archal 0.9.15 → 0.9.16

package/dist/vitest/index.cjs

@@ -6819,7 +6819,7 @@ __export(index_exports, {
   withArchal: () => withArchal
 });
 module.exports = __toCommonJS(index_exports);
-var import_node_path13 = require("path");
+var import_node_path14 = require("path");
 var import_node_url4 = require("url");
 
 // ../runtime/src/auth-lease.ts
@@ -7736,16 +7736,37 @@ var SESSION_STOP_CONFIRM_MAX_ATTEMPTS = 40;
 var ARCHAL_WORKSPACE_HEADER = "x-archal-workspace";
 var SESSION_RESPONSE_SCOPE_HEADER = "x-archal-session-response";
 var CLI_SESSION_TRANSPORT_SCOPE = "cli-transport";
+var INFRASTRUCTURE_DETAIL_PATTERN = /(?:archal[-_\s]?(?:proxy|runtime|control[-_\s]?plane|service[-_\s]?gateway|openclaw[-_\s]?gateway)|control[-_\s]?plane|CLI_JWT_SECRET|CONTROL_PLANE|JWT_SECRET|ARCHAL_|runtime provider|runtime\/session|worker[-_\s]?endpoint|x[-_]?archal|service[-_\s]?gateway|service[-_\s]?runtime|provider[-_\s]?gateway|graphql[-_\s]?gateway|workflow[-_\s]?(?:runtime|harness|session)|harness[-_\s]?bootstrap|service_mcp_servers|\/service-gateway|tls intercept|sidecar|openclaw[-_\s]?gateway|credential_issuance_seed|hosted\s+clone|cloud(?:Clone|Twin)Urls|(?:clone|twin)[-_]access[-_]denied|twin[-_]not[-_]in[-_]catalog|pre[-_\s]?migration|stale[-_\s]?data)/i;
+function publicHostedSessionDetail(detail) {
+  if (!detail?.trim()) {
+    return "";
+  }
+  return INFRASTRUCTURE_DETAIL_PATTERN.test(detail) ? "service routing failed to prepare the requested services." : detail;
+}
+function hostedSessionRequestErrorMessage(method, path2, status, detail) {
+  const publicDetail = publicHostedSessionDetail(detail);
+  return `Hosted session request failed (${method} ${path2}, HTTP ${status}${publicDetail ? `: ${publicDetail}` : ""}).`;
+}
 var HostedSessionRequestError = class extends Error {
   constructor(method, path2, status, detail) {
-    super(
-      `Hosted session request failed (${method} ${path2}, HTTP ${status}${detail ? `: ${detail}` : ""}).`
-    );
+    super(hostedSessionRequestErrorMessage(method, path2, status, detail));
     this.method = method;
     this.path = path2;
     this.status = status;
-    this.detail = detail;
     this.name = "HostedSessionRequestError";
+    this.detail = publicHostedSessionDetail(detail);
+    Object.defineProperty(this, "internalDetail", {
+      value: detail,
+      enumerable: false,
+      configurable: false,
+      writable: false
+    });
+  }
+  detail;
+  internalDetail;
+  /** @internal */
+  getInternalDetailForRetry() {
+    return this.internalDetail;
   }
 };
 function trimEnv(name) {
@@ -7857,7 +7878,7 @@ function isTransientHostedSessionStartError(error95) {
     if (error95.status === 401 || error95.status === 429 || error95.status === 500 || error95.status === 502 || error95.status === 503 || error95.status === 504) {
       return true;
     }
-    return detailLooksTransient(error95.detail);
+    return detailLooksTransient(error95.getInternalDetailForRetry());
   }
   if (error95 instanceof Error) {
     if (error95.message.startsWith("Hosted session timed out waiting for readiness")) {
@@ -53414,7 +53435,7 @@ function resolveRuntimeModuleFromFile(currentModuleFile2, relativePath, buildExt
   return (0, import_node_path5.resolve)((0, import_node_path5.dirname)(currentModuleFile2), relativePath.replace(/\.js$/, resolvedExtension));
 }
 function resolveRuntimeModule(relativePath, buildExtension) {
-  const currentModuleFile2 = typeof __filename === "string" ? __filename : (0, import_node_url.fileURLToPath)(__archal_import_meta_url);
+  const currentModuleFile2 = typeof __filename === "string" && (0, import_node_path5.isAbsolute)(__filename) ? __filename : (0, import_node_url.fileURLToPath)(__archal_import_meta_url);
   return resolveRuntimeModuleFromFile(currentModuleFile2, relativePath, buildExtension);
 }
 
