@proagentstore/cli 0.4.96 → 0.4.97

package/dist/browser-runner/local-apply/contract.js

@@ -95,12 +95,12 @@ export const LOCAL_APPLY_BLOCK_REASONS = [
  * dispatch, naming the update, rather than silently producing the older behaviour (`apply.ts`
  * `runnerContractProblem`).
  *
- * ── Why it moved to 0.4.96 (#1013)
+ * ── Why it moved to 0.4.97 (#1013)
  *
- * #953 adds the read-only `/local-apply/preflight` route used before an email lead can enter
- * tailoring. That route lives in `packages/browser-runner`, which ships INSIDE the published CLI.
- * A machine below this floor cannot make the live/expired/unverifiable observation, so it must
- * not silently look equivalent to a current runner.
+ * #1013 adds the exact isolated-run browser handoff used when a sign-in or CAPTCHA blocks an
+ * application. That route lives in `packages/browser-runner`, which ships INSIDE the published
+ * CLI. A machine below this floor cannot retain the actual isolated page and must not silently
+ * substitute the shared/default browser page.
  *
  * A behaviour change in the runner is a CONTRACT change, because the cloud's decisions assume it.
  * So this floor moves with it: #1013's exact-page login/CAPTCHA handoff and post-submit receipt
@@ -111,7 +111,7 @@ export const LOCAL_APPLY_BLOCK_REASONS = [
  * been published. `cliAtLeast` treats an unreported version as capable, which is the convention
  * every MIN_CLI gate here follows.
  */
-export const LOCAL_APPLY_CONTRACT_MIN_CLI = "0.4.96";
+export const LOCAL_APPLY_CONTRACT_MIN_CLI = "0.4.97";
 export const LOCAL_APPLY_DIAGNOSTIC_CAUSES = ["bridge_unused", "engine_exited_nonzero", "timed_out", "no_engine_output", "submit_unconfirmed"];
 export const LOCAL_APPLY_CONFIRMATION_MARKERS = ["page_text", "url_receipt", "already_applied_notice"];
 export const LOCAL_APPLY_SIGNALS = [

package/dist/browser-runner/local-apply/live-run-browser.js

@@ -0,0 +1,87 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { McpRuntime } from "../mcp-runtime.js";
+/** Bind application handoff to the run browser, not to the runner-wide active page. */
+export function createLocalApplyBrowserFactory(options) {
+    return async (profile, runDir) => {
+        if (profile === "isolated")
+            return createIsolatedApplyBrowser(runDir, options.headless);
+        const browser = await options.defaultBrowser(profile, runDir);
+        return { ...browser, handoffPage: options.sharedPage };
+    };
+}
+/**
+ * Start the disposable browser context for one application run and retain only its current live
+ * page for the bounded takeover adapter.  This deliberately does not seed, copy, or persist an
+ * owner profile: the profile remains the run's existing throwaway `runDir/profile` directory.
+ */
+export async function createIsolatedApplyBrowser(runDir, headless) {
+    const playwright = await import("playwright");
+    const profileDir = join(runDir, "profile");
+    let context;
+    let mcp;
+    let activePage = null;
+    let stopped = false;
+    try {
+        context = await playwright.chromium.launchPersistentContext(profileDir, {
+            headless,
+            acceptDownloads: true,
+            viewport: null,
+            args: [
+                "--disable-blink-features=AutomationControlled",
+                "--start-maximized",
+                "--window-size=1512,982",
+                "--remote-debugging-port=0",
+                "--use-fake-ui-for-media-stream",
+                "--use-fake-device-for-media-stream",
+            ],
+        });
+        await context.addInitScript(() => {
+            Object.defineProperty(navigator, "webdriver", { get: () => undefined });
+        }).catch(() => undefined);
+        const track = (page) => {
+            activePage = page;
+            // Never fall back to another tab after the exact page closes: that would hand a
+            // person a different site/page. A lost page is terminal for this handoff.
+            page.once("close", () => {
+                if (activePage === page)
+                    activePage = null;
+            });
+        };
+        context.on("page", track);
+        const initial = context.pages().at(-1) ?? await context.newPage();
+        track(initial);
+        mcp = new McpRuntime();
+        await mcp.start({ cdpEndpoint: await cdpEndpoint(profileDir) });
+        return {
+            tools: mcp,
+            handoffPage: () => activePage && !activePage.isClosed() ? activePage : null,
+            stop: async () => {
+                if (stopped)
+                    return;
+                stopped = true;
+                activePage = null;
+                await mcp.stop().catch(() => undefined);
+                await context.close().catch(() => undefined);
+            },
+        };
+    }
+    catch (error) {
+        await mcp?.stop().catch(() => undefined);
+        await context?.close().catch(() => undefined);
+        throw error;
+    }
+}
+async function cdpEndpoint(profileDir) {
+    const portFile = join(profileDir, "DevToolsActivePort");
+    for (let i = 0; i < 50; i++) {
+        if (existsSync(portFile)) {
+            const text = await import("node:fs/promises").then(({ readFile }) => readFile(portFile, "utf8"));
+            const port = text.split("\n", 1)[0]?.trim();
+            if (port)
+                return `http://127.0.0.1:${port}`;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+    throw new Error("could not read the local application browser CDP port");
+}

