@metabase/cli 0.5.7-alpha.bryan-rci-6-coverage.6f886fd → 0.5.8

package/dist/{run-Dc3u_olU.mjs → run-C_IZfmQ7.mjs}

@@ -1,11 +1,12 @@
-import { c as InternalError, h as ValidationError, o as ConfigError, r as isPlainObject, s as FailedResultError } from "./predicates-0C0TsWcJ.mjs";
-import { at as connectionFlags, d as serializeJson, dt as profileFlag, p as writeJsonLine, q as HttpError, t as interruptSignal } from "./cli.mjs";
-import { t as defineMetabaseCommand } from "./runtime-DsfR_yrb.mjs";
-import { i as TransformTestRefusalCode } from "./transform-test-DHTxBt4k.mjs";
-import { i as runProcessBinary, r as runProcess, t as ProcessNotFoundError } from "./process-cDa9fEBe.mjs";
-import { t as parseYaml } from "./yaml-QoEP-7KU.mjs";
+import { c as InternalError, f as ResponseShapeError, h as ValidationError, i as AbortError, o as ConfigError, p as TimeoutError, r as isPlainObject, s as FailedResultError, u as NetworkError } from "./predicates-0C0TsWcJ.mjs";
+import { I as CapabilityError, Y as isHttpNotFound, f as serializeJson, ft as profileFlag, o as jsonLineWriter, ot as connectionFlags, q as HttpError, t as interruptSignal } from "./cli.mjs";
+import { t as defineMetabaseCommand } from "./runtime-Dd2uBKqN.mjs";
+import { o as isTransformTestCode } from "./transform-test-D6QIyu8C.mjs";
+import { a as runProcess, n as ProcessNotFoundError, o as runProcessBinary, r as ProcessTimeoutError, t as ProcessInterruptedError } from "./process-ByKCTa6A.mjs";
+import { t as parseMetabaseYaml } from "./yaml-BthVUNj3.mjs";
 import { z } from "zod";
-import { writeFile } from "node:fs/promises";
+import { rename, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
 import { randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { performance } from "node:perf_hooks";
@@ -82,6 +83,7 @@ function coverageStage(assessment) {
 					name: transform.name
 				})) }
 			});
+			return null;
 		}
 	};
 }
@@ -103,6 +105,10 @@ const CiWarning = z.object({
 	code: z.string(),
 	message: z.string()
 });
+const StageStop = z.object({
+	code: z.string(),
+	message: z.string()
+});
 const CheckedTransform = z.object({
 	entity_id: z.string(),
 	name: z.string()
@@ -150,7 +156,8 @@ const CheckResult = EventEnvelope.extend({
 const StageEnd = EventEnvelope.extend({
 	type: z.literal("stage.end"),
 	stage: StageName,
-	status: StageStatus
+	status: StageStatus,
+	stopped: StageStop.nullable()
 });
 const JobEnd = EventEnvelope.extend({
 	type: z.literal("job.end"),
@@ -179,11 +186,12 @@ function createEmitter(options) {
 		if (!parsed.success) throw new InternalError(`ci event "${body.type}" does not match its schema: ${parsed.error.message}`);
 		seq += 1;
 		options.write(parsed.data);
+		return parsed.data;
 	};
 }
-function stageStatus(verdicts) {
+function stageStatus(verdicts, stopped) {
 	if (verdicts.includes("failed")) return "failed";
-	if (verdicts.includes("refused") || verdicts.includes("error")) return "errored";
+	if (stopped !== null || verdicts.includes("refused") || verdicts.includes("error")) return "errored";
 	return "passed";
 }
 async function runStages(stages, emit) {
@@ -195,7 +203,8 @@ async function runStages(stages, emit) {
 			emit({
 				type: "stage.end",
 				stage: stage.name,
-				status: "skipped"
+				status: "skipped",
+				stopped: null
 			});
 			continue;
 		}
@@ -204,7 +213,7 @@ async function runStages(stages, emit) {
 			stage: stage.name
 		});
 		const verdicts = [];
-		await stage.run((check) => {
+		const stopped = await stage.run((check) => {
 			verdicts.push(check.verdict);
 			checks += 1;
 			warnings += check.warnings.length;
@@ -214,11 +223,12 @@ async function runStages(stages, emit) {
 				...check
 			});
 		});
-		state = stageStatus(verdicts);
+		state = stageStatus(verdicts, stopped);
 		emit({
 			type: "stage.end",
 			stage: stage.name,
-			status: state
+			status: state,
+			stopped
 		});
 	}
 	return {
@@ -235,6 +245,7 @@ const SINGLE_PATH_STATUSES = /* @__PURE__ */ new Map([
 	["D", "deleted"],
 	["T", "modified"]
 ]);
+const STATUS_CODE = /^(?:[AMDT](?:\d{3})?|[RC]\d{3})$/;
 const RENAME_STATUS = "R";
 const COPY_STATUS = "C";
 function nameStatusError(message) {
@@ -252,6 +263,7 @@ function parseNameStatus(output) {
 	let index = 0;
 	while (index < tokens.length) {
 		const code = requireToken(tokens[index], "a status");
+		if (!STATUS_CODE.test(code)) throw nameStatusError(`unexpected status "${code}"`);
 		const missingPath = `a path for status "${code}"`;
 		const first = tokens[index + 1];
 		const second = tokens[index + 2];
@@ -275,6 +287,7 @@ function parseNameStatus(output) {
 			continue;
 		}
 		if (letter === COPY_STATUS) {
+			requireToken(first, missingPath);
 			entries.push({
