@retasc/cli 1.29.0 → 1.31.0

package/dist/index.js

@@ -5,7 +5,7 @@ import { selfCommand, versionStamp } from "./lib/launcher.js";
 import { loadConfig, patchConfig, saveConfig, configPath, isLoggedIn } from "./config.js";
 import { installMcp, normalizeScope } from "./commands/mcp.js";
 import { installGate, resolveGatePrefix } from "./commands/gate.js";
-import { claimAction } from "./commands/claim.js";
+import { claimAction, releaseAction } from "./commands/claim.js";
 import { bindAction, setupFromToken } from "./commands/bind.js";
 import { joinAction } from "./commands/join.js";
 import { chooseInviteOrg, chooseInviteProjects } from "./commands/invite.js";
@@ -195,6 +195,13 @@ program
     // RTSC-495 — the agent's door. Everything this command normally asks was already
     // answered in the Dash, so the token stands in for all of it and nothing is prompted.
     .option("--setup <token>", "Complete setup from a Dash setup code — no sign-in, no prompts")
+    // RTSC-713 — the OTHER agent door, and the one that needs no Dash trip first.
+    //
+    // Three behaviours, deliberately on one flag because none is useful alone: NDJSON
+    // outcomes on stdout, the browser door without a TTY, and continuable states reported
+    // at exit 0 instead of thrown. Structured output an agent cannot act on, or a door
+    // that leads to a thrown Error, is each worse than neither.
+    .option("--json", "Report machine-readable outcomes (for an agent driving setup)")
     .action(async (opts) => {
     // BEFORE requireLogin: the whole point is a machine that has never signed in. The
     // token is the authorization, and asking for a session here would refuse every
@@ -593,6 +600,13 @@ program
 // Normalize --only to the canonical uppercase id so it matches the branch ids
 // scan() derives (rtsc-181/… → RTSC-181), same as `done` does for --id.
 tidyAction({ ...opts, only: opts.only ? String(opts.only).toUpperCase() : undefined }).catch(fail));
+program
+    .command("release [issue]")
+    .description("Hand a claimed issue back to the queue. Leaves your worktree and branch alone.")
+    .option("--id <RTSC-NN>", "The issue to release (or pass it positionally)")
+    .requiredOption("--claim-token <token>", "The claim token printed when you claimed it (the server fences on it)")
+    .option("--note <text>", "Handoff note for whoever picks it up next")
+    .action((issueArg, opts) => releaseAction({ issueArg, ...opts }).catch(fail));
 program
     .command("done")
     .description("Mark the current issue (rtsc-NN/ branch, or --id) done and tear down its worktree+branch.")

package/dist/lib/binding.js

@@ -119,6 +119,55 @@ export function readShadowedBinding(dir) {
         return undefined;
     return parseServerEntry(folderEntry(dir), "folder");
 }
+/**
+ * Is this a PLACEHOLDER entry — a bare URL with no credential of any kind (RTSC-691)?
+ *
+ * RTSC-678's flow starts by pointing the client at `https://mcp.retasc.com/mcp` with
+ * nothing else in it, so the server can answer the handshake with setup instructions.
+ * That entry is not a binding: it cannot authenticate, and every tool call through it
+ * fails. It exists to be replaced by the real one `bind` writes.
+ *
+ * It has to be recognised so it can be REMOVED, because scope precedence would otherwise
+ * make it win. `claude mcp add -t http` writes Claude-local scope by default; a `bind
+ * --scope project` writes `./.mcp.json`; and claude-local beats the folder marker at
+ * runtime (see the precedence note at the top of this file). Left in place, the finished
+ * setup would sit in a file nothing reads while the credential-less entry took every
+ * call — a setup that looks done and works nowhere.
+ *
+ * Deliberately narrow: a `url` and NO `command`, no env credential, no Authorization
+ * header. Anything carrying a credential, or spawning something, is somebody's real
+ * configuration and is never silently removed.
+ */
+export function isPlaceholderEntry(raw, knownUrls = PLACEHOLDER_URLS) {
+    if (!raw || typeof raw !== "object")
+        return false;
+    if (typeof raw.url !== "string" || raw.url.length === 0)
+        return false;
+    if (typeof raw.command === "string")
+        return false;
+    if (raw.env && Object.keys(raw.env).length > 0)
+        return false;
+    // ANY header, not just Authorization. A gateway that injects credentials under some
+    // other name is still somebody's real configuration.
+    if (raw.headers && Object.keys(raw.headers).length > 0)
+        return false;
+    // And it must be the bootstrap URL we ourselves tell people to paste. This is the
+    // clause that matters: Claude Code stores MCP OAuth tokens OUTSIDE the server entry,
+    // keyed by server name, so a fully authorized OAuth binding is byte-identical to a
+    // placeholder by shape alone. RTSC-678 — this issue's parent — is about adding exactly
+    // that OAuth door, so shape-only matching would have grown a way to silently delete a
+    // working binding at the moment we shipped one.
+    return knownUrls.includes(normalizeUrl(raw.url));
+}
+/** The bare URLs we hand out for bootstrapping, normalized. */
+const PLACEHOLDER_URLS = ["https://mcp.retasc.com/mcp"];
+function normalizeUrl(u) {
+    return u.trim().replace(/\/+$/, "").toLowerCase();
+}
+/** Is there a placeholder in Claude Code's LOCAL scope for this folder? */
+export function hasClaudeLocalPlaceholder(dir) {
+    return isPlaceholderEntry(claudeLocalRetascEntry(dir));
+}
 /** A user-scope (global) Retasc server: top-level in Claude Code's config,
  *  NOT under projects[dir]. Illegal under DESIGN §13 override #1 — it applies
  *  to every folder that has no binding of its own, so issues can land in the

