@pikku/cli 0.12.153 → 0.12.155

package/dist/src/fabric/functions/publish.function.js

@@ -6,6 +6,7 @@ import { tmpdir } from 'node:os';
 import { execFileSync } from 'node:child_process';
 import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext } from '../lib/config.js';
+import { FabricPreconditionError } from '../lib/errors.js';
 export const FabricPublishInput = z.object({
     dir: z.string().optional(),
     apiUrl: z.string().optional(),
@@ -33,18 +34,18 @@ export const FabricPublish = pikkuSessionlessFunc({
         const verification = await rpc.invoke('FabricAddonVerify', { dir });
         await cli?.channel.send(verification);
         if (!verification.ok) {
-            throw new Error('Addon verification failed — fix the errors above before publishing.');
+            throw new FabricPreconditionError('Addon verification failed — fix the errors above before publishing.');
         }
         const ctx = await resolveApiContext({ apiUrlOverride });
         if (!ctx.token)
-            throw new Error('Not logged in. Run `pikku fabric login` first.');
+            throw new FabricPreconditionError('Not logged in. Run `pikku fabric login` first.');
         const packageDir = dir ?? process.cwd();
         const pkgPath = join(packageDir, 'package.json');
         if (!existsSync(pkgPath))
-            throw new Error(`No package.json found in ${packageDir}`);
+            throw new FabricPreconditionError(`No package.json found in ${packageDir}`);
         const pkg = JSON.parse(await readFile(pkgPath, 'utf8'));
         if (!pkg.name || !pkg.version)
-            throw new Error('package.json must have a name and version');
+            throw new FabricPreconditionError('package.json must have a name and version');
         // Pack via `npm pack` so the artifact honours the package's `files` field
         // (ship src/.pikku/types, not build/VCS noise) and matches the layout a
         // normal install produces. npm nests contents under `package/`; the
@@ -65,7 +66,7 @@ export const FabricPublish = pikkuSessionlessFunc({
                 body: JSON.stringify(body),
             });
             if (!r.ok)
-                throw new Error(`POST ${path} → ${r.status}: ${await r.text()}`);
+                throw new FabricPreconditionError(`POST ${path} → ${r.status}: ${await r.text()}`);
             return r.json();
         };
         // 1. presigned upload URL (short-lived)
@@ -74,7 +75,7 @@ export const FabricPublish = pikkuSessionlessFunc({
         //    is signed over host only; mismatched headers break the signature).
         const put = await fetch(uploadUrl, { method: 'PUT', body: artifact });
         if (!put.ok)
-            throw new Error(`upload failed → ${put.status}: ${await put.text()}`);
+            throw new FabricPreconditionError(`upload failed → ${put.status}: ${await put.text()}`);
         // 3. finalize — server reads the artifact back, extracts meta, indexes it
         const entry = await post('/registry/addons/publish', { artifactKey });
         const publisher = entry.publisher?.name ?? null;

package/dist/src/fabric/functions/report.function.js

@@ -4,6 +4,7 @@ import { resolveApiContext } from '../lib/config.js';
 import { collectReportEnvironment } from '../lib/report-environment.js';
 import { FindingInput, buildFindingPayload, parseFinding, parseFindingJson, postFinding, renderReceipt, validateFinding, } from '../lib/finding.js';
 import { flushSpool, readSpool, spoolFinding } from '../lib/finding-spool.js';
+import { FabricPreconditionError } from '../lib/errors.js';
 /**
  * Every field is optional here and the strictness lives in `FindingInput`,
  * because `--stdin` supplies the whole finding at once and the flags then
@@ -21,7 +22,7 @@ export const FabricReportOutput = z.object({
 });
 const readStdin = async () => {
     if (process.stdin.isTTY) {
-        throw new Error('--stdin expects the finding as JSON on standard input, and nothing was piped in.');
+        throw new FabricPreconditionError('--stdin expects the finding as JSON on standard input, and nothing was piped in.');
     }
     const chunks = [];
     for await (const chunk of process.stdin)
@@ -49,11 +50,11 @@ export const FabricReport = pikkuSessionlessFunc({
             ? parseFindingJson(await readStdin())
             : parseFinding(flags);
         if ('problems' in parsed) {
-            throw new Error(parsed.problems.join('\n'));
+            throw new FabricPreconditionError(parsed.problems.join('\n'));
         }
         const problems = validateFinding(parsed.finding);
         if (problems.length > 0) {
-            throw new Error(problems.join('\n'));
+            throw new FabricPreconditionError(problems.join('\n'));
         }
         const payload = buildFindingPayload(parsed.finding, await collectReportEnvironment());
         console.log(renderReceipt(payload));

