@agentuity/cli 0.1.16 → 0.1.18

package/src/cmd/cloud/queue/stats.ts

@@ -0,0 +1,297 @@
+import { z } from 'zod';
+import { createCommand } from '../../../types';
+import * as tui from '../../../tui';
+import { createQueueAPIClient, getQueueApiOptions } from './util';
+import { getCommand } from '../../../command-prefix';
+import {
+	getOrgAnalytics,
+	getQueueAnalytics,
+	streamOrgAnalytics,
+	streamQueueAnalytics,
+	type OrgAnalytics,
+	type QueueAnalytics,
+	type SSEStatsEvent,
+} from '@agentuity/server';
+
+const StatsResponseSchema = z.union([
+	z.object({ type: z.literal('org'), analytics: z.unknown() }),
+	z.object({ type: z.literal('queue'), analytics: z.unknown() }),
+	z.object({ type: z.literal('stream'), events: z.array(z.unknown()) }),
+]);
+
+function formatNumber(n: number): string {
+	if (n >= 1_000_000) return `${(n / 1_000_000).toFixed(1)}M`;
+	if (n >= 1_000) return `${(n / 1_000).toFixed(1)}K`;
+	return String(n);
+}
+
+function formatPercent(n: number): string {
+	return `${n.toFixed(2)}%`;
+}
+
+function formatLatency(ms: number): string {
+	if (ms >= 1000) return `${(ms / 1000).toFixed(1)}s`;
+	return `${Math.round(ms)}ms`;
+}
+
+function formatDuration(start: string, end: string): string {
+	const startDate = new Date(start);
+	const endDate = new Date(end);
+	const hours = Math.round((endDate.getTime() - startDate.getTime()) / 3600000);
+	if (hours >= 24) return `${Math.round(hours / 24)}d`;
+	return `${hours}h`;
+}
+
+function displayOrgAnalytics(analytics: OrgAnalytics): void {
+	const { summary, queues, period } = analytics;
+
+	tui.info(`Organization Analytics (${formatDuration(period.start, period.end)})`);
+	tui.newline();
+	console.log(tui.colorPrimary('Summary:'));
+	console.log(`  ${tui.muted('Total Queues:')}     ${summary.total_queues}`);
+	console.log(
+		`  ${tui.muted('Published:')}        ${formatNumber(summary.total_messages_published)}`
+	);
+	console.log(
+		`  ${tui.muted('Delivered:')}        ${formatNumber(summary.total_messages_delivered)}`
+	);
+	console.log(
+		`  ${tui.muted('Acknowledged:')}     ${formatNumber(summary.total_messages_acknowledged)}`
+	);
+	console.log(`  ${tui.muted('DLQ Messages:')}     ${formatNumber(summary.total_dlq_messages)}`);
+	console.log(`  ${tui.muted('Avg Latency:')}      ${formatLatency(summary.avg_latency_ms)}`);
+	console.log(`  ${tui.muted('P95 Latency:')}      ${formatLatency(summary.p95_latency_ms)}`);
+	console.log(`  ${tui.muted('Error Rate:')}       ${formatPercent(summary.error_rate_percent)}`);
+
+	if (queues.length > 0) {
+		tui.newline();
+		console.log(tui.colorPrimary('Queues:'));
+		const tableData = queues.map((q) => ({
+			Name: q.name,
+			Type: q.queue_type,
+			Published: formatNumber(q.messages_published),
+			Delivered: formatNumber(q.messages_delivered),
+			Backlog: formatNumber(q.backlog),
+			DLQ: formatNumber(q.dlq_count),
+			'Avg Latency': formatLatency(q.avg_latency_ms),
+			'Error %': formatPercent(q.error_rate_percent),
+		}));
+		tui.table(tableData);
+	}
+}
+
+function displayQueueAnalytics(analytics: QueueAnalytics): void {
+	const { queue_name, queue_type, period, current, period_stats, latency, consumer_latency } =
+		analytics;
+
+	tui.info(`Queue: ${queue_name} (${queue_type})`);
+	console.log(tui.colorWarning(`Period: ${formatDuration(period.start, period.end)}`));
+	tui.newline();
+
+	console.log(tui.colorPrimary('Current State:'));
+	console.log(`  ${tui.muted('Backlog:')}          ${formatNumber(current.backlog)}`);
+	console.log(`  ${tui.muted('In-Flight:')}        ${formatNumber(current.messages_in_flight)}`);
