@codiac.io/codiac-cli 1.3.236 → 1.3.238

package/dist/apis/codiac-relay-nats/gen/contracts/types.gen.d.ts

@@ -16758,3 +16758,65 @@ export type CabinetRestoreRequest = {
     enterprise?: string;
     skipCabinets?: boolean;
 };
+export type AgentFrameworkKind = "openclaw" | "hermes" | "byoa";
+export type HostNamingSpec = {
+    strategy: string;
+    domain?: string;
+};
+export type AiAgentProvisionRequest = {
+    enterprise: string;
+    cabinet: string;
+    framework: AgentFrameworkKind;
+    name?: string;
+    hasIngress?: boolean;
+    model?: string;
+    hostNaming?: HostNamingSpec;
+    overrides?: Record<string, any>;
+    inputs?: Record<string, string>;
+    correlationId?: string;
+    socketId?: string;
+};
+export type StepResult = {
+    step: string;
+    status: "done" | "skipped" | "autoResolved" | "blocked" | "failed";
+    detail?: string;
+};
+export type InputField = {
+    name: string;
+    label: string;
+    type?: string;
+    secret?: boolean;
+};
+export type ResolvedBy = {
+    kind: string;
+    cliCommand?: string;
+    frontendRoute?: string;
+    params?: Record<string, any>;
+    needs?: Array<InputField>;
+};
+export type Remediation = {
+    step: string;
+    code: string;
+    reason: string;
+    resolvedBy: ResolvedBy;
+    reattempt: boolean;
+};
+export type ProvisionedAgent = {
+    name: string;
+    cabinet: string;
+    namespace?: string;
+    service?: string;
+    url?: string;
+};
+export type ProvisionError = {
+    message: string;
+    step?: string;
+    cause?: string;
+};
+export type AiAgentProvisionResult = {
+    status: "ok" | "needs_action" | "failed";
+    steps: Array<StepResult>;
+    nextAction?: Remediation;
+    agent?: ProvisionedAgent;
+    error?: ProvisionError;
+};

package/dist/commands/ai/agent/install.d.ts

@@ -0,0 +1,73 @@
+import { AtLeast } from '@codiac.io/codiac-common/contracts';
+import { CommandBaseExec, IEnterpriseEntity } from '../../../command-base-exec';
+import { RootMap } from '../../../apis/codiac-api/contracts';
+export type AgentType = 'openclaw' | 'hermes' | 'byoa';
+export interface IAgentInstallRequest extends IEnterpriseEntity {
+    enterprise: string;
+    cabinet: string;
+    type: AgentType;
+    name: string;
+    hasIngress: boolean;
+    /** Host-naming strategy to apply to the ingress host (pass-through only; strategy UX lands separately). */
+    naming?: string;
+    /** Domain paired with the naming strategy for the ingress host (pass-through only; strategy UX lands separately). */
+    domain?: string;
+}
+export default class AiAgentInstall extends CommandBaseExec<IAgentInstallRequest> {
+    static description: string;
+    static examples: {
+        description: string;
+        command: string;
+    }[];
+    static flags: {
+        help: import("@oclif/core/lib/interfaces").BooleanFlag<void>;
+        enterpriseCode: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
+        type: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
+        cabinet: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
+        ingress: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        naming: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
+        domain: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
+        input: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
+        "take-defaults": import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        silent: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        echo: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        "to-script": import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    static args: {};
+    protected adminOnly: boolean;
+    captureArgs(): Promise<[
+        partial: Partial<IAgentInstallRequest>,
+        takeDefaults: boolean,
+        explicit?: Partial<IAgentInstallRequest>
+    ]>;
+    buildCandidate_silently(partial: AtLeast<IAgentInstallRequest, "enterprise">, _rootMap: RootMap, _explicit?: Partial<IAgentInstallRequest>): Promise<IAgentInstallRequest | undefined>;
+    buildCandidate_interactively(partial: AtLeast<IAgentInstallRequest, "enterprise">, rootMap: RootMap, takeDefaults: boolean, explicit?: Partial<IAgentInstallRequest>): Promise<IAgentInstallRequest | undefined>;
+    private setType;
+    private setName;
+    private setHasIngress;
+    /** Resolves `partial.naming` (and `partial.domain` when the strategy needs one) for the
+     * WebTerminal ingress host. Mutates `partial` in place. Returns `false` on a clean user
+     * cancel (caller must then return `undefined` from `buildCandidate_interactively`).
+     *
+     * Read-only: only ever calls `ScopedHostNameConfig.readMany` (best-effort, for the "use an
+     * existing mapping" list). Never calls `executeDomainUpsert` or any relay mutation — the
+     * actual host-map upsert happens during Task 9's provisioning. */
+    private setHostNamingStrategy;
+    buildCommandString(candidate: IAgentInstallRequest, cmd: string[]): string[];
+    executeTask(candidate: IAgentInstallRequest): Promise<void>;
+    /** Maps the resolved candidate (plus any remediation inputs gathered so far) to the
+     * `post.ai-agent-provision` request shape. */
+    private toProvisionRequest;
+    /** One line per step: `<step>: <status>` (+ detail when present). */
+    private printStepResults;
+    /** Best-effort, informational-only WebTerminal access note — never blocks or fails the
+     * command. Prefers the server-resolved `agent.url` when present; falls back to describing
+     * the requested strategy since the exact resolved host depends on the host-map's own logic. */
+    private printAccessInfo;
+    /** Silent mode disables all prompting (the base lifecycle rebinds `_ui` to a throwing
+     * provider) — mirrors the same detection `CommandBaseExec.runAsync()` uses, so a
+     * `needs_action` response can fail fast with a clear message instead of a raw
+     * "cannot acquire input" error. */
+    private isSilentMode;
+}

package/dist/commands/ai/agent/install.js

@@ -0,0 +1,417 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+const core_1 = require("@oclif/core");
+const _ = require("lodash");
+const host_name_strategy_enum_1 = require("@codiac.io/codiac-domain/host-name-strategy-enum");
+const command_base_exec_1 = require("../../../command-base-exec");
+const framework_spec_1 = require("../../../uilogic/framework-spec");
+const AGENT_TYPES = ['openclaw', 'hermes', 'byoa'];
+/** Validates a user-supplied strategy against the enum's VALUE form (snake_case wire
+ * values), not its KEY form. `host/map.ts` uses `naming in HostNameStrategyEnum`, which
+ * checks object KEYS (camelCase) — a latent quirk there we deliberately do not replicate. */
+const isValidStrategy = (s) => Object.values(host_name_strategy_enum_1.HostNameStrategyEnum).includes(s);
+/** MVP heuristic: a strategy needs a paired domain when its wire value mentions "domain".
