@zaip-ai/cli 6.3.0 → 7.6.0

package/templates/.agents/tools/cloud-runner-dns.test.mjs

@@ -0,0 +1,256 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { providerDiagnostic, run } from "./cloud-runner.mjs";
+import { dnsBody, sameDns } from "./cloud-runner-dns.mjs";
+
+const fail = (code) => {
+  throw new Error(code);
+};
+const name = "probe.example.com";
+const a = { name, type: "A", content: "198.51.100.7", proxied: true, ttl: 1 };
+function fixture(target = a, initial = []) {
+  const contract = {
+    version: 1,
+    profile: "autonomous-cloud",
+    authorization: { standing: true, reference: "offline-test" },
+    cloudflare: {
+      account_id: "account",
+      zone_id: "zone",
+      zone_name: "example.com",
+      dns_records: [],
+      direct_dns_records: { [name]: target },
+      allowed_operations: ["cloudflare:dns:read", "cloudflare:dns:create", "cloudflare:dns:edit"],
+    },
+  };
+  const records = structuredClone(initial),
+    calls = [];
+  const args = {
+    operation: "cloudflare:dns:create",
+    contract: ".agents/config/autonomous-cloud-contract.json",
+    credentialsSource: "root",
+    provider: "cloudflare",
+    accountId: "account",
+    zoneId: "zone",
+    dnsRecord: name,
+  };
+  const ok = (result, extra = {}) => ({
+    ok: true,
+    json: async () => ({ success: true, result, ...extra }),
+  });
+  const deps = {
+    realpath: async (path) => path,
+    readFile: async (path) => {
+      assert.ok(path.endsWith("autonomous-cloud-contract.json") || path.endsWith(".env"));
+      return path.endsWith(".env")
+        ? "CLOUDFLARE_API_TOKEN=fake-offline-token"
+        : JSON.stringify(contract);
+    },
+    http: async (url, options) => {
+      calls.push({ url, ...options });
+      assert.equal(options.redirect, "error");
+      const parsed = new URL(url);
+      if (parsed.pathname.endsWith("/zones/zone"))
+        return ok({ id: "zone", name: "example.com", account: { id: "account" } });
+      if (options.method === "GET") return ok(records);
+      const body = JSON.parse(options.body);
+      if (options.method === "POST") {
+        const record = { ...body, id: `new-${records.length}` };
+        records.push(record);
+        return ok(record);
+      }
+      const record = records.find((entry) => parsed.pathname.endsWith(`/${entry.id}`));
+      assert.ok(record);
+      Object.assign(record, body);
+      return ok(record);
+    },
+  };
+  return { contract, records, calls, args, deps, ok };
+}
+
+test("DNS-only creates without Hostinger, SSH or Terraform and reads sanitized metadata", async () => {
+  const f = fixture();
+  await run(f.args, f.deps);
+  const result = await run({ ...f.args, operation: "cloudflare:dns:read" }, f.deps);
+  assert.equal(result.record.type, "A");
+  assert.equal(result.record.content, undefined);
+  assert.equal(f.calls.filter((call) => call.method === "POST").length, 1);
+});
+
+test("explicit contract ID edits one of two TXT records, preserving unrelated TXT and MX", async () => {
+  const target = { name, type: "TXT", content: "changed", id: "txt-2" };
+  const f = fixture(
+    [target, { name, type: "TXT", content: "keep", id: "txt-1" }],
+    [
+      { name, type: "TXT", content: "keep", id: "txt-1" },
+      { name, type: "TXT", content: "old", id: "txt-2" },
+      { name, type: "MX", content: "mail.example.com", priority: 10, id: "mx" },
+    ],
+  );
+  await assert.rejects(
+    run({ ...f.args, operation: "cloudflare:dns:edit", dnsType: "TXT" }, f.deps),
+    /ambiguous_dns_record/,
+  );
+  await run(
