pi-agent-browser-native 0.9.5 → 0.9.7

package/scripts/platform-smoke/linux-image/Dockerfile

@@ -1,6 +1,6 @@
 # Local Crabbox Ubuntu/Linux target image for pi-agent-browser-native platform smoke.
-# Build with npm run smoke:platform:ubuntu-image so the agent-browser version
-# comes from scripts/agent-browser-capability-baseline.mjs. The Go toolchain
+# Build with npm run smoke:platform:ubuntu-image to check the latest stock
+# agent-browser against the audited capability baseline. The Go toolchain
 # matches the version scripts/prepare-quality-checker.mjs selects for the
 # corrected quality checker that platform-target builds.
 
@@ -15,7 +15,10 @@ COPY --from=go /usr/local/go /usr/local/go
 RUN ln -s /usr/local/go/bin/go /usr/local/go/bin/gofmt /usr/local/bin/ \
 	&& apt-get update \
 	&& apt-get install -y --no-install-recommends ca-certificates chromium fonts-liberation git libvulkan1 mesa-vulkan-drivers openssh-client tar xvfb \
-	&& npm install -g "agent-browser@${AGENT_BROWSER_VERSION}" \
+	&& npm install -g agent-browser --allow-scripts=agent-browser \
+	&& actual="$(agent-browser --version)" \
+	&& printf 'Installed %s; audited baseline agent-browser %s\n' "$actual" "$AGENT_BROWSER_VERSION" \
+	&& test "$actual" = "agent-browser $AGENT_BROWSER_VERSION" \
 	&& groupadd -g 1002 circleci \
 	&& useradd -m -u 1001 -g 1002 -s /bin/bash circleci \
 	&& mkdir -p /work/crabbox /home/circleci/.cache \

package/scripts/platform-smoke/platform-build-windows.ps1

@@ -1,6 +1,8 @@
 param(
   [Parameter(Mandatory=$true)][string]$PackageName,
-  [Parameter(Mandatory=$true)][string]$NodeValidationVersion
+  [Parameter(Mandatory=$true)][string]$NodeValidationVersion,
+  [string]$CandidatePath = "",
+  [string]$CandidateSha256 = ""
 )
 
 $ErrorActionPreference = "Continue"
@@ -40,6 +42,17 @@ $PackTarball = ($PackOutput | Select-Object -Last 1)
 $PackFile = if ($PackTarball) { Join-Path $PackDir $PackTarball } else { "" }
 if (Test-Path $PackStderr) { Get-Content -Raw $PackStderr }
 Write-Output "PLATFORM_NPM_PACK_EXIT=$PackExit"
+$CandidateExit = 0
+if ($CandidatePath) {
+  $PackFile = Join-Path $PackDir "release-candidate.tgz"
+  $CandidateBefore = ""
+  try {
+    Copy-Item -LiteralPath (Join-Path $SourceRoot $CandidatePath) -Destination $PackFile -ErrorAction Stop
+    $CandidateBefore = (Get-FileHash -LiteralPath $PackFile -Algorithm SHA256 -ErrorAction Stop).Hash.ToLowerInvariant()
+  } catch { $CandidateExit = 1 }
+  Write-Output "PLATFORM_CANDIDATE_SHA256_BEFORE=$CandidateBefore"
+  if ($CandidateBefore -ne $CandidateSha256) { $CandidateExit = 1 }
+}
 Write-Output "PLATFORM_PACKED_TARBALL=$PackFile"
 
 $PiCli = Join-Path $SourceRoot "node_modules/.bin/pi.cmd"
@@ -49,7 +62,7 @@ Write-Output "PLATFORM_PI_CLI=$PiCli"
 
