@thinkrun/cli 0.1.27

package/dist/src/protected-flow/detector.js

@@ -0,0 +1,75 @@
+/**
+ * Protected-flow classification: detect when an action did not change state or hit a protected element.
+ */
+import { createBlockedOutcome } from './types.js';
+/**
+ * Classify a bridge result into a blocked outcome when the bridge signals blocked.
+ * Returns null when the result does not indicate a blocked flow.
+ */
+export function classifyFromBridgeResult(data) {
+    if (!data || typeof data !== 'object')
+        return null;
+    const hint = data;
+    if (!hint.blocked)
+        return null;
+    const category = normalizeCategory(hint.blockedReason);
+    const handoffRequired = hint.handoffRequired ?? category === 'secure_hosted_field';
+    return createBlockedOutcome(category, {
+        handoffRequired,
+        target: hint.target,
+    });
+}
+function normalizeCategory(reason) {
+    if (reason === 'secure_hosted_field' || reason === 'no_op_click' ||
+        reason === 'custom_widget_mismatch' || reason === 'low_confidence') {
+        return reason;
+    }
+    if (typeof reason === 'string' && /hosted|secure|iframe|payment|auth/i.test(reason)) {
+        return 'secure_hosted_field';
+    }
+    if (typeof reason === 'string' && /no.?op|no.?change|unchanged/i.test(reason)) {
+        return 'no_op_click';
+    }
+    return 'low_confidence';
+}
+/**
+ * Classify from pre/post state comparison using StateFingerprint objects.
+ * Detects no-op actions by comparing page state before and after the action.
+ *
+ * Returns null if states differ (action had an effect) or if fingerprints are missing.
+ * Returns BlockedOutcome with 'no_op_click' if page state is unchanged.
+ */
+export function classifyFromStateCheck(actionType, preState, postState) {
+    if (preState === undefined || postState === undefined)
+        return null;
+    // Support legacy string comparison (backward compat)
+    if (typeof preState === 'string' || typeof postState === 'string') {
+        if (preState !== postState)
+            return null;
+        return createBlockedOutcome('no_op_click', { handoffRequired: false });
+    }
+    // URL changed → navigation occurred, action had an effect
+    if (preState.url !== postState.url)
+        return null;
+    // Title changed → page updated
+    if (preState.title !== postState.title)
+        return null;
+    // Form values changed → input had an effect
+    if (preState.formValues !== postState.formValues)
+        return null;
+    // Focused element changed → interaction had an effect
+    if (preState.focusedElement !== postState.focusedElement)
+        return null;
+    // Target hash changed → visible content near target updated
+    if (preState.targetHash !== undefined && postState.targetHash !== undefined &&
+        preState.targetHash !== postState.targetHash)
+        return null;
+    // Nothing changed — this was a no-op.
+    // Use action-specific message for non-click actions.
+    const outcome = createBlockedOutcome('no_op_click', { handoffRequired: false });
+    if (actionType !== 'click') {
+        outcome.message = `${actionType} did not change page state. The element may be unresponsive.`;
+    }
+    return outcome;
+}
+//# sourceMappingURL=detector.js.map

package/dist/src/protected-flow/detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector.js","sourceRoot":"","sources":["../../../src/protected-flow/detector.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAWlD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAa;IAEb,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,IAAyB,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE/B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACvD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,KAAK,qBAAqB,CAAC;IACnF,OAAO,oBAAoB,CAAC,QAAQ,EAAE;QACpC,eAAe;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAe;IACxC,IAAI,MAAM,KAAK,qBAAqB,IAAI,MAAM,KAAK,aAAa;QAC5D,MAAM,KAAK,wBAAwB,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QACvE,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpF,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9E,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAgD,EAChD,QAA+C,EAC/C,SAAgD;IAEhD,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEnE,qDAAqD;IACrD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClE,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,oBAAoB,CAAC,aAAa,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,0DAA0D;IAC1D,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEhD,+BAA+B;IAC/B,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAEpD,4CAA4C;IAC5C,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE9D,sDAAsD;IACtD,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAEtE,4DAA4D;IAC5D,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS;QACvE,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE9D,sCAAsC;IACtC,qDAAqD;IACrD,MAAM,OAAO,GAAG,oBAAoB,CAAC,aAAa,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,CAAC,OAAO,GAAG,GAAG,UAAU,8DAA8D,CAAC;IAChG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/protected-flow/types.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Structured outcomes for protected flows (hosted payment, auth, no-op interactions).
+ * Enables detect-and-stop semantics and human handoff instead of false success.
+ */
+/** Why an action was blocked. */
+export type BlockerCategory = 'secure_hosted_field' | 'no_op_click' | 'custom_widget_mismatch' | 'low_confidence';
+/** Structured blocked outcome — return this instead of success when automation cannot progress. */
+export interface BlockedOutcome {
+    success: false;
+    blocked: true;
+    handoffRequired: boolean;
+    category: BlockerCategory;
+    message: string;
+    /** Optional selector or target that was blocked. */
+    target?: string;
+}
+export declare function isBlockedOutcome(value: unknown): value is BlockedOutcome;
+/** Human-facing message for each category. */
+export declare const BLOCKER_MESSAGES: Record<BlockerCategory, string>;
+export declare function createBlockedOutcome(category: BlockerCategory, options?: {
+    handoffRequired?: boolean;
+    target?: string;
+}): BlockedOutcome;
+//# sourceMappingURL=types.d.ts.map

