@gatebolt/cli 0.4.0 → 0.5.0

package/dist/config.js

@@ -1,32 +1,68 @@
 export const DEFAULT_BASE_URL = "https://api.gatebolt.com";
 export async function resolveConnection(flags, loadProfile) {
-    const key = flags.key ?? process.env.GBOLT_KEY;
-    const url = flags.url ?? process.env.GBOLT_URL;
+    const key = flags.key ?? process.env.GATEBOLT_KEY;
+    const url = flags.url ?? process.env.GATEBOLT_URL;
     const profile = key && url ? null : await loadProfile();
     const resolvedKey = key ?? profile?.key;
     const baseUrl = (url ?? profile?.url ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
     if (!resolvedKey) {
-        throw new Error("Missing API key. Set GBOLT_KEY, pass --key, or run `gatebolt configure`.");
+        throw new Error("Missing API key. Set GATEBOLT_KEY, pass --key, or run `gatebolt configure`.");
     }
-    return { key: resolvedKey, baseUrl };
+    const connection = { key: resolvedKey, baseUrl };
+    const profileName = connectionProfileName(key, profile);
+    if (profileName)
+        connection.profileName = profileName;
+    return connection;
 }
-export async function resolveRepoSlug(flags, loadProfile) {
-    const raw = flags.repo ?? process.env.GBOLT_REPO ?? (await loadProfile())?.repo;
-    if (!raw) {
-        throw new Error("Missing repository slug. Set GBOLT_REPO, pass --repo, or run `gatebolt configure`.");
-    }
-    return slugifyRepo(raw);
+function connectionProfileName(key, profile) {
+    if (key || !profile)
+        return undefined;
+    return profile.name;
 }
 const SLUG_MAX_LENGTH = 48;
-export function slugifyRepo(value) {
+function toSlug(value) {
     const slug = value
         .toLowerCase()
         .trim()
         .replace(/[^a-z0-9]+/g, "-")
-        .slice(0, SLUG_MAX_LENGTH)
         .replace(/^-+|-+$/g, "");
     if (!slug) {
         throw new Error(`Could not derive a repository slug from "${value}".`);
     }
+    if (slug.length > SLUG_MAX_LENGTH) {
+        throw new Error(`"${value}" makes a ${slug.length}-character slug, over the ${SLUG_MAX_LENGTH} limit. ` +
+            "Run `gatebolt link --name <shorter-name>` to name this repository yourself.");
+    }
     return slug;
 }
+export function repoIdentityFromName(name) {
+    return { slug: toSlug(name), name };
+}
+const REMOTE_SCHEMES = new Set(["ssh:", "https:", "http:", "git:"]);
+const HAS_SCHEME = /^[a-z][a-z0-9+.-]*:\/\//i;
+const SCP_LIKE = /^(?:[^@]+@)?[^:/]{2,}:(.+)$/;
+function remotePath(url) {
+    const trimmed = url.trim();
+    if (!HAS_SCHEME.test(trimmed)) {
+        return SCP_LIKE.exec(trimmed)?.[1] ?? null;
+    }
+    let parsed;
+    try {
+        parsed = new URL(trimmed);
+    }
+    catch {
+        return null;
+    }
+    return REMOTE_SCHEMES.has(parsed.protocol) ? parsed.pathname : null;
+}
+export function parseRemoteUrl(url) {
+    const path = remotePath(url);
+    if (!path)
+        return null;
+    const segments = path.split("/").filter(Boolean);
+    const repo = segments.pop()?.replace(/\.git$/i, "");
+    if (!repo || segments.length === 0)
+        return null;
+    const name = `${segments.join("/")}/${repo}`;
+    return { slug: toSlug(name), name };
+}

package/dist/contracts.js

@@ -12,3 +12,9 @@ export const AGENT_VENDORS = [
 export function isAgentVendor(value) {
     return AGENT_VENDORS.includes(value);
 }
+// Mirrors z.uuid() in @gatebolt/validators; keep in sync by hand (the CLI
+// takes no dependency on the validators package).
+const SERVER_UUID = /^(?:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
+export function isUuid(value) {
+    return SERVER_UUID.test(value);
+}

