@extenshi/cli 0.21.0 → 0.23.0

package/dist/project.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAgB3F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIxC,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAE/B,qBAAa,eAAgB,SAAQ,KAAK;IAExC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;gBAFb,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,YAAA;CAMvB;AACD,wBAAsB,cAAc,CACnC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,EAC9C,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,OAAY,EACnB,QAAQ,UAAQ,GACd,OAAO,CAAC,IAAI,CAAC,CAyCf;AAED,eAAO,MAAM,cAAc,4BAAe,CAAA;AAK1C,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,iBAe5D;AACD,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyDhE;AA6GD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,QAggBvD"}
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAQ3F,OAAO,EAKN,wBAAwB,EAKxB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAQxC,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAE/B,qBAAa,eAAgB,SAAQ,KAAK;IAExC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;IACtB,iFAAiF;IACjF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;gBAJf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,YAAA;IACtB,iFAAiF;IACxE,MAAM,CAAC,EAAE,MAAM,YAAA;CAMzB;AAeD,wBAAsB,cAAc,CACnC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,EAC9C,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,OAAY,EACnB,QAAQ,UAAQ,GACd,OAAO,CAAC,IAAI,CAAC,CAkDf;AAED,eAAO,MAAM,cAAc,4BAAe,CAAA;AAwD1C,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,iBAe5D;AACD,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyDhE;AAoGD,wGAAwG;AACxG,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC3B,8EAA8E;IAC9E,OAAO,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC/E,qFAAqF;IACrF,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAA;CAC7B;AAED,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAA;AAElF,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACd;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAazF;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC7C,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,EAC9C,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,kBAAkB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B;AAUD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAMzG;AACD,sDAAsD;AACtD,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,cAAc,EAAE,GACvB,OAAO,CAAC;IAAE,MAAM,EAAE,UAAU,GAAG,cAAc,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC,CAgC1G;AAoCD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,QAgnBvD"}

package/dist/project.js

@@ -2,25 +2,47 @@
 import { execFileSync } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
 import { createReadStream } from 'node:fs';
-import { lstat, mkdir, open, readFile, readlink, rename, rm, stat } from 'node:fs/promises';
+import { lstat, mkdir, open, readdir, readFile, readlink, rename, rm, stat } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import path from 'node:path';
-import { agentEvidenceSchema, EVIDENCE_ATTACHMENT_MAX_BYTES, evidenceAttachmentSchema, hashMetadata, importManifestSchema, workspacePatchSchema, } from '@extenshi/contracts';
+import { agentCreateProjectSchema, agentEvidenceSchema, EVIDENCE_ATTACHMENT_MAX_BYTES, EVIDENCE_ATTACHMENTS_MAX, evidenceAttachmentSchema, hashMetadata, importManifestSchema, proposeDecisionSchema, workspacePatchSchema, } from '@extenshi/contracts';
 import { loadConfig } from './config.js';
 import { assertNotSecretLike, attachmentContentType } from './evidence-attachments.js';
+import { InvalidInputError } from './expected-error.js';
+import { isExtensionLocale } from './extension-localization.js';
+import { readLocaleMessages } from './listing.js';
+import { resolvePackagedArtifact } from './package.js';
 import { loadArtifact } from './review-archive.js';
 const cliVersion = createRequire(import.meta.url)('../package.json').version;
 export class ProjectApiError extends Error {
     category;
     status;
     code;
-    constructor(category, status, code) {
-        super(`Project API: ${category} (${status}). ${code === 'PROJECT_PREMIUM_REQUIRED' ? 'Automated release readiness requires a Pro project. ' : ''}${category === 'auth' ? 'Run extenshi login, or reconnect your OAuth client.' : category === 'unsupported' ? 'The server does not support this command yet.' : 'Run extenshi doctor --json for diagnostics.'}`);
+    detail;
+    constructor(category, status, code, 
+    /** The server's own reason for a 4xx refusal (e.g. why an image was refused). */
+    detail) {
+        super(`Project API: ${category} (${status}). ${detail ? `${detail} ` : ''}${code === 'PROJECT_PREMIUM_REQUIRED' ? 'Automated release readiness requires a Pro project. ' : ''}${codeHint(code)}${category === 'auth' ? 'Run extenshi login, or reconnect your OAuth client.' : category === 'unsupported' ? 'The server does not support this command yet.' : 'Run extenshi doctor --json for diagnostics.'}`);
         this.category = category;
         this.status = status;
         this.code = code;
+        this.detail = detail;
     }
 }
+/**
+ * Stable codes the backend authors (never provider or user text) — the only
+ * server messages echoed, so a secret in an error body still cannot leak.