package/dist/src/protected-flow/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/protected-flow/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,iCAAiC;AACjC,MAAM,MAAM,eAAe,GACvB,qBAAqB,GACrB,aAAa,GACb,wBAAwB,GACxB,gBAAgB,CAAC;AAErB,mGAAmG;AACnG,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,KAAK,CAAC;IACf,OAAO,EAAE,IAAI,CAAC;IACd,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAOxE;AAED,8CAA8C;AAC9C,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAK5D,CAAC;AAEF,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,eAAe,EACzB,OAAO,GAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3D,cAAc,CAShB"}

package/dist/src/protected-flow/types.js

@@ -0,0 +1,28 @@
+/**
+ * Structured outcomes for protected flows (hosted payment, auth, no-op interactions).
+ * Enables detect-and-stop semantics and human handoff instead of false success.
+ */
+export function isBlockedOutcome(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        value.success === false &&
+        value.blocked === true);
+}
+/** Human-facing message for each category. */
+export const BLOCKER_MESSAGES = {
+    secure_hosted_field: 'Secure payment or auth field detected. Human input required.',
+    no_op_click: 'Click did not change page state. The element may be in a protected iframe or unresponsive.',
+    custom_widget_mismatch: 'Custom widget did not respond to the action. Human input may be required.',
+    low_confidence: 'Interaction path is uncertain. Consider completing this step manually.',
+};
+export function createBlockedOutcome(category, options = {}) {
+    return {
+        success: false,
+        blocked: true,
+        handoffRequired: options.handoffRequired ?? category === 'secure_hosted_field',
+        category,
+        message: BLOCKER_MESSAGES[category],
+        target: options.target,
+    };
+}
+//# sourceMappingURL=types.js.map

package/dist/src/protected-flow/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/protected-flow/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoBH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAAwB,CAAC,OAAO,KAAK,KAAK;QAC1C,KAAwB,CAAC,OAAO,KAAK,IAAI,CAC3C,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAoC;IAC/D,mBAAmB,EAAE,8DAA8D;IACnF,WAAW,EAAE,4FAA4F;IACzG,sBAAsB,EAAE,2EAA2E;IACnG,cAAc,EAAE,wEAAwE;CACzF,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAClC,QAAyB,EACzB,UAA0D,EAAE;IAE5D,OAAO;QACL,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,IAAI;QACb,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,QAAQ,KAAK,qBAAqB;QAC9E,QAAQ;QACR,OAAO,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QACnC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC"}

