@proagentstore/cli 0.4.67 → 0.4.69

package/dist/browser-runner/coding/engine-adapter.js

@@ -156,9 +156,23 @@ function parseCodexLine(line) {
     if (type === "thread.started" && typeof ev.thread_id === "string" && ev.thread_id)
         return [{ kind: "session", sessionId: ev.thread_id }];
     if (type === "turn.completed" || type === "turn.failed") {
-        const result = typeof ev.error === "string" ? ev.error : typeof ev.message === "string" ? ev.message : type === "turn.failed" ? "failed" : "";
+        // Codex sends `error` as an OBJECT — `{"type":"turn.failed","error":{"message":"…401…"}}` — and
+        // reading only the string form reduced a 401 to the word "failed" (#889).
+        const result = typeof ev.error === "string"
+            ? ev.error
+            : typeof record(ev.error)?.message === "string"
+                ? record(ev.error)?.message
+                : typeof ev.message === "string"
+                    ? ev.message
+                    : type === "turn.failed"
+                        ? "failed"
+                        : "";
         return [{ kind: "turn_end", raw: ev, isError: type === "turn.failed", result }];
     }
+    if (type === "error") {
+        const text = typeof ev.message === "string" ? ev.message : typeof record(ev.error)?.message === "string" ? record(ev.error)?.message : "";
+        return text.trim() ? [{ kind: "engine_error", text: text.trim() }] : [];
+    }
     if (!item)
         return [];
     const itemType = typeof item.type === "string" ? item.type : "";

package/dist/browser-runner/coding/engine-turn.js

@@ -19,6 +19,28 @@
  */
 /** Longest engine line carried as {@link EngineTurnReport.detail}. The pane holds the rest. */
 export const MAX_TURN_DETAIL = 240;
+/**
+ * How much of a turn's own output rides on its report as {@link EngineTurnReport.tail} (#889).
+ *
+ * The last LINES, because the actionable part of a failure is at the end — Codex retried a 401 five
+ * times and then said so in `turn.failed`. Bounded three ways (lines, per-line, total) because the
+ * report is re-sent on every snapshot and a runaway line must not grow it.
+ */
+export const MAX_TURN_TAIL_LINES = 60;
+export const MAX_TURN_TAIL_LINE = 400;
+export const MAX_TURN_TAIL_CHARS = 8000;
+/** Append one line of the turn's own output to its tail, keeping the newest within the bounds above. */
+export function appendTurnTail(tail, line) {
+    const text = line.trim();
+    if (!text)
+        return;
+    tail.push(text.length > MAX_TURN_TAIL_LINE ? `${text.slice(0, MAX_TURN_TAIL_LINE)}…` : text);
+    while (tail.length > MAX_TURN_TAIL_LINES)
+        tail.shift();
+    let total = tail.reduce((n, l) => n + l.length + 1, 0);
+    while (total > MAX_TURN_TAIL_CHARS && tail.length > 1)
+        total -= tail.shift().length + 1;
+}
 /**
  * A one-shot turn's process has exited — say what that means, and nothing more.
  *
@@ -26,14 +48,16 @@ export const MAX_TURN_DETAIL = 240;
  * 15-minute wedge ceiling and `interrupt()` both land here, and counting either as an engine
  * failure would let three slow builds read as a broken CLI.
  */
-export function turnReportFromExit(code, signal, lastLine = "", now = Date.now()) {
-    const detail = lastLine.trim().slice(0, MAX_TURN_DETAIL);
+export function turnReportFromExit(code, signal, lastLine = "", now = Date.now(), tail = []) {
+    const detail = (lastLine.trim() || tail.at(-1) || "").slice(0, MAX_TURN_DETAIL);
+    const verdict = signal !== null ? "killed" : code === 0 ? "ok" : "failed";
     return {
-        verdict: signal !== null ? "killed" : code === 0 ? "ok" : "failed",
+        verdict,
         exitCode: code,
         signal,
         at: now,
         ...(detail ? { detail } : {}),
+        ...(verdict === "failed" ? { tail: [...tail] } : {}),
     };
 }
 /**
@@ -43,7 +67,7 @@ export function turnReportFromExit(code, signal, lastLine = "", now = Date.now()
  * the shape of gap that makes a platform-wide claim ("we notice a failed turn") false in the one
  * case that runs most.
  */
-export function turnReportFromResult(isError, detail = "", now = Date.now()) {
+export function turnReportFromResult(isError, detail = "", now = Date.now(), tail = []) {
     const text = detail.trim().slice(0, MAX_TURN_DETAIL);
     return {
         verdict: isError ? "failed" : "ok",
@@ -51,5 +75,6 @@ export function turnReportFromResult(isError, detail = "", now = Date.now()) {
         signal: null,
         at: now,
         ...(text ? { detail: text } : {}),
+        ...(isError ? { tail: [...tail] } : {}),
     };
 }