 $PackedNodeInstallStdout = Join-Path $PackDir "packed-node-install.stdout.txt"
 $PackedNodeInstallStderr = Join-Path $PackDir "packed-node-install.stderr.txt"
-if ($PackFile -and (Test-Path $PackFile)) {
+if ($CandidateExit -eq 0 -and $PackFile -and (Test-Path $PackFile)) {
   Push-Location $PiProject
   & npm init -y >$PackedNodeInstallStdout 2>$PackedNodeInstallStderr
   if ($LASTEXITCODE -eq 0) {
@@ -94,7 +107,14 @@ Write-Output "PLATFORM_PI_LIST_EXIT=$PiListExit"
 Write-Section "PI_LIST_STDOUT" $PiListStdout
 Write-Section "PI_LIST_STDERR" $PiListStderr
 
-if ($NodeVersionExit -ne 0 -or $NpmCiExit -ne 0 -or $VerifyExit -ne 0 -or $PackExit -ne 0 -or $PackedNodeInstallExit -ne 0 -or $PiInstallExit -ne 0 -or $PiListExit -ne 0) {
+if ($CandidatePath) {
+  $CandidateAfter = ""
+  try { $CandidateAfter = (Get-FileHash -LiteralPath $PackFile -Algorithm SHA256 -ErrorAction Stop).Hash.ToLowerInvariant() } catch { $CandidateExit = 1 }
+  Write-Output "PLATFORM_CANDIDATE_SHA256_AFTER=$CandidateAfter"
+  if ($CandidateAfter -ne $CandidateSha256) { $CandidateExit = 1 }
+}
+
+if ($NodeVersionExit -ne 0 -or $NpmCiExit -ne 0 -or $VerifyExit -ne 0 -or $PackExit -ne 0 -or $PackedNodeInstallExit -ne 0 -or $PiInstallExit -ne 0 -or $PiListExit -ne 0 -or $CandidateExit -ne 0) {
   Write-Output "PLATFORM_BUILD_FAILED"
   exit 1
 }

package/scripts/platform-smoke/suite-checks.mjs

@@ -28,7 +28,7 @@ export function commonChecks(result, secretViolations, stopResult) {
 	];
 }
 
-export function platformBuildChecks(config, result) {
+export function platformBuildChecks(config, result, candidate) {
 	const stdout = result.stdout;
 	const listOutput = section(stdout, "PI_LIST_STDOUT");
 	const nodeVersion = marker(stdout, "PLATFORM_NODE_VERSION");
@@ -48,6 +48,16 @@ export function platformBuildChecks(config, result) {
 				/PLATFORM_NPM_PACK_EXIT=0/.test(stdout) &&
 				marker(stdout, "PLATFORM_PACKED_TARBALL").length > 0,
 		},
+		...(candidate
+			? [
+					{
+						id: "release-candidate-sha256",
+						fn: () =>
+							marker(stdout, "PLATFORM_CANDIDATE_SHA256_BEFORE") === candidate.sha256 &&
+							marker(stdout, "PLATFORM_CANDIDATE_SHA256_AFTER") === candidate.sha256,
+					},
+				]
+			: []),
 		{ id: "packed-node-install", fn: () => /PLATFORM_PACKED_NODE_INSTALL_EXIT=0/.test(stdout) },
 		{ id: "pi-install-local-package", fn: () => /PLATFORM_PI_INSTALL_EXIT=0/.test(stdout) },
 		{

package/scripts/platform-smoke/targets.mjs

@@ -32,6 +32,7 @@ function suiteDefinition({ config, targetName, suiteName, leaseSession }) {
 				targetName,
 				config.packageName,
 				config.nodeValidationVersion,
+				leaseSession?.candidate,
 			),
 			timeout: 1_500_000,
 			metadata: { suiteName, modelCalls: 0 },
@@ -48,7 +49,7 @@ function suiteDefinition({ config, targetName, suiteName, leaseSession }) {
 			extract: (suiteDir, result, secretValues) => {
 				writePlatformExtracts(suiteDir, result.stdout, secretValues);
 			},
-			checks: (result) => platformBuildChecks(config, result),
+			checks: (result) => platformBuildChecks(config, result, leaseSession?.candidate),
 		};
 	}
 	if (suiteName === "browser-dogfood-smoke") {
@@ -150,7 +151,7 @@ export async function runTargetSuite({
 	return { ok: assertions.ok, suiteDir, assertions };
 }
 
