[codex] Structure update manifest failures

[juliusmarminge]

Summary

• replace generic update-manifest parse, merge, and serialization exceptions with structured Schema errors
• retain platform, source location, offending input, and conflicting version/field/file metadata
• expose known validation failures through the Effect error channel while leaving unexpected exceptions as defects
• keep semantic validation failures cause-free

Validation

• vp test run scripts/merge-update-manifests.test.ts (10 tests)
• vp check
• vp run typecheck

Sensitive-context follow-up\n- unsupported manifest lines are represented by line number and line length rather than raw contents\n- parse messages no longer echo potentially sensitive line text

---

Note

Medium Risk
Changes how merge-update-manifest failures are represented (typed Effect errors vs generic throws), which callers must handle; scope is release scripting, not runtime auth, with lower blast radius but a behavioral contract shift.

Overview
Replaces generic Error throws in update manifest parse, merge, and serialize with Effect Schema tagged errors (UpdateManifestParseError, version/extra/file conflict errors, serialization errors). Adds attemptUpdateManifest so the merge CLI surfaces known failures on the Effect error channel while unexpected exceptions still die as defects.

Failure payloads and messages are tightened so logs do not echo sensitive input: unsupported lines report line number and length (not the line text), file URL conflicts use getUrlDiagnostics (length, protocol, hostname only), and extra-field conflicts record types and string lengths instead of raw values. File merge conflicts also record which manifest (primary / secondary) and hash/size metadata without embedding full URLs or sha512 strings.

Adds shared getUrlDiagnostics (exported from @t3tools/shared/urlDiagnostics) and redactDpopRequestTarget in dpop.ts for the same redaction pattern; tests assert neither helper leaks credentials, paths, or query tokens.

^{Reviewed by Cursor Bugbot for commit 4bd4e6d. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Replace generic errors with typed structured errors in update manifest parsing and merging

• Introduces typed error classes (UpdateManifestParseError, UpdateManifestVersionConflictError, UpdateManifestExtraConflictError, UpdateManifestFileConflictError, UpdateManifestSerializationError) using effect/Schema in update-manifest.ts, replacing all generic Error throws.
• Conflict errors expose only non-sensitive diagnostics (types, lengths, URL protocol/hostname) rather than raw values, using a new getUrlDiagnostics utility in urlDiagnostics.ts and redactDpopRequestTarget in dpop.ts.
• Adds attemptUpdateManifest helper to wrap manifest operations as Effect failures instead of defects; merge-update-manifests.ts is updated to use it, surfacing errors on the Effect error channel.
• Behavioral Change: callers of mergeUpdateManifestFiles now receive typed Effect failures instead of thrown exceptions for all parse, merge, and serialization errors.

^{Macroscope summarized 4bd4e6d.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 3cf50f52-e7f8-43c7-a769-0be0fc7f89a2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/update-manifest-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Parse message omits offending line
  • Added the offendingLine content to the message getter so it now produces messages like "unsupported line 'not yaml'." when offendingLine is present.
• ✅ Fixed: File conflict labels wrong manifest
  • Separated the combined file iteration into two explicit loops (primary first, then secondary) so that primarySha512/primarySize are structurally guaranteed to come from the primary manifest's entries for cross-manifest conflicts.

Or push these changes by commenting:

@cursor push 3d9418fa45

Preview (3d9418fa45)

diff --git a/scripts/lib/update-manifest.ts b/scripts/lib/update-manifest.ts--- a/scripts/lib/update-manifest.ts+++ b/scripts/lib/update-manifest.ts@@ -36,7 +36,8 @@
override get message(): string {
const location =
this.lineNumber === undefined ? this.sourcePath : `${this.sourcePath}:${this.lineNumber}`;
- return `Invalid ${this.platformLabel} update manifest at ${location}: ${this.reason}.`;+ const suffix = this.offendingLine !== undefined ? ` '${this.offendingLine}'` : "";+ return `Invalid ${this.platformLabel} update manifest at ${location}: ${this.reason}${suffix}.`;
}
}
@@ -361,7 +362,7 @@
}
const filesByUrl = new Map<string, UpdateManifestFile>();
- for (const file of [...primary.files, ...secondary.files]) {+ for (const file of primary.files) {
const existing = filesByUrl.get(file.url);
if (existing && (existing.sha512 !== file.sha512 || existing.size !== file.size)) {
throw new UpdateManifestFileConflictError({
@@ -375,6 +376,20 @@
}
filesByUrl.set(file.url, file);
}
+ for (const file of secondary.files) {+ const existing = filesByUrl.get(file.url);+ if (existing && (existing.sha512 !== file.sha512 || existing.size !== file.size)) {+ throw new UpdateManifestFileConflictError({+ platformLabel,+ url: file.url,+ primarySha512: existing.sha512,+ primarySize: existing.size,+ secondarySha512: file.sha512,+ secondarySize: file.size,+ });+ }+ filesByUrl.set(file.url, file);+ }
return {
version: primary.version,

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit ac92fa2. Configure here.}

[macroscopeapp]

Approvability

Verdict: Approved

Build script refactor converting plain Error throws to structured tagged error classes. Same error conditions, same behavior - just better typed errors. Comprehensive tests verify the new structure and that sensitive data is not leaked.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 9114601

Dismissing prior approval to re-evaluate c9aeab5

Dismissing prior approval to re-evaluate 4bd4e6d

[juliusmarminge]

