pi-agent-browser-native 0.9.3 → 0.9.4

package/scripts/platform-smoke/artifacts.mjs

@@ -18,7 +18,10 @@ export function writeExitCode(dir, code, signal) {
 }
 
 export function writeSummary(dir, data) {
-	writeFileSync(resolve(dir, "summary.json"), JSON.stringify({ ...data, writtenAt: new Date().toISOString() }, null, 2));
+	writeFileSync(
+		resolve(dir, "summary.json"),
+		JSON.stringify({ ...data, writtenAt: new Date().toISOString() }, null, 2),
+	);
 }
 
 export function writeManifest(dir, expectedFiles) {
@@ -26,11 +29,16 @@ export function writeManifest(dir, expectedFiles) {
 	function walk(current) {
 		for (const entry of readdirSync(current, { withFileTypes: true })) {
 			const path = resolve(current, entry.name);
-			if (entry.isDirectory()) walk(path);
-			else if (entry.isFile()) present.push(relative(dir, path));
+			if (entry.isDirectory()) {
+				walk(path);
+			} else if (entry.isFile()) {
+				present.push(relative(dir, path));
+			}
 		}
 	}
-	if (existsSync(dir)) walk(dir);
+	if (existsSync(dir)) {
+		walk(dir);
+	}
 	const allPresent = [...new Set([...present, "artifact-manifest.json"])].sort();
 	const manifest = {
 		expected: expectedFiles,
@@ -43,7 +51,13 @@ export function writeManifest(dir, expectedFiles) {
 }
 
 export function collectSecretValues(envNames, env = process.env) {
-	return [...new Set(envNames.map((name) => env[name]).filter((value) => typeof value === "string" && value.length >= 8))];
+	return [
+		...new Set(
+			envNames
+				.map((name) => env[name])
+				.filter((value) => typeof value === "string" && value.length >= 8),
+		),
+	];
 }
 
 export function redactSecrets(text, secretValues = []) {
@@ -58,14 +72,21 @@ export function scanForSecrets(text, secretValues = []) {
 	const content = String(text ?? "");
 	const violations = [];
 	for (const secret of secretValues) {
-		if (secret && content.includes(secret)) violations.push("raw forwarded secret value");
+		if (secret && content.includes(secret)) {
+			violations.push("raw forwarded secret value");
+		}
 	}
 	for (const [pattern, label] of [
 		[/bearer\s+[A-Za-z0-9\-._~+/]{20,}=*/gi, "bearer token"],
 		[/Authorization:\s*Bearer\s+[A-Za-z0-9\-._~+/]{20,}=*/gi, "authorization header"],
-		[/(?:api[_-]?key|access[_-]?token|refresh[_-]?token|cookie)\s*[:=]\s*["']?[A-Za-z0-9_./+\-=]{20,}/gi, "token-like field"],
+		[
+			/(?:api[_-]?key|access[_-]?token|refresh[_-]?token|cookie)\s*[:=]\s*["']?[A-Za-z0-9_./+\-=]{20,}/gi,
+			"token-like field",
+		],
 	]) {
-		if (pattern.test(content)) violations.push(label);
+		if (pattern.test(content)) {
+			violations.push(label);
+		}
 	}
 	return [...new Set(violations)];
 }
@@ -79,11 +100,17 @@ export function scanArtifactTextFiles(dir, secretValues = []) {
 				walk(path);
 				continue;
 			}
-			if (!entry.isFile()) continue;
-			if (!/\.(?:txt|json|jsonl|md|log|ps1|mjs|js)$/i.test(entry.name)) continue;
+			if (!entry.isFile()) {
+				continue;
+			}
+			if (!/\.(?:txt|json|jsonl|md|log|ps1|mjs|js)$/i.test(entry.name)) {
+				continue;
+			}
 			try {
 				const text = readFileSync(path, "utf8");
-				for (const violation of scanForSecrets(text, secretValues)) findings.push({ file: relative(dir, path), violation });
+				for (const violation of scanForSecrets(text, secretValues)) {
+					findings.push({ file: relative(dir, path), violation });
+				}
 			} catch {
 				// Ignore unreadable or non-text files.
 			}

