@proagentstore/cli 0.4.153 → 0.4.155

package/dist/browser-runner/coding/engine-check.js

@@ -1,11 +1,38 @@
 import { spawnSync } from "node:child_process";
 import { unwrapLauncher } from "./launcher-wrapper.js";
-import { statSync } from "node:fs";
+import { realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { handlerFor } from "./handlers.js";
 import { parseCommand } from "./headless.js";
 import { resolveEngineSpawn } from "./engine-spawn.js";
+function safeRealpath(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return p;
+    }
+}
+function defaultVersionText(launch, env) {
+    // The file the check FOUND, not the bare name: off Windows `command` is the name as given, which spawnSync would
+    // resolve against this process's PATH rather than the one being checked — and report another binary's version.
+    const command = launch.via === "direct" && launch.binaryPath ? launch.binaryPath : launch.command;
+    const r = spawnSync(command, launch.args, { encoding: "utf8", env, timeout: 5_000, windowsHide: true, windowsVerbatimArguments: launch.windowsVerbatimArguments });
+    return r.error || r.status !== 0 ? null : `${r.stdout ?? ""}${r.stderr ?? ""}`;
+}
+/** `codex-cli 0.146.0`, `2.1.3 (Claude Code)`, `grok 1.0.62 (1474f9cbdd91)` → the version. Null when there is none. */
+export function parseEngineVersion(text) {
+    return text?.match(/\b\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/)?.[0] ?? null;
+}
+/** Whose `grok` answered: xAI's names itself; the community npm one prints a bare version from a node_modules script. */
+export function grokVendor(text, binaryPath) {
+    if (text && /^\s*grok \d+\.\d+/m.test(text))
+        return "xai";
+    if (/[\\/]node_modules[\\/]|@vibe-kit/.test(binaryPath ?? ""))
+        return "community";
+    return "unknown";
+}
 function defaultExists(p) {
     try {
         statSync(p);
@@ -52,6 +79,14 @@ export function detectEngineLogin(engine, deps = {}) {
         }
         return { login: "missing", where: file };
     }
+    if (engine === "grok") {
+        // xAI's Grok CLI keeps its subscription login (grok.com / accounts.x.ai) in auth.json under GROK_HOME, default
+        // ~/.grok. An external auth provider or OIDC setup signs in another way, so absence is not proof there.
+        if (env.GROK_AUTH_PROVIDER_COMMAND?.trim() || env.GROK_OIDC_ISSUER?.trim() || env.GROK_DEPLOYMENT_KEY?.trim())
+            return { login: "unknown" };
+        const file = join(env.GROK_HOME?.trim() || join(home, ".grok"), "auth.json");
+        return { login: exists(file) ? "found" : "missing", where: file };
+    }
     if (engine === "gemini") {
         // Google sign-in lands here; Gemini also accepts other auth (gcloud, Vertex), so absence is
         // not proof of "signed out".
@@ -73,6 +108,9 @@ export function checkEngine(input, deps = {}) {
     const bin = parsed.bin || parseCommand(handlerFor(engine).cliCommand).bin || engine;
     const { binaryPath, via } = resolveEngineSpawn(bin, [], deps);
     const login = input.credentialInjected ? { login: "found", where: "platform" } : detectEngineLogin(engine, deps);
+    // Grok's version is what tells xAI's CLI from a same-named npm package, so it is always read for Grok (a native
+    // binary, milliseconds); the others only when asked (coding_engine_get), because each is a Node startup.
+    const versionText = binaryPath && (engine === "grok" || input.withVersion) ? (deps.versionText ?? defaultVersionText)(resolveEngineSpawn(bin, ["--version"], deps), deps.env ?? process.env) : null;
     return {
         checked: true,
         engine,
@@ -81,5 +119,7 @@ export function checkEngine(input, deps = {}) {
         ...(binaryPath ? { binaryPath, binaryVia: via } : {}),
         login: login.login,
         ...(login.where ? { loginWhere: login.where } : {}),
+        ...(binaryPath && (engine === "grok" || input.withVersion) ? { version: parseEngineVersion(versionText) } : {}),
+        ...(engine === "grok" && binaryPath ? { vendor: grokVendor(versionText, (deps.realpath ?? safeRealpath)(binaryPath)) } : {}),
     };
 }

