orizu 0.5.38 → 0.5.39

package/dist/publish-merge-job.js

@@ -0,0 +1,320 @@
+/** ORI-2280: the agent-free publish merge one-shot. The coordinator runs it
+ * in a sandbox with network access to Artifacts only. It merges one session
+ * copy into its team copy with `publishSessionMerge`, getting one scoped key
+ * at a time from the web app and revoking every key before it reports. */
+import { execFile } from 'node:child_process';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+import { createEphemeralAskPass } from './artifacts-git-runtime.js';
+import { publishSessionMerge } from './artifacts-session-merge.js';
+import { CLOUDFLARE_ARTIFACTS_HOST_PATTERN } from './cloudflare-artifacts-git-remote.js';
+import { assertSecureTokenTransport } from './http.js';
+import { assertWorkspaceBootstrapRemote, isLoopbackOrigin } from './workspace-bootstrap-job.js';
+import { PUBLISH_MERGE_CONFLICT_FILES_LIMIT, PUBLISH_MERGE_CONFLICT_PATH_MAX, PUBLISH_MERGE_COORDINATOR_WALL_MS, PUBLISH_MERGE_WALL_AT_ENV, } from './publish-merge-timing.js';
+import { DEFAULT_REPOSITORY_BACKUP_LIMITS } from './repository-backup-core.js';
+const PUBLISH_MERGE_JOB_CAPABILITY = 'publish-merge-job:v1';
+/** Timing. The job's wall is the earlier of:
+ *  - ORIZU_PUBLISH_MERGE_WALL_AT, when set: the epoch-ms moment the
+ *    coordinator stops the sandbox (its createdAt + 120 s, so sandbox create
+ *    and CLI boot are already counted);
+ *  - 110 s from the job's own start, the fallback when it is not set.
+ * Within it:
+ *  - the merge ends by 90 s from start, and always 10 s before the wall;
+ *  - revoking the keys still live ends 10 s before the wall, each call at
+ *    most 15 s or whatever is left;
+ *  - the last 10 s are kept for posting the result, so it always goes out.
+ * All of this is well below the read keys' five-minute life, so no key is
+ * ever renewed. */
+const JOB_DEADLINE_MS = 90_000;
+const RESULT_RESERVE_MS = 10_000;
+const JOB_WALL_MS = PUBLISH_MERGE_COORDINATOR_WALL_MS - RESULT_RESERVE_MS;
+const LATE_CALL_TIMEOUT_MS = 15_000;
+const GIT_TIMEOUT_MS = 60_000;
+/** ADR-012's envelope for a repository's whole object graph. The graph is
+ * always larger than the content it was seeded from, so ADR-011's 1 GiB
+ * content limit is not the measure here. */
+const ADMISSION = {
+    totalBytes: DEFAULT_REPOSITORY_BACKUP_LIMITS.maxObjectBytes,
+    objectBytes: DEFAULT_REPOSITORY_BACKUP_LIMITS.maxSingleObjectBytes,
+    objects: DEFAULT_REPOSITORY_BACKUP_LIMITS.maxObjects,
+    commits: DEFAULT_REPOSITORY_BACKUP_LIMITS.maxCommits,
+};
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const IDENTITY = {
+    GIT_AUTHOR_NAME: 'Orizu',
+    GIT_AUTHOR_EMAIL: 'publish@orizu.invalid',
+    GIT_COMMITTER_NAME: 'Orizu',
+    GIT_COMMITTER_EMAIL: 'publish@orizu.invalid',
+};
+class JobFailure extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+    }
+}
+function resolvePublishMergeJobEnv(env) {
+    const value = (name) => env[name]?.trim() ?? '';
+    const resolved = {
+        bootSecret: value('ORIZU_BOOT_SECRET'),
+        jobId: value('ORIZU_PUBLISH_MERGE_JOB_ID'),
+        coordinatorUrl: value('ORIZU_COORDINATOR_URL').replace(/\/+$/, ''),
+        baseUrl: value('ORIZU_BASE_URL').replace(/\/+$/, ''),
+        expectedGitHost: value('ORIZU_PUBLISH_MERGE_GIT_HOST').toLowerCase(),
+    };
+    if (Object.values(resolved).some((item) => item.length === 0))
+        return 'missing required env';
+    const wallAtText = value(PUBLISH_MERGE_WALL_AT_ENV);
+    const wallAt = wallAtText ? Number(wallAtText) : undefined;
+    if (wallAt !== undefined && (!/^[0-9]{13}$/.test(wallAtText) || !Number.isSafeInteger(wallAt)))
+        return 'invalid wall deadline';
+    try {
+        assertSecureTokenTransport(resolved.coordinatorUrl);
+        assertSecureTokenTransport(resolved.baseUrl);
+    }
