@aopslabs/aops 0.3.16 → 0.3.18

package/dist/commands/global-update.js

@@ -1,14 +1,18 @@
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, writeFileSync, } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, readdirSync, readlinkSync, readFileSync, realpathSync, writeFileSync, } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { compareCanonicalText } from '@aopslabs/artifact-trust-contracts';
-import { Command } from 'commander';
+import { Command, Option } from 'commander';
+import { isCommunityDiagnosticV1 } from '../lib/community-diagnostic.js';
 const CHECK_CONTRACT = 'aops.global-update-check/v1';
 const PLAN_CONTRACT = 'aops.global-update-plan/v1';
 const RESULT_CONTRACT = 'aops.global-update-result/v1';
+const EXECUTOR_CONTRACT = 'aops.global-update-executor/v1';
+const RESULT_FILE = 'update-result.json';
+const EXECUTOR_RECEIPT_FILE = 'executor-receipt.json';
 const PUBLIC_REGISTRY = 'https://registry.npmjs.org';
 const EXACT_STABLE_VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/u;
 const PLAN_ID = /^sha256:[a-f0-9]{64}$/u;
@@ -20,6 +24,16 @@ const HEALTH_SAMPLES = 4;
 const HEALTH_INTERVAL_MS = 3_000;
 const HEALTH_STARTUP_ATTEMPTS = 30;
 const HEALTH_STARTUP_INTERVAL_MS = 2_000;
+class ChildCommandError extends Error {
+    status;
+    diagnostic;
+    constructor(command, status, diagnostic) {
+        super(`${path.basename(command)} failed with status ${status ?? 'unknown'}`);
+        this.name = 'ChildCommandError';
+        this.status = status;
+        this.diagnostic = diagnostic;
+    }
+}
 function cleanEnvironment() {
     return {
         ...process.env,
@@ -44,7 +58,17 @@ function defaultRunner(command, args, cwd = process.cwd()) {
     });
     if (result.error)
         throw result.error;
-    assert.equal(result.status, 0, `${command} ${args.join(' ')} failed\n${result.stdout}\n${result.stderr}`);
+    if (result.status !== 0) {
+        let diagnostic;
+        try {
+            const parsed = JSON.parse(result.stderr.trim());
+            if (isCommunityDiagnosticV1(parsed.error))
+                diagnostic = parsed.error;
+        }
+        catch {
+        }
+        throw new ChildCommandError(command, result.status, diagnostic);
+    }
     return result.stdout;
 }
 export function resolveNpmInvocation(options = {}) {
@@ -54,13 +78,12 @@ export function resolveNpmInvocation(options = {}) {
     const nodeExecutable = path.resolve(options.nodeExecutable ?? process.execPath);
     const environment = options.environment ?? process.env;
     const fileExists = options.fileExists ?? existsSync;
-    const candidates = [
-        path.join(path.dirname(nodeExecutable), 'node_modules', 'npm', 'bin', 'npm-cli.js'),
-    ];
+    const candidates = [];
     const npmExecPath = environment.npm_execpath?.trim();
     if (npmExecPath && /^npm-cli\.(?:c?js)$/iu.test(path.basename(npmExecPath))) {
         candidates.push(path.resolve(npmExecPath));
     }
+    candidates.push(path.join(path.dirname(nodeExecutable), 'node_modules', 'npm', 'bin', 'npm-cli.js'));
     for (const entry of String(environment.PATH ?? '').split(path.delimiter)) {
         if (!entry.trim())
             continue;
@@ -108,6 +131,57 @@ export function compareStableVersions(left, right) {
 function sha256(file) {
     return createHash('sha256').update(readFileSync(file)).digest('hex');
 }
+function executorTreeInventory(executorRoot) {
+    const root = plainDirectory(executorRoot, 'candidate executor root');
+    const records = [];
+    let totalBytes = 0;
+    const visit = (directory, prefix) => {
+        for (const entry of readdirSync(directory, { withFileTypes: true })
+            .sort((left, right) => compareCanonicalText(left.name, right.name))) {
+            const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+            const absolute = path.join(directory, entry.name);
+            const stat = lstatSync(absolute);
+            const normalizedRelative = relative.replace(/\\/gu, '/');