 				status: "added",
 				path: requireToken(second, missingPath)
@@ -315,46 +328,34 @@ const TransformDocument = z.object({
 }).loose();
 const TransformTestDocument = z.object({ transform_id: z.string().min(1) }).loose();
 const SerdesMeta = z.array(z.object({ model: z.string() }).loose()).min(1);
-function serdesModel(path, document) {
-	if (!isPlainObject(document) || !(SERDES_META_KEY in document)) return null;
-	const meta = SerdesMeta.safeParse(document[SERDES_META_KEY]);
-	if (!meta.success) throw new ValidationError(`${path}: ${SERDES_META_KEY} must be a non-empty list of entries with a model`, {
+function parseOrRefuse(path, schema, value, rule) {
+	const parsed = schema.safeParse(value);
+	if (!parsed.success) throw new ValidationError(`${path}: ${rule}`, {
 		source: path,
-		zodIssues: meta.error.issues
+		zodIssues: parsed.error.issues
 	});
-	const last = meta.data.at(-1);
-	if (last === void 0) throw new InternalError(`${path}: ${SERDES_META_KEY} passed a non-empty check but has no entries`);
-	return last.model;
+	return parsed.data;
 }
 function classifyContentFile(path, document) {
-	const model = serdesModel(path, document);
-	if (model === "Transform") {
-		const transform = TransformDocument.safeParse(document);
-		if (!transform.success) throw new ValidationError(`${path}: a Transform must have an entity_id, a name, a source and a target`, {
-			source: path,
-			zodIssues: transform.error.issues
-		});
+	if (!isPlainObject(document) || !(SERDES_META_KEY in document)) return { kind: "other" };
+	const last = parseOrRefuse(path, SerdesMeta, document[SERDES_META_KEY], `${SERDES_META_KEY} must be a non-empty list of entries with a model`).at(-1);
+	if (last === void 0) throw new InternalError(`${path}: ${SERDES_META_KEY} passed a non-empty check but has no entries`);
+	if (last.model === "Transform") {
+		const transform = parseOrRefuse(path, TransformDocument, document, "a Transform must have an entity_id, a name, a source and a target");
 		return {
 			kind: "transform",
-			entityId: transform.data.entity_id,
-			name: transform.data.name,
+			entityId: transform.entity_id,
+			name: transform.name,
 			logic: {
-				source: transform.data.source,
-				target: transform.data.target
+				source: transform.source,
+				target: transform.target
 			}
 		};
 	}
-	if (model === "TransformTest") {
-		const test = TransformTestDocument.safeParse(document);
-		if (!test.success) throw new ValidationError(`${path}: a TransformTest must name its transform_id`, {
-			source: path,
-			zodIssues: test.error.issues
-		});
-		return {
-			kind: "transform-test",
-			transformId: test.data.transform_id
-		};
-	}
+	if (last.model === "TransformTest") return {
+		kind: "transform-test",
+		transformId: parseOrRefuse(path, TransformTestDocument, document, "a TransformTest must name its transform_id").transform_id
+	};
 	return { kind: "other" };
 }
 function transformEntityId(file) {
@@ -364,7 +365,11 @@ function affectedTransforms(changes) {
 	const touched = /* @__PURE__ */ new Set();
 	const atHead = /* @__PURE__ */ new Set();
 	const atBase = /* @__PURE__ */ new Set();
-	for (const { base, head } of changes) {
+	for (const { path, base, head } of changes) {
+		if (base !== null && base.kind !== "other" && head?.kind === "other") throw new ValidationError(`${path}: a Transform or TransformTest at base no longer reads as one at head`, {
+			source: path,
+			zodIssues: []
+		});
 		const headId = transformEntityId(head);
 		const baseId = transformEntityId(base);
 		if (headId !== null) {
@@ -376,16 +381,56 @@ function affectedTransforms(changes) {
 	}
 	return [...touched].filter((entityId) => atHead.has(entityId) || !atBase.has(entityId));
 }
-const CONTENT_FILE_EXTENSIONS = [".yaml", ".yml"];
+const TRANSFORM_MODEL_PATTERN = `model["']?:[[:space:]]*["']?Transform`;
+function headTransforms(files) {
+	const atHead = {
+		names: /* @__PURE__ */ new Map(),
+		tested: /* @__PURE__ */ new Set()
+	};
+	for (const file of files) if (file?.kind === "transform") atHead.names.set(file.entityId, file.name);
+	else if (file?.kind === "transform-test") atHead.tested.add(file.transformId);
+	return atHead;
+}
+const CONTENT_TOP_LEVEL_FOLDERS = [
+	"actions",
+	"channels",
+	"collections",
+	"custom_viz_plugins",
+	"data_apps",
+	"databases",
+	"embedding_themes",
+	"glossary",
+	"metabots",
+	"python_libraries",
+	"python-libraries",
+	"osi_ai_context",
+	"snippets",
+	"transforms"
+];
+const SHARED_TOP_LEVEL_FILE_NAMES = /* @__PURE__ */ new Map([["data_apps", "data_app.yaml"]]);
+const CONTENT_FOLDERS = new Set(CONTENT_TOP_LEVEL_FOLDERS);
 function isContentPath(path) {
-	return CONTENT_FILE_EXTENSIONS.some((extension) => path.endsWith(extension));