+    catch {
+        return 'insecure coordinator or base URL';
+    }
+    const localGitAllowed = isLoopbackOrigin(resolved.coordinatorUrl) && isLoopbackOrigin(resolved.baseUrl) && resolved.expectedGitHost === 'localhost';
+    if (!UUID_PATTERN.test(resolved.jobId) || (!CLOUDFLARE_ARTIFACTS_HOST_PATTERN.test(resolved.expectedGitHost) && !localGitAllowed)) {
+        return 'invalid job id or git host';
+    }
+    return wallAt === undefined ? resolved : { ...resolved, wallAt };
+}
+/** Every remote must be an https repository in the hosted namespace on the expected host. */
+function assertRemote(remote, expectedGitHost) {
+    try {
+        assertWorkspaceBootstrapRemote(String(remote), expectedGitHost);
+    }
+    catch {
+        throw new JobFailure('scope_refused');
+    }
+    return new URL(String(remote)).toString();
+}
+async function post(url, bearer, body, signal) {
+    let response;
+    try {
+        response = await fetch(url, {
+            method: 'POST',
+            redirect: 'error',
+            signal,
+            headers: { authorization: `Bearer ${bearer}`, 'content-type': 'application/json' },
+            body: JSON.stringify(body),
+        });
+    }
+    catch {
+        throw new JobFailure(signal?.aborted ? 'job_timed_out' : 'api_unavailable');
+    }
+    const value = await response.json().catch(() => null);
+    const record = value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+    // The session lost its authority while a key was being minted: a refusal.
+    if (response.status === 403 && record?.error === 'gate_denied')
+        throw new JobFailure('denied');
+    if (response.status === 401 || response.status === 403)
+        throw new JobFailure('scope_refused');
+    if (!response.ok || !record)
+        throw new JobFailure('api_unavailable');
+    return record;
+}
+/** The permission check's answer, or unavailable for anything else. */
+function gateAllows(value) {
+    const keys = Object.keys(value).sort().join(',');
+    if (keys === 'allowed' && value.allowed === true)
+        return true;
+    if (keys === 'allowed,reason' && value.allowed === false && typeof value.reason === 'string')
+        return false;
+    throw new JobFailure('api_unavailable');
+}
+/** ADR-012: the team copy is canonical state, so the merged graph must fit
+ * the admission envelope before a write key is asked for. The merge folder
+ * holds exactly both copies' fetched objects and the merge commit. */
+async function assertMergeAdmitted(worktree, signal, narrower = {}) {
+    const { stdout } = await promisify(execFile)('git', ['cat-file', '--batch-all-objects', '--batch-check=%(objecttype) %(objectsize)'], { cwd: worktree, maxBuffer: 64 * 1024 * 1024, signal });
+    if (!isMergeInventoryAdmitted(stdout, narrower))
+        throw new JobFailure('admission_refused');
+}
+/** One `<type> <size>` line per object, as `git cat-file --batch-check` prints them. */
+export function isMergeInventoryAdmitted(inventory, narrower = {}) {
+    const limits = Object.fromEntries(Object.entries(ADMISSION).map(([key, max]) => [key, Math.min(max, narrower[key] ?? max)]));
+    let totalBytes = 0;
+    let objects = 0;
+    let commits = 0;
+    for (const line of inventory.split('\n')) {
+        if (!line)
+            continue;
+        const [type, size] = line.split(' ');
+        const bytes = Number(size);
+        objects += 1;
+        totalBytes += bytes;
+        if (type === 'commit')
+            commits += 1;
+        if (!Number.isSafeInteger(bytes) || bytes > limits.objectBytes)
+            return false;
+    }
+    return totalBytes <= limits.totalBytes && objects <= limits.objects && commits <= limits.commits;
+}
+/** A post with its own time limit. An AbortController and timer, as for the
+ * deadline: AbortSignal.timeout did not fire inside the job under bun test. */