package/dist/diff.js

@@ -1,3 +1,4 @@
+import { REPO_LINK_FILE } from "./profiles.js";
 const PARSER_BUG_HINT = "This is likely a GateBolt bug — please report it.";
 export function observedFilesFromGit(nameStatusOutput, numstatOutput, untrackedOutput) {
     const counts = parseNumstat(numstatOutput);
@@ -18,7 +19,7 @@ export function observedFilesFromGit(nameStatusOutput, numstatOutput, untrackedO
             continue;
         observed.push({ path, action: "added" });
     }
-    return observed;
+    return observed.filter((file) => file.path !== REPO_LINK_FILE);
 }
 function parseNameStatus(output) {
     const reader = createReader(splitFields(output));

package/dist/errors.js

@@ -3,7 +3,13 @@ const STATUS_BAD_REQUEST = 400;
 const STATUS_UNAUTHORIZED = 401;
 const STATUS_NOT_FOUND = 404;
 const STATUS_CONFLICT = 409;
-const STATUS_RATE_LIMITED = 429;
+const WRONG_WIRE_MESSAGE = "Not found — no GateBolt agent wire answered. Check the URL points at your GateBolt instance.";
+const NOT_FOUND_MESSAGE = {
+    "change.declare": "Not found — the repository id in .gatebolt is not one this API key can record against. The repository may have been deleted, or the file may have come from another workspace. Run `gatebolt link` from the repo root to re-establish it, then commit the .gatebolt it writes.",
+    "change.observe": "Not found — no change matches this API key. `observe` must use the same key that ran `declare`; if the key was rotated in between, re-run `gatebolt declare`.",
+    "repository.link": WRONG_WIRE_MESSAGE,
+    "agentKey.create": WRONG_WIRE_MESSAGE,
+};
 export function formatError(error) {
     if (error instanceof RequestError) {
         return messageForStatus(error);
@@ -16,17 +22,13 @@ export function formatError(error) {
 export function messageForStatus(error) {
     switch (error.status) {
         case STATUS_BAD_REQUEST:
-            return "Invalid request — check the declared values and try again.";
-        // The server collapses a missing/invalid key and a spent rate limit into one
-        // 401, so this cannot name which without guessing.
+            return `Invalid request — ${error.fieldErrors.join(" ") || "check the declared values and try again."}`;
         case STATUS_UNAUTHORIZED:
-            return "Unauthorized — the API key is invalid or has hit its rate limit.";
+            return "Unauthorized — check the API key. Run `gatebolt configure` to set a valid key for this repo.";
         case STATUS_NOT_FOUND:
-            return "Not found — no change matches this API key. `observe` must use the same key that ran `declare`; if the key was rotated in between, re-run `gatebolt declare`.";
+            return NOT_FOUND_MESSAGE[error.procedure];
         case STATUS_CONFLICT:
             return "Conflict — this change was already observed with different files.";
-        case STATUS_RATE_LIMITED:
-            return "Rate limited — try again later.";
         default:
             return error.message;
     }

package/dist/git.js

@@ -1,4 +1,5 @@
 import { execFile } from "node:child_process";
+import { resolve } from "node:path";
 import { promisify } from "node:util";
 const run = promisify(execFile);
 const MAX_GIT_OUTPUT_BYTES = 67_108_864;
@@ -28,6 +29,22 @@ export async function repoContext() {
         return null;
     return { gitDir: dir, root };
 }
+// --git-path resolves the shared hooks dir — correct even inside a linked worktree.
+export async function hooksPath() {
+    const output = await git(["rev-parse", "--git-path", "hooks"]);
+    return resolve(output.trim());
+}
+export async function remoteOriginUrl() {
+    try {
+        const output = await git(["remote", "get-url", "origin"]);
+        return output.trim() || null;
+    }
+    catch (error) {
+        if (gitExitedNonZero(error))
+            return null;
+        throw gitFailure(error);
+    }
+}
 export async function currentHead() {
     const output = await git(["rev-parse", "HEAD"]);
     return output.trim();

package/dist/help.js

@@ -2,7 +2,7 @@ import { readFile } from "node:fs/promises";
 import { DEFAULT_BASE_URL } from "./config.js";
 import { AGENT_VENDORS } from "./contracts.js";
 import { isRecord } from "./json.js";
-export const USAGE = "Usage: gatebolt <declare|observe|configure> [options]";
+export const USAGE = "Usage: gatebolt <login|init|declare|observe|configure|link> [options]";
 const ROOT_HELP = `gatebolt — the GateBolt agent client. An agent declares the files it intends to
 touch before it edits, then observes the actual diff when the work lands;
 GateBolt reconciles the two and scores the drift.
@@ -10,9 +10,13 @@ GateBolt reconciles the two and scores the drift.
 ${USAGE}
 
 Commands:
+  login       Sign in through your browser and save an agent key for this machine.
+  init        Set up GateBolt in a repository: link it and wire the agent hooks.
   declare     Record the files the agent intends to touch, before it edits.
   observe     Derive the diff from git and reconcile it against the declaration.
-  configure   Save a per-repo profile (url, repo, key) to ~/.gatebolt/config.json.
+  configure   Save a profile (url, key) to ~/.gatebolt/config.json.
+  link        Record which repository this checkout is, in a committable file.
+  hook        Internal — the declare/observe hook commands gatebolt init wires up.
 