+            if (stat.isSymbolicLink()) {
+                const target = readlinkSync(absolute);
+                const resolved = realpathSync.native(absolute);
+                ensureWithin(root, resolved, `candidate executor link ${normalizedRelative}`);
+                records.push({
+                    path: normalizedRelative,
+                    type: 'link',
+                    target: target.replace(/\\/gu, '/'),
+                    resolved: path.relative(root, resolved).replace(/\\/gu, '/'),
+                });
+                assert.equal(records.length <= 20_000, true, 'candidate executor entry bound exceeded');
+                continue;
+            }
+            if (stat.isDirectory()) {
+                records.push({ path: normalizedRelative, type: 'directory', mode: stat.mode & 0o777 });
+                assert.equal(records.length <= 20_000, true, 'candidate executor entry bound exceeded');
+                visit(absolute, relative);
+                continue;
+            }
+            assert.equal(stat.isFile(), true, `candidate executor entry invalid: ${normalizedRelative}`);
+            const canonical = plainFile(absolute, `candidate executor file ${normalizedRelative}`);
+            ensureWithin(root, canonical, `candidate executor file ${normalizedRelative}`);
+            totalBytes += stat.size;
+            records.push({
+                path: normalizedRelative,
+                type: 'file',
+                mode: stat.mode & 0o777,
+                bytes: stat.size,
+                sha256: sha256(canonical),
+            });
+            assert.equal(records.length <= 20_000, true, 'candidate executor entry bound exceeded');
+            assert.equal(totalBytes <= 512 * 1024 * 1024, true, 'candidate executor package byte bound exceeded');
+        }
+    };
+    visit(root, '');
+    return {
+        entryCount: records.length,
+        sha256: createHash('sha256').update(JSON.stringify(records)).digest('hex'),
+    };
+}
 function plainDirectory(candidate, label) {
     const absolute = path.resolve(candidate);
     const stat = lstatSync(absolute);
@@ -364,6 +438,136 @@ export function readGlobalUpdatePlan(planPath) {
     assert.equal(plan.safety.healthStartupIntervalMs, HEALTH_STARTUP_INTERVAL_MS);
     return plan;
 }
+function readCandidateExecutorReceipt(plan, receiptPath) {
+    const operationRoot = plainDirectory(plan.operationRoot, 'global update operation root');
+    const resolved = plainFile(receiptPath, 'global update executor receipt');
+    assert.equal(resolved, path.join(operationRoot, EXECUTOR_RECEIPT_FILE), 'global update executor receipt must stay at the operation root');
+    const receipt = parseJson(readFileSync(resolved, 'utf8'), 'global_update_executor_receipt');
+    assert.equal(receipt.schemaVersion, 1);
+    assert.equal(receipt.contract, EXECUTOR_CONTRACT);
+    assert.equal(receipt.planId, plan.planId, 'global update executor plan identity mismatch');
+    const executorRoot = plainDirectory(receipt.executorRoot, 'global update executor root');
+    ensureWithin(operationRoot, executorRoot, 'global update executor root');
+    assert.equal(executorRoot, path.join(operationRoot, 'executor'));
+    const entrypoint = plainFile(receipt.entrypoint, 'global update executor entrypoint');
+    ensureWithin(executorRoot, entrypoint, 'global update executor entrypoint');
+    assert.equal(entrypoint, receipt.entrypoint, 'global update executor entrypoint must be canonical');
+    assert.match(receipt.entrypointSha256, SHA256);
+    assert.equal(sha256(entrypoint), receipt.entrypointSha256, 'global update executor entrypoint changed');
+    const candidate = packageRecordByName(plan.candidates, '@aopslabs/aops');
+    assert.equal(receipt.candidate.version, candidate.version);
+    assert.equal(receipt.candidate.sha256, candidate.sha256);
+    const executorPackageRoot = path.join(executorRoot, 'node_modules', '@aopslabs', 'aops');