+ */
+const PASSTHROUGH_CODE = /^(PROJECT_PREMIUM_REQUIRED|OWNER_SESSION_REQUIRED|IDEMPOTENCY_KEY_REUSED_WITH_DIFFERENT_INPUT|DEV_PROJECT_LIMIT_[A-Z_]+|DECISION_[A-Z_]+(?::[A-Za-z.,]+)?)$/;
+function codeHint(code) {
+    if (!code || code === 'PROJECT_PREMIUM_REQUIRED')
+        return '';
+    if (code.startsWith('DECISION_') || code === 'OWNER_SESSION_REQUIRED')
+        return `${code}: owner decisions are decided on the Dojo project page; agents and API keys can only propose them. `;
+    if (code.startsWith('DEV_PROJECT_LIMIT_'))
+        return `${code}: this plan's limit is reached (see Dojo billing). `;
+    return `${code}: a retried request reuses its key; different input needs a new idempotency key. `;
+}
 export async function projectRequest(config, method, input = {}, mutation = false) {
     if (!config.apiKey)
         throw new ProjectApiError('auth', 401);
@@ -57,7 +79,16 @@ export async function projectRequest(config, method, input = {}, mutation = fals
                                 : 'unsupported'
                             : status >= 500
                                 ? 'server'
-                                : 'validation', status, body?.error?.message === 'PROJECT_PREMIUM_REQUIRED' ? 'PROJECT_PREMIUM_REQUIRED' : undefined);
+                                : 'validation', status, typeof body?.error?.message === 'string' && PASSTHROUGH_CODE.test(body.error.message)
+            ? body.error.message
+            : undefined, 
+        // 4xx reasons are written for the caller (BAD_REQUEST / FORBIDDEN / PRECONDITION_FAILED);
+        // 5xx messages are not surfaced. Stable codes travel as `code` above instead.
+        [400, 403, 412, 413].includes(status) &&
+            typeof body?.error?.message === 'string' &&
+            !PASSTHROUGH_CODE.test(body.error.message)
+            ? body.error.message.slice(0, 500)
+            : undefined);
     }
     if (!body?.result?.data)
         throw new ProjectApiError('server', response.status);
@@ -70,6 +101,55 @@ async function jsonFile(file, limit = 256 * 1024) {
         throw new Error('Metadata file exceeds 256 KiB');
     return JSON.parse(await readFile(file, 'utf8'));
 }
+const missing = (error) => ['ENOENT', 'ENOTDIR'].includes(error.code ?? '');
+/**
+ * Every `_locales/<lang>/messages.json` next to the manifest, cut down to the
+ * keys its store-visible fields reference (`__MSG_*__` in name, short_name,
+ * description, action title): the server reads only those, and full catalogs
+ * for a dozen locales could crowd the 256 KiB import limit. Folders outside the
+ * Chrome Web Store locale registry and unparseable files are skipped.