+ * Every current strategy value fits this rule except `shared_ingress_ip`. If a future
+ * strategy is added that breaks the pattern, this heuristic will need to become explicit. */
+const strategyNeedsDomain = (s) => s.includes("domain");
+class AiAgentInstall extends command_base_exec_1.CommandBaseExec {
+    constructor() {
+        super(...arguments);
+        this.adminOnly = true;
+    }
+    captureArgs() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const { flags } = yield this.parse(AiAgentInstall);
+            let partial = {};
+            let explicit = {};
+            if (flags.enterpriseCode)
+                partial.enterprise = flags.enterpriseCode;
+            if (flags.type) {
+                partial.type = flags.type;
+                explicit.type = partial.type;
+            }
+            if (flags.cabinet) {
+                partial.cabinet = flags.cabinet;
+                explicit.cabinet = partial.cabinet;
+            }
+            if (flags.name) {
+                partial.name = flags.name.trim();
+                explicit.name = partial.name;
+            }
+            // Boolean switch: oclif always supplies a value (default: true), so explicit-vs-default
+            // cannot be distinguished here. Per the brief, mirror only to partial and skip the
+            // explicit snapshot for this flag.
+            partial.hasIngress = flags.ingress;
+            if (flags.naming) {
+                partial.naming = flags.naming;
+                explicit.naming = partial.naming;
+            }
+            if (flags.domain) {
+                partial.domain = flags.domain;
+                explicit.domain = partial.domain;
+            }
+            const takeDefaults = flags['take-defaults'];
+            return [partial, takeDefaults, explicit];
+        });
+    }
+    buildCandidate_silently(partial, _rootMap, _explicit) {
+        var _a, _b;
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (partial.type == undefined)
+                throw new Error("Must specify agent type (--type openclaw|hermes|byoa).");
+            if (!AGENT_TYPES.includes(partial.type))
+                throw new Error(`Invalid agent type [${partial.type}]; must be one of: openclaw, hermes, byoa.`);
+            const spec = (0, framework_spec_1.resolveFrameworkSpec)(partial.type);
+            if (!spec.supported)
+                throw new Error((_a = spec.comingSoon) !== null && _a !== void 0 ? _a : `Agent type [${partial.type}] is not yet supported.`);
+            // NOTE: presence-only validation here. Cross-checking the cabinet against the rootMap
+            // (existence, cluster assignment, etc.) is deferred to Task 9's real provisioning logic.
+            if (partial.cabinet == undefined || _.isEmpty(partial.cabinet))
+                throw new Error("Must specify cabinet.");
+            const name = partial.name && !_.isEmpty(partial.name) ? partial.name : spec.defaultName;
+            const hasIngress = (_b = partial.hasIngress) !== null && _b !== void 0 ? _b : true;
+            if (hasIngress) {
+                if (partial.naming == undefined || _.isEmpty(partial.naming))
+                    throw new Error("A host-naming strategy is required when the agent has ingress (pass --naming, or use --no-ingress). Example: --naming svc_dot_cab_dot_domain.");
+                if (!isValidStrategy(partial.naming))
+                    throw new Error(`Invalid host-naming strategy [${partial.naming}]. Valid values: ${Object.values(host_name_strategy_enum_1.HostNameStrategyEnum).join(", ")}.`);
+                if (strategyNeedsDomain(partial.naming) && (partial.domain == undefined || _.isEmpty(partial.domain)))
+                    throw new Error(`Strategy [${partial.naming}] requires a domain (pass --domain, e.g. --domain oncodiac.io).`);
+            }
+            return Object.assign(Object.assign({ enterprise: partial.enterprise, cabinet: partial.cabinet, type: partial.type, name,
+                hasIngress }, (partial.naming ? { naming: partial.naming } : {})), (partial.domain ? { domain: partial.domain } : {}));
+        });
+    }
+    buildCandidate_interactively(partial, rootMap, takeDefaults, explicit) {
+        var _a;
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const overrides = [];
+            // --- type -----------------------------------------------------------
+            partial.type = yield this.setType(partial.type, takeDefaults, overrides);
+            const spec = (0, framework_spec_1.resolveFrameworkSpec)(partial.type);
+            if (!spec.supported) {
+                this._ui.userMessage(this._styler.colorWarning((_a = spec.comingSoon) !== null && _a !== void 0 ? _a : `Agent type [${partial.type}] is not yet supported.`));
+                return undefined; // clean cancel — lifecycle prints "Operation cancelled. No work was done."
+            }
+            // --- cabinet ----------------------------------------------------------
+            // Reuse the existing rootMapUtils cabinet picker rather than hand-rolling
+            // selection/validation/confirmation logic (it already implements Rules 1-3).
+            const [cabinet] = yield this.rootMapUtils.promptForCabinet(partial.enterprise, rootMap, partial.cabinet, takeDefaults, undefined, explicit === null || explicit === void 0 ? void 0 : explicit.cabinet);
+            partial.cabinet = cabinet.name;
+            // --- name ---------------------------------------------------------------
+            partial.name = yield this.setName(partial.name, partial.type, takeDefaults, explicit === null || explicit === void 0 ? void 0 : explicit.name);
+            // --- hasIngress -----------------------------------------------------------
+            partial.hasIngress = yield this.setHasIngress(partial.hasIngress, takeDefaults);
+            // --- naming/domain (host-map for the WebTerminal ingress) -----------------
+            // Pure resolution + validation only — no relay/API mutation here. The actual
+            // host-map upsert happens during Task 9's provisioning.
+            if (partial.hasIngress) {
+                const proceeded = yield this.setHostNamingStrategy(partial, explicit);
+                if (!proceeded)
+                    return undefined; // clean cancel — lifecycle prints "Operation cancelled. No work was done."