@@ -53700,6 +53721,7 @@ var RouteRuntimePolicyError = class extends Error {
 
 // ../route-runtime-core/src/runtime.ts
 var import_node_module = require("module");
+var import_node_path7 = require("path");
 
 // ../../twins/core/src/errors.ts
 function errorMessage4(error95) {
@@ -53951,7 +53973,7 @@ var discordRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url3 }) => `Blocked Discord traffic to ${url3}. Declare discord in archalVitestProject({ services: { discord: { mode: "route" } } }) before calling the Discord REST API in Vitest.`,
-    declaredEscape: ({ url: url3, configuredBaseUrl }) => `Blocked Discord escape to ${url3}. Discord route mode is configured, but this domain is outside the approved Discord REST route surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url3 }) => `Blocked Discord escape to ${url3}. Discord route mode is configured, but this domain is outside the approved Discord REST route surface.`,
     warning: ({ url: url3 }) => `Observed adjacent Discord domain ${url3}. Archal did not reroute this request because it is outside the approved Discord REST route surface.`
   },
   sdkIdentifiers: ["discord.js", "@discordjs/rest"],
@@ -53999,7 +54021,7 @@ var githubRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url3 }) => `Blocked GitHub traffic to ${url3}. Declare github in archalVitestProject({ services: { github: { mode: "route" } } }) before using the official GitHub SDK.`,
-    declaredEscape: ({ url: url3, configuredBaseUrl }) => `Blocked GitHub escape to ${url3}. GitHub route mode is configured, but this domain is outside the primary routed GitHub surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url3 }) => `Blocked GitHub escape to ${url3}. GitHub route mode is configured, but this domain is outside the primary routed GitHub surface.`,
     warning: ({ url: url3 }) => `Observed adjacent GitHub domain ${url3}. Archal did not reroute this request because it is outside the primary GitHub API route surface.`
   },
   sdkIdentifiers: ["@octokit/rest"],
@@ -54027,7 +54049,7 @@ var googleWorkspaceRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url3 }) => `Blocked Google Workspace traffic to ${url3}. Declare google-workspace in archalVitestProject({ services: { 'google-workspace': { mode: "route" } } }) before using the official Google client.`,
-    declaredEscape: ({ url: url3, configuredBaseUrl }) => `Blocked Google Workspace escape to ${url3}. Google Workspace route mode is configured, but this domain is outside the primary routed surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url3 }) => `Blocked Google Workspace escape to ${url3}. Google Workspace route mode is configured, but this domain is outside the primary routed surface.`,
     warning: ({ url: url3 }) => `Observed adjacent Google Workspace domain ${url3}. Archal did not reroute this request because it is outside the primary Google Workspace API route surface.`
   },
   sdkIdentifiers: ["googleapis"],
@@ -54049,7 +54071,7 @@ var apifyRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url3 }) => `Blocked Apify traffic to ${url3}. Declare apify before using the official Apify client.`,
-    declaredEscape: ({ url: url3, configuredBaseUrl }) => `Blocked Apify escape to ${url3}. Apify route mode is configured, but this domain is outside the primary routed Apify API surface. Configured clone base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url3 }) => `Blocked Apify escape to ${url3}. Apify route mode is configured, but this domain is outside the primary routed Apify API surface.`,
     warning: ({ url: url3 }) => `Observed adjacent Apify domain ${url3}. Archal did not reroute this request because it is outside the primary Apify API route surface.`
   },
   sdkIdentifiers: ["apify-client", "apify"],
@@ -54074,7 +54096,7 @@ var jiraRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url3 }) => `Blocked Jira traffic to ${url3}. Declare jira in archalVitestProject({ services: { jira: { mode: "route" } } }) before using the official Jira SDK.`,
-    declaredEscape: ({ url: url3, configuredBaseUrl }) => `Blocked Jira escape to ${url3}. Jira route mode is configured, but this domain is outside the primary routed Jira surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url3 }) => `Blocked Jira escape to ${url3}. Jira route mode is configured, but this domain is outside the primary routed Jira surface.`,
     warning: ({ url: url3 }) => `Observed adjacent Jira domain ${url3}. Archal did not reroute this request because it is outside the primary Jira route surface.`
   },
   sdkIdentifiers: ["jira.js"],
@@ -54095,7 +54117,7 @@ var linearRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url3 }) => `Blocked Linear traffic to ${url3}. Declare linear in archalVitestProject({ services: { linear: { mode: "route" } } }) before using the official Linear SDK.`,