+    { ...f.args, operation: "cloudflare:dns:edit", dnsType: "TXT", dnsRecordId: "txt-2" },
+    f.deps,
+  );
+  assert.equal(f.records[0].content, "keep");
+  assert.equal(f.records[1].content, "changed");
+  assert.equal(f.records[2].priority, 10);
+  assert.equal(JSON.parse(f.calls.find((call) => call.method === "PATCH").body).id, undefined);
+  await assert.rejects(
+    run({ ...f.args, operation: "cloudflare:dns:edit", dnsRecordId: "mx" }, f.deps),
+    /target_mismatch/,
+  );
+});
+
+test("new TXT coexists with MX and TXT but duplicate content never repeats creation", async () => {
+  const f = fixture({ name, type: "TXT", content: "new" }, [
+    { id: "old", name, type: "TXT", content: "old" },
+  ]);
+  await run(f.args, f.deps);
+  assert.equal(f.records.length, 2);
+  assert.equal(
+    f.calls.some((call) => call.method === "PATCH"),
+    false,
+  );
+  await assert.rejects(run(f.args, f.deps), /record_already_exists/);
+});
+
+test("typed MX, SRV and CAA bodies survive write verification", async () => {
+  for (const target of [
+    { name, type: "MX", content: "mail.example.com", priority: 10 },
+    {
+      name,
+      type: "SRV",
+      data: { priority: 1, weight: 2, port: 443, target: "service.example.com" },
+    },
+    { name, type: "CAA", data: { flags: 0, tag: "issue", value: "letsencrypt.org" } },
+  ]) {
+    const f = fixture(target);
+    await run(f.args, f.deps);
+    assert.ok(sameDns(f.records[0], target));
+  }
+});
+
+test("unsupported types, malformed fields and proxy/TTL errors fail before provider access", async () => {
+  for (const target of [
+    { ...a, type: "NS" },
+    { ...a, ignored_field: true },
+    { ...a, content: "invalid-IP" },
+    { ...a, ttl: 300 },
+    { ...a, proxied: "true" },
+    { ...a, proxied: false, ttl: 0 },
+    { name, type: "MX", content: "mail.example.com" },
+    { name, type: "TXT", content: "x", proxied: true },
+    { name, type: "CAA", data: { flags: 300, tag: "issue", value: "ca.test" } },
+    { name, type: "SRV", data: { priority: 0, weight: 1, port: -1, target: "x.example.com" } },
+  ]) {
+    const f = fixture(target);
+    await assert.rejects(run(f.args, f.deps));
+    assert.equal(f.calls.length, 0);
+  }
+});
+
+test("authorization, zone identity, private origins and Terraform ownership fail closed", async () => {
+  for (const mutate of [
+    (f) => {
+      delete f.contract.authorization;
+    },
+    (f) => {
+      f.args.accountId = "wrong";
+    },
+    (f) => {
+      f.contract.cloudflare.zone_name = "other.example.com";
+    },
+    (f) => {
+      f.contract.cloudflare.dns_records = [name];
+    },
+    (f) => {
+      f.contract.cloudflare.private_origin_addresses = [a.content];
+    },
+  ]) {
+    const f = fixture();
+    mutate(f);
+    await assert.rejects(run(f.args, f.deps));
+    assert.equal(
+      f.calls.some((call) => call.method !== "GET"),
+      false,
+    );
+  }
+});
+
+test("CNAME and NS conflicts never cause a write", async () => {
+  for (const type of ["CNAME", "NS"]) {
+    const f = fixture(a, [{ name, type, content: "other.example.com", id: "other" }]);
+    await assert.rejects(run(f.args, f.deps), /dns_record_conflict/);
+    assert.equal(
+      f.calls.some((call) => call.method !== "GET"),
+      false,
+    );
+  }
+});
+
+test("pagination discovers duplicate on second page and bounds incomplete inventory", async () => {
+  for (const total of [2, 21]) {
+    const f = fixture();
+    const http = f.deps.http;
+    f.deps.http = async (url, options) =>
+      url.includes("dns_records?")