+            }
+            if (overrides.length > 0) {
+                this._ui.userMessage(this._styler.colorWarning("One or more provided values were invalid and have been replaced:"));
+                for (const o of overrides) {
+                    this._ui.userMessage(`  ${o.param}: ${this._styler.colorWarning(o.given)} → ${this._styler.hilite(o.using)}`);
+                }
+                const confirmed = yield this._ui.promptConfirm("confirmOverrides", "Proceed with the above substitutions?", true);
+                if (!confirmed)
+                    return undefined;
+            }
+            return yield this.buildCandidate_silently(partial, rootMap, explicit);
+        });
+    }
+    setType(userInput, takeDefaults, overrides) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            let invalidInput = false;
+            if (userInput != undefined && !AGENT_TYPES.includes(userInput)) {
+                invalidInput = true;
+                overrides.push({ param: 'type', given: String(userInput), using: '(to be selected)' });
+                userInput = undefined;
+            }
+            if (userInput != undefined) {
+                this._ui.userMessage(`Agent type: ${this._styler.hilite(userInput)}`);
+                return userInput;
+            }
+            if (invalidInput) {
+                this._ui.userMessage(this._styler.colorWarning("Provided agent type was not valid; please select from the list below."));
+            }
+            const selected = yield this._ui.promptSelect('type', 'Select agent type to install:', AGENT_TYPES, false, false);
+            const resolved = selected !== null && selected !== void 0 ? selected : AGENT_TYPES[0];
+            if (invalidInput) {
+                overrides[overrides.length - 1].using = resolved;
+            }
+            return resolved;
+        });
+    }
+    setName(userInput, type, takeDefaults, userSuppliedValue) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (userInput && !_.isEmpty(userInput)) {
+                if (userSuppliedValue == userInput) {
+                    this._ui.userMessage(`Agent name: ${this._styler.hilite(userInput)}`);
+                    return userInput;
+                }
+            }
+            const defaultName = (0, framework_spec_1.resolveFrameworkSpec)(type).defaultName;
+            if (takeDefaults) {
+                this._ui.userMessage(`Agent name: ${this._styler.hilite(defaultName)}`);
+                return defaultName;
+            }
+            const confirmed = yield this._ui.promptConfirm('name', `Agent name: ${this._styler.hilite(defaultName)} `, true);
+            if (confirmed)
+                return defaultName;
+            const typed = yield this._ui.prompt('name', 'Enter agent name:', true, defaultName);
+            return (typed && !_.isEmpty(typed)) ? typed : defaultName;
+        });
+    }
+    setHasIngress(userInput, takeDefaults) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const defaultValue = userInput !== null && userInput !== void 0 ? userInput : true;
+            if (takeDefaults) {
+                this._ui.userMessage(`Expose via ingress: ${this._styler.hilite(String(defaultValue))}`);
+                return defaultValue;
+            }
+            return yield this._ui.promptConfirm('hasIngress', `Expose the agent web terminal through an ingress host? `, defaultValue);
+        });
+    }
+    /** Resolves `partial.naming` (and `partial.domain` when the strategy needs one) for the
+     * WebTerminal ingress host. Mutates `partial` in place. Returns `false` on a clean user
+     * cancel (caller must then return `undefined` from `buildCandidate_interactively`).
+     *
+     * Read-only: only ever calls `ScopedHostNameConfig.readMany` (best-effort, for the "use an
+     * existing mapping" list). Never calls `executeDomainUpsert` or any relay mutation — the
+     * actual host-map upsert happens during Task 9's provisioning. */
+    setHostNamingStrategy(partial, explicit) {
+        var _a, _b, _c, _d;
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            // 1. Explicit, valid --naming already given: accept it (Rule 2 — do not re-prompt).
+            if ((explicit === null || explicit === void 0 ? void 0 : explicit.naming) != undefined) {
+                if (isValidStrategy(explicit.naming)) {
+                    this._ui.userMessage(`Host naming strategy: ${this._styler.hilite(explicit.naming)}`);
+                    if (strategyNeedsDomain(explicit.naming) && (partial.domain == undefined || _.isEmpty(partial.domain))) {
+                        partial.domain = (_a = (yield this._ui.prompt("domain", "Domain (e.g. oncodiac.io): "))) === null || _a === void 0 ? void 0 : _a.trim();
+                    }
+                    return true;
+                }
+                this._ui.userMessage(this._styler.colorWarning(`Provided host-naming strategy [${explicit.naming}] is not valid; please select from the list below.`));
+            }
+            // 2. Best-effort fetch of existing host mappings on this enterprise.
+            let existing = [];
+            try {
+                existing = (_b = yield this._codiacApi.ScopedHostNameConfig.readMany({ enterprise: partial.enterprise })) !== null && _b !== void 0 ? _b : [];
+            }
+            catch (err) {
+                this.logger.detail(`Could not load existing host mappings: ${(_c = err === null || err === void 0 ? void 0 : err.message) !== null && _c !== void 0 ? _c : err}`);
+            }
+            // 3. Offer "use an existing mapping" vs "create a new one" when mappings already exist.
+            if (existing.length > 0) {
+                const choice = yield this._ui.promptSelect("useExisting", "Use an existing host mapping, or create a new one?", [
+                    { name: "Use an existing host mapping", value: "existing" },
+                    { name: "Create a new one", value: "new" },
+                ]);
+                if (!choice)
+                    return false; // clean cancel
+                if (choice === "existing") {
+                    const mappingChoices = existing.map((m, i) => ({ name: `${m.strategy} — ${m.domainName}`, value: String(i) }));
+                    const selectedIdx = yield this._ui.promptSelect("existingMapping", "Select an existing host mapping:", mappingChoices);
+                    if (selectedIdx == undefined)
+                        return false; // clean cancel
+                    const selected = existing[Number(selectedIdx)];
+                    partial.naming = selected.strategy;
+                    partial.domain = selected.domainName;
+                    return true;
+                }
+                // "new" falls through to step 4 below.
+            }
+            // 4. New mapping: select a strategy (mirrors host/map's display transform), then a domain
+            // when the chosen strategy needs one.
