runcloud 0.1.102 → 0.1.103

package/dist/diagnose.js

@@ -1,13 +1,43 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { GoogleAuth, Impersonated } from 'google-auth-library';
+import { renderSessionDiagnosticTerminal, writeSessionDiagnosticBundle, } from './sessionDiagnostics.js';
+const execFileAsync = promisify(execFile);
 const DEFAULT_URLS = {
     dev: {
         apiOps: 'https://cp-api-ops-dev-97683904813.us-east4.run.app',
         worker: 'https://cp-worker-dev-97683904813.us-east4.run.app',
     },
     prod: {
-        apiOps: 'https://cp-api-ops-prod-350096142301.us-east4.run.app',
+        apiOps: 'https://cp-api-ops-prod-wqoplvhyxa-uk.a.run.app',
         worker: 'https://cp-worker-prod-350096142301.us-east4.run.app',
     },
 };
+const DEFAULT_SERVICE_ACCOUNTS = {
+    dev: 'cp-diagnose-ops-dev@newly-v3-dev.iam.gserviceaccount.com',
+    prod: 'cp-diagnose-ops-prod@newly-v3-prod.iam.gserviceaccount.com',
+};
+export function resolveSessionDiagnoseTarget(env) {
+    if (env === 'dev' || env === 'prod') {
+        const url = stripSlash(process.env[`DIAGNOSE_CP_API_OPS_URL_${env.toUpperCase()}`] ??
+            process.env.DIAGNOSE_CP_API_OPS_URL ??
+            DEFAULT_URLS[env].apiOps);
+        return {
+            url,
+            audience: process.env.DIAGNOSE_OIDC_AUDIENCE ?? url,
+            serviceAccount: process.env.DIAGNOSE_OPS_IMPERSONATE_SERVICE_ACCOUNT ?? DEFAULT_SERVICE_ACCOUNTS[env],
+        };
+    }
+    const match = /^pr-(\d+)$/.exec(env);
+    if (!match)
+        throw new Error(`--env must be dev, prod, or pr-<number> (got "${env}")`);
+    const url = `https://cp-api-pr-${match[1]}-97683904813.us-east4.run.app`;
+    return {
+        url,
+        audience: process.env.DIAGNOSE_OIDC_AUDIENCE ?? url,
+        serviceAccount: process.env.DIAGNOSE_OPS_IMPERSONATE_SERVICE_ACCOUNT ?? DEFAULT_SERVICE_ACCOUNTS.dev,
+    };
+}
 function stripSlash(url) {
     return url.replace(/\/+$/, '');
 }
@@ -16,6 +46,7 @@ export function resolveTargets(env) {
         throw new Error(`--env must be dev or prod (got "${env}")`);
     }
     const upper = env.toUpperCase();
+    const serviceAccount = process.env.DIAGNOSE_OPS_IMPERSONATE_SERVICE_ACCOUNT ?? DEFAULT_SERVICE_ACCOUNTS[env];
     const apiOps = process.env[`DIAGNOSE_CP_API_OPS_URL_${upper}`] ??
         process.env.DIAGNOSE_CP_API_OPS_URL ??
         DEFAULT_URLS[env].apiOps;
@@ -23,8 +54,8 @@ export function resolveTargets(env) {
         process.env.DIAGNOSE_CP_WORKER_URL ??
