@proagentstore/cli 0.4.53 → 0.4.55

package/dist/browser-runner/apply-outcome.js

@@ -0,0 +1,70 @@
+/**
+ * Every outcome `/browser/complete` can be called with, and what it means locally.
+ *
+ * Only `cancelled` changed in #636. The rest are the behaviour that was already there, written
+ * down: `blocked` stays its own status because the agent stopped and needs the USER (email
+ * verification, something it cannot answer truthfully) — needs-attention, not a failure, and
+ * the console shows it as an active ticket rather than burying it.
+ *
+ * `captcha`/`stuck`/`needs_input` reach here only through the workflow's handoff TIMEOUT,
+ * which calls this endpoint with `failed` and a "… not resolved in time" detail — so their
+ * rows are a backstop for a direct call. They are `failed` because `TaskStatus` has no
+ * `escalated`, which is what the cloud's run record calls them; the honest local equivalent
+ * would be `needs_human`, but a task in that state is not finished, and every call to this
+ * method IS the finish. Left as-is deliberately rather than changed under an unrelated fix.
+ */
+export const APPLY_OUTCOME_DISPOSITION = {
+    submitted: { status: "completed", event: "task.completed", error: false },
+    ready: { status: "completed", event: "task.completed", error: false },
+    expired: { status: "completed", event: "task.completed", error: false },
+    blocked: { status: "blocked", event: "task.failed", error: true },
+    captcha: { status: "failed", event: "task.failed", error: true },
+    stuck: { status: "failed", event: "task.failed", error: true },
+    needs_input: { status: "failed", event: "task.failed", error: true },
+    failed: { status: "failed", event: "task.failed", error: true },
+    max_steps: { status: "failed", event: "task.failed", error: true },
+    cancelled: { status: "cancelled", event: "task.cancelled", error: false },
+};
+/**
+ * The disposition for an outcome off the wire.
+ *
+ * `outcome` is a string from an HTTP body: a newer cloud can send one this bundled runner has
+ * never heard of, since the runner ships inside a CLI the user upgrades on their own schedule.
+ * An unknown outcome falls back to `failed` — the same `?? "failed"` the cloud's
+ * `browserRunStopReason` uses — because "something ended and I cannot say it went well" is the
+ * only honest reading of a word this build does not know.
+ */
+export function dispositionForOutcome(outcome) {
+    return APPLY_OUTCOME_DISPOSITION[outcome] ?? APPLY_OUTCOME_DISPOSITION.failed;
+}
+/**
+ * Write a finished run's outcome onto the task, and name the event to append.
+ *
+ * Pure apart from the mutation of the task it is handed, so the whole disposition — status,
+ * error-or-not, which event — is decided in one tested place instead of inside a method that
+ * also detaches CDP sessions and closes pages.
+ */
+export function settleTaskOutcome(task, outcome, detail) {
+    const disposition = dispositionForOutcome(outcome);
+    task.status = disposition.status;
+    task.output = { outcome, detail };
+    if (disposition.error)
+        task.error = detail || outcome;
+    task.updatedAt = new Date().toISOString();
+    task.completedAt = task.updatedAt;
+    return disposition;
+}
+/**
+ * The statuses a task cannot be moved out of — what `cancelTask` refuses to overwrite.
+ *
+ * `blocked` is deliberately NOT here: a blocked task is waiting on the owner, and Stop is the
+ * owner answering. `cancelled` IS here, and was the member the old `completed || failed` pair
+ * missed (#636) — a second Stop rewrote the timestamps and appended a duplicate
+ * `task.cancelled`. `completed` and `failed` stay untouchable in the other direction: a run
+ * that genuinely finished must not be relabelled as cancelled, because it was not.
+ */
+export const TERMINAL_TASK_STATUSES = ["completed", "failed", "cancelled"];
+/** Has this task already finished, whichever way it finished? */
+export function isTerminalTaskStatus(status) {
+    return TERMINAL_TASK_STATUSES.includes(status);
+}

