@catalyst-cloud/cli 0.14.1 → 0.14.2

package/dist/onboard.js

@@ -2,9 +2,8 @@ import { randomBytes, randomUUID } from "node:crypto";
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { createReadStream, createWriteStream } from "node:fs";
 import { createInterface } from "node:readline/promises";
-import { spawnSync } from "node:child_process";
 import { dirname, isAbsolute, join } from "node:path";
-import { parseMachinePaths, resolveCatalystPath, } from "../vendor/paths/index.js";
+import { parseMachinePaths, resolveCatalystPath } from "../vendor/paths/index.js";
 import { machinePathsFile } from "../vendor/paths/node.js";
 import { CliError, UsageError } from "./errors.js";
 export const ONBOARD_STEPS = [
@@ -19,6 +18,7 @@ export const ONBOARD_STEPS = [
     "linear.adopt",
     "linear.automations",
     "github.install",
+    "github.personal",
     "github.repos",
     "projects",
     "accounts",
@@ -41,15 +41,21 @@ export function onboardStateRoot(home, env = {}) {
             throw new CliError("bootstrap state directory must be absolute", "onboard-state-path", EXIT_REFUSED);
         return bootstrap;
     }
-    const pathsFile = machinePathsFile({ env: { ...env, HOME: home } });
-    const machine = pathsFile && existsSync(pathsFile)
-        ? parseMachinePaths(JSON.parse(readFileSync(pathsFile, "utf8")))
-        : undefined;
-    if (env.CATALYST_PATHS_FILE && !machine)
-        throw new CliError("the selected machine paths file is missing", "onboard-state-path", EXIT_REFUSED);
-    if (env.CATALYST_STATE_DIR !== undefined || machine)
-        return resolveCatalystPath("state", { env, machine });
-    return join(env.XDG_STATE_HOME ?? join(home, ".local", "state"), "catalyst");
+    try {
+        const pathsFile = machinePathsFile({ env: { ...env, HOME: home } });
+        const machine = pathsFile && existsSync(pathsFile)
+            ? parseMachinePaths(JSON.parse(readFileSync(pathsFile, "utf8"))) : undefined;
+        if (env.CATALYST_PATHS_FILE && !machine)
+            throw new CliError("the selected machine paths file is missing", "onboard-state-path", EXIT_REFUSED);
+        if (env.CATALYST_STATE_DIR !== undefined || machine)
+            return resolveCatalystPath("state", { env, machine });
+        return join(env.XDG_STATE_HOME ?? join(home, ".local", "state"), "catalyst");
+    }
+    catch (error) {
+        if (error instanceof CliError)
+            throw error;
+        throw new CliError("the selected setup paths are invalid; keep the file and correct it before resuming", "onboard-state-path", EXIT_REFUSED);
+    }
 }
 export function onboardStatePath(home, env = {}) {
     return join(onboardStateRoot(home, env), "install", "last-run.json");
@@ -58,63 +64,29 @@ export function onboardLockPath(home, env = {}) {
     return join(onboardStateRoot(home, env), "install.lock");
 }
 export const ONBOARD_DEPENDENCIES = {
-    "linear.workspace": ["signin"],
-    "linear.personal": ["signin", "linear.workspace"],
+    "linear.workspace": ["signin"], "linear.personal": ["signin", "linear.workspace"],
     "linear.team": ["signin", "linear.workspace", "linear.personal"],
-    "linear.adopt": ["linear.team"],
-    "linear.automations": ["linear.team", "linear.personal"],
-    "github.install": ["signin"],
-    "github.repos": ["github.install"],
-    projects: ["linear.team", "github.repos"],
-    accounts: ["signin"],
-    settings: ["projects"],
-    values: ["settings"],
-    capacity: ["projects"],
-    daemon: ["signin"],
-    "first-ticket": [
-        "projects",
-        "accounts",
-        "settings",
-        "values",
-        "capacity",
-        "daemon",
-    ],
+    "linear.adopt": ["linear.team"], "linear.automations": ["linear.team", "linear.personal"],