package/scripts/platform-smoke/commands.mjs

@@ -0,0 +1,104 @@
+/** Native POSIX/PowerShell platform command rendering; every required gate contributes to the final exit. */
+import { CAPABILITY_BASELINE } from "../agent-browser-capability-baseline.mjs";
+import { platformFor } from "./suite-evidence.mjs";
+
+function shellQuote(value) {
+	return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+
+function psSingleQuote(value) {
+	return `'${String(value).replace(/'/g, "''")}'`;
+}
+
+export function buildPlatformBuildCommand(targetName, packageName, nodeValidationVersion) {
+	if (platformFor(targetName) === "powershell") {
+		return `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File .\\scripts\\platform-smoke\\platform-build-windows.ps1 -PackageName ${psSingleQuote(packageName)} -NodeValidationVersion ${psSingleQuote(nodeValidationVersion)}`;
+	}
+	return [
+		`echo "Starting platform-build in $(pwd) at $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,
+		`RUN_ROOT=".platform-smoke-runs/platform-build-$(date -u +%Y%m%dT%H%M%SZ)-$$"`,
+		`SOURCE_ROOT="$(pwd)"`,
+		`PACK_DIR="$SOURCE_ROOT/$RUN_ROOT/pack"`,
+		`PI_PROJECT="$SOURCE_ROOT/$RUN_ROOT/pi-project"`,
+		`mkdir -p "$PACK_DIR" "$PI_PROJECT"`,
+		`echo "PLATFORM_RUN_ROOT=$RUN_ROOT"`,
+		`NODE_VERSION=$(node --version)`,
+		`echo "PLATFORM_NODE_VERSION=$NODE_VERSION"`,
+		`if node -e 'process.exit(process.versions.node.localeCompare(process.argv[1], undefined, { numeric: true }) < 0 ? 1 : 0)' ${shellQuote(nodeValidationVersion)}; then NODE_VERSION_EXIT=0; else NODE_VERSION_EXIT=1; fi`,
+		`echo "PLATFORM_NODE_VERSION_EXIT=$NODE_VERSION_EXIT"`,
+		`npm ci 2>&1`,
+		`NPM_CI_EXIT=$?`,
+		`echo "PLATFORM_NPM_CI_EXIT=$NPM_CI_EXIT"`,
+		`npm run verify -- platform-target 2>&1`,
+		`VERIFY_EXIT=$?`,
+		`echo "PLATFORM_VERIFY_EXIT=$VERIFY_EXIT"`,
+		`PACK_TARBALL=$(npm pack --silent --pack-destination "$PACK_DIR" 2>"$PACK_DIR/npm-pack.stderr.txt")`,
+		`PACK_EXIT=$?`,
+		`cat "$PACK_DIR/npm-pack.stderr.txt"`,
+		`PACK_FILE="$PACK_DIR/$PACK_TARBALL"`,
+		`echo "PLATFORM_NPM_PACK_EXIT=$PACK_EXIT"`,
+		`echo "PLATFORM_PACKED_TARBALL=$PACK_FILE"`,
+		`PI_CLI="$SOURCE_ROOT/node_modules/.bin/pi"`,
+		`if [ ! -x "$PI_CLI" ]; then PI_CLI="$(command -v pi || true)"; fi`,
+		`echo "PLATFORM_PI_CLI=$PI_CLI"`,
+		`if [ -n "$PACK_TARBALL" ] && [ -f "$PACK_FILE" ]; then (cd "$PI_PROJECT" && npm init -y >"$PACK_DIR/packed-node-install.stdout.txt" 2>"$PACK_DIR/packed-node-install.stderr.txt" && npm install --no-save "$PACK_FILE" >>"$PACK_DIR/packed-node-install.stdout.txt" 2>>"$PACK_DIR/packed-node-install.stderr.txt"); PACKED_NODE_INSTALL_EXIT=$?; else echo "missing tarball" >"$PACK_DIR/packed-node-install.stderr.txt"; PACKED_NODE_INSTALL_EXIT=1; fi`,
