@proagentstore/cli 0.4.158 → 0.4.160

package/dist/browser-runner/coding/engine-adapter.js

@@ -1,9 +1,10 @@
 import { stripAnsi } from "./transcript-lines.js";
+import { createGrokEngineAdapter, grokOutputFormat } from "./grok-adapter.js";
 export function engineInvocationModeFromAdapter(mode) {
     return mode === "stream-json" ? "structured" : "raw";
 }
 export function structuredCapableEngine(clientType) {
-    return clientType === "claude" || clientType === "codex";
+    return clientType === "claude" || clientType === "codex" || clientType === "grok";
 }
 export function engineInvocationWarning(clientType, mode) {
     if (mode !== "raw" || !structuredCapableEngine(clientType))
@@ -234,5 +235,8 @@ export function engineAdapterFor(clientType, userArgs = []) {
         return claudeEngineAdapter;
     if (clientType === "codex" && userArgs[0] === "exec" && !["resume", "fork", "review", "help"].includes(userArgs[1] ?? ""))
         return codexEngineAdapter;
+    // Grok's NDJSON stream (#1187) — unless the preset chose another output format on purpose, which stays raw.
+    if (clientType === "grok" && [null, "streaming-json"].includes(grokOutputFormat(userArgs)))
+        return createGrokEngineAdapter();
     return genericRawEngineAdapter;
 }

package/dist/browser-runner/coding/grok-adapter.js

@@ -0,0 +1,110 @@
+function record(v) {
+    return v && typeof v === "object" && !Array.isArray(v) ? v : null;
+}
+function hasFlag(args, flag) {
+    return args.some((a) => a === flag || a.startsWith(`${flag}=`));
+}
+/** The value a preset gave `--output-format`, or null. */
+export function grokOutputFormat(args) {
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === "--output-format")
+            return args[i + 1] ?? null;
+        if (args[i].startsWith("--output-format="))
+            return args[i].slice("--output-format=".length);
+    }
+    return null;
+}
+/** The preset's argv with the structured-output flags in front — any order parses, and the trailing `-p` stays last. */
+export function grokStructuredArgs(userArgs) {
+    const add = [];
+    if (!grokOutputFormat(userArgs))
+        add.push("--output-format", "streaming-json");
+    if (!hasFlag(userArgs, "--no-auto-update"))
+        add.push("--no-auto-update");
+    return [...add, ...userArgs];
+}
+/** The text a terminal call produced: its content blocks, else `output_for_prompt` without its `exit: N` header. */
+function toolOutput(ev, raw) {
+    const texts = (Array.isArray(ev.content) ? ev.content : []).flatMap((c) => {
+        const inner = record(record(c)?.content);
+        return typeof inner?.text === "string" ? [inner.text] : [];
+    });
+    if (texts.some((t) => t.trim()))
+        return texts.join("");
+    const prompt = typeof raw?.output_for_prompt === "string" ? raw.output_for_prompt : "";
+    return prompt.replace(/^exit: -?\d+\n/, "");
+}
+/** A Grok call as the tool the rest of the runner knows: its terminal tool IS a Bash call. */
+function asTool(ev) {
+    const rawInput = record(ev.rawInput) ?? {};
+    if (ev.kind === "execute" && typeof rawInput.command === "string")
+        return { name: "Bash", input: { command: rawInput.command } };
+    return { name: typeof ev.toolName === "string" && ev.toolName ? ev.toolName : String(ev.title ?? "tool"), input: rawInput };
+}
+/** One session's adapter: it holds the reply being streamed in deltas until something else happens. */
+export function createGrokEngineAdapter() {
+    let text = "";
+    const flush = () => {
+        const t = text.trim();
+        text = "";
+        return t ? [{ kind: "assistant_text", text: t }] : [];
+    };
+    function parseLine(line) {
+        let ev;
+        try {
+            ev = record(JSON.parse(line));
+        }
+        catch {
+            return [];
+        }
+        if (!ev)
+            return [];
+        switch (ev.type) {
+            case "text":
+                if (typeof ev.data === "string")
+                    text += ev.data;
+                return [{ kind: "meta" }];
+            case "thought":
+            case "usage":
+            case "available_commands":
+                return [{ kind: "meta" }];
+            case "tool_call": {
+                const id = typeof ev.toolCallId === "string" ? ev.toolCallId : "";
+                const { name, input } = asTool(ev);
+                return [...flush(), { kind: "tool_use", block: { type: "tool_use", id, name, input }, id, name, input }];
+            }
+            case "tool_call_update": {
+                // Pending and in-progress updates are the same call filling in; only its END settles it.
+                if (ev.status !== "completed" && ev.status !== "failed")
+                    return [{ kind: "meta" }];
+                const id = typeof ev.toolCallId === "string" ? ev.toolCallId : "";
+                const raw = record(ev.rawOutput);
+                const exitCode = typeof raw?.exit_code === "number" ? raw.exit_code : null;
+                const content = toolOutput(ev, raw);
+                const block = { type: "tool_result", tool_use_id: id, is_error: ev.status === "failed" || (exitCode !== null && exitCode !== 0), content };
+                return [{ kind: "tool_result", block, toolUseId: id, content }];
+            }
+            case "end": {
+                const stop = typeof ev.stopReason === "string" ? ev.stopReason : "";
+                const isError = stop !== "end_turn";
+                return [...flush(), { kind: "turn_end", raw: ev, isError, result: isError ? `stopped: ${stop || "unknown"}` : "" }];
+            }
+            case "error": {
+                const message = typeof ev.message === "string" ? ev.message : typeof record(ev.error)?.message === "string" ? record(ev.error)?.message : "";
+                return message.trim() ? [{ kind: "engine_error", text: message.trim() }] : [{ kind: "meta" }];
+            }
+            default:
+                return [];
+        }
+    }
+    return {
+        mode: "stream-json",
+        persistent: false,
+        prepareArgs: grokStructuredArgs,
+        buildLaunchArgs: (userArgs) => [...userArgs],
+        buildTurnArgs: (userArgs, turnText) => [...userArgs, turnText],
+        parseLine,
+        // An older Grok CLI that does not know a flag refuses before it runs the prompt, so one retry raw is safe.
+        rejectsStructuredOutput: (line) => /(?:--output-format|--no-auto-update|streaming-json)/.test(line) && /(?:unexpected argument|unknown (?:argument|option)|unrecognized|invalid value|isn't a valid value)/i.test(line),
+    };
+}