 Options:
   -h, --help    Show this help, or the help of a command.
@@ -20,12 +24,28 @@ Options:
 
 Run \`gatebolt <command> --help\` for the options of a command.
 `;
+const LOGIN_HELP = `Usage: gatebolt login [options]
+
+Signs in through your browser and saves an agent API key for this machine.
+Opens a GateBolt page to approve the device, then mints an org-scoped key and
+writes a profile to ~/.gatebolt/config.json. Run once per machine; the profile
+is named after the organization you pick.
+
+Options:
+  --key-name <name>   Label for the key in the dashboard. Defaults to
+                      "gatebolt-cli (<hostname>)".
+  --url <url>         GateBolt URL. Defaults to ${DEFAULT_BASE_URL}.
+  -h, --help          Show this help.
+`;
 const DECLARE_HELP = `Usage: gatebolt declare --task <text> --vendor <vendor> --name <name>
                         --model <id> --file <path> [--file <path> ...] [options]
+       gatebolt declare --abort
 
-Records the files the agent intends to touch, before it edits. Snapshots the
-current commit as the base and writes the change id under <git-dir>/gatebolt/
-for \`gatebolt observe\` to pick up. The repository must have at least one commit.
+Records the files the agent intends to touch, before it edits. Reads the
+repository id from .gatebolt, or establishes it from the \`origin\` remote when
+the file is absent. Snapshots the current commit as the base and writes the
+change id under <git-dir>/gatebolt/ for \`gatebolt observe\` to pick up. The
+repository must have at least one commit.
 
 Required:
   --task <text>           What the agent is doing.
@@ -37,10 +57,12 @@ Required:
 Options:
   --agent-version <ver>   Version of the agent — not of this CLI.
   --launched-by <email>   Email of the person who launched the agent.
-  --profile <name>        Profile to read url, repo and key from.
+  --profile <name>        Profile to read url and key from.
   --key <key>             API key. Overrides the profile.
   --url <url>             GateBolt URL. Overrides the profile.
-  --repo <slug>           Repo slug. Overrides the profile.
+  --abort                 Clear the open declaration for this repo (local only;
+                          use it to unstick a declaration that can no longer be
+                          reconciled), then declare again. Ignores other flags.
   -h, --help              Show this help.
 `;
 const OBSERVE_HELP = `Usage: gatebolt observe [options]
@@ -57,27 +79,72 @@ Options:
   --url <url>          GateBolt URL. Overrides the profile.
   -h, --help           Show this help.
 `;
-const CONFIGURE_HELP = `Usage: gatebolt configure --repo <slug> [options]
+const CONFIGURE_HELP = `Usage: gatebolt configure [options]
 
 Saves a profile to ~/.gatebolt/config.json, owner-readable only. Prompts for the
-API key unless --key is given; what you type is not echoed.
-
-Required:
-  --repo <slug>      Slug of the repo this agent works in, created on the first
-                     declare. Normalized to lowercase-hyphens.
+API key unless --key is given; what you type is not echoed. Run \`gatebolt link\`
+in a repo to record which repository it is.
 
 Options:
-  --profile <name>   Profile name. Defaults to the repo slug.
+  --profile <name>   Profile name. Defaults to "default".
   --url <url>        GateBolt URL. Defaults to ${DEFAULT_BASE_URL}.
   --key <key>        API key. Skips the prompt, for scripting.
   -h, --help         Show this help.
 
