@swmansion/argent 0.27.1-next.20 → 0.27.1-next.22

package/dist/cli-cmds.mjs

@@ -9363,6 +9363,35 @@ var FLOW_NAME_CHARSET = "[A-Za-z0-9_-]+";
 var FLOW_NAME_PATTERN = new RegExp(`^${FLOW_NAME_CHARSET}$`);
 var FLOW_FILE_NAME_PATTERN = new RegExp(`^${FLOW_NAME_CHARSET}\\.yaml$`);
 var SCRIPT_FILE_NAME_PATTERN = new RegExp(`^${FLOW_NAME_CHARSET}\\.mjs$`);
+function interpolateFileInputPath(template, args) {
+  let missing = false;
+  const out = template.replace(/\$\{([A-Za-z0-9_]+)\}/g, (_m, name) => {
+    const v = args[name];
+    if (typeof v !== "string" || v.length === 0) {
+      missing = true;
+      return "";
+    }
+    return v;
+  });
+  return missing ? null : out;
+}
+var TOOL_FILE_EXTENSIONS = [".png", ".yaml"];
+function hasToolFileExtension(file2) {
+  const name = file2.toLowerCase();
+  return TOOL_FILE_EXTENSIONS.some((extension) => name.endsWith(extension));
+}
+function toolStepFiles(specs, args) {
+  const files = [];
+  for (const spec of specs ?? []) {
+    if (spec.skipWhenSet !== void 0 && args[spec.skipWhenSet] !== void 0) continue;
+    const filled = interpolateFileInputPath(spec.path, args);
+    if (filled !== null) files.push({ spec, path: filled });
+  }
+  return files;
+}
+function isClientFileArgument({ spec, path: path23 }) {
+  return spec.kind === "file" && spec.path === `\${${spec.target}}` && path23.startsWith("/") && hasToolFileExtension(path23);
+}
 
 // ../registry/src/flow-file-refs.ts
 import * as fs2 from "node:fs/promises";
@@ -9390,6 +9419,8 @@ function isRecord(value) {
 }
 function collectFlowRequests(doc) {
   const runTargets = /* @__PURE__ */ new Set();
+  const snapshots = /* @__PURE__ */ new Set();
+  const toolSteps = [];
   const seen = /* @__PURE__ */ new Set();
   const visit = (steps, depth) => {
     if (!Array.isArray(steps) || depth > MAX_BLOCK_NESTING || seen.has(steps)) return;
@@ -9401,11 +9432,20 @@ function collectFlowRequests(doc) {
         const target = completeRunExtension(run2);
         if (FLOW_FILE_NAME_PATTERN.test(path2.posix.basename(target))) runTargets.add(target);
       }
+      const snapshot = isRecord(step.snapshot) ? step.snapshot.name : step.snapshot;
+      if (typeof snapshot === "string" && FLOW_NAME_PATTERN.test(snapshot)) snapshots.add(snapshot);
+      if (typeof step.tool === "string") {
+        toolSteps.push({ tool: step.tool, args: isRecord(step.args) ? step.args : {} });
+      }
       visit(step.steps, depth + 1);
     }
   };
   if (isRecord(doc)) visit(doc.steps, 0);
-  return { runTargets: [...runTargets] };
+  return { runTargets: [...runTargets], snapshots: [...snapshots], toolSteps };
+}
+function baselineKeyFor(canonicalPath, flowName) {
+  const stem = path2.basename(canonicalPath, ".yaml");
+  return FLOW_NAME_PATTERN.test(stem) ? stem : flowName;
 }
 function flowMemberKey(anchorDir, target) {
   return `${anchorDir}\0${target}`;
@@ -24461,7 +24501,17 @@ function parseLinkTarget(input) {
 // ../argent-tools-client/src/file-inputs.ts
 import { createHash as createHash2, randomUUID as randomUUID3 } from "node:crypto";
 import { createReadStream, rmSync } from "node:fs";
-import { mkdir as mkdir3, readFile as readFile3, rm as rm2, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
+import {
+  chmod as chmod3,
+  lstat,
+  mkdir as mkdir3,
+  readFile as readFile3,
+  realpath as realpath2,
+  rename as rename2,
+  rm as rm2,
+  stat as stat2,
+  writeFile as writeFile3
+} from "node:fs/promises";
 import { constants, tmpdir } from "node:os";
 import * as path4 from "node:path";
 
@@ -24770,9 +24820,61 @@ function isAllowedClientFilePath(p) {
 function isClientFileDirective2(value) {
   return !!value && typeof value === "object" && value[CLIENT_FILE_MARKER2] === true && typeof value.path === "string" && typeof value.content === "string";
 }
-async function applyClientFileDirectives(result) {
+async function replaceFile(target, bytes, mode) {
+  const temp = path4.join(path4.dirname(target), `.baseline-${randomUUID3()}.tmp`);
+  try {
+    await writeFile3(temp, bytes, { flag: "wx" });