package/dist/browser-runner/coding/engine-env.js

@@ -6,12 +6,29 @@
  * `headless.ts` sat one line under its size pin — so the concern gets a file rather than the pin
  * getting a raise. `engine-auth.ts` READS this env; this builds it.
  *
- *  1. {@link mergeEnv} — the platform's overlay over the machine's, where empty means REMOVE.
+ *  1. {@link mergeEnv} — the platform's overlay over the machine's, where empty means REMOVE, and
+ *     never the platform's own credentials ({@link PLATFORM_CREDENTIAL_ENV}, #1163).
  *  2. {@link engineSpawnEnv} — that, plus the `gh` guard ahead of the real binary on `PATH`, and the
  *     `git` stash guard (#1021) ahead of both.
  */
 import { ghGuardEnv } from "./gh-guard.js";
 import { gitGuardEnv } from "./git-guard.js";
+/**
+ * The platform's own credentials, which no engine may inherit (#1163).
+ *
+ * An engine runs with its permission prompts off, on repositories and issues that carry untrusted
+ * text, so a prompt injection ("run `curl -d $PAGS_TOKEN …`") gets whatever its environment holds.
+ * `PAGS_TOKEN` is the owner's 30-day ACCOUNT session — every agent, and through relay-token minting
+ * every machine. `PAGS_RUNNER_TOKEN` is this runtime's own bearer and `PAGS_RUNNER_CONTROL_NONCE` its
+ * shutdown credential. None of them is the engine's to use.
+ */
+export const PLATFORM_CREDENTIAL_ENV = ["PAGS_TOKEN", "PAGS_RUNNER_TOKEN", "PAGS_RUNNER_CONTROL_NONCE"];
+/** `env` without {@link PLATFORM_CREDENTIAL_ENV}, in place — what the runtime does to its own env at start. */
+export function dropPlatformCredentials(env) {
+    for (const name of PLATFORM_CREDENTIAL_ENV)
+        delete env[name];
+    return env;
+}
 /**
  * Merge the platform's resolved engine env over the machine's, where an EMPTY value means
  * REMOVE rather than "set to empty".
@@ -30,7 +47,9 @@ export function mergeEnv(base, overlay) {
         else
             out[k] = v;
     }
-    return out;
+    // Every engine's env is built here — coding, local-browser, local-artifact — so this is the one place
+    // the platform's credentials are kept out of all of them, whatever the machine or an overlay holds (#1163).
+    return dropPlatformCredentials(out);
 }
 /**
  * The env a turn is spawned with: the merged env, with the `gh` write guard on `PATH` when the

package/dist/browser-runner/coding/engine-spawn.js

@@ -1,5 +1,23 @@
 import { accessSync, constants, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
 import { posix, win32 } from "node:path";
+/**
+ * xAI's Grok CLI for a bare `grok`, wherever PATH points (#1156). Its installer (x.ai/cli/install.sh, install.ps1) always
+ * puts it in `~/.grok/bin` (`GROK_BIN_DIR` overrides), and adds that to PATH only in the SHELL's profile — so a
+ * `pags up` started by launchd, systemd, a Scheduled Task or an older terminal does not see it. And an npm package of
+ * the same name, the community `@vibe-kit/grok-cli` (API-key billed, different flags), can sit earlier on PATH: on the
+ * Mac mini it did, in nvm's bin. The preset means xAI's CLI, so its own location wins when it is there. An explicit path
+ * in a preset is the owner's choice and is never rewritten.
+ */
+export function officialEngineBinary(bin, deps = {}) {
+    if (bin !== "grok")
+        return null;
+    const windows = (deps.platform ?? process.platform) === "win32";
+    const env = deps.env ?? process.env;
+    const dir = envVar(env, "GROK_BIN_DIR", windows)?.trim() || (windows ? win32 : posix).join(deps.home ?? homedir(), ".grok", "bin");
+    const file = (windows ? win32 : posix).join(dir, windows ? "grok.exe" : "grok");
+    return (deps.isExecutable ?? defaultIsExecutable)(file) ? file : null;
+}
 function defaultIsExecutable(p) {
     try {
         if (!statSync(p).isFile())
@@ -67,7 +85,8 @@ export function quoteCmdArg(arg) {
     a = `"${a}"`;
     return a.replace(CMD_META, "^$1").replace(CMD_META, "^$1");
 }
-export function resolveEngineSpawn(bin, args, deps = {}) {
+export function resolveEngineSpawn(requested, args, deps = {}) {
+    const bin = officialEngineBinary(requested, deps) ?? requested;
     const windows = (deps.platform ?? process.platform) === "win32";
     if (!windows)
         return { command: bin, args, binaryPath: resolveBinary(bin, deps), via: "direct" };

