@proagentstore/cli 0.4.83 → 0.4.84

package/dist/browser-runner/local-apply/bridge.js

@@ -105,6 +105,7 @@ function withQuote(schema, required) {
 export class ApplyBridge {
     browser;
     host;
+    /** Read by the runtime for the #975 diagnostic: 0 calls is the finding, not an internal detail. */
     actions = 0;
     pages = 0;
     lastSnapshot = "";

package/dist/browser-runner/local-apply/contract.js

@@ -56,7 +56,10 @@ export const LOCAL_APPLY_BLOCK_REASONS = [
     "source_unavailable",
     "artifact_changed",
     "job_unavailable",
+    "bridge_unused",
 ];
+export const LOCAL_APPLY_DIAGNOSTIC_CAUSES = ["bridge_unused", "engine_exited_nonzero", "timed_out", "no_engine_output"];
+export const LOCAL_APPLY_SIGNALS = ["approval_policy_blocked", "bridge_tools_missing", "auth_prompt", "no_output", "engine_refused_task"];
 export const LOCAL_APPLY_UNAVAILABLE_REASONS = ["expired", "unavailable"];
 export const LOCAL_APPLY_EVENT_TYPES = [
     "engine.auth_checked",
@@ -162,6 +165,24 @@ export function parseLocalApplyResult(raw) {
         out.submitted = { url, at, gateId };
         out.submitAttempted = true;
     }
+    // #975 — accepted ONLY as the closed vocabulary it declares. A runner that sends prose here gets
+    // it dropped rather than stored: the whole point of a structured diagnostic is that no new
+    // free-text channel opens between the machine and the owner's records.
+    const d = o.diagnostic && typeof o.diagnostic === "object" && !Array.isArray(o.diagnostic) ? o.diagnostic : null;
+    const cause = d ? oneOf(LOCAL_APPLY_DIAGNOSTIC_CAUSES, d.cause) : null;
+    if (d && cause) {
+        const count = (v) => (typeof v === "number" && Number.isInteger(v) && v >= 0 && v <= 1_000_000 ? v : 0);
+        out.diagnostic = {
+            cause,
+            bridgeCalls: count(d.bridgeCalls),
+            engineExit: typeof d.engineExit === "number" && Number.isInteger(d.engineExit) && d.engineExit >= -1 && d.engineExit <= 255 ? d.engineExit : 0,
+            activeMs: count(d.activeMs),
+            pages: count(d.pages),
+            filled: count(d.filled),
+            // Deduped from a closed 5-value vocabulary, so it is bounded by the enum itself — no cap needed.
+            signals: [...new Set((Array.isArray(d.signals) ? d.signals : []).filter((x) => LOCAL_APPLY_SIGNALS.includes(x)))],
+        };
+    }
     if (outcome === "blocked") {
         out.blockReason = oneOf(LOCAL_APPLY_BLOCK_REASONS, o.blockReason) ?? "incomplete";
         out.questions = (Array.isArray(o.questions) ? o.questions : [])