package/dist/browser-runner/coding/headless.js

@@ -2,6 +2,7 @@ import { spawn } from "node:child_process";
 import { classifyCommand, commandFromToolInput, fillTargetFromResult, toolCallOk, toolResultMark } from "./engine-acts.js";
 import { parseEngineUsage } from "./engine-usage.js";
 import { turnReportFromExit, turnReportFromResult } from "./engine-turn.js";
+import { renderToolResult, shortInput, stripAnsi } from "./transcript-lines.js";
 /**
  * Merge the platform's resolved engine env over the machine's, where an EMPTY value means
  * REMOVE rather than "set to empty".
@@ -115,6 +116,15 @@ export class HeadlessSession {
      * damages the record exactly as much as missing a real one.
      */
     awaitingResult = new Map();
+    /**
+     * `tool_use_id` → tool name, for the ONE decision the result event cannot make on its own: how
+     * much of it reaches the pane (#700, `toolResultBudget` in `transcript-lines.ts`).
+     *
+     * Separate from {@link awaitingResult}, which holds only the small minority of calls that
+     * classify as consequential acts. Entries are deleted when their result arrives and the whole
+     * map is cleared at the turn boundary, where a call that never got one is known never to.
+     */
+    toolNames = new Map();
     /** Turn counter — only used to build a fallback id when the CLI's event has no `uuid`. */
     usageSeq = 0;
     /**
@@ -597,7 +607,13 @@ export class HeadlessSession {
                         this.push(`[${stamp()}] ${block.text.trim()}`); // timestamped agent reply
                     }
                     else if (block.type === "tool_use") {
-                        this.push(`⚙ ${String(block.name ?? "tool")} ${shortInput(block.input)}`); // ⚙
+                        const name = String(block.name ?? "tool");
+                        this.push(`⚙ ${name} ${shortInput(block.input)}`); // ⚙
+                        // The result arrives in a LATER event carrying only `tool_use_id`, and how much
+                        // of it reaches the pane depends on which tool it was (#700) — so the name is
+                        // remembered here and read back in `settleAct`'s sibling branch below.
+                        if (typeof block.id === "string" && block.id)
+                            this.toolNames.set(block.id, name);
                         this.noteAct(block);
                     }
                 }
@@ -605,7 +621,12 @@ export class HeadlessSession {
             case "user": // tool results come back as a synthetic user message
                 for (const block of ev.message?.content ?? []) {
                     if (block.type === "tool_result") {
-                        this.push(`  ↳${toolResultMark(block)} ${toolResult(block.content)}`); // ↳✓ / ↳✗ (#597)
+                        const id = typeof block.tool_use_id === "string" ? block.tool_use_id : "";
+                        // `""` when the call was not seen (a pane that began mid-turn, a runner restart):
+                        // an unknown tool takes the conservative budget rather than the generous one.
+                        const tool = this.toolNames.get(id) ?? "";
+                        this.toolNames.delete(id);
+                        this.push(renderToolResult(toolResultMark(block), block.content, tool)); // ↳✓ / ↳✗ (#597)
                         this.settleAct(block);
                     }
                 }
@@ -633,13 +654,16 @@ export class HeadlessSession {
                 // never saw whether it worked" is a materially different claim from silence, and
                 // silence is what a supervisor would read as "it did nothing".
                 this.flushAwaitingActs();
+                this.toolNames.clear(); // no further result is coming for anything still named here
                 this.run = "idle"; // the turn is OVER — a fact, not a guess
                 break;
             }
             default:
                 break;
         }
-        // Keep the in-memory transcript bounded.
+        // Keep the in-memory transcript bounded. Counts ENTRIES, and an entry may now be a
+        // multi-line block (a result, or a long assistant reply) rather than one line — the
+        // character bound that matters is `MAX_PANE` in runtime.ts, applied on the way out.
         if (this.transcript.length > 4000)
             this.transcript = this.transcript.slice(-3000);
     }
@@ -665,8 +689,8 @@ export class HeadlessSession {
      *
      * The result carries more than the outcome: `gh pr create --fill` states its PR number nowhere
      * but its own stdout, so an unnumbered `pr.open`/`pr.merge` takes it from here (#417). It is read
-     * from the RAW `block.content`, never from `toolResult()`'s display line — that truncates to 240
-     * characters for the transcript and would cut the URL off a verbose result.
+     * from the RAW `block.content`, never from `renderToolResult()`'s display lines — those are cut to
+     * the pane's budget (`transcript-lines.ts`) and would drop the URL off a verbose result.
      *
      * This path (and `noteAct`) is reachable ONLY from the structured stream-json handling above
      * (`assistant` → `tool_use`, `user` → `tool_result`). A Codex/Grok session is a raw spawn with no
@@ -820,36 +844,6 @@ export function buildClaudeArgs(userArgs, resumeId) {
         args.push("--resume", resumeId);
     return args;
 }
-/** Strip ANSI/VT escape sequences so a raw CLI's coloured output reads as plain text. */
-function stripAnsi(s) {
-    // biome-ignore lint/suspicious/noControlCharactersInRegex: stripping terminal escape/control codes from terminal output.
-    return s.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "").replace(/\x1b[()][AB0-2]/g, "").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f]/g, "");
-}
-/** Compact a tool_use input object to a single readable line. */
-function shortInput(input) {
-    if (input == null)
-        return "";
-    try {
-        const s = typeof input === "string" ? input : JSON.stringify(input);
-        return s.length > 160 ? `${s.slice(0, 160)}…` : s;
-    }
-    catch {
-        return "";
-    }
-}
-/** Render a tool_result's content (string, or array of {type:text,text}) to text. */
-function toolResult(content) {
-    let text = "";
-    if (typeof content === "string")
-        text = content;
-    else if (Array.isArray(content)) {
-        text = content
-            .map((b) => (b && typeof b === "object" && "text" in b ? String(b.text) : ""))
-            .join(" ");
-    }
-    text = text.replace(/\s+/g, " ").trim();
-    return text.length > 240 ? `${text.slice(0, 240)}…` : text;
-}
 function loadFile(path) {
     if (!path || !existsSync(path))
         return {};

