@proagentstore/cli 0.4.37 → 0.4.39

package/dist/browser-runner/coding/repo.js

@@ -19,11 +19,35 @@ import { join } from "node:path";
 export function sanitizeSessionName(label) {
     return label.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 60) || "session";
 }
+/**
+ * The clone URL with the credential embedded, or the URL untouched.
+ *
+ * PURE and exported so the one line that decides where a credential goes is unit-testable
+ * without a network or a git binary. `username` is provider-specific — GitHub wants
+ * `x-access-token`, GitLab `oauth2`, Bitbucket `x-token-auth` (#221) — and it defaults to the
+ * value this function used to hardcode, so a cloud that sends only `token` behaves as before.
+ *
+ * Only https carries a credential: git ignores userinfo on an ssh URL, so injecting there would
+ * be pure exposure for no effect. Both halves are percent-encoded — a secret containing `@`,
+ * `/` or `:` would otherwise re-parse the URL into a DIFFERENT host and send the credential
+ * there. GitHub's tokens contain none of those, so nothing changes for the existing provider.
+ */
+export function authenticatedCloneUrl(cloneUrl, token, username) {
+    if (!token || !/^https:\/\//i.test(cloneUrl))
+        return cloneUrl;
+    const user = encodeURIComponent(username || "x-access-token");
+    return cloneUrl.replace(/^https:\/\//i, `https://${user}:${encodeURIComponent(token)}@`);
+}
 /**
  * Ensure a repo is present at `dir`, cloning it from `cloneUrl` if not. Idempotent
- * — an existing checkout is left alone (no clobber). For private repos a GitHub
- * App installation token is injected as `x-access-token` into an https URL. The
- * coding CLI then runs in this directory.
+ * — an existing checkout is left alone (no clobber). For private repos the cloud
+ * sends a token, injected as the password half of an https URL. The coding CLI then
+ * runs in this directory.
+ *
+ * `tokenUsername` is the USERNAME half, and it is provider-specific: GitHub wants
+ * `x-access-token`, GitLab `oauth2`, Bitbucket `x-token-auth` (#221). It defaults to
+ * `x-access-token` — the value this function used to hardcode — so an older cloud that
+ * sends only `token` behaves exactly as before.
  *
  * Returns the absolute working directory. Throws on clone failure so the caller
  * can surface it (a session can't start without its repo).
@@ -50,10 +74,7 @@ export function ensureRepo(dir, opts = {}) {
         }
         rmSync(dir, { recursive: true, force: true });
     }
-    let url = opts.cloneUrl;
-    if (opts.token && /^https:\/\//.test(url)) {
-        url = url.replace(/^https:\/\//, `https://x-access-token:${opts.token}@`);
-    }
+    const url = authenticatedCloneUrl(opts.cloneUrl, opts.token, opts.tokenUsername);
     const args = ["clone", "--depth", "1"];
     if (opts.branch)
         args.push("--branch", opts.branch);

package/dist/browser-runner/coding/runtime.js

@@ -71,7 +71,7 @@ export class CodingRuntime {
             const workDir = input.workDir
                 ? resolve(input.workDir.replace(/^~(?=$|\/)/, homedir()))
                 : join(this.reposBaseDir, sanitizeSessionName(input.repoId));
-            ensureRepo(workDir, { cloneUrl: input.cloneUrl, branch: input.branch, token: input.token });
+            ensureRepo(workDir, { cloneUrl: input.cloneUrl, branch: input.branch, token: input.token, tokenUsername: input.tokenUsername });
             session = new HeadlessSession({
                 id: input.sessionId,
                 workDir,