+	const slash = path.indexOf("/");
+	if (slash === -1) return false;
+	const top = path.slice(0, slash);
+	const fileName = path.slice(path.lastIndexOf("/") + 1);
+	if (!fileName.endsWith(".yaml") || fileName.startsWith(".") || !CONTENT_FOLDERS.has(top)) return false;
+	const entityFileName = SHARED_TOP_LEVEL_FILE_NAMES.get(top);
+	return entityFileName === void 0 || entityFileName === fileName;
+}
+function noContentChangesWarning(entries) {
+	if (entries.some((entry) => isContentPath(entry.path) || entry.status === "renamed" && isContentPath(entry.oldPath))) return null;
+	return {
+		code: "no-content-changes",
+		message: "the change touches no Metabase content files, so CI checked nothing"
+	};
 }
 function uncommittedContentWarning(paths) {
 	const content = paths.filter(isContentPath);
 	if (content.length === 0) return null;
 	return {
 		code: "uncommitted-content",
-		message: `${content.length === 1 ? "1 content file is" : `${content.length} content files are`} not committed, so CI did not check: ${content.join(", ")}`
+		message: `${content.length === 1 ? "1 content file has uncommitted changes" : `${content.length} content files have uncommitted changes`}, which CI does not see; it checks the committed version: ${content.join(", ")}`
 	};
 }
 //#endregion
@@ -394,65 +439,71 @@ const GIT = "git";
 const NO_MATCH_EXIT_CODE = 1;
 const NO_MERGE_BASE_EXIT_CODE = 1;
 const UNKNOWN_REF_EXIT_CODE = 1;
-async function withGit(spawn) {
+const GIT_TIMEOUT_MS = 12e4;
+async function withGit(repo, args, spawn) {
 	try {
 		return await spawn();
 	} catch (error) {
 		if (error instanceof ProcessNotFoundError) throw new ConfigError("git is not installed or not on PATH");
+		if (error instanceof ProcessInterruptedError) throw new AbortError(`interrupted while git ${args.join(" ")} ran in ${repo}`);
+		if (error instanceof ProcessTimeoutError) throw new ConfigError(`git ${args.join(" ")} did not finish within ${GIT_TIMEOUT_MS / 1e3} s in ${repo}`);
 		throw error;
 	}
 }
-function runGit(repo, args) {
-	return withGit(() => runProcess(GIT, [
+function runGit(repo, args, signal) {
+	return withGit(repo, args, () => runProcess(GIT, [
 		"-C",
 		repo,
 		...args
-	]));
+	], {
+		signal,
+		timeoutMs: GIT_TIMEOUT_MS
+	}));
 }
-async function git(repo, args) {
-	const result = await runGit(repo, args);
+async function git(repo, args, signal) {
+	const result = await runGit(repo, args, signal);
 	if (result.exitCode !== 0) throw new ConfigError(`git ${args.join(" ")} failed in ${repo}: ${result.stderr.trim()}`);
 	return result.stdout;
 }
-async function repositoryRoot(repo) {
-	const result = await runGit(repo, ["rev-parse", "--show-toplevel"]);
+async function repositoryRoot(repo, signal) {
+	const result = await runGit(repo, ["rev-parse", "--show-toplevel"], signal);
 	if (result.exitCode !== 0) throw new ConfigError(`--repo ${repo} is not inside a git work tree: ${result.stderr.trim()}`);
 	return result.stdout.trim();
 }
-async function resolveCommit(repo, ref, flag) {
+async function resolveCommit(repo, ref, flag, signal) {
 	const result = await runGit(repo, [
 		"rev-parse",
 		"--verify",
 		"--quiet",
 		"--end-of-options",
 		`${ref}^{commit}`
-	]);
+	], signal);
 	if (result.exitCode === UNKNOWN_REF_EXIT_CODE) throw new ConfigError(`${flag} ${ref} is not a commit in ${repo}`);
 	if (result.exitCode !== 0) throw new ConfigError(`git rev-parse failed in ${repo}: ${result.stderr.trim()}`);
 	return result.stdout.trim();
 }
-async function checkedOutCommit(repo) {
+async function checkedOutCommit(repo, signal) {
 	const result = await runGit(repo, [
 		"rev-parse",
 		"--verify",
 		"--quiet",
 		"HEAD"
-	]);
+	], signal);
 	if (result.exitCode === UNKNOWN_REF_EXIT_CODE) return null;
 	if (result.exitCode !== 0) throw new ConfigError(`git rev-parse HEAD failed in ${repo}: ${result.stderr.trim()}`);
 	return result.stdout.trim();
 }
-async function mergeBase(repo, base, head) {
+async function mergeBase(repo, base, head, signal) {
 	const result = await runGit(repo, [
 		"merge-base",
 		base,
 		head
-	]);
+	], signal);
 	if (result.exitCode === NO_MERGE_BASE_EXIT_CODE) throw new ConfigError(`--base and --head share no history in ${repo}: the clone may be shallow (fetch the full history, e.g. actions/checkout with fetch-depth: 0), or the histories are unrelated`);
 	if (result.exitCode !== 0) throw new ConfigError(`git merge-base failed in ${repo}: ${result.stderr.trim()}`);
 	return result.stdout.trim();
 }
-function diffNameStatus(repo, from, to) {
+function diffNameStatus(repo, from, to, signal) {
 	return git(repo, [
 		"diff",
 		"--name-status",
@@ -460,24 +511,35 @@ function diffNameStatus(repo, from, to) {
 		"-M",
 		from,
 		to
-	]);
