@tryarcanist/cli 0.1.132 → 0.1.134

package/README.md

@@ -131,7 +131,7 @@ arcanist sessions create your-org/your-repo "retry-safe create" --idempotency-ke
 
 `--backend` picks the agent runtime backend: `codex` (default) or `claude_code`. `--model` must be valid for the chosen backend — codex runs OpenAI models (`gpt-5.4` default, `gpt-5.5`), `claude_code` runs Anthropic models (`claude-opus-4-8` default, `claude-sonnet-4-6`) — and the CLI rejects a mismatch before any network call. `claude_code` sessions require an Anthropic API key configured in Settings.
 
-`--wait` blocks until the created prompt finishes and exits non-zero if the prompt finishes with `status: failed`, making it suitable for cron or other schedulers that alert on command failure. `--poll-interval <ms>` tunes the completion check frequency.
+`--wait` blocks until the created prompt finishes, prints the resulting PR/branch line in human-readable mode when it is already available, and exits non-zero if the prompt finishes with `status: failed`, making it suitable for cron or other schedulers that alert on command failure. `--poll-interval <ms>` tunes the completion check frequency.
 
 Use `--base-branch <branch>` to target a non-default base branch. The CLI only validates that the branch value is non-empty; branch existence is checked later by the session runtime.
 
@@ -176,6 +176,8 @@ arcanist sessions get abc123
 arcanist sessions get abc123 --json
 ```
 
+Human-readable output includes `PR: <url> (<branch>)` when the session has opened a PR, or `Branch: <branch>` when a produced branch is known but no PR URL is present yet. If publishing is still settling, rerun `sessions get`; JSON mode returns the raw session payload, with result fields at `.session.prUrl`, `.session.publishedBranch`, and `.session.lastBranch`.
+
 ### `arcanist sessions list`
 
 ```bash
@@ -324,6 +326,18 @@ arcanist sessions create your-org/your-repo "verify the new rate limiter is acti
 
 For cron, prefer `ARCANIST_TOKEN` or a logged-in `~/.arcanist/config.json` over passing `--token` on the command line.
 
+To capture the PR URL after a successful run, use `create --wait` for the exit code, then read the session state:
+
+```bash
+SESSION_ID=$(arcanist sessions create your-org/your-repo "fix the flaky test" --wait --json | jq -r .sessionId)
+for _ in {1..20}; do
+  PR_URL=$(arcanist sessions get "$SESSION_ID" --json | jq -r '.session.prUrl // empty')
+  [ -n "$PR_URL" ] && break
+  sleep 5
+done
+[ -n "$PR_URL" ] || { echo "PR URL not ready for $SESSION_ID" >&2; exit 1; }
+```
+
 ## Troubleshooting
 
 - **401 on login verification**: token may be invalid or expired. Regenerate in **Settings > CLI Tokens**.