package/dist/browser-runner/coding/headless.js

@@ -1,7 +1,7 @@
 import { spawn } from "node:child_process";
 import { classifyCommand, commandFromToolInput, fillTargetFromResult, toolCallOk, toolResultMark } from "./engine-acts.js";
 import { parseEngineUsage } from "./engine-usage.js";
-import { turnReportFromExit, turnReportFromResult } from "./engine-turn.js";
+import { appendTurnTail, turnReportFromExit, turnReportFromResult } from "./engine-turn.js";
 import { renderToolResult, shortInput, stripAnsi } from "./transcript-lines.js";
 import { authoredTurn, authorTag } from "./turn-author.js";
 import { engineSpawnEnv, mergeEnv } from "./engine-env.js";
@@ -98,6 +98,8 @@ export class HeadlessSession {
      * carry a previous turn's line.
      */
     turnLastLine = "";
+    /** This turn's own output, newest last and bounded — reported on a failed turn (#889). */
+    turnTail = [];
     /** True once this session has retried an old Codex CLI without its unsupported `--json` flag. */
     fellBackToRaw = false;
     /** Structured events observed in the current one-shot process. */
@@ -408,8 +410,11 @@ export class HeadlessSession {
             this.lastOutputAt = Date.now();
             this.sawOutputSinceInput = true;
             const text = d.toString("utf8").trim();
-            if (text)
+            if (text) {
                 this.push(`[${this.binName}] ${stripAnsi(text)}`);
+                for (const l of stripAnsi(text).split("\n"))
+                    appendTurnTail(this.turnTail, l);
+            }
         });
         proc.on("exit", (code) => {
             // A stop() + re-start() on the SAME session object can leave this old process's
@@ -471,6 +476,7 @@ export class HeadlessSession {
         this.lastOutputAt = now;
         this.turnStartedAt = now;
         this.sawOutputSinceInput = false; // arm the persistent-raw idle heuristic for THIS turn
+        this.turnTail = []; // a one-shot turn re-arms it at its spawn too (a --json fallback re-runs the turn)
         try {
             // Brief first, instruction second, and never the other way round: it is background for
             // the request, and an engine that reads the request last acts on the request.
@@ -510,6 +516,7 @@ export class HeadlessSession {
         // Arm the per-turn line capture BEFORE the spawn, so a report can only ever carry a line
         // this turn produced (#545).
         this.turnLastLine = "";
+        this.turnTail = [];
         this.sawStructuredEvent = false;
         this.structuredOutputRejected = false;
         const resumedCodexThreadId = this.codexResumeThreadId;
@@ -546,6 +553,7 @@ export class HeadlessSession {
             if (this.proc !== proc)
                 return; // stale: a newer turn owns the session now
             this.push(`[${this.config.clientType}] failed to start: ${err.message}`);
+            appendTurnTail(this.turnTail, `failed to start: ${err.message}`);
             this.run = "idle";
             this.proc = null;
             // The command itself is unrunnable — report the session dead so the loop stops with a
@@ -610,7 +618,7 @@ export class HeadlessSession {
             //
             // A signal means WE ended it (the wedge ceiling, an interrupt), which is the `killed`
             // verdict: evidence about this platform's timers, not about the engine's health.
-            this.turnReport = turnReportFromExit(code, signal, this.turnLastLine);
+            this.turnReport = turnReportFromExit(code, signal, this.turnLastLine, Date.now(), this.turnTail);
             this.run = "idle";
             this.proc = null;
         });
@@ -664,8 +672,11 @@ export class HeadlessSession {
             if (this.mode === "stream-json") {