+    if (mode !== void 0) await chmod3(temp, mode & 511);
+    await rename2(temp, target);
+  } catch (err) {
+    await rm2(temp, { force: true });
+    throw err;
+  }
+}
+async function writeBaselineFile(file2, bytes, allowedDirs) {
+  if (!path4.isAbsolute(file2) || path4.normalize(file2) !== file2 || file2.split(/[\\/]/).includes("..") || !file2.endsWith(".png") || !allowedDirs.includes(path4.dirname(file2))) {
+    return allowedDirs.length === 0 ? "this call writes no baselines" : `${file2} is not a baseline of this call (${allowedDirs.map((d) => `${d}/<name>.png`).join(", ")})`;
+  }
+  if (bytes.length > MAX_CONTENT_BYTES) {
+    return `${file2}: the baseline is larger than the 32 MiB cap on a file this client writes`;
+  }
+  const dir = path4.dirname(file2);
+  await mkdir3(dir, { recursive: true });
+  const link2 = await lstat(file2).catch(() => null);
+  const real = link2 === null ? null : await realpath2(file2).catch(() => null);
+  if (link2 !== null && real === null) return `${file2} is a symbolic link to a missing file`;
+  if (real !== null) {
+    if (!real.endsWith(".png")) return `${file2} links to a file that is not a PNG file`;
+    if (path4.dirname(real) !== await realpath2(dir)) {
+      return `${file2} links outside its baseline directory`;
+    }
+  }
+  const existing = real === null ? null : await stat2(real);
+  if (existing !== null && !existing.isFile()) return `${file2} is not a regular file`;
+  await replaceFile(
+    real ?? path4.join(await realpath2(dir), path4.basename(file2)),
+    bytes,
+    existing?.mode
+  );
+  return null;
+}
+async function applyClientFileDirectives(result, opts = {}) {
   const written = [];
+  const failed = [];
   async function walk(value) {
+    if (isClientFileDirective2(value) && value.encoding === "base64") {
+      const error52 = await writeBaselineFile(
+        value.path,
+        Buffer.from(value.content, "base64"),
+        opts.allowedDirs ?? []
+      ).catch((err) => err instanceof Error ? err.message : String(err));
+      if (error52 !== null) {
+        failed.push({ path: value.path, error: error52 });
+        return { path: value.path, error: error52 };
+      }
+      written.push(value.path);
+      return value.path;
+    }
     if (isClientFileDirective2(value)) {
       if (!isAllowedClientFilePath(value.path)) return null;
       try {
@@ -24785,7 +24887,9 @@ async function applyClientFileDirectives(result) {
       }
     }
     if (Array.isArray(value)) {
-      return Promise.all(value.map(walk));
+      const out = [];
+      for (const item of value) out.push(await walk(item));
+      return out;
     }
     if (value && typeof value === "object") {
       const out = {};
@@ -24797,12 +24901,12 @@ async function applyClientFileDirectives(result) {
     return value;
   }
   const rewritten = await walk(result);
-  return { result: rewritten, written };
+  return { result: rewritten, written, failed };
 }
 
 // ../argent-tools-client/src/flow-files.ts
 var import_yaml = __toESM(require_dist(), 1);
-import { readFile as readFile4, realpath as realpath2, stat as stat3 } from "node:fs/promises";
+import { readdir as readdir4, readFile as readFile4, realpath as realpath3, stat as stat3 } from "node:fs/promises";
 import * as path5 from "node:path";
 var INLINE_MEMBERS_BYTES = 256 * 1024;
 var FLOW_FILES_LOG_ENV = "ARGENT_FLOW_FILES_LOG";
@@ -24837,7 +24941,7 @@ function savedFlowProject(file2) {
 }
 async function landing(spelled) {
   try {
-    const canonical = await realpath2(spelled);
+    const canonical = await realpath3(spelled);
     return { canonical, fence: canonical };
   } catch (err) {
     const failure = err.code === "ENOENT" ? { missing: true } : { error: err.message };
@@ -24846,7 +24950,7 @@ async function landing(spelled) {
     for (; ; ) {
       const parent = path5.dirname(at);
       if (parent === at) return { canonical, fence: spelled, ...failure };
-      const real = await realpath2(parent).catch(() => null);
+      const real = await realpath3(parent).catch(() => null);