+    "github.install": ["signin"], "github.personal": ["signin"], "github.repos": ["github.install", "linear.team"],
+    projects: ["linear.team", "github.repos"], accounts: ["signin"], settings: ["projects"],
+    values: ["settings"], capacity: ["projects"], daemon: ["signin"],
+    "first-ticket": ["projects", "linear.adopt", "linear.automations", "accounts", "settings", "values", "capacity", "daemon"],
 };
 const ADMIN_STEPS = new Set([
-    "linear.workspace",
-    "linear.team",
-    "linear.adopt",
-    "linear.automations",
-    "github.install",
-    "github.repos",
-    "projects",
-    "settings",
-    "values",
-    "capacity",
-    "first-ticket",
+    "linear.workspace", "linear.adopt", "linear.automations", "github.install",
+    "github.repos", "projects", "settings", "values", "capacity", "first-ticket",
 ]);
 export const ONBOARD_TITLES = {
-    machine: "Check this computer",
-    cli: "Check the catalyst command",
-    skills: "Check the Catalyst skills",
-    legacy: "Remove earlier Catalyst installs",
-    signin: "Sign in to Catalyst",
-    "linear.workspace": "Connect your Linear workspace",
-    "linear.personal": "Connect your Linear account",
-    "linear.team": "Choose a Linear team",
-    "linear.adopt": "Apply the Catalyst workflow",
-    "linear.automations": "Check Linear's pull request automations",
-    "github.install": "Install Catalyst on GitHub",
-    "github.repos": "Choose repositories",
-    projects: "Register your projects",
-    accounts: "Check coding accounts",
-    settings: "Review repository settings",
-    values: "Import selected local values",
-    capacity: "Check runner capacity",
-    daemon: "Start background sync",
-    housekeeping: "Schedule the daily update",
-    "first-ticket": "Start a first ticket",
-    ready: "Check onboarding readiness",
+    machine: "Check this computer", cli: "Check the catalyst command", skills: "Check the Catalyst skills",
+    legacy: "Remove earlier Catalyst installs", signin: "Sign in to Catalyst",
+    "linear.workspace": "Connect your Linear workspace", "linear.personal": "Connect your Linear account",
+    "linear.team": "Choose a Linear team", "linear.adopt": "Apply the Catalyst workflow",
+    "linear.automations": "Check Linear's pull request automations", "github.install": "Install Catalyst on GitHub",
+    "github.personal": "Connect your GitHub account",
+    "github.repos": "Choose repositories", projects: "Register your projects", accounts: "Check coding accounts",
+    settings: "Review repository settings", values: "Import selected local values", capacity: "Check runner capacity",
+    daemon: "Check optional local sync", housekeeping: "Schedule the daily update",
+    "first-ticket": "Start a first ticket", ready: "Check onboarding readiness",
 };
 function isoNow(ctx, deps) {
     return (deps.now ?? ctx.now)().toISOString();
@@ -123,13 +95,16 @@ function safeRead(path) {
     try {
         if (lstatSync(path).isSymbolicLink())
             throw new CliError(`the saved setup record at ${path} cannot be a symbolic link`, "onboard-state-symlink", EXIT_REFUSED);
-        return JSON.parse(readFileSync(path, "utf8"));
+        const value = JSON.parse(readFileSync(path, "utf8"));
+        if (value === null)
+            throw new CliError("the saved setup record has an unknown shape; keep it and move it aside before trying again", "onboard-state-shape", EXIT_REFUSED);
+        return value;
     }
     catch (err) {
         if (err instanceof CliError)
             throw err;
         if (object(err)?.code === "ENOENT")
-            return undefined;
+            return null;
         throw new CliError(`the saved setup record at ${path} is not valid JSON; keep it and move it aside before trying again`, "onboard-state-corrupt", EXIT_REFUSED);
