@proagentstore/cli 0.4.155 → 0.4.158

package/dist/bootstrap.js

@@ -16,7 +16,7 @@ import {
   payloadAt,
   payloadRoot,
   readTrial
-} from "./chunk-PKMXQJEJ.js";
+} from "./chunk-7O4S5477.js";
 
 // src/bootstrap.ts
 import { existsSync } from "fs";

package/dist/browser-runner/coding/pane-redact.js

@@ -0,0 +1,84 @@
+import { maskSecrets } from "../crash-reports.js";
+import { tmuxExec } from "./tmux.js";
+/** How long a delivered value is masked in captures. */
+export const INJECTED_TTL_MS = 24 * 60 * 60_000;
+const MAX_REMEMBERED = 50;
+const injected = [];
+/** Mask `value` in every capture from now on (for {@link INJECTED_TTL_MS}). Values under 4 characters are not maskable. */
+export function rememberInjected(value, now = Date.now()) {
+    const v = value.trim();
+    if (v.length < 4)
+        return;
+    injected.push({ value: v, until: now + INJECTED_TTL_MS });
+    while (injected.length > MAX_REMEMBERED)
+        injected.shift();
+}
+/** For tests. */
+export function forgetInjected() {
+    injected.length = 0;
+}
+/** Every remembered value in `text`, replaced character for character with `•` — across line wraps too. */
+export function maskInjected(text, now = Date.now()) {
+    const live = injected.filter((e) => e.until > now);
+    if (!live.length || !text)
+        return text;
+    // Search the text with its newlines removed, then mask the ORIGINAL positions, so a value tmux wrapped
+    // onto the next row is still found and the pane keeps its shape.
+    const at = [];
+    let flat = "";
+    for (let i = 0; i < text.length; i++) {
+        if (text[i] === "\n" || text[i] === "\r")
+            continue;
+        at.push(i);
+        flat += text[i];
+    }
+    const chars = text.split("");
+    for (const { value } of live) {
+        for (let i = flat.indexOf(value); i !== -1; i = flat.indexOf(value, i + value.length)) {
+            for (let k = i; k < i + value.length; k++)
+                chars[at[k]] = "•";
+        }
+    }
+    return chars.join("");
+}
+/** A pane as it may leave this machine. */
+export function redactPane(text, now = Date.now()) {
+    return maskInjected(maskSecrets(text), now);
+}
+const redacting = new WeakSet();
+/** Mark this response's panes for redaction: a terminal route, unless the caller is inject confirming a delivery. */
+export function redactPanesOf(res, path, body) {
+    if ((path.startsWith("/tmux/") || path.startsWith("/terminal/")) && body?.unmasked !== true)
+        redacting.add(res);
+}
+/** The body `json()` writes: its `pane`/`paneBefore` redacted when {@link redactPanesOf} marked the response. */
+export function outgoing(res, body) {
+    if (!redacting.has(res) || !body || typeof body !== "object")
+        return body;
+    const out = { ...body };
+    for (const key of ["pane", "paneBefore"])
+        if (typeof out[key] === "string")
+            out[key] = redactPane(out[key]);
+    return out;
+}
+/**
+ * `POST /secure/scrub {target, value}`: after an echoed delivery, remember the value for masking and clear
+ * the tmux pane's scrollback. `cleared` is false for a non-tmux backend, whose history this cannot reach.
+ */
+export function scrubDelivered(body) {
+    const value = typeof body.value === "string" ? body.value : "";
+    const target = typeof body.target === "string" ? body.target.trim() : "";
+    if (!value || !target)
+        return { remembered: false, cleared: false };
+    rememberInjected(value);
+    const tmuxTarget = /^tmux:/i.test(target) ? target.slice(5) : /^(kitty|iterm2):/i.test(target) ? "" : target;
+    if (!tmuxTarget)
+        return { remembered: true, cleared: false };
+    try {
+        tmuxExec(["clear-history", "-t", tmuxTarget]);
+        return { remembered: true, cleared: true };
+    }
+    catch {
+        return { remembered: true, cleared: false };
+    }
+}

package/dist/browser-runner/coding/runtime.js

@@ -1,3 +1,4 @@
+import { confineWorkDir } from "./workdir-guard.js";
 import { actDigest } from "./input-ledger.js";
 import { parkRestore, parkSnapshot } from "./park-snapshot.js";
 import { runObjective } from "./run-objective.js";
@@ -15,6 +16,13 @@ const MAX_PANE = 64 * 1024;
 export class CodingRuntime {
     reposBaseDir;
     sessions = new Map();
+    /**
+     * Which agent instance each session belongs to (#1164). One `pags up` serves every agent on the
+     * machine, and every relayed request names the instance whose socket it arrived on — so a session
+     * started by one agent must not be driven, read or ended through another's. Bound at `/coding/start`;
+     * a session with no binding (one started before this, or by a local caller) answers to anyone, as before.
+     */
+    owners = new Map();
     /**
      * Coding turns that are running here (#896, #1007).
      *
@@ -84,21 +92,26 @@ export class CodingRuntime {
      * workDir (authoritative even for managed clone dirs); fall back to an explicit path
      * (the cloud passes the D1 `repo.workdir` when the session map is empty after a runner
      * restart). Expands a leading `~` the same way start() does.
+     *
+     * An explicit path is CONFINED (#1165): never the home folder or above it, never inside a
+     * credential directory — so `{ workDir: "~", path: ".ssh/id_ed25519" }` is refused rather
+     * than a confined read of a private key. See `workdir-guard.ts`.
      */
     resolveWorkDir(input) {
         if (input.sessionId) {
             const s = this.sessions.get(input.sessionId);
+            // The session's own folder answers to the same rule: a session started in `~` must not reopen it.
             if (s)
-                return s.config.workDir;
+                return confineWorkDir(s.config.workDir, { allow: [this.reposBaseDir] });
         }
         if (input.workDir)
-            return resolve(input.workDir.replace(/^~(?=$|\/)/, homedir()));
+            return confineWorkDir(input.workDir, { allow: [this.reposBaseDir] });
         throw new InspectError("no session or workDir to inspect");
     }
     /** Where a parked run's checkout is (#1077): its declared folder, else the managed clone dir `start()` uses. */
     parkWorkDir(input) {
         if (input.workDir)
-            return resolve(input.workDir.replace(/^~(?=$|\/)/, homedir()));
+            return confineWorkDir(input.workDir, { allow: [this.reposBaseDir] });
         if (input.repoId)
             return join(this.reposBaseDir, sanitizeSessionName(input.repoId));
         throw new InspectError("no workDir or repoId for the parked checkout");
@@ -357,6 +370,22 @@ export class CodingRuntime {
         this.takeovers.delete(sessionId);
         return { ok: true, usage, acts, authResolved };
     }
+    /** Record the instance a session belongs to — the first one to start it (#1164). */
+    bindInstance(sessionId, instanceId) {
+        if (sessionId && instanceId && !this.owners.has(sessionId))
+            this.owners.set(sessionId, instanceId);
+    }
+    /** Why `instanceId` may not touch this session, or null (#1164). An unbound session, or no caller instance, is not refused. */
+    instanceRefusal(sessionId, instanceId) {
+        const owner = this.owners.get(sessionId);
+        if (!owner || !instanceId || owner === instanceId)
+            return null;
+        return `Coding session ${sessionId} belongs to another agent on this machine; a request from this agent cannot reach it.`;
+    }
+    /** Is this session visible to `instanceId` — its own, unbound, or no caller instance (#1164)? */
+    visibleTo(sessionId, instanceId) {
+        return this.instanceRefusal(sessionId, instanceId) === null;
+    }
     list() {
         return [...this.sessions.entries()].map(([sessionId, s]) => ({
             sessionId,

