@mycadet/cli 0.12.10 → 0.12.11

package/src/commands/hatch.ts

@@ -10,7 +10,7 @@ import { green } from "../lib/color";
 import { HATCH_ART, HATCHED_EMOJI, VALID_REMOTE_HOSTS } from "../lib/constants";
 import type { RemoteHost } from "../lib/constants";
 import { hatchDocker } from "../lib/docker";
-import { parseFeatureFlagArgs, readAmbientFlagEnvVars } from "../lib/flag-args";
+import { readAmbientFlagEnvVars } from "../lib/flag-args";
 import { hatchLocal } from "../lib/hatch-local";
 import {
   getCloudUrl,
@@ -23,37 +23,26 @@ const DEFAULT_REMOTE: RemoteHost = "local";
 
 interface HatchArgs {
   verbose: boolean;
-  keepAlive: boolean;
   name: string | null;
   remote: RemoteHost;
   watch: boolean;
   sourcePath: string | null;
   configValues: Record<string, string>;
   flagEnvVars: Record<string, string>;
-  analyze: boolean;
-  disableCloud: boolean;
   netnsContainer: string | null;
   gatewayPort: number | null;
   assistantCaCert: string | null;
 }
 
 function parseArgs(): HatchArgs {
-  const { envVars: cliFlagVars, remaining: args } = parseFeatureFlagArgs(
-    process.argv.slice(3),
-  );
-  const flagEnvVars = { ...readAmbientFlagEnvVars(), ...cliFlagVars };
-  const disableCloudAmbient =
-    process.env.CADET_DISABLE_CLOUD?.trim().toLowerCase();
-  let disableCloud =
-    disableCloudAmbient === "true" || disableCloudAmbient === "1";
+  const args = process.argv.slice(3);
+  const flagEnvVars = readAmbientFlagEnvVars();
   let verbose = false;
-  let keepAlive = false;
   let name: string | null = null;
   let remote: RemoteHost = DEFAULT_REMOTE;
   let watch = false;
   let sourcePath: string | null = null;
   const configValues: Record<string, string> = {};
-  let analyze = false;
   let netnsContainer: string | null = null;
   let gatewayPort: number | null = null;
   let assistantCaCert: string | null = null;
@@ -69,47 +58,33 @@ function parseArgs(): HatchArgs {
       console.log(
         "  -v, --verbose             Show service startup logs and extended next steps",
       );
-      console.log("  --name <name>             Custom instance name");
+      console.log("  --name <name>             Custom name for this assistant");
       console.log(
         "  --remote <host>           Remote host (local, docker, custom, cloud)",
       );
       console.log(
-        "  --watch                   Run assistant and gateway in watch mode (hot reload on source changes)",
-      );
-      console.log(
-        "  --source <path>           Build images from a local source tree at <path>. Useful for callers that want each run to pick up local CLI changes.",
+        "  --watch                   Run Cadet in watch mode with hot reload on source changes",
       );
       console.log(
-        "  --keep-alive              Stay alive after hatch, exit when gateway stops",
+        "  --source <path>           Build images from a local source tree at <path>",
       );
       console.log(
         "  --config <key=value>      Set a workspace config value (repeatable)",
       );
       console.log(
-        "  --flag <key=value>        Set a feature flag override as CADET_FLAG_<KEY> env var (repeatable)",
+        "  --netns-container <name>  Join an existing container's network namespace instead of creating a per-instance network.",
       );
       console.log(
-        "  --analyze                 Emit a structured hatch-timing log line on stdout",
+        "  --gateway-port <port>     Use an explicit host port for accessing the assistant.",
       );
       console.log(
-        "  --disable-cloud        Suppress all outbound platform API calls",
-      );
-      console.log(
-        "  --netns-container <name>  Join an existing container's network namespace (docker target only) instead of creating a per-instance network. The namespace owner publishes host ports, so --gateway-port is required.",
-      );
-      console.log(
-        "  --gateway-port <port>     Use an explicit host port for the gateway runtime URL instead of auto-allocating. Required with --netns-container.",
-      );
-      console.log(
-        "  --assistant-ca-cert <path>  Trust an extra PEM CA bundle in the assistant container (NODE_EXTRA_CA_CERTS) from process start. Useful behind a TLS-terminating egress proxy.",
+        "  --assistant-ca-cert <path>  Trust an extra PEM CA bundle in the assistant container from process start.",
       );
       process.exit(0);
     } else if (arg === "-v" || arg == "--verbose") {
       verbose = true;
     } else if (arg === "--watch") {
       watch = true;
-    } else if (arg === "--analyze") {
-      analyze = true;
     } else if (arg === "--source") {
       const next = args[i + 1];
       if (!next || next.startsWith("-")) {
@@ -118,8 +93,6 @@ function parseArgs(): HatchArgs {
       }
       sourcePath = next;
       i++;
-    } else if (arg === "--keep-alive") {
-      keepAlive = true;
     } else if (arg === "--name") {
       const next = args[i + 1];
       if (!next || next.startsWith("-")) {
@@ -163,8 +136,6 @@ function parseArgs(): HatchArgs {
       const value = next.slice(eqIndex + 1);
       configValues[key] = value;
       i++;
-    } else if (arg === "--disable-cloud") {
-      disableCloud = true;
     } else if (arg === "--netns-container") {
       const next = args[i + 1];
       if (!next || next.startsWith("-")) {
@@ -194,7 +165,7 @@ function parseArgs(): HatchArgs {
       i++;
     } else {
       console.error(
-        `Error: Unknown argument '${arg}'. Valid options: -v, --verbose, --watch, --source <path>, --keep-alive, --name <name>, --remote <${VALID_REMOTE_HOSTS.join("|")}>, --config <key=value>, --flag <key=value>, --analyze, --disable-cloud, --netns-container <name>, --gateway-port <port>, --assistant-ca-cert <path>`,
+        `Error: Unknown argument '${arg}'. Valid options: -v, --verbose, --watch, --source <path>, --name <name>, --remote <${VALID_REMOTE_HOSTS.join("|")}>, --config <key=value>, --netns-container <name>, --gateway-port <port>, --assistant-ca-cert <path>`,
       );
       process.exit(1);
     }
@@ -202,15 +173,12 @@ function parseArgs(): HatchArgs {
 
