@proagentstore/cli 0.4.73 → 0.4.75

package/dist/browser-runner/coding/engine-turn.js

@@ -29,17 +29,39 @@ export const MAX_TURN_DETAIL = 240;
 export const MAX_TURN_TAIL_LINES = 60;
 export const MAX_TURN_TAIL_LINE = 400;
 export const MAX_TURN_TAIL_CHARS = 8000;
-/** Append one line of the turn's own output to its tail, keeping the newest within the bounds above. */
+/** Leads a tail that has lost its oldest lines, with how many (#898). */
+const DROPPED_LINE = /^\[(\d+) earlier lines? of this turn not kept\]$/;
+/**
+ * Append one line of the turn's own output to its tail, keeping the newest within the bounds above.
+ *
+ * What falls off the front is COUNTED, in a first line that says so (#898): the cloud reports "the
+ * last N lines", and a tail that silently lost its head made N read as all the turn printed.
+ */
 export function appendTurnTail(tail, line) {
     const text = line.trim();
     if (!text)
         return;
+    const marked = tail.length ? DROPPED_LINE.exec(tail[0]) : null;
+    let dropped = marked ? Number(marked[1]) : 0;
+    if (marked)
+        tail.shift();
     tail.push(text.length > MAX_TURN_TAIL_LINE ? `${text.slice(0, MAX_TURN_TAIL_LINE)}…` : text);
-    while (tail.length > MAX_TURN_TAIL_LINES)
+    while (tail.length > MAX_TURN_TAIL_LINES - 1) {
         tail.shift();
+        dropped++;
+    }
     let total = tail.reduce((n, l) => n + l.length + 1, 0);
-    while (total > MAX_TURN_TAIL_CHARS && tail.length > 1)
+    // Room is kept for the count line itself, so the tail stays inside its total bound.
+    while (total > MAX_TURN_TAIL_CHARS - 48 && tail.length > 1) {
         total -= tail.shift().length + 1;
+        dropped++;
+    }
+    if (dropped)
+        tail.unshift(`[${dropped} earlier line${dropped === 1 ? "" : "s"} of this turn not kept]`);
+}
+/** The engine's last line within {@link MAX_TURN_DETAIL}, with an ellipsis when it was cut (#898). */
+function detailOf(text) {
+    return text.length > MAX_TURN_DETAIL ? `${text.slice(0, MAX_TURN_DETAIL)}…` : text;
 }
 /**
  * A one-shot turn's process has exited — say what that means, and nothing more.
@@ -49,7 +71,7 @@ export function appendTurnTail(tail, line) {
  * failure would let three slow builds read as a broken CLI.
  */
 export function turnReportFromExit(code, signal, lastLine = "", now = Date.now(), tail = []) {
-    const detail = (lastLine.trim() || tail.at(-1) || "").slice(0, MAX_TURN_DETAIL);
+    const detail = detailOf(lastLine.trim() || tail.at(-1) || "");
     const verdict = signal !== null ? "killed" : code === 0 ? "ok" : "failed";
     return {
         verdict,
@@ -68,7 +90,7 @@ export function turnReportFromExit(code, signal, lastLine = "", now = Date.now()
  * case that runs most.
  */
 export function turnReportFromResult(isError, detail = "", now = Date.now(), tail = []) {
-    const text = detail.trim().slice(0, MAX_TURN_DETAIL);
+    const text = detailOf(detail.trim());
     return {
         verdict: isError ? "failed" : "ok",
         exitCode: null,

