@proagentstore/cli 0.4.30 → 0.4.32

package/dist/browser-runner/coding/headless.js

@@ -24,7 +24,16 @@ import { dirname, join } from "node:path";
 import { handlerFor } from "./handlers.js";
 export class HeadlessSession {
     config;
-    sessionName;
+    /**
+     * A human-readable label for this engine process (#247).
+     *
+     * Was `sessionName`, formatted `pags-<client>-<id>` — which looked exactly like a tmux
+     * target and was reported to the console as `tmuxSession`. The engine has not used tmux
+     * since it moved to the stream-json interface, so a user who did the obvious thing with a
+     * name like that (`tmux attach -t pags-claude-…`) got "session not found" and reasonably
+     * concluded their engine was broken. It addresses nothing — it is only ever displayed.
+     */
+    engineLabel;
     proc = null;
     buf = "";
     transcript = [];
@@ -55,7 +64,7 @@ export class HeadlessSession {
     spawnFailed = false;
     constructor(config) {
         this.config = config;
-        this.sessionName = `pags-${config.clientType}-${config.id}`;
+        this.engineLabel = `${config.clientType}:${config.id}`;
         this.claudeSessionId = readState(config.statePath, config.id);
         // Claude is the structured engine; everything else is a raw CLI.
         this.mode = config.clientType === "claude" ? "stream-json" : "raw";

package/dist/browser-runner/coding/repo.js

@@ -0,0 +1,63 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+/**
+ * Repo/workdir helpers for the coding engine.
+ *
+ * These lived in `coding/tmux.ts` and have nothing to do with tmux — `ensureRepo` runs `git
+ * clone`. The coding engine stopped using tmux when it moved to the structured stream-json
+ * interface, so anyone cleaning up that module found its two most load-bearing functions
+ * inside it (#247). Split out so the tmux module is only tmux, and only the terminal-operator
+ * agents depend on it.
+ */
+/**
+ * A safe, collision-resistant label derived from an arbitrary string.
+ *
+ * Named for tmux because that is where it started, but the coding engine uses it purely as a
+ * display/identity label — no tmux target is derived from it (#247).
+ */
+export function sanitizeSessionName(label) {
+    return label.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 60) || "session";
+}
+/**
+ * Ensure a repo is present at `dir`, cloning it from `cloneUrl` if not. Idempotent
+ * — an existing checkout is left alone (no clobber). For private repos a GitHub
+ * App installation token is injected as `x-access-token` into an https URL. The
+ * coding CLI then runs in this directory.
+ *
+ * Returns the absolute working directory. Throws on clone failure so the caller
+ * can surface it (a session can't start without its repo).
+ */
+export function ensureRepo(dir, opts = {}) {
+    // A real checkout (has .git) is reused as-is.
+    if (existsSync(join(dir, ".git")))
+        return dir;
+    if (!opts.cloneUrl) {
+        // No source to clone from — just make the directory the engine will run in.
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        return dir;
+    }
+    // The dir exists but has no `.git`. It could be a half-cloned/empty managed dir
+    // (safe to clear) OR a real user directory the caller passed as an explicit workDir
+    // (deleting it = data loss). NEVER recursively delete a non-empty non-git dir — refuse
+    // instead, so a mis-wired workDir+cloneUrl can't nuke a user's files. An empty dir is
+    // fine to remove (git clone needs an empty/absent target).
+    if (existsSync(dir)) {
+        const entries = readdirSync(dir);
+        if (entries.length > 0) {
+            throw new Error(`Refusing to clone into non-empty directory "${dir}" (no .git found) — move it aside or point at an empty path.`);
+        }
+        rmSync(dir, { recursive: true, force: true });
+    }
+    let url = opts.cloneUrl;
+    if (opts.token && /^https:\/\//.test(url)) {
+        url = url.replace(/^https:\/\//, `https://x-access-token:${opts.token}@`);
+    }
+    const args = ["clone", "--depth", "1"];
+    if (opts.branch)
+        args.push("--branch", opts.branch);
+    args.push(url, dir);
+    execFileSync("git", args, { stdio: "pipe", timeout: 180_000 });
+    return dir;
+}

package/dist/browser-runner/coding/runtime.js

@@ -2,7 +2,7 @@ import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { defaultStatePath, HeadlessSession } from "./headless.js";
 import { InspectError, readGitRemoteOrigin, readRepoFile, repoTree, runRepoGit } from "./inspect.js";
-import { ensureRepo, sanitizeSessionName } from "./tmux.js";
+import { ensureRepo, sanitizeSessionName } from "./repo.js";
 /** Hard cap on a pane returned to the brain/console (matches the worker MAX_PANE_CHARS). */
 const MAX_PANE = 64 * 1024;
 export class CodingRuntime {
@@ -135,14 +135,14 @@ export class CodingRuntime {
         return [...this.sessions.entries()].map(([sessionId, s]) => ({
             sessionId,
             alive: s.alive,
-            tmuxSession: s.sessionName,
+            engineLabel: s.engineLabel,
         }));
     }
     /** Rich diagnostics for every tracked session — the console's transparency view. */
     diagnostics() {
         return [...this.sessions.entries()].map(([sessionId, s]) => ({
             sessionId,
-            tmuxSession: s.sessionName,
+            engineLabel: s.engineLabel,
             alive: s.alive,
             runState: s.alive ? s.runState() : "idle",
             ready: s.alive ? s.ready : false,

