@proagentstore/cli 0.4.92 → 0.4.93

package/dist/browser-runner/local-artifact/contract.js

@@ -20,6 +20,8 @@ export const LOCAL_ARTIFACT_TASK_TYPE = "local_artifact.generate";
 export const LOCAL_ARTIFACT_RUN_PATH = "/local-artifact/run";
 export const LOCAL_ARTIFACT_STATUS_PATH = "/local-artifact/status";
 export const LOCAL_ARTIFACT_CANCEL_PATH = "/local-artifact/cancel";
+/** First CLI that consumes an explicit uploaded source instead of its local master files. */
+export const LOCAL_ARTIFACT_UPLOADED_SOURCES_MIN_CLI = "0.4.93";
 /** The readiness event a completed tailoring run emits, once, through the connection outbox. */
 export const MATERIALS_READY_EVENT = "job.application.materials_ready";
 export const LOCAL_ARTIFACT_ENGINES = ["claude", "codex"];

package/dist/browser-runner/local-artifact/runtime.js

@@ -67,6 +67,26 @@ export function parseArtifactEnvelope(raw) {
             throw bad(`source ${String(r.role)} is listed twice`);
         sources.push({ role: r.role, path: r.path });
     }
+    const uploadedSources = [];
+    if (o.uploadedSources !== undefined) {
+        if (!Array.isArray(o.uploadedSources) || o.uploadedSources.length !== 2)
+            throw bad("uploadedSources must contain the selected resume and profile");
+        for (const source of o.uploadedSources) {
+            const r = (source && typeof source === "object" ? source : {});
+            if ((r.role !== "resume" && r.role !== "profile") || uploadedSources.some((x) => x.role === r.role))
+                throw bad("uploaded sources need one resume and one profile");
+            if (typeof r.fileId !== "string" || !PATH_SEGMENT.test(r.fileId) || typeof r.version !== "string" || !r.version || r.version.length > 300 || typeof r.originalSha256 !== "string" || !/^[a-f0-9]{64}$/.test(r.originalSha256) || typeof r.extractedTextSha256 !== "string" || !/^[a-f0-9]{64}$/.test(r.extractedTextSha256) || typeof r.extractedAt !== "string" || Number.isNaN(Date.parse(r.extractedAt)) || typeof r.text !== "string")
+                throw bad("uploaded source provenance is invalid");
+            const bytes = Buffer.byteLength(r.text, "utf8");
+            if (!bytes || bytes > LOCAL_ARTIFACT_CAPS.sourceBytes)
+                throw bad(`uploaded source must be 1-${LOCAL_ARTIFACT_CAPS.sourceBytes} UTF-8 bytes`);
+            if (sha256(r.text) !== r.extractedTextSha256)
+                throw bad("uploaded source text does not match its extracted-text hash");
+            uploadedSources.push({ role: r.role, fileId: r.fileId, version: r.version, originalSha256: r.originalSha256, extractedTextSha256: r.extractedTextSha256, extractedAt: r.extractedAt, text: r.text });
+        }
+        if (uploadedSources.length !== 2 || !uploadedSources.some((s) => s.role === "resume") || !uploadedSources.some((s) => s.role === "profile"))
+            throw bad("uploaded sources need one resume and one profile");
+    }
     const p = (o.policy && typeof o.policy === "object" ? o.policy : {});
     const retainDays = intIn(p.retainDays, 0, 3650);
     const maxMinutes = intIn(p.maxMinutes, 1, 60);
@@ -83,6 +103,7 @@ export function parseArtifactEnvelope(raw) {
         authMode: o.authMode,
         workspace: o.workspace,
         sources,
+        ...(uploadedSources.length ? { uploadedSources } : {}),
         policy: { retainDays, maxMinutes, maxConcurrent },
         ...("lead" in lead ? { lead: lead.lead } : { lead: null, leadError: lead.error }),
     };
@@ -163,31 +184,53 @@ export class LocalArtifactRuntime {
             throw new Pause("workspace_unavailable", [`The workspace ${e.workspace} cannot be used: ${err instanceof Error ? err.message : String(err)}`]);
         }
         this.sweepArtifacts(run, workspace);
-        // Sources: read by the runtime, hashed, handed to the CLI in its prompt. Content never leaves this function except into the prompt.
+        // Sources: uploaded selections arrive only over the authenticated relay, are written beneath
+        // this run's private scratch folder under fixed role names, and never use a user filename/path.
+        // Local mode remains the existing path. Content never reaches events/results/DB.