+async function postWithin(timeoutMs, url, bearer, body) {
+    const stop = new AbortController();
+    const timer = setTimeout(() => stop.abort(), timeoutMs);
+    try {
+        return await post(url, bearer, body, stop.signal);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** The conflict list the job reports, bounded so the result always fits the
+ * coordinator's body limit. A path too long to name is counted instead. */
+export function boundConflictFiles(files) {
+    const named = files.filter((file) => file.length <= PUBLISH_MERGE_CONFLICT_PATH_MAX).slice(0, PUBLISH_MERGE_CONFLICT_FILES_LIMIT);
+    return { files: named, moreFiles: files.length - named.length };
+}
+function toOutcome(result) {
+    switch (result.kind) {
+        case 'merged':
+            return { outcome: 'merged', mergeSha: result.mergeSha };
+        case 'already_merged':
+            return { outcome: 'already_merged', headSha: result.canonicalSha };
+        case 'conflict':
+            return { outcome: 'conflict', ...boundConflictFiles(result.files) };
+        case 'denied':
+            return { outcome: 'denied' };
+        case 'race_lost':
+            return { outcome: 'race_lost' };
+    }
+}
+export async function runPublishMergeJob(options) {
+    const { env } = options;
+    const startedAt = Date.now();
+    const wallEnd = Math.min(startedAt + JOB_WALL_MS, env.wallAt ?? Number.POSITIVE_INFINITY);
+    const reserveMs = Math.min(options.timing?.resultReserveMs ?? RESULT_RESERVE_MS, RESULT_RESERVE_MS);
+    const lateCallMs = Math.min(options.timing?.lateCallMs ?? LATE_CALL_TIMEOUT_MS, LATE_CALL_TIMEOUT_MS);
+    const stop = new AbortController();
+    const timer = setTimeout(() => stop.abort(), Math.max(0, Math.min(options.deadlineMs ?? JOB_DEADLINE_MS, wallEnd - reserveMs - startedAt)));
+    const deadline = stop.signal;
+    const api = (action) => `${env.baseUrl}/api/internal/publish-merge/${env.jobId}/${action}`;
+    const issued = [];
+    let jobToken = '';
+    /** A late call's bound: its own limit, or the time left before the last `keepMs` of the wall. */
+    const lateBound = (keepMs) => Math.min(lateCallMs, wallEnd - keepMs - Date.now());
+    const revokeCall = async (target, tokenId) => {
+        const bound = lateBound(reserveMs);
+        if (bound <= 0)
+            throw new JobFailure('credentials_pending');
+        return postWithin(bound, api('revoke'), jobToken, { target, tokenId });
+    };
+    let outcome;
+    const root = await mkdtemp(join(tmpdir(), 'orizu-publish-merge-'));
+    try {
+        const askPass = await createEphemeralAskPass(root);
+        const claimed = await post(`${env.coordinatorUrl}/publish-merge-jobs/${env.jobId}/claim`, env.bootSecret, {}, deadline);
+        if (typeof claimed.jobToken !== 'string' || !claimed.jobToken)
+            throw new JobFailure('scope_refused');
+        jobToken = claimed.jobToken;
+        const spec = await post(api('spec'), jobToken, {}, deadline);
+        const sessionRemote = assertRemote(spec.session?.remote, env.expectedGitHost);
+        if (spec.jobId !== env.jobId || typeof spec.sessionCommitSha !== 'string' || spec.ref !== 'refs/heads/main' || typeof spec.commitMessage !== 'string') {
+            throw new JobFailure('scope_refused');
+        }
+        const mint = async (target, scope) => {
+            const value = await post(api('credential'), jobToken, { target, scope }, deadline);
+            if (typeof value.tokenId !== 'string' || typeof value.plaintext !== 'string')
+                throw new JobFailure('scope_refused');
+            issued.push({ target, tokenId: value.tokenId });
+            return { tokenId: value.tokenId, plaintext: value.plaintext, remote: assertRemote(value.remote, env.expectedGitHost) };
+        };
