firedrill-run 3.0.2 → 3.0.5

package/README.md

@@ -11,19 +11,19 @@ permissions.
 
 ## Get started
 
-Use this version explicitly while the unversioned package still points to the
-previous platform:
+Install and sign in:
 
 ```sh
-npx firedrill-run@3.0.1 init
-npx firedrill-run@3.0.1 --help
+npx firedrill-run init
+npx firedrill-run --help
 ```
 
-For automation, `firedrill --help` and `--json` describe the installed version.
+Use `firedrill --version` to read the installed package version without signing
+in. Add `--json` for structured output. Use `firedrill --help` for commands.
 
 ## Requirements
 
-- Node.js `>=22.23.4 <23`.
+- Node.js `>=22.23.4 <23 || >=24.11.1 <25 || >=26.13.1 <27`. Other major versions are not supported.
 - macOS, Windows or Linux are source-supported targets. A release qualification
   must name the actual OS/architecture used; support is not proof each platform
   was exercised. Native keyring availability also depends on its platform build.

package/bin/firedrill.mjs

@@ -2,7 +2,9 @@
 // Keep this bootstrap plain JavaScript. An unsupported Node runtime must not
 // try to parse TypeScript before it can explain the required toolchain.
 const [major, minor, patch] = process.versions.node.split('.').map(Number);
-const supported = major === 22 && (minor > 23 || minor === 23 && patch >= 4);
+const supported = major === 22 && (minor > 23 || minor === 23 && patch >= 4)
+  || major === 24 && (minor > 11 || minor === 11 && patch >= 1)
+  || major === 26 && (minor > 13 || minor === 13 && patch >= 1);
 function report(code, message, exitCode = 1) {
   process.stderr.write(process.argv.includes('--json')
     ? JSON.stringify({ type: 'error', error: { code, message } }) + '\n'
@@ -10,7 +12,31 @@ function report(code, message, exitCode = 1) {
   process.exitCode = exitCode;
 }
 if (!supported) {
-  report('node_runtime_unsupported', 'Firedrill requires Node 22.23.4 or a later 22.x release. Update Node, then run the command again.');
+  report('node_runtime_unsupported', 'Firedrill requires Node 22.23.4 or later 22.x, Node 24.11.1 or later 24.x, or Node 26.13.1 or later 26.x. Update Node, then run the command again.');
+} else if (process.argv.slice(2).some(value => value === '--version' || value === '-v')) {
+  const args = process.argv.slice(2);
+  const versionFlags = args.filter(value => value === '--version' || value === '-v');
+  if (versionFlags.length !== 1 || new Set(args).size !== args.length
+      || args.some(value => !['--version', '-v', '--json'].includes(value))) {
+    report('arguments_invalid', 'Use firedrill --version or firedrill --version --json.', 2);
+  } else {
+    try {
+      // The public assembler supplies this manifest. Do not initialize commands,
+      // credentials or network access just to read the installed package version.
+      const { readFile } = await import('node:fs/promises');
+      const manifest = JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8'));
+      if (!['firedrill-run', '@firedrill/simulation-cli'].includes(manifest.name)
+          || typeof manifest.version !== 'string'
+          || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(manifest.version)) {
+        throw new Error('version_metadata_unavailable');
+      }
+      process.stdout.write(args.includes('--json')
+        ? JSON.stringify({ type: 'version', data: { version: manifest.version } }) + '\n'
+        : manifest.version + '\n');
+    } catch {
+      report('cli_installation_unavailable', 'The installed CLI version could not be read. Restore the Firedrill installation, then try again.');
+    }
+  }
 } else {
   let entry;
   try { entry = await import('../dist/cli/src/main.js'); }

package/dist/assembly.json

@@ -1,7 +1,7 @@
 {
   "schema": "firedrill.cli-assembly.v1",
   "package": "firedrill-run",
-  "version": "3.0.2",
+  "version": "3.0.5",
   "entry": "cli/src/main.js",
   "helpers": [
     "cli/runtime/source_snapshot.py",