-export async function runTargetSuites(config, targetName, suiteNames) {
+export async function runTargetSuites(config, targetName, suiteNames, candidate) {
 	const slug = `${config.packageName}-${targetName}`;
 	const runId = makeRunId();
 	const lease = await warmupLease(targetName, slug, config);
@@ -172,7 +173,7 @@ export async function runTargetSuites(config, targetName, suiteNames) {
 				config,
 				targetName,
 				suiteName,
-				leaseSession: { ...lease, dependenciesReady, sync },
+				leaseSession: { ...lease, dependenciesReady, sync, candidate },
 				runId,
 			});
 			results.push(result);

package/scripts/platform-smoke.mjs

@@ -5,8 +5,10 @@
  * Scope: Maintainer release verification only; target command rendering and artifact assertions live under scripts/platform-smoke/.
  */
 
+import { createHash } from "node:crypto";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
-import { dirname, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 const __filename = fileURLToPath(import.meta.url);
@@ -28,17 +30,17 @@ function printHelp() {
 	console.log(`Usage: node scripts/platform-smoke.mjs <command> [options]
 
 Commands:
-  doctor                     Validate Crabbox and platform prerequisites
-  run --target <names>       Run one or more comma-separated targets concurrently
-  run --suite <name>         Run one suite on all or specified targets
+  doctor [--target <names>]  Validate prerequisites for selected targets (required by default)
+  run [--target <names>]    Run required or explicitly selected targets concurrently
+  run --suite <name>         Run one suite on required or specified targets
 
 Package scripts:
   check:platform-smoke       Syntax-check harness scripts and run cheap harness invariant tests
   smoke:platform:ubuntu-image Build the local Ubuntu image used by default
-  smoke:platform:all         Runs doctor first, then the full macOS/Ubuntu/Windows matrix
+  smoke:platform:all         Runs doctor first, then required macOS/Ubuntu targets (not optional Windows)
 
 Targets:
-  macos, ubuntu, windows-native
+  macos, ubuntu (required); windows-native (explicit best-effort)
 
 Suites:
   platform-build             npm ci, npm run verify -- platform-target, npm pack, packed pi install --approve, pi list --approve
@@ -109,34 +111,75 @@ function validateNames(kind, names, allowed) {
 	}
 }
 
