@fungi.computer/oyster 0.3.2 → 0.4.1

package/dist/browser/boot.d.ts

@@ -8,8 +8,8 @@ import type { BrowserSessions } from "./sessions.js";
  * (`BrowserSessions`), never a meter, so a boot check is never billed to a
  * Team, and the agent tool never receives it. It accepts no URL: it builds
  * `<origin>/_boot/<releaseId>/index.html` itself from the host's configured
- * origin. Its dedicated provider session is pinned to that host by the
- * provider guardrail (a host-level backstop). The browser's request gate
+ * origin. Browser Run also pins that host through a provider guardrail;
+ * Chromium contexts have no provider host allowlist. The browser's request gate
  * fails every request whose exact origin (scheme, host, port) differs, on
  * the page and on every frame it admits, before that frame runs. The
  * capability token is added by that gate, and only to exact-origin

package/dist/browser/boot.js

@@ -12,8 +12,8 @@ import { attachPage, navigatePage, pageLocation } from "./page.js";
  * (`BrowserSessions`), never a meter, so a boot check is never billed to a
  * Team, and the agent tool never receives it. It accepts no URL: it builds
  * `<origin>/_boot/<releaseId>/index.html` itself from the host's configured
- * origin. Its dedicated provider session is pinned to that host by the
- * provider guardrail (a host-level backstop). The browser's request gate
+ * origin. Browser Run also pins that host through a provider guardrail;
+ * Chromium contexts have no provider host allowlist. The browser's request gate
  * fails every request whose exact origin (scheme, host, port) differs, on
  * the page and on every frame it admits, before that frame runs. The
  * capability token is added by that gate, and only to exact-origin
@@ -102,7 +102,11 @@ const responseSchema = z.object({
 });
 const loadingFailedSchema = z.object({ requestId: z.string() });
 const createdSchema = z.object({
-    targetInfo: z.object({ targetId: z.string(), type: z.string() }),
+    targetInfo: z.object({
+        targetId: z.string(),
+        type: z.string(),
+        browserContextId: z.string().optional(),
+    }),
 });
 const attachedSchema = z.object({
     sessionId: z.string(),
@@ -355,6 +359,9 @@ function observe(client, recorder, pinned, target, children, pages) {
             const created = createdSchema.safeParse(params);
             if (!created.success || created.data.targetInfo.type !== "page")
                 return;
+            if (client.browserContextId !== undefined &&
+                created.data.targetInfo.browserContextId !== client.browserContextId)
+                return;
             const { targetId } = created.data.targetInfo;
             if (!pages.sealed)
                 pages.known.add(targetId);

package/dist/browser/browser.d.ts

@@ -63,7 +63,7 @@ export type BrowserLimits = Readonly<{
     maxConcurrentPerTeam: number;
     /** A lease older than this is reaped even if active. */
     maxLifetimeMs: number;
-    /** A lease idle this long is reaped; also the provider keep-alive. */
+    /** Reaped on the next operation; Browser Run also uses it as keep-alive. */
     idleTimeoutMs: number;
     /** Per-navigation load deadline. */
     navigationTimeoutMs?: number;

package/dist/browser/browser.js

@@ -56,7 +56,8 @@ export function createBrowser(host, limits) {
             const attempts = (pending?.attempts ?? 0) + 1;
             if (attempts > maxTeardownAttempts) {
                 teardowns.delete(sessionId);
-                // The provider keep-alive (the idle timeout) is the last backstop.
+                // Browser Run has an idle backstop. Chromium does not: a context
+                // abandoned here persists until Chromium restarts.
                 host.report({
                     kind: "teardown_abandoned",
                     teamId,

package/dist/browser/cdp-client.d.ts

@@ -34,6 +34,8 @@ export type HttpFetch = (url: string, init?: RequestInit) => Promise<Response>;
  */
 export declare function openCdpSocket(fetcher: HttpFetch, url: string, headers: Readonly<Record<string, string>>, signal: AbortSignal): Promise<CdpSocket>;
 export type CdpClient = Readonly<{
+    /** A Chromium context-scoped host supplies this; Browser Run leaves it absent. */
+    browserContextId?: string;
     /** One command/response round trip, optionally flattened into `sessionId`. */
     call: (method: string, params: Readonly<Record<string, Json>>, options?: Readonly<{
         sessionId?: string;