-    declaredEscape: ({ url: url3, configuredBaseUrl }) => `Blocked Linear escape to ${url3}. Linear route mode is configured, but this domain is outside the primary routed Linear API surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url3 }) => `Blocked Linear escape to ${url3}. Linear route mode is configured, but this domain is outside the primary routed Linear API surface.`,
     warning: ({ url: url3 }) => `Observed adjacent Linear domain ${url3}. Archal did not reroute this request because it is outside the primary Linear API route surface.`
   },
   sdkIdentifiers: ["@linear/sdk"],
@@ -54117,7 +54139,7 @@ var rampRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url3 }) => `Blocked Ramp traffic to ${url3}. Declare ramp in archalVitestProject({ services: { ramp: { mode: "route" } } }) before using the official Ramp client.`,
-    declaredEscape: ({ url: url3, configuredBaseUrl }) => `Blocked Ramp escape to ${url3}. Ramp route mode is configured, but this domain is outside the primary routed Ramp API surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url3 }) => `Blocked Ramp escape to ${url3}. Ramp route mode is configured, but this domain is outside the primary routed Ramp API surface.`,
     warning: ({ url: url3 }) => `Observed adjacent Ramp domain ${url3}. Archal did not reroute this request because it is outside the primary Ramp API route surface.`
   },
   sdkIdentifiers: ["ramp"],
@@ -54150,7 +54172,7 @@ var slackRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url3 }) => `Blocked Slack traffic to ${url3}. Declare slack in archalVitestProject({ services: { slack: { mode: "route" } } }) before using the official Slack SDK.`,
-    declaredEscape: ({ url: url3, configuredBaseUrl }) => `Blocked Slack escape to ${url3}. Slack route mode is configured, but this domain is outside the primary routed Slack surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url3 }) => `Blocked Slack escape to ${url3}. Slack route mode is configured, but this domain is outside the primary routed Slack surface.`,
     warning: ({ url: url3 }) => `Observed adjacent Slack domain ${url3}. Archal did not reroute this request because it is outside the primary Slack API route surface.`
   },
   sdkIdentifiers: ["@slack/web-api"],
@@ -54218,7 +54240,7 @@ var stripeRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url3 }) => `Blocked Stripe traffic to ${url3}. Declare stripe in archalVitestProject({ services: { stripe: { mode: "route" } } }) before using the official Stripe SDK.`,
-    declaredEscape: ({ url: url3, configuredBaseUrl }) => `Blocked Stripe escape to ${url3}. Stripe route mode is configured, but this Stripe-owned domain is outside the current routed surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url3 }) => `Blocked Stripe escape to ${url3}. Stripe route mode is configured, but this Stripe-owned domain is outside the current routed surface.`,
     warning: ({ url: url3 }) => `Observed adjacent Stripe domain ${url3}. Archal did not reroute this request because it is outside the primary Stripe API route surface.`
   },
   runtimeSurface: stripeRuntimeSurface,
@@ -54241,7 +54263,7 @@ var supabaseRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url3 }) => `Blocked Supabase traffic to ${url3}. Declare supabase in archalVitestProject({ services: { supabase: { mode: "route" } } }) before using the official Supabase SDK.`,
-    declaredEscape: ({ url: url3, configuredBaseUrl }) => `Blocked Supabase escape to ${url3}. Supabase route mode is configured, but this domain is outside the primary routed Supabase surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url3 }) => `Blocked Supabase escape to ${url3}. Supabase route mode is configured, but this domain is outside the primary routed Supabase surface.`,
     warning: ({ url: url3 }) => `Observed adjacent Supabase domain ${url3}. Archal did not reroute this request because it is outside the primary Supabase route surface.`
   },
   sdkIdentifiers: ["@supabase/supabase-js"],
@@ -54263,7 +54285,7 @@ var tavilyRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url3 }) => `Blocked Tavily traffic to ${url3}. Declare tavily before using the official Tavily client.`,
-    declaredEscape: ({ url: url3, configuredBaseUrl }) => `Blocked Tavily escape to ${url3}. Tavily route mode is configured, but this domain is outside the primary routed Tavily API surface. Configured clone base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url3 }) => `Blocked Tavily escape to ${url3}. Tavily route mode is configured, but this domain is outside the primary routed Tavily API surface.`,
     warning: ({ url: url3 }) => `Observed adjacent Tavily domain ${url3}. Archal did not reroute this request because it is outside the primary Tavily API route surface.`
   },
   sdkIdentifiers: ["@tavily/core", "tavily"],
@@ -54307,10 +54329,25 @@ function buildServiceCompatibilityProfile(manifest) {
 }
 
