@coderook/cli 0.37.0 → 0.38.2

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, with cbx or plain git, from Claude Code.",
-  "version": "0.37.0",
+  "version": "0.38.2",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cbx/src/core/upload.js

@@ -30,6 +30,7 @@ const solid_js_1 = require("./solid.js");
 const retry_js_1 = require("./retry.js");
 const staging_js_1 = require("./staging.js");
 const transfer_progress_js_1 = require("./transfer_progress.js");
+const upload_completion_js_1 = require("./upload_completion.js");
 const delta_js_1 = require("../shared/delta.js");
 const telemetry_js_1 = require("../shared/telemetry.js");
 /** Above this the API insists on a multipart session. */
@@ -230,6 +231,7 @@ class Uploader {
             // waiting rather than serve out its backoff first.
             this.check();
             try {
+                init.onAttempt?.(attempt);
                 return await this.attempt(route, init);
             }
             catch (error) {
@@ -243,6 +245,7 @@ class Uploader {
                 if (attempt >= retry_js_1.RETRY_ATTEMPTS || !(0, retry_js_1.worthRetrying)(error))
                     throw error;
                 this.telemetry.retry();
+                init.onRetry?.(attempt + 1, wait);
                 await this.pause(wait);
                 wait *= 2;
             }
@@ -928,27 +931,22 @@ class Uploader {
             (details ? ` Details: ${details}` : ""));
     }
     async publishVersion(at) {
+        const initial = {
+            stage: "publish", files: at.declarations.length, totalFiles: at.declarations.length,
+            bytes: at.progress.sentBytes, totalBytes: at.totalBytes, percent: 96,
+            bytesPerSecond: 0, path: "Preparing the file manifest",
+            completion: { phase: "preparing", elapsedSeconds: 0 },
+        };
+        return (0, upload_completion_js_1.withCompletionProgress)(initial, at.report, (report) => this.recordVersion({ ...at, report }));
+    }
+    async recordVersion(at) {
         const { request, repositoryId, declarations, uploaded, reused, prior, everything, ticked, deletions, readFailures, vanished, totalBytes, progress, report, } = at;
         // 4. Name the version, which is what makes the upload visible.
         this.check();
-        report({
-            stage: "publish",
-            files: declarations.length,
-            totalFiles: declarations.length,
-            bytes: progress.sentBytes,
-            totalBytes,
-            /*
-              A save, not a version.
-      
-              Sending produces a commit; it becomes a version when somebody names
-              it, which happens later and on purpose. This line said "Recording the
-              version" while doing neither — it was the last wording left over from
-              before the two were separate, and it sat on the one screen a person
-              watches to the end.
-            */
-            path: "Writing down what was sent",
-            percent: 96,
-            bytesPerSecond: progress.rate(),
+        const completing = (phase, path) => report({
+            stage: "publish", files: declarations.length, totalFiles: declarations.length,
+            bytes: progress.sentBytes, totalBytes, percent: 96, bytesPerSecond: 0,
+            path, completion: { phase, elapsedSeconds: 0 },
         });
         // The version names everything the project holds: what was just sent,
         // plus every file that kept the object the last version pointed at.
