orizu 0.4.0 → 0.5.0

package/dist/egress-policy.js

@@ -0,0 +1,159 @@
+/**
+ * G5 — sandbox egress policy builder (ALI-1006, per the hosted-agent threat
+ * model T1). Owns the ALLOWLIST CONTENT the `SandboxProvider` seam plumbs to the
+ * sandbox firewall at create (`packages/cli/src/vercel-sandbox-provider.ts` →
+ * Vercel `networkPolicy`). The Vercel adapter is a pass-through; this file is
+ * where "default-deny with a per-team allowlist (Orizu API, model providers, git
+ * host); blocked attempts logged" is actually decided.
+ *
+ * The policy is DEFAULT-DENY: the record form `{ allow: { host: rules } }` denies
+ * everything NOT explicitly listed, so the correctness invariant is simply that
+ * we NEVER emit a `"*"` allow entry (which would re-open the sandbox). The
+ * model-key credential broker (G3 / `buildModelKeyBrokerPolicy`) is COMPOSED onto
+ * the model host's rule here so brokering + allowlisting are ONE coherent policy,
+ * not two policies that could disagree.
+ *
+ * SNI matching (verified against @vercel/sandbox@1.10.2 `NetworkPolicy`): an
+ * allow entry matches the exact SNI host; a LEADING-wildcard entry (`*.orizu.ai`)
+ * matches any single-or-multi-label subdomain but NOT the apex — so a host that
+ * must serve BOTH apex and subdomains is listed twice (`orizu.ai` +
+ * `*.orizu.ai`). Domains are hostnames only — never a protocol, path, or port.
+ *
+ * The BASE allowlist (Orizu API + model provider + git host) is CODE-OWNED and
+ * non-negotiable: `buildEgressPolicy` always includes it and per-team config can
+ * only ADD to it, never remove a base host. See
+ * docs/requirements/hosted-customer-workbench/sandbox-egress-policy.md for the
+ * rationale per host and the honest statement of what Vercel enforces (firewall,
+ * SNI-level) vs. what we generate (blocked-attempt evidence via the canary).
+ */
+/** Default model-provider endpoint (Anthropic) the broker injects a key for. */
+export const ANTHROPIC_API_HOST = 'api.anthropic.com';
+/** Anthropic authenticates with `x-api-key` (not a Bearer Authorization). */
+export const ANTHROPIC_API_KEY_HEADER = 'x-api-key';
+/** GitHub git-over-HTTPS SNIs. `git clone`/`git push` over the smart HTTP
+ *  protocol connect to `github.com`; `codeload.github.com` serves repository
+ *  archive/tarball fetches (release assets, `pip`/`go` github-archive installs).
+ *  Both are allowed so the agent's git work AND any archive fetch its workflow
+ *  triggers succeed — everything else on github's infra stays denied. */
+export const GIT_HOST_DOMAINS = ['github.com', 'codeload.github.com'];
+/** Default host the startup canary probes to PROVE the policy is live (a known
+ *  non-allowlisted host: reaching it means egress is NOT enforced). */
+export const DEFAULT_EGRESS_CANARY_HOST = 'example.com';
+/** Default Orizu control-plane base when none is configured. */
+const DEFAULT_ORIZU_BASE_URL = 'https://orizu.ai';
+/**
+ * Resolve the Orizu control-plane host from a base URL and CONSERVATIVELY
+ * wildcard its registrable base domain so the policy survives the API moving to
+ * a subdomain (e.g. `api.orizu.ai`) without re-opening egress. Returns the apex
+ * PLUS a leading-wildcard for its subdomains: `orizu.ai` + `*.orizu.ai`. A
+ * loopback/localhost base (rehearsal) yields just the bare host (no wildcard —
+ * there is nothing to broaden and the firewall does not enforce it anyway).
+ */
+export function orizuEgressDomains(baseUrl) {
+    const raw = (baseUrl ?? process.env.ORIZU_BASE_URL ?? DEFAULT_ORIZU_BASE_URL).trim();
+    let host;
+    try {
+        host = new URL(raw).hostname.toLowerCase();
+    }
+    catch {
+        // Not a URL — treat the value as a bare host (strip any stray path/port).