Summary

• replace generic update-manifest parse, merge, and serialization exceptions with structured Schema errors
• retain platform, source location, offending input, and conflicting version/field/file metadata
• expose known validation failures through the Effect error channel while leaving unexpected exceptions as defects
• keep semantic validation failures cause-free

Validation

• vp test run scripts/merge-update-manifests.test.ts (10 tests)
• vp check
• vp run typecheck

Sensitive-context follow-up\n- unsupported manifest lines are represented by line number and line length rather than raw contents\n- parse messages no longer echo potentially sensitive line text

---

Note

Medium Risk
Changes how merge-update-manifest failures are represented (typed Effect errors vs generic throws), which callers must handle; scope is release scripting, not runtime auth, with lower blast radius but a behavioral contract shift.

Overview
Replaces generic Error throws in update manifest parse, merge, and serialize with Effect Schema tagged errors (UpdateManifestParseError, version/extra/file conflict errors, serialization errors). Adds attemptUpdateManifest so the merge CLI surfaces known failures on the Effect error channel while unexpected exceptions still die as defects.

Failure payloads and messages are tightened so logs do not echo sensitive input: unsupported lines report line number and length (not the line text), file URL conflicts use getUrlDiagnostics (length, protocol, hostname only), and extra-field conflicts record types and string lengths instead of raw values. File merge conflicts also record which manifest (primary / secondary) and hash/size metadata without embedding full URLs or sha512 strings.

Adds shared getUrlDiagnostics (exported from @t3tools/shared/urlDiagnostics) and redactDpopRequestTarget in dpop.ts for the same redaction pattern; tests assert neither helper leaks credentials, paths, or query tokens.

^{Reviewed by Cursor Bugbot for commit 4bd4e6d. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Replace generic errors with typed structured errors in update manifest parsing and merging

• Introduces typed error classes (UpdateManifestParseError, UpdateManifestVersionConflictError, UpdateManifestExtraConflictError, UpdateManifestFileConflictError, UpdateManifestSerializationError) using effect/Schema in update-manifest.ts, replacing all generic Error throws.
• Conflict errors expose only non-sensitive diagnostics (types, lengths, URL protocol/hostname) rather than raw values, using a new getUrlDiagnostics utility in urlDiagnostics.ts and redactDpopRequestTarget in dpop.ts.
• Adds attemptUpdateManifest helper to wrap manifest operations as Effect failures instead of defects; merge-update-manifests.ts is updated to use it, surfacing errors on the Effect error channel.
• Behavioral Change: callers of mergeUpdateManifestFiles now receive typed Effect failures instead of thrown exceptions for all parse, merge, and serialization errors.

^{Macroscope summarized 4bd4e6d.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 3cf50f52-e7f8-43c7-a769-0be0fc7f89a2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/update-manifest-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Parse message omits offending line
  • Added the offendingLine content to the message getter so it now produces messages like "unsupported line 'not yaml'." when offendingLine is present.
• ✅ Fixed: File conflict labels wrong manifest
  • Separated the combined file iteration into two explicit loops (primary first, then secondary) so that primarySha512/primarySize are structurally guaranteed to come from the primary manifest's entries for cross-manifest conflicts.

Or push these changes by commenting:

@cursor push 3d9418fa45

Preview (3d9418fa45)

diff --git a/scripts/lib/update-manifest.ts b/scripts/lib/update-manifest.ts--- a/scripts/lib/update-manifest.ts+++ b/scripts/lib/update-manifest.ts@@ -36,7 +36,8 @@
override get message(): string {
const location =
this.lineNumber === undefined ? this.sourcePath : `${this.sourcePath}:${this.lineNumber}`;
- return `Invalid ${this.platformLabel} update manifest at ${location}: ${this.reason}.`;+ const suffix = this.offendingLine !== undefined ? ` '${this.offendingLine}'` : "";+ return `Invalid ${this.platformLabel} update manifest at ${location}: ${this.reason}${suffix}.`;
}
}
@@ -361,7 +362,7 @@
}
const filesByUrl = new Map<string, UpdateManifestFile>();
- for (const file of [...primary.files, ...secondary.files]) {+ for (const file of primary.files) {
const existing = filesByUrl.get(file.url);
if (existing && (existing.sha512 !== file.sha512 || existing.size !== file.size)) {
throw new UpdateManifestFileConflictError({
@@ -375,6 +376,20 @@
}
filesByUrl.set(file.url, file);
}
+ for (const file of secondary.files) {+ const existing = filesByUrl.get(file.url);+ if (existing && (existing.sha512 !== file.sha512 || existing.size !== file.size)) {+ throw new UpdateManifestFileConflictError({+ platformLabel,+ url: file.url,+ primarySha512: existing.sha512,+ primarySize: existing.size,+ secondarySha512: file.sha512,+ secondarySize: file.size,+ });+ }+ filesByUrl.set(file.url, file);+ }
return {
version: primary.version,

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit ac92fa2. Configure here.}

[macroscopeapp]

Approvability

Verdict: Approved

Build script refactor converting plain Error throws to structured tagged error classes. Same error conditions, same behavior - just better typed errors. Comprehensive tests verify the new structure and that sensitive data is not leaked.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 9114601

Dismissing prior approval to re-evaluate c9aeab5

Dismissing prior approval to re-evaluate 4bd4e6d

[juliusmarminge]