   return {
     verbose,
-    keepAlive,
     name,
     remote,
     watch,
     sourcePath,
     configValues,
     flagEnvVars,
-    analyze,
-    disableCloud,
     netnsContainer,
     gatewayPort,
     assistantCaCert,
@@ -230,25 +198,17 @@ export const hatch = Object.assign(
 
   const {
     verbose,
-    keepAlive,
     name,
     remote,
     watch,
     sourcePath,
     configValues,
     flagEnvVars,
-    analyze,
-    disableCloud,
     netnsContainer,
     gatewayPort,
     assistantCaCert,
   } = parseArgs();
 
-  if (disableCloud) {
-    process.env.CADET_DISABLE_CLOUD = "true";
-    flagEnvVars.CADET_DISABLE_CLOUD = "true";
-  }
-
   if (watch && remote !== "local" && remote !== "docker") {
     console.error(
       "Error: --watch is only supported for local and docker hatch targets.",
@@ -286,7 +246,6 @@ export const hatch = Object.assign(
     await hatchLocal({
       name,
       watch,
-      keepAlive,
       configValues,
       flagEnvVars,
       verbose,
@@ -301,7 +260,6 @@ export const hatch = Object.assign(
       configValues,
       flagEnvVars,
       sourcePath,
-      analyze,
       netnsContainer: netnsContainer ?? undefined,
       gatewayPort: gatewayPort ?? undefined,
       assistantCaCertPath: assistantCaCert ?? undefined,

package/src/commands/pair.ts

@@ -586,6 +586,10 @@ export const pair = Object.assign(
     console.log(qr);
   });
   console.log("");
+  console.log("Or enter this code on the pairing page:");
+  console.log("");
+  console.log(`  ${challenge.deviceCode}`);
+  console.log("");
   if (appUrl) {
     console.log("The QR opens the Cadet app. App link:");
     console.log("");
@@ -598,7 +602,9 @@ export const pair = Object.assign(
   console.log("");
   console.log(`  ${pairUrl}`);
   console.log("");
-  console.log(`On another computer, run:  cadet connect import "${pairUrl}"`);
+  console.log("Or on another computer, run:");
+  console.log("");
+  console.log(`  cadet connect import "${pairUrl}"`);
   console.log("");
   console.log(`Expires: ${challenge.expiresAt}`);
 },

package/src/commands/ps.ts

@@ -1,3 +1,4 @@
+import { getNginxIngressPort } from "../lib/nginx-ingress.js";
 import { isCloudHome } from "../lib/cloud-values.js";
 import { join } from "path";
 