+		`echo "PLATFORM_PACKED_NODE_INSTALL_EXIT=$PACKED_NODE_INSTALL_EXIT"`,
+		`echo "--- PACKED_NODE_INSTALL_STDOUT START ---"; cat "$PACK_DIR/packed-node-install.stdout.txt" 2>/dev/null || true; echo "--- PACKED_NODE_INSTALL_STDOUT END ---"`,
+		`echo "--- PACKED_NODE_INSTALL_STDERR START ---"; cat "$PACK_DIR/packed-node-install.stderr.txt" 2>/dev/null || true; echo "--- PACKED_NODE_INSTALL_STDERR END ---"`,
+		`if [ "$PACKED_NODE_INSTALL_EXIT" -eq 0 ] && [ -n "$PI_CLI" ]; then (cd "$PI_PROJECT" && PI_OFFLINE=1 "$PI_CLI" install -l --approve ./node_modules/${packageName} >"$PACK_DIR/pi-install.stdout.txt" 2>"$PACK_DIR/pi-install.stderr.txt"); PI_INSTALL_EXIT=$?; else echo "missing pi cli or packed install" >"$PACK_DIR/pi-install.stderr.txt"; PI_INSTALL_EXIT=1; fi`,
+		`echo "PLATFORM_PI_INSTALL_EXIT=$PI_INSTALL_EXIT"`,
+		`echo "--- PI_INSTALL_STDOUT START ---"; cat "$PACK_DIR/pi-install.stdout.txt" 2>/dev/null || true; echo "--- PI_INSTALL_STDOUT END ---"`,
+		`echo "--- PI_INSTALL_STDERR START ---"; cat "$PACK_DIR/pi-install.stderr.txt" 2>/dev/null || true; echo "--- PI_INSTALL_STDERR END ---"`,
+		`if [ -n "$PI_CLI" ]; then (cd "$PI_PROJECT" && PI_OFFLINE=1 "$PI_CLI" list --approve >"$PACK_DIR/pi-list.stdout.txt" 2>"$PACK_DIR/pi-list.stderr.txt"); PI_LIST_EXIT=$?; else echo "missing pi cli" >"$PACK_DIR/pi-list.stderr.txt"; PI_LIST_EXIT=1; fi`,
+		`echo "PLATFORM_PI_LIST_EXIT=$PI_LIST_EXIT"`,
+		`echo "--- PI_LIST_STDOUT START ---"; cat "$PACK_DIR/pi-list.stdout.txt" 2>/dev/null || true; echo "--- PI_LIST_STDOUT END ---"`,
+		`echo "--- PI_LIST_STDERR START ---"; cat "$PACK_DIR/pi-list.stderr.txt" 2>/dev/null || true; echo "--- PI_LIST_STDERR END ---"`,
+		`if [ "$NODE_VERSION_EXIT" -ne 0 ] || [ "$NPM_CI_EXIT" -ne 0 ] || [ "$VERIFY_EXIT" -ne 0 ] || [ "$PACK_EXIT" -ne 0 ] || [ "$PACKED_NODE_INSTALL_EXIT" -ne 0 ] || [ "$PI_INSTALL_EXIT" -ne 0 ] || [ "$PI_LIST_EXIT" -ne 0 ]; then echo "PLATFORM_BUILD_FAILED"; exit 1; fi`,
+		`echo "PLATFORM_BUILD_OK"`,
+	].join("\n");
+}
+
+export function buildBrowserDogfoodCommand(
+	targetName,
+	agentBrowserVersion = CAPABILITY_BASELINE.targetVersion,
+	dependenciesReady = false,
+) {
+	if (platformFor(targetName) === "powershell") {
+		return `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File .\\scripts\\platform-smoke\\browser-dogfood-windows.ps1 -AgentBrowserVersion ${psSingleQuote(agentBrowserVersion)}${dependenciesReady ? " -SkipNpmCi" : ""}`;