package/dist/browser-runner/coding/headless.js

@@ -59,6 +59,8 @@ export class HeadlessSession {
     proc = null;
     buf = "";
     transcript = [];
+    /** Records trimmed off the front of {@link transcript} — said in the pane, never silent (#898). */
+    droppedRecords = 0;
     run = "idle";
     /** Claude Code's own session id (from the init event) — used to --resume. */
     claudeSessionId = null;
@@ -351,7 +353,8 @@ export class HeadlessSession {
     }
     /** The rendered conversation the brain/console reads (Claude's real output). */
     snapshot() {
-        return this.transcript.join("\n");
+        const text = this.transcript.join("\n");
+        return this.droppedRecords > 0 ? `[${this.droppedRecords} earlier lines of this session's output are no longer kept]\n${text}` : text;
     }
     /** Launch (or resume) the agent process. Idempotent if already alive. */
     /**
@@ -691,6 +694,10 @@ export class HeadlessSession {
         if (this.buf.length > cap) {
             if (this.mode === "raw")
                 this.pushRaw(this.buf);
+            // Said in the pane (#898): an event this size was discarded whole, and a reader could not
+            // tell a dropped tool result from one that never came.
+            else
+                this.push(`[a ${this.buf.length.toLocaleString("en-US")}-character line of engine output was too large to keep and was dropped]`);
             this.buf = "";
         }
     }
@@ -730,8 +737,14 @@ export class HeadlessSession {
             // never scraped back out of the rendered pane.
             this.turnLastLine = clean.trim();
         }
-        if (this.transcript.length > 4000)
-            this.transcript = this.transcript.slice(-3000);
+        this.trimTranscript();
+    }
+    /** Keep the newest 3,000 records once past 4,000, and COUNT what went (#898). */
+    trimTranscript() {
+        if (this.transcript.length <= 4000)
+            return;
+        this.droppedRecords += this.transcript.length - 3000;
+        this.transcript = this.transcript.slice(-3000);
     }
     handle(line) {
         const events = this.adapter.parseLine(line);
@@ -808,8 +821,7 @@ export class HeadlessSession {
         // Keep the in-memory transcript bounded. Counts ENTRIES, and an entry may now be a
         // multi-line block (a result, or a long assistant reply) rather than one line — the
         // character bound that matters is `MAX_PANE` in runtime.ts, applied on the way out.
-        if (this.transcript.length > 4000)
-            this.transcript = this.transcript.slice(-3000);
+        this.trimTranscript();
         return events.length > 0;
     }
     push(line) {

package/dist/browser-runner/coding/inspect.js

@@ -272,7 +272,9 @@ export function repoSearch(workDir, opts) {
     const limit = Math.max(1, Math.min(SEARCH_MAX_RESULTS, Math.floor(opts.maxResults ?? SEARCH_MAX_RESULTS)));
     const relPath = opts.path ? relative(workDir, resolveInside(workDir, opts.path)) : undefined;
     const argv = mode === "content"
-        ? ["grep", "-n", "-I", "-i", "-F", "--untracked", "--max-count", String(SEARCH_PER_FILE), "-e", pattern]
+        ? // No `--max-count` (#898): git stopped at 5 per file and `total` counted only those, so a
+            // file with 200 matches read as one with 5. The per-file cap is applied below, COUNTED.
+            ["grep", "-n", "-I", "-i", "-F", "--untracked", "-e", pattern]
         : // Tracked PLUS untracked-not-ignored: a file created ten minutes ago is exactly the one
             // somebody is trying to find, and `ls-files` alone would deny it exists.
             ["ls-files", "--cached", "--others", "--exclude-standard"];
@@ -297,12 +299,33 @@ export function repoSearch(workDir, opts) {
             throw new InspectError(err.message || `git ${mode} search failed`);
     }
     const lines = out.split("\n").filter((l) => l !== "");
-    const all = mode === "content"
-        ? lines.map(parseGrepLine).filter((m) => m !== null)
-        : // The pattern never reaches git here — the filter is a plain case-insensitive substring
-            // over the path, which is what "find the file called X" actually means.
-            lines.filter((p) => p.toLowerCase().includes(pattern.toLowerCase())).map((p) => ({ path: p }));
-    return { mode, pattern, matches: all.slice(0, limit), shown: Math.min(all.length, limit), total: all.length, truncated: all.length > limit };
+    if (mode === "path") {
+        // The pattern never reaches git here — the filter is a plain case-insensitive substring
+        // over the path, which is what "find the file called X" actually means.
+        const all = lines.filter((p) => p.toLowerCase().includes(pattern.toLowerCase())).map((p) => ({ path: p }));
+        return { mode, pattern, matches: all.slice(0, limit), shown: Math.min(all.length, limit), total: all.length, truncated: all.length > limit };
+    }
+    const all = lines.map(parseGrepLine).filter((m) => m !== null);
+    const perFile = new Map();
+    const omittedPerFile = {};
+    const capped = all.filter((m) => {
+        const n = (perFile.get(m.path) ?? 0) + 1;
+        perFile.set(m.path, n);
+        if (n <= SEARCH_PER_FILE)
+            return true;
+        omittedPerFile[m.path] = (omittedPerFile[m.path] ?? 0) + 1;
+        return false;
+    });
+    const matches = capped.slice(0, limit);
+    return {
+        mode,
+        pattern,
+        matches,
+        shown: matches.length,
+        total: all.length,
+        truncated: matches.length < all.length,
+        ...(Object.keys(omittedPerFile).length ? { omittedPerFile } : {}),
+    };
 }
 /** `path:line:text` — split on the FIRST two colons only, since code is full of them. */
 function parseGrepLine(line) {
@@ -315,7 +338,9 @@ function parseGrepLine(line) {
     const n = Number.parseInt(line.slice(first + 1, second), 10);
     if (!Number.isFinite(n))
         return null;
-    return { path: line.slice(0, first), line: n, text: line.slice(second + 1).trim().slice(0, SEARCH_MAX_LINE) };
+    const text = line.slice(second + 1).trim();
+    // Marked (#898): a cut line read as the whole line. `repo_read_file` with `startLine` has the rest.
+    return { path: line.slice(0, first), line: n, text: text.length > SEARCH_MAX_LINE ? `${text.slice(0, SEARCH_MAX_LINE)}…` : text };
 }
 /** The deepest `maxDepth` this will honour. Named because the TOOL has to say it (#508). */
 export const TREE_MAX_DEPTH = 4;
@@ -342,6 +367,10 @@ export function repoTree(workDir, relPath = ".", maxDepth = 3, maxEntries = 500)
     const queue = [{ dir: start, depth: 0 }];
     let truncated = false;
     let truncatedByDepth = false;
+    // Dot-entries ARE listed now (#898): `.github/`, `.env.example`, `.claude/` were hidden with
+    // nothing saying so. What is still skipped is named in `skipped`, so absence is never a claim.
+    const skipped = new Set();
+    const result = () => ({ root: relPath, entries, truncated, truncatedByDepth, depthCap, ...(skipped.size ? { skipped: [...skipped].sort() } : {}) });
     while (queue.length) {
         const { dir, depth } = queue.shift();
         let items;
@@ -352,11 +381,13 @@ export function repoTree(workDir, relPath = ".", maxDepth = 3, maxEntries = 500)
             continue;
         }
         for (const it of items) {
-            if (it.name.startsWith(".") || IGNORE_DIRS.has(it.name))
+            if (IGNORE_DIRS.has(it.name)) {
+                skipped.add(it.name);
                 continue;
+            }
             if (entries.length >= entryCap) {
                 truncated = true;
-                return { root: relPath, entries, truncated, truncatedByDepth, depthCap };
+                return result();
             }
             const abs = resolve(dir, it.name);
             const rel = relative(workDir, abs);
@@ -387,7 +418,7 @@ export function repoTree(workDir, relPath = ".", maxDepth = 3, maxEntries = 500)
             }
         }
     }
-    return { root: relPath, entries, truncated, truncatedByDepth, depthCap };
+    return result();
 }
 export const SYNC_FETCH_TTL_MS = 60_000;
 /** Per work-tree root: when the last fetch attempt was made and how it went. */

