@proagentstore/cli 0.4.38 → 0.4.40

package/dist/browser-runner/coding/repo.js

@@ -19,11 +19,35 @@ import { join } from "node:path";
 export function sanitizeSessionName(label) {
     return label.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 60) || "session";
 }
+/**
+ * The clone URL with the credential embedded, or the URL untouched.
+ *
+ * PURE and exported so the one line that decides where a credential goes is unit-testable
+ * without a network or a git binary. `username` is provider-specific — GitHub wants
+ * `x-access-token`, GitLab `oauth2`, Bitbucket `x-token-auth` (#221) — and it defaults to the
+ * value this function used to hardcode, so a cloud that sends only `token` behaves as before.
+ *
+ * Only https carries a credential: git ignores userinfo on an ssh URL, so injecting there would
+ * be pure exposure for no effect. Both halves are percent-encoded — a secret containing `@`,
+ * `/` or `:` would otherwise re-parse the URL into a DIFFERENT host and send the credential
+ * there. GitHub's tokens contain none of those, so nothing changes for the existing provider.
+ */
+export function authenticatedCloneUrl(cloneUrl, token, username) {
+    if (!token || !/^https:\/\//i.test(cloneUrl))
+        return cloneUrl;
+    const user = encodeURIComponent(username || "x-access-token");
+    return cloneUrl.replace(/^https:\/\//i, `https://${user}:${encodeURIComponent(token)}@`);
+}
 /**
  * Ensure a repo is present at `dir`, cloning it from `cloneUrl` if not. Idempotent
- * — an existing checkout is left alone (no clobber). For private repos a GitHub
- * App installation token is injected as `x-access-token` into an https URL. The
- * coding CLI then runs in this directory.
+ * — an existing checkout is left alone (no clobber). For private repos the cloud
+ * sends a token, injected as the password half of an https URL. The coding CLI then
+ * runs in this directory.
+ *
+ * `tokenUsername` is the USERNAME half, and it is provider-specific: GitHub wants
+ * `x-access-token`, GitLab `oauth2`, Bitbucket `x-token-auth` (#221). It defaults to
+ * `x-access-token` — the value this function used to hardcode — so an older cloud that
+ * sends only `token` behaves exactly as before.
  *
  * Returns the absolute working directory. Throws on clone failure so the caller
  * can surface it (a session can't start without its repo).
@@ -50,10 +74,7 @@ export function ensureRepo(dir, opts = {}) {
         }
         rmSync(dir, { recursive: true, force: true });
     }
-    let url = opts.cloneUrl;
-    if (opts.token && /^https:\/\//.test(url)) {
-        url = url.replace(/^https:\/\//, `https://x-access-token:${opts.token}@`);
-    }
+    const url = authenticatedCloneUrl(opts.cloneUrl, opts.token, opts.tokenUsername);
     const args = ["clone", "--depth", "1"];
     if (opts.branch)
         args.push("--branch", opts.branch);

package/dist/browser-runner/coding/runtime.js

@@ -71,7 +71,7 @@ export class CodingRuntime {
             const workDir = input.workDir
                 ? resolve(input.workDir.replace(/^~(?=$|\/)/, homedir()))
                 : join(this.reposBaseDir, sanitizeSessionName(input.repoId));
-            ensureRepo(workDir, { cloneUrl: input.cloneUrl, branch: input.branch, token: input.token });
+            ensureRepo(workDir, { cloneUrl: input.cloneUrl, branch: input.branch, token: input.token, tokenUsername: input.tokenUsername });
             session = new HeadlessSession({
                 id: input.sessionId,
                 workDir,

package/dist/index.js

@@ -617,11 +617,57 @@ var publishCommand = new Command5("publish").description("Publish an agent to Pr
 
 // src/commands/runner/command.ts
 import { spawn as spawn3 } from "child_process";
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { Command as Command6 } from "commander";
 
