@ai21/gateway 1.1.0 → 1.3.0

package/README.md

@@ -15,14 +15,14 @@ sends one request to prove it works. With no key stored it signs you in through
 browser first and creates an AI21 key for you, all in the one command — pass `--key`
 only for scripting, since a key in argv stays in your shell history.
 
-The key is checked against the gateway *before* anything is written, so a key the
+The key is checked against the gateway _before_ anything is written, so a key the
 gateway will not take — or an agent id the key does not carry — stops the command
 instead of leaving a config that fails every later request. There is no flag to skip
 that check, and it needs none: only a definite rejection stops the install. If the
 gateway cannot be reached, or answers something we cannot read, the config is written
 and a warning says the key went unchecked.
 
-`--no-verify` turns off the *post-write* check — the one that proves end to end that
+`--no-verify` turns off the _post-write_ check — the one that proves end to end that
 Claude Code reaches the gateway. It does not affect the pre-write key check.
 
 The gateway passes your own Claude credential through, so without a Claude login it
@@ -32,6 +32,11 @@ leaves `settings.json` as it was before the run, and exits 9. A timeout or any o
 verification failure only warns and keeps the config. `--no-verify` skips this too, for
 machines where Claude Code is signed in later.
 
+The gateway currently supports only the Claude Code CLI. With no `claude` on PATH and
+no Anthropic key (`--anthropic-key` or `ANTHROPIC_API_KEY`), `install` stops before
+signing in, writes nothing, and exits 10, even under `--no-verify`. With an Anthropic
+key it goes ahead and verifies with a direct request instead.
+
 The dashboard prints this command for you (Add agent, or Reconnect on an existing
 agent) and offers the key as a separate copy.
 
@@ -95,6 +100,14 @@ the only one supported so far — an unsupported name is refused rather than
 defaulted, so a `--client` we do not implement never writes Claude Code's file by
 mistake.
 
+`install` reports onboarding events to AI21's product analytics (Amplitude), so we can
+see where setup fails: when it started, then whether it completed or at which step it
+failed, with the CLI version, OS, workspace id and a random per-run id. A failure is
+reported as a fixed reason, never the message you saw, so no key, email, path, agent id
+or argument is ever sent. Setup counts as completed only once the written config has
+been verified. Only the production and staging gateways report; any other `--gateway`
+sends nothing. Reporting never delays or fails a command (`src/telemetry/`).
+
 > **Internal only.** The package is published to AI21's Artifact Registry, not
 > public npm, so a bare `npx` cannot reach it yet — see below.
 
@@ -116,7 +129,7 @@ last tag. `package.json` stays at `0.0.0`; the git tag is the record.
 `403` misleads: it reads as though the AI21 gateway rejected you, but it is npm
 failing to reach the registry — before the CLI has run at all.
 
-The last one catches people out: this project *is* `@ai21/gateway`, so npx
+The last one catches people out: this project _is_ `@ai21/gateway`, so npx
 resolves the name to the working directory instead of the registry, finds no
 linked binary, and fails. The published artifact can never be exercised from its
 own source tree — use a scratch directory.