package/dist/cli/src/request-input.js

@@ -2,13 +2,88 @@ import { constants } from 'node:fs';
 import { lstat, open } from 'node:fs/promises';
 import { resolve } from 'node:path';
 import { CliError } from './http.js';
+/** Consume a pipe once without leaving an abort waiting for another byte. */
+async function stdinInput(signal, maximumBytes) {
+    signal.throwIfAborted();
+    const input = process.stdin;
+    if (input.isTTY || input.readableEncoding !== null) {
+        throw new CliError('request_stdin_invalid', 'Pipe one UTF-8 JSON object into --file -. Nothing was submitted.', 2);
+    }
+    const chunks = await new Promise((accept, reject) => {
+        const collected = [];
+        let size = 0;
+        let settled = false;
+        const invalid = () => new CliError('request_stdin_invalid', 'Standard input must contain one JSON object within transport capacity. Nothing was submitted.', 2);
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            input.pause();
+            input.removeListener('data', data);
+            input.removeListener('end', end);
+            input.removeListener('error', failed);
+            input.removeListener('close', closed);
+            signal.removeEventListener('abort', aborted);
+            if (error !== undefined)
+                reject(error);
+            else
+                accept(collected);
+        };
+        const data = (chunk) => {
+            if (!Buffer.isBuffer(chunk)) {
+                finish(invalid());
+                return;
+            }
+            size += chunk.length;
+            if (size > maximumBytes) {
+                finish(invalid());
+                return;
+            }
+            collected.push(Buffer.from(chunk));
+        };
+        const end = () => finish();
+        const failed = () => finish(invalid());
+        const closed = () => { if (!input.readableEnded)
+            finish(invalid()); };
+        const aborted = () => finish(signal.reason ?? new DOMException('The operation was aborted.', 'AbortError'));
+        input.on('data', data);
+        input.once('end', end);
+        input.once('error', failed);
+        input.once('close', closed);
+        signal.addEventListener('abort', aborted, { once: true });
+        // EOF or cancellation can precede listener installation. Never wait for an
+        // event that has already happened, including an idle pipe on cancellation.
+        if (signal.aborted)
+            aborted();
+        else if (input.readableEnded)
+            end();
+        else if (input.destroyed)
+            failed();
+        else
+            input.resume();
+    });
+    signal.throwIfAborted();
+    try {
+        const raw = new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks));
+        const value = JSON.parse(raw);
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new Error();
+        return raw;
+    }
+    catch {
+        throw new CliError('request_stdin_invalid', 'Standard input is not a UTF-8 JSON object. Nothing was submitted.', 2);
+    }
+}
 /** Read one bounded, unchanged JSON object without rewriting number literals. */
 export async function requestInput(path, signal, maximumBytes = 8 * 1024 * 1024) {
+    signal.throwIfAborted();
     if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 2 || maximumBytes > 8 * 1024 * 1024) {
         throw new CliError('request_capacity_invalid', 'Choose a supported request capacity.', 2);
     }
     if (!path)
         return '{}';
+    if (path === '-')
+        return stdinInput(signal, maximumBytes);
     const before = await lstat(resolve(path));
     if (!before.isFile() || before.isSymbolicLink() || before.size > maximumBytes) {
         throw new CliError('request_file_invalid', 'Choose a regular JSON file within transport capacity.', 2);

package/dist/cli/src/tool-catalog.js

@@ -206,19 +206,45 @@ export async function toolCatalogCommand(args, options, output) {
         dataset_id: null, restore: null, duration_seconds: seconds, launch_request_key: key }, output) : null;
     const body = { release_id: releaseId, duration_seconds: seconds, install_consent: true, start_consent: seconds !== null, usage_quote_id: usageQuote };
     output('catalog_setup_intent', { request_key: key, ...body }, `Catalog request: ${key}\nRecovery: tools catalog-status ${key}`);
+    const unconfirmed = (error, acceptedId) => {
+        // Preserve only the transport's typed, bounded diagnostic. Never echo its
+        // response body/message, and never infer a rejected write from HTTP status.
+        const typed = error instanceof CliError ? error : null;
+        const code = typed && /^[a-z_]{1,64}$/.test(typed.code) ? typed.code : null;
+        const httpStatus = typed?.httpStatus;
+        const status = typeof httpStatus === 'number' && Number.isInteger(httpStatus)
+            && httpStatus >= 400 && httpStatus <= 599 ? httpStatus : null;
+        const detail = code || status !== null || typed?.requestId
+            ? ` Response: ${[status === null ? null : `HTTP ${status}`, code, typed?.requestId ? `support reference ${typed.requestId}` : null].filter(Boolean).join('; ')}.` : '';
+        return new CliError(acceptedId ? 'catalog_readback_unconfirmed' : 'catalog_acceptance_unconfirmed', (acceptedId ? `Setup ${acceptedId} was accepted, but its readback could not be confirmed.` : 'Setup acceptance is unconfirmed.')
+            + detail + ` No replacement was submitted. Read tools catalog-status ${key} --workspace ${scope.workspace}.`, 1, status, typed?.requestId ?? null);
+    };
+    let accepted;
     let row;
     try {
-        const accepted = await api(`${prefix}/catalog-setups`, { ...auth, method: 'POST', idempotencyKey: key, body });
-        catalogRead(accepted, catalogSetupMatches(accepted, owner, { key, input: body }));
-        row = await readSetup(key, { id: accepted.id, input: body });
+        accepted = await api(`${prefix}/catalog-setups`, { ...auth, method: 'POST', idempotencyKey: key, body });
     }
-    catch {
+    catch (submissionError) {
+        // An answered error can follow a committed write. Recover the same key;
+        // missing/failed readback does not prove the original was never accepted.
         try {
             row = await readSetup(key, { input: body });
         }
         catch {
-            throw new CliError('catalog_acceptance_unconfirmed', `Setup acceptance is unconfirmed. No replacement was submitted. Read tools catalog-status ${key} --workspace ${scope.workspace}.`);
+            throw unconfirmed(submissionError);
         }
+        output('catalog_setup', row, text(row));
+        return;
+    }
+    // A mismatched accepted response must not be hidden by a less constrained
+    // fallback. Trust its ID only after the full original scope/input check.
+    if (!catalogSetupMatches(accepted, owner, { key, input: body }))
+        throw unconfirmed(undefined);
+    try {
+        row = await readSetup(key, { id: accepted.id, input: body });
+    }
+    catch (readbackError) {
+        throw unconfirmed(readbackError, accepted.id);
     }
     output('catalog_setup', row, text(row));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "firedrill-run",
-  "version": "3.0.2",
+  "version": "3.0.5",
   "description": "Local AI agent simulations with cloud-hosted worlds and tools",
   "type": "module",
   "bin": {
@@ -13,7 +13,7 @@
   ],
   "license": "UNLICENSED",
   "engines": {
-    "node": ">=22.23.4 <23"
+    "node": ">=22.23.4 <23 || >=24.11.1 <25 || >=26.13.1 <27"
   },
   "dependencies": {
     "@napi-rs/keyring": "2.1.2",