@minnovate/shadow-publisher 0.10.3 → 0.11.1

package/dist/claude/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "git-publisher",
   "displayName": "Git Publisher",
-  "version": "0.10.3",
+  "version": "0.11.1",
   "description": "Publish an app folder's Git history to the serverless Git publishing backend and keep it updated (\"publish my app\", \"update my app\", \"fetch the engineered version\").",
   "author": { "name": "git-publisher project" },
   "keywords": ["git", "publish", "deploy", "serverless"]

package/dist/claude/plugin/skills/publish-app/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: publish-app
 description: Publish or update the user's app (a folder) with the publisher. Use when the user says "publish my app", "update my app", "save my changes", "push my changes", "save this version online", or asks to resolve an interrupted publication. Handles first-time setup, every later update, interruption recovery and conflicts by running the `publisher` command; never uses git to commit or push.
-allowed-tools: Bash(publisher *), Bash(npm install -g @minnovate/shadow-publisher*), Bash(git status *), Bash(git diff *), Bash(git log *)
+allowed-tools: Bash(publisher *), Bash(mkdir -p *), Bash(npm install -g @minnovate/shadow-publisher*), Bash(git status *), Bash(git diff *), Bash(git log *)
 ---
 
 # Publish or update the user's app
@@ -10,6 +10,9 @@ You publish the user's app folder with the `publisher` command. All saving, merg
 retry and resume logic lives in it; your job is to run it, read its `--json` output, and tell the
 user what happened in plain language. Never explain S3, packs, commits, sessions or tokens.
 
+**When the user asks for Shadow or the publisher, use it at once.** Do not look at other ways to
+host or share the app first.
+
 **`publisher sync` is how a change is saved and published. Never run `git add`, `git commit`,
 `git push` or `git stash` in the user's app folder**, and never add a git remote. `sync` records the
 folder's changes itself — and leaves out `.env` files, keys, `node_modules` and anything larger than
@@ -25,10 +28,25 @@ Every command accepts `--json` and prints exactly one JSON object on stdout. Exi
 publisher --version
 ```
 
-If the command is not found, install it: `npm install -g @minnovate/shadow-publisher` (it needs
-Node.js 22). In a Claude Cowork task this is normal: the sandbox starts empty every time, so install it
-without asking. On the person's own computer, say in one line that you are installing the
-publisher. If `npm` itself is missing, tell them Node.js 22 must be installed first, and stop.
+If the command is not found, or the version is older than 0.11.0, install it:
+`npm install -g @minnovate/shadow-publisher@latest` (it needs Node.js 22). In a Claude Cowork task
+this is normal: the sandbox starts empty every time, so install it without asking. On the person's
+own computer, say in one line that you are installing the publisher. If `npm` itself is missing,
+tell them Node.js 22 must be installed first, and stop.
+
+### In a sandbox: keep the sign-in where the next command finds it
+
+A sandbox (Claude Cowork, Claude Code on the web, a chat's code tool) can forget every file outside
+its working folder between two commands. A sign-in kept in `/root/.config` is then gone at the
+next command. So in a sandbox, do this from the start:
+
+- Put `GIT_PUBLISHER_CREDENTIALS=<working folder>/.shadow-publisher/credentials.json` in front of
+  **every** `publisher` command. Use the absolute path of the folder the task works in. Never use
+  `/root` or `/tmp`, and never a path inside the app folder.
+- Do nothing about `TMPDIR`. From 0.11.0 the publisher uses `/tmp` when `TMPDIR` names a folder that
+  does not exist, and says so in one line.
+
+On the person's own computer, use neither: the default place is kept.
 
 ```bash
 publisher doctor --json
@@ -49,25 +67,30 @@ publisher doctor --json
 
 ### Signing in
 
-`publisher login` waits until the person has confirmed a code in their browser, and your shell may
-show nothing until a command ends. So never run it in the foreground. Start it in the background with
-its output going to a file, and read the file:
+`publisher login` waits until the code it prints is approved, and your shell may show nothing until
+a command ends. So sign in with two short commands instead of one that waits:
 
 ```bash
-publisher login --json > /tmp/publisher-login.log 2>&1 &
+publisher login --no-wait --json
 ```
 
-Within a few seconds the log shows `To sign in, open:` with a link under it, and `and confirm the
-code:` with the code under it. Give the person both, as a link they can click, and say the page will ask them to sign in with their work account.
-Then read the log every few seconds until it holds a JSON object (`ok: true`), for up to ten minutes.
-In a Claude Cowork task this happens again in every new task, because the sandbox forgets the
-sign-in when the task ends.
+It prints one JSON object with `userCode` and `verificationUri`, and `next.command`. Then:
+
+1. **If a tool named `approve_publisher_sign_in` is available** (the Shadow connector, which the
+   person connected in Claude's settings), call it with `userCode`. Do not give them the link.
+   If the tool answers that it did not approve, do step 2 instead.
+2. Otherwise give the person `verificationUri` as a link they can click, and `userCode`, and say
+   the page will ask them to sign in with their work account.
+3. Run `next.command` — it is `publisher login --continue --json`. It returns `ok: true` within
+   seconds of the approval. If it returns `state: "pending"`, the code is not approved yet: wait
+   for the person, then run it again. It refuses after ten minutes; then start again.
+4. **Check that the sign-in was kept before you publish**: run `publisher doctor --json` as a NEW
+   command. `next.action` must be `"ready"`. If it is not, or a command says the sign-in or the
+   waiting sign-in was not kept (its message names the file it looked for), this environment
+   forgot the file: keep it in another folder, as the section above says, and sign in again.
 
-**If a tool named `approve_publisher_sign_in` is available** (the Shadow publisher connector, which
-the person connected in Claude's settings), do not give them the link: call that tool with the code
-from the log, then keep reading the log as above — it reaches `ok: true` within a few seconds, with
-nothing for the person to do. If the tool answers that it did not approve, give them the link and
-code as above. The tool never returns a credential, and you never need one.
+In a Claude Cowork task this happens again in every new task, because the sandbox forgets the
+sign-in when the task ends. The tool never returns a credential, and you never need one.
 
 **Never ask the user for a token, an endpoint, a URL or a credential — in any words.** They are
 publishing an app; they do not know what those are, and you do not need them: `login` discovers
@@ -78,16 +101,27 @@ have; when it is not null it is already phrased for them, so pass it on rather t
 If they name an environment ("publish to dev"), pass `--profile dev` on each command rather than
 changing their default.
 
-## 2. First publication of a folder
+## 2. A new app: make it before you write it
+
+When the person asks for a NEW app, make it before you write a file. Do step 1 first, then:
+
+```bash
+mkdir -p <folder>
+publisher init <folder> --name "<app name>" --json
+```
+
+`init` makes the app and links the folder to it. It publishes nothing and starts no checks. While
+you write the app, the platform prepares its hosting, so the first publication goes live in
+seconds, not in a minute. The folder must exist, and it can be empty. Its output names the app
+under `appId`. Then write the app into that folder, and publish it with step 3, without `--name`.
 
-There is no separate first step: run step 3 in the app folder, adding `--name "<app name>"` the
-first time. A folder that is not published yet gets its application and repository from that same
-`sync` (the portal makes the application first, in one request), and is then published.
+If the app is already written and was never published, `init` gains nothing. Run step 3 in the
+app folder and add `--name "<app name>"`: that one `sync` makes the app, and then publishes it.
 