package/dist/src/session/agent-identity.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Agent identity — persistent `agentId` for stable tab ownership across CLI invocations.
+ *
+ * Each agent gets a stable `agentId` (prefix `agt_` + 12 hex chars) stored in
+ * `~/.thinkrun/agent.json` (or `THINKRUN_LOCK_DIR/agent.json` for tests).
+ * During the internal rebrand pass, we still fall back to legacy
+ * `THINKBROWSE_LOCK_DIR` / `~/.thinkbrowse/agent.json` if the new dir is not
+ * established yet.
+ * This ID persists across all CLI commands so the lock system can distinguish
+ * "same agent, new command" from "different competing agent".
+ *
+ * Resolution order for `resolveAgentId()`:
+ *   1. `THINKRUN_AGENT_ID` env var
+ *      (`THINKBROWSE_AGENT_ID` legacy fallback)
+ *   2. `agent.json` on disk
+ *   3. Auto-created persistent local identity in `agent.json`
+ *
+ * Only callers that explicitly opt out of persistence should ever see the
+ * legacy ephemeral fallback.
+ */
+/** Persistent agent identity stored in `~/.thinkrun/agent.json`. */
+export interface AgentIdentity {
+    /** Stable local identifier: `agt_` + 12 lowercase hex chars. */
+    agentId: string;
+    /** Optional human-readable label shown in the activity feed. */
+    name?: string;
+    /** ISO timestamp of when this identity was first created. */
+    createdAt: string;
+    /** UUID returned by `POST /api/agents` when registered with ThinkRun cloud. */
+    cloudAgentId?: string;
+}
+/** Path to the agent identity file.
+ *  Uses `THINKRUN_LOCK_DIR` (with legacy THINKBROWSE_LOCK_DIR fallback) so
+ *  test isolation applies automatically. */
+export declare function getAgentFilePath(): string;
+/** Generate a new agent ID: `agt_` followed by 12 lowercase hex characters. */
+export declare function generateAgentId(): string;
+/**
+ * Persist an agent identity to disk.
+ * Writes atomically via a temp file + rename to prevent torn writes.
+ */
+export declare function saveAgentIdentity(identity: AgentIdentity): void;
+/**
+ * Load the saved agent identity from disk.
+ * Returns `null` if the file is absent or malformed — never throws.
+ */
+export declare function loadAgentIdentity(): AgentIdentity | null;
+/**
+ * Resolve the agent ID for the current invocation.
+ *
+ * Priority:
+ *   1. `THINKRUN_AGENT_ID` environment variable (explicit override)
+ *      with `THINKBROWSE_AGENT_ID` as a legacy fallback
+ *   2. `agentId` from `~/.thinkrun/agent.json` (persistent, created by `agent-init`
+ *      or auto-created on first use)
+ *   3. Legacy ephemeral fallback derived from `process.ppid` only when the caller
+ *      explicitly disables persistence
+ *
+ * By default the CLI auto-creates and persists a stable local agent identity on
+ * first use so the no-explicit-ID path still has durable same-controller continuity.
+ */
+export declare function resolveAgentId(options?: {
+    persistIfMissing?: boolean;
+}): string;
+//# sourceMappingURL=agent-identity.d.ts.map

package/dist/src/session/agent-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-identity.d.ts","sourceRoot":"","sources":["../../../src/session/agent-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAgBD;;4CAE4C;AAC5C,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAID,+EAA+E;AAC/E,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAmBD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CAI/D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,aAAa,GAAG,IAAI,CAUxD;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,OAAO,CAAC,EAAE;IAAE,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CA2B/E"}