package/dist/browser-runner/coding/grok-continuity.js

@@ -0,0 +1,53 @@
+/**
+ * Grok keeps ITS OWN conversation across one-shot turns (#1156) — by an id the runner chooses.
+ *
+ * Every Grok turn is a new `grok … -p "<turn>"` process, so without this each turn started with no memory of the last
+ * one but the platform's replay. `-c/--continue` was the CLI's only offer when the preset was written, and it picks the
+ * MOST RECENT session in the directory — another `grok` run in the same checkout (the owner's own) would answer instead
+ * (`coding-engines.ts`, "NO PRESET RESUMES"). xAI's Grok CLI now takes an explicit id, so continuity is exact:
+ *
+ *   first turn    `-s <uuid>`   a NEW conversation under an id the runner made up (1.x: must be a UUID, must not exist);
+ *   later turns   `-r <uuid>`   resume exactly that one (errors if it does not exist — never "the most recent").
+ *
+ * Checked against `grok --help` of xAI's Grok CLI 1.0.62 (2026-10-18). 0.2.x also accepts both: there `-s` creates-or-
+ * resumes and `-r` errors on an unknown id. NOT yet exercised end to end — the CLI refuses every turn until it is signed
+ * in, and it was not on the machine this was written on — so the runner treats it as unproven: a turn whose flags are
+ * rejected is retried once without them and the session runs without continuity, and the platform's replay is still
+ * sent with every turn (`holdsConversationThisTurn` stays false for Grok) until a signed-in run proves it.
+ */
+import { randomUUID } from "node:crypto";
+const UUID_RE = /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i;
+/** Only a UUID ever reaches argv — anything else read back from the state file is discarded. */
+export function isGrokConversationId(value) {
+    return typeof value === "string" && UUID_RE.test(value);
+}
+export function newGrokConversation(makeId = randomUUID) {
+    return { id: makeId(), started: false };
+}
+/** The turn's argv: the continuity flag first (any order parses), then the preset, then the turn as `-p`'s value. */
+export function grokTurnArgs(userArgs, turnText, conversation) {
+    if (!conversation)
+        return [...userArgs, turnText];
+    return [conversation.started ? "-r" : "-s", conversation.id, ...userArgs, turnText];
+}
+/**
+ * The CLI refused the continuity flags themselves — an argument error, printed before it signs in or runs anything (the
+ * argument parser runs first). Narrow on purpose: retrying any other failure could run a real instruction twice.
+ */
+// Only a line that BEGINS with the CLI's own `error:` (clap's argument errors), and only about these flags or the id —
+// a tool's output in a failed turn that merely mentions a session must never cause a same-turn retry.
+const REJECTED_RE = /^\s*error:\s(?:.*unexpected argument '?-(?:s|r)\b|.*(?:--session-id|--resume)\b|.*must be a valid uuid|.*session\b.*\b(?:not found|already exists|does not exist))/i;
+export function grokRejectedContinuity(lines) {
+    return lines.some((l) => REJECTED_RE.test(l));
+}
+/** What a finished turn means for the conversation. Pure. */
+export function afterGrokTurn(conversation, outcome) {
+    // The flags themselves were refused before anything ran: run without continuity from now on.
+    if (outcome.code && outcome.rejected)
+        return { next: null, persist: null, disable: true };
+    // Done: the CLI holds the conversation now. Remember it, so the next turn — and the next runner start — resume it.
+    if (outcome.code === 0)
+        return { next: { ...conversation, started: true }, persist: conversation.id, disable: false };
+    // Any other failure: the conversation may be half-made or unknown. Forget it, so the next turn starts a clean one.
+    return { next: null, persist: null, disable: false };
+}

package/dist/browser-runner/coding/headless-state.js

@@ -5,7 +5,7 @@ export function isCodexThreadId(value) {
     return typeof value === "string" && /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i.test(value);
 }
 function stateKey(id, engine) {
-    return engine === "codex" ? `codex:${id}` : id;
+    return engine === "claude" ? id : `${engine}:${id}`;
 }
 function loadFile(path) {
     if (!path || !existsSync(path))