Summary

• replace generic update-manifest parse, merge, and serialization exceptions with structured Schema errors
• retain platform, source location, offending input, and conflicting version/field/file metadata
• expose known validation failures through the Effect error channel while leaving unexpected exceptions as defects
• keep semantic validation failures cause-free

Validation

• vp test run scripts/merge-update-manifests.test.ts (10 tests)
• vp check
• vp run typecheck

Sensitive-context follow-up\n- unsupported manifest lines are represented by line number and line length rather than raw contents\n- parse messages no longer echo potentially sensitive line text

---

Note

Medium Risk
Changes how merge-update-manifest failures are represented (typed Effect errors vs generic throws), which callers must handle; scope is release scripting, not runtime auth, with lower blast radius but a behavioral contract shift.

Overview
Replaces generic Error throws in update manifest parse, merge, and serialize with Effect Schema tagged errors (UpdateManifestParseError, version/extra/file conflict errors, serialization errors). Adds attemptUpdateManifest so the merge CLI surfaces known failures on the Effect error channel while unexpected exceptions still die as defects.

Failure payloads and messages are tightened so logs do not echo sensitive input: unsupported lines report line number and length (not the line text), file URL conflicts use getUrlDiagnostics (length, protocol, hostname only), and extra-field conflicts record types and string lengths instead of raw values. File merge conflicts also record which manifest (primary / secondary) and hash/size metadata without embedding full URLs or sha512 strings.

Adds shared getUrlDiagnostics (exported from @t3tools/shared/urlDiagnostics) and redactDpopRequestTarget in dpop.ts for the same redaction pattern; tests assert neither helper leaks credentials, paths, or query tokens.

^{Reviewed by Cursor Bugbot for commit 4bd4e6d. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Replace generic errors with typed structured errors in update manifest parsing and merging

• Introduces typed error classes (UpdateManifestParseError, UpdateManifestVersionConflictError, UpdateManifestExtraConflictError, UpdateManifestFileConflictError, UpdateManifestSerializationError) using effect/Schema in update-manifest.ts, replacing all generic Error throws.
• Conflict errors expose only non-sensitive diagnostics (types, lengths, URL protocol/hostname) rather than raw values, using a new getUrlDiagnostics utility in urlDiagnostics.ts and redactDpopRequestTarget in dpop.ts.
• Adds attemptUpdateManifest helper to wrap manifest operations as Effect failures instead of defects; merge-update-manifests.ts is updated to use it, surfacing errors on the Effect error channel.
• Behavioral Change: callers of mergeUpdateManifestFiles now receive typed Effect failures instead of thrown exceptions for all parse, merge, and serialization errors.

^{Macroscope summarized 4bd4e6d.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 3cf50f52-e7f8-43c7-a769-0be0fc7f89a2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/update-manifest-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Parse message omits offending line
  • Added the offendingLine content to the message getter so it now produces messages like "unsupported line 'not yaml'." when offendingLine is present.
• ✅ Fixed: File conflict labels wrong manifest
  • Separated the combined file iteration into two explicit loops (primary first, then secondary) so that primarySha512/primarySize are structurally guaranteed to come from the primary manifest's entries for cross-manifest conflicts.

Or push these changes by commenting:

@cursor push 3d9418fa45

Preview (3d9418fa45)

diff --git a/scripts/lib/update-manifest.ts b/scripts/lib/update-manifest.ts--- a/scripts/lib/update-manifest.ts+++ b/scripts/lib/update-manifest.ts@@ -36,7 +36,8 @@
override get message(): string {
const location =
this.lineNumber === undefined ? this.sourcePath : `${this.sourcePath}:${this.lineNumber}`;
- return `Invalid ${this.platformLabel} update manifest at ${location}: ${this.reason}.`;+ const suffix = this.offendingLine !== undefined ? ` '${this.offendingLine}'` : "";+ return `Invalid ${this.platformLabel} update manifest at ${location}: ${this.reason}${suffix}.`;
}
}
@@ -361,7 +362,7 @@
}
const filesByUrl = new Map<string, UpdateManifestFile>();
- for (const file of [...primary.files, ...secondary.files]) {+ for (const file of primary.files) {
const existing = filesByUrl.get(file.url);
if (existing && (existing.sha512 !== file.sha512 || existing.size !== file.size)) {
throw new UpdateManifestFileConflictError({
@@ -375,6 +376,20 @@
}
filesByUrl.set(file.url, file);
}
+ for (const file of secondary.files) {+ const existing = filesByUrl.get(file.url);+ if (existing && (existing.sha512 !== file.sha512 || existing.size !== file.size)) {+ throw new UpdateManifestFileConflictError({+ platformLabel,+ url: file.url,+ primarySha512: existing.sha512,+ primarySize: existing.size,+ secondarySha512: file.sha512,+ secondarySize: file.size,+ });+ }+ filesByUrl.set(file.url, file);+ }
return {
version: primary.version,

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit ac92fa2. Configure here.}

[macroscopeapp]

Approvability

Verdict: Approved

Build script refactor converting plain Error throws to structured tagged error classes. Same error conditions, same behavior - just better typed errors. Comprehensive tests verify the new structure and that sensitive data is not leaked.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 9114601

Dismissing prior approval to re-evaluate c9aeab5

Dismissing prior approval to re-evaluate 4bd4e6d

[juliusmarminge]