+	console.log(`  ${tui.muted('DLQ:')}              ${formatNumber(current.dlq_count)}`);
+	console.log(`  ${tui.muted('Consumers:')}        ${current.active_consumers}`);
+	if (current.oldest_message_age_seconds != null) {
+		console.log(`  ${tui.muted('Oldest Msg Age:')}   ${current.oldest_message_age_seconds}s`);
+	}
+
+	tui.newline();
+	console.log(tui.colorPrimary('Period Stats:'));
+	console.log(
+		`  ${tui.muted('Published:')}          ${formatNumber(period_stats.messages_published)}`
+	);
+	console.log(
+		`  ${tui.muted('Delivered:')}          ${formatNumber(period_stats.messages_delivered)}`
+	);
+	console.log(
+		`  ${tui.muted('Acknowledged:')}       ${formatNumber(period_stats.messages_acknowledged)}`
+	);
+	console.log(
+		`  ${tui.muted('Failed:')}             ${formatNumber(period_stats.messages_failed)}`
+	);
+	console.log(
+		`  ${tui.muted('Replayed:')}           ${formatNumber(period_stats.messages_replayed)}`
+	);
+	console.log(
+		`  ${tui.muted('Bytes Published:')}    ${tui.formatBytes(period_stats.bytes_published)}`
+	);
+	console.log(
+		`  ${tui.muted('Delivery Attempts:')}  ${formatNumber(period_stats.delivery_attempts)}`
+	);
+	console.log(`  ${tui.muted('Retries:')}            ${formatNumber(period_stats.retry_count)}`);
+
+	tui.newline();
+	console.log(tui.colorPrimary('Delivery Latency:'));
+	console.log(`  ${tui.muted('Average:')}          ${formatLatency(latency.avg_ms)}`);
+	if (latency.p50_ms != null)
+		console.log(`  ${tui.muted('Median (P50):')}     ${formatLatency(latency.p50_ms)}`);
+	if (latency.p95_ms != null)
+		console.log(`  ${tui.muted('P95:')}              ${formatLatency(latency.p95_ms)}`);
+	if (latency.p99_ms != null)
+		console.log(`  ${tui.muted('P99:')}              ${formatLatency(latency.p99_ms)}`);
+	if (latency.max_ms != null)
+		console.log(`  ${tui.muted('Max:')}              ${formatLatency(latency.max_ms)}`);
+
+	tui.newline();
+	console.log(tui.colorPrimary('Consumer Latency:'));
+	console.log(`  ${tui.muted('Average:')}          ${formatLatency(consumer_latency.avg_ms)}`);
+	if (consumer_latency.p50_ms != null)
+		console.log(`  ${tui.muted('Median (P50):')}     ${formatLatency(consumer_latency.p50_ms)}`);
+	if (consumer_latency.p95_ms != null)
+		console.log(`  ${tui.muted('P95:')}              ${formatLatency(consumer_latency.p95_ms)}`);
+	if (consumer_latency.p99_ms != null)
+		console.log(`  ${tui.muted('P99:')}              ${formatLatency(consumer_latency.p99_ms)}`);
+
+	if (analytics.destinations && analytics.destinations.length > 0) {
+		tui.newline();
+		tui.info('Destinations:');
+		const destData = analytics.destinations.map((d) => {
+			const total = d.success_count + d.failure_count;
+			const errorRate = total > 0 ? (d.failure_count / total) * 100 : 0;
+			return {
+				ID: d.id.slice(0, 12) + '...',
+				URL: d.url.length > 40 ? d.url.slice(0, 37) + '...' : d.url,
+				Success: formatNumber(d.success_count),
+				Failed: formatNumber(d.failure_count),
+				'Avg Response': d.avg_response_time_ms ? formatLatency(d.avg_response_time_ms) : '-',
+				'Error %': formatPercent(errorRate),
+			};
+		});
+		tui.table(destData);
+	}
+}
+
+function displayStreamEvent(event: SSEStatsEvent, queueName?: string): void {
+	const time = new Date(event.timestamp).toLocaleTimeString();
+	const prefix = queueName ? `[${queueName}]` : '[org]';
+
+	process.stdout.write('\x1b[2K\r');
+	process.stdout.write(
+		`${tui.colorMuted(time)} ${prefix} ` +
+			`Backlog: ${tui.colorInfo(formatNumber(event.backlog))} | ` +