package/dist/browser-runner/coding/secret-file.js

@@ -1,7 +1,8 @@
-import { closeSync, constants, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeSync } from "node:fs";
+import { closeSync, constants, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { RunnerInputError } from "../errors.js";
+import { isWithin, realPathOf } from "./workdir-guard.js";
 /**
  * The runner's half of the machine-to-machine secret handoff (#918): read a secret file so the
  * cloud can encrypt it, and write one back from the cloud's decrypted copy.
@@ -18,23 +19,44 @@ import { RunnerInputError } from "../errors.js";
  */
 /** Big enough for any `.env`, key file or credentials JSON; small enough that this is not a file-transfer tool. */
 export const SECRET_MAX_BYTES = 64 * 1024;
-/** `~` expanded; a relative path resolves against the home directory, which is where `pags up` users name things from. */
-function resolvePath(raw) {
+/**
+ * The ONE folder the secret handoff reads from and writes to (#1165).
+ *
+ * It used to take any path the owner's account could reach: `/secure/read` would hand over
+ * `~/.ssh/id_ed25519`, and `/secure/write` with `overwrite: true` could replace `~/.ssh/authorized_keys`.
+ * Now a relative path is relative to this folder, and an absolute or `~/…` path must already be inside
+ * it, resolved through symlinks, so a link planted in it cannot point back out. Moving a delivered
+ * file to where it is used is the operator's step, in the open.
+ */
+export function secureFilesDir(home = homedir()) {
+    return join(home, ".config", "proagentstore", "secure-files");
+}
+/** `~` expanded; relative to {@link secureFilesDir}; refused unless it stays inside that folder. */
+function resolvePath(raw, home = homedir()) {
     const p = String(raw ?? "").trim();
     if (!p)
         throw new RunnerInputError("A `path` is required.");
-    const expanded = p.replace(/^~(?=$|\/)/, homedir());
-    return isAbsolute(expanded) ? resolve(expanded) : resolve(homedir(), expanded);
+    const root = secureFilesDir(home);
+    const expanded = p.replace(/^~(?=$|\/)/, home);
+    const path = isAbsolute(expanded) ? resolve(expanded) : resolve(root, expanded);
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    if (path === root || !isWithin(realPathOf(path, home), realPathOf(root, home))) {
+        throw new RunnerInputError(`${p} is outside ${root}. The secret handoff reads and writes only inside that folder — name a file there, e.g. \`app.env\`.`);
+    }
+    return path;
 }
-export function readSecretFile(input) {
-    const path = resolvePath(input.path);
+export function readSecretFile(input, home = homedir()) {
+    const path = resolvePath(input.path, home);
     let st;
     try {
-        st = statSync(path);
+        st = lstatSync(path);
     }
     catch {
         throw new RunnerInputError(`No file at ${path}.`);
     }
+    // Not followed (#1165): a symlink in the folder would read whatever it points at.
+    if (st.isSymbolicLink())
+        throw new RunnerInputError(`${path} is a symbolic link; the secret handoff reads regular files only.`);
     if (!st.isFile())
         throw new RunnerInputError(`${path} is not a regular file.`);
     if (st.size === 0)
@@ -63,8 +85,8 @@ function parseMode(raw) {
         throw new RunnerInputError(`mode ${s} is group/world-writable or executable; a secret file must not be.`);
     return mode;
 }
-export function writeSecretFile(input) {
-    const path = resolvePath(input.path);
+export function writeSecretFile(input, home = homedir()) {
+    const path = resolvePath(input.path, home);
     if (typeof input.value !== "string" || !input.value)
         throw new RunnerInputError("Nothing to write.");
     const mode = parseMode(input.mode);

package/dist/browser-runner/coding/workdir-guard.js

@@ -0,0 +1,80 @@
+/**
+ * What a caller-supplied `workDir` may be (#1165).
+ *
+ * The read-only inspection routes (`read-file`, `tree`, `search`, `git`) confine every PATH to the
+ * `workDir` — but took the `workDir` itself from the request. `{ workDir: "~", path: ".ssh/id_ed25519" }`
+ * was a perfectly confined read of a private key. The cloud sends the owner's registered repo folder
+ * (`coding_repos.workdir`), and registration accepts any local path, `~` included; this runner has no
+ * copy of that registry to check against. So it refuses what can never be a repository it should
+ * read inside, whoever asked:
+ *
+ *   • the filesystem root, the home folder, or any folder ABOVE the home folder — a root that holds
+ *     everything the owner has;
+ *   • a folder inside a credential directory ({@link CREDENTIAL_DIRS}) — `~/.ssh`, `~/.gnupg`, the
+ *     cloud CLIs' config, and ProAgentStore's own (`~/.config/proagentstore`, which holds the account
+ *     session), except the managed clones the runner itself makes there.
+ *
+ * Resolved through symlinks first (the nearest existing ancestor, for a folder a clone will create), so
+ * `~/dev/innocent -> ~/.ssh` is the credential directory it points at.
+ */
+import { existsSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { InspectError } from "./inspect.js";
+/** Folders under the home folder whose contents are credentials, never a repository to read. */
+export const CREDENTIAL_DIRS = [
+    ".ssh",
+    ".gnupg",
+    ".aws",
+    ".azure",
+    ".kube",
+    ".docker",
+    ".password-store",
+    ".config/gcloud",
+    ".config/gh",
+    ".config/proagentstore",
+    "Library/Keychains",
+];
+/** `~` expanded; resolved through symlinks as far as the path exists. */
+export function realPathOf(raw, home = homedir()) {
+    const expanded = raw.trim().replace(/^~(?=$|[\\/])/, home);
+    let p = resolve(isAbsolute(expanded) ? expanded : join(home, expanded));
+    const tail = [];
+    while (!existsSync(p)) {
+        const up = dirname(p);
+        if (up === p)
+            break;
+        tail.unshift(basename(p));
+        p = up;
+    }
+    let real = p;
+    try {
+        real = realpathSync(p);
+    }
+    catch {
+        // Unreadable: judge the path as written.
+    }
+    return tail.length ? join(real, ...tail) : real;
+}
+/** Is `child` the same as `parent` or inside it? */
+export function isWithin(child, parent) {
+    const rel = relative(parent, child);
+    return rel === "" || (!!rel && !rel.startsWith("..") && !isAbsolute(rel));
+}
+/**
+ * The `workDir` a request may name, or an {@link InspectError} saying why not. `allow` lists folders the
+ * runner itself manages inside a credential directory — the managed clone root — which stay usable.
+ */
+export function confineWorkDir(raw, opts = {}) {
+    const home = realPathOf(opts.home ?? homedir(), opts.home ?? homedir());
+    const path = realPathOf(raw, opts.home ?? homedir());
+    if (isWithin(home, path)) {
+        throw new InspectError(`"${raw}" is ${path === home ? "the home folder" : "a folder that contains the home folder"}, not a repository — register the repository's own folder.`);
+    }
+    if ((opts.allow ?? []).some((a) => isWithin(path, realPathOf(a, home))))
+        return path;
+    const credential = CREDENTIAL_DIRS.find((d) => isWithin(path, realPathOf(join(home, d), home)));
+    if (credential)
+        throw new InspectError(`"${raw}" is inside ~/${credential}, which holds credentials — it cannot be read as a repository.`);
+    return path;
+}