+    const executorManifest = packageManifest(executorPackageRoot, '@aopslabs/aops');
+    assert.equal(executorManifest.version, plan.target.packages.cli);
+    const dependencies = executorManifest.dependencies;
+    assert.equal(dependencies?.['@aopslabs/aops-server'], plan.target.packages.server);
+    const executorServer = packageManifest(path.join(executorRoot, 'node_modules', '@aopslabs', 'aops-server'), '@aopslabs/aops-server');
+    assert.equal(executorServer.version, plan.target.packages.server);
+    assert.equal(Number.isSafeInteger(receipt.executorEntryCount), true);
+    assert.match(receipt.executorContentSha256, SHA256);
+    const inventory = executorTreeInventory(executorRoot);
+    assert.equal(inventory.entryCount, receipt.executorEntryCount, 'candidate executor entry count changed');
+    assert.equal(inventory.sha256, receipt.executorContentSha256, 'candidate executor content changed');
+    return receipt;
+}
+export function stageCandidateGlobalUpdateExecutor(plan, run = defaultRunner) {
+    const receiptPath = path.join(plan.operationRoot, EXECUTOR_RECEIPT_FILE);
+    if (existsSync(receiptPath)) {
+        return { receipt: readCandidateExecutorReceipt(plan, receiptPath), receiptPath };
+    }
+    const executorRoot = path.join(plan.operationRoot, 'executor');
+    assert.equal(existsSync(executorRoot), false, 'unverified global update executor directory already exists');
+    mkdirSync(executorRoot, { mode: 0o700 });
+    const cacheRoot = path.join(plan.operationRoot, 'cache');
+    mkdirSync(cacheRoot, { recursive: true, mode: 0o700 });
+    const cli = packageRecordByName(plan.candidates, '@aopslabs/aops');
+    const server = packageRecordByName(plan.candidates, '@aopslabs/aops-server');
+    runNpm(run, publicNpmArgs([
+        '--prefix',
+        executorRoot,
+        'install',
+        '--ignore-scripts',
+        '--omit=dev',
+        '--prefer-offline',
+        `--cache=${cacheRoot}`,
+        '--fund=false',
+        '--audit=false',
+        cli.path,
+        server.path,
+    ]));
+    const entrypoint = plainFile(path.join(executorRoot, 'node_modules', '@aopslabs', 'aops', 'dist', 'main.js'), 'global update executor entrypoint');
+    const inventory = executorTreeInventory(executorRoot);
+    const receipt = {
+        schemaVersion: 1,
+        contract: EXECUTOR_CONTRACT,
+        planId: plan.planId,
+        executorRoot: plainDirectory(executorRoot, 'global update executor root'),
+        entrypoint,
+        entrypointSha256: sha256(entrypoint),
+        executorEntryCount: inventory.entryCount,
+        executorContentSha256: inventory.sha256,
+        candidate: { version: cli.version, sha256: cli.sha256 },
+    };
+    writeFileSync(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+    return { receipt: readCandidateExecutorReceipt(plan, receiptPath), receiptPath };
+}
+function validateCandidateExecutorInvocation(plan, receiptPath) {
+    const receipt = readCandidateExecutorReceipt(plan, receiptPath);
+    const invokedEntrypoint = plainFile(process.argv[1], 'invoked AOPS CLI entrypoint');
+    assert.equal(invokedEntrypoint, receipt.entrypoint, 'candidate update execution must run from the verified staged entrypoint');
+    return receipt;
+}
+export function validateLegacyGlobalUpdateBridgeInvocation(plan, invokedEntrypoint = process.argv[1]) {
+    const invoked = plainFile(invokedEntrypoint, 'legacy update bridge candidate entrypoint');
+    const globalCliRoot = plainDirectory(path.dirname(path.dirname(plan.cliPath)), 'planned global CLI root');
+    const relativeToGlobal = path.relative(globalCliRoot, invoked);
+    assert.equal(relativeToGlobal.startsWith('..') || path.isAbsolute(relativeToGlobal), true, 'legacy update bridge must run from an external exact candidate, not the installed old CLI');
+    const candidateRoot = plainDirectory(path.dirname(path.dirname(invoked)), 'legacy update bridge candidate root');
