport, describeError, runtimeCrashIdentity } from "./crash-reports.js";
+/**
+ * A request that failed on the runtime's side (5xx), as a crash report (#1087): method, path and the
+ * correlation ids the URL and headers carry — the instance header, a `/tasks/:id`, a `/sessions/:id`.
+ * Never the body. Called from the server's one request boundary.
+ */
+export function recordRequestFailure(log, req, error) {
+    const path = (req.url || "").split("?")[0];
+    const instance = req.headers["x-pags-instance-id"];
+    log.record(crashReport({
+        ...runtimeCrashIdentity(),
+        kind: "request_failure",
+        ...describeError(error),
+        route: `${req.method ?? "?"} ${path}`,
+        instanceId: typeof instance === "string" ? instance : undefined,
+        taskId: /\/tasks\/([^/]+)/.exec(path)?.[1],
+        sessionId: /\/sessions\/([^/]+)/.exec(path)?.[1],
+    }));
+}

package/dist/browser-runner/runner.js

@@ -1,4 +1,5 @@
 import { spawnSync } from "node:child_process";
+import { CrashLog, runtimeCrashIdentity } from "./crash-reports.js";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { basename, dirname, join, resolve } from "node:path";
@@ -81,6 +82,8 @@ export class LocalRunner {
     /** The profile dir Chrome was actually launched into (holds DevToolsActivePort). */
     launchedProfileDir = null;
     store;
+    /** This runtime's crash reports (#1087) — delivered to the platform by the CLI that runs it. */
+    crashLog;
     /** Local tmux coding sessions (the second runtime — AgentCoder port). */
     coding;
     /** Local CLI browser research (#944): a signed-in Codex / Claude Code CLI researching through the policy bridge. */
@@ -99,8 +102,9 @@ export class LocalRunner {
         this.config = config;
         mkdirSync(config.dataDir, { recursive: true });
         this.store = new RunnerStore(config.dataDir);
+        this.crashLog = new CrashLog(join(config.dataDir, "crash-reports.json"), runtimeCrashIdentity());
         this.coding = new CodingRuntime(join(config.dataDir, "repos"));
-        const { browserFor, applyBrowserFor } = createRunnerBrowserFactories({ headless: config.headless, defaultTools: () => this.getMcp(), sharedPage: () => this.activePage });
+        const { browserFor, applyBrowserFor } = createRunnerBrowserFactories({ headless: config.headless, dataDir: config.dataDir, defaultTools: () => this.getMcp(), defaultCookies: async () => (await (await this.getBrowserContext()).cookies()).map((c) => ({ name: c.name, domain: c.domain, expires: c.expires })), sharedPage: () => this.activePage });
         this.localBrowser = new LocalBrowserRuntime({ dataDir: config.dataDir, selfUrl: () => this.selfUrl, browserFor });
         this.localArtifact = new LocalArtifactRuntime({ dataDir: config.dataDir });
         const localApplyTakeover = createLocalApplyTakeoverAdapter({ get: (id) => this.takeovers.get(id), set: (id, page) => this.takeovers.set(id, { page, reason: "local_apply", humanDone: false }), frame: (id) => this.takeoverFrame(id), input: (id, input) => this.takeoverInput(id, input), end: (id) => this.endTakeover(id) });

package/dist/browser-runner/server.js

@@ -1,5 +1,6 @@
 import { createServer, } from "node:http";
 import { URL } from "node:url";
+import { recordRequestFailure } from "./request-failure.js";
 import { LocalRunner, RunnerInputError } from "./runner.js";
 import { probeGitSshIdentity } from "./coding/repo.js";
 import { checkEngine } from "./coding/engine-check.js";
@@ -30,6 +31,11 @@ export function createRunnerServer(runner) {
         }
         catch (error) {
             const status = error instanceof RunnerInputError ? error.status : 500;
+            // A request that failed on the runner's side is a crash report (#1087), not just a 500 to
+            // the caller: method, path and correlation ids from the URL and headers — never the body.
+            // A caller's bad input (`RunnerInputError`) is answered, not recorded.
+            if (status >= 500)
+                recordRequestFailure(runner.crashLog, req, error);
             json(res, status, {
                 error: error instanceof Error ? error.message : String(error),
             });
@@ -39,8 +45,15 @@ export function createRunnerServer(runner) {
 export async function startRunnerServer(config) {
     const runner = new LocalRunner(config);
     const server = createRunnerServer(runner);
-    await new Promise((resolve) => {
-        server.listen(config.port, config.host, resolve);
+    // A bind failure (EADDRINUSE, EACCES) REJECTS (#1087). It used to be an `error` event with no
+    // listener — an uncaught exception that the crash handler swallows, leaving a runtime that never
+    // started and never exited. Now the entrypoint records a `startup_failure` and exits non-zero.
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(config.port, config.host, () => {
+            server.off("error", reject);
+            resolve();
+        });
     });
     const address = server.address();
     const actualPort = address.port;

