@pellux/goodvibes-tui 1.13.1 → 1.14.0

package/src/cli/status.ts

@@ -2,9 +2,11 @@ import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import { resolveDaemonEnabled } from '@pellux/goodvibes-sdk/platform/config';
 import type { OnboardingCheckMarkersState } from '../runtime/onboarding/index.ts';
 import { resolveRuntimeEndpointBinding } from './endpoints.ts';
-import { isNetworkFacing } from './network-posture.ts';
+import type { RuntimeEndpointId } from './endpoints.ts';
+import { classifyBindPosture, isNetworkFacing } from './network-posture.ts';
 import type { GoodVibesCliOutputFormat } from './types.ts';
 import type { CliServicePosture } from './service-posture.ts';
+import type { InstallSelfCheckFinding } from '../runtime/install-self-check.ts';
 import { getProviderIdFromModel } from '../config/provider-model.ts';
 
 export interface CliStatusOptions {
@@ -14,8 +16,57 @@ export interface CliStatusOptions {
   readonly onboardingMarkers?: OnboardingCheckMarkersState;
   readonly auth?: CliAuthStatus;
   readonly service?: CliServicePosture;
+  /** Findings from the install self-check (missing vendor binaries, broken daemon path), computed by the caller. */
+  readonly install?: readonly InstallSelfCheckFinding[];
   readonly doctor?: boolean;
   readonly outputFormat?: GoodVibesCliOutputFormat;
+  /** Per-workspace trust + registration posture, computed read-only by the caller. */
+  readonly workspace?: CliWorkspaceStatus;
+  /** Per-command exec sandbox availability, host-probed by the caller. */
+  readonly sandbox?: CliSandboxStatus;
+  /** Outbound relay reachability posture (config + feature-flag gate only — a one-shot CLI process has no live connection to inspect). */
+  readonly relay?: CliRelayStatus;
+}
+
+/** Config-derived relay posture. No live socket check — see doctor's other surfaces for the same honesty bar. */
+export interface CliRelayStatus {
+  readonly configEnabled: boolean;
+  readonly featureEnabled: boolean;
+  readonly url: string;
+  readonly rendezvousId: string;
+  readonly requireStepUpForMutations: boolean;
+}
+
+/** Honest per-command exec sandbox posture for the report. */
+export interface CliSandboxStatus {
+  /** `sandbox.enabled` config switch. */
+  readonly configEnabled: boolean;
+  /** The graduation-gated `exec-sandbox` feature flag. */
+  readonly featureEnabled: boolean;
+  /** Host can actually provide a boundary (bubblewrap present and working). */
+  readonly available: boolean;
+  readonly backend: 'bubblewrap' | 'none';
+  /** Host-probe diagnosis (why unavailable) or one-line availability summary. */
+  readonly reason: string;
+  /** Whether `--unshare-net` isolation is confirmed on this host, or unknown. */
+  readonly networkIsolationGuaranteed: boolean;
+}
+
+/** Read-only snapshot of this workspace's trust gate and registration coverage. */
+export interface CliWorkspaceStatus {
+  /** TUI-local trust decision; 'undecided' when no choice is persisted yet. */
+  readonly trustLevel: 'trusted' | 'restricted' | 'undecided';
+  readonly trustGrandfathered: boolean;
+  /** Coverage verdict from the shared workspace registry. */
+  readonly registrationStatus: 'covered' | 'declined' | 'unknown';
+  /** Normalized working directory resolved against the registry. */
+  readonly registrationRoot: string;
+  /** Nearest registered root covering this path, or null. */
+  readonly registeredBy: string | null;
+  /** Coverage inherited through the git worktree→main-repo link. */
+  readonly viaWorktreeLink: boolean;
+  /** True when the root is too broad to register ($HOME, filesystem root, ~/.goodvibes). */
+  readonly registrationBroad: boolean;
 }
 
 export interface CliAuthStatus {
@@ -29,7 +80,7 @@ export interface CliAuthStatus {
 
 export interface CliDoctorFinding {
   readonly id: string;
-  readonly area: 'auth' | 'network' | 'onboarding' | 'security' | 'service' | 'secrets';
+  readonly area: 'auth' | 'network' | 'onboarding' | 'security' | 'service' | 'secrets' | 'install' | 'sandbox';
   readonly severity: 'warning' | 'risk';
   readonly summary: string;
   readonly cause: string;
@@ -69,9 +120,33 @@ export interface CliStatusSnapshot {
     readonly scope: string;
     readonly updatedAt: number | null;
   };
+  readonly workspace: CliWorkspaceStatus | null;
+  readonly sandbox: CliSandboxStatus | null;
+  readonly relay: CliRelayStatus | null;
+  readonly exposure: readonly CliExposureSurface[];
   readonly findings: readonly CliDoctorFinding[];
 }
 