+        ? f.ok([{ ...a, id: `page-${new URL(url).searchParams.get("page")}` }], {
+            result_info: { total_pages: total },
+          })
+        : http(url, options);
+    await assert.rejects(
+      run({ ...f.args, operation: "cloudflare:dns:edit" }, f.deps),
+      total === 2 ? /ambiguous_dns_record/ : /dns_inventory_incomplete/,
+    );
+    assert.equal(
+      f.calls.some((call) => call.method !== "GET"),
+      false,
+    );
+  }
+});
+
+test("read-after-write uses returned ID and fails on mismatched provider result", async () => {
+  const f = fixture();
+  const http = f.deps.http;
+  f.deps.http = async (url, options) =>
+    options.method === "POST" ? f.ok({ ...a, id: "missing" }) : http(url, options);
+  await assert.rejects(run(f.args, f.deps), /read_after_write_failed/);
+});
+
+test("HTTP errors report only status; writes remain uncertain and are never retried", async () => {
+  for (const method of ["GET", "POST"]) {
+    const f = fixture();
+    const http = f.deps.http;
+    f.deps.http = async (url, options) =>
+      options.method === method
+        ? {
+            ok: false,
+            status: 403,
+            json: async () => {
+              throw new Error("must not read secret body");
+            },
+          }
+        : http(url, options);
+    await assert.rejects(run(f.args, f.deps), (error) => {
+      assert.deepEqual(providerDiagnostic(error), {
+        code:
+          method === "GET" ? "provider_request_failed" : "remote_result_requires_reconciliation",
+        http_status: 403,
+      });
+      assert.doesNotMatch(JSON.stringify(error), /fake-offline-token|secret body/);
+      return true;
+    });
+  }
+});
+
+test("structured comparison is independent of provider data key ordering", () => {
+  const body = dnsBody(
+    { name, type: "CAA", data: { flags: 0, tag: "issue", value: "ca.test" } },
+    fail,
+  );
+  assert.ok(sameDns({ ...body, data: { value: "ca.test", tag: "issue", flags: 0 } }, body));
+  assert.equal(sameDns({ ...body, data: { ...body.data, flags: 128 } }, body), false);
+});

package/templates/.agents/tools/cloud-runner-process.mjs

@@ -0,0 +1,61 @@
+import { spawn } from "node:child_process";
+export function execute(file, args, options = {}) {
+  return new Promise((done, reject) => {
+    const child = spawn(file, args, {
+      cwd: options.cwd,
+      env: safeEnv(options.env),
+      stdio: ["pipe", "pipe", "pipe"],
+      windowsHide: true,
+    });
+    let stdout = "",
+      stderr = "",
+      overflow = false,
+      timedOut = false;
+    const limit = options.maxOutput ?? 1_000_000;
+    const append = (current, chunk) => {
+      if (Buffer.byteLength(current) + chunk.length > limit) {
+        overflow = true;
+        child.kill();
+        return current;
+      }
+      return current + chunk.toString("utf8");
+    };
+    child.stdout.on("data", (chunk) => {
+      stdout = append(stdout, chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr = append(stderr, chunk);
+    });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill();
+    }, options.timeout ?? 30_000);
+    child.once("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.stdin.on("error", () => {});
+    child.stdin.end(options.input);
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      done({ code: overflow || timedOut ? 1 : (code ?? 1), stdout, stderr, overflow, timedOut });
+    });
+  });
+}
+function safeEnv(extra = {}) {
+  const allowed = [
+    "PATH",
+    "Path",
+    "SYSTEMROOT",
+    "SystemRoot",
+    "WINDIR",
+    "ComSpec",
+    "PATHEXT",