     }
 }
@@ -197,33 +172,10 @@ function normalizeStep(value, fallbackAt) {
         "found",
         "remaining",
         "count",
-        "version",
-        "account",
-        "membershipId",
-        "checkedAt",
-        "project",
-        "repository",
-        "ticket",
-        "cursor",
-        "lag",
-        "heartbeatAgeMs",
-        "supervised",
-        "streaming",
-        "scheduled",
-        "validated",
-        "available",
-        "phaseStarted",
-        "linearComment",
-        "fleetActivity",
-        "requiredValues",
-        "paused",
-        "revision",
-        "hash",
-        "path",
-        "provider",
-        "scope",
-        "checks",
-        "passed",
+        "version", "account", "membershipId", "checkedAt", "project", "repository", "ticket",
+        "cursor", "lag", "heartbeatAgeMs", "supervised", "streaming", "scheduled", "validated",
+        "available", "phaseStarted", "linearComment", "fleetActivity", "requiredValues", "paused",
+        "revision", "hash", "path", "provider", "scope", "checks", "passed", "team", "teamKey",
     ]) {
         const item = evidence?.[key];
         if (item === null ||
@@ -237,9 +189,9 @@ function normalizeStep(value, fallbackAt) {
     return step;
 }
 /** Reads both the M1 journal and the 0.13.4 install-script receipt without discarding completed steps. */
-export function readOnboardJournal(path, cliVersion = "0.14.0", now = new Date()) {
+export function readOnboardJournal(path, cliVersion = "0.13.1", now = new Date()) {
     const raw = safeRead(path);
-    if (raw === undefined)
+    if (raw === null)
         return null;
     const value = object(raw);
     if (!value || !Array.isArray(value.steps))
@@ -274,22 +226,13 @@ export function readOnboardJournal(path, cliVersion = "0.14.0", now = new Date()
             : exit,
         steps: [...deduped.values()],
         ...(typeof value.account === "string" ? { account: value.account } : {}),
-        ...(typeof value.membershipId === "string"
-            ? { membershipId: value.membershipId }
-            : {}),
+        ...(typeof value.membershipId === "string" ? { membershipId: value.membershipId } : {}),
         ...(typeof value.baseUrl === "string" ? { baseUrl: value.baseUrl } : {}),
-        ...(value.scope === "step" || value.scope === "onboarding"
-            ? { scope: value.scope }
-            : {}),
-        ...(value.mode === "plan" || value.mode === "run"
-            ? { mode: value.mode }
-            : {}),
-        ...(typeof value.complete === "boolean"
-            ? { complete: value.complete }
-            : {}),
-        operations: Object.fromEntries(Object.entries(object(value.operations) ?? {}).filter(([key, v]) => ONBOARD_STEPS.includes(key) &&
-            typeof v === "string" &&
-            /^[a-zA-Z0-9_.:-]{1,160}$/.test(v))),
+        ...(value.scope === "step" || value.scope === "onboarding" ? { scope: value.scope } : {}),
+        ...(value.mode === "plan" || value.mode === "run" ? { mode: value.mode } : {}),
+        ...(typeof value.complete === "boolean" ? { complete: value.complete } : {}),
+        ...(typeof value.localSync === "boolean" ? { localSync: value.localSync } : {}),
+        operations: Object.fromEntries(Object.entries(object(value.operations) ?? {}).filter(([key, v]) => ONBOARD_STEPS.includes(key) && typeof v === "string" && /^[a-zA-Z0-9_.:-]{1,160}$/.test(v))),
         changes: Array.isArray(value.changes)
             ? value.changes.flatMap((change) => {
                 const row = object(change);
@@ -335,20 +278,11 @@ export function writeOnboardJournal(path, journal) {
 function defaultAlive(pid) {
     try {
         process.kill(pid, 0);
+        return true;
     }
-    catch (err) {
-        return object(err)?.code !== "ESRCH";