package/dist/browser-runner/store.js

@@ -1,6 +1,8 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
+import { CrashLog, crashReport, readJsonOrQuarantine, runtimeCrashIdentity, writeJsonAtomic } from "./crash-reports.js";
 import { WORKFLOW_DRIVEN_TASKS } from "./task-types.js";
+/** Events kept in the local store. Older ones are dropped — and counted in `droppedEvents`. */
+export const MAX_EVENTS = 500;
 function emptyStore() {
     return {
         sessions: [],
@@ -8,10 +10,26 @@ function emptyStore() {
         events: [],
     };
 }
+/**
+ * The runner's local sessions / tasks / events file.
+ *
+ * Crash-safe since #1087: every write is atomic (temp file + fsync + rename, `crash-reports.ts`), so
+ * a crash mid-write leaves the previous file intact rather than a truncated one; and a file that
+ * does not parse is QUARANTINED (moved to `runner-store.json.corrupt-<time>`) and reported in the
+ * crash log for delivery to the platform — it used to read as an empty store, and the next write
+ * then overwrote the evidence. Limits are those of `writeJsonAtomic`: the write in flight at a hard
+ * kill or power loss is lost, never half-applied.
+ */
 export class RunnerStore {
     filePath;
+    crashLog;
     constructor(dataDir) {
         this.filePath = join(dataDir, "runner-store.json");
+        this.crashLog = new CrashLog(join(dataDir, "crash-reports.json"), runtimeCrashIdentity());
+    }
+    /** How many events the buffer has dropped, ever. */
+    droppedEventCount() {
+        return this.read().droppedEvents ?? 0;
     }
     listSessions() {
         return this.read().sessions;
@@ -84,7 +102,10 @@ export class RunnerStore {
             createdAt: new Date().toISOString(),
         };
         data.events.unshift(row);
-        data.events = data.events.slice(0, 500);
+        if (data.events.length > MAX_EVENTS) {
+            data.droppedEvents = (data.droppedEvents ?? 0) + (data.events.length - MAX_EVENTS);
+            data.events.length = MAX_EVENTS;
+        }
         this.write(data);
         return row;
     }
@@ -92,24 +113,26 @@ export class RunnerStore {
         return this.read().events.slice(0, limit);
     }
     read() {
-        if (!existsSync(this.filePath))
+        const got = readJsonOrQuarantine(this.filePath);
+        if (got.status === "missing")
             return emptyStore();
-        try {
-            const parsed = JSON.parse(readFileSync(this.filePath, "utf-8"));
-            return {
-                sessions: Array.isArray(parsed.sessions) ? parsed.sessions : [],
-                tasks: Array.isArray(parsed.tasks) ? parsed.tasks : [],
-                events: Array.isArray(parsed.events) ? parsed.events : [],
-            };
-        }
-        catch {
+        if (got.status === "quarantined") {
+            // Evidence, not an empty store: the file is moved aside, the move is reported, and only
+            // then does the runner continue on a fresh store.
+            const message = `runner store was unreadable and was moved to ${got.quarantinedTo}: ${got.error}`;
+            process.stderr.write(`[store] ${message}\n`);
+            this.crashLog.record(crashReport({ ...runtimeCrashIdentity(), kind: "store_corrupt", message }));
             return emptyStore();
         }
+        const parsed = got.value;
+        return {
+            sessions: Array.isArray(parsed.sessions) ? parsed.sessions : [],
+            tasks: Array.isArray(parsed.tasks) ? parsed.tasks : [],
+            events: Array.isArray(parsed.events) ? parsed.events : [],
+            droppedEvents: Number(parsed.droppedEvents) || 0,
+        };
     }
     write(data) {
-        mkdirSync(dirname(this.filePath), { recursive: true });
-        writeFileSync(this.filePath, `${JSON.stringify(data, null, 2)}\n`, {
-            mode: 0o600,
-        });
+        writeJsonAtomic(this.filePath, data);
     }
 }