package/dist/browser-runner/coding/transcript-lines.js

@@ -0,0 +1,223 @@
+/**
+ * How an engine event becomes a line in the pane — the runner's half of #700.
+ *
+ * ── The defect this file exists to remove
+ *
+ * `headless.ts` rendered every `tool_result` through a four-line helper that did two things before
+ * the pane existed: it collapsed `\s+` to a single space, and it cut the text to 240 characters.
+ * Both losses were total and neither was disclosed beyond a trailing ellipsis.
+ *
+ * The consequence is not "results are short". It is that **the shape of a result no longer depends
+ * on the command that produced it.** `cat`, `sed -n '1,50p'`, `cat -n | head -60` and "print every
+ * character" all arrive at the same size, on one line, with the indentation gone. A Pilot that
+ * cannot see a file therefore has no move: every rephrasing it can reach is the same request with
+ * the same bound. One live run spent twelve of its sixteen decisions searching that empty space and
+ * concluded — reasonably, on the evidence in front of it — that "the CLI is summarizing file
+ * contents". It was not; the evidence had been destroyed upstream.
+ *
+ * Measured across 20 sessions of one instance: **150 of 251 stored tool-result lines (59.8%) hit
+ * the 240-character cap** — 102 `Bash`, 43 `Read` — with a maximum line length of 246. The cap was
+ * the common case, and it fired hardest on `Read`, the tool whose entire job is returning file
+ * contents.
+ *
+ * ── What replaces it, and what it costs
+ *
+ * Three changes, and the reason each is separate:
+ *
+ *  1. **Line structure survives.** Newlines are kept and continuation lines carry
+ *     {@link RESULT_CONT_PREFIX}. This is the half that matters most and it costs almost nothing:
+ *     `cat -n` output is unreadable as one space-joined line at ANY length, so the collapse made
+ *     the cap worse than its size alone implies.
+ *  2. **The cap is per tool** ({@link toolResultBudget}), not one number. A `Read` result is the
+ *     case that needs room; an `Edit`'s "has been updated successfully" is a status string that was
+ *     never near 240 anyway. Raising one number for everything would buy file text by spending the
+ *     pane on results that carry none.
+ *  3. **A cut states its own size** (`…[cut: 1,500 of 18,432 chars]`), so the reader learns there
+ *     is more AND how much — which is what makes "ask for a slice that fits" a strategy rather than
+ *     a guess. Same disclosure discipline as `repo_read_file`'s window header and `repo_git`'s
+ *     TRUNCATED note on the cloud side.
+ *
+ * **The cost is real and it is the pane.** A `terminal` row stores the last 8,000 characters
+ * (`TERMINAL_SNAPSHOT_CHARS`) and one Pilot decision reads the last 6,000 (`PILOT_PANE_CHARS`), so
+ * every character bought for file text is bought by evicting history — including the `⚙`/`↳`
+ * framing `engine-tool-calls.ts` parses back out and the engine-error lines #580 exists to keep
+ * visible. {@link RESULT_CAP_CONTENT_CHARS} is therefore derived from that window rather than
+ * chosen from it — see {@link RESULT_CAP_CONTENT_CHARS} and {@link RESULT_RENDERED_MAX}, which
+ * state the content budget and what it actually costs the pane once framing is paid for.
+ *
+ * ── Old runners, and why nothing gates on a version
+ *
+ * A machine that has not upgraded keeps the 240-char single-line behaviour, so every cloud reader
+ * must go on tolerating short, structureless results — `engine-tool-calls.ts` already models that
+ * (`outputCut`) and continues to. Continuation lines are read by their PREFIX, not by a version
+ * probe: a pane is judged by what it contains, the way the `↳✓` outcome marker is.
+ */
+/**
+ * The prefix every line of a result after the first carries.
+ *
+ * It exists for two reasons and the second is the load-bearing one:
+ *
+ *  - the pane stays readable as a transcript rather than as an unindented dump, and
+ *  - a result can no longer FORGE the framing. `parseEngineToolCalls` decides what a line is from
+ *    its first characters, so a file containing a line that begins `⚙ ` or `↳` would, once
+ *    newlines survived, parse as a tool call the engine never made. Every continuation line begins
+ *    with this prefix instead, so a result's own text can never start a line that the parser reads
+ *    as anything else.
+ *
+ * `│` (U+2502), not `|`: a markdown table in an engine's reply uses the ASCII pipe, and the point
+ * of the character is that transcript prose does not use it.
+ */
+export const RESULT_CONT_PREFIX = "  │ ";
+/**
+ * How much of a CONTENT tool's result — its own characters, framing excluded — reaches the pane.
+ *
+ * Derived, not picked: the Pilot reads the last 6,000 characters of the pane
+ * (`PILOT_PANE_CHARS`, `workers/api/src/lib/coding-repetition.ts`), and no single result may take
+ * more than a QUARTER of that in content, which is ~35 lines of ordinary source — what a bounded
+ * slice request actually asks for. What that costs the pane in full is {@link RESULT_RENDERED_MAX},
+ * and it is the larger number, because framing is not free.
+ *
+ * The two constants are separate declarations in separate packages for the reason `RESULT_ARROW` is
+ * (a Worker must not import the runner's Node package); the derivation is stated here so that
+ * moving one without the other is at least a visible mistake.
+ *
+ * `used` and `total` in the cut notice are BOTH content characters, deliberately: the number is
+ * only actionable if the model can compare it against the file it is asking for.
+ */
+export const RESULT_CAP_CONTENT_CHARS = 1500;
+/**
+ * A ceiling on LINES as well as characters, because the prefix is charged per line.
+ *
+ * A result of 1,500 one-character lines would pay {@link RESULT_CONT_PREFIX} 1,500 times — 6,000
+ * characters of framing for 1,500 of content, i.e. the whole of the Pilot's window spent on
+ * indentation. 60 lines bounds that overhead at 240 characters.
+ */
+export const RESULT_CAP_CONTENT_LINES = 60;
+/** Every other tool keeps the historical 240 characters — see {@link CONTENT_TOOLS}. */