package/dist/index.js

@@ -1023,22 +1023,6 @@ function noChangeOutcomeCopy(reason) {
   }
 }
 
-// ../../shared/session/transient-disconnect.ts
-var TRANSIENT_DISCONNECT_VISIBILITY_MS = 15e3;
-function nextDisconnectMask(mask, previous, current, now) {
-  if (!current || current.sandboxSubstate !== "reconnecting") return null;
-  if (mask) return mask;
-  if (!previous || previous.sandboxSubstate === "reconnecting") return null;
-  return { since: now, heldPhase: previous.phase, heldSubstate: previous.sandboxSubstate ?? "none" };
-}
-function isDisconnectMaskActive(mask, now) {
-  return mask !== null && now - mask.since < TRANSIENT_DISCONNECT_VISIBILITY_MS;
-}
-function applyDisconnectMask(view, mask, now) {
-  if (!isDisconnectMaskActive(mask, now)) return view;
-  return { ...view, phase: mask.heldPhase, sandboxSubstate: mask.heldSubstate };
-}
-
 // ../../shared/transcript/malformed-search.ts
 var MALFORMED_SEARCH_BLOCKED_TRANSCRIPT_PREFIX = "Arcanist blocked this malformed search command before execution.";
 var BASH_UNMATCHED_QUOTE_EOF_RE = /\/bin\/bash:\s+-c:\s+line\s+\d+:\s+unexpected EOF while looking for matching [`'"][`'"]?/i;
@@ -2063,6 +2047,23 @@ ${event.answer ? `**Answer:** ${event.answer}
 function formatNumber(value) {
   return value.toLocaleString();
 }
+function stringField(value) {
+  return typeof value === "string" && value.trim() ? value : null;
+}
+function formatSessionResult(session) {
+  const prUrl = stringField(session.prUrl);
+  const publishedBranch = stringField(session.publishedBranch);
+  const lastBranch = stringField(session.lastBranch);
+  const baseBranch = stringField(session.baseBranch);
+  const branch = publishedBranch ?? (lastBranch && lastBranch !== baseBranch ? lastBranch : null);
+  if (prUrl) {
+    return `PR: ${prUrl}${branch ? ` (${branch})` : ""}`;
+  }
+  if (branch) {
+    return `Branch: ${branch}`;
+  }
+  return null;
+}
 function latestCompletedPromptResult(prompts) {
   for (let i = prompts.length - 1; i >= 0; i--) {
     if (prompts[i].status === "completed") return prompts[i].result;
@@ -2314,6 +2315,22 @@ function renderWatchEvent(event, state) {
   }
 }
 
+// ../../shared/session/transient-disconnect.ts
+var TRANSIENT_DISCONNECT_VISIBILITY_MS = 15e3;
+function nextDisconnectMask(mask, previous, current, now) {
+  if (!current || current.sandboxSubstate !== "reconnecting") return null;
+  if (mask) return mask;
+  if (!previous || previous.sandboxSubstate === "reconnecting") return null;
+  return { since: now, heldPhase: previous.phase, heldSubstate: previous.sandboxSubstate ?? "none" };
+}
+function isDisconnectMaskActive(mask, now) {
+  return mask !== null && now - mask.since < TRANSIENT_DISCONNECT_VISIBILITY_MS;
+}
+function applyDisconnectMask(view, mask, now) {
+  if (!isDisconnectMaskActive(mask, now)) return view;
+  return { ...view, phase: mask.heldPhase, sandboxSubstate: mask.heldSubstate };
+}
+
 // src/commands/watch.ts
 function parsePollInterval(raw) {
   if (!raw) return DEFAULT_WATCH_POLL_INTERVAL_MS;
@@ -2621,6 +2638,15 @@ async function createCommand(repoUrl, promptArg, options, command) {
       if (sessionData.sessionUrl) console.log(`URL: ${sessionData.sessionUrl}`);
     }
     await waitForCreatedPrompt(sessionId, promptId, sessionData.sessionUrl, waitPollIntervalMs, runtime, command);
+    if (!isJson(command, options)) {
+      try {
+        const sessionPayload = await apiFetch(config, `/api/sessions/${sessionId}`);
+        const sessionState = sessionPayload.session && typeof sessionPayload.session === "object" ? sessionPayload.session : sessionPayload;
+        const resultLine = formatSessionResult(sessionState);
+        if (resultLine) console.log(resultLine);
+      } catch {
+      }
+    }
   }
   if (isJson(command, options)) {
     const output = { sessionId };
@@ -2640,6 +2666,155 @@ async function createCommand(repoUrl, promptArg, options, command) {
   if (sessionData.sessionUrl) console.log(`URL: ${sessionData.sessionUrl}`);
 }
 