 // ../route-runtime-core/src/runtime.ts
-var require2 = (0, import_node_module.createRequire)(typeof __filename === "string" ? __filename : __archal_import_meta_url);
+var require2 = (0, import_node_module.createRequire)(
+  typeof __filename === "string" && (0, import_node_path7.isAbsolute)(__filename) ? __filename : __archal_import_meta_url
+);
 var httpModule = require2("node:http");
 var httpsModule = require2("node:https");
 var SHARED_SERVICE_PROFILES = listSharedRouteManifests().map(buildServiceCompatibilityProfile);
+var CLIENT_VISIBLE_BLOCKED_REQUEST_MESSAGE = "Network request failed";
+function createClientVisibleNetworkError() {
+  return new TypeError(CLIENT_VISIBLE_BLOCKED_REQUEST_MESSAGE);
+}
+function sanitizeClientVisibleNetworkError(error95) {
+  const visibleError = error95;
+  for (const key of Reflect.ownKeys(error95)) {
+    delete visibleError[key];
+  }
+  error95.name = "TypeError";
+  error95.message = CLIENT_VISIBLE_BLOCKED_REQUEST_MESSAGE;
+  error95.stack = `${error95.name}: ${error95.message}`;
+}
 function now() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
@@ -54514,7 +54551,7 @@ var NodeRouteRuntime = class {
               response3 = await this.originalFetch(
                 buildRoutedFetchRequest(originalRequest, decision.targetUrl, service, init)
               );
-            } catch (error95) {
+            } catch {
               this.traceRequest({
                 method,
                 sourceUrl: sourceUrl.toString(),
@@ -54524,9 +54561,9 @@ var NodeRouteRuntime = class {
                 outcome: "failed",
                 reason: "network_error",
                 targetUrl,
-                error: errorMessage4(error95)
+                error: CLIENT_VISIBLE_BLOCKED_REQUEST_MESSAGE
               });
-              throw error95;
+              throw createClientVisibleNetworkError();
             }
             this.traceRequest({
               method,
@@ -54550,7 +54587,7 @@ var NodeRouteRuntime = class {
               ...init,
               headers
             });
-          } catch (error95) {
+          } catch {
             this.traceRequest({
               method,
               sourceUrl: sourceUrl.toString(),
@@ -54560,9 +54597,9 @@ var NodeRouteRuntime = class {
               outcome: "failed",
               reason: "network_error",
               targetUrl,
-              error: errorMessage4(error95)
+              error: CLIENT_VISIBLE_BLOCKED_REQUEST_MESSAGE
             });
-            throw error95;
+            throw createClientVisibleNetworkError();
           }
           this.traceRequest({
             method,
@@ -54972,28 +55009,29 @@ var NodeRouteRuntime = class {
     if (record3.target === "twin") {
       request.once("response", sanitizeIncomingResponseHeaders);
     }
-    if (!this.traceEnabled) {
-      return request;
-    }
     let settled = false;
-    request.once("response", (response) => {
-      settled = true;
-      this.traceRequest({
-        ...record3,
-        statusCode: response.statusCode,
-        statusText: response.statusMessage
+    if (this.traceEnabled) {
+      request.once("response", (response) => {
+        settled = true;
+        this.traceRequest({
+          ...record3,
+          statusCode: response.statusCode,
+          statusText: response.statusMessage
+        });
       });
-    });
+    }
     request.once("error", (error95) => {
-      if (settled) {
-        return;
+      if (this.traceEnabled && !settled) {
+        this.traceRequest({
+          ...record3,
+          outcome: "failed",
+          reason: "network_error",
+          error: record3.target === "twin" ? CLIENT_VISIBLE_BLOCKED_REQUEST_MESSAGE : error95.message
+        });
+      }
+      if (record3.target === "twin") {
+        sanitizeClientVisibleNetworkError(error95);
       }
-      this.traceRequest({
-        ...record3,
-        outcome: "failed",
-        reason: "network_error",
-        error: error95.message
-      });
     });
     return request;
   }
@@ -74449,7 +74487,7 @@ var import_node_fs8 = require("fs");
 // ../../twins/core/src/seed-loader.ts
 var import_promises = require("fs/promises");
 var import_node_fs7 = require("fs");
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 var import_node_url2 = require("url");
 