package/dist/browser/errors.d.ts

@@ -3,7 +3,7 @@ declare const CloudBrowserUrlDenied_base: new <A extends Record<string, any> = {
 } & Readonly<A>;
 /**
  * The cloud-browser backend's closed, typed failure channel. Every backend
- * (today only Cloudflare Browser Run) throws exclusively from this union;
+ * (Cloudflare Browser Run or on-box Chromium) throws from this union;
  * `agent-cloud-browser-source.ts` is the one place that maps it onto
  * Mycelium's `CapabilityFailed`, so the model only ever sees a bounded,
  * owner-admitted message (never a raw provider error body or stack).
@@ -17,7 +17,7 @@ export declare class CloudBrowserUrlDenied extends CloudBrowserUrlDenied_base<{
 declare const CloudBrowserUpstreamError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "CloudBrowserUpstreamError";
 } & Readonly<A>;
-/** The provider (Cloudflare Browser Run) answered with a failure. */
+/** The configured provider answered with a failure or is unreachable. */
 export declare class CloudBrowserUpstreamError extends CloudBrowserUpstreamError_base<{
     readonly op: string;
     readonly status: number | null;

package/dist/browser/errors.js

@@ -1,7 +1,7 @@
 import * as Data from "effect/Data";
 /**
  * The cloud-browser backend's closed, typed failure channel. Every backend
- * (today only Cloudflare Browser Run) throws exclusively from this union;
+ * (Cloudflare Browser Run or on-box Chromium) throws from this union;
  * `agent-cloud-browser-source.ts` is the one place that maps it onto
  * Mycelium's `CapabilityFailed`, so the model only ever sees a bounded,
  * owner-admitted message (never a raw provider error body or stack).
@@ -9,7 +9,7 @@ import * as Data from "effect/Data";
 /** The target URL failed policy before any provider call was made. */
 export class CloudBrowserUrlDenied extends Data.TaggedError("CloudBrowserUrlDenied") {
 }
-/** The provider (Cloudflare Browser Run) answered with a failure. */
+/** The configured provider answered with a failure or is unreachable. */
 export class CloudBrowserUpstreamError extends Data.TaggedError("CloudBrowserUpstreamError") {
 }
 /** A call did not complete within its deadline. */

package/dist/browser/index.d.ts

@@ -1,7 +1,8 @@
 /**
  * `@fungi.computer/oyster/browser`: the one agent browser for the Hub and a
  * standalone Oyster. A host builds the port from a provider (`browserRunSessions`
- * or `bindingSessions`, plus Browser Run Quick Reads when it has them), its
+ * or `bindingSessions` or `onboxBrowserSessions` on staging, plus Browser Run
+ * Quick Reads when it has them), its
  * required metering owner and an event sink; `createBrowser` owns lease
  * ownership, egress policy and billing order; `browserCapabilitySource` is
  * the agent's `cloudBrowser` tool. Raw CDP stays internal to this directory.
@@ -13,4 +14,4 @@ export type { LeaseOwner } from "./lease-registry.js";
 export { cloudBrowserBounds, extractInputSchema, extractResultSchema, linksResultSchema, markdownInputSchema, markdownResultSchema, navigateResultSchema, openResultSchema, scrapeInputSchema, scrapeResultSchema, snapshotResultSchema, type BinaryResult, type CloudBrowserAck, type CloudBrowserClosed, type CloudBrowserOperation, type CloudBrowserOperationResult, type ExtractInput, type ExtractResult, type LinksResult, type MarkdownInput, type MarkdownResult, type NavigateResult, type OpenResult, type ScrapeInput, type ScrapeResult, type SnapshotResult, } from "./operations.js";
 export type { CdpSocket, HttpFetch } from "./cdp-client.js";
 export { browserRunQuickReads, type BrowserRunQuickReadsConfig, type QuickRead, type QuickReads, } from "./quick-reads.js";
-export { bindingSessions, browserRunSessions, type BrowserBinding, type BrowserSessions, type CdpConnect, } from "./sessions.js";
+export { bindingSessions, browserRunSessions, onboxBrowserSessions, type BrowserBinding, type BrowserSessions, type CdpConnect, } from "./sessions.js";