+            const strategies = Object.values(host_name_strategy_enum_1.HostNameStrategyEnum).sort()
+                .map(x => ({ value: x, name: x.replace(/_dot_/g, ".").replace(/_slash_/g, "/") }));
+            const chosen = yield this._ui.promptSelect("naming", "Host naming strategy", strategies);
+            if (!chosen)
+                return false; // clean cancel
+            partial.naming = chosen;
+            if (strategyNeedsDomain(partial.naming) && (partial.domain == undefined || _.isEmpty(partial.domain))) {
+                partial.domain = (_d = (yield this._ui.prompt("domain", "Domain (e.g. oncodiac.io): "))) === null || _d === void 0 ? void 0 : _d.trim();
+            }
+            return true;
+        });
+    }
+    buildCommandString(candidate, cmd) {
+        cmd.push("-e", candidate.enterprise);
+        cmd.push("-t", candidate.type);
+        cmd.push("-c", candidate.cabinet);
+        cmd.push("-n", candidate.name);
+        cmd.push(candidate.hasIngress ? "--ingress" : "--no-ingress");
+        if (candidate.naming)
+            cmd.push("--naming", candidate.naming);
+        if (candidate.domain)
+            cmd.push("--domain", candidate.domain);
+        cmd.push("--silent");
+        return cmd;
+    }
+    // NOTE: thin client over `post.ai-agent-provision` — all provisioning logic (operator,
+    // asset deploy, host-map) lives server-side in the relay. This method only builds the
+    // request, calls the endpoint, and drives the needs_action remediation loop.
+    executeTask(candidate) {
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            // Seed inputs from any --input key=value flags so a needs_action requiring those
+            // values (e.g. inline secrets) resolves on the first call — the headless/silent path.
+            const inputs = {};
+            const { flags } = yield this.parse(AiAgentInstall);
+            for (const kv of ((_a = flags.input) !== null && _a !== void 0 ? _a : [])) {
+                const eq = kv.indexOf('=');
+                if (eq > 0)
+                    inputs[kv.slice(0, eq)] = kv.slice(eq + 1);
+            }
+            const attemptedCodes = new Set();
+            while (true) {
+                const request = this.toProvisionRequest(candidate, inputs);
+                const result = yield this.genRelayClient.Call.aiAgentProvision(request);
+                if (result.error || !result.output) {
+                    const msg = `Error provisioning agent [${candidate.name}]: ${(_b = result.message) !== null && _b !== void 0 ? _b : ''} ${(_d = (_c = result.error) === null || _c === void 0 ? void 0 : _c.message) !== null && _d !== void 0 ? _d : ''}`.trimEnd();
+                    this.logger.error(msg, result.error);
+                    this._ui.userMessage(`${this._styler.colorCritical('ERROR!')} ${msg}`);
+                    throw (_e = result.error) !== null && _e !== void 0 ? _e : new Error(msg);
+                }
+                const out = result.output;
+                this.printStepResults(out.steps);
+                if (out.status === 'ok') {
+                    this.printAccessInfo(candidate, out.agent);
+                    return;
+                }
+                if (out.status === 'failed') {
+                    const msg = `Failed provisioning agent [${candidate.name}]: ${(_g = (_f = out.error) === null || _f === void 0 ? void 0 : _f.message) !== null && _g !== void 0 ? _g : ''}`.trimEnd();
+                    this.logger.notice(msg, out);
+                    this._ui.userMessage(`${this._styler.colorCritical('FAILED!')} ${msg}`);
+                    throw new Error(msg);
+                }
+                // status === 'needs_action'
+                const rem = out.nextAction;
+                const needs = (_j = (_h = rem.resolvedBy) === null || _h === void 0 ? void 0 : _h.needs) !== null && _j !== void 0 ? _j : [];
+                if (this.isSilentMode()) {
+                    const missing = needs.map(f => f.name).join(', ');
+                    const hint = ((_k = rem.resolvedBy) === null || _k === void 0 ? void 0 : _k.cliCommand) ? ` Resolve with: ${rem.resolvedBy.cliCommand}` : '';
+                    throw new Error(`Cannot proceed in --silent mode: ${rem.reason}${missing ? ` (missing: ${missing})` : ''}.${hint}`);
+                }
+                if (needs.length > 0) {
+                    for (const f of needs) {
+                        const value = f.secret
+                            ? yield this._ui.promptPassword(f.name, `${rem.reason}\n${f.label}:`)
+                            : yield this._ui.prompt(f.name, `${rem.reason}\n${f.label}:`, true);
+                        if (value != undefined)
+                            inputs[f.name] = value;
+                    }
+                }
+                else {
+                    this._ui.userMessage(this._styler.colorWarning(`Action needed (${rem.code}): ${rem.reason}`));
+                    if ((_l = rem.resolvedBy) === null || _l === void 0 ? void 0 : _l.cliCommand)
+                        this._ui.userMessage(`Resolve with:  ${this._styler.hilite(rem.resolvedBy.cliCommand)}`);
+                    const proceed = yield this._ui.promptConfirm('recheck', "Re-check after you've resolved this?", true);
+                    if (!proceed)
+                        return;
+                }
+                // Loop guard: if we come back with the SAME remediation code AND gathered no new
+                // inputs, abort — prevents spinning forever on a condition that never clears.