+			`In-Flight: ${tui.colorInfo(formatNumber(event.messages_in_flight))} | ` +
+			`Throughput: ${tui.colorSuccess(formatNumber(event.throughput_1m))}/min | ` +
+			`Latency: ${formatLatency(event.avg_latency_ms)} | ` +
+			`Errors: ${event.error_rate_1m > 0 ? tui.colorError(String(event.error_rate_1m)) : '0'}/min`
+	);
+}
+
+export const statsSubcommand = createCommand({
+	name: 'stats',
+	description: 'View queue analytics and statistics',
+	tags: ['read-only', 'requires-auth'],
+	requires: { auth: true, org: true },
+	examples: [
+		{
+			command: getCommand('cloud queue stats'),
+			description: 'View org-level analytics for all queues',
+		},
+		{
+			command: getCommand('cloud queue stats --name my-queue'),
+			description: 'View detailed analytics for a specific queue',
+		},
+		{
+			command: getCommand('cloud queue stats --live'),
+			description: 'Stream real-time stats (Ctrl+C to exit)',
+		},
+		{
+			command: getCommand('cloud queue stats --name my-queue --live --interval 10'),
+			description: 'Stream queue stats every 10 seconds',
+		},
+	],
+	schema: {
+		args: z.object({
+			name: z.string().optional().describe('Queue name (omit for org-level stats)'),
+		}),
+		options: z.object({
+			live: z.boolean().default(false).describe('Stream real-time stats'),
+			interval: z.number().default(5).describe('Refresh interval in seconds (for --live)'),
+			start: z.string().optional().describe('Start time (ISO 8601)'),
+			end: z.string().optional().describe('End time (ISO 8601)'),
+			granularity: z.enum(['minute', 'hour', 'day']).optional().describe('Time granularity'),
+		}),
+		response: StatsResponseSchema,
+	},
+	idempotent: true,
+
+	async handler(ctx) {
+		const { args, opts, options } = ctx;
+		const client = await createQueueAPIClient(ctx);
+		const apiOptions = getQueueApiOptions(ctx);
+
+		const analyticsOptions = {
+			...apiOptions,
+			start: opts.start,
+			end: opts.end,
+			granularity: opts.granularity,
+		};
+
+		if (opts.live) {
+			const events: SSEStatsEvent[] = [];
+
+			tui.info(
+				`Streaming stats every ${opts.interval}s... ${tui.colorMuted('(Ctrl+C to exit)')}`
+			);
+			tui.info('');
+
+			const handleInterrupt = () => {
+				tui.info('');
+				tui.info('Stream stopped.');
+				process.exit(0);
+			};
+			process.on('SIGINT', handleInterrupt);
+
+			try {
+				if (args.name) {
+					const stream = streamQueueAnalytics(client, args.name, {
+						interval: opts.interval,
+						orgId: apiOptions?.orgId,
+					});
+					for await (const event of stream) {
+						events.push(event);
+						if (!options.json) {
+							displayStreamEvent(event, args.name);
+						}
+					}
+				} else {
+					const stream = streamOrgAnalytics(client, {
+						interval: opts.interval,
+						orgId: apiOptions?.orgId,
+					});
+					for await (const event of stream) {
+						events.push(event);
+						if (!options.json) {
+							displayStreamEvent(event);
+						}
+					}
+				}
+			} finally {
+				process.off('SIGINT', handleInterrupt);
+			}
+
+			return { type: 'stream' as const, events };
+		}
+
+		if (args.name) {
+			const analytics = await getQueueAnalytics(client, args.name, analyticsOptions);
+
+			if (!options.json) {
+				displayQueueAnalytics(analytics);
+			}
+
+			return { type: 'queue' as const, analytics };
+		}
+
+		const analytics = await getOrgAnalytics(client, analyticsOptions);
+
+		if (!options.json) {
+			displayOrgAnalytics(analytics);
+		}
+
+		return { type: 'org' as const, analytics };
+	},
+});
+
+export default statsSubcommand;