package/dist/browser-runner/coding/handlers.js

@@ -15,7 +15,7 @@ const HANDLERS = {
     claude: { clientType: "claude", cliCommand: "claude --dangerously-skip-permissions", envVar: "ANTHROPIC_API_KEY" },
     gemini: { clientType: "gemini", cliCommand: "gemini --approval-mode yolo --skip-trust --prompt", envVar: "GEMINI_API_KEY" },
     codex: { clientType: "codex", cliCommand: "codex exec --json --sandbox danger-full-access", envVar: "OPENAI_API_KEY" },
-    grok: { clientType: "grok", cliCommand: "grok --permission-mode bypassPermissions -p", envVar: "XAI_API_KEY" },
+    grok: { clientType: "grok", cliCommand: "grok --permission-mode bypassPermissions --no-auto-update --output-format streaming-json -p", envVar: "XAI_API_KEY" },
     generic: { clientType: "generic", cliCommand: "bash", envVar: "" },
 };
 export function handlerFor(clientType) {

package/dist/browser-runner/coding/headless.js

@@ -601,11 +601,12 @@ export class HeadlessSession {
         if (this.config.clientType === "grok" && this.grokContinuity && !this.grokConversation)
             this.grokConversation = newGrokConversation();
         const grokConversation = this.config.clientType === "grok" && this.grokContinuity ? this.grokConversation : null;
+        const presetArgs = this.adapter.prepareArgs?.(this.cmdArgs) ?? this.cmdArgs; // #1187: Grok's structured flags; gone with the adapter if refused
         const turnArgs = resumedCodexThreadId
             ? buildCodexResumeArgs(this.cmdArgs, resumedCodexThreadId, text)
             : grokConversation
-                ? grokTurnArgs(this.cmdArgs, text, grokConversation)
-                : this.adapter.buildTurnArgs(this.cmdArgs, text);
+                ? grokTurnArgs(presetArgs, text, grokConversation)
+                : this.adapter.buildTurnArgs(presetArgs, text);
         const env = this.spawnEnv;
         const target = spawnTarget(this.cmdPrefix, this.cmdBin, turnArgs);
         const launch = resolveEngineSpawn(target.command, target.args, { env });

package/dist/browser-runner/coding/pane-redact.js

@@ -1,4 +1,5 @@
 import { maskSecrets } from "../crash-reports.js";
+import { machineSecureTypeDeps, secureType } from "./secure-type.js";
 import { tmuxExec } from "./tmux.js";
 /** How long a delivered value is masked in captures. */
 export const INJECTED_TTL_MS = 24 * 60 * 60_000;
@@ -82,3 +83,7 @@ export function scrubDelivered(body) {
         return { remembered: true, cleared: false };
     }
 }
+/** The two secret routes a delivery uses: `/secure/type` (the value over stdin, #1143) and `/secure/scrub` (after it, #1166). */
+export async function secureTerminalRoute(path, body) {
+    return path === "/secure/scrub" ? scrubDelivered(body) : secureType(body, await machineSecureTypeDeps());
+}