+// src/commands/egress.ts
+import { readFileSync as readFileSync2 } from "fs";
+
+// ../../shared/types/business-egress-policy.ts
+var MAX_BUSINESS_EGRESS_DOMAINS = 100;
+var MAX_DOMAIN_LENGTH = 253;
+function normalizeEgressDomains(entries, key = "egressAllowlist") {
+  const unique = [...new Set(entries.map((entry) => entry.trim().toLowerCase()).filter(Boolean))].sort();
+  if (unique.length > MAX_BUSINESS_EGRESS_DOMAINS) {
+    throw new Error(`${key} must contain at most ${MAX_BUSINESS_EGRESS_DOMAINS} domain names`);
+  }
+  for (const entry of unique) {
+    assertValidEgressDomain(entry, key);
+  }
+  return unique;
+}
+function assertValidEgressDomain(value, key = "egressAllowlist") {
+  if (value.includes("*") || value.startsWith(".") || value.endsWith(".") || value.includes("/") || value.includes(":")) {
+    throw new Error(`${key} entries must be exact domain names`);
+  }
+  if (value.length > MAX_DOMAIN_LENGTH) {
+    throw new Error(`${key} entries must be exact domain names`);
+  }
+  const labels = value.split(".");
+  if (labels.length === 4 && labels.every((label) => /^\d+$/.test(label) && Number(label) >= 0 && Number(label) <= 255)) {
+    throw new Error(`${key} entries must be exact domain names`);
+  }
+  if (labels.length < 2 || labels.some(
+    (label) => label.length < 1 || label.length > 63 || !/^[a-z0-9-]+$/.test(label) || label.startsWith("-") || label.endsWith("-")
+  )) {
+    throw new Error(`${key} entries must be exact domain names`);
+  }
+}
+
+// ../../shared/egress-allowlist/parser.ts
+var EGRESS_ALLOWLIST_SOURCE_PATH = ".arcanist/egress-allowlist.txt";
+function parseEgressAllowlistSourceFile(content, key = EGRESS_ALLOWLIST_SOURCE_PATH) {
+  const domains = content.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  return normalizeEgressDomains(domains, key);
+}
+
+// src/commands/egress.ts
+function parseRepoArg(value) {
+  const trimmed = value.trim().replace(/^https:\/\/github\.com\//, "").replace(/\.git$/, "");
+  const [owner, repo, extra] = trimmed.split("/");
+  if (!owner || !repo || extra) throw new CliError("user", "repo must be owner/name or a GitHub URL");
+  return { owner, repo };
+}
+function encodePathSegment(value) {
+  return encodeURIComponent(value);
+}
+async function resolveBusinessId(config, options) {
+  if (options.business && options.business.trim()) return options.business.trim();
+  const whoami = await apiFetch(config, "/api/auth/whoami");
+  if (whoami.businessId && whoami.businessId.trim()) return whoami.businessId;
+  throw new CliError("user", "--business is required when the authenticated token has no business context.");
+}
+async function egressSourceSetCommand(sourceRepoArg, options = {}, command) {
+  const runtime = getRuntimeOptions(command, options);
+  const config = requireConfig(runtime);
+  const businessId = await resolveBusinessId(config, options);
+  const source = parseRepoArg(sourceRepoArg);
+  const payload = await apiFetch(
+    config,
+    `/api/businesses/${encodePathSegment(businessId)}/egress-allowlist/source`,
+    {
+      method: "PUT",
+      body: JSON.stringify({ sourceRepoOwner: source.owner, sourceRepoName: source.repo })
+    }
+  );
+  if (isJson(command, options)) {
