@minnovate/shadow-publisher 0.10.2 → 0.11.0

package/dist/claude/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "git-publisher",
   "displayName": "Git Publisher",
-  "version": "0.10.2",
+  "version": "0.11.0",
   "description": "Publish an app folder's Git history to the serverless Git publishing backend and keep it updated (\"publish my app\", \"update my app\", \"fetch the engineered version\").",
   "author": { "name": "git-publisher project" },
   "keywords": ["git", "publish", "deploy", "serverless"]

package/dist/claude/plugin/skills/publish-app/SKILL.md

@@ -10,6 +10,9 @@ You publish the user's app folder with the `publisher` command. All saving, merg
 retry and resume logic lives in it; your job is to run it, read its `--json` output, and tell the
 user what happened in plain language. Never explain S3, packs, commits, sessions or tokens.
 
+**When the user asks for Shadow or the publisher, use it at once.** Do not look at other ways to
+host or share the app first.
+
 **`publisher sync` is how a change is saved and published. Never run `git add`, `git commit`,
 `git push` or `git stash` in the user's app folder**, and never add a git remote. `sync` records the
 folder's changes itself — and leaves out `.env` files, keys, `node_modules` and anything larger than
@@ -25,10 +28,25 @@ Every command accepts `--json` and prints exactly one JSON object on stdout. Exi
 publisher --version
 ```
 
-If the command is not found, install it: `npm install -g @minnovate/shadow-publisher` (it needs
-Node.js 22). In a Claude Cowork task this is normal: the sandbox starts empty every time, so install it
-without asking. On the person's own computer, say in one line that you are installing the
-publisher. If `npm` itself is missing, tell them Node.js 22 must be installed first, and stop.
+If the command is not found, or the version is older than 0.11.0, install it:
+`npm install -g @minnovate/shadow-publisher@latest` (it needs Node.js 22). In a Claude Cowork task
+this is normal: the sandbox starts empty every time, so install it without asking. On the person's
+own computer, say in one line that you are installing the publisher. If `npm` itself is missing,
+tell them Node.js 22 must be installed first, and stop.
+
+### In a sandbox: keep the sign-in where the next command finds it
+
+A sandbox (Claude Cowork, Claude Code on the web, a chat's code tool) can forget every file outside
+its working folder between two commands. A sign-in kept in `/root/.config` is then gone at the
+next command. So in a sandbox, do this from the start:
+
+- Put `GIT_PUBLISHER_CREDENTIALS=<working folder>/.shadow-publisher/credentials.json` in front of
+  **every** `publisher` command. Use the absolute path of the folder the task works in. Never use
+  `/root` or `/tmp`, and never a path inside the app folder.
+- Do nothing about `TMPDIR`. From 0.11.0 the publisher uses `/tmp` when `TMPDIR` names a folder that
+  does not exist, and says so in one line.
+
+On the person's own computer, use neither: the default place is kept.
 
 ```bash
 publisher doctor --json
@@ -49,25 +67,30 @@ publisher doctor --json
 
 ### Signing in
 
-`publisher login` waits until the person has confirmed a code in their browser, and your shell may
-show nothing until a command ends. So never run it in the foreground. Start it in the background with
-its output going to a file, and read the file:
+`publisher login` waits until the code it prints is approved, and your shell may show nothing until
+a command ends. So sign in with two short commands instead of one that waits:
 
 ```bash
-publisher login --json > /tmp/publisher-login.log 2>&1 &
+publisher login --no-wait --json
 ```
 
-Within a few seconds the log shows `To sign in, open:` with a link under it, and `and confirm the
-code:` with the code under it. Give the person both, as a link they can click, and say the page will ask them to sign in with their work account.
-Then read the log every few seconds until it holds a JSON object (`ok: true`), for up to ten minutes.
-In a Claude Cowork task this happens again in every new task, because the sandbox forgets the
-sign-in when the task ends.
+It prints one JSON object with `userCode` and `verificationUri`, and `next.command`. Then:
+
+1. **If a tool named `approve_publisher_sign_in` is available** (the Shadow connector, which the
+   person connected in Claude's settings), call it with `userCode`. Do not give them the link.
+   If the tool answers that it did not approve, do step 2 instead.
+2. Otherwise give the person `verificationUri` as a link they can click, and `userCode`, and say
+   the page will ask them to sign in with their work account.
+3. Run `next.command` — it is `publisher login --continue --json`. It returns `ok: true` within
+   seconds of the approval. If it returns `state: "pending"`, the code is not approved yet: wait
+   for the person, then run it again. It refuses after ten minutes; then start again.
+4. **Check that the sign-in was kept before you publish**: run `publisher doctor --json` as a NEW
+   command. `next.action` must be `"ready"`. If it is not, or a command says the sign-in or the
+   waiting sign-in was not kept (its message names the file it looked for), this environment
+   forgot the file: keep it in another folder, as the section above says, and sign in again.
 
-**If a tool named `approve_publisher_sign_in` is available** (the Shadow publisher connector, which
-the person connected in Claude's settings), do not give them the link: call that tool with the code
-from the log, then keep reading the log as above — it reaches `ok: true` within a few seconds, with
-nothing for the person to do. If the tool answers that it did not approve, give them the link and
-code as above. The tool never returns a credential, and you never need one.
+In a Claude Cowork task this happens again in every new task, because the sandbox forgets the
+sign-in when the task ends. The tool never returns a credential, and you never need one.
 
 **Never ask the user for a token, an endpoint, a URL or a credential — in any words.** They are
 publishing an app; they do not know what those are, and you do not need them: `login` discovers
@@ -96,7 +119,10 @@ publisher sync . --message "<a few words on what changed>" --until-change --time
 ```
 
 That one command records what changed in the folder, brings in anything published meanwhile (a
-fast-forward or a clean merge — it never rewrites the user's work), and publishes the result. Write
+fast-forward or a clean merge — it never rewrites the user's work), and publishes the result. Its
+`timings` say how long each stage took (milliseconds): `discovery`, `authentication`, `link`,
+`prepare`, `upload`, and — once the app is followed — `received`, `checks` and `deployment`. Quote
+them when the person asks why it was slow. Write
 the message in the user's words ("Add a contact page"), not git's.