                 if (this.handle(line))
                     this.sawStructuredEvent = true;
-                else if (this.adapter.rejectsStructuredOutput?.(line))
-                    this.structuredOutputRejected = true;
+                else {
+                    if (this.adapter.rejectsStructuredOutput?.(line))
+                        this.structuredOutputRejected = true;
+                    this.pushUnframed(line);
+                }
             }
             else
                 this.pushRaw(line); // raw engine — the line IS the terminal output
@@ -687,11 +698,34 @@ export class HeadlessSession {
     get codexResumeThreadId() {
         return this.config.clientType === "codex" && this.mode === "stream-json" && isCodexThreadId(this.codexThreadId) ? this.codexThreadId : null;
     }
+    /**
+     * A line a STRUCTURED engine printed outside its protocol — not JSON at all (#889).
+     *
+     * A one-shot turn's stderr shares this stream, and it is where the diagnosis lives: Codex logged
+     * `ERROR codex_api…: 401 Unauthorized` there on every retry. It was dropped, which is how a turn
+     * that failed for a stated reason reached the pane and the report as no output at all. JSON this
+     * build does not recognise is still skipped — that is protocol noise, not the engine talking.
+     */
+    pushUnframed(line) {
+        try {
+            JSON.parse(line);
+            return;
+        }
+        catch {
+            /* not JSON — the engine's own words */
+        }
+        const clean = stripAnsi(line).trim();
+        if (!clean)
+            return;
+        this.push(`[${this.binName}] ${clean}`);
+        appendTurnTail(this.turnTail, clean);
+    }
     /** Raw-engine stdout: strip ANSI control codes and append to the transcript. */
     pushRaw(line) {
         const clean = stripAnsi(line);
         if (clean.trim()) {
             this.push(clean);
+            appendTurnTail(this.turnTail, clean);
             // The engine's own words, kept for the turn's report (#545) — captured on the way in,
             // never scraped back out of the rendered pane.
             this.turnLastLine = clean.trim();
@@ -734,15 +768,21 @@ export class HeadlessSession {
                     this.settleAct(ev.block);
                     break;
                 }
+                case "engine_error":
+                    this.push(`[${this.binName}] error: ${ev.text}`);
+                    appendTurnTail(this.turnTail, `error: ${ev.text}`);
+                    break;
                 case "turn_end": {
                     const failure = ev.isError ? ev.result : "";
-                    if (failure)
+                    if (failure) {
                         this.push(`[error] ${failure}`);
+                        appendTurnTail(this.turnTail, `[error] ${failure}`);
+                    }
                     // The structured path's ANALOGUE of a non-zero exit (#545). Claude has no process
                     // per turn, so `exitCode` is honestly null and the verdict comes from the protocol's
                     // own `is_error` — the same claim, in the words the engine states it in. Without
                     // this the field would exist for three engines and silently not for the flagship.
-                    this.turnReport = turnReportFromResult(ev.isError, failure);
+                    this.turnReport = turnReportFromResult(ev.isError, failure, Date.now(), this.turnTail);
                     // The same event that ends the turn also reports what the turn COST (#267). It was
                     // parsed and thrown away, which is why Engine spend was absent from the ledger.
                     // An errored turn still burned tokens, so this is recorded regardless of is_error.