package/dist/src/fabric/functions/rollback.function.js

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
+import { FabricPreconditionError } from '../lib/errors.js';
 export const FabricRollbackInput = z.object({
     branch: z.string(),
     target: z.string().optional(),
@@ -29,9 +30,9 @@ export const FabricRollback = pikkuSessionlessFunc({
     func: async (_services, { target, list, dryRun }) => {
         const ctx = await resolveApiContext();
         if (!ctx.token)
-            throw new Error('Not logged in. Run `pikku fabric login` first.');
+            throw new FabricPreconditionError('Not logged in. Run `pikku fabric login` first.');
         if (!ctx.projectId)
-            throw new Error('No fabric project linked. Run `pikku fabric link` first.');
+            throw new FabricPreconditionError('No fabric project linked. Run `pikku fabric link` first.');
         const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
         // --list (or no target) → just show candidates.
         if (list || !target) {

package/dist/src/fabric/functions/secrets-delete.function.js

@@ -4,6 +4,7 @@ import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
 import { promptConfirm } from '../lib/prompt.js';
 import { resolveStage } from '../lib/stage.js';
+import { FabricPreconditionError } from '../lib/errors.js';
 export const FabricSecretsDeleteInput = z.object({
     name: z.string(),
     branch: z.string().optional(),
@@ -21,21 +22,21 @@ export const FabricSecretsDelete = pikkuSessionlessFunc({
     func: async (_services, { name, branch: requested, force }) => {
         const ctx = await resolveApiContext();
         if (!ctx.token)
-            throw new Error('Not logged in. Run `pikku fabric login` first.');
+            throw new FabricPreconditionError('Not logged in. Run `pikku fabric login` first.');
         if (!ctx.projectId)
-            throw new Error('No fabric project linked. Run `pikku fabric link` first.');
+            throw new FabricPreconditionError('No fabric project linked. Run `pikku fabric link` first.');
         // Resolved before the prompt so the confirmation names the stage that
         // would actually lose the secret, not an argument that may be absent.
         const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
         const { stageId, branch } = await resolveStage(rpc, ctx.projectId, requested);
         if (!force) {
             if (!process.stdin.isTTY) {
-                throw new Error(`Refusing to delete ${name} from ${branch} without confirmation — re-run with --force to delete non-interactively.`);
+                throw new FabricPreconditionError(`Refusing to delete ${name} from ${branch} without confirmation — re-run with --force to delete non-interactively.`);
             }
             // Fabric cannot read the sealed value back, so this is not recoverable
             // by re-reading it — the plaintext has to be supplied again.
             if (!(await promptConfirm(`Delete ${name} from ${branch}? It cannot be recovered — the value must be set again.`))) {
-                throw new Error('Delete aborted.');
+                throw new FabricPreconditionError('Delete aborted.');
             }
         }
         const result = await rpc.invoke('deleteStageSecret', { stageId, name });

package/dist/src/fabric/functions/secrets-list.function.js

@@ -3,6 +3,7 @@ import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
 import { resolveStage } from '../lib/stage.js';
+import { FabricPreconditionError } from '../lib/errors.js';
 export const FabricSecretsListInput = z.object({
     branch: z.string().optional(),
     json: z.boolean().optional(),
@@ -17,9 +18,9 @@ export const FabricSecretsList = pikkuSessionlessFunc({
     func: async (_services, { branch: requested, json }) => {
         const ctx = await resolveApiContext();
         if (!ctx.token)
-            throw new Error('Not logged in. Run `pikku fabric login` first.');
+            throw new FabricPreconditionError('Not logged in. Run `pikku fabric login` first.');
         if (!ctx.projectId)
-            throw new Error('No fabric project linked. Run `pikku fabric link` first.');
+            throw new FabricPreconditionError('No fabric project linked. Run `pikku fabric link` first.');
         const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
         const { stageId, branch } = await resolveStage(rpc, ctx.projectId, requested);
         const result = await rpc.invoke('listStageSecretNames', { stageId });