+	}
+	return [
+		`echo "Starting browser-dogfood-smoke in $(pwd) at $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,
+		`RUN_ROOT=".platform-smoke-runs/browser-dogfood-$(date -u +%Y%m%dT%H%M%SZ)-$$"`,
+		`SOURCE_ROOT="$(pwd)"`,
+		`DOGFOOD_DIR="$SOURCE_ROOT/$RUN_ROOT/dogfood"`,
+		`DOGFOOD_ARTIFACT_DIR="$DOGFOOD_DIR/artifacts"`,
+		`mkdir -p "$DOGFOOD_ARTIFACT_DIR"`,
+		`echo "PLATFORM_RUN_ROOT=$RUN_ROOT"`,
+		`echo "PLATFORM_DOGFOOD_ARTIFACT_DIR=$DOGFOOD_ARTIFACT_DIR"`,
+		`NODE_VERSION=$(node --version)`,
+		`NODE_MAJOR="${"${NODE_VERSION#v}"}"`,
+		`NODE_MAJOR="${"${NODE_MAJOR%%.*}"}"`,
+		`echo "PLATFORM_NODE_VERSION=$NODE_VERSION"`,
+		`EXPECTED_AGENT_BROWSER_VERSION=${shellQuote(`agent-browser ${agentBrowserVersion}`)}`,
+		`AGENT_BROWSER_VERSION_OUTPUT=$(agent-browser --version 2>&1)`,
+		`AGENT_BROWSER_VERSION_COMMAND_EXIT=$?`,
+		`echo "PLATFORM_AGENT_BROWSER_VERSION=$AGENT_BROWSER_VERSION_OUTPUT"`,
+		`if [ "$AGENT_BROWSER_VERSION_COMMAND_EXIT" -eq 0 ] && [ "$AGENT_BROWSER_VERSION_OUTPUT" = "$EXPECTED_AGENT_BROWSER_VERSION" ]; then AGENT_BROWSER_READY_EXIT=0; else AGENT_BROWSER_READY_EXIT=1; fi`,
+		`echo "PLATFORM_AGENT_BROWSER_READY_EXIT=$AGENT_BROWSER_READY_EXIT"`,
+		...(dependenciesReady
+			? [
+					`if [ -d node_modules ]; then echo "PLATFORM_NPM_CI_SKIPPED=1"; NPM_CI_EXIT=0; else npm ci 2>&1; NPM_CI_EXIT=$?; fi`,
+				]
+			: [`npm ci 2>&1`, `NPM_CI_EXIT=$?`]),
+		`echo "PLATFORM_NPM_CI_EXIT=$NPM_CI_EXIT"`,
+		`TSX_CLI="$SOURCE_ROOT/node_modules/.bin/tsx"`,
+		`if [ ! -x "$TSX_CLI" ]; then TSX_CLI="$(command -v tsx || true)"; fi`,
+		`echo "PLATFORM_TSX_CLI=$TSX_CLI"`,
+		`if [ "$NPM_CI_EXIT" -eq 0 ] && [ "$AGENT_BROWSER_READY_EXIT" -eq 0 ] && [ -n "$TSX_CLI" ]; then "$TSX_CLI" scripts/verify-agent-browser-dogfood.ts --artifact-dir "$DOGFOOD_ARTIFACT_DIR" --json >"$DOGFOOD_DIR/dogfood.stdout.txt" 2>"$DOGFOOD_DIR/dogfood.stderr.txt"; DOGFOOD_EXIT=$?; else echo "missing tsx, npm ci failed, or agent-browser baseline mismatch" >"$DOGFOOD_DIR/dogfood.stderr.txt"; DOGFOOD_EXIT=1; fi`,
+		`echo "PLATFORM_DOGFOOD_EXIT=$DOGFOOD_EXIT"`,
+		`echo "--- DOGFOOD_STDOUT START ---"; cat "$DOGFOOD_DIR/dogfood.stdout.txt" 2>/dev/null || true; echo "--- DOGFOOD_STDOUT END ---"`,
+		`echo "--- DOGFOOD_STDERR START ---"; cat "$DOGFOOD_DIR/dogfood.stderr.txt" 2>/dev/null || true; echo "--- DOGFOOD_STDERR END ---"`,
+		`if [ "$NPM_CI_EXIT" -ne 0 ] || [ "$AGENT_BROWSER_READY_EXIT" -ne 0 ] || [ "$DOGFOOD_EXIT" -ne 0 ]; then echo "PLATFORM_BROWSER_DOGFOOD_FAILED"; exit 1; fi`,
+		`echo "PLATFORM_BROWSER_DOGFOOD_OK"`,
+	].join("\n");
+}