package/src/cmd/cloud/queue/util.ts

@@ -0,0 +1,34 @@
+import type { Logger } from '@agentuity/core';
+import { APIClient, type QueueApiOptions } from '@agentuity/server';
+import { getGlobalCatalystAPIClient } from '../../../config';
+import type { AuthData, Config, GlobalOptions } from '../../../types';
+
+/**
+ * Context required for queue API operations.
+ */
+export interface QueueContext {
+	logger: Logger;
+	auth: AuthData;
+	config: Config | null;
+	options: GlobalOptions;
+	orgId?: string;
+}
+
+/**
+ * Creates an API client for queue operations.
+ *
+ * Queues are global resources that don't require a project context.
+ * Uses the global Catalyst API client with user authentication.
+ */
+export async function createQueueAPIClient(ctx: QueueContext): Promise<APIClient> {
+	return getGlobalCatalystAPIClient(ctx.logger, ctx.auth, ctx.config?.name);
+}
+
+/**
+ * Creates QueueApiOptions from the CLI context.
+ * Prioritizes explicit orgId on context, then falls back to global --org-id option.
+ */
+export function getQueueApiOptions(ctx: QueueContext): QueueApiOptions | undefined {
+	const orgId = ctx.orgId ?? ctx.options.orgId;
+	return orgId ? { orgId } : undefined;
+}

package/src/cmd/cloud/sandbox/snapshot/build.ts

@@ -5,10 +5,12 @@ import { YAML } from 'bun';
 import * as tar from 'tar';
 import { createCommand } from '../../../../types';
 import * as tui from '../../../../tui';
+import { ErrorCode } from '../../../../errors';
 import { getCommand } from '../../../../command-prefix';
 import {
 	snapshotBuildInit,
 	snapshotBuildFinalize,
+	snapshotUpload,
 	SnapshotBuildFileSchema,
 } from '@agentuity/server';
 import type { SnapshotFileInfo } from '@agentuity/server';
@@ -35,8 +37,13 @@ const SnapshotBuildResponseSchema = z.object({
 		.record(z.string(), z.string())
 		.optional()
 		.describe('User-defined metadata key-value pairs'),
+	error: z.string().optional().describe('Error message if build failed'),
+	malwareDetected: z.boolean().optional().describe('True if malware was detected'),
+	virusName: z.string().optional().describe('Name of detected virus'),
 });
 
+const MALWARE_REGEX = /malware detected \(([^)]+)\)/i;
+
 interface FileEntry {
 	path: string;
 	absolutePath: string;
@@ -229,6 +236,33 @@ async function createTarGzArchive(
 	);
 }
 
+function createProgressStream(
+	file: ReturnType<typeof Bun.file>,
+	totalSize: number,
+	onProgress: (percent: number) => void
+): ReadableStream<Uint8Array> {
+	let bytesRead = 0;
+	const reader = file.stream().getReader();
+
+	return new ReadableStream<Uint8Array>({
+		async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				onProgress(100);
+				return;
+			}
+			bytesRead += value.byteLength;
+			const percent = Math.min(99, Math.floor((bytesRead / totalSize) * 100));
+			onProgress(percent);
+			controller.enqueue(value);
+		},
+		cancel() {
+			reader.cancel();
+		},
+	});
+}
+
 async function generateContentHash(params: {
 	runtime: string;
 	description?: string;
@@ -236,6 +270,7 @@ async function generateContentHash(params: {
 	files: SnapshotFileInfo[];
 	fileHashes: Map<string, string>;
 	env?: Record<string, string>;
+	isPublic?: boolean;
 }): Promise<string> {
 	const hash = createHash('sha256');
 
@@ -254,7 +289,8 @@ async function generateContentHash(params: {
 		const sortedFiles = [...params.files].sort((a, b) => a.path.localeCompare(b.path));
 		for (const file of sortedFiles) {
 			const contentHash = params.fileHashes.get(file.path) ?? '';
-			hash.update(`file:${file.path}:${file.size}:${contentHash}\n`);
+			const mode = file.mode.toString(8).padStart(4, '0');
+			hash.update(`file:${file.path}:${file.size}:${contentHash}:${mode}:${file.contentType}\n`);
 		}
 	}
 
@@ -265,6 +301,8 @@ async function generateContentHash(params: {
 		}
 	}
 
+	hash.update(`access:${params.isPublic ? 'public' : 'private'}\n`);
+
 	return hash.digest('hex');
 }
 