package/dist/src/fabric/functions/secrets-rotate.function.js

@@ -3,6 +3,7 @@ import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
 import { resolveStage } from '../lib/stage.js';
+import { FabricPreconditionError } from '../lib/errors.js';
 export const FabricSecretsRotateInput = z.object({
     branch: z.string().optional(),
     force: z.boolean().optional(),
@@ -17,9 +18,9 @@ export const FabricSecretsRotate = pikkuSessionlessFunc({
     func: async (_services, { branch: requested, force }) => {
         const ctx = await resolveApiContext();
         if (!ctx.token)
-            throw new Error('Not logged in. Run `pikku fabric login` first.');
+            throw new FabricPreconditionError('Not logged in. Run `pikku fabric login` first.');
         if (!ctx.projectId)
-            throw new Error('No fabric project linked. Run `pikku fabric link` first.');
+            throw new FabricPreconditionError('No fabric project linked. Run `pikku fabric link` first.');
         // Resolved before the refusal, so the one message standing between a
         // typo and unreadable secrets names the stage that would actually be
         // rotated rather than echoing an argument that may not have been passed.
@@ -29,7 +30,7 @@ export const FabricSecretsRotate = pikkuSessionlessFunc({
             // Not a confirmation for politeness — this is the one operation here
             // that destroys access to data. Fabric cannot read the sealed values, so
             // it cannot carry them over, and nobody can undo it afterwards.
-            throw new Error(`Rotating the sealing key on ${branch} makes every secret already set on it unreadable — fabric cannot re-seal values it cannot open, so each one must be set again after the next deploy. Re-run with --force if that is what you want.`);
+            throw new FabricPreconditionError(`Rotating the sealing key on ${branch} makes every secret already set on it unreadable — fabric cannot re-seal values it cannot open, so each one must be set again after the next deploy. Re-run with --force if that is what you want.`);
         }
         const result = await rpc.invoke('rotateStageSealingKey', { stageId });
         console.log(`[fabric] retired sealing key ${result.retiredKeyId} on ${branch}`);

package/dist/src/fabric/functions/secrets-set.function.js

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
+import { FabricPreconditionError } from '../lib/errors.js';
 import { promptSecret } from '../lib/prompt.js';
 import { resolveStage } from '../lib/stage.js';
 import { seal, serializeSealedValue } from '../lib/sealed-box.js';
@@ -22,12 +23,18 @@ export const FabricSecretsSet = pikkuSessionlessFunc({
     func: async (_services, { name, branch: requested, value }) => {
         const ctx = await resolveApiContext();
         if (!ctx.token)
-            throw new Error('Not logged in. Run `pikku fabric login` first.');
+            throw new FabricPreconditionError('Not logged in. Run `pikku fabric login` first.');
         if (!ctx.projectId)
-            throw new Error('No fabric project linked. Run `pikku fabric link` first.');
-        const plaintext = value ?? (await promptSecret(`${name} value`));
+            throw new FabricPreconditionError('No fabric project linked. Run `pikku fabric link` first.');
+        // A value on the command line wins; otherwise the prompt, which reads
+        // piped stdin when there is no tty rather than waiting for a human who is
+        // not there. Both paths are scriptable, so neither can hang a CI job.
+        const plaintext = value ??
+            (await promptSecret(`${name} value`, {
+                nonInteractiveHint: `Pass the value with \`--value\`, or pipe it: \`echo '<value>' | pikku fabric secrets set ${name}\`.`,
+            }));
         if (!plaintext)
-            throw new Error('Empty secret value — aborting.');
+            throw new FabricPreconditionError('Empty secret value — aborting.');
         const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
         const { stageId, branch } = await resolveStage(rpc, ctx.projectId, requested);
         // Fabric holds only the public half of this keypair. The private half went