package/dist/browser-runner/crash-reports.js

@@ -57,12 +57,19 @@ export const MAX_REPORTS = 100;
 export const MAX_QUARANTINED = 5;
 const MAX_MESSAGE = 1000;
 const MAX_STACK = 4000;
-/** Mask credential-shaped text: bearer tokens, API keys, JWTs, `token=…` pairs. */
+/**
+ * Mask credential-shaped text: bearer tokens, API keys, JWTs, `token=…` pairs.
+ *
+ * THE redactor for everything this machine sends to the platform (#1166): crash reports, the update log
+ * (`bootstrap/update-log.ts`) and terminal panes (`coding/pane-redact.ts`). A PAGS session is TWO
+ * segments — `base64url(json).hmac` (`workers/api/src/lib/session.ts`) — so the token rule takes an
+ * optional third: a three-segment-only rule masked a bare session only when `Bearer`/`token=` preceded it.
+ */
 export function maskSecrets(text) {
     return text
         .replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi, "$1 [redacted]")
         .replace(/\b(sk-[A-Za-z0-9_-]{8,}|ghp_[A-Za-z0-9]{8,}|gho_[A-Za-z0-9]{8,}|github_pat_[A-Za-z0-9_]{8,}|xox[abp]-[A-Za-z0-9-]{8,}|pags_runner_[A-Za-z0-9-]{8,})/g, "[redacted]")
-        .replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, "[redacted-jwt]")
+        .replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{16,}(?:\.[A-Za-z0-9_-]{8,})?/g, "[redacted-jwt]")
         .replace(/\b((?:api[_-]?key|token|secret|password|authorization)\s*[=:]\s*)("?)[^\s"&]{4,}\2/gi, "$1[redacted]");
 }
 /** A stable, non-identifying key for an account — the same as the runner lock's (`runner-lock.ts`). */

package/dist/browser-runner/request-instance.js

@@ -0,0 +1,42 @@
+import { RunnerInputError } from "./errors.js";
+/** The relayed instance id header, or undefined. */
+export function instanceOf(req) {
+    const raw = req.headers["x-pags-instance-id"];
+    const id = (Array.isArray(raw) ? raw[0] : raw)?.trim();
+    return id || undefined;
+}
+/** The coding session a `/coding/*` request is about: its body's `sessionId`, or the takeover path's id. */
+export function codingSessionIdOf(path, body) {
+    const m = path.match(/^\/coding\/takeover\/([^/]+)\//);
+    if (m)
+        return decodeURIComponent(m[1]);
+    return typeof body?.sessionId === "string" && body.sessionId ? body.sessionId : null;
+}
+/** Why `caller` may not reach the coding session this request names, or null. */
+export async function codingSessionRefusal(coding, req, path, caller) {
+    if (!path.startsWith("/coding/"))
+        return null;
+    const sessionId = codingSessionIdOf(path, req.method === "POST" ? await readJson(req) : undefined);
+    return sessionId ? coding.instanceRefusal(sessionId, caller) : null;
+}
+/** A body read once and kept, so the session guard and the route handler both see it. */
+const bodies = new WeakMap();
+export async function readJson(req) {
+    if (bodies.has(req))
+        return bodies.get(req);
+    const chunks = [];
+    for await (const chunk of req)
+        chunks.push(Buffer.from(chunk));
+    const raw = Buffer.concat(chunks).toString("utf-8");
+    let parsed = {};
+    if (raw) {
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            throw new RunnerInputError("Request body must be valid JSON");
+        }
+    }
+    bodies.set(req, parsed);
+    return parsed;
+}

package/dist/browser-runner/server.js

@@ -1,3 +1,5 @@
+import { outgoing, redactPanesOf, scrubDelivered } from "./coding/pane-redact.js";
+import { codingSessionRefusal, instanceOf, readJson } from "./request-instance.js";
 import { createServer, } from "node:http";
 import { URL } from "node:url";
 import { recordRequestFailure } from "./request-failure.js";
@@ -75,6 +77,15 @@ export async function startRunnerServer(config) {
 async function route(runner, req, res) {
     const url = new URL(req.url || "/", `http://${req.headers.host || "127.0.0.1"}`);
     const path = url.pathname.replace(/\/$/, "") || "/";
+    // The agent this request came from, and whether it may touch the coding session it names (#1164, request-instance.ts).
+    const caller = instanceOf(req);
+    const refused = await codingSessionRefusal(runner.coding, req, path, caller);
+    if (refused)
+        return json(res, 403, { error: refused });
+    // Panes leave this machine redacted (#1166, coding/pane-redact.ts); a delivered secret is scrubbed.
+    redactPanesOf(res, path, req.method === "POST" && /^\/(tmux|terminal)\//.test(path) ? await readJson(req) : undefined);
+    if (req.method === "POST" && path === "/secure/scrub")
+        return json(res, 200, scrubDelivered(await readJson(req)));
     if ((req.method === "GET" || req.method === "POST") && path === "/health") {
         // #896: a health check that cannot say WHO answered is not enough to decide anything with.
         // A contender for the single-instance lock has a pid and a port from the lock file; what it
@@ -290,7 +301,9 @@ async function route(runner, req, res) {
     }
     if (req.method === "POST" && path === "/coding/start") {
         const b = await readJson(req);
-        return json(res, 200, runner.coding.start(b));
+        const started = runner.coding.start(b);
+        runner.coding.bindInstance(b.sessionId, caller);
+        return json(res, 200, started);
     }
     if (req.method === "POST" && path === "/coding/capture") {
         // `drainUsage` opts this caller in to consuming the session's measured engine spend (#267).
@@ -308,7 +321,8 @@ async function route(runner, req, res) {
         return json(res, 200, runner.coding.end(b.sessionId));
     }
     if (req.method === "GET" && path === "/coding/sessions") {
-        return json(res, 200, { sessions: runner.coding.list() });
+        // Each agent sees its own sessions (#1164); a local caller (the update controller) sees them all.
+        return json(res, 200, { sessions: runner.coding.list().filter((s) => runner.coding.visibleTo(s.sessionId, caller)) });
     }
     // Per-session CPU and memory, for the heartbeat (#924): which agent is loading this machine.
     if (req.method === "GET" && path === "/coding/resources") {
@@ -827,20 +841,6 @@ function authorize(req, config) {
     const headerToken = req.headers["x-pags-runner-token"];
     return auth === `Bearer ${token}` || headerToken === token;
 }
-async function readJson(req) {
-    const chunks = [];
-    for await (const chunk of req)
-        chunks.push(Buffer.from(chunk));
-    const raw = Buffer.concat(chunks).toString("utf-8");
-    if (!raw)
-        return {};
-    try {
-        return JSON.parse(raw);
-    }
-    catch {
-        throw new RunnerInputError("Request body must be valid JSON");
-    }
-}
 function clampLimit(value, fallback, max) {
     const parsed = Number(value || fallback);
     if (!Number.isFinite(parsed))
@@ -852,5 +852,5 @@ function json(res, status, body) {
         "Content-Type": "application/json; charset=utf-8",
         "X-Content-Type-Options": "nosniff",
     });
-    res.end(JSON.stringify(body));
+    res.end(JSON.stringify(outgoing(res, body)));
 }