package/dist/browser-runner/local-apply/runtime-handoff.js

@@ -17,8 +17,11 @@ export class LocalApplyHandoffRuntime {
             throw new RunnerInputError("A handoff already exists for this application run", 409);
         if (!this.host.takeover)
             return this.closed(run, request.handoffId, "unavailable");
+        const page = run.browser?.handoffPage?.();
+        if (!page || page.isClosed())
+            return this.closed(run, request.handoffId, "page_lost");
         try {
-            await this.host.takeover.open(request);
+            await this.host.takeover.open(request, page);
         }
         catch {
             return this.closed(run, request.handoffId, "profile_unavailable");

package/dist/browser-runner/local-apply/takeover-adapter.js

@@ -5,14 +5,12 @@ export function isLocalApplyTakeover(id) { return id.startsWith(prefix); }
 export function createLocalApplyTakeoverAdapter(deps) {
     const key = (handoffId) => `${prefix}${handoffId}`;
     return {
-        async open(request) {
-            if (request.browserProfile !== "default")
-                throw new RunnerInputError("This browser profile has no live handoff page", 409);
+        async open(request, page) {
             const id = key(request.handoffId);
             if (deps.get(id))
                 throw new RunnerInputError("A local application handoff already exists", 409);
-            // Do not create a page here: a destroyed page must remain a lost handoff, never look ready.
-            const page = deps.activePage();
+            // Do not create or substitute a page here. The runtime supplied the page retained by
+            // this exact run/profile; a destroyed page must remain a lost handoff, never look ready.
             if (!page || page.isClosed())
                 throw new RunnerInputError("The local application page is no longer available", 409);
             deps.set(id, page);

package/dist/browser-runner/runner.js

@@ -18,6 +18,7 @@ import { LocalArtifactRuntime } from "./local-artifact/runtime.js";
 import { LOCAL_ARTIFACT_TASK_TYPE } from "./local-artifact/contract.js";
 import { LocalApplyRuntime } from "./local-apply/runtime.js";
 import { LOCAL_APPLY_TASK_TYPE } from "./local-apply/contract.js";
+import { createLocalApplyBrowserFactory } from "./local-apply/live-run-browser.js";
 import { createLocalApplyTakeoverAdapter, isLocalApplyTakeover } from "./local-apply/takeover-adapter.js";
 import { WORKFLOW_DRIVEN_TASKS } from "./task-types.js";
 /** True for a plain object. */
@@ -104,13 +105,14 @@ export class LocalRunner {
             await mcp.start({ userDataDir: join(runDir, "profile"), headless: config.headless });
             return { tools: mcp, stop: () => mcp.stop() };
         };
+        const applyBrowserFor = createLocalApplyBrowserFactory({ headless: config.headless, defaultBrowser: browserFor, sharedPage: () => this.activePage });
         this.localBrowser = new LocalBrowserRuntime({ dataDir: config.dataDir, selfUrl: () => this.selfUrl, browserFor });
         this.localArtifact = new LocalArtifactRuntime({ dataDir: config.dataDir });
         this.localApply = new LocalApplyRuntime({
             dataDir: config.dataDir,
             selfUrl: () => this.selfUrl,
-            browserFor,
-            takeover: createLocalApplyTakeoverAdapter({ activePage: () => this.activePage, get: (id) => this.takeovers.get(id), set: (id, page) => this.takeovers.set(id, { page, reason: "local_apply", humanDone: false }), frame: (id) => this.takeoverFrame(id), input: (id, input) => this.takeoverInput(id, input), end: (id) => this.endTakeover(id) }),
+            browserFor: applyBrowserFor,
+            takeover: createLocalApplyTakeoverAdapter({ get: (id) => this.takeovers.get(id), set: (id, page) => this.takeovers.set(id, { page, reason: "local_apply", humanDone: false }), frame: (id) => this.takeoverFrame(id), input: (id, input) => this.takeoverInput(id, input), end: (id) => this.endTakeover(id) }),
         });
         // Tasks paused/running on a previous process are orphaned now — their
         // pages and takeover sessions are gone. Fail them so the board is clean.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-	"version": "0.4.96",
+	"version": "0.4.97",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",