+    catch (error) {
+        return object(error)?.code !== "ESRCH";
     }
-    if (pid === process.pid)
-        return true;
-    const probe = spawnSync("ps", ["-p", String(pid), "-o", "args="], {
-        encoding: "utf8",
-        timeout: 2_000,
-    });
-    if (probe.status !== 0)
-        return true;
-    const command = probe.stdout.trim();
-    return command.includes("catalyst") && command.includes("onboard");
 }
 function readLockOwner(path) {
     try {
@@ -375,12 +309,14 @@ function removeStaleLock(lockPath, owner) {
         if (!before.isDirectory() || before.isSymbolicLink())
             return false;
         const current = readLockOwner(lockPath);
-        if (current?.pid !== owner.pid || current?.token !== owner.token)
+        if ((current?.pid ?? null) !== (owner?.pid ?? null) ||
+            (current?.token ?? "") !== (owner?.token ?? ""))
             return false;
-        const stalePath = `${lockPath}.stale-${owner.pid}-${randomBytes(4).toString("hex")}`;
+        const stalePath = `${lockPath}.stale-${owner?.pid ?? "unknown"}-${randomBytes(4).toString("hex")}`;
         renameSync(lockPath, stalePath);
         const moved = readLockOwner(stalePath);
-        if (moved?.pid !== owner.pid || moved?.token !== owner.token) {
+        if ((moved?.pid ?? null) !== (owner?.pid ?? null) ||
+            (moved?.token ?? "") !== (owner?.token ?? "")) {
             try {
                 renameSync(stalePath, lockPath);
             }
@@ -448,11 +384,7 @@ function acquireLock(ctx, deps) {
     const handoff = ctx.env.CATALYST_INSTALL_LOCK_TOKEN;
     if (current?.pid === pid && current.token !== "" && current.token === handoff)
         return { path, owner: current };
-    const ownerIsAlive = current?.pid === pid
-        ? false
-        : current
-            ? (deps.isProcessAlive ?? defaultAlive)(current.pid)
-            : false;
+    const ownerIsAlive = current ? (deps.isProcessAlive ?? defaultAlive)(current.pid) : false;
     if (current && ownerIsAlive)
         throw new CliError(`setup is already running (pid ${current.pid}); wait for it to finish, then run the same command`, "onboard-locked", EXIT_FAILED);
     if (!current)
@@ -487,6 +419,10 @@ function freshJournal(ctx, cliVersion, deps) {
         changes: [],
     };
 }
+/** A refusal before loading state must not reuse or copy an unreadable receipt. */
+export function onboardErrorJournal(ctx, cliVersion, exit) {
+    return { ...freshJournal(ctx, cliVersion, {}), scope: "onboarding", mode: "run", exit, complete: false };
+}
 function planJournal(journal) {
     return {
         ...journal,
@@ -536,18 +472,14 @@ async function confirmContinue(ctx, args, deps) {
     }
 }
 function sanitizedResult(id, result, at) {
-    const row = normalizeStep({
-        id,
-        ...result,
-        state: result.state === "refused" ? "failed" : result.state,
-    }, at);
+    const row = normalizeStep({ id, ...result, state: result.state === "refused" ? "failed" : result.state }, at);
     row.at = at;
     return row;
 }
 function stepSatisfied(step) {
-    return (step?.state === "done" ||
-        (step?.state === "skipped" &&
-            (step.id === "legacy" || step.reason === "member_scope")));
+    return step?.state === "done" || (step?.state === "skipped" &&
+        (step.id === "legacy" || step.reason === "member_scope" ||
+            (step.id === "daemon" && step.reason === "local_sync_not_selected")));
 }
 function requireMatchingIdentity(journal, identity) {
     const account = journal.account ?? journal.tenant;
@@ -563,22 +495,21 @@ function requireMatchingIdentity(journal, identity) {
     }
 }
 /** The receipt records progress; adapters verify the current state before any resumed action. */
