@proagentstore/cli 0.4.65 → 0.4.67

package/dist/browser-runner/coding/engine-acts.js

@@ -34,6 +34,7 @@
  * A raw engine emits nothing parseable, so an empty act list means "nothing observed", never
  * "nothing happened", and every consumer has to say so rather than render it as an all-clear.
  */
+import { splitHeredocs } from "./heredoc.js";
 /** Acts whose consequences reach outside the machine, or cannot be walked back locally. */
 const IRREVERSIBLE = new Set([
     "pr.merge",
@@ -77,10 +78,15 @@ export function redactCommand(command) {
  * Over-splitting costs nothing (a fragment simply matches no rule); under-splitting loses an act,
  * and the real-world shape of the case this exists for is exactly a compound line:
  * `cd repo && git push -u origin fix && gh pr create --fill && gh pr merge --squash`.
+ *
+ * Heredoc BODIES are removed first (#873): they are data — a commit message, a comment body, a
+ * script editing a test file — and their lines, split as commands, recorded pushes, merges and a
+ * repository deletion that never ran. This side sees the whole command, so a real command after
+ * the terminator is still read.
  */
 export function splitSegments(command) {
-    return String(command ?? "")
-        .split(/\|\||&&|[;|\n]/)
+    return splitHeredocs(String(command ?? ""))
+        .executed.split(/\|\||&&|[;|\n]/)
         .map((s) => s.trim())
         .filter(Boolean);
 }
@@ -265,7 +271,9 @@ export function classifySegment(segment) {
  * was on that line.
  */
 export function classifyCommand(id, command, at = new Date().toISOString()) {
-    const full = redactCommand(command);
+    // The evidence keeps what was executed and collapses each heredoc body to one line (#873), so
+    // the 400-character cap is not spent on a commit message while the push after it is cut off.
+    const full = redactCommand(splitHeredocs(command).elided);
     if (!full)
         return [];
     const out = [];