package/dist/src/session/agent-identity.js

@@ -0,0 +1,133 @@
+/**
+ * Agent identity — persistent `agentId` for stable tab ownership across CLI invocations.
+ *
+ * Each agent gets a stable `agentId` (prefix `agt_` + 12 hex chars) stored in
+ * `~/.thinkrun/agent.json` (or `THINKRUN_LOCK_DIR/agent.json` for tests).
+ * During the internal rebrand pass, we still fall back to legacy
+ * `THINKBROWSE_LOCK_DIR` / `~/.thinkbrowse/agent.json` if the new dir is not
+ * established yet.
+ * This ID persists across all CLI commands so the lock system can distinguish
+ * "same agent, new command" from "different competing agent".
+ *
+ * Resolution order for `resolveAgentId()`:
+ *   1. `THINKRUN_AGENT_ID` env var
+ *      (`THINKBROWSE_AGENT_ID` legacy fallback)
+ *   2. `agent.json` on disk
+ *   3. Auto-created persistent local identity in `agent.json`
+ *
+ * Only callers that explicitly opt out of persistence should ever see the
+ * legacy ephemeral fallback.
+ */
+import { existsSync, readFileSync, mkdirSync, writeFileSync, renameSync, rmSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+// ─── Directory resolution ─────────────────────────────────────────────────────
+function getLockDir() {
+    const configuredDir = process.env['THINKRUN_LOCK_DIR'] ?? process.env['THINKBROWSE_LOCK_DIR'];
+    if (configuredDir)
+        return configuredDir;
+    const thinkrunDir = join(homedir(), '.thinkrun');
+    const thinkbrowseDir = join(homedir(), '.thinkbrowse');
+    if (!existsSync(thinkrunDir) && existsSync(thinkbrowseDir)) {
+        return thinkbrowseDir;
+    }
+    return thinkrunDir;
+}
+/** Path to the agent identity file.
+ *  Uses `THINKRUN_LOCK_DIR` (with legacy THINKBROWSE_LOCK_DIR fallback) so
+ *  test isolation applies automatically. */
+export function getAgentFilePath() {
+    return join(getLockDir(), 'agent.json');
+}
+// ─── Generation ───────────────────────────────────────────────────────────────
+/** Generate a new agent ID: `agt_` followed by 12 lowercase hex characters. */
+export function generateAgentId() {
+    return 'agt_' + randomBytes(6).toString('hex');
+}
+// ─── Atomic write helper ──────────────────────────────────────────────────────
+let _atomicSeq = 0;
+function atomicWriteJson(destPath, data) {
+    const tmp = `${destPath}.${process.pid}.${_atomicSeq++}.tmp`;
+    try {
+        writeFileSync(tmp, JSON.stringify(data, null, 2), 'utf-8');
+        renameSync(tmp, destPath);
+    }
+    catch (err) {
+        try {
+            rmSync(tmp, { force: true });
+        }
+        catch { /* best-effort */ }
+        throw err;
+    }
+}
+// ─── Persistence ─────────────────────────────────────────────────────────────
+/**
+ * Persist an agent identity to disk.
+ * Writes atomically via a temp file + rename to prevent torn writes.
+ */
+export function saveAgentIdentity(identity) {
+    const dir = getLockDir();
+    mkdirSync(dir, { recursive: true });
+    atomicWriteJson(getAgentFilePath(), identity);
+}
+/**
+ * Load the saved agent identity from disk.
+ * Returns `null` if the file is absent or malformed — never throws.
+ */
+export function loadAgentIdentity() {
+    try {
+        const path = getAgentFilePath();
+        if (!existsSync(path))
+            return null;
+        const data = JSON.parse(readFileSync(path, 'utf-8'));
+        if (typeof data?.agentId !== 'string')
+            return null;
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+// ─── Resolution ──────────────────────────────────────────────────────────────
+/**
+ * Resolve the agent ID for the current invocation.
+ *
+ * Priority:
+ *   1. `THINKRUN_AGENT_ID` environment variable (explicit override)
+ *      with `THINKBROWSE_AGENT_ID` as a legacy fallback
+ *   2. `agentId` from `~/.thinkrun/agent.json` (persistent, created by `agent-init`
+ *      or auto-created on first use)
+ *   3. Legacy ephemeral fallback derived from `process.ppid` only when the caller
+ *      explicitly disables persistence
+ *
+ * By default the CLI auto-creates and persists a stable local agent identity on
+ * first use so the no-explicit-ID path still has durable same-controller continuity.
+ */
+export function resolveAgentId(options) {
+    const envId = process.env['THINKRUN_AGENT_ID'] ?? process.env['THINKBROWSE_AGENT_ID'];
+    if (envId && typeof envId === 'string' && envId.length > 0) {
+        return envId;
+    }
+    const saved = loadAgentIdentity();
+    if (saved?.agentId) {
+        return saved.agentId;
+    }
+    if (options?.persistIfMissing === false) {
+        return 'agt_' + process.ppid.toString(16).padStart(12, '0');
+    }
+    const generated = generateAgentId();
+    try {
+        saveAgentIdentity({
+            agentId: generated,
+            createdAt: new Date().toISOString(),
+        });
+    }
+    catch {
+        // Persistence failed, so fall back to the legacy deterministic shell-based
+        // identity rather than inventing a fresh controller on every invocation.
+        return 'agt_' + process.ppid.toString(16).padStart(12, '0');
+    }
+    return generated;
+}
+//# sourceMappingURL=agent-identity.js.map