-async function runTargets(args) {
-	const { runTargetSuites } = await import("./platform-smoke/targets.mjs");
+function selectedTargets(args) {
 	const targets = args.target
 		? args.target
 				.split(",")
 				.map((name) => name.trim())
 				.filter(Boolean)
 		: config.requiredTargets;
+	validateNames("target", targets, [...config.requiredTargets, ...(config.optionalTargets ?? [])]);
+	if (targets.length === 0) {
+		throw new Error("Select at least one target");
+	}
+	return targets;
+}
+
+async function runTargets(args) {
+	const { runTargetSuites } = await import("./platform-smoke/targets.mjs");
+	const targets = selectedTargets(args);
 	const suites = args.suite ? [args.suite] : config.requiredSuites;
-	validateNames("target", targets, config.requiredTargets);
 	validateNames("suite", suites, config.requiredSuites);
-	const results = await Promise.all(
-		targets.map(async (targetName) => {
-			console.log(`\n=== Target: ${targetName} ===`);
-			return { targetName, result: await runTargetSuites(config, targetName, suites) };
-		}),
-	);
-	const failed = results.filter(({ result }) => !result.ok);
-	if (failed.length > 0) {
-		console.error(
-			`\nPlatform smoke failed for ${failed.map(({ targetName }) => targetName).join(", ")}. See ${config.artifactRoot}.`,
+	let stagedCandidate;
+	try {
+		const candidatePath = process.env.PI_AGENT_BROWSER_RELEASE_TARBALL;
+		if (candidatePath !== undefined && suites.includes("platform-build")) {
+			if (candidatePath.trim().length === 0) {
+				throw new Error("PI_AGENT_BROWSER_RELEASE_TARBALL must name a candidate tarball");
+			}
+			const bytes = await readFile(resolve(candidatePath));
+			const directory = await mkdtemp(resolve(process.cwd(), ".npm-release-candidate-"));
+			stagedCandidate = { directory };
+			await writeFile(join(directory, "candidate"), bytes, { flag: "wx", mode: 0o600 });
+			stagedCandidate.path = `${basename(directory)}/candidate`;
+			stagedCandidate.sha256 = createHash("sha256").update(bytes).digest("hex");
+		}
+		const settled = await Promise.allSettled(
+			targets.map(async (targetName) => {
+				console.log(`\n=== Target: ${targetName} ===`);
+				return {
+					targetName,
+					result: await runTargetSuites(config, targetName, suites, stagedCandidate),
+				};
+			}),
+		);
+		const errors = settled.filter((result) => result.status === "rejected");
+		if (errors.length > 0) {
+			const messages = errors.map((result) =>
+				result.reason instanceof Error ? result.reason.message : String(result.reason),
+			);
+			throw new AggregateError(
+				errors.map((result) => result.reason),
+				`Platform smoke could not complete: ${messages.join("; ")}`,
+			);
+		}
+		const results = settled.map((result) => result.value);
+		const failed = results.filter(({ result }) => !result.ok);
+		if (failed.length > 0) {
+			console.error(
+				`\nPlatform smoke failed for ${failed.map(({ targetName }) => targetName).join(", ")}. See ${config.artifactRoot}.`,
+			);
+			return 1;
+		}
+		console.log(
+			`\nPlatform smoke passed for ${results.map(({ targetName }) => targetName).join(", ")}.`,
 		);
-		return 1;
+		return 0;
+	} finally {
+		if (stagedCandidate) {
+			await rm(stagedCandidate.directory, { recursive: true, force: true });
+		}
 	}
-	console.log(
-		`\nPlatform smoke passed for ${results.map(({ targetName }) => targetName).join(", ")}.`,
-	);
-	return 0;
 }
 
 export async function main(argv = process.argv.slice(2)) {
@@ -151,7 +194,7 @@ export async function main(argv = process.argv.slice(2)) {
 
 	if (args.command === "doctor") {
 		const { runDoctor } = await import("./platform-smoke/doctor.mjs");
-		await runDoctor(config);
+		await runDoctor({ ...config, requiredTargets: selectedTargets(args) });
 		return process.exitCode ?? 0;
 	}
 