+	], signal);
 }
-function statusPorcelain(repo) {
+function statusPorcelain(repo, signal) {
 	return git(repo, [
 		"status",
 		"--porcelain",
 		"-z",
 		"--untracked-files=all"
-	]);
+	], signal);
 }
-function readFileAt(repo, commit, path) {
-	return git(repo, [
-		"cat-file",
-		"blob",
-		`${commit}:${path}`
-	]);
+async function fileModesAt(repo, commit, signal) {
+	const output = await git(repo, [
+		"ls-tree",
+		"-r",
+		"-z",
+		"--full-tree",
+		commit
+	], signal);
+	const modes = /* @__PURE__ */ new Map();
+	for (const record of output.split("\0")) {
+		if (record === "") continue;
+		const space = record.indexOf(" ");
+		const tab = record.indexOf("	");
+		if (space === -1 || tab < space) throw new InternalError(`git ls-tree -z: malformed entry "${record}"`);
+		modes.set(record.slice(tab + 1), record.slice(0, space));
+	}
+	return modes;
 }
-async function filesMatching(repo, commit, pattern, pathspecs) {
+async function filesMatching(repo, commit, pattern, pathspecs, signal) {
 	const result = await runGit(repo, [
 		"grep",
 		"--no-color",
@@ -489,7 +551,7 @@ async function filesMatching(repo, commit, pattern, pathspecs) {
 		commit,
 		"--",
 		...pathspecs
-	]);
+	], signal);
 	if (result.exitCode === NO_MATCH_EXIT_CODE) return [];
 	if (result.exitCode !== 0) throw new ConfigError(`git grep failed in ${repo}: ${result.stderr.trim()}`);
 	const prefix = `${commit}:`;
@@ -500,17 +562,21 @@ async function filesMatching(repo, commit, pattern, pathspecs) {
 }
 const NEWLINE = 10;
 const utf8 = new TextDecoder("utf-8");
-async function readFilesAt(repo, commit, paths) {
+async function readFilesAt(repo, commit, paths, signal) {
 	const files = /* @__PURE__ */ new Map();
 	if (paths.length === 0) return files;
 	const multiline = paths.find((path) => path.includes("\n"));
 	if (multiline !== void 0) throw new ConfigError(`cannot read ${JSON.stringify(multiline)}: a path with a newline cannot be batched`);
-	const result = await withGit(() => runProcessBinary(GIT, [
+	const args = ["cat-file", "--batch"];
+	const result = await withGit(repo, args, () => runProcessBinary(GIT, [
 		"-C",
 		repo,
-		"cat-file",
-		"--batch"
-	], { stdin: paths.map((path) => `${commit}:${path}\n`).join("") }));
+		...args
+	], {
+		stdin: paths.map((path) => `${commit}:${path}\n`).join(""),
+		signal,
+		timeoutMs: GIT_TIMEOUT_MS
+	}));
 	if (result.exitCode !== 0) throw new ConfigError(`git cat-file --batch failed in ${repo}: ${result.stderr.trim()}`);
 	const output = result.stdout;
 	let offset = 0;
@@ -530,10 +596,23 @@ async function readFilesAt(repo, commit, paths) {
 }
 //#endregion
 //#region src/commands/ci/job-plan.ts
-const CONTENT_PATHSPECS = CONTENT_FILE_EXTENSIONS.map((extension) => `*${extension}`);
-async function classifyAt(repo, commit, path) {
-	if (path === null || !isContentPath(path)) return null;
-	return classifyContentFile(path, parseYaml(await readFileAt(repo, commit, path), z.unknown(), { source: `${commit}:${path}` }));
+const CONTENT_PATHSPECS = CONTENT_TOP_LEVEL_FOLDERS.map((folder) => `${folder}/*.yaml`);
+const FILE_MODES = /* @__PURE__ */ new Set(["100644", "100755"]);
+async function classifyAt(repo, commit, paths, signal) {
+	const content = paths.filter(isContentPath);
+	if (content.length === 0) return /* @__PURE__ */ new Map();
+	const modes = await fileModesAt(repo, commit, signal);
+	for (const path of content) {
+		const mode = modes.get(path);
+		if (mode === void 0) throw new InternalError(`git listed ${path} at ${commit}, but its tree does not hold it`);
+		if (!FILE_MODES.has(mode)) throw new ValidationError(`${commit}:${path} is not a regular file (git mode ${mode}): Metabase would import what it points to, which this check cannot read; commit the file itself`, {
+			source: `${commit}:${path}`,
+			zodIssues: []
+		});
+	}
+	const classified = /* @__PURE__ */ new Map();
+	for (const [path, text] of await readFilesAt(repo, commit, content, signal)) classified.set(path, classifyContentFile(path, parseMetabaseYaml(text, `${commit}:${path}`)));
+	return classified;
 }
 function basePath(entry) {
 	if (entry.status === "added") return null;
@@ -542,41 +621,42 @@ function basePath(entry) {
 function headPath(entry) {
 	return entry.status === "deleted" ? null : entry.path;
 }
-async function classifyChange(repo, forkPoint, head, entry) {
-	const [baseSide, headSide] = await Promise.all([classifyAt(repo, forkPoint, basePath(entry)), classifyAt(repo, head, headPath(entry))]);
-	return {
-		base: baseSide,
-		head: headSide
-	};
+function present(paths) {
+	return paths.filter((path) => path !== null);
 }
-const TRANSFORM_MODEL_PATTERN = `model["']?:[[:space:]]*["']?Transform`;
-function record(atHead, file) {