       if (real !== null) {
         return { canonical, fence: path5.join(real, path5.basename(at)), ...failure };
       }
@@ -24866,7 +24970,7 @@ async function closureRoots(rootPath, rootCanonical, projectRoot) {
   }
   const real = [];
   for (const candidate of candidates) {
-    const resolved = await realpath2(candidate).catch(() => null);
+    const resolved = await realpath3(candidate).catch(() => null);
     if (resolved !== null && !real.includes(resolved)) real.push(resolved);
   }
   return real.filter((root) => !real.some((other) => other !== root && isWithin(root, other)));
@@ -24904,31 +25008,120 @@ async function readFlowMember(anchorDir, target, roots, budget, opts) {
   if (!/\.ya?ml$/i.test(path5.basename(canonical))) {
     return refuse(`${target} links to a file that is not a YAML file`);
   }
-  const read = await readFileInputWire(canonical, { includeContent: true });
+  const sent = await sendBytes(member, canonical, budget, opts);
+  return { ...sent, text: sent.bytes?.toString("utf8") };
+}
+async function readToolMember(file2, roots, budget, opts) {
+  const member = { role: "tool", key: file2, path: file2 };
+  const refuse = (reason) => ({
+    member: { ...member, state: "refused", error: reason },
+    sent: `refused (${reason})`
+  });
+  const { canonical } = await landing(file2);
+  if (!roots.some((root) => isWithin(canonical, root))) {
+    return refuse(`${file2} is outside every root this client serves (${roots.join(", ")})`);
+  }
+  if (!hasToolFileExtension(canonical)) {
+    return refuse(`${file2} links to a file that is not one of ${TOOL_FILE_EXTENSIONS.join(", ")}`);
+  }
+  const st = await stat3(canonical).catch((err) => err);
+  if (st instanceof Error) {
+    if (st.code === "ENOENT" || st.code === "ENOTDIR") {
+      return { member: { ...member, state: "missing" }, sent: "missing" };
+    }
+    return refuse(st.message);
+  }
+  if (st.isDirectory()) return refuse("EISDIR: illegal operation on a directory, read");
+  return sendBytes(member, canonical, budget, opts);
+}
+function callPlatform(args) {
+  if (typeof args.device === "string" && args.device.startsWith("chromium-cdp-")) return "chromium";
+  if (typeof args.platform !== "string") return void 0;
+  return args.platform === "ios-remote" ? "ios" : args.platform;
+}
+async function baselineEntry(file2, roots, forWrite) {
+  const { canonical, error: error52 } = await landing(file2);
+  if (!roots.some((root) => isWithin(canonical, root))) {
+    return {
+      state: "refused",
+      error: `${file2} is outside every root this client serves (${roots.join(", ")})`
+    };
+  }
+  if (error52 !== void 0) return { state: "refused", error: error52 };
+  const st = await stat3(canonical).catch((err) => err);
+  if (st instanceof Error) {
+    if (st.code !== "ENOENT") return { state: "refused", error: st.message };
+    return forWrite ? { state: "refused", error: `${file2} is a symbolic link to a missing file` } : { state: "missing" };
+  }
+  if (!canonical.endsWith(".png")) {
+    return { state: "refused", error: `${file2} links to a file that is not a PNG file` };
+  }
+  if (forWrite && !st.isFile()) return { state: "refused", error: `${file2} is not a regular file` };
+  if (st.isDirectory()) {
+    return { state: "refused", error: "EISDIR: illegal operation on a directory, read" };
+  }
+  return st.isFile() ? { state: "ok", real: canonical } : { state: "missing" };
+}
+async function sendBytes(member, real, budget, opts) {
+  const read = await readFileInputWire(real, { includeContent: true });
   if (read?.contentOmitted) {
-    return refuse(`${canonical} is larger than the 32 MiB cap on a file sent to the tool-server`);
+    const error52 = `${real} is larger than the 32 MiB cap on a file sent to the tool-server`;
+    return { member: { ...member, state: "refused", error: error52 }, sent: `refused (${error52})` };
   }
   if (read?.content === void 0) {
-    return refuse(
-      await readFile4(canonical).then(
-        () => `${canonical} could not be read on this client`,