package/dist/src/fabric/functions/smoke.function.js

@@ -11,6 +11,7 @@ import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { findProjectRoot, readJsonSafe, } from '../../functions/validate/validate.js';
 import { headSha, isWorkingTreeClean } from '../lib/git.js';
 import { added, changed, dim, removed } from '../lib/output.js';
+import { FabricPreconditionError } from '../lib/errors.js';
 const DEFAULT_BUN_VERSION = 'bun@1.4.0';
 const DEFAULT_STEP_TIMEOUT_SECONDS = 300;
 const DEFAULT_STARTUP_TIMEOUT_SECONDS = 60;
@@ -146,7 +147,7 @@ async function waitForHealth(args) {
 }
 function rewriteFrontendCommand(command) {
     if (command.length === 0) {
-        throw new Error('frontend dev.command must not be empty');
+        throw new FabricPreconditionError('frontend dev.command must not be empty');
     }
     if (command[0] === 'yarn') {
         return {
@@ -461,7 +462,7 @@ async function createTempWorktree(root) {
         timeoutMs: 60_000,
     });
     if (!cloneStep.ok) {
-        throw new Error(`Failed to create temp checkout.\nworktree: ${step.tail || 'git worktree add failed.'}\nclone: ${cloneStep.tail || 'git clone failed.'}`);
+        throw new FabricPreconditionError(`Failed to create temp checkout.\nworktree: ${step.tail || 'git worktree add failed.'}\nclone: ${cloneStep.tail || 'git clone failed.'}`);
     }
     const detachStep = await runCommandStep({
         name: 'git checkout --detach',
@@ -471,7 +472,7 @@ async function createTempWorktree(root) {
         timeoutMs: 60_000,
     });
     if (!detachStep.ok) {
-        throw new Error(`Failed to detach temp checkout.\n${detachStep.tail || 'git checkout --detach failed.'}`);
+        throw new FabricPreconditionError(`Failed to detach temp checkout.\n${detachStep.tail || 'git checkout --detach failed.'}`);
     }
     return tempDir;
 }

package/dist/src/fabric/functions/status.function.js

@@ -3,6 +3,7 @@ import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
 import { keyValue, statusColor, dim } from '../lib/output.js';
+import { FabricPreconditionError } from '../lib/errors.js';
 export const FabricStatusInput = z.object({});
 export const FabricStatusOutput = z.object({
     projectId: z.string(),
@@ -15,9 +16,9 @@ export const FabricStatus = pikkuSessionlessFunc({
     func: async (_services) => {
         const ctx = await resolveApiContext();
         if (!ctx.token)
-            throw new Error('Not logged in. Run `pikku fabric login` first.');
+            throw new FabricPreconditionError('Not logged in. Run `pikku fabric login` first.');
         if (!ctx.projectId)
-            throw new Error('No fabric project linked. Run `pikku fabric link` first.');
+            throw new FabricPreconditionError('No fabric project linked. Run `pikku fabric link` first.');
         const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
         const status = await rpc.invoke('getProjectStatus', {
             projectId: ctx.projectId,

package/dist/src/fabric/functions/trace.function.js

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
+import { FabricPreconditionError } from '../lib/errors.js';
 export const FabricTraceInput = z.object({
     branch: z.string(),
     traceId: z.string(),
@@ -21,9 +22,9 @@ export const FabricTrace = pikkuSessionlessFunc({
     func: async (_services, { branch, traceId, json }) => {
         const ctx = await resolveApiContext();
         if (!ctx.token)
-            throw new Error('Not logged in. Run `pikku fabric login` first.');
+            throw new FabricPreconditionError('Not logged in. Run `pikku fabric login` first.');
         if (!ctx.projectId)
-            throw new Error('No fabric project linked. Run `pikku fabric link` first.');
+            throw new FabricPreconditionError('No fabric project linked. Run `pikku fabric link` first.');
         const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
         const res = await rpc.invoke('getTraceByStageKind', {
             projectId: ctx.projectId,

package/dist/src/fabric/functions/variables-get.function.js

@@ -3,6 +3,7 @@ import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
 import { resolveStage } from '../lib/stage.js';
+import { FabricPreconditionError } from '../lib/errors.js';
 export const FabricVariablesGetInput = z.object({
     name: z.string(),
     branch: z.string().optional(),
@@ -20,9 +21,9 @@ export const FabricVariablesGet = pikkuSessionlessFunc({
     func: async (_services, { name, branch: requested, json }) => {
         const ctx = await resolveApiContext();
         if (!ctx.token)
-            throw new Error('Not logged in. Run `pikku fabric login` first.');
+            throw new FabricPreconditionError('Not logged in. Run `pikku fabric login` first.');
         if (!ctx.projectId)
-            throw new Error('No fabric project linked. Run `pikku fabric link` first.');
+            throw new FabricPreconditionError('No fabric project linked. Run `pikku fabric link` first.');
         const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
         const { stageId, branch } = await resolveStage(rpc, ctx.projectId, requested);
         const { exists, value } = await rpc.invoke('getStageConsoleVariable', {