package/scripts/platform-smoke/crabbox-runner.mjs

@@ -18,68 +18,110 @@ function packageSlug(config = {}) {
 	return process.env.PLATFORM_SMOKE_PACKAGE_SLUG || config.packageName || "pi-agent-browser-native";
 }
 
-export function describeTarget(targetName, config = {}) {
+function targetSetting(name, configured, fallback) {
+	return env(name) || configured || fallback;
+}
+
+function describeMacTarget(config) {
 	const slug = packageSlug(config);
+	const user = env("PLATFORM_SMOKE_MAC_USER") || env("USER");
+	const host = targetSetting("PLATFORM_SMOKE_MAC_HOST", config.macos?.host, "localhost");
+	const port = String(targetSetting("PLATFORM_SMOKE_MAC_PORT", config.macos?.port, 22));
+	const workRoot =
+		env("PLATFORM_SMOKE_MAC_WORK_ROOT") ||
+		config.macos?.workRoot ||
+		`/Users/${user}/crabbox/${slug}`;
+	return {
+		provider: "ssh",
+		crabboxTarget: "macos",
+		shell: "posix",
+		workRoot,
+		args: [
+			"--provider",
+			"ssh",
+			"--target",
+			"macos",
+			"--static-host",
+			host,
+			"--static-user",
+			user,
+			"--static-port",
+			port,
+			"--static-work-root",
+			workRoot,
+		],
+	};
+}
+
+function describeUbuntuTarget(config) {
+	const image =
+		env("PLATFORM_SMOKE_UBUNTU_IMAGE") || config.ubuntuContainerImage || DEFAULT_UBUNTU_IMAGE;
+	return {
+		provider: "local-container",
+		crabboxTarget: "linux",
+		shell: "posix",
+		image,
+		workRoot: config.localContainer?.workRoot || "/work/crabbox",
+		args: ["--provider", "local-container", "--target", "linux", "--local-container-image", image],
+	};
+}
+
+function describeWindowsTarget(config) {
+	const slug = packageSlug(config);
+	const vm = targetSetting(
+		"PLATFORM_SMOKE_WINDOWS_VM",
+		config.windowsParallels?.sourceVm,
+		"pi-extension-windows-template",
+	);
+	const snapshot = targetSetting(
+		"PLATFORM_SMOKE_WINDOWS_SNAPSHOT",
+		config.windowsParallels?.snapshot,
+		"crabbox-ready",
+	);
+	const user = targetSetting(
+		"PLATFORM_SMOKE_WINDOWS_USER",
+		config.windowsParallels?.user,
+		env("USER"),
+	);
+	const workRoot =
+		env("PLATFORM_SMOKE_WINDOWS_WORK_ROOT") ||
+		config.windowsParallels?.workRoot ||
+		`C:\\crabbox\\${slug}`;
+	return {
+		provider: "parallels",
+		crabboxTarget: "windows",
+		shell: "powershell",
+		workRoot,
+		windowsMode: "normal",
+		sourceVm: vm,
+		snapshot,
+		args: [
+			"--provider",
+			"parallels",
+			"--target",
+			"windows",
+			"--windows-mode",
+			"normal",
+			"--parallels-source",
+			vm,
+			"--parallels-source-snapshot",
+			snapshot,
+			"--parallels-user",
+			user,
+			"--parallels-work-root",
+			workRoot,
+		],
+	};
+}
+
+export function describeTarget(targetName, config = {}) {
 	switch (targetName) {
-		case "macos": {
-			const user = env("PLATFORM_SMOKE_MAC_USER") || env("USER");
-			const host = env("PLATFORM_SMOKE_MAC_HOST") || config.macos?.host || "localhost";
-			const port = String(env("PLATFORM_SMOKE_MAC_PORT") || config.macos?.port || 22);
-			const workRoot = env("PLATFORM_SMOKE_MAC_WORK_ROOT") || config.macos?.workRoot || `/Users/${user}/crabbox/${slug}`;
-			return {
-				provider: "ssh",
-				crabboxTarget: "macos",
-				shell: "posix",
-				workRoot,
-				args: [
-					"--provider", "ssh",
-					"--target", "macos",
-					"--static-host", host,
-					"--static-user", user,
-					"--static-port", port,
-					"--static-work-root", workRoot,
-				],
-			};
-		}
-		case "ubuntu": {
-			const image = env("PLATFORM_SMOKE_UBUNTU_IMAGE") || config.ubuntuContainerImage || DEFAULT_UBUNTU_IMAGE;
-			return {
-				provider: "local-container",
-				crabboxTarget: "linux",
-				shell: "posix",
-				image,
-				workRoot: config.localContainer?.workRoot || "/work/crabbox",
-				args: [
-					"--provider", "local-container",
-					"--target", "linux",
-					"--local-container-image", image,
-				],
-			};
-		}
-		case "windows-native": {
-			const vm = env("PLATFORM_SMOKE_WINDOWS_VM") || config.windowsParallels?.sourceVm || "pi-extension-windows-template";
-			const snapshot = env("PLATFORM_SMOKE_WINDOWS_SNAPSHOT") || config.windowsParallels?.snapshot || "crabbox-ready";
-			const user = env("PLATFORM_SMOKE_WINDOWS_USER") || config.windowsParallels?.user || env("USER");
-			const workRoot = env("PLATFORM_SMOKE_WINDOWS_WORK_ROOT") || config.windowsParallels?.workRoot || `C:\\crabbox\\${slug}`;
-			return {
-				provider: "parallels",
-				crabboxTarget: "windows",
-				shell: "powershell",
-				workRoot,
-				windowsMode: "normal",
-				sourceVm: vm,
-				snapshot,
-				args: [
-					"--provider", "parallels",
-					"--target", "windows",
-					"--windows-mode", "normal",
-					"--parallels-source", vm,
-					"--parallels-source-snapshot", snapshot,
-					"--parallels-user", user,
-					"--parallels-work-root", workRoot,
-				],
-			};
-		}
+		case "macos":
+			return describeMacTarget(config);
+		case "ubuntu":
+			return describeUbuntuTarget(config);
+		case "windows-native":
+			return describeWindowsTarget(config);
 		default:
 			throw new Error(`unknown platform smoke target: ${targetName}`);
 	}
@@ -90,14 +132,14 @@ export function buildTargetBaseArgs(targetName, config = {}) {
 }
 