+export const RESULT_CAP_DEFAULT_CHARS = 240;
+/** …and at most six lines of it, so a status string cannot spend six prefixes to say nothing. */
+export const RESULT_CAP_DEFAULT_LINES = 6;
+/** The longest cut notice the renderer can emit — `…[cut: 999,999,999 of 999,999,999 chars]`. */
+const CUT_NOTICE_MAX = 45;
+/**
+ * What the WHOLE result block can cost the pane, framing and disclosure included.
+ *
+ * Stated because the content budget alone is not the honest figure and pretending otherwise is how
+ * a cap gets quietly exceeded: the arrow prefix, one `RESULT_CONT_PREFIX` and one newline per
+ * continuation line, and the cut notice are all pane characters too. At the current numbers that is
+ * ~1,840 — under a THIRD of the Pilot's 6,000-character window, so three consecutive content
+ * results still coexist with the narrative and the `⚙`/`↳` framing rather than evicting them.
+ *
+ * If someone widens {@link RESULT_CAP_CONTENT_CHARS}, this is the number that says what it costs.
+ */
+export const RESULT_RENDERED_MAX = "  ↳✓ ".length + RESULT_CAP_CONTENT_CHARS + (RESULT_CAP_CONTENT_LINES - 1) * (RESULT_CONT_PREFIX.length + 1) + CUT_NOTICE_MAX;
+/**
+ * The tools whose RESULT is the answer, rather than a receipt for an action.
+ *
+ * `Read`/`Bash` are the two the measurement names (43 and 102 of the 150 truncated lines).
+ * `Grep`/`Glob`/`BashOutput`/`NotebookRead` are here because their results are line-structured
+ * listings — the same content, arriving through a different tool name — and a Pilot that asked for
+ * a grep instead of a cat should not be punished for it.
+ *
+ * `Edit`, `Write`, `MultiEdit` and `TodoWrite` are deliberately absent: their results are status
+ * strings ("has been updated successfully…", 176-214 characters in the sampled sessions) that the
+ * old cap barely touched, so widening them would spend the pane and buy nothing.
+ */
+export const CONTENT_TOOLS = new Set(["Read", "Bash", "BashOutput", "Grep", "Glob", "NotebookRead"]);
+/** The budget for one tool's result. An unknown or unnamed tool gets the conservative one. */
+export function toolResultBudget(tool) {
+    return CONTENT_TOOLS.has(tool)
+        ? { chars: RESULT_CAP_CONTENT_CHARS, lines: RESULT_CAP_CONTENT_LINES }
+        : { chars: RESULT_CAP_DEFAULT_CHARS, lines: RESULT_CAP_DEFAULT_LINES };
+}
+/** Strip ANSI/VT escape sequences so a raw CLI's coloured output reads as plain text. */
+export function stripAnsi(s) {
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: stripping terminal escape/control codes from terminal output.
+    return s.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "").replace(/\x1b[()][AB0-2]/g, "").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f]/g, "");
+}
+/** Compact a tool_use input object to a single readable line. */
+export function shortInput(input) {
+    if (input == null)
+        return "";
+    try {
+        const s = typeof input === "string" ? input : JSON.stringify(input);
+        return s.length > 160 ? `${s.slice(0, 160)}…` : s;
+    }
+    catch {
+        return "";
+    }
+}
+/** Render a tool_result's content (string, or array of `{type:text,text}`) to raw text. */
+export function toolResultText(content) {
+    if (typeof content === "string")
+        return content;
+    if (!Array.isArray(content))
+        return "";
+    // Joined with a NEWLINE, not a space: separate content blocks are separate pieces of output,
+    // and the whole point of this module is that the difference is preserved.
+    return content
+        .map((b) => (b && typeof b === "object" && "text" in b ? String(b.text) : ""))
+        .filter((t) => t !== "")
+        .join("\n");
+}
+/**
+ * Normalise a result's text to display lines: no CR, no escape codes, no trailing whitespace, and
+ * no runs of blank lines. Every one of those is pane budget spent on nothing.
+ */
+function tidyLines(text) {
+    const out = [];
+    for (const raw of stripAnsi(text.replace(/\r\n?/g, "\n")).split("\n")) {
+        const line = raw.trimEnd();
+        // Drop a leading blank, and collapse a run of blanks to one.
+        if (!line && (out.length === 0 || out[out.length - 1] === ""))
+            continue;
+        out.push(line);
+    }
+    while (out.length && out[out.length - 1] === "")
+        out.pop();
+    return out;
+}
+/**
+ * The full transcript entry for one `tool_result` — the arrow line plus any continuation lines.
+ *
+ * The head is cut rather than the tail, unchanged from the old helper: a file, a listing and a
+ * grep all answer from their beginning, and a test run's tail is recoverable from the engine's own
+ * reply text, which is never truncated. Changing that is a separate decision and is not made here.
+ */
+export function renderToolResult(mark, content, tool) {
+    const lines = tidyLines(toolResultText(content));
+    const budget = toolResultBudget(tool);
+    const total = lines.join("\n").length;
+    const kept = [];
+    let used = 0;
+    let cut = false;
+    for (const line of lines) {
+        if (kept.length >= budget.lines) {
+            cut = true;
+            break;
+        }
+        const room = budget.chars - used;
+        if (room <= 0) {
+            cut = true;
+            break;
+        }
+        if (line.length > room) {
+            kept.push(line.slice(0, room));
+            used += room;
+            cut = true;
+            break;
+        }
+        kept.push(line);
+        used += line.length;
+    }
+    if (cut && kept.length) {
+        // The figures, not just the ellipsis: "there was more" tells the reader to give up, "1,500
+        // of 18,432" tells it how narrow a slice would arrive whole. The ellipsis stays because it
+        // is what every runner ever written has used to mark a cut, and readers key on it.
+        kept[kept.length - 1] = `${kept[kept.length - 1]}…[cut: ${used.toLocaleString("en-US")} of ${total.toLocaleString("en-US")} chars]`;
+    }
+    const head = `  ↳${mark} ${kept[0] ?? ""}`.trimEnd();
+    if (kept.length < 2)
+        return head;
+    return [head, ...kept.slice(1).map((l) => `${RESULT_CONT_PREFIX}${l}`)].join("\n");
+}