 Set GATEBOLT_CONFIG to keep the config somewhere other than the default path.
 `;
+const LINK_HELP = `Usage: gatebolt link [options]
+
+Records which repository this checkout is, so every clone, worktree and CI job
+resolves the same one. Derives the name from the \`origin\` remote unless --name
+is given, then writes the repository id to a .gatebolt file at the repo root —
+commit that file.
+
+Options:
+  --name <name>      Name this repository yourself. Required when there is no
+                     \`origin\` remote to derive from.
+  --profile <name>   Profile to read url and key from. Recorded in .gatebolt.
+  --key <key>        API key. Overrides the profile.
+  --url <url>        GateBolt URL. Overrides the profile.
+  -h, --help         Show this help.
+`;
+const INIT_HELP = `Usage: gatebolt init [options]
+
+Sets up GateBolt in this repository: links it (writing a committable .gatebolt),
+wires your agent's declare → observe hooks into the repo, and installs a pre-push
+backstop. Reuses a saved profile, so run \`gatebolt login\` or \`gatebolt configure\`
+first. Safe to re-run.
+
+Options:
+  --name <name>      Name this repository yourself. Required when there is no
+                     \`origin\` remote to derive it from.
+  --enforce <mode>   \`strict\` blocks edits until you declare; \`lenient\` keeps
+                     it advisory. Omit to leave a repo's current mode unchanged
+                     (a fresh repo stays advisory).
+  --no-hooks         Only link the repository; don't wire the agent hooks.
+  --no-pre-push      Don't install the pre-push backstop.
+  --force            Replace an existing, non-GateBolt pre-push hook.
+  --profile <name>   Profile to read url and key from.
+  -h, --help         Show this help.
+`;
+const HOOK_HELP = `Usage: gatebolt hook <guard|post-turn|pre-push>
+
+Internal subcommands the hooks installed by \`gatebolt init\` invoke — you don't run
+these by hand. \`guard\` denies an edit until a declaration exists (strict mode only),
+\`post-turn\` reconciles the diff when a turn ends, and \`pre-push\` reconciles an open
+declaration before a push.
+
+Options:
+  -h, --help   Show this help.
+`;
 const COMMAND_HELP = new Map([
+    ["login", LOGIN_HELP],
+    ["init", INIT_HELP],
     ["declare", DECLARE_HELP],
     ["observe", OBSERVE_HELP],
     ["configure", CONFIGURE_HELP],
+    ["link", LINK_HELP],
+    ["hook", HOOK_HELP],
 ]);
 export function isCommand(command) {
     return COMMAND_HELP.has(command);

package/dist/index.js

@@ -1,6 +1,10 @@
 #!/usr/bin/env node
 import { runConfigure } from "./commands/configure.js";
 import { runDeclare } from "./commands/declare.js";
+import { runHook } from "./commands/hook.js";
+import { runInit } from "./commands/init.js";
+import { runLink } from "./commands/link.js";
+import { runLogin } from "./commands/login.js";
 import { runObserve } from "./commands/observe.js";
 import { formatError } from "./errors.js";
 import { cliVersion, helpFor, isCommand, USAGE } from "./help.js";
@@ -26,12 +30,20 @@ async function dispatch(command, argv) {
         return;
     }
     switch (command) {
+        case "login":
+            return runLogin(argv);
         case "declare":
             return runDeclare(argv);
         case "observe":
             return runObserve(argv);
         case "configure":
             return runConfigure(argv);
+        case "link":
+            return runLink(argv);
+        case "init":
+            return runInit(argv);
+        case "hook":
+            return runHook(argv);
         default:
             process.stderr.write(`${USAGE}\nRun \`gatebolt --help\` for details.\n`);
             process.exitCode = 1;