package/dist/src/session/agent-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-identity.js","sourceRoot":"","sources":["../../../src/session/agent-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAgBjC,iFAAiF;AAEjF,SAAS,UAAU;IACjB,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC9F,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3D,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;4CAE4C;AAC5C,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED,iFAAiF;AAEjF,+EAA+E;AAC/E,MAAM,UAAU,eAAe;IAC7B,OAAO,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,iFAAiF;AAEjF,IAAI,UAAU,GAAG,CAAC,CAAC;AAEnB,SAAS,eAAe,CAAC,QAAgB,EAAE,IAAa;IACtD,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;IAC7D,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3D,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACjE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAuB;IACvD,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,eAAe,CAAC,gBAAgB,EAAE,EAAE,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACrD,IAAI,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO,IAAqB,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,OAAwC;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACtF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,IAAI,OAAO,EAAE,gBAAgB,KAAK,KAAK,EAAE,CAAC;QACxC,OAAO,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,iBAAiB,CAAC;YAChB,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,yEAAyE;QACzE,OAAO,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/src/session/cli-session-sync.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Opt-in CLI session persistence helpers.
+ *
+ * When a ThinkRun API key is configured, local-mode commands can
+ * optionally register a session document in the cloud activity feed so
+ * that screenshots and other actions appear in the UI alongside cloud
+ * and extension sessions.
+ *
+ * ALL exported functions are fire-and-forget — they never throw and
+ * never block the caller.  The sync is a best-effort side-channel; if
+ * the cloud API is unreachable the CLI continues to function normally.
+ *
+ * File written to disk: `~/.thinkrun/local-session-{tabId}.json`
+ * (same directory as working-location.json; THINKRUN_LOCK_DIR for
+ * test isolation).
+ */
+/**
+ * Read the persisted cloud sessionId for a given local tabId.
+ * Returns undefined if no session file exists or it is malformed.
+ */
+export declare function readCliSessionId(tabId: string): string | undefined;
+/**
+ * Call POST /api/sessions/local-init to register a CLI session in the
+ * cloud activity feed.  Persists the returned sessionId to disk.
+ *
+ * @returns The sessionId on success, undefined on any failure.
+ */
+export declare function initCliSession(tabId: string, fetchFn?: typeof fetch): Promise<string | undefined>;
+/** Action types accepted by the /local-sync/action endpoint. */
+export type BrowserActionType = 'navigate' | 'click' | 'type' | 'fill' | 'press' | 'scroll' | 'hover' | 'select' | 'wait' | 'wait_for_text' | 'extract' | 'evaluate' | 'go-back' | 'go-forward';
+/**
+ * Fire-and-forget: POST a browser action to the cloud session action log.
+ * Never throws, never blocks the caller.
+ *
+ * @param sessionId  The cloud session ID returned by initCliSession.
+ * @param type       Action type — must be in ALLOWED_ACTION_TYPES on the server.
+ * @param details    Arbitrary key-value pairs describing the action (url, selector, etc.)
+ * @param fetchFn    Injectable fetch for testing.
+ */
+export declare function syncBrowserAction(sessionId: string, type: BrowserActionType, details: Record<string, unknown>, fetchFn?: typeof fetch): void;
+/**
+ * Fire-and-forget: POST a screenshot action to the cloud session.
+ * Never throws, never blocks the caller.
+ */
+export declare function syncScreenshotAction(sessionId: string, artifactBase64: string, artifactMimeType: string, caption: string, fetchFn?: typeof fetch): void;
+/**
+ * Fire-and-forget: PATCH /api/sessions/:sessionId/local-close, then
+ * clean up the persisted session file.
+ * Never throws, never blocks the caller.
+ *
+ * The session file is deleted BEFORE the HTTP call to prevent TOCTOU
+ * races with a concurrent closeCliSessionSync (e.g. Ctrl-C fires while
+ * stopSession is already in flight).
+ */
+export declare function closeCliSession(tabId: string, status: 'completed' | 'failed', fetchFn?: typeof fetch): void;
+/** Injectable spawnSync type for testing. */
+export type SpawnSyncFn = (cmd: string, args: string[], opts: object) => unknown;
+/**
+ * Synchronous version of closeCliSession for use in process exit handlers
+ * where async operations are not guaranteed to run to completion.
+ *
+ * Uses `curl` via spawnSync (-K - to read config from stdin) so the HTTP
+ * request completes before the process exits and the API key never appears
+ * in `ps aux` / /proc/<pid>/cmdline.
+ *
+ * The session file is deleted BEFORE the HTTP request to prevent TOCTOU
+ * races with a concurrent async closeCliSession call.
+ *
+ * @param spawnFn — injectable for testing; defaults to node:child_process spawnSync
+ */
+export declare function closeCliSessionSync(tabId: string, status: 'completed' | 'failed', spawnFn?: SpawnSyncFn): void;
+//# sourceMappingURL=cli-session-sync.d.ts.map

package/dist/src/session/cli-session-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-session-sync.d.ts","sourceRoot":"","sources":["../../../src/session/cli-session-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA+CH;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASlE;AAcD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,OAAO,KAAwB,GACvC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqB7B;AAED,gEAAgE;AAChE,MAAM,MAAM,iBAAiB,GACzB,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAChD,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,eAAe,GAAG,SAAS,GACpE,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;AAE1C;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAE,OAAO,KAAwB,GACvC,IAAI,CAeN;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,OAAO,KAAwB,GACvC,IAAI,CAoBN;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,GAAG,QAAQ,EAC9B,OAAO,GAAE,OAAO,KAAwB,GACvC,IAAI,CAmBN;AAID,6CAA6C;AAC7C,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,GAAG,QAAQ,EAC9B,OAAO,GAAE,WAAuB,GAC/B,IAAI,CAmCN"}