 
 A published app runs with no internet access: **it may not load anything from other sites** — no

package/dist/publisher.cjs

@@ -28,7 +28,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/main.ts
-var import_node_path8 = require("node:path");
+var import_node_path9 = require("node:path");
 
 // ../protocol/src/versions.ts
 var PROTOCOL_VERSION = 1;
@@ -2957,6 +2957,7 @@ var MAX_WAIT_SECONDS = 5;
 var import_node_child_process = require("node:child_process");
 var import_node_os = require("node:os");
 var import_promises = require("node:fs/promises");
+var import_node_fs = require("node:fs");
 var import_node_path = require("node:path");
 var import_node_util = require("node:util");
 var import_node_child_process2 = require("node:child_process");
@@ -2991,6 +2992,23 @@ var GIT_BIN = process.env["GITPUB_GIT_BIN"] ?? "git";
 function neutralCwd() {
   return (0, import_node_os.tmpdir)();
 }
+function startFailure(label, error2, cwd) {
+  const opts = { retryable: true, cause: error2 };
+  if (error2.code !== "ENOENT") return new PublisherError("UNAVAILABLE", `${label} could not be started: ${error2.message}`, opts);
+  if (!isDirectory(cwd)) {
+    const which = cwd === (0, import_node_os.tmpdir)() ? "the temporary directory (TMPDIR)" : "its working directory";
+    return new PublisherError("UNAVAILABLE", `${label} could not be started: ${which} ${cwd} does not exist`, { ...opts, details: { missing: "cwd", cwd } });
+  }
+  const where = GIT_BIN.includes("/") ? `at ${GIT_BIN}` : "on PATH";
+  return new PublisherError("UNAVAILABLE", `${label} could not be started: git was not found ${where}`, { ...opts, details: { missing: "git", git: GIT_BIN } });
+}
+function isDirectory(path) {
+  try {
+    return (0, import_node_fs.statSync)(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
 var gitStats = { invocations: 0, totalMs: 0 };
 var liveChildren = /* @__PURE__ */ new Set();
 var closedChildren = /* @__PURE__ */ new WeakSet();
@@ -3158,11 +3176,12 @@ function spawnTracked(args, opts) {
     if (typeof a !== "string") throw new Error("git args must be strings");
     if (a.includes("\0")) throw new PublisherError("INVALID_REQUEST", "NUL in git argument");
   }
-  const child = spawnImpl(GIT_BIN, args, { cwd: opts.cwd ?? neutralCwd(), env: sanitizedGitEnv(opts.env), stdio: ["pipe", "pipe", "pipe"], windowsHide: true, detached: true });
+  const cwd = opts.cwd ?? neutralCwd();
+  const child = spawnImpl(GIT_BIN, args, { cwd, env: sanitizedGitEnv(opts.env), stdio: ["pipe", "pipe", "pipe"], windowsHide: true, detached: true });
   gitStats.invocations++;
   const cleanupBoundMs = opts.cleanupBoundMs ?? CLEANUP_BOUND_MS;
   track(child, cleanupBoundMs);
-  return { child, cleanupBoundMs };
+  return { child, cleanupBoundMs, cwd };
 }
 function feedStdin(child, input, onSourceError) {
   let unpipe = () => void 0;
@@ -3211,7 +3230,7 @@ async function runGit(args, opts = {}) {
   const started = Date.now();
   const timeoutMs = opts.timeoutMs ?? 12e4;
   const maxOut = opts.maxStdoutBytes ?? 64 * 1024 * 1024;
-  const { child, cleanupBoundMs } = spawnTracked(args, opts);
+  const { child, cleanupBoundMs, cwd } = spawnTracked(args, opts);
   child.once("exit", () => armCloseBound(child, cleanupBoundMs));
   const stdoutChunks = [];
   let outBytes = 0;
@@ -3261,7 +3280,7 @@ async function runGit(args, opts = {}) {
   const result = { code, stdout: Buffer.concat(stdoutChunks), stderr, durationMs };
   const cleanup = await reapChild(child, { boundMs: cleanupBoundMs, ...opts.groupObserver ? { observer: opts.groupObserver } : {} });
   if (!reapSucceeded(cleanup)) throw cleanupFailure(`git ${args[0]}`, cleanup, killedReason ?? void 0);
-  if (ended.error) throw new PublisherError("UNAVAILABLE", `git ${args[0]} could not be started: ${ended.error.message}`, { retryable: true, cause: ended.error });
+  if (ended.error) throw startFailure(`git ${args[0]}`, ended.error, cwd);
   if (killedReason) throw killedError(killedReason, killedDetail, args, timeoutMs, maxOut);
   if (code !== 0 && !opts.allowFailure) throw new GitCommandError(args, code, stderr, opts.label);
   return result;
@@ -3269,7 +3288,7 @@ async function runGit(args, opts = {}) {
 function startWatchdog(child, opts, kill, isClosed) {
   if (opts.maxMemoryBytes === void 0 && opts.maxDiskBytes === void 0) return { stop: () => void 0, done: Promise.resolve() };
   const sampler = opts.sampler ?? defaultResourceSampler;
-  const interval = Math.max(10, opts.sampleIntervalMs ?? 500);
+  const interval2 = Math.max(10, opts.sampleIntervalMs ?? 500);
   const sampleBoundMs = opts.cleanupBoundMs ?? CLEANUP_BOUND_MS;
   const pgid = child.pid;
   let stopped = false;
@@ -3299,7 +3318,7 @@ function startWatchdog(child, opts, kill, isClosed) {
     }
     let tick = 0;
     while (!stopped) {
-      await sleep2(interval);
+      await sleep2(interval2);
       if (stopped) return;
       if (opts.maxMemoryBytes !== void 0) {
         const rss = await sample("memory", (signal) => sampler.groupRss(pgid, signal));
@@ -3334,8 +3353,8 @@ async function scanProcessGroup(pgid, signal) {
       if (signal?.aborted) throw new Error("process-group scan abandoned by its caller");
       if (!/^\d+$/.test(name)) continue;
       try {
-        const stat3 = await (0, import_promises.readFile)(`/proc/${name}/stat`, "utf8");
-        const rest = stat3.slice(stat3.lastIndexOf(")") + 2).split(" ");
+        const stat4 = await (0, import_promises.readFile)(`/proc/${name}/stat`, "utf8");
+        const rest = stat4.slice(stat4.lastIndexOf(")") + 2).split(" ");
         if (Number(rest[2]) !== pgid) continue;
         const status = await (0, import_promises.readFile)(`/proc/${name}/status`, "utf8");
         members2.push({ pid: Number(name), rss: Number(/^VmRSS:\s+(\d+)/m.exec(status)?.[1] ?? 0) * 1024 });
@@ -3524,13 +3543,13 @@ function compareVersions(a, b) {
 
 // ../git-core/src/hash.ts
 var import_node_crypto2 = require("node:crypto");
-var import_node_fs = require("node:fs");
+var import_node_fs2 = require("node:fs");
 var import_promises2 = require("node:fs/promises");
 async function sha256File(path) {
   const h = (0, import_node_crypto2.createHash)("sha256");
   let size = 0;
   await new Promise((resolve3, reject) => {
-    (0, import_node_fs.createReadStream)(path).on("data", (c) => {
+    (0, import_node_fs2.createReadStream)(path).on("data", (c) => {
       const b = typeof c === "string" ? Buffer.from(c) : c;
       size += b.length;
       h.update(b);
@@ -3542,12 +3561,12 @@ async function sha256File(path) {
 }
 
 // ../git-core/src/bare-repo.ts
-var import_node_fs2 = require("node:fs");
+var import_node_fs3 = require("node:fs");
 async function indexPackFromFile(dir, packPath, opts = {}) {
   const args = ["index-pack", "--stdin", ...opts.keep ?? true ? ["--keep=gitpub"] : []];
   if (opts.strict ?? true) args.push("--strict", "--fsck-objects");
   if (opts.maxInputBytes) args.push(`--max-input-size=${opts.maxInputBytes}`);
-  const run = { cwd: dir, input: (0, import_node_fs2.createReadStream)(packPath), label: "index-pack", ...opts };
+  const run = { cwd: dir, input: (0, import_node_fs3.createReadStream)(packPath), label: "index-pack", ...opts };
   const res = await runGit(args, { ...run, allowFailure: true });
   if (res.code !== 0) {
     const msg = res.stderr.trim().split("\n").pop() ?? "index-pack failed";
@@ -3614,14 +3633,14 @@ function revParse(dir, rev) {
 }
 
 // ../git-core/src/pack.ts
-var import_node_fs3 = require("node:fs");