@@ -1081,53 +1079,61 @@ class Uploader {
                 },
             }
             : null;
-        const send = (asChanges) => (0, profile_js_1.timed)("publish the version", () => this.call(`/v1/repositories/${repositoryId}/versions`, {
-            method: "POST",
-            contentType: "application/json",
-            body: JSON.stringify({
-                message: request.message.trim() || "Saved from the CodeRook desktop app",
-                ...(request.baseVersionId === undefined
-                    ? {}
-                    : {
-                        ancestryMode: "required",
-                        baseVersionId: request.baseVersionId,
+        const send = (asChanges) => {
+            completing("confirming", "Files uploaded · waiting for CodeRook to confirm the save");
+            return (0, profile_js_1.timed)("publish the version", () => this.call(`/v1/repositories/${repositoryId}/versions`, {
+                method: "POST",
+                contentType: "application/json",
+                onAttempt: (attempt) => {
+                    if (attempt > 1)
+                        completing("confirming", `Retry ${attempt} · waiting for CodeRook to confirm the save`);
+                },
+                onRetry: (attempt, waitMs) => completing("retrying", `Confirmation interrupted · retry ${attempt} in ${Math.ceil(waitMs / 1000)} s · uploaded files are reused`),
+                body: JSON.stringify({
+                    message: request.message.trim() || "Saved from the CodeRook desktop app",
+                    ...(request.baseVersionId === undefined
+                        ? {}
+                        : {
+                            ancestryMode: "required",
+                            baseVersionId: request.baseVersionId,
+                        }),
+                    ...(request.expectedHeadVersionId === undefined
+                        ? {}
+                        : { expectedHeadVersionId: request.expectedHeadVersionId }),
+                    ...(request.track ? { track: request.track } : {}),
+                    ...(request.allowIgnored ? { allowIgnored: true } : {}),
+                    ...(this.trackedByGit.length ? { trackedByGit: this.trackedByGit } : {}),
+                    ...(request.allowSecrets ? { allowSecrets: true } : {}),
+                    ...(linesAdded === undefined ? {} : { linesAdded }),
+                    ...(linesRemoved === undefined ? {} : { linesRemoved }),
+                    /*
+                      Names this attempt so a retry after a lost connection is answered
+                      with the version already made, rather than making a second one.
+                    */
+                    idempotencyKey: (0, publish_name_js_1.publishAttemptName)({
+                        repositoryId,
+                        expectedHeadVersionId: request.expectedHeadVersionId,
+                        message: request.message,
+                        /*
+                          Named by what each file is. A whole file is its object; a chunked
+                          one is the digest of its contents — so retrying the same publish
+                          produces the same key either way, which is the point of it.
+                        */
+                        files: contents.map((item) => ({
+                            path: item.path,
+                            objectId: item.objectId ?? item.sha256 ?? "",
+                        })),
                     }),
-                ...(request.expectedHeadVersionId === undefined
-                    ? {}
-                    : { expectedHeadVersionId: request.expectedHeadVersionId }),
-                ...(request.track ? { track: request.track } : {}),
-                ...(request.allowIgnored ? { allowIgnored: true } : {}),
-                ...(this.trackedByGit.length ? { trackedByGit: this.trackedByGit } : {}),
-                ...(request.allowSecrets ? { allowSecrets: true } : {}),
-                ...(linesAdded === undefined ? {} : { linesAdded }),
-                ...(linesRemoved === undefined ? {} : { linesRemoved }),
-                /*
-                  Names this attempt so a retry after a lost connection is answered
-                  with the version already made, rather than making a second one.
-                */
-                idempotencyKey: (0, publish_name_js_1.publishAttemptName)({
-                    repositoryId,
-                    expectedHeadVersionId: request.expectedHeadVersionId,
-                    message: request.message,
+                    sourceSize: sourceBytes,
+                    storedSize: storedBytes,
                     /*
-                      Named by what each file is. A whole file is its object; a chunked
-                      one is the digest of its contents — so retrying the same publish
-                      produces the same key either way, which is the point of it.
+                      One shape or the other, never both — the service refuses a file that
+                      names an object and a chunk list, and so does its database.
                     */
-                    files: contents.map((item) => ({
-                        path: item.path,
-                        objectId: item.objectId ?? item.sha256 ?? "",
-                    })),
+                    ...(asChanges && changesOnly ? changesOnly : { files: wire }),
                 }),
-                sourceSize: sourceBytes,
-                storedSize: storedBytes,
-                /*
-                  One shape or the other, never both — the service refuses a file that
-                  names an object and a chunk list, and so does its database.
-                */
-                ...(asChanges && changesOnly ? changesOnly : { files: wire }),
-            }),
-        }));
+            }));
+        };
         /*
           A service that cannot build on the version named (it was taken down,
           say) answers files_from_*; the whole list is then sent instead, which
@@ -1147,6 +1153,7 @@ class Uploader {
           instead. A repeated attempt predates manifest echoing, so read that
           Version once rather than guessing.