+    const manifest = packageManifest(candidateRoot, '@aopslabs/aops');
+    const version = exactVersion(manifest.version, 'legacy update bridge candidate version');
+    assert.equal(version, plan.target.packages.cli, 'legacy update bridge candidate must match the plan target');
+    return { candidateRoot, version };
+}
+export function dispatchGlobalUpdate(options, run = defaultRunner) {
+    const plan = readGlobalUpdatePlan(options.plan);
+    assert.equal(options.confirm, plan.planId, 'global update confirmation does not match the exact plan');
+    const resultPath = path.join(plan.operationRoot, RESULT_FILE);
+    assert.equal(existsSync(resultPath), false, 'global_update_plan_already_terminal');
+    let executorStarted = false;
+    try {
+        const { receipt, receiptPath } = stageCandidateGlobalUpdateExecutor(plan, run);
+        executorStarted = true;
+        return parseJson(run(process.execPath, [
+            receipt.entrypoint,
+            'update',
+            'apply',
+            '--plan',
+            options.plan,
+            '--confirm',
+            options.confirm,
+            '--executor-receipt',
+            receiptPath,
+            '--json',
+        ]).trim(), 'global_update_candidate_result');
+    }
+    catch (error) {
+        if (!existsSync(resultPath)) {
+            writeTerminalUpdateResult(plan, {
+                schemaVersion: 1,
+                contract: RESULT_CONTRACT,
+                status: executorStarted ? 'executor-result-missing' : 'executor-staging-failed',
+                planId: plan.planId,
+                failedStage: executorStarted ? 'candidate-executor' : 'stage-candidate-executor',
+                globalState: executorStarted ? 'unknown-requires-inspection' : 'unchanged',
+                rollbackPerformed: false,
+                error: safeUpdateError(error),
+                events: [],
+            });
+        }
+        throw new Error(`global update candidate executor failed; diagnostic record: ${resultPath}`, { cause: error });
+    }
+}
 export function installGlobalUpdateClosure(run, plan, records, topology) {
     const cli = packageRecordByName(records, '@aopslabs/aops');
     const server = packageRecordByName(records, '@aopslabs/aops-server');
@@ -528,9 +732,61 @@ export function validateLoopbackOrigin(value, label) {
     assert.equal(url.hash, '', `${label} must not include a fragment`);
     return url.origin;
 }
+function nestedCommunityDiagnostic(error) {
+    const pending = [error];
+    const visited = new Set();
+    while (pending.length > 0) {
+        const candidate = pending.shift();
+        if (!candidate || visited.has(candidate))
+            continue;
+        visited.add(candidate);
+        if (typeof candidate === 'object') {
+            const record = candidate;
+            if (isCommunityDiagnosticV1(record.diagnostic))
+                return record.diagnostic;
+            if (record.cause)
+                pending.push(record.cause);
+            if (candidate instanceof AggregateError)
+                pending.push(...candidate.errors);
+        }
+    }
+    return undefined;
+}
+function safeUpdateError(error) {
+    const diagnostic = nestedCommunityDiagnostic(error);
+    if (diagnostic) {
+        const details = diagnostic.details;
+        return Object.fromEntries(Object.entries({
+            code: diagnostic.code,
+            causeCode: diagnostic.cause.code,
+            phase: diagnostic.phase,
+            operationId: typeof details.operationId === 'string' && UUID.test(details.operationId)
+                ? details.operationId
+                : undefined,
+            operation: typeof details.operation === 'string' ? details.operation : undefined,
+            journalPhase: typeof details.journalPhase === 'string' ? details.journalPhase : undefined,
+            journalStep: typeof details.journalStep === 'string' ? details.journalStep : undefined,
+        }).filter(([, value]) => value !== undefined));
+    }