package/dist/cli.d.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { type RunResult } from "./result.js";
 export { EXIT, type RunResult } from "./result.js";
-export declare const USAGE = "ai21-gateway \u2014 point a local coding agent at the AI21 Intelligent Gateway\n\nUsage:\n  ai21-gateway install --agent-id <id>        configure this machine (default command)\n  ai21-gateway login                          sign in and create an AI21 key\n  ai21-gateway uninstall                      revert what this tool wrote\n  ai21-gateway --help\n  ai21-gateway --version\n\nInstall flags:\n  --agent-id <id>   agent to attribute requests to (required)\n  --key <key>       AI21 key. Omit it and the CLI uses the key from your signed-in\n                    session, signing you in through the browser if you are not\n                    already. A key passed here is kept in your shell history\n  --workspace <id>  workspace to create the key in; the default is chosen for you\n  --user-id <id>    adds the x-ai21-user-id attribution header\n  --client <name>   which agent to configure; 'claude-code' (default) is the only\n                    one supported so far\n  --gateway <url>   override the gateway URL outright\n  --user | --repo   write to the home directory (default) or repo-local\n  --yes             overwrite an existing conflicting value\n  --print           render the resolved configuration instead of writing it\n                    (the key is always masked)\n  --json            machine-readable output\n\nLogin flags:\n  --workspace <id>  workspace to create the key in. Without it one is chosen for\n                    you and named in the output\n  --gateway <url>   override the gateway URL outright\n  --app <url>       the webapp origin serving the sign-in page\n\n'login' opens your browser, creates an AI21 key in your workspace and stores it\nunder ~/.config/ai21-gateway. 'install' does this for you when you have no key\nyet, so it is only needed on its own to sign in ahead of time or to move to a\ndifferent workspace.\n\nUninstall flags:\n  --agent-id <id>   guard: refuse unless the stored agent matches\n  --from-backup     restore settings.json.bak verbatim instead of removing\n                    only this tool's keys \u2014 discards later edits\n  --yes             proceed with a --from-backup restore that discards changes\n  --user | --repo   which settings.json to revert (home by default)\n\nBy default 'uninstall' removes only the keys this tool wrote, leaving unrelated\nsettings and any later edits of your own intact.\n\nVerification flags:\n  --anthropic-key <key>  Anthropic credential for the verifying request; used\n                         only when 'claude' is not on PATH, never written to disk\n  --no-verify            write the configuration without verifying it\n\nAfter a successful write the CLI sends one request through the gateway to confirm\nthe configuration works: 'claude -p' when it is on PATH, otherwise a direct\nrequest if an Anthropic credential is available. With neither, verification is\nskipped with a warning \u2014 it never changes the exit code.\n\nRe-running the same command is a no-op. An existing settings.json is backed up\nto settings.json.bak before it is changed, and is left untouched if the CLI\nrefuses.";
+export declare const USAGE = "ai21-gateway \u2014 point a local coding agent at the AI21 Intelligent Gateway\n\nUsage:\n  ai21-gateway install --agent-id <id>        configure this machine (default command)\n  ai21-gateway login                          sign in and create an AI21 key\n  ai21-gateway uninstall                      revert what this tool wrote\n  ai21-gateway --help\n  ai21-gateway --version\n\nInstall flags:\n  --agent-id <id>   agent to attribute requests to (required)\n  --key <key>       AI21 key. Omit it and the CLI uses the key from your signed-in\n                    session, signing you in through the browser if you are not\n                    already. A key passed here is kept in your shell history\n  --workspace <id>  workspace to create the key in; the default is chosen for you\n  --user-id <id>    adds the x-ai21-user-id attribution header\n  --client <name>   which agent to configure; 'claude-code' (default) is the only\n                    one supported so far\n  --gateway <url>   override the gateway URL outright\n  --user | --repo   write to the home directory (default) or repo-local\n  --yes             overwrite an existing conflicting value\n  --print           render the resolved configuration instead of writing it\n                    (the key is always masked)\n  --json            machine-readable output\n\nLogin flags:\n  --workspace <id>  workspace to create the key in. Without it one is chosen for\n                    you and named in the output\n  --gateway <url>   override the gateway URL outright\n  --app <url>       the webapp origin serving the sign-in page\n\n'login' opens your browser, creates an AI21 key in your workspace and stores it\nunder ~/.config/ai21-gateway. 'install' does this for you when you have no key\nyet, so it is only needed on its own to sign in ahead of time or to move to a\ndifferent workspace.\n\nUninstall flags:\n  --agent-id <id>   guard: refuse unless the stored agent matches\n  --from-backup     restore settings.json.bak verbatim instead of removing\n                    only this tool's keys \u2014 discards later edits\n  --yes             proceed with a --from-backup restore that discards changes\n  --user | --repo   which settings.json to revert (home by default)\n\nBy default 'uninstall' removes only the keys this tool wrote, leaving unrelated\nsettings and any later edits of your own intact.\n\nVerification flags:\n  --anthropic-key <key>  Anthropic credential for the verifying request; used\n                         only when 'claude' is not on PATH, never written to disk\n  --no-verify            write the configuration without verifying it\n\nAfter a successful write the CLI sends one request through the gateway to confirm\nthe configuration works: 'claude -p' when it is on PATH, otherwise a direct\nrequest if an Anthropic credential is available. With neither, 'install' stops\nbefore signing in and writes nothing: only the Claude Code CLI is supported.\n\nRe-running the same command is a no-op. An existing settings.json is backed up\nto settings.json.bak before it is changed, and is left untouched if the CLI\nrefuses.";
 export declare function readVersion(): string;
 /**
  * Pure entry point: argv in, streams-and-exit-code out. Keeping I/O at the edge

package/dist/cli.js

@@ -12,7 +12,12 @@ import { nodeBrowserDeps, openBrowser } from "./login/browser.js";
 import { selectSecretStore } from "./login/keychain/select.js";
 import { runCredentialCommand } from "./login/keychain/runner.js";
 import { startLoopback } from "./login/loopback.js";
+import { createStatusLine, isInteractive } from "./status.js";
+import { waitForEnter } from "./prompt.js";
+import { FLUSH_CAP_MS, nodeTelemetry } from "./telemetry/telemetry.js";
 export { EXIT } from "./result.js";
+/** 128 + SIGINT: what a shell reports for Ctrl-C, so scripts see the usual code. */
+const EXIT_INTERRUPTED = 130;
 export const USAGE = `ai21-gateway — point a local coding agent at the AI21 Intelligent Gateway
 
 Usage:
@@ -66,8 +71,8 @@ Verification flags:
 
 After a successful write the CLI sends one request through the gateway to confirm
 the configuration works: 'claude -p' when it is on PATH, otherwise a direct
-request if an Anthropic credential is available. With neither, verification is
-skipped with a warning — it never changes the exit code.
+request if an Anthropic credential is available. With neither, 'install' stops
+before signing in and writes nothing: only the Claude Code CLI is supported.
 
