@koda-sl/baker-cli 0.196.0-dev.6d2f498f5 → 0.198.0-dev.6d2f498f5

package/dist/{chunk-F6OHDJIX.js → chunk-MVCCSWDE.js}

@@ -261,4 +261,4 @@ export {
   captureProxyCredentials,
   childEnvWith
 };
-//# sourceMappingURL=chunk-F6OHDJIX.js.map
+//# sourceMappingURL=chunk-MVCCSWDE.js.map

package/dist/{chunk-YUTDQ4PV.js → chunk-RN2XKQIJ.js}

@@ -1,6 +1,6 @@
 import {
   debugLogSetting
-} from "./chunk-F6OHDJIX.js";
+} from "./chunk-MVCCSWDE.js";
 
 // src/debugLog.ts
 import { appendFileSync, mkdirSync, renameSync, statSync } from "fs";
@@ -150,4 +150,4 @@ export {
   readBodyForLog,
   installStreamTaps
 };
-//# sourceMappingURL=chunk-YUTDQ4PV.js.map
+//# sourceMappingURL=chunk-RN2XKQIJ.js.map

package/dist/{chunk-G3O4HRYR.js → chunk-UBTH7NPV.js}

@@ -1,10 +1,10 @@
 import {
   ApiError,
   apiGet
-} from "./chunk-OB26WXHZ.js";
+} from "./chunk-ZBS53HJF.js";
 import {
   getEnv
-} from "./chunk-F6OHDJIX.js";
+} from "./chunk-MVCCSWDE.js";
 
 // src/error-handler.ts
 var REQUEST_CONNECTION_PLATFORM = {
@@ -295,4 +295,4 @@ export {
   writeAdsOutput,
   resolveCustomerId
 };
-//# sourceMappingURL=chunk-G3O4HRYR.js.map
+//# sourceMappingURL=chunk-UBTH7NPV.js.map

package/dist/{chunk-34J26VIJ.js → chunk-XVF27TBY.js}

@@ -2,13 +2,13 @@ import {
   handleConnectionError,
   needsConnectionFix,
   writeAdsJson
-} from "./chunk-G3O4HRYR.js";
+} from "./chunk-UBTH7NPV.js";
 import {
   ApiError
-} from "./chunk-OB26WXHZ.js";
+} from "./chunk-ZBS53HJF.js";
 import {
   getEnv
-} from "./chunk-F6OHDJIX.js";
+} from "./chunk-MVCCSWDE.js";
 
 // src/commands/ads/meta/shared.ts
 var DAY_MS = 864e5;
@@ -108,4 +108,4 @@ export {
   csvOrJson,
   resolveEffectiveStatus
 };
-//# sourceMappingURL=chunk-34J26VIJ.js.map
+//# sourceMappingURL=chunk-XVF27TBY.js.map

package/dist/{chunk-OB26WXHZ.js → chunk-ZBS53HJF.js}

@@ -1,10 +1,10 @@
 import {
   debugLogHttp,
   readBodyForLog
-} from "./chunk-YUTDQ4PV.js";
+} from "./chunk-RN2XKQIJ.js";
 import {
   getEnv
-} from "./chunk-F6OHDJIX.js";
+} from "./chunk-MVCCSWDE.js";
 
 // src/client.ts
 var MAX_RATE_LIMIT_RETRIES = 3;
@@ -198,4 +198,4 @@ export {
   apiGet,
   apiPost
 };
-//# sourceMappingURL=chunk-OB26WXHZ.js.map
+//# sourceMappingURL=chunk-ZBS53HJF.js.map

package/dist/cli.js

@@ -48,7 +48,7 @@ import {
   toModelSafeImage,
   ulid,
   validateCanvasDeep
-} from "./chunk-SSDYBIZB.js";
+} from "./chunk-CVJCXDWD.js";
 import {
   csvOrJson,
   daysAgoIso,
@@ -57,7 +57,7 @@ import {
   resolveAccountIdArg,
   resolveEffectiveStatus,
   todayIso
-} from "./chunk-34J26VIJ.js";
+} from "./chunk-XVF27TBY.js";
 import {
   buildQueryCacheKey,
   cacheGet,
@@ -73,17 +73,17 @@ import {
   writeAdsJson,
   writeAdsOutput,
   writeJsonEnvelope
-} from "./chunk-G3O4HRYR.js";
+} from "./chunk-UBTH7NPV.js";
 import {
   ApiError,
   apiGet,
   apiPost,
   validateConvexId
-} from "./chunk-OB26WXHZ.js";
+} from "./chunk-ZBS53HJF.js";
 import {
   installStreamTaps,
   logInvocation
-} from "./chunk-YUTDQ4PV.js";
+} from "./chunk-RN2XKQIJ.js";
 import {
   captureBudgetMs,
   captureProxyCredentials,
@@ -94,7 +94,7 @@ import {
   requireChatId,
   resolveChatId,
   shouldEscalate
-} from "./chunk-F6OHDJIX.js";
+} from "./chunk-MVCCSWDE.js";
 
