@proagentstore/cli 0.4.72 → 0.4.74

package/dist/browser-runner/local-browser/bridge.js

@@ -1,6 +1,8 @@
 import { LOCAL_BROWSER_SOURCE_FAILURE_REASONS, redactDetail } from "./contract.js";
 /** The browser tools a research run may use. Everything else from the browser is not even listed. */
 const READ_TOOLS = new Set(["browser_navigate", "browser_navigate_back", "browser_snapshot", "browser_wait_for", "browser_click"]);
+/** The research tools the bridge adds; the CLI records its results through these. */
+const RESEARCH_TOOL_NAMES = ["record_finding", "report_source_failure", "finish_research"];
 /** Refused BY NAME with the reason, so a CLI that guesses one is told why rather than "unknown tool". */
 const WRITE_TOOLS = new Set([
     "browser_type",
@@ -18,6 +20,11 @@ const WRITE_TOOLS = new Set([
 /** Roles a click may target in research mode: moving between pages, never acting on one. */
 const CLICKABLE_ROLES = new Set(["link", "tab", "menuitem", "treeitem", "option"]);
 const PAGINATION_NAME = /^(next|previous|prev|more|load more|show more|see more|view more|older|newer|page \d+|\d+|›|»|‹|«)( page| results| jobs)?$/i;
+/**
+ * Every tool name the bridge can ever list (#952) — the exact set a CLI may be told to trust
+ * without asking. Write tools are not in it, so trusting this set cannot trust a write.
+ */
+export const BRIDGE_TOOL_NAMES = [...READ_TOOLS, ...RESEARCH_TOOL_NAMES];
 const RESEARCH_TOOLS = [
     {
         name: "record_finding",
@@ -157,22 +164,35 @@ export class BrowserBridge {
         const last = [...this.visited].pop();
         return last ? { domain: last } : {};
     }
-    refuse(tool, reason) {
-        this.host.emit({ type: "policy.decision", detail: { tool, decision: "refused", reason } });
+    /** Refuse, on the trace — naming the site and the owner's decision behind it when there is one. */
+    refuse(tool, reason, host) {
+        const consentId = host ? this.host.consentIdFor(host) : undefined;
+        this.host.emit({ type: "policy.decision", ...(host ? { domain: host } : {}), ...(consentId ? { consentId } : {}), detail: { tool, decision: "refused", reason } });
         return text(reason, true);
     }
+    /** Hosts already admitted on this run — a site is recorded as allowed once, not on every page. */
+    admitted = new Set();
+    allowed(host, basis) {
+        if (this.admitted.has(host))
+            return;
+        this.admitted.add(host);
+        const consentId = basis === "consent" ? this.host.consentIdFor(host) : undefined;
+        this.host.emit({ type: "policy.decision", domain: host, ...(consentId ? { consentId } : {}), detail: { decision: "allowed", basis } });
+    }
     /** May the run be on this host — asking the owner, and waiting, when it is a new one. */
     async admit(host, url) {
         if (this.host.isDenied(host))
             return `${host} is on this run's deny list.`;
-        if (this.host.isPermitted(host))
+        if (this.host.isPermitted(host)) {
+            this.allowed(host, this.host.consentIdFor(host) ? "consent" : "allow_list");
             return null;
+        }
         if (this.host.allowListOnly())
             return `${host} is not on this run's list of allowed sites.`;
         this.host.emit({ type: "consent.requested", url, domain: host, detail: { scope: "navigate" } });
         const outcome = await this.host.pause("consent_required", { domain: host });
         if (outcome === "resumed" && this.host.isPermitted(host) && !this.host.isDenied(host)) {
-            this.host.emit({ type: "policy.decision", domain: host, detail: { decision: "consented" } });
+            this.allowed(host, "consent");
             return null;
         }
         return `The owner did not allow ${host}. Skip it and record it with report_source_failure (access_denied).`;