Summary

• replace generic update-manifest parse, merge, and serialization exceptions with structured Schema errors
• retain platform, source location, offending input, and conflicting version/field/file metadata
• expose known validation failures through the Effect error channel while leaving unexpected exceptions as defects
• keep semantic validation failures cause-free

Validation

• vp test run scripts/merge-update-manifests.test.ts (10 tests)
• vp check
• vp run typecheck

Sensitive-context follow-up\n- unsupported manifest lines are represented by line number and line length rather than raw contents\n- parse messages no longer echo potentially sensitive line text

---

Note

Medium Risk
Changes how merge-update-manifest failures are represented (typed Effect errors vs generic throws), which callers must handle; scope is release scripting, not runtime auth, with lower blast radius but a behavioral contract shift.

Overview
Replaces generic Error throws in update manifest parse, merge, and serialize with Effect Schema tagged errors (UpdateManifestParseError, version/extra/file conflict errors, serialization errors). Adds attemptUpdateManifest so the merge CLI surfaces known failures on the Effect error channel while unexpected exceptions still die as defects.

Failure payloads and messages are tightened so logs do not echo sensitive input: unsupported lines report line number and length (not the line text), file URL conflicts use getUrlDiagnostics (length, protocol, hostname only), and extra-field conflicts record types and string lengths instead of raw values. File merge conflicts also record which manifest (primary / secondary) and hash/size metadata without embedding full URLs or sha512 strings.

Adds shared getUrlDiagnostics (exported from @t3tools/shared/urlDiagnostics) and redactDpopRequestTarget in dpop.ts for the same redaction pattern; tests assert neither helper leaks credentials, paths, or query tokens.

^{Reviewed by Cursor Bugbot for commit 4bd4e6d. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Replace generic errors with typed structured errors in update manifest parsing and merging

• Introduces typed error classes (UpdateManifestParseError, UpdateManifestVersionConflictError, UpdateManifestExtraConflictError, UpdateManifestFileConflictError, UpdateManifestSerializationError) using effect/Schema in update-manifest.ts, replacing all generic Error throws.
• Conflict errors expose only non-sensitive diagnostics (types, lengths, URL protocol/hostname) rather than raw values, using a new getUrlDiagnostics utility in urlDiagnostics.ts and redactDpopRequestTarget in dpop.ts.
• Adds attemptUpdateManifest helper to wrap manifest operations as Effect failures instead of defects; merge-update-manifests.ts is updated to use it, surfacing errors on the Effect error channel.
• Behavioral Change: callers of mergeUpdateManifestFiles now receive typed Effect failures instead of thrown exceptions for all parse, merge, and serialization errors.

^{Macroscope summarized 4bd4e6d.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 3cf50f52-e7f8-43c7-a769-0be0fc7f89a2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/update-manifest-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Parse message omits offending line
  • Added the offendingLine content to the message getter so it now produces messages like "unsupported line 'not yaml'." when offendingLine is present.
• ✅ Fixed: File conflict labels wrong manifest
  • Separated the combined file iteration into two explicit loops (primary first, then secondary) so that primarySha512/primarySize are structurally guaranteed to come from the primary manifest's entries for cross-manifest conflicts.

Or push these changes by commenting:

@cursor push 3d9418fa45

Preview (3d9418fa45)

diff --git a/scripts/lib/update-manifest.ts b/scripts/lib/update-manifest.ts--- a/scripts/lib/update-manifest.ts+++ b/scripts/lib/update-manifest.ts@@ -36,7 +36,8 @@
override get message(): string {
const location =
this.lineNumber === undefined ? this.sourcePath : `${this.sourcePath}:${this.lineNumber}`;
- return `Invalid ${this.platformLabel} update manifest at ${location}: ${this.reason}.`;+ const suffix = this.offendingLine !== undefined ? ` '${this.offendingLine}'` : "";+ return `Invalid ${this.platformLabel} update manifest at ${location}: ${this.reason}${suffix}.`;
}
}
@@ -361,7 +362,7 @@
}
const filesByUrl = new Map<string, UpdateManifestFile>();
- for (const file of [...primary.files, ...secondary.files]) {+ for (const file of primary.files) {
const existing = filesByUrl.get(file.url);
if (existing && (existing.sha512 !== file.sha512 || existing.size !== file.size)) {
throw new UpdateManifestFileConflictError({
@@ -375,6 +376,20 @@
}
filesByUrl.set(file.url, file);
}
+ for (const file of secondary.files) {+ const existing = filesByUrl.get(file.url);+ if (existing && (existing.sha512 !== file.sha512 || existing.size !== file.size)) {+ throw new UpdateManifestFileConflictError({+ platformLabel,+ url: file.url,+ primarySha512: existing.sha512,+ primarySize: existing.size,+ secondarySha512: file.sha512,+ secondarySize: file.size,+ });+ }+ filesByUrl.set(file.url, file);+ }
return {
version: primary.version,

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit ac92fa2. Configure here.}

[macroscopeapp]

Approvability

Verdict: Approved

Build script refactor converting plain Error throws to structured tagged error classes. Same error conditions, same behavior - just better typed errors. Comprehensive tests verify the new structure and that sensitive data is not leaked.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 9114601

Dismissing prior approval to re-evaluate c9aeab5

Dismissing prior approval to re-evaluate 4bd4e6d

[juliusmarminge]