+    const original = error instanceof Error ? error.message : String(error ?? 'global update failed');
+    const message = original
+        .split(/\r?\n/u, 1)[0]
+        .replace(/https?:\/\/\S+/giu, '[REDACTED_URL]')
+        .replace(/((?:password|passwd|secret|token|api[_-]?key|authorization)\s*[=:]\s*)\S+/giu, '$1[REDACTED]')
+        .replace(/(?:[A-Za-z]:\\|\/)\S+/gu, '[REDACTED_PATH]')
+        .slice(0, 500);
+    const code = /\b(?:aops|community|global_update)_[a-z0-9_]+\b/iu.exec(original)?.[0]?.toLowerCase()
+        ?? 'global_update_failed';
+    return { code, message };
+}
+function writeTerminalUpdateResult(plan, result) {
+    const resultPath = path.join(plan.operationRoot, RESULT_FILE);
+    writeFileSync(resultPath, `${JSON.stringify(result, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+}
 export async function applyGlobalUpdate(options, run = defaultRunner, execution = defaultExecutionDependencies) {
     const plan = readGlobalUpdatePlan(options.plan);
     assert.equal(options.confirm, plan.planId, 'global update confirmation does not match the exact plan');
+    assert.equal(existsSync(path.join(plan.operationRoot, RESULT_FILE)), false, 'global_update_plan_already_terminal');
     const current = inspectGlobalInstall(run);
     assert.deepEqual(current.packages, plan.prior.packages, 'global packages changed after update planning');
     assert.deepEqual(current.topology, plan.prior.topology, 'global package topology changed after update planning');
@@ -538,31 +794,39 @@ export async function applyGlobalUpdate(options, run = defaultRunner, execution
     assertHealthyServices(serviceSnapshot(run, current.cliPath));
     const events = [];
     let applicationUpdateId = null;
+    let failedStage = 'stop-cockpit';
     try {
         stopService(run, current.cliPath, 'cockpit');
         events.push('stopped:cockpit');
+        failedStage = 'stop-server';
         stopService(run, current.cliPath, 'server');
         events.push('stopped:server');
+        failedStage = 'install-candidate';
         installGlobalUpdateClosure(run, plan, plan.candidates, plan.target.topology);
         events.push('installed:candidate');
+        failedStage = 'verify-candidate';
         const updated = inspectGlobalInstall(run);
         assert.deepEqual(updated.packages, plan.target.packages, 'installed candidate closure is not exact');
         assert.deepEqual(updated.topology, plan.target.topology, 'installed candidate topology is not canonical');
         if (plan.prior.packages.server === plan.target.packages.server) {
+            failedStage = 'start-unchanged-server';
             startService(run, updated.cliPath, 'server');
             events.push('started:server-unchanged');
         }
         else {
+            failedStage = 'update-server-application';
             applicationUpdateId = updateServerApplication(run, updated.cliPath, {
                 prior: plan.prior.packages.server,
                 target: plan.target.packages.server,
             });
             events.push('updated:server');
         }
+        failedStage = 'start-cockpit';
         startService(run, updated.cliPath, 'cockpit');
         events.push('started:cockpit');
+        failedStage = 'stable-health';
         const healthEvidence = await assertStableHealth(run, plan, execution);
-        return {
+        const result = {
             schemaVersion: 1,
             contract: RESULT_CONTRACT,
             status: 'updated',
@@ -573,9 +837,13 @@ export async function applyGlobalUpdate(options, run = defaultRunner, execution
             healthEvidence,
             next: 'Exit and reopen the AOPS TUI to run the newly installed binary.',
         };
+        writeTerminalUpdateResult(plan, result);
+        return result;
     }
     catch (updateError) {
+        const updateStage = failedStage;
         events.push('rollback:started');
+        let rollbackError;
         try {