 The first `sync` prepares the folder with an explicit file selection: it excludes `.git`,
 `node_modules`, build caches, `.env*`, keys/certificates and files larger than 50 MB, and it
-respects `.gitignore`. Show the user the `linked` result and the excluded files it reports so they
-know what was left out (the exclusion rules are a safety net, not a secret scanner).
+respects `.gitignore`. Show the user the excluded files it reports so they know what was left out
+(the exclusion rules are a safety net, not a secret scanner).
 
 ## 3. Every publish, the first one included
 
@@ -96,7 +130,10 @@ publisher sync . --message "<a few words on what changed>" --until-change --time
 ```
 
 That one command records what changed in the folder, brings in anything published meanwhile (a
-fast-forward or a clean merge — it never rewrites the user's work), and publishes the result. Write
+fast-forward or a clean merge — it never rewrites the user's work), and publishes the result. Its
+`timings` say how long each stage took (milliseconds): `discovery`, `authentication`, `link`,
+`prepare`, `upload`, and — once the app is followed — `received`, `checks` and `deployment`. Quote
+them when the person asks why it was slow. Write
 the message in the user's words ("Add a contact page"), not git's.
 
 A published app runs with no internet access: **it may not load anything from other sites** — no
@@ -205,7 +242,7 @@ publisher list --json
 
 `apps[]` lists what they published, newest first, each with its `name` and a `checkout` command.
 Ask which one only if the name does not settle it, then run its `checkout` command and work in that
-folder. Never `sync` an empty new folder in its place: that makes a second app.
+folder. Never `init` or `sync` an empty new folder in its place: that makes a second app.
 
 ## If the service cannot be reached
 

package/dist/publisher.cjs

@@ -28,7 +28,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/main.ts
-var import_node_path8 = require("node:path");
+var import_node_path9 = require("node:path");
 
 // ../protocol/src/versions.ts
 var PROTOCOL_VERSION = 1;
@@ -2957,6 +2957,7 @@ var MAX_WAIT_SECONDS = 5;
 var import_node_child_process = require("node:child_process");
 var import_node_os = require("node:os");
 var import_promises = require("node:fs/promises");
+var import_node_fs = require("node:fs");
 var import_node_path = require("node:path");
 var import_node_util = require("node:util");
 var import_node_child_process2 = require("node:child_process");
@@ -2991,6 +2992,23 @@ var GIT_BIN = process.env["GITPUB_GIT_BIN"] ?? "git";
 function neutralCwd() {
   return (0, import_node_os.tmpdir)();
 }
+function startFailure(label, error2, cwd) {
+  const opts = { retryable: true, cause: error2 };
+  if (error2.code !== "ENOENT") return new PublisherError("UNAVAILABLE", `${label} could not be started: ${error2.message}`, opts);
+  if (!isDirectory(cwd)) {
+    const which = cwd === (0, import_node_os.tmpdir)() ? "the temporary directory (TMPDIR)" : "its working directory";
+    return new PublisherError("UNAVAILABLE", `${label} could not be started: ${which} ${cwd} does not exist`, { ...opts, details: { missing: "cwd", cwd } });
+  }
+  const where = GIT_BIN.includes("/") ? `at ${GIT_BIN}` : "on PATH";
+  return new PublisherError("UNAVAILABLE", `${label} could not be started: git was not found ${where}`, { ...opts, details: { missing: "git", git: GIT_BIN } });
+}
+function isDirectory(path) {
+  try {
+    return (0, import_node_fs.statSync)(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
 var gitStats = { invocations: 0, totalMs: 0 };
 var liveChildren = /* @__PURE__ */ new Set();
 var closedChildren = /* @__PURE__ */ new WeakSet();
@@ -3158,11 +3176,12 @@ function spawnTracked(args, opts) {
     if (typeof a !== "string") throw new Error("git args must be strings");
     if (a.includes("\0")) throw new PublisherError("INVALID_REQUEST", "NUL in git argument");
   }
-  const child = spawnImpl(GIT_BIN, args, { cwd: opts.cwd ?? neutralCwd(), env: sanitizedGitEnv(opts.env), stdio: ["pipe", "pipe", "pipe"], windowsHide: true, detached: true });
+  const cwd = opts.cwd ?? neutralCwd();
+  const child = spawnImpl(GIT_BIN, args, { cwd, env: sanitizedGitEnv(opts.env), stdio: ["pipe", "pipe", "pipe"], windowsHide: true, detached: true });
   gitStats.invocations++;
   const cleanupBoundMs = opts.cleanupBoundMs ?? CLEANUP_BOUND_MS;
   track(child, cleanupBoundMs);
-  return { child, cleanupBoundMs };
+  return { child, cleanupBoundMs, cwd };
 }
 function feedStdin(child, input, onSourceError) {
   let unpipe = () => void 0;
@@ -3211,7 +3230,7 @@ async function runGit(args, opts = {}) {
   const started = Date.now();
   const timeoutMs = opts.timeoutMs ?? 12e4;
   const maxOut = opts.maxStdoutBytes ?? 64 * 1024 * 1024;
-  const { child, cleanupBoundMs } = spawnTracked(args, opts);
+  const { child, cleanupBoundMs, cwd } = spawnTracked(args, opts);
   child.once("exit", () => armCloseBound(child, cleanupBoundMs));
   const stdoutChunks = [];
   let outBytes = 0;
@@ -3261,7 +3280,7 @@ async function runGit(args, opts = {}) {
   const result = { code, stdout: Buffer.concat(stdoutChunks), stderr, durationMs };
   const cleanup = await reapChild(child, { boundMs: cleanupBoundMs, ...opts.groupObserver ? { observer: opts.groupObserver } : {} });
   if (!reapSucceeded(cleanup)) throw cleanupFailure(`git ${args[0]}`, cleanup, killedReason ?? void 0);
-  if (ended.error) throw new PublisherError("UNAVAILABLE", `git ${args[0]} could not be started: ${ended.error.message}`, { retryable: true, cause: ended.error });
+  if (ended.error) throw startFailure(`git ${args[0]}`, ended.error, cwd);
   if (killedReason) throw killedError(killedReason, killedDetail, args, timeoutMs, maxOut);
   if (code !== 0 && !opts.allowFailure) throw new GitCommandError(args, code, stderr, opts.label);
   return result;
@@ -3334,8 +3353,8 @@ async function scanProcessGroup(pgid, signal) {
       if (signal?.aborted) throw new Error("process-group scan abandoned by its caller");
       if (!/^\d+$/.test(name)) continue;
       try {
-        const stat3 = await (0, import_promises.readFile)(`/proc/${name}/stat`, "utf8");
-        const rest = stat3.slice(stat3.lastIndexOf(")") + 2).split(" ");
+        const stat4 = await (0, import_promises.readFile)(`/proc/${name}/stat`, "utf8");
+        const rest = stat4.slice(stat4.lastIndexOf(")") + 2).split(" ");
         if (Number(rest[2]) !== pgid) continue;
         const status = await (0, import_promises.readFile)(`/proc/${name}/status`, "utf8");
         members2.push({ pid: Number(name), rss: Number(/^VmRSS:\s+(\d+)/m.exec(status)?.[1] ?? 0) * 1024 });
@@ -3524,13 +3543,13 @@ function compareVersions(a, b) {
 
 // ../git-core/src/hash.ts
 var import_node_crypto2 = require("node:crypto");
-var import_node_fs = require("node:fs");
+var import_node_fs2 = require("node:fs");