-export async function cmdOnboard(args, ctx, deps = {}, cliVersion = "0.14.0") {
+export async function cmdOnboard(args, ctx, deps = {}, cliVersion = "0.13.1") {
     if (args.subcommand !== null || args.rest.length > 0)
         throw new UsageError("onboard takes no positional arguments");
-    const only = typeof args.flags.only === "string"
-        ? args.flags.only
-        : undefined;
-    const resume = typeof args.flags["resume-from"] === "string"
-        ? args.flags["resume-from"]
-        : undefined;
+    if (args.json || args.flags.yes === true || args.flags["dry-run"] === true)
+        deps = { ...deps, ui: undefined };
+    const only = typeof args.flags.only === "string" ? args.flags.only : undefined;
+    const memberScopeSkips = (id) => ADMIN_STEPS.has(id) ||
+        (id === "linear.team" && only !== "linear.team" && typeof args.flags.team !== "string");
+    const resume = typeof args.flags["resume-from"] === "string" ? args.flags["resume-from"] : undefined;
     const resumeFrom = resume === "install" ? "signin" : resume;
     for (const id of [only, resumeFrom])
         if (id && !ONBOARD_STEPS.includes(id))
             throw new UsageError(`unknown onboarding step: ${id}`);
     const statePath = onboardStatePath(ctx.home, ctx.env);
-    let journal = readOnboardJournal(statePath, cliVersion, (deps.now ?? ctx.now)()) ??
-        freshJournal(ctx, cliVersion, deps);
+    let journal = readOnboardJournal(statePath, cliVersion, (deps.now ?? ctx.now)()) ?? freshJournal(ctx, cliVersion, deps);
     if (args.flags["dry-run"] === true) {
         if (args.json)
             ctx.stdout(JSON.stringify(planJournal(journal)));
@@ -590,26 +521,31 @@ export async function cmdOnboard(args, ctx, deps = {}, cliVersion = "0.14.0") {
     let identity = null;
     try {
         if (deps.identity) {
-            identity = await deps.identity();
+            identity = await deps.identity(journal);
             requireMatchingIdentity(journal, identity);
         }
     }
     catch (error) {
-        if (error instanceof CliError) {
-            ctx.stderr(error.message);
-            return error.exitCode;
-        }
-        ctx.stderr("Could not verify your Catalyst membership. Setup was not changed.");
-        return EXIT_FAILED;
+        const code = error instanceof CliError ? error.exitCode : EXIT_FAILED;
+        ctx.stderr("Could not verify your Catalyst membership. Setup was not changed. Sign in with the original account to resume.");
+        if (args.json)
+            ctx.stdout(JSON.stringify({ ...journal, mode: "run", exit: code, complete: false }));
+        return code;
     }
-    if (!args.json)
+    if (deps.ui)
+        deps.ui.plan(journal);
+    else if (!args.json)
         printPlan(ctx, journal);
     const inheritedConsent = resume === "install" && Boolean(ctx.env.CATALYST_INSTALL_LOCK_TOKEN);
-    if (!inheritedConsent && !(await confirmContinue(ctx, args, deps))) {
+    let localSync = args.flags["local-sync"] === true || journal.localSync === true;
+    const consent = inheritedConsent ? true : deps.ui ? await deps.ui.confirmPlan(localSync) : await confirmContinue(ctx, args, deps);
+    if (typeof consent !== "boolean")
+        localSync = consent.localSync;
+    if (!(typeof consent === "boolean" ? consent : consent.proceed)) {
         ctx.stderr("Nothing was changed. Run the same command when ready.");
         if (args.json)
             ctx.stdout(JSON.stringify({ ...journal, complete: false }));
-        return 0;
+        return deps.ui?.signal.aborted ? EXIT_WAITING : 0;
     }
     let lock;
     try {
@@ -624,35 +560,23 @@ export async function cmdOnboard(args, ctx, deps = {}, cliVersion = "0.14.0") {
         return error.exitCode;
     }
     const stop = new AbortController();