         const texts = [];
         const hashes = [];
         const missing = [];
-        for (const s of e.sources) {
-            const shown = `${e.workspace}/${s.path}`;
-            try {
-                const file = resolveSource(workspace, s.path);
-                const buf = readFileSync(file);
-                if (buf.length > LOCAL_ARTIFACT_CAPS.sourceBytes)
-                    throw new Error(`larger than ${LOCAL_ARTIFACT_CAPS.sourceBytes / 1024} KB`);
-                if (!buf.length)
-                    throw new Error("empty");
-                texts.push({ role: s.role, text: buf.toString("utf8") });
-                const hash = { role: s.role, path: shown, sha256: sha256(buf), bytes: buf.length };
-                hashes.push(hash);
-                this.emit(run, { type: "source.read", detail: hash });
-            }
-            catch (err) {
-                this.emit(run, { type: "source.missing", detail: { role: s.role, path: shown } });
-                missing.push(`Your ${s.role} at ${shown} could not be read (${err instanceof Error && !/ENOENT/.test(err.message) ? err.message : "not found"}). Add it, or choose another file in the Application Tailor settings.`);
+        if (e.uploadedSources?.length) {
+            const sourceDir = join(run.scratch, "sources");
+            mkdirSync(sourceDir, { recursive: true, mode: 0o700 });
+            for (const s of e.uploadedSources) {
+                const safePath = join(sourceDir, `${s.role}.txt`);
+                try {
+                    writeFileSync(safePath, s.text, { encoding: "utf8", flag: "wx", mode: 0o600 });
+                    const bytes = Buffer.byteLength(s.text, "utf8");
+                    const hash = { role: s.role, path: `uploaded/${s.fileId}@${s.version}`, sha256: s.extractedTextSha256, bytes };
+                    texts.push({ role: s.role, text: readFileSync(safePath, "utf8") });
+                    hashes.push(hash);
+                    this.emit(run, { type: "source.read", detail: hash });
+                }
+                catch (err) {
+                    this.emit(run, { type: "source.missing", detail: { role: s.role, path: `uploaded/${s.fileId}` } });
+                    missing.push(`The selected uploaded ${s.role} could not be materialized (${err instanceof Error ? err.message : "unknown error"}).`);
+                }
             }
         }
+        else
+            for (const s of e.sources) {
+                const shown = `${e.workspace}/${s.path}`;
+                try {
+                    const file = resolveSource(workspace, s.path);
+                    const buf = readFileSync(file);
+                    if (buf.length > LOCAL_ARTIFACT_CAPS.sourceBytes)
+                        throw new Error(`larger than ${LOCAL_ARTIFACT_CAPS.sourceBytes / 1024} KB`);
+                    if (!buf.length)
+                        throw new Error("empty");
+                    texts.push({ role: s.role, text: buf.toString("utf8") });
+                    const hash = { role: s.role, path: shown, sha256: sha256(buf), bytes: buf.length };
+                    hashes.push(hash);
+                    this.emit(run, { type: "source.read", detail: hash });
+                }
+                catch (err) {
+                    this.emit(run, { type: "source.missing", detail: { role: s.role, path: shown } });
+                    missing.push(`Your ${s.role} at ${shown} could not be read (${err instanceof Error && !/ENOENT/.test(err.message) ? err.message : "not found"}). Add it, or choose another file in the Application Tailor settings.`);
+                }
+            }
         for (const role of REQUIRED_SOURCE_ROLES) {
-            if (!e.sources.some((s) => s.role === role))
+            if (e.uploadedSources?.length ? !e.uploadedSources.some((s) => s.role === role) : !e.sources.some((s) => s.role === role))
                 missing.push(`No ${role} source is configured. Choose one in the Application Tailor settings.`);
         }
         if (missing.length)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-	"version": "0.4.92",
+  "version": "0.4.93",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",