package/dist/browser-runner/commit-guard.js

@@ -0,0 +1,127 @@
+/**
+ * The commit guard AT THE ACT BOUNDARY — the runner half of #627 / #629.
+ *
+ * ── Why it has to be here
+ *
+ * `dryRun` and `readOnly` were enforced entirely in the cloud, on `action.name`: a string the MODEL
+ * wrote ABOUT the element. This process is the one that actually clicks, and it clicks by `ref`
+ * ({@link https://github.com/microsoft/playwright-mcp} `browser_click({ element, target })` — only
+ * `target` locates; `element` is a human-readable description). So the guard tested a story about
+ * the act while the act went somewhere else entirely, and the runner — the only party holding the
+ * DOM, and therefore the only one that can KNOW whether a control submits — had never been told
+ * that a run was a rehearsal at all: `grep -rn dryRun packages/browser-runner/src` returned eight
+ * hits and every one of them was the orphaned-browser reaper's unrelated `--dry-run` flag.
+ *
+ * A nameless click had already submitted a real application during a run the owner asked to be a
+ * test. The fix at the time made an EMPTY name a refusal, which left a WRONG name — a paraphrase,
+ * an `aria-label` the model rewrote, a page in French — behaving exactly as before.
+ *
+ * ── What is a fact here and what is still a guess
+ *
+ * FACT (`read_only`): whether the targeted control submits a form, and whether that form is a POST.
+ * Language-independent, label-independent, and not something the brain can talk its way past. A
+ * GET form is a search — the read-only prompt explicitly allows finding things — so only POST is
+ * refused. Enter and Space are checked against the FOCUSED element the same way.
+ *
+ * GUESS (both rehearsal modes): which of several POST submits on a multi-page ATS is the FINAL one.
+ * Nothing in the DOM says so — "Save and Continue" on page 3 and "Submit application" on page 6 are
+ * the same kind of control — and a rehearsal must be able to walk the whole form. So a rehearsal
+ * still decides on a LABEL. What changed is whose label: the element's own accessible name, read
+ * back out of the live DOM, instead of the model's claim about it, and a vocabulary that is not
+ * English-only. That residual is recorded on the issue rather than papered over.
+ */
+/**
+ * The FLOOR vocabulary, used only when the cloud sent none. It is deliberately the read-only
+ * (widest) set: a runner that has been told "read_only" but not told the words must not fail open.
+ * The authoritative list is `workers/api/src/lib/commit-guard.ts`, and `commit-guard.test.ts` there
+ * asserts this file still parses as a regex, so a copy that rots is a red build rather than a
+ * silent downgrade.
+ */
+export const FALLBACK_COMMIT_RE = /\b(confirm|accept|submit|send|post|publish|delete|remove|pay|purchase|buy|apply|approve|agree|save)\b|(?<![\p{L}\p{N}])(envoyer|soumettre|valider|absenden|abschicken|senden|einreichen|enviar|invia|inviare|verstuur|versturen|verzenden|indienen|skicka|wy[śs]lij|g[öo]nder|kirim|отправить)(?![\p{L}\p{N}])|提交|送出|确认|確認|送信|提出|제출|보내기|إرسال|تقديم/iu;
+/** Compile the policy the cloud sent, falling back to the floor above. A malformed pattern must
+ *  NOT disarm the guard — it falls back rather than throwing, because the caller is about to act. */
+export function commitLabelRe(spec) {
+    if (!spec?.labels)
+        return FALLBACK_COMMIT_RE;
+    try {
+        return new RegExp(spec.labels, spec.flags || "iu");
+    }
+    catch {
+        return FALLBACK_COMMIT_RE;
+    }
+}
+/** Keys that submit a focused form. `NumpadEnter` submits identically and was matched by nothing. */
+export const SUBMIT_KEY_RE = /^(enter|return|numpadenter)$/i;
+/** Space activates the focused control, including a submit button. */
+export const ACTIVATE_KEY_RE = /^(space|spacebar|\s)$/i;
+/** The probe evaluated ON the targeted element. Kept as source text because it crosses into the
+ *  page through the standard `browser_evaluate` tool, which takes a function expression. */
+export const ELEMENT_PROBE_FN = `el => {
+  var btn = (el.closest && el.closest('button,input,a,[role=button]')) || el;
+  var tag = (btn.tagName || '').toLowerCase();
+  var type = ((btn.getAttribute && btn.getAttribute('type')) || '').toLowerCase();
+  var form = btn.form || (btn.closest && btn.closest('form')) || null;
+  var submits = !!form && ((tag === 'button' && type !== 'button' && type !== 'reset') || (tag === 'input' && (type === 'submit' || type === 'image')));
+  var name = (btn.getAttribute && btn.getAttribute('aria-label')) || btn.value || btn.innerText || btn.textContent || '';
+  return { submits: submits, method: form ? ((form.getAttribute('method') || 'get').toLowerCase()) : '', tag: tag, type: type, name: String(name).replace(/\\s+/g, ' ').trim().slice(0, 160) };
+}`;
+/** The probe for a keypress: there is no ref, so it reads whatever has focus. */
+export const FOCUS_PROBE_FN = `(() => {
+  var el = document.activeElement;
+  if (!el) return { inForm: false, method: '', tag: '', type: '', name: '' };
+  var form = el.form || (el.closest && el.closest('form')) || null;
+  var name = (el.getAttribute && el.getAttribute('aria-label')) || el.value || el.innerText || el.textContent || '';
+  return { inForm: !!form, method: form ? ((form.getAttribute('method') || 'get').toLowerCase()) : '', tag: (el.tagName || '').toLowerCase(), type: ((el.getAttribute && el.getAttribute('type')) || '').toLowerCase(), name: String(name).replace(/\\s+/g, ' ').trim().slice(0, 160) };
+})()`;
+/**
+ * May this click reach the page? Returns the refusal to hand back to the brain, or null.
+ *
+ * `facts` is null when the element could not be probed (an evaluate that failed, a ref the page no
+ * longer has). That is not treated as permission: in read-only it is refused outright, and in a
+ * rehearsal it falls back to the claimed name, which is the behaviour that shipped.
+ */
+export function refuseClick(spec, facts, claimedName, re) {
+    const claimed = (claimedName ?? "").trim();
+    const real = (facts?.name ?? "").trim();
+    if (spec.mode === "read_only") {
+        if (!facts) {
+            return "BLOCKED by the runner — this agent is READ-ONLY and that element could not be read from the page, so the click cannot be shown to be safe. Re-read the snapshot and target an element from it.";
+        }
+        if (facts.submits && facts.method === "post") {
+            return `BLOCKED by the runner — this agent is READ-ONLY and "${real || claimed || facts.tag}" submits a form (POST) on this page. That is a change, whatever the control is called. Report what you can already see with finish.`;
+        }
+    }
+    const hit = [real, claimed].find((n) => n && re.test(n));
+    if (!hit)
+        return null;
+    return spec.mode === "read_only"
+        ? `BLOCKED by the runner — this agent is READ-ONLY and can never perform "${hit}". Report what you can already see with finish.`
+        : `BLOCKED by the runner — this is a REHEARSAL and "${hit}" commits. The page never received the click. Call finish now instead of retrying.`;
+}
+/**
+ * May this keypress reach the page?
+ *
+ * Read-only only. A rehearsal's Enter is decided by the cloud loop, which holds the one piece of
+ * state that makes the call — an Enter immediately after an arrow key is an autocomplete ACCEPT,
+ * not a submit — and this process cannot tell a JS listbox that will swallow the key from a form
+ * that will take it.
+ */
+export function refuseKey(spec, key, focus) {
+    if (spec.mode !== "read_only")
+        return null;
+    const k = (key ?? "").trim();
+    const submitKey = SUBMIT_KEY_RE.test(k);
+    const activateKey = ACTIVATE_KEY_RE.test(k);
+    if (!submitKey && !activateKey)
+        return null;
+    if (!focus) {
+        return `BLOCKED by the runner — this agent is READ-ONLY and the focused element could not be read, so pressing ${k || "Enter"} cannot be shown to be safe.`;
+    }
+    if (submitKey && focus.inForm && focus.method === "post") {
+        return `BLOCKED by the runner — this agent is READ-ONLY and pressing ${k} submits the form this field belongs to (POST). A search or filter that only reads (GET) is fine; this one writes. Report what you can already see with finish.`;
+    }
+    if (activateKey && (focus.tag === "button" || focus.type === "submit") && focus.method === "post") {
+        return `BLOCKED by the runner — this agent is READ-ONLY and Space activates "${focus.name || "the focused button"}", which submits a form (POST).`;
+    }
+    return null;
+}