         DEFAULT_URLS[env].worker;
     return [
-        { service: 'cp-api', url: stripSlash(apiOps) },
-        { service: 'cp-worker', url: stripSlash(worker) },
+        { service: 'cp-api', url: stripSlash(apiOps), serviceAccount },
+        { service: 'cp-worker', url: stripSlash(worker), serviceAccount },
     ];
 }
 function extractAuthorization(headers) {
@@ -34,30 +65,123 @@ function extractAuthorization(headers) {
     const h = headers;
     return h?.Authorization ?? h?.authorization;
 }
-export async function resolveOpsAuthHeader(env = process.env) {
-    const audience = env.DIAGNOSE_OIDC_AUDIENCE ?? 'newly-diagnose-ops';
+async function gcloudIdentityToken(audience, serviceAccount) {
+    const args = ['auth', 'print-identity-token', `--audiences=${audience}`];
+    if (serviceAccount)
+        args.push(`--impersonate-service-account=${serviceAccount}`);
+    const { stdout } = await execFileAsync('gcloud', args, { timeout: 15_000, maxBuffer: 1024 * 1024 });
+    const token = stdout.trim();
+    if (!token)
+        throw new Error('gcloud returned an empty identity token');
+    return token;
+}
+function idTokenAudience(authorization) {
+    const token = authorization.replace(/^Bearer\s+/i, '');
+    const payload = token.split('.')[1];
+    if (!payload)
+        return null;
+    try {
+        const parsed = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+        if (typeof parsed.aud === 'string')
+            return [parsed.aud];
+        return Array.isArray(parsed.aud)
+            ? parsed.aud.filter((entry) => typeof entry === 'string')
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function exactAudienceAuthorization(authorization, audience) {
+    if (!authorization)
+        throw new Error('credential returned no authorization header');
+    const audiences = idTokenAudience(authorization);
+    if (!audiences?.includes(audience)) {
+        throw new Error(`credential minted an ID token for ${audiences?.join(', ') || 'an unreadable audience'}, not ${audience}`);
+    }
+    return authorization;
+}
+async function impersonatedIdentityToken(audience, serviceAccount) {
+    const sourceClient = await new GoogleAuth({
+        scopes: ['https://www.googleapis.com/auth/cloud-platform'],
+    }).getClient();
+    const impersonated = new Impersonated({
+        sourceClient,
+        targetPrincipal: serviceAccount,
+        targetScopes: ['https://www.googleapis.com/auth/cloud-platform'],
+        lifetime: 600,
+    });
+    const token = await impersonated.fetchIdToken(audience, { includeEmail: true });
+    return exactAudienceAuthorization(`Bearer ${token}`, audience);
+}
+export async function resolveOpsAuthHeader(env = process.env, requestedAudience, requestedServiceAccount) {
+    const audience = requestedAudience ?? env.DIAGNOSE_OIDC_AUDIENCE ?? 'newly-diagnose-ops';
+    const serviceAccount = env.DIAGNOSE_OPS_IMPERSONATE_SERVICE_ACCOUNT ?? requestedServiceAccount;
+    let adcError = 'unknown ADC error';
     try {
-        const { GoogleAuth } = await import('google-auth-library');
         const auth = new GoogleAuth();
         const client = await auth.getIdTokenClient(audience);
-        const authz = extractAuthorization(await client.getRequestHeaders());
-        if (authz) {
-            return authz;
-        }
+        return exactAudienceAuthorization(extractAuthorization(await client.getRequestHeaders()), audience);
     }
-    catch {
+    catch (error) {
+        adcError = error instanceof Error ? error.message : String(error);
+    }
+    let impersonationError = 'not configured';
+    if (serviceAccount && env.DIAGNOSE_DISABLE_IMPERSONATION !== '1') {
+        try {
+            return await impersonatedIdentityToken(audience, serviceAccount);
+        }
+        catch (error) {
+            impersonationError = error instanceof Error ? error.message : String(error);
+        }
     }
     const token = env.DIAGNOSE_OPS_TOKEN;
     if (token) {
         return `Bearer ${token}`;
     }
-    throw new Error('No ops credential available. Run `gcloud auth application-default login` (ADC/OIDC), ' +
-        'or export DIAGNOSE_OPS_TOKEN with the break-glass ops token.');
+    if (env.DIAGNOSE_DISABLE_GCLOUD !== '1') {
+        try {
+            return exactAudienceAuthorization(`Bearer ${await gcloudIdentityToken(audience, serviceAccount)}`, audience);
+        }
+        catch (error) {