package/dist/profiles.js

@@ -1,8 +1,9 @@
 import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { isUuid } from "./contracts.js";
 import { isRecord } from "./json.js";
-const POINTER_FILE = ".gatebolt";
+export const REPO_LINK_FILE = ".gatebolt";
 const CONFIG_FILE_MODE = 0o600;
 function configPath() {
     return (nonEmpty(process.env.GATEBOLT_CONFIG) ??
@@ -28,14 +29,15 @@ export function parseConfig(raw) {
 function parseProfile(value) {
     if (!isRecord(value))
         return null;
-    const { url, repo, key } = value;
-    if (typeof repo !== "string" || typeof key !== "string") {
+    const { url, key } = value;
+    if (typeof key !== "string")
         return null;
-    }
-    if (url !== undefined && typeof url !== "string") {
+    if (url !== undefined && typeof url !== "string")
         return null;
-    }
-    return url === undefined ? { repo, key } : { url, repo, key };
+    const profile = { key };
+    if (url !== undefined)
+        profile.url = url;
+    return profile;
 }
 export function selectProfileName(config, inputs) {
     const explicit = nonEmpty(inputs.name) ?? nonEmpty(inputs.env) ?? nonEmpty(inputs.pointer);
@@ -51,21 +53,25 @@ export async function resolveProfile(opts) {
     if (!config)
         return null;
     const explicit = nonEmpty(opts.name) ?? nonEmpty(process.env.GATEBOLT_PROFILE);
-    const pointer = await readPointer(opts.root);
+    const pointer = await readLinkedProfile(opts.root);
+    const preference = configured(config, nonEmpty(opts.preferred)) ?? pointer;
     const name = selectProfileName(config, {
         name: opts.name,
         env: process.env.GATEBOLT_PROFILE,
-        pointer,
+        pointer: preference,
     });
     if (!name)
         return null;
     const profile = config.profiles[name];
     if (profile)
-        return profile;
-    if (!explicit && name === pointer)
+        return { name, ...profile };
+    if (!explicit && name === preference)
         return null;
     throw new Error(`Profile "${name}" is not in ${configPath()}. Run \`gatebolt configure --profile ${name}\`.`);
 }
+function configured(config, name) {
+    return name && config.profiles[name] ? name : undefined;
+}
 export function profileLoader(opts) {
     let cached;
     return () => (cached ??= resolveProfile(opts));
@@ -102,14 +108,43 @@ async function loadConfig() {
     }
     return config;
 }
-async function readPointer(root) {
+async function readLinkedProfile(root) {
     try {
-        return nonEmpty((await readFile(join(root, POINTER_FILE), "utf8")).trim());
+        const link = await readRepoLink(root);
+        return link?.profile;
     }
     catch {
         return undefined;
     }
 }
+export async function readRepoLink(root) {
+    let raw;
+    try {
+        raw = await readFile(join(root, REPO_LINK_FILE), "utf8");
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return null;
+        throw error;
+    }
+    const data = safeJsonParse(raw);
+    if (!isRecord(data) ||
+        typeof data.repositoryId !== "string" ||
+        !isUuid(data.repositoryId)) {
+        throw new Error(`${join(root, REPO_LINK_FILE)} is malformed — it should hold {"repositoryId": "<uuid>"}. ` +
+            "Run `gatebolt link` from the repo root to rewrite it, then commit it.");
+    }
+    const link = { repositoryId: data.repositoryId };
+    if (typeof data.profile === "string") {
+        link.profile = data.profile;
+    }
+    return link;
+}
+export async function writeRepoLink(root, link) {
+    const path = join(root, REPO_LINK_FILE);
+    await writeFile(path, JSON.stringify(link, null, 2) + "\n", "utf8");
+    return path;
+}
 function safeJsonParse(raw) {
     try {
         return JSON.parse(raw);

package/dist/rest.js

@@ -0,0 +1,49 @@
+const AUTH_BASE_PATH = "/api/auth";
+const REQUEST_TIMEOUT_MS = 30_000;
+export async function authFetch(baseUrl, path, request) {
+    let response;
+    try {
+        response = await fetch(buildUrl(baseUrl, path, request.query), {
+            method: request.method,
+            headers: buildHeaders(request),
+            body: request.body === undefined ? undefined : JSON.stringify(request.body),
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        throw connectionError(baseUrl, error);
+    }
+    return { status: response.status, json: await readJson(response) };
+}
+function buildUrl(baseUrl, path, query) {
+    const url = new URL(`${baseUrl}${AUTH_BASE_PATH}${path}`);
+    for (const [name, value] of Object.entries(query ?? {})) {
+        url.searchParams.set(name, value);
+    }
+    return url.toString();
+}
+function buildHeaders(request) {
+    const headers = {};
+    if (request.body !== undefined)
+        headers["content-type"] = "application/json";
+    if (request.token)
+        headers.authorization = `Bearer ${request.token}`;
+    return headers;
+}
+async function readJson(response) {
+    const text = await response.text();
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+function connectionError(baseUrl, error) {
+    if (error instanceof Error && error.name === "TimeoutError") {
+        return new Error(`Timed out waiting for ${baseUrl}.`);
+    }
+    return new Error(`Could not reach ${baseUrl}.`);
+}

