@proagentstore/cli 0.4.154 → 0.4.156

package/dist/browser-runner/coding/engine-env.js

@@ -6,12 +6,29 @@
  * `headless.ts` sat one line under its size pin — so the concern gets a file rather than the pin
  * getting a raise. `engine-auth.ts` READS this env; this builds it.
  *
- *  1. {@link mergeEnv} — the platform's overlay over the machine's, where empty means REMOVE.
+ *  1. {@link mergeEnv} — the platform's overlay over the machine's, where empty means REMOVE, and
+ *     never the platform's own credentials ({@link PLATFORM_CREDENTIAL_ENV}, #1163).
  *  2. {@link engineSpawnEnv} — that, plus the `gh` guard ahead of the real binary on `PATH`, and the
  *     `git` stash guard (#1021) ahead of both.
  */
 import { ghGuardEnv } from "./gh-guard.js";
 import { gitGuardEnv } from "./git-guard.js";
+/**
+ * The platform's own credentials, which no engine may inherit (#1163).
+ *
+ * An engine runs with its permission prompts off, on repositories and issues that carry untrusted
+ * text, so a prompt injection ("run `curl -d $PAGS_TOKEN …`") gets whatever its environment holds.
+ * `PAGS_TOKEN` is the owner's 30-day ACCOUNT session — every agent, and through relay-token minting
+ * every machine. `PAGS_RUNNER_TOKEN` is this runtime's own bearer and `PAGS_RUNNER_CONTROL_NONCE` its
+ * shutdown credential. None of them is the engine's to use.
+ */
+export const PLATFORM_CREDENTIAL_ENV = ["PAGS_TOKEN", "PAGS_RUNNER_TOKEN", "PAGS_RUNNER_CONTROL_NONCE"];
+/** `env` without {@link PLATFORM_CREDENTIAL_ENV}, in place — what the runtime does to its own env at start. */
+export function dropPlatformCredentials(env) {
+    for (const name of PLATFORM_CREDENTIAL_ENV)
+        delete env[name];
+    return env;
+}
 /**
  * Merge the platform's resolved engine env over the machine's, where an EMPTY value means
  * REMOVE rather than "set to empty".
@@ -30,7 +47,9 @@ export function mergeEnv(base, overlay) {
         else
             out[k] = v;
     }
-    return out;
+    // Every engine's env is built here — coding, local-browser, local-artifact — so this is the one place
+    // the platform's credentials are kept out of all of them, whatever the machine or an overlay holds (#1163).
+    return dropPlatformCredentials(out);
 }
 /**
  * The env a turn is spawned with: the merged env, with the `gh` write guard on `PATH` when the

package/dist/browser-runner/coding/runtime.js

@@ -1,3 +1,4 @@
+import { confineWorkDir } from "./workdir-guard.js";
 import { actDigest } from "./input-ledger.js";
 import { parkRestore, parkSnapshot } from "./park-snapshot.js";
 import { runObjective } from "./run-objective.js";
@@ -84,21 +85,26 @@ export class CodingRuntime {
      * workDir (authoritative even for managed clone dirs); fall back to an explicit path
      * (the cloud passes the D1 `repo.workdir` when the session map is empty after a runner
      * restart). Expands a leading `~` the same way start() does.
+     *
+     * An explicit path is CONFINED (#1165): never the home folder or above it, never inside a
+     * credential directory — so `{ workDir: "~", path: ".ssh/id_ed25519" }` is refused rather
+     * than a confined read of a private key. See `workdir-guard.ts`.
      */
     resolveWorkDir(input) {
         if (input.sessionId) {
             const s = this.sessions.get(input.sessionId);
+            // The session's own folder answers to the same rule: a session started in `~` must not reopen it.
             if (s)
-                return s.config.workDir;
+                return confineWorkDir(s.config.workDir, { allow: [this.reposBaseDir] });
         }
         if (input.workDir)
-            return resolve(input.workDir.replace(/^~(?=$|\/)/, homedir()));
+            return confineWorkDir(input.workDir, { allow: [this.reposBaseDir] });
         throw new InspectError("no session or workDir to inspect");
     }
     /** Where a parked run's checkout is (#1077): its declared folder, else the managed clone dir `start()` uses. */
     parkWorkDir(input) {
         if (input.workDir)
-            return resolve(input.workDir.replace(/^~(?=$|\/)/, homedir()));
+            return confineWorkDir(input.workDir, { allow: [this.reposBaseDir] });
         if (input.repoId)
             return join(this.reposBaseDir, sanitizeSessionName(input.repoId));
         throw new InspectError("no workDir or repoId for the parked checkout");