+            const gcloudError = error instanceof Error ? error.message : String(error);
+            throw new Error(`No usable ops credential for audience ${audience}.\n` +
+                `ADC failed: ${truncate(adcError, 500)}\n` +
+                `Service-account impersonation failed: ${truncate(impersonationError, 500)}\n` +
+                `gcloud failed: ${truncate(gcloudError, 500)}\n\n` +
+                'Repair access by adding the Google identity to control-plane `operators`, applying Terraform, ' +
+                'and running `gcloud auth application-default login`, then rerun. ' +
+                'For a headless agent, export DIAGNOSE_OPS_TOKEN with the read-only break-glass token.');
+        }
+    }
+    throw new Error(`No ops credential available for audience ${audience}. ` +
+        `ADC failed: ${truncate(adcError, 300)}. ` +
+        `Service-account impersonation failed: ${truncate(impersonationError, 300)}. ` +
+        'Run `gcloud auth application-default login` after the operator Terraform has been applied, or export DIAGNOSE_OPS_TOKEN.');
 }
 function truncate(value, max = 200) {
     const trimmed = value.trim();
     return trimmed.length > max ? `${trimmed.slice(0, max)}...` : trimmed;
 }
+function diagnosticHttpFailure(status, body, target) {
+    const detail = truncate(body, 500);
+    if (status === 403 && /<title>403 Forbidden|does not have permission/i.test(body)) {
+        return (`HTTP 403: Cloud Run denied invocation of ${target}. ` +
+            'The active Google identity needs roles/run.invoker through the control-plane operator roster.');
+    }
+    if (status === 403) {
+        return (`HTTP 403: ${target} rejected the operator identity. ` +
+            `Check DIAGNOSE_OPS_ALLOWED_EMAILS${detail ? ` (${detail})` : '.'}`);
+    }
+    if (status === 401) {
+        return `HTTP 401: ${target} rejected the ID-token audience or credential${detail ? ` (${detail})` : '.'}`;
+    }
+    if (status === 503) {
+        return (`HTTP 503: ${target} has no healthy serving revision. ` +
+            'Inspect the Cloud Run revision startup logs and deployed migration/config provenance.');
+    }
+    return `HTTP ${status}${detail ? `: ${detail}` : ''}`;
+}
 export async function fetchDiagnose(target, authHeader) {
     try {
         const res = await fetch(`${target.url}/diagnose`, { headers: { Authorization: authHeader } });
@@ -65,7 +189,7 @@ export async function fetchDiagnose(target, authHeader) {
             const body = await res.text().catch(() => '');
             return {
                 service: target.service,
-                error: `HTTP ${res.status}${body ? `: ${truncate(body)}` : ''}`,
+                error: diagnosticHttpFailure(res.status, body, target.url),
             };
         }
         return (await res.json());
@@ -100,14 +224,44 @@ export function rollupVerdict(services) {
 }
 export async function fanoutDiagnose(env) {
     const targets = resolveTargets(env);
-    const authHeader = await resolveOpsAuthHeader();
-    const results = await Promise.all(targets.map((target) => fetchDiagnose(target, authHeader)));
+    const results = await Promise.all(targets.map(async (target) => fetchDiagnose(target, await resolveOpsAuthHeader(process.env, target.url, target.serviceAccount))));
     const services = {};
     results.forEach((result, index) => {
         services[targets[index].service] = result;
     });
     return { rollup: rollupVerdict(services), services };
 }
+export function projectIdFromInput(value) {
+    const trimmed = value.trim();
+    try {
+        const url = new URL(trimmed);
+        const match = /^\/project\/([^/?#]+)/.exec(url.pathname);
+        if (match?.[1])
+            return decodeURIComponent(match[1]);
+    }
+    catch {
+    }
+    if (/^[A-Za-z0-9_.:-]{1,160}$/.test(trimmed))
+        return trimmed;
+    throw new Error('--project must be a project id or a newly.app/project/<id> URL');
+}
+export async function fetchSessionDiagnosticReport(input) {
+    const params = new URLSearchParams();
+    if (input.session)
+        params.set('session', input.session);
+    if (input.project)
+        params.set('project', projectIdFromInput(input.project));
+    if (input.at)
+        params.set('at', input.at);
+    const res = await fetch(`${input.target.url}/diagnose/session?${params}`, {
+        headers: { Authorization: input.authHeader },
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => '');