@@ -185,7 +205,7 @@ export class BrowserBridge {
             return this.refuse("browser_navigate", `The run's limit of ${this.host.limits.maxPages} pages is reached. Call finish_research now.`);
         const refusal = await this.admit(host, url);
         if (refusal)
-            return this.refuse("browser_navigate", refusal);
+            return this.refuse("browser_navigate", refusal, host);
         const res = await this.browser.callTool("browser_navigate", { url });
         if (res.isError)
             return { content: [{ type: "text", text: textOf(res) }], isError: true };

package/dist/browser-runner/local-browser/contract.js

@@ -47,16 +47,54 @@ export const LOCAL_BROWSER_EVENT_TYPES = [
     "run.resumed",
     "note",
 ];
-export const LOCAL_BROWSER_PLATFORM_EVENT_TYPES = ["run.requested", "runner.dispatched", "run.ended"];
+export const LOCAL_BROWSER_PLATFORM_EVENT_TYPES = ["run.requested", "runner.dispatched", "run.ended", "review.decision"];
 export const LOCAL_BROWSER_ENGINE_AUTHS = ["subscription", "machine-login", "api-key", "missing_login", "unknown"];
 export const LOCAL_BROWSER_SOURCE_FAILURE_REASONS = ["login_required", "captcha", "paywall", "access_denied", "robots", "timeout", "error"];
 export const LOCAL_BROWSER_CAPS = { findings: 200, sourceFailures: 200, text: 4000, fieldCount: 40 };
 const SENSITIVE_KEY = /cookie|password|passwd|secret|token|authorization|api[_-]?key|otp|form[_-]?values?|credential/i;
+/** An env var NAME whose value is a credential. */
+const SECRET_ENV_NAME = /KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|COOKIE|SESSION|AUTH/i;
+/** Credential-shaped text, wherever it appears — the patterns a CLI or a page tends to print. */
+const SECRET_PATTERNS = [
+    // NAME=value for a credential-named variable: keep the name, drop the value.
+    [/\b([A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL)[A-Z0-9_]*)\s*[=:]\s*["']?[^\s"']+["']?/g, "$1=[REDACTED]"],
+    [/\b(Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{10,}/gi, "$1 [REDACTED]"],
+    [/\bsk-[A-Za-z0-9_-]{20,}/g, "[REDACTED]"],
+    [/\b(?:ghp|gho|ghs|ghu|github_pat|xox[abpr])_[A-Za-z0-9_]{20,}/g, "[REDACTED]"],
+    [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, "[REDACTED]"],
+    // Base64-ish runs over 40 characters: keys, tokens, session blobs.
+    [/[A-Za-z0-9+/_-]{41,}={0,2}/g, "[REDACTED]"],
+];
+/**
+ * The values of credential-named variables in an environment, longest first — what `redactText`
+ * must never let through even when the value has no recognisable shape.
+ */
+export function secretEnvValues(env) {
+    return Object.entries(env)
+        .filter(([k, v]) => SECRET_ENV_NAME.test(k) && typeof v === "string" && v.trim().length >= 8)
+        .map(([, v]) => v.trim())
+        .sort((a, b) => b.length - a.length);
+}
+/**
+ * Remove credentials from free text before it is stored (#947): first every known secret value,
+ * verbatim, then anything credential-shaped. Used on CLI output that becomes an error, on result
+ * text, and on every string in a trace detail.
+ */
+export function redactText(text, secrets = []) {
+    let out = text;
+    for (const s of secrets)
+        if (s.length >= 8)
+            out = out.split(s).join("[REDACTED]");
+    for (const [re, sub] of SECRET_PATTERNS)
+        out = out.replace(re, sub);
+    return out;
+}
 /**
- * Drop sensitive keys and bound sizes. A trace is for a supervisor to read, so nothing in it may
- * carry a cookie, a password, a form value or a key — whatever the runner sent.
+ * Drop sensitive keys, redact credential-shaped values and bound sizes. A trace is for a supervisor
+ * to read, so nothing in it may carry a cookie, a password, a form value or a key — whatever the
+ * runner sent.