 var import_promises2 = require("node:fs/promises");
 async function sha256File(path) {
   const h = (0, import_node_crypto2.createHash)("sha256");
   let size = 0;
   await new Promise((resolve3, reject) => {
-    (0, import_node_fs.createReadStream)(path).on("data", (c) => {
+    (0, import_node_fs2.createReadStream)(path).on("data", (c) => {
       const b = typeof c === "string" ? Buffer.from(c) : c;
       size += b.length;
       h.update(b);
@@ -3542,12 +3561,12 @@ async function sha256File(path) {
 }
 
 // ../git-core/src/bare-repo.ts
-var import_node_fs2 = require("node:fs");
+var import_node_fs3 = require("node:fs");
 async function indexPackFromFile(dir, packPath, opts = {}) {
   const args = ["index-pack", "--stdin", ...opts.keep ?? true ? ["--keep=gitpub"] : []];
   if (opts.strict ?? true) args.push("--strict", "--fsck-objects");
   if (opts.maxInputBytes) args.push(`--max-input-size=${opts.maxInputBytes}`);
-  const run = { cwd: dir, input: (0, import_node_fs2.createReadStream)(packPath), label: "index-pack", ...opts };
+  const run = { cwd: dir, input: (0, import_node_fs3.createReadStream)(packPath), label: "index-pack", ...opts };
   const res = await runGit(args, { ...run, allowFailure: true });
   if (res.code !== 0) {
     const msg = res.stderr.trim().split("\n").pop() ?? "index-pack failed";
@@ -3614,14 +3633,14 @@ function revParse(dir, rev) {
 }
 
 // ../git-core/src/pack.ts
-var import_node_fs3 = require("node:fs");
+var import_node_fs4 = require("node:fs");
 async function buildPack(repoDir, opts) {
   return packObjectsToFile(repoDir, ["--revs"], [...opts.include, ...opts.exclude.map((e) => `^${e}`)], opts);
 }
 async function packObjectsToFile(repoDir, extraArgs, stdinLines, opts) {
   const args = ["pack-objects", ...extraArgs, "--stdout", "-q", "--delta-base-offset"];
   const child = spawnGit(args, { cwd: repoDir, ...opts.cleanupBoundMs !== void 0 ? { cleanupBoundMs: opts.cleanupBoundMs } : {} });
-  const out = (0, import_node_fs3.createWriteStream)(opts.outPath);
+  const out = (0, import_node_fs4.createWriteStream)(opts.outPath);
   let stderr = "";
   child.stderr.on("data", (c) => stderr += c.toString());
   const timeoutMs = opts.timeoutMs ?? 6e5;
@@ -3652,7 +3671,7 @@ async function packObjectsToFile(repoDir, extraArgs, stdinLines, opts) {
       }
     }
     const code = ended.code;
-    if (ended.error) throw new PublisherError("UNAVAILABLE", `git pack-objects could not be started: ${ended.error.message}`, { retryable: true, cause: ended.error });
+    if (ended.error) throw startFailure("git pack-objects", ended.error, repoDir);
     if (opts.signal?.aborted) throw new PublisherError("CANCELLED", "pack creation cancelled");
     if (timedOut) throw new PublisherError("GIT", `pack-objects timed out after ${timeoutMs}ms`, { retryable: true });
     if (code !== 0) throw new PublisherError("GIT", `pack-objects failed: ${stderr.trim().split("\n").pop() ?? ""}`);
@@ -4255,9 +4274,43 @@ async function postForm(base, path, fields, fetchImpl = globalThis.fetch) {
 // ../client/src/credentials.ts
 var REFRESH_EARLY_MS = 6e4;
 function credentialsPath() {
-  if (process.env["GIT_PUBLISHER_CREDENTIALS"]) return process.env["GIT_PUBLISHER_CREDENTIALS"];
-  const base = process.env["XDG_CONFIG_HOME"] ?? (0, import_node_path4.join)((0, import_node_os2.homedir)(), ".config");
-  return (0, import_node_path4.join)(base, "git-publisher", "credentials.json");
+  return credentialsLocation().path;
+}
+function credentialsLocation() {
+  const explicit = process.env["GIT_PUBLISHER_CREDENTIALS"];
+  if (explicit) return { path: explicit, from: "GIT_PUBLISHER_CREDENTIALS" };
+  const xdg = process.env["XDG_CONFIG_HOME"];
+  return { path: (0, import_node_path4.join)(xdg ?? (0, import_node_path4.join)((0, import_node_os2.homedir)(), ".config"), "git-publisher", "credentials.json"), from: xdg ? "XDG_CONFIG_HOME" : "HOME" };
+}
+async function credentialsFileState() {
+  let raw;
+  try {
+    raw = await (0, import_promises5.readFile)(credentialsPath(), "utf8");
+  } catch (e) {
+    return e.code === "ENOENT" ? "absent" : "unreadable";
+  }
+  try {
+    JSON.parse(raw);
+    return "present";
+  } catch {
+    return "unparseable";
+  }
+}
+async function whereCredentialsWere() {
+  const { path, from } = credentialsLocation();
+  const state = await credentialsFileState();
+  const set = from === "HOME" ? "the default under HOME" : `set by ${from}`;
+  const kept = state === "absent" ? ` ${notKept('"publisher login" answered ok', "sign in again")}` : "";
+  return { sentence: `${WHAT_IS_THERE[state]} ${path} (${set}).${kept}`, details: { path, from, state } };
+}
+var WHAT_IS_THERE = {
+  absent: "there is no credentials file at",
+  present: "no connection is saved in",
+  unreadable: "the credentials file cannot be read at",
+  unparseable: "the credentials file cannot be parsed at"
+};
+function notKept(earlier, then) {
+  return `If ${earlier} in an earlier command, this environment did not keep that file: set GIT_PUBLISHER_CREDENTIALS to a file in a folder that is kept between commands, outside the app folder, and ${then}.`;
 }
 function normalize(endpoint) {
   return endpoint.replace(/\/+$/, "");
@@ -4305,11 +4358,13 @@ async function readCredentials() {
 }
 var writes = 0;
 async function writeCredentials(file) {
-  const path = credentialsPath();
+  return writeSecretJson(credentialsPath(), file);
+}
+async function writeSecretJson(path, value) {
   await (0, import_promises5.mkdir)((0, import_node_path4.dirname)(path), { recursive: true, mode: 448 });
   const tmp = `${path}.${process.pid}.${++writes}.tmp`;
   try {
-    await (0, import_promises5.writeFile)(tmp, JSON.stringify(file, null, 2) + "\n", { mode: 384 });
+    await (0, import_promises5.writeFile)(tmp, JSON.stringify(value, null, 2) + "\n", { mode: 384 });
     await (0, import_promises5.chmod)(tmp, 384);
     await (0, import_promises5.rename)(tmp, path);
   } catch (e) {
@@ -4458,7 +4513,12 @@ async function resolveToken(endpoint, explicit, opts = {}) {
   if (given) return given;
   const url2 = normalize(endpoint);
   const entry = (await readCredentials()).endpoints[url2];
-  if (!entry) throw new PublisherError("UNAUTHORIZED", `no credentials for ${endpoint}; run "publisher login" or set GIT_PUBLISHER_TOKEN`, { details: { signIn: "missing" } });
+  if (!entry) {
+    const where = await whereCredentialsWere();
+    throw new PublisherError("UNAUTHORIZED", `no credentials for ${endpoint}: ${where.sentence} Run "publisher login" or set GIT_PUBLISHER_TOKEN.`, {
+      details: { signIn: "missing", credentialsFile: where.details }
+    });
+  }
   const now = (opts.now ?? Date.now)();
   const lapsed = entry.expiresAt !== void 0 && Date.parse(entry.expiresAt) - REFRESH_EARLY_MS <= now;
   if (entry.refreshToken && entry.authEndpoint && lapsed) return refreshCredential(url2, entry, opts);
@@ -5104,7 +5164,7 @@ async function checkIgnore(dir, paths) {