package/dist/browser-runner/coding/headless.js

@@ -14,6 +14,7 @@ import { handlerFor } from "./handlers.js";
 import { resolveEngineAuth } from "./engine-auth.js";
 import { buildCodexResumeArgs, engineAdapterFor, engineInvocationModeFromAdapter, engineInvocationWarning, genericRawEngineAdapter } from "./engine-adapter.js";
 import { isCodexThreadId, readCodexState, readState, writeState } from "./headless-state.js";
+import { afterGrokTurn, grokRejectedContinuity, grokTurnArgs, isGrokConversationId, newGrokConversation } from "./grok-continuity.js";
 export { buildClaudeArgs } from "./engine-adapter.js";
 export { defaultStatePath } from "./headless-state.js";
 /**
@@ -70,6 +71,10 @@ export class HeadlessSession {
     claudeSessionId = null;
     /** Codex's thread id from `thread.started` — used only by the explicit-ID resume path (#848). */
     codexThreadId = null;
+    /** Grok's own conversation across one-shot turns (#1156, grok-continuity.ts); null = the next turn starts one. */
+    grokConversation = null;
+    /** Off once this machine's CLI refused the continuity flags: the session then runs as before, turn by turn. */
+    grokContinuity = true;
     /**
      * The cloud's context brief, until the first turn spends it (ADR 0005, #693). Null once
      * delivered, and null from the start when the engine resumed its own conversation.
@@ -270,6 +275,8 @@ export class HeadlessSession {
             config.clientType === "codex" && this.mode === "stream-json" && !config.fresh
                 ? readCodexState(config.statePath, config.id) ?? (config.resumeFrom ? readCodexState(config.statePath, config.resumeFrom) : null)
                 : null;
+        const storedGrok = config.clientType === "grok" && !config.fresh ? (readState(config.statePath, config.id, "grok") ?? (config.resumeFrom ? readState(config.statePath, config.resumeFrom, "grok") : null)) : null;
+        this.grokConversation = isGrokConversationId(storedGrok) ? { id: storedGrok, started: true } : null;
         // AFTER both lines above, because `resumedConversation` reads them: the brief is the fallback,
         // so an engine that found its own conversation drops it unread rather than being handed a
         // summary of the conversation it is already in.
@@ -590,9 +597,15 @@ export class HeadlessSession {
         this.structuredOutputRejected = false;
         const resumedCodexThreadId = this.codexResumeThreadId;
         const inputId = this.turnInputId;
+        // #1156: Grok carries its conversation by an id this runner chose — `-s` to make it, `-r` to resume it.
+        if (this.config.clientType === "grok" && this.grokContinuity && !this.grokConversation)
+            this.grokConversation = newGrokConversation();
+        const grokConversation = this.config.clientType === "grok" && this.grokContinuity ? this.grokConversation : null;
         const turnArgs = resumedCodexThreadId
             ? buildCodexResumeArgs(this.cmdArgs, resumedCodexThreadId, text)
-            : this.adapter.buildTurnArgs(this.cmdArgs, text);
+            : grokConversation
+                ? grokTurnArgs(this.cmdArgs, text, grokConversation)
+                : this.adapter.buildTurnArgs(this.cmdArgs, text);
         const env = this.spawnEnv;
         const target = spawnTarget(this.cmdPrefix, this.cmdBin, turnArgs);
         const launch = resolveEngineSpawn(target.command, target.args, { env });
@@ -687,6 +700,19 @@ export class HeadlessSession {
                 this.runOneShot(text);
                 return;
             }
+            if (grokConversation) {
+                const after = afterGrokTurn(grokConversation, { code, rejected: grokRejectedContinuity(this.turnTail) });
+                this.grokConversation = after.next;
+                writeState(this.config.statePath, this.config.id, after.persist, "grok");
+                // The flags were refused before anything ran (an argument error): the same turn again, without them.
+                if (after.disable) {
+                    this.grokContinuity = false;
+                    this.proc = null;
+                    this.push("[grok CLI rejected its session flags; retrying this turn without conversation continuity]");
+                    this.runOneShot(text);
+                    return;
+                }
+            }
             // A rejected/expired explicit ID is not retried as the same turn: the CLI may have started
             // work before failing. Drop only that known-bad local key so the NEXT turn is safely fresh.
             if (code && resumedCodexThreadId && this.codexThreadId === resumedCodexThreadId) {

package/dist/browser-runner/index.js

@@ -5,6 +5,7 @@ import { CrashLog, crashReport, describeError, installCrashHandlers, runtimeCras
 import { startRunnerServer } from "./server.js";
 import { reapOnStartup } from "./reaper.js";
 import { randomUUID } from "node:crypto";
+import { dropPlatformCredentials } from "./coding/engine-env.js";
 function arg(name, fallback) {
     const index = process.argv.indexOf(name);
     if (index === -1)
@@ -58,6 +59,9 @@ Endpoints:
     process.exit(0);
 }
 const config = configFromArgs();
+// Read, so out of the environment (#1163): nothing this runtime spawns — engines, git, gh, a browser —
+// inherits the account session or this runtime's own bearer and shutdown credential.
+dropPlatformCredentials(process.env);
 // Resilience: a stray error in any runtime must NOT take the whole runner down —
 // that drops the tunnel and forces the user to restart `pags up` (and lose their
 // session). Keep serving. Per-component handlers catch most things; this is the