+        host = raw.replace(/^[a-z]+:\/\//i, '').split('/')[0].split(':')[0].toLowerCase();
+    }
+    if (!host)
+        return [DEFAULT_ORIZU_BASE_URL.replace('https://', '')];
+    // Loopback / single-label hosts: no base-domain to wildcard.
+    if (host === 'localhost' || host === '127.0.0.1' || !host.includes('.')) {
+        return [host];
+    }
+    const labels = host.split('.');
+    // Registrable base = last two labels (orizu.ai from api.orizu.ai). Good enough
+    // for our single first-party domain; a multi-part TLD would over-broaden, but
+    // the base host is always our own domain so this is a controlled input.
+    const baseDomain = labels.slice(-2).join('.');
+    const domains = new Set([baseDomain, `*.${baseDomain}`]);
+    // Also allow the exact configured host if it is a deeper subdomain than the
+    // wildcard's single-level match would guarantee (belt-and-braces).
+    domains.add(host);
+    return [...domains];
+}
+/**
+ * Normalize a per-team extra domain to a bare hostname (or leading-wildcard).
+ * Strips protocol/path/port, lowercases, and validates the SNI shape. Returns
+ * null for anything that is not a plausible hostname so a bad config entry is
+ * dropped rather than silently widening the policy in an unexpected way.
+ */
+export function normalizeEgressDomain(input) {
+    let value = input.trim().toLowerCase();
+    if (!value)
+        return null;
+    value = value.replace(/^[a-z]+:\/\//i, ''); // strip scheme
+    value = value.split('/')[0]; // strip path
+    value = value.split(':')[0]; // strip port
+    if (!value)
+        return null;
+    // A leading `*.` wildcard is allowed; validate the remainder as a hostname.
+    const hostPart = value.startsWith('*.') ? value.slice(2) : value;
+    // Labels: alphanumeric + hyphen, dot-separated, at least one dot (reject bare
+    // single labels and anything with illegal characters, spaces, or `*` mid-host).
+    if (!/^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/.test(hostPart)) {
+        return null;
+    }
+    return value;
+}
+/**
+ * Compute the ordered list of BASE (code-owned, non-removable) allow domains for
+ * an Orizu base URL: the Orizu control-plane host(s), the model provider host,
+ * and the git host(s). Exported so tests and the policy doc assert the exact set.
+ */
+export function baseEgressDomains(opts = {}) {
+    const domains = new Set();
+    for (const d of orizuEgressDomains(opts.orizuBaseUrl))
+        domains.add(d);
+    domains.add(opts.modelHost ?? ANTHROPIC_API_HOST);
+    for (const d of opts.modelHosts ?? []) {
+        const n = normalizeEgressDomain(d);
+        if (n)
+            domains.add(n);
+    }
+    for (const d of GIT_HOST_DOMAINS)
+        domains.add(d);
+    return [...domains];
+}
+/**
+ * Build a DEFAULT-DENY Vercel network policy whose allowlist is exactly the base
+ * hosts (Orizu API + model provider + git) plus any valid per-team extra domains,
+ * with the model-key broker transform COMPOSED onto the model host's rule.
+ *
+ * Correctness invariants (unit-tested):
+ *   - record form → default-deny (no `"*"` key is EVER emitted);
+ *   - every base host is present;
+ *   - the broker transform sits on the model host's rule (one coherent policy);
+ *   - base hosts survive regardless of `extraDomains` (cannot be removed).
+ */
+export function buildEgressPolicy(opts = {}) {
+    const brokerHost = opts.modelKeyBroker?.host ?? ANTHROPIC_API_HOST;
+    const base = baseEgressDomains({
+        orizuBaseUrl: opts.orizuBaseUrl,
+        modelHost: brokerHost,
+        modelHosts: opts.modelHosts,
+    });
+    const allow = {};
+    for (const domain of base)
+        allow[domain] = [];
+    // Additive per-team domains: normalized + de-duped; NEVER able to unset a base
+    // host (base was inserted first; a repeat just re-sets the same empty rule).