+/**
+ * Per-surface exposure report row: what a network surface binds to, how it
+ * authenticates callers, and what cross-origin allowlist (if any) applies.
+ * A plain report — it changes no behavior and writes no config.
+ */
+export interface CliExposureSurface {
+  readonly id: RuntimeEndpointId;
+  readonly label: string;
+  readonly enabled: boolean;
+  /** Bind envelope, e.g. "network 0.0.0.0:3421". */
+  readonly bind: string;
+  /** Reachability posture label, e.g. "Local only" / "Local Network" / "Custom network". */
+  readonly reach: string;
+  readonly networkFacing: boolean;
+  /** How callers authenticate against this surface when it is network-facing. */
+  readonly authMode: string;
+  /** Browser-origin allowlist state. Only the control plane has one; others report n/a. */
+  readonly originAllowlist: string;
+}
+
 function yesNo(value: unknown): string {
   return value === true ? 'yes' : 'no';
 }
@@ -94,6 +169,146 @@ function bindLine(label: string, enabled: unknown, binding: { readonly hostMode:
   return `  ${label}: ${yesNo(enabled)} (${binding.hostMode} ${binding.host}:${binding.port})`;
 }
 
+/** Describe registration coverage for the Workspace status section. */
+function registrationLine(workspace: CliWorkspaceStatus): string {
+  switch (workspace.registrationStatus) {
+    case 'covered':
+      return workspace.viaWorktreeLink
+        ? `registered (via worktree link to ${workspace.registeredBy})`
+        : `registered (covered by ${workspace.registeredBy})`;
+    case 'declined':
+      return 'not registered (declined for this directory)';
+    case 'unknown':
+      return workspace.registrationBroad
+        ? 'not registered (root too broad to register)'
+        : 'not registered (never asked)';
+  }
+}
+
+/** The `Workspace:` block showing the TUI-local trust gate and shared-registry coverage. */
+function renderWorkspaceSection(workspace: CliWorkspaceStatus | null): string[] {
+  if (!workspace) return [];
+  return [
+    'Workspace:',
+    `  trust: ${workspace.trustLevel}${workspace.trustGrandfathered ? ' (grandfathered)' : ''}`,
+    `  registration: ${registrationLine(workspace)}`,
+    `  root: ${workspace.registrationRoot}`,
+    '',
+  ];
+}
+
+/** The `Exec sandbox:` block — honest host-probed availability of the per-command boundary. */
+function renderSandboxSection(sandbox: CliSandboxStatus | null): string[] {
+  if (!sandbox) return [];
+  const active = sandbox.configEnabled && sandbox.featureEnabled && sandbox.available;
+  const network = !sandbox.available
+    ? 'n/a'
+    : sandbox.networkIsolationGuaranteed
+      ? 'isolation confirmed'
+      : 'isolation unknown';
+  return [
+    'Exec sandbox:',
+    `  active: ${active ? 'yes' : 'no'}`,
+    `  configEnabled: ${yesNo(sandbox.configEnabled)}`,
+    `  featureEnabled: ${yesNo(sandbox.featureEnabled)}`,
+    `  backend: ${sandbox.backend}`,
+    `  available: ${yesNo(sandbox.available)}`,
+    `  network: ${network}`,
+    `  detail: ${sandbox.reason}`,
+    '',
+  ];
+}
+
+/**
+ * The `Relay:` block — config + feature-flag gate only. This CLI invocation is
+ * a separate one-shot process from any running daemon, so it cannot read the
+ * daemon's live in-memory connection state (see /relay status in the TUI for
+ * that). "active" here means the gate that lets a running daemon register.
+ */
+function renderRelaySection(relay: CliRelayStatus | null): string[] {
+  if (!relay) return [];
+  const active = relay.configEnabled && relay.featureEnabled;
+  return [
+    'Relay:',
+    `  active: ${active ? 'yes (a running daemon will register)' : 'no'}`,
+    `  configEnabled (relay.enabled): ${yesNo(relay.configEnabled)}`,
+    `  featureEnabled (relay-connect flag): ${yesNo(relay.featureEnabled)}`,