         */
+        completing("local", "CodeRook confirmed the save · updating local records");
         let acceptedManifest = (0, publication_js_1.acceptedManifestDigests)(completed.manifest?.files);
         /*
           A service that lists version-delta-v1 also says when it combined this
@@ -1162,6 +1169,7 @@ class Uploader {
             !request.allowSecrets &&
             (await this.versionDeltaAllowed());
         if (!completed.mergeTrack && !landedAsSent && !Object.keys(acceptedManifest).length) {
+            completing("local", "CodeRook confirmed the save · reading the accepted file manifest");
             acceptedManifest = Object.fromEntries([...(await this.versionFiles(repositoryId, completed.version.id, request.localPath))].map(([file, descriptor]) => [file, descriptor.sha256]));
         }
         const manifest = Object.keys(acceptedManifest).length
@@ -1181,6 +1189,7 @@ class Uploader {
           file, which on a 47,000-file project was over a billion comparisons at
           the very end of a save.
         */
+        completing("local", "CodeRook confirmed the save · updating local file records");
         const sentDigest = new Map(declarations.map((declaration) => [declaration.path, declaration.sha256]));
         /*
           A file named from bytes already stored, at a path the last version did
@@ -1231,6 +1240,7 @@ class Uploader {
             if (rows.every((row) => typeof row.sha256 === "string" && row.sha256.length === 64)) {
                 const key = `${repositoryId}/${completed.version.id}`;
                 versionListings.set(key, Promise.resolve(rows));
+                completing("local", "CodeRook confirmed the save · caching the file listing for next time");
                 await writeListing(request.localPath, repositoryId, completed.version.id, rows);
             }
         }

package/dist/cbx/src/core/upload_completion.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withCompletionProgress = withCompletionProgress;
+/** Keep a pending completion visible without inventing server-side progress.
+ * Every phase change comes from the uploader; ticks only measure elapsed time.
+ */
+async function withCompletionProgress(initial, report, work) {
+    const started = performance.now();
+    let latest = initial;
+    let active = true;
+    const emit = (progress) => {
+        latest = progress;
+        if (progress.stage !== "publish")
+            active = false;
+        report(progress.stage === "publish" ? {
+            ...progress,
+            completion: {
+                phase: progress.completion?.phase ?? "preparing",
+                elapsedSeconds: Math.max(0, (performance.now() - started) / 1000),
+            },
+        } : progress);
+    };
+    emit(initial);
+    const timer = setInterval(() => { if (active)
+        emit(latest); }, 1000);
+    timer.unref?.();
+    try {
+        return await work(emit);
+    }
+    finally {
+        active = false;
+        clearInterval(timer);
+    }
+}

package/dist/cli/src/cli.js

@@ -22,10 +22,12 @@ const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
 const node_process_1 = __importDefault(require("node:process"));
+const workspace_command_js_1 = require("./workspace_command.js");
 const api_js_1 = require("./api.js");
 const registry_js_1 = require("./registry.js");
 const help_js_1 = require("./help.js");
 const progress_js_1 = require("./progress.js");
+const upload_progress_js_1 = require("./upload_progress.js");
 const publish_js_1 = require("./publish.js");
 const attach_command_js_1 = require("./attach_command.js");
 const build_command_js_1 = require("./build_command.js");
@@ -686,7 +688,7 @@ async function commandImport(parsed) {
         flags: submitFlags,
     });
     if (code === 0 && plan.temporary) {
-        console.log(dim(`The working copy stays at ${plan.folder} until you remove it.
+        console.log(dim(`The working copy stays at ${plan.folder} until you remove it.
