@the-open-engine/zeroshot 6.27.0 → 6.29.0

package/lib/target/target-session.js

@@ -0,0 +1,163 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LoginRequiredError = void 0;
+exports.targetLogin = targetLogin;
+exports.refreshAccessToken = refreshAccessToken;
+exports.getAccessTokenProvider = getAccessTokenProvider;
+exports.revokeAndCleanup = revokeAndCleanup;
+const device_flow_ts_1 = require("./device-flow.js");
+const credential_store_ts_1 = require("./credential-store.js");
+const target_registry_ts_1 = require("./target-registry.js");
+class LoginRequiredError extends Error {
+    targetName;
+    constructor(targetName) {
+        super(`Login required. Run: zeroshot target login ${targetName}`);
+        this.name = 'LoginRequiredError';
+        this.targetName = targetName;
+    }
+}
+exports.LoginRequiredError = LoginRequiredError;
+async function targetLogin(targetName, target, credentialStore, acquireLock, settings, deps) {
+    const { http, clock, browserOpener, stderr, discoveryEndpoints } = deps;
+    const { deviceAuthorizationEndpoint, tokenEndpoint, clientId } = discoveryEndpoints;
+    const codeResponse = await (0, device_flow_ts_1.requestDeviceCode)(deviceAuthorizationEndpoint, clientId, http);
+    stderr.write(`\nOpen this URL to authorize:\n  ${codeResponse.verification_uri}\n\nEnter code: ${codeResponse.user_code}\n\n`);
+    if (codeResponse.verification_uri_complete) {
+        try {
+            await browserOpener.open(codeResponse.verification_uri_complete);
+        }
+        catch {
+            // Browser open is best-effort
+        }
+    }
+    const tokenResponse = await (0, device_flow_ts_1.pollForToken)(tokenEndpoint, clientId, codeResponse.device_code, codeResponse.interval, codeResponse.expires_in, http, clock, undefined, { token: target.deviceToken, label: 'Zeroshot CLI' });
+    if (!tokenResponse.organization) {
+        throw new device_flow_ts_1.UnboundSessionError(codeResponse.verification_uri);
+    }
+    const serviceKey = (0, credential_store_ts_1.targetServiceKey)(target.id);
+    const release = await acquireLock();
+    try {
+        await credentialStore.set(serviceKey, credential_store_ts_1.TARGET_ACCOUNT, tokenResponse.refresh_token);
+    }
+    finally {
+        await release();
+    }
+    (0, target_registry_ts_1.updateTargetOrganization)(targetName, tokenResponse.organization, settings);
+    return { organization: tokenResponse.organization };
+}
+async function refreshAccessToken(targetName, target, credentialStore, acquireLock, deps) {
+    const { http, discoveryEndpoints } = deps;
+    const { tokenEndpoint, revocationEndpoint, clientId } = discoveryEndpoints;
+    const serviceKey = (0, credential_store_ts_1.targetServiceKey)(target.id);
+    const release = await acquireLock();
+    try {
+        const currentRefreshToken = await credentialStore.get(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
+        if (!currentRefreshToken) {
+            throw new LoginRequiredError(targetName);
+        }
+        const body = new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: currentRefreshToken,
+            client_id: clientId,
+            audience: 'capsule',
+        });
+        let tokenResponse;
+        const response = await http.fetch(tokenEndpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+            redirect: 'error',
+        });
+        if (!response.ok) {
+            const errorBody = (await response.json().catch(() => ({ error: 'unknown' })));
+            if (errorBody.error === 'invalid_grant') {
+                await credentialStore.delete(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
+                throw new LoginRequiredError(targetName);
+            }
+            throw new Error(`Token refresh failed (${response.status}): ${errorBody.error}`);
+        }