@@ -649,10 +650,10 @@ async function getRootManagedRows(): Promise<RootManagedRow[]> {
     rows.push({
       assistantId: app.assistantId,
       row: {
-        name: "nginx edge",
+        name: "nginx",
         type: APP_TYPE,
         status: withStatusEmoji(alive ? "running" : "not running"),
-        info: alive ? `PID ${app.pid}` : `PID ${app.pid} (exited)`,
+        info: `port ${app.port ?? getNginxIngressPort()}, PID ${app.pid}${alive ? "" : " (exited)"}`,
       },
     });
   }
@@ -813,6 +814,7 @@ export async function listAllAssistants(verbose: boolean): Promise<void> {
     ),
     { name: "NAME", type: "TYPE", status: "STATUS", info: "INFO" },
   );
+  console.log("");
 }
 
 // ── Entry point ─────────────────────────────────────────────────

package/src/commands/tunnel.ts

@@ -10,6 +10,7 @@ import {
 import {
   formatAssistantReference,
   loadAllAssistants,
+  readRootProcesses,
   resolveTargetAssistant,
   type AssistantEntry,
 } from "../lib/assistant-config";
@@ -37,6 +38,8 @@ import {
   hasWebhookIntegrationsConfigured,
   providerSupportsReservedDomain,
   runProviderTunnel,
+  stopTunnelProcess,
+  summarizeStartupFailure,
 } from "../lib/tunnel.js";
 
 // The accepted `--provider` values ARE the shared registry, so validation
@@ -63,7 +66,7 @@ function parseArgs(): TunnelArgs {
     const arg = args[i];
     if (arg === "--help" || arg === "-h") {
       console.log(
-        "Usage: cadet tunnel [<name>] --provider <provider> [options]",
+        "Usage: cadet tunnel [<name>] --provider <provider> [options]\n       cadet tunnel stop [<name>]",
       );
       console.log("");
       console.log("Front a locally running assistant with an HTTPS tunnel.");
@@ -121,7 +124,7 @@ function parseArgs(): TunnelArgs {
         `                                URL, and logs stream to tunnel.log in the CLI log directory. A background`,
       );
       console.log(
-        "                                tunnel stops with `kill <pid>`, except when it adopted an already-running",
+        "                                tunnel stops with `cadet tunnel stop`, except when it adopted an already-running",
       );
       console.log(
         "                                tunnel (started outside this command): killing the supervisor then",
@@ -394,9 +397,17 @@ async function spawnDetachedTunnel(): Promise<void> {
   });
 
   if (exitCode !== undefined) {
+    let logText = "";
+    try {
+      logText = readFileSync(logPath, "utf-8");
+    } catch {
+      // Log file not readable — the summary falls back to none.
+    }
+    const reason = summarizeStartupFailure(logText);
     console.error(
-      `Error: tunnel process exited during startup${exitCode !== null ? ` (exit code ${exitCode})` : ""}. Logs: ${logPath}`,
+      `Error (${exitCode ?? "unknown"}): tunnel process exited during startup${reason ? `: ${reason}` : "."}`,
     );
+    console.error(`Logs: ${logPath}`);
     process.exit(1);
   }
 
@@ -411,12 +422,40 @@ async function spawnDetachedTunnel(): Promise<void> {
   if (adopted) {
     console.log(adoptedTunnelStopNotice(child.pid));
   } else {
-    console.log(`Stop with: kill ${child.pid}`);
+    console.log("Stop with: cadet tunnel stop");
   }
 }
 
 export const tunnel = Object.assign(
   async function tunnel(): Promise<void> {
+    if (process.argv[3] === "stop") {
+      const args = process.argv.slice(4);
+      if (args.includes("--help") || args.includes("-h")) {
+        console.log("Usage: cadet tunnel stop [<name>]");
+        console.log(
+          "Stop the recorded Cadet-managed tunnel, keeping nginx and the saved domain.",
+        );
+        return;
+      }
+      if (args.some((arg) => arg.startsWith("-")))
+        throw new Error("Usage: cadet tunnel stop [<name>]");
+      const { entry, workspaceDir } = resolveLocalTunnelTarget(
+        args.join(" ") || null,
+      );
+      if (!readRootProcesses().tunnel) {
+        console.log(
+          "No Cadet-managed tunnel is recorded. Externally started tunnels must be stopped directly.",
+        );
+        return;
+      }
+      const stopped = await stopTunnelProcess(entry.assistantId, workspaceDir);
+      console.log(
+        stopped
+          ? "Tunnel stopped. nginx and the saved domain are unchanged."
+          : "No running tunnel found; cleared stale tunnel state.",
+      );
+      return;
+    }
     const { assistantName, provider, domain, clearDomain, foreground } =
       parseArgs();
 