package/dist/src/fabric/functions/variables-set.function.js

@@ -4,6 +4,7 @@ import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
 import { resolveStage } from '../lib/stage.js';
 import { parseVariableValue } from '../lib/variable-value.js';
+import { FabricPreconditionError } from '../lib/errors.js';
 export const FabricVariablesSetInput = z.object({
     name: z.string(),
     branch: z.string().optional(),
@@ -20,9 +21,9 @@ export const FabricVariablesSet = pikkuSessionlessFunc({
     func: async (_services, { name, branch: requested, value }) => {
         const ctx = await resolveApiContext();
         if (!ctx.token)
-            throw new Error('Not logged in. Run `pikku fabric login` first.');
+            throw new FabricPreconditionError('Not logged in. Run `pikku fabric login` first.');
         if (!ctx.projectId)
-            throw new Error('No fabric project linked. Run `pikku fabric link` first.');
+            throw new FabricPreconditionError('No fabric project linked. Run `pikku fabric link` first.');
         const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
         const { stageId, branch } = await resolveStage(rpc, ctx.projectId, requested);
         // Deliberately not sealed, and deliberately not prompted for. A variable is

package/dist/src/fabric/lib/changes.js

@@ -1,6 +1,7 @@
 import { extname } from 'node:path';
 import { resolveApiContext } from './config.js';
 import { getFabricRPC } from './http.js';
+import { FabricPreconditionError } from './errors.js';
 /**
  * Resolve the three things every `changes` command needs: the api url, a
  * bearer, and the project the queue belongs to.
@@ -12,7 +13,7 @@ import { getFabricRPC } from './http.js';
 export async function changesContext(apiUrlOverride, projectIdOverride) {
     const ctx = await resolveApiContext({ apiUrlOverride });
     if (!ctx.token)
-        throw new Error('Not logged in. Run `pikku fabric login` first.');
+        throw new FabricPreconditionError('Not logged in. Run `pikku fabric login` first.');
     return {
         rpc: getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token }),
         projectId: projectIdOverride ?? ctx.projectId,
@@ -20,7 +21,7 @@ export async function changesContext(apiUrlOverride, projectIdOverride) {
 }
 export function requireProjectId(projectId) {
     if (!projectId)
-        throw new Error('No fabric project. Pass --project-id, or run `pikku fabric link` in the checkout.');
+        throw new FabricPreconditionError('No fabric project. Pass --project-id, or run `pikku fabric link` in the checkout.');
     return projectId;
 }
 /**

package/dist/src/fabric/lib/config.js

@@ -2,6 +2,7 @@ import { readFile, writeFile, mkdir } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
+import { FabricPreconditionError } from './errors.js';
 const DEFAULT_API_URL = 'https://api.pikkufabric.com';
 const projectConfigName = 'pikkufabric.config.json';
 const authFilePath = join(homedir(), '.fabric', 'auth.json');
@@ -52,7 +53,7 @@ export async function writeProjectConfig(cwd, config) {
             raw = await readFile(path, 'utf8');
         }
         catch (error) {
-            throw new Error(`Cannot read ${projectConfigName} at ${path} (${error.message}) — refusing to overwrite it`);
+            throw new FabricPreconditionError(`Cannot read ${projectConfigName} at ${path} (${error.message}) — refusing to overwrite it`);
         }
         try {
             const parsed = JSON.parse(raw);

package/dist/src/fabric/lib/deployment.js

@@ -1,3 +1,4 @@
+import { FabricPreconditionError } from './errors.js';
 const IN_FLIGHT = new Set(['queued', 'planning', 'building', 'deploying']);
 const SUCCEEDED = new Set(['active']);
 const FAILED = new Set([
@@ -313,7 +314,7 @@ export function reconcileDeployedRef({ requested, actual, deploymentId, }) {
     if (actual === requested)
         return actual;
     const short = (sha) => sha.slice(0, 8);
-    throw new Error([
+    throw new FabricPreconditionError([
         `Refusing to continue: deployment ${deploymentId} is pinned to ${short(actual)}, not the ${short(requested)} you asked for.`,
         'A deployment already parked for this branch was attached to rather than a new one being cut,',
         'so continuing would deploy a different commit than the one named.',