-    const signal = deps.signal
-        ? AbortSignal.any([deps.signal, stop.signal])
-        : stop.signal;
-    const stepCtx = {
-        ...ctx,
-        stdout: args.json ? ctx.stderr : ctx.stdout,
+    const signal = AbortSignal.any([stop.signal, ...(deps.signal ? [deps.signal] : []), ...(deps.ui ? [deps.ui.signal] : [])]);
+    const stepCtx = { ...ctx, stdout: deps.ui ? (line) => deps.ui.message(line) : args.json ? ctx.stderr : ctx.stdout,
+        stderr: deps.ui ? (line) => deps.ui.message(line) : ctx.stderr,
         fetch: ((input, init) => ctx.fetch(input, {
-            ...init,
-            signal: init?.signal ? AbortSignal.any([signal, init.signal]) : signal,
-        })),
-    };
+            ...init, signal: init?.signal ? AbortSignal.any([signal, init.signal]) : signal,
+        })) };
     let current = null;
     const interrupted = () => {
         stop.abort();
         if (current)
-            setStep(journal, {
-                id: current,
-                state: "failed",
-                reason: "interrupted",
-                at: isoNow(ctx, deps),
-            });
+            setStep(journal, { id: current, state: "failed", reason: "interrupted", at: isoNow(ctx, deps) });
         journal.exit = EXIT_WAITING;
         journal.complete = false;
         try {
             writeOnboardJournal(statePath, journal);
         }
-        catch {
-            /* keep the last atomic receipt */
-        }
+        catch { /* keep the last atomic receipt */ }
     };
     const signals = ["SIGINT", "SIGTERM", "SIGHUP"];
     if (deps.bindSignals !== false)
@@ -664,26 +588,27 @@ export async function cmdOnboard(args, ctx, deps = {}, cliVersion = "0.14.0") {
         writeOnboardJournal(statePath, journal);
         if (args.json)
             ctx.stdout(JSON.stringify(journal));
+        else if (deps.ui)
+            deps.ui.finish(journal, only);
         else {
             if (journal.complete)
                 ctx.stdout("Onboarding complete.");
             else if (only && code === 0)
                 ctx.stdout(`${ONBOARD_TITLES[only]} finished. Onboarding still has other steps.`);
             else
-                ctx.stdout(`Setup still needs ${journal.steps.filter((step) => !stepSatisfied(step)).length} checks.`);
+                ctx.stdout(`Setup still needs ${journal.steps.filter(step => !stepSatisfied(step)).length} checks.`);
             ctx.stdout("resume: catalyst onboard");
         }
         return code;
     };
     try {
-        journal =
-            readOnboardJournal(statePath, cliVersion, (deps.now ?? ctx.now)()) ??
-                journal;
+        journal = readOnboardJournal(statePath, cliVersion, (deps.now ?? ctx.now)()) ?? journal;
         if (deps.identity)
             requireMatchingIdentity(journal, identity);
         journal.cli = cliVersion;
         journal.scope = only ? "step" : "onboarding";
         journal.mode = "run";
+        journal.localSync = localSync;
         for (const id of ONBOARD_STEPS)
             if (!journalStep(journal, id))
                 setStep(journal, { id, state: "pending" });
@@ -704,119 +629,104 @@ export async function cmdOnboard(args, ctx, deps = {}, cliVersion = "0.14.0") {
             for (const id of ONBOARD_STEPS)
                 needed.add(id);
         const fromIndex = resumeFrom ? ONBOARD_STEPS.indexOf(resumeFrom) : 0;
-        for (const id of ONBOARD_STEPS.filter((id) => needed.has(id))) {
+        for (const id of ONBOARD_STEPS.filter(id => needed.has(id))) {
             if (signal.aborted)
                 return finish(EXIT_WAITING);
             current = id;
+            deps.ui?.stepStart(id);
             // Member onboarding keeps administration outside its scope, with an explicit recorded reason.