+var import_node_fs4 = require("node:fs");
 async function buildPack(repoDir, opts) {
   return packObjectsToFile(repoDir, ["--revs"], [...opts.include, ...opts.exclude.map((e) => `^${e}`)], opts);
 }
 async function packObjectsToFile(repoDir, extraArgs, stdinLines, opts) {
   const args = ["pack-objects", ...extraArgs, "--stdout", "-q", "--delta-base-offset"];
   const child = spawnGit(args, { cwd: repoDir, ...opts.cleanupBoundMs !== void 0 ? { cleanupBoundMs: opts.cleanupBoundMs } : {} });
-  const out = (0, import_node_fs3.createWriteStream)(opts.outPath);
+  const out = (0, import_node_fs4.createWriteStream)(opts.outPath);
   let stderr = "";
   child.stderr.on("data", (c) => stderr += c.toString());
   const timeoutMs = opts.timeoutMs ?? 6e5;
@@ -3652,7 +3671,7 @@ async function packObjectsToFile(repoDir, extraArgs, stdinLines, opts) {
       }
     }
     const code = ended.code;
-    if (ended.error) throw new PublisherError("UNAVAILABLE", `git pack-objects could not be started: ${ended.error.message}`, { retryable: true, cause: ended.error });
+    if (ended.error) throw startFailure("git pack-objects", ended.error, repoDir);
     if (opts.signal?.aborted) throw new PublisherError("CANCELLED", "pack creation cancelled");
     if (timedOut) throw new PublisherError("GIT", `pack-objects timed out after ${timeoutMs}ms`, { retryable: true });
     if (code !== 0) throw new PublisherError("GIT", `pack-objects failed: ${stderr.trim().split("\n").pop() ?? ""}`);
@@ -4255,9 +4274,43 @@ async function postForm(base, path, fields, fetchImpl = globalThis.fetch) {
 // ../client/src/credentials.ts
 var REFRESH_EARLY_MS = 6e4;
 function credentialsPath() {
-  if (process.env["GIT_PUBLISHER_CREDENTIALS"]) return process.env["GIT_PUBLISHER_CREDENTIALS"];
-  const base = process.env["XDG_CONFIG_HOME"] ?? (0, import_node_path4.join)((0, import_node_os2.homedir)(), ".config");
-  return (0, import_node_path4.join)(base, "git-publisher", "credentials.json");
+  return credentialsLocation().path;
+}
+function credentialsLocation() {
+  const explicit = process.env["GIT_PUBLISHER_CREDENTIALS"];
+  if (explicit) return { path: explicit, from: "GIT_PUBLISHER_CREDENTIALS" };
+  const xdg = process.env["XDG_CONFIG_HOME"];
+  return { path: (0, import_node_path4.join)(xdg ?? (0, import_node_path4.join)((0, import_node_os2.homedir)(), ".config"), "git-publisher", "credentials.json"), from: xdg ? "XDG_CONFIG_HOME" : "HOME" };
+}
+async function credentialsFileState() {
+  let raw;
+  try {
+    raw = await (0, import_promises5.readFile)(credentialsPath(), "utf8");
+  } catch (e) {
+    return e.code === "ENOENT" ? "absent" : "unreadable";
+  }
+  try {
+    JSON.parse(raw);
+    return "present";
+  } catch {
+    return "unparseable";
+  }
+}
+async function whereCredentialsWere() {
+  const { path, from } = credentialsLocation();
+  const state = await credentialsFileState();
+  const set = from === "HOME" ? "the default under HOME" : `set by ${from}`;
+  const kept = state === "absent" ? ` ${notKept('"publisher login" answered ok', "sign in again")}` : "";
+  return { sentence: `${WHAT_IS_THERE[state]} ${path} (${set}).${kept}`, details: { path, from, state } };
+}
+var WHAT_IS_THERE = {
+  absent: "there is no credentials file at",
+  present: "no connection is saved in",
+  unreadable: "the credentials file cannot be read at",
+  unparseable: "the credentials file cannot be parsed at"
+};
+function notKept(earlier, then) {
+  return `If ${earlier} in an earlier command, this environment did not keep that file: set GIT_PUBLISHER_CREDENTIALS to a file in a folder that is kept between commands, outside the app folder, and ${then}.`;
 }
 function normalize(endpoint) {
   return endpoint.replace(/\/+$/, "");
@@ -4305,11 +4358,13 @@ async function readCredentials() {
 }
 var writes = 0;
 async function writeCredentials(file) {
-  const path = credentialsPath();
+  return writeSecretJson(credentialsPath(), file);
+}
+async function writeSecretJson(path, value) {
   await (0, import_promises5.mkdir)((0, import_node_path4.dirname)(path), { recursive: true, mode: 448 });
   const tmp = `${path}.${process.pid}.${++writes}.tmp`;
   try {
-    await (0, import_promises5.writeFile)(tmp, JSON.stringify(file, null, 2) + "\n", { mode: 384 });
+    await (0, import_promises5.writeFile)(tmp, JSON.stringify(value, null, 2) + "\n", { mode: 384 });
     await (0, import_promises5.chmod)(tmp, 384);
     await (0, import_promises5.rename)(tmp, path);
   } catch (e) {
@@ -4458,7 +4513,12 @@ async function resolveToken(endpoint, explicit, opts = {}) {
   if (given) return given;
   const url2 = normalize(endpoint);
   const entry = (await readCredentials()).endpoints[url2];
-  if (!entry) throw new PublisherError("UNAUTHORIZED", `no credentials for ${endpoint}; run "publisher login" or set GIT_PUBLISHER_TOKEN`, { details: { signIn: "missing" } });
+  if (!entry) {
+    const where = await whereCredentialsWere();
+    throw new PublisherError("UNAUTHORIZED", `no credentials for ${endpoint}: ${where.sentence} Run "publisher login" or set GIT_PUBLISHER_TOKEN.`, {
+      details: { signIn: "missing", credentialsFile: where.details }
+    });
+  }
   const now = (opts.now ?? Date.now)();
   const lapsed = entry.expiresAt !== void 0 && Date.parse(entry.expiresAt) - REFRESH_EARLY_MS <= now;
   if (entry.refreshToken && entry.authEndpoint && lapsed) return refreshCredential(url2, entry, opts);
@@ -4712,7 +4772,7 @@ async function followRun(input, opts) {
   const fetchImpl = opts.fetch ?? fetch;
   const sleep2 = opts.sleep ?? sleep;
   const now = opts.now ?? Date.now;
-  const interval = opts.intervalMs ?? POLL_INTERVAL_MS;
+  const interval2 = opts.intervalMs ?? POLL_INTERVAL_MS;
   const deadline = now() + (opts.timeoutMs ?? FOLLOW_TIMEOUT_MS);
   const query = new URLSearchParams({ publication: input.publicationId, ref: input.ref, commit: input.commit });
   const url2 = `${input.portal.replace(/\/+$/, "")}/api/v1/terminal/repositories/${encodeURIComponent(input.repoId)}/runs?${query}`;
@@ -4758,8 +4818,8 @@ async function followRun(input, opts) {
     } else {
       lastError = answer.status === 0 ? "the portal could not be reached" : `the portal answered ${answer.status}`;
     }
-    if (now() + interval > deadline) return { kind: "timed-out", stages: last, lastError };
-    await sleep2(interval);
+    if (now() + interval2 > deadline) return { kind: "timed-out", stages: last, lastError };
+    await sleep2(interval2);
   }
 }
 function soleRun(body) {
@@ -5104,7 +5164,7 @@ async function checkIgnore(dir, paths) {
 }
 
 // ../client/src/fetch.ts
-var import_node_fs5 = require("node:fs");
+var import_node_fs6 = require("node:fs");
 var import_promises8 = require("node:fs/promises");
 var import_node_os3 = require("node:os");
 var import_node_path6 = require("node:path");
@@ -5116,12 +5176,12 @@ var import_node_crypto4 = require("node:crypto");
 var import_promises7 = require("node:fs/promises");
 
 // ../client/src/upload.ts
-var import_node_fs4 = require("node:fs");
+var import_node_fs5 = require("node:fs");
 var import_node_stream = require("node:stream");
 async function uploadPack(fetchImpl, upload, packPath, size, opts) {
   if (new Date(upload.expiresAt).getTime() < Date.now() + 5e3) return "expired";
   let sent = 0;
-  const file = (0, import_node_fs4.createReadStream)(packPath);
+  const file = (0, import_node_fs5.createReadStream)(packPath);
   const progress = new TransformStream({
     transform(chunk, controller) {
       sent += chunk.byteLength;