package/dist/browser-runner/coding/tmux.js

@@ -1,6 +1,4 @@
 import { execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
-import { join } from "node:path";
 /**
  * Low-level tmux primitives for the coding runtime.
  *
@@ -127,49 +125,3 @@ export function capturePane(target, lines = 200) {
     const captured = tmuxExec(["capture-pane", "-p", "-t", target, "-S", `-${lines}`, "-J"]);
     return stripAnsi(captured).trim();
 }
-/** A safe, collision-resistant tmux session name derived from an arbitrary label. */
-export function sanitizeSessionName(label) {
-    return label.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 60) || "session";
-}
-/**
- * Ensure a repo is present at `dir`, cloning it from `cloneUrl` if not. Idempotent
- * — an existing checkout is left alone (no clobber). For private repos a GitHub
- * App installation token is injected as `x-access-token` into an https URL. The
- * coding CLI then runs in this directory.
- *
- * Returns the absolute working directory. Throws on clone failure so the caller
- * can surface it (a session can't start without its repo).
- */
-export function ensureRepo(dir, opts = {}) {
-    // A real checkout (has .git) is reused as-is.
-    if (existsSync(join(dir, ".git")))
-        return dir;
-    if (!opts.cloneUrl) {
-        // No source to clone from — make the directory so tmux can cd into it.
-        if (!existsSync(dir))
-            mkdirSync(dir, { recursive: true });
-        return dir;
-    }
-    // The dir exists but has no `.git`. It could be a half-cloned/empty managed dir
-    // (safe to clear) OR a real user directory the caller passed as an explicit workDir
-    // (deleting it = data loss). NEVER recursively delete a non-empty non-git dir — refuse
-    // instead, so a mis-wired workDir+cloneUrl can't nuke a user's files. An empty dir is
-    // fine to remove (git clone needs an empty/absent target).
-    if (existsSync(dir)) {
-        const entries = readdirSync(dir);
-        if (entries.length > 0) {
-            throw new Error(`Refusing to clone into non-empty directory "${dir}" (no .git found) — move it aside or point at an empty path.`);
-        }
-        rmSync(dir, { recursive: true, force: true });
-    }
-    let url = opts.cloneUrl;
-    if (opts.token && /^https:\/\//.test(url)) {
-        url = url.replace(/^https:\/\//, `https://x-access-token:${opts.token}@`);
-    }
-    const args = ["clone", "--depth", "1"];
-    if (opts.branch)
-        args.push("--branch", opts.branch);
-    args.push(url, dir);
-    execFileSync("git", args, { stdio: "pipe", timeout: 180_000 });
-    return dir;
-}

package/dist/browser-runner/index.js

@@ -2,6 +2,7 @@
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { startRunnerServer } from "./server.js";
+import { randomUUID } from "node:crypto";
 // Resilience: a stray error in any runtime must NOT take the whole runner down —
 // that drops the tunnel and forces the user to restart `pags up` (and lose their
 // session). Log it and keep serving. Per-component handlers catch most things;
@@ -29,7 +30,11 @@ function configFromArgs() {
         host: arg("--host", process.env.PAGS_RUNNER_HOST || "127.0.0.1") || "127.0.0.1",
         port: Number(arg("--port", process.env.PAGS_RUNNER_PORT || "49171")),
         dataDir,
-        token: arg("--token", process.env.PAGS_RUNNER_TOKEN),
+        // Never start unauthenticated (#245). This surface drives a coding CLI with permissions
+        // skipped, and `authorize` now fails closed — so a missing token would make the runner
+        // answer nothing rather than answer everyone. Generate one and print it, mirroring what
+        // `pags runner connect` has always done.
+        token: arg("--token", process.env.PAGS_RUNNER_TOKEN) || `pags_runner_${randomUUID()}`,
         instanceId: arg("--instance-id", process.env.PAGS_INSTANCE_ID),
         headless: flag("--headless") || process.env.PAGS_RUNNER_HEADLESS === "1",
     };