+ */
+async function localeCatalogs(manifestPath, manifest) {
+    const action = manifest.action ?? manifest.browser_action ?? manifest.page_action;
+    const keys = new Set([manifest.name, manifest.short_name, manifest.description, action?.default_title].flatMap((value) => {
+        const key = typeof value === 'string' ? /^__MSG_(.+?)__$/.exec(value.trim())?.[1] : undefined;
+        return key ? [key.toLowerCase()] : [];
+    }));
+    if (!keys.size)
+        return undefined;
+    const root = path.join(path.dirname(manifestPath), '_locales');
+    let entries;
+    try {
+        entries = await readdir(root, { withFileTypes: true });
+    }
+    catch (error) {
+        if (missing(error))
+            return undefined;
+        throw error;
+    }
+    const files = new Map();
+    for (const entry of entries) {
+        if (!entry.isDirectory() || !isExtensionLocale(entry.name))
+            continue;
+        const file = path.join(root, entry.name, 'messages.json');
+        try {
+            if ((await stat(file)).size > 256 * 1024)
+                continue;
+            files.set(`_locales/${entry.name}/messages.json`, await readFile(file, 'utf8'));
+        }
+        catch (error) {
+            if (!missing(error))
+                throw error;
+        }
+    }
+    const catalogs = {};
+    for (const [locale, messages] of readLocaleMessages(files)) {
+        const catalog = Object.fromEntries(Object.entries(messages).filter(([key, entry]) => keys.has(key.toLowerCase()) && typeof entry?.message === 'string'));
+        if (Object.keys(catalog).length)
+            catalogs[locale] = catalog;
+    }
+    return Object.keys(catalogs).length ? catalogs : undefined;
+}
 export async function atomicJson(file, value) {
     await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
     const temporary = `${file}.${randomUUID()}.tmp`;
@@ -232,6 +312,139 @@ async function flush(cwd, config, binding) {
         await atomicJson(file, { operations });
     }
 }
+/**
+ * Queue and synchronize evidence records — THE client path for evidence, shared
+ * by `evidence push` and every command's `--evidence`. Each record is queued
+ * and flushed on its own so a long per-locale batch never trips the 20-entry
+ * pending cap while online; offline, the rest keep queueing for `project sync`.
+ */
+async function submitEvidence(cwd, config, binding, inputs) {
+    let pending = false;
+    for (const input of inputs) {
+        await queue(cwd, { method: 'agentRecordEvidence', input });
+        try {
+            await flush(cwd, config, binding);
+        }
+        catch (error) {
+            if (error instanceof ProjectApiError && ['offline', 'server'].includes(error.category))
+                pending = true;
+            else
+                throw error;
+        }
+    }
+    return pending ? 'pending-sync' : 'recorded';
+}
+/**
+ * The local gate for an evidence attachment, run before any byte leaves the
+ * machine: a secret-looking name, a type outside the contract's allowlist or a
+ * file over the per-file cap is refused — never silently dropped, which would
+ * show passed evidence without its proof.
+ */
+export async function prepareEvidenceAttachment(file) {
+    assertNotSecretLike(file);
+    const contentType = attachmentContentType(file);
+    if (!contentType)
+        throw new InvalidInputError(`"${file}": unsupported attachment type. Allowed: png, jpg, webp, json, txt, md, zip.`);
+    const bytes = await readFile(path.resolve(file));
+    if (bytes.byteLength > EVIDENCE_ATTACHMENT_MAX_BYTES)
+        throw new InvalidInputError(`"${file}" is ${(bytes.byteLength / 1024 / 1024).toFixed(1)} MB; the per-file limit is 10 MB.`);
+    return { file, bytes, contentType, sha256: sha(bytes) };
+}
+/**
+ * Upload one prepared attachment to the project's PRIVATE evidence storage:
+ * register it (agentCreateEvidenceUpload), PUT the bytes to the short-lived
+ * presigned URL, and return the metadata an evidence record references. Shared
+ * by `evidence push --attach` and `screenshots --evidence`.