 // src/commands/runner/http.ts
-import { hostname } from "os";
+import { hostname as hostname2 } from "os";
+
+// src/machine.ts
+import { randomUUID } from "crypto";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir2, hostname } from "os";
+import { join as join5 } from "path";
+var CONFIG_DIR2 = join5(homedir2(), ".config", "proagentstore");
+var MACHINE_FILE = join5(CONFIG_DIR2, "machine.json");
+var MAX_NAMES = 10;
+function isValidMachineId(value) {
+  return typeof value === "string" && /^[A-Za-z0-9_-]{8,64}$/.test(value);
+}
+function parseMachineFile(text) {
+  try {
+    const data = JSON.parse(text);
+    if (!isValidMachineId(data.id)) return null;
+    const names = Array.isArray(data.names) ? data.names.filter((n) => typeof n === "string" && n.trim().length > 0).map((n) => n.trim()) : [];
+    return { id: data.id, names: names.slice(0, MAX_NAMES) };
+  } catch {
+    return null;
+  }
+}
+function withName(identity, name) {
+  const current = name.trim();
+  const prev = identity?.names ?? [];
+  const names = current ? [current, ...prev.filter((n) => n !== current)] : [...prev];
+  return { id: identity?.id ?? "", names: names.slice(0, MAX_NAMES) };
+}
+function loadMachineIdentity(now = hostname()) {
+  let stored = null;
+  try {
+    if (existsSync5(MACHINE_FILE)) stored = parseMachineFile(readFileSync4(MACHINE_FILE, "utf-8"));
+  } catch {
+  }
+  const next = withName(stored ?? { id: randomUUID(), names: [] }, now);
+  if (stored && stored.id === next.id && stored.names.join("\0") === next.names.join("\0")) return next;
+  try {
+    mkdirSync3(CONFIG_DIR2, { recursive: true });
+    writeFileSync3(MACHINE_FILE, JSON.stringify(next, null, 2));
+    return next;
+  } catch {
+    return stored ?? { id: "", names: [] };
+  }
+}
+
+// src/commands/runner/http.ts
 function clean(value) {
   const trimmed = value?.trim();
   return trimmed || void 0;
@@ -647,13 +693,17 @@ function apiPathSegment(value) {
   return encodeURIComponent(value);
 }
 function buildRuntimeRegistrationBody(opts, capabilities = []) {
+  const node = hostname2();
+  const machine = loadMachineIdentity(node);
   return {
     endpointUrl: clean(opts.endpointUrl) || opts.endpointUrl,
     token: clean(opts.runnerToken) || clean(opts.token) || clean(process.env.PAGS_RUNNER_TOKEN),
     placement: opts.placement === "managed" ? "managed" : "local",
     capabilities,
     runnerVersion: clean(opts.runnerVersion) || "",
-    runnerNode: hostname()
+    runnerNode: node,
+    machineId: machine.id,
+    machineNames: machine.names
   };
 }
 async function requestRunner(method, path, opts, body) {
@@ -708,7 +758,7 @@ function responseErrorMessage(data, text, statusText) {
 
 // src/commands/runner/process.ts
 import { spawn as spawn2 } from "child_process";
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 import { resolve as resolve4 } from "path";
 import { createServer as createServer2 } from "net";
 import { fileURLToPath as fileURLToPath2 } from "url";
@@ -745,7 +795,7 @@ function buildRunnerArgs(opts) {
 function findWorkspaceRoot() {
   let dir = process.cwd();
   for (let i = 0; i < 8; i++) {
-    if (existsSync5(resolve4(dir, "pnpm-workspace.yaml"))) return dir;
+    if (existsSync6(resolve4(dir, "pnpm-workspace.yaml"))) return dir;
     const parent = resolve4(dir, "..");
     if (parent === dir) break;
     dir = parent;
@@ -763,10 +813,10 @@ function runnerSpawnSpec(opts) {
   let cwd = root;
   let command = "pags-browser-runner";
   let args = runnerArgs;
-  if (existsSync5(localPackage)) {
+  if (existsSync6(localPackage)) {
     command = "pnpm";
     args = ["--filter", "@proagentstore/browser-runner", "dev", "--", ...runnerArgs];
-  } else if (existsSync5(bundledPackage)) {
+  } else if (existsSync6(bundledPackage)) {
     cwd = process.cwd();
     command = process.execPath;
     args = [bundledPackage, ...runnerArgs];
@@ -804,19 +854,19 @@ async function waitForLocalRunner(opts, timeoutMs = 15e3) {
 }
 
 // src/commands/runner/relay.ts
-import { hostname as hostname2 } from "os";
+import { hostname as hostname3 } from "os";
 