@@ -315,6 +353,14 @@ export const buildSubcommand = createCommand({
 			description: z.string().optional().describe('Snapshot description (overrides build file)'),
 			metadata: z.array(z.string()).optional().describe('Metadata key-value pairs (KEY=VALUE)'),
 			force: z.boolean().optional().describe('Force rebuild even if content is unchanged'),
+			public: z
+				.boolean()
+				.optional()
+				.describe('Make snapshot public (enables virus scanning, no encryption)'),
+			confirm: z
+				.boolean()
+				.optional()
+				.describe('Confirm public snapshot publishing (required for --public)'),
 		}),
 		response: SnapshotBuildResponseSchema,
 	},
@@ -323,6 +369,37 @@ export const buildSubcommand = createCommand({
 		const { args, opts, options, auth, region, config, logger, orgId } = ctx;
 
 		const dryRun = options.dryRun === true;
+		const isPublic = opts.public === true;
+
+		if (isPublic && !dryRun) {
+			if (!opts.confirm) {
+				if (!tui.isTTYLike()) {
+					logger.fatal(
+						`Publishing a public snapshot requires confirmation.\n\n` +
+							`Public snapshots make all environment variables and files publicly accessible.\n\n` +
+							`To proceed, add the --confirm flag:\n` +
+							`  ${getCommand('cloud sandbox snapshot build . --public --confirm')}\n\n` +
+							`To preview what will be published, use --dry-run first:\n` +
+							`  ${getCommand('cloud sandbox snapshot build . --public --dry-run')}`
+					);
+				}
+
+				tui.warningBox(
+					'Public Snapshot',
+					`You are publishing a public snapshot.\n\n` +
+						`This will make all environment variables and\n` +
+						`files in the snapshot publicly accessible.\n\n` +
+						`Run with --dry-run to preview the contents.`
+				);
+				console.log('');
+
+				const confirmed = await tui.confirm('Proceed with public snapshot?', false);
+
+				if (!confirmed) {
+					logger.fatal('Aborted');
+				}
+			}
+		}
 
 		const directory = resolve(args.directory);
 		if (!existsSync(directory)) {
@@ -457,21 +534,35 @@ export const buildSubcommand = createCommand({
 			files = await resolveFileGlobs(directory, buildConfig.files);
 		}
 
-		const fileList: SnapshotFileInfo[] = Array.from(files.values()).map((f) => ({
-			path: f.path,
-			size: f.size,
-		}));
-		const totalSize = fileList.reduce((sum, f) => sum + f.size, 0);
-
-		const fileHashes = new Map<string, string>();
+		const fileMetadata = new Map<string, { sha256: string; contentType: string; mode: number }>();
 		for (const file of files.values()) {
 			const fullPath = join(directory, file.path);
 			const bunFile = Bun.file(fullPath);
 			const content = await bunFile.arrayBuffer();
 			const hash = createHash('sha256').update(Buffer.from(content)).digest('hex');
-			fileHashes.set(file.path, hash);
+			const contentType = bunFile.type || 'application/octet-stream';
+			const stat = statSync(fullPath);
+			const mode = stat.mode & 0o7777; // Extract permission bits only
+			fileMetadata.set(file.path, { sha256: hash, contentType, mode });
 		}
 
+		const fileHashes = new Map<string, string>();
+		for (const [path, meta] of fileMetadata) {
+			fileHashes.set(path, meta.sha256);
+		}
+
+		const fileList: SnapshotFileInfo[] = Array.from(files.values()).map((f) => {
+			const meta = fileMetadata.get(f.path);
+			return {
+				path: f.path,
+				size: f.size,
+				sha256: meta?.sha256 ?? '',
+				contentType: meta?.contentType ?? 'application/octet-stream',
+				mode: meta?.mode ?? 0o644,
+			};
+		});
+		const totalSize = fileList.reduce((sum, f) => sum + f.size, 0);
+
 		const contentHash = await generateContentHash({
 			runtime: buildConfig.runtime,
 			description: finalDescription,
@@ -479,6 +570,7 @@ export const buildSubcommand = createCommand({
 			files: fileList,
 			fileHashes,
 			env: finalEnv,
+			isPublic,
 		});
 
 		if (dryRun) {
@@ -492,11 +584,12 @@ export const buildSubcommand = createCommand({
 							Description: finalDescription ?? '-',
 							Runtime: buildConfig.runtime,
 							Tag: opts.tag ?? 'latest',
+							Access: isPublic ? 'public' : 'private',
 							Size: tui.formatBytes(totalSize),
 							Files: fileList.length.toFixed(),
 						},
 					],
-					['Name', 'Description', 'Runtime', 'Tag', 'Size', 'Files'],
+					['Name', 'Description', 'Runtime', 'Tag', 'Access', 'Size', 'Files'],
 					{ layout: 'vertical', padStart: '  ' }
 				);
 