  */
-export function redactDetail(detail, depth = 0) {
+export function redactDetail(detail, depth = 0, secrets = []) {
     if (!detail || typeof detail !== "object" || Array.isArray(detail) || depth > 3)
         return undefined;
     const out = {};
@@ -64,13 +102,13 @@ export function redactDetail(detail, depth = 0) {
         if (SENSITIVE_KEY.test(k))
             continue;
         if (typeof v === "string")
-            out[k] = v.slice(0, 1000);
+            out[k] = redactText(v.slice(0, 1000), secrets);
         else if (typeof v === "number" || typeof v === "boolean" || v === null)
             out[k] = v;
         else if (Array.isArray(v))
-            out[k] = v.slice(0, 20).map((x) => (typeof x === "string" ? x.slice(0, 300) : typeof x === "number" || typeof x === "boolean" ? x : null));
+            out[k] = v.slice(0, 20).map((x) => (typeof x === "string" ? redactText(x.slice(0, 300), secrets) : typeof x === "number" || typeof x === "boolean" ? x : null));
         else if (typeof v === "object") {
-            const nested = redactDetail(v, depth + 1);
+            const nested = redactDetail(v, depth + 1, secrets);
             if (nested)
                 out[k] = nested;
         }
@@ -167,8 +205,10 @@ export function parseLocalBrowserResult(raw) {
         const detail = str(r.detail, 1000);
         sourceFailures.push(detail ? { url, reason, detail } : { url, reason });
     }
-    const out = { runId, outcome, findings, sourceFailures, summary: str(o.summary, LOCAL_BROWSER_CAPS.text) ?? "", traceId, engineAuth };
-    const error = str(o.error, 1000);
+    const out = { runId, outcome, findings, sourceFailures, summary: redactText(str(o.summary, LOCAL_BROWSER_CAPS.text) ?? ""), traceId, engineAuth };
+    // Redacted again here, whatever the runner did: an error is CLI output, and CLIs print keys.
+    const rawError = str(o.error, 1000);
+    const error = rawError === null ? null : redactText(rawError);
     if (outcome === "failed")
         out.error = error ?? "The run failed without a reason.";
     return { result: out };

package/dist/browser-runner/local-browser/engine.js

@@ -12,6 +12,13 @@
  *  - Codex: `--sandbox read-only` (its shell cannot write, and per Codex's sandbox design has no
  *    network), `--ignore-user-config` (no MCP servers or providers from the user's own config — auth
  *    still comes from the login), web search switched off, and the bridge as its only MCP server.
+ *    `codex exec` runs with approval policy `never`, so an MCP tool that needs approval is simply
+ *    refused — a live run on 2026-10-07 opened no page for exactly that reason (#952). The bridge is
+ *    therefore pre-approved, and ONLY it: `default_tools_approval_mode="approve"` on the
+ *    `pags_browser` server, and `enabled_tools` pinned to the bridge's own tool names
+ *    (`BRIDGE_TOOL_NAMES`). Nothing else is approved — the shell stays read-only with no network,
+ *    there is no other server — and the bridge still enforces sites, consent, limits and the
+ *    research-only tool set in the runner, whatever the CLI is allowed to call.
  *    NOT VERIFIED END TO END on a live machine: that read-only shell commands get no network, and
  *    which of the two web-search keys a given Codex version honours. #947 holds that test.
  *
@@ -21,6 +28,7 @@
  * turns a subscription run into per-token billing.
  */
 import { mergeEnv } from "../coding/engine-env.js";
+import { BRIDGE_TOOL_NAMES } from "./bridge.js";
 import { resolveEngineAuth } from "../coding/engine-auth.js";
 /** The bridge's MCP server name — and so the prefix of its tools inside the CLI. */
 export const BRIDGE_SERVER_NAME = "pags_browser";
@@ -89,6 +97,11 @@ export function buildEngineSpec(input) {
             `${key}.env=${envTable}`,
             "-c",
             `${key}.tool_timeout_sec=${Math.ceil(input.toolTimeoutMs / 1000)}`,
+            // Pre-approve the bridge, and only its own tools (#952); see the note atop this file.