package/dist/browser-runner/coding/terminal.js

@@ -1,7 +1,7 @@
 import { execFileSync } from "node:child_process";
 import { homedir } from "node:os";
 import { resolve } from "node:path";
-import { capturePane, createSession, killSession, listSessionsDetailed, runCommand as tmuxRunCommand, sendKey as tmuxSendKey, sendText as tmuxSendText, sessionExists } from "./tmux.js";
+import { capturePane, createSession, killSession, listSessionsDetailed, runCommand as tmuxRunCommand, sendKey as tmuxSendKey, sendText as tmuxSendText, sessionExists, tmuxExec } from "./tmux.js";
 function shellPath() {
     return process.env.SHELL || "/bin/zsh";
 }
@@ -51,6 +51,76 @@ export function captureTerminalTarget(target, opts = {}) {
             return itermSessionScript(t.id, "return contents of theSession");
     }
 }
+/**
+ * The foreground command running in a target right now — `claude`, `node`, `zsh`, … (#348).
+ *
+ * The platform cannot measure what an AI CLI inside a pane spends: a pane holds rendered text, not
+ * the stream-json `result` event `headless.ts` reads. So the cloud records the drive as UNMETERED
+ * instead, and this is the one fact that makes that record specific rather than generic. It is a
+ * name, never a number — no cost figure is ever parsed out of pane output, because a scraped
+ * dollar amount would be a guess dressed as a measurement.
+ *
+ * Returns `null` when it cannot be read (no such target, iTerm2, a backend that will not say).
+ * `null` means UNREADABLE and must not be flattened into "nothing was running" upstream: the
+ * distinction is the entire point of recording this at all.
+ */
+export function activeTerminalCommand(target, backend) {
+    let t;
+    try {
+        t = splitTerminalTarget(target, backend);
+    }
+    catch {
+        return null;
+    }
+    try {
+        switch (t.backend) {
+            case "tmux": {
+                const out = tmuxExec(["display-message", "-p", "-t", t.id, "#{pane_current_command}"]).trim();
+                return out || null;
+            }
+            case "kitty":
+                return kittyForegroundCommand(t.id);
+            // iTerm2 exposes no cheap, reliable foreground-process query. Saying so is the honest
+            // answer; guessing from the pane's last line would not be.
+            case "iterm2":
+                return null;
+        }
+    }
+    catch {
+        return null;
+    }
+}
+/** The foreground process of a kitty window, from `kitty @ ls`. Null if it can't be determined. */
+function kittyForegroundCommand(id) {
+    try {
+        const parsed = JSON.parse(kittyExec(["@", "ls"], 5000));
+        if (!Array.isArray(parsed))
+            return null;
+        for (const osWindow of parsed) {
+            const tabs = Array.isArray(osWindow.tabs) ? osWindow.tabs : [];
+            for (const tab of tabs) {
+                const windows = Array.isArray(tab.windows) ? tab.windows : [];
+                for (const win of windows) {
+                    const row = win;
+                    if (String(row.id ?? "") !== id)
+                        continue;
+                    const procs = Array.isArray(row.foreground_processes) ? row.foreground_processes : [];
+                    for (const p of procs) {
+                        const cmdline = p.cmdline;
+                        const first = Array.isArray(cmdline) ? String(cmdline[0] ?? "").trim() : "";
+                        if (first)
+                            return first;
+                    }
+                    return null;
+                }
+            }
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
 export function runTerminalCommand(target, command, backend) {
     const t = splitTerminalTarget(target, backend);
     if (!command.trim())

package/dist/browser-runner/mcp-runtime.js

@@ -136,13 +136,25 @@ export class McpRuntime {
         this.client = new Client({ name: "pags-runner", version: "1.0.0" });
         await this.client.connect(clientTransport);
     }
+    /**
+     * The connected client, or a diagnosis. `client` is unset before `start()` AND cleared by
+     * `stop()`, so both call sites below are reachable with it missing — a use-after-stop is the
+     * likely one, since `stop()` runs on teardown while a slow in-flight action is still landing.
+     * A bare `this.client!` turned that into "Cannot read properties of undefined (reading
+     * 'callTool')" at the relay boundary, which names neither the runtime nor the lifecycle.
+     */
+    connected() {
+        if (!this.client)
+            throw new Error("MCP runtime is not running — call start() first (or it was already stopped).");
+        return this.client;
+    }
     /** The standard Playwright MCP tool schemas — advertised to the cloud brain verbatim. */
     async listTools() {
-        const res = await this.client.listTools();
+        const res = await this.connected().listTools();
         return res.tools;
     }
     async callTool(name, args = {}) {
-        return (await this.client.callTool({ name, arguments: args }));
+        return (await this.connected().callTool({ name, arguments: args }));
     }
     /** Text of the last tool result (the standard tools return their output as text content). */
     textOf(res) {