+        throw new Error(`Session diagnostics failed: ${diagnosticHttpFailure(res.status, body, input.target.url)}`);
+    }
+    return (await res.json());
+}
 export function renderRollup(result, session) {
     const lines = [result.rollup];
     if (session) {
@@ -135,21 +289,54 @@ export function renderRollup(result, session) {
 export function registerDiagnose(program) {
     program
         .command('diagnose')
-        .description('Fan out /diagnose across control-plane services and roll up a verdict (dev/ops only)')
-        .option('--env <env>', 'dev or prod', 'dev')
-        .option('--session <id>', 'annotate the rollup with a session id you are investigating')
+        .description('Diagnose control-plane health or trace one cloud session end to end (dev/ops only)')
+        .option('--env <env>', 'dev, prod, or pr-<number>', 'dev')
+        .option('--session <id>', 'diagnose this exact session')
+        .option('--project <id-or-url>', 'diagnose the latest/nearest session for a project')
+        .option('--at <iso-time>', 'select the project session nearest this incident time')
+        .option('--out <dir>', 'write evidence, report, diagram, and agent repro/fix prompt')
         .option('--json', 'emit the merged JSON document instead of the human rollup')
         .action(async (opts) => {
         try {
+            if (opts.session || opts.project) {
+                if (Boolean(opts.session) === Boolean(opts.project)) {
+                    throw new Error('Provide exactly one of --session or --project');
+                }
+                if (opts.at && !opts.project) {
+                    throw new Error('--at requires --project because an exact --session needs no time selection');
+                }
+                if (opts.at && Number.isNaN(Date.parse(opts.at))) {
+                    throw new Error('--at must be an ISO timestamp');
+                }
+                const target = resolveSessionDiagnoseTarget(opts.env);
+                const authHeader = await resolveOpsAuthHeader(process.env, target.audience, target.serviceAccount);
+                const report = await fetchSessionDiagnosticReport({
+                    target,
+                    authHeader,
+                    ...(opts.session ? { session: opts.session } : {}),
+                    ...(opts.project ? { project: opts.project } : {}),
+                    ...(opts.at ? { at: opts.at } : {}),
+                });
+                if (opts.out) {
+                    const output = await writeSessionDiagnosticBundle(report, opts.out);
+                    if (!opts.json)
+                        console.error(`Diagnostic evidence written to ${output}`);
+                }
+                console.log(opts.json ? JSON.stringify(report, null, 2) : renderSessionDiagnosticTerminal(report));
+                return;
+            }
+            if (opts.at || opts.out) {
+                throw new Error('--at and --out require --session or --project');
+            }
             if (opts.env !== 'dev' && opts.env !== 'prod') {
-                throw new Error('--env must be dev or prod');
+                throw new Error('Global health diagnosis supports only --env dev or prod');
             }
             const result = await fanoutDiagnose(opts.env);
             if (opts.json) {
-                console.log(JSON.stringify({ session: opts.session ?? null, ...result }, null, 2));
+                console.log(JSON.stringify(result, null, 2));
                 return;
             }
-            console.log(renderRollup(result, opts.session));
+            console.log(renderRollup(result));
         }
         catch (e) {
             console.error(e instanceof Error ? e.message : String(e));

package/dist/sessionDiagnostics.js

@@ -0,0 +1,192 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+const STATUS_TEXT = {
+    ok: 'OK',
+    failed: 'FAIL',
+    blocked: 'BLOCKED',
+    pending: 'WAIT',
+    not_requested: 'NOT SENT',
+    unknown: 'UNKNOWN',
+};
+const MERMAID_CLASS = {
+    ok: 'ok',
+    failed: 'failed',
+    blocked: 'failed',
+    pending: 'pending',
+    not_requested: 'unknown',
+    unknown: 'unknown',
+};
+function stage(report, id) {
+    return report.stages.find((candidate) => candidate.id === id);
+}
+function nodeLabel(report, id) {
+    const item = stage(report, id);
+    return `[${STATUS_TEXT[item.status]} ${item.label}]`;
+}
+export function renderAsciiDiagram(report) {