+    for (const raw of opts.extraDomains ?? []) {
+        const domain = normalizeEgressDomain(raw);
+        if (domain)
+            allow[domain] = allow[domain] ?? [];
+    }
+    // Compose the broker transform onto the model host's rule (G3 + G5 as one
+    // policy). The raw key stays host-side in this object; it is never written into
+    // the sandbox — OpenCode is given a non-secret dummy key and the proxy overrides
+    // the real header on matching egress.
+    if (opts.modelKeyBroker) {
+        const headerName = opts.modelKeyBroker.headerName ?? ANTHROPIC_API_KEY_HEADER;
+        allow[brokerHost] = [{ transform: [{ headers: { [headerName]: opts.modelKeyBroker.apiKey } }] }];
+    }
+    return { allow };
+}

package/dist/git-credential.js

@@ -0,0 +1,131 @@
+/**
+ * Git credential helper (ALI-971 / WS-D).
+ *
+ * Implements git's credential-helper protocol on stdin/stdout so teammates can
+ * `git pull`/`git push` the hosted workbench repo with NO GitHub identity: git
+ * asks this helper for a credential, we broker a short-lived, downscoped
+ * installation token from Orizu and hand it back as `x-access-token:<token>`.
+ * The token is never written to disk (60-min TTL is the backstop).
+ *
+ * Protocol: git runs `orizu git-credential <op>` where op is get|store|erase
+ * and feeds `key=value` lines on stdin terminated by a blank line. Only `get`
+ * does work; `store`/`erase` are no-ops. For `get` we respond only when the
+ * host is github.com AND the cwd resolves to an attached Orizu workspace —
+ * otherwise we stay silent so git falls through to its normal handling.
+ *
+ * Purpose selection: git does not tell us read-vs-write intent, so we mint
+ * `write` first (the common push case for curators) and fall back to `read` on
+ * a 403 (plain members). Pure logic + injected fetcher/io: index.ts stays thin.
+ */
+import { existsSync } from 'fs';
+import { dirname, join } from 'path';
+import { authedFetch } from './http.js';
+import { readJsonManifest } from './workspace.js';
+const GITHUB_HOST = 'github.com';
+export function parseCredentialInput(stdin) {
+    const map = {};
+    for (const rawLine of stdin.split('\n')) {
+        const line = rawLine.replace(/\r$/, '');
+        if (!line)
+            continue;
+        const eq = line.indexOf('=');
+        if (eq <= 0)
+            continue;
+        map[line.slice(0, eq)] = line.slice(eq + 1);
+    }
+    return map;
+}
+/**
+ * Walk up from `cwd` to the workspace root (the dir holding orizu.team.json) and
+ * return its bound workspace id, or null if this is not an attached workspace.
+ */
+export function resolveAttachedWorkspaceId(cwd) {
+    let dir = cwd;
+    for (;;) {
+        const manifestPath = join(dir, 'orizu.team.json');
+        if (existsSync(manifestPath)) {
+            const manifest = readJsonManifest(manifestPath);
+            const canonical = manifest?.canonical;
+            const serviceId = canonical && typeof canonical === 'object' && !Array.isArray(canonical)
+                ? canonical.serviceId
+                : null;
+            if (typeof serviceId === 'string' && serviceId)
+                return serviceId;
+            const setup = manifest?.setup;
+            const attached = setup && typeof setup === 'object' && !Array.isArray(setup)
+                ? setup.attachedWorkspaceId
+                : null;
+            return typeof attached === 'string' && attached ? attached : null;
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/**
+ * Resolve the workspace id, preferring an explicit override, then the
+ * `ORIZU_WORKSPACE_ID` env var (set during `git clone` so the helper works
+ * before the working tree — and thus orizu.team.json — exists), then the cwd
+ * manifest walk for steady-state pull/push.