+        const revoke = async (target, tokenId) => {
+            const value = await revokeCall(target, tokenId);
+            if (value.revoked !== true)
+                throw new JobFailure('credentials_pending');
+            issued.splice(issued.findIndex((item) => item.tokenId === tokenId), 1);
+        };
+        const auth = (credential) => ({ askPassPath: askPass.path, token: credential.plaintext });
+        const sessionRead = await mint('session', 'read');
+        if (sessionRead.remote !== sessionRemote)
+            throw new JobFailure('scope_refused');
+        const teamRead = await mint('team', 'read');
+        const result = await publishSessionMerge({
+            root,
+            canonical: { remote: teamRead.remote, auth: auth(teamRead) },
+            source: { remote: sessionRemote, auth: auth(sessionRead) },
+            canonicalRef: 'refs/heads/main',
+            sourceRef: 'refs/heads/main',
+            expectedSourceSha: spec.sessionCommitSha,
+            commitMessage: spec.commitMessage,
+            commitIdentityEnv: IDENTITY,
+            authorize: async (merge) => {
+                await assertMergeAdmitted(merge.worktree, deadline, options.admission);
+                return gateAllows(await post(api('gate'), jobToken, {}, deadline));
+            },
+            withCanonicalWrite: async (push) => {
+                const write = await mint('team', 'write');
+                if (write.remote !== teamRead.remote)
+                    throw new JobFailure('scope_refused');
+                try {
+                    return await push(auth(write));
+                }
+                finally {
+                    await revoke('team', write.tokenId);
+                }
+            },
+            timeoutMs: GIT_TIMEOUT_MS,
+            signal: deadline,
+        });
+        outcome = toOutcome(result);
+    }
+    catch (error) {
+        if (error instanceof JobFailure && error.code === 'denied')
+            outcome = { outcome: 'denied' };
+        else if (deadline.aborted)
+            outcome = { outcome: 'failed', code: 'job_timed_out' };
+        else
+            outcome = { outcome: 'failed', code: error instanceof JobFailure && error.code !== 'denied' ? error.code : 'publish_failed' };
+    }
+    finally {
+        clearTimeout(timer);
+        // Revoke whatever is still live, newest first, even past the deadline; an
+        // unrevoked key wins over the merge outcome because its authority is then uncertain.
+        for (const { target, tokenId } of [...issued].reverse()) {
+            try {
+                const value = await revokeCall(target, tokenId);
+                if (value.revoked !== true)
+                    throw new JobFailure('credentials_pending');
+            }
+            catch {
+                outcome = { outcome: 'failed', code: 'credentials_pending' };
+            }
+        }
+        await rm(root, { recursive: true, force: true });
+    }
+    let reported = false;
+    try {
+        const bound = lateBound(0);
+        if (bound <= 0)
+            throw new JobFailure('job_timed_out');
+        await postWithin(bound, `${env.coordinatorUrl}/publish-merge-jobs/${env.jobId}/result`, env.bootSecret, outcome);
+        reported = true;
+    }
+    catch {
+        reported = false;
+    }
+    return { reported, outcome };
+}
+export async function publishMergeJobCommand(args, io) {
+    if (args.includes('--capability-check')) {
+        io.print(PUBLISH_MERGE_JOB_CAPABILITY);
+        return 0;
+    }
+    const env = resolvePublishMergeJobEnv(process.env);
+    if (typeof env === 'string') {
+        io.printErr?.(`publish-merge-job: ${env}`);
+        return 1;
+    }
+    const result = await runPublishMergeJob({ env });
+    io.print(JSON.stringify(result.outcome));
+    return result.reported ? 0 : 1;
+}