package/dist/browser/index.js

@@ -1,7 +1,8 @@
 /**
  * `@fungi.computer/oyster/browser`: the one agent browser for the Hub and a
  * standalone Oyster. A host builds the port from a provider (`browserRunSessions`
- * or `bindingSessions`, plus Browser Run Quick Reads when it has them), its
+ * or `bindingSessions` or `onboxBrowserSessions` on staging, plus Browser Run
+ * Quick Reads when it has them), its
  * required metering owner and an event sink; `createBrowser` owns lease
  * ownership, egress policy and billing order; `browserCapabilitySource` is
  * the agent's `cloudBrowser` tool. Raw CDP stays internal to this directory.
@@ -11,4 +12,4 @@ export { browserCapabilitySource, CLOUD_BROWSER_DESCRIPTIONS, } from "./capabili
 export { CloudBrowserCapacityExceeded, CloudBrowserCreditDenied, CloudBrowserLeaseNotFound, CloudBrowserLeasePaused, CloudBrowserTimeout, CloudBrowserUnavailable, CloudBrowserUpstreamError, CloudBrowserUrlDenied, } from "./errors.js";
 export { cloudBrowserBounds, extractInputSchema, extractResultSchema, linksResultSchema, markdownInputSchema, markdownResultSchema, navigateResultSchema, openResultSchema, scrapeInputSchema, scrapeResultSchema, snapshotResultSchema, } from "./operations.js";
 export { browserRunQuickReads, } from "./quick-reads.js";
-export { bindingSessions, browserRunSessions, } from "./sessions.js";
+export { bindingSessions, browserRunSessions, onboxBrowserSessions, } from "./sessions.js";

package/dist/browser/page.js

@@ -8,7 +8,11 @@ import { cloudBrowserBounds, } from "./operations.js";
  * The session-create response shape was confirmed by the live workerd smoke
  * on 2026-10-03; see `test/browser/cdp-client.test.ts`.
  */
-const targetSchema = z.object({ targetId: z.string(), type: z.string() });
+const targetSchema = z.object({
+    targetId: z.string(),
+    type: z.string(),
+    browserContextId: z.string().optional(),
+});
 const getTargetsResultSchema = z.object({ targetInfos: z.array(targetSchema) });
 const attachResultSchema = z.object({ sessionId: z.string() });
 const navigateResultSchema = z.object({
@@ -31,11 +35,14 @@ const capturedDataSchema = z.object({ data: z.string() });
 /** Attach to the session's first page target (or a new blank one). */
 export async function attachPage(client) {
     const targets = getTargetsResultSchema.parse(await client.call("Target.getTargets", {}));
-    const targetId = targets.targetInfos.find((target) => target.type === "page")?.targetId ??
+    const targetId = targets.targetInfos.find((target) => target.type === "page" &&
+        (client.browserContextId === undefined ||
+            target.browserContextId === client.browserContextId))?.targetId ??
         z
             .object({ targetId: z.string() })
-            .parse(await client.call("Target.createTarget", { url: "about:blank" }))
-            .targetId;
+            .parse(await client.call("Target.createTarget", client.browserContextId === undefined
+            ? { url: "about:blank" }
+            : { url: "about:blank", browserContextId: client.browserContextId })).targetId;
     const { sessionId: cdpSessionId } = attachResultSchema.parse(await client.call("Target.attachToTarget", { targetId, flatten: true }));
     await client.call("Page.enable", {}, { sessionId: cdpSessionId });
     await client.call("Accessibility.enable", {}, { sessionId: cdpSessionId });

package/dist/browser/sessions.d.ts

@@ -11,16 +11,17 @@ import { type CdpClient, type CdpSocket, type HttpFetch } from "./cdp-client.js"
  * - Binding: `binding.fetch("http://fake.host/v1/devtools/…")`, the endpoints
  *   a Workers Browser Run binding answers.
  *
+ * Chromium on staging uses browser contexts rather than Browser Run endpoints.
  * Provider session ids stay inside the module; agent leases use their own ids.
  */
 export type AcquireOptions = Readonly<{
-    /** Provider idle keep-alive, clamped to Browser Run's 10s–20min range. */
+    /** Browser Run idle keep-alive (10s–20min); Chromium has no equivalent. */
     keepAliveMs: number;
-    /** Provider guardrail: the only hosts this session may load. */
+    /** Browser Run provider guardrail; Chromium relies on its caller's URL gate. */
     allowedDomains?: readonly string[];
 }>;
 /**
- * The provider half of the host port. Built only by the two functions below.
+ * The provider half of the host port.
  * Each step is separate so `createBrowser` owns a provider session id from the
  * moment it exists, including when its CDP connect then fails.
  */
@@ -31,7 +32,7 @@ export type BrowserSessions = Readonly<{
     connect: (sessionId: string, signal: AbortSignal) => Promise<CdpClient>;
     /** Ask the provider to delete a session; 404 is already gone. @internal */
     release: (sessionId: string, signal: AbortSignal) => Promise<"closed" | "closing">;
-    /** Reads the provider's session record until it reports an end time. @internal */
+    /** Confirm provider closure (Chromium checks context absence). @internal */
     confirmClosed: (sessionId: string, deadlineAt: number) => Promise<void>;
 }>;
 /** A Workers BROWSER binding (`Fetcher`), reduced to the call this module makes. */
@@ -50,3 +51,5 @@ export declare function browserRunSessions(config: Readonly<{
 }>): BrowserSessions;
 /** A standalone Oyster's own Workers BROWSER binding. */
 export declare function bindingSessions(binding: BrowserBinding): BrowserSessions;
+/** Staging uses Chromium's native CDP browser contexts; no session store. */
+export declare function onboxBrowserSessions(origin: string, fetcher?: HttpFetch): BrowserSessions;