@@ -5526,7 +5586,7 @@ async function download(fetchImpl, url2, dest, sha256, size, call2) {
       controller.enqueue(chunk);
     }
   });
-  await (0, import_promises9.pipeline)(import_node_stream2.Readable.fromWeb(res.body.pipeThrough(counted)), (0, import_node_fs5.createWriteStream)(dest));
+  await (0, import_promises9.pipeline)(import_node_stream2.Readable.fromWeb(res.body.pipeThrough(counted)), (0, import_node_fs6.createWriteStream)(dest));
   if (n !== size || hash.digest("hex") !== sha256) throw new PublisherError("NETWORK", "downloaded artifact failed checksum verification", { retryable: true });
   return n;
 }
@@ -5829,10 +5889,8 @@ async function migrateAssociation(opts) {
 var DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 var str = (v) => typeof v === "string" && v.length > 0 ? v : null;
 var num = (v, fallback) => typeof v === "number" && Number.isFinite(v) && v > 0 ? v : fallback;
-async function deviceLogin(opts) {
+async function startDeviceLogin(opts) {
   const doFetch = opts.fetch ?? globalThis.fetch;
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  const now = opts.now ?? Date.now;
   const control = normalize(opts.endpoint);
   let advertised;
   try {
@@ -5843,8 +5901,7 @@ async function deviceLogin(opts) {
   if (typeof advertised !== "string" || advertised === "") throw new PublisherError("UNAVAILABLE", "this deployment does not offer device login; obtain a token another way");
   const base = normalize(advertised);
   assertCredentialEndpoint(base);
-  const post2 = (path, fields) => postForm(base, path, fields, doFetch);
-  const started = await post2("/v1/auth/device", { client_id: opts.clientId ?? "gitpub-cli" });
+  const started = await postForm(base, "/v1/auth/device", { client_id: opts.clientId ?? "gitpub-cli" }, doFetch);
   if (started.status !== 200) throw new PublisherError("UNAVAILABLE", `starting the login failed (${started.status})`, { retryable: true });
   const s = started.body;
   const deviceCode = str(s.device_code);
@@ -5852,17 +5909,33 @@ async function deviceLogin(opts) {
   const uri = str(s.verification_uri_complete) ?? str(s.verification_uri);
   if (!deviceCode || !userCode || !uri) throw new PublisherError("UNAVAILABLE", "the login response was incomplete");
   const expiresInSeconds = num(s.expires_in, 600);
-  let intervalMs = num(s.interval, 5) * 1e3;
-  await opts.onPrompt({ userCode, verificationUri: uri, expiresInSeconds, intervalSeconds: intervalMs / 1e3 });
-  const deadline = now() + expiresInSeconds * 1e3;
+  return {
+    deviceCode,
+    userCode,
+    verificationUri: uri,
+    expiresInSeconds,
+    intervalSeconds: num(s.interval, 5),
+    authEndpoint: base,
+    expiresAt: (opts.now ?? Date.now)() + expiresInSeconds * 1e3
+  };
+}
+async function pollDeviceLogin(started, opts) {
+  const doFetch = opts.fetch ?? globalThis.fetch;
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = opts.now ?? Date.now;
+  let intervalMs = started.intervalSeconds * 1e3;
+  let last = opts.lastPolledAt;
   for (; ; ) {
-    await sleep2(intervalMs);
-    if (now() >= deadline) throw new PublisherError("EXPIRED", "the login expired before it was approved");
-    const polled = await post2("/v1/auth/token", { grant_type: DEVICE_CODE_GRANT, device_code: deviceCode });
+    const at = Math.max(now(), last === null ? 0 : last + intervalMs);
+    if (opts.until !== void 0 && at > opts.until) return null;
+    if (at > now()) await sleep2(at - now());
+    if (now() >= started.expiresAt) throw new PublisherError("EXPIRED", "the login expired before it was approved");
+    const polled = await postForm(started.authEndpoint, "/v1/auth/token", { grant_type: DEVICE_CODE_GRANT, device_code: started.deviceCode }, doFetch);
+    last = now();
     if (polled.status === 200) {
       const token = str(polled.body["access_token"]);
       if (!token) throw new PublisherError("UNAVAILABLE", "the login returned no credential");
-      return { token, refreshToken: str(polled.body["refresh_token"]), expiresInSeconds: num(polled.body["expires_in"], 900), authEndpoint: base };
+      return { token, refreshToken: str(polled.body["refresh_token"]), expiresInSeconds: num(polled.body["expires_in"], 900), authEndpoint: started.authEndpoint };
     }
     const error2 = str(polled.body["error"]);
     if (error2 === "authorization_pending") continue;
@@ -5876,33 +5949,44 @@ async function deviceLogin(opts) {
     throw new PublisherError("UNAVAILABLE", `the login failed (${polled.status}${error2 ? `: ${error2}` : ""})`);
   }
 }
+async function deviceLogin(opts) {
+  const started = await startDeviceLogin(opts);
+  const { deviceCode: _secret, authEndpoint: _auth, expiresAt: _at, ...shown2 } = started;
+  await opts.onPrompt(shown2);
+  const signIn = await pollDeviceLogin(started, { ...opts, lastPolledAt: (opts.now ?? Date.now)() });
+  return signIn;
+}
 
-// src/discover.ts
-var DEFAULT_PORTAL_URL = "https://shadow.minnovate.ai";
-function portalBase(env, flag) {
-  return (flag ?? env["GIT_PUBLISHER_PORTAL"] ?? DEFAULT_PORTAL_URL).replace(/\/+$/, "");
+// ../client/src/pending-login.ts
+var import_promises10 = require("node:fs/promises");
+var import_node_path7 = require("node:path");
+function pendingLoginPath() {
+  return (0, import_node_path7.join)((0, import_node_path7.dirname)(credentialsPath()), "login-pending.json");
 }
-async function discoverEndpoint(portal, fetchImpl = fetch) {
-  const url2 = `${portal}/api/v1/config`;
-  let body;
+async function savePendingLogin(pending) {
+  return writeSecretJson(pendingLoginPath(), { version: 1, ...pending });
+}
+async function readPendingLogin() {
+  let raw;
   try {
-    const response = await fetchImpl(url2);
-    if (!response.ok) {
-      throw new PublisherError("UNAVAILABLE", `could not ask ${portal} where to publish (it answered ${response.status})`, { retryable: true });
-    }
-    body = await response.json();
-  } catch (e) {
-    if (PublisherError.isPublisherError(e)) throw e;
-    throw new PublisherError("NETWORK", `could not reach ${portal}: ${e instanceof Error ? e.message : String(e)}`, { retryable: true });
-  }
-  const endpoint = body?.publishingEndpoint;
-  if (endpoint === null || endpoint === void 0) {
-    throw new PublisherError("LOCAL_STATE", `${portal} is not set up for publishing; ask whoever runs it, or pass --endpoint`);
-  }
-  if (typeof endpoint !== "string" || endpoint.trim() === "") {
-    throw new PublisherError("UNAVAILABLE", `${portal} answered with something this version does not understand`, { retryable: false });
+    raw = JSON.parse(await (0, import_promises10.readFile)(pendingLoginPath(), "utf8"));
+  } catch {
+    return null;
   }
-  return endpoint;
+  if (typeof raw !== "object" || raw === null) return null;
+  const r = raw;
+  const s = r.started;
+  if (r.version !== 1 || typeof r.endpoint !== "string" || !s) return null;
+  if (typeof s.deviceCode !== "string" || typeof s.authEndpoint !== "string" || typeof s.expiresAt !== "number" || typeof s.intervalSeconds !== "number") return null;
+  return {
+    endpoint: r.endpoint,
+    started: s,
+    ...typeof r.profile === "string" ? { profile: r.profile } : {},
+    ...r.setDefault === true ? { setDefault: true } : {}
+  };
+}
+async function removePendingLogin() {
+  await (0, import_promises10.rm)(pendingLoginPath(), { force: true });
 }
 
 // src/git-minimum.ts
@@ -5911,6 +5995,93 @@ function gitSupported(version2) {
   return compareVersions(version2, CLIENT_GIT_MINIMUM) >= 0;
 }
 
+// src/progress.ts