+    "ProgramData",
+    "PROGRAMDATA",
+  ];
+  const base = Object.fromEntries(
+    allowed.filter((key) => process.env[key]).map((key) => [key, process.env[key]]),
+  );
+  return { ...base, ...extra };
+}

package/templates/.agents/tools/cloud-runner-process.test.mjs

@@ -0,0 +1,43 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { resolve } from "node:path";
+import test from "node:test";
+import { execute } from "./cloud-runner.mjs";
+
+const root = resolve(import.meta.dirname, "../..");
+
+test("real subprocess preserves large JSON and reports overflow and timeout", async () => {
+  const result = await execute(
+    process.execPath,
+    ["-e", "process.stdout.write(JSON.stringify({data:'x'.repeat(50000)}))"],
+    { maxOutput: 60_000 },
+  );
+  assert.equal(result.code, 0);
+  assert.equal(JSON.parse(result.stdout).data.length, 50_000);
+  const overflow = await execute(
+    process.execPath,
+    ["-e", "process.stdout.write('x'.repeat(50000))"],
+    { maxOutput: 100 },
+  );
+  assert.notEqual(overflow.code, 0);
+  assert.equal(overflow.overflow, true);
+  const timeout = await execute(process.execPath, ["-e", "setInterval(()=>{},1000)"], {
+    timeout: 100,
+  });
+  assert.notEqual(timeout.code, 0);
+  assert.equal(timeout.timedOut, true);
+});
+
+test("CLI rejects invalid and duplicate arguments with sanitized errors", () => {
+  for (const args of [
+    ["--operation", "invalid"],
+    ["--operation", "contract:derive", "--operation", "invalid"],
+  ]) {
+    const result = spawnSync(process.execPath, [".agents/tools/cloud-runner.mjs", ...args], {
+      cwd: root,
+      encoding: "utf8",
+    });
+    assert.notEqual(result.status, 0);
+    assert.deepEqual(JSON.parse(result.stderr), { ok: false, code: "invalid_arguments" });
+  }
+});

package/templates/.agents/tools/cloud-runner.integration.test.mjs

@@ -34,7 +34,23 @@ test("real filesystem, local HTTP providers and stateful child CLI complete plan
     resolve(import.meta.dirname, "cloud-runner.mjs"),
     join(workspace, ".agents/tools/cloud-runner.mjs"),
   );
-  for (const name of ["cloud-runner-dns.mjs", "cloud-runner-terraform.mjs"]) {
+  for (const name of [
+    "repository-policy.mjs",
+    "cloud-runner-dns.mjs",
+    "cloud-runner-terraform.mjs",
+    "cloud-runner-process.mjs",
+    "cloud-runner-arguments.mjs",
+    "cloud-onboarding.mjs",
+    "cloud-onboarding-policy.mjs",
+    "cloud-onboarding-files.mjs",
+    "cloud-onboarding-credentials.mjs",
+    "cloud-onboarding-generation.mjs",
+    "cloud-onboarding-architecture.mjs",
+    "cloud-onboarding-provider.mjs",
+    "cloud-onboarding-ssh.mjs",
+    "cloud-onboarding-configure.mjs",
+    "cloud-onboarding-terraform.mjs",
+  ]) {
     await copyFile(resolve(import.meta.dirname, name), join(workspace, ".agents/tools", name));
   }
   await copyFile(
@@ -114,8 +130,8 @@ test("real filesystem, local HTTP providers and stateful child CLI complete plan
       allowed_operations: ["terraform:plan", "terraform:apply"],
       plan: {
         backend: { type: "s3", config },
-        path: ".local/cloud/plans/approved.tfplan",
-        policy_json_path: ".local/cloud/plans/approved.json",
+        path: ".agents/private/state/cloud/plans/approved.tfplan",
+        policy_json_path: ".agents/private/state/cloud/plans/approved.json",
         policy_contract_path: ".agents/config/policy.json",
       },
     },

package/templates/.agents/tools/cloud-runner.mjs

@@ -1,10 +1,16 @@
-import { spawn } from "node:child_process";
+import { execute } from "./cloud-runner-process.mjs";