package/dist/{chunk-PKMXQJEJ.js → chunk-7O4S5477.js}

@@ -207,21 +207,193 @@ async function installPayload(version, root = payloadRoot(), install = npmInstal
   return payload;
 }
 
+// src/crash-reports.ts
+import { closeSync, copyFileSync, existsSync as existsSync2, fsyncSync, mkdirSync as mkdirSync3, openSync, readdirSync as readdirSync2, readFileSync as readFileSync3, renameSync as renameSync3, unlinkSync, writeSync } from "fs";
+import { basename, dirname, join as join3 } from "path";
+import { createHash, randomUUID } from "crypto";
+var MAX_REPORTS = 100;
+var MAX_QUARANTINED = 5;
+var MAX_MESSAGE = 1e3;
+var MAX_STACK = 4e3;
+function maskSecrets(text) {
+  return text.replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi, "$1 [redacted]").replace(/\b(sk-[A-Za-z0-9_-]{8,}|ghp_[A-Za-z0-9]{8,}|gho_[A-Za-z0-9]{8,}|github_pat_[A-Za-z0-9_]{8,}|xox[abp]-[A-Za-z0-9-]{8,}|pags_runner_[A-Za-z0-9-]{8,})/g, "[redacted]").replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{16,}(?:\.[A-Za-z0-9_-]{8,})?/g, "[redacted-jwt]").replace(/\b((?:api[_-]?key|token|secret|password|authorization)\s*[=:]\s*)("?)[^\s"&]{4,}\2/gi, "$1[redacted]");
+}
+function crashAccountKey(login) {
+  return createHash("sha256").update(login.trim().toLowerCase()).digest("hex").substring(0, 12);
+}
+function clip(text, max) {
+  if (text.length <= max) return text;
+  return `${text.substring(0, max)}
+[cut: showing the first ${max} of ${text.length} characters]`;
+}
+var clean = (value, max) => clip(maskSecrets(String(value ?? "")), max);
+var shortId = (value) => typeof value === "string" && /^[A-Za-z0-9._:-]{1,128}$/.test(value) ? value : void 0;
+function describeError(error) {
+  if (error instanceof Error) {
+    const cause = error.cause;
+    return {
+      message: clean(`${error.name}: ${error.message}`, MAX_MESSAGE),
+      stack: error.stack ? clean(error.stack, MAX_STACK) : void 0,
+      cause: cause === void 0 ? void 0 : clean(cause instanceof Error ? `${cause.name}: ${cause.message}` : cause, MAX_MESSAGE)
+    };
+  }
+  return { message: clean(error, MAX_MESSAGE) };
+}
+function crashReport(input) {
+  return {
+    id: shortId(input.id) ?? `crash_${randomUUID()}`,
+    at: input.at ?? (/* @__PURE__ */ new Date()).toISOString(),
+    source: input.source,
+    kind: input.kind,
+    message: clean(input.message, MAX_MESSAGE),
+    ...input.stack ? { stack: clean(input.stack, MAX_STACK) } : {},
+    ...input.cause ? { cause: clean(input.cause, MAX_MESSAGE) } : {},
+    ...input.exitCode !== void 0 ? { exitCode: input.exitCode } : {},
+    ...input.signal !== void 0 ? { signal: input.signal } : {},
+    ...shortId(input.build) ? { build: input.build } : {},
+    ...shortId(input.account) ? { account: input.account } : {},
+    ...shortId(input.instanceId) ? { instanceId: input.instanceId } : {},
+    ...shortId(input.sessionId) ? { sessionId: input.sessionId } : {},
+    ...shortId(input.taskId) ? { taskId: input.taskId } : {},
+    ...input.route ? { route: clean(input.route, 200) } : {},
+    ...input.tail?.length ? { tail: input.tail.slice(-20).map((line) => clean(line, 300)) } : {}
+  };
+}
+function writeJsonAtomic(path, data, mode = 384) {
+  mkdirSync3(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  const fd = openSync(tmp, "w", mode);
+  try {
+    writeSync(fd, `${JSON.stringify(data, null, 2)}
+`);
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  try {
+    renameSync3(tmp, path);
+  } catch (error) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw error;
+  }
+}
+function removeStaleTemps(path) {
+  const dir = dirname(path);
+  const prefix = `${basename(path)}.`;
+  if (!existsSync2(dir)) return;
+  for (const name of readdirSync2(dir)) {
+    if (!name.startsWith(prefix) || !name.endsWith(".tmp")) continue;
+    try {
+      unlinkSync(join3(dir, name));
+    } catch {
+    }
+  }
+}
+function readJsonOrQuarantine(path) {
+  removeStaleTemps(path);
+  if (!existsSync2(path)) return { status: "missing" };
+  try {
+    return { status: "ok", value: JSON.parse(readFileSync3(path, "utf-8")) };
+  } catch (error) {
+    const quarantinedTo = `${path}.corrupt-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+    try {
+      renameSync3(path, quarantinedTo);
+    } catch {
+      try {
+        copyFileSync(path, quarantinedTo);
+      } catch (copyError) {
+        return { status: "quarantined", quarantinedTo: "(not preserved)", error: `${describeError(error).message}; preserving it failed: ${describeError(copyError).message}` };
+      }
+    }
+    pruneQuarantine(path);
+    return { status: "quarantined", quarantinedTo, error: describeError(error).message };
+  }
+}
+function pruneQuarantine(path) {
+  const dir = dirname(path);
+  const prefix = `${basename(path)}.corrupt-`;
+  const copies = readdirSync2(dir).filter((name) => name.startsWith(prefix)).sort();
+  const excess = copies.length - MAX_QUARANTINED;
+  for (const name of excess > 0 ? copies.slice(0, excess) : []) {
+    try {
+      unlinkSync(join3(dir, name));
+    } catch {
+    }
+  }
+}
+var CrashLog = class {
+  /** `base` stamps the reports this log writes about ITSELF (a quarantined file). */
+  constructor(path, base = { source: "runtime" }) {
+    this.path = path;
+    this.base = base;
+  }
+  path;
+  base;
+  /** Everything still on disk, oldest first. A corrupt file is quarantined and reported, then read as a fresh file. */
+  read() {
+    const got = readJsonOrQuarantine(this.path);
+    if (got.status === "ok") {
+      const reports = Array.isArray(got.value.reports) ? got.value.reports.filter((r) => !!r && typeof r.id === "string") : [];
+      return { reports, dropped: Number(got.value.dropped) || 0 };
+    }
+    if (got.status === "missing") return { reports: [], dropped: 0 };
+    const file = {
+      reports: [crashReport({ ...this.base, kind: "store_corrupt", message: `crash-report file was unreadable and was moved to ${basename(got.quarantinedTo)}: ${got.error}` })],
+      dropped: 0
+    };
+    this.write(file);
+    return file;
+  }
+  /** Append a report (bounded). Never throws: a crash path must not crash on its own record. */
+  record(report) {
+    try {
+      const file = this.read();
+      if (file.reports.some((r) => r.id === report.id)) return true;
+      file.reports.push(report);
+      const over = file.reports.length - MAX_REPORTS;
+      if (over > 0) {
+        file.reports = file.reports.slice(over);
+        file.dropped += over;
+      }
+      this.write(file);
+      return true;
+    } catch (error) {
+      process.stderr.write(`[crash-reports] could not record ${report.kind}: ${describeError(error).message}
+`);
+      return false;
+    }
+  }
+  /** Drop reports by id — only by this file's own writer. */
+  remove(ids) {
+    if (!ids.length) return;
+    const file = this.read();
+    const gone = new Set(ids);
+    file.reports = file.reports.filter((r) => !gone.has(r.id));
+    this.write(file);
+  }
+  write(file) {
+    writeJsonAtomic(this.path, file);
+  }
+};
+
 // src/bootstrap/update-log.ts
-import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, statSync, writeFileSync as writeFileSync2 } from "fs";
+import { appendFileSync, existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync4, statSync, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname, join as join3 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 var MAX_BYTES = 256 * 1024;
 var UPDATE_LOG_UPLOAD_CHARS = 4e3;
 function updateLogPath(env = process.env) {
-  return env.PAGS_UPDATE_LOG?.trim() || join3(env.PAGS_CONFIG_DIR?.trim() || join3(homedir2(), ".config", "proagentstore"), "update.log");
+  return env.PAGS_UPDATE_LOG?.trim() || join4(env.PAGS_CONFIG_DIR?.trim() || join4(homedir2(), ".config", "proagentstore"), "update.log");
 }
 function logUpdateStep(step, env = process.env, now = /* @__PURE__ */ new Date()) {
   const path = updateLogPath(env);
   try {
-    mkdirSync3(dirname(path), { recursive: true });
-    if (existsSync2(path) && statSync(path).size > MAX_BYTES) {
-      const text = readFileSync3(path, "utf8");
+    mkdirSync4(dirname2(path), { recursive: true });
+    if (existsSync3(path) && statSync(path).size > MAX_BYTES) {
+      const text = readFileSync4(path, "utf8");
       writeFileSync2(path, text.slice(text.indexOf("\n", text.length / 2) + 1));
     }
     appendFileSync(path, `${now.toISOString()} [${process.pid}] ${step.replace(/\s*\n\s*/g, " | ")}
@@ -231,7 +403,7 @@ function logUpdateStep(step, env = process.env, now = /* @__PURE__ */ new Date()
 }
 function updateLogTail(env = process.env, maxChars = UPDATE_LOG_UPLOAD_CHARS) {
   try {
-    const text = readFileSync3(updateLogPath(env), "utf8").trimEnd();
+    const text = maskSecrets(readFileSync4(updateLogPath(env), "utf8").trimEnd());
     if (!text) return null;
     if (text.length <= maxChars) return text;
     const cut = text.slice(-maxChars);
@@ -276,6 +448,11 @@ export {
   latestPublishedRelease,
   latestPublishedVersion,
   installPayload,
+  crashAccountKey,
+  crashReport,
+  writeJsonAtomic,
+  readJsonOrQuarantine,
+  CrashLog,
   logUpdateStep,
   updateLogUpload
 };