Summary

• replace generic update-manifest parse, merge, and serialization exceptions with structured Schema errors
• retain platform, source location, offending input, and conflicting version/field/file metadata
• expose known validation failures through the Effect error channel while leaving unexpected exceptions as defects
• keep semantic validation failures cause-free

Validation

• vp test run scripts/merge-update-manifests.test.ts (10 tests)
• vp check
• vp run typecheck

Sensitive-context follow-up\n- unsupported manifest lines are represented by line number and line length rather than raw contents\n- parse messages no longer echo potentially sensitive line text

---

Note

Medium Risk
Changes how merge-update-manifest failures are represented (typed Effect errors vs generic throws), which callers must handle; scope is release scripting, not runtime auth, with lower blast radius but a behavioral contract shift.

Overview
Replaces generic Error throws in update manifest parse, merge, and serialize with Effect Schema tagged errors (UpdateManifestParseError, version/extra/file conflict errors, serialization errors). Adds attemptUpdateManifest so the merge CLI surfaces known failures on the Effect error channel while unexpected exceptions still die as defects.

Failure payloads and messages are tightened so logs do not echo sensitive input: unsupported lines report line number and length (not the line text), file URL conflicts use getUrlDiagnostics (length, protocol, hostname only), and extra-field conflicts record types and string lengths instead of raw values. File merge conflicts also record which manifest (primary / secondary) and hash/size metadata without embedding full URLs or sha512 strings.

Adds shared getUrlDiagnostics (exported from @t3tools/shared/urlDiagnostics) and redactDpopRequestTarget in dpop.ts for the same redaction pattern; tests assert neither helper leaks credentials, paths, or query tokens.

^{Reviewed by Cursor Bugbot for commit 4bd4e6d. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Replace generic errors with typed structured errors in update manifest parsing and merging

• Introduces typed error classes (UpdateManifestParseError, UpdateManifestVersionConflictError, UpdateManifestExtraConflictError, UpdateManifestFileConflictError, UpdateManifestSerializationError) using effect/Schema in update-manifest.ts, replacing all generic Error throws.
• Conflict errors expose only non-sensitive diagnostics (types, lengths, URL protocol/hostname) rather than raw values, using a new getUrlDiagnostics utility in urlDiagnostics.ts and redactDpopRequestTarget in dpop.ts.
• Adds attemptUpdateManifest helper to wrap manifest operations as Effect failures instead of defects; merge-update-manifests.ts is updated to use it, surfacing errors on the Effect error channel.
• Behavioral Change: callers of mergeUpdateManifestFiles now receive typed Effect failures instead of thrown exceptions for all parse, merge, and serialization errors.

^{Macroscope summarized 4bd4e6d.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 3cf50f52-e7f8-43c7-a769-0be0fc7f89a2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/update-manifest-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Parse message omits offending line
  • Added the offendingLine content to the message getter so it now produces messages like "unsupported line 'not yaml'." when offendingLine is present.
• ✅ Fixed: File conflict labels wrong manifest
  • Separated the combined file iteration into two explicit loops (primary first, then secondary) so that primarySha512/primarySize are structurally guaranteed to come from the primary manifest's entries for cross-manifest conflicts.

Or push these changes by commenting:

@cursor push 3d9418fa45

Preview (3d9418fa45)

diff --git a/scripts/lib/update-manifest.ts b/scripts/lib/update-manifest.ts--- a/scripts/lib/update-manifest.ts+++ b/scripts/lib/update-manifest.ts@@ -36,7 +36,8 @@
override get message(): string {
const location =
this.lineNumber === undefined ? this.sourcePath : `${this.sourcePath}:${this.lineNumber}`;
- return `Invalid ${this.platformLabel} update manifest at ${location}: ${this.reason}.`;+ const suffix = this.offendingLine !== undefined ? ` '${this.offendingLine}'` : "";+ return `Invalid ${this.platformLabel} update manifest at ${location}: ${this.reason}${suffix}.`;
}
}
@@ -361,7 +362,7 @@
}
const filesByUrl = new Map<string, UpdateManifestFile>();
- for (const file of [...primary.files, ...secondary.files]) {+ for (const file of primary.files) {
const existing = filesByUrl.get(file.url);
if (existing && (existing.sha512 !== file.sha512 || existing.size !== file.size)) {
throw new UpdateManifestFileConflictError({
@@ -375,6 +376,20 @@
}
filesByUrl.set(file.url, file);
}
+ for (const file of secondary.files) {+ const existing = filesByUrl.get(file.url);+ if (existing && (existing.sha512 !== file.sha512 || existing.size !== file.size)) {+ throw new UpdateManifestFileConflictError({+ platformLabel,+ url: file.url,+ primarySha512: existing.sha512,+ primarySize: existing.size,+ secondarySha512: file.sha512,+ secondarySize: file.size,+ });+ }+ filesByUrl.set(file.url, file);+ }
return {
version: primary.version,

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit ac92fa2. Configure here.}

[macroscopeapp]

Approvability

Verdict: Approved

Build script refactor converting plain Error throws to structured tagged error classes. Same error conditions, same behavior - just better typed errors. Comprehensive tests verify the new structure and that sensitive data is not leaked.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 9114601

Dismissing prior approval to re-evaluate c9aeab5

Dismissing prior approval to re-evaluate 4bd4e6d

[juliusmarminge]

Summary

• replace generic update-manifest parse, merge, and serialization exceptions with structured Schema errors
• retain platform, source location, offending input, and conflicting version/field/file metadata
• expose known validation failures through the Effect error channel while leaving unexpected exceptions as defects
• keep semantic validation failures cause-free

Validation

• vp test run scripts/merge-update-manifests.test.ts (10 tests)
• vp check
• vp run typecheck

Sensitive-context follow-up\n- unsupported manifest lines are represented by line number and line length rather than raw contents\n- parse messages no longer echo potentially sensitive line text

---

Note

Medium Risk
Changes how merge-update-manifest failures are represented (typed Effect errors vs generic throws), which callers must handle; scope is release scripting, not runtime auth, with lower blast radius but a behavioral contract shift.