-	if (file?.kind === "transform") atHead.names.set(file.entityId, file.name);
-	else if (file?.kind === "transform-test") atHead.tested.add(file.transformId);
+function sideOf(files, path) {
+	if (path === null || !isContentPath(path)) return null;
+	const file = files.get(path);
+	if (file === void 0) throw new InternalError(`${path} was not read, though the diff names it`);
+	return file;
 }
-async function scanHead(repo, head, changes, changedPaths) {
-	const atHead = {
-		names: /* @__PURE__ */ new Map(),
-		tested: /* @__PURE__ */ new Set()
-	};
-	for (const change of changes) record(atHead, change.head);
-	const unchanged = (await filesMatching(repo, head, TRANSFORM_MODEL_PATTERN, CONTENT_PATHSPECS)).filter((path) => !changedPaths.has(path));
-	for (const [path, text] of await readFilesAt(repo, head, unchanged)) record(atHead, classifyContentFile(path, parseYaml(text, z.unknown(), { source: `${head}:${path}` })));
-	return atHead;
+async function classifyChanges(repo, forkPoint, head, entries, signal) {
+	const [baseFiles, headFiles] = await Promise.all([classifyAt(repo, forkPoint, present(entries.map(basePath)), signal), classifyAt(repo, head, present(entries.map(headPath)), signal)]);
+	return entries.map((entry) => ({
+		path: entry.path,
+		base: sideOf(baseFiles, basePath(entry)),
+		head: sideOf(headFiles, headPath(entry))
+	}));
 }
-async function planJob(repoPath, baseRef, headRef) {
-	const repo = await repositoryRoot(repoPath);
+async function scanHead(repo, head, changes, changedPaths, signal) {
+	const unchangedFiles = (await classifyAt(repo, head, (await filesMatching(repo, head, TRANSFORM_MODEL_PATTERN, CONTENT_PATHSPECS, signal)).filter((path) => !changedPaths.has(path)), signal)).values();
+	return headTransforms([...changes.map((change) => change.head), ...unchangedFiles]);
+}
+async function planJob(repoPath, baseRef, headRef, signal) {
+	const repo = await repositoryRoot(repoPath, signal);
 	const [base, head, checkout] = await Promise.all([
-		resolveCommit(repo, baseRef, "--base"),
-		resolveCommit(repo, headRef, "--head"),
-		checkedOutCommit(repo)
+		resolveCommit(repo, baseRef, "--base", signal),
+		resolveCommit(repo, headRef, "--head", signal),
+		checkedOutCommit(repo, signal)
 	]);
-	const forkPoint = await mergeBase(repo, base, head);
-	const entries = parseNameStatus(await diffNameStatus(repo, forkPoint, head));
-	const changes = await Promise.all(entries.map((entry) => classifyChange(repo, forkPoint, head, entry)));
-	const atHead = await scanHead(repo, head, changes, new Set(entries.map((entry) => entry.path)));
+	const forkPoint = await mergeBase(repo, base, head, signal);
+	const entries = parseNameStatus(await diffNameStatus(repo, forkPoint, head, signal));
+	const changes = await classifyChanges(repo, forkPoint, head, entries, signal);
+	const atHead = await scanHead(repo, head, changes, new Set(entries.map((entry) => entry.path)), signal);
 	const checked = [];
 	const warnings = [];
+	const noContent = noContentChangesWarning(entries);
+	if (noContent !== null) warnings.push(noContent);
 	for (const entityId of affectedTransforms(changes)) {
 		const name = atHead.names.get(entityId);
 		if (name === void 0) {
@@ -597,7 +677,7 @@ async function planJob(repoPath, baseRef, headRef) {
 		testedAtHead: atHead.tested
 	});
 	if (head === checkout) {
-		const uncommitted = uncommittedContentWarning(parseStatusPorcelain(await statusPorcelain(repo)));
+		const uncommitted = uncommittedContentWarning(parseStatusPorcelain(await statusPorcelain(repo, signal)));
 		if (uncommitted !== null) warnings.push(uncommitted);
 	}
 	return {
@@ -612,17 +692,31 @@ async function planJob(repoPath, baseRef, headRef) {
 }
 //#endregion
 //#region src/commands/ci/job.ts
+async function writeResults(path, events) {
+	const temporary = join(dirname(path), `.${basename(path)}.${randomUUID()}.tmp`);
+	await writeFile(temporary, serializeJson(events, false) + "\n", {
+		encoding: "utf8",
+		flag: "wx"
+	});
+	try {
+		await rename(temporary, path);
+	} catch (error) {
+		await rm(temporary, { force: true });
+		throw error;
+	}
+}
 async function runJob(options) {
+	if (options.resultsPath !== null) await rm(options.resultsPath, { force: true });
 	const events = [];
 	const emit = createEmitter({
 		job: options.job,
 		now: options.now,
 		write: (event) => {
 			events.push(event);
-			options.write(event);
+			if (event.type !== "job.end") options.write(event);
 		}
 	});
-	const plan = await planJob(options.repo, options.base, options.head);
+	const plan = await planJob(options.repo, options.base, options.head, options.signal);
 	emit({
 		type: "job.start",
 		v: 1,
@@ -631,7 +725,7 @@ async function runJob(options) {