 Re-running the same command is a no-op. An existing settings.json is backed up
 to settings.json.bak before it is changed, and is left untouched if the CLI
@@ -84,6 +89,15 @@ export function readVersion() {
     }
     return version;
 }
+/** A corrupt install still reports, rather than failing a command over analytics. */
+function versionForTelemetry() {
+    try {
+        return readVersion();
+    }
+    catch {
+        return "unknown";
+    }
+}
 function versionResult() {
     try {
         return { code: EXIT.OK, out: `${readVersion()}\n`, err: "" };
@@ -116,12 +130,22 @@ export async function run(argv) {
         case "error":
             return { code: EXIT.USAGE, out: "", err: `${outcome.message}\n\n${USAGE}\n` };
         case "args": {
+            // `--json` keeps stderr to plain lines too: a consumer may be capturing both streams.
+            const status = createStatusLine(process.stderr, !outcome.args.json && isInteractive(process.stderr, process.env));
             // One stream for login's progress and credential-file warnings, so neither is missed.
-            const notify = (message) => void process.stderr.write(`${message}\n`);
+            // Routed through the status line so a message never lands in the middle of the spinner.
+            const notify = (message) => status.log(message);
             // Everything the CLI needs from the outside world is gathered here, at the
             // edge, so every layer below stays pure and testable against a temp
             // directory and a pair of fake streams.
-            return dispatch(outcome.args, {
+            const telemetry = nodeTelemetry(outcome.args.urls.gateway, versionForTelemetry(), fetch);
+            // Ctrl-C would otherwise leave a half-drawn spinner on the prompt line.
+            const interrupt = () => {
+                status.stop();
+                process.exit(EXIT_INTERRUPTED);
+            };
+            process.once("SIGINT", interrupt);
+            const result = await dispatch(outcome.args, {
                 paths: { cwd: process.cwd(), home: homedir() },
                 prompt: { input: process.stdin, output: process.stderr },
                 processEnv: process.env,
@@ -130,6 +154,7 @@ export async function run(argv) {
                 login: {
                     startListener: startLoopback,
                     openBrowser: (url) => openBrowser(url, nodeBrowserDeps()),
+                    waitForEnter: () => waitForEnter(process.stdin),
                     fetchImpl: fetch,
                     secrets: selectSecretStore({
                         paths: { home: homedir(), warn: notify },
@@ -142,7 +167,16 @@ export async function run(argv) {
                 // stderr, so `--json` on stdout stays a single parseable object even while
                 // login narrates its progress.
                 notify,
+                status,
+                telemetry,
+            }).finally(() => {
+                // Cleared before the caller writes the result, and on a throw, so no frame survives.
+                status.stop();
+                process.off("SIGINT", interrupt);
             });
+            // The caller exits right after this returns, which would cut off a send in flight.
+            await telemetry.flush(FLUSH_CAP_MS);
+            return result;
         }
     }
 }

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,IAAI,EAAkB,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,IAAI,EAAkB,MAAM,aAAa,CAAC;AAEnD,MAAM,CAAC,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SA0DZ,CAAC;AAEV,+EAA+E;AAC/E,SAAS,WAAW;IAClB,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;IAC7D,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,0EAA0E;QAC1E,kCAAkC;QAClC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,GAAG,EAAE,EAAE;YACP,GAAG,EAAE,6GAA6G;SACnH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAuB;IAC/C,wEAAwE;IACxE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAE5E,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAEnC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QACvD,KAAK,SAAS;YACZ,OAAO,aAAa,EAAE,CAAC;QACzB,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,OAAO,KAAK,IAAI,EAAE,CAAC;QAChF,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,sFAAsF;YACtF,MAAM,MAAM,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;YAEpF,2EAA2E;YAC3E,oEAAoE;YACpE,wCAAwC;YACxC,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE;gBAC5B,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;gBAC9C,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;gBACxD,UAAU,EAAE,OAAO,CAAC,GAAG;gBACvB,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC;gBACnC,QAAQ,EAAE,gBAAgB,EAAE;gBAC5B,KAAK,EAAE;oBACL,aAAa,EAAE,aAAa;oBAC5B,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC;oBACzD,SAAS,EAAE,KAAK;oBAChB,OAAO,EAAE,iBAAiB,CAAC;wBACzB,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;wBACxC,GAAG,EAAE,oBAAoB;wBACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE;wBACjF,SAAS,EAAE,aAAa;qBACzB,CAAC;iBACH;gBACD,2EAA2E;gBAC3E,+BAA+B;gBAC/B,MAAM;aACP,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,MAAM;IACb,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAExC,IAAI,CAAC;QACH,8EAA8E;QAC9E,OAAO,YAAY,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,MAAM,EAAE,EAAE,CAAC;IACb,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE1C,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE1C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,IAAI,EAAkB,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEvE,OAAO,EAAE,IAAI,EAAkB,MAAM,aAAa,CAAC;AAEnD,oFAAoF;AACpF,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,MAAM,CAAC,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SA0DZ,CAAC;AAEV,+EAA+E;AAC/E,SAAS,WAAW;IAClB,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;IAC7D,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,qFAAqF;AACrF,SAAS,mBAAmB;IAC1B,IAAI,CAAC;QACH,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,0EAA0E;QAC1E,kCAAkC;QAClC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,GAAG,EAAE,EAAE;YACP,GAAG,EAAE,6GAA6G;SACnH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAuB;IAC/C,wEAAwE;IACxE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAE5E,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAEnC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QACvD,KAAK,SAAS;YACZ,OAAO,aAAa,EAAE,CAAC;QACzB,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,OAAO,KAAK,IAAI,EAAE,CAAC;QAChF,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,sFAAsF;YACtF,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAClH,sFAAsF;YACtF,wFAAwF;YACxF,MAAM,MAAM,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAE9D,2EAA2E;YAC3E,oEAAoE;YACpE,wCAAwC;YACxC,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,EAAE,KAAK,CAAC,CAAC;YAEzF,wEAAwE;YACxE,MAAM,SAAS,GAAG,GAAS,EAAE;gBAC3B,MAAM,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACjC,CAAC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAElC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE;gBAC1C,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;gBAC9C,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;gBACxD,UAAU,EAAE,OAAO,CAAC,GAAG;gBACvB,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC;gBACnC,QAAQ,EAAE,gBAAgB,EAAE;gBAC5B,KAAK,EAAE;oBACL,aAAa,EAAE,aAAa;oBAC5B,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC;oBACzD,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;oBAC/C,SAAS,EAAE,KAAK;oBAChB,OAAO,EAAE,iBAAiB,CAAC;wBACzB,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;wBACxC,GAAG,EAAE,oBAAoB;wBACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE;wBACjF,SAAS,EAAE,aAAa;qBACzB,CAAC;iBACH;gBACD,2EAA2E;gBAC3E,+BAA+B;gBAC/B,MAAM;gBACN,MAAM;gBACN,SAAS;aACV,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBACd,qFAAqF;gBACrF,MAAM,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;YAEH,mFAAmF;YACnF,MAAM,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAEpC,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,MAAM;IACb,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAExC,IAAI,CAAC;QACH,8EAA8E;QAC9E,OAAO,YAAY,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,MAAM,EAAE,EAAE,CAAC;IACb,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE1C,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE1C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC"}