+        tokenResponse = (await response.json());
+        try {
+            await credentialStore.set(serviceKey, credential_store_ts_1.TARGET_ACCOUNT, tokenResponse.refresh_token);
+        }
+        catch {
+            await bestEffortRevoke(tokenResponse.refresh_token, revocationEndpoint, clientId, http);
+            await credentialStore.delete(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
+            throw new LoginRequiredError(targetName);
+        }
+        return { accessToken: tokenResponse.access_token, expiresIn: tokenResponse.expires_in };
+    }
+    finally {
+        await release();
+    }
+}
+async function bestEffortRevoke(token, revocationEndpoint, clientId, http) {
+    if (!revocationEndpoint)
+        return;
+    try {
+        const body = new URLSearchParams({
+            token,
+            client_id: clientId,
+            token_type_hint: 'refresh_token',
+        });
+        await http.fetch(revocationEndpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+            redirect: 'error',
+        });
+    }
+    catch {
+        // Best-effort
+    }
+}
+function getAccessTokenProvider(targetName, target, credentialStore, acquireLock, deps, clock = { now: () => Date.now() }) {
+    let cachedToken = null;
+    let expiresAt = 0;
+    return {
+        async getAccessToken(_signal) {
+            if (cachedToken && clock.now() < expiresAt - 30_000) {
+                return cachedToken;
+            }
+            const result = await refreshAccessToken(targetName, target, credentialStore, acquireLock, deps);
+            cachedToken = result.accessToken;
+            expiresAt = clock.now() + result.expiresIn * 1000;
+            return result.accessToken;
+        },
+    };
+}
+async function revokeAndCleanup(target, credentialStore, acquireLock, deps, force) {
+    const { http, discoveryEndpoints } = deps;
+    const { revocationEndpoint, clientId } = discoveryEndpoints;
+    const serviceKey = (0, credential_store_ts_1.targetServiceKey)(target.id);
+    const release = await acquireLock();
+    try {
+        const refreshToken = await credentialStore.get(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
+        if (refreshToken && revocationEndpoint) {
+            const body = new URLSearchParams({
+                token: refreshToken,
+                client_id: clientId,
+                token_type_hint: 'refresh_token',
+            });
+            try {
+                const response = await http.fetch(revocationEndpoint, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                    body: body.toString(),
+                    redirect: 'error',
+                });
+                if (!response.ok && !force) {
+                    throw new Error(`Remote revocation failed (${response.status}). Use --force to remove anyway.`);
+                }
+            }
+            catch (err) {
+                if (!force)
+                    throw err;
+            }
+        }
+        await credentialStore.delete(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
+    }
+    finally {
+        await release();
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-open-engine/zeroshot",
-  "version": "6.27.0",
+  "version": "6.29.0",
   "description": "Multi-agent orchestration engine for Claude, Codex, and Gemini",
   "main": "src/orchestrator.js",
   "bin": {
@@ -29,7 +29,7 @@
     ]
   },
   "scripts": {
-    "pretest": "npm run build:agent-cli-provider",
+    "pretest": "npm run build:agent-cli-provider && npm run build:target",
     "test": "node tests/run-tests.js",
     "test:unit": "node tests/run-tests.js",
     "test:e2e": "mocha 'tests/e2e/**/*.test.js' --timeout 120000",
@@ -40,14 +40,17 @@
     "test:coverage:report": "c8 --reporter=html npm run test:unit && echo 'Coverage report generated at coverage/index.html'",