 		warnings: plan.warnings
 	});
 	const outcome = await runStages(await options.stages(plan), emit);
-	emit({
+	const end = emit({
 		type: "job.end",
 		state: outcome.state,
 		counts: {
@@ -639,7 +733,8 @@ async function runJob(options) {
 			warnings: outcome.warnings + plan.warnings.length
 		}
 	});
-	if (options.resultsPath !== null) await writeFile(options.resultsPath, serializeJson(events, false) + "\n", "utf8");
+	if (options.resultsPath !== null) await writeResults(options.resultsPath, events);
+	options.write(end);
 	return outcome.state;
 }
 //#endregion
@@ -648,21 +743,122 @@ function testVerdict(result) {
 	const statuses = new Set(result.expectations.map((expectation) => expectation.status));
 	if (statuses.has("failed")) return "failed";
 	if (statuses.has("error")) return "error";
-	return "passed";
+	return result.status;
 }
 function testRefusal(error) {
-	if (!(error instanceof HttpError)) return null;
-	const code = TransformTestRefusalCode.safeParse(error.errorCode);
-	if (!code.success) return null;
+	if (!(error instanceof HttpError) || error.errorCode === null || !isTransformTestCode(error.errorCode)) return null;
 	return {
-		error_code: code.data,
-		message: error.serverMessage ?? error.message
+		error_code: error.errorCode,
+		message: error.serverMessage ?? error.message,
+		tables: error.tables
 	};
 }
 const CHANGE_FAILURE_CODES = /* @__PURE__ */ new Set(["transform-test.transform-failed", "transform-test.unparseable-source"]);
 function refusalVerdict(refusal) {
 	return CHANGE_FAILURE_CODES.has(refusal.error_code) ? "failed" : "refused";
 }
+const TRANSFORM_NOT_ON_INSTANCE = {
+	error_code: "ci.transform-not-on-instance",
+	message: "the transform is in the branch but not on the Metabase instance; load the branch into it first"
+};
+const INVALID_ENTITY_ID = {
+	error_code: "ci.invalid-entity-id",
+	message: "the transform's entity_id in the branch is not a valid entity id"
+};
+const TRANSFORM_UNREADABLE = {
+	error_code: "ci.transform-unreadable",
+	message: "the CI identity cannot read this transform, so Metabase hides its tests: reading it needs query permission on every table it reads"
+};
+const TEST_RUN_FORBIDDEN = {
+	error_code: "ci.test-run-forbidden",
+	message: "Metabase did not let the CI identity run this test: running a test needs write access to it, and a read-only remote-synced instance refuses everyone"
+};
+function requestFailure(error) {
+	if (error instanceof HttpError) return {
+		error_code: "ci.http-error",
+		status: error.status,
+		message: error.message
+	};
+	if (error instanceof TimeoutError) return {
+		error_code: "ci.timeout",
+		status: null,
+		message: error.message
+	};
+	if (error instanceof NetworkError) return {
+		error_code: "ci.network-error",
+		status: null,
+		message: error.message
+	};
+	if (error instanceof ResponseShapeError) return {
+		error_code: "ci.unreadable-answer",
+		status: null,
+		message: error.message
+	};
+	return null;
+}
+function sessionStop(error) {
+	if (error instanceof CapabilityError) return {
+		code: "ci.unsupported-server",
+		message: error.message
+	};
+	if (error instanceof HttpError && error.kind === "auth") return {
+		code: "ci.unauthorized",
+		message: error.message
+	};
+	return null;
+}
+function lookupStop(error) {
+	const stop = sessionStop(error);
+	if (stop !== null) return stop;
+	const failure = requestFailure(error);
+	return failure === null ? null : {
+		code: failure.error_code,
+		message: failure.message
+	};
+}
+const REFUSAL_FOR_FORBIDDEN = {
+	read: TRANSFORM_UNREADABLE,
+	list: null,
+	run: TEST_RUN_FORBIDDEN
+};
+function transformFailure(error, request) {
+	const stop = sessionStop(error);
+	if (stop !== null) return {
+		kind: "stop",
+		stop
+	};
+	const refusal = request === "run" ? testRefusal(error) : null;
+	if (refusal !== null) return {
+		kind: "check",
+		verdict: refusalVerdict(refusal),
+		detail: refusal
+	};
+	const forbiddenRefusal = error instanceof HttpError && error.kind === "forbidden" ? REFUSAL_FOR_FORBIDDEN[request] : null;
+	if (forbiddenRefusal !== null) return {
+		kind: "check",
+		verdict: "refused",
+		detail: forbiddenRefusal
+	};
+	if (request === "read" && isHttpNotFound(error)) return {
+		kind: "check",
+		verdict: "refused",
+		detail: TRANSFORM_NOT_ON_INSTANCE
+	};
+	const failure = requestFailure(error);
+	if (failure === null) return null;
+	if (error instanceof NetworkError && request !== "run") return {
+		kind: "stop",
+		stop: {
+			code: failure.error_code,
+			message: failure.message
+		}
+	};
+	return {
+		kind: "check",
+		verdict: "error",
+		detail: failure
+	};
+}
 //#endregion
 //#region src/commands/ci/unit-stage.ts
 const TEST_TIMEOUT_MS = 12e4;