package/src/commands/upgrade.ts

@@ -76,7 +76,10 @@ import {
   startLocalDaemon,
   stopLocalProcesses,
 } from "../lib/local.js";
-import { restoreTunnelEdgeAndAutoTunnel } from "../lib/tunnel.js";
+import {
+  restoreContainerTunnelEdge,
+  restoreTunnelEdgeAndAutoTunnel,
+} from "../lib/tunnel.js";
 import {
   leaseGuardianToken,
   resetGuardianBootstrap,
@@ -516,6 +519,8 @@ async function upgradeDocker(
       preUpgradeBackupPath: backupPath ?? undefined,
     };
     saveAssistantEntry(updatedEntry);
+    // Refresh the host-served web bundle before clients reload on completion.
+    await restoreContainerTunnelEdge(updatedEntry);
 
     // Notify clients on the new service group that the upgrade succeeded.
     await broadcastUpgradeEvent(

package/src/lib/assistant-config.ts

@@ -170,6 +170,10 @@ export interface RootProcessRecord {
   /** The assistant the process fronts, so `cadet ps` can nest the row. */
   assistantId?: string;
   startedAt: string;
+  /** Listening port for the nginx edge. */
+  port?: number;
+  /** Managed process temporarily displaced by a pairing-only tunnel. */
+  previous?: RootProcessRecord;
 }
 
 export type RootProcessKind = "tunnel" | "app";
@@ -247,12 +251,21 @@ export function stampRootProcess(
   });
 }
 
-/** Drop the recorded root process entry, e.g. once the process is stopped. */
-export function clearRootProcess(kind: RootProcessKind): void {
+/** Release a recorded process, preserving a replacement or restoring a displaced record. */
+export function clearRootProcess(
+  kind: RootProcessKind,
+  expectedPid?: number,
+): void {
   withCliLockfileLock(() => {
     const data = readLockfile();
-    if (data[kind] === undefined) return;
-    delete data[kind];
+    const record = data[kind];
+    if (
+      record === undefined ||
+      (expectedPid !== undefined && record.pid !== expectedPid)
+    )
+      return;
+    if (record.previous) data[kind] = record.previous;
+    else delete data[kind];
     writeLockfileUnlocked(data);
   });
 }
@@ -442,7 +455,9 @@ export function loadLatestAssistant(): AssistantEntry | null {
 }
 
 export function findAssistantByName(name: string): AssistantEntry | null {
-  return loadAllAssistants().find((entry) => entry.assistantId === name) ?? null;
+  return (
+    loadAllAssistants().find((entry) => entry.assistantId === name) ?? null
+  );
 }
 
 export function getAssistantDisplayName(entry: AssistantEntry): string {

package/src/lib/cloud-login-poll.ts

@@ -0,0 +1,75 @@
+import { z } from "zod";
+import { loopbackSafeFetch } from "./loopback-fetch.js";
+
+const requestSchema = z.object({
+  request_id: z.string().regex(/^[a-f0-9]{64}$/),
+  poll_secret: z.string().regex(/^[a-f0-9]{64}$/),
+  verification_uri: z.string().url(),
+  user_code: z.string().min(1),
+  interval: z.number().min(1).max(10),
+});
+const resultSchema = z.object({ session_token: z.string().min(1) });
+
+/** Browser approval and polling work when the terminal and browser are on different hosts. */
+export async function pollingCloudLogin(
+  cloudUrl: string,
+  options: {
+    timeoutMs?: number;
+    fetch?: (
+      input: string | URL | Request,
+      init?: RequestInit,
+    ) => Promise<Response>;
+    log?: (message: string) => void;
+  } = {},
+): Promise<string> {
+  const request = options.fetch ?? loopbackSafeFetch;
+  const log = options.log ?? console.log;
+  const signal = AbortSignal.timeout(options.timeoutMs ?? 300_000);
+  const origin = new URL(cloudUrl).origin;
+  try {
+    const started = await request(`${origin}/v1/auth/cli/start`, {
+      method: "POST",
+      signal,
+    });
+    if (!started.ok)
+      throw new Error(`Could not start terminal login (${started.status}).`);
+    const login = requestSchema.parse(await started.json());
+    log(`Open this URL to log in: ${login.verification_uri}`);
+    log(
+      `Confirm code ${login.user_code} in your browser. Waiting up to 5 minutes...`,
+    );
+    while (!signal.aborted) {
+      const response = await request(`${origin}/v1/auth/cli/poll`, {
+        method: "POST",
+        signal,
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          request_id: login.request_id,
+          poll_secret: login.poll_secret,
+        }),
+      });
+      if (response.status === 200)
+        return resultSchema.parse(await response.json()).session_token;
+      if (response.status === 410)
+        throw new Error("Login request expired. Run cadet login again.");
+      if (response.status !== 202)
+        throw new Error(`Login polling failed (${response.status}).`);
+      await new Promise<void>((resolve, reject) => {
+        const abort = () => {
+          clearTimeout(timer);
+          reject(new Error("Login timed out after 5 minutes."));
+        };
+        const timer = setTimeout(() => {
+          signal.removeEventListener("abort", abort);
+          resolve();
+        }, login.interval * 1000);
+        signal.addEventListener("abort", abort, { once: true });
+        if (signal.aborted) abort();
+      });
+    }
+    throw new Error("Login timed out after 5 minutes.");
+  } catch (error) {
+    if (signal.aborted) throw new Error("Login timed out after 5 minutes.");
+    throw error;
+  }
+}

