@rackbops/ac-agent 2.0.0-alpha.56 → 2.0.0-alpha.57

package/README.md

@@ -907,7 +907,7 @@ kind's jobs, and one holding only `agent.exec.claude` never reads these):
 | `already-current` | exit 0 and the version is unchanged; winget's `0x8A15002B` (no applicable update) also maps here, and means "no newer version this machine can install", which is not always the same as "current" | for the winget code |
 | `needs-sudoers` | `apt`: `sudo -n` refused, in sudo 1.9's wording (`a password is required`, `is not in the sudoers file`, `is not allowed to execute`, `is not allowed to run sudo on`, `user <u> may not run sudo on <host>`) or sudo-rs's, the default `sudo` of recent Ubuntu (`interactive authentication is required`, `I'm afraid I can't do that`, `user <u> may not run <command> on <host>`) | the sudoers rule to add, with what it grants |
 | `needs-elevation` | `winget`: its `0x8A150019` return code (command requires administrator privileges) | the command to paste into an elevated terminal |
-| `failed` | any other non-zero exit (the last output line, printable and cut at 300 characters), winget's `0x8A150014` (no installed package with that id), the output cap, a version that cannot be read after an exit 0, a command that could not start | what failed |
+| `failed` | any other non-zero exit (the last output line that is not closing advice such as `Or consider using native installation with: claude install`, printable and cut at 300 characters), winget's `0x8A150014` (no installed package with that id), the output cap, a version that cannot be read after an exit 0, a command that could not start | what failed |
 | `timed-out` | the 15-minute limit | check the package before retrying: it may be half-installed |
 
 The winget return codes are pinned by number from winget's own generated table
@@ -918,7 +918,7 @@ package, or an installer that elevates itself, when its caller is not elevated h
 here**: it may relaunch the installer through UAC, which puts a consent prompt on the logon user's
 desktop (the agent is a logon task in that session) that the agent cannot answer; the job then waits
 until it is answered or the 15-minute limit fires (`timed-out`), and a limited `taskkill` cannot end an
-elevated installer. Anything else an installer fails with is `failed`, with its last output line.
+elevated installer. Anything else an installer fails with is `failed`, with its last output line that is not closing advice.
 
 **Audit.** Two lines in the agent log per run: `toolchain upgrade started: "<tool>" via <manager>
 <packageId> (version of <cmd>)` when the job starts (so a run the agent does not survive is on record),

package/dist/ac-agent.mjs

@@ -47,7 +47,7 @@ function _mergeNamespaces(n, m) {
 }
 
 var name = "@rackbops/ac-agent";
-var version = "2.0.0-alpha.56";
+var version = "2.0.0-alpha.57";
 var type = "module";
 var description = "The per-machine host agent (installed with npx @rackbops/ac-agent): an HTTPS health server plus install/status/uninstall for a Windows logon task or a systemd user unit.";
 var bin = {
@@ -5210,7 +5210,12 @@ function createGrantState(initial, persist) {
     let current = initial;
     return {
         revision: () => current?.revision ?? null,
-        allows: (pluginId, capability) => (current?.grants[pluginId] ?? []).includes(capability),
+        // Own keys only (#722): `grants` is parsed from JSON, a plain object, and `constructor` passes
+        // PLUGIN_ID, so a bare `grants[pluginId]` read the inherited `Object` (no `.includes`) and the
+        // guard answered 500 instead of 403.
+        allows: (pluginId, capability) => current !== null && Object.hasOwn(current.grants, pluginId)
+            ? (current.grants[pluginId] ?? []).includes(capability)
+            : false,
         replace: (set) => {
             persist(set);
             current = set;
@@ -66328,7 +66333,8 @@ const WINDOWS = {
 };
 const TIERS = [200_000, 1_000_000];
 function windowFor(model, occupancy) {
-    const win = WINDOWS[model];
+    // Own keys only (#722): `model` is text from a transcript, as in 1.x's dict lookup.
+    const win = Object.hasOwn(WINDOWS, model) ? WINDOWS[model] : undefined;
     if (win !== undefined)
         return { window: win, mapped: true };
     for (const tier of TIERS) {
@@ -66738,7 +66744,8 @@ function isPlainObject(v) {
 /** USD-equivalent for one assistant turn, at list API rates. `0` for an unpriced model -- the
  *  caller counts its tokens and surfaces the id instead of guessing. */
 function recordCost(model, usage) {
-    const rate = PRICES[model];
+    // Own keys only (#722): `model` is text from a transcript, as in 1.x's dict lookup.
+    const rate = Object.hasOwn(PRICES, model) ? PRICES[model] : undefined;
     if (!rate)
         return 0;
     const creation = isPlainObject(usage.cache_creation) ? usage.cache_creation : {};
@@ -66827,7 +66834,7 @@ function scanFile(fileBuffer, mtime, size, stem, parentName, fullPathComponents)
         turns++;
         if (model) {
             models.add(model);
-            if (!(model in PRICES))
+            if (!Object.hasOwn(PRICES, model))
                 unpriced.add(model);
         }
         cost += recordCost(model, usage);
@@ -75850,12 +75857,18 @@ function sudoersRule(username) {
 function printable(text, max) {
     return text.replace(/[^\x20-\x7e]/g, "?").slice(0, max);
 }
+/** A closing line that advises rather than reports, e.g. the Claude CLI's "Or consider using native
+ *  installation with: claude install" printed after the error that actually failed the run. */
+const ADVICE_LINE = /^(?:or\s+)?(?:consider|try|hint|tip|see|for more)(?=\s|:|$)/i;
+/** The command's last line that reports something: trailing advice lines are skipped, so the reason
+ *  is the failure and not the hint printed after it. All-advice output falls back to its last line. */
 function lastNonEmptyLine(text) {
     const lines = text
         .split(/\r?\n/)
         .map((line) => line.trim())
         .filter((line) => line !== "");
-    return printable(lines.at(-1) ?? "", MAX_REASON_CHARS);
+    const reported = lines.findLast((line) => !ADVICE_LINE.test(line));
+    return printable(reported ?? lines.at(-1) ?? "", MAX_REASON_CHARS);
 }
 function classifyOutcome(input) {
     if (input.limit === "timeout") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rackbops/ac-agent",
-  "version": "2.0.0-alpha.56",
+  "version": "2.0.0-alpha.57",
   "private": false,
   "type": "module",
   "description": "The per-machine host agent (installed with npx @rackbops/ac-agent): an HTTPS health server plus install/status/uninstall for a Windows logon task or a systemd user unit.",