@@ -680,12 +876,17 @@ function transformLookup(entityId, entry) {
 function clientPort(client) {
 	return {
 		lookUpTransforms: async (entityIds) => {
-			const result = await client.eidTranslation.translate({ entity_ids: { transform: [...entityIds] } });
+			const result = await client.eidTranslation.translate({ entity_ids: { transform: [...entityIds] } }, { signal: interruptSignal });
 			const lookups = /* @__PURE__ */ new Map();
 			for (const entityId of entityIds) lookups.set(entityId, transformLookup(entityId, result.entity_ids[entityId]));
 			return lookups;
 		},
-		listTests: async (transformId) => (await client.transformTest.list({ "transform-id": transformId })).data,
+		readTransform: async (transformId) => {
+			await client.transform.get(transformId, { signal: interruptSignal });
+		},
+		listTests: async (transformId) => {
+			return (await client.transformTest.list({ "transform-id": transformId }, { signal: interruptSignal })).data;
+		},
 		runTest: (testId) => client.transformTest.run(testId, {
 			timeoutMs: TEST_TIMEOUT_MS,
 			signal: interruptSignal
@@ -694,21 +895,80 @@ function clientPort(client) {
 	};
 }
 const MISSING_TRANSFORM_DETAIL = {
-	"not-found": {
-		error_code: "ci.transform-not-on-instance",
-		message: "the transform is in the branch but not on the Metabase instance; load the branch into it first"
-	},
-	"invalid-entity-id": {
-		error_code: "ci.invalid-entity-id",
-		message: "the transform's entity_id in the branch is not a valid entity id"
-	}
+	"not-found": TRANSFORM_NOT_ON_INSTANCE,
+	"invalid-entity-id": INVALID_ENTITY_ID
 };
+async function attempt(request, call) {
+	try {
+		return {
+			kind: "settled",
+			value: await call()
+		};
+	} catch (error) {
+		const failure = transformFailure(error, request);
+		if (failure === null) throw error;
+		return failure;
+	}
+}
+function reportFailure(failure, check, ms, report) {
+	if (failure.kind === "stop") return failure.stop;
+	report({
+		check,
+		verdict: failure.verdict,
+		warnings: [],
+		ms,
+		detail: failure.detail
+	});
+	return null;
+}
+async function checkTransform(transform, transformId, port, report) {
+	const transformCheck = {
+		kind: "transform-test",
+		id: transform.entity_id,
+		label: transform.name
+	};
+	const started = port.nowMs();
+	const read = await attempt("read", () => port.readTransform(transformId));
+	if (read.kind !== "settled") return reportFailure(read, transformCheck, port.nowMs() - started, report);
+	const tests = await attempt("list", () => port.listTests(transformId));
+	if (tests.kind !== "settled") return reportFailure(tests, transformCheck, port.nowMs() - started, report);
+	for (const test of tests.value.toSorted((a, b) => a.id - b.id)) {
+		const check = {
+			kind: "transform-test",
+			id: String(test.id),
+			label: `${transform.name}: ${test.name}`
+		};
+		const runStarted = port.nowMs();
+		const run = await attempt("run", () => port.runTest(test.id));
+		const ms = port.nowMs() - runStarted;
+		if (run.kind === "settled") {
+			report({
+				check,
+				verdict: testVerdict(run.value),
+				warnings: [],
+				ms,
+				detail: run.value
+			});
+			continue;
+		}
+		const stop = reportFailure(run, check, ms, report);
+		if (stop !== null) return stop;
+	}
+	return null;
+}
 function unitStage(checked, connect) {
 	return {
 		name: "unit",
 		run: async (report) => {
 			const port = await connect();
-			const lookups = await port.lookUpTransforms(checked.map((transform) => transform.entity_id));
+			let lookups;
+			try {
+				lookups = await port.lookUpTransforms(checked.map((transform) => transform.entity_id));
+			} catch (error) {
+				const stop = lookupStop(error);
+				if (stop === null) throw error;
+				return stop;
+			}
 			for (const transform of checked) {
 				const lookup = lookups.get(transform.entity_id);
 				if (lookup === void 0) throw new InternalError(`no lookup for transform ${transform.entity_id}`);
@@ -726,36 +986,10 @@ function unitStage(checked, connect) {
 					});
 					continue;
 				}
-				const tests = await port.listTests(lookup.id);
-				for (const test of tests.toSorted((a, b) => a.id - b.id)) {
-					const check = {
-						kind: "transform-test",
-						id: String(test.id),
-						label: `${transform.name}: ${test.name}`
-					};
-					const started = port.nowMs();
-					try {
-						const result = await port.runTest(test.id);
-						report({
-							check,
-							verdict: testVerdict(result),
-							warnings: [],
-							ms: port.nowMs() - started,
-							detail: result
-						});
-					} catch (error) {
-						const refusal = testRefusal(error);
-						if (refusal === null) throw error;
-						report({
-							check,
-							verdict: refusalVerdict(refusal),