package/dist/browser-runner/coding/secret-file.js

@@ -1,7 +1,8 @@
-import { closeSync, constants, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeSync } from "node:fs";
+import { closeSync, constants, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { RunnerInputError } from "../errors.js";
+import { isWithin, realPathOf } from "./workdir-guard.js";
 /**
  * The runner's half of the machine-to-machine secret handoff (#918): read a secret file so the
  * cloud can encrypt it, and write one back from the cloud's decrypted copy.
@@ -18,23 +19,44 @@ import { RunnerInputError } from "../errors.js";
  */
 /** Big enough for any `.env`, key file or credentials JSON; small enough that this is not a file-transfer tool. */
 export const SECRET_MAX_BYTES = 64 * 1024;
-/** `~` expanded; a relative path resolves against the home directory, which is where `pags up` users name things from. */
-function resolvePath(raw) {
+/**
+ * The ONE folder the secret handoff reads from and writes to (#1165).
+ *
+ * It used to take any path the owner's account could reach: `/secure/read` would hand over
+ * `~/.ssh/id_ed25519`, and `/secure/write` with `overwrite: true` could replace `~/.ssh/authorized_keys`.
+ * Now a relative path is relative to this folder, and an absolute or `~/…` path must already be inside
+ * it, resolved through symlinks, so a link planted in it cannot point back out. Moving a delivered
+ * file to where it is used is the operator's step, in the open.
+ */
+export function secureFilesDir(home = homedir()) {
+    return join(home, ".config", "proagentstore", "secure-files");
+}
+/** `~` expanded; relative to {@link secureFilesDir}; refused unless it stays inside that folder. */
+function resolvePath(raw, home = homedir()) {
     const p = String(raw ?? "").trim();
     if (!p)
         throw new RunnerInputError("A `path` is required.");
-    const expanded = p.replace(/^~(?=$|\/)/, homedir());
-    return isAbsolute(expanded) ? resolve(expanded) : resolve(homedir(), expanded);
+    const root = secureFilesDir(home);
+    const expanded = p.replace(/^~(?=$|\/)/, home);
+    const path = isAbsolute(expanded) ? resolve(expanded) : resolve(root, expanded);
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    if (path === root || !isWithin(realPathOf(path, home), realPathOf(root, home))) {
+        throw new RunnerInputError(`${p} is outside ${root}. The secret handoff reads and writes only inside that folder — name a file there, e.g. \`app.env\`.`);
+    }
+    return path;
 }
-export function readSecretFile(input) {
-    const path = resolvePath(input.path);
+export function readSecretFile(input, home = homedir()) {
+    const path = resolvePath(input.path, home);
     let st;
     try {
-        st = statSync(path);
+        st = lstatSync(path);
     }
     catch {
         throw new RunnerInputError(`No file at ${path}.`);
     }
+    // Not followed (#1165): a symlink in the folder would read whatever it points at.
+    if (st.isSymbolicLink())
+        throw new RunnerInputError(`${path} is a symbolic link; the secret handoff reads regular files only.`);
     if (!st.isFile())
         throw new RunnerInputError(`${path} is not a regular file.`);
     if (st.size === 0)
@@ -63,8 +85,8 @@ function parseMode(raw) {
         throw new RunnerInputError(`mode ${s} is group/world-writable or executable; a secret file must not be.`);
     return mode;
 }
-export function writeSecretFile(input) {
-    const path = resolvePath(input.path);
+export function writeSecretFile(input, home = homedir()) {
+    const path = resolvePath(input.path, home);
     if (typeof input.value !== "string" || !input.value)
         throw new RunnerInputError("Nothing to write.");
     const mode = parseMode(input.mode);