package/dist/index.js

@@ -2,8 +2,11 @@
 import {
   BOOTSTRAP_ENV,
   CLI_PACKAGE,
+  CrashLog,
   badVersions,
   beginTrial,
+  crashAccountKey,
+  crashReport,
   installPayload,
   isVersion,
   latestPublishedRelease,
@@ -11,10 +14,12 @@ import {
   markPayloadHealthy,
   olderThan,
   payloadRoot,
+  readJsonOrQuarantine,
   runNpm,
   takeRollbackNotice,
-  updateLogUpload
-} from "./chunk-PKMXQJEJ.js";
+  updateLogUpload,
+  writeJsonAtomic
+} from "./chunk-7O4S5477.js";
 
 // src/index.ts
 import { createRequire as createRequire3 } from "module";
@@ -1272,7 +1277,7 @@ var publishCommand = new Command7("publish").description("Publish an agent to Pr
 
 // src/commands/runner/command.ts
 import { spawn as spawn5 } from "child_process";
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 import { Command as Command8 } from "commander";
 
 // src/commands/runner/process.ts
@@ -1426,6 +1431,78 @@ function sampleResources(read = os, now = Date.now(), extra = {}) {
   };
 }
 
+// src/commands/runner/route-policy.ts
+var ALWAYS = ["/health", "/capabilities", "/events"];
+var READ_ALWAYS = ["/tasks"];
+var BROWSER = ["/tasks", "/browser/", "/takeover", "/sessions"];
+var BY_RUNTIME = {
+  // The coding engine, the website runtime builder's task, and the engine's own SIGN-IN: the cloud relays the
+  // login page through `/browser/act` + `/browser/handoff` and its card through `/takeover` (coding-sessions-open.ts).
+  coding: ["/coding/", "/tasks", "/browser/act", "/browser/handoff", "/takeover"],
+  browser: BROWSER,
+  local_browser: ["/local-browser/"],
+  local_artifact: ["/local-artifact/"],
+  local_apply: ["/local-apply/", ...BROWSER],
+  local_native: ["/native/"]
+};
+var TERMINAL = ["/tmux/", "/terminal/", "/secure/"];
+var REPO_READS = ["/coding/tree", "/coding/read-file", "/coding/git", "/coding/search", "/coding/git-remote", "/coding/repo-check"];
+var SIGN_IN_TMUX = /* @__PURE__ */ new Set(["/tmux/session", "/tmux/run", "/tmux/send", "/tmux/capture"]);
+var SIGN_IN_SESSION = /^pags-signin-[a-z0-9_-]+$/;
+function hasTerminal(caps) {
+  const tools = caps.tools ?? [];
+  return (caps.surfaces ?? []).includes("tmux") || tools.some((t) => t.startsWith("tmux_") || t.startsWith("terminal_"));
+}
+function allowedPrefixes(caps) {
+  const out = [...ALWAYS];
+  if (!caps) return out;
+  if (caps.runtime && BY_RUNTIME[caps.runtime]) out.push(...BY_RUNTIME[caps.runtime]);
+  const tools = caps.tools ?? [];
+  if (hasTerminal(caps)) out.push(...TERMINAL);
+  if (tools.some((t) => t.startsWith("browser_"))) out.push("/browser/");
+  if (tools.some((t) => t.startsWith("repo_"))) out.push(...REPO_READS);
+  return out;
+}
+function covers(prefix, path) {
+  if (prefix.endsWith("/")) return path.startsWith(prefix);
+  return path === prefix || path.startsWith(`${prefix}/`);
+}
+function routeRefusal(caps, path, method = "POST", body) {
+  const clean3 = path.split("?")[0] ?? path;
+  if (/(^|\/)\.\.(\/|$)/.test(clean3)) return `Refused ${clean3}: a relayed path may not climb out of its route.`;
+  if (allowedPrefixes(caps).some((p) => covers(p, clean3))) return null;
+  if ((method === "GET" || method === "HEAD") && READ_ALWAYS.some((p) => covers(p, clean3))) return null;
+  if (caps?.runtime === "coding" && SIGN_IN_TMUX.has(clean3)) {
+    const session = body?.session;
+    if (typeof session === "string" && SIGN_IN_SESSION.test(session)) return null;
+  }
+  return `Refused ${clean3}: this agent's declared capabilities do not include it, so this machine will not run it for this agent.`;
+}
+var AgentRoutePolicy = class {
+  constructor(fetchInstances) {
+    this.fetchInstances = fetchInstances;
+  }
+  fetchInstances;
+  declared = /* @__PURE__ */ new Map();
+  refreshing = null;
+  learn(instances) {
+    for (const inst of instances ?? []) this.declared.set(inst.id, inst.capabilities ?? null);
+  }
+  refresh() {
+    this.refreshing ??= this.fetchInstances().then((instances) => this.learn(instances)).catch(() => void 0).finally(() => {
+      this.refreshing = null;
+    });
+    return this.refreshing;
+  }
+  refusalFor(id) {
+    return (method, path, body) => {
+      const caps = this.declared.get(id);
+      if (caps === void 0) void this.refresh();
+      return routeRefusal(caps, path, method, body);
+    };
+  }
+};
+
 // src/commands/runner/self-update.ts
 import { spawn as spawn4 } from "child_process";
 var RUNNER_UPDATE_PATH = "/pags/runner/update";
@@ -2803,6 +2880,8 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
     if (plan.target && !attached.has(plan.target)) forceNext.delete(plan.target);
     return { status: 200, result: { attached: [...attached.keys()], ...plan.target ? { target: plan.target, holding: attached.has(plan.target) } : {} } };
   };
+  const routes = new AgentRoutePolicy(() => requestPags("GET", "/v1/instances/my/instances", { ...opts, pagsToken: pagsToken() }).then((r) => r.instances));
+  await routes.refresh();
   const attach = (id, label = `${id.slice(0, 8)}\u2026`) => {
     if (attached.has(id)) return;
     const mintToken = () => requestPags("POST", `/v1/relay/${apiPathSegment(id)}/token`, { ...opts, pagsToken: pagsToken() }, {}).then((r) => r.token);
@@ -2838,7 +2917,8 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
         runnerNode,
         // The final automatic-update drain is an admission gate, not merely another poll:
         // command work starts only when the old runner is still permitted to serve it.
-        () => relayMutationAdmission.begin()
+        () => relayMutationAdmission.begin(),
+        routes.refusalFor(id)
       )
     );
     if (label) writeLine(`Attached agent: ${label}`);
@@ -2934,6 +3014,7 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
         "/v1/instances/my/instances",
         { ...opts, pagsToken: pagsToken() }
       );
+      routes.learn(res.instances);
       const { attach: toAttach, detach: toDetach } = diffMembership(
         attached.keys(),
         res.instances ?? [],
@@ -2983,7 +3064,7 @@ async function readSessionResources(localUrl, runnerToken) {
 }
 var RTT_PROBE_PREFIX = "rtt:";
 var RTT_ECHO_PREFIX = "rtt-echo:";
-function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, force = false, onConflict, onOpen, onControl, runnerNode = hostname5(), beginMutation = () => () => void 0) {
+function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, force = false, onConflict, onOpen, onControl, runnerNode = hostname5(), beginMutation = () => () => void 0, routeRefusal2 = () => null) {
   let backoffMs = 1e3;
   let reconnecting = false;
   let closed = false;
@@ -3051,6 +3132,14 @@ function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, f
         return;
       }
       const method = (cmd.method || "POST").toUpperCase();
+      const refused = routeRefusal2(method, cmd.path, cmd.body);
+      if (refused) {
+        try {
+          ws.send(JSON.stringify({ id: cmd.id, status: 403, result: { error: refused } }));
+        } catch {
+        }
+        return;
+      }
       const releaseMutation = method !== "GET" && method !== "HEAD" ? beginMutation() : null;
       if (method !== "GET" && method !== "HEAD" && !releaseMutation) {
         try {
@@ -3154,200 +3243,28 @@ function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, f
   };
 }
 