package/dist/browser-runner/coding/secure-type.js

@@ -0,0 +1,78 @@
+/**
+ * Type a secret into a terminal WITHOUT putting it in any process's argv (#1143).
+ *
+ * `secure_input_inject` used to type through `/tmux/send` / `/terminal/send`, which run
+ * `tmux send-keys -t <session> -l <value>` and `kitty @ send-text --match id:<n> <value>`: the plaintext sat
+ * in a child process's argv for the life of the call, readable by any local user through `ps` or
+ * `/proc/<pid>/cmdline`, and by whatever records process launches. Here the value travels over STDIN:
+ *
+ *   • tmux  — `load-buffer -b <one-use name> -` (the value on stdin), then `paste-buffer -d -b <name> -t <session>`,
+ *             which deletes the buffer as it pastes; a paste that fails deletes it anyway.
+ *   • kitty — `kitty @ send-text --match id:<n> --stdin` (the value on stdin).
+ *   • iTerm2 — refused: its `write text` takes the value inside an AppleScript argument, and always presses Return.
+ *
+ * Its own route (`POST /secure/type`), so ordinary `tmux_send_keys` text is unaffected, and so there is one body
+ * this runner promises never to log or put in an error: errors name the target, never the value — and with the
+ * value off argv, a failed command's own message (which quotes its argv) cannot carry it either.
+ */
+import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { RunnerInputError } from "../errors.js";
+/** Deliver `value` to `target` (a bare tmux session, `tmux:<session>` or `kitty:<id>`); the pane before and after. */
+export async function secureType(body, deps) {
+    const target = typeof body.target === "string" ? body.target.trim() : "";
+    const value = typeof body.value === "string" ? body.value : "";
+    if (!target)
+        throw new RunnerInputError("A `target` is required.");
+    if (!value)
+        throw new RunnerInputError("Nothing to type.");
+    const opts = (input) => ({ input, encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+    const kitty = /^kitty:(.+)$/i.exec(target);
+    if (kitty) {
+        const paneBefore = deps.capture(kitty[1], "kitty");
+        try {
+            deps.exec("kitty", ["@", "send-text", "--match", `id:${kitty[1]}`, "--stdin"], opts(value));
+        }
+        catch {
+            throw new Error(`Typing into ${target} failed: kitty remote control is unavailable (allow_remote_control yes).`);
+        }
+        const pane = deps.capture(kitty[1], "kitty");
+        return { target, pane, paneBefore, changed: pane !== paneBefore };
+    }
+    if (/^iterm2:/i.test(target))
+        throw new RunnerInputError("iTerm2 cannot be typed into without the value in a script argument; use a tmux or kitty target.");
+    const session = target.replace(/^tmux:/i, "");
+    if (!deps.exists(session))
+        throw new RunnerInputError(`No tmux session "${session}".`, 404);
+    const paneBefore = deps.capture(session, "tmux");
+    const buffer = `pags-secure-${randomUUID()}`;
+    try {
+        deps.exec("tmux", ["load-buffer", "-b", buffer, "-"], opts(value));
+        deps.exec("tmux", ["paste-buffer", "-d", "-b", buffer, "-t", session], opts(""));
+    }
+    catch {
+        throw new Error(`Typing into "${session}" failed: tmux did not accept the paste.`);
+    }
+    finally {
+        // `-d` deleted it on a paste that ran; this is the paste that did not.
+        try {
+            deps.exec("tmux", ["delete-buffer", "-b", buffer], opts(""));
+        }
+        catch {
+            // Already gone — the normal case.
+        }
+    }
+    const pane = await deps.settle(session);
+    return { target, pane, paneBefore, changed: pane !== paneBefore };
+}
+/** The real hands. */
+export async function machineSecureTypeDeps() {
+    const { capturePane, sessionExists, waitForPaneSettle } = await import("./tmux.js");
+    const { captureTerminalTarget } = await import("./terminal.js");
+    return {
+        exec: (file, args, opts) => execFileSync(file, args, opts),
+        exists: sessionExists,
+        capture: (t, backend) => (backend === "kitty" ? captureTerminalTarget(t, { backend: "kitty" }) : capturePane(t, 200)),
+        settle: (session) => waitForPaneSettle(session, { quietMs: 750, timeoutMs: 3_000 }),
+    };
+}

package/dist/browser-runner/server.js

@@ -1,4 +1,4 @@
-import { outgoing, redactPanesOf, scrubDelivered } from "./coding/pane-redact.js";
+import { outgoing, redactPanesOf, secureTerminalRoute } from "./coding/pane-redact.js";
 import { codingSessionRefusal, instanceOf, readJson } from "./request-instance.js";
 import { createServer, } from "node:http";
 import { URL } from "node:url";
@@ -84,8 +84,8 @@ async function route(runner, req, res) {
         return json(res, 403, { error: refused });
     // Panes leave this machine redacted (#1166, coding/pane-redact.ts); a delivered secret is scrubbed.
     redactPanesOf(res, path, req.method === "POST" && /^\/(tmux|terminal)\//.test(path) ? await readJson(req) : undefined);
-    if (req.method === "POST" && path === "/secure/scrub")
-        return json(res, 200, scrubDelivered(await readJson(req)));
+    if (req.method === "POST" && (path === "/secure/scrub" || path === "/secure/type"))
+        return json(res, 200, await secureTerminalRoute(path, await readJson(req)));
     if ((req.method === "GET" || req.method === "POST") && path === "/health") {
         // #896: a health check that cannot say WHO answered is not enough to decide anything with.
         // A contender for the single-instance lock has a pid and a port from the lock file; what it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.158",
+  "version": "0.4.160",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",