+ */
+export async function uploadEvidenceAttachment(config, projectId, attachment) {
+    const upload = (await projectRequest(config, 'agentCreateEvidenceUpload', {
+        projectId,
+        fileName: path.basename(attachment.file),
+        contentType: attachment.contentType,
+        bytes: attachment.bytes.byteLength,
+        sha256: attachment.sha256,
+    }, true));
+    const put = await fetch(upload.uploadUrl, {
+        method: 'PUT',
+        body: new Uint8Array(attachment.bytes),
+        headers: { 'content-type': attachment.contentType },
+    });
+    if (!put.ok)
+        throw new Error(`Attachment upload failed (${put.status}). Request a fresh upload and retry.`);
+    return evidenceAttachmentSchema.parse({
+        kind: 'screenshot',
+        sha256: attachment.sha256,
+        bytes: attachment.bytes.byteLength,
+        contentType: attachment.contentType,
+        evidenceRef: upload.evidenceRef,
+    });
+}
+/**
+ * Whether evidence may carry `summary`. Both ends must know the key, because
+ * both validate with a STRICT schema: the installed @extenshi/contracts (an
+ * older one rejects the key locally), and the server — which says so in
+ * connection diagnostics (`contracts.evidenceSummary`). Unknown → no: the record
+ * still lands, only the summary is left out. Asked once per run.
+ */
+let summarySupport;
+export function evidenceSummarySupported(config) {
+    if (!('summary' in agentEvidenceSchema.shape))
+        return Promise.resolve(false);
+    summarySupport ??= projectRequest(config, 'agentConnectionDiagnostics')
+        .then((diagnostics) => Number(diagnostics.contracts?.evidenceSummary) >= 1)
+        .catch(() => false);
+    return summarySupport;
+}
+/** Test hook: forget the cached capability answer. */
+export function resetEvidenceSummarySupport() {
+    summarySupport = undefined;
+}
+/**
+ * Record evidence for the project bound in `cwd` (`extenshi project bind`),
+ * exactly as `evidence push` does — same schema, queue and flush — but from the
+ * command that produced the result, so no report file is hand-authored.
+ *
+ * Readiness counts evidence whose artifact and input digests match the prepared
+ * release; provenance (observed here, after the command wrote its outputs)
+ * records which commit produced it. Source is always `local` — CI evidence
+ * arrives only through the verified ingest.
+ *
+ * `attach` files are uploaded first, as `evidence push --attach` does; the same
+ * bytes attached to several records upload once, because the server accepts a
+ * ref again on a record with matching metadata. Uploading needs a connection:
+ * offline, it throws rather than queue a record without its proof.
+ */
+export async function recordAgentEvidence(cwd, records) {
+    return withLocalLock(cwd, async () => {
+        const binding = await localState(cwd);
+        const config = await loadConfig();
+        const provenance = await localProvenance(cwd);
+        const summaries = records.some((r) => r.summary) && (await evidenceSummarySupported(config));
+        const uploads = new Map();
+        const upload = (attachment) => {
+            let uploaded = uploads.get(attachment.sha256);
+            if (!uploaded) {
+                uploaded = uploadEvidenceAttachment(config, binding.projectId, attachment);
+                uploads.set(attachment.sha256, uploaded);
+            }
+            return uploaded;
+        };
+        const inputs = [];
+        for (const { summary, attach, ...record } of records) {
+            const attachments = attach?.length ? await Promise.all(attach.map(upload)) : [];
+            inputs.push(agentEvidenceSchema.parse({
+                projectId: binding.projectId,
+                idempotencyKey: randomUUID(),
+                ...record,
+                ...(summaries && summary ? { summary } : {}),
+                ...(attachments.length ? { attachments } : {}),
+                provenance,
+            }));
+        }
+        const status = await submitEvidence(cwd, config, binding, inputs);
+        return { status, projectId: binding.projectId, records: inputs.length, summaries };
+    });
+}
 async function syncPatch(cwd, patch, options) {
     return withLocalLock(cwd, async () => {
         const binding = await localState(cwd);
@@ -362,11 +575,126 @@ export function registerProjectCommands(program) {
         });
         await syncPatch(cwd, { repository: { repo: options.repo, defaultBranch: options.branch } }, {});
     }));
+    project
+        .command('create')
+        .description('Create a Dojo project owned by this API key, through the same service as the Dojo wizard. ' +
+        'Idempotent per --idempotency-key; prints the project id and next steps (bind, scaffold, decisions).')
