witnora 0.20.9 → 0.20.11

package/dist/cli.js

@@ -40,8 +40,8 @@ import { runOnboard } from "./onboard.js";
 import { inspectRepository } from "./onboard.js";
 import { renderReleaseEvaluation, runReleaseEvaluation } from "./release-evaluation.js";
 import { runPrivateCapabilityDiscovery } from "./private-discovery.js";
-import { configureManagedWorkflowHarness, doctorCustomerGateway, initializeCustomerGateway, isGatewayDoctorReady, readManagedCustomerGatewayLogs, renderGatewayDoctor, renderManagedGatewayStatus, restartManagedCustomerGateway, runCustomerGateway, startManagedCustomerGateway, statusManagedCustomerGateway, stopManagedCustomerGateway, superviseManagedCustomerGateway, } from "./gateway.js";
-import { installCurrentGatewayService, stopCurrentGatewayOwners, uninstallCurrentGatewayService } from "./gateway-service.js";
+import { awaitManagedCustomerGateway, configureManagedWorkflowHarness, doctorCustomerGateway, initializeCustomerGateway, isGatewayDoctorReady, readManagedCustomerGatewayLogs, renderGatewayDoctor, renderManagedGatewayStatus, runCustomerGateway, startManagedCustomerGateway, statusManagedCustomerGateway, stopManagedCustomerGateway, superviseManagedCustomerGateway, } from "./gateway.js";
+import { installCurrentGatewayService, restartCurrentGatewayOwners, stopCurrentGatewayOwners, uninstallCurrentGatewayService } from "./gateway-service.js";
 import { runCustomerGatewayCommand } from "./gateway-exec.js";
 import { verifyEvidencePacketV02 } from "./evidence-v02.js";
 process.on("uncaughtException", reportFatalError);
@@ -162,6 +162,7 @@ else if (command === "onboard") {
         actionTransport: readActionTransport(readFlag("--action-transport")),
         waitForActionPathMs: readActionTransport(readFlag("--action-transport")) && !readBoolFlag("--no-wait-for-action-path") ? 10 * 60 * 1_000 : 0,
         openBrowser: readBoolFlag("--no-browser") ? async () => { } : undefined,
+        confirmRunDetectedAgent: readBoolFlag("--no-run-agent") ? undefined : confirmDetectedAgentRun,
     });
 }
 else if (command === "mcp") {
@@ -233,7 +234,11 @@ else if (command === "gateway") {
         process.stdout.write(`${await readManagedCustomerGatewayLogs({ repository: readFlag("--repo") ?? process.cwd(), dir: readFlag("--dir"), lines })}\n`);
     }
     else if (action === "restart") {
-        const result = await restartManagedCustomerGateway({ repository: readFlag("--repo") ?? process.cwd(), dir: readFlag("--dir") });
+        const repository = readFlag("--repo") ?? process.cwd();
+        const dir = readFlag("--dir");
+        const configHome = readFlag("--config-home");
+        const serviceOptions = { repository, gatewayDirectory: dir, cliEntry: fileURLToPath(import.meta.url), configHome };
+        const result = await restartCurrentGatewayOwners(serviceOptions, () => stopManagedCustomerGateway({ repository, dir, configHome }), () => awaitManagedCustomerGateway({ repository, dir, configHome }));
         process.stdout.write(readBoolFlag("--json") ? `${JSON.stringify(result, null, 2)}\n` : renderManagedGatewayStatus(result));
     }
     else if (action === "repair") {
@@ -1045,6 +1050,12 @@ async function promptValue(label) {
         prompt.close();
     }
 }
+async function confirmDetectedAgentRun(command) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY)
+        return false;
+    const answer = (await promptValue(`Run ${command.join(" ")} safely once now in this terminal? [Y/n] `)).toLowerCase();
+    return answer === "" || answer === "y" || answer === "yes";
+}
 async function promptSecret(label) {
     if (!process.stdin.isTTY || !process.stdout.isTTY || !process.stdin.setRawMode) {
         throw new Error("Missing project API key. Set WITNORA_API_KEY (or legacy AGENTCERT_API_KEY) or pass --api-key in a trusted environment.");

package/dist/command-help.js

@@ -56,6 +56,7 @@ Options:
   --repo <directory>      Repository to configure (default: current directory)
   --template <type>       Override automatic repository detection
   --action-transport <t>  Test HTTP or MCP against the exact generated sandbox Action path
+  --no-run-agent          Do not offer to run a detected bounded Agent command in this terminal
   --no-browser            Print the approval URL without opening it
 `;
     if (command === "mcp")