             stopService(run, plan.cliPath, 'cockpit', true);
             stopService(run, plan.cliPath, 'server', true);
@@ -597,8 +865,64 @@ export async function applyGlobalUpdate(options, run = defaultRunner, execution
             events.push('rollback:healthy');
         }
         catch (rollbackError) {
-            throw new AggregateError([updateError, rollbackError], `global update and automatic rollback both failed; recovery artifacts remain at ${plan.operationRoot}`);
+            try {
+                const restoredForRecovery = inspectGlobalInstall(run);
+                assert.deepEqual(restoredForRecovery.packages, plan.prior.packages, 'service recovery package closure is not exact');
+                assert.deepEqual(restoredForRecovery.topology, plan.prior.topology, 'service recovery package topology is not exact');
+                stopService(run, restoredForRecovery.cliPath, 'cockpit', true);
+                stopService(run, restoredForRecovery.cliPath, 'server', true);
+                startService(run, restoredForRecovery.cliPath, 'server');
+                events.push('started:server-recovery');
+                startService(run, restoredForRecovery.cliPath, 'cockpit');
+                events.push('started:cockpit-recovery');
+                await assertStableHealth(run, plan, execution);
+                events.push('rollback:services-recovered');
+            }
+            catch (serviceRecoveryError) {
+                writeTerminalUpdateResult(plan, {
+                    schemaVersion: 1,
+                    contract: RESULT_CONTRACT,
+                    status: 'recovery-required',
+                    planId: plan.planId,
+                    failedStage: updateStage,
+                    rollbackPerformed: true,
+                    rollback: { status: 'failed', error: safeUpdateError(rollbackError) },
+                    serviceRecovery: { status: 'failed', error: safeUpdateError(serviceRecoveryError) },
+                    error: safeUpdateError(updateError),
+                    events,
+                });
+                throw new AggregateError([updateError, rollbackError, serviceRecoveryError], `global update, automatic rollback, and service recovery failed; services may remain stopped; recovery artifacts remain at ${plan.operationRoot}`);
+            }
+            writeTerminalUpdateResult(plan, {
+                schemaVersion: 1,
+                contract: RESULT_CONTRACT,
+                status: 'failed-restored',
+                planId: plan.planId,
+                failedStage: updateStage,
+                installed: plan.prior.packages,
+                rollbackPerformed: true,
+                rollback: {
+                    status: 'healthy',
+                    recovery: 'services-recovered',
+                    applicationRollbackError: safeUpdateError(rollbackError),
+                },
+                error: safeUpdateError(updateError),
+                events,
+            });
+            throw new AggregateError([updateError, rollbackError], `global update and application rollback failed; prior exact packages and healthy services were restored; recovery artifacts remain at ${plan.operationRoot}`);
         }
+        writeTerminalUpdateResult(plan, {
+            schemaVersion: 1,
+            contract: RESULT_CONTRACT,
+            status: 'failed-restored',
+            planId: plan.planId,
+            failedStage: updateStage,
+            installed: plan.prior.packages,
+            rollbackPerformed: true,
+            rollback: { status: 'healthy' },
+            error: safeUpdateError(updateError),
+            events,
+        });
         throw new Error('global update failed; the prior exact packages were restored and are healthy', { cause: updateError });
     }
 }
@@ -623,7 +947,27 @@ export function makeGlobalUpdateCommand() {
         .description('Apply one exact prepared plan with automatic rollback and health verification')