package/src/lib/cloud-login.ts

@@ -6,6 +6,7 @@
  * login when the user picks that provider).
  */
 
+import { pollingCloudLogin } from "./cloud-login-poll.js";
 import { randomBytes } from "crypto";
 import { createServer } from "http";
 import type { AddressInfo } from "net";
@@ -37,7 +38,7 @@ import {
   generatePkcePair,
 } from "./workos-pkce.js";
 
-const LOGIN_TIMEOUT_MS = 120_000; // 2 minutes
+const LOGIN_TIMEOUT_MS = 300_000;
 
 function escapeHtml(s: string): string {
   return s
@@ -258,6 +259,7 @@ export function startLoopbackListener(
 
 /** App-held WorkOS PKCE login */
 export async function workosPkceLogin(cloudUrl: string): Promise<string> {
+  if (!process.stdin.isTTY) return pollingCloudLogin(cloudUrl);
   const clientId = await fetchWorkosClientId(cloudUrl);
   const { verifier, challenge } = generatePkcePair();
   const state = randomBytes(32).toString("hex");

package/src/lib/docker.ts

@@ -305,7 +305,6 @@ export interface HatchDockerParams {
    * also enables hot-reload.
    */
   sourcePath?: string | null;
-  analyze?: boolean;
   /**
    * Name of an existing container whose network namespace the assistant,
    * gateway, and credential-executor join (`--network=container:<name>`),
@@ -1719,7 +1718,6 @@ export async function hatchDocker(params: HatchDockerParams): Promise<void> {
         logFd,
         runtimeUrl,
         containersUpAt,
-        analyze: params.analyze ?? false,
       });
 
     if (!ready && !(watch && repoRoot)) {
@@ -1828,7 +1826,6 @@ async function waitForGatewayAndLease(opts: {
   logFd: number | "ignore";
   runtimeUrl: string;
   containersUpAt: number;
-  analyze: boolean;
 }): Promise<{
   ready: boolean;
   guardianAccessToken?: string;
@@ -1844,7 +1841,6 @@ async function waitForGatewayAndLease(opts: {
     logFd,
     runtimeUrl,
     containersUpAt,
-    analyze,
   } = opts;
 
   const log = (msg: string): void => {
@@ -1964,14 +1960,12 @@ async function waitForGatewayAndLease(opts: {
   const containersUpToReadyMs = readyAt - start;
   const elapsedSec = (containersUpToReadyMs / 1000).toFixed(1);
   log(`Assistant ready after ${elapsedSec}s`);
-  if (analyze) {
-    console.info(
-      `[cadet-hatch-timing] ${JSON.stringify({
-        containers_up_to_ready_ms: containersUpToReadyMs,
-        instance: instanceName,
-      })}`,
-    );
-  }
+  console.info(
+    `[cadet-hatch-timing] ${JSON.stringify({
+      containers_up_to_ready_ms: containersUpToReadyMs,
+      instance: instanceName,
+    })}`,
+  );
 