+        .requiredOption('--name <name>', 'Project name (1–120 characters)')
+        .option('--browsers <list>', 'Comma-separated target browsers: chrome,firefox,edge')
+        .option('--description <text>')
+        .option('--category <category>', 'Catalog category')
+        .option('--idempotency-key <uuid>', 'Reuse on a retry so it returns the same project instead of a new one')
+        .option('--json', 'Emit the machine-readable result')
+        .action(run(async (options) => {
+        const config = await loadConfig();
+        const input = agentCreateProjectSchema.parse({
+            idempotencyKey: options.idempotencyKey ?? randomUUID(),
+            name: options.name,
+            description: options.description,
+            category: options.category,
+            browsers: options.browsers
+                ? String(options.browsers)
+                    .split(',')
+                    .map((s) => s.trim().toLowerCase())
+                    .filter(Boolean)
+                : [],
+        });
+        let result;
+        try {
+            result = await projectRequest(config, 'agentCreateProject', input, true);
+        }
+        catch (error) {
+            // Same key, same input: a retry after an ambiguous failure cannot duplicate.
+            if (!(error instanceof ProjectApiError) || !['offline', 'server'].includes(error.category))
+                throw error;
+            try {
+                result = await projectRequest(config, 'agentCreateProject', input, true);
+            }
+            catch (retryError) {
+                throw new Error(`${retryError instanceof Error ? retryError.message : 'Project create failed.'} Retry with --idempotency-key ${input.idempotencyKey} so a created project is returned instead of duplicated.`);
+            }
+        }
+        if (options.json) {
+            print({ ...result, idempotencyKey: input.idempotencyKey });
+            return;
+        }
+        console.log(`${result.replayed ? 'Existing' : 'Created'} project ${result.project?.name ?? ''} — ${result.projectId}`);
+        if (result.dojoUrl)
+            console.log(`  ${result.dojoUrl}`);
+        for (const step of result.nextSteps ?? [])
+            console.log(`  • ${step}`);
+        console.log(`  idempotency key: ${input.idempotencyKey}`);
+    }));
+    project
+        .command('decisions')
+        .description('Owner decisions (AMO add-on id, license, seller identity, pricing, targets): status, value, suggested default and what each blocks')
+        .option('--project <id>', 'Project id (default: the project bound to this directory)')
+        .option('--json', 'Emit the machine-readable view')
+        .action(run(async (options) => {
+        const projectId = options.project ?? (await localState(process.cwd())).projectId;
+        const view = await projectRequest(await loadConfig(), 'agentGetDecisions', { projectId });
+        if (options.json) {
+            print(view);
+            return;
+        }
+        const shown = (v) => (typeof v === 'string' ? v : JSON.stringify(v));
+        console.log(`Owner decisions — project ${projectId} (${view.pending.length} pending)`);
+        for (const d of view.decisions) {
+            const mark = d.status === 'decided' ? '✓' : d.status === 'proposed' ? '?' : '·';
+            const value = d.value !== null
+                ? shown(d.value)
+                : d.suggestedValue !== null
+                    ? `(suggested: ${shown(d.suggestedValue)})`
+                    : '';
+            const blocks = [
+                ...d.blocksBrowsers,
+                ...(d.blocksPayment ? ['paid releases'] : []),
+            ].join(', ');
+            console.log(`  ${mark} ${String(d.key).padEnd(22)} ${String(d.status).padEnd(9)} ${value}${blocks ? `  [blocks ${blocks}]` : ''}`);
+        }
+        if (view.pending.length)
+            console.log('  Agents propose with `extenshi project propose-decision <key> <value>`; the owner decides on the Dojo project page.');
+    }));
+    project
+        .command('propose-decision <key> <value>')
+        .description('Propose a value for an owner decision (JSON for pricing, comma-separated for targetBrowsers/targetLocales). ' +
+        'The owner accepts or edits it in Dojo; a decided key is refused.')