package/dist/lib/browserLogin.js

@@ -0,0 +1,80 @@
+import { createServer } from "node:http";
+import { randomBytes } from "node:crypto";
+/** How long to wait for the human to click Approve. Generous: they may have to sign in
+ *  to the Dash first, and possibly through GitHub or Google after that. */
+const WAIT_MS = 5 * 60 * 1000;
+/**
+ * Open a loopback listener and return the URL to send the browser to, plus a promise
+ * that resolves when the browser comes back.
+ *
+ * Split in two on purpose. The caller needs the URL BEFORE the wait starts, so it can
+ * print it — a printed URL is what makes this work when the browser fails to open, which
+ * is the common case on a headless Linux box where `xdg-open` is absent.
+ */
+export async function startBrowserLogin(dashUrl) {
+    const state = randomBytes(24).toString("hex");
+    let resolve;
+    let reject;
+    const settled = new Promise((res, rej) => {
+        resolve = res;
+        reject = rej;
+    });
+    // The timeout below rejects this promise whether or not anyone is awaiting it. A caller
+    // that takes `url`/`cancel` and never calls `wait()` would otherwise get an unhandled
+    // rejection, which is fatal on Node 15+. Attaching an inert handler at construction
+    // makes the promise safe to ignore; `wait()` still sees the real rejection.
+    settled.catch(() => { });
+    const server = createServer((req, res) => {
+        const url = new URL(req.url ?? "/", "http://127.0.0.1");
+        const code = url.searchParams.get("code");
+        const gotState = url.searchParams.get("state");
+        // The browser is a person's, so answer it in a way a person can read. Whatever
+        // happens here, the tab is finished with.
+        const reply = (status, body) => {
+            res.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
+            res.end(`<!doctype html><meta charset="utf-8"><title>Retasc</title>` +
+                `<body style="font:16px system-ui;padding:3rem;max-width:32rem;margin:auto">${body}</body>`);
+        };
+        if (!code || gotState !== state) {
+            // A mismatched nonce means this redirect did not come from the flow we started.
+            // The code is not forwarded, so it expires unspent two minutes later.
+            reply(400, "<h1>Sign-in could not be verified</h1><p>Close this tab and run <code>retasc login</code> again.</p>");
+            return;
+        }
+        reply(200, "<h1>Signed in</h1><p>You can close this tab and go back to your terminal.</p>");
+        resolve({ code });
+    });
+    await new Promise((res, rej) => {
+        server.once("error", rej);
+        // Port 0: the OS picks a free one. Hard-coding a port would collide with a second
+        // `retasc login` and with whatever else the developer is running.
+        server.listen(0, "127.0.0.1", res);
+    });
+    const port = server.address().port;
+    const timer = setTimeout(() => {
+        reject(new Error(`TIMEOUT: no response from the browser within ${WAIT_MS / 60_000} minutes`));
+    }, WAIT_MS);
+    // Do not hold the process open on this timer alone.
+    timer.unref?.();
+    const close = () => {
+        clearTimeout(timer);
+        // `close()` stops accepting but leaves the browser's idle keep-alive socket open, and
+        // that handle holds the event loop until Node's 5s keepAliveTimeout fires — so the
+        // CLI would appear to hang for five seconds after a successful sign-in.
+        server.closeAllConnections?.();
+        server.close();
+    };
+    return {
+        url: `${dashUrl.replace(/\/+$/, "")}/cli-auth?port=${port}&state=${encodeURIComponent(state)}`,
+        port,
+        wait: async () => {
+            try {
+                return await settled;
+            }
+            finally {
+                close();
+            }
+        },
+        cancel: close,
+    };
+}