+    `  url: ${relay.url || '(not set)'}`,
+    `  rendezvousId: ${relay.rendezvousId || '(not yet minted)'}`,
+    `  requireStepUpForMutations: ${yesNo(relay.requireStepUpForMutations)}`,
+    '  Threat model: the relay operator sees only ciphertext and connection metadata — self-host your own relay for full control.',
+    '',
+  ];
+}
+
+/**
+ * How callers authenticate against a surface, derived from the auth material
+ * the CLI already inspects. A loopback surface trusts the local host; a
+ * network-facing surface is authenticated by a local user store and/or an
+ * operator token, and reports "none configured" when neither exists.
+ */
+function surfaceAuthMode(networkFacing: boolean, auth: CliAuthStatus | undefined): string {
+  if (!networkFacing) return 'loopback (host-local trust)';
+  if (!auth) return 'unknown';
+  const parts: string[] = [];
+  if (auth.userStorePresent) parts.push('local users');
+  if (auth.operatorTokenPresent) parts.push('operator token');
+  if (parts.length === 0) return 'none configured';
+  return parts.join(' + ');
+}
+
+/** Comma-separated CORS origins, trimmed and emptied of blanks. */
+function parseAllowedOrigins(raw: unknown): string[] {
+  return String(raw ?? '')
+    .split(',')
+    .map((origin) => origin.trim())
+    .filter((origin) => origin.length > 0);
+}
+
+/**
+ * The only browser-origin allowlist in this codebase belongs to the control
+ * plane (controlPlane.cors.*). httpListener and web have no origin allowlist
+ * concept, so this returns an honest n/a for them.
+ */
+function surfaceOriginAllowlist(id: RuntimeEndpointId, config: Pick<ConfigManager, 'get'>): string {
+  if (id !== 'controlPlane') return 'n/a (no origin allowlist for this surface)';
+  if (config.get('controlPlane.cors.enabled') !== true) return 'CORS off (same-origin only)';
+  const origins = parseAllowedOrigins(config.get('controlPlane.cors.allowedOrigins'));
+  if (origins.length === 0) return 'CORS on, empty allowlist (refuses all cross-origin)';
+  if (origins.includes('*')) return `CORS on, WILDCARD any-origin (${origins.join(', ')})`;
+  return `CORS on, allowlist: ${origins.join(', ')}`;
+}
+
+const EXPOSURE_SURFACES: readonly { readonly id: RuntimeEndpointId; readonly label: string; readonly enabledKey: string }[] = [
+  { id: 'controlPlane', label: 'controlPlane', enabledKey: 'controlPlane.enabled' },
+  { id: 'httpListener', label: 'httpListener', enabledKey: 'danger.httpListener' },
+  { id: 'web', label: 'web', enabledKey: 'web.enabled' },
+];
+
+/**
+ * Build the per-surface exposure report (bind address, auth mode, origin
+ * allowlist) for every network surface. Pure over the status options — a
+ * report only, no behavior change.
+ */
+export function buildCliExposureReport(options: CliStatusOptions): readonly CliExposureSurface[] {
+  const config = options.configManager;
+  return EXPOSURE_SURFACES.map((surface): CliExposureSurface => {
+    const enabled = config.get(surface.enabledKey as never) === true;
+    const binding = resolveRuntimeEndpointBinding(config, surface.id);
+    const networkFacing = isNetworkFacing(enabled, binding);
+    return {
+      id: surface.id,
+      label: surface.label,
+      enabled,
+      bind: `${binding.hostMode} ${binding.host}:${binding.port}`,
+      reach: classifyBindPosture(binding).label,
+      networkFacing,
+      authMode: surfaceAuthMode(networkFacing, options.auth),
+      originAllowlist: surfaceOriginAllowlist(surface.id, config),
+    };
+  });
+}
+
 export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliDoctorFinding[] {
   const config = options.configManager;
   const serviceEnabled = config.get('service.enabled') === true;
@@ -241,6 +456,49 @@ export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliD
     });
   }
 