package/dist/browser-runner/coding/engine-check.js

@@ -0,0 +1,114 @@
+import { spawnSync } from "node:child_process";
+import { accessSync, constants, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { delimiter, isAbsolute, join, resolve } from "node:path";
+import { handlerFor } from "./handlers.js";
+import { parseCommand } from "./headless.js";
+function defaultIsExecutable(p) {
+    try {
+        if (!statSync(p).isFile())
+            return false;
+        accessSync(p, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function defaultExists(p) {
+    try {
+        statSync(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function defaultKeychainItemStatus(service) {
+    // Existence only: without `-w`/`-g` the secret is never read, so this cannot prompt or leak.
+    const r = spawnSync("security", ["find-generic-password", "-s", service], { stdio: "ignore", timeout: 5_000 });
+    return r.error ? null : r.status;
+}
+/** The same resolution `spawn(bin)` does: a path is taken as-is, a bare name is searched on PATH. */
+export function resolveBinary(bin, deps = {}) {
+    const isExec = deps.isExecutable ?? defaultIsExecutable;
+    if (!bin)
+        return null;
+    if (bin.includes("/") || isAbsolute(bin)) {
+        const p = resolve(bin);
+        return isExec(p) ? p : null;
+    }
+    const env = deps.env ?? process.env;
+    const exts = (deps.platform ?? process.platform) === "win32" ? (env.PATHEXT || ".EXE;.CMD;.BAT").split(";") : [""];
+    for (const dir of (env.PATH || "").split(delimiter)) {
+        if (!dir)
+            continue;
+        for (const ext of exts) {
+            const p = join(dir, bin + ext);
+            if (isExec(p))
+                return p;
+        }
+    }
+    return null;
+}
+/** Does this engine have a stored interactive login on the machine? */
+export function detectEngineLogin(engine, deps = {}) {
+    const env = deps.env ?? process.env;
+    const home = deps.home ?? homedir();
+    const exists = deps.exists ?? defaultExists;
+    const platform = deps.platform ?? process.platform;
+    if (engine === "codex") {
+        // `codex login` (ChatGPT subscription) writes auth.json under CODEX_HOME, default ~/.codex.
+        const dir = env.CODEX_HOME?.trim() || join(home, ".codex");
+        const file = join(dir, "auth.json");
+        return { login: exists(file) ? "found" : "missing", where: file };
+    }
+    if (engine === "claude") {
+        // An exported subscription token is a login the engine can read in `machine` mode.
+        if (env.CLAUDE_CODE_OAUTH_TOKEN?.trim())
+            return { login: "found", where: "CLAUDE_CODE_OAUTH_TOKEN" };
+        const dir = env.CLAUDE_CONFIG_DIR?.trim() || join(home, ".claude");
+        const file = join(dir, ".credentials.json");
+        if (exists(file))
+            return { login: "found", where: file };
+        if (platform === "darwin") {
+            // Claude Code keeps its macOS login in the keychain. 0 = the item exists, 44 = it does
+            // not; anything else (a locked keychain, no `security`) is not an answer.
+            const status = (deps.keychainItemStatus ?? defaultKeychainItemStatus)("Claude Code-credentials");
+            if (status === 0)
+                return { login: "found", where: "keychain" };
+            if (status === 44)
+                return { login: "missing", where: `keychain / ${file}` };
+            return { login: "unknown" };
+        }
+        return { login: "missing", where: file };
+    }
+    if (engine === "gemini") {
+        // Google sign-in lands here; Gemini also accepts other auth (gcloud, Vertex), so absence is
+        // not proof of "signed out".
+        const file = join(home, ".gemini", "oauth_creds.json");
+        return exists(file) ? { login: "found", where: file } : { login: "unknown" };
+    }
+    return { login: "unknown" };
+}
+/**
+ * The whole answer. `credentialInjected` is the cloud saying it will hand this spawn a credential
+ * of its own (a platform-stored subscription token), in which case the machine's login is not what
+ * the engine reads and is not checked.
+ */
+export function checkEngine(input, deps = {}) {
+    const engine = (["claude", "gemini", "codex", "grok", "generic"].includes(input.clientType ?? "") ? input.clientType : "claude");
+    const parsed = parseCommand(input.command);
+    const bin = parsed.bin || parseCommand(handlerFor(engine).cliCommand).bin || engine;
+    const binaryPath = resolveBinary(bin, deps);
+    const login = input.credentialInjected ? { login: "found", where: "platform" } : detectEngineLogin(engine, deps);
+    return {
+        checked: true,
+        engine,
+        bin,
+        binaryFound: binaryPath !== null,
+        ...(binaryPath ? { binaryPath } : {}),
+        login: login.login,
+        ...(login.where ? { loginWhere: login.where } : {}),
+    };
+}

package/dist/browser-runner/coding/headless.js

@@ -428,7 +428,26 @@ export class HeadlessSession {
             }
         });
     }
-    /** Send a user turn. `author` names who wrote it, because `role` cannot — see turn-author.ts (#505). */
+    /**
+     * Does the engine carry its own conversation into THIS turn (#693 slice 2)?
+     *
+     * The boundary ADR 0005 draws, stated where the runner applies it: the platform's record is the
+     * source of truth and the engine's own memory is an optimisation preferred when it is there. It is
+     * there for a PERSISTENT process (Claude's stream-json session, a persistent REPL), which holds
+     * every turn since it started, and for a structured Codex turn that will resume its explicit
+     * thread (#848). A one-shot raw process has nothing: each turn is a new process.
+     */
+    get holdsConversationThisTurn() {
+        return this.adapter.persistent || this.codexResumeThreadId !== null;
+    }
+    /**
+     * Send a user turn. `author` names who wrote it, because `role` cannot — see turn-author.ts (#505).
+     *
+     * `replay` is the cloud's per-turn composition of the platform's record (#693 slice 2). It is spent
+     * only when {@link holdsConversationThisTurn} is false, so an engine with its own memory is never
+     * handed a summary of the conversation it is already in; when spent it replaces the one-shot
+     * session-start brief, being the same record composed later.
+     */
     input(text, opts = {}) {
         // The Engine reads the preamble, the pane the short marker; the instruction stays evidence.
         const sent = authoredTurn(text, opts.author);
@@ -437,11 +456,14 @@ export class HeadlessSession {
         // Pilot re-read through `/coding/capture` and twelve thousand characters of reconstructed
         // history would evict the live output they are looking at — the same budget argument
         // `turn-author.ts` makes for its two-word marker.
-        const seed = this.pendingSeed;
+        const replay = this.holdsConversationThisTurn ? null : opts.replay?.trim() || null;
+        const seed = replay ?? this.pendingSeed;
         this.pendingSeed = null;
         if (!this.alive)
             this.start();
-        if (seed)
+        if (replay)
+            this.push("[pags] this engine keeps no memory between turns, so ProAgentStore's record of the conversation so far was delivered with this turn — a reconstruction, not the engine's own memory");
+        else if (seed)
             this.push("[pags] a context brief from ProAgentStore's record was delivered with this turn — a reconstruction, not the previous conversation");
         this.push(`\n❯ [${stamp()}] ${authorTag(opts.author)}${text}`); // ❯ — your turn, timestamped
         this.run = "thinking";