package/dist/src/fabric/lib/git.d.ts

@@ -1,9 +1,18 @@
+import { PikkuError } from '@pikku/core/errors';
 /**
  * Local git probes for the deploy safety checks (clean tree, HEAD == remote,
  * ref resolution). Shell out to `git` rather than depend on simple-git —
  * matches what wrangler/vercel/fly do, no runtime dep.
  */
-export declare class GitError extends Error {
+/**
+ * A `git` invocation that came back non-zero.
+ *
+ * A `PikkuError`, because the message already carries the whole diagnosis —
+ * which command, which exit code, and git's own stderr — and ten frames of the
+ * spawn helper in front of "fatal: not a git repository" answer a question
+ * nobody asked. `--verbose` / `PIKKU_DEBUG` still prints the stack.
+ */
+export declare class GitError extends PikkuError {
     command: string;
     exitCode: number;
     stderr: string;

package/dist/src/fabric/lib/git.js

@@ -1,11 +1,20 @@
 import { spawn } from 'node:child_process';
 import { FabricPreconditionError } from './errors.js';
+import { PikkuError } from '@pikku/core/errors';
 /**
  * Local git probes for the deploy safety checks (clean tree, HEAD == remote,
  * ref resolution). Shell out to `git` rather than depend on simple-git —
  * matches what wrangler/vercel/fly do, no runtime dep.
  */
-export class GitError extends Error {
+/**
+ * A `git` invocation that came back non-zero.
+ *
+ * A `PikkuError`, because the message already carries the whole diagnosis —
+ * which command, which exit code, and git's own stderr — and ten frames of the
+ * spawn helper in front of "fatal: not a git repository" answer a question
+ * nobody asked. `--verbose` / `PIKKU_DEBUG` still prints the stack.
+ */
+export class GitError extends PikkuError {
     command;
     exitCode;
     stderr;

package/dist/src/fabric/lib/prompt.d.ts

@@ -1,12 +1,21 @@
 /**
- * Read a line from stdin with optional masking. Used for secret-set when the
- * user didn't pass `--value` on the command line so we can avoid leaving
- * the plaintext in shell history.
+ * Ask for a value that should not end up in shell history.
+ *
+ * With a tty this is a prompt. Without one — piped input, CI, an agent — the
+ * value is read from stdin instead, because scripting `pikku fabric secrets
+ * set` is a reasonable thing to want, and because a prompt with nobody to
+ * answer it is a hang. If stdin is closed or empty, `nonInteractiveHint` tells
+ * the caller which flag to reach for; it is raised as a `PikkuError` so
+ * `formatCLIError` prints that sentence and nothing else.
  */
-export declare function promptSecret(label: string): Promise<string>;
+export declare function promptSecret(label: string, { nonInteractiveHint }: {
+    nonInteractiveHint: string;
+}): Promise<string>;
 /**
  * Classic yes/no confirmation. Returns `defaultYes` on an empty answer.
  * Callers must gate on `process.stdin.isTTY` first — there is no human to
- * answer in a non-interactive session, so prompting there would hang.
+ * answer in a non-interactive session, so prompting there would hang. The
+ * guard below is the backstop for a caller that forgets: a refusal naming the
+ * question beats a process that never returns.
  */
 export declare function promptConfirm(label: string, defaultYes?: boolean): Promise<boolean>;