package/dist/publish-merge-timing.d.ts

@@ -0,0 +1,18 @@
+/** ORI-2280: the publish merge job's wall, shared by the coordinator, which
+ * stops the sandbox at it, and the CLI job, which must report before it. No
+ * Node or Worker imports: both sides compile this file. */
+/** From the coordinator creating the job to it stopping the sandbox. */
+export declare const PUBLISH_MERGE_COORDINATOR_WALL_MS: number;
+/** The coordinator sets this on the sandbox to `createdAt + PUBLISH_MERGE_COORDINATOR_WALL_MS`, in epoch milliseconds. */
+export declare const PUBLISH_MERGE_WALL_AT_ENV = "ORIZU_PUBLISH_MERGE_WALL_AT";
+/** A conflict result names at most this many paths, each at most
+ * PUBLISH_MERGE_CONFLICT_PATH_MAX characters, and counts the rest, so the
+ * result always fits the coordinator's result body limit. */
+export declare const PUBLISH_MERGE_CONFLICT_FILES_LIMIT = 200;
+export declare const PUBLISH_MERGE_CONFLICT_PATH_MAX = 1024;
+/** The failure codes the sandbox may report. The coordinator's own codes
+ * (`timed_out`, `provider_unavailable`, `snapshot_missing_command`, ...) are
+ * not among them, so a reported failure always says which side saw it. */
+export declare const PUBLISH_MERGE_JOB_FAILURE_CODES: readonly ["scope_refused", "admission_refused", "credentials_pending", "api_unavailable", "job_timed_out", "publish_failed"];
+export type PublishMergeJobFailureCode = (typeof PUBLISH_MERGE_JOB_FAILURE_CODES)[number];
+//# sourceMappingURL=publish-merge-timing.d.ts.map

package/dist/publish-merge-timing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-merge-timing.d.ts","sourceRoot":"","sources":["../src/publish-merge-timing.ts"],"names":[],"mappings":"AAAA;;2DAE2D;AAE3D,wEAAwE;AACxE,eAAO,MAAM,iCAAiC,QAAgB,CAAA;AAC9D,0HAA0H;AAC1H,eAAO,MAAM,yBAAyB,gCAAgC,CAAA;AAEtE;;6DAE6D;AAC7D,eAAO,MAAM,kCAAkC,MAAM,CAAA;AACrD,eAAO,MAAM,+BAA+B,OAAO,CAAA;AAEnD;;0EAE0E;AAC1E,eAAO,MAAM,+BAA+B,8HAOlC,CAAA;AACV,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAA"}

package/dist/publish-merge-timing.js

@@ -0,0 +1,23 @@
+/** ORI-2280: the publish merge job's wall, shared by the coordinator, which
+ * stops the sandbox at it, and the CLI job, which must report before it. No
+ * Node or Worker imports: both sides compile this file. */
+/** From the coordinator creating the job to it stopping the sandbox. */
+export const PUBLISH_MERGE_COORDINATOR_WALL_MS = 2 * 60 * 1000;
+/** The coordinator sets this on the sandbox to `createdAt + PUBLISH_MERGE_COORDINATOR_WALL_MS`, in epoch milliseconds. */
+export const PUBLISH_MERGE_WALL_AT_ENV = 'ORIZU_PUBLISH_MERGE_WALL_AT';
+/** A conflict result names at most this many paths, each at most
+ * PUBLISH_MERGE_CONFLICT_PATH_MAX characters, and counts the rest, so the
+ * result always fits the coordinator's result body limit. */
+export const PUBLISH_MERGE_CONFLICT_FILES_LIMIT = 200;
+export const PUBLISH_MERGE_CONFLICT_PATH_MAX = 1024;
+/** The failure codes the sandbox may report. The coordinator's own codes
+ * (`timed_out`, `provider_unavailable`, `snapshot_missing_command`, ...) are
+ * not among them, so a reported failure always says which side saw it. */
+export const PUBLISH_MERGE_JOB_FAILURE_CODES = [
+    'scope_refused',
+    'admission_refused',
+    'credentials_pending',
+    'api_unavailable',
+    'job_timed_out',
+    'publish_failed',
+];

package/dist/workbench-cli.d.ts

@@ -24,6 +24,8 @@ export interface WorkbenchRunCosts {
 export interface WorkbenchRunSummary extends WorkbenchRunCosts {
     id: string;
     status: string;
+    /** Why a failed run failed, in plain words, mapped by the server (ORI-2264). */
+    failureReason?: string;
 }
 export interface WorkbenchSession {
     id: string;
@@ -53,6 +55,8 @@ export interface WorkbenchRun extends WorkbenchRunCosts {
     status: string;
     evidence?: Record<string, unknown>;
     summary?: Record<string, unknown>;
+    /** Why a failed run failed, in plain words, mapped by the server (ORI-2264). */
+    failureReason?: string;
     latestSequence?: number;
     startedAt?: string | null;
     finishedAt?: string | null;