package/dist/login/lock.d.ts

@@ -7,6 +7,12 @@
  * within microseconds of a crash.
  */
 export declare function breakStale(lockPath: string, judgedIno: number): void;
+/**
+ * On Windows a lock another process has just deleted lingers, "delete pending", until the
+ * last handle on it closes (a waiter's `inspect` is one). Creating it again meanwhile
+ * fails with EPERM rather than EEXIST, so there it means "still held, retry".
+ */
+export declare function isDeletePending(err: unknown, platform?: NodeJS.Platform): boolean;
 /**
  * Runs `change` with the lock held, and releases it however that turns out. The lock's
  * directory must exist. Throws if the lock is not free within the budget.

package/dist/login/lock.js

@@ -95,6 +95,15 @@ function release(lockPath, ownIno) {
             throw err;
     }
 }
+/**
+ * On Windows a lock another process has just deleted lingers, "delete pending", until the
+ * last handle on it closes (a waiter's `inspect` is one). Creating it again meanwhile
+ * fails with EPERM rather than EEXIST, so there it means "still held, retry".
+ */
+export function isDeletePending(err, platform = process.platform) {
+    const code = err.code;
+    return platform === "win32" && (code === "EPERM" || code === "EACCES");
+}
 /**
  * Runs `change` with the lock held, and releases it however that turns out. The lock's
  * directory must exist. Throws if the lock is not free within the budget.
@@ -103,6 +112,7 @@ export function withLock(lockPath, change, options = {}) {
     // Overridable so the test for the refusal does not spend the real budget waiting.
     const deadline = Date.now() + (options.waitBudgetMs ?? WAIT_BUDGET_MS);
     let fd;
+    let deletePending;
     for (;;) {
         try {
             // "wx" is O_CREAT|O_EXCL: the create either wins or fails, with no window between
@@ -111,7 +121,9 @@ export function withLock(lockPath, change, options = {}) {
             break;
         }
         catch (err) {
-            if (err.code !== "EEXIST")
+            if (isDeletePending(err))
+                deletePending = err;
+            else if (err.code !== "EEXIST")
                 throw err;
         }
         const holder = inspect(lockPath);
@@ -120,6 +132,9 @@ export function withLock(lockPath, change, options = {}) {
             continue;
         }
         if (Date.now() >= deadline) {
+            // Never contended, only refused: a real permission error, so report it as one.
+            if (holder === undefined && deletePending !== undefined)
+                throw deletePending;
             throw new Error(`another ai21-gateway command is writing credentials (${lockPath} held for ${holder?.ageMs ?? "?"}ms). ` +
                 "Wait for it to finish, or delete that file if nothing is running.");
         }

package/dist/login/lock.js.map

@@ -1 +1 @@
-{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../src/login/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,SAAS,EACT,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,SAAS,GACV,MAAM,SAAS,CAAC;AAEjB,uFAAuF;AACvF,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B;;;;GAIG;AACH,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,MAAM,QAAQ,GAAG,EAAE,CAAC;AAEpB,sFAAsF;AACtF,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACnE,CAAC;AAQD,uGAAuG;AACvG,SAAS,OAAO,CAAC,QAAgB;IAC/B,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAEvC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;IAC5F,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,SAAiB;IAC5D,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC7C,IAAI,CAAC;QACH,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAE7D,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,SAAS;YAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,SAAS,OAAO,CAAC,QAAgB,EAAE,MAAc;IAC/C,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,KAAK,MAAM;YAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAI,QAAgB,EAAE,MAAe,EAAE,UAAqC,EAAE;IACpG,kFAAkF;IAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,cAAc,CAAC,CAAC;IACvE,IAAI,EAAU,CAAC;IAEf,SAAS,CAAC;QACR,IAAI,CAAC;YACH,kFAAkF;YAClF,2BAA2B;YAC3B,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACrC,MAAM;QACR,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,GAAG,cAAc,CAAC,EAAE,CAAC;YAC/E,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,wDAAwD,QAAQ,aAAa,MAAM,EAAE,KAAK,IAAI,GAAG,OAAO;gBACtG,mEAAmE,CACtE,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;IACjC,IAAI,CAAC;QACH,6DAA6D;QAC7D,SAAS,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QAElC,OAAO,MAAM,EAAE,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC"}
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../src/login/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,SAAS,EACT,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,SAAS,GACV,MAAM,SAAS,CAAC;AAEjB,uFAAuF;AACvF,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B;;;;GAIG;AACH,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,MAAM,QAAQ,GAAG,EAAE,CAAC;AAEpB,sFAAsF;AACtF,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACnE,CAAC;AAQD,uGAAuG;AACvG,SAAS,OAAO,CAAC,QAAgB;IAC/B,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAEvC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;IAC5F,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,SAAiB;IAC5D,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC7C,IAAI,CAAC;QACH,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAE7D,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,SAAS;YAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,SAAS,OAAO,CAAC,QAAgB,EAAE,MAAc;IAC/C,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,KAAK,MAAM;YAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAY,EAAE,WAA4B,OAAO,CAAC,QAAQ;IACxF,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;IAEjD,OAAO,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAI,QAAgB,EAAE,MAAe,EAAE,UAAqC,EAAE;IACpG,kFAAkF;IAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,cAAc,CAAC,CAAC;IACvE,IAAI,EAAU,CAAC;IACf,IAAI,aAAsB,CAAC;IAE3B,SAAS,CAAC;QACR,IAAI,CAAC;YACH,kFAAkF;YAClF,2BAA2B;YAC3B,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACrC,MAAM;QACR,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,eAAe,CAAC,GAAG,CAAC;gBAAE,aAAa,GAAG,GAAG,CAAC;iBACzC,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,GAAG,cAAc,CAAC,EAAE,CAAC;YAC/E,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC3B,+EAA+E;YAC/E,IAAI,MAAM,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS;gBAAE,MAAM,aAAa,CAAC;YAE7E,MAAM,IAAI,KAAK,CACb,wDAAwD,QAAQ,aAAa,MAAM,EAAE,KAAK,IAAI,GAAG,OAAO;gBACtG,mEAAmE,CACtE,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;IACjC,IAAI,CAAC;QACH,6DAA6D;QAC7D,SAAS,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QAElC,OAAO,MAAM,EAAE,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/login/session.d.ts