+import { assertRepositoryOperation, loadRepositoryPolicy } from "./repository-policy.mjs";
+
+export { execute };
+
 import { createHash } from "node:crypto";
 import { access, mkdir, readFile, realpath, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseEnv } from "node:util";
-import { authHeaders, dnsBody, dnsInventory, sameDns } from "./cloud-runner-dns.mjs";
+import { runOnboarding } from "./cloud-onboarding.mjs";
+import { exact, normalize, parse, requireValue } from "./cloud-runner-arguments.mjs";
+import { authHeaders, dnsInventory, runDns, sameDns } from "./cloud-runner-dns.mjs";
 import { runTerraform } from "./cloud-runner-terraform.mjs";
 
 const root = resolve(import.meta.dirname, "..", "..");
@@ -16,13 +22,15 @@ if (main) {
       `${JSON.stringify({ ok: true, ...(await run(parse(process.argv.slice(2)))) })}\n`,
     );
   } catch (error) {
-    process.stderr.write(`${JSON.stringify({ ok: false, code: errorCode(error) })}\n`);
+    process.stderr.write(`${JSON.stringify({ ok: false, ...providerDiagnostic(error) })}\n`);
     process.exitCode = 1;
   }
 }
-
 /** Runs one contract-bound operation. Dependencies are injectable for offline tests. */
 export async function run(args, injected = {}) {
+  assertRepositoryOperation(await loadRepositoryPolicy(root), "infra");
+  if (typeof args.operation === "string" && args.operation.startsWith("vps:"))
+    return runOnboarding(args, { exec: execute, ...injected });
   const deps = dependencies(injected);
   if (args.operation === "contract:derive") {
     exact(args, ["operation", "credentials-source"]);
@@ -88,7 +96,15 @@ export async function run(args, injected = {}) {
   if (contract.version !== 1 || contract.profile !== "autonomous-cloud") fail("invalid_contract");
   const credentials = await dotenv(requireValue(args, "credentials-source"), deps);
   if (args.operation.startsWith("cloudflare:dns:"))
-    return cloudflare(args, contract, credentials, deps);
+    return runDns(args, contract, credentials, deps, {
+      exact,
+      normalize,
+      fail,
+      nonempty,
+      inZone,
+      request,
+      result,
+    });
   if (args.operation.startsWith("hostinger:")) return hostinger(args, contract, credentials, deps);
   if (args.operation.startsWith("terraform:"))
     return runTerraform(args, contract, credentials, {
@@ -114,84 +130,6 @@ export async function run(args, injected = {}) {
   fail("operation_not_allowed");
 }
 
-async function cloudflare(args, contract, credentials, deps) {
-  exact(args, [
-    "contract",
-    "operation",
-    "provider",
-    "account-id",
-    "credentials-source",
-    "zone-id",
-    "dns-record",
-  ]);
-  const scope = contract.cloudflare;
-  if (!credentials.cloudflare || args.provider !== "cloudflare") fail("credential_unavailable");
-  if (!scope || args.accountId !== scope.account_id || args.zoneId !== scope.zone_id)
-    fail("target_mismatch");
-  if (
-    !new Set(["cloudflare:dns:read", "cloudflare:dns:create", "cloudflare:dns:edit"]).has(
-      args.operation,
-    ) ||
-    !scope.allowed_operations?.includes(args.operation)
-  )
-    fail("operation_not_allowed");
-  const managed = dnsInventory(scope).has(args.dnsRecord);
-  const direct = scope.direct_dns_records?.[args.dnsRecord];
-  if (args.operation === "cloudflare:dns:read" ? !managed && !direct : !direct || managed)
-    fail("operation_not_allowed");
-  const headers = authHeaders(credentials.cloudflare);
-  const zone = await request(
-    deps,
-    `https://api.cloudflare.com/client/v4/zones/${encodeURIComponent(args.zoneId)}`,
-    { method: "GET", headers },
-  );