-// src/crash-reports.ts
-import { closeSync as closeSync2, copyFileSync, existsSync as existsSync8, fsyncSync, mkdirSync as mkdirSync7, openSync as openSync2, readdirSync, readFileSync as readFileSync8, renameSync as renameSync3, unlinkSync as unlinkSync3, writeSync as writeSync2 } from "fs";
-import { basename, dirname as dirname4, join as join9 } from "path";
-import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
-var MAX_REPORTS = 100;
-var MAX_QUARANTINED = 5;
-var MAX_MESSAGE = 1e3;
-var MAX_STACK = 4e3;
-function maskSecrets(text) {
-  return text.replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi, "$1 [redacted]").replace(/\b(sk-[A-Za-z0-9_-]{8,}|ghp_[A-Za-z0-9]{8,}|gho_[A-Za-z0-9]{8,}|github_pat_[A-Za-z0-9_]{8,}|xox[abp]-[A-Za-z0-9-]{8,}|pags_runner_[A-Za-z0-9-]{8,})/g, "[redacted]").replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, "[redacted-jwt]").replace(/\b((?:api[_-]?key|token|secret|password|authorization)\s*[=:]\s*)("?)[^\s"&]{4,}\2/gi, "$1[redacted]");
-}
-function crashAccountKey(login) {
-  return createHash2("sha256").update(login.trim().toLowerCase()).digest("hex").substring(0, 12);
-}
-function clip(text, max) {
-  if (text.length <= max) return text;
-  return `${text.substring(0, max)}
-[cut: showing the first ${max} of ${text.length} characters]`;
-}
-var clean3 = (value, max) => clip(maskSecrets(String(value ?? "")), max);
-var shortId = (value) => typeof value === "string" && /^[A-Za-z0-9._:-]{1,128}$/.test(value) ? value : void 0;
-function describeError(error) {
-  if (error instanceof Error) {
-    const cause = error.cause;
-    return {
-      message: clean3(`${error.name}: ${error.message}`, MAX_MESSAGE),
-      stack: error.stack ? clean3(error.stack, MAX_STACK) : void 0,
-      cause: cause === void 0 ? void 0 : clean3(cause instanceof Error ? `${cause.name}: ${cause.message}` : cause, MAX_MESSAGE)
-    };
-  }
-  return { message: clean3(error, MAX_MESSAGE) };
-}
-function crashReport(input) {
-  return {
-    id: shortId(input.id) ?? `crash_${randomUUID3()}`,
-    at: input.at ?? (/* @__PURE__ */ new Date()).toISOString(),
-    source: input.source,
-    kind: input.kind,
-    message: clean3(input.message, MAX_MESSAGE),
-    ...input.stack ? { stack: clean3(input.stack, MAX_STACK) } : {},
-    ...input.cause ? { cause: clean3(input.cause, MAX_MESSAGE) } : {},
-    ...input.exitCode !== void 0 ? { exitCode: input.exitCode } : {},
-    ...input.signal !== void 0 ? { signal: input.signal } : {},
-    ...shortId(input.build) ? { build: input.build } : {},
-    ...shortId(input.account) ? { account: input.account } : {},
-    ...shortId(input.instanceId) ? { instanceId: input.instanceId } : {},
-    ...shortId(input.sessionId) ? { sessionId: input.sessionId } : {},
-    ...shortId(input.taskId) ? { taskId: input.taskId } : {},
-    ...input.route ? { route: clean3(input.route, 200) } : {},
-    ...input.tail?.length ? { tail: input.tail.slice(-20).map((line) => clean3(line, 300)) } : {}
-  };
-}
-function writeJsonAtomic(path, data, mode = 384) {
-  mkdirSync7(dirname4(path), { recursive: true });
-  const tmp = `${path}.${process.pid}.${randomUUID3()}.tmp`;
-  const fd = openSync2(tmp, "w", mode);
-  try {
-    writeSync2(fd, `${JSON.stringify(data, null, 2)}
-`);
-    fsyncSync(fd);
-  } finally {
-    closeSync2(fd);
-  }
-  try {
-    renameSync3(tmp, path);
-  } catch (error) {
-    try {
-      unlinkSync3(tmp);
-    } catch {
-    }
-    throw error;
-  }
-}
-function removeStaleTemps(path) {
-  const dir = dirname4(path);
-  const prefix = `${basename(path)}.`;
-  if (!existsSync8(dir)) return;
-  for (const name of readdirSync(dir)) {
-    if (!name.startsWith(prefix) || !name.endsWith(".tmp")) continue;
-    try {
-      unlinkSync3(join9(dir, name));
-    } catch {
-    }
-  }
-}
-function readJsonOrQuarantine(path) {
-  removeStaleTemps(path);
-  if (!existsSync8(path)) return { status: "missing" };
-  try {
-    return { status: "ok", value: JSON.parse(readFileSync8(path, "utf-8")) };
-  } catch (error) {
-    const quarantinedTo = `${path}.corrupt-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
-    try {
-      renameSync3(path, quarantinedTo);
-    } catch {
-      try {
-        copyFileSync(path, quarantinedTo);
-      } catch (copyError) {
-        return { status: "quarantined", quarantinedTo: "(not preserved)", error: `${describeError(error).message}; preserving it failed: ${describeError(copyError).message}` };
-      }
-    }
-    pruneQuarantine(path);
-    return { status: "quarantined", quarantinedTo, error: describeError(error).message };
-  }
-}
-function pruneQuarantine(path) {
-  const dir = dirname4(path);
-  const prefix = `${basename(path)}.corrupt-`;
-  const copies = readdirSync(dir).filter((name) => name.startsWith(prefix)).sort();
-  const excess = copies.length - MAX_QUARANTINED;
-  for (const name of excess > 0 ? copies.slice(0, excess) : []) {