 export function leaseIdFor(targetName, slug) {
-	if (targetName === "macos") return "static_localhost";
+	if (targetName === "macos") {
+		return "static_localhost";
+	}
 	return slug;
 }
 
 function parseLeaseId(text) {
-	return text.match(/\bleased\s+(\S+)/)?.[1]
-		?? text.match(/\blease=(\S+)/)?.[1]
-		?? null;
+	return text.match(/\bleased\s+(\S+)/)?.[1] ?? text.match(/\blease=(\S+)/)?.[1] ?? null;
 }
 
 export function execCrabbox(args, options = {}) {
@@ -112,31 +154,63 @@ export function execCrabbox(args, options = {}) {
 		let killTimeout;
 		if (options.timeout) {
 			timeout = setTimeout(() => {
-				stderr.push(Buffer.from(`\n[platform-smoke] crabbox timed out after ${options.timeout}ms\n`));
-				try { child.kill("SIGTERM"); } catch {}
+				stderr.push(
+					Buffer.from(`\n[platform-smoke] crabbox timed out after ${options.timeout}ms\n`),
+				);
+				try {
+					child.kill("SIGTERM");
+				} catch {
+					// A concurrently exited child needs no signal; its close/error receipt settles the run.
+				}
 				killTimeout = setTimeout(() => {
-					try { child.kill("SIGKILL"); } catch {}
+					try {
+						child.kill("SIGKILL");
+					} catch {
+						// A concurrently exited child needs no signal; its close/error receipt settles the run.
+					}
 				}, 10_000);
 			}, options.timeout);
 		}
 		child.stdout.on("data", (chunk) => stdout.push(chunk));
 		child.stderr.on("data", (chunk) => stderr.push(chunk));
 		child.on("error", (error) => {
-			if (timeout) clearTimeout(timeout);
-			if (killTimeout) clearTimeout(killTimeout);
-			resolvePromise({ stdout: Buffer.concat(stdout).toString(), stderr: `${Buffer.concat(stderr).toString()}${error.message}\n`, code: 1, signal: null });
+			if (timeout) {
+				clearTimeout(timeout);
+			}
+			if (killTimeout) {
+				clearTimeout(killTimeout);
+			}
+			resolvePromise({
+				stdout: Buffer.concat(stdout).toString(),
+				stderr: `${Buffer.concat(stderr).toString()}${error.message}\n`,
+				code: 1,
+				signal: null,
+			});
 		});
 		child.on("close", (code, signal) => {
-			if (timeout) clearTimeout(timeout);
-			if (killTimeout) clearTimeout(killTimeout);
-			resolvePromise({ stdout: Buffer.concat(stdout).toString(), stderr: Buffer.concat(stderr).toString(), code: code ?? (signal ? 1 : 0), signal });
+			if (timeout) {
+				clearTimeout(timeout);
+			}
+			if (killTimeout) {
+				clearTimeout(killTimeout);
+			}
+			resolvePromise({
+				stdout: Buffer.concat(stdout).toString(),
+				stderr: Buffer.concat(stderr).toString(),
+				code: code ?? (signal ? 1 : 0),
+				signal,
+			});
 		});
 	});
 }
 