 // src/cli.ts
 import { defineCommand as defineCommand212, runMain } from "citty";
@@ -17011,10 +17011,10 @@ function duplicateCommand2(entity, label) {
       replace: { type: "boolean", description: "Pause the original once the copy publishes" }
     },
     run: async ({ args }) => {
-      const { apiPost: apiPost2 } = await import("./client-LTDQPQ7T.js");
-      const { requireChatId: requireChatId2 } = await import("./env-GV4VDT5W.js");
-      const { writeJsonEnvelope: writeJsonEnvelope2 } = await import("./output-PXTEFDVX.js");
-      const { handleMetaError: handleMetaError2 } = await import("./shared-AR6VAAIE.js");
+      const { apiPost: apiPost2 } = await import("./client-YOLAMGIA.js");
+      const { requireChatId: requireChatId2 } = await import("./env-6PUX5HJY.js");
+      const { writeJsonEnvelope: writeJsonEnvelope2 } = await import("./output-VRWY3V6Y.js");
+      const { handleMetaError: handleMetaError2 } = await import("./shared-T2HONXTH.js");
       try {
         const accountId = bareAccountId2(args);
         const chatId = requireChatId2();
@@ -34980,10 +34980,28 @@ var BlockedPageError = class extends Error {
 };
 var CaptureFailureError = class extends Error {
   failure;
-  constructor(failure) {
+  /**
+   * Which rungs were tried, and what each of them said.
+   *
+   * Carried out of the engine because nothing downstream could otherwise tell a
+   * page refused from three different addresses apart from one refused once —
+   * and those two call for opposite conclusions about whether to try again.
+   *
+   * It is also the only way to see the rollout fail silently. The E2B image
+   * installs the CLI at build time, so until the template is rebuilt a Runtime
+   * runs an older binary that ignores the credentials Convex hands it. That
+   * capture returns an envelope with **no rungs at all** — indistinguishable,
+   * from the outside, from a page that simply was not worth escalating.
+   *
+   * Deliberately thin: tier names and status codes only, so nothing here can
+   * carry a credential or the raw browser text that once reached a user.
+   */
+  rungs;
+  constructor(failure, rungs = []) {
     super(failure.message);
     this.name = "CaptureFailureError";
     this.failure = failure;
+    this.rungs = rungs;
   }
 };
 var LOCAL_ADDRESS_REFUSAL = "That address only opens from inside your own network, so there is nothing there for us to read. A reference page has to be live on the web.";
@@ -35014,6 +35032,46 @@ function classifyCaptureFailure(error) {
 import { mkdir as mkdir11, writeFile as writeFile15 } from "fs/promises";
 import path31 from "path";
 