 }
 
 // ../client/src/fetch.ts
-var import_node_fs5 = require("node:fs");
+var import_node_fs6 = require("node:fs");
 var import_promises8 = require("node:fs/promises");
 var import_node_os3 = require("node:os");
 var import_node_path6 = require("node:path");
@@ -5116,12 +5176,12 @@ var import_node_crypto4 = require("node:crypto");
 var import_promises7 = require("node:fs/promises");
 
 // ../client/src/upload.ts
-var import_node_fs4 = require("node:fs");
+var import_node_fs5 = require("node:fs");
 var import_node_stream = require("node:stream");
 async function uploadPack(fetchImpl, upload, packPath, size, opts) {
   if (new Date(upload.expiresAt).getTime() < Date.now() + 5e3) return "expired";
   let sent = 0;
-  const file = (0, import_node_fs4.createReadStream)(packPath);
+  const file = (0, import_node_fs5.createReadStream)(packPath);
   const progress = new TransformStream({
     transform(chunk, controller) {
       sent += chunk.byteLength;
@@ -5526,7 +5586,7 @@ async function download(fetchImpl, url2, dest, sha256, size, call2) {
       controller.enqueue(chunk);
     }
   });
-  await (0, import_promises9.pipeline)(import_node_stream2.Readable.fromWeb(res.body.pipeThrough(counted)), (0, import_node_fs5.createWriteStream)(dest));
+  await (0, import_promises9.pipeline)(import_node_stream2.Readable.fromWeb(res.body.pipeThrough(counted)), (0, import_node_fs6.createWriteStream)(dest));
   if (n !== size || hash.digest("hex") !== sha256) throw new PublisherError("NETWORK", "downloaded artifact failed checksum verification", { retryable: true });
   return n;
 }
@@ -5829,10 +5889,8 @@ async function migrateAssociation(opts) {
 var DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 var str = (v) => typeof v === "string" && v.length > 0 ? v : null;
 var num = (v, fallback) => typeof v === "number" && Number.isFinite(v) && v > 0 ? v : fallback;
-async function deviceLogin(opts) {
+async function startDeviceLogin(opts) {
   const doFetch = opts.fetch ?? globalThis.fetch;
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  const now = opts.now ?? Date.now;
   const control = normalize(opts.endpoint);
   let advertised;
   try {
@@ -5843,8 +5901,7 @@ async function deviceLogin(opts) {
   if (typeof advertised !== "string" || advertised === "") throw new PublisherError("UNAVAILABLE", "this deployment does not offer device login; obtain a token another way");
   const base = normalize(advertised);
   assertCredentialEndpoint(base);
-  const post2 = (path, fields) => postForm(base, path, fields, doFetch);
-  const started = await post2("/v1/auth/device", { client_id: opts.clientId ?? "gitpub-cli" });
+  const started = await postForm(base, "/v1/auth/device", { client_id: opts.clientId ?? "gitpub-cli" }, doFetch);
   if (started.status !== 200) throw new PublisherError("UNAVAILABLE", `starting the login failed (${started.status})`, { retryable: true });
   const s = started.body;
   const deviceCode = str(s.device_code);
@@ -5852,17 +5909,33 @@ async function deviceLogin(opts) {
   const uri = str(s.verification_uri_complete) ?? str(s.verification_uri);
   if (!deviceCode || !userCode || !uri) throw new PublisherError("UNAVAILABLE", "the login response was incomplete");
   const expiresInSeconds = num(s.expires_in, 600);
-  let intervalMs = num(s.interval, 5) * 1e3;
-  await opts.onPrompt({ userCode, verificationUri: uri, expiresInSeconds, intervalSeconds: intervalMs / 1e3 });
-  const deadline = now() + expiresInSeconds * 1e3;
+  return {
+    deviceCode,
+    userCode,
+    verificationUri: uri,
+    expiresInSeconds,
+    intervalSeconds: num(s.interval, 5),
+    authEndpoint: base,
+    expiresAt: (opts.now ?? Date.now)() + expiresInSeconds * 1e3
+  };
+}
+async function pollDeviceLogin(started, opts) {
+  const doFetch = opts.fetch ?? globalThis.fetch;
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = opts.now ?? Date.now;
+  let intervalMs = started.intervalSeconds * 1e3;
+  let last = opts.lastPolledAt;
   for (; ; ) {
-    await sleep2(intervalMs);
-    if (now() >= deadline) throw new PublisherError("EXPIRED", "the login expired before it was approved");
-    const polled = await post2("/v1/auth/token", { grant_type: DEVICE_CODE_GRANT, device_code: deviceCode });
+    const at = Math.max(now(), last === null ? 0 : last + intervalMs);
+    if (opts.until !== void 0 && at > opts.until) return null;
+    if (at > now()) await sleep2(at - now());
+    if (now() >= started.expiresAt) throw new PublisherError("EXPIRED", "the login expired before it was approved");
+    const polled = await postForm(started.authEndpoint, "/v1/auth/token", { grant_type: DEVICE_CODE_GRANT, device_code: started.deviceCode }, doFetch);
+    last = now();
     if (polled.status === 200) {
       const token = str(polled.body["access_token"]);
       if (!token) throw new PublisherError("UNAVAILABLE", "the login returned no credential");
-      return { token, refreshToken: str(polled.body["refresh_token"]), expiresInSeconds: num(polled.body["expires_in"], 900), authEndpoint: base };
+      return { token, refreshToken: str(polled.body["refresh_token"]), expiresInSeconds: num(polled.body["expires_in"], 900), authEndpoint: started.authEndpoint };
     }
     const error2 = str(polled.body["error"]);
     if (error2 === "authorization_pending") continue;
@@ -5876,33 +5949,44 @@ async function deviceLogin(opts) {
     throw new PublisherError("UNAVAILABLE", `the login failed (${polled.status}${error2 ? `: ${error2}` : ""})`);
   }
 }
+async function deviceLogin(opts) {
+  const started = await startDeviceLogin(opts);
+  const { deviceCode: _secret, authEndpoint: _auth, expiresAt: _at, ...shown2 } = started;
+  await opts.onPrompt(shown2);
+  const signIn = await pollDeviceLogin(started, { ...opts, lastPolledAt: (opts.now ?? Date.now)() });
+  return signIn;
+}
 
-// src/discover.ts
-var DEFAULT_PORTAL_URL = "https://shadow.minnovate.ai";
-function portalBase(env, flag) {
-  return (flag ?? env["GIT_PUBLISHER_PORTAL"] ?? DEFAULT_PORTAL_URL).replace(/\/+$/, "");
+// ../client/src/pending-login.ts
+var import_promises10 = require("node:fs/promises");
+var import_node_path7 = require("node:path");
+function pendingLoginPath() {
+  return (0, import_node_path7.join)((0, import_node_path7.dirname)(credentialsPath()), "login-pending.json");
 }
-async function discoverEndpoint(portal, fetchImpl = fetch) {
-  const url2 = `${portal}/api/v1/config`;
-  let body;
+async function savePendingLogin(pending) {
+  return writeSecretJson(pendingLoginPath(), { version: 1, ...pending });
+}
+async function readPendingLogin() {
+  let raw;
   try {
-    const response = await fetchImpl(url2);
-    if (!response.ok) {
-      throw new PublisherError("UNAVAILABLE", `could not ask ${portal} where to publish (it answered ${response.status})`, { retryable: true });
-    }
-    body = await response.json();
-  } catch (e) {