package/dist/browser-runner/coding/workdir-guard.js

@@ -0,0 +1,80 @@
+/**
+ * What a caller-supplied `workDir` may be (#1165).
+ *
+ * The read-only inspection routes (`read-file`, `tree`, `search`, `git`) confine every PATH to the
+ * `workDir` — but took the `workDir` itself from the request. `{ workDir: "~", path: ".ssh/id_ed25519" }`
+ * was a perfectly confined read of a private key. The cloud sends the owner's registered repo folder
+ * (`coding_repos.workdir`), and registration accepts any local path, `~` included; this runner has no
+ * copy of that registry to check against. So it refuses what can never be a repository it should
+ * read inside, whoever asked:
+ *
+ *   • the filesystem root, the home folder, or any folder ABOVE the home folder — a root that holds
+ *     everything the owner has;
+ *   • a folder inside a credential directory ({@link CREDENTIAL_DIRS}) — `~/.ssh`, `~/.gnupg`, the
+ *     cloud CLIs' config, and ProAgentStore's own (`~/.config/proagentstore`, which holds the account
+ *     session), except the managed clones the runner itself makes there.
+ *
+ * Resolved through symlinks first (the nearest existing ancestor, for a folder a clone will create), so
+ * `~/dev/innocent -> ~/.ssh` is the credential directory it points at.
+ */
+import { existsSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { InspectError } from "./inspect.js";
+/** Folders under the home folder whose contents are credentials, never a repository to read. */
+export const CREDENTIAL_DIRS = [
+    ".ssh",
+    ".gnupg",
+    ".aws",
+    ".azure",
+    ".kube",
+    ".docker",
+    ".password-store",
+    ".config/gcloud",
+    ".config/gh",
+    ".config/proagentstore",
+    "Library/Keychains",
+];
+/** `~` expanded; resolved through symlinks as far as the path exists. */
+export function realPathOf(raw, home = homedir()) {
+    const expanded = raw.trim().replace(/^~(?=$|[\\/])/, home);
+    let p = resolve(isAbsolute(expanded) ? expanded : join(home, expanded));
+    const tail = [];
+    while (!existsSync(p)) {
+        const up = dirname(p);
+        if (up === p)
+            break;
+        tail.unshift(basename(p));
+        p = up;
+    }
+    let real = p;
+    try {
+        real = realpathSync(p);
+    }
+    catch {
+        // Unreadable: judge the path as written.
+    }
+    return tail.length ? join(real, ...tail) : real;
+}
+/** Is `child` the same as `parent` or inside it? */
+export function isWithin(child, parent) {
+    const rel = relative(parent, child);
+    return rel === "" || (!!rel && !rel.startsWith("..") && !isAbsolute(rel));
+}
+/**
+ * The `workDir` a request may name, or an {@link InspectError} saying why not. `allow` lists folders the
+ * runner itself manages inside a credential directory — the managed clone root — which stay usable.
+ */
+export function confineWorkDir(raw, opts = {}) {
+    const home = realPathOf(opts.home ?? homedir(), opts.home ?? homedir());
+    const path = realPathOf(raw, opts.home ?? homedir());
+    if (isWithin(home, path)) {
+        throw new InspectError(`"${raw}" is ${path === home ? "the home folder" : "a folder that contains the home folder"}, not a repository — register the repository's own folder.`);
+    }
+    if ((opts.allow ?? []).some((a) => isWithin(path, realPathOf(a, home))))
+        return path;
+    const credential = CREDENTIAL_DIRS.find((d) => isWithin(path, realPathOf(join(home, d), home)));
+    if (credential)
+        throw new InspectError(`"${raw}" is inside ~/${credential}, which holds credentials — it cannot be read as a repository.`);
+    return path;
+}

package/dist/browser-runner/index.js

@@ -5,6 +5,7 @@ import { CrashLog, crashReport, describeError, installCrashHandlers, runtimeCras
 import { startRunnerServer } from "./server.js";
 import { reapOnStartup } from "./reaper.js";
 import { randomUUID } from "node:crypto";
+import { dropPlatformCredentials } from "./coding/engine-env.js";
 function arg(name, fallback) {
     const index = process.argv.indexOf(name);
     if (index === -1)
@@ -58,6 +59,9 @@ Endpoints:
     process.exit(0);
 }
 const config = configFromArgs();
+// Read, so out of the environment (#1163): nothing this runtime spawns — engines, git, gh, a browser —
+// inherits the account session or this runtime's own bearer and shutdown credential.
+dropPlatformCredentials(process.env);
 // Resilience: a stray error in any runtime must NOT take the whole runner down —
 // that drops the tunnel and forces the user to restart `pags up` (and lose their
 // session). Keep serving. Per-component handlers catch most things; this is the