 function isRetryableWarmupFailure(targetName, result) {
-	if (targetName !== "windows-native" || result.code === 0) return false;
-	return /Could not create a linked clone of the virtual hard disk|due to an internal error|context canceled|timed out after 300000ms/i.test(`${result.stdout}\n${result.stderr}`);
+	if (targetName !== "windows-native" || result.code === 0) {
+		return false;
+	}
+	return /Could not create a linked clone of the virtual hard disk|due to an internal error|context canceled|timed out after 300000ms/i.test(
+		`${result.stdout}\n${result.stderr}`,
+	);
 }
 
 export async function warmupLease(targetName, slug, config = {}) {
@@ -144,8 +218,14 @@ export async function warmupLease(targetName, slug, config = {}) {
 	let result;
 	for (let attempt = 1; attempt <= 2; attempt += 1) {
 		console.log(`  [crabbox] ${args.join(" ")}${attempt > 1 ? ` (retry ${attempt})` : ""}`);
+		// The retry depends on the prior warmup receipt and its completed stale-lease cleanup.
+		// oxlint-disable-next-line no-await-in-loop
 		result = await execCrabbox(args, { timeout: 300_000 });
-		if (!isRetryableWarmupFailure(targetName, result)) break;
+		if (!isRetryableWarmupFailure(targetName, result)) {
+			break;
+		}
+		// Stop stale target resources before a retry can acquire another lease.
+		// oxlint-disable-next-line no-await-in-loop
 		await cleanupStaleTargetState(targetName, config);
 	}
 	return {
@@ -160,10 +240,15 @@ export async function runOnLease(targetName, leaseId, command, options = {}) {
 	for (const name of options.allowEnv ?? []) {
 		args.push("--allow-env", name);
 	}
-	if (options.sync === false) args.push("--no-sync");
-	else args.push("--fresh-sync");
+	if (options.sync === false) {
+		args.push("--no-sync");
+	} else {
+		args.push("--fresh-sync");
+	}
 	args.push("--shell", command);
-	console.log(`  [crabbox] run ${targetName} ${options.sync === false ? "--no-sync" : "--fresh-sync"}`);
+	console.log(
+		`  [crabbox] run ${targetName} ${options.sync === false ? "--no-sync" : "--fresh-sync"}`,
+	);
 	return execCrabbox(args, { timeout: options.timeout ?? 900_000 });
 }
 
@@ -174,7 +259,9 @@ export async function stopLease(targetName, leaseId, config = {}) {
 }
 
 export async function cleanupStaleTargetState(targetName, config = {}) {
-	if (targetName === "macos") return null;
+	if (targetName === "macos") {
+		return null;
+	}
 	const args = ["cleanup", ...buildTargetBaseArgs(targetName, config)];
 	console.log(`  [crabbox] ${args.join(" ")}`);
 	return execCrabbox(args, { timeout: 120_000 });