+    writeJson(payload);
+    return;
+  }
+  console.log(`Set egress allowlist source to ${source.owner}/${source.repo}:${EGRESS_ALLOWLIST_SOURCE_PATH}.`);
+}
+async function egressSourceGetCommand(options = {}, command) {
+  const runtime = getRuntimeOptions(command, options);
+  const config = requireConfig(runtime);
+  const businessId = await resolveBusinessId(config, options);
+  const payload = await apiFetch(
+    config,
+    `/api/businesses/${encodePathSegment(businessId)}/egress-allowlist/source`
+  );
+  if (isJson(command, options)) {
+    writeJson(payload);
+    return;
+  }
+  if (!payload.source) {
+    console.log("No egress allowlist source configured.");
+    return;
+  }
+  console.log(
+    `${payload.source.sourceRepoOwner}/${payload.source.sourceRepoName}:${payload.path} (${payload.defaultBranch ?? "default branch"})`
+  );
+  console.log(`${payload.domains.length} ${payload.domains.length === 1 ? "domain" : "domains"}.`);
+}
+async function egressAddCommand(domains, options = {}, command) {
+  const runtime = getRuntimeOptions(command, options);
+  const config = requireConfig(runtime);
+  const businessId = await resolveBusinessId(config, options);
+  const normalized = normalizeEgressDomains(domains, "domains");
+  const payload = await apiFetch(
+    config,
+    `/api/businesses/${encodePathSegment(businessId)}/egress-allowlist/pull-request`,
+    {
+      method: "POST",
+      body: JSON.stringify({ domains: normalized, ...options.reason ? { reason: options.reason } : {} })
+    }
+  );
+  if (isJson(command, options)) {
+    writeJson(payload);
+    return;
+  }
+  if (payload.status === "unchanged") {
+    console.log("All requested domains are already present in the source file.");
+    return;
+  }
+  console.log(`Egress allowlist PR ${payload.status}: ${payload.prUrl}`);
+  console.log(`Added: ${payload.addedDomains.join(", ")}`);
+}
+async function egressSyncCommand(options = {}, command) {
+  const runtime = getRuntimeOptions(command, options);
+  const config = requireConfig(runtime);
+  const businessId = await resolveBusinessId(config, options);
+  const payload = await apiFetch(
+    config,
+    `/api/businesses/${encodePathSegment(businessId)}/egress-allowlist/sync`,
+    { method: "POST" }
+  );
+  if (isJson(command, options)) {
+    writeJson(payload);
+    return;
+  }
+  console.log(
+    `Applied ${payload.egressAllowlist.length} egress allowlist domains from ${payload.source.sourceRepoOwner}/${payload.source.sourceRepoName}:${payload.path}.`
+  );
+}
+async function egressValidateCommand(path = EGRESS_ALLOWLIST_SOURCE_PATH, options = {}, command) {
+  const content = readFileSync2(path, "utf8");
+  const domains = parseEgressAllowlistSourceFile(content, path);
+  if (isJson(command, options)) {
+    writeJson({ ok: true, path, domains });
+    return;
+  }
+  console.log(`Valid egress allowlist: ${path}`);
+  console.log(`${domains.length} ${domains.length === 1 ? "domain" : "domains"}.`);
+}
+
 // src/commands/login.ts
 async function loginCommand(options, command) {
   const runtime = getRuntimeOptions(command, options);
@@ -2709,7 +2884,7 @@ async function messageCommand(sessionId, promptArg, options = {}, command) {
 