@@ -6,6 +6,11 @@ import type { SecretStore } from "./secretStore.js";
 export interface LoginDeps {
     readonly startListener: (options: LoopbackOptions) => Promise<Listener>;
     readonly openBrowser: (url: string) => boolean;
+    /**
+     * Holds the flow until the user presses Enter; false if input ended instead. Absent,
+     * the browser opens straight away, which is what tests and non-interactive callers get.
+     */
+    readonly waitForEnter?: () => Promise<boolean>;
     /** For the token exchange and workspace listing; injected so tests make no calls. */
     readonly fetchImpl: FetchLike;
     /** Where the refresh token and the minted key are kept; injected so tests use neither. */
@@ -26,7 +31,14 @@ export type LoginOutcome = {
 export interface LoginProgress {
     /** The caller decides which stream this lands on. */
     readonly notify: (message: string) => void;
+    /** Called once the browser has been sent to the sign-in page and the wait begins. */
+    readonly waiting?: () => void;
 }
+/**
+ * The code framed so the eye lands on it: it is the whole defence against another
+ * process asking to sign in, and in running prose it was easy to skim past.
+ */
+export declare function codeBox(code: string): string;
 /**
  * The consent screen's URL.
  *

package/dist/login/session.js

@@ -6,6 +6,15 @@
 import { randomInt } from "node:crypto";
 import { CLIENT_ID, CLIENT_PARAM, CLI_LOGIN_PATH, CODE_PARAM, EXPIRES_PARAM, REDIRECT_PARAM, STATE_PARAM, verificationCode, } from "./contract.js";
 import { LOGIN_TIMEOUT_MS } from "./loopback.js";
+/**
+ * The code framed so the eye lands on it: it is the whole defence against another
+ * process asking to sign in, and in running prose it was easy to skim past.
+ */
+export function codeBox(code) {
+    const inner = ` verification code: ${code} `;
+    const rule = "─".repeat([...inner].length);
+    return `  ╭${rule}╮\n  │${inner}│\n  ╰${rule}╯`;
+}
 /**
  * The consent screen's URL.
  *
@@ -25,7 +34,18 @@ export function loginUrl(urls, callbackUrl, state, code, expiresAtSeconds) {
 }
 export async function runLogin(urls, deps, io) {
     const code = verificationCode((max) => randomInt(max));
-    // Stamped early, so the page gives up a moment before the listener, not after.
+    /* The code comes first and the browser only on Enter, so it is read before the browser
+     * takes focus. The listener starts after that too: its clock must not run while the
+     * user is still reading. */
+    io.notify(`Sign in to AI21 to continue.\n\n${codeBox(code)}\n\n` +
+        `The sign-in page will show this code. If it shows anything else, choose Deny —\n` +
+        `something other than this terminal is asking to sign in.`);
+    if (deps.waitForEnter !== undefined) {
+        io.notify(`\nPress Enter to open ${new URL(urls.app).host} in your browser…`);
+        if (!(await deps.waitForEnter()))
+            return { kind: "declined", reason: "it was cancelled in the terminal" };
+    }
+    // Stamped here, so the page gives up a moment before the listener, not after.
     const expiresAtSeconds = Math.floor((Date.now() + LOGIN_TIMEOUT_MS) / 1000);
     let listener;
     try {
@@ -40,10 +60,8 @@ export async function runLogin(urls, deps, io) {
     /* Printed as well as opened: `openBrowser` cannot tell us a browser appeared, and over
      * SSH the URL is the only way in. */
     deps.openBrowser(listener.signInUrl);
-    io.notify(`Sign in to continue — your browser should open. If it does not, visit:\n\n  ${listener.signInUrl}\n\n` +
-        `  verification code: ${code}\n\n` +
-        `The page will show this code. If it shows anything else, choose Deny — something\n` +
-        `other than this terminal is asking to sign in.\n\nWaiting…`);
+    io.notify(`\nIf the browser did not open, visit:\n\n  ${listener.signInUrl}`);
+    io.waiting?.();
     return settle(await listener.result);
 }
 function settle(outcome) {