-        (err) => err instanceof Error ? err.message : String(err)
-      )
+    const error52 = await readFile4(real).then(
+      () => `${real} could not be read on this client`,
+      (err) => err instanceof Error ? err.message : String(err)
     );
+    return { member: { ...member, state: "refused", error: error52 }, sent: `refused (${error52})` };
   }
-  const text2 = Buffer.from(read.content, "base64").toString("utf8");
+  const bytes = Buffer.from(read.content, "base64");
   const size = read.size ?? 0;
   if (budget.inline + size <= INLINE_MEMBERS_BYTES || !opts.uploadEndpoint) {
     budget.inline += size;
-    return { member: { ...member, ...read }, text: text2, sent: `inline ${size}` };
+    return { member: { ...member, ...read }, sent: `inline ${size}`, bytes };
   }
-  const uploaded = await uploadFile(canonical, opts.uploadEndpoint, opts.signal);
+  const uploaded = await uploadFile(real, opts.uploadEndpoint, opts.signal);
   return {
     member: { ...member, size: read.size, mtimeMs: read.mtimeMs, ...uploaded },
-    text: text2,
-    sent: `upload ${size}`
+    sent: `upload ${size}`,
+    bytes
   };
 }
+async function collectBaselineMembers(canonical, flowName, snapshots, args, roots, budget, opts, sent, emit) {
+  const dir = path5.join(
+    path5.dirname(canonical),
+    "__baselines__",
+    baselineKeyFor(canonical, flowName)
+  );
+  const real = (await landing(dir)).canonical;
+  if (!roots.some((root) => isWithin(real, root))) return;
+  const updates = args.updateBaselines === true;
+  if (updates) opts.baselineDirs?.push(dir);
+  const platform = callPlatform(args);
+  const prefixes = snapshots.map(
+    (name) => `${name}__${platform === void 0 ? "" : `${platform}-`}`
+  );
+  const names = await readdir4(dir).catch(() => []);
+  for (const name of names.sort()) {
+    if (!name.endsWith(".png")) continue;
+    if (!updates && !prefixes.some((prefix) => name.startsWith(prefix))) continue;
+    const file2 = path5.join(dir, name);
+    if (sent.has(file2)) continue;
+    const member = { role: "baseline", key: file2, path: file2 };
+    const entry = await baselineEntry(file2, roots, updates);
+    if (entry.state === "refused") {
+      emit({ ...member, state: "refused", error: entry.error }, `refused (${entry.error})`);
+    } else if (entry.state === "missing") {
+      emit({ ...member, state: "missing" }, "missing");
+    } else if (updates) {
+      emit({ ...member, state: "listed" }, "listed");
+    } else {
+      const sent2 = await sendBytes(member, entry.real, budget, opts);
+      emit(sent2.member, sent2.sent);
+    }
+  }
+}
 async function collectFlowMembers(rootPath, rootBytes, args, opts) {
   if (!namesValidFlow(args)) return {};
   const canonical = await canonicalFlowPath(rootPath);
@@ -24940,10 +25133,16 @@ async function collectFlowMembers(rootPath, rootBytes, args, opts) {
   const roots = await closureRoots(rootPath, canonical, args.project_root);
   const members = [];
   const seen = /* @__PURE__ */ new Set();
+  const snapshots = /* @__PURE__ */ new Set();
   const budget = { inline: 0 };
   const logging = process.env[FLOW_FILES_LOG_ENV] === "1";
   const log2 = opts.log ?? ((line) => void process.stderr.write(`${line}
 `));
+  const emit = (member, sent) => {
+    members.push(member);
+    const subject = member.role === "flow" ? member.canonical : member.key;
+    if (logging) log2(printable(`[flow-files] ${member.role} ${subject}: ${sent}`));
+  };
   const queue = [{ canonical, text: rootBytes.toString("utf8"), hop: 0 }];
   for (let file2 = queue.shift(); file2 !== void 0; file2 = queue.shift()) {
     let doc;
@@ -24952,19 +25151,45 @@ async function collectFlowMembers(rootPath, rootBytes, args, opts) {
     } catch {
       continue;
     }
+    const requests = collectFlowRequests(doc);
+    for (const name of requests.snapshots) snapshots.add(name);
+    for (const step of requests.toolSteps) {
+      if (step.tool === "flow-execute") continue;
+      for (const file3 of toolStepFiles(opts.toolFileInputs?.(step.tool), step.args)) {