 // src/commands/runner/membership.ts
-function isEligible(inst, thisNode) {
+function isEligible(inst, thisNode, alsoKnownAs = []) {
   if (inst.status !== "active") return false;
   if (inst.capabilities?.runtime == null) return false;
   const pin = inst.config?.runnerNode;
-  if (pin && pin !== thisNode) return false;
+  if (pin && pin !== thisNode && !alsoKnownAs.includes(pin)) return false;
   return true;
 }
-function diffMembership(attached, eligible, thisNode, blocked = /* @__PURE__ */ new Set()) {
+function diffMembership(attached, eligible, thisNode, blocked = /* @__PURE__ */ new Set(), alsoKnownAs = []) {
   const have = new Set(attached);
-  const want = eligible.filter((i) => isEligible(i, thisNode));
+  const want = eligible.filter((i) => isEligible(i, thisNode, alsoKnownAs));
   const wantIds = new Set(want.map((i) => i.id));
   return {
     attach: want.filter((i) => !have.has(i.id) && !blocked.has(i.id)),
@@ -836,7 +886,8 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
   const apiBase = pagsApiBase(opts.apiBase).replace(/^http/, "ws");
   const pagsToken = clean(opts.pagsToken) || clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token);
   if (!pagsToken) throw new Error("PAGS token required for WebSocket relay");
-  const runnerNode = hostname2();
+  const runnerNode = hostname3();
+  const machine = loadMachineIdentity(runnerNode);
   const capabilities = await requestRunner("GET", "/capabilities", { url: localUrl, token: runnerToken, instanceId: instanceIds[0] });
   const caps = Array.isArray(capabilities.capabilities) ? capabilities.capabilities.filter((item) => typeof item === "string") : [];
   const registerRuntime = async (id) => {
@@ -848,6 +899,8 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
         capabilities: caps,
         runnerVersion: CLI_VERSION,
         runnerNode,
+        machineId: machine.id,
+        machineNames: machine.names,
         force
       });
     } catch (e) {
@@ -881,7 +934,7 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
   writeLine("Runtime registered with PAGS \u2713");
   writeLine("");
   writeLine("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
-  writeLine(`  \u2705 CONNECTED \u2014 WebSocket relay \xB7 ${hostname2()}`);
+  writeLine(`  \u2705 CONNECTED \u2014 WebSocket relay \xB7 ${hostname3()}`);
   writeLine(`  Agents:   ${instanceIds.length} instance${instanceIds.length === 1 ? "" : "s"}`);
   writeLine("  No cloudflared needed. Ctrl+C to disconnect.");
   writeLine("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
@@ -922,7 +975,11 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
             attached.keys(),
             res.instances ?? [],
             runnerNode,
-            blocked
+            blocked,
+            // The names this machine has also worn. Without them a pin made under a
+            // previous hostname reads as "pinned to another machine", and this poll
+            // detaches the agent twenty seconds after startup attached it (#379).
+            machine.names
           );
           for (const inst of toAttach) {
             await registerRuntime(inst.id);
@@ -963,7 +1020,7 @@ function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, f
       backoffMs = Math.min(backoffMs * 2, 3e4);
       return;
     }
-    const params = new URLSearchParams({ token: relayToken, node: hostname2() });
+    const params = new URLSearchParams({ token: relayToken, node: hostname3() });
     if (force) params.set("force", "1");
     const url = `${wsBase}/v1/relay/${encodeURIComponent(instanceId)}/connect?${params.toString()}`;
     const ws = new WebSocket(url);
@@ -1069,7 +1126,7 @@ function createRunnerCommand() {
     await startRunnerForeground(opts);
   });
   command.command("connect <instanceIds...>").description("Start ONE local runtime, connect via WebSocket relay, and register it for every given PAGS instance").option("--host <host>", "Host to bind", "127.0.0.1").option("--port <port>", "Port to bind", "49171").option("--data-dir <path>", "Runner data directory").option("--token <token>", "Runner bearer token. Defaults to PAGS_RUNNER_TOKEN or a generated token").option("--headless", "Run Playwright headless").option("--api-base <url>", "PAGS API base URL").option("--pags-token <token>", "PAGS session token. Defaults to PAGS_TOKEN").option("--runner-version <version>", "Runner version").option("--force", "Take over from another connected machine").option("--watch-instances", "Attach newly eligible agents while running, without a restart").action(async (instanceIds, opts) => {
-    const runnerToken = clean(opts.token) || clean(process.env.PAGS_RUNNER_TOKEN) || `pags_runner_${randomUUID()}`;
+    const runnerToken = clean(opts.token) || clean(process.env.PAGS_RUNNER_TOKEN) || `pags_runner_${randomUUID2()}`;
     const host = clean(opts.host) || "127.0.0.1";
     const port = clean(opts.port) || String(await findFreePort2(49171));
     const localUrl = `http://${host}:${port}`;
@@ -1231,7 +1288,7 @@ import { Command as Command7 } from "commander";
 
 // src/tui.ts
 import chalk from "chalk";
-import { hostname as hostname3 } from "os";
+import { hostname as hostname4 } from "os";
 import readline from "readline";
 var ACCENT = "#7c3aed";
 var c = chalk.hex(ACCENT);
@@ -1273,7 +1330,7 @@ function printStatus(state) {
   clearScreen();
   printLogo(state.version);
   const connected = state.runner === "online" && state.tunnel === "online" && state.registration === "registered";
-  console.log(pad + d("Signed in as ") + w(state.user) + d("  \xB7  agent: ") + w(state.activeInstance) + d("  \xB7  node: ") + w(hostname3()));
+  console.log(pad + d("Signed in as ") + w(state.user) + d("  \xB7  agent: ") + w(state.activeInstance) + d("  \xB7  node: ") + w(hostname4()));
   console.log("");
   const row = (kind, s) => {
     const { icon, label, note } = describe(kind, s);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.38",
+  "version": "0.4.40",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",