@proagentstore/cli 0.4.73 → 0.4.74

package/dist/browser-runner/local-browser/bridge.js

@@ -1,6 +1,8 @@
 import { LOCAL_BROWSER_SOURCE_FAILURE_REASONS, redactDetail } from "./contract.js";
 /** The browser tools a research run may use. Everything else from the browser is not even listed. */
 const READ_TOOLS = new Set(["browser_navigate", "browser_navigate_back", "browser_snapshot", "browser_wait_for", "browser_click"]);
+/** The research tools the bridge adds; the CLI records its results through these. */
+const RESEARCH_TOOL_NAMES = ["record_finding", "report_source_failure", "finish_research"];
 /** Refused BY NAME with the reason, so a CLI that guesses one is told why rather than "unknown tool". */
 const WRITE_TOOLS = new Set([
     "browser_type",
@@ -18,6 +20,11 @@ const WRITE_TOOLS = new Set([
 /** Roles a click may target in research mode: moving between pages, never acting on one. */
 const CLICKABLE_ROLES = new Set(["link", "tab", "menuitem", "treeitem", "option"]);
 const PAGINATION_NAME = /^(next|previous|prev|more|load more|show more|see more|view more|older|newer|page \d+|\d+|›|»|‹|«)( page| results| jobs)?$/i;
+/**
+ * Every tool name the bridge can ever list (#952) — the exact set a CLI may be told to trust
+ * without asking. Write tools are not in it, so trusting this set cannot trust a write.
+ */
+export const BRIDGE_TOOL_NAMES = [...READ_TOOLS, ...RESEARCH_TOOL_NAMES];
 const RESEARCH_TOOLS = [
     {
         name: "record_finding",

package/dist/browser-runner/local-browser/engine.js

@@ -12,6 +12,13 @@
  *  - Codex: `--sandbox read-only` (its shell cannot write, and per Codex's sandbox design has no
  *    network), `--ignore-user-config` (no MCP servers or providers from the user's own config — auth
  *    still comes from the login), web search switched off, and the bridge as its only MCP server.
+ *    `codex exec` runs with approval policy `never`, so an MCP tool that needs approval is simply
+ *    refused — a live run on 2026-10-07 opened no page for exactly that reason (#952). The bridge is
+ *    therefore pre-approved, and ONLY it: `default_tools_approval_mode="approve"` on the
+ *    `pags_browser` server, and `enabled_tools` pinned to the bridge's own tool names
+ *    (`BRIDGE_TOOL_NAMES`). Nothing else is approved — the shell stays read-only with no network,
+ *    there is no other server — and the bridge still enforces sites, consent, limits and the
+ *    research-only tool set in the runner, whatever the CLI is allowed to call.
  *    NOT VERIFIED END TO END on a live machine: that read-only shell commands get no network, and
  *    which of the two web-search keys a given Codex version honours. #947 holds that test.
  *
@@ -21,6 +28,7 @@
  * turns a subscription run into per-token billing.
  */
 import { mergeEnv } from "../coding/engine-env.js";
+import { BRIDGE_TOOL_NAMES } from "./bridge.js";
 import { resolveEngineAuth } from "../coding/engine-auth.js";
 /** The bridge's MCP server name — and so the prefix of its tools inside the CLI. */
 export const BRIDGE_SERVER_NAME = "pags_browser";
@@ -89,6 +97,11 @@ export function buildEngineSpec(input) {
             `${key}.env=${envTable}`,
             "-c",
             `${key}.tool_timeout_sec=${Math.ceil(input.toolTimeoutMs / 1000)}`,
+            // Pre-approve the bridge, and only its own tools (#952); see the note atop this file.
+            "-c",
+            `${key}.default_tools_approval_mode="approve"`,
+            "-c",
+            `${key}.enabled_tools=[${BRIDGE_TOOL_NAMES.map(toml).join(", ")}]`,
             // Two spellings across Codex versions; an unknown key is ignored, so both are set.
             "-c",
             'web_search="disabled"',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.73",
+  "version": "0.4.74",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",