package/dist/browser-runner/coding/secret-file.js

@@ -0,0 +1,103 @@
+import { closeSync, constants, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { RunnerInputError } from "../errors.js";
+/**
+ * The runner's half of the machine-to-machine secret handoff (#918): read a secret file so the
+ * cloud can encrypt it, and write one back from the cloud's decrypted copy.
+ *
+ * The value crosses the relay between the API worker and this process and goes nowhere else. Both
+ * functions are built so it cannot leak by accident:
+ *
+ *   • no shell, no tmux, no subprocess — a pane or a process table is exactly where a secret is
+ *     visible to everything that later reads the machine (`tmux_capture_pane`, `ps`);
+ *   • every error names the PATH and never the bytes, because a runner error becomes the cloud's
+ *     error string, and that string reaches the model;
+ *   • `readSecretFile` returns the value to its caller (the relay) and `writeSecretFile` returns
+ *     only a byte count.
+ */
+/** Big enough for any `.env`, key file or credentials JSON; small enough that this is not a file-transfer tool. */
+export const SECRET_MAX_BYTES = 64 * 1024;
+/** `~` expanded; a relative path resolves against the home directory, which is where `pags up` users name things from. */
+function resolvePath(raw) {
+    const p = String(raw ?? "").trim();
+    if (!p)
+        throw new RunnerInputError("A `path` is required.");
+    const expanded = p.replace(/^~(?=$|\/)/, homedir());
+    return isAbsolute(expanded) ? resolve(expanded) : resolve(homedir(), expanded);
+}
+export function readSecretFile(input) {
+    const path = resolvePath(input.path);
+    let st;
+    try {
+        st = statSync(path);
+    }
+    catch {
+        throw new RunnerInputError(`No file at ${path}.`);
+    }
+    if (!st.isFile())
+        throw new RunnerInputError(`${path} is not a regular file.`);
+    if (st.size === 0)
+        throw new RunnerInputError(`${path} is empty — there is nothing to hand off.`);
+    if (st.size > SECRET_MAX_BYTES)
+        throw new RunnerInputError(`${path} is ${st.size} bytes; the secret handoff carries at most ${SECRET_MAX_BYTES}.`);
+    const buf = readFileSync(path);
+    const value = buf.toString("utf8");
+    // The store holds text. A file that does not survive a UTF-8 round trip would arrive changed,
+    // which for a key file is worse than refusing.
+    if (!Buffer.from(value, "utf8").equals(buf))
+        throw new RunnerInputError(`${path} is not UTF-8 text; the secret handoff carries text files only.`);
+    return { path, value, bytes: buf.length };
+}
+/** `"600"` / `"0600"` / `"640"` → a file mode, owner-readable at least, never group/world-writable or executable. */
+function parseMode(raw) {
+    if (raw == null || raw === "")
+        return 0o600;
+    const s = String(raw).trim();
+    if (!/^0?[0-7]{3}$/.test(s))
+        throw new RunnerInputError(`mode must be octal like "600", got "${s}".`);
+    const mode = Number.parseInt(s, 8);
+    if ((mode & 0o400) === 0)
+        throw new RunnerInputError(`mode ${s} would make the file unreadable by its owner.`);
+    if ((mode & 0o022) !== 0 || (mode & 0o111) !== 0)
+        throw new RunnerInputError(`mode ${s} is group/world-writable or executable; a secret file must not be.`);
+    return mode;
+}
+export function writeSecretFile(input) {
+    const path = resolvePath(input.path);
+    if (typeof input.value !== "string" || !input.value)
+        throw new RunnerInputError("Nothing to write.");
+    const mode = parseMode(input.mode);
+    let replaced = false;
+    try {
+        const st = lstatSync(path);
+        if (!st.isFile())
+            throw new RunnerInputError(`${path} exists and is not a regular file.`);
+        if (input.overwrite !== true)
+            throw new RunnerInputError(`${path} already exists. Pass overwrite: true to replace it.`);
+        replaced = true;
+    }
+    catch (e) {
+        if (e instanceof RunnerInputError)
+            throw e;
+        // Not there yet: the normal case.
+    }
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    // Written beside the target and renamed over it, so a reader never sees half a secret, and
+    // created with the final mode so it is never briefly world-readable.
+    const tmp = join(dirname(path), `.${basename(path)}.pags-${process.pid}-${Date.now()}.tmp`);
+    const data = Buffer.from(input.value, "utf8");
+    const fd = openSync(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, mode);
+    try {
+        writeSync(fd, data);
+        fsyncSync(fd);
+    }
+    catch (e) {
+        closeSync(fd);
+        rmSync(tmp, { force: true });
+        throw new Error(`Could not write ${path}: ${e.code ?? "write failed"}.`);
+    }
+    closeSync(fd);
+    renameSync(tmp, path);
+    return { path, bytes: data.length, replaced };
+}

package/dist/browser-runner/server.js

@@ -541,6 +541,18 @@ async function route(runner, req, res) {
         }
         return json(res, 200, { session, created: true, workDir });
     }
+    // ── secret handoff (#918) ──────────────────────────────────────────────
+    // Machine-to-machine secret transfer for `tmux_secure_put` / `tmux_secure_get`. The value moves
+    // only between this process and the cloud's encrypted store — never through a pane, a shell or
+    // a subprocess. See coding/secret-file.ts.
+    if (req.method === "POST" && path === "/secure/read") {
+        const { readSecretFile } = await import("./coding/secret-file.js");
+        return json(res, 200, readSecretFile(await readJson(req)));
+    }
+    if (req.method === "POST" && path === "/secure/write") {
+        const { writeSecretFile } = await import("./coding/secret-file.js");
+        return json(res, 200, writeSecretFile(await readJson(req)));
+    }
     // ── generic terminal connector ──────────────────────────────────────────
     // One local-terminal vocabulary over backend-specific adapters. tmux is fully
     // controllable; kitty needs remote control enabled; iTerm2 needs macOS Automation access.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.67",
+  "version": "0.4.69",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",