package/dist/index.js

@@ -875,24 +875,43 @@ async function defaultAsk(question) {
 
 // src/commands/runner/http.ts
 import { hostname as hostname3 } from "os";
+
+// src/commands/runner/session-token.ts
+var held = null;
 function clean(value) {
+  return (value ?? "").trim();
+}
+function takeSessionTokenFromEnv(env = process.env) {
+  const token = clean(env.PAGS_TOKEN);
+  if (token) held = token;
+  delete env.PAGS_TOKEN;
+}
+function holdSessionToken(token) {
+  held = clean(token) || held;
+}
+function sessionToken(explicit) {
+  return clean(explicit) || clean(held) || clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token);
+}
+
+// src/commands/runner/http.ts
+function clean2(value) {
   const trimmed = value?.trim();
   return trimmed || void 0;
 }
 function runnerBaseUrl(url) {
-  return (clean(url) || clean(process.env.PAGS_RUNNER_URL) || "http://127.0.0.1:49171").replace(/\/$/, "");
+  return (clean2(url) || clean2(process.env.PAGS_RUNNER_URL) || "http://127.0.0.1:49171").replace(/\/$/, "");
 }
 function pagsApiBase(url) {
-  return (clean(url) || clean(process.env.PAGS_API_BASE) || "https://api.proagentstore.online").replace(/\/$/, "");
+  return (clean2(url) || clean2(process.env.PAGS_API_BASE) || "https://api.proagentstore.online").replace(/\/$/, "");
 }
 function pagsHeaders(token) {
-  const resolved = clean(token) || clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token);
+  const resolved = sessionToken(token);
   return resolved ? { Authorization: `Bearer ${resolved}` } : {};
 }
 function runnerRequestHeaders(opts) {
-  const resolved = clean(opts.token) || clean(process.env.PAGS_RUNNER_TOKEN);
+  const resolved = clean2(opts.token) || clean2(process.env.PAGS_RUNNER_TOKEN);
   const headers = resolved ? { Authorization: `Bearer ${resolved}` } : {};
-  const instanceId = clean(opts.instanceId) || clean(process.env.PAGS_INSTANCE_ID);
+  const instanceId = clean2(opts.instanceId) || clean2(process.env.PAGS_INSTANCE_ID);
   if (instanceId) headers["X-PAGS-Instance-Id"] = instanceId;
   return headers;
 }
@@ -903,11 +922,11 @@ function buildRuntimeRegistrationBody(opts, capabilities = []) {
   const node = hostname3();
   const machine = loadMachineIdentity(node);
   return {
-    endpointUrl: clean(opts.endpointUrl) || opts.endpointUrl,
-    token: clean(opts.runnerToken) || clean(opts.token) || clean(process.env.PAGS_RUNNER_TOKEN),
+    endpointUrl: clean2(opts.endpointUrl) || opts.endpointUrl,
+    token: clean2(opts.runnerToken) || clean2(opts.token) || clean2(process.env.PAGS_RUNNER_TOKEN),
     placement: opts.placement === "managed" ? "managed" : "local",
     capabilities,
-    runnerVersion: clean(opts.runnerVersion) || "",
+    runnerVersion: clean2(opts.runnerVersion) || "",
     runnerNode: node,
     machineId: machine.id,
     machineNames: machine.names
@@ -1284,11 +1303,11 @@ async function findFreePort2(start) {
 }
 function buildRunnerArgs(opts) {
   const args = [];
-  if (clean(opts.host)) args.push("--host", clean(opts.host));
-  if (clean(opts.port)) args.push("--port", clean(opts.port));
-  if (clean(opts.dataDir)) args.push("--data-dir", clean(opts.dataDir));
-  if (clean(opts.token)) args.push("--token", clean(opts.token));
-  if (clean(opts.instanceId)) args.push("--instance-id", clean(opts.instanceId));
+  if (clean2(opts.host)) args.push("--host", clean2(opts.host));
+  if (clean2(opts.port)) args.push("--port", clean2(opts.port));
+  if (clean2(opts.dataDir)) args.push("--data-dir", clean2(opts.dataDir));
+  if (clean2(opts.token)) args.push("--token", clean2(opts.token));
+  if (clean2(opts.instanceId)) args.push("--instance-id", clean2(opts.instanceId));
   if (opts.headless) args.push("--headless");
   return args;
 }
@@ -1545,9 +1564,9 @@ function partitionByPin(instances, thisNode, alsoKnownAs = []) {
   for (const inst of instances) (isEligible(inst, thisNode, alsoKnownAs) ? here : elsewhere).push(inst);
   return { here, elsewhere };
 }