package/dist/browser-runner/local-apply/runtime.js

@@ -147,6 +147,23 @@ export function verifyArtifact(workspace, home, a) {
         return { error: `The approved ${label} at ${a.path} could not be read.` };
     }
 }
+/**
+ * What to tell the owner when the CLI put nothing on the page (#975) — built from the diagnostic's
+ * own ids, so the advice follows the observation rather than guessing at it.
+ */
+function bridgeUnusedHelp(engine, d) {
+    if (d.signals.includes("approval_policy_blocked"))
+        return `The ${engine} CLI would not use the browser tools because its own approval policy refused them. Allow the PAGS bridge toolset for this session, then retry.`;
+    if (d.signals.includes("bridge_tools_missing"))
+        return `The ${engine} CLI never saw the browser tools. Update the CLI (npm i -g @proagentstore/cli), run \`pags up\` again, then retry.`;
+    if (d.signals.includes("auth_prompt"))
+        return `The ${engine} CLI stopped on a sign-in prompt before opening the page. Sign it in on this machine, then retry.`;
+    if (d.signals.includes("no_output"))
+        return `The ${engine} CLI produced no output at all before exiting. Check that it runs on this machine, then retry.`;
+    if (d.signals.includes("engine_refused_task"))
+        return `The ${engine} CLI declined the task and never opened the page. Its own closing message is on this run's summary.`;
+    return `The ${engine} CLI ran for ${Math.round(d.activeMs / 1000)}s and exited (code ${d.engineExit}) without opening the application page — no navigation, no checkpoint, no fill. Nothing was submitted. Retry, or run the CLI by hand on this machine to see why it stops.`;
+}
 export class LocalApplyRuntime {
     deps;
     runs = new Map();
@@ -304,6 +321,42 @@ export class LocalApplyRuntime {
         }, 5_000);
         run.timer.unref?.();
     }
+    /**
+     * What the runner OBSERVED about its own CLI (#975), as ids this platform defines.
+     *
+     * Matched against the engine's structured output on the machine; only the matching signal's ID
+     * crosses the contract, never the line that matched it. That is what makes a diagnostic safe to
+     * persist: a CLI prints the owner's résumé prose and their typed answers while it works, and no
+     * redaction can reliably tell those from the rest of its chatter.
+     */
+    signalsOf(run) {
+        const text = run.output.join("\n");
+        const out = [];
+        if (!text.trim())
+            out.push("no_output");
+        // #952's live failure, invisible from the cloud and fixable by configuration.
+        if (/approval policy is\s*[`'"]?never|requires? approval|permission denied for tool|not allowed to use/i.test(text))
+            out.push("approval_policy_blocked");
+        if (/browser_navigate.{0,40}(not found|unknown tool|unavailable)|no such tool|tool .{0,40}is not available/i.test(text))
+            out.push("bridge_tools_missing");
+        if (missingLogin(run.envelope.engine, text))
+            out.push("auth_prompt");
+        if (/\b(i (cannot|can't|won't)|unable to) (help|assist|complete|do that|proceed)/i.test(text))
+            out.push("engine_refused_task");
+        return [...new Set(out)];
+    }
+    /** The bounded, closed-vocabulary diagnostic for a run that put nothing on the page (#975). */
+    diagnosticOf(run, code, cause) {
+        return {
+            cause,
+            bridgeCalls: run.bridge?.actions ?? 0,
+            engineExit: Number.isInteger(code) && code >= -1 && code <= 255 ? code : 0,
+            activeMs: this.activeMs(run),
+            pages: run.bridge?.pages ?? 0,
+            filled: run.bridge?.filled ?? 0,
+            signals: this.signalsOf(run),
+        };
+    }
     /** What the run amounts to when the CLI exits — decided by what the bridge did, not what the CLI says. */
     outcomeOf(run, code) {
         const e = run.envelope;
@@ -323,10 +376,26 @@ export class LocalApplyRuntime {
             return { outcome: "blocked", summary, blockReason: "engine_not_signed_in", questions: [signInHelp(e.engine)], engineAuth: "missing_login" };
         if (b?.blocked)
             return { outcome: "blocked", summary, blockReason: b.blocked.reason, questions: b.blocked.questions };
-        if (run.timedOut)
-            return { outcome: "blocked", summary, blockReason: "incomplete", questions: [`Stopped at the ${e.limits.maxMinutes}-minute limit before the form was ready for review.`] };
+        if (run.timedOut) {
+            return { outcome: "blocked", summary, blockReason: "incomplete", questions: [`Stopped at the ${e.limits.maxMinutes}-minute limit before the form was ready for review.`], diagnostic: this.diagnosticOf(run, code, "timed_out") };
+        }
+        // #975: a CLI that never called the bridge did NOTHING on the page, which is a different
+        // failure from stopping partway — different cause, different fix — and saying `incomplete`
+        // for both left the owner with a 51-second run they could not explain. The diagnostic says
+        // how long it ran, how many bridge calls it made (0) and what the runner saw it print.
+        const calls = b?.actions ?? 0;
+        if (calls === 0) {
+            const diagnostic = this.diagnosticOf(run, code, !run.output.join("").trim() ? "no_engine_output" : code !== 0 ? "engine_exited_nonzero" : "bridge_unused");
+            return { outcome: "blocked", summary, blockReason: "bridge_unused", questions: [bridgeUnusedHelp(e.engine, diagnostic)], diagnostic };
+        }
         const tail = code !== 0 ? ` (the ${e.engine} CLI exited with code ${code})` : "";
-        return { outcome: "blocked", summary, blockReason: "incomplete", questions: [`The CLI stopped before marking the form ready for review${tail}. Review the form yourself, or retry.`] };
+        return {
+            outcome: "blocked",
+            summary,
+            blockReason: "incomplete",
+            questions: [`The CLI stopped before marking the form ready for review${tail}. Review the form yourself, or retry.`],
+            diagnostic: this.diagnosticOf(run, code, code !== 0 ? "engine_exited_nonzero" : "bridge_unused"),
+        };
     }
     activeMs(run) {
         return run.activeMs + (run.state === "running" ? this.now() - run.activeSince : 0);
@@ -524,6 +593,9 @@ export class LocalApplyRuntime {
             ...(r.outcome === "submitted" && r.submitted ? { submitted: r.submitted } : {}),
             ...(r.outcome === "blocked" ? { blockReason: r.blockReason ?? "incomplete", questions: (r.questions ?? []).map((q) => redactText(q, run.secrets)), ...(r.blockReason === "job_unavailable" && r.unavailable ? { unavailable: r.unavailable } : {}) } : {}),
             ...(r.outcome === "failed" ? { error: redactText((r.error ?? "The run failed without a reason.").slice(0, 1000), run.secrets) } : {}),
+            // #975 — carried through as the closed vocabulary it is. Nothing here is redacted because
+            // nothing here is text: counts, an exit code, and signal ids this platform defines.
+            ...(r.diagnostic ? { diagnostic: r.diagnostic } : {}),
         };
         if (run.child && run.child.exitCode === null)
             this.kill(run);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.83",
+  "version": "0.4.84",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",