-            if (identity?.role === "member" && ADMIN_STEPS.has(id)) {
-                setStep(journal, {
-                    id,
-                    state: "skipped",
-                    reason: "member_scope",
-                    at: isoNow(ctx, deps),
-                });
+            if (identity?.role === "member" && memberScopeSkips(id)) {
+                setStep(journal, { id, state: "skipped", reason: "member_scope", at: isoNow(ctx, deps) });
+                deps.ui?.stepEnd(journalStep(journal, id));
                 continue;
             }
-            const missing = (ONBOARD_DEPENDENCIES[id] ?? []).find((parent) => !stepSatisfied(journalStep(journal, parent)));
+            const missing = (ONBOARD_DEPENDENCIES[id] ?? []).find(parent => !stepSatisfied(journalStep(journal, parent)));
             if (missing) {
-                setStep(journal, {
-                    id,
-                    state: "waiting",
-                    reason: "prerequisite_not_ready",
-                    at: isoNow(ctx, deps),
-                });
+                setStep(journal, { id, state: "waiting", reason: "prerequisite_not_ready", at: isoNow(ctx, deps) });
                 writeOnboardJournal(statePath, journal);
+                deps.ui?.stepEnd(journalStep(journal, id));
                 continue;
             }
             let adapter = deps.adapters?.[id];
             // Compatibility for the initial legacy adapter, which performs its own before/after checks.
             if (!adapter && id === "legacy") {
-                let result = deps.runStep
-                    ? { state: "pending" }
-                    : { state: "skipped", reason: "legacy_not_selected" };
-                adapter = {
-                    check: async () => result,
-                    act: deps.runStep
-                        ? async () => (result = await deps.runStep(id, stepCtx))
-                        : undefined,
-                };
+                let result = deps.runStep ? { state: "pending" } : { state: "skipped", reason: "legacy_not_selected" };
+                adapter = { check: async () => result, act: deps.runStep ? async () => result = await deps.runStep(id, stepCtx) : undefined };
             }
             if (!adapter) {
-                setStep(journal, {
-                    id,
-                    state: "waiting",
-                    reason: "step_not_available_in_this_release",
-                    at: isoNow(ctx, deps),
-                });
+                setStep(journal, { id, state: "waiting", reason: "step_not_available_in_this_release", at: isoNow(ctx, deps) });
                 writeOnboardJournal(statePath, journal);
+                deps.ui?.stepEnd(journalStep(journal, id));
                 continue;
             }
             try {
-                let result = await adapter.check(stepCtx, journal);
-                if (result.state === "pending" &&
-                    adapter.act &&
-                    (!only || id === only) &&
-                    ONBOARD_STEPS.indexOf(id) >= fromIndex) {
+                let result = await adapter.check(stepCtx, journal, signal);
+                if (result.state === "pending" && adapter.act && (!only || id === only) && ONBOARD_STEPS.indexOf(id) >= fromIndex) {
                     if (deps.identity) {
-                        identity = await deps.identity();
+                        identity = await deps.identity(journal);
                         requireMatchingIdentity(journal, identity);
+                        if (identity?.role === "member" && memberScopeSkips(id)) {
+                            setStep(journal, { id, state: "skipped", reason: "member_scope", at: isoNow(ctx, deps) });
+                            writeOnboardJournal(statePath, journal);
+                            deps.ui?.stepEnd(journalStep(journal, id));
+                            continue;
+                        }
                     }
                     journal.operations[id] ??= `${journal.runId}:${id}`;
                     setStep(journal, { id, state: "running", at: isoNow(ctx, deps) });
                     journal.exit = null;
                     writeOnboardJournal(statePath, journal);
-                    const action = await adapter.act(stepCtx, journal);
+                    const action = await adapter.act(stepCtx, journal, signal);
