@proagentstore/cli 0.4.35 → 0.4.36

package/dist/browser-runner/coding/engine-acts.js

@@ -0,0 +1,199 @@
+/**
+ * What the Engine actually DID — the consequential-act record (#294).
+ *
+ * A delegated run recorded its objective and its terminal outcome and nothing in between. Live,
+ * run `73ffc073` merged its own PRs to `main` unattended and the supervisor view said "done". For
+ * a read-only goal that is fine; for a goal that merges to the trunk it is trust, not review.
+ *
+ * ── WHERE THE SIGNAL COMES FROM, AND WHY IT IS NOT THE OTHER ONE ──
+ *
+ * The obvious alternative was a repo-state delta: snapshot branch/HEAD/refs before and after a run
+ * and diff them. #276 already reads `git status --short --branch` through the runner, so it is
+ * nearly free. It was rejected on a fact, not a preference: **a pull request is not a git object.**
+ * `gh pr create` changes nothing in the local repository at all, and `gh pr merge` changes a ref on
+ * GitHub that the local checkout does not learn about until somebody fetches. So the delta design
+ * cannot satisfy the one thing the issue asks for by name — "a run that opens or merges a PR leaves
+ * a record naming that act" — and would report a clean tree on `main` for the exact run that
+ * prompted the issue.
+ *
+ * What it CAN see (branch moved, tree dirty) is already reported by #276, so building it here would
+ * have duplicated the covered half and missed the uncovered one.
+ *
+ * The worry the issue actually raises about this side — "parsing terminal output is unreliable, the
+ * model's prose is not an audit trail" — does not apply to what is parsed here. This does not read
+ * the Engine's prose. Claude Code's stream-json protocol emits a `tool_use` block per tool
+ * invocation carrying the literal command string it is about to run, and a `tool_result` carrying
+ * whether it failed. `{"command":"gh pr merge 42 --squash"}` is a protocol event, the same class of
+ * fact as the `result` event #267 takes its cost figures from. It is what the Engine RAN, not what
+ * it later said about what it ran.
+ *
+ * ── THE HONEST GAP ──
+ *
+ * Only a stream-json engine (Claude Code) produces these. A raw Codex/Grok session emits nothing
+ * parseable, so it records no acts — the same gap, for the same reason, as engine usage (#267). An
+ * empty act list therefore means "nothing observed", never "nothing happened", and every consumer
+ * has to say so rather than render it as an all-clear.
+ */
+/** Acts whose consequences reach outside the machine, or cannot be walked back locally. */
+const IRREVERSIBLE = new Set([
+    "pr.merge",
+    "push.trunk",
+    "push.force",
+    "branch.delete",
+    "reset.hard",
+    "clean",
+    "file.delete",
+    "release.publish",
+    "package.publish",
+    "repo.delete",
+    "deploy",
+]);
+/** Hard cap on the recorded command text. Long enough to read, short enough not to be a log dump. */
+const MAX_COMMAND = 400;
+/**
+ * Strip anything that looks like a credential before the command is stored or shown.
+ *
+ * A command line is the single most common place a token is pasted in the open
+ * (`GH_TOKEN=… git push`, `https://x-access-token:…@github.com/…`), and this record travels from
+ * the user's machine into D1 and then into a supervisor's model prompt. Redacting at the point of
+ * capture is the only place that covers all three.
+ */
+export function redactCommand(command) {
+    let s = String(command ?? "");
+    // Credentials embedded in a clone/push URL.
+    s = s.replace(/(https?:\/\/)[^/\s@]+@/g, "$1***@");
+    // Known token shapes, whatever they are assigned to.
+    s = s.replace(/\b(gh[pousr]_|github_pat_)[A-Za-z0-9_]{10,}/g, "$1***");
+    s = s.replace(/\bsk-[A-Za-z0-9_-]{16,}/g, "sk-***");
+    s = s.replace(/\bxox[baprs]-[A-Za-z0-9-]{10,}/g, "xox-***");
+    // Anything ASSIGNED to a secret-shaped name, whatever the value looks like.