     "postinstall": "node scripts/fix-node-pty-permissions.js && node scripts/check-path.js",
     "start": "node cli/index.js",
-    "typecheck": "tsc --noEmit && npm run typecheck:cluster && npm run typecheck:hosted-target && npm run typecheck:hosted-session",
+    "typecheck": "tsc --noEmit && npm run typecheck:cluster && npm run typecheck:hosted-target && npm run typecheck:hosted-session && npm run typecheck:target",
     "typecheck:agent-cli-provider": "tsc --project tsconfig.agent-cli-provider.json",
     "typecheck:hosted-target": "tsc --project tsconfig.hosted-target.json",
     "typecheck:hosted-session": "tsc --project tsconfig.hosted-session.json",
     "test:hosted-target": "node --test tests/hosted-target/*.test.ts",
+    "test:target": "npm run build:agent-cli-provider && npm run build:target && node --test tests/target/*.test.ts",
+    "typecheck:target": "tsc --project tsconfig.target.json",
     "typecheck:cluster": "tsc --project tsconfig.cluster.json",
     "lint:agent-cli-provider": "eslint \"src/agent-cli-provider/**/*.ts\" \"tests/agent-cli-provider/**/*.ts\"",
     "build:agent-cli-provider": "tsc --project tsconfig.agent-cli-provider.build.json",
+    "build:target": "tsc --project tsconfig.target.build.json",
     "build:cluster": "npm run protocol:generate && tsc --project tsconfig.cluster.cjs.json && tsc --project tsconfig.cluster.esm.json && tsc --project tsconfig.hosted-session.cjs.json && tsc --project tsconfig.hosted-session.esm.json && node scripts/build-cluster.js",
     "test:agent-cli-provider": "node --test tests/agent-cli-provider/*.test.js",
     "test:omp": "npm run build:agent-cli-provider && node --test tests/agent-cli-provider/omp-*.test.js && node tests/run-tests.js tests/omp-rpc-watcher.test.js tests/omp-isolation-capability.test.js tests/omp-docker-auth.test.js tests/omp-docker-fresh-only.test.js",
@@ -55,8 +58,17 @@
     "check:agent-cli-provider": "npm run check:agent-cli-provider:ci",
     "check:agent-cli-provider:ci": "npm run typecheck:agent-cli-provider && npm run lint:agent-cli-provider && npm run build:agent-cli-provider && npm run test:agent-cli-provider",
     "test:cluster-client": "npm run build:cluster && node --test tests/cluster/client.test.js tests/cluster/parity.test.js tests/cluster/architecture.test.js tests/cluster/verifier-regressions.test.js tests/cluster/request-validation.test.js tests/hosted-session/coordinator.test.js",
-    "test:cluster-package": "npm run build:agent-cli-provider && npm run build:cluster && node --test tests/cluster/package.test.js",
+    "test:cluster-package": "npm run build:agent-cli-provider && npm run build:cluster && npm run build:target && node --test tests/cluster/package.test.js",
     "dev:link": "npm link",
+    "opcore:status": "opcore status --repo . --json",
+    "opcore:scan": "opcore --repo . --json",
+    "opcore:check": "node scripts/opcore-introduced-check.js",
+    "opcore:check:staged": "node scripts/opcore-introduced-check.js --staged",
+    "opcore:install:rust-metrics": "cargo install rust-code-analysis-cli --version 0.0.25 --locked",
+    "opcore:graph:build": "opcore graph build --repo . --json",
+    "opcore:graph:update": "opcore graph update --repo . --json",
+    "opcore:measure": "opcore measure --repo . --json",
+    "audit:production": "node scripts/audit-production-dependencies.js",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "validate:templates": "node scripts/validate-templates.js",
@@ -77,9 +89,9 @@
     "release:preflight": "node scripts/release-preflight.js",
     "release:recover": "node scripts/release-recovery.js",
     "release:assert-published": "node scripts/assert-release-published.js",
-    "prepack": "npm run build:cluster",
+    "prepack": "npm run build:cluster && npm run build:target",
     "prepublishOnly": "npm run lint && npm run typecheck && npm run check:agent-cli-provider:ci",