package/dist/lib/fetchFile.js

@@ -0,0 +1,222 @@
+// Local file DOWNLOAD for the MCP proxy (RTSC-681) — the read counterpart to attachFile.ts.
+//
+// Why this exists: attachments were one-way. Uploading has been a single tool call since
+// RTSC-660 (the agent names a path, the proxy uploads with the key it holds), but reading one
+// back required `Authorization: Bearer <agent key>` on /attachments/download — a credential the
+// model structurally does not have and is explicitly told not to hunt for. So a human could
+// attach a certificate for an agent to verify and the agent could see its name and nothing
+// else. The proxy already brokers bytes in one direction with a credential the model never
+// touches; this is the same trade in reverse.
+//
+// The cost of the reverse trade is different, and worse, which is why this module is stricter
+// than its sibling rather than a mirror image of it. attachFile.ts confines what may be READ,
+// because a proxy-side read bypasses the harness's file-access prompt. A proxy-side WRITE
+// bypasses the harness's write prompt, and a write is the more dangerous primitive: bytes we
+// place in `.claude/settings.json`, `.githooks/`, or a workflow file become someone's next
+// command execution. The filename is not ours either — it comes off an attachment row any org
+// member (or an importer pulling from Jira, ClickUp or Asana) can influence.
+//
+// So this side takes no destination from anybody. Downloads land in ONE directory the proxy
+// owns, under a sanitized name, never overwriting, never through a symlink. An agent that
+// wants the file somewhere else copies it with its own file tools — which the harness DOES
+// prompt on. That asymmetry is the whole argument: bypassing the read prompt was unavoidable
+// to make upload work at all, bypassing the write prompt is not.
+import { lstatSync, mkdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { basename, join, sep } from "node:path";
+/** The one tool name for "read an attached file", whichever transport can carry the bytes.
+ *  The server publishes an INLINE variant under this SAME name (bytes in the tool result,
+ *  capped, an image as an image); when a proxy is present it overrides that entry in
+ *  `tools/list` with the to-disk form below. One name, the best shape the environment can
+ *  actually support — exactly as save_attachment_file works. */
+export const FETCH_TOOL_NAME = "get_attachment_file";
+/** Matches the server's blob ceiling (MAX_ENCRYPTED_BLOB_BYTES), so nothing storable is
+ *  un-readable. Checked against what the server SAYS the size is, and again against what it
+ *  actually sent — a length header is a claim, not a guarantee. */
+export const MAX_FETCH_BYTES = 50 * 1024 * 1024;
+/** Where downloads land, relative to the attach root. Inside the workspace on purpose: a
+ *  harness that sandboxes file reads to the project would not be able to open anything we
+ *  wrote to the OS temp dir, and a file the agent cannot read is the bug we are fixing. */
+export const DOWNLOAD_DIR_SEGMENTS = [".retasc", "attachments"];
+/** The directory the proxy owns for downloaded attachments. */
+export function downloadDir(root) {
+    return join(root, ...DOWNLOAD_DIR_SEGMENTS);
+}
+/**
+ * Reduce a server-supplied name to something safe to create INSIDE a directory we own.
+ *
+ * Every rule here is about a name we did not choose: the row's filename came from whoever
+ * uploaded it, or from an importer copying a third-party tracker's field verbatim.
+ *  - `basename` first, then a second sweep for separators — `../../.git/hooks/pre-commit` and
+ *    an absolute path both collapse to a leaf, and a Windows `..\\` does too.
+ *  - control characters and NUL, which truncate paths in some syscalls and lie in terminals.
+ *  - a leading dot, so nothing we write can become a dotfile (`.gitignore`, `.npmrc`, `.env`)
+ *    even inside our own directory.
+ *  - Windows device names (CON, NUL, COM1…), which are not openable as files there.
+ *  - length, so a long title can't push us past a filesystem limit and get truncated into a
+ *    name that collides with something else.
+ * Empty after all that (a name made entirely of stripped characters) falls back to the id,
+ * which is unique by construction.
+ */
+export function sanitizeDownloadName(name, attachmentId) {
+    const leaf = basename(String(name ?? "").replace(/[\\/]+/g, "/"));
+    let cleaned = leaf
+        .replace(/[\\/]/g, "_")
+        .replace(/[\u0000-\u001f\u007f]/g, "") // control characters and NUL, which lie in a terminal and truncate paths
+        .replace(/^\.+/, "") // no dotfiles, not even inside a directory we own
+        .trim()
+        .slice(0, 120);
+    if (/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\.|$)/i.test(cleaned))
+        cleaned = `file-${cleaned}`;
+    return cleaned || `attachment-${attachmentId}`;
+}
+/**
+ * Where `attachmentId`'s bytes go. One directory per attachment (ids are unique and immutable,
+ * so two files never contend for a name and a cached file is never the wrong file), under the
+ * proxy-owned root. The id is validated rather than sanitized: it comes from the server, it is
+ * an opaque token, and anything that isn't one is a bug or an attack, not a name to clean up.
+ * The containment check at the end is belt-and-braces — after the id check and the name
+ * sanitizer there is no known way to escape, which is exactly when a cheap assertion earns its
+ * place.
+ */
+export function resolveDownloadTarget(root, attachmentId, filename) {
+    const id = String(attachmentId ?? "").trim();
+    if (!/^[A-Za-z0-9_-]{1,64}$/.test(id)) {
+        return { ok: false, error: `refusing to write: "${id}" is not a valid attachment id` };
+    }
+    const dir = join(downloadDir(root), id);
+    const name = sanitizeDownloadName(filename, id);
+    const path = join(dir, name);
+    if (path !== join(dir, basename(path)) || !path.startsWith(dir + sep)) {
+        return { ok: false, error: `refusing to write ${path}: it resolves outside ${dir}` };
+    }
+    return { ok: true, dir, path, filename: name };
+}
+/**
+ * The size of an already-downloaded file, or null if there isn't one. `lstat`, never `stat`:
+ * a symlink at this path would make `stat` report the target's size and the agent read