package/scripts/platform-smoke/doctor-support.mjs

@@ -0,0 +1,157 @@
+/** Read-only host/process inspection and platform-doctor report ownership. */
+import { execFileSync, execSync } from "node:child_process";
+import { mkdirSync, unlinkSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+export function env(name) {
+	return process.env[name] ?? "";
+}
+export function setting(name, configured, fallback) {
+	return env(name) || configured || fallback;
+}
+
+export function createReporter() {
+	let count = 0;
+	return {
+		ok(label) {
+			console.log(`  ✓ ${label}`);
+		},
+		warn(label) {
+			console.log(`  ⚠ ${label}`);
+		},
+		fail(label) {
+			console.error(`  ✗ ${label}`);
+			count += 1;
+		},
+		get count() {
+			return count;
+		},
+	};
+}
+
+export function silent(cmd, args, options = {}) {
+	try {
+		return execFileSync(cmd, args, { timeout: 20_000, stdio: "pipe", ...options })
+			.toString()
+			.trim();
+	} catch {
+		return null;
+	}
+}
+export function shell(command, options = {}) {
+	try {
+		return execSync(command, { timeout: 20_000, stdio: "pipe", ...options })
+			.toString()
+			.trim();
+	} catch {
+		return null;
+	}
+}
+export function commandPath(name) {
+	return silent("which", [name]);
+}
+
+function parseVersion(version) {
+	const match = String(version).match(/\d+(?:\.\d+){0,2}/);
+	return match ? match[0].split(".").map((part) => Number(part)) : null;
+}
+export function versionAtLeast(actual, minimum) {
+	const a = parseVersion(actual);
+	const b = parseVersion(minimum);
+	if (!a || !b) {
+		return false;
+	}
+	for (let index = 0; index < Math.max(a.length, b.length); index += 1) {
+		const left = a[index] ?? 0;
+		const right = b[index] ?? 0;
+		if (left > right) {
+			return true;
+		}
+		if (left < right) {
+			return false;
+		}
+	}
+	return true;
+}
+
+function isForbiddenProjectPath(path) {
+	return (
+		/(^|\/)\.env(?:\..*)?$/.test(path) ||
+		/(^|\/)[^/]+\.tgz$/.test(path) ||
+		/(^|\/)\.artifacts(?:\/|$)/.test(path) ||
+		/(^|\/)\.crabbox(?:\/|$)/.test(path) ||
+		/(^|\/)\.debug(?:\/|$)/.test(path) ||
+		/(^|\/)\.platform-smoke-runs(?:\/|$)/.test(path)
+	);
+}
+function npmPackFiles() {
+	const output = silent("npm", ["pack", "--dry-run", "--json"]);
+	if (!output) {
+		return null;
+	}
+	try {
+		return JSON.parse(output)[0]?.files?.map((file) => file.path) ?? [];
+	} catch {
+		return null;
+	}
+}
+
+export function checkForbiddenProjectFiles(report) {
+	const tracked = shell("git ls-files")?.split(/\r?\n/).filter(Boolean) ?? [];
+	const trackedForbidden = tracked.filter(isForbiddenProjectPath);
+	if (trackedForbidden.length === 0) {
+		report.ok("tracked source files exclude forbidden local artifacts");
+	} else {
+		report.fail(`forbidden tracked source path(s): ${trackedForbidden.join(", ")}`);
+	}
+	const localForbidden =
+		shell(
+			"find . -maxdepth 2 \\( -name '.env' -o -name '.env.*' -o -name '*.tgz' \\) -not -path './node_modules/*' 2>/dev/null",
+		)
+			?.split(/\r?\n/)
+			.filter(Boolean) ?? [];
+	if (localForbidden.length === 0) {
+		report.ok("no local .env or package tarball artifacts at repo top level");
+	} else {
+		report.fail(`forbidden local artifact(s): ${localForbidden.join(", ")}`);
+	}
+	const packFiles = npmPackFiles();
+	if (!packFiles) {
+		report.fail("could not inspect npm pack contents");
+		return;
+	}
+	const packedForbidden = packFiles.filter(isForbiddenProjectPath);
+	if (packedForbidden.length === 0) {
+		report.ok("npm package excludes forbidden local artifacts");
+	} else {
+		report.fail(`forbidden npm package path(s): ${packedForbidden.join(", ")}`);
+	}
+}
+
+export function checkArtifactRoot(artifactRoot, report) {
+	console.log("\n── Artifact root ──");
+	const artRoot = resolve(process.cwd(), artifactRoot);
+	try {
+		mkdirSync(artRoot, { recursive: true });
+		const probe = resolve(artRoot, ".doctor-write-test");
+		writeFileSync(probe, "ok");
+		unlinkSync(probe);
+		report.ok(`writable: ${artRoot}`);
+	} catch (error) {
+		report.fail(`artifact root not writable: ${error.message}`);
+	}
+}
+
+export function checkAgentBrowserVersion(expectedVersion, report, command = "agent-browser") {
+	const version = shell(`${command} --version`);
+	if (!version) {
+		report.fail(`${command} not found or did not report a version`);
+		return;
+	}
+	const firstLine = version.split(/\r?\n/)[0];
+	if (!expectedVersion || firstLine.includes(expectedVersion)) {
+		report.ok(`${command}: ${firstLine}`);
+	} else {
+		report.fail(`${command} version ${firstLine} does not match expected ${expectedVersion}`);
+	}
+}