 // ../../twins/core/src/mcp/mcp-handler-runtime.ts
@@ -74458,12 +74496,12 @@ var import_node_perf_hooks = require("perf_hooks");
 
 // ../../twins/core/src/fixture-oracle.ts
 var import_node_fs9 = require("fs");
-var import_node_path8 = require("path");
+var import_node_path9 = require("path");
 var import_node_url3 = require("url");
 
 // ../../twins/core/src/run-twin-cli.ts
 var import_node_fs10 = require("fs");
-var import_node_path9 = require("path");
+var import_node_path10 = require("path");
 
 // ../../twins/manifest.json
 var manifest_default2 = [
@@ -74940,7 +74978,7 @@ var SCENARIO_RISK_TAXONOMY2 = SCENARIO_RISK_RULES2.map(
 var import_node_crypto10 = require("crypto");
 var import_node_fs11 = require("fs");
 var import_node_os4 = require("os");
-var import_node_path10 = require("path");
+var import_node_path11 = require("path");
 var RecordingManifestEntrySchema2 = external_exports4.object({
   filename: external_exports4.string(),
   sha256: external_exports4.string().regex(/^[0-9a-f]{64}$/, "sha256 must be 64 lowercase hex chars"),
@@ -74963,7 +75001,7 @@ var RecordingManifestSchema2 = external_exports4.object({
   entries: external_exports4.array(RecordingManifestEntrySchema2)
 }).loose();
 var DEFAULT_BASE_URL2 = process.env["ARCHAL_FIXTURE_BASE_URL"] ?? "https://archalforge8f96908966.blob.core.windows.net/archal-fixture-artifacts?sv=2023-11-03&spr=https&se=2031-05-10T00%3A00%3A00Z&sr=c&sp=rl&sig=r3%2FC3EwzilSHls8z3Pn5ZR%2BkinwQw1C6%2BDKObIZSIu0%3D";
-var DEFAULT_CACHE_ROOT2 = process.env["ARCHAL_FIXTURE_CACHE_ROOT"] ?? (0, import_node_path10.resolve)((0, import_node_os4.homedir)(), ".archal", "forge", "recordings-cache");
+var DEFAULT_CACHE_ROOT2 = process.env["ARCHAL_FIXTURE_CACHE_ROOT"] ?? (0, import_node_path11.resolve)((0, import_node_os4.homedir)(), ".archal", "forge", "recordings-cache");
 function warnIfSasExpiresSoon2(baseUrl) {
   if (process.env["ARCHAL_FIXTURE_SAS_WARN"] === "0") return;
   const queryIdx = baseUrl.indexOf("?");
@@ -75016,7 +75054,7 @@ function resolveArchalVitestServiceProfiles(services) {
 var import_node_crypto12 = require("crypto");
 var import_node_child_process2 = require("child_process");
 var import_node_fs12 = require("fs");
-var import_node_path11 = require("path");
+var import_node_path12 = require("path");
 var import_node_os5 = require("os");
 