package/dist/extensions/agent-browser/lib/argv-descriptor.js

@@ -1,123 +0,0 @@
-import { GLOBAL_BOOLEAN_FLAGS_WITH_OPTIONAL_VALUES, VALUE_FLAGS, optionalGlobalValueFlagConsumesNext, stripUpstreamGlobalFlags, } from "./argv-grammar.js";
-import { isOpenNavigationCommand } from "./command-taxonomy.js";
-function isBooleanLiteral(token) {
-    const normalized = token?.trim().toLowerCase();
-    return normalized === "true" || normalized === "false";
-}
-function flagConsumesFollowingToken(token, nextToken) {
-    const normalizedToken = token.split("=", 1).at(0) ?? token;
-    if (optionalGlobalValueFlagConsumesNext(normalizedToken, nextToken)) {
-        return true;
-    }
-    if (token.includes("=")) {
-        return false;
-    }
-    return (VALUE_FLAGS.has(normalizedToken) ||
-        (GLOBAL_BOOLEAN_FLAGS_WITH_OPTIONAL_VALUES.has(normalizedToken) && isBooleanLiteral(nextToken)));
-}
-export function findCommandStartIndex(args) {
-    for (let index = 0; index < args.length; index += 1) {
-        const token = args[index];
-        if (token.startsWith("--session=") ||
-            token.startsWith("--namespace=") ||
-            token.startsWith("--restore=")) {
-            continue;
-        }
-        if (token.startsWith("-")) {
-            if (flagConsumesFollowingToken(token, args[index + 1])) {
-                index += 1;
-            }
-            continue;
-        }
-        return index;
-    }
-    return undefined;
-}
-export function extractCommandTokens(args) {
-    const commandStartIndex = findCommandStartIndex(args);
-    return commandStartIndex === undefined ? [] : args.slice(commandStartIndex);
-}
-export function extractUpstreamCommandTokens(args) {
-    return stripUpstreamGlobalFlags(extractCommandTokens(args));
-}
-function waitDownloadShape(considered, downloadIndex) {
-    const next = considered.at(downloadIndex + 1);
-    const candidate = next?.token.startsWith("--") === false ? next : undefined;
-    return {
-        downloadPath: candidate?.token,
-        downloadPathIndex: candidate?.index,
-        subcommand: considered[downloadIndex].token,
-    };
-}
-export function parseWaitCommandTokens(commandTokens) {
-    if (commandTokens[0] !== "wait") {
-        return {};
-    }
-    const considered = commandTokens.slice(1).map((token, offset) => ({ index: offset + 1, token }));
-    const timeoutIndex = considered.findIndex((entry) => entry.token === "--timeout");
-    if (timeoutIndex >= 0) {
-        considered.splice(timeoutIndex, Math.min(2, considered.length - timeoutIndex));
-    }
-    for (const flags of [
-        ["--url", "-u"],
-        ["--load", "-l"],
-        ["--fn", "-f"],
-        ["--text", "-t"],
-    ]) {
-        const match = considered.find((entry) => flags.some((flag) => flag === entry.token));
-        if (match) {
-            return { subcommand: match.token };
-        }
-    }
-    const downloadIndex = considered.findIndex((entry) => entry.token === "--download" || entry.token === "-d");
-    if (downloadIndex >= 0) {
-        return waitDownloadShape(considered, downloadIndex);
-    }
-    return { subcommand: considered[0]?.token };
-}
-function getOpenCommandTarget(commandTokens) {
-    for (let index = 1; index < commandTokens.length; index += 1) {
-        const token = commandTokens[index];
-        if (token === "--init-script" || token === "--enable") {
-            index += 1;
-            continue;
-        }
-        if (token.startsWith("--init-script=") || token.startsWith("--enable=")) {
-            continue;
-        }
-        if (token.startsWith("-")) {
-            continue;
-        }
-        return token;
-    }
-    return undefined;
-}
-function getCommandSubcommand(tokens) {
-    if (isOpenNavigationCommand(tokens.at(0))) {
-        return getOpenCommandTarget(tokens);
-    }
-    if (tokens.at(0) === "wait") {
-        return parseWaitCommandTokens(tokens).subcommand;
-    }
-    return tokens.at(1);
-}
-function parseCommandInfoFromTokens(commandTokens) {
-    const upstreamCommandTokens = stripUpstreamGlobalFlags(commandTokens);
-    const command = upstreamCommandTokens[0];
-    return {
-        command,
-        subcommand: getCommandSubcommand(upstreamCommandTokens),
-    };
-}
-export function parseCommandInfo(args) {
-    return parseCommandInfoFromTokens(extractCommandTokens(args));
-}
-export function parseArgvDescriptor(args) {
-    const commandTokens = extractCommandTokens(args);
-    const upstreamCommandTokens = stripUpstreamGlobalFlags(commandTokens);
-    return {
-        commandInfo: parseCommandInfoFromTokens(commandTokens),
-        commandTokens,
-        upstreamCommandTokens,
-    };
-}