package/dist/session.js

@@ -26,11 +26,12 @@ export function writeSession(gitDir, session) {
     return writeJson(gitDir, SESSION_FILE, session);
 }
 export function readSession(gitDir) {
-    return readJson(gitDir, SESSION_FILE, ({ changeId, baseSha, branch }) => typeof changeId === "string" && typeof baseSha === "string"
+    return readJson(gitDir, SESSION_FILE, ({ changeId, baseSha, branch, profile }) => typeof changeId === "string" && typeof baseSha === "string"
         ? {
             changeId,
             baseSha,
             branch: typeof branch === "string" ? branch : undefined,
+            profile: typeof profile === "string" ? profile : undefined,
         }
         : null);
 }

package/dist/transport.js

@@ -3,11 +3,15 @@ const REQUEST_TIMEOUT_MS = 30_000;
 export class RequestError extends Error {
     status;
     code;
-    constructor(message, status, code) {
+    procedure;
+    fieldErrors;
+    constructor(message, status, code, details) {
         super(message);
         this.status = status;
         this.code = code;
         this.name = "RequestError";
+        this.procedure = details.procedure;
+        this.fieldErrors = details.fieldErrors ?? [];
     }
 }
 export async function postChange(connection, procedure, input) {
@@ -24,7 +28,7 @@ export async function postChange(connection, procedure, input) {
         });
     }
     catch (error) {
-        throw connectionError(connection.baseUrl, error);
+        throw connectionError(connection.baseUrl, error, procedure);
     }
     let body;
     try {
@@ -32,32 +36,38 @@ export async function postChange(connection, procedure, input) {
     }
     catch (error) {
         if (!(error instanceof SyntaxError)) {
-            throw connectionError(connection.baseUrl, error);
+            throw connectionError(connection.baseUrl, error, procedure);
         }
         body = null;
     }
     if (!response.ok) {
-        throw toRequestError(response.status, body);
+        throw toRequestError(response.status, body, procedure);
     }
-    return extractResult(body);
+    return extractResult(body, procedure);
 }
-function connectionError(baseUrl, error) {
+function connectionError(baseUrl, error, procedure) {
     if (error instanceof Error && error.name === "TimeoutError") {
-        return new RequestError(`Timed out waiting for ${baseUrl}.`, 0, "TIMEOUT");
+        return new RequestError(`Timed out waiting for ${baseUrl}.`, 0, "TIMEOUT", {
+            procedure,
+        });
     }
-    return new RequestError(`Could not reach ${baseUrl}.`, 0, "NETWORK");
+    return new RequestError(`Could not reach ${baseUrl}.`, 0, "NETWORK", {
+        procedure,
+    });
 }
-function toRequestError(status, body) {
+function toRequestError(status, body, procedure) {
     const parsed = parseTrpcError(body);
-    return new RequestError(parsed?.message ?? `Request failed with status ${status}.`, status, parsed?.code ?? "UNKNOWN");
+    return new RequestError(parsed?.message ?? `Request failed with status ${status}.`, status, parsed?.code ?? "UNKNOWN", { procedure, fieldErrors: parsed?.fieldErrors ?? [] });
 }
-export function extractResult(body) {
+export function extractResult(body, procedure) {
     const result = isRecord(body) ? body.result : undefined;
     const data = isRecord(result) ? result.data : undefined;
     if (isRecord(data) && data.json !== undefined) {
         return data.json;
     }
-    throw new RequestError("Unexpected response from server.", 0, "MALFORMED");
+    throw new RequestError("Unexpected response from server.", 0, "MALFORMED", {
+        procedure,
+    });
 }
 function parseTrpcError(body) {
     const error = isRecord(body) ? body.error : undefined;
@@ -68,5 +78,15 @@ function parseTrpcError(body) {
     return {
         message: typeof json.message === "string" ? json.message : undefined,
         code: isRecord(data) && typeof data.code === "string" ? data.code : undefined,
+        fieldErrors: parseFieldErrors(data),
     };
 }
+function parseFieldErrors(data) {
+    const zodError = isRecord(data) ? data.zodError : undefined;
+    const fieldErrors = isRecord(zodError) ? zodError.fieldErrors : undefined;
+    if (!isRecord(fieldErrors))
+        return [];
+    return Object.values(fieldErrors)
+        .flat()
+        .filter((message) => typeof message === "string");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gatebolt/cli",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Declare-then-observe agent client for GateBolt — records the files an AI agent intends to touch, then reconciles the actual git diff.",
   "keywords": [
     "gatebolt",
@@ -22,8 +22,7 @@
     "gatebolt": "./dist/index.js"
   },
   "files": [
-    "dist",
-    "recipes"
+    "dist"
   ],
   "engines": {
     "node": ">=20"