 // src/url-resolution.ts
@@ -75070,16 +75108,16 @@ function toSafeCoordinatorDirectoryName(sessionKey) {
   return `${slug2 || "session"}-${hash3}`;
 }
 function resolveCoordinatorPaths(config3) {
-  const baseDirectory = (0, import_node_path11.resolve)(
-    trimEnv("ARCHAL_VITEST_COORDINATOR_DIR") ?? (0, import_node_path11.join)((0, import_node_os5.tmpdir)(), "archal-vitest")
+  const baseDirectory = (0, import_node_path12.resolve)(
+    trimEnv("ARCHAL_VITEST_COORDINATOR_DIR") ?? (0, import_node_path12.join)((0, import_node_os5.tmpdir)(), "archal-vitest")
   );
   const sessionKey = config3.sessionKey ?? `${config3.projectName}-${(0, import_node_crypto12.randomUUID)()}`;
-  const directory = (0, import_node_path11.resolve)(baseDirectory, toSafeCoordinatorDirectoryName(sessionKey));
+  const directory = (0, import_node_path12.resolve)(baseDirectory, toSafeCoordinatorDirectoryName(sessionKey));
   return {
     directory,
-    lockDirectory: (0, import_node_path11.join)(directory, "lock"),
-    statePath: (0, import_node_path11.join)(directory, "state.json"),
-    reaperPidPath: (0, import_node_path11.join)(directory, "reaper.pid")
+    lockDirectory: (0, import_node_path12.join)(directory, "lock"),
+    statePath: (0, import_node_path12.join)(directory, "state.json"),
+    reaperPidPath: (0, import_node_path12.join)(directory, "reaper.pid")
   };
 }
 function shouldStopSessionOnRelease() {
@@ -75935,7 +75973,7 @@ function isTruthyEnv(value) {
 }
 function formatTraceRecord(record3) {
   const manifestStatus = record3.manifestMatched ? `matched ${record3.service ?? "manifest"}` : "no manifest match";
-  const destination = record3.target === "twin" ? `twin${record3.targetUrl ? ` ${record3.targetUrl}` : ""}` : record3.target === "upstream" ? "real upstream" : "blocked";
+  const destination = record3.target === "twin" ? "service endpoint" : record3.target === "upstream" ? "real upstream" : "blocked";
   const status = record3.statusCode === void 0 ? record3.error ? `error=${record3.error}` : "no status" : `${record3.statusCode}${record3.statusText ? ` ${record3.statusText}` : ""}`;
   return `\x1B[2m[archal:route] ${record3.method} ${record3.sourceUrl} | ${manifestStatus} | ${record3.outcome} -> ${destination} | ${status}\x1B[0m
 `;
@@ -76571,12 +76609,12 @@ var ArchalReporter = class {
 // src/seed-files.ts
 var import_node_crypto13 = require("crypto");
 var import_node_fs13 = require("fs");
-var import_node_path12 = require("path");
+var import_node_path13 = require("path");
 var MAX_SEED_FILE_BYTES = 256 * 1024;
 function classifySeed(value) {
   const trimmed = value.trim();
   if (trimmed.startsWith("./") || trimmed.startsWith("../") || trimmed.startsWith("/")) {
-    const ext = (0, import_node_path12.extname)(trimmed).toLowerCase();
+    const ext = (0, import_node_path13.extname)(trimmed).toLowerCase();
     if (ext === ".json") return { type: "file", path: trimmed, format: "json" };
     if (ext === ".md") return { type: "file", path: trimmed, format: "markdown" };
     throw new Error(
@@ -76586,14 +76624,14 @@ function classifySeed(value) {
     );
   }
   if (trimmed.endsWith(".json") || trimmed.endsWith(".md")) {
-    const ext = (0, import_node_path12.extname)(trimmed).toLowerCase();
+    const ext = (0, import_node_path13.extname)(trimmed).toLowerCase();
     const format = ext === ".json" ? "json" : "markdown";
     return { type: "file", path: trimmed, format };
   }
   return { type: "named", name: trimmed };
 }
 function readSeedFile(seedPath, serviceName) {
-  const resolved = (0, import_node_path12.resolve)(seedPath);
+  const resolved = (0, import_node_path13.resolve)(seedPath);
   if (!(0, import_node_fs13.existsSync)(resolved)) {
     throw new Error(
       `Seed file not found for ${serviceName}: ${resolved}
@@ -76708,8 +76746,8 @@ var DEFAULT_EXCLUDE_PATTERNS = [
 ];
 var ARCHAL_VITEST_WIRING_MARKER_ENV = "ARCHAL_VITEST_WIRING_MARKER";
 var ARCHAL_VITEST_WORKSPACE_REPORTER_MARKER_ENV = "ARCHAL_VITEST_WORKSPACE_REPORTER_MARKER";
-var currentModuleFile = typeof __filename === "string" ? __filename : (0, import_node_url4.fileURLToPath)(__archal_import_meta_url);
-var reporterEntryModule = (0, import_node_path13.resolve)((0, import_node_path13.dirname)(currentModuleFile), "../reporter-entry.js");
+var currentModuleFile = typeof __filename === "string" && (0, import_node_path14.isAbsolute)(__filename) ? __filename : (0, import_node_url4.fileURLToPath)(__archal_import_meta_url);
+var reporterEntryModule = (0, import_node_path14.resolve)((0, import_node_path14.dirname)(currentModuleFile), "../reporter-entry.js");
 function buildTestConfig(options, testOptions) {
   markHelperCalled();
   assertSupportedArchalVitestServices(options.services);