+ */
+export function resolveWorkspaceId(io) {
+    if (io.workspaceId)
+        return io.workspaceId;
+    const fromEnv = process.env.ORIZU_WORKSPACE_ID?.trim();
+    if (fromEnv)
+        return fromEnv;
+    return resolveAttachedWorkspaceId(io.cwd);
+}
+async function mintToken(fetcher, workspaceId, purpose) {
+    const response = await fetcher(`/api/cli/workspaces/${encodeURIComponent(workspaceId)}/repo-token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ purpose }),
+    });
+    if (response.ok) {
+        const data = (await response.json());
+        if (data.token)
+            return { ok: true, token: data.token };
+        return { ok: false, status: response.status, error: 'Broker returned no token' };
+    }
+    let error = `status ${response.status}`;
+    try {
+        const body = (await response.json());
+        if (body.error)
+            error = body.error;
+    }
+    catch {
+        // Non-JSON body; keep the status-based message.
+    }
+    return { ok: false, status: response.status, error };
+}
+export async function runGitCredential(op, io) {
+    // store/erase are no-ops: we never persist a credential to disk.
+    if (op !== 'get')
+        return 0;
+    const input = parseCredentialInput(io.stdin);
+    // Only broker for github.com; anything else is git's own business.
+    if (input.host && input.host !== GITHUB_HOST)
+        return 0;
+    const workspaceId = resolveWorkspaceId(io);
+    if (!workspaceId) {
+        // Unattached directory: stay silent so git falls through cleanly.
+        return 0;
+    }
+    const fetcher = io.fetcher ?? authedFetch;
+    // Mint write first (curators/pushers), fall back to read on 403 (members).
+    let minted = await mintToken(fetcher, workspaceId, 'write');
+    if (!minted.ok && minted.status === 403) {
+        minted = await mintToken(fetcher, workspaceId, 'read');
+    }
+    if (!minted.ok) {
+        io.printErr(`orizu git-credential: could not broker a token for this workspace (${minted.error}). ` +
+            'Ensure you are logged in (`orizu login`) and a team admin/curator has provisioned the repo.');
+        return 0;
+    }
+    io.print('username=x-access-token');
+    io.print(`password=${minted.token}`);
+    io.print('');
+    return 0;
+}

package/dist/github-setup.js

@@ -0,0 +1,226 @@
+/**
+ * GitHub link + hosted-repo attach for `orizu setup` (ALI-971 / WS-C + WS-D).
+ *
+ * Pure logic + injected HTTP/git/io so index.ts stays thin and the flows are
+ * unit-testable without a real browser, server, or git. Two responsibilities:
+ *
+ *   1. `runGithubLink` — the REQUIRED team-setup link step: POST the link route,
+ *      open/print the App-install URL, then poll until the org is connected
+ *      (with a timeout + resume guidance).
+ *   2. `runHostedAttach` — clone the provisioned workbench repo and wire the
+ *      repo-local git credential helper so future pull/push flow through the
+ *      Orizu broker. Never stores a long-lived credential: the clone uses a
+ *      one-shot brokered token embedded only in the transient clone URL, which
+ *      is immediately rewritten to a clean origin.
+ */
+import { spawnSync } from 'child_process';
+import { mkdirSync } from 'fs';
+import { join } from 'path';
+import { authedFetch } from './http.js';
+const DEFAULT_POLL_INTERVAL_MS = 2000;
+const DEFAULT_POLL_TIMEOUT_MS = 180000;
+function defaultSleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+async function readError(response) {
+    try {
+        const body = (await response.json());
+        if (body.error)
+            return body.error;
+    }
+    catch {
+        // fall through to status text
+    }
+    return `status ${response.status}`;
+}
+/**
+ * Begin (or resume) the required GitHub link for a team and block until the
+ * customer org is connected. Throws with resume guidance on timeout.