+            "-c",
+            `${key}.default_tools_approval_mode="approve"`,
+            "-c",
+            `${key}.enabled_tools=[${BRIDGE_TOOL_NAMES.map(toml).join(", ")}]`,
             // Two spellings across Codex versions; an unknown key is ignored, so both are set.
             "-c",
             'web_search="disabled"',

package/dist/browser-runner/local-browser/runtime.js

@@ -26,7 +26,7 @@ import { fileURLToPath } from "node:url";
 import { RunnerInputError } from "../errors.js";
 import { BrowserBridge, domainWithin } from "./bridge.js";
 import { BRIDGE_ENV } from "./bridge-stdio.js";
-import { LOCAL_BROWSER_AUTH_MODES, LOCAL_BROWSER_ENGINES, LOCAL_BROWSER_TASK_TYPE, redactDetail, } from "./contract.js";
+import { LOCAL_BROWSER_AUTH_MODES, LOCAL_BROWSER_ENGINES, LOCAL_BROWSER_TASK_TYPE, redactDetail, redactText, secretEnvValues, } from "./contract.js";
 import { buildEngineSpec, finalText, missingLogin, observedEngineAuth, researchPrompt, signInHelp } from "./engine.js";
 const MAX_EVENTS = 2000;
 const OUTPUT_LINES = 400;
@@ -76,11 +76,28 @@ export function parseEnvelope(raw) {
         authMode: o.authMode,
         workspace: ws.kind === "path" ? { kind: "path", path: ws.path } : { kind: "scratch" },
         browserProfile: o.browserProfile,
-        policy: { mode: "research_only", allowDomains: strList(p.allowDomains), denyDomains: strList(p.denyDomains), consentedDomains: strList(p.consentedDomains), profileConsented: p.profileConsented === true },
+        policy: {
+            mode: "research_only",
+            allowDomains: strList(p.allowDomains),
+            denyDomains: strList(p.denyDomains),
+            consentedDomains: strList(p.consentedDomains),
+            profileConsented: p.profileConsented === true,
+            consentIds: consentIdMap(p.consentIds),
+        },
         limits,
         resultSchema: { id: typeof schema.id === "string" ? schema.id : "findings", version: typeof schema.version === "number" ? schema.version : 1 },
     };
 }
+/** Decision ids keyed by lowercase domain (or `*`), from an untrusted object. */
+function consentIdMap(raw) {
+    const out = {};
+    if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+        for (const [k, v] of Object.entries(raw).slice(0, 200))
+            if (typeof v === "string" && SAFE_ID.test(v))
+                out[k.toLowerCase()] = v;
+    }
+    return out;
+}
 /**
  * A `~/…` workspace, resolved under the home directory — re-checked here against the real disk,
  * because the API could only check the string. A symlink out of home is refused like `..` is.
@@ -142,6 +159,8 @@ export class LocalBrowserRuntime {
             consented: new Set(envelope.policy.consentedDomains),
             deny: new Set(envelope.policy.denyDomains),
             profileConsented: envelope.policy.profileConsented,
+            consentIds: new Map(Object.entries(envelope.policy.consentIds ?? {})),
+            secrets: secretEnvValues(process.env),
             activeSince: this.now(),
             activeMs: 0,
             waiters: [],
@@ -165,10 +184,13 @@ export class LocalBrowserRuntime {
             if (outcome !== "resumed" || !run.profileConsented)
                 throw new Error("The owner did not allow research in their signed-in browser profile.");
         }
+        if (e.browserProfile === "default")
+            this.emit(run, { type: "policy.decision", ...this.consentRef(run, "*"), detail: { scope: "signed_in_profile", decision: "consented" } });
         run.browser = await this.deps.browserFor(e.browserProfile, run.dir);
         run.bridge = new BrowserBridge(run.browser.tools, {
             emit: (ev) => this.emit(run, ev),
             pause: (reason, detail) => this.pause(run, reason, detail),
+            consentIdFor: (host) => this.consentRef(run, host).consentId,
             isDenied: (host) => [...run.deny].some((d) => domainWithin(host, d)),
             isPermitted: (host) => [...e.policy.allowDomains, ...run.consented].some((d) => domainWithin(host, d)),
             allowListOnly: () => e.policy.allowDomains.length > 0,
@@ -186,6 +208,8 @@ export class LocalBrowserRuntime {
         });
         if (spec.mcpConfig)
             writeFileSync(spec.mcpConfig.path, spec.mcpConfig.json, { mode: 0o600 });
+        // The env the engine actually gets — a key the owner chose to pass (api-key mode) included.