+var SAYS = {
+  received: { doing: "Shadow is picking up your changes", done: "Shadow has your changes", still: "still picking up your changes" },
+  running: { doing: "checking that everything still works", done: "everything still works", still: "still checking" },
+  deploying: { doing: "putting the new version in place; the current one stays up meanwhile", done: "the new version is in place", still: "still putting it in place" },
+  live: { doing: "going live", done: "everyone sees the new version", still: "still going live" }
+};
+var HEARTBEAT_MS = 3e4;
+var SPINNER = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+function took(ms) {
+  const seconds = Math.max(0, Math.floor(ms / 1e3));
+  if (seconds < 60) return `${seconds} s`;
+  const minutes = Math.floor(seconds / 60);
+  return minutes >= 10 ? `${minutes} min` : `${minutes} min ${String(seconds % 60).padStart(2, "0")} s`;
+}
+function interval(fn, ms) {
+  const timer = setInterval(fn, ms);
+  timer.unref();
+  return { stop: () => clearInterval(timer) };
+}
+function settledLine(e, total) {
+  const word = e.word.padEnd(10);
+  switch (e.state) {
+    case "done":
+      return `  \u2713 ${word} ${SAYS[e.stage].done}${total}
+`;
+    case "failed":
+      return `  \u2717 ${word} it stopped here
+`;
+    case "skipped":
+      return `  \u2013 ${word} skipped
+`;
+    default:
+      return null;
+  }
+}
+function stageReporter(io) {
+  const now = io.now ?? Date.now;
+  const every = io.every ?? interval;
+  let ticking = null;
+  let drawn = false;
+  let receivedAt = null;
+  const clear = () => {
+    if (drawn) io.write("\r\x1B[2K");
+    drawn = false;
+  };
+  const stopTicking = () => {
+    ticking?.timer.stop();
+    ticking = null;
+    clear();
+  };
+  const since = (e) => {
+    const at = e.at === null ? NaN : Date.parse(e.at);
+    return Number.isFinite(at) ? Math.min(at, now()) : now();
+  };
+  return {
+    onStage(e) {
+      if (e.state === "in-progress" || ticking?.stage === e.stage) stopTicking();
+      else clear();
+      const says = SAYS[e.stage];
+      if (e.stage === "received" && e.at !== null) receivedAt = since(e);
+      if (e.state !== "in-progress") {
+        const total = e.stage === "live" && e.state === "done" && receivedAt !== null ? ` (${took(since(e) - receivedAt)} after Shadow received it)` : "";
+        const line = settledLine(e, total);
+        if (line !== null) io.write(line);
+        return;
+      }
+      io.write(`  \u2026 ${e.word.padEnd(10)} ${says.doing}
+`);
+      const from = since(e);
+      if (io.isTTY) {
+        let frame = 0;
+        const draw = () => {
+          io.write(`\r\x1B[2K    ${SPINNER[frame++ % SPINNER.length]} ${says.still} \xB7 ${took(now() - from)}`);
+          drawn = true;
+        };
+        draw();
+        ticking = { stage: e.stage, timer: every(draw, 1e3) };
+      } else {
+        ticking = { stage: e.stage, timer: every(() => io.write(`    ${says.still} (${took(now() - from)} so far)
+`), HEARTBEAT_MS) };
+      }
+    },
+    stop: stopTicking
+  };
+}
+
 // src/follow.ts
 async function followPublication(p, endpoint, o, opts) {
   const derived = portalForEndpoint(endpoint);
@@ -5925,11 +6096,11 @@ async function followPublication(p, endpoint, o, opts) {
   const refs = Object.entries(o.refs ?? {});
   if (refs.length !== 1) return elsewhere("several-refs");
   const [ref, commit] = refs[0];
-  opts.log("Following it: received -> checked -> going live -> live. Ctrl-C stops watching; the publication is already saved.");
+  opts.log("Following it to live: received -> checked -> going live -> live. Ctrl-C stops watching; the publication is saved and carries on without you.");
   const outcome = await p.followRun(
     { portal, repoId: o.repoId, publicationId: o.publicationId, ref, commit },
     { onStage: opts.onStage, ...opts.timeoutMs === void 0 ? {} : { timeoutMs: opts.timeoutMs }, ...opts.untilChange === true ? { untilChange: true } : {} }
-  );
+  ).finally(() => opts.stopStages?.());
   const answerable = confirmed.terminal.includes(PREPARATION);
   const dir = shellWord(opts.dir);
   const next = outcome.kind === "timed-out" || outcome.kind === "moving" ? { action: "follow", command: `publisher follow ${dir} --publication ${o.publicationId}${opts.untilChange === true ? " --until-change" : ""} --json` } : outcome.kind === "waiting" && answerable ? { action: "question", command: `publisher question ${dir} --json` } : void 0;
@@ -5965,13 +6136,15 @@ function shellWord(path) {
   return /^[A-Za-z0-9_./-]+$/.test(path) ? path : `'${path.replace(/'/g, `'\\''`)}'`;
 }
 function stageEmitter(json, quiet) {
-  return (e) => {
-    if (json) process.stdout.write(stageLine(e, true) + "\n");
-    else if (!quiet) process.stderr.write(stageLine(e, false) + "\n");
+  const nothing = () => {
   };
+  if (json) return { onStage: (e) => process.stdout.write(stageLine(e) + "\n"), stopStages: nothing };
+  if (quiet) return { onStage: nothing, stopStages: nothing };
+  const { onStage, stop } = stageReporter({ write: (s) => process.stderr.write(s), isTTY: process.stderr.isTTY === true });
+  return { onStage, stopStages: stop };
 }
-function stageLine(e, json) {
-  return json ? JSON.stringify({ event: "stage", stage: e.stage, word: e.word, state: e.state, at: e.at }) : `  ${e.word}: ${e.state.replace("-", " ")}`;
+function stageLine(e) {
+  return JSON.stringify({ event: "stage", stage: e.stage, word: e.word, state: e.state, at: e.at });
 }
 function inPortal(portal, lead, verb) {
   return `${lead} ${verb} in the portal${portal === null ? "" : `: ${portal}`}.`;
@@ -5993,7 +6166,7 @@ function progressHint(r, portal, answerable = false) {
       }
       break;
     case "moving": {
-      const now = r.stages.find((s) => s.state === "in-progress") ?? r.stages.filter((s) => s.state !== "pending").at(-1);
+      const now = r.stages.filter((s) => s.state === "in-progress").at(-1) ?? r.stages.filter((s) => s.state !== "pending").at(-1);
       return `Now: ${now?.word ?? "received"}. Run next.command to wait for the next step.`;
     }
     case "timed-out":
@@ -6043,15 +6216,81 @@ async function repositoryForInit(p, endpoint, name, opts = {}) {
   return { repoId: made.repository.repoId, appId: made.appId };
 }
 
-// src/login.ts
-async function verifiedCapabilities(publisher) {
-  const caps = await publisher.getCapabilities();
-  await publisher.listRepositories({ limit: 1 });
-  return caps;
+// src/args.ts
+var import_node_util2 = require("node:util");
+var OPTIONS = {
+  endpoint: { type: "string" },
+  profile: { type: "string" },
+  token: { type: "string" },
+  portal: { type: "string" },
+  name: { type: "string" },
+  repo: { type: "string" },
+  message: { type: "string" },
+  publication: { type: "string" },
+  timeout: { type: "string" },
+  branch: { type: "string" },
+  ours: { type: "string" },
+  theirs: { type: "string" },
+  to: { type: "string" },
+  cursor: { type: "string" },
+  ref: { type: "string", multiple: true },
+  json: { type: "boolean" },
+  quiet: { type: "boolean" },
+  force: { type: "boolean" },
+  apply: { type: "boolean" },
+  "mark-conflicts": { type: "boolean" },
+  help: { type: "boolean" },
+  version: { type: "boolean" },
+  "set-default": { type: "boolean" },
+  archived: { type: "boolean" },
+  // A flag of its own, not a negation of --wait: there is no --wait.
+  "no-wait": { type: "boolean" },
+  "until-change": { type: "boolean" },
+  // `login --continue`: finish the sign-in a `login --no-wait` started.