package/dist/browser-runner/coding/heredoc.js

@@ -0,0 +1,103 @@
+/**
+ * Separate a shell command's heredoc BODIES from the text that is executed (#873).
+ *
+ * The act record carries the whole command line, and a heredoc body is data: a commit message, an
+ * issue-comment body, a Python script editing a test file. Read as commands, their lines produced
+ * acts that never happened ("merged a pull request #3" from a string inside a Python heredoc) and
+ * repository targets nobody wrote to (#872, `mcp/apps` from a comment body).
+ *
+ * VENDORED: `workers/api/src/lib/heredoc.ts` is the original; this is a copy, because a Worker must not
+ * import the runner package. `workers/api/src/lib/heredoc.test.ts` runs the same cases through both.
+ *
+ * The rules, and the one place this is stricter than "strip from `<<` to the terminator":
+ *  - `<<WORD`, `<<'WORD'`, `<<"WORD"`, `<<\WORD` and `<<-WORD` open a heredoc. `<<<` is a
+ *    here-string, not a heredoc. Several operators on one line are read in order, as the shell does.
+ *  - An operator only counts outside quotes, except inside a `$( … )` substitution, which is how
+ *    `git commit -m "$(cat <<'EOF'` is written — a `<<` inside `"a << b"` is not one.
+ *  - The body is the lines AFTER the operator's line, up to a line that is exactly the delimiter
+ *    (leading tabs allowed for `<<-`). The terminator line is dropped too.
+ *  - The REST OF THE OPERATOR'S LINE is executed and kept: `git commit -F - <<'EOF' && git push`
+ *    pushes, and dropping it would hide a real act.
+ *  - No terminator — the stored command is cut at 400 characters — makes everything after the
+ *    operator's line body. A heredoc that never closed cannot have run anything after it that
+ *    this text shows.
+ */
+/** A delimiter, read at the position just after `<<`. */
+const DELIMITER = /(-?)[ \t]*(?:'([^'\n]*)'|"([^"\n]*)"|\\?([A-Za-z_][A-Za-z0-9_]*))/y;
+/** The heredoc operators on one executed line, in order, respecting quotes and `$( … )`. */
+function operatorsOn(line) {
+    const out = [];
+    // A stack of contexts: "sh" (unquoted, including inside `$( … )`), "dq" and "sq".
+    const stack = ["sh"];
+    for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        const top = stack[stack.length - 1];
+        if (top === "sq") {
+            if (ch === "'")
+                stack.pop();
+            continue;
+        }
+        if (ch === "\\") {
+            i++;
+            continue;
+        }
+        if (ch === "$" && line[i + 1] === "(") {
+            stack.push("sh");
+            i++;
+            continue;
+        }
+        if (top === "dq") {
+            if (ch === '"')
+                stack.pop();
+            continue;
+        }
+        if (ch === "'")
+            stack.push("sq");
+        else if (ch === '"')
+            stack.push("dq");
+        else if (ch === ")" && stack.length > 1)
+            stack.pop();
+        else if (ch === "#" && (i === 0 || /\s/.test(line[i - 1])))
+            break;
+        else if (ch === "<" && line[i + 1] === "<" && line[i + 2] !== "<" && line[i - 1] !== "<") {
+            DELIMITER.lastIndex = i + 2;
+            const m = DELIMITER.exec(line);
+            const word = m ? (m[2] ?? m[3] ?? m[4]) : undefined;
+            if (m && word) {
+                out.push({ word, dash: m[1] === "-" });
+                i = DELIMITER.lastIndex - 1;
+            }
+        }
+    }
+    return out;
+}
+export function splitHeredocs(command) {
+    const executed = [];
+    const bodies = [];
+    const elided = [];
+    const pending = [];
+    let bodyLines = 0;
+    const marker = () => `[heredoc body: ${bodyLines} line${bodyLines === 1 ? "" : "s"}]`;
+    for (const raw of String(command ?? "").split("\n")) {
+        const line = raw.replace(/\r$/, "");
+        if (pending.length) {
+            const { word, dash } = pending[0];
+            if ((dash ? line.replace(/^\t+/, "") : line) === word) {
+                pending.shift();
+                elided.push(marker(), raw);
+                bodyLines = 0;
+            }
+            else {
+                bodies.push(raw);
+                bodyLines++;
+            }
+            continue;
+        }
+        executed.push(raw);
+        elided.push(raw);
+        pending.push(...operatorsOn(line));
+    }
+    if (pending.length)
+        elided.push(marker());
+    return { executed: executed.join("\n"), bodies: bodies.join("\n"), unterminated: pending.length > 0, elided: elided.join("\n") };
+}