-  if (zone?.result?.id !== args.zoneId || zone?.result?.account?.id !== args.accountId)
-    fail("target_mismatch");
-  const listUrl = `https://api.cloudflare.com/client/v4/zones/${encodeURIComponent(args.zoneId)}/dns_records?name=${encodeURIComponent(args.dnsRecord)}`;
-  const listed = await request(deps, listUrl, { method: "GET", headers });
-  const matches = Array.isArray(listed?.result)
-    ? listed.result.filter((record) => record?.name === args.dnsRecord)
-    : [];
-  if (matches.length > 1) fail("ambiguous_dns_record");
-  const current = matches[0];
-  if (args.operation === "cloudflare:dns:read") {
-    if (!current) fail("record_not_found");
-    return result(
-      args.operation,
-      "cloudflare",
-      [args.accountId, args.zoneId, args.dnsRecord, current.id].filter(Boolean),
-    );
-  }
-  const body = dnsBody(direct, fail);
-  if (
-    body.name !== args.dnsRecord ||
-    !inZone(body.name, scope.zone_name) ||
-    body.content === contract.hostinger?.vps?.application?.ssh_host
-  )
-    fail("target_mismatch");
-  if (args.operation === "cloudflare:dns:create" && current) fail("record_already_exists");
-  if (args.operation === "cloudflare:dns:edit" && !current?.id) fail("record_not_found");
-  const endpoint = current?.id
-    ? `https://api.cloudflare.com/client/v4/zones/${encodeURIComponent(args.zoneId)}/dns_records/${encodeURIComponent(current.id)}`
-    : `https://api.cloudflare.com/client/v4/zones/${encodeURIComponent(args.zoneId)}/dns_records`;
-  await request(deps, endpoint, {
-    method: current?.id ? "PATCH" : "POST",
-    headers,
-    body: JSON.stringify(body),
-  });
-  const observed = await request(deps, listUrl, { method: "GET", headers });
-  const after = Array.isArray(observed?.result)
-    ? observed.result.find((record) => record?.name === args.dnsRecord)
-    : null;
-  if (!after?.id || !sameDns(after, body)) fail("read_after_write_failed");
-  return result(args.operation, "cloudflare", [
-    args.accountId,
-    args.zoneId,
-    args.dnsRecord,
-    after.id,
-  ]);
-}
-
 async function hostinger(args, contract, credentials, deps) {
   const ssh = args.operation.startsWith("hostinger:ssh:");
   exact(
@@ -531,68 +469,32 @@ async function request(deps, url, options) {
       redirect: "error",
       signal: AbortSignal.timeout(15_000),
     });
-    if (!response?.ok) fail("provider_request_failed");
+    if (!response?.ok) {
+      const error = Object.assign(new Error("provider_request_failed"), {
+        code: "provider_request_failed",
+      });
+      if (Number.isInteger(response?.status) && response.status >= 100 && response.status <= 599)
+        error.http_status = response.status;
+      throw error;
+    }
     const body = typeof response.json === "function" ? await response.json() : response;
     if (body.success === false) fail("provider_request_failed");
     return body;
   } catch (error) {
-    if (options.method !== "GET") fail("remote_result_requires_reconciliation");
+    if (options.method !== "GET") {
+      const failure = Object.assign(new Error("remote_result_requires_reconciliation"), {
+        code: "remote_result_requires_reconciliation",
+        ...providerDiagnostic(error),
+      });
+      failure.code = "remote_result_requires_reconciliation";
+      throw failure;
+    }
     throw error;
   }
 }
 function boundedFetch(url, options) {
   return fetch(url, options);
 }
-export function execute(file, args, options = {}) {
-  return new Promise((done, reject) => {
-    const child = spawn(file, args, {
-      cwd: options.cwd,
-      env: safeEnv(options.env),