 // src/commands/sandbox.ts
 import { execFileSync } from "child_process";
-import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
 import { dirname } from "path";
 
 // ../../shared/sandbox-layer/parser.ts
@@ -3270,7 +3445,7 @@ function assertCleanAndPushed() {
 function assertManifestExists(path) {
   if (!existsSync(path)) throw new CliError("user", `Missing sandbox manifest: ${path}`);
 }
-function parseRepoArg(value, fallback) {
+function parseRepoArg2(value, fallback) {
   if (!value) return fallback();
   const parsed = parseGithubRepoFullName(value);
   if (!parsed) throw new CliError("user", "repo must be owner/name or a GitHub URL");
@@ -3279,10 +3454,10 @@ function parseRepoArg(value, fallback) {
 function repoPath(repo) {
   return `${repo.owner}/${repo.repo}`;
 }
-function encodePathSegment(value) {
+function encodePathSegment2(value) {
   return encodeURIComponent(value);
 }
-async function resolveBusinessId(config, options) {
+async function resolveBusinessId2(config, options) {
   if (options.business && options.business.trim()) return options.business.trim();
   const whoami = await apiFetch(config, "/api/auth/whoami");
   if (whoami.businessId && whoami.businessId.trim()) return whoami.businessId;
@@ -3421,7 +3596,7 @@ function buildLogsPath(businessId, buildId, options = {}) {
   if (options.afterSequence != null) params.set("afterSequence", String(options.afterSequence));
   if (options.limit != null) params.set("limit", String(options.limit));
   const suffix = params.toString() ? `?${params.toString()}` : "";
-  return `/api/businesses/${encodePathSegment(businessId)}/sandbox-layer/build-requests/${encodePathSegment(
+  return `/api/businesses/${encodePathSegment2(businessId)}/sandbox-layer/build-requests/${encodePathSegment2(
     buildId
   )}/logs${suffix}`;
 }
@@ -3438,7 +3613,7 @@ async function waitForBuild(config, businessId, buildId, options) {
     }
     const status = await apiFetch(
       config,
-      `/api/businesses/${encodePathSegment(businessId)}/sandbox-layer/build-requests/${encodePathSegment(buildId)}`
+      `/api/businesses/${encodePathSegment2(businessId)}/sandbox-layer/build-requests/${encodePathSegment2(buildId)}`
     );
     if (TERMINAL_BUILD_STATUSES.has(status.buildRequest.status)) {
       return status.buildRequest;
@@ -3527,12 +3702,12 @@ async function sandboxInitCommand(options = {}, command) {
 async function sandboxValidateCommand(options = {}, command) {
   const manifestPath = options.manifest ?? DEFAULT_MANIFEST_PATH;
   assertManifestExists(manifestPath);
-  const manifestText = readFileSync2(manifestPath, "utf8");
+  const manifestText = readFileSync3(manifestPath, "utf8");
   let layerPath;
   try {
     layerPath = parseSandboxLayerManifest(manifestPath, manifestText).layer.dockerfile;
     assertManifestExists(layerPath);
-    const layerText = readFileSync2(layerPath, "utf8");
+    const layerText = readFileSync3(layerPath, "utf8");
     const parsed = await parseSandboxLayerSource({ manifestPath, manifestText, layerPath, layerText });
     const payload = formatValidationPayload({ manifestPath, layerPath, parsed });
     if (isJson(command, options)) {
@@ -3556,13 +3731,13 @@ async function sandboxBuildCommand(sourceRepoArg, options = {}, command) {
   const manifestPath = options.manifest ?? DEFAULT_MANIFEST_PATH;
   assertManifestExists(manifestPath);
   if (!options.ref) assertCleanAndPushed();
-  const sourceRepo = parseRepoArg(sourceRepoArg, currentRepo);
-  const targetRepo = options.targetRepo ? parseRepoArg(options.targetRepo, currentRepo) : null;
-  const businessId = await resolveBusinessId(config, options);
+  const sourceRepo = parseRepoArg2(sourceRepoArg, currentRepo);
+  const targetRepo = options.targetRepo ? parseRepoArg2(options.targetRepo, currentRepo) : null;
+  const businessId = await resolveBusinessId2(config, options);
   const ref = options.ref ?? currentRef();
   const payload = await apiFetch(
     config,
-    `/api/businesses/${encodePathSegment(businessId)}/repos/${encodePathSegment(sourceRepo.owner)}/${encodePathSegment(