+        const { unwrapWhenSet } = file3.spec;
+        if (unwrapWhenSet !== void 0 && step.args[unwrapWhenSet] !== void 0) continue;
+        if (!isClientFileArgument(file3) || seen.has(file3.path)) continue;
+        seen.add(file3.path);
+        const read = await readToolMember(file3.path, roots, budget, opts);
+        emit(read.member, read.sent);
+      }
+    }
     const anchorDir = path5.dirname(file2.canonical);
-    for (const target of collectFlowRequests(doc).runTargets) {
+    for (const target of requests.runTargets) {
       const key = flowMemberKey(anchorDir, target);
       if (seen.has(key)) continue;
       seen.add(key);
       const { member, text: text2, sent } = await readFlowMember(anchorDir, target, roots, budget, opts);
-      members.push(member);
-      if (logging) log2(printable(`[flow-files] flow ${member.canonical}: ${sent}`));
+      emit(member, sent);
       if (text2 !== void 0 && file2.hop + 1 < MAX_RUN_DEPTH) {
         queue.push({ canonical: member.canonical, text: text2, hop: file2.hop + 1 });
       }
     }
   }
+  if (snapshots.size > 0) {
+    const flowName = path5.basename(rootPath, ".yaml");
+    await collectBaselineMembers(
+      canonical,
+      flowName,
+      [...snapshots],
+      args,
+      roots,
+      budget,
+      opts,
+      seen,
+      emit
+    );
+  }
   return { canonical, spelling, members };
 }
 
@@ -24999,7 +25224,20 @@ async function consumeToolStream(name, body, onProgress, signal) {
     }
   };
   const decoder = new TextDecoder();
-  let buffered = "";
+  let pieces = [];
+  const take = (text2) => {
+    let start = 0;
+    let newline;
+    while ((newline = text2.indexOf("\n", start)) !== -1) {
+      signal?.throwIfAborted();
+      pieces.push(text2.slice(start, newline));
+      const line = pieces.join("");
+      pieces = [];
+      start = newline + 1;
+      handleLine(line);
+    }
+    if (start < text2.length) pieces.push(text2.slice(start));
+  };
   try {
     for (; ; ) {
       let chunk;
@@ -25011,17 +25249,11 @@ async function consumeToolStream(name, body, onProgress, signal) {
       }
       const { done, value } = chunk;
       if (done) break;
-      buffered += decoder.decode(value, { stream: true });
-      let newline;
-      while ((newline = buffered.indexOf("\n")) !== -1) {
-        signal?.throwIfAborted();
-        const line = buffered.slice(0, newline);
-        buffered = buffered.slice(newline + 1);
-        handleLine(line);
-      }
+      take(decoder.decode(value, { stream: true }));
     }
-    buffered += decoder.decode();
-    if (buffered.trim()) handleLine(buffered);
+    take(decoder.decode());
+    const last = pieces.join("");
+    if (last.trim()) handleLine(last);
   } catch (err) {
     void reader.cancel().catch(() => {
     });
@@ -25031,8 +25263,7 @@ async function consumeToolStream(name, body, onProgress, signal) {
   if (!final) {
     throw brokenStream(name, "the stream ended without a result", progress);
   }
-  const { result: data } = await applyClientFileDirectives(final.data);
-  return { data, note: final.note };
+  return { data: final.data, note: final.note };
 }
 function errorBodyMessage(body) {
   if (Array.isArray(body.issues) && typeof body.message === "string") return body.message;
@@ -25120,17 +25351,31 @@ function createToolsClient(options = {}) {
     opts?.signal?.throwIfAborted();
     const { url: url2, token, remote } = await route();
     let finalArgs = args;
-    const meta3 = await fetchTool(name, { signal: opts?.signal });
+    const tools2 = await fetchTools({ signal: opts?.signal });
+    const meta3 = tools2.find((t2) => t2.name === name) ?? null;
+    const baselineDirs = [];
     if (meta3?.fileInputs?.length) {
       if (remote) assertRequiredPresent(meta3, args);
       finalArgs = await prepareFileInputs(meta3.fileInputs, args ?? {}, {
         includeContent: remote,
         uploadEndpoint: remote ? { url: url2, token } : void 0,
         log: diagnose,
+        baselineDirs,
         collectMembers: collectFlowMembers,