+                if (attemptedCodes.has(rem.code) && needs.length === 0) {
+                    const msg = `Still blocked on [${rem.code}]: ${rem.reason}`;
+                    this._ui.userMessage(this._styler.colorCritical(msg));
+                    throw new Error(msg);
+                }
+                attemptedCodes.add(rem.code);
+            }
+        });
+    }
+    /** Maps the resolved candidate (plus any remediation inputs gathered so far) to the
+     * `post.ai-agent-provision` request shape. */
+    toProvisionRequest(candidate, inputs) {
+        return {
+            enterprise: candidate.enterprise,
+            cabinet: candidate.cabinet,
+            framework: candidate.type,
+            name: candidate.name,
+            hasIngress: candidate.hasIngress,
+            hostNaming: candidate.hasIngress ? { strategy: candidate.naming, domain: candidate.domain } : undefined,
+            inputs,
+        };
+    }
+    /** One line per step: `<step>: <status>` (+ detail when present). */
+    printStepResults(steps) {
+        for (const s of steps) {
+            const line = s.detail ? `${s.step}: ${s.status} — ${s.detail}` : `${s.step}: ${s.status}`;
+            if (s.status === 'failed')
+                this._ui.userMessage(this._styler.colorCritical(line));
+            else if (s.status === 'blocked')
+                this._ui.userMessage(this._styler.colorWarning(line));
+            else
+                this._ui.userMessage(this._styler.colorGood(line));
+        }
+    }
+    /** Best-effort, informational-only WebTerminal access note — never blocks or fails the
+     * command. Prefers the server-resolved `agent.url` when present; falls back to describing
+     * the requested strategy since the exact resolved host depends on the host-map's own logic. */
+    printAccessInfo(candidate, agent) {
+        var _a;
+        if (agent === null || agent === void 0 ? void 0 : agent.url) {
+            this._ui.userMessage(`${this._styler.colorGood('READY')} WebTerminal ingress: ${this._styler.hilite(agent.url)}`);
+        }
+        else if (candidate.hasIngress && candidate.domain) {
+            this._ui.userMessage(`${this._styler.colorGood('READY')} WebTerminal ingress: ${this._styler.hilite(candidate.domain)} (strategy ${candidate.naming})`);
+            this._ui.userMessage(`  Exact host resolves from the [${candidate.naming}] host-map strategy; see host mappings for the final URL.`);
+        }
+        else if (candidate.hasIngress) {
+            this._ui.userMessage(`${this._styler.colorGood('READY')} WebTerminal ingress mapped via strategy ${this._styler.hilite((_a = candidate.naming) !== null && _a !== void 0 ? _a : '')}.`);
+        }
+        else {
+            this._ui.userMessage(`${this._styler.colorGood('READY')} Agent [${candidate.name}] is reachable only in-cluster (no ingress requested).`);
+        }
+    }
+    /** Silent mode disables all prompting (the base lifecycle rebinds `_ui` to a throwing
+     * provider) — mirrors the same detection `CommandBaseExec.runAsync()` uses, so a
+     * `needs_action` response can fail fast with a clear message instead of a raw
+     * "cannot acquire input" error. */
+    isSilentMode() {
+        return this.argv.includes('--silent') || this.pipedInput != undefined;
+    }
+}
+exports.default = AiAgentInstall;
+AiAgentInstall.description = 'Provisions a stateful Codiac agent workload (openclaw, hermes, or byoa) into an enterprise cabinet.';
+AiAgentInstall.examples = [
+    {
+        description: 'Install a Hermes agent into the dev cabinet of the ben enterprise.',
+        command: '<%= config.bin %> <%= command.id %> -e ben -t hermes -c dev',
+    },
+    {
+        description: 'Non-interactive (scripted) invocation. Ingress defaults on, so a host-naming strategy must be given explicitly; shared_ingress_ip needs no --domain.',
+        command: '<%= config.bin %> <%= command.id %> -e ben -t hermes -c dev --silent --naming shared_ingress_ip',
+    },
+    {
+        description: 'Renders the equivalent silent command and then executes.',
+        command: '<%= config.bin %> <%= command.id %> -e ben -t hermes -c dev --echo',
+    },
+    {
+        description: 'Renders the equivalent silent command without executing.',
+        command: '<%= config.bin %> <%= command.id %> -e ben -t hermes -c dev --to-script',
+    },
+];
+AiAgentInstall.flags = {
+    help: core_1.Flags.help({ char: 'h' }),
+    enterpriseCode: core_1.Flags.string({ char: 'e', required: false, description: 'Code name identifying the target enterprise.' }),
+    type: core_1.Flags.string({ char: 't', options: ['openclaw', 'hermes', 'byoa'], description: 'Agent framework to install: openclaw, hermes, or byoa (bring-your-own-agent).' }),
+    cabinet: core_1.Flags.string({ char: 'c', description: 'Cabinet (environment) into which the agent workload is deployed.' }),
+    name: core_1.Flags.string({ char: 'n', description: 'Asset name for the agent workload (defaults to <type>-agent).' }),
+    ingress: core_1.Flags.boolean({ char: 'g', allowNo: true, default: true, description: 'Expose the agent web terminal through an ingress host (use --no-ingress to keep it cluster-internal).' }),
+    naming: core_1.Flags.string({ description: 'Host-naming strategy to use for the ingress host (prompted during install when omitted).' }),
+    domain: core_1.Flags.string({ description: 'Domain to use with the host-naming strategy for the ingress host.' }),
+    input: core_1.Flags.string({ multiple: true, description: 'Pre-supply a needs_action input as key=value (repeatable), e.g. --input openRouterKey=sk-... . Lets --silent/headless runs resolve secret/decision prompts without interaction.' }),
+    // Interaction mode flags (TODO: will eventually move to base class)
+    "take-defaults": core_1.Flags.boolean({ exclusive: ["silent"], description: "Prevents prompting for confirmation on parameters that were passed in or were automatically set to default values (Irrelevant in --silent mode).  This behavior does NOT apply to scenarios where the command needs to override invalid user input; such cases will always prompt for confirmation." }),