+    const main = ['session', 'venue', 'runner', 'command', 'metro', 'preview'];
+    const mainLine = main.map((id) => nodeLabel(report, id)).join(' -> ');
+    const runnerOffset = main.slice(0, 3).map((id) => nodeLabel(report, id)).join(' -> ').length;
+    const editor = nodeLabel(report, 'code_server');
+    return [mainLine, `${' '.repeat(Math.max(0, runnerOffset - 2))}\\-> ${editor}`].join('\n');
+}
+function mermaidEscape(value) {
+    return value
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/\\/g, '\\\\')
+        .replace(/"/g, "'")
+        .replace(/\r?\n/g, ' ');
+}
+export function renderMermaidDiagram(report) {
+    const lines = [
+        'flowchart LR',
+        '  session --> venue --> runner --> command --> metro --> preview',
+        '  runner --> code_server',
+    ];
+    for (const item of report.stages) {
+        lines.push(`  ${item.id}["${mermaidEscape(`${STATUS_TEXT[item.status]}: ${item.label}<br/>${item.summary}`)}"]`, `  class ${item.id} ${MERMAID_CLASS[item.status]}`);
+        const source = report.sources.find((candidate) => item.sourceRefIds.includes(candidate.id));
+        if (source)
+            lines.push(`  click ${item.id} "${source.url}" "Open ${mermaidEscape(source.symbol)}"`);
+    }
+    lines.push('  classDef ok fill:#d9f2e3,stroke:#237a45,color:#102a1c', '  classDef failed fill:#fde2e2,stroke:#b42318,color:#3b0a08,stroke-width:3px', '  classDef pending fill:#fff1cc,stroke:#a15c00,color:#3d2600', '  classDef unknown fill:#eceff3,stroke:#667085,color:#1d2939');
+    return lines.join('\n');
+}
+function markdownTable(rows) {
+    if (rows.length === 0)
+        return '';
+    const escaped = rows.map((row) => row.map((cell) => cell.replace(/\|/g, '\\|').replace(/\r?\n/g, ' ')));
+    const header = escaped[0];
+    return [
+        `| ${header.join(' | ')} |`,
+        `| ${header.map(() => '---').join(' | ')} |`,
+        ...escaped.slice(1).map((row) => `| ${row.join(' | ')} |`),
+    ].join('\n');
+}
+function compactData(data) {
+    const text = JSON.stringify(data);
+    return text.length > 240 ? `${text.slice(0, 237)}...` : text;
+}
+export function renderSessionDiagnosticMarkdown(report) {
+    const stageRows = report.stages.map((item) => {
+        const links = item.sourceRefIds
+            .map((id) => report.sources.find((source) => source.id === id))
+            .filter((source) => Boolean(source))
+            .map((source) => `[${source.symbol}](${source.url})`)
+            .join(', ');
+        return [item.label, STATUS_TEXT[item.status], item.summary, links || '-'];
+    });
+    const timelineRows = report.events.map((event) => [
+        event.ts,
+        event.severity.toUpperCase(),
+        event.kind,
+        event.correlationId ?? '-',
+        compactData(event.data),
+    ]);
+    const sourceRows = report.sources.map((source) => [
+        source.label,
+        `[${source.path}:${source.line}](${source.url})`,
+        source.symbol,
+    ]);
+    const runtime = report.session.runtime
+        ? `\n\n\`\`\`json\n${JSON.stringify(report.session.runtime, null, 2)}\n\`\`\``
+        : '\n\nNo live runtime snapshot was captured.';
+    return `# Cloud Session Diagnosis
+
+**Root cause:** \`${report.rootCause.code}\` at **${report.rootCause.stage ?? 'no single stage'}**
+
+${report.rootCause.summary}
+
+- Session: \`${report.session.id}\`
+- Project: [\`${report.session.projectId}\`](${report.links.project})
+- Environment: \`${report.env}\`
+- Incident time: \`${report.query.at ?? 'latest session state'}\`
+${report.query.evidenceUntil ? `- Historical evidence cutoff: \`${report.query.evidenceUntil}\`` : ''}
+- Deployed revision: \`${report.deploy.revision ?? 'unknown'}\`
+- Deployed commit: ${report.links.githubCommit ? `[\`${report.deploy.git_sha}\`](${report.links.githubCommit})` : 'unknown'}
+- Venue: \`${report.session.venueRef ?? report.session.venue ?? 'not recorded'}\`
+- [Correlated Cloud Run logs](${report.links.cloudLogs})
+${report.links.venueLogsCommand ? `- Retained venue logs: \`${report.links.venueLogsCommand}\`` : ''}
+
+## Failure Diagram
+
+\`\`\`mermaid
+${renderMermaidDiagram(report)}
+\`\`\`
+
+## Stage Diagnosis
+
+${markdownTable([['Stage', 'State', 'Evidence-based conclusion', 'Implementation'], ...stageRows])}
+
+## Runtime Snapshot${runtime}
+
+## Diagnostic Timeline
+
+${timelineRows.length > 0 ? markdownTable([['Time', 'Level', 'Event', 'Command', 'Data'], ...timelineRows]) : 'No diagnostic events were collected for this session.'}