Overview
Replaces generic Error throws in update manifest parse, merge, and serialize with Effect Schema tagged errors (UpdateManifestParseError, version/extra/file conflict errors, serialization errors). Adds attemptUpdateManifest so the merge CLI surfaces known failures on the Effect error channel while unexpected exceptions still die as defects.

Failure payloads and messages are tightened so logs do not echo sensitive input: unsupported lines report line number and length (not the line text), file URL conflicts use getUrlDiagnostics (length, protocol, hostname only), and extra-field conflicts record types and string lengths instead of raw values. File merge conflicts also record which manifest (primary / secondary) and hash/size metadata without embedding full URLs or sha512 strings.

Adds shared getUrlDiagnostics (exported from @t3tools/shared/urlDiagnostics) and redactDpopRequestTarget in dpop.ts for the same redaction pattern; tests assert neither helper leaks credentials, paths, or query tokens.

^{Reviewed by Cursor Bugbot for commit 4bd4e6d. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Replace generic errors with typed structured errors in update manifest parsing and merging

• Introduces typed error classes (UpdateManifestParseError, UpdateManifestVersionConflictError, UpdateManifestExtraConflictError, UpdateManifestFileConflictError, UpdateManifestSerializationError) using effect/Schema in update-manifest.ts, replacing all generic Error throws.
• Conflict errors expose only non-sensitive diagnostics (types, lengths, URL protocol/hostname) rather than raw values, using a new getUrlDiagnostics utility in urlDiagnostics.ts and redactDpopRequestTarget in dpop.ts.
• Adds attemptUpdateManifest helper to wrap manifest operations as Effect failures instead of defects; merge-update-manifests.ts is updated to use it, surfacing errors on the Effect error channel.
• Behavioral Change: callers of mergeUpdateManifestFiles now receive typed Effect failures instead of thrown exceptions for all parse, merge, and serialization errors.

^{Macroscope summarized 4bd4e6d.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 3cf50f52-e7f8-43c7-a769-0be0fc7f89a2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/update-manifest-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Parse message omits offending line
  • Added the offendingLine content to the message getter so it now produces messages like "unsupported line 'not yaml'." when offendingLine is present.
• ✅ Fixed: File conflict labels wrong manifest
  • Separated the combined file iteration into two explicit loops (primary first, then secondary) so that primarySha512/primarySize are structurally guaranteed to come from the primary manifest's entries for cross-manifest conflicts.

Or push these changes by commenting:

@cursor push 3d9418fa45

Preview (3d9418fa45)

diff --git a/scripts/lib/update-manifest.ts b/scripts/lib/update-manifest.ts--- a/scripts/lib/update-manifest.ts+++ b/scripts/lib/update-manifest.ts@@ -36,7 +36,8 @@
override get message(): string {
const location =
this.lineNumber === undefined ? this.sourcePath : `${this.sourcePath}:${this.lineNumber}`;
- return `Invalid ${this.platformLabel} update manifest at ${location}: ${this.reason}.`;+ const suffix = this.offendingLine !== undefined ? ` '${this.offendingLine}'` : "";+ return `Invalid ${this.platformLabel} update manifest at ${location}: ${this.reason}${suffix}.`;
}
}
@@ -361,7 +362,7 @@
}
const filesByUrl = new Map<string, UpdateManifestFile>();
- for (const file of [...primary.files, ...secondary.files]) {+ for (const file of primary.files) {
const existing = filesByUrl.get(file.url);
if (existing && (existing.sha512 !== file.sha512 || existing.size !== file.size)) {
throw new UpdateManifestFileConflictError({
@@ -375,6 +376,20 @@
}
filesByUrl.set(file.url, file);
}
+ for (const file of secondary.files) {+ const existing = filesByUrl.get(file.url);+ if (existing && (existing.sha512 !== file.sha512 || existing.size !== file.size)) {+ throw new UpdateManifestFileConflictError({+ platformLabel,+ url: file.url,+ primarySha512: existing.sha512,+ primarySize: existing.size,+ secondarySha512: file.sha512,+ secondarySize: file.size,+ });+ }+ filesByUrl.set(file.url, file);+ }
return {
version: primary.version,

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit ac92fa2. Configure here.}

[macroscopeapp]

Approvability

Verdict: Approved

Build script refactor converting plain Error throws to structured tagged error classes. Same error conditions, same behavior - just better typed errors. Comprehensive tests verify the new structure and that sensitive data is not leaked.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 9114601

Dismissing prior approval to re-evaluate c9aeab5

Dismissing prior approval to re-evaluate 4bd4e6d

[juliusmarminge]

Summary

• replace generic update-manifest parse, merge, and serialization exceptions with structured Schema errors
• retain platform, source location, offending input, and conflicting version/field/file metadata
• expose known validation failures through the Effect error channel while leaving unexpected exceptions as defects
• keep semantic validation failures cause-free

Validation

• vp test run scripts/merge-update-manifests.test.ts (10 tests)
• vp check
• vp run typecheck

Sensitive-context follow-up\n- unsupported manifest lines are represented by line number and line length rather than raw contents\n- parse messages no longer echo potentially sensitive line text

---

Note

Medium Risk
Changes how merge-update-manifest failures are represented (typed Effect errors vs generic throws), which callers must handle; scope is release scripting, not runtime auth, with lower blast radius but a behavioral contract shift.