-    "prepare": "npm run build:agent-cli-provider && husky"
+    "prepare": "npm run build:agent-cli-provider && npm run build:target && husky"
   },
   "c8": {
     "reporter": [
@@ -119,7 +131,7 @@
     "url": "https://github.com/the-open-engine/zeroshot/issues"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=22.0.0"
   },
   "publishConfig": {
     "access": "public",
@@ -145,6 +157,9 @@
   "files": [
     "src/",
     "lib/",
+    "!src/target/register-hosted-commands.ts",
+    "!lib/target/register-hosted-commands.js",
+    "!lib/target/register-hosted-commands.d.ts",
     "bin/",
     "cli/",
     "task-lib/",
@@ -166,10 +181,12 @@
     "commander": "^14.0.2",
     "node-pty": "^1.1.0",
     "omelette": "^0.4.17",
+    "open": "^10.1.0",
     "pidusage": "^4.0.1",
     "proper-lockfile": "^4.1.2"
   },
   "optionalDependencies": {
+    "@napi-rs/keyring": "^1.1.6",
     "ws": "^8.18.3"
   },
   "devDependencies": {
@@ -191,6 +208,7 @@
     "jscpd": "^3.5.10",
     "lint-staged": "^16.2.7",
     "mocha": "^11.7.5",
+    "opcore": "0.2.1",
     "prettier": "^3.7.4",
     "semantic-release": "^25.0.2",
     "sinon": "^21.0.0",

package/scripts/audit-production-dependencies.js

@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+'use strict';
+
+const { spawnSync } = require('node:child_process');
+
+const severityRank = new Map([
+  ['info', 0],
+  ['low', 1],
+  ['moderate', 2],
+  ['high', 3],
+  ['critical', 4],
+]);
+const approvedLeafAdvisories = new Map([
+  ['brace-expansion', new Set(['1123898', '1130591'])],
+  ['smol-toml', new Set(['1115393'])],
+]);
+const approvedLeafPaths = new Map([
+  ['brace-expansion', 'node_modules/opcore/node_modules/brace-expansion'],
+  ['smol-toml', 'node_modules/opcore/node_modules/smol-toml'],
+]);
+const approvedVersions = new Map([
+  ['node_modules/opcore', '0.2.1'],
+  ['node_modules/opcore/node_modules/brace-expansion', '5.0.6'],
+  ['node_modules/opcore/node_modules/smol-toml', '1.6.0'],
+]);
+
+function isRelevant(vulnerability) {
+  return (severityRank.get(vulnerability.severity) ?? Number.POSITIVE_INFINITY) >= 2;
+}
+
+function hasExpectedNodes(name, vulnerability) {
+  const nodes = vulnerability.nodes;
+  if (!Array.isArray(nodes) || nodes.length === 0) return false;
+  const leafPath = approvedLeafPaths.get(name);
+  if (leafPath !== undefined) return nodes.length === 1 && nodes[0] === leafPath;
+  if (name === 'opcore') return nodes.length === 1 && nodes[0] === 'node_modules/opcore';
+  return nodes.every((node) => node.startsWith('node_modules/opcore/node_modules/'));
+}
+
+function isApprovedLeaf(name, vulnerability) {
+  const approvedSources = approvedLeafAdvisories.get(name);
+  if (approvedSources === undefined || !hasExpectedNodes(name, vulnerability)) return false;
+  if (!Array.isArray(vulnerability.via) || vulnerability.via.length === 0) return false;
+  return vulnerability.via.every(
+    (advisory) =>
+      advisory !== null &&
+      typeof advisory === 'object' &&
+      approvedSources.has(String(advisory.source))
+  );
+}
+
+function isApprovedVulnerability(name, vulnerabilities, memo, active) {
+  if (memo.has(name)) return memo.get(name);
+  if (active.has(name)) return false;
+  const vulnerability = vulnerabilities[name];
+  if (vulnerability === undefined || !hasExpectedNodes(name, vulnerability)) return false;
+  if (isApprovedLeaf(name, vulnerability)) {
+    memo.set(name, true);
+    return true;
+  }
+  if (!Array.isArray(vulnerability.via) || vulnerability.via.length === 0) return false;
+  if (!vulnerability.via.every((dependency) => typeof dependency === 'string')) return false;
+
+  active.add(name);
+  const approved = vulnerability.via.every((dependency) =>
+    isApprovedVulnerability(dependency, vulnerabilities, memo, active)
+  );
+  active.delete(name);