-							warnings: [],
-							ms: port.nowMs() - started,
-							detail: refusal
-						});
-					}
-				}
+				const stop = await checkTransform(transform, lookup.id, port, report);
+				if (stop !== null) return stop;
 			}
+			return null;
 		}
 	};
 }
@@ -766,9 +1000,10 @@ var run_default = defineMetabaseCommand({
 		name: "run",
 		description: "Check the transforms a branch changed, writing one JSON event per line"
 	},
-	details: "Compares --head with its merge base with --base, finds the transforms whose files or tests changed, and runs their transform tests on the Metabase instance of --profile, which must already hold the branch's content. Only committed content is checked: when --head is the checked-out commit, a content file that is modified or untracked in the working tree is listed in an `uncommitted-content` warning instead. Writes one JSON event per line (`job.start`, then each stage and check, then `job.end`); `job.start.checked` lists the transforms the job covered, and each transform test's result is passed through as the check's `detail`. Exits 1 when the job does not pass; `job.end.state` says whether a check failed (`failed`: fix the transform) or could not run (`errored`: fix the test or the setup). A crash stops the stream before `job.end` and writes no --results file.",
+	details: "Compares --head with its merge base with --base and finds the transforms whose files or tests changed. Two stages check them: `lint` fails each transform the branch adds or whose logic (source or target) it edits that has no transform test, and warns about untested transforms the branch did not touch; `unit` runs the changed transforms' tests on the Metabase instance that --url, MB_URL or --profile names, in that order, which must already hold the branch's content, and is skipped when no transform changed. Content files are the `.yaml` files Metabase's import reads: not dotfiles, under a top-level serialization folder such as `transforms/` or `collections/`. Only committed content is checked: when --head is the checked-out commit, a content file with uncommitted changes is listed in an `uncommitted-content` warning, and its committed version is checked. Writes one JSON event per line (`job.start`, then each stage and check, then `job.end`); `job.start.checked` lists the transforms the job covered, and a `no-content-changes` warning says when the change touches no content file, so nothing was checked; each transform test's result is passed through as the check's `detail`. Exits 0 when the job passes. Exits 1 after `job.end` when it does not: `state` is `failed` when a check failed (fix the transform), and `errored` when no check failed but one could not judge the change (fix the test or the setup); a failure outranks errors, since it is a finding about the change. A test run that times out, loses its connection or gets an HTTP error is an `error` check whose `detail.error_code` starts with `ci.`, and the next test runs. A failure every later request would repeat ends the unit stage early, `errored` unless a check failed, with the reason in `stage.end.stopped`: Metabase rejects the credential, the server has no transform testing, the entity-id lookup fails, or Metabase cannot be reached before a test runs. Exits 2 on a usage or config error: a bad flag, a --repo, --base or --head that git cannot resolve or relate, or no Metabase credential when a transform needs testing, which is found after `job.start`. Exits 1 on a crash, such as a changed content file that does not parse, and 130 on an interrupt: the stream stops before `job.end`, the error is on stderr, and no --results file is left, not even an earlier run's. When the reader closes stdout early, the job still runs to the end, writes --results and exits by its state.",
 	requires: [
 		"eidTranslation.translate",
+		"transform.get",
 		"transformTest.list",
 		"transformTest.run"
 	],
@@ -787,12 +1022,12 @@ var run_default = defineMetabaseCommand({
 		},
 		repo: {
 			type: "string",
-			description: "Path to the git repository",
+			description: "Path inside the git work tree to check",
 			default: "."
 		},
 		results: {
 			type: "string",
-			description: "Also write every event to this JSON file"
+			description: "Also write every event to this file, as one JSON array"
 		}
 	},
 	outputSchema: CiEvent,
@@ -809,8 +1044,9 @@ var run_default = defineMetabaseCommand({
 			},
 			job: randomUUID(),
 			now: () => /* @__PURE__ */ new Date(),
-			write: writeJsonLine,
-			resultsPath: args.results ?? null
+			write: jsonLineWriter(process.stdout),
+			resultsPath: args.results ?? null,
+			signal: interruptSignal
 		});
 		if (state !== "passed") throw new FailedResultError(`ci job ${state}`);
 	}