Overview
Replaces generic Error throws in update manifest parse, merge, and serialize with Effect Schema tagged errors (UpdateManifestParseError, version/extra/file conflict errors, serialization errors). Adds attemptUpdateManifest so the merge CLI surfaces known failures on the Effect error channel while unexpected exceptions still die as defects.

Failure payloads and messages are tightened so logs do not echo sensitive input: unsupported lines report line number and length (not the line text), file URL conflicts use getUrlDiagnostics (length, protocol, hostname only), and extra-field conflicts record types and string lengths instead of raw values. File merge conflicts also record which manifest (primary / secondary) and hash/size metadata without embedding full URLs or sha512 strings.

Adds shared getUrlDiagnostics (exported from @t3tools/shared/urlDiagnostics) and redactDpopRequestTarget in dpop.ts for the same redaction pattern; tests assert neither helper leaks credentials, paths, or query tokens.

^{Reviewed by Cursor Bugbot for commit 4bd4e6d. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Replace generic errors with typed structured errors in update manifest parsing and merging

• Introduces typed error classes (UpdateManifestParseError, UpdateManifestVersionConflictError, UpdateManifestExtraConflictError, UpdateManifestFileConflictError, UpdateManifestSerializationError) using effect/Schema in update-manifest.ts, replacing all generic Error throws.
• Conflict errors expose only non-sensitive diagnostics (types, lengths, URL protocol/hostname) rather than raw values, using a new getUrlDiagnostics utility in urlDiagnostics.ts and redactDpopRequestTarget in dpop.ts.
• Adds attemptUpdateManifest helper to wrap manifest operations as Effect failures instead of defects; merge-update-manifests.ts is updated to use it, surfacing errors on the Effect error channel.
• Behavioral Change: callers of mergeUpdateManifestFiles now receive typed Effect failures instead of thrown exceptions for all parse, merge, and serialization errors.

^{Macroscope summarized 4bd4e6d.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 3cf50f52-e7f8-43c7-a769-0be0fc7f89a2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/update-manifest-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Parse message omits offending line
  • Added the offendingLine content to the message getter so it now produces messages like "unsupported line 'not yaml'." when offendingLine is present.
• ✅ Fixed: File conflict labels wrong manifest
  • Separated the combined file iteration into two explicit loops (primary first, then secondary) so that primarySha512/primarySize are structurally guaranteed to come from the primary manifest's entries for cross-manifest conflicts.

Or push these changes by commenting:

@cursor push 3d9418fa45

Preview (3d9418fa45)

diff --git a/scripts/lib/update-manifest.ts b/scripts/lib/update-manifest.ts--- a/scripts/lib/update-manifest.ts+++ b/scripts/lib/update-manifest.ts@@ -36,7 +36,8 @@
override get message(): string {
const location =
this.lineNumber === undefined ? this.sourcePath : `${this.sourcePath}:${this.lineNumber}`;
- return `Invalid ${this.platformLabel} update manifest at ${location}: ${this.reason}.`;+ const suffix = this.offendingLine !== undefined ? ` '${this.offendingLine}'` : "";+ return `Invalid ${this.platformLabel} update manifest at ${location}: ${this.reason}${suffix}.`;
}
}
@@ -361,7 +362,7 @@
}
const filesByUrl = new Map<string, UpdateManifestFile>();
- for (const file of [...primary.files, ...secondary.files]) {+ for (const file of primary.files) {
const existing = filesByUrl.get(file.url);
if (existing && (existing.sha512 !== file.sha512 || existing.size !== file.size)) {
throw new UpdateManifestFileConflictError({
@@ -375,6 +376,20 @@
}
filesByUrl.set(file.url, file);
}
+ for (const file of secondary.files) {+ const existing = filesByUrl.get(file.url);+ if (existing && (existing.sha512 !== file.sha512 || existing.size !== file.size)) {+ throw new UpdateManifestFileConflictError({+ platformLabel,+ url: file.url,+ primarySha512: existing.sha512,+ primarySize: existing.size,+ secondarySha512: file.sha512,+ secondarySize: file.size,+ });+ }+ filesByUrl.set(file.url, file);+ }
return {
version: primary.version,

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit ac92fa2. Configure here.}

[macroscopeapp]

Approvability

Verdict: Approved

Build script refactor converting plain Error throws to structured tagged error classes. Same error conditions, same behavior - just better typed errors. Comprehensive tests verify the new structure and that sensitive data is not leaked.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 9114601

Dismissing prior approval to re-evaluate c9aeab5

Dismissing prior approval to re-evaluate 4bd4e6d

[juliusmarminge]

Summary

• replace generic update-manifest parse, merge, and serialization exceptions with structured Schema errors
• retain platform, source location, offending input, and conflicting version/field/file metadata
• expose known validation failures through the Effect error channel while leaving unexpected exceptions as defects
• keep semantic validation failures cause-free

Validation

• vp test run scripts/merge-update-manifests.test.ts (10 tests)
• vp check
• vp run typecheck

Sensitive-context follow-up\n- unsupported manifest lines are represented by line number and line length rather than raw contents\n- parse messages no longer echo potentially sensitive line text

---

Note

Medium Risk
Changes how merge-update-manifest failures are represented (typed Effect errors vs generic throws), which callers must handle; scope is release scripting, not runtime auth, with lower blast radius but a behavioral contract shift.