-    try {
-      unlinkSync3(join9(dir, name));
-    } catch {
-    }
-  }
-}
-var CrashLog = class {
-  /** `base` stamps the reports this log writes about ITSELF (a quarantined file). */
-  constructor(path, base = { source: "runtime" }) {
-    this.path = path;
-    this.base = base;
-  }
-  path;
-  base;
-  /** Everything still on disk, oldest first. A corrupt file is quarantined and reported, then read as a fresh file. */
-  read() {
-    const got = readJsonOrQuarantine(this.path);
-    if (got.status === "ok") {
-      const reports = Array.isArray(got.value.reports) ? got.value.reports.filter((r) => !!r && typeof r.id === "string") : [];
-      return { reports, dropped: Number(got.value.dropped) || 0 };
-    }
-    if (got.status === "missing") return { reports: [], dropped: 0 };
-    const file = {
-      reports: [crashReport({ ...this.base, kind: "store_corrupt", message: `crash-report file was unreadable and was moved to ${basename(got.quarantinedTo)}: ${got.error}` })],
-      dropped: 0
-    };
-    this.write(file);
-    return file;
-  }
-  /** Append a report (bounded). Never throws: a crash path must not crash on its own record. */
-  record(report) {
-    try {
-      const file = this.read();
-      if (file.reports.some((r) => r.id === report.id)) return true;
-      file.reports.push(report);
-      const over = file.reports.length - MAX_REPORTS;
-      if (over > 0) {
-        file.reports = file.reports.slice(over);
-        file.dropped += over;
-      }
-      this.write(file);
-      return true;
-    } catch (error) {
-      process.stderr.write(`[crash-reports] could not record ${report.kind}: ${describeError(error).message}
-`);
-      return false;
-    }
-  }
-  /** Drop reports by id — only by this file's own writer. */
-  remove(ids) {
-    if (!ids.length) return;
-    const file = this.read();
-    const gone = new Set(ids);
-    file.reports = file.reports.filter((r) => !gone.has(r.id));
-    this.write(file);
-  }
-  write(file) {
-    writeJsonAtomic(this.path, file);
-  }
-};
-
 // src/crash-delivery.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join10 } from "path";
+import { join as join9 } from "path";
 var BATCH = 50;
 var LEDGER_MAX = 1e3;
 var TIMEOUT_MS = 1e4;
 function runnerDataDir(dataDir, env = process.env) {
-  return dataDir || env.PAGS_RUNNER_DATA_DIR || join10(homedir4(), ".config", "proagentstore", "browser-runner");
+  return dataDir || env.PAGS_RUNNER_DATA_DIR || join9(homedir4(), ".config", "proagentstore", "browser-runner");
 }
 function crashPaths(configDir2, account, dataDir) {
   const key = crashAccountKey(account);
   return {
-    runtimeFile: join10(runnerDataDir(dataDir), "crash-reports.json"),
-    cliFile: join10(configDir2, `runner-crashes-${key}.json`),
-    ledgerFile: join10(configDir2, `crash-delivered-${key}.json`)
+    runtimeFile: join9(runnerDataDir(dataDir), "crash-reports.json"),
+    cliFile: join9(configDir2, `runner-crashes-${key}.json`),
+    ledgerFile: join9(configDir2, `crash-delivered-${key}.json`)
   };
 }
 function readRuntimeReports(path) {
-  if (!existsSync9(path)) return [];
+  if (!existsSync8(path)) return [];
   try {
-    const parsed = JSON.parse(readFileSync9(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync8(path, "utf-8"));
     return Array.isArray(parsed.reports) ? parsed.reports.filter((r) => r && typeof r.id === "string") : [];
   } catch {
     return [];
@@ -3478,7 +3395,7 @@ function createRunnerCommand() {
   });
   command.command("connect <instanceIds...>").description("Start ONE local runtime, connect via WebSocket relay, and register it for every given PAGS instance").option("--host <host>", "Host to bind", "127.0.0.1").option("--port <port>", "Port to bind", "49171").option("--data-dir <path>", "Runner data directory").option("--token <token>", "Runner bearer token. Defaults to PAGS_RUNNER_TOKEN or a generated token").option("--headless", "Run Playwright headless").option("--api-base <url>", "PAGS API base URL").option("--pags-token <token>", "PAGS session token. Defaults to PAGS_TOKEN").option("--runner-version <version>", "Runner version").option("--force", "Take over from another connected machine").option("--watch-instances", "Attach newly eligible agents while running, without a restart").action(async (instanceIds, opts) => {
     takeSessionTokenFromEnv();
-    const runnerToken = clean2(opts.token) || clean2(process.env.PAGS_RUNNER_TOKEN) || `pags_runner_${randomUUID4()}`;
+    const runnerToken = clean2(opts.token) || clean2(process.env.PAGS_RUNNER_TOKEN) || `pags_runner_${randomUUID3()}`;
     const host = clean2(opts.host) || "127.0.0.1";
     const port = clean2(opts.port) || String(await findFreePort2(49171));
     const lockAccount = clean2(process.env.PAGS_LOCK_ACCOUNT) || "";
@@ -3697,27 +3614,27 @@ function createRunnerCommand() {
 var runnerCommand = createRunnerCommand();
 