+        toolFileInputs: (tool) => tools2.find((t2) => t2.name === tool)?.fileInputs,
         signal: opts?.signal
       });
     }
+    const settle = async (data) => {
+      const applied = await applyClientFileDirectives(data, { allowedDirs: baselineDirs });
+      for (const { path: file2, error: error52 } of applied.failed) {
+        diagnose(`The baseline ${file2} was not written on this client: ${error52}`);
+      }
+      if (process.env.ARGENT_FLOW_FILES_LOG === "1") {
+        for (const file2 of applied.written) diagnose(`[flow-files] baseline ${file2}: written`);
+      }
+      return applied.result;
+    };
     const stream = opts?.onProgress !== void 0 || carriesMembers(finalArgs);
     const sentOnce = carriesUpload(finalArgs);
     const res = await doFetch(
@@ -25162,7 +25407,11 @@ function createToolsClient(options = {}) {
         }),
         opts?.signal
       );
-      return { ...streamed, outputHint: meta3?.outputHint };
+      return {
+        data: await settle(streamed.data),
+        note: streamed.note,
+        outputHint: meta3?.outputHint
+      };
     }
     let json2;
     try {
@@ -25186,17 +25435,16 @@ function createToolsClient(options = {}) {
       });
     }
     opts?.signal?.throwIfAborted();
-    const { result: data } = await applyClientFileDirectives(json2.data);
-    return { data, note: json2.note, outputHint: meta3?.outputHint };
+    return { data: await settle(json2.data), note: json2.note, outputHint: meta3?.outputHint };
   }
   return { fetchTools, fetchTool, callTool, baseUrl };
 }
 
 // ../argent-tools-client/src/artifacts.ts
-import { copyFile, mkdir as mkdir4, readFile as readFile5, realpath as realpath3, rm as rm3, stat as stat4, writeFile as writeFile4 } from "node:fs/promises";
+import { copyFile, mkdir as mkdir4, readFile as readFile5, realpath as realpath4, rm as rm3, stat as stat4, writeFile as writeFile4 } from "node:fs/promises";
 import { constants as fsConstants } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { basename as basename6, dirname as dirname7, extname as extname2, isAbsolute as isAbsolute5, join as join11, normalize, resolve as resolve6, sep as sep4 } from "node:path";
+import { basename as basename6, dirname as dirname7, extname as extname2, isAbsolute as isAbsolute5, join as join11, normalize as normalize2, resolve as resolve6, sep as sep4 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
 
 // ../configuration-core/src/flags.ts
@@ -25935,8 +26183,8 @@ function durableBaseDir() {
   const projectRoot = findProjectRoot(process.cwd());
   return projectRoot ?? dirname7(argentHomeDir());
 }
-var ALLOWED_SAVE_DIRS = /* @__PURE__ */ new Set([normalize(".argent/recordings")]);
-var RECORDINGS_SAVE_DIR = normalize(".argent/recordings");
+var ALLOWED_SAVE_DIRS = /* @__PURE__ */ new Set([normalize2(".argent/recordings")]);
+var RECORDINGS_SAVE_DIR = normalize2(".argent/recordings");
 function configuredRecordingsDir() {
   let value;
   try {
@@ -25995,7 +26243,7 @@ async function writeDurableUnique(dir, filename, write) {
 }
 function durableSaveTarget(handle) {
   if (typeof handle.saveDir !== "string" || !handle.saveDir || handle.archive) return null;
-  const rel = normalize(handle.saveDir);
+  const rel = normalize2(handle.saveDir);
   if (isAbsolute5(rel) || rel === ".." || rel.startsWith(`..${sep4}`) || rel.split(sep4).includes("..")) {
     return null;
   }
@@ -26017,8 +26265,8 @@ function durableSaveTarget(handle) {
 }
 async function confineToRealBase(dir, base, rel) {
   try {
-    const realDir = await realpath3(dir);
-    const realBase = await realpath3(base);
+    const realDir = await realpath4(dir);
+    const realBase = await realpath4(base);
     return realDir === join11(realBase, rel);
   } catch {
     return false;
@@ -29700,7 +29948,7 @@ var _CI_VENDOR_COUNT_FOR_TEST = vendors_default.length;
 var SESSION_ID2 = randomUUID5();
 function readCliVersion() {
   if (true) {
-    return "0.27.1-next.20";
+    return "0.27.1-next.22";
   }
   return "0.0.0";
 }
@@ -31053,11 +31301,16 @@ counts the remaining flows skipped.