package/dist/gateway-exec.js

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
-import { readFile } from "node:fs/promises";
-import { join, resolve } from "node:path";
+import { access, readFile } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
 export async function runCustomerGatewayCommand(options) {
     const repository = resolve(options.repository);
     const gatewayDirectory = resolve(options.gatewayDirectory ?? join(repository, ".witnora", "gateway"));
@@ -14,8 +14,9 @@ export async function runCustomerGatewayCommand(options) {
     if (!host || !Number.isInteger(port) || port < 1 || port > 65_535 || !gatewayToken) {
         throw new Error("The local Gateway binding is incomplete. Run witnora onboard from this repository before starting the Agent workflow.");
     }
+    const launch = await resolveLaunch(options.command, options.args ?? []);
     return await new Promise((resolveChild, rejectChild) => {
-        const child = spawn(options.command, options.args ?? [], {
+        const child = spawn(launch.command, launch.args, {
             cwd: repository,
             env: {
                 ...process.env,
@@ -29,6 +30,24 @@ export async function runCustomerGatewayCommand(options) {
         child.once("exit", (code) => resolveChild({ exitCode: code ?? 1 }));
     });
 }
+async function resolveLaunch(command, args) {
+    const packageManager = basename(command).toLowerCase();
+    if (process.platform !== "win32" || packageManager !== "npm" && packageManager !== "npx")
+        return { command, args };
+    const cliName = packageManager === "npm" ? "npm-cli.js" : "npx-cli.js";
+    const candidates = [
+        packageManager === "npm" ? process.env.npm_execpath : undefined,
+        join(dirname(process.execPath), "node_modules", "npm", "bin", cliName),
+    ].filter((candidate) => Boolean(candidate));
+    for (const candidate of candidates) {
+        try {
+            await access(candidate);
+            return { command: process.execPath, args: [candidate, ...args] };
+        }
+        catch { /* try the next customer-local Node installation path */ }
+    }
+    throw new Error(`Could not locate ${packageManager} for the Agent workflow. Run the repository's direct Node or Python command instead.`);
+}
 async function readJson(path, label) {
     try {
         const value = JSON.parse(await readFile(path, "utf8"));

package/dist/gateway-service.js

@@ -12,9 +12,11 @@ export async function installGatewayService(input) {
     // before replacing the definition so onboarding never leaves two owners
     // racing for the same localhost port.
     if (plan.kind === "WINDOWS_TASK") {
-        await input.run(plan.stop.command, plan.stop.args).catch(() => undefined);
-        await (input.removeFile ?? removeFile)(plan.serviceLease.path);
-        await (input.sleep ?? wait)(WINDOWS_PARENT_EXIT_GRACE_MS);
+        if (!input.existingOwnerStopped) {
+            await input.run(plan.stop.command, plan.stop.args).catch(() => undefined);
+            await (input.removeFile ?? removeFile)(plan.serviceLease.path);
+            await (input.sleep ?? wait)(WINDOWS_PARENT_EXIT_GRACE_MS);
+        }
         await input.writeDefinition(plan.serviceLease.path, `${plan.serviceLease.generation}\n`);
     }
     if (plan.launcher)
@@ -40,6 +42,7 @@ export async function installCurrentGatewayService(options) {
         run: options.run ?? runCommand,
         sleep: options.sleep,
         removeFile: options.removeFile,
+        existingOwnerStopped: options.existingOwnerStopped,
     });
 }
 export async function uninstallCurrentGatewayService(options) {
@@ -69,6 +72,11 @@ export async function restartCurrentGatewayService(options) {
     await run(plan.start.command, plan.start.args);
     return plan;
 }
+export async function restartCurrentGatewayOwners(options, stopManagedGateway, awaitManagedGateway) {
+    await stopCurrentGatewayOwners(options, stopManagedGateway);
+    await restartCurrentGatewayService({ ...options, existingOwnerStopped: true });
+    return awaitManagedGateway();
+}
 export async function stopCurrentGatewayService(options) {
     const plan = createGatewayServicePlan(currentPlanInput(options));
     await (options.run ?? runCommand)(plan.stop.command, plan.stop.args).catch(() => undefined);