package/dist/browser-runner/server.js

@@ -162,18 +162,12 @@ async function route(runner, req, res) {
         return json(res, 200, { sessions: runner.coding.list() });
     }
     if ((req.method === "GET" || req.method === "POST") && path === "/coding/diagnostics") {
-        const { listSessions: tmuxList } = await import("./coding/tmux.js");
-        const allTmux = tmuxList();
-        const pagsTmux = allTmux.filter((n) => n.startsWith("pags-"));
-        const tracked = runner.coding.diagnostics();
-        const trackedNames = new Set(tracked.map((s) => s.tmuxSession));
-        const orphanedTmux = pagsTmux.filter((n) => !trackedNames.has(n));
-        return json(res, 200, {
-            tracked,
-            orphanedTmux,
-            tmuxTotal: allTmux.length,
-            pagsTmuxTotal: pagsTmux.length,
-        });
+        // No tmux figures here any more (#247). The coding engine spawns a child process
+        // directly, so `pagsTmuxTotal` was structurally always 0 and `tmuxTotal` counted the
+        // user's own unrelated sessions — this is the panel someone opens BECAUSE something is
+        // wrong, and it pointed them at a false cause. The terminal-operator agents, which do
+        // use tmux, have their own /tmux/* endpoints and are unaffected.
+        return json(res, 200, { tracked: runner.coding.diagnostics() });
     }
     if (req.method === "POST" && path === "/coding/browse") {
         const { readdirSync, statSync } = await import("node:fs");
@@ -197,30 +191,14 @@ async function route(runner, req, res) {
             return json(res, 400, { error: e instanceof Error ? e.message : String(e), dir });
         }
     }
-    if (req.method === "POST" && path === "/coding/kill-tmux") {
-        const { killSession: tmuxKill, listSessions: tmuxList } = await import("./coding/tmux.js");
-        const b = await readJson(req);
-        let targets = [];
-        if (b.orphansOnly) {
-            const allTmux = tmuxList();
-            const pagsTmux = allTmux.filter((n) => n.startsWith("pags-"));
-            const tracked = new Set(runner.coding.diagnostics().map((s) => s.tmuxSession));
-            targets = pagsTmux.filter((n) => !tracked.has(n));
-        }
-        else if (b.sessions?.length) {
-            targets = b.sessions.filter((n) => typeof n === "string" && n.startsWith("pags-"));
-        }
-        else {
-            // Kill all pags-* tmux sessions
-            targets = tmuxList().filter((n) => n.startsWith("pags-"));
-            runner.coding.closeAll();
-        }
-        let killed = 0;
-        for (const name of targets) {
-            if (tmuxKill(name))
-                killed++;
-        }
-        return json(res, 200, { killed, sessions: targets });
+    // Close every tracked coding session. The path still says "kill-tmux" ON PURPOSE: an older
+    // runner must keep answering a newer API, and renaming it would 404 across that skew (#247).
+    // The tmux half is gone — it only ever targeted `pags-*` sessions, which the coding engine
+    // has never created. `closeAll()` is the part that always worked, and is now the whole job.
+    if (req.method === "POST" && (path === "/coding/kill-tmux" || path === "/coding/close-sessions")) {
+        const closed = runner.coding.diagnostics().map((s) => s.sessionId);
+        runner.coding.closeAll();
+        return json(res, 200, { closed: closed.length, sessions: closed });
     }
     // ── Read-only code inspection (the Co-pilot/Chat's "eyes" — no CLI driving) ──
     // Confined to the session's workDir by inspect.ts; errors surface as 400.
@@ -413,13 +391,35 @@ async function route(runner, req, res) {
     }
     return json(res, 404, { error: "Not found" });
 }
+/**
+ * Authorize a request to the local runner (#245).
+ *
+ * This surface drives a coding CLI that `pags up` launches with
+ * `--dangerously-skip-permissions` / `--sandbox danger-full-access`, so "who may POST here" is
+ * the whole security boundary. Two things were the wrong way round:
+ *
+ * 1. **No token used to mean ALLOW.** `pags up` always generates one, so that path was safe —
+ *    but `pags-browser-runner` run directly (its own --help documents this) passes
+ *    `token: undefined`, and served the entire surface unauthenticated. Now it fails CLOSED;
+ *    the standalone entrypoint generates a token instead of starting open.
+ *
+ * 2. **A browser could reach it.** Binding to loopback is not isolation: a page the user is
+ *    visiting cannot READ a cross-origin response, but it can still SEND the POST, and the
+ *    server sets no CORS headers and did no Origin check. The token already made that
+ *    unguessable — but nothing legitimate that calls this runner is a browser (the cloud
+ *    dispatches over the relay; the CLI calls it directly), and neither sends `Origin`. So the
+ *    presence of that header is by itself proof the caller is a web page, and is refused before
+ *    the token is even considered. Also closes DNS-rebinding, which loopback does not.
+ */
 function authorize(req, config) {
+    if (req.headers.origin)
+        return false;
     const token = config.token;
     if (config.instanceId && req.headers["x-pags-instance-id"] !== config.instanceId) {
         return false;
     }
     if (!token)
-        return true;
+        return false;
     const auth = req.headers.authorization || "";
     const headerToken = req.headers["x-pags-runner-token"];
     return auth === `Bearer ${token}` || headerToken === token;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.30",
+  "version": "0.4.32",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",