+ */
+export async function runGithubLink(teamSlug, io) {
+    const fetcher = io.fetcher ?? authedFetch;
+    const start = await fetcher('/api/cli/github/link', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ teamSlug }),
+    });
+    if (start.status === 409) {
+        io.print('   GitHub org already connected for this team.');
+        return { status: 'active', orgLogin: null, alreadyLinked: true };
+    }
+    if (!start.ok) {
+        throw new Error(`Failed to start GitHub link: ${await readError(start)}`);
+    }
+    const { installUrl, state } = (await start.json());
+    io.print('   Connect your team GitHub org by installing the Orizu GitHub App:');
+    io.print(`     ${installUrl}`);
+    if (io.openUrl) {
+        io.openUrl(installUrl);
+        io.print('   Opened the install page in your browser. Waiting for you to finish...');
+    }
+    else {
+        io.print('   Open the URL above, install the App, then return here. Waiting...');
+    }
+    const now = io.now ?? (() => Date.now());
+    const sleep = io.sleep ?? defaultSleep;
+    const interval = io.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+    const timeout = io.pollTimeoutMs ?? DEFAULT_POLL_TIMEOUT_MS;
+    const deadline = now() + timeout;
+    for (;;) {
+        const poll = await fetcher(`/api/cli/github/link?state=${encodeURIComponent(state)}`);
+        if (poll.ok) {
+            const data = (await poll.json());
+            if (data.status === 'active') {
+                io.print(`   GitHub org connected${data.orgLogin ? ` (${data.orgLogin})` : ''}.`);
+                return { status: 'active', orgLogin: data.orgLogin ?? null, alreadyLinked: false };
+            }
+            if (data.status === 'pending_confirmation') {
+                return await confirmLink(teamSlug, data.orgLogin ?? null, io, fetcher);
+            }
+        }
+        if (now() >= deadline) {
+            throw new Error('Timed out waiting for the GitHub App install to complete. ' +
+                `Resume with \`orizu github link --team ${teamSlug}\` after finishing the install.`);
+        }
+        await sleep(interval);
+    }
+}
+/**
+ * The install callback bound an org but left the row `pending_confirmation`.
+ * Confirm the org with the human (second factor), then complete via the
+ * authenticated confirm endpoint — this is the only path to `active`.
+ */
+async function confirmLink(teamSlug, orgLogin, io, fetcher) {
+    io.print(`   GitHub reported installation on org: ${orgLogin ?? '(unknown)'}`);
+    if (!io.confirm) {
+        throw new Error(`Org ${orgLogin ?? '(unknown)'} is bound but needs confirmation. ` +
+            `Run \`orizu github link --team ${teamSlug}\` interactively to confirm.`);
+    }
+    const approved = await io.confirm(orgLogin);
+    if (!approved) {
+        throw new Error(`Did not confirm org ${orgLogin ?? '(unknown)'}. ` +
+            `Re-run \`orizu github link --team ${teamSlug}\` to link the correct org.`);
+    }
+    const resp = await fetcher('/api/cli/github/link/confirm', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ teamSlug, orgLogin }),
+    });
+    if (!resp.ok) {
+        throw new Error(`Failed to confirm GitHub link: ${await readError(resp)}`);
+    }
+    const confirmed = (await resp.json());
+    io.print(`   GitHub org connected (${confirmed.orgLogin ?? orgLogin ?? 'linked'}).`);
+    return { status: 'active', orgLogin: confirmed.orgLogin ?? orgLogin, alreadyLinked: false };
+}
+/**
+ * Decide how `orizu setup` should materialize the workspace. `--local` (or the
+ * absence of a linked org) keeps Phase 1 scaffolding; a linked org with a
+ * provisioned repo attaches by clone; a linked org without a repo provisions
+ * first, then attaches.
+ */
+export function decideSetupMode(input) {
+    if (input.local || !input.activeInstallation)
+        return 'local';
+    return input.repoFullName ? 'attach' : 'provision-then-attach';
+}
+function gitOrThrow(git, args, opts) {
+    const result = git(args, opts);
+    if (result.status !== 0) {
+        throw new Error(`git ${args[0]} failed: ${result.stderr || `exit ${result.status}`}`);
+    }
+}
+const CREDENTIAL_HELPER = '!orizu git-credential';
+/**
+ * Provision-if-needed, then clone with the Orizu credential helper already
+ * configured so the brokered token NEVER touches argv, the clone URL, or
+ * .git/config. The helper resolves the workspace during clone via the
+ * `ORIZU_WORKSPACE_ID` env var (the working tree — and orizu.team.json — does
+ * not exist yet), then mints on demand. Repo-local config persists the helper
+ * for subsequent pull/push, which resolve the workspace from cwd.