package/dist/browser-runner/coding/runtime.js

@@ -189,10 +189,12 @@ export class CodingRuntime {
         // `[exited with code N]` / `[error]` lines recorded on exit. Blanking it when the
         // process is dead lost exactly the output + failure reason the brain/console needs
         // to diagnose a crash or read a one-shot CLI's final result.
-        const pane = clip(session.snapshot());
+        const full = session.snapshot();
+        const pane = clip(full);
         return {
             sessionId,
             pane,
+            paneChars: full.length,
             alive,
             ready: alive ? session.ready : false,
             runState: alive ? session.runState() : "idle",
@@ -391,6 +393,7 @@ export class CodingRuntime {
         return session;
     }
 }
+/** The tail, marked (#898): the head it drops is said, with both numbers, at the top. */
 function clip(pane) {
-    return pane.length > MAX_PANE ? pane.slice(pane.length - MAX_PANE) : pane;
+    return pane.length > MAX_PANE ? `[cut: showing the last ${MAX_PANE} of ${pane.length} characters]\n${pane.slice(pane.length - MAX_PANE)}` : pane;
 }

package/dist/browser-runner/local-browser/bridge.js

@@ -1,6 +1,8 @@
 import { LOCAL_BROWSER_SOURCE_FAILURE_REASONS, redactDetail } from "./contract.js";
 /** The browser tools a research run may use. Everything else from the browser is not even listed. */
 const READ_TOOLS = new Set(["browser_navigate", "browser_navigate_back", "browser_snapshot", "browser_wait_for", "browser_click"]);
+/** The research tools the bridge adds; the CLI records its results through these. */
+const RESEARCH_TOOL_NAMES = ["record_finding", "report_source_failure", "finish_research"];
 /** Refused BY NAME with the reason, so a CLI that guesses one is told why rather than "unknown tool". */
 const WRITE_TOOLS = new Set([
     "browser_type",
@@ -18,6 +20,11 @@ const WRITE_TOOLS = new Set([
 /** Roles a click may target in research mode: moving between pages, never acting on one. */
 const CLICKABLE_ROLES = new Set(["link", "tab", "menuitem", "treeitem", "option"]);
 const PAGINATION_NAME = /^(next|previous|prev|more|load more|show more|see more|view more|older|newer|page \d+|\d+|›|»|‹|«)( page| results| jobs)?$/i;
+/**
+ * Every tool name the bridge can ever list (#952) — the exact set a CLI may be told to trust
+ * without asking. Write tools are not in it, so trusting this set cannot trust a write.
+ */
+export const BRIDGE_TOOL_NAMES = [...READ_TOOLS, ...RESEARCH_TOOL_NAMES];
 const RESEARCH_TOOLS = [
     {
         name: "record_finding",