Overview
Replaces generic Error throws in update manifest parse, merge, and serialize with Effect Schema tagged errors (UpdateManifestParseError, version/extra/file conflict errors, serialization errors). Adds attemptUpdateManifest so the merge CLI surfaces known failures on the Effect error channel while unexpected exceptions still die as defects.

Failure payloads and messages are tightened so logs do not echo sensitive input: unsupported lines report line number and length (not the line text), file URL conflicts use getUrlDiagnostics (length, protocol, hostname only), and extra-field conflicts record types and string lengths instead of raw values. File merge conflicts also record which manifest (primary / secondary) and hash/size metadata without embedding full URLs or sha512 strings.

Adds shared getUrlDiagnostics (exported from @t3tools/shared/urlDiagnostics) and redactDpopRequestTarget in dpop.ts for the same redaction pattern; tests assert neither helper leaks credentials, paths, or query tokens.

^{Reviewed by Cursor Bugbot for commit 4bd4e6d. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Replace generic errors with typed structured errors in update manifest parsing and merging

• Introduces typed error classes (UpdateManifestParseError, UpdateManifestVersionConflictError, UpdateManifestExtraConflictError, UpdateManifestFileConflictError, UpdateManifestSerializationError) using effect/Schema in update-manifest.ts, replacing all generic Error throws.
• Conflict errors expose only non-sensitive diagnostics (types, lengths, URL protocol/hostname) rather than raw values, using a new getUrlDiagnostics utility in urlDiagnostics.ts and redactDpopRequestTarget in dpop.ts.
• Adds attemptUpdateManifest helper to wrap manifest operations as Effect failures instead of defects; merge-update-manifests.ts is updated to use it, surfacing errors on the Effect error channel.
• Behavioral Change: callers of mergeUpdateManifestFiles now receive typed Effect failures instead of thrown exceptions for all parse, merge, and serialization errors.

^{Macroscope summarized 4bd4e6d.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 3cf50f52-e7f8-43c7-a769-0be0fc7f89a2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/update-manifest-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Parse message omits offending line
  • Added the offendingLine content to the message getter so it now produces messages like "unsupported line 'not yaml'." when offendingLine is present.
• ✅ Fixed: File conflict labels wrong manifest
  • Separated the combined file iteration into two explicit loops (primary first, then secondary) so that primarySha512/primarySize are structurally guaranteed to come from the primary manifest's entries for cross-manifest conflicts.

Or push these changes by commenting:

@cursor push 3d9418fa45

Preview (3d9418fa45)

diff --git a/scripts/lib/update-manifest.ts b/scripts/lib/update-manifest.ts--- a/scripts/lib/update-manifest.ts+++ b/scripts/lib/update-manifest.ts@@ -36,7 +36,8 @@
override get message(): string {
const location =
this.lineNumber === undefined ? this.sourcePath : `${this.sourcePath}:${this.lineNumber}`;
- return `Invalid ${this.platformLabel} update manifest at ${location}: ${this.reason}.`;+ const suffix = this.offendingLine !== undefined ? ` '${this.offendingLine}'` : "";+ return `Invalid ${this.platformLabel} update manifest at ${location}: ${this.reason}${suffix}.`;
}
}
@@ -361,7 +362,7 @@
}
const filesByUrl = new Map<string, UpdateManifestFile>();
- for (const file of [...primary.files, ...secondary.files]) {+ for (const file of primary.files) {
const existing = filesByUrl.get(file.url);
if (existing && (existing.sha512 !== file.sha512 || existing.size !== file.size)) {
throw new UpdateManifestFileConflictError({
@@ -375,6 +376,20 @@
}
filesByUrl.set(file.url, file);
}
+ for (const file of secondary.files) {+ const existing = filesByUrl.get(file.url);+ if (existing && (existing.sha512 !== file.sha512 || existing.size !== file.size)) {+ throw new UpdateManifestFileConflictError({+ platformLabel,+ url: file.url,+ primarySha512: existing.sha512,+ primarySize: existing.size,+ secondarySha512: file.sha512,+ secondarySize: file.size,+ });+ }+ filesByUrl.set(file.url, file);+ }
return {
version: primary.version,

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit ac92fa2. Configure here.}

[macroscopeapp]

Approvability

Verdict: Approved

Build script refactor converting plain Error throws to structured tagged error classes. Same error conditions, same behavior - just better typed errors. Comprehensive tests verify the new structure and that sensitive data is not leaked.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 9114601

Dismissing prior approval to re-evaluate c9aeab5

Dismissing prior approval to re-evaluate 4bd4e6d