+    s = s.replace(/\b([A-Za-z_][A-Za-z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASSWD|APIKEY|API_KEY|KEY|PAT))=(\S+)/gi, "$1=***");
+    return s.trim().slice(0, MAX_COMMAND);
+}
+/**
+ * Split a shell command into the pieces that each run something.
+ *
+ * Deliberately aggressive — `&&`, `||`, `;`, `|` and newlines all split, regardless of quoting.
+ * Over-splitting costs nothing (a fragment simply matches no rule); under-splitting loses an act,
+ * and the real-world shape of the case this exists for is exactly a compound line:
+ * `cd repo && git push -u origin fix && gh pr create --fill && gh pr merge --squash`.
+ */
+export function splitSegments(command) {
+    return String(command ?? "")
+        .split(/\|\||&&|[;|\n]/)
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+/** A token that is exactly the trunk, not a branch merely containing the word (`feature/main-fix`). */
+const TRUNK_TOKEN = /(?:^|\s)(?:HEAD:)?(?:refs\/heads\/)?(?:main|master)(?:\s|$)/;
+function prRef(segment) {
+    // `gh pr merge 42 --squash`, `gh pr merge --squash 42`, or a full URL.
+    const url = segment.match(/https?:\/\/\S*?\/pull\/(\d+)/);
+    if (url)
+        return `#${url[1]}`;
+    const num = segment.match(/\bgh\s+pr\s+(?:merge|create)\b(?:\s+-{1,2}\S+(?:=\S+)?)*\s+(\d+)\b/);
+    return num ? `#${num[1]}` : null;
+}
+function pushTarget(segment) {
+    // `git push [flags] <remote> <refspec>` — take the first two non-flag words after `push`.
+    const after = segment.split(/\bgit\s+push\b/)[1] ?? "";
+    const words = after.split(/\s+/).filter((w) => w && !w.startsWith("-"));
+    return words.length ? words.slice(0, 2).join(" ") : null;
+}
+/**
+ * Classify ONE shell segment. Returns null for ordinary work, which is nearly everything.
+ *
+ * The rules are matched in order of consequence, so `git push --force origin main` is recorded as
+ * the force-push it is rather than as an ordinary push.
+ */
+export function classifySegment(segment) {
+    const s = String(segment ?? "");
+    const hit = (kind, target = null) => ({
+        kind,
+        target,
+        irreversible: IRREVERSIBLE.has(kind),
+    });
+    if (/\bgh\s+pr\s+merge\b/.test(s))
+        return hit("pr.merge", prRef(s));
+    if (/\bgh\s+pr\s+create\b/.test(s))
+        return hit("pr.open", prRef(s));
+    if (/\bgh\s+release\s+create\b/.test(s))
+        return hit("release.publish");
+    if (/\bgh\s+repo\s+delete\b/.test(s))
+        return hit("repo.delete");
+    if (/\bgit\s+push\b/.test(s)) {
+        if (/(?:^|\s)(?:--force|--force-with-lease|-f)(?:=|\s|$)/.test(s))
+            return hit("push.force", pushTarget(s));
+        // `git push origin --delete x` and the older `git push origin :x` both delete a REMOTE
+        // branch — the one push that destroys rather than adds.
+        if (/(?:^|\s)--delete(?:\s|$)/.test(s) || /\s:\S+/.test(s))
+            return hit("branch.delete", pushTarget(s));
+        if (TRUNK_TOKEN.test(s.split(/\bgit\s+push\b/)[1] ?? ""))
+            return hit("push.trunk", pushTarget(s));
+        return hit("push", pushTarget(s));
+    }
+    // `-d` as well as `-D`: a supervisor asking "what did it delete" does not care that one of them
+    // refused on unmerged commits.