+    `/api/businesses/${encodePathSegment2(businessId)}/repos/${encodePathSegment2(sourceRepo.owner)}/${encodePathSegment2(
       sourceRepo.repo
     )}/sandbox-layer/build-requests`,
     {
@@ -3592,11 +3767,11 @@ async function sandboxBuildCommand(sourceRepoArg, options = {}, command) {
 async function sandboxStatusCommand(repoArg, options = {}, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const businessId = await resolveBusinessId(config, options);
-  const repo = parseRepoArg(repoArg, currentRepo);
+  const businessId = await resolveBusinessId2(config, options);
+  const repo = parseRepoArg2(repoArg, currentRepo);
   const payload = await apiFetch(
     config,
-    `/api/businesses/${encodePathSegment(businessId)}/repos/${encodePathSegment(repo.owner)}/${encodePathSegment(
+    `/api/businesses/${encodePathSegment2(businessId)}/repos/${encodePathSegment2(repo.owner)}/${encodePathSegment2(
       repo.repo
     )}/sandbox-layer/resolution`
   );
@@ -3609,10 +3784,10 @@ async function sandboxStatusCommand(repoArg, options = {}, command) {
 async function sandboxHistoryCommand(sourceRepoArg, options = {}, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const businessId = await resolveBusinessId(config, options);
-  const sourceRepo = parseRepoArg(sourceRepoArg, currentRepo);
+  const businessId = await resolveBusinessId2(config, options);
+  const sourceRepo = parseRepoArg2(sourceRepoArg, currentRepo);
   const params = new URLSearchParams({ sourceRepo: repoPath(sourceRepo) });
-  if (options.targetRepo) params.set("targetRepo", repoPath(parseRepoArg(options.targetRepo, currentRepo)));
+  if (options.targetRepo) params.set("targetRepo", repoPath(parseRepoArg2(options.targetRepo, currentRepo)));
   if (options.status) params.set("status", options.status);
   if (options.limit) {
     const limit = Number(options.limit);
@@ -3623,7 +3798,7 @@ async function sandboxHistoryCommand(sourceRepoArg, options = {}, command) {
   }
   const payload = await apiFetch(
     config,
-    `/api/businesses/${encodePathSegment(businessId)}/sandbox-layer/build-requests?${params.toString()}`
+    `/api/businesses/${encodePathSegment2(businessId)}/sandbox-layer/build-requests?${params.toString()}`
   );
   if (isJson(command, options)) {
     writeJson(payload);
@@ -3640,7 +3815,7 @@ async function sandboxRebuildStaleCommand(options = {}, command) {
   if (options.all && options.business) {
     throw new CliError("user", "Use either --all or --business, not both.");
   }
-  const businessId = options.all ? null : await resolveBusinessId(config, options);
+  const businessId = options.all ? null : await resolveBusinessId2(config, options);
   let payload = await apiFetch(config, "/api/admin/sandbox-layer/rebuild-campaigns", {
     method: "POST",
     body: JSON.stringify({
@@ -3668,7 +3843,7 @@ async function followRebuildCampaign(config, campaignId) {
   for (; ; ) {
     const payload = await apiFetch(
       config,
-      `/api/admin/sandbox-layer/rebuild-campaigns/${encodePathSegment(campaignId)}`
+      `/api/admin/sandbox-layer/rebuild-campaigns/${encodePathSegment2(campaignId)}`
     );
     if (isCampaignTerminal(payload.campaign.status)) return payload;
     await sleep2(DEFAULT_POLL_INTERVAL_MS);
@@ -3697,7 +3872,7 @@ function printRebuildCampaign(payload) {
 async function sandboxLogsCommand(buildId, options = {}, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const businessId = await resolveBusinessId(config, options);
+  const businessId = await resolveBusinessId2(config, options);
   let afterSequence = options.afterSequence == null ? void 0 : Number(options.afterSequence);
   if (afterSequence != null && (!Number.isInteger(afterSequence) || afterSequence < 0)) {
     throw new CliError("user", "--after-sequence must be a non-negative integer.");
@@ -3721,12 +3896,12 @@ async function sandboxLogsCommand(buildId, options = {}, command) {
 async function sandboxAssignDefaultCommand(sourceRepoArg, options = {}, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const businessId = await resolveBusinessId(config, options);