+        run.secrets = secretEnvValues({ ...process.env, ...spec.env });
         run.engineAuth = observedEngineAuth(e.engine, spec.env);
         this.emit(run, { type: "engine.auth_checked", detail: { engine: e.engine, authMode: e.authMode, engineAuth: run.engineAuth } });
         const child = this.spawn(spec.command, spec.args, { cwd: run.workDir, env: spec.env, stdio: ["ignore", "pipe", "pipe"] });
@@ -231,7 +255,7 @@ export class LocalBrowserRuntime {
         if (run.events.length >= MAX_EVENTS)
             return;
         const { detail: raw, ...rest } = ev;
-        const detail = redactDetail(raw);
+        const detail = redactDetail(raw, 0, run.secrets);
         run.events.push({ ...rest, ...(detail && Object.keys(detail).length ? { detail } : {}), at: new Date(this.now()).toISOString(), seq: ++run.seq });
     }
     pause(run, reason, detail) {
@@ -262,6 +286,8 @@ export class LocalBrowserRuntime {
         const run = this.get(String(o.runId ?? ""));
         if (run.state === "ended")
             throw new RunnerInputError("The run has ended", 409);
+        for (const [d, id] of Object.entries(consentIdMap(o.consentIds)))
+            run.consentIds.set(d, id);
         for (const d of strList(o.consentedDomains))
             run.consented.add(d);
         for (const d of strList(o.denyDomains))
@@ -313,6 +339,16 @@ export class LocalBrowserRuntime {
             return run.bridge.callTool(o.name, (o.args && typeof o.args === "object" ? o.args : {}));
         throw new RunnerInputError("op must be list or call");
     }
+    /** The decision that covers this host (or `*`), as an event field — empty when none does. */
+    consentRef(run, host) {
+        if (host === "*")
+            return run.consentIds.has("*") ? { consentId: run.consentIds.get("*") } : {};
+        let best = null;
+        for (const [d, id] of run.consentIds)
+            if (d !== "*" && domainWithin(host, d) && (!best || d.length > best[0].length))
+                best = [d, id];
+        return best ? { consentId: best[1] } : {};
+    }
     get(runId) {
         const run = this.runs.get(runId);
         if (!run)
@@ -367,10 +403,11 @@ export class LocalBrowserRuntime {
             outcome: r.outcome,
             findings: run.bridge?.findings ?? [],
             sourceFailures: run.bridge?.sourceFailures ?? [],
-            summary: (r.summary ?? "").slice(0, 4000),
+            summary: redactText((r.summary ?? "").slice(0, 4000), run.secrets),
             traceId: run.envelope.runId,
             engineAuth: r.engineAuth ?? run.engineAuth,
-            ...(r.outcome === "failed" ? { error: (r.error ?? "The run failed without a reason.").slice(0, 1000) } : {}),
+            // CLI output becomes this text, and a CLI prints whatever it was given: redacted before it is kept.
+            ...(r.outcome === "failed" ? { error: redactText((r.error ?? "The run failed without a reason.").slice(0, 1000), run.secrets) } : {}),
         };
         if (run.child && run.child.exitCode === null)
             this.kill(run);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.72",
+  "version": "0.4.74",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",