package/dist/index.js

@@ -875,24 +875,43 @@ async function defaultAsk(question) {
 
 // src/commands/runner/http.ts
 import { hostname as hostname3 } from "os";
+
+// src/commands/runner/session-token.ts
+var held = null;
 function clean(value) {
+  return (value ?? "").trim();
+}
+function takeSessionTokenFromEnv(env = process.env) {
+  const token = clean(env.PAGS_TOKEN);
+  if (token) held = token;
+  delete env.PAGS_TOKEN;
+}
+function holdSessionToken(token) {
+  held = clean(token) || held;
+}
+function sessionToken(explicit) {
+  return clean(explicit) || clean(held) || clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token);
+}
+
+// src/commands/runner/http.ts
+function clean2(value) {
   const trimmed = value?.trim();
   return trimmed || void 0;
 }
 function runnerBaseUrl(url) {
-  return (clean(url) || clean(process.env.PAGS_RUNNER_URL) || "http://127.0.0.1:49171").replace(/\/$/, "");
+  return (clean2(url) || clean2(process.env.PAGS_RUNNER_URL) || "http://127.0.0.1:49171").replace(/\/$/, "");
 }
 function pagsApiBase(url) {
-  return (clean(url) || clean(process.env.PAGS_API_BASE) || "https://api.proagentstore.online").replace(/\/$/, "");
+  return (clean2(url) || clean2(process.env.PAGS_API_BASE) || "https://api.proagentstore.online").replace(/\/$/, "");
 }
 function pagsHeaders(token) {
-  const resolved = clean(token) || clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token);
+  const resolved = sessionToken(token);
   return resolved ? { Authorization: `Bearer ${resolved}` } : {};
 }
 function runnerRequestHeaders(opts) {
-  const resolved = clean(opts.token) || clean(process.env.PAGS_RUNNER_TOKEN);
+  const resolved = clean2(opts.token) || clean2(process.env.PAGS_RUNNER_TOKEN);
   const headers = resolved ? { Authorization: `Bearer ${resolved}` } : {};
-  const instanceId = clean(opts.instanceId) || clean(process.env.PAGS_INSTANCE_ID);
+  const instanceId = clean2(opts.instanceId) || clean2(process.env.PAGS_INSTANCE_ID);
   if (instanceId) headers["X-PAGS-Instance-Id"] = instanceId;
   return headers;
 }
@@ -903,11 +922,11 @@ function buildRuntimeRegistrationBody(opts, capabilities = []) {
   const node = hostname3();
   const machine = loadMachineIdentity(node);
   return {
-    endpointUrl: clean(opts.endpointUrl) || opts.endpointUrl,
-    token: clean(opts.runnerToken) || clean(opts.token) || clean(process.env.PAGS_RUNNER_TOKEN),
+    endpointUrl: clean2(opts.endpointUrl) || opts.endpointUrl,
+    token: clean2(opts.runnerToken) || clean2(opts.token) || clean2(process.env.PAGS_RUNNER_TOKEN),
     placement: opts.placement === "managed" ? "managed" : "local",
     capabilities,
-    runnerVersion: clean(opts.runnerVersion) || "",
+    runnerVersion: clean2(opts.runnerVersion) || "",
     runnerNode: node,
     machineId: machine.id,
     machineNames: machine.names
@@ -1284,11 +1303,11 @@ async function findFreePort2(start) {
 }
 function buildRunnerArgs(opts) {
   const args = [];
-  if (clean(opts.host)) args.push("--host", clean(opts.host));
-  if (clean(opts.port)) args.push("--port", clean(opts.port));
-  if (clean(opts.dataDir)) args.push("--data-dir", clean(opts.dataDir));
-  if (clean(opts.token)) args.push("--token", clean(opts.token));
-  if (clean(opts.instanceId)) args.push("--instance-id", clean(opts.instanceId));
+  if (clean2(opts.host)) args.push("--host", clean2(opts.host));
+  if (clean2(opts.port)) args.push("--port", clean2(opts.port));
+  if (clean2(opts.dataDir)) args.push("--data-dir", clean2(opts.dataDir));
+  if (clean2(opts.token)) args.push("--token", clean2(opts.token));
+  if (clean2(opts.instanceId)) args.push("--instance-id", clean2(opts.instanceId));
   if (opts.headless) args.push("--headless");
   return args;
 }
@@ -1545,9 +1564,9 @@ function partitionByPin(instances, thisNode, alsoKnownAs = []) {
   for (const inst of instances) (isEligible(inst, thisNode, alsoKnownAs) ? here : elsewhere).push(inst);
   return { here, elsewhere };
 }