package/dist/login/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/login/session.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EAEd,UAAU,EACV,aAAa,EACb,cAAc,EACd,WAAW,EACX,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAA6D,MAAM,eAAe,CAAC;AAuB5G;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CACtB,IAAkB,EAClB,WAAmB,EACnB,KAAa,EACb,IAAY,EACZ,gBAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACvC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9D,gDAAgD;IAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAE9C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAkB,EAAE,IAAe,EAAE,EAAiB;IACnF,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,+EAA+E;IAC/E,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC,GAAG,IAAI,CAAC,CAAC;IAE5E,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;YAClC,aAAa,EAAE,IAAI,CAAC,GAAG;YACvB,SAAS,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC;SAC9F,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,yCAAyC,EAAE,CAAC;IACpH,CAAC;IAED;yCACqC;IACrC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACrC,EAAE,CAAC,MAAM,CACP,+EAA+E,QAAQ,CAAC,SAAS,MAAM;QACrG,wBAAwB,IAAI,MAAM;QAClC,oFAAoF;QACpF,4DAA4D,CAC/D,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,MAAM,CAAC,OAAwB;IACtC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACpD,KAAK,UAAU;YACb,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;gBACxC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE;gBACtD,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;IACvE,CAAC;AACH,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/login/session.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EAEd,UAAU,EACV,aAAa,EACb,cAAc,EACd,WAAW,EACX,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAA6D,MAAM,eAAe,CAAC;AA8B5G;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,KAAK,GAAG,uBAAuB,IAAI,GAAG,CAAC;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;IAE3C,OAAO,MAAM,IAAI,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CACtB,IAAkB,EAClB,WAAmB,EACnB,KAAa,EACb,IAAY,EACZ,gBAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACvC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9D,gDAAgD;IAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAE9C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAkB,EAAE,IAAe,EAAE,EAAiB;IACnF,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAEvD;;gCAE4B;IAC5B,EAAE,CAAC,MAAM,CACP,mCAAmC,OAAO,CAAC,IAAI,CAAC,MAAM;QACpD,kFAAkF;QAClF,0DAA0D,CAC7D,CAAC;IACF,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpC,EAAE,CAAC,MAAM,CAAC,yBAAyB,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC;QAC9E,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IAC5G,CAAC;IAED,8EAA8E;IAC9E,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC,GAAG,IAAI,CAAC,CAAC;IAE5E,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;YAClC,aAAa,EAAE,IAAI,CAAC,GAAG;YACvB,SAAS,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC;SAC9F,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,yCAAyC,EAAE,CAAC;IACpH,CAAC;IAED;yCACqC;IACrC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACrC,EAAE,CAAC,MAAM,CAAC,8CAA8C,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9E,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;IAEf,OAAO,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,MAAM,CAAC,OAAwB;IACtC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACpD,KAAK,UAAU;YACb,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;gBACxC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE;gBACtD,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;IACvE,CAAC;AACH,CAAC"}

package/dist/precheck.d.ts

@@ -30,6 +30,7 @@ export type PrecheckOutcome = {
 } | {
     readonly kind: "rejected";
     readonly reason: string;
+    readonly status: number;
 } | {
     readonly kind: "unknown-agent";
     readonly known: readonly string[];

package/dist/precheck.js

@@ -67,7 +67,7 @@ export async function precheckKey(ctx, deps) {
     }
     if (!response.ok) {
         return REJECTION_STATUSES.has(response.status)
-            ? { kind: "rejected", reason: "the gateway rejected it" }
+            ? { kind: "rejected", reason: "the gateway rejected it", status: response.status }
             : { kind: "inconclusive", reason: `the gateway answered ${response.status}` };
     }
     const ids = agentIdsIn((await response.text?.()) ?? "");

package/dist/precheck.js.map

@@ -1 +1 @@
-{"version":3,"file":"precheck.js","sourceRoot":"","sources":["../src/precheck.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAwBH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAU1C,+FAA+F;AAC/F,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAEpD,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,OAAO,CAAC;AAC5G,CAAC;AAED,qEAAqE;AACrE,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE5C,OAAO,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAE7C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAElE,iEAAiE;QACjE,MAAM,EAAE,GAAI,KAAiC,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAE7C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAoB,EAAE,IAAkB;IACxE,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IACzG,CAAC;IAED,IAAI,QAAuE,CAAC;IAC5E,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE;YAC7C,MAAM,EAAE,KAAK;YACb,uFAAuF;YACvF,OAAO,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,EAAE;YACrC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;SACjD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC;gBAClB,CAAC,CAAC,qCAAqC,mBAAmB,GAAG,IAAI,GAAG;gBACpE,CAAC,CAAC,kCAAkC;SACvC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,yBAAyB,EAAE;YACzD,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,wBAAwB,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IACpF,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAClG,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO,GAAG,YAAY,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;AAC5F,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB;IAC9B,OAAO,EAAE,SAAS,EAAE,KAA6B,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"precheck.js","sourceRoot":"","sources":["../src/precheck.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAwBH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAU1C,+FAA+F;AAC/F,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAEpD,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,OAAO,CAAC;AAC5G,CAAC;AAED,qEAAqE;AACrE,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE5C,OAAO,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAE7C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAElE,iEAAiE;QACjE,MAAM,EAAE,GAAI,KAAiC,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAE7C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAoB,EAAE,IAAkB;IACxE,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IACzG,CAAC;IAED,IAAI,QAAuE,CAAC;IAC5E,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE;YAC7C,MAAM,EAAE,KAAK;YACb,uFAAuF;YACvF,OAAO,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,EAAE;YACrC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;SACjD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC;gBAClB,CAAC,CAAC,qCAAqC,mBAAmB,GAAG,IAAI,GAAG;gBACpE,CAAC,CAAC,kCAAkC;SACvC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;YAClF,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,wBAAwB,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IACpF,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAClG,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO,GAAG,YAAY,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;AAC5F,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB;IAC9B,OAAO,EAAE,SAAS,EAAE,KAA6B,EAAE,CAAC;AACtD,CAAC"}