-  const sourceRepo = parseRepoArg(sourceRepoArg, currentRepo);
+  const businessId = await resolveBusinessId2(config, options);
+  const sourceRepo = parseRepoArg2(sourceRepoArg, currentRepo);
   const manifestPath = options.manifest ?? DEFAULT_MANIFEST_PATH;
   const payload = await apiFetch(
     config,
-    `/api/businesses/${encodePathSegment(businessId)}/sandbox-layer/default-source`,
+    `/api/businesses/${encodePathSegment2(businessId)}/sandbox-layer/default-source`,
     { method: "PUT", body: JSON.stringify(sourceBody(sourceRepo, manifestPath)) }
   );
   if (isJson(command, options)) {
@@ -3741,13 +3916,13 @@ async function sandboxAssignDefaultCommand(sourceRepoArg, options = {}, command)
 async function sandboxAssignRepoCommand(targetRepoArg, sourceRepoArg, options = {}, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const businessId = await resolveBusinessId(config, options);
-  const targetRepo = parseRepoArg(targetRepoArg, currentRepo);
-  const sourceRepo = parseRepoArg(sourceRepoArg, currentRepo);
+  const businessId = await resolveBusinessId2(config, options);
+  const targetRepo = parseRepoArg2(targetRepoArg, currentRepo);
+  const sourceRepo = parseRepoArg2(sourceRepoArg, currentRepo);
   const manifestPath = options.manifest ?? DEFAULT_MANIFEST_PATH;
   const payload = await apiFetch(
     config,
-    `/api/businesses/${encodePathSegment(businessId)}/repos/${encodePathSegment(targetRepo.owner)}/${encodePathSegment(
+    `/api/businesses/${encodePathSegment2(businessId)}/repos/${encodePathSegment2(targetRepo.owner)}/${encodePathSegment2(
       targetRepo.repo
     )}/sandbox-layer/assignment`,
     { method: "PUT", body: JSON.stringify(sourceBody(sourceRepo, manifestPath)) }
@@ -3766,11 +3941,11 @@ async function sandboxAssignRepoCommand(targetRepoArg, sourceRepoArg, options =
 async function sandboxUnassignDefaultCommand(options = {}, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const businessId = await resolveBusinessId(config, options);
+  const businessId = await resolveBusinessId2(config, options);
   if (!options.yes) await confirmOrThrow("Clear the business default sandbox layer source?");
   const payload = await apiFetch(
     config,
-    `/api/businesses/${encodePathSegment(businessId)}/sandbox-layer/default-source`,
+    `/api/businesses/${encodePathSegment2(businessId)}/sandbox-layer/default-source`,
     { method: "DELETE" }
   );
   if (isJson(command, options)) {
@@ -3782,12 +3957,12 @@ async function sandboxUnassignDefaultCommand(options = {}, command) {
 async function sandboxUnassignRepoCommand(targetRepoArg, options = {}, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const businessId = await resolveBusinessId(config, options);
-  const targetRepo = parseRepoArg(targetRepoArg, currentRepo);
+  const businessId = await resolveBusinessId2(config, options);
+  const targetRepo = parseRepoArg2(targetRepoArg, currentRepo);
   if (!options.yes) await confirmOrThrow(`Clear sandbox layer assignment for ${repoPath(targetRepo)}?`);
   const payload = await apiFetch(
     config,
-    `/api/businesses/${encodePathSegment(businessId)}/repos/${encodePathSegment(targetRepo.owner)}/${encodePathSegment(
+    `/api/businesses/${encodePathSegment2(businessId)}/repos/${encodePathSegment2(targetRepo.owner)}/${encodePathSegment2(
       targetRepo.repo
     )}/sandbox-layer/assignment`,
     { method: "DELETE" }
@@ -3846,6 +4021,8 @@ async function getSessionCommand(sessionId, options, command) {
   console.log(`Status: ${String(session.phase ?? session.status ?? "unknown")}`);
   if (session.repoUrl) console.log(`Repo: ${String(session.repoUrl)}`);
   if (session.title) console.log(`Title: ${String(session.title)}`);
+  const resultLine = formatSessionResult(session);
+  if (resultLine) console.log(resultLine);
 }
 async function sessionEventsCommand(sessionId, options, command) {
   const afterSequence = resolveSequenceOption(options.afterSequence, options.after, "--after-sequence", "--after");
@@ -3969,8 +4146,8 @@ function parseStopBlocked(err) {
 }
 