-function pinnedAway(held, instances, thisNode, alsoKnownAs = []) {
+function pinnedAway(held2, instances, thisNode, alsoKnownAs = []) {
   const pins = new Map(instances.map((i) => [i.id, i.config?.runnerNode]));
-  return [...held].filter((id) => {
+  return [...held2].filter((id) => {
     const pin = pins.get(id);
     return !!pin && pin !== thisNode && !alsoKnownAs.includes(pin);
   });
@@ -2567,7 +2586,7 @@ var MEMBERSHIP_SYNC_PATH = "/pags/membership/sync";
 var CLI_CONTROL_PATHS = /* @__PURE__ */ new Set([MEMBERSHIP_SYNC_PATH, RUNNER_UPDATE_PATH, RUNNER_RESTART_PATH]);
 async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force = false, watchInstances = false) {
   const apiBase = pagsApiBase(opts.apiBase).replace(/^http/, "ws");
-  const pagsToken = () => clean(opts.pagsToken) || clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token);
+  const pagsToken = () => sessionToken(opts.pagsToken);
   if (!pagsToken()) throw new Error("PAGS token required for WebSocket relay");
   const runnerNode = hostname5();
   const machine = loadMachineIdentity(runnerNode);
@@ -3154,18 +3173,18 @@ function clip(text, max) {
   return `${text.substring(0, max)}
 [cut: showing the first ${max} of ${text.length} characters]`;
 }
-var clean2 = (value, max) => clip(maskSecrets(String(value ?? "")), max);
+var clean3 = (value, max) => clip(maskSecrets(String(value ?? "")), max);
 var shortId = (value) => typeof value === "string" && /^[A-Za-z0-9._:-]{1,128}$/.test(value) ? value : void 0;
 function describeError(error) {
   if (error instanceof Error) {
     const cause = error.cause;
     return {
-      message: clean2(`${error.name}: ${error.message}`, MAX_MESSAGE),
-      stack: error.stack ? clean2(error.stack, MAX_STACK) : void 0,
-      cause: cause === void 0 ? void 0 : clean2(cause instanceof Error ? `${cause.name}: ${cause.message}` : cause, MAX_MESSAGE)
+      message: clean3(`${error.name}: ${error.message}`, MAX_MESSAGE),
+      stack: error.stack ? clean3(error.stack, MAX_STACK) : void 0,
+      cause: cause === void 0 ? void 0 : clean3(cause instanceof Error ? `${cause.name}: ${cause.message}` : cause, MAX_MESSAGE)
     };
   }
-  return { message: clean2(error, MAX_MESSAGE) };
+  return { message: clean3(error, MAX_MESSAGE) };
 }
 function crashReport(input) {
   return {
@@ -3173,9 +3192,9 @@ function crashReport(input) {
     at: input.at ?? (/* @__PURE__ */ new Date()).toISOString(),
     source: input.source,
     kind: input.kind,
-    message: clean2(input.message, MAX_MESSAGE),
-    ...input.stack ? { stack: clean2(input.stack, MAX_STACK) } : {},
-    ...input.cause ? { cause: clean2(input.cause, MAX_MESSAGE) } : {},
+    message: clean3(input.message, MAX_MESSAGE),
+    ...input.stack ? { stack: clean3(input.stack, MAX_STACK) } : {},
+    ...input.cause ? { cause: clean3(input.cause, MAX_MESSAGE) } : {},
     ...input.exitCode !== void 0 ? { exitCode: input.exitCode } : {},
     ...input.signal !== void 0 ? { signal: input.signal } : {},
     ...shortId(input.build) ? { build: input.build } : {},
@@ -3183,8 +3202,8 @@ function crashReport(input) {
     ...shortId(input.instanceId) ? { instanceId: input.instanceId } : {},
     ...shortId(input.sessionId) ? { sessionId: input.sessionId } : {},
     ...shortId(input.taskId) ? { taskId: input.taskId } : {},
-    ...input.route ? { route: clean2(input.route, 200) } : {},
-    ...input.tail?.length ? { tail: input.tail.slice(-20).map((line) => clean2(line, 300)) } : {}
+    ...input.route ? { route: clean3(input.route, 200) } : {},
+    ...input.tail?.length ? { tail: input.tail.slice(-20).map((line) => clean3(line, 300)) } : {}
   };
 }
 function writeJsonAtomic(path, data, mode = 384) {
@@ -3458,10 +3477,11 @@ function createRunnerCommand() {
     await startRunnerForeground(opts);
   });