package/dist/prompt.d.ts

@@ -1,10 +1,3 @@
-/**
- * The terminal the CLI was run from.
- *
- * All that is left of the key prompt: pasting a key is error-prone, so the only ways in
- * are `--key` and signing in through the browser. What survives is the tty check, which
- * decides whether a sign-in can be offered at all.
- */
 import type { Readable, Writable } from "node:stream";
 export interface PromptIo {
     readonly input: Readable & {
@@ -15,3 +8,8 @@ export interface PromptIo {
     /** Overrides the stream's own flag; tests drive a pipe as though it were a tty. */
     readonly isTTY?: boolean;
 }
+/**
+ * Resolves true on the next Enter, false if the input ends first (Ctrl-D, a closed pipe).
+ * The interface is closed either way, so stdin does not keep the process alive.
+ */
+export declare function waitForEnter(input: Readable): Promise<boolean>;

package/dist/prompt.js

@@ -1,2 +1,24 @@
-export {};
+/**
+ * The terminal the CLI was run from.
+ *
+ * All that is left of the key prompt: pasting a key is error-prone, so the only ways in
+ * are `--key` and signing in through the browser. What survives is the tty check, which
+ * decides whether a sign-in can be offered at all, and the Enter that opens the browser.
+ */
+import { createInterface } from "node:readline";
+/**
+ * Resolves true on the next Enter, false if the input ends first (Ctrl-D, a closed pipe).
+ * The interface is closed either way, so stdin does not keep the process alive.
+ */
+export function waitForEnter(input) {
+    return new Promise((resolve) => {
+        const rl = createInterface({ input });
+        let answered = false;
+        rl.once("line", () => {
+            answered = true;
+            rl.close();
+        });
+        rl.once("close", () => resolve(answered));
+    });
+}
 //# sourceMappingURL=prompt.js.map

package/dist/prompt.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../src/prompt.ts"],"names":[],"mappings":""}
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../src/prompt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAUhD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAe;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACtC,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACnB,QAAQ,GAAG,IAAI,CAAC;YAChB,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/report.d.ts

@@ -80,3 +80,7 @@ export interface NoCredentialInput {
  * gateway can never answer, so a config left in place only breaks Claude Code.
  */
 export declare function reportNoClaudeCredential(input: NoCredentialInput): RunResult;
+/** `login`'s success: who is signed in, and the workspace any key was minted in. */
+export declare function reportSignedIn(email: string, workspace: string, streams?: ColorTargets): RunResult;
+/** Refused before anything else runs: without `claude` there is nothing to configure. */
+export declare function reportNoClaudeCli(json: boolean, streams?: ColorTargets): RunResult;