-function pinnedAway(held, instances, thisNode, alsoKnownAs = []) {
+function pinnedAway(held2, instances, thisNode, alsoKnownAs = []) {
   const pins = new Map(instances.map((i) => [i.id, i.config?.runnerNode]));
-  return [...held].filter((id) => {
+  return [...held2].filter((id) => {
     const pin = pins.get(id);
     return !!pin && pin !== thisNode && !alsoKnownAs.includes(pin);
   });
@@ -2567,7 +2586,7 @@ var MEMBERSHIP_SYNC_PATH = "/pags/membership/sync";
 var CLI_CONTROL_PATHS = /* @__PURE__ */ new Set([MEMBERSHIP_SYNC_PATH, RUNNER_UPDATE_PATH, RUNNER_RESTART_PATH]);
 async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force = false, watchInstances = false) {
   const apiBase = pagsApiBase(opts.apiBase).replace(/^http/, "ws");
-  const pagsToken = () => clean(opts.pagsToken) || clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token);
+  const pagsToken = () => sessionToken(opts.pagsToken);
   if (!pagsToken()) throw new Error("PAGS token required for WebSocket relay");
   const runnerNode = hostname5();
   const machine = loadMachineIdentity(runnerNode);
@@ -3154,18 +3173,18 @@ function clip(text, max) {
   return `${text.substring(0, max)}
 [cut: showing the first ${max} of ${text.length} characters]`;
 }
-var clean2 = (value, max) => clip(maskSecrets(String(value ?? "")), max);
+var clean3 = (value, max) => clip(maskSecrets(String(value ?? "")), max);
 var shortId = (value) => typeof value === "string" && /^[A-Za-z0-9._:-]{1,128}$/.test(value) ? value : void 0;
 function describeError(error) {
   if (error instanceof Error) {
     const cause = error.cause;
     return {
-      message: clean2(`${error.name}: ${error.message}`, MAX_MESSAGE),
-      stack: error.stack ? clean2(error.stack, MAX_STACK) : void 0,
-      cause: cause === void 0 ? void 0 : clean2(cause instanceof Error ? `${cause.name}: ${cause.message}` : cause, MAX_MESSAGE)
+      message: clean3(`${error.name}: ${error.message}`, MAX_MESSAGE),
+      stack: error.stack ? clean3(error.stack, MAX_STACK) : void 0,
+      cause: cause === void 0 ? void 0 : clean3(cause instanceof Error ? `${cause.name}: ${cause.message}` : cause, MAX_MESSAGE)
     };
   }
-  return { message: clean2(error, MAX_MESSAGE) };
+  return { message: clean3(error, MAX_MESSAGE) };
 }
 function crashReport(input) {
   return {
@@ -3173,9 +3192,9 @@ function crashReport(input) {
     at: input.at ?? (/* @__PURE__ */ new Date()).toISOString(),
     source: input.source,
     kind: input.kind,
-    message: clean2(input.message, MAX_MESSAGE),
-    ...input.stack ? { stack: clean2(input.stack, MAX_STACK) } : {},
-    ...input.cause ? { cause: clean2(input.cause, MAX_MESSAGE) } : {},
+    message: clean3(input.message, MAX_MESSAGE),
+    ...input.stack ? { stack: clean3(input.stack, MAX_STACK) } : {},
+    ...input.cause ? { cause: clean3(input.cause, MAX_MESSAGE) } : {},
     ...input.exitCode !== void 0 ? { exitCode: input.exitCode } : {},
     ...input.signal !== void 0 ? { signal: input.signal } : {},
     ...shortId(input.build) ? { build: input.build } : {},
@@ -3183,8 +3202,8 @@ function crashReport(input) {
     ...shortId(input.instanceId) ? { instanceId: input.instanceId } : {},
     ...shortId(input.sessionId) ? { sessionId: input.sessionId } : {},
     ...shortId(input.taskId) ? { taskId: input.taskId } : {},
-    ...input.route ? { route: clean2(input.route, 200) } : {},
-    ...input.tail?.length ? { tail: input.tail.slice(-20).map((line) => clean2(line, 300)) } : {}
+    ...input.route ? { route: clean3(input.route, 200) } : {},
+    ...input.tail?.length ? { tail: input.tail.slice(-20).map((line) => clean3(line, 300)) } : {}
   };
 }
 function writeJsonAtomic(path, data, mode = 384) {
@@ -3458,10 +3477,11 @@ function createRunnerCommand() {
     await startRunnerForeground(opts);
   });