package/dist/browser-runner/handoff-status.js

@@ -0,0 +1,56 @@
+/**
+ * What a handoff-status poll can answer WITHOUT looking at the live page (#641).
+ *
+ * A handoff is the runner asking a human for something the brain cannot do: solve a
+ * challenge, perform one widget step it failed at, or supply a value it must not invent.
+ * The remote Workflow polls `browserHandoffStatus` until it is told the human acted, and
+ * `solved: true` is a licence to resume the application — so the only safe answers are the
+ * ones the runner can actually stand behind.
+ *
+ * ── The rule
+ *
+ * A handoff whose PAGE IS GONE is LOST, not resolved. It is the same category as a handoff
+ * whose SESSION is gone (the runner restarted, the takeover expired), which the caller
+ * already answers `solved: false` under a comment stating the rule outright: *a status poll
+ * must never relaunch the browser or claim a lost handoff is done.* Three lines below that
+ * comment sat `if (page.isClosed()) return { solved: true }`, ahead of all three per-reason
+ * branches, so it overrode every one of them:
+ *
+ *   - `challenge` — the brain resumed with the CAPTCHA unsolved, and the claim was acted
+ *     on rather than re-checked: the workflow records `solvedChallengeUrl`, and the apply
+ *     loop then suppresses captcha re-detection on that page for the rest of the round. A
+ *     false "solved" muted the detector that would have caught it.
+ *   - `stuck` — resumed without the human doing the single step the handoff exists for;
+ *     `humanDone` was never consulted.
+ *   - `needs_input` — resumed with `value: undefined`, so the workflow skipped the save and
+ *     the brain re-asked on the next round for a value it had been given.
+ *
+ * There is nothing to resume ONTO in any of those cases: the page the human was working in
+ * no longer exists, and the brain's next action would land on a freshly created blank tab.
+ * Staying unsolved lets the wait time out into "not resolved in time", which the cloud maps
+ * to `escalated` → the board's "Needs you" column — visible, and retryable by the owner.
+ *
+ * ── The one exception, and why it is not one
+ *
+ * `needs_input` is answered BEFORE page liveness is considered, because its answer never
+ * involved the page: the value arrives out of band through `browserSubmitInput`, which
+ * writes it onto the session. A value the owner typed is a real answer whether or not the
+ * tab survived, and discarding it would re-ask for something already in hand.
+ */
+/**
+ * The answer to a handoff-status poll, or `null` when only the live DOM can give one — a
+ * `challenge` on a page that is still open, whose token clears in the page itself.
+ */
+export function resolveHandoffStatus(facts) {
+    // Out of band, and therefore unaffected by a page that has gone.
+    if (facts.reason === "needs_input")
+        return { solved: !!facts.inputValue, challenge: null, value: facts.inputValue };
+    // Lost, not done. See the note above — this line is the fix for #641.
+    if (facts.pageClosed)
+        return { solved: false, challenge: null };
+    // A stuck handoff resumes only when the human explicitly clicks Resume — there's
+    // nothing to auto-detect.
+    if (facts.reason === "stuck")
+        return { solved: !!facts.humanDone, challenge: null };
+    return null;
+}