 
 The CLI sends a run to its tool-server: the local one that starts
 automatically, or the one that \`argent link\` or ARGENT_TOOLS_URL names. Over
-a link, the CLI uploads the flow file and the run: fragments that it reaches.
-The tool-server rejects the flow before the first step when the flow or a
-fragment has one of these steps:
-  - script: or snapshot:
-  - a tool: step that takes a file or records a flow
+a link, the CLI uploads the flow file, the run: fragments that it reaches and
+the snapshot baselines that the run compares. It also uploads each .png or
+.yaml file that a tool: step takes as a file argument by an absolute path. The
+CLI writes the new baselines that the run returns. The tool-server rejects the
+flow before the first step when the flow or a fragment has one of these steps:
+  - a script: step
+  - a tool: step that runs or records a flow
+  - a tool: step that takes a directory, an app or an output directory
+  - a tool: step whose tool builds a file path from several arguments
+  - a tool: step that names a relative path or a file other than .png or .yaml
 Without a link, all step kinds run.
 
 Subcommands:
@@ -31596,6 +31849,14 @@ function isFlowReport(data) {
   const steps = data?.steps;
   return Array.isArray(steps) && steps.every((step) => !!step && typeof step === "object");
 }
+function unwrittenBaselines(report) {
+  const writes = report.baselineWrites;
+  if (!Array.isArray(writes)) return [];
+  return writes.flatMap((write) => {
+    const { path: file2, error: error52 } = write ?? {};
+    return typeof file2 === "string" && typeof error52 === "string" ? [`${file2}: ${error52}`] : [];
+  });
+}
 async function runFlowDirectory(dir, args, projectRoot, options) {
   const printError = (message, err = message) => {
     console.error(args.json ? JSON.stringify(errorRecord(err, message)) : message);
@@ -31666,8 +31927,17 @@ async function runFlowDirectory(dir, args, projectRoot, options) {
       flowPath,
       baseUrl
     );
-    results.push({ path: rel, status: report.ok ? "pass" : "fail", report });
+    const unwritten = unwrittenBaselines(report);
+    results.push({ path: rel, status: report.ok && !unwritten.length ? "pass" : "fail", report });
     if (!report.ok) failures.push({ path: rel, ...summarizeFailure(report), rerun });
+    else if (unwritten.length) {
+      failures.push({
+        path: rel,
+        headline: "baselines not written",
+        detail: unwritten.join("\n"),
+        rerun
+      });
+    }
     if (!args.json) {
       for (const line of renderFailedSteps(report)) console.log(line);
       console.log(`  ${renderSummary(report, { withDevice: true })}`);
@@ -31928,7 +32198,12 @@ ${renderSummary(report, { withDevice: true })}`);
   } else {
     console.log(renderReport(report));
   }
-  return exitAfterFlush(report.ok ? 0 : 1);
+  const unwritten = unwrittenBaselines(report);
+  if (!args.json && !args.jsonStream) {
+    for (const line of unwritten)
+      console.log(`  ${STATUS_GLYPH.error} baseline not written: ${line}`);
+  }
+  return exitAfterFlush(report.ok && unwritten.length === 0 ? 0 : 1);
 }
 
 // ../argent-cli/src/tools.ts