-    if (PublisherError.isPublisherError(e)) throw e;
-    throw new PublisherError("NETWORK", `could not reach ${portal}: ${e instanceof Error ? e.message : String(e)}`, { retryable: true });
-  }
-  const endpoint = body?.publishingEndpoint;
-  if (endpoint === null || endpoint === void 0) {
-    throw new PublisherError("LOCAL_STATE", `${portal} is not set up for publishing; ask whoever runs it, or pass --endpoint`);
-  }
-  if (typeof endpoint !== "string" || endpoint.trim() === "") {
-    throw new PublisherError("UNAVAILABLE", `${portal} answered with something this version does not understand`, { retryable: false });
+    raw = JSON.parse(await (0, import_promises10.readFile)(pendingLoginPath(), "utf8"));
+  } catch {
+    return null;
   }
-  return endpoint;
+  if (typeof raw !== "object" || raw === null) return null;
+  const r = raw;
+  const s = r.started;
+  if (r.version !== 1 || typeof r.endpoint !== "string" || !s) return null;
+  if (typeof s.deviceCode !== "string" || typeof s.authEndpoint !== "string" || typeof s.expiresAt !== "number" || typeof s.intervalSeconds !== "number") return null;
+  return {
+    endpoint: r.endpoint,
+    started: s,
+    ...typeof r.profile === "string" ? { profile: r.profile } : {},
+    ...r.setDefault === true ? { setDefault: true } : {}
+  };
+}
+async function removePendingLogin() {
+  await (0, import_promises10.rm)(pendingLoginPath(), { force: true });
 }
 
 // src/git-minimum.ts
@@ -6132,15 +6216,81 @@ async function repositoryForInit(p, endpoint, name, opts = {}) {
   return { repoId: made.repository.repoId, appId: made.appId };
 }
 
-// src/login.ts
-async function verifiedCapabilities(publisher) {
-  const caps = await publisher.getCapabilities();
-  await publisher.listRepositories({ limit: 1 });
-  return caps;
+// src/args.ts
+var import_node_util2 = require("node:util");
+var OPTIONS = {
+  endpoint: { type: "string" },
+  profile: { type: "string" },
+  token: { type: "string" },
+  portal: { type: "string" },
+  name: { type: "string" },
+  repo: { type: "string" },
+  message: { type: "string" },
+  publication: { type: "string" },
+  timeout: { type: "string" },
+  branch: { type: "string" },
+  ours: { type: "string" },
+  theirs: { type: "string" },
+  to: { type: "string" },
+  cursor: { type: "string" },
+  ref: { type: "string", multiple: true },
+  json: { type: "boolean" },
+  quiet: { type: "boolean" },
+  force: { type: "boolean" },
+  apply: { type: "boolean" },
+  "mark-conflicts": { type: "boolean" },
+  help: { type: "boolean" },
+  version: { type: "boolean" },
+  "set-default": { type: "boolean" },
+  archived: { type: "boolean" },
+  // A flag of its own, not a negation of --wait: there is no --wait.
+  "no-wait": { type: "boolean" },
+  "until-change": { type: "boolean" },
+  // `login --continue`: finish the sign-in a `login --no-wait` started.
+  continue: { type: "boolean" }
+};
+function str2(v) {
+  return typeof v === "string" ? v : void 0;
+}
+function parseArgs(argv) {
+  try {
+    const { positionals, values } = (0, import_node_util2.parseArgs)({ args: argv, options: OPTIONS, allowPositionals: true, strict: true });
+    return { cmd: positionals, flags: { ...values } };
+  } catch (e) {
+    throw new PublisherError("INVALID_REQUEST", e instanceof Error ? e.message : String(e));
+  }
+}
+
+// src/discover.ts
+var DEFAULT_PORTAL_URL = "https://shadow.minnovate.ai";
+function portalBase(env, flag) {
+  return (flag ?? env["GIT_PUBLISHER_PORTAL"] ?? DEFAULT_PORTAL_URL).replace(/\/+$/, "");
+}
+async function discoverEndpoint(portal, fetchImpl = fetch) {
+  const url2 = `${portal}/api/v1/config`;
+  let body;
+  try {
+    const response = await fetchImpl(url2);
+    if (!response.ok) {
+      throw new PublisherError("UNAVAILABLE", `could not ask ${portal} where to publish (it answered ${response.status})`, { retryable: true });
+    }
+    body = await response.json();
+  } catch (e) {
+    if (PublisherError.isPublisherError(e)) throw e;
+    throw new PublisherError("NETWORK", `could not reach ${portal}: ${e instanceof Error ? e.message : String(e)}`, { retryable: true });
+  }
+  const endpoint = body?.publishingEndpoint;
+  if (endpoint === null || endpoint === void 0) {
+    throw new PublisherError("LOCAL_STATE", `${portal} is not set up for publishing; ask whoever runs it, or pass --endpoint`);
+  }
+  if (typeof endpoint !== "string" || endpoint.trim() === "") {
+    throw new PublisherError("UNAVAILABLE", `${portal} answered with something this version does not understand`, { retryable: false });
+  }
+  return endpoint;
 }
 
 // src/prompt.ts
-var import_promises10 = require("node:readline/promises");
+var import_promises11 = require("node:readline/promises");
 function isInteractive(env) {
   return env.isTTY === true && !env.json;
 }
@@ -6157,7 +6307,7 @@ function resolveChoice(answer, names) {
   return names.find((n) => n.toLowerCase() === a.toLowerCase()) ?? null;
 }
 async function ask3(question) {
-  const rl = (0, import_promises10.createInterface)({ input: process.stdin, output: process.stderr });
+  const rl = (0, import_promises11.createInterface)({ input: process.stdin, output: process.stderr });
   try {
     return await rl.question(question);
   } catch {
@@ -6202,58 +6352,205 @@ Profile name: `);
   return null;
 }
 
-// src/args.ts
-var import_node_util2 = require("node:util");
-var OPTIONS = {
-  endpoint: { type: "string" },
-  profile: { type: "string" },
-  token: { type: "string" },
-  portal: { type: "string" },
-  name: { type: "string" },
-  repo: { type: "string" },
-  message: { type: "string" },
-  publication: { type: "string" },
-  timeout: { type: "string" },
-  branch: { type: "string" },
-  ours: { type: "string" },
-  theirs: { type: "string" },
-  to: { type: "string" },
-  cursor: { type: "string" },
-  ref: { type: "string", multiple: true },
-  json: { type: "boolean" },
-  quiet: { type: "boolean" },
-  force: { type: "boolean" },
-  apply: { type: "boolean" },
-  "mark-conflicts": { type: "boolean" },
-  help: { type: "boolean" },
-  version: { type: "boolean" },
-  "set-default": { type: "boolean" },
-  archived: { type: "boolean" },
-  // A flag of its own, not a negation of --wait: there is no --wait.
-  "no-wait": { type: "boolean" },
-  "until-change": { type: "boolean" }
-};
-function parseArgs(argv) {
+// src/timings.ts
+function stopwatch(now = Date.now) {
+  const started = now();
+  let last = started;
+  const laps = {};
+  return {
+    /** `reached` false records a stage this command did not go through: null, and no time taken. */
+    lap(name, reached = true) {
+      const t = now();
+      if (!reached) {
+        laps[name] ??= null;
+        return t;
+      }
+      laps[name] = (laps[name] ?? 0) + (t - last);
+      last = t;
+      return t;
+    },
+    /** Every lap so far, with `total` since the stopwatch started. */
+    read(extra = {}) {