package/dist/browser-runner/runner.js

@@ -5,8 +5,11 @@ import { basename, dirname, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { captureScreenshotDataUrl, challengeSolved, detectHumanChallenge } from "./challenge.js";
 import { resolveRealChromeProfileDir, seedProfileCopy } from "./browser-profile.js";
+import { isTerminalTaskStatus, settleTaskOutcome } from "./apply-outcome.js";
 import { McpRuntime } from "./mcp-runtime.js";
+import { commitLabelRe, ELEMENT_PROBE_FN, FOCUS_PROBE_FN, refuseClick, refuseKey } from "./commit-guard.js";
 import { HumanHandoffError, RunnerInputError } from "./errors.js";
+import { resolveHandoffStatus } from "./handoff-status.js";
 import { RunnerStore } from "./store.js";
 import { CodingRuntime } from "./coding/runtime.js";
 import { WORKFLOW_DRIVEN_TASKS } from "./task-types.js";
@@ -169,7 +172,11 @@ export class LocalRunner {
     }
     cancelTask(id) {
         const task = this.requireTask(id);
-        if (task.status === "completed" || task.status === "failed")
+        // Already finished, whichever way — the old `completed || failed` pair missed `cancelled`, so
+        // a second Stop rewrote the timestamps and appended a duplicate event (#636). A run that
+        // genuinely completed or failed is NOT relabelled: it ended before the Stop arrived. Off THIS
+        // return the cloud mirrored `task.cancelled` carrying `{status:"failed"}` — fixed in the cloud.
+        if (isTerminalTaskStatus(task.status))
             return task;
         task.status = "cancelled";
         task.updatedAt = new Date().toISOString();
@@ -837,6 +844,46 @@ export class LocalRunner {
             return false;
         return null;
     }
+    /** Evaluate a function ON an element (by snapshot ref) and parse its JSON result. Never throws
+     *  — a null return means "the page could not be asked", which callers must not read as a yes. */
+    async evalJson(mcp, ref, label, fn) {
+        const res = await mcp.callTool("browser_evaluate", { element: label, target: ref, function: fn }).catch(() => null);
+        if (!res || res.isError)
+            return null;
+        const txt = mcp.textOf(res);
+        const i = txt.indexOf("### Result");
+        if (i < 0)
+            return null;
+        const after = txt.slice(i + "### Result".length).trim();
+        const end = after.indexOf("\n###");
+        const block = (end >= 0 ? after.slice(0, end) : after).trim();
+        try {
+            return JSON.parse(block);
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * The commit guard, enforced HERE because this is the process that clicks (#627, #629).
+     *
+     * The cloud's pre-filter reads a label the model wrote; this one reads the element. For a
+     * read-only agent that is a DOM fact — does this control submit a POST form — which no label,
+     * in any language, can talk its way past. Returns the refusal to hand back to the brain.
+     */
+    async commitRefusal(mcp, page, action, guard) {
+        const re = commitLabelRe(guard);
+        if (action.action === "click") {
+            const ref = (action.ref || "").trim();
+            const facts = ref ? await this.evalJson(mcp, ref, action.name || action.role || "control", ELEMENT_PROBE_FN) : null;
+            return refuseClick(guard, facts, action.name, re);
+        }
+        if (action.action === "key") {
+            const focus = (await page.evaluate(FOCUS_PROBE_FN).catch(() => null));
+            return refuseKey(guard, action.key, focus);
+        }
+        return null;
+    }
     /** The snapshot ref the brain must target the element by (standard-tool `target`). */
     refOf(action) {
         const ref = (action.ref || "").trim();
@@ -943,7 +990,7 @@ export class LocalRunner {
      * element by its snapshot ref. A tool-level failure is thrown so the workflow
      * surfaces it to the brain as an `error` (which drives its self-correction).
      */
-    async browserAct(action, resumePath) {
+    async browserAct(action, resumePath, guard) {
         const page = await this.getActivePage();
         // Arm résumé auto-attach so a file chooser never blocks the flow (see method).
         // resumePath may be a signed URL (remote runner) or a local path — resolve to
@@ -970,9 +1017,19 @@ export class LocalRunner {
                 title: await active.title().catch(() => ""),
                 challenge: await detectHumanChallenge(active),
                 screenshot: await this.shot(active),
+                commitGuard: { supported: true, mode: guard?.mode },
             };
         }
         const mcp = await this.getMcp();
+        // BEFORE the tool call, never after: this is the last point at which the action is still
+        // only a proposal. `commitGuard.supported` on every reply is how the cloud learns that this
+        // enforcement exists here at all — measured from the runner's own answer, not guessed from
+        // a version number, because the published CLI upgrades on the field's schedule.
+        if (guard) {
+            const refusal = await this.commitRefusal(mcp, page, action, guard);
+            if (refusal)
+                throw new RunnerInputError(refusal);
+        }
         const res = await this.callBrowserTool(mcp, action);
         const text = mcp.textOf(res).trim();
         // A native page dialog (alert/confirm/beforeunload) puts the standard server
@@ -994,6 +1051,7 @@ export class LocalRunner {
                 challenge: await detectHumanChallenge(settled),
                 feedback: dialogMsg ? `a native dialog was accepted: "${dialogMsg}"` : "a native dialog was accepted",
                 screenshot: await this.shot(settled),
+                commitGuard: { supported: true, mode: guard?.mode },
             };
         }
         if (res.isError)
@@ -1027,6 +1085,7 @@ export class LocalRunner {
             challenge: await detectHumanChallenge(active),
             feedback: feedback || undefined,
             screenshot: await this.shot(active),
+            commitGuard: { supported: true, mode: guard?.mode },
         };
     }
     // ── Agent-driven application lifecycle (called by the remote Workflow brain) ──
@@ -1091,15 +1150,12 @@ export class LocalRunner {
         if (!session)
             return { solved: false, challenge: null };
         const page = session.page;
-        if (page.isClosed())
-            return { solved: true, challenge: null };
-        // A needs_input handoff resumes once the user supplies the value.
-        if (session.reason === "needs_input")
-            return { solved: !!session.inputValue, challenge: null, value: session.inputValue };
-        // A stuck handoff resumes only when the human explicitly clicks Resume —
-        // there's nothing to auto-detect.
-        if (session.reason === "stuck")
-            return { solved: !!session.humanDone, challenge: null };
+        // Every answer that needs no live DOM — including a GONE page, which used to report
+        // solved:true and resume past an unsolved challenge (#641) — comes from
+        // handoff-status.ts; null means only an open challenge's own DOM can answer.
+        const offline = resolveHandoffStatus({ reason: session.reason, pageClosed: page.isClosed(), inputValue: session.inputValue, humanDone: session.humanDone });
+        if (offline)
+            return offline;
         // A challenge resumes when the token/widget clears OR the human clicks Done —
         // custom captchas (e.g. PageUp's "not a robot") have no detectable token, so
         // the human's explicit Done is the authority; never strand them.
@@ -1144,23 +1200,17 @@ export class LocalRunner {
         }
         return { ok: true };
     }
-    /** Finalize an agent-driven application (submitted/expired → completed; else failed). */
+    /** Finalize an agent-driven application — the outcome→status table lives in apply-outcome.ts. */
     async browserComplete(taskId, outcome, detail) {
         await this.endTakeover(taskId).catch(() => undefined);
         const task = this.store.getTask(taskId);
         if (task) {
-            const success = outcome === "submitted" || outcome === "ready" || outcome === "expired";
-            // 'blocked' = the agent stopped and needs the USER (email verification, can't
-            // proceed truthfully) — it's needs-attention, not a failure, so keep it a
-            // distinct status (the console shows it as an active ticket, not buried).
-            task.status = outcome === "blocked" ? "blocked" : success ? "completed" : "failed";
-            task.output = { outcome, detail };
-            if (!success)
-                task.error = detail || outcome;
-            task.updatedAt = new Date().toISOString();
-            task.completedAt = task.updatedAt;
+            // A TOTAL table, not a chain of string comparisons: `cancelled` matched none of
+            // them and fell through to `failed`, so a run the owner stopped was filed as an
+            // error with a Retry button on it (#636). See apply-outcome.ts.
+            const { event } = settleTaskOutcome(task, outcome, detail);
             this.store.putTask(task);
-            this.addTaskEvent(task, success ? "task.completed" : "task.failed", detail || `Application ${outcome}`, { outcome, detail });
+            this.addTaskEvent(task, event, detail || `Application ${outcome}`, { outcome, detail });
         }
         await this.closeStalePages().catch(() => undefined);
         return { ok: true };