+    silent: core_1.Flags.boolean({ exclusive: ["echo", "to-script"], description: 'Executes without any user interaction; fails on missing or invalid arguments.' }),
+    echo: core_1.Flags.boolean({ exclusive: ["to-script", "silent"], description: 'Renders the equivalent non-interactive command for future use before executing.' }),
+    "to-script": core_1.Flags.boolean({ exclusive: ["echo", "silent"], description: 'Renders the equivalent non-interactive command without executing it.' }),
+};
+AiAgentInstall.args = {};
+//# sourceMappingURL=install.js.map

package/dist/commands/ai/agent/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../../../src/commands/ai/agent/install.ts"],"names":[],"mappings":";;;AAAA,sCAAmC;AACnC,4BAA6B;AAE7B,8FAAwF;AACxF,kEAAgF;AAGhF,oEAAuE;AAKvE,MAAM,WAAW,GAAgB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAEhE;;6FAE6F;AAC7F,MAAM,eAAe,GAAG,CAAC,CAAS,EAAW,EAAE,CAAE,MAAM,CAAC,MAAM,CAAC,8CAAoB,CAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAE9G;;6FAE6F;AAC7F,MAAM,mBAAmB,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAezE,MAAqB,cAAe,SAAQ,mCAAqC;IAAjF;;QA2CY,cAAS,GAAG,IAAI,CAAC;IAsZ7B,CAAC;IAnZc,WAAW;;YAKtB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAEnD,IAAI,OAAO,GAAkC,EAAE,CAAC;YAChD,IAAI,QAAQ,GAAkC,EAAE,CAAC;YAEjD,IAAI,KAAK,CAAC,cAAc;gBAAE,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC,cAAc,CAAC;YAEpE,IAAI,KAAK,CAAC,IAAI,EAAE;gBAAE,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,IAAiB,CAAC;gBAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;aAAE;YACzF,IAAI,KAAK,CAAC,OAAO,EAAE;gBAAE,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;gBAAC,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;aAAE;YAC3F,IAAI,KAAK,CAAC,IAAI,EAAE;gBAAE,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;aAAE;YAEnF,wFAAwF;YACxF,mFAAmF;YACnF,mCAAmC;YACnC,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC;YAEnC,IAAI,KAAK,CAAC,MAAM,EAAE;gBAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;gBAAC,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;aAAE;YACtF,IAAI,KAAK,CAAC,MAAM,EAAE;gBAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;gBAAC,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;aAAE;YAEtF,MAAM,YAAY,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;YAE5C,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;KAAA;IAGY,uBAAuB,CAClC,OAAoD,EACpD,QAAiB,EACjB,SAAyC;;;YAGzC,IAAI,OAAO,CAAC,IAAI,IAAI,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YACzG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,IAAI,4CAA4C,CAAC,CAAC;YAE1I,MAAM,IAAI,GAAG,IAAA,qCAAoB,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,MAAA,IAAI,CAAC,UAAU,mCAAI,eAAe,OAAO,CAAC,IAAI,yBAAyB,CAAC,CAAC;YAE9G,sFAAsF;YACtF,yFAAyF;YACzF,IAAI,OAAO,CAAC,OAAO,IAAI,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAEzG,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;YACxF,MAAM,UAAU,GAAG,MAAA,OAAO,CAAC,UAAU,mCAAI,IAAI,CAAC;YAE9C,IAAI,UAAU,EAAE;gBACd,IAAI,OAAO,CAAC,MAAM,IAAI,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC1D,MAAM,IAAI,KAAK,CAAC,+IAA+I,CAAC,CAAC;gBACnK,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC;oBAClC,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,CAAC,MAAM,oBAAqB,MAAM,CAAC,MAAM,CAAC,8CAAoB,CAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtJ,IAAI,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACnG,MAAM,IAAI,KAAK,CAAC,aAAa,OAAO,CAAC,MAAM,iEAAiE,CAAC,CAAC;aACjH;YAED,qCACE,UAAU,EAAE,OAAO,CAAC,UAAU,EAC9B,OAAO,EAAE,OAAO,CAAC,OAAO,EACxB,IAAI,EAAE,OAAO,CAAC,IAAI,EAClB,IAAI;gBACJ,UAAU,IACP,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAClD,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACrD;;KACH;IAGY,4BAA4B,CACvC,OAAoD,EACpD,OAAgB,EAChB,YAAqB,EACrB,QAAwC;;;YAGxC,MAAM,SAAS,GAA2D,EAAE,CAAC;YAE7E,uEAAuE;YACvE,OAAO,CAAC,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAEzE,MAAM,IAAI,GAAG,IAAA,qCAAoB,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBACnB,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAA,IAAI,CAAC,UAAU,mCAAI,eAAe,OAAO,CAAC,IAAI,yBAAyB,CAAC,CAAC,CAAC;gBACzH,OAAO,SAAS,CAAC,CAAC,2EAA2E;aAC9F;YAED,yEAAyE;YACzE,0EAA0E;YAC1E,6EAA6E;YAC7E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CACxD,OAAO,CAAC,UAAU,EAClB,OAAO,EACP,OAAO,CAAC,OAAO,EACf,YAAY,EACZ,SAAS,EACT,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,CAClB,CAAC;YACF,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;YAE/B,2EAA2E;YAC3E,OAAO,CAAC,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,CAAC,CAAC;YAE5F,6EAA6E;YAC7E,OAAO,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAEhF,6EAA6E;YAC7E,6EAA6E;YAC7E,wDAAwD;YACxD,IAAI,OAAO,CAAC,UAAU,EAAE;gBACtB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACtE,IAAI,CAAC,SAAS;oBAAE,OAAO,SAAS,CAAC,CAAC,2EAA2E;aAC9G;YAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE;gBACxB,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,kEAAkE,CAAC,CAAC,CAAC;gBACpH,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE;oBACzB,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;iBAC/G;gBACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,kBAAkB,EAAE,uCAAuC,EAAE,IAAI,CAAC,CAAC;gBAClH,IAAI,CAAC,SAAS;oBAAE,OAAO,SAAS,CAAC;aAClC;YAED,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;;KACvE;IAEa,OAAO,CACnB,SAAgC,EAChC,YAAqB,EACrB,SAAiE;;YAEjE,IAAI,YAAY,GAAG,KAAK,CAAC;YAEzB,IAAI,SAAS,IAAI,SAAS,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;gBAC9D,YAAY,GAAG,IAAI,CAAC;gBACpB,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBACvF,SAAS,GAAG,SAAS,CAAC;aACvB;YAED,IAAI,SAAS,IAAI,SAAS,EAAE;gBAC1B,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBACtE,OAAO,SAAS,CAAC;aAClB;YAED,IAAI,YAAY,EAAE;gBAChB,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,uEAAuE,CAAC,CAAC,CAAC;aAC1H;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAY,MAAM,EAAE,+BAA+B,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5H,MAAM,QAAQ,GAAG,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,WAAW,CAAC,CAAC,CAAC,CAAC;YAC5C,IAAI,YAAY,EAAE;gBAChB,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC;aAClD;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KAAA;IAEa,OAAO,CACnB,SAA6B,EAC7B,IAAe,EACf,YAAqB,EACrB,iBAA0B;;YAE1B,IAAI,SAAS,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;gBACtC,IAAI,iBAAiB,IAAI,SAAS,EAAE;oBAClC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