   command.command("connect <instanceIds...>").description("Start ONE local runtime, connect via WebSocket relay, and register it for every given PAGS instance").option("--host <host>", "Host to bind", "127.0.0.1").option("--port <port>", "Port to bind", "49171").option("--data-dir <path>", "Runner data directory").option("--token <token>", "Runner bearer token. Defaults to PAGS_RUNNER_TOKEN or a generated token").option("--headless", "Run Playwright headless").option("--api-base <url>", "PAGS API base URL").option("--pags-token <token>", "PAGS session token. Defaults to PAGS_TOKEN").option("--runner-version <version>", "Runner version").option("--force", "Take over from another connected machine").option("--watch-instances", "Attach newly eligible agents while running, without a restart").action(async (instanceIds, opts) => {
-    const runnerToken = clean(opts.token) || clean(process.env.PAGS_RUNNER_TOKEN) || `pags_runner_${randomUUID4()}`;
-    const host = clean(opts.host) || "127.0.0.1";
-    const port = clean(opts.port) || String(await findFreePort2(49171));
-    const lockAccount = clean(process.env.PAGS_LOCK_ACCOUNT) || "";
+    takeSessionTokenFromEnv();
+    const runnerToken = clean2(opts.token) || clean2(process.env.PAGS_RUNNER_TOKEN) || `pags_runner_${randomUUID4()}`;
+    const host = clean2(opts.host) || "127.0.0.1";
+    const port = clean2(opts.port) || String(await findFreePort2(49171));
+    const lockAccount = clean2(process.env.PAGS_LOCK_ACCOUNT) || "";
     let lockHeld = null;
     if (lockAccount) {
       const taken = await acquireLock({ account: lockAccount, node: hostname6(), machineId: loadMachineIdentity().id || null, version: CLI_VERSION, port: Number(port), runnerToken });
@@ -3505,7 +3525,7 @@ function createRunnerCommand() {
     });
     const deliver = async () => {
       if (!crashes) return;
-      const token = clean(opts.pagsToken) || clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token);
+      const token = sessionToken(opts.pagsToken);
       if (!token) return;
       const result = await deliverCrashReports({ apiBase: pagsApiBase(opts.apiBase), token, account: crashAccount, paths: crashes });
       if (result.delivered) writeLine(`Delivered ${result.delivered} crash report(s) to ProAgentStore.`);
@@ -3543,12 +3563,12 @@ function createRunnerCommand() {
       await connectViaRelay(instanceIds, localUrl, runnerToken, opts, Boolean(opts.force), Boolean(opts.watchInstances));
       void deliver().catch(() => void 0);
       setInterval(() => void deliver().catch(() => void 0), 5 * 6e4).unref();
-      if (!clean(opts.pagsToken)) {
+      if (!clean2(opts.pagsToken)) {
         startSessionRefresh({
           apiBase: pagsApiBase(opts.apiBase),
-          token: () => clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token) || null,
+          token: () => sessionToken() || null,
           onRefreshed: (token, previous) => {
-            process.env.PAGS_TOKEN = token;
+            holdSessionToken(token);
             const stored = loadSession();
             if (stored?.token === previous) saveSession({ ...stored, token, expiresAt: sessionExpiresAt(token) ?? stored.expiresAt });
           },
@@ -3738,8 +3758,8 @@ async function waitForBackgroundHolder(childPid, read, alive, opts = {}) {
   const deadline = Date.now() + (opts.timeoutMs ?? 3e4);
   while (Date.now() < deadline) {
     if (!alive(childPid)) return "exited";
-    const held = await read();
-    if (held.lock?.pid === childPid && held.verdict === "live") return "live";
+    const held2 = await read();
+    if (held2.lock?.pid === childPid && held2.verdict === "live") return "live";
     await sleep(opts.intervalMs ?? 500);
   }
   return alive(childPid) ? "timeout" : "exited";
@@ -3747,8 +3767,8 @@ async function waitForBackgroundHolder(childPid, read, alive, opts = {}) {
 async function waitUntilTakeable(read, opts = {}) {
   const deadline = Date.now() + (opts.timeoutMs ?? 15e3);
   for (; ; ) {
-    const held = await read();
-    if (!held.lock || isTakeable(held.verdict)) return true;
+    const held2 = await read();
+    if (!held2.lock || isTakeable(held2.verdict)) return true;