package/dist/browser-runner/server.js

@@ -90,8 +90,12 @@ async function route(runner, req, res) {
         return json(res, 200, await runner.browserSnapshot(b.taskId));
     }
     if (req.method === "POST" && path === "/browser/act") {
+        // `guard` is the commit policy for THIS run (#627, #629) — a rehearsal or a read-only
+        // agent. It travels with every action rather than being registered once, because the
+        // runner serves many instances at once and a per-connection mode would be a second piece
+        // of state to get wrong.
         const body = await readJson(req);
-        return json(res, 200, await runner.browserAct(body, body.resumePath));
+        return json(res, 200, await runner.browserAct(body, body.resumePath, body.guard));
     }
     if (req.method === "POST" && path === "/browser/event") {
         const b = await readJson(req);

package/dist/browser-runner/test-job-server.js

@@ -1,9 +1,10 @@
 import { createServer, } from "node:http";
 export async function startTestJobServer(port = 0) {
     const submissions = [];
+    const searches = [];
     const server = createServer(async (req, res) => {
         try {
-            await route(req, res, submissions);
+            await route(req, res, submissions, searches);
         }
         catch (error) {
             html(res, 500, `<h1>Server Error</h1><pre>${escapeHtml(String(error))}</pre>`);
@@ -17,7 +18,10 @@ export async function startTestJobServer(port = 0) {
     return {
         url,
         jobUrl: `${url}/jobs/software-engineer`,
+        quickApplyUrl: `${url}/jobs/quick-apply`,
+        searchUrl: `${url}/search`,
         submissions,
+        searches,
         async close() {
             await new Promise((resolve, reject) => {
                 server.close((error) => (error ? reject(error) : resolve()));
@@ -36,7 +40,7 @@ export async function startTestJobServer(port = 0) {
         },
     };
 }
-async function route(req, res, submissions) {
+async function route(req, res, submissions, searches) {
     const url = new URL(req.url || "/", "http://127.0.0.1");
     if (req.method === "GET" && url.pathname === "/") {
         redirect(res, "/jobs/software-engineer");
@@ -51,6 +55,17 @@ async function route(req, res, submissions) {
         }));
         return;
     }
+    if (req.method === "GET" && url.pathname === "/jobs/quick-apply") {
+        html(res, 200, quickApplyPage());
+        return;
+    }
+    if (req.method === "GET" && url.pathname === "/search") {
+        const q = url.searchParams.get("q");
+        if (q !== null)
+            searches.push(q);
+        html(res, 200, searchPage(q));
+        return;
+    }
     if (req.method === "POST" && url.pathname === "/apply") {
         const submission = await parseApplication(req);
         submissions.unshift(submission);
@@ -125,6 +140,33 @@ function jobPage(opts = {}) {
     </main>
   `);
 }
+/** One click = one real application. No `required` attribute anywhere, so nothing but the guard
+ *  can stop the POST — a fixture where HTML validation did the stopping would prove nothing. */
+function quickApplyPage() {
+    return page("Postuler en 1 clic", `
+    <main>
+      <section class="job"><h1>Ingénieur logiciel</h1><p class="company">Fixture Labs</p></section>
+      <form action="/apply" method="post" enctype="multipart/form-data" class="application-form">
+        <input type="hidden" name="fullName" value="Sergey Ivochkin" />
+        <input type="hidden" name="email" value="sergey@example.com" />
+        <label>Recherche <input name="coverNote" aria-label="Recherche" /></label>
+        <button type="submit">Envoyer ma candidature</button>
+      </form>
+    </main>
+  `);
+}
+/** A GET search form: submitting it only READS. */
+function searchPage(q) {
+    return page("Recherche", `
+    <main>
+      <form action="/search" method="get">
+        <label>Search <input name="q" aria-label="Search" /></label>
+        <button type="submit">Search</button>
+      </form>
+      <p id="result">${q === null ? "no query" : `searched: ${escapeHtml(q)}`}</p>
+    </main>
+  `);
+}
 function successPage(submission) {
     return page("Application Received", `
     <main>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.53",
+  "version": "0.4.55",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",