package/dist/browser-runner/server.js

@@ -304,7 +304,10 @@ async function route(runner, req, res) {
             sendText(session, String(b.text));
         for (const k of b.keys ?? [])
             sendKey(session, String(k));
-        return json(res, 200, { session, pane: capturePane(session, 200) });
+        // `activeCommand` rides along on every WRITE so the cloud can record what it just drove
+        // (#348). It is a process name, never a cost — see activeTerminalCommand's comment.
+        const { activeTerminalCommand } = await import("./coding/terminal.js");
+        return json(res, 200, { session, pane: capturePane(session, 200), activeCommand: activeTerminalCommand(session, "tmux") });
     }
     if (req.method === "POST" && path === "/tmux/run") {
         const { runCommand, capturePane, sessionExists } = await import("./coding/tmux.js");
@@ -318,7 +321,8 @@ async function route(runner, req, res) {
         if (!sessionExists(session))
             return json(res, 404, { error: `No tmux session "${session}".` });
         runCommand(session, command);
-        return json(res, 200, { session, command, pane: capturePane(session, 200) });
+        const { activeTerminalCommand } = await import("./coding/terminal.js");
+        return json(res, 200, { session, command, pane: capturePane(session, 200), activeCommand: activeTerminalCommand(session, "tmux") });
     }
     if (req.method === "POST" && path === "/tmux/session") {
         const { createSession, killSession, sessionExists } = await import("./coding/tmux.js");
@@ -357,7 +361,7 @@ async function route(runner, req, res) {
         return json(res, 200, { target, pane: captureTerminalTarget(target, { backend, lines: b.lines }) });
     }
     if (req.method === "POST" && path === "/terminal/run") {
-        const { runTerminalCommand } = await import("./coding/terminal.js");
+        const { runTerminalCommand, activeTerminalCommand } = await import("./coding/terminal.js");
         const b = await readJson(req);
         const target = String(b.target || "").trim();
         const command = String(b.command ?? "");
@@ -366,16 +370,20 @@ async function route(runner, req, res) {
         if (!command.trim())
             return json(res, 400, { error: "A `command` is required." });
         const backend = b.backend === "tmux" || b.backend === "kitty" || b.backend === "iterm2" ? b.backend : undefined;
-        return json(res, 200, { target, command, pane: runTerminalCommand(target, command, backend) });
+        const pane = runTerminalCommand(target, command, backend);
+        // Read AFTER the command lands, so `claude "fix x"` reports `claude` rather than the shell
+        // that was sitting there a moment earlier (#348).
+        return json(res, 200, { target, command, pane, activeCommand: activeTerminalCommand(target, backend) });
     }
     if (req.method === "POST" && path === "/terminal/send") {
-        const { sendTerminalKeys } = await import("./coding/terminal.js");
+        const { sendTerminalKeys, activeTerminalCommand } = await import("./coding/terminal.js");
         const b = await readJson(req);
         const target = String(b.target || "").trim();
         if (!target)
             return json(res, 400, { error: "A `target` is required." });
         const backend = b.backend === "tmux" || b.backend === "kitty" || b.backend === "iterm2" ? b.backend : undefined;
-        return json(res, 200, { target, pane: sendTerminalKeys(target, { backend, text: b.text == null ? undefined : String(b.text), keys: b.keys ?? [] }) });
+        const pane = sendTerminalKeys(target, { backend, text: b.text == null ? undefined : String(b.text), keys: b.keys ?? [] });
+        return json(res, 200, { target, pane, activeCommand: activeTerminalCommand(target, backend) });
     }
     if (req.method === "POST" && path === "/terminal/session") {
         const { createTerminalTarget, killTerminalTarget } = await import("./coding/terminal.js");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.37",
+  "version": "0.4.39",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",