+      return { ...laps, ...extra, total: now() - started };
+    }
+  };
+}
+function splitAtBegin(clock, onProgress) {
+  let sending = false;
+  return {
+    onProgress(e) {
+      if (!sending && e.phase === "begin") {
+        sending = true;
+        clock.lap("prepare");
+      }
+      onProgress(e);
+    },
+    done: () => sending ? clock.lap("upload") : (clock.lap("prepare"), null)
+  };
+}
+function between(from, to) {
+  const a = from?.at ? Date.parse(from.at) : NaN;
+  const b = to?.at ? Date.parse(to.at) : NaN;
+  return Number.isFinite(a) && Number.isFinite(b) && to.state !== "skipped" ? Math.max(0, b - a) : null;
+}
+function runTimings(stages, acceptedAt) {
+  const s = (name) => stages?.find((e) => e.stage === name);
+  const receivedAt = s("received")?.at ? Date.parse(s("received").at) : NaN;
+  return {
+    handoff: acceptedAt !== null && Number.isFinite(receivedAt) ? Math.max(0, receivedAt - acceptedAt) : null,
+    received: between(s("received"), s("running")),
+    checks: between(s("running"), s("deploying")),
+    deployment: between(s("deploying"), s("live"))
+  };
+}
+function duration3(ms) {
+  return ms < 1e4 ? `${(Math.max(0, ms) / 1e3).toFixed(1)} s` : took(ms);
+}
+function timingsLine(t) {
+  const parts = Object.entries(t).filter((e) => e[1] !== null).map(([name, ms]) => `${name} ${duration3(ms)}`);
+  return `Took: ${parts.join(" \xB7 ")}`;
+}
+
+// src/login.ts
+async function verifiedCapabilities(publisher) {
+  const caps = await publisher.getCapabilities();
+  await publisher.listRepositories({ limit: 1 });
+  return caps;
+}
+var CONTINUE = "publisher login --continue --json";
+var START_AGAIN = "publisher login --no-wait --json";
+function prompt({ verificationUri, userCode, expiresInSeconds }) {
+  process.stderr.write(
+    `
+To sign in, open:
+  ${verificationUri}
+
+and confirm the code:
+  ${userCode}
+
+Waiting (it expires in ${Math.round(expiresInSeconds / 60)} minutes)...
+`
+  );
+}
+async function login(ctx) {
+  if (ctx.flags["continue"] === true) return continueLogin(ctx);
+  const clock = stopwatch();
+  const target = resolveLoginEndpoint(ctx.input);
+  const endpoint = "endpoint" in target ? target.endpoint : await discoverEndpoint(portalBase(process.env, str2(ctx.flags["portal"])));
+  if (!endpoint) throw new PublisherError("INVALID_REQUEST", "login requires --endpoint (or --profile naming a stored one)");
+  clock.lap("discovery");
+  const profile = str2(ctx.flags["profile"]);
+  const setDefault = ctx.flags["set-default"] === true;
+  const given = str2(ctx.flags["token"]) ?? process.env["GIT_PUBLISHER_TOKEN"];
+  if (given) return finish(ctx, { endpoint, token: given, signIn: null, profile, setDefault }, clock);
+  if (ctx.flags["no-wait"] === true) {
+    const started = await startDeviceLogin({ endpoint });
+    clock.lap("start");
+    prompt(started);
+    const pendingFile = await savePendingLogin({ endpoint, started, ...profile ? { profile } : {}, ...setDefault ? { setDefault } : {} });
+    ctx.out(pendingResult(endpoint, started, "Have the code approved, then run next.command to finish signing in.", clock, { pendingFile }));
+    return 0;
+  }
+  const signIn = await deviceLogin({
+    endpoint,
+    onPrompt: (shown2) => {
+      clock.lap("start");
+      prompt(shown2);
+    }
+  });
+  clock.lap("approval");
+  return finish(ctx, { endpoint, token: signIn.token, signIn, profile, setDefault }, clock);
+}
+async function continueLogin(ctx) {
+  const clock = stopwatch();
+  const pending = await readPendingLogin();
+  if (pending === null) {
+    const pendingFile = pendingLoginPath();
+    throw new PublisherError("LOCAL_STATE", `no sign-in is waiting at ${pendingFile}. ${notKept(`"${START_AGAIN}" answered`, `run ${START_AGAIN} again`)}`, {
+      details: { pendingFile, credentialsFile: credentialsLocation(), next: { action: "sign-in", ask: null, command: START_AGAIN, profiles: [] } }
+    });
+  }
+  const timeout = str2(ctx.flags["timeout"]);
+  let signIn;
   try {
-    const { positionals, values } = (0, import_node_util2.parseArgs)({ args: argv, options: OPTIONS, allowPositionals: true, strict: true });
-    return { cmd: positionals, flags: { ...values } };
+    signIn = await pollDeviceLogin(pending.started, { lastPolledAt: null, ...timeout === void 0 ? {} : { until: Date.now() + followTimeoutMs(timeout) } });
   } catch (e) {
-    throw new PublisherError("INVALID_REQUEST", e instanceof Error ? e.message : String(e));
+    if (e instanceof PublisherError && (e.code === "EXPIRED" || e.code === "FORBIDDEN")) await removePendingLogin();
+    throw e;
   }
+  clock.lap("approval");
+  if (signIn === null) {
+    ctx.out(pendingResult(pending.endpoint, pending.started, "The code is not approved yet. Have it approved, then run next.command again.", clock));
+    return 3;
+  }
+  const code = await finish(
+    ctx,
+    { endpoint: pending.endpoint, token: signIn.token, signIn, profile: pending.profile ?? str2(ctx.flags["profile"]), setDefault: pending.setDefault === true },
+    clock
+  );
+  await removePendingLogin();
+  return code;
+}
+function pendingResult(endpoint, started, hint, clock, extra = {}) {
+  return {
+    ok: false,
+    state: "pending",
+    endpoint,
+    userCode: started.userCode,
+    verificationUri: started.verificationUri,
+    expiresAt: new Date(started.expiresAt).toISOString(),
+    ...extra,
+    next: { action: "approve", ask: null, command: CONTINUE },
+    hint,
+    timings: clock.read()
+  };
+}
+async function finish(ctx, got, clock) {
+  const { endpoint, token, signIn } = got;
+  const caps = await verifiedCapabilities(createPublisher({ endpoint, token }));
+  clock.lap("verify");
+  let profile = got.profile;
+  if (!profile && isInteractive({ json: ctx.json, isTTY: process.stdin.isTTY })) {
+    const suggested = suggestProfileName(endpoint, new Set(Object.keys(ctx.input.file.profiles)));
+    profile = await askProfileName(endpoint, suggested) ?? void 0;
+  }
+  const path = await saveCredential(endpoint, token, void 0, {
+    ...profile ? { profile } : {},
+    setDefault: got.setDefault,
+    // The refresh half, when the service issued one: the sign-in outlives the credential.
+    ...signIn ? { signIn } : {}
+  });
+  const file = await readCredentials();
+  clock.lap("save");
+  const named = profileForEndpoint(file, endpoint, profile);
+  const timings = clock.read();
+  ctx.log(timingsLine(timings));
+  ctx.out({
+    ok: true,
+    endpoint,
+    profile: named,
+    isDefault: named !== null && file.defaultProfile === named,
+    server: caps.server,
+    credentialsFile: path,
+    // Which setting chose that path: a sandbox that keeps only its workspace needs it to be there.
+    credentialsFrom: credentialsLocation().from,
+    timings
+  });
+  return 0;
 }
 
 // src/skills.ts
 var import_node_child_process3 = require("node:child_process");
-var import_node_fs6 = require("node:fs");