package/dist/browser-runner/coding/runtime.js

@@ -216,7 +216,7 @@ export class CodingRuntime {
             case "message":
                 // Narrowed rather than trusted: this runner is a published package any caller can
                 // POST to, and an unrecognised author must read as "unstated", not become a label.
-                session.input(action.text, { author: asTurnAuthor(action.author) });
+                session.input(action.text, { author: asTurnAuthor(action.author), replay: typeof action.replay === "string" ? action.replay : undefined });
                 break;
             case "keys": {
                 // A snapshot is no longer the whole answer (#448). `key()` records the attempt and

package/dist/browser-runner/server.js

@@ -2,6 +2,7 @@ import { createServer, } from "node:http";
 import { URL } from "node:url";
 import { LocalRunner, RunnerInputError } from "./runner.js";
 import { probeGitSshIdentity } from "./coding/repo.js";
+import { checkEngine } from "./coding/engine-check.js";
 import { listGithubOrgs, listGithubRepos, searchGithubRepos, getGithubRepoDetail, getGithubCredentialScope } from "./coding/github-browse.js";
 export function createRunnerServer(runner) {
     return createServer(async (req, res) => {
@@ -383,6 +384,18 @@ async function route(runner, req, res) {
             return json(res, 400, { error: e instanceof Error ? e.message : String(e) });
         }
     }
+    // Can this machine run an engine — its binary on PATH, its subscription login stored (#879)? Asked
+    // BEFORE a session is launched, so a missing engine is a named refusal rather than a dead pane.
+    // An older runner 404s this, and the cloud reads that as "unverified", never as "missing".
+    if (req.method === "POST" && path === "/coding/engine-check") {
+        const b = await readJson(req);
+        try {
+            return json(res, 200, checkEngine(b));
+        }
+        catch (e) {
+            return json(res, 400, { error: e instanceof Error ? e.message : String(e) });
+        }
+    }
     // Background cold-start clones (#858): start (or join) one, and read it back. An older runner 404s
     // both, and the cloud falls back to the synchronous `/coding/clone` below.
     if (req.method === "POST" && (path === "/coding/clone-start" || path === "/coding/clone-status")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.65",
+  "version": "0.4.67",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",