+  if (isNetworkFacing(controlPlaneEnabled, controlPlaneBinding)
+    && config.get('controlPlane.cors.enabled') === true
+    && parseAllowedOrigins(config.get('controlPlane.cors.allowedOrigins')).includes('*')) {
+    findings.push({
+      id: 'control-plane-cors-wildcard-origin',
+      area: 'network',
+      severity: 'risk',
+      summary: 'The control plane accepts cross-origin requests from any origin.',
+      cause: `controlPlane is ${controlPlaneBinding.hostMode}-bound on ${controlPlaneBinding.host}:${controlPlaneBinding.port}, controlPlane.cors.enabled is true, and controlPlane.cors.allowedOrigins contains a wildcard "*".`,
+      impact: 'Any website a signed-in operator visits could make credentialed cross-origin calls to the control plane.',
+      action: 'Replace the wildcard with an explicit list of trusted browser origins in controlPlane.cors.allowedOrigins.',
+    });
+  }
+
+  if (options.install) {
+    for (const finding of options.install) {
+      findings.push({
+        id: `install-${finding.id}`,
+        area: 'install',
+        severity: 'warning',
+        summary: finding.summary,
+        cause: finding.detail,
+        impact: 'The daemon and any background surfaces (control plane, listener, web) may fail to start until the install is repaired.',
+        action: `Repair this install by running: ${finding.repairCommand}`,
+      });
+    }
+  }
+
+  // Exec sandbox requested but the host cannot provide a boundary: the exec tool
+  // silently runs unsandboxed and the approval flow keeps prompting. Flag it so
+  // the operator knows the boundary they turned on is not in force.
+  if (options.sandbox && options.sandbox.configEnabled && options.sandbox.featureEnabled && !options.sandbox.available) {
+    findings.push({
+      id: 'exec-sandbox-unavailable',
+      area: 'sandbox',
+      severity: 'warning',
+      summary: 'The per-command exec sandbox is enabled but unavailable on this host.',
+      cause: options.sandbox.reason,
+      impact: 'Exec commands run unsandboxed and boundary-safe commands still prompt instead of auto-allowing.',
+      action: 'Install bubblewrap (bwrap) on Linux, or disable sandbox.enabled to stop requesting a boundary this host cannot provide.',
+    });
+  }
+
   return findings;
 }
 
@@ -283,6 +541,10 @@ export function buildCliStatusSnapshot(options: CliStatusOptions): CliStatusSnap
       scope: marker?.scope ?? 'none',
       updatedAt: marker?.payload?.updatedAt ?? null,
     },
+    workspace: options.workspace ?? null,
+    sandbox: options.sandbox ?? null,
+    relay: options.relay ?? null,
+    exposure: buildCliExposureReport(options),
     findings,
   };
 }
@@ -349,6 +611,17 @@ export function renderCliStatus(options: CliStatusOptions): string {
     `  checked: ${marker?.exists ? 'yes' : 'no'}`,
     `  scope: ${marker?.scope ?? 'none'}`,
     `  updatedAt: ${marker?.payload ? new Date(marker.payload.updatedAt).toISOString() : 'n/a'}`,
+    '',
+    ...renderWorkspaceSection(snapshot.workspace),
+    ...renderSandboxSection(snapshot.sandbox),
+    ...renderRelaySection(snapshot.relay),
+    'Exposure (report only — no changes made):',
+    ...snapshot.exposure.flatMap((surface) => [
+      `  ${surface.label}: ${yesNo(surface.enabled)} · ${surface.reach}${surface.networkFacing ? ' · network-facing' : ''}`,
+      `    bind: ${surface.bind}`,
+      `    auth: ${surface.authMode}`,
+      `    originAllowlist: ${surface.originAllowlist}`,
+    ]),
   ];
 
   if (options.doctor) {

package/src/cli/tui-startup.ts

@@ -1,6 +1,8 @@
 import type { CommandContext, CommandRegistry } from '../input/command-registry.ts';
 import type { InputHandler } from '../input/handler.ts';
+import type { SelectionItem } from '../input/selection-modal.ts';
 import { hasResumableWizardProgress, readOnboardingCheckMarker, readWizardProgress } from '../runtime/onboarding/index.ts';
+import { startOnboardingFastPath } from '../runtime/onboarding/fast-path.ts';
 import { readLastSessionPointer } from '@/runtime/index.ts';
 import type { GoodVibesCliParseResult } from './types.ts';
 