+ */
+export async function runHostedAttach(options, io) {
+    const fetcher = io.fetcher ?? authedFetch;
+    let repoFullName = options.repoFullName;
+    let provisioned = false;
+    if (!repoFullName) {
+        io.print('   Provisioning the hosted workbench repo...');
+        const response = await fetcher(`/api/cli/workspaces/${encodeURIComponent(options.workspaceId)}/provision-repo`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({}),
+        });
+        if (!response.ok) {
+            throw new Error(`Failed to provision workbench repo: ${await readError(response)}`);
+        }
+        const data = (await response.json());
+        repoFullName = data.repo;
+        provisioned = true;
+    }
+    const cleanUrl = `https://github.com/${repoFullName}.git`;
+    io.print(`   Cloning ${repoFullName}...`);
+    // Clone with the helper inline + the workspace id in the env so the token is
+    // brokered on demand and never materializes in the URL or on disk.
+    gitOrThrow(io.git, [
+        '-c',
+        `credential.helper=${CREDENTIAL_HELPER}`,
+        '-c',
+        'credential.useHttpPath=true',
+        'clone',
+        cleanUrl,
+        options.targetDir,
+    ], { env: { ORIZU_WORKSPACE_ID: options.workspaceId } });
+    // Persist the helper repo-locally for future pull/push (cwd-resolved).
+    gitOrThrow(io.git, ['config', 'credential.helper', CREDENTIAL_HELPER], { cwd: options.targetDir });
+    gitOrThrow(io.git, ['config', 'credential.useHttpPath', 'true'], { cwd: options.targetDir });
+    const ensureOrizuDir = io.ensureOrizuDir ?? ((repoDir) => mkdirSync(join(repoDir, '.orizu'), { recursive: true }));
+    ensureOrizuDir(options.targetDir);
+    io.print('   Attached. Configured the Orizu credential helper for git.');
+    return { repoFullName, provisioned, targetDir: options.targetDir };
+}
+// -- Interactive setup dispatch (ALI-996 / WS-C crumb) ----------------------
+function defaultGitRunner(args, opts) {
+    // Strip repo-context env (set by git when running inside hooks) so the
+    // child git is scoped strictly to cwd/args — see daytona-slice-rehearsal.ts.
+    const env = { ...process.env };
+    delete env.GIT_DIR;
+    delete env.GIT_WORK_TREE;
+    delete env.GIT_INDEX_FILE;
+    const result = spawnSync('git', args, { cwd: opts?.cwd, encoding: 'utf8', env });
+    return { status: result.status ?? 1, stderr: result.stderr };
+}
+/**
+ * Bridge the required github-link step to the hosted attach. Create-or-attaches
+ * the server workspace (whose response now surfaces repoProvider/repoFullName —
+ * ALI-972), then routes through the already-tested `decideSetupMode`:
+ *   - `local`                 → returns `attached: false`; the caller scaffolds.
+ *   - `attach` / `provision-then-attach` → clones (provisioning first if needed)
+ *     via `runHostedAttach` and returns `attached: true`.
+ */
+export async function runInteractiveHostedSetup(input, io) {
+    const fetcher = io.fetcher ?? authedFetch;
+    const response = await fetcher('/api/cli/workspaces', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ teamSlug: input.teamSlug, name: input.teamSlug, slug: input.teamSlug }),
+    });
+    if (!response.ok) {
+        throw new Error(`Failed to attach workspace: ${await readError(response)}`);
+    }
+    const data = (await response.json());
+    const workspace = data.workspace;
+    if (!workspace?.id) {
+        throw new Error('Workspace attach response did not include an id');
+    }
+    const repoFullName = workspace.repoFullName ?? null;
+    const mode = decideSetupMode({
+        local: input.local,
+        activeInstallation: input.activeInstallation,
+        repoFullName,
+    });
+    if (mode === 'local') {
+        return { mode, attached: false, repoFullName: null };
+    }
+    const result = await runHostedAttach({ workspaceId: workspace.id, repoFullName, targetDir: input.targetDir }, { print: io.print, fetcher, git: io.git ?? defaultGitRunner, ensureOrizuDir: io.ensureOrizuDir });
+    return { mode, attached: true, repoFullName: result.repoFullName };
+}