   command.command("connect <instanceIds...>").description("Start ONE local runtime, connect via WebSocket relay, and register it for every given PAGS instance").option("--host <host>", "Host to bind", "127.0.0.1").option("--port <port>", "Port to bind", "49171").option("--data-dir <path>", "Runner data directory").option("--token <token>", "Runner bearer token. Defaults to PAGS_RUNNER_TOKEN or a generated token").option("--headless", "Run Playwright headless").option("--api-base <url>", "PAGS API base URL").option("--pags-token <token>", "PAGS session token. Defaults to PAGS_TOKEN").option("--runner-version <version>", "Runner version").option("--force", "Take over from another connected machine").option("--watch-instances", "Attach newly eligible agents while running, without a restart").action(async (instanceIds, opts) => {
-    const runnerToken = clean(opts.token) || clean(process.env.PAGS_RUNNER_TOKEN) || `pags_runner_${randomUUID4()}`;
-    const host = clean(opts.host) || "127.0.0.1";
-    const port = clean(opts.port) || String(await findFreePort2(49171));
-    const lockAccount = clean(process.env.PAGS_LOCK_ACCOUNT) || "";
+    takeSessionTokenFromEnv();
+    const runnerToken = clean2(opts.token) || clean2(process.env.PAGS_RUNNER_TOKEN) || `pags_runner_${randomUUID4()}`;
+    const host = clean2(opts.host) || "127.0.0.1";
+    const port = clean2(opts.port) || String(await findFreePort2(49171));
+    const lockAccount = clean2(process.env.PAGS_LOCK_ACCOUNT) || "";
     let lockHeld = null;
     if (lockAccount) {
       const taken = await acquireLock({ account: lockAccount, node: hostname6(), machineId: loadMachineIdentity().id || null, version: CLI_VERSION, port: Number(port), runnerToken });
@@ -3505,7 +3525,7 @@ function createRunnerCommand() {
     });
     const deliver = async () => {
       if (!crashes) return;
-      const token = clean(opts.pagsToken) || clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token);
+      const token = sessionToken(opts.pagsToken);
       if (!token) return;
       const result = await deliverCrashReports({ apiBase: pagsApiBase(opts.apiBase), token, account: crashAccount, paths: crashes });
       if (result.delivered) writeLine(`Delivered ${result.delivered} crash report(s) to ProAgentStore.`);
@@ -3543,12 +3563,12 @@ function createRunnerCommand() {
       await connectViaRelay(instanceIds, localUrl, runnerToken, opts, Boolean(opts.force), Boolean(opts.watchInstances));
       void deliver().catch(() => void 0);
       setInterval(() => void deliver().catch(() => void 0), 5 * 6e4).unref();
-      if (!clean(opts.pagsToken)) {
+      if (!clean2(opts.pagsToken)) {
         startSessionRefresh({
           apiBase: pagsApiBase(opts.apiBase),
-          token: () => clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token) || null,
+          token: () => sessionToken() || null,
           onRefreshed: (token, previous) => {
-            process.env.PAGS_TOKEN = token;
+            holdSessionToken(token);
             const stored = loadSession();
             if (stored?.token === previous) saveSession({ ...stored, token, expiresAt: sessionExpiresAt(token) ?? stored.expiresAt });
           },
@@ -3738,8 +3758,8 @@ async function waitForBackgroundHolder(childPid, read, alive, opts = {}) {
   const deadline = Date.now() + (opts.timeoutMs ?? 3e4);
   while (Date.now() < deadline) {
     if (!alive(childPid)) return "exited";
-    const held = await read();
-    if (held.lock?.pid === childPid && held.verdict === "live") return "live";
+    const held2 = await read();
+    if (held2.lock?.pid === childPid && held2.verdict === "live") return "live";
     await sleep(opts.intervalMs ?? 500);
   }
   return alive(childPid) ? "timeout" : "exited";
@@ -3747,8 +3767,8 @@ async function waitForBackgroundHolder(childPid, read, alive, opts = {}) {
 async function waitUntilTakeable(read, opts = {}) {
   const deadline = Date.now() + (opts.timeoutMs ?? 15e3);
   for (; ; ) {
-    const held = await read();
-    if (!held.lock || isTakeable(held.verdict)) return true;
+    const held2 = await read();
+    if (!held2.lock || isTakeable(held2.verdict)) return true;