                     if (action.state === "done") {
-                        result = await adapter.check(stepCtx, journal);
+                        result = await adapter.check(stepCtx, journal, signal);
                         if (result.state === "pending")
                             result = { state: "waiting", reason: "verification_pending" };
                     }
                     else
                         result = action;
                     if (id === "signin" && result.state === "done" && deps.identity) {
-                        identity = await deps.identity();
+                        identity = await deps.identity(journal);
                         requireMatchingIdentity(journal, identity);
+                        if (identity?.role === "member" && memberScopeSkips(id)) {
+                            setStep(journal, { id, state: "skipped", reason: "member_scope", at: isoNow(ctx, deps) });
+                            writeOnboardJournal(statePath, journal);
+                            deps.ui?.stepEnd(journalStep(journal, id));
+                            continue;
+                        }
                     }
                 }
+                if (id === "signin" && result.state === "done" && deps.identity) {
+                    identity = await deps.identity(journal);
+                    requireMatchingIdentity(journal, identity);
+                    if (!identity)
+                        result = { state: "failed", reason: "membership_not_verified" };
+                }
                 if (result.state === "refused")
                     refused = true;
                 if (result.state === "pending")
-                    result = {
-                        ...result,
-                        state: "waiting",
-                        reason: result.reason ?? "action_required",
-                    };
+                    result = { ...result, state: "waiting", reason: result.reason ?? "action_required" };
                 setStep(journal, sanitizedResult(id, result, isoNow(ctx, deps)));
             }
             catch (error) {
                 if (error instanceof CliError && error.exitCode === EXIT_REFUSED)
                     refused = true;
-                const reason = error instanceof CliError &&
-                    /^[a-z][a-z0-9_-]{1,63}$/.test(error.code)
-                    ? error.code.replaceAll("-", "_")
-                    : "step_failed";
-                setStep(journal, {
-                    id,
-                    state: "failed",
-                    reason,
-                    at: isoNow(ctx, deps),
-                });
+                const reason = signal.aborted ? "interrupted" : error instanceof CliError && /^[a-z][a-z0-9_-]{1,63}$/.test(error.code) ? error.code.replaceAll("-", "_") : "step_failed";
+                setStep(journal, { id, state: "failed", reason, at: isoNow(ctx, deps) });
                 stepCtx.stderr(`✗ ${ONBOARD_TITLES[id]}: ${reason}. The safe reason is saved; run the same command to resume.`);
             }
+            if (signal.aborted) {
+                setStep(journal, { id, state: "failed", reason: "interrupted", at: isoNow(ctx, deps) });
+                return finish(EXIT_WAITING);
+            }
+            deps.ui?.stepEnd(journalStep(journal, id));
             writeOnboardJournal(statePath, journal);
             if (refused)
                 break;
         }
         current = null;
         const scope = only ? [only] : [...ONBOARD_STEPS];
-        const code = refused
-            ? EXIT_REFUSED
-            : scope.some((id) => journalStep(journal, id)?.state === "failed")
-                ? EXIT_FAILED
-                : scope.every((id) => stepSatisfied(journalStep(journal, id)))
-                    ? 0
-                    : EXIT_WAITING;
+        const code = refused ? EXIT_REFUSED : scope.some(id => journalStep(journal, id)?.state === "failed") ? EXIT_FAILED
+            : scope.every(id => stepSatisfied(journalStep(journal, id))) ? 0 : EXIT_WAITING;
         return finish(code);
     }
     catch (error) {
@@ -832,5 +742,6 @@ export async function cmdOnboard(args, ctx, deps = {}, cliVersion = "0.14.0") {
             for (const name of signals)
                 process.off(name, interrupted);
         releaseLock(lock);
+        deps.ui?.dispose();
     }
 }