package/dist/browser/sessions.js

@@ -116,3 +116,162 @@ export function bindingSessions(binding) {
         connect: (url, headers, signal) => openCdpSocket(fetcher, url, headers, signal),
     });
 }
+/** Staging uses Chromium's native CDP browser contexts; no session store. */
+export function onboxBrowserSessions(origin, fetcher = (url, init) => fetch(url, init)) {
+    const base = new URL(origin);
+    if (base.protocol !== "http:" ||
+        base.hostname !== "127.0.0.1" ||
+        base.username ||
+        base.password ||
+        base.pathname !== "/" ||
+        base.search ||
+        base.hash)
+        throw new TypeError("On-box browser origin must be bare IPv4 loopback");
+    const browserEndpointSchema = z.object({ webSocketDebuggerUrl: z.url() });
+    const contextsSchema = z.object({ browserContextIds: z.array(z.string()) });
+    const createdContextSchema = z.object({
+        browserContextId: z.string().min(1),
+    });
+    async function connectBrowser(signal) {
+        // Chromium's native discovery endpoint is not a Botanical session server.
+        let discovery;
+        try {
+            discovery = await fetcher(new URL("/json/version", base).href, {
+                signal,
+            });
+        }
+        catch (cause) {
+            if (signal.aborted)
+                throw cause;
+            throw new CloudBrowserUpstreamError({
+                op: "onbox.connect",
+                status: null,
+                message: "On-box Chromium is unavailable",
+            });
+        }
+        if (!discovery.ok)
+            throw new CloudBrowserUpstreamError({
+                op: "onbox.connect",
+                status: discovery.status,
+                message: "On-box Chromium is unavailable",
+            });
+        let body;
+        try {
+            body = await discovery.json();
+        }
+        catch (cause) {
+            if (signal.aborted)
+                throw cause;
+            throw new CloudBrowserUpstreamError({
+                op: "onbox.connect",
+                status: null,
+                message: "On-box browser returned an unreadable CDP endpoint",
+            });
+        }
+        const discovered = browserEndpointSchema.safeParse(body);
+        if (!discovered.success)
+            throw new CloudBrowserUpstreamError({
+                op: "onbox.connect",
+                status: null,
+                message: "On-box browser returned an unreadable CDP endpoint",
+            });
+        const { webSocketDebuggerUrl } = discovered.data;
+        const endpoint = new URL(webSocketDebuggerUrl);
+        if (endpoint.protocol !== "ws:" ||
+            endpoint.hostname !== "127.0.0.1" ||
+            endpoint.port !== base.port ||
+            !/^\/devtools\/browser\/[^/]+$/u.test(endpoint.pathname) ||
+            endpoint.username ||
+            endpoint.password ||
+            endpoint.search ||
+            endpoint.hash)
+            throw new CloudBrowserUpstreamError({
+                op: "onbox.connect",
+                status: null,
+                message: "On-box browser returned an invalid CDP endpoint",
+            });
+        return createCdpClient(await openCdpSocket(fetcher, endpoint.href.replace(/^ws:/u, "http:"), {}, signal));
+    }
+    async function contexts(client, signal) {
+        const result = contextsSchema.safeParse(await client.call("Target.getBrowserContexts", {}, { signal }));
+        if (!result.success)
+            throw new CloudBrowserUpstreamError({
+                op: "onbox.contexts",
+                status: null,
+                message: "On-box browser returned unreadable contexts",
+            });
+        return result.data.browserContextIds;
+    }
+    return {
+        create: async (_options, signal) => {
+            // Chromium has no idle keep-alive or allowedDomains create guardrail:
+            // Oyster's Agent URL policy and the boot page request gate remain active.
+            // A Chromium restart ends every context; no restart recovery is claimed.
+            const client = await connectBrowser(signal);
+            try {
+                const created = createdContextSchema.safeParse(await client.call("Target.createBrowserContext", {}, { signal }));
+                if (!created.success)
+                    throw new CloudBrowserUpstreamError({
+                        op: "onbox.create",
+                        status: null,
+                        message: "On-box browser returned an unreadable context",
+                    });
+                const { browserContextId } = created.data;
+                try {
+                    await client.call("Target.createTarget", { url: "about:blank", browserContextId }, { signal });
+                    return browserContextId;
+                }
+                catch (error) {
+                    await client.call("Target.disposeBrowserContext", { browserContextId }, { signal });
+                    throw error;
+                }
+            }
+            finally {
+                client.close();
+            }
+        },
+        connect: async (id, signal) => {
+            const client = await connectBrowser(signal);
+            try {
+                if (!(await contexts(client, signal)).includes(id))
+                    throw new CloudBrowserUpstreamError({
+                        op: "onbox.connect",
+                        status: null,
+                        message: "On-box browser context is gone",
+                    });
+                return { ...client, browserContextId: id };
+            }
+            catch (error) {
+                client.close();
+                throw error;
+            }
+        },
+        release: async (id, signal) => {
+            const client = await connectBrowser(signal);
+            try {
+                if ((await contexts(client, signal)).includes(id))
+                    await client.call("Target.disposeBrowserContext", { browserContextId: id }, { signal });
+                return "closed";
+            }
+            finally {
+                client.close();
+            }
+        },
+        confirmClosed: async (id, deadlineAt) => {
+            const signal = AbortSignal.timeout(Math.max(1, deadlineAt - Date.now()));
+            const client = await connectBrowser(signal);
+            try {
+                if (!(await contexts(client, signal)).includes(id))
+                    return;
+            }
+            finally {
+                client.close();
+            }
+            throw new CloudBrowserUpstreamError({
+                op: "onbox.close.confirm",
+                status: null,
+                message: "On-box browser did not confirm closure",
+            });
+        },
+    };
+}