@@ -9,6 +11,115 @@ export type TuiStartupShellPaths = Parameters<typeof readOnboardingCheckMarker>[
   readonly homeDirectory: string;
 };
 
+export type FirstOpenTrustLevel = 'trusted' | 'restricted';
+
+/** The decisions a first-open prompt choice resolves to. Absent halves were not asked. */
+export interface FirstOpenDecision {
+  readonly trust?: FirstOpenTrustLevel;
+  readonly register?: 'yes' | 'no';
+}
+
+/**
+ * decodeFirstOpenChoice — pure mapping from a chosen selection-item id (or null
+ * on Escape/enter-through) to the trust + registration decisions, given which
+ * halves the prompt actually offered. Kept pure so the combined-prompt semantics
+ * are unit-testable without a live modal.
+ *
+ * Escape/enter-through (id === null) is the safe default: an offered trust half
+ * settles to 'restricted' (matching the standalone trust prompt), and an offered
+ * register half defaults to NO — recorded as a subtree-scoped decline so the
+ * directory is not re-asked every startup.
+ */
+export function decodeFirstOpenChoice(
+  id: string | null,
+  offered: { readonly trustNeeded: boolean; readonly registerNeeded: boolean },
+): FirstOpenDecision {
+  const decision: { trust?: FirstOpenTrustLevel; register?: 'yes' | 'no' } = {};
+  if (offered.trustNeeded && offered.registerNeeded) {
+    // Combined 2x2 choice.
+    const trust: FirstOpenTrustLevel = id === 'trust-register' || id === 'trust-only' ? 'trusted' : 'restricted';
+    const register: 'yes' | 'no' = id === 'trust-register' || id === 'restrict-register' ? 'yes' : 'no';
+    decision.trust = trust;
+    decision.register = register;
+  } else if (offered.trustNeeded) {
+    decision.trust = id === 'trusted' ? 'trusted' : 'restricted';
+  } else if (offered.registerNeeded) {
+    decision.register = id === 'register' ? 'yes' : 'no';
+  }
+  return decision;
+}
+
+/** Build the selection rows for a first-open prompt given which halves apply. */
+export function buildFirstOpenItems(offered: {
+  readonly trustNeeded: boolean;
+  readonly registerNeeded: boolean;
+}): { readonly title: string; readonly items: SelectionItem[] } {
+  if (offered.trustNeeded && offered.registerNeeded) {
+    return {
+      title: 'New workspace — trust level and registration',
+      items: [
+        { id: 'trust-register', label: 'Trust & register this workspace', detail: 'Full capability, and track it in your workspace registry', primaryAction: 'select' },
+        { id: 'trust-only', label: 'Trust, don\'t register', detail: 'Full capability; leave it out of the registry', primaryAction: 'select' },
+        { id: 'restrict-register', label: 'Keep restricted, register', detail: 'Read-only for now; still track it in the registry', primaryAction: 'select' },
+        { id: 'restrict-only', label: 'Keep restricted, don\'t register', detail: 'Read-only exploration; nothing recorded (default)', primaryAction: 'select' },
+      ],
+    };
+  }
+  if (offered.trustNeeded) {
+    return {
+      title: 'New workspace — choose a trust level',
+      items: [
+        { id: 'trusted', label: 'Trust this workspace', detail: 'Full capability — all tools may run', primaryAction: 'select' },
+        { id: 'restricted', label: 'Keep restricted (read-only)', detail: 'Explore safely; writes and commands are denied until trusted', primaryAction: 'select' },
+      ],
+    };
+  }
+  return {
+    title: 'Register this directory as a workspace?',
+    items: [
+      { id: 'register', label: 'Register this workspace', detail: 'Track this project root in your workspace registry', primaryAction: 'select' },
+      { id: 'skip', label: 'Don\'t register', detail: 'Leave it out; not asked again for this directory (default)', primaryAction: 'select' },
+    ],
+  };
+}
+
+/**
+ * First-open workspace prompt — one surface folding the TUI-local trust gate and
+ * the platform-wide registration half. When GoodVibes opens a workspace it has
+ * no trust decision for, and/or one whose registration resolves UNKNOWN, ask
+ * once (never two stacked modals): trust level AND "register this directory?".
+ *
+ * The two records are independent: a grandfathered-trusted workspace skips the
+ * trust half but may still see the register half once; a covered/declined/broad
+ * directory skips the register half. Escape/enter-through takes the safe default
+ * (restricted, and a recorded decline for the register half).
+ */
+async function promptWorkspaceFirstOpen(commandContext: CommandContext, render: () => void): Promise<void> {
+  const trustManager = commandContext.workspace?.workspaceTrustManager;
+  const registrationManager = commandContext.workspace?.workspaceRegistrationManager;
+  const trustNeeded = Boolean(trustManager && !trustManager.isDecided());
+  const evaluation = registrationManager ? await registrationManager.evaluate() : null;
+  const registerNeeded = Boolean(evaluation?.offerRegister);
+  if (!trustNeeded && !registerNeeded) return;
+
+  const offered = { trustNeeded, registerNeeded };
+  const { title, items } = buildFirstOpenItems(offered);
+  commandContext.openSelection?.(
+    title,
+    items,
+    { allowSearch: false, primaryVerbLabel: 'Choose' },
+    (result) => {
+      const decision = decodeFirstOpenChoice(result?.item.id ?? null, offered);
+      const apply = async () => {
+        if (decision.trust && trustManager) await trustManager.setLevel(decision.trust);
+        if (decision.register === 'yes' && registrationManager) await registrationManager.register();
+        else if (decision.register === 'no' && registrationManager) await registrationManager.decline();
+      };
+      void apply().finally(render);
+    },
+  );
+}
+
 export function applyInitialTuiCliState(options: {
   readonly cli: GoodVibesCliParseResult;
   readonly input: InputHandler;
@@ -70,7 +181,9 @@ export function applyInitialTuiCliState(options: {
         .then(() => render());
     }
   } else if (!globalOnboardingMarker.exists) {
-    input.openOnboardingWizard({ mode: 'new', reset: true });
+    // Fast path: get a brand-new user to a working session in the fewest steps.
+    // Falls back to the full wizard when the surface can't detect providers.
+    startOnboardingFastPath({ input, commandContext, shellPaths, render });
   } else {
     // User has completed onboarding before but left a wizard session in progress.
     // Reopen the wizard at the last saved step so they can continue or dismiss.
@@ -89,6 +202,11 @@ export function applyInitialTuiCliState(options: {
           },
         });
       }
+    } else {
+      // Returning user, no wizard to resume: this is the moment to ask, in one
+      // surface, about a genuinely new workspace's trust level and whether to
+      // register it — before they run anything here.
+      void promptWorkspaceFirstOpen(commandContext, render);
     }
   }
 }