package/dist/vitest/index.d.ts

@@ -54,7 +54,7 @@ interface ArchalRuntime {
  * can impersonate the developer for the life of the token.
  *
  * Userland should never need the auth header — the route-mode runtime
- * injects it directly into outbound twin requests without routing through
+ * injects it directly into outbound clone requests without routing through
  * userland code. The redacted snapshot exposes just the metadata tests
  * legitimately need: session id, service names, base URLs, resolved seeds,
  * manifest versions.

package/dist/vitest/index.js

@@ -8,15 +8,15 @@ import {
   readArchalVitestConfig,
   resetArchalClones,
   resolveRuntimeModule
-} from "./chunk-2GY4SFKE.js";
+} from "./chunk-FU2VLK75.js";
 import {
   encodeConfig,
   getCredentials,
   getSessionIdFilePath
-} from "./chunk-WVRVNHAX.js";
+} from "./chunk-CJJ32YQF.js";
 
 // src/index.ts
-import { dirname, resolve as resolve2 } from "path";
+import { dirname, isAbsolute, resolve as resolve2 } from "path";
 import { fileURLToPath } from "url";
 import { defineProject } from "vitest/config";
 
@@ -865,7 +865,7 @@ var DEFAULT_EXCLUDE_PATTERNS = [
 ];
 var ARCHAL_VITEST_WIRING_MARKER_ENV = "ARCHAL_VITEST_WIRING_MARKER";
 var ARCHAL_VITEST_WORKSPACE_REPORTER_MARKER_ENV = "ARCHAL_VITEST_WORKSPACE_REPORTER_MARKER";
-var currentModuleFile = typeof __filename === "string" ? __filename : fileURLToPath(import.meta.url);
+var currentModuleFile = typeof __filename === "string" && isAbsolute(__filename) ? __filename : fileURLToPath(import.meta.url);
 var reporterEntryModule = resolve2(dirname(currentModuleFile), "../reporter-entry.js");
 function buildTestConfig(options, testOptions) {
   markHelperCalled();

package/dist/vitest/runtime/hosted-session-reaper.js

@@ -4,7 +4,7 @@ import {
   createHostedAuthLease,
   parsePositiveInteger,
   runHostedSessionReaper
-} from "../chunk-WVRVNHAX.js";
+} from "../chunk-CJJ32YQF.js";
 
 // src/runtime/hosted-session-reaper.ts
 var VITEST_AUTH_LEASE_OPTIONS = {

package/dist/vitest/runtime/setup-files.js

@@ -1,7 +1,7 @@
 import {
   bootstrapArchalVitestRouting
-} from "../chunk-2GY4SFKE.js";
-import "../chunk-WVRVNHAX.js";
+} from "../chunk-FU2VLK75.js";
+import "../chunk-CJJ32YQF.js";
 