-      stdio: ["pipe", "pipe", "pipe"],
-      windowsHide: true,
-    });
-    let stdout = "",
-      stderr = "",
-      overflow = false,
-      timedOut = false;
-    const limit = options.maxOutput ?? 1_000_000;
-    const append = (current, chunk) => {
-      if (Buffer.byteLength(current) + chunk.length > limit) {
-        overflow = true;
-        child.kill();
-        return current;
-      }
-      return current + chunk.toString("utf8");
-    };
-    child.stdout.on("data", (chunk) => {
-      stdout = append(stdout, chunk);
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr = append(stderr, chunk);
-    });
-    const timer = setTimeout(() => {
-      timedOut = true;
-      child.kill();
-    }, options.timeout ?? 30_000);
-    child.once("error", (error) => {
-      clearTimeout(timer);
-      reject(error);
-    });
-    child.stdin.on("error", () => {});
-    child.stdin.end(options.input);
-    child.once("close", (code) => {
-      clearTimeout(timer);
-      done({ code: overflow || timedOut ? 1 : (code ?? 1), stdout, stderr, overflow, timedOut });
-    });
-  });
-}
-function safeEnv(extra = {}) {
-  const allowed = ["PATH", "Path", "SYSTEMROOT", "SystemRoot", "WINDIR", "ComSpec", "PATHEXT"];
-  const base = Object.fromEntries(
-    allowed.filter((key) => process.env[key]).map((key) => [key, process.env[key]]),
-  );
-  return { ...base, ...extra };
-}
 function validPlan(plan, accountId) {
   if (
     !plan ||
@@ -718,9 +620,9 @@ function stable(value) {
   return JSON.stringify(value);
 }
 function canonicalPlan(path, extension = ".tfplan") {
-  return new RegExp(`^\\.local/cloud/plans/[A-Za-z0-9_-]+${extension.replace(".", "\\.")}$`).test(
-    path ?? "",
-  );
+  return new RegExp(
+    `^\\.agents/private/state/cloud/plans/[A-Za-z0-9_-]+${extension.replace(".", "\\.")}$`,
+  ).test(path ?? "");
 }
 function requireString(object, key) {
   if (typeof object?.[key] !== "string" || !object[key].trim()) fail("invalid_contract");
@@ -738,37 +640,7 @@ function nonempty(value) {
 function sha256(value) {
   return createHash("sha256").update(value).digest("hex");
 }
-function parse(values) {
-  const out = {};
-  for (let index = 0; index < values.length; index += 2) {
-    if (
-      !values[index]?.startsWith("--") ||
-      values[index + 1] === undefined ||
-      values[index + 1].startsWith("--")
-    )
-      fail("invalid_arguments");
-    const key = normalize(values[index].slice(2));
-    if (Object.hasOwn(out, key)) fail("invalid_arguments");
-    out[key] = values[index + 1];
-  }
-  return out;
-}
-function exact(actual, allowed) {
-  const normalized = allowed.map(normalize);
-  if (
-    Object.keys(actual).some((key) => !normalized.includes(key)) ||
-    normalized.some((key) => actual[key] === undefined)
-  )
-    fail("invalid_arguments");
-}
-function requireValue(actual, key) {
-  const value = actual[normalize(key)];
-  if (!value) fail("invalid_arguments");
-  return value;
-}
-function normalize(key) {
-  return key.replace(/-([a-z])/g, (_, letter) => letter.toUpperCase());
-}
+
 function insideRoot(path) {
   const absolute = resolve(root, path);
   const rel = relative(root, absolute);
@@ -784,3 +656,11 @@ function fail(code) {
 function errorCode(error) {
   return typeof error?.code === "string" ? error.code : "invalid_request";
 }
+export function providerDiagnostic(error) {
+  return {
+    code: errorCode(error),
+    ...(Number.isInteger(error?.http_status) && error.http_status >= 100 && error.http_status <= 599
+      ? { http_status: error.http_status }
+      : {}),
+  };
+}