 ` +
             `Run ${accent("cbx get " + plan.name)} anywhere to fetch it fresh.`));
     }
@@ -972,17 +974,17 @@ async function commandSubmit(parsed) {
     */
     const shielded = (await (0, worktree_js_1.detectPrivateDirectories)(folder)).filter((finding) => [...sending].some((file) => file === finding.path || file.startsWith(`${finding.path}/`)));
     if (shielded.length && !hasFlag(parsed, "allow-private")) {
-        console.log(red(`
+        console.log(red(`
 ${shielded.length} folder${shielded.length === 1 ? "" : "s"} here belong${shielded.length === 1 ? "s" : ""} to a program, not to your project:`));
         for (const finding of shielded) {
             console.log(`  ${finding.path}  ${dim(`— ${finding.because}`)}`);
         }
-        console.log(`
+        console.log(`
 Nothing was sent. To leave them behind:`);
         for (const finding of shielded) {
             console.log(`  ${accent(`echo "${finding.rule}" >> .gitignore`)}`);
         }
-        console.error(`
+        console.error(`
 Or pass ${accent("--allow-private")} if they genuinely belong in the project.`);
         return 1;
     }
@@ -1031,7 +1033,7 @@ Or pass ${accent("--allow-private")} if they genuinely belong in the project.`);
             `rest were not opened.`));
     }
     if (stillPasted.length) {
-        console.log(red(`
+        console.log(red(`
 ${stillPasted.length} file${stillPasted.length === 1 ? " has a credential" : "s have credentials"} inside:`));
         for (const finding of stillPasted.slice(0, 20)) {
             console.log(`  ${finding.path}`);
@@ -1046,11 +1048,11 @@ ${stillPasted.length} file${stillPasted.length === 1 ? " has a credential" : "s
             console.log(dim(`  …and ${stillPasted.length - 20} more`));
         }
         if (!hasFlag(parsed, "allow-secrets")) {
-            console.error(`
+            console.error(`
 Nothing was sent. Move the key into an environment variable, and if` +
                 ` it has ever been published, replace it at the service that issued` +
                 ` it — a key that has leaked stays leaked.` +
-                `
+                `
 Pass ${accent("--allow-secrets")} if these are not real keys.`);
             return 1;
         }
@@ -1070,6 +1072,7 @@ Pass ${accent("--allow-secrets")} if these are not real keys.`);
         console.log("");
     }
     const line = progressLine();
+    const uploadDisplay = new upload_progress_js_1.UploadDisplay();
     let uploader = new upload_js_1.Uploader(config_js_1.credentials);
     /*
       Built by the shared description, so this and the git remote helper cannot
@@ -1225,14 +1228,12 @@ Pass ${accent("--allow-secrets")} if these are not real keys.`);
                 console.log("Nothing was uploaded and no Version was created.");
                 return 0;
             }
-            result = await uploader.execute(uploadRequest, plan, (progress) => {
-                line(`  ${track(progress.percent)} ${String(progress.percent).padStart(3)}%  ` +
-                    `${progress.stage.padEnd(7)} ${progress.files}/${progress.totalFiles}  ` +
-                    dim(progress.path.slice(-40)));
-            });
+            result = await uploader.execute(uploadRequest, plan, (progress) => uploadDisplay.report(progress));
+            uploadDisplay.done();
             break;
         }
         catch (error) {
+            uploadDisplay.done();
             done(line);
             /*
               Classified by the shared description rather than by a private regular
@@ -1257,7 +1258,7 @@ Pass ${accent("--allow-secrets")} if these are not real keys.`);
                 continue;
             }
             if (failure?.kind === "interrupted") {
-                console.error(red(`
+                console.error(red(`
 The connection failed: ${text}`));
                 console.error(`Your work may already have been saved. Run the same command again —` +
                     ` it will not create a second version.`);
@@ -1500,7 +1501,7 @@ async function commandGet(parsed) {
                     `changed while the interrupted fetch was stopped:`));
                 for (const file of changedInTheGap.slice(0, 20))
                     console.error(`  ${file.path}`);
-                console.error(`
+                console.error(`
 Save them with ${accent("cbx submit")}, or finish the fetch and ` +
                     `discard them with ${accent("cbx get --replace")}.`);
                 return 1;