package/dist/src/fabric/lib/prompt.js

@@ -1,32 +1,95 @@
 import { createInterface } from 'node:readline/promises';
+import { createInterface as createLineInterface } from 'node:readline';
 import { stdin, stdout } from 'node:process';
+import { FabricPreconditionError } from './errors.js';
 /**
- * Read a line from stdin with optional masking. Used for secret-set when the
- * user didn't pass `--value` on the command line so we can avoid leaving
- * the plaintext in shell history.
+ * Read the first line stdin has to offer, or `null` if it has none.
+ *
+ * Resolves on the first newline rather than on EOF, so a pipe that stays open
+ * after the value has been written (a harness holding the write end, `cat |`)
+ * does not hang the command. `terminal: false` matters: readline's terminal
+ * mode tries to drive a tty it does not have, and on a closed stdin the
+ * `question()` promise it returns never settles at all — which is how
+ * `pikku fabric secrets set NAME < /dev/null` used to end in node's
+ * "Detected unsettled top-level await" warning instead of an error.
  */
-export async function promptSecret(label) {
+const readFirstLine = async () => {
+    const rl = createLineInterface({ input: stdin, terminal: false });
+    try {
+        return await new Promise((resolve) => {
+            rl.once('line', (line) => resolve(line));
+            rl.once('close', () => resolve(null));
+        });
+    }
+    finally {
+        rl.close();
+    }
+};
+/**
+ * Ask for a value that should not end up in shell history.
+ *
+ * With a tty this is a prompt. Without one — piped input, CI, an agent — the
+ * value is read from stdin instead, because scripting `pikku fabric secrets
+ * set` is a reasonable thing to want, and because a prompt with nobody to
+ * answer it is a hang. If stdin is closed or empty, `nonInteractiveHint` tells
+ * the caller which flag to reach for; it is raised as a `PikkuError` so
+ * `formatCLIError` prints that sentence and nothing else.
+ */
+export async function promptSecret(label, { nonInteractiveHint }) {
+    if (!stdin.isTTY) {
+        const piped = await readFirstLine();
+        const value = piped?.trim() ?? '';
+        if (!value) {
+            throw new FabricPreconditionError(`${label}: stdin is not a tty and nothing was piped in.\n${nonInteractiveHint}`);
+        }
+        return value;
+    }
     const rl = createInterface({ input: stdin, output: stdout, terminal: true });
     // Best-effort masking — the readline API doesn't suppress echo natively;
     // for hardened input you'd want `read -s` or a tty trick, but for our
     // CLI the standard prompt is fine and matches what wrangler does.
     process.stdout.write(`${label}: `);
-    const value = await rl.question('');
-    rl.close();
-    return value.trim();
+    try {
+        // `question()` never rejects when the stream ends under it, so the close is
+        // raced explicitly: ^D at a prompt is an abort, not an infinite wait.
+        const value = await Promise.race([
+            rl.question(''),
+            new Promise((resolve) => rl.once('close', () => resolve(null))),
+        ]);
+        if (value === null) {
+            throw new FabricPreconditionError(`${label}: input closed before a value was given.\n${nonInteractiveHint}`);
+        }
+        return value.trim();
+    }
+    finally {
+        rl.close();
+    }
 }
 /**
  * Classic yes/no confirmation. Returns `defaultYes` on an empty answer.
  * Callers must gate on `process.stdin.isTTY` first — there is no human to
- * answer in a non-interactive session, so prompting there would hang.
+ * answer in a non-interactive session, so prompting there would hang. The
+ * guard below is the backstop for a caller that forgets: a refusal naming the
+ * question beats a process that never returns.
  */
 export async function promptConfirm(label, defaultYes = false) {
+    if (!stdin.isTTY) {
+        throw new FabricPreconditionError(`Cannot ask "${label}" — stdin is not a tty. Re-run interactively, or pass the flag that answers it (--force / --auto-approve / --yes).`);
+    }
     const rl = createInterface({ input: stdin, output: stdout });
-    const answer = (await rl.question(`${label} [${defaultYes ? 'Y/n' : 'y/N'}] `))
-        .trim()
-        .toLowerCase();
-    rl.close();
-    if (!answer)
-        return defaultYes;
-    return answer === 'y' || answer === 'yes';
+    try {
+        const answer = await Promise.race([
+            rl.question(`${label} [${defaultYes ? 'Y/n' : 'y/N'}] `),
+            new Promise((resolve) => rl.once('close', () => resolve(null))),
+        ]);
+        if (answer === null)
+            return false;
+        const normalized = answer.trim().toLowerCase();
+        if (!normalized)
+            return defaultYes;
+        return normalized === 'y' || normalized === 'yes';
+    }
+    finally {
+        rl.close();
+    }
 }

package/dist/src/fabric/lib/report-environment.d.ts

@@ -3,10 +3,11 @@ export interface PikkuPackageVersion {
     name: string;
     version: string;
     /**
-     * Resolved through a symlink — a yarn workspace or a `yarn link`ed checkout
-     * rather than a published tarball. The framework is read-only during a build
-     * run, so a linked package is code that may already have been modified, and a
-     * finding describing it is describing something other than a release.
+     * Resolved to a checkout outside `node_modules` — a workspace or a linked
+     * working tree rather than a published tarball. The framework is read-only
+     * during a build run, so a linked package is code that may already have been
+     * modified, and a finding describing it is describing something other than a
+     * release.
      */
     linked: boolean;
 }