package/dist/workbench-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workbench-cli.d.ts","sourceRoot":"","sources":["../src/workbench-cli.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,EAKL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAA;AAI1B,MAAM,WAAW,gBAAgB;IAC/B,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CACtD;AAED,MAAM,WAAW,cAAc;IAC7B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5B;AAKD,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,mBAAmB,EAAE,CAAA;IAC5B,iFAAiF;IACjF,KAAK,CAAC,EAAE,iBAAiB,CAAA;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,YAAa,SAAQ,iBAAiB;IACrD,EAAE,EAAE,MAAM,CAAA;IACV,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAUD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAED,yEAAyE;AACzE,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,gBAAgB,CAAA;AA0B5F,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,aAAa,GAAG,SAAS,CAAA;IAChC,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,4EAA4E;IAC5E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,mEAAmE;IACnE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,MAAM,WAAW,mBAAoB,SAAQ,sBAAsB;IACjE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpC,GAAG,CAAC,EAAE,gBAAgB,CAAA;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,cAAc,CAAA;IACtB,0EAA0E;IAC1E,qBAAqB,CAAC,EAAE,sBAAsB,CAAA;IAC9C,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,0EAA0E;IAC1E,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAED,MAAM,WAAW,oBAAqB,SAAQ,sBAAsB;IAClE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,GAAG,CAAC,EAAE,gBAAgB,CAAA;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,gBAAgB,CAAA;IACtB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,gBAAgB,CAAA;IACzB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,eAAe,GAAG,IAAI,CAAA;CAClC;AAED;;6CAE6C;AAC7C,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;gBAElB,KAAK,EAAE;QACjB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;QAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;QACnC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;KAC3C;CAqBF;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC7B,oFAAoF;IACpF,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,gBAAgB,CAAA;IACzB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CAC1C;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,YAAY,CAAA;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,iBAAiB,EAAE,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,cAAc,CAAA;IACtB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAA;CAC7C;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,KAAK,CAAC,EAAE,cAAc,CAAA;IACtB,mEAAmE;IACnE,GAAG,CAAC,EAAE,gBAAgB,CAAA;IACtB,wDAAwD;IACxD,qBAAqB,CAAC,EAAE,sBAAsB,CAAA;CAC/C;AAoCD,eAAO,MAAM,mCAAmC,OAAQ,CAAA;AACxD,eAAO,MAAM,sCAAsC,KAAK,CAAA;AAgKxD,wBAAsB,eAAe,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAqIjG;AAED,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,oBAAyB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAyBpG;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgBtF;AAsGD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgC/F;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA4BtG;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CASxG;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAiC5G;AAED,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,KAAK,SAAqB,GACzB,OAAO,CAAC,cAAc,CAAC,CAezB;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,cAAc,CAAC,CA2C7F;AA4OD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB9F"}
+{"version":3,"file":"workbench-cli.d.ts","sourceRoot":"","sources":["../src/workbench-cli.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,EAKL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAA;AAI1B,MAAM,WAAW,gBAAgB;IAC/B,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CACtD;AAED,MAAM,WAAW,cAAc;IAC7B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5B;AAKD,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,gFAAgF;IAChF,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,mBAAmB,EAAE,CAAA;IAC5B,iFAAiF;IACjF,KAAK,CAAC,EAAE,iBAAiB,CAAA;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,YAAa,SAAQ,iBAAiB;IACrD,EAAE,EAAE,MAAM,CAAA;IACV,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,gFAAgF;IAChF,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAUD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAED,yEAAyE;AACzE,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,gBAAgB,CAAA;AA0B5F,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,aAAa,GAAG,SAAS,CAAA;IAChC,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,4EAA4E;IAC5E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,mEAAmE;IACnE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,MAAM,WAAW,mBAAoB,SAAQ,sBAAsB;IACjE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpC,GAAG,CAAC,EAAE,gBAAgB,CAAA;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,cAAc,CAAA;IACtB,0EAA0E;IAC1E,qBAAqB,CAAC,EAAE,sBAAsB,CAAA;IAC9C,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,0EAA0E;IAC1E,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAED,MAAM,WAAW,oBAAqB,SAAQ,sBAAsB;IAClE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,GAAG,CAAC,EAAE,gBAAgB,CAAA;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,gBAAgB,CAAA;IACtB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,gBAAgB,CAAA;IACzB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,eAAe,GAAG,IAAI,CAAA;CAClC;AAED;;6CAE6C;AAC7C,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;gBAElB,KAAK,EAAE;QACjB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;QAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;QACnC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;KAC3C;CAqBF;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC7B,oFAAoF;IACpF,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,gBAAgB,CAAA;IACzB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CAC1C;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,YAAY,CAAA;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,iBAAiB,EAAE,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,cAAc,CAAA;IACtB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAA;CAC7C;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,KAAK,CAAC,EAAE,cAAc,CAAA;IACtB,mEAAmE;IACnE,GAAG,CAAC,EAAE,gBAAgB,CAAA;IACtB,wDAAwD;IACxD,qBAAqB,CAAC,EAAE,sBAAsB,CAAA;CAC/C;AAoCD,eAAO,MAAM,mCAAmC,OAAQ,CAAA;AACxD,eAAO,MAAM,sCAAsC,KAAK,CAAA;AAgKxD,wBAAsB,eAAe,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAqIjG;AAED,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,oBAAyB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAyBpG;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgBtF;AAsGD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgC/F;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA4BtG;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CASxG;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAiC5G;AAED,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,KAAK,SAAqB,GACzB,OAAO,CAAC,cAAc,CAAC,CAezB;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,cAAc,CAAC,CA2C7F;AAsPD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB9F"}