+  continue: { type: "boolean" }
+};
+function str2(v) {
+  return typeof v === "string" ? v : void 0;
+}
+function parseArgs(argv) {
+  try {
+    const { positionals, values } = (0, import_node_util2.parseArgs)({ args: argv, options: OPTIONS, allowPositionals: true, strict: true });
+    return { cmd: positionals, flags: { ...values } };
+  } catch (e) {
+    throw new PublisherError("INVALID_REQUEST", e instanceof Error ? e.message : String(e));
+  }
+}
+
+// src/discover.ts
+var DEFAULT_PORTAL_URL = "https://shadow.minnovate.ai";
+function portalBase(env, flag) {
+  return (flag ?? env["GIT_PUBLISHER_PORTAL"] ?? DEFAULT_PORTAL_URL).replace(/\/+$/, "");
+}
+async function discoverEndpoint(portal, fetchImpl = fetch) {
+  const url2 = `${portal}/api/v1/config`;
+  let body;
+  try {
+    const response = await fetchImpl(url2);
+    if (!response.ok) {
+      throw new PublisherError("UNAVAILABLE", `could not ask ${portal} where to publish (it answered ${response.status})`, { retryable: true });
+    }
+    body = await response.json();
+  } catch (e) {
+    if (PublisherError.isPublisherError(e)) throw e;
+    throw new PublisherError("NETWORK", `could not reach ${portal}: ${e instanceof Error ? e.message : String(e)}`, { retryable: true });
+  }
+  const endpoint = body?.publishingEndpoint;
+  if (endpoint === null || endpoint === void 0) {
+    throw new PublisherError("LOCAL_STATE", `${portal} is not set up for publishing; ask whoever runs it, or pass --endpoint`);
+  }
+  if (typeof endpoint !== "string" || endpoint.trim() === "") {
+    throw new PublisherError("UNAVAILABLE", `${portal} answered with something this version does not understand`, { retryable: false });
+  }
+  return endpoint;
 }
 
 // src/prompt.ts
-var import_promises10 = require("node:readline/promises");
+var import_promises11 = require("node:readline/promises");
 function isInteractive(env) {
   return env.isTTY === true && !env.json;
 }
@@ -6068,7 +6307,7 @@ function resolveChoice(answer, names) {
   return names.find((n) => n.toLowerCase() === a.toLowerCase()) ?? null;
 }
 async function ask3(question) {
-  const rl = (0, import_promises10.createInterface)({ input: process.stdin, output: process.stderr });
+  const rl = (0, import_promises11.createInterface)({ input: process.stdin, output: process.stderr });
   try {
     return await rl.question(question);
   } catch {
@@ -6113,58 +6352,205 @@ Profile name: `);
   return null;
 }
 
-// src/args.ts
-var import_node_util2 = require("node:util");
-var OPTIONS = {
-  endpoint: { type: "string" },
-  profile: { type: "string" },
-  token: { type: "string" },
-  portal: { type: "string" },
-  name: { type: "string" },
-  repo: { type: "string" },
-  message: { type: "string" },
-  publication: { type: "string" },
-  timeout: { type: "string" },
-  branch: { type: "string" },
-  ours: { type: "string" },
-  theirs: { type: "string" },
-  to: { type: "string" },
-  cursor: { type: "string" },
-  ref: { type: "string", multiple: true },
-  json: { type: "boolean" },
-  quiet: { type: "boolean" },
-  force: { type: "boolean" },
-  apply: { type: "boolean" },
-  "mark-conflicts": { type: "boolean" },
-  help: { type: "boolean" },
-  version: { type: "boolean" },
-  "set-default": { type: "boolean" },
-  archived: { type: "boolean" },
-  // A flag of its own, not a negation of --wait: there is no --wait.
-  "no-wait": { type: "boolean" },
-  "until-change": { type: "boolean" }
-};
-function parseArgs(argv) {
+// src/timings.ts
+function stopwatch(now = Date.now) {
+  const started = now();
+  let last = started;
+  const laps = {};
+  return {
+    /** `reached` false records a stage this command did not go through: null, and no time taken. */
+    lap(name, reached = true) {
+      const t = now();
+      if (!reached) {
+        laps[name] ??= null;
+        return t;
+      }
+      laps[name] = (laps[name] ?? 0) + (t - last);
+      last = t;
+      return t;
+    },
+    /** Every lap so far, with `total` since the stopwatch started. */
+    read(extra = {}) {
+      return { ...laps, ...extra, total: now() - started };
+    }
+  };
+}
+function splitAtBegin(clock, onProgress) {
+  let sending = false;
+  return {
+    onProgress(e) {
+      if (!sending && e.phase === "begin") {
+        sending = true;
+        clock.lap("prepare");
+      }
+      onProgress(e);
+    },
+    done: () => sending ? clock.lap("upload") : (clock.lap("prepare"), null)
+  };
+}
+function between(from, to) {
+  const a = from?.at ? Date.parse(from.at) : NaN;
+  const b = to?.at ? Date.parse(to.at) : NaN;
+  return Number.isFinite(a) && Number.isFinite(b) && to.state !== "skipped" ? Math.max(0, b - a) : null;
+}
+function runTimings(stages, acceptedAt) {
+  const s = (name) => stages?.find((e) => e.stage === name);
+  const receivedAt = s("received")?.at ? Date.parse(s("received").at) : NaN;
+  return {
+    handoff: acceptedAt !== null && Number.isFinite(receivedAt) ? Math.max(0, receivedAt - acceptedAt) : null,
+    received: between(s("received"), s("running")),
+    checks: between(s("running"), s("deploying")),
+    deployment: between(s("deploying"), s("live"))
+  };
+}
+function duration3(ms) {
+  return ms < 1e4 ? `${(Math.max(0, ms) / 1e3).toFixed(1)} s` : took(ms);
+}
+function timingsLine(t) {
+  const parts = Object.entries(t).filter((e) => e[1] !== null).map(([name, ms]) => `${name} ${duration3(ms)}`);
+  return `Took: ${parts.join(" \xB7 ")}`;
+}
+
+// src/login.ts
+async function verifiedCapabilities(publisher) {
+  const caps = await publisher.getCapabilities();
+  await publisher.listRepositories({ limit: 1 });
+  return caps;
+}
+var CONTINUE = "publisher login --continue --json";
+var START_AGAIN = "publisher login --no-wait --json";
+function prompt({ verificationUri, userCode, expiresInSeconds }) {
+  process.stderr.write(
+    `
+To sign in, open:
+  ${verificationUri}
+
+and confirm the code:
+  ${userCode}
+
+Waiting (it expires in ${Math.round(expiresInSeconds / 60)} minutes)...
+`
+  );
+}
+async function login(ctx) {
+  if (ctx.flags["continue"] === true) return continueLogin(ctx);
+  const clock = stopwatch();
+  const target = resolveLoginEndpoint(ctx.input);
+  const endpoint = "endpoint" in target ? target.endpoint : await discoverEndpoint(portalBase(process.env, str2(ctx.flags["portal"])));
+  if (!endpoint) throw new PublisherError("INVALID_REQUEST", "login requires --endpoint (or --profile naming a stored one)");
+  clock.lap("discovery");
+  const profile = str2(ctx.flags["profile"]);
+  const setDefault = ctx.flags["set-default"] === true;
+  const given = str2(ctx.flags["token"]) ?? process.env["GIT_PUBLISHER_TOKEN"];
+  if (given) return finish(ctx, { endpoint, token: given, signIn: null, profile, setDefault }, clock);
+  if (ctx.flags["no-wait"] === true) {
+    const started = await startDeviceLogin({ endpoint });
+    clock.lap("start");
+    prompt(started);
+    const pendingFile = await savePendingLogin({ endpoint, started, ...profile ? { profile } : {}, ...setDefault ? { setDefault } : {} });
+    ctx.out(pendingResult(endpoint, started, "Have the code approved, then run next.command to finish signing in.", clock, { pendingFile }));
+    return 0;
+  }
+  const signIn = await deviceLogin({
+    endpoint,
+    onPrompt: (shown2) => {
+      clock.lap("start");
+      prompt(shown2);
+    }
+  });
+  clock.lap("approval");
+  return finish(ctx, { endpoint, token: signIn.token, signIn, profile, setDefault }, clock);
+}
+async function continueLogin(ctx) {
+  const clock = stopwatch();
+  const pending = await readPendingLogin();
+  if (pending === null) {
+    const pendingFile = pendingLoginPath();
+    throw new PublisherError("LOCAL_STATE", `no sign-in is waiting at ${pendingFile}. ${notKept(`"${START_AGAIN}" answered`, `run ${START_AGAIN} again`)}`, {
+      details: { pendingFile, credentialsFile: credentialsLocation(), next: { action: "sign-in", ask: null, command: START_AGAIN, profiles: [] } }
+    });
+  }
+  const timeout = str2(ctx.flags["timeout"]);
+  let signIn;
   try {
-    const { positionals, values } = (0, import_node_util2.parseArgs)({ args: argv, options: OPTIONS, allowPositionals: true, strict: true });
-    return { cmd: positionals, flags: { ...values } };
+    signIn = await pollDeviceLogin(pending.started, { lastPolledAt: null, ...timeout === void 0 ? {} : { until: Date.now() + followTimeoutMs(timeout) } });
   } catch (e) {
-    throw new PublisherError("INVALID_REQUEST", e instanceof Error ? e.message : String(e));
+    if (e instanceof PublisherError && (e.code === "EXPIRED" || e.code === "FORBIDDEN")) await removePendingLogin();
+    throw e;
+  }
+  clock.lap("approval");
+  if (signIn === null) {
+    ctx.out(pendingResult(pending.endpoint, pending.started, "The code is not approved yet. Have it approved, then run next.command again.", clock));
+    return 3;
   }
+  const code = await finish(
+    ctx,
+    { endpoint: pending.endpoint, token: signIn.token, signIn, profile: pending.profile ?? str2(ctx.flags["profile"]), setDefault: pending.setDefault === true },
+    clock
+  );
+  await removePendingLogin();
+  return code;
+}
+function pendingResult(endpoint, started, hint, clock, extra = {}) {
+  return {
+    ok: false,
+    state: "pending",
+    endpoint,
+    userCode: started.userCode,
+    verificationUri: started.verificationUri,
+    expiresAt: new Date(started.expiresAt).toISOString(),
+    ...extra,
+    next: { action: "approve", ask: null, command: CONTINUE },
+    hint,
+    timings: clock.read()
+  };
+}
+async function finish(ctx, got, clock) {
+  const { endpoint, token, signIn } = got;
+  const caps = await verifiedCapabilities(createPublisher({ endpoint, token }));
+  clock.lap("verify");
+  let profile = got.profile;
+  if (!profile && isInteractive({ json: ctx.json, isTTY: process.stdin.isTTY })) {
+    const suggested = suggestProfileName(endpoint, new Set(Object.keys(ctx.input.file.profiles)));
+    profile = await askProfileName(endpoint, suggested) ?? void 0;
+  }
+  const path = await saveCredential(endpoint, token, void 0, {
+    ...profile ? { profile } : {},
+    setDefault: got.setDefault,
+    // The refresh half, when the service issued one: the sign-in outlives the credential.