package/dist/browser/url-policy.d.ts

@@ -12,7 +12,9 @@ export type UrlCheckOptions = Readonly<{
  * `169.254.169.254`, a private range like `10/8`, the box's own address, and
  * a rebinding hostname (one whose DNS answer is private) are all refused
  * here, before Cloudflare ever sees the URL. The name is resolved once; the
- * caller never connects to it directly — Cloudflare does, so this is a policy
- * gate, not a proxy.
+ * caller does not connect directly: Browser Run does in production, Chromium
+ * does on staging. This check is not network confinement: a page can redirect,
+ * load subresources or resolve the host differently after this check. Staging
+ * must isolate Chromium's network egress before enabling Agent leases.
  */
 export declare function assertCloudBrowserUrlAllowed(raw: string, options: UrlCheckOptions): Promise<URL>;

package/dist/browser/url-policy.js

@@ -10,8 +10,10 @@ import { CloudBrowserUrlDenied } from "./errors.js";
  * `169.254.169.254`, a private range like `10/8`, the box's own address, and
  * a rebinding hostname (one whose DNS answer is private) are all refused
  * here, before Cloudflare ever sees the URL. The name is resolved once; the
- * caller never connects to it directly — Cloudflare does, so this is a policy
- * gate, not a proxy.
+ * caller does not connect directly: Browser Run does in production, Chromium
+ * does on staging. This check is not network confinement: a page can redirect,
+ * load subresources or resolve the host differently after this check. Staging
+ * must isolate Chromium's network egress before enabling Agent leases.
  */
 export async function assertCloudBrowserUrlAllowed(raw, options) {
     let url;