package/dist/gateway.js

@@ -1424,12 +1424,19 @@ export async function stopManagedCustomerGateway(options = {}) {
     const after = await statusManagedCustomerGateway(options);
     return { ...after, stopped: !after.healthy };
 }
-export async function restartManagedCustomerGateway(options = {}) {
-    const status = await statusManagedCustomerGateway(options);
-    if (status.state === "RUNNING_EXTERNAL")
-        throw new Error("The Gateway is running outside Witnora process management. Stop that foreground process before requesting a managed restart.");
-    await stopManagedCustomerGateway(options);
-    return startManagedCustomerGateway(options);
+export async function awaitManagedCustomerGateway(options = {}) {
+    const sleep = options.sleep ?? wait;
+    const deadline = Date.now() + (options.timeoutMs ?? 12_000);
+    let status = await statusManagedCustomerGateway(options);
+    while (Date.now() < deadline) {
+        if (status.state === "RUNNING_MANAGED")
+            return { ...status, started: true };
+        if (status.state === "RUNNING_EXTERNAL" || status.state === "CONFLICT")
+            throw new Error(status.detail);
+        await sleep(120);
+        status = await statusManagedCustomerGateway(options);
+    }
+    throw new Error(`The operating-system Gateway supervisor did not restore a healthy managed process before the startup deadline. ${status.detail}`);
 }
 export async function superviseManagedCustomerGateway(options = {}) {
     const inspect = options.inspect ?? (() => statusManagedCustomerGateway({ repository: options.repository, dir: options.dir }));

package/dist/onboard.js

@@ -13,6 +13,7 @@ import { discoverRuntimeReferences, planRuntimeSandboxModules } from "./runtime-
 import { automaticRuntimeReferencesUsable, bootstrapLocalRuntime, verifyAutomaticRuntimeProbe } from "./runtime-bootstrap.js";
 import { activateRealPathIntegrations } from "./real-path-activation.js";
 import { installCurrentGatewayService, stopCurrentGatewayService } from "./gateway-service.js";
+import { runCustomerGatewayCommand } from "./gateway-exec.js";
 export async function runOnboard(options) {
     const requestFetch = options.fetch ?? fetch;
     const output = options.output ?? ((message) => process.stdout.write(message));
@@ -331,9 +332,23 @@ export async function runOnboard(options) {
         });
         if (actionTransportTest?.state === "WAITING_FOR_ACTION_PATH" && (options.waitForActionPathMs ?? 0) > 0) {
             output("\nBase setup is complete. Onboarding is waiting for the Business Task and Action path; it has not claimed completion.\n");
-            output(agentRunCommand
-                ? `Open a second terminal in this repository and run the Agent safely once:\n${agentRunCommand}\n`
-                : "Run the Agent normally in its sandbox. If it has no work now, you may enter the workspace and finish Action verification after its first real run.\n");
+            let ranDetectedAgent = false;
+            if (localWorkflowCommand && options.confirmRunDetectedAgent) {
+                output(`Detected Agent command: ${localWorkflowCommand.join(" ")}\n`);
+                if (await options.confirmRunDetectedAgent(localWorkflowCommand)) {
+                    output("Running this Agent safely once in the current terminal...\n");
+                    const [command, ...args] = localWorkflowCommand;
+                    const result = await (options.runGatewayCommand ?? runCustomerGatewayCommand)({ repository: repositoryPath, command: command, args });
+                    if (result.exitCode !== 0)
+                        throw new Error(`The detected Agent command exited with code ${result.exitCode}. Onboarding remains fail closed.`);
+                    output("Agent run completed. Keep the browser open and confirm the Business Task; this command will finish automatically.\n");
+                    ranDetectedAgent = true;
+                }
+            }
+            if (!ranDetectedAgent)
+                output(agentRunCommand
+                    ? `Run the Agent in its normal environment, or use this command from another terminal:\n${agentRunCommand}\n`
+                    : "Run the Agent normally in its sandbox. If it has no work now, you may enter the workspace and finish Action verification after its first real run.\n");
             output(`Keep this command open for up to ${Math.max(1, Math.ceil((options.waitForActionPathMs ?? 0) / 60_000))} minutes. It will finish automatically after you confirm the Business Task in the browser; no second onboard command is required. Press Ctrl+C to pause safely.\n`);
             const resolution = await waitForOnboardingResolution({
                 repository: repositoryPath, server, projectId: token.projectId, apiKey: token.apiKey,
@@ -677,6 +692,11 @@ function relativeGeneratedFiles(repositoryPath, files) {
 }
 function randomSuffix() { return Math.random().toString(36).slice(2, 10); }
 async function detectLocalWorkflowCommand(repositoryPath) {
+    const manifest = await optionalJson(join(repositoryPath, "package.json"));
+    const scripts = manifest?.scripts;
+    if (scripts && typeof scripts === "object" && !Array.isArray(scripts) && typeof scripts.agent === "string") {
+        return ["npm", "run", "agent"];
+    }
     if (await exists(join(repositoryPath, "scripts", "run_workflow.py")))
         return ["python", "scripts/run_workflow.py"];
     if (await exists(join(repositoryPath, "scripts", "run-workflow.mjs")))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.20.9",
+  "version": "0.20.11",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",