+    ...signIn ? { signIn } : {}
+  });
+  const file = await readCredentials();
+  clock.lap("save");
+  const named = profileForEndpoint(file, endpoint, profile);
+  const timings = clock.read();
+  ctx.log(timingsLine(timings));
+  ctx.out({
+    ok: true,
+    endpoint,
+    profile: named,
+    isDefault: named !== null && file.defaultProfile === named,
+    server: caps.server,
+    credentialsFile: path,
+    // Which setting chose that path: a sandbox that keeps only its workspace needs it to be there.
+    credentialsFrom: credentialsLocation().from,
+    timings
+  });
+  return 0;
 }
 
 // src/skills.ts
 var import_node_child_process3 = require("node:child_process");
-var import_node_fs6 = require("node:fs");
-var import_node_path7 = require("node:path");
+var import_node_fs7 = require("node:fs");
+var import_node_path8 = require("node:path");
 var MARKETPLACE = "shadow-publisher";
 var PLUGIN = "git-publisher";
 function packageRoot() {
-  return (0, import_node_path7.join)((0, import_node_path7.dirname)((0, import_node_fs6.realpathSync)(process.argv[1])), "..");
+  return (0, import_node_path8.join)((0, import_node_path8.dirname)((0, import_node_fs7.realpathSync)(process.argv[1])), "..");
 }
 function packageVersion() {
   try {
-    return JSON.parse((0, import_node_fs6.readFileSync)((0, import_node_path7.join)(packageRoot(), "package.json"), "utf8")).version;
+    return JSON.parse((0, import_node_fs7.readFileSync)((0, import_node_path8.join)(packageRoot(), "package.json"), "utf8")).version;
   } catch {
     return "unknown";
   }
@@ -6181,8 +6567,8 @@ function claude(args) {
   });
 }
 async function installSkills({ log }) {
-  const source = (0, import_node_path7.join)(packageRoot(), "dist", "claude");
-  if (!(0, import_node_fs6.existsSync)((0, import_node_path7.join)(source, ".claude-plugin", "marketplace.json"))) {
+  const source = (0, import_node_path8.join)(packageRoot(), "dist", "claude");
+  if (!(0, import_node_fs7.existsSync)((0, import_node_path8.join)(source, ".claude-plugin", "marketplace.json"))) {
     throw new PublisherError("LOCAL_STATE", `this publisher carries no skills at ${source}; reinstall it with: npm install -g @minnovate/shadow-publisher`);
   }
   const step = async (what, args) => {
@@ -6280,6 +6666,46 @@ function hintFor(view) {
   return `It is waiting for your answer. Run: publisher answer ${how}`;
 }
 
+// src/tempdir.ts
+var import_node_fs8 = require("node:fs");
+var import_promises12 = require("node:fs/promises");
+var import_node_os4 = require("node:os");
+var FALLBACK_TEMP_DIRS = ["/tmp", "/var/tmp"];
+async function unusable(path) {
+  try {
+    if (!(await (0, import_promises12.stat)(path)).isDirectory()) return "is not a directory";
+  } catch {
+    return "does not exist";
+  }
+  try {
+    await (0, import_promises12.access)(path, import_node_fs8.constants.W_OK | import_node_fs8.constants.X_OK);
+    return null;
+  } catch {
+    return "cannot be written";
+  }
+}
+async function ensureTempDir(env = process.env, fallbacks = FALLBACK_TEMP_DIRS) {
+  const named = (0, import_node_os4.tmpdir)();
+  const reason = await unusable(named);
+  if (reason === null) return { path: named, replaced: null };
+  for (const candidate of fallbacks) {
+    if (candidate !== named && await unusable(candidate) === null) {
+      env["TMPDIR"] = candidate;
+      return { path: candidate, replaced: { path: named, reason } };
+    }
+  }
+  throw new PublisherError(
+    "LOCAL_STATE",
+    `the temporary directory ${named} ${reason}, and neither ${fallbacks.join(" nor ")} can be used: set TMPDIR to a directory that can be written`,
+    {
+      details: { tempDir: named, reason, tried: [...fallbacks] }
+    }
+  );
+}
+function replacedLine(t) {
+  return t.replaced === null ? null : `note: the temporary directory ${t.replaced.path} ${t.replaced.reason}; using ${t.path} instead`;
+}
+
 // src/main.ts
 var USAGE = `publisher \u2014 publish an app's Git history to the serverless Git backend
 
@@ -6293,6 +6719,8 @@ Usage:
       [--endpoint <url>]                                skip discovery and use this one
       [--portal <url>]                                  ask a different platform (or GIT_PUBLISHER_PORTAL)
       [--profile <name>] [--set-default] [--token <token>]
+      [--no-wait]                                       print the code and exit; finish with login --continue
+  publisher login --continue [--timeout <seconds>]      collect the credential once the code is approved
   publisher logout (--endpoint <url> | --profile <name>)
   publisher profile list | profile use <name> | profile remove <name>
   publisher init [dir] [--name <name>] [--repo <id>]    create (or attach to) a repository, associate this folder
@@ -6349,9 +6777,6 @@ function optStr(flags, key) {
   const v = str2(flags[key]);
   return v ? { [key]: v } : {};
 }
-function str2(v) {
-  return typeof v === "string" ? v : void 0;
-}
 async function main(argv) {
   const { cmd, flags } = parseArgs(argv);
   const json = flags["json"] === true;
@@ -6366,8 +6791,8 @@ async function main(argv) {
     process.stderr.write(`\r[${e.phase}] ${e.message}${pct}          `);
     if (e.phase === "done") process.stderr.write("\n");
   };
-  const dirArg = (i) => (0, import_node_path8.resolve)(cmd[i] ?? ".");
-  const following = { onStage: stageEmitter(json, quiet), log, untilChange: flags["until-change"] === true };
+  const dirArg = (i) => (0, import_node_path9.resolve)(cmd[i] ?? ".");
+  const following = { ...stageEmitter(json, quiet), log, untilChange: flags["until-change"] === true };
   const resolutionInput = async (dir) => {
     let association;
     if (dir && await isGitRepo(dir)) association = (await readAssociation(dir))?.endpoint;
@@ -6394,7 +6819,11 @@ async function main(argv) {
   const client = async (dir) => {
     const { endpoint, source } = await endpointFor(dir);
     const token = str2(flags["token"]);
-    return { endpoint, p: createPublisher({ endpoint, endpointSource: source, ...token ? { token } : {}, clientName: "git-publisher-cli", clientVersion: CLIENT_VERSION }) };
+    return {
+      endpoint,
+      source,
+      p: createPublisher({ endpoint, endpointSource: source, ...token ? { token } : {}, clientName: "git-publisher-cli", clientVersion: CLIENT_VERSION })
+    };
   };
   const linkFolder = async (p, endpoint, dir, attach) => {
     let onboarding = null;
@@ -6426,12 +6855,17 @@ async function main(argv) {
 `);
     return 0;
   }
+  if (flags["help"] !== true && GIT_COMMANDS.has(cmd[0] ?? "")) {
+    const line = replacedLine(await ensureTempDir());
+    if (line !== null) process.stderr.write(line + "\n");
+  }
   switch (flags["help"] === true ? "help" : cmd[0]) {
     case void 0:
     case "help":
       process.stdout.write(USAGE);
       return 0;
     case "doctor": {
+      const temp = await ensureTempDir().catch((e) => e instanceof PublisherError ? { error: e.message } : null);
       const git = await gitVersion().catch(() => null);
       const dir = dirArg(1);
       const s = credentialStatus(await resolutionInput(dir));
@@ -6453,6 +6887,7 @@ async function main(argv) {
         profiles: s.profiles,
         defaultProfile: s.defaultProfile,
         credentialsFile: credentialsPath(),
+        tempDir: temp,
         association: association === null ? null : { endpoint: association.endpoint, repoId: association.repoId },
         // Printed as it comes: `moved` carries where to, `unreachable` carries why, and the two
         // need different next steps so they are not collapsed into "not ok".