 // src/runtime/setup-files.ts
 import { existsSync, rmSync } from "fs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "archal",
-  "version": "0.9.15",
+  "version": "0.9.16",
   "description": "Test your agents & integrations against service clones",
   "type": "module",
   "main": "dist/index.cjs",
@@ -40,7 +40,7 @@
     "vitest"
   ],
   "engines": {
-    "node": ">=22"
+    "node": ">=20.20"
   },
   "files": [
     "bin",

package/skills/eval/SKILL.md

@@ -28,7 +28,7 @@ AGENT_TASK="Reply with OK and do not use tools." node ./.archal/harness.mjs
 
 A wired harness that exits cleanly with no service calls is ready. If it says the starter harness is still a stub, edit `.archal/harness.mjs` to call the user's Cursor, Codex, Claude Code, or custom agent first. Other failures catch: no runnable entrypoint, UI-boot assumptions, missing provider keys, service bridge misconfig.
 
-If a local harness returns text but records zero clone-observed calls, check for real-service auth signals such as `api.github.com` plus `401`/`Bad credentials`. That means the harness did not reach the clone. Fix by running the SDK under sandbox/Docker routing, or by wiring the SDK to the clone REST URL pattern shown by `archal clone start <service>` / `archal clone status` and authenticating with `ARCHAL_TOKEN`.
+If a local harness returns text but records zero clone-observed calls, check for real-service auth signals such as `api.github.com` plus `401`/`Bad credentials`. That means the harness did not reach the clone. Fix by running the SDK under sandbox/Docker routing, or by reading `AGENT_CLONE_URLS` for clone REST URLs and adding the JSON headers from `AGENT_ROUTE_HEADERS` to clone requests.
 
 ## Running
 

package/skills/onboard/SKILL.md

@@ -85,7 +85,7 @@ Confirm detected clones, then ask which of these the user wants. Each delegates
 - `"agent": { "command": "node", "args": ["./agent.js"] }` - plain Node script
 - `"agent": { "command": "python", "args": ["agent.py"] }` - Python agent
 
-If the user doesn't have a harness yet, prefer `npx archal init`; it creates `./.archal/harness.mjs`, points `.archal.json` at it, and adds a starter scenario without overwriting existing files. The generated harness is a guarded stub: Archal refuses to score it until the user edits it to call their Cursor, Codex, Claude Code, or custom agent. A custom harness should read `AGENT_TASK` from env, call the agent runtime, print `{ "text": "..." }` to stdout, and call `reportAgentMetrics()` from `archal/harness` with accumulated `{ inputTokens, outputTokens, llmCallCount }` before exit. Service clients need one explicit routing mode: use sandbox/Docker routing when the harness calls normal service URLs such as `https://api.github.com`, or configure SDK base URLs to the clone REST URL pattern shown by `archal clone start <service>` / `archal clone status` and authenticate those requests with `ARCHAL_TOKEN`. Alternative: skip `agent` in `.archal.json` and pass `--harness <path>` per-run.
+If the user doesn't have a harness yet, prefer `npx archal init`; it creates `./.archal/harness.mjs`, points `.archal.json` at it, and adds a starter scenario without overwriting existing files. The generated harness is a guarded stub: Archal refuses to score it until the user edits it to call their Cursor, Codex, Claude Code, or custom agent. A custom harness should read `AGENT_TASK` from env, call the agent runtime, print `{ "text": "..." }` to stdout, and call `reportAgentMetrics()` from `archal/harness` with accumulated `{ inputTokens, outputTokens, llmCallCount }` before exit. Service clients need one explicit routing mode: use sandbox/Docker routing when the harness calls normal service URLs such as `https://api.github.com`, or configure SDK base URLs from `AGENT_CLONE_URLS` and add the JSON headers from `AGENT_ROUTE_HEADERS` to those clone requests. Alternative: skip `agent` in `.archal.json` and pass `--harness <path>` per-run.
 
 ### Option A - Evaluate an agent with scenarios