package/dist/workbench-cli.js

@@ -763,6 +763,9 @@ function formatSessionStatus(result) {
             const cost = finiteOrNull(run.modelCostUsd);
             const suffix = cost !== null ? `  ${formatUsd(cost)}` : '';
             lines.push(`  run ${run.id}  ${run.status}${suffix}`);
+            const why = failedRunLine(run);
+            if (why)
+                lines.push(`    ${why}`);
         }
         return lines.join('\n');
     }
@@ -797,10 +800,17 @@ function formatSessionFinishOutcome(result) {
     const deletions = typeof proposed.deletions === 'number' ? proposed.deletions : 0;
     return `manifest ${id}  ${status}  repo_merge  (${files} files, +${additions}/-${deletions})`;
 }
+// The web page's failed line, with the reason the server mapped (ORI-2264).
+function failedRunLine(run) {
+    return run.status === 'failed' && typeof run.failureReason === 'string' && run.failureReason
+        ? `The agent stopped: ${run.failureReason}.`
+        : null;
+}
 function formatRunStatus(run) {
     const sequence = typeof run.latestSequence === 'number' ? `  latestSequence=${run.latestSequence}` : '';
     const costLine = formatCostSummary(run);
-    return `run ${run.id}  ${run.status}${sequence}${costLine ? `\n  ${costLine}` : ''}`;
+    const why = failedRunLine(run);
+    return `run ${run.id}  ${run.status}${sequence}${costLine ? `\n  ${costLine}` : ''}${why ? `\n  ${why}` : ''}`;
 }
 // ALI-1045: one compact digest line per event — shared with the attached
 // `session start --hosted --tail` stream. Full fidelity stays in `--json`.