 // src/commands/test-creds.ts
-import { readFileSync as readFileSync3 } from "fs";
-function parseRepoArg2(repo) {
+import { readFileSync as readFileSync4 } from "fs";
+function parseRepoArg3(repo) {
   const trimmed = repo.trim();
   const slashIndex = trimmed.indexOf("/");
   if (slashIndex <= 0 || slashIndex === trimmed.length - 1) {
@@ -3987,13 +4164,13 @@ function readValue(options) {
     throw new CliError("user", "Provide exactly one of --value, --value-file, or --value-stdin.");
   }
   if (options.value !== void 0) return options.value;
-  const raw = options.valueFile ? readFileSync3(options.valueFile, "utf8") : readFileSync3(0, "utf8");
+  const raw = options.valueFile ? readFileSync4(options.valueFile, "utf8") : readFileSync4(0, "utf8");
   return raw.replace(/\r?\n$/, "");
 }
 async function listTestCredentialsCommand(repo, options, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const repoArg = parseRepoArg2(repo);
+  const repoArg = parseRepoArg3(repo);
   const payload = await apiFetch(config, basePath(options.business, repoArg));
   if (isJson(command, options)) {
     writeJson(payload);
@@ -4011,7 +4188,7 @@ async function listTestCredentialsCommand(repo, options, command) {
 async function setTestCredentialCommand(repo, name, options, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const repoArg = parseRepoArg2(repo);
+  const repoArg = parseRepoArg3(repo);
   const value = readValue(options);
   const payload = await apiFetch(
     config,
@@ -4029,12 +4206,12 @@ async function deleteTestCredentialCommand(repo, name, options, command) {
     throw new CliError("user", "`test-creds delete --json` requires --yes.");
   }
   if (options.yes !== true) {
-    const repoArg2 = parseRepoArg2(repo);
+    const repoArg2 = parseRepoArg3(repo);
     await confirmOrThrow(`Delete test credential '${name}' for ${repoArg2.owner}/${repoArg2.name}?`);
   }
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const repoArg = parseRepoArg2(repo);
+  const repoArg = parseRepoArg3(repo);
   const payload = await apiFetch(
     config,
     `${basePath(options.business, repoArg)}/${encodeURIComponent(name)}`,
@@ -4321,6 +4498,13 @@ sandboxAssign.command("repo").description("Assign a sandbox layer source to one
 var sandboxUnassign = sandbox.command("unassign").description("Remove sandbox layer source assignments");
 sandboxUnassign.command("default").description("Clear the business default sandbox layer source").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--yes", "Skip confirmation").action((options, command) => sandboxUnassignDefaultCommand(options, command));
 sandboxUnassign.command("repo").description("Clear a target repo sandbox layer assignment").argument("<target-repo>", "Target repository owner/name").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--yes", "Skip confirmation").action((targetRepo, options, command) => sandboxUnassignRepoCommand(targetRepo, options, command));
+var egress = program.command("egress").description("Workspace egress allowlist commands");
+var egressSource = egress.command("source").description("Manage the workspace egress allowlist source repo");
+egressSource.command("set").description("Set the source repo for .arcanist/egress-allowlist.txt").argument("<source-repo>", "Source repository owner/name").option("--business <id>", "Business ID; defaults to authenticated user's business").action((sourceRepo, options, command) => egressSourceSetCommand(sourceRepo, options, command));
+egressSource.command("get").description("Show the configured egress allowlist source").option("--business <id>", "Business ID; defaults to authenticated user's business").action((options, command) => egressSourceGetCommand(options, command));
+egress.command("add").description("Open or update a PR adding domains to the egress allowlist source file").argument("<domains...>", "Exact domain names to add").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--reason <text>", "Reason to include in the PR body").action((domains, options, command) => egressAddCommand(domains, options, command));
+egress.command("sync").description("Apply the merged egress allowlist source file to the runtime business policy").option("--business <id>", "Business ID; defaults to authenticated user's business").action((options, command) => egressSyncCommand(options, command));
+egress.command("validate").description("Validate a local egress allowlist source file").argument("[path]", "Path to validate", ".arcanist/egress-allowlist.txt").action((path, options, command) => egressValidateCommand(path, options, command));
 var tokens = program.command("tokens").description("CLI token commands");
 tokens.command("list").description("List CLI tokens").option("--limit <n>", "Maximum tokens to return").option("--cursor <cursor>", "Pagination cursor").action((options, command) => listTokensCommand(options, command));
 tokens.command("create").description("Create a CLI token and print it once").option("--scope <scope>", "Token scope: read or write", "read").option("--expires-in-days <days>", "Token expiry in days").addHelpText(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryarcanist/cli",
-  "version": "0.1.132",
+  "version": "0.1.134",
   "description": "CLI for Arcanist — create and manage coding agent sessions",
   "type": "module",
   "bin": {