     if (Date.now() >= deadline) return false;
     await sleep(opts.intervalMs ?? 500);
   }
@@ -3785,8 +3805,8 @@ function describeStatus(lock, verdict, bg, now = Date.now()) {
 }
 var statusCommand = new Command9("status").description("Is a runner running on this machine for your account \u2014 and how was it started").action(async () => {
   const session = requireSession();
-  const held = await inspectHolder(lockPath(session.user.login));
-  const { running, lines } = describeStatus(held.lock, held.lock ? held.verdict : null, readBackgroundState(backgroundStatePath(session.user.login)));
+  const held2 = await inspectHolder(lockPath(session.user.login));
+  const { running, lines } = describeStatus(held2.lock, held2.lock ? held2.verdict : null, readBackgroundState(backgroundStatePath(session.user.login)));
   writeLine("");
   for (const line of lines) writeLine(`  ${line}`);
   writeLine("");
@@ -4039,13 +4059,13 @@ async function startInBackground(start, deps = processDeps()) {
   const upArgs = restartUpArgs(start.opts);
   const env = {
     ...deps.env,
-    PAGS_TOKEN: start.session.token,
     PAGS_LOCK_ACCOUNT: account,
     [BACKGROUND_ENV]: "1",
     [BACKGROUND_LOG_ENV]: logPath,
     [RESTART_COMMAND_ENV]: backgroundRestartCommand(deps.execPath, start.runnerArgs[0], upArgs, deps.platform)
   };
   delete env.PAGS_UP_SUPERVISED;
+  delete env.PAGS_TOKEN;
   deps.step("Starting the runner in the background\u2026", "wait");
   const pid = spawnDetached(deps.execPath, start.runnerArgs, env, logPath, deps.spawn);
   writeBackgroundState(backgroundStatePath(account, deps.env), {
@@ -4427,17 +4447,17 @@ var upCommand = new Command10("up").description("Start the browser runner for al
   printStep(`Connecting ${state.activeInstance}\u2026`, "wait");
   const lockFile = lockPath(session.user.login);
   if (unattended || opts.background && process.env[BACKGROUND_RESTART_ENV] === "1") await waitUntilTakeable(() => inspectHolder(lockFile), { timeoutMs: 6e4 });
-  const held = await inspectHolder(lockFile);
-  if (held.lock && !isTakeable(held.verdict)) {
-    logUpdateStep(`start: the lock is held by pid ${held.lock.pid} (${held.verdict})${opts.replace ? " \u2014 replacing it" : " \u2014 exiting"}`);
+  const held2 = await inspectHolder(lockFile);
+  if (held2.lock && !isTakeable(held2.verdict)) {
+    logUpdateStep(`start: the lock is held by pid ${held2.lock.pid} (${held2.verdict})${opts.replace ? " \u2014 replacing it" : " \u2014 exiting"}`);
     if (!opts.replace) {
       clearScreen();
       printLogo(CLI_VERSION2);
-      for (const line of holderMessage(held.lock, held.verdict)) writeLine(`  ${line}`);
+      for (const line of holderMessage(held2.lock, held2.verdict)) writeLine(`  ${line}`);
       writeLine("");
       process.exit(1);
     }
-    const replaced = await replaceHolder(held.lock, { now: opts.now === true });
+    const replaced = await replaceHolder(held2.lock, { now: opts.now === true });
     if (!replaced.ok) {
       clearScreen();
       printLogo(CLI_VERSION2);
@@ -4461,7 +4481,9 @@ var upCommand = new Command10("up").description("Start the browser runner for al
     stdio: ["ignore", "pipe", "pipe"],
     // The child is the lock HOLDER (#896): it owns the relay sockets, so it is what a
     // contender must find and what `--replace` must be able to stop.
-    env: { ...process.env, PAGS_TOKEN: session.token, [SUPERVISED_ENV]: SUPERVISOR_RESTARTS, PAGS_LOCK_ACCOUNT: session.user.login }
+    // No PAGS_TOKEN (#1163): the child reads session.json itself, so the account session is in no
+    // environment its runtime and engines could inherit.
+    env: { ...process.env, PAGS_TOKEN: void 0, [SUPERVISED_ENV]: SUPERVISOR_RESTARTS, PAGS_LOCK_ACCOUNT: session.user.login }
   });
   const logs = [];
   let childRsid = "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.154",
+  "version": "0.4.156",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",