package/dist/workspace-bootstrap-job.d.ts

@@ -25,6 +25,7 @@ export interface WorkspaceBootstrapJobRunResult {
     state: 'verified' | 'failed';
     diagnostic: WorkspaceBootstrapFailureCode | null;
 }
+export declare function isLoopbackOrigin(value: string): boolean;
 export declare function resolveWorkspaceBootstrapJobEnv(env: Record<string, string | undefined>): {
     ok: true;
     value: WorkspaceBootstrapJobEnv;

package/dist/workspace-bootstrap-job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-bootstrap-job.d.ts","sourceRoot":"","sources":["../src/workspace-bootstrap-job.ts"],"names":[],"mappings":"AAaA,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,4BAA4B,CAAA;AAGnC,eAAO,MAAM,kCAAkC,+BAA+B,CAAA;AAC9E,eAAO,MAAM,6BAA6B,wBAAwB,CAAA;AAQlE,eAAO,MAAM,mCAAmC,SAAU,CAAA;AAC1D,eAAO,MAAM,iDAAiD,SAAU,CAAA;AAExE,eAAO,MAAM,iCAAiC,2IAOpC,CAAA;AAEV,MAAM,MAAM,6BAA6B,GAAG,CAAC,OAAO,iCAAiC,CAAC,CAAC,MAAM,CAAC,CAAA;AAC9F,MAAM,MAAM,0BAA0B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAE/F,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAqCD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,OAAO,CAAA;IACjB,KAAK,EAAE,UAAU,GAAG,QAAQ,CAAA;IAC5B,UAAU,EAAE,6BAA6B,GAAG,IAAI,CAAA;CACjD;AAyBD,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAErC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,wBAAwB,CAAA;CAAE,GAC7C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAkDtD;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,CAwB5F;AAqQD,MAAM,WAAW,+BAA+B;IAC9C,GAAG,EAAE,wBAAwB,CAAA;IAC7B,SAAS,CAAC,EAAE,0BAA0B,CAAA;IACtC,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtC;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,8BAA8B,CAAC,CA6GzC;AAED,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,8BAA8B,GACjC,OAAO,CAAC,MAAM,CAAC,CAqBjB"}
+{"version":3,"file":"workspace-bootstrap-job.d.ts","sourceRoot":"","sources":["../src/workspace-bootstrap-job.ts"],"names":[],"mappings":"AAaA,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,4BAA4B,CAAA;AAGnC,eAAO,MAAM,kCAAkC,+BAA+B,CAAA;AAC9E,eAAO,MAAM,6BAA6B,wBAAwB,CAAA;AAQlE,eAAO,MAAM,mCAAmC,SAAU,CAAA;AAC1D,eAAO,MAAM,iDAAiD,SAAU,CAAA;AAExE,eAAO,MAAM,iCAAiC,2IAOpC,CAAA;AAEV,MAAM,MAAM,6BAA6B,GAAG,CAAC,OAAO,iCAAiC,CAAC,CAAC,MAAM,CAAC,CAAA;AAC9F,MAAM,MAAM,0BAA0B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAE/F,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAqCD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,OAAO,CAAA;IACjB,KAAK,EAAE,UAAU,GAAG,QAAQ,CAAA;IAC5B,UAAU,EAAE,6BAA6B,GAAG,IAAI,CAAA;CACjD;AAgBD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOvD;AAED,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAErC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,wBAAwB,CAAA;CAAE,GAC7C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAkDtD;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,CAwB5F;AAqQD,MAAM,WAAW,+BAA+B;IAC9C,GAAG,EAAE,wBAAwB,CAAA;IAC7B,SAAS,CAAC,EAAE,0BAA0B,CAAA;IACtC,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtC;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,8BAA8B,CAAC,CA6GzC;AAED,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,8BAA8B,GACjC,OAAO,CAAC,MAAM,CAAC,CAqBjB"}

package/dist/workspace-bootstrap-job.js

@@ -37,7 +37,7 @@ class WorkspaceBootstrapFailure extends Error {
 function isObject(value) {
     return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }
-function isLoopbackOrigin(value) {
+export function isLoopbackOrigin(value) {
     try {
         const host = new URL(value).hostname;
         return host === 'localhost' || host === '127.0.0.1' || host === '::1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orizu",
-  "version": "0.5.38",
+  "version": "0.5.39",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",
@@ -18,6 +18,9 @@
   "bin": {
     "orizu": "dist/index.js"
   },
+  "engines": {
+    "node": ">=22"
+  },
   "files": [
     "README.md",
     "dist",
@@ -35,7 +38,7 @@
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.201",
     "@vercel/sandbox": "1.10.2",
-    "effect": "3.22.1",
+    "effect": "4.0.0",
     "esbuild": "^0.25.8"
   },
   "devDependencies": {