+  memo.set(name, approved);
+  return approved;
+}
+
+function exceptionVersionsMatch(lock) {
+  if (lock?.packages?.['']?.dependencies?.opcore !== '0.2.1') return false;
+  return Array.from(approvedVersions).every(
+    ([packagePath, version]) => lock?.packages?.[packagePath]?.version === version
+  );
+}
+
+function evaluateAudit(payload, lock) {
+  if (payload === null || typeof payload !== 'object' || payload.error !== undefined) {
+    throw new Error('npm audit did not return a valid vulnerability report');
+  }
+  const vulnerabilities = payload.vulnerabilities;
+  if (vulnerabilities === null || typeof vulnerabilities !== 'object') {
+    throw new Error('npm audit report is missing vulnerabilities');
+  }
+
+  const relevant = Object.entries(vulnerabilities).filter(([, vulnerability]) =>
+    isRelevant(vulnerability)
+  );
+  const memo = new Map();
+  const allowed = relevant.filter(([name]) =>
+    isApprovedVulnerability(name, vulnerabilities, memo, new Set())
+  );
+  if (allowed.length > 0 && !exceptionVersionsMatch(lock)) {
+    return { allowed: [], blocked: relevant, versionMismatch: true };
+  }
+  const allowedNames = new Set(allowed.map(([name]) => name));
+  return {
+    allowed,
+    blocked: relevant.filter(([name]) => !allowedNames.has(name)),
+    versionMismatch: false,
+  };
+}
+
+function runAudit() {
+  const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+  const result = spawnSync(npm, ['audit', '--audit-level=moderate', '--omit=dev', '--json'], {
+    encoding: 'utf8',
+    maxBuffer: 16 * 1024 * 1024,
+  });
+  if (result.error) throw result.error;
+
+  let payload;
+  try {
+    payload = JSON.parse(result.stdout);
+  } catch {
+    throw new Error(
+      result.stderr || result.stdout || `npm audit exited with status ${result.status}`
+    );
+  }
+  const lock = require('../package-lock.json');
+  return evaluateAudit(payload, lock);
+}
+
+function main() {
+  const result = runAudit();
+  if (result.blocked.length > 0) {
+    const suffix = result.versionMismatch ? ' (Opcore exception version mismatch)' : '';
+    console.error(
+      `Production dependency audit failed${suffix}: ${result.blocked.map(([name]) => name).join(', ')}`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (result.allowed.length > 0) {
+    console.warn(
+      `Production dependency audit passed with pinned Opcore advisories: ${result.allowed
+        .map(([name]) => name)
+        .join(', ')}`
+    );
+    return;
+  }
+  console.log('Production dependency audit passed');
+}
+
+if (require.main === module) main();
+
+module.exports = { evaluateAudit };

package/scripts/opcore-agent-gate.js

@@ -0,0 +1,159 @@
+#!/usr/bin/env node
+
+const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { extractToolRequest, isRecord, overlaysForTool } = require('./opcore-agent-tool-overlays');
+
+const validationTimeoutMs = 120_000;
+const maxFeedbackChars = 4000;
+const preWriteChecks = [
+  'typescript.syntax',
+  'typescript.types',
+  'typescript.lint',
+  'typescript.function-metrics',
+  'typescript.file-length',
+  'rust.source-hygiene',
+  'rust.fmt',
+  'rust.file-length',
+  'rust.function-metrics',
+  'docs.staleness',
+  'docs.freshness',
+  'docs.length',
+  'docs.dry',
+  'docs.content-quality',
+  'docs.code-blocks',
+  'docs.rules-why',
+];
+
+function parseArgs(argv) {
+  const args = { harness: 'unknown' };
+  let index = 0;
+  while (index < argv.length) {
+    const arg = argv[index];
+    const next = argv[index + 1];
+    if (arg === '--harness') args.harness = next || 'unknown';
+    else if (arg.startsWith('--harness=')) args.harness = arg.slice('--harness='.length);
+    else if (arg === '--repo') args.repo = next;
+    else if (arg.startsWith('--repo=')) args.repo = arg.slice('--repo='.length);
+    index += arg === '--harness' || arg === '--repo' ? 2 : 1;