-var import_node_path7 = require("node:path");
+var import_node_fs7 = require("node:fs");
+var import_node_path8 = require("node:path");
 var MARKETPLACE = "shadow-publisher";
 var PLUGIN = "git-publisher";
 function packageRoot() {
-  return (0, import_node_path7.join)((0, import_node_path7.dirname)((0, import_node_fs6.realpathSync)(process.argv[1])), "..");
+  return (0, import_node_path8.join)((0, import_node_path8.dirname)((0, import_node_fs7.realpathSync)(process.argv[1])), "..");
 }
 function packageVersion() {
   try {
-    return JSON.parse((0, import_node_fs6.readFileSync)((0, import_node_path7.join)(packageRoot(), "package.json"), "utf8")).version;
+    return JSON.parse((0, import_node_fs7.readFileSync)((0, import_node_path8.join)(packageRoot(), "package.json"), "utf8")).version;
   } catch {
     return "unknown";
   }
@@ -6270,8 +6567,8 @@ function claude(args) {
   });
 }
 async function installSkills({ log }) {
-  const source = (0, import_node_path7.join)(packageRoot(), "dist", "claude");
-  if (!(0, import_node_fs6.existsSync)((0, import_node_path7.join)(source, ".claude-plugin", "marketplace.json"))) {
+  const source = (0, import_node_path8.join)(packageRoot(), "dist", "claude");
+  if (!(0, import_node_fs7.existsSync)((0, import_node_path8.join)(source, ".claude-plugin", "marketplace.json"))) {
     throw new PublisherError("LOCAL_STATE", `this publisher carries no skills at ${source}; reinstall it with: npm install -g @minnovate/shadow-publisher`);
   }
   const step = async (what, args) => {
@@ -6369,6 +6666,46 @@ function hintFor(view) {
   return `It is waiting for your answer. Run: publisher answer ${how}`;
 }
 
+// src/tempdir.ts
+var import_node_fs8 = require("node:fs");
+var import_promises12 = require("node:fs/promises");
+var import_node_os4 = require("node:os");
+var FALLBACK_TEMP_DIRS = ["/tmp", "/var/tmp"];
+async function unusable(path) {
+  try {
+    if (!(await (0, import_promises12.stat)(path)).isDirectory()) return "is not a directory";
+  } catch {
+    return "does not exist";
+  }
+  try {
+    await (0, import_promises12.access)(path, import_node_fs8.constants.W_OK | import_node_fs8.constants.X_OK);
+    return null;
+  } catch {
+    return "cannot be written";
+  }
+}
+async function ensureTempDir(env = process.env, fallbacks = FALLBACK_TEMP_DIRS) {
+  const named = (0, import_node_os4.tmpdir)();
+  const reason = await unusable(named);
+  if (reason === null) return { path: named, replaced: null };
+  for (const candidate of fallbacks) {
+    if (candidate !== named && await unusable(candidate) === null) {
+      env["TMPDIR"] = candidate;
+      return { path: candidate, replaced: { path: named, reason } };
+    }
+  }
+  throw new PublisherError(
+    "LOCAL_STATE",
+    `the temporary directory ${named} ${reason}, and neither ${fallbacks.join(" nor ")} can be used: set TMPDIR to a directory that can be written`,
+    {
+      details: { tempDir: named, reason, tried: [...fallbacks] }
+    }
+  );
+}
+function replacedLine(t) {
+  return t.replaced === null ? null : `note: the temporary directory ${t.replaced.path} ${t.replaced.reason}; using ${t.path} instead`;
+}
+
 // src/main.ts
 var USAGE = `publisher \u2014 publish an app's Git history to the serverless Git backend
 
@@ -6382,6 +6719,8 @@ Usage:
       [--endpoint <url>]                                skip discovery and use this one
       [--portal <url>]                                  ask a different platform (or GIT_PUBLISHER_PORTAL)
       [--profile <name>] [--set-default] [--token <token>]
+      [--no-wait]                                       print the code and exit; finish with login --continue
+  publisher login --continue [--timeout <seconds>]      collect the credential once the code is approved
   publisher logout (--endpoint <url> | --profile <name>)
   publisher profile list | profile use <name> | profile remove <name>
   publisher init [dir] [--name <name>] [--repo <id>]    create (or attach to) a repository, associate this folder
@@ -6438,9 +6777,6 @@ function optStr(flags, key) {
   const v = str2(flags[key]);
   return v ? { [key]: v } : {};
 }
-function str2(v) {
-  return typeof v === "string" ? v : void 0;
-}
 async function main(argv) {
   const { cmd, flags } = parseArgs(argv);
   const json = flags["json"] === true;
@@ -6455,7 +6791,7 @@ async function main(argv) {
     process.stderr.write(`\r[${e.phase}] ${e.message}${pct}          `);
     if (e.phase === "done") process.stderr.write("\n");
   };
-  const dirArg = (i) => (0, import_node_path8.resolve)(cmd[i] ?? ".");
+  const dirArg = (i) => (0, import_node_path9.resolve)(cmd[i] ?? ".");
   const following = { ...stageEmitter(json, quiet), log, untilChange: flags["until-change"] === true };
   const resolutionInput = async (dir) => {
     let association;
@@ -6483,7 +6819,11 @@ async function main(argv) {
   const client = async (dir) => {
     const { endpoint, source } = await endpointFor(dir);
     const token = str2(flags["token"]);
-    return { endpoint, p: createPublisher({ endpoint, endpointSource: source, ...token ? { token } : {}, clientName: "git-publisher-cli", clientVersion: CLIENT_VERSION }) };
+    return {
+      endpoint,
+      source,
+      p: createPublisher({ endpoint, endpointSource: source, ...token ? { token } : {}, clientName: "git-publisher-cli", clientVersion: CLIENT_VERSION })
+    };
   };
   const linkFolder = async (p, endpoint, dir, attach) => {
     let onboarding = null;
@@ -6515,12 +6855,17 @@ async function main(argv) {
 `);
     return 0;
   }
+  if (flags["help"] !== true && GIT_COMMANDS.has(cmd[0] ?? "")) {
+    const line = replacedLine(await ensureTempDir());
+    if (line !== null) process.stderr.write(line + "\n");
+  }
   switch (flags["help"] === true ? "help" : cmd[0]) {
     case void 0:
     case "help":
       process.stdout.write(USAGE);
       return 0;
     case "doctor": {
+      const temp = await ensureTempDir().catch((e) => e instanceof PublisherError ? { error: e.message } : null);
       const git = await gitVersion().catch(() => null);
       const dir = dirArg(1);
       const s = credentialStatus(await resolutionInput(dir));
@@ -6542,6 +6887,7 @@ async function main(argv) {
         profiles: s.profiles,
         defaultProfile: s.defaultProfile,
         credentialsFile: credentialsPath(),
+        tempDir: temp,
         association: association === null ? null : { endpoint: association.endpoint, repoId: association.repoId },
         // Printed as it comes: `moved` carries where to, `unreachable` carries why, and the two
         // need different next steps so they are not collapsed into "not ok".
@@ -6561,48 +6907,8 @@ async function main(argv) {
       out({ ...result, next: { action: "reauthenticate", ask: null, command } });
       return 0;
     }
-    case "login": {
-      const portal = portalBase(process.env, str2(flags["portal"]));
-      const input = await resolutionInput();