package/dist/build/build-jobs.d.ts

@@ -11,7 +11,7 @@ declare const jobSchema: Schema.Struct<{
     readonly expiresAt: Schema.Number;
     readonly remote: Schema.NonEmptyString;
     readonly reportUrl: Schema.NonEmptyString;
-    readonly status: Schema.Literals<readonly ["running", "succeeded", "failed", "revoked"]>;
+    readonly status: Schema.Literals<readonly ["running", "succeeded", "failed", "interrupted", "revoked"]>;
     readonly artifact: Schema.NullOr<Schema.Struct<{
         readonly digest: Schema.NonEmptyString;
         readonly bytes: Schema.Number;
@@ -87,7 +87,7 @@ export declare function createTeamBuildPublisher(options: Readonly<{
         readonly expiresAt: number;
         readonly remote: string;
         readonly reportUrl: string;
-        readonly status: "revoked" | "running" | "failed" | "succeeded";
+        readonly status: "revoked" | "running" | "failed" | "succeeded" | "interrupted";
         readonly artifact: {
             readonly digest: string;
             readonly bytes: number;
@@ -103,7 +103,7 @@ export declare function createTeamBuildPublisher(options: Readonly<{
         readonly expiresAt: number;
         readonly remote: string;
         readonly reportUrl: string;
-        readonly status: "revoked" | "running" | "failed" | "succeeded";
+        readonly status: "revoked" | "running" | "failed" | "succeeded" | "interrupted";
         readonly artifact: {
             readonly digest: string;
             readonly bytes: number;

package/dist/build/build-jobs.js

@@ -53,6 +53,7 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
 import * as Schema from "effect/Schema";
 import { base64url } from "jose";
 import { workspaceBuildPolicy } from "./build-policy.js";
+import { boundedDiagnostic } from "@fungi.computer/bird-dog/effect";
 /** The secret-free Team job; no provider token enters publication. */
 const jobSchema = Schema.Struct({
     jobId: Schema.NonEmptyString,
@@ -63,7 +64,13 @@ const jobSchema = Schema.Struct({
     expiresAt: Schema.Number,
     remote: Schema.NonEmptyString,
     reportUrl: Schema.NonEmptyString,
-    status: Schema.Literals(["running", "succeeded", "failed", "revoked"]),
+    status: Schema.Literals([
+        "running",
+        "succeeded",
+        "failed",
+        "interrupted",
+        "revoked",
+    ]),
     artifact: Schema.NullOr(Schema.Struct({ digest: Schema.NonEmptyString, bytes: Schema.Number })),
     detail: Schema.NullOr(Schema.String),
 });
@@ -148,10 +155,8 @@ export function createTeamBuildPublisher(options) {
                         ? "succeeded"
                         : "failed", exitCode === 0
                         ? "Build exited without reporting status"
-                        : "Build exited with " +
-                            String(exitCode) +
-                            ": " +
-                            (result.output?.stderr ?? "").slice(-1_000)));
+                        : (boundedDiagnostic(result.output?.stderr ?? "") ??
+                            `Build exited with ${String(exitCode)}`)));
                     await build.deliverProjection();
                     return completed;
                 }

package/dist/build/candidate-cli.js

@@ -1,17 +1,21 @@
 import * as Schema from "effect/Schema";
 import { releaseSchema } from "@fungi.computer/puffball/effect";
 import { readFile } from "node:fs/promises";
+import { candidateFailureDiagnostic } from "./candidate-diagnostic.js";
 import { candidateManifestObjects, teamAppCandidateManifestSchema, } from "../build-contract.js";
 import { buildTeamCandidate, teamCandidateConfigurationSchema, teamCandidateLayout, TeamCandidateBuildError, } from "./candidate-builder.js";
 /** Objects in flight at once; each is read from disk only while it uploads. */
 const uploadConcurrency = 4;
 /** Attempts per object when its connection drops before a response. */
 const uploadAttempts = 3;
-/** Report a failed build to the host's build output: its kind, never its text. */
+/** Report bounded diagnostics to the host's build output. */
 function reportFailure(cause) {
+    const diagnostic = candidateFailureDiagnostic(cause);
+    process.stderr.write(`Team App source/build failed: ${diagnostic}\n`);
     process.stderr.write(`${JSON.stringify({
         source: "oyster-candidate-builder",
         failureKind: cause instanceof Error ? "Error" : "NonErrorThrown",
+        diagnostic,
     })}\n`);
 }
 const [configuration, repositoryPath, outputPath] = process.argv.slice(2);
@@ -113,7 +117,5 @@ try {
 }
 catch (cause) {
     reportFailure(cause);
-    // Customer source and provider messages can contain secrets; only expose the stage.
-    process.stderr.write("Team App source/build failed\n");
     process.exitCode = 1;
 }