+
+## How The System Works
+
+${markdownTable([['Component', 'Source lines', 'Symbol'], ...sourceRows])}
+`;
+}
+export function renderSessionDiagnosticTerminal(report) {
+    const lines = [
+        `${report.rootCause.code}: ${report.rootCause.summary}`,
+        `session ${report.session.id} | project ${report.session.projectId} | env ${report.env}`,
+        `venue ${report.session.venueRef ?? report.session.venue ?? '(not recorded)'}`,
+        '',
+        renderAsciiDiagram(report),
+        '',
+    ];
+    for (const item of report.stages) {
+        const source = report.sources.find((candidate) => item.sourceRefIds.includes(candidate.id));
+        lines.push(`${STATUS_TEXT[item.status].padEnd(8)} ${item.label}: ${item.summary}`);
+        if (source)
+            lines.push(`           ${source.url}`);
+    }
+    lines.push('', `Cloud logs: ${report.links.cloudLogs}`);
+    if (report.links.venueLogsCommand) {
+        lines.push(`Venue logs: ${report.links.venueLogsCommand}`);
+    }
+    if (report.rootCause.code === 'evidence_missing') {
+        lines.push('', 'Evidence repair: verify the session_diagnostic_events migration, matching API/worker/launcher provenance, and the controlled PR preview smoke before diagnosing the product symptom.');
+    }
+    return lines.join('\n');
+}
+export function renderReproFixPrompt(report) {
+    const failedStage = report.rootCause.stage
+        ? report.stages.find((candidate) => candidate.id === report.rootCause.stage)
+        : undefined;
+    const evidenceIds = failedStage?.evidenceEventIds.length
+        ? failedStage.evidenceEventIds.map((id) => `#${id}`).join(', ')
+        : 'none attached to the primary stage';
+    return `# Reproduce And Fix This Cloud Session Failure
+
+Investigate session \`${report.session.id}\` for project \`${report.session.projectId}\` in \`${report.env}\`.
+The collected diagnosis is \`${report.rootCause.code}\`: ${report.rootCause.summary}
+Primary-stage evidence event ids: ${evidenceIds}.
+
+Use the adjacent \`bundle.json\` as evidence, not as a conclusion to repeat blindly. Follow the deployed source URLs in \`sources\`, inspect the correlated Cloud Run logs, and run \`${report.links.venueLogsCommand ?? 'the venue-specific retained log command from the report'}\` when applicable.
+
+If the diagnosis is \`evidence_missing\`, repair evidence collection first: verify the \`session_diagnostic_events\` migration is applied, API/worker/launcher provenance matches, and the controlled PR preview smoke persists its full correlated timeline. Do not infer a product cause from absent telemetry.
+
+1. Identify the first boundary whose recorded output does not match its required input.
+2. Add or extend the smallest regression test that reproduces that exact failure. For cross-service delivery, use the normal PR environment smoke/e2e path instead of mocks alone.
+3. Fix the production path durably in \`control-plane/\`, \`newly-desktop/\`, or \`newly-cli/\`. Do not add work to the frozen legacy Modal backend or Neon stack.
+4. Prove the fix with the regression test, relevant unit/integration tests, and a deployed PR run that records the expected command/process timeline.
+5. Re-run \`newly diagnose --env ${report.env} --session ${report.session.id}\` and explain any remaining \`FAIL\`, \`BLOCKED\`, or \`UNKNOWN\` stage. Do not call missing evidence healthy.
+`;
+}
+export async function writeSessionDiagnosticBundle(report, outDir) {
+    const absolute = resolve(outDir);
+    await mkdir(absolute, { recursive: true });
+    await Promise.all([
+        writeFile(resolve(absolute, 'bundle.json'), `${JSON.stringify(report, null, 2)}\n`, 'utf8'),
+        writeFile(resolve(absolute, 'report.md'), `${renderSessionDiagnosticMarkdown(report)}\n`, 'utf8'),
+        writeFile(resolve(absolute, 'diagram.mmd'), `${renderMermaidDiagram(report)}\n`, 'utf8'),
+        writeFile(resolve(absolute, 'repro-fix-prompt.md'), renderReproFixPrompt(report), 'utf8'),
+    ]);
+    return absolute;
+}

package/dist/version.js

@@ -1 +1 @@
-export const CLI_VERSION = '0.1.102';
+export const CLI_VERSION = '0.1.103';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runcloud",
-  "version": "0.1.102",
+  "version": "0.1.103",
   "description": "Create and control run.cloud remote mobile simulators and cloud sandboxes",
   "license": "Apache-2.0",
   "keywords": [