-      const target = resolveLoginEndpoint(input);
-      const endpoint = "endpoint" in target ? target.endpoint : await discoverEndpoint(portal);
-      if (!endpoint) throw new PublisherError("INVALID_REQUEST", "login requires --endpoint (or --profile naming a stored one)");
-      const given = str2(flags["token"]) ?? process.env["GIT_PUBLISHER_TOKEN"];
-      const signIn = given ? null : await deviceLogin({
-        endpoint,
-        onPrompt: ({ userCode, verificationUri, expiresInSeconds }) => {
-          process.stderr.write(
-            `
-To sign in, open:
-  ${verificationUri}
-
-and confirm the code:
-  ${userCode}
-
-Waiting (it expires in ${Math.round(expiresInSeconds / 60)} minutes)...
-`
-          );
-        }
-      });
-      const token = given ?? signIn.token;
-      const p = createPublisher({ endpoint, token });
-      const caps = await verifiedCapabilities(p);
-      let profileFlag = str2(flags["profile"]);
-      if (!profileFlag && isInteractive({ json, isTTY: process.stdin.isTTY })) {
-        const suggested = suggestProfileName(endpoint, new Set(Object.keys(input.file.profiles)));
-        profileFlag = await askProfileName(endpoint, suggested) ?? void 0;
-      }
-      const path = await saveCredential(endpoint, token, void 0, {
-        ...profileFlag ? { profile: profileFlag } : {},
-        setDefault: flags["set-default"] === true,
-        // The refresh half, when the service issued one: the sign-in outlives the credential.
-        ...signIn ? { signIn } : {}
-      });
-      const file = await readCredentials();
-      const profile = profileForEndpoint(file, endpoint, profileFlag);
-      out({ ok: true, endpoint, profile, isDefault: profile !== null && file.defaultProfile === profile, server: caps.server, credentialsFile: path });
-      return 0;
-    }
+    case "login":
+      return login({ flags, json, out, log, input: await resolutionInput() });
     case "logout": {
       const profile = str2(flags["profile"]);
       const endpoint = str2(flags["endpoint"]) ?? process.env["GIT_PUBLISHER_ENDPOINT"];
@@ -6740,11 +7046,20 @@ Waiting (it expires in ${Math.round(expiresInSeconds / 60)} minutes)...
     case "sync": {
       const dir = dirArg(1);
       const timeoutMs = followTimeoutMs(str2(flags["timeout"]));
-      const { p, endpoint } = await client(dir);
+      const clock = stopwatch();
+      const { p, endpoint, source } = await client(dir);
+      clock.lap("discovery");
+      await resolveToken(endpoint, str2(flags["token"]), { endpointSource: source });
+      clock.lap("authentication");
       const linked = await isGitRepo(dir) && await readAssociation(dir) !== null ? null : await linkFolder(p, endpoint, dir, {});
-      const r = await p.syncChanges({ directory: dir, markConflicts: flags["mark-conflicts"] === true, ...optStr(flags, "message") }, { onProgress: progress });
+      clock.lap("link", linked !== null);
+      const sending = splitAtBegin(clock, progress);
+      const r = await p.syncChanges({ directory: dir, markConflicts: flags["mark-conflicts"] === true, ...optStr(flags, "message") }, { onProgress: sending.onProgress });
+      const acceptedAt = sending.done();
       const o = r.published;
       const followed = o !== null && o.state === "accepted" && flags["no-wait"] !== true ? await followPublication(p, endpoint, o, { ...following, timeoutMs, dir }) : null;
+      const syncTimings = clock.read(followed !== null && "stages" in followed ? runTimings(followed.stages, acceptedAt) : {});
+      log(timingsLine(syncTimings));
       out({
         ok: r.state === "published" || r.state === "up_to_date",
         state: r.state,
@@ -6762,7 +7077,8 @@ Waiting (it expires in ${Math.round(expiresInSeconds / 60)} minutes)...
           ...o.next === null ? {} : { next: o.next }
         },
         hint: syncHint(r.state, r.reconciled.before.conflicts, r.marked),
-        progress: followed
+        progress: followed,
+        timings: syncTimings
       });
       return r.state === "published" || r.state === "up_to_date" ? 0 : r.state === "unknown" ? 3 : 2;
     }
@@ -6783,7 +7099,11 @@ Waiting (it expires in ${Math.round(expiresInSeconds / 60)} minutes)...
       if (publication.state !== "accepted") {
         throw new PublisherError("LOCAL_STATE", `publication ${publicationId} is ${publication.state}, not accepted; run publisher status`);
       }
-      out({ publicationId, progress: await followPublication(p, endpoint, publication, { ...following, timeoutMs, dir }) });
+      const clock = stopwatch();
+      const followed = await followPublication(p, endpoint, publication, { ...following, timeoutMs, dir });
+      const timings = clock.read("stages" in followed ? runTimings(followed.stages, null) : {});
+      log(timingsLine(timings));
+      out({ publicationId, progress: followed, timings });
       return 0;
     }
     /**
@@ -6800,7 +7120,7 @@ Waiting (it expires in ${Math.round(expiresInSeconds / 60)} minutes)...
     }
     /** Answer it, as `question=value` pairs, re-reading the preparation first. */
     case "answer": {
-      const dir = (0, import_node_path8.resolve)(".");
+      const dir = (0, import_node_path9.resolve)(".");
       const { p, endpoint } = await client(dir);
       const repoId = str2(flags["repo"]) ?? (await readAssociation(dir))?.repoId;
       if (!repoId) throw new PublisherError("LOCAL_STATE", "no repository association; pass --repo");
@@ -6843,7 +7163,8 @@ ${USAGE}`);
       return 1;
   }
 }
-function demand(r, input) {
+var GIT_COMMANDS = /* @__PURE__ */ new Set(["init", "publish", "status", "fetch", "checkout", "workspace-status", "sync", "merge-check"]);
+async function demand(r, input) {
   if (r.kind === "resolved") return r;
   const next = nextStep(credentialStatus(input));
   const details = { profiles: r.kind === "none" ? [] : r.profiles, next };
@@ -6853,8 +7174,10 @@ function demand(r, input) {
       throw new PublisherError("LOCAL_STATE", `no such profile: ${r.name}.${run}`, { details });
     case "ambiguous":
       throw new PublisherError("LOCAL_STATE", `several connections and none is the default: pass --profile <name>, or choose one once.${run}`, { details });
-    case "none":
-      throw new PublisherError("LOCAL_STATE", `not connected to a publishing service yet.${run}`, { details });
+    case "none": {
+      const where = await whereCredentialsWere();
+      throw new PublisherError("LOCAL_STATE", `not connected to a publishing service yet: ${where.sentence}${run}`, { details: { ...details, credentialsFile: where.details } });
+    }
   }
 }
 function syncHint(state, conflicts, marked) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minnovate/shadow-publisher",
-  "version": "0.10.3",
+  "version": "0.11.1",
   "description": "publisher: publish an app's Git history to the serverless Git backend",
   "license": "Apache-2.0",
   "type": "module",