+    if (/\bgit\s+branch\s+(?:-\S*[dD]\b|--delete\b)/.test(s))
+        return hit("branch.delete");
+    if (/\bgit\s+reset\s+(?:\S+\s+)*--hard\b/.test(s))
+        return hit("reset.hard");
+    if (/\bgit\s+clean\b[^\n]*(?:^|\s)-\S*[fdx]/.test(s))
+        return hit("clean");
+    // Only a RECURSIVE or FORCED rm. Plain `rm scratch.txt` is housekeeping, and recording it would
+    // bury the acts that matter under noise — the record is only useful if it stays dense.
+    if (/\brm\s+(?:\S+\s+)*-\S*[rf]/.test(s))
+        return hit("file.delete");
+    if (/\b(?:npm|pnpm|yarn|bun)\s+publish\b/.test(s))
+        return hit("package.publish");
+    if (/\bwrangler\s+(?:\S+\s+)*deploy\b/.test(s))
+        return hit("deploy");
+    if (/\b(?:vercel|netlify)\s+(?:\S+\s+)*deploy\b/.test(s))
+        return hit("deploy");
+    if (/\bvercel\b[^\n]*--prod\b/.test(s))
+        return hit("deploy");
+    return null;
+}
+/**
+ * Classify a whole command into zero or more acts.
+ *
+ * `id` is the engine's `tool_use` id; a compound command yielding two acts gets `id:0`/`id:1` so
+ * each still has its own stable dedup key. Every act carries the FULL original command as evidence,
+ * not just the segment that matched — a supervisor reading "force-pushed" needs to see what else
+ * was on that line.
+ */
+export function classifyCommand(id, command, at = new Date().toISOString()) {
+    const full = redactCommand(command);
+    if (!full)
+        return [];
+    const out = [];
+    for (const seg of splitSegments(command)) {
+        const c = classifySegment(seg);
+        if (!c)
+            continue;
+        out.push({
+            id: `${id}:${out.length}`,
+            kind: c.kind,
+            command: full,
+            target: c.target,
+            irreversible: c.irreversible,
+            ok: null,
+            at,
+        });
+    }
+    return out;
+}
+/**
+ * Pull the command string out of a `tool_use` block's input.
+ *
+ * Keyed on the INPUT SHAPE rather than the tool name: Claude Code calls it `Bash`, but a session
+ * launched with a custom agent/tool set can present the same shell capability under another name,
+ * and matching the name would silently record nothing for it. Anything handing a tool a `command`
+ * string is running a command.
+ */
+export function commandFromToolInput(input) {
+    if (!input || typeof input !== "object")
+        return null;
+    const cmd = input.command;
+    return typeof cmd === "string" && cmd.trim() ? cmd : null;
+}

package/dist/browser-runner/coding/headless.js

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import { classifyCommand, commandFromToolInput } from "./engine-acts.js";
 import { parseEngineUsage } from "./engine-usage.js";
 /**
  * Merge the platform's resolved engine env over the machine's, where an EMPTY value means
@@ -33,6 +34,16 @@ import { resolveEngineAuth } from "./engine-auth.js";
  * (refusing new records) would lose the turns that just happened rather than ancient ones.
  */
 const MAX_PENDING_USAGE = 200;
+/**
+ * How many un-drained consequential acts a session holds (#294).
+ *
+ * Smaller than the usage cap because acts are rare by construction — an ordinary turn produces
+ * none — so filling this means something has gone very wrong (a loop force-pushing repeatedly),
+ * and in that case the FIRST ones are the ones that explain it. So this cap drops the NEWEST rather
+ * than the oldest, the opposite of the usage queue: a spend record is fungible and the recent ones
+ * matter most, whereas the merge that started an incident is the one you cannot afford to lose.
+ */
+const MAX_PENDING_ACTS = 100;
 export class HeadlessSession {
     config;
     /**
@@ -66,6 +77,20 @@ export class HeadlessSession {
     stopped = false;
     /** Measured engine spend not yet handed to the cloud (#267). Drained by {@link takeUsage}. */
     pendingUsage = [];
+    /**
+     * Consequential acts observed but not yet handed to the cloud (#294). Drained by
+     * {@link takeActs}.