@@ -1783,8 +1784,8 @@ async function suggestRules(folder, apply) {
     const addition = (0, detect_js_1.rulesFromSuggestions)(recommended);
     const shared = rules.shared.trimEnd();
     await (0, worktree_js_1.writeRules)(folder, {
-        shared: shared ? `${shared}
-
+        shared: shared ? `${shared}
+
 ${addition}` : addition,
         local: rules.local,
     });
@@ -1989,7 +1990,7 @@ async function commandMerges(parsed) {
         const counts = merge.conflicts;
         console.log(`${accent(merge.reference)}  ${counts ? `${counts.unresolved} of ${counts.total} still to decide` : ""}  ${dim(new Date(merge.createdAt).toLocaleString())}`);
     }
-    console.log(dim(`
+    console.log(dim(`
 Run cbx merge <reference> to look at one.`));
     return 0;
 }
@@ -2092,7 +2093,7 @@ async function commandMerge(parsed) {
             console.log(dim(`  waiting on ${waiting.map((person) => person.displayName).join(", ")}`));
         }
     }
-    console.log(`
+    console.log(`
 ${accent(now.mergeTrack.reference)} · ` +
         /*
           The combined version is only counted once it can be built; until then
@@ -2111,7 +2112,7 @@ ${accent(now.mergeTrack.reference)} · ` +
             return 1;
         }
         const applied = await (0, api_js_1.applyMerge)(summary.id);
-        console.log(`
+        console.log(`
 Applied as ${accent(`v${applied.version.sequence}`)}.`);
         if (applied.closedIssues?.length) {
             console.log(`Closed ${applied.closedIssues.map((number) => `#${number}`).join(", ")}.`);
@@ -2121,13 +2122,13 @@ Applied as ${accent(`v${applied.version.sequence}`)}.`);
     }
     const stillOpen = now.conflicts.some((conflict) => !conflict.resolvedAt);
     if (!decision && stillOpen) {
-        console.log(dim(`
+        console.log(dim(`
 --mine keeps yours, --theirs keeps what was already saved,` +
-            ` --both keeps theirs and saves yours beside it, --drop removes the file.
+            ` --both keeps theirs and saves yours beside it, --drop removes the file.
 Add --path <file> for one file, then --apply when ready.`));
     }
     else if (now.provisional.ready) {
-        console.log(dim(`
+        console.log(dim(`
 Run cbx merge ${now.mergeTrack.reference} --apply to publish it.`));
     }
     return 0;
@@ -2713,6 +2714,33 @@ const SPECS = [
         ],
         run: project_commands_js_1.commandVersions,
     },
+    {
+        name: "workspace",
+        group: "Your projects",
+        summary: "edit, save and run a private project remotely without a checkout",
+        usage: "workspace <open|list|show|read|files|search|diff|patch|save|run|logs|cancel|deploy|preview|handoff|close|recipe> <project> [workspace] [job]",
+        detail: "Works on CodeRook's durable remote draft, never the current local folder. Use --data-file for structured edits or recipe configuration. Mutations need the reviewed --revision and a unique --key; reuse the same key and request when retrying. Recipes reference existing project workflows. Saving and deploying are separate operations.",
+        options: [
+            { flags: "--data-file <path>", description: "read an operation's JSON from this local file" },
+            { flags: "--name <name>", description: "name a new workspace" },
+            { flags: "--track <track>", description: "base the workspace on this project Track" },
+            { flags: "--base-version <id>", description: "select a saved base version" },
+            { flags: "--revision <number>", description: "the exact reviewed workspace revision" },
+            { flags: "--key <operation-key>", description: "unique idempotency key; preserve it for retries" },
+            { flags: "--path <path>", description: "read this project-relative file" },
+            { flags: "--query <text>", description: "text to find in the remote workspace" },
+            { flags: "--offset <number>", description: "continue a paginated listing, search or diff" },
+            { flags: "--start-line <number>", description: "first text line to read" },
+            { flags: "--lines <number>", description: "maximum text lines to read" },
+            { flags: "--recipe <name>", description: "configured hosted execution recipe" },
+            { flags: "--target <target>", description: "exact configured deployment target" },
+            { flags: "--version <id>", description: "saved workspace version to deploy" },
+            { flags: "-m, --message <text>", description: "describe the version being saved" },