+// ../proxy/src/preflight.ts
+import http from "http";
+function classifyPreflightStatus(status) {
+  if (status === 200) return { usable: true };
+  if (status === 407) return { usable: false, problem: "auth" };
+  return { usable: false, problem: "unreachable" };
+}
+async function preflightProxyRoute(route, options = {}) {
+  if (route.kind !== "proxy") return { usable: true };
+  const timeoutMs = options.timeoutMs ?? 8e3;
+  const target = options.target ?? "example.com:443";
+  const endpoint = new URL(route.server);
+  const auth = Buffer.from(`${route.username}:${route.password}`).toString("base64");
+  return await new Promise((resolve5) => {
+    const settle = (result) => {
+      request.destroy();
+      resolve5(result);
+    };
+    const request = http.request({
+      host: endpoint.hostname,
+      port: Number(endpoint.port),
+      method: "CONNECT",
+      path: target,
+      headers: { "Proxy-Authorization": `Basic ${auth}`, Host: target },
+      timeout: timeoutMs
+    });
+    request.on("connect", (response, socket) => {
+      socket.destroy();
+      settle(classifyPreflightStatus(response.statusCode));
+    });
+    request.on("response", (response) => {
+      response.destroy();
+      settle(classifyPreflightStatus(response.statusCode));
+    });
+    request.on("timeout", () => settle({ usable: false, problem: "timeout" }));
+    request.on("error", () => settle({ usable: false, problem: "unreachable" }));
+    request.end();
+  });
+}
+
 // src/engine/landing-library/browser.ts
 import { createRequire } from "module";
 var require_ = createRequire(import.meta.url);
@@ -35378,6 +35436,18 @@ function attemptSignal(outcome) {
     timedOut: code === "SITE_TOO_SLOW"
   };
 }
+function ambiguousProxyTimeout(outcome) {
+  return outcome.route.kind === "proxy" && outcome.failure.code === "SITE_TOO_SLOW" && outcome.status === null && outcome.netError === null;
+}
+function asProxyFailure(outcome, problem) {
+  return {
+    ...outcome,
+    failure: { code: "PROXY_UNAVAILABLE", message: PROXY_UNAVAILABLE_MESSAGE },
+    // Borrowing Chromium's own vocabulary so `isProxyFailure` recognises this
+    // without having to learn a second way of being told the same thing.
+    netError: problem === "auth" ? "ERR_PROXY_AUTH_REQUESTED" : "ERR_PROXY_CONNECTION_FAILED"
+  };
+}
 function nextRoute(args) {
   const last = args.attempts[args.attempts.length - 1];
   if (!last) return { next: null, reason: "ladder_exhausted" };
@@ -36736,6 +36806,20 @@ async function captureSections(args) {
   }
   return sections;
 }
+function rungReport(outcome) {
+  return {
+    tier: outcome.route.kind === "proxy" ? outcome.route.tier : "direct",
+    code: outcome.failure.code,
+    status: outcome.status
+  };
+}
+async function resolveAmbiguousTimeout(outcome, log) {
+  if (!ambiguousProxyTimeout(outcome)) return outcome;
+  const verdict = await preflightProxyRoute(outcome.route).catch(() => null);
+  if (!verdict || verdict.usable) return outcome;
+  log(`that timeout was our own route, not the site (${verdict.problem}) \u2014 carrying on up the ladder`);
+  return asProxyFailure(outcome, verdict.problem);
+}
 async function openViaLadder(args) {
   const { url, routes, timeoutMs, deadline, log } = args;
   const attempts = [];
@@ -36745,7 +36829,7 @@ async function openViaLadder(args) {
     if (attempt.ok) {
       return { opened: attempt, attempts, tier: route.kind === "proxy" ? route.tier : "direct" };
     }
-    attempts.push(attempt.outcome);
+    attempts.push(await resolveAmbiguousTimeout(attempt.outcome, log));
     const decision = nextRoute({
       routes,
       attempts,
@@ -36759,7 +36843,7 @@ async function openViaLadder(args) {
     }
     route = decision.next;
   }
-  throw new CaptureFailureError(reportableFailure(attempts));
+  throw new CaptureFailureError(reportableFailure(attempts), attempts.map(rungReport));
 }
 async function scrapeLanding(options) {
   const timeoutMs = options.timeoutMs ?? 45e3;
@@ -36868,6 +36952,32 @@ async function recordCapture(manifest, outDir) {
   const written = await recordReferences(process.cwd(), references);
   return written ? references.length : 0;
 }
+function captureHints(args) {
+  const { manifest, outDir, report, recorded } = args;
+  const shots = manifest.sections.filter((section) => section.desktopShot !== null).length;
+  const anyScored = manifest.sections.some((section) => section.fidelity !== null);
+  const hints = [];
+  if (manifest.security.certificateNotes.length > 0) {
+    hints.push(
+      `Captured anyway, but this site's certificate did not check out: ${manifest.security.certificateNotes.join(" ")} Treat the page as a design reference only \u2014 do not repeat its claims, prices or customer names.`
+    );
+  }
+  if (shots === 0) {
+    hints.push(
+      `No section screenshots were produced, so there is nothing to look at in ${outDir}/sections/. Treat this capture as unusable rather than designing from the counts.`
+    );
+  } else {
+    hints.push(