;oBACtE,OAAO,SAAS,CAAC;iBAClB;aACF;YAED,MAAM,WAAW,GAAG,IAAA,qCAAoB,EAAC,IAAI,CAAC,CAAC,WAAW,CAAC;YAC3D,IAAI,YAAY,EAAE;gBAChB,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBACxE,OAAO,WAAW,CAAC;aACpB;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,eAAe,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACjH,IAAI,SAAS;gBAAE,OAAO,WAAW,CAAC;YAElC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAS,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAC5F,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC;QAC5D,CAAC;KAAA;IAEa,aAAa,CAAC,SAA8B,EAAE,YAAqB;;YAC/E,MAAM,YAAY,GAAG,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,IAAI,CAAC;YACvC,IAAI,YAAY,EAAE;gBAChB,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,uBAAuB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC;gBACzF,OAAO,YAAY,CAAC;aACrB;YACD,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,YAAY,EAAE,yDAAyD,EAAE,YAAY,CAAC,CAAC;QAC7H,CAAC;KAAA;IAED;;;;;;sEAMkE;IACpD,qBAAqB,CACjC,OAAoD,EACpD,QAAwC;;;YAGxC,oFAAoF;YACpF,IAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,KAAI,SAAS,EAAE;gBACjC,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;oBACpC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,yBAAyB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACtF,IAAI,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE;wBACtG,OAAO,CAAC,MAAM,GAAG,MAAA,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAS,QAAQ,EAAE,6BAA6B,CAAC,CAAC,0CAAE,IAAI,EAAE,CAAC;qBACnG;oBACD,OAAO,IAAI,CAAC;iBACb;gBACD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,kCAAkC,QAAQ,CAAC,MAAM,oDAAoD,CAAC,CAAC,CAAC;aACxJ;YAED,qEAAqE;YACrE,IAAI,QAAQ,GAA2B,EAAE,CAAC;YAC1C,IAAI;gBACF,QAAQ,GAAG,MAAA,MAAM,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,mCAAI,EAAE,CAAC;aAC1G;YAAC,OAAO,GAAQ,EAAE;gBACjB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,0CAA0C,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,OAAO,mCAAI,GAAG,EAAE,CAAC,CAAC;aACrF;YAED,wFAAwF;YACxF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;gBACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CACxC,aAAa,EACb,oDAAoD,EACpD;oBACE,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,UAAU,EAAE;oBAC3D,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,EAAE;iBAC3C,CACF,CAAC;gBACF,IAAI,CAAC,MAAM;oBAAE,OAAO,KAAK,CAAC,CAAC,eAAe;gBAE1C,IAAI,MAAM,KAAK,UAAU,EAAE;oBACzB,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC/G,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAS,iBAAiB,EAAE,kCAAkC,EAAE,cAAc,CAAC,CAAC;oBAC/H,IAAI,WAAW,IAAI,SAAS;wBAAE,OAAO,KAAK,CAAC,CAAC,eAAe;oBAE3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;oBAC/C,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC;oBACnC,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC;oBACrC,OAAO,IAAI,CAAC;iBACb;gBACD,uCAAuC;aACxC;YAED,0FAA0F;YAC1F,sCAAsC;YACtC,MAAM,UAAU,GAAI,MAAM,CAAC,MAAM,CAAC,8CAAoB,CAAc,CAAC,IAAI,EAAE;iBACxE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACrF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,sBAAsB,EAAE,UAAU,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC,CAAC,eAAe;YAC1C,OAAO,CAAC,MAAM,GAAG,MAAgB,CAAC;YAElC,IAAI,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE;gBACrG,OAAO,CAAC,MAAM,GAAG,MAAA,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAS,QAAQ,EAAE,6BAA6B,CAAC,CAAC,0CAAE,IAAI,EAAE,CAAC;aACnG;YACD,OAAO,IAAI,CAAC;;KACb;IAGM,kBAAkB,CAAC,SAA+B,EAAE,GAAa;QACtE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QAC9D,IAAI,SAAS,CAAC,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrB,OAAO,GAAG,CAAC;IACb,CAAC;IAGD,uFAAuF;IACvF,sFAAsF;IACtF,6EAA6E;IAChE,WAAW,CAAC,SAA+B;;;YACtD,iFAAiF;YACjF,sFAAsF;YACtF,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACnD,KAAK,MAAM,EAAE,IAAI,CAAC,MAAA,KAAK,CAAC,KAAK,mCAAI,EAAE,CAAC,EAAE;gBACpC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC3B,IAAI,EAAE,GAAG,CAAC;oBAAE,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;aACxD;YACD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;YAEzC,OAAO,IAAI,EAAE;gBACX,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAExE,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;oBAClC,MAAM,GAAG,GAAG,6BAA6B,SAAS,CAAC,IAAI,MAAM,MAAA,MAAM,CAAC,OAAO,mCAAI,EAAE,IAAI,MAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,OAAO,mCAAI,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;oBAC7H,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;oBACrC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;oBACvE,MAAM,MAAA,MAAM,CAAC,KAAK,mCAAI,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;iBACtC;gBAED,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC1B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAEjC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE;oBACvB,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;oBAC3C,OAAO;iBACR;gBAED,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE;oBAC3B,MAAM,GAAG,GAAG,8BAA8B,SAAS,CAAC,IAAI,MAAM,MAAA,MAAA,GAAG,CAAC,KAAK,0CAAE,OAAO,mCAAI,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;oBACnG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAC7B,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;oBACxE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;iBACtB;gBAED,4BAA4B;gBAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,UAAW,CAAC;gBAC5B,MAAM,KAAK,GAAG,MAAA,MAAA,GAAG,CAAC,UAAU,0CAAE,KAAK,mCAAI,EAAE,CAAC;gBAE1C,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE;oBACvB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAClD,MAAM,IAAI,GAAG,CAAA,MAAA,GAAG,CAAC,UAAU,0CAAE,UAAU,EAAC,CAAC,CAAC,kBAAkB,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7F,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;iBACrH;gBAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;oBACpB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE;wBACrB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM;4BACpB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC;4BACrE,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAS,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC;wBAC9E,IAAI,KAAK,IAAI,SAAS;4BAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;qBAChD;iBACF;qBAAM;oBACL,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,kBAAkB,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;oBAC9F,IAAI,MAAA,GAAG,CAAC,UAAU,0CAAE,UAAU;wBAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,kBAAkB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;oBACzH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,EAAE,sCAAsC,EAAE,IAAI,CAAC,CAAC;oBACtG,IAAI,CAAC,OAAO;wBAAE,OAAO;iBACtB;gBAED,iFAAiF;gBACjF,8EAA8E;gBAC9E,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;oBACtD,MAAM,GAAG,GAAG,qBAAqB,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;oBAC5D,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;oBACtD,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;iBACtB;gBACD,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;aAC9B;;KACF;IAGD;kDAC8C;IACtC,kBAAkB,CAAC,SAA+B,EAAE,MAA8B;QACxF,OAAO;YACL,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,SAAS,EAAE,SAAS,CAAC,IAAI;YACzB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,MAAO,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;YACxG,MAAM;SACP,CAAC;IACJ,CAAC;IAGD,qEAAqE;IAC7D,gBAAgB,CAAC,KAAmB;QAC1C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE;YACrB,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YAC1F,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;iBAC7E,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;;gBAClF,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;SACzD;IACH,CAAC;IAGD;;mGAE+F;IACvF,eAAe,CAAC,SAA+B,EAAE,KAAwB;;QAC/E,IAAI,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,GAAG,EAAE;YACd,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,yBAAyB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SACnH;aAAM,IAAI,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,MAAM,EAAE;YACnD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,yBAAyB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;YACxJ,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,mCAAmC,SAAS,CAAC,MAAM,2DAA2D,CAAC,CAAC;SACtI;aAAM,IAAI,SAAS,CAAC,UAAU,EAAE;YAC/B,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,4CAA4C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAA,SAAS,CAAC,MAAM,mCAAI,EAAE,CAAC,GAAG,CAAC,CAAC;SACpJ;aAAM;YACL,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,SAAS,CAAC,IAAI,wDAAwD,CAAC,CAAC;SAC3I;IACH,CAAC;IAGD;;;uCAGmC;IAC3B,YAAY;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC;IACxE,CAAC;;AA/bH,iCAicC;AA/bQ,0BAAW,GAAG,qGAAqG,CAAC;AAEpH,uBAAQ,GAAG;IAChB;QACE,WAAW,EAAE,oEAAoE;QACjF,OAAO,EAAE,6DAA6D;KACvE;IACD;QACE,WAAW,EAAE,sJAAsJ;QACnK,OAAO,EAAE,iGAAiG;KAC3G;IACD;QACE,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,oEAAoE;KAC9E;IACD;QACE,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,yEAAyE;KACnF;CACF,CAAC;AAEK,oBAAK,GAAG;IACb,IAAI,EAAE,YAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC/B,cAAc,EAAE,YAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;IACzH,IAAI,EAAE,YAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,+EAA+E,EAAE,CAAC;IACxK,OAAO,EAAE,YAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,kEAAkE,EAAE,CAAC;IACrH,IAAI,EAAE,YAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC;IAC/G,OAAO,EAAE,YAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,uGAAuG,EAAE,CAAC;IACzL,MAAM,EAAE,YAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,0FAA0F,EAAE,CAAC;IACjI,MAAM,EAAE,YAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,mEAAmE,EAAE,CAAC;IAC1G,KAAK,EAAE,YAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,iLAAiL,EAAE,CAAC;IAEvO,oEAAoE;IACpE,eAAe,EAAE,YAAK,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,qSAAqS,EAAE,CAAC;IAC7W,MAAM,EAAE,YAAK,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,+EAA+E,EAAE,CAAC;IACzJ,IAAI,EAAE,YAAK,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,iFAAiF,EAAE,CAAC;IAC3J,WAAW,EAAE,YAAK,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,sEAAsE,EAAE,CAAC;CACnJ,CAAC;AAEK,mBAAI,GAAG,EAAE,CAAC"}

package/dist/commands/csp/login.js

@@ -75,21 +75,25 @@ class CspLogin extends command_base_exec_tenant_1.CommandBaseExecTenant {
             const cspTenant = yield this.cspContextualizer.ensureCspTenantContext(this._codiacApi, partial.providerCode, partial.providerSubscription, partial.providerTenant, true);
             partial.providerSubscription = cspTenant.subscriptionId;
             partial.providerTenant = cspTenant.tenantId;
-            let candidate;
-            if (partial.proprietaryInput) {
-                candidate = this.cspContextualizer.assembleLoginRequest(this.ioc, partial.providerCode, partial.username, partial.secret, cspTenant.subscriptionId, partial.proprietaryInput);
+            // Pass the RAW secret through. The downstream login flow
+            // (AwsResourceConfigurator.promptToLogin -> assembleLoginRequest ->
+            // crunchForTransport) base64-encodes the secret exactly once. Previously the
+            // proprietaryInput (AWS session-token) branch pre-crunched the secret HERE via
+            // assembleLoginRequest, so it got base64-encoded a SECOND time downstream. The
+            // server decoded once and received a mangled secret -> "SignatureDoesNotMatch"
+            // for every `--silent -p ... --aws-session-token ...` login (cod exits 0 on
+            // failure, so CI never noticed). Build the candidate uniformly with the raw
+            // secret and let the single downstream crunch happen.
+            let candidate = {
+                providerCode: partial.providerCode,
+                username: partial.username,
+                secret: partial.secret,
+                providerSubscription: partial.providerSubscription,
+            };
+            if (partial.providerTenant)
+                candidate.providerTenant = partial.providerTenant;
+            if (partial.proprietaryInput)
                 candidate.proprietaryInput = partial.proprietaryInput;
-            }
-            else {
-                candidate = {
-                    providerCode: partial.providerCode,
-                    username: partial.username,
-                    secret: partial.secret,
-                    providerSubscription: partial.providerSubscription,
-                };
-                if (partial.providerTenant)
-                    candidate.providerTenant = partial.providerTenant;
-            }
             if (partial.credsType)
                 candidate.credsType = partial.credsType;
             return candidate;