@@ -572,11 +665,12 @@ export const buildSubcommand = createCommand({
 					return await snapshotBuildInit(client, {
 						runtime: buildConfig.runtime,
 						name: finalName,
-						tag: opts.tag,
+						tag: opts.tag ?? 'latest',
 						description: finalDescription,
 						contentHash,
 						force: opts.force,
-						encrypt: true,
+						encrypt: !isPublic,
+						public: isPublic,
 						orgId,
 					});
 				},
@@ -611,7 +705,7 @@ export const buildSubcommand = createCommand({
 				};
 			}
 
-			// Encrypt the archive if public key is provided
+			// Encrypt the archive if public key is provided (private snapshots only)
 			let uploadPath = archivePath;
 			let uploadSize = archiveSize;
 
@@ -646,28 +740,89 @@ export const buildSubcommand = createCommand({
 				uploadSize = Bun.file(encryptedPath).size;
 			}
 
-			await tui.spinner({
-				message: 'Uploading snapshot...',
-				type: 'progress',
-				clearOnSuccess: true,
-				callback: async (updateProgress) => {
-					const uploadFile = Bun.file(uploadPath);
-					const response = await fetch(initResult.uploadUrl!, {
-						method: 'PUT',
-						headers: {
-							'Content-Type': 'application/gzip',
-							'Content-Length': String(uploadSize),
+			if (initResult.uploadUrl) {
+				// Private snapshot: upload directly to S3
+				// Use Bun.file() directly as body - Bun sets Content-Length automatically from file size
+				await tui.spinner({
+					message: 'Uploading snapshot...',
+					clearOnSuccess: true,
+					callback: async () => {
+						const uploadFile = Bun.file(uploadPath);
+						const response = await fetch(initResult.uploadUrl!, {
+							method: 'PUT',
+							headers: {
+								'Content-Type': 'application/gzip',
+							},
+							body: uploadFile,
+						});
+
+						if (!response.ok) {
+							throw new Error(`Upload failed: ${response.status} ${response.statusText}`);
+						}
+					},
+				});
+			} else {
+				// Public snapshot: upload via Catalyst (with virus scanning)
+				try {
+					await tui.spinner({
+						message: 'Uploading and scanning snapshot...',
+						type: 'progress',
+						clearOnSuccess: true,
+						clearOnError: true,
+						callback: async (updateProgress) => {
+							const uploadFile = Bun.file(uploadPath);
+							const progressStream = createProgressStream(uploadFile, uploadSize, updateProgress);
+							await snapshotUpload(client, {
+								snapshotId: initResult.snapshotId!,
+								body: progressStream,
+								contentLength: uploadSize,
+								orgId,
+							});
 						},
-						body: uploadFile,
 					});
-
-					if (!response.ok) {
-						throw new Error(`Upload failed: ${response.status} ${response.statusText}`);
+				} catch (err) {
+					const errorMessage = err instanceof Error ? err.message : String(err);
+					const malwareMatch = MALWARE_REGEX.exec(errorMessage);
+
+					if (malwareMatch) {
+						const virusName = malwareMatch[1];
+
+						if (options.json) {
+							console.log(
+								JSON.stringify(
+									{
+										snapshotId: '',
+										name: finalName ?? '',
+										tag: opts.tag ?? 'latest',
+										runtime: buildConfig.runtime,
+										sizeBytes: totalSize,
+										fileCount: fileList.length,
+										createdAt: new Date().toISOString(),
+										error: errorMessage,
+										malwareDetected: true,
+										virusName,
+									},
+									null,
+									2
+								)
+							);
+							process.exit(ErrorCode.MALWARE_DETECTED);
+						}
+
+						console.log('');
+						tui.errorBox(
+							'Malware Detected',
+							`Your snapshot was rejected because it contains malware.\n\nVirus: ${virusName}\n\nPlease remove the infected files and try again.`
+						);
+						tui.fatal(
+							'Snapshot build failed due to malware detection',
+							ErrorCode.MALWARE_DETECTED
+						);
 					}
 
-					updateProgress(100);
-				},
-			});
+					throw err;
+				}
+			}
 
 			const snapshot = await tui.spinner({
 				message: 'Finalizing snapshot...',