   // Lease guardian token. The /readyz check confirms both gateway and
   // assistant are reachable. Retry with backoff in case there is a brief

package/src/lib/ensure-binary.ts

@@ -31,6 +31,8 @@ export interface EnsureBinaryOptions {
   runInstall?: (argv: string[]) => boolean;
   /** Confirm the install. Default: promptLine "[Y/n]" on Enter-as-yes. */
   confirmInstall?: () => Promise<boolean>;
+  platform?: NodeJS.Platform;
+  confirmHomebrewInstall?: () => Promise<boolean>;
   streams?: {
     input?: NodeJS.ReadStream | Readable;
     output?: NodeJS.WriteStream | Writable;
@@ -69,9 +71,60 @@ export async function ensureBinaryInstalled(
   }
 
   const pmAvailable = opts.pmAvailable ?? probePackageManager;
-  const argv = Object.entries(opts.packages).find(([pm]) =>
-    pmAvailable(pm),
-  )?.[1];
+  let argv = Object.entries(opts.packages).find(([pm]) => pmAvailable(pm))?.[1];
+  if (
+    !argv &&
+    (opts.platform ?? process.platform) === "darwin" &&
+    opts.packages.brew
+  ) {
+    const brew = ["/opt/homebrew/bin/brew", "/usr/local/bin/brew"].find(
+      pmAvailable,
+    );
+    if (brew) {
+      const prefix = brew.slice(0, -"/bin/brew".length);
+      process.env.PATH = `${prefix}/bin:${prefix}/sbin:${process.env.PATH ?? ""}`;
+      argv = [brew, ...opts.packages.brew.slice(1)];
+    }
+  }
+  if (
+    !argv &&
+    (opts.platform ?? process.platform) === "darwin" &&
+    opts.packages.brew
+  ) {
+    output.write(
+      "Homebrew is required to install this dependency, but it isn't installed.\n",
+    );
+    const confirmHomebrew =
+      opts.confirmHomebrewInstall ?? defaultConfirm(opts, "Homebrew");
+    let approved = false;
+    try {
+      approved = await confirmHomebrew();
+    } catch {
+      /* No interactive approval. */
+    }
+    if (approved) {
+      const bootstrap = [
+        "/bin/bash",
+        "-c",
+        '/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/7a3f48c7e498d7df3237fd41c30f4d492857edf4/install.sh)"',
+      ];
+      const installed = opts.runInstall
+        ? opts.runInstall(bootstrap)
+        : runInstallArgv(bootstrap);
+      const brew = installed
+        ? ["brew", "/opt/homebrew/bin/brew", "/usr/local/bin/brew"].find(
+            pmAvailable,
+          )
+        : undefined;
+      if (brew) {
+        const prefix =
+          brew === "brew" ? "" : brew.slice(0, -"/bin/brew".length);
+        if (prefix)
+          process.env.PATH = `${prefix}/bin:${prefix}/sbin:${process.env.PATH ?? ""}`;
+        argv = [brew, ...opts.packages.brew.slice(1)];
+      }
+    }
+  }
   if (!argv) {
     output.write(`⚠ No supported package manager found. ${opts.manualHint}\n`);
     return null;
@@ -90,7 +143,10 @@ export async function ensureBinaryInstalled(
 }
 
 /** Default confirm: visible prompt, Enter = yes, non-TTY throws. */
-function defaultConfirm(opts: EnsureBinaryOptions): () => Promise<boolean> {
+function defaultConfirm(
+  opts: EnsureBinaryOptions,
+  binary = opts.binary,
+): () => Promise<boolean> {
   return async () => {
     const input = opts.streams?.input ?? process.stdin;
     const output = opts.streams?.output ?? process.stdout;
@@ -99,7 +155,7 @@ function defaultConfirm(opts: EnsureBinaryOptions): () => Promise<boolean> {
       throw new Error("Install confirm requires an interactive terminal.");
     }
     const answer = (
-      await readLineText(`Install ${opts.binary} now? [Y/n] `, {
+      await readLineText(`Install ${binary} now? [Y/n] `, {
         input,
         output,
       })
@@ -114,7 +170,10 @@ function defaultConfirm(opts: EnsureBinaryOptions): () => Promise<boolean> {
 function runInstallArgv(argv: string[]): boolean {
   const [command, ...args] = argv;
   if (!command) return false;
-  const result = spawnSync(command, args, { stdio: "inherit" });
+  const result = spawnSync(command, args, {
+    stdio: "inherit",
+    windowsHide: true,
+  });
   return !result.error && result.status === 0;
 }