+        .option('--project <id>', 'Project id (default: the project bound to this directory)')
+        .option('--rationale <text>', 'Why this value; shown to the owner')
+        .action(run(async (key, value, options) => {
+        const projectId = options.project ?? (await localState(process.cwd())).projectId;
+        // A braced GUID also starts with "{", so JSON is only taken when it parses.
+        let json;
+        try {
+            json = /^[[{]/.test(value.trim()) ? JSON.parse(value) : undefined;
+        }
+        catch {
+            json = undefined;
+        }
+        const parsedValue = json !== undefined
+            ? json
+            : ['targetBrowsers', 'targetLocales'].includes(key)
+                ? value
+                    .split(',')
+                    .map((s) => s.trim())
+                    .filter(Boolean)
+                : value;
+        const input = proposeDecisionSchema.parse({
+            projectId,
+            idempotencyKey: randomUUID(),
+            key,
+            value: parsedValue,
+            rationale: options.rationale,
+            proposedBy: `extenshi-cli/${cliVersion}`,
+        });
+        print(await projectRequest(await loadConfig(), 'agentProposeDecision', input, true));
+    }));
     project
         .command('import-manifest <file>')
         .option('--built', 'Record a built observation without replacing source editor paths')
         .option('--browser <browser>', 'Target browser', 'chrome')
         .option('--messages <file>', 'Default-locale messages for project name and description')
+        .option('--no-locales', 'Do not send the _locales/<lang>/messages.json translations next to the manifest')
         .option('--expected-state-hash <hash>', 'Reviewed Dojo state hash; overrides the cached binding')
         .option('--dry-run')
         .action(run(async (file, options) => {
@@ -389,6 +717,9 @@ export function registerProjectCommands(program) {
                         throw error;
                 }
             }
+            // Translations of name/description from every _locales folder fill
+            // Dojo's Languages tab, so it matches what the repository ships.
+            const messagesByLocale = options.locales ? await localeCatalogs(location, manifest) : undefined;
             const base = importManifestSchema.parse({
                 projectId: binding.projectId,
                 schemaVersion: 1,
@@ -399,6 +730,7 @@ export function registerProjectCommands(program) {
                 kind: options.built ? 'built' : 'source',
                 manifest,
                 messages,
+                messagesByLocale,
                 dryRun: true,
                 tombstones: missingOriginFields(observed, `/${options.built ? 'builtManifests' : 'sourceManifests'}/${options.browser}/provenance`),
             });
@@ -562,40 +894,17 @@ export function registerProjectCommands(program) {
                 throw new Error('Report artifactDigest does not match the supplied artifact. Rerun the check for this package.');
             if (!['local', 'agent'].includes(metadata.provenance?.source))
                 throw new Error('Evidence source must be local or agent; this command cannot attest CI.');
-            // Attachments: refuse secret-looking names locally, upload bytes to
-            // the presigned private URL, record only metadata on the evidence.
+            // Attachments: every file passes the local checks before the first
+            // upload; bytes go to the presigned private URL and the evidence
+            // records only their metadata.