package/src/cli/types.ts

@@ -20,9 +20,11 @@ export type GoodVibesCliCommand =
   | 'surfaces'
   | 'listener'
   | 'control-plane'
-  | 'bundle'
+  | 'support-bundle'
   | 'remote'
   | 'bridge'
+  | 'hooks'
+  | 'plugin'
   | 'completion'
   | 'help'
   | 'version'

package/src/config/index.ts

@@ -39,6 +39,22 @@ export function isAutoApproveEnabled(configManager: Pick<ConfigManager, 'get'>):
   return configManager.get('behavior.autoApprove');
 }
 
+/**
+ * True when the current permission posture effectively auto-approves everything:
+ * auto-approve on, permission mode `allow-all`, or a `custom` mode whose every
+ * tool action is `allow`. Drives the footer's danger indicator.
+ */
+export function isEffectiveDangerMode(configManager: Pick<ConfigManager, 'get' | 'getCategory'>): boolean {
+  if (configManager.get('behavior.autoApprove')) return true;
+  const permMode = configManager.get('permissions.mode');
+  if (permMode === 'allow-all') return true;
+  if (permMode === 'custom') {
+    const tools = configManager.getCategory('permissions').tools;
+    if (Object.values(tools).every((action) => action === 'allow')) return true;
+  }
+  return false;
+}
+
 export function getWorkingDirectory(configManager: Pick<ConfigManager, 'getWorkingDirectory'>): string | null {
   return configManager.getWorkingDirectory();
 }