package/dist/browser-runner/local-browser/engine.js

@@ -12,6 +12,13 @@
  *  - Codex: `--sandbox read-only` (its shell cannot write, and per Codex's sandbox design has no
  *    network), `--ignore-user-config` (no MCP servers or providers from the user's own config — auth
  *    still comes from the login), web search switched off, and the bridge as its only MCP server.
+ *    `codex exec` runs with approval policy `never`, so an MCP tool that needs approval is simply
+ *    refused — a live run on 2026-10-07 opened no page for exactly that reason (#952). The bridge is
+ *    therefore pre-approved, and ONLY it: `default_tools_approval_mode="approve"` on the
+ *    `pags_browser` server, and `enabled_tools` pinned to the bridge's own tool names
+ *    (`BRIDGE_TOOL_NAMES`). Nothing else is approved — the shell stays read-only with no network,
+ *    there is no other server — and the bridge still enforces sites, consent, limits and the
+ *    research-only tool set in the runner, whatever the CLI is allowed to call.
  *    NOT VERIFIED END TO END on a live machine: that read-only shell commands get no network, and
  *    which of the two web-search keys a given Codex version honours. #947 holds that test.
  *
@@ -21,6 +28,7 @@
  * turns a subscription run into per-token billing.
  */
 import { mergeEnv } from "../coding/engine-env.js";
+import { BRIDGE_TOOL_NAMES } from "./bridge.js";
 import { resolveEngineAuth } from "../coding/engine-auth.js";
 /** The bridge's MCP server name — and so the prefix of its tools inside the CLI. */
 export const BRIDGE_SERVER_NAME = "pags_browser";
@@ -89,6 +97,11 @@ export function buildEngineSpec(input) {
             `${key}.env=${envTable}`,
             "-c",
             `${key}.tool_timeout_sec=${Math.ceil(input.toolTimeoutMs / 1000)}`,
+            // Pre-approve the bridge, and only its own tools (#952); see the note atop this file.
+            "-c",
+            `${key}.default_tools_approval_mode="approve"`,
+            "-c",
+            `${key}.enabled_tools=[${BRIDGE_TOOL_NAMES.map(toml).join(", ")}]`,
             // Two spellings across Codex versions; an unknown key is ignored, so both are set.
             "-c",
             'web_search="disabled"',

package/dist/browser-runner/server.js

@@ -304,15 +304,16 @@ async function route(runner, req, res) {
         const raw = (b.dir || "~").replace(/^~(?=$|\/)/, homedir());
         const dir = resolve(raw);
         try {
-            const entries = readdirSync(dir, { withFileTypes: true })
-                .filter((e) => !e.name.startsWith("."))
+            const visible = readdirSync(dir, { withFileTypes: true }).filter((e) => !e.name.startsWith("."));
+            const entries = visible
                 .slice(0, 200)
                 .map((e) => ({
                 name: e.name,
                 type: e.isDirectory() ? "dir" : "file",
                 size: e.isFile() ? statSync(resolve(dir, e.name)).size : undefined,
             }));
-            return json(res, 200, { dir, entries });
+            // Said, not silent (#898): a folder of 500 entries read as one of 200.
+            return json(res, 200, { dir, entries, ...(visible.length > entries.length ? { total: visible.length, truncated: true } : {}) });
         }
         catch (e) {
             return json(res, 400, { error: e instanceof Error ? e.message : String(e), dir });

package/dist/index.js

@@ -1718,7 +1718,7 @@ function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, f
         try {
           result = text2 ? JSON.parse(text2) : {};
         } catch {
-          result = { raw: text2.slice(0, 500) };
+          result = text2.length > 500 ? { raw: text2.slice(0, 500), rawChars: text2.length, truncated: true } : { raw: text2 };
         }
         try {
           ws.send(JSON.stringify({ id: cmd.id, status: res.status, result }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.73",
+  "version": "0.4.75",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",