+            const prepared = [];
+            for (const file of options.attach ?? [])
+                prepared.push(await prepareEvidenceAttachment(file));
+            if (prepared.length > EVIDENCE_ATTACHMENTS_MAX)
+                throw new InvalidInputError(`At most ${EVIDENCE_ATTACHMENTS_MAX} attachments per evidence record.`);
             const attachments = [];
-            for (const file of options.attach ?? []) {
-                assertNotSecretLike(file);
-                const contentType = attachmentContentType(file);
-                if (!contentType)
-                    throw new Error(`"${file}": unsupported attachment type. Allowed: png, jpg, webp, json, txt, md, zip.`);
-                const bytes = await readFile(path.resolve(file));
-                if (bytes.byteLength > EVIDENCE_ATTACHMENT_MAX_BYTES)
-                    throw new Error(`"${file}" is ${(bytes.byteLength / 1024 / 1024).toFixed(1)} MB; the per-file limit is 10 MB.`);
-                const config = await loadConfig();
-                const upload = (await projectRequest(config, 'agentCreateEvidenceUpload', {
-                    projectId: binding.projectId,
-                    fileName: path.basename(file),
-                    contentType,
-                    bytes: bytes.byteLength,
-                    sha256: sha(bytes),
-                }, true));
-                const put = await fetch(upload.uploadUrl, {
-                    method: 'PUT',
-                    body: new Uint8Array(bytes),
-                    headers: { 'content-type': contentType },
-                });
-                if (!put.ok)
-                    throw new Error(`Attachment upload failed (${put.status}). Request a fresh upload and retry.`);
-                attachments.push(evidenceAttachmentSchema.parse({
-                    kind: 'screenshot',
-                    sha256: sha(bytes),
-                    bytes: bytes.byteLength,
-                    contentType,
-                    evidenceRef: upload.evidenceRef,
-                }));
-            }
+            for (const attachment of prepared)
+                attachments.push(await uploadEvidenceAttachment(await loadConfig(), binding.projectId, attachment));
             // Explicit metadata allowlist. Full logs and arbitrary report properties stay local.
             const { kind, browser, locale, inputDigest, status, provenance: origin, reportUrl } = metadata;
             const input = agentEvidenceSchema.parse({
@@ -611,21 +920,14 @@ export function registerProjectCommands(program) {
                 reportUrl,
                 ...(attachments.length ? { attachments } : {}),
             });
-            await queue(cwd, { method: 'agentRecordEvidence', input });
-            try {
-                await flush(cwd, await loadConfig(), binding);
-            }
-            catch (error) {
-                if (error instanceof ProjectApiError && ['offline', 'server'].includes(error.category)) {
-                    print({
-                        status: 'pending-sync',
-                        artifactDigest,
-                        message: 'Evidence metadata is queued. Run extenshi project sync when connected.',
-                    });
-                    process.exitCode = 1;
-                    return;
-                }
-                throw error;
+            if ((await submitEvidence(cwd, await loadConfig(), binding, [input])) === 'pending-sync') {
+                print({
+                    status: 'pending-sync',
+                    artifactDigest,
+                    message: 'Evidence metadata is queued. Run extenshi project sync when connected.',
+                });
+                process.exitCode = 1;
+                return;
             }
             print({
                 status: 'recorded',
@@ -637,6 +939,7 @@ export function registerProjectCommands(program) {
     const release = program.command('release');
     release
         .command('prepare <artifact>')
+        .description('Record the exact release: <artifact> is the store zip, or the extenshi-packages.json written by `extenshi package` (the --browser entry is used and its sha256 re-checked)')
         .option('--browser <browser>', 'Target browser', 'chrome')
         .option('--locales <locales>', 'Comma-separated release locales')
         .option('--source-manifest <file>', 'Source manifest used for this build')
@@ -653,7 +956,9 @@ export function registerProjectCommands(program) {
             throw new Error('--payment must be required or not-used');
         if (options.paymentConfig && options.payment !== 'required')
             throw new Error('Payment configuration requires --payment required');
-        const bytes = await readFile(path.resolve(artifact));
+        // A zip, or extenshi package's manifest (entry for --browser, sha re-checked).
+        const { artifactPath } = resolvePackagedArtifact(artifact, options.browser);
+        const bytes = await readFile(path.resolve(artifactPath));
         const loaded = await loadArtifact(bytes);
         const origin = await localProvenance(process.cwd());
         if (options.commit) {
@@ -725,6 +1030,10 @@ export function registerProjectCommands(program) {
             return;
         }
         print(status);
+        // stdout stays the JSON document; say where the payment fact came from on stderr.
+        const payment = status.checks?.find((c) => c.kind === 'payment' && c.platform);
+        if (typeof payment?.platform?.summary === 'string')
+            console.error(`payment (${payment.source ?? 'no passing evidence'}): ${payment.platform.summary}`);
         if (!status.ready)
             process.exitCode = 1;
     }));