+     */
+    pendingActs = [];
+    /**
+     * Acts whose `tool_result` has not come back yet, keyed by the engine's `tool_use` id.
+     *
+     * They are held here rather than published immediately so the record can say whether the
+     * command SUCCEEDED. A `gh pr merge` that failed on a branch-protection rule, published as a
+     * merge, would put an unattended merge to `main` in the audit trail that never happened — which
+     * damages the record exactly as much as missing a real one.
+     */
+    awaitingResult = new Map();
     /** Turn counter — only used to build a fallback id when the CLI's event has no `uuid`. */
     usageSeq = 0;
     /**
@@ -77,6 +102,18 @@ export class HeadlessSession {
      * The queue is in memory and dies with the process, so a salt can never cause a double-count.
      */
     usageRunId = Math.random().toString(36).slice(2, 10);
+    /** Fallback counter for an act whose `tool_use` block carries no id of its own. */
+    actSeq = 0;
+    /**
+     * Per-PROCESS salt for act ids, for the same reason as {@link usageRunId}.
+     *
+     * Claude Code's `tool_use` ids are unique within a conversation, not across restarts. Without a
+     * salt, a resumed session could re-emit an id the cloud has already written, and the
+     * conflict-ignoring insert would silently drop the SECOND act — a real merge, discarded because
+     * an older one happened to share an id. The queue is in memory and dies with the process, so a
+     * salt can never cause a double-write.
+     */
+    actsRunId = Math.random().toString(36).slice(2, 10);
     /**
      * The engine binary could not be spawned (ENOENT, not executable).
      *
@@ -456,13 +493,16 @@ export class HeadlessSession {
                     }
                     else if (block.type === "tool_use") {
                         this.push(`⚙ ${String(block.name ?? "tool")} ${shortInput(block.input)}`); // ⚙
+                        this.noteAct(block);
                     }
                 }
                 break;
             case "user": // tool results come back as a synthetic user message
                 for (const block of ev.message?.content ?? []) {
-                    if (block.type === "tool_result")
+                    if (block.type === "tool_result") {
                         this.push(`  ↳ ${toolResult(block.content)}`); // ↳
+                        this.settleAct(block);
+                    }
                 }
                 break;
             case "result": {
@@ -477,6 +517,11 @@ export class HeadlessSession {
                     if (this.pendingUsage.length > MAX_PENDING_USAGE)
                         this.pendingUsage.shift();
                 }
+                // The turn ended, so no further `tool_result` is coming for anything still waiting.
+                // Publish it with an UNKNOWN outcome rather than dropping it: "it ran this and we
+                // never saw whether it worked" is a materially different claim from silence, and
+                // silence is what a supervisor would read as "it did nothing".
+                this.flushAwaitingActs();
                 this.run = "idle"; // the turn is OVER — a fact, not a guess
                 break;
             }
@@ -490,6 +535,62 @@ export class HeadlessSession {
     push(line) {
         this.transcript.push(line);
     }
+    /**
+     * A `tool_use` block just went past — record it if the command it carries is consequential
+     * (#294). Nearly every call classifies to nothing and costs one regex sweep.