         .requiredOption('--plan <path>', 'Exact update-plan.json path returned by prepare')
         .requiredOption('--confirm <plan-id>', 'Exact sha256 plan id returned by prepare')
+        .addOption(new Option('--executor-receipt <path>').hideHelp())
         .option('--json', 'Output JSON')
-        .action(async (options) => output(await applyGlobalUpdate(options), options.json === true));
+        .action(async (options) => {
+        if (typeof options.executorReceipt === 'string') {
+            const plan = readGlobalUpdatePlan(options.plan);
+            validateCandidateExecutorInvocation(plan, options.executorReceipt);
+            output(await applyGlobalUpdate(options), options.json === true);
+            return;
+        }
+        output(dispatchGlobalUpdate(options), options.json === true);
+    });
+    command
+        .command('bridge')
+        .description('Apply an old-CLI plan from an externally launched exact public candidate')
+        .requiredOption('--plan <path>', 'Exact update-plan.json path returned by the installed old CLI')
+        .requiredOption('--confirm <plan-id>', 'Exact sha256 plan id returned by prepare')
+        .option('--json', 'Output JSON')
+        .action((options) => {
+        const plan = readGlobalUpdatePlan(options.plan);
+        validateLegacyGlobalUpdateBridgeInvocation(plan);
+        output(dispatchGlobalUpdate(options), options.json === true);
+    });
     return command;
 }

package/dist/lib/agent-assets/native-fs.js

@@ -543,9 +543,9 @@ function defaultNativeRoot() {
     return moduleDirectory.endsWith(`${path.sep}dist`) ? bundled : compiledOrSource;
 }
 function injectedNativeManifestSha256() {
-    return typeof "4adb33acb603e59a7468a00116b92ef15500fe8831a079235708261636780360" === 'undefined'
+    return typeof "859b976094fe8cde402fd4ff8b48716df0360ce7e30e698f43b6515216f4c95f" === 'undefined'
         ? undefined
-        : "4adb33acb603e59a7468a00116b92ef15500fe8831a079235708261636780360";
+        : "859b976094fe8cde402fd4ff8b48716df0360ce7e30e698f43b6515216f4c95f";
 }
 function sha256(bytes) {
     return createHash('sha256').update(bytes).digest('hex');

package/dist/lib/cli-error-format.js

@@ -0,0 +1,13 @@
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+export function formatCliError(error, depth = 0) {
+    const message = messageOf(error);
+    if (!(error instanceof AggregateError) || error.errors.length === 0 || depth >= 3)
+        return message;
+    const details = error.errors.map((cause, index) => {
+        const rendered = formatCliError(cause, depth + 1).replaceAll('\n', '\n    ');
+        return `  ${index + 1}. ${rendered}`;
+    });
+    return `${message}\n${details.join('\n')}`;
+}

package/dist/lib/community-native-lifecycle.js

@@ -23,7 +23,7 @@ const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-
 const MAX_CONFIG_BYTES = 65_536;
 const MAX_TLS_ROOT_CERT_BYTES = 1_048_576;
 const MIN_EXACT_SECRET_REDACTION_LENGTH = 8;
-const DEFAULT_READY_TIMEOUT_MS = 30_000;
+const DEFAULT_READY_TIMEOUT_MS = 120_000;
 const DEFAULT_STOP_TIMEOUT_MS = 15_000;
 const READY_POLL_MS = 250;
 const MAX_LOG_TAIL_BYTES = 4 * 1024 * 1024;

package/dist/main.js

@@ -41,6 +41,7 @@ import { makeGlobalUpdateCommand } from './commands/global-update.js';
 import { launchBundledTui, shouldLaunchBundledTui } from './lib/tui-launcher.js';
 import { CommunityDiagnosticError, formatCommunityDiagnostic, } from './lib/community-diagnostic.js';
 import { resolveCliApiBaseUrl } from './utils/api.js';
+import { formatCliError } from './lib/cli-error-format.js';
 const KERNEL_COMMANDS_REPLACED_BY_AOPS = new Set(['agent', 'api', 'auth', 'client', 'host']);
 function removeReplacedKernelCommands(program) {
     const mutable = program;
@@ -204,7 +205,7 @@ async function main() {
             }
         }
         else {
-            logError(String(error?.message ?? error));
+            logError(formatCliError(error));
         }
         process.exitCode = 1;
     }