     if (Date.now() >= deadline) return false;
     await sleep(opts.intervalMs ?? 500);
   }
@@ -3785,8 +3805,8 @@ function describeStatus(lock, verdict, bg, now = Date.now()) {
 }
 var statusCommand = new Command9("status").description("Is a runner running on this machine for your account \u2014 and how was it started").action(async () => {
   const session = requireSession();
-  const held = await inspectHolder(lockPath(session.user.login));
-  const { running, lines } = describeStatus(held.lock, held.lock ? held.verdict : null, readBackgroundState(backgroundStatePath(session.user.login)));
+  const held2 = await inspectHolder(lockPath(session.user.login));
+  const { running, lines } = describeStatus(held2.lock, held2.lock ? held2.verdict : null, readBackgroundState(backgroundStatePath(session.user.login)));
   writeLine("");
   for (const line of lines) writeLine(`  ${line}`);
   writeLine("");
@@ -4039,13 +4059,13 @@ async function startInBackground(start, deps = processDeps()) {
   const upArgs = restartUpArgs(start.opts);
   const env = {
     ...deps.env,
-    PAGS_TOKEN: start.session.token,
     PAGS_LOCK_ACCOUNT: account,
     [BACKGROUND_ENV]: "1",
     [BACKGROUND_LOG_ENV]: logPath,
     [RESTART_COMMAND_ENV]: backgroundRestartCommand(deps.execPath, start.runnerArgs[0], upArgs, deps.platform)
   };
   delete env.PAGS_UP_SUPERVISED;
+  delete env.PAGS_TOKEN;
   deps.step("Starting the runner in the background\u2026", "wait");
   const pid = spawnDetached(deps.execPath, start.runnerArgs, env, logPath, deps.spawn);
   writeBackgroundState(backgroundStatePath(account, deps.env), {
@@ -4427,17 +4447,17 @@ var upCommand = new Command10("up").description("Start the browser runner for al
   printStep(`Connecting ${state.activeInstance}\u2026`, "wait");
   const lockFile = lockPath(session.user.login);
   if (unattended || opts.background && process.env[BACKGROUND_RESTART_ENV] === "1") await waitUntilTakeable(() => inspectHolder(lockFile), { timeoutMs: 6e4 });
-  const held = await inspectHolder(lockFile);
-  if (held.lock && !isTakeable(held.verdict)) {
-    logUpdateStep(`start: the lock is held by pid ${held.lock.pid} (${held.verdict})${opts.replace ? " \u2014 replacing it" : " \u2014 exiting"}`);
+  const held2 = await inspectHolder(lockFile);
+  if (held2.lock && !isTakeable(held2.verdict)) {
+    logUpdateStep(`start: the lock is held by pid ${held2.lock.pid} (${held2.verdict})${opts.replace ? " \u2014 replacing it" : " \u2014 exiting"}`);
     if (!opts.replace) {
       clearScreen();
       printLogo(CLI_VERSION2);
-      for (const line of holderMessage(held.lock, held.verdict)) writeLine(`  ${line}`);
+      for (const line of holderMessage(held2.lock, held2.verdict)) writeLine(`  ${line}`);
       writeLine("");
       process.exit(1);
     }
-    const replaced = await replaceHolder(held.lock, { now: opts.now === true });
+    const replaced = await replaceHolder(held2.lock, { now: opts.now === true });
     if (!replaced.ok) {
       clearScreen();
       printLogo(CLI_VERSION2);
@@ -4461,7 +4481,9 @@ var upCommand = new Command10("up").description("Start the browser runner for al
     stdio: ["ignore", "pipe", "pipe"],
     // The child is the lock HOLDER (#896): it owns the relay sockets, so it is what a
     // contender must find and what `--replace` must be able to stop.
-    env: { ...process.env, PAGS_TOKEN: session.token, [SUPERVISED_ENV]: SUPERVISOR_RESTARTS, PAGS_LOCK_ACCOUNT: session.user.login }
+    // No PAGS_TOKEN (#1163): the child reads session.json itself, so the account session is in no
+    // environment its runtime and engines could inherit.
+    env: { ...process.env, PAGS_TOKEN: void 0, [SUPERVISED_ENV]: SUPERVISOR_RESTARTS, PAGS_LOCK_ACCOUNT: session.user.login }
   });
   const logs = [];
   let childRsid = "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.153",
+  "version": "0.4.155",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",