+     */
+    noteAct(block) {
+        const command = commandFromToolInput(block.input);
+        if (!command)
+            return;
+        const toolUseId = typeof block.id === "string" && block.id ? block.id : `${this.config.id}:${this.actSeq++}`;
+        const acts = classifyCommand(`${this.actsRunId}:${toolUseId}`, command);
+        if (!acts.length)
+            return;
+        this.awaitingResult.set(toolUseId, acts);
+    }
+    /** The matching `tool_result` arrived — stamp the outcome and publish. */
+    settleAct(block) {
+        const id = typeof block.tool_use_id === "string" ? block.tool_use_id : "";
+        const acts = this.awaitingResult.get(id);
+        if (!acts)
+            return;
+        this.awaitingResult.delete(id);
+        const ok = block.is_error !== true;
+        for (const a of acts)
+            this.publishAct({ ...a, ok });
+    }
+    /** Publish everything still waiting, with an unknown outcome. */
+    flushAwaitingActs() {
+        for (const acts of this.awaitingResult.values()) {
+            for (const a of acts)
+                this.publishAct(a);
+        }
+        this.awaitingResult.clear();
+    }
+    publishAct(act) {
+        // Drops the NEWEST at the cap — see MAX_PENDING_ACTS for why this queue is the opposite
+        // way round from the usage one.
+        if (this.pendingActs.length >= MAX_PENDING_ACTS)
+            return;
+        this.pendingActs.push(act);
+    }
+    /**
+     * Hand over the consequential acts seen since the last drain, and forget them (#294).
+     *
+     * Drained rather than re-reported for the same reason as {@link takeUsage}: a 3s capture poll
+     * must not re-send the same merge forever. The cloud's insert is keyed on
+     * {@link EngineActRecord.id}, so the genuine race — the console's poll and the Pilot's own
+     * capture draining at the same moment — still cannot write the act twice.
+     *
+     * A raw engine returns an empty array, always. Nothing parses its stdout, so it has nothing to
+     * hand over; an empty list here means "not observed", never "nothing happened".
+     */
+    takeActs() {
+        const out = this.pendingActs;
+        this.pendingActs = [];
+        return out;
+    }
     /**
      * Hand over the measured spend since the last drain, and forget it (#267).
      *

package/dist/browser-runner/coding/runtime.js

@@ -110,7 +110,7 @@ export class CodingRuntime {
             // exactly the question asked about a session that just stopped.
             authResolved: session.authResolved,
             engineRuntime: session.engineRuntime,
-            ...(opts.drainUsage ? { usage: session.takeUsage() } : {}),
+            ...(opts.drainUsage ? { usage: session.takeUsage(), acts: session.takeActs() } : {}),
         };
     }
     /** Perform one action, then return the fresh snapshot (non-blocking, like browser act). */
@@ -143,12 +143,17 @@ export class CodingRuntime {
     end(sessionId) {
         const session = this.sessions.get(sessionId);
         const usage = session ? session.takeUsage() : [];
+        // Acts drain here too, and for a sharper version of the same reason (#294): the LAST thing a
+        // coding run does is very often the consequential one — push, open the PR, merge it — and it
+        // happens after the final capture poll. Discarding the tail would systematically lose exactly
+        // the acts this record exists for.
+        const acts = session ? session.takeActs() : [];
         if (session) {
             session.stop();
             this.sessions.delete(sessionId);
         }
         this.takeovers.delete(sessionId);
-        return { ok: true, usage };
+        return { ok: true, usage, acts };
     }
     list() {
         return [...this.sessions.entries()].map(([sessionId, s]) => ({

package/dist/browser-runner/test-job-server.js

@@ -21,6 +21,17 @@ export async function startTestJobServer(port = 0) {
         async close() {
             await new Promise((resolve, reject) => {
                 server.close((error) => (error ? reject(error) : resolve()));
+                // `close()` stops ACCEPTING connections; it does not end the open ones, and
+                // its callback does not fire until the last socket goes away. A Playwright
+                // browser that navigated here keeps its connection alive for reuse, so the
+                // callback waited on a socket only the browser would ever close — an
+                // UNBOUNDED wait, not a slow one.
+                //
+                // That is why this could not be fixed by raising a budget, and two attempts
+                // tried: bc3f2b3 bounded `mcp.stop()`, f3e9c53 raised `hookTimeout`. The hook
+                // still burned its whole budget, red-gated CI, and blocked the API deploy on
+                // main for unrelated commits that happened to land next.
+                server.closeAllConnections();
             });
         },
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.35",
+  "version": "0.4.36",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",