@@ -6472,48 +6907,8 @@ async function main(argv) {
       out({ ...result, next: { action: "reauthenticate", ask: null, command } });
       return 0;
     }
-    case "login": {
-      const portal = portalBase(process.env, str2(flags["portal"]));
-      const input = await resolutionInput();
-      const target = resolveLoginEndpoint(input);
-      const endpoint = "endpoint" in target ? target.endpoint : await discoverEndpoint(portal);
-      if (!endpoint) throw new PublisherError("INVALID_REQUEST", "login requires --endpoint (or --profile naming a stored one)");
-      const given = str2(flags["token"]) ?? process.env["GIT_PUBLISHER_TOKEN"];
-      const signIn = given ? null : await deviceLogin({
-        endpoint,
-        onPrompt: ({ userCode, verificationUri, expiresInSeconds }) => {
-          process.stderr.write(
-            `
-To sign in, open:
-  ${verificationUri}
-
-and confirm the code:
-  ${userCode}
-
-Waiting (it expires in ${Math.round(expiresInSeconds / 60)} minutes)...
-`
-          );
-        }
-      });
-      const token = given ?? signIn.token;
-      const p = createPublisher({ endpoint, token });
-      const caps = await verifiedCapabilities(p);
-      let profileFlag = str2(flags["profile"]);
-      if (!profileFlag && isInteractive({ json, isTTY: process.stdin.isTTY })) {
-        const suggested = suggestProfileName(endpoint, new Set(Object.keys(input.file.profiles)));
-        profileFlag = await askProfileName(endpoint, suggested) ?? void 0;
-      }
-      const path = await saveCredential(endpoint, token, void 0, {
-        ...profileFlag ? { profile: profileFlag } : {},
-        setDefault: flags["set-default"] === true,
-        // The refresh half, when the service issued one: the sign-in outlives the credential.
-        ...signIn ? { signIn } : {}
-      });
-      const file = await readCredentials();
-      const profile = profileForEndpoint(file, endpoint, profileFlag);
-      out({ ok: true, endpoint, profile, isDefault: profile !== null && file.defaultProfile === profile, server: caps.server, credentialsFile: path });
-      return 0;
-    }
+    case "login":
+      return login({ flags, json, out, log, input: await resolutionInput() });
     case "logout": {
       const profile = str2(flags["profile"]);
       const endpoint = str2(flags["endpoint"]) ?? process.env["GIT_PUBLISHER_ENDPOINT"];
@@ -6651,11 +7046,20 @@ Waiting (it expires in ${Math.round(expiresInSeconds / 60)} minutes)...
     case "sync": {
       const dir = dirArg(1);
       const timeoutMs = followTimeoutMs(str2(flags["timeout"]));
-      const { p, endpoint } = await client(dir);
+      const clock = stopwatch();
+      const { p, endpoint, source } = await client(dir);
+      clock.lap("discovery");
+      await resolveToken(endpoint, str2(flags["token"]), { endpointSource: source });
+      clock.lap("authentication");
       const linked = await isGitRepo(dir) && await readAssociation(dir) !== null ? null : await linkFolder(p, endpoint, dir, {});
-      const r = await p.syncChanges({ directory: dir, markConflicts: flags["mark-conflicts"] === true, ...optStr(flags, "message") }, { onProgress: progress });
+      clock.lap("link", linked !== null);
+      const sending = splitAtBegin(clock, progress);
+      const r = await p.syncChanges({ directory: dir, markConflicts: flags["mark-conflicts"] === true, ...optStr(flags, "message") }, { onProgress: sending.onProgress });
+      const acceptedAt = sending.done();
       const o = r.published;
       const followed = o !== null && o.state === "accepted" && flags["no-wait"] !== true ? await followPublication(p, endpoint, o, { ...following, timeoutMs, dir }) : null;
+      const syncTimings = clock.read(followed !== null && "stages" in followed ? runTimings(followed.stages, acceptedAt) : {});
+      log(timingsLine(syncTimings));
       out({
         ok: r.state === "published" || r.state === "up_to_date",
         state: r.state,
@@ -6673,7 +7077,8 @@ Waiting (it expires in ${Math.round(expiresInSeconds / 60)} minutes)...
           ...o.next === null ? {} : { next: o.next }
         },
         hint: syncHint(r.state, r.reconciled.before.conflicts, r.marked),
-        progress: followed
+        progress: followed,
+        timings: syncTimings
       });
       return r.state === "published" || r.state === "up_to_date" ? 0 : r.state === "unknown" ? 3 : 2;
     }
@@ -6694,7 +7099,11 @@ Waiting (it expires in ${Math.round(expiresInSeconds / 60)} minutes)...
       if (publication.state !== "accepted") {
         throw new PublisherError("LOCAL_STATE", `publication ${publicationId} is ${publication.state}, not accepted; run publisher status`);
       }
-      out({ publicationId, progress: await followPublication(p, endpoint, publication, { ...following, timeoutMs, dir }) });
+      const clock = stopwatch();
+      const followed = await followPublication(p, endpoint, publication, { ...following, timeoutMs, dir });
+      const timings = clock.read("stages" in followed ? runTimings(followed.stages, null) : {});
+      log(timingsLine(timings));
+      out({ publicationId, progress: followed, timings });
       return 0;
     }
     /**
@@ -6711,7 +7120,7 @@ Waiting (it expires in ${Math.round(expiresInSeconds / 60)} minutes)...
     }
     /** Answer it, as `question=value` pairs, re-reading the preparation first. */
     case "answer": {
-      const dir = (0, import_node_path8.resolve)(".");
+      const dir = (0, import_node_path9.resolve)(".");
       const { p, endpoint } = await client(dir);
       const repoId = str2(flags["repo"]) ?? (await readAssociation(dir))?.repoId;
       if (!repoId) throw new PublisherError("LOCAL_STATE", "no repository association; pass --repo");
@@ -6754,7 +7163,8 @@ ${USAGE}`);
       return 1;
   }
 }
-function demand(r, input) {
+var GIT_COMMANDS = /* @__PURE__ */ new Set(["init", "publish", "status", "fetch", "checkout", "workspace-status", "sync", "merge-check"]);
+async function demand(r, input) {
   if (r.kind === "resolved") return r;
   const next = nextStep(credentialStatus(input));
   const details = { profiles: r.kind === "none" ? [] : r.profiles, next };
@@ -6764,8 +7174,10 @@ function demand(r, input) {
       throw new PublisherError("LOCAL_STATE", `no such profile: ${r.name}.${run}`, { details });
     case "ambiguous":
       throw new PublisherError("LOCAL_STATE", `several connections and none is the default: pass --profile <name>, or choose one once.${run}`, { details });
-    case "none":
-      throw new PublisherError("LOCAL_STATE", `not connected to a publishing service yet.${run}`, { details });
+    case "none": {
+      const where = await whereCredentialsWere();
+      throw new PublisherError("LOCAL_STATE", `not connected to a publishing service yet: ${where.sentence}${run}`, { details: { ...details, credentialsFile: where.details } });
+    }
   }
 }
 function syncHint(state, conflicts, marked) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minnovate/shadow-publisher",
-  "version": "0.10.2",
+  "version": "0.11.0",
   "description": "publisher: publish an app's Git history to the serverless Git backend",
   "license": "Apache-2.0",
   "type": "module",