 // src/commands/status.ts
-import { readFileSync as readFileSync11, statSync as statSync2, watchFile } from "fs";
+import { readFileSync as readFileSync10, statSync as statSync2, watchFile } from "fs";
 import { Command as Command9 } from "commander";
 
 // src/background.ts
 import { spawn as nodeSpawn2 } from "child_process";
-import { closeSync as closeSync3, existsSync as existsSync10, mkdirSync as mkdirSync8, openSync as openSync3, readFileSync as readFileSync10, renameSync as renameSync4, statSync, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname5, join as join11 } from "path";
+import { closeSync as closeSync2, existsSync as existsSync9, mkdirSync as mkdirSync7, openSync as openSync2, readFileSync as readFileSync9, renameSync as renameSync3, statSync, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname4, join as join10 } from "path";
 var BACKGROUND_ENV = "PAGS_BACKGROUND";
 var BACKGROUND_LOG_ENV = "PAGS_BACKGROUND_LOG";
 var BACKGROUND_RESTART_ENV = "PAGS_BACKGROUND_RESTART";
 var LOG_ROTATE_BYTES = 5 * 1024 * 1024;
-var backgroundLogPath = (account, env = process.env) => join11(configDir(env), "logs", `runner-${accountKey(account)}.log`);
-var backgroundStatePath = (account, env = process.env) => join11(configDir(env), `background-${accountKey(account)}.json`);
+var backgroundLogPath = (account, env = process.env) => join10(configDir(env), "logs", `runner-${accountKey(account)}.log`);
+var backgroundStatePath = (account, env = process.env) => join10(configDir(env), `background-${accountKey(account)}.json`);
 function writeBackgroundState(path, state) {
-  mkdirSync8(dirname5(path), { recursive: true });
+  mkdirSync7(dirname4(path), { recursive: true });
   writeFileSync6(path, `${JSON.stringify(state)}
 `, { mode: 384 });
 }
 function readBackgroundState(path) {
   try {
-    const parsed = JSON.parse(readFileSync10(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync9(path, "utf-8"));
     return parsed?.v === 1 && Number.isInteger(parsed.pid) ? parsed : null;
   } catch {
     return null;
@@ -3729,7 +3646,7 @@ function rotateLog(path, maxBytes = LOG_ROTATE_BYTES) {
   } catch {
     return false;
   }
-  renameSync4(path, `${path}.1`);
+  renameSync3(path, `${path}.1`);
   return true;
 }
 function shellQuote(arg, platform = process.platform) {
@@ -3741,16 +3658,16 @@ function backgroundRestartCommand(execPath, script, upArgs, platform = process.p
   return platform === "win32" ? `set ${BACKGROUND_RESTART_ENV}=1&& ${argv}` : `${BACKGROUND_RESTART_ENV}=1 ${argv}`;
 }
 function spawnDetached(command, args, env, logPath, spawn6 = nodeSpawn2) {
-  mkdirSync8(dirname5(logPath), { recursive: true });
+  mkdirSync7(dirname4(logPath), { recursive: true });
   rotateLog(logPath);
-  const fd = openSync3(logPath, "a", 384);
+  const fd = openSync2(logPath, "a", 384);
   try {
     const child = spawn6(command, args, { detached: true, stdio: ["ignore", fd, fd], env, windowsHide: true });
     child.unref();
     if (!child.pid) throw new Error("the runner process did not start");
     return child.pid;
   } finally {
-    closeSync3(fd);
+    closeSync2(fd);
   }
 }
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -3774,8 +3691,8 @@ async function waitUntilTakeable(read, opts = {}) {
   }
 }
 function tailLines(path, n) {
-  if (!existsSync10(path)) return null;
-  const lines = readFileSync10(path, "utf-8").split("\n");
+  if (!existsSync9(path)) return null;
+  const lines = readFileSync9(path, "utf-8").split("\n");
   if (lines.at(-1) === "") lines.pop();
   return lines.slice(Math.max(0, lines.length - n));
 }
@@ -3830,7 +3747,7 @@ var logsCommand = new Command9("logs").description("Show the background runner's
   watchFile(path, { interval: 1e3 }, (cur) => {
     if (cur.size < offset) offset = 0;
     if (cur.size === offset) return;
-    process.stdout.write(readFileSync11(path).subarray(offset, cur.size));
+    process.stdout.write(readFileSync10(path).subarray(offset, cur.size));
     offset = cur.size;
   });
 });
@@ -4100,7 +4017,7 @@ async function startInBackground(start, deps = processDeps()) {
 
 // src/service-install.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { mkdirSync as mkdirSync9, rmSync, writeFileSync as writeFileSync7 } from "fs";
+import { mkdirSync as mkdirSync8, rmSync, writeFileSync as writeFileSync7 } from "fs";
 import { posix, win32 as win322 } from "path";
 var SERVICE_LABEL = "online.proagentstore.pags-up";
 var SYSTEMD_UNIT = "pags-up.service";
@@ -4293,7 +4210,7 @@ function serviceRemovalPlan(ctx) {
   };
 }
 var defaultWrite = (path, content) => {
-  mkdirSync9(path.replace(/[\\/][^\\/]*$/, ""), { recursive: true });
+  mkdirSync8(path.replace(/[\\/][^\\/]*$/, ""), { recursive: true });
   writeFileSync7(path, content);
 };
 var defaultRun = (file, args) => void execFileSync3(file, args, { stdio: "pipe", timeout: 6e4 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.155",
+  "version": "0.4.158",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",