+            { flags: "--note <text>", description: "task context for another computer/assistant" },
+        ],
+        examples: ["cbx workspace open my-project --name \"Laptop work\" --key laptop-open-001", "cbx workspace list my-project"],
+        run: workspace_command_js_1.commandWorkspace,
+    },
     {
         name: "ai",
         group: "Your projects",
@@ -3670,7 +3698,8 @@ const SPECS = [
         name: "mcp",
         group: "Other",
         summary: "serve CodeRook to Claude Code, Codex and other assistants",
-        usage: "mcp",
+        usage: "mcp [--workspaces]",
+        options: [{ flags: "--workspaces", description: "opt into the remote connector's write/run/deploy tools and workspace permissions" }],
         detail: "Speaks the Model Context Protocol on stdin and stdout, so an assistant\n" +
             "can look at your projects while it works. Not run by hand — point the\n" +
             "assistant at it and it starts and stops the process itself.\n" +
@@ -3691,7 +3720,7 @@ const SPECS = [
             "A project whose owner has turned off machine reading is refused, in\n" +
             "words rather than as a status code.\n",
         examples: ["claude mcp add coderook -- cbx mcp"],
-        run: () => (0, mcp_js_1.commandMcp)(version_js_1.VERSION),
+        run: parsed => parsed.flags.has("workspaces") ? (0, workspace_command_js_1.commandWorkspaceMcp)() : (0, mcp_js_1.commandMcp)(version_js_1.VERSION),
     },
     {
         name: "doctor",

package/dist/cli/src/local_commands.js

@@ -26,6 +26,7 @@ exports.localMerge = localMerge;
  */
 const node_path_1 = __importDefault(require("node:path"));
 const node_process_1 = __importDefault(require("node:process"));
+const upload_progress_js_1 = require("./upload_progress.js");
 const history_js_1 = require("../../cbx/src/local/history.js");
 const merge_js_1 = require("../../cbx/src/local/merge.js");
 const repository_js_1 = require("../../cbx/src/local/repository.js");
@@ -384,6 +385,7 @@ async function localPush(parsed, repository) {
                 return 1;
         }
         const interactive = node_process_1.default.stdout.isTTY;
+        const uploadDisplay = new upload_progress_js_1.UploadDisplay();
         const result = await (0, remote_js_1.push)(repository, {
             credentials: config_js_1.credentials,
             projectName: link?.slug ?? (chosen ? ("id" in chosen ? chosen.slug : chosen.name) : node_path_1.default.basename(repository.root)),
@@ -392,10 +394,13 @@ async function localPush(parsed, repository) {
             allowSecrets: has(parsed, "allow-secrets"),
             acknowledged: has(parsed, "yes", "y"),
             report: (event) => {
+                if (event.kind === "upload")
+                    uploadDisplay.report(event.progress);
                 if (event.kind === "save" && interactive) {
                     node_process_1.default.stdout.write(`\r${dim(`Sending ${event.index + 1} of ${event.total}: ${event.save.message.split("\n")[0].slice(0, 50)}`)}   `);
                 }
                 if (event.kind === "pushed" || event.kind === "unchanged") {
+                    uploadDisplay.done();
                     if (interactive)
                         node_process_1.default.stdout.write(`\r${" ".repeat(80)}\r`);
                     console.log(`  ${accent(short(event.save.id))}  ` +
@@ -403,7 +408,7 @@ async function localPush(parsed, repository) {
                         `  ${event.save.message.split("\n")[0]}`);
                 }
             },
-        });
+        }).finally(() => uploadDisplay.done());
         if (!result.pushed.length) {
             console.log(`Everything on ${accent(result.line)} is already on CodeRook.`);
             return 0;

package/dist/cli/src/runner.js

@@ -32,6 +32,9 @@ exports.report = report;
 const node_child_process_1 = require("node:child_process");
 const node_crypto_1 = require("node:crypto");
 const promises_1 = require("node:fs/promises");
+const node_fs_1 = require("node:fs");
+const node_stream_1 = require("node:stream");
+const promises_2 = require("node:stream/promises");
 const node_os_1 = require("node:os");
 const node_os_2 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
@@ -395,7 +398,38 @@ async function performRun(repositoryId, run, runner) {
                 }
             });
         }, HEARTBEAT_MS);
-        if (run.versionId) {
+        if (run.workspaceInput) {
+            const input = await call(`/v1/repositories/${repositoryId}/workspace-runs/${run.runId}/input`);