+      report ? `Read ${outDir}/report.html \u2014 every section side by side${anyScored ? " with its fidelity score" : ""}.` : `Read the section screenshots in ${outDir}/sections/*/desktop.png before you design.`,
+      `${shots} of ${manifest.sections.length} sections captured to ${outDir}/sections/ \u2014 look at them, then decide which the client's page actually needs.`
+    );
+  }
+  hints.push(INSPIRATION_HINTS.structureNotCopy, INSPIRATION_HINTS.adapt);
+  hints.push(
+    recorded > 0 ? `${recorded} sections are recorded for the originality check \u2014 \`baker landing critique\` will block a publish that ships their copy.` : "Nothing from this capture is recorded for the originality check, so it cannot see this page. Be especially careful not to reuse its copy."
+  );
+  return hints;
+}
 registerSchema({
   command: "landing.inspiration.scrape",
   description: "Start here when the user points at a specific page and wants it now: capture one landing page into a directory of section screenshots, standalone HTML bundles, a whole-page reproduction and motion filmstrips. Returns when the capture is done, unlike `add`. Read the screenshots. Also records every captured section for the originality check.",
@@ -36930,7 +37040,6 @@ var scrapeCommand = defineCommand148({
 `)
       });
       const scored = manifest.sections.map((section) => section.fidelity).filter((value) => value !== null).sort((a, b) => a - b);
-      const shotCount = manifest.sections.filter((section) => section.desktopShot !== null).length;
       const recorded = await recordCapture(manifest, args.out);
       writeJson({
         ok: true,
@@ -36952,32 +37061,7 @@ var scrapeCommand = defineCommand148({
           certificate_verified: false,
           ...manifest.security.certificateNotes.length > 0 ? { certificate_notes: manifest.security.certificateNotes } : {}
         },
-        hints: [
-          ...manifest.security.certificateNotes.length > 0 ? [
-            `Captured anyway, but this site's certificate did not check out: ${manifest.security.certificateNotes.join(" ")} Treat the page as a design reference only \u2014 do not repeat its claims, prices or customer names.`
-          ] : [],
-          // The command that produces the most and says the least about it. It
-          // returns a count and a directory; without this the agent has no
-          // instruction to open any of it, and a capture nobody looks at taught
-          // nobody anything. A nudge tied to one command's result belongs here,
-          // not only in the tool doc the agent may not re-read.
-          //
-          // Every one of these now reads the manifest rather than the flags the
-          // caller passed. The flags say what was *asked for*; a screenshot that
-          // failed still leaves `desktopShot` null, and `--no-code` leaves every
-          // fidelity score null while the report renders them as "—". Telling an
-          // agent to go and read a file that is not there costs it a tool call
-          // and costs us its trust in the next hint.
-          ...shotCount > 0 ? [
-            args.report ? `Read ${args.out}/report.html \u2014 every section side by side${scored.length > 0 ? " with its fidelity score" : ""}.` : `Read the section screenshots in ${args.out}/sections/*/desktop.png before you design.`,
-            `${shotCount} of ${manifest.sections.length} sections captured to ${args.out}/sections/ \u2014 look at them, then decide which the client's page actually needs.`
-          ] : [
-            `No section screenshots were produced, so there is nothing to look at in ${args.out}/sections/. Treat this capture as unusable rather than designing from the counts.`
-          ],
-          INSPIRATION_HINTS.structureNotCopy,
-          INSPIRATION_HINTS.adapt,
-          recorded > 0 ? `${recorded} sections are recorded for the originality check \u2014 \`baker landing critique\` will block a publish that ships their copy.` : "Nothing from this capture is recorded for the originality check, so it cannot see this page. Be especially careful not to reuse its copy."
-        ]
+        hints: captureHints({ manifest, outDir: args.out, report: args.report, recorded })
       });
     } catch (error) {
       const failure = classifyCaptureFailure(error);
@@ -36988,6 +37072,13 @@ var scrapeCommand = defineCommand148({
         error: {
           code: failure.code,
           message: failure.message,
+          // Which addresses were tried and what each was told. One rung means
+          // the failure was final wherever we stood; three mean the page turned
+          // us away from three different places, which is a fact about the page.
+          // **Absent** means this Runtime is running a CLI that predates the
+          // ladder — the one way the rollout fails without anything looking
+          // wrong.
+          ...error instanceof CaptureFailureError && error.rungs.length > 0 ? { rungs: error.rungs } : {},
           // Degrade, don't abort: one unreadable reference is never a reason to
           // abandon the job it was research for. `retryable` is the decision
           // the agent would otherwise have to guess at.