package/dist/report.js

@@ -57,6 +57,17 @@ function painterFor(target) {
         return PLAIN;
     return (format, text) => styleText(format, text, { validateStream: false });
 }
+const MARK = { green: "✔", red: "✖", yellow: "⚠" };
+/**
+ * A result line in its tone, led by a symbol so pass and fail read apart at a glance.
+ * The symbol rides with colour: plain output stays byte-identical, which is the
+ * contract every existing output assertion and log scraper relies on.
+ */
+function headline(paint, tone, text) {
+    if (paint === PLAIN)
+        return text;
+    return `${paint(tone, MARK[tone])} ${paint(tone, text)}`;
+}
 /**
  * The sentence a refusal exists to deliver: it answers the only question a refusal
  * raises — what happened to my file? — so it is painted like a `warning:` label
@@ -70,19 +81,20 @@ const NOTHING_WRITTEN = "Nothing was written.";
 export function nothingWasWritten(streams = PROCESS_STREAMS) {
     return painterFor(streams.err)("yellow", NOTHING_WRITTEN);
 }
-function revertLine(outcome) {
+function revertLine(outcome, paint) {
+    const path = paint("bold", outcome.path);
     switch (outcome.kind) {
         case "reverted": {
             const parts = [
                 outcome.restored.length > 0 ? `restored ${outcome.restored.join(", ")} to previous values` : undefined,
                 outcome.removed.length > 0 ? `removed ${outcome.removed.join(", ")}` : undefined,
             ].filter((part) => part !== undefined);
-            return `Reverted ${outcome.path} — ${parts.join("; ")}`;
+            return `Reverted ${path} — ${parts.join("; ")}`;
         }
         case "restored":
-            return `Restored ${outcome.path} from ${outcome.backup}`;
+            return `Restored ${path} from ${outcome.backup}`;
         case "not-configured":
-            return `Nothing to revert — ${outcome.path} does not carry this tool's settings.`;
+            return `Nothing to revert — ${path} does not carry this tool's settings.`;
         case "agent-mismatch":
             return `${outcome.path} is configured for agent '${outcome.actual}', not '${outcome.expected}'.`;
         case "drifted":
@@ -129,9 +141,9 @@ export function reportRevert(outcome, json, streams = PROCESS_STREAMS) {
     const ok = code === EXIT.OK;
     // Colour tracks the exit code, with one exception: `not-configured` is a state,
     // not a refusal, and painting "nothing to revert" red reads like a crash.
-    const format = outcome.kind === "not-configured" ? "yellow" : ok ? "green" : "red";
+    const tone = outcome.kind === "not-configured" ? "yellow" : ok ? "green" : "red";
     const paint = painterFor(ok ? streams.out : streams.err);
-    const body = `${paint(format, revertLine(outcome))}\n${revertDetail(outcome, paint)}`;
+    const body = `${headline(paint, tone, revertLine(outcome, paint))}\n${revertDetail(outcome, paint)}`;
     return ok ? { code, out: body, err: "" } : { code, out: "", err: body };
 }
 /**
@@ -176,14 +188,15 @@ export function collectWarnings(ctx) {
     return warnings;
 }
 /** Human-readable line for a config outcome. Never includes the key. */
-function humanLine(outcome) {
+function humanLine(outcome, paint) {
+    const path = paint("bold", outcome.path);
     switch (outcome.kind) {
         case "created":
-            return `Wrote ${outcome.path}`;
+            return `Wrote ${path}`;
         case "updated":
-            return `Updated ${outcome.path} (${outcome.changed.join(", ")})\nBacked up the previous file to ${outcome.backup}`;
+            return `Updated ${path} (${outcome.changed.join(", ")})`;
         case "unchanged":
-            return `Already configured — ${outcome.path} is up to date.`;
+            return `Already configured — ${path} is up to date.`;
         case "conflict":
             return `${outcome.path} already sets values this command would change.`;
         case "malformed":
@@ -228,10 +241,16 @@ function precheckWarning(outcome) {
     };
 }
 /** The stdout line for a successful verification; nothing for any other outcome. */
-function verificationLine(outcome) {
+function verificationLine(outcome, paint) {
     if (outcome?.kind !== "passed")
         return "";
-    return `Verified through the gateway with ${VERIFIED_VIA[outcome.via]}.\n`;
+    return `${headline(paint, "green", `Verified through the gateway with ${VERIFIED_VIA[outcome.via]}.`)}\n`;
+}
+/** An aside under the headline, dimmed so the headline stays the thing read first. */
+function backupLine(outcome, paint) {
+    if (outcome.kind !== "updated")
+        return "";
+    return `${paint("dim", `Backed up the previous file to ${outcome.backup}`)}\n`;
 }
 /**
  * One JSON object with what happened, where, why it exited that way, and any
@@ -290,9 +309,10 @@ export function report(input) {
     const paintWarning = painterFor(streams.err);
     // Only the label is coloured: the message is prose, and a paragraph of yellow is
     // harder to read than the plain one it replaced.
-    const warningText = warnings.map((w) => `${paintWarning("yellow", "warning:")} ${w.message}\n`).join("");
-    const line = paintBody(ok ? "green" : "red", humanLine(input.outcome));
-    const body = `${line}\n${verificationLine(input.verification)}${input.detail ?? ""}`;
+    const warningText = warnings.map((w) => `${headline(paintWarning, "yellow", "warning:")} ${w.message}\n`).join("");
+    const line = headline(paintBody, ok ? "green" : "red", humanLine(input.outcome, paintBody));
+    const body = `${line}\n${backupLine(input.outcome, paintBody)}` +
+        `${verificationLine(input.verification, paintBody)}${input.detail ?? ""}`;
     return ok ? { code, out: body, err: warningText } : { code, out: "", err: `${body}${warningText}` };
 }
 /** Stable `--json` reasons, spelled for a funnel rather than for a person. */
@@ -340,11 +360,33 @@ export function reportNoClaudeCredential(input) {
         return { code, out: `${JSON.stringify(payload, null, 2)}\n`, err: "" };
     }
     const streams = input.streams ?? PROCESS_STREAMS;
-    const headline = painterFor(streams.err)("red", NO_CREDENTIAL_HEADLINE[input.reason]);
+    const title = headline(painterFor(streams.err), "red", NO_CREDENTIAL_HEADLINE[input.reason]);
     return {
         code,
         out: "",
-        err: `${headline} ${NO_CREDENTIAL_NEXT_STEP[input.reason]}\n${noCredentialStateLine(input, streams)}\n`,
+        err: `${title} ${NO_CREDENTIAL_NEXT_STEP[input.reason]}\n${noCredentialStateLine(input, streams)}\n`,
+    };
+}
+/** `login`'s success: who is signed in, and the workspace any key was minted in. */
+export function reportSignedIn(email, workspace, streams = PROCESS_STREAMS) {
+    const paint = painterFor(streams.out);
+    return {
+        code: EXIT.OK,
+        out: `${headline(paint, "green", `Signed in as ${paint("bold", email)}.`)}\n  workspace: ${paint("bold", workspace)}\n`,
+        err: "",
     };
 }
+/** Stable `--json` reason; kept apart from `no_claude_subscription` so a funnel can split them. */
+const NO_CLAUDE_CLI_REASON = "claude_code_cli_not_installed";
+const NO_CLAUDE_CLI_MESSAGE = "The Claude Code CLI was not found. The AI21 gateway currently supports only the Claude Code CLI; install it to use the gateway, then re-run this command.";
+/** Refused before anything else runs: without `claude` there is nothing to configure. */
+export function reportNoClaudeCli(json, streams = PROCESS_STREAMS) {
+    const code = EXIT.NO_CLAUDE_CLI;
+    if (json) {
+        const payload = { ok: false, outcome: "no-claude-cli", exitCode: code, reason: NO_CLAUDE_CLI_REASON, warnings: [] };
+        return { code, out: `${JSON.stringify(payload, null, 2)}\n`, err: "" };
+    }
+    const headline = painterFor(streams.err)("red", NO_CLAUDE_CLI_MESSAGE);
+    return { code, out: "", err: `${headline}\n${nothingWasWritten(streams)}\n` };
+}
 //# sourceMappingURL=report.js.map