+            run.command = input.command;
+            run.workingDirectory = input.workingDirectory;
+            run.artifactPaths = input.artifactPaths;
+            logs.add(`Fetching ${input.files.length} selected files from frozen workspace revision ${input.revision}…`, 'stdout');
+            const token = await (0, config_js_1.loadToken)();
+            for (const file of input.files) {
+                if (cancelled)
+                    throw new Error('Cancelled while fetching workspace input');
+                if (!/^[a-f0-9]{64}$/.test(file.sha256 ?? ''))
+                    throw new Error(`The frozen file ${file.path} has no verified content digest`);
+                const destination = insideWorkspace(workspace, file.path);
+                await (0, promises_1.mkdir)(node_path_1.default.dirname(destination), { recursive: true });
+                const response = await fetch(`${(0, config_js_1.apiOrigin)()}/v1/repositories/${repositoryId}/workspace-runs/${run.runId}/input/${file.index}`, { headers: { authorization: `Bearer ${token}`, ...(0, identify_js_1.clientHeaders)() }, signal: AbortSignal.timeout(REQUEST_DEADLINE_MS) });
+                if (!response.ok || !response.body)
+                    throw new Error(`Could not fetch frozen workspace file ${file.path} (${response.status})`);
+                const hash = (0, node_crypto_1.createHash)('sha256');
+                let bytes = 0;
+                const verify = new node_stream_1.Transform({ transform(chunk, _encoding, callback) { bytes += chunk.length; if (bytes > file.size) {
+                        callback(new Error('Frozen workspace file exceeds its declared size'));
+                        return;
+                    } hash.update(chunk); callback(null, chunk); } });
+                await (0, promises_2.pipeline)(node_stream_1.Readable.fromWeb(response.body), verify, (0, node_fs_1.createWriteStream)(destination));
+                if (bytes !== file.size || hash.digest('hex') !== file.sha256)
+                    throw new Error(`Frozen content verification failed for ${file.path}; credential-bearing source must use separately configured credentials`);
+                if (file.executable && process.platform !== 'win32')
+                    await (0, promises_1.chmod)(destination, 0o755);
+            }
+            logs.add('Selected workspace inputs verified.', 'stdout');
+        }
+        else if (run.versionId) {
             logs.add(`Fetching v${run.versionSequence ?? "?"}…`, "stdout");
             /*
               The one phase that knows its own size. The version says how many files

package/dist/cli/src/upload_progress.js

@@ -0,0 +1,41 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UploadDisplay = void 0;
+const node_process_1 = __importDefault(require("node:process"));
+const progress_1 = require("./progress");
+/** The timer in the shared uploader keeps finalization visible in every client. */
+class UploadDisplay {
+    interactive;
+    write;
+    phase = "";
+    frame = 0;
+    constructor(interactive = Boolean(node_process_1.default.stdout.isTTY), write = (text) => { node_process_1.default.stdout.write(text); }) {
+        this.interactive = interactive;
+        this.write = write;
+    }
+    report(progress) {
+        const finishing = progress.stage === "publish";
+        const phase = finishing ? progress.path : progress.stage;
+        if (!this.interactive) {
+            if (finishing && phase !== this.phase)
+                this.write(`  ${phase}\n`);
+            this.phase = phase;
+            return;
+        }
+        this.phase = phase;
+        const seconds = Math.floor(progress.completion?.elapsedSeconds ?? 0);
+        const clock = `${Math.floor(seconds / 60)}:${String(seconds % 60).padStart(2, "0")}`;
+        const detail = finishing
+            ? `${["|", "/", "-", "\\"][this.frame++ % 4]} Finalizing save · ${clock} elapsed · ${progress.path}`
+            : `${(0, progress_1.bar)(progress.percent / 100, 18, (text) => text)} ${progress.percent}% ${progress.stage} ${progress.files}/${progress.totalFiles} ${progress.path}`;
+        // Keep status on one terminal row, including narrow windows.
+        const width = Math.max(1, (node_process_1.default.stdout.columns ?? 120) - 3);
+        this.write(`\r\x1b[2K  ${detail.replace(/[\x00-\x1f\x7f]/g, " ").slice(0, width)}`);
+    }
+    done() { if (this.interactive)
+        this.write("\r\x1b[2K"); }
+}
+exports.UploadDisplay = UploadDisplay;