+  }
+  return args;
+}
+
+function resolveRepoRoot(explicitRepo, cwd) {
+  if (explicitRepo) return path.resolve(explicitRepo);
+  const start = path.resolve(cwd || process.cwd());
+  const result = spawnSync('git', ['rev-parse', '--show-toplevel'], {
+    cwd: start,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'ignore'],
+  });
+  return result.status === 0 && result.stdout.trim() ? path.resolve(result.stdout.trim()) : start;
+}
+
+function runValidation(request) {
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'zeroshot-opcore-prewrite-'));
+  const requestPath = path.join(tempDir, 'validation-request.json');
+  try {
+    fs.writeFileSync(requestPath, `${JSON.stringify(request)}\n`);
+    const opcoreEntrypoint = require.resolve('opcore');
+    const result = spawnSync(
+      process.execPath,
+      [
+        opcoreEntrypoint,
+        'validate',
+        'pre-write',
+        '--request-file',
+        requestPath,
+        '--timeout-ms',
+        String(validationTimeoutMs),
+        '--json',
+      ],
+      {
+        cwd: request.repo.repoRoot,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+      }
+    );
+    if (result.error) throw result.error;
+    const payload = JSON.parse((result.stdout || '').trim());
+    if (!payload.receipt) {
+      throw new Error(result.stderr || result.stdout || `Opcore exited ${result.status}`);
+    }
+    return payload.receipt;
+  } finally {
+    fs.rmSync(tempDir, { recursive: true, force: true });
+  }
+}
+
+function feedback(toolName, receipt) {
+  const summary = receipt.failureSummary?.message || 'Pre-write validation failed';
+  const checks = receipt.checks?.length ? ` checks=${receipt.checks.join(',')}` : '';
+  const paths = receipt.overlays?.paths?.length ? ` paths=${receipt.overlays.paths.join(',')}` : '';
+  const message = `Opcore write gate blocked ${toolName}: ${summary} status=${receipt.validationStatus}${checks}${paths}\n`;
+  return message.length <= maxFeedbackChars
+    ? message
+    : `${message.slice(0, maxFeedbackChars - 15).trimEnd()} [truncated]\n`;
+}
+
+async function readStdin() {
+  let input = '';
+  for await (const chunk of process.stdin) input += chunk.toString();
+  return input;
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  let mapped;
+  try {
+    const raw = await readStdin();
+    if (!raw.trim()) return 0;
+    const envelope = JSON.parse(raw);
+    if (!isRecord(envelope)) throw new Error('hook payload must be a JSON object');
+    const tool = extractToolRequest(envelope);
+    if (!tool) return 0;
+    const repoRoot = resolveRepoRoot(args.repo, tool.cwd);
+    const overlays = await overlaysForTool(repoRoot, tool);
+    if (overlays.length === 0) return 0;
+    mapped = {
+      toolName: tool.toolName,
+      request: {
+        requestId: `zeroshot-opcore-agent-gate-${Date.now()}`,
+        repo: { repoRoot },
+        scope: { kind: 'files', files: overlays.map((overlay) => overlay.path) },
+        graph: { mode: 'optional', provider: 'opcore-graph' },
+        overlays,
+        checks: preWriteChecks,
+        reportMode: 'introduced',
+      },
+    };
+  } catch (error) {
+    process.stderr.write(
+      `Opcore write gate skipped: ${error instanceof Error ? error.message : String(error)}\n`
+    );
+    return 0;
+  }
+
+  try {
+    const receipt = runValidation(mapped.request);
+    if (receipt.ok) return 0;
+    process.stderr.write(feedback(mapped.toolName, receipt));
+    return 2;
+  } catch (error) {
+    process.stderr.write(
+      `Opcore write gate blocked ${mapped.toolName}: validation command failed: ${error instanceof Error ? error.message : String(error)}\n`
+    );
+    return 2;
+  }
+}
+
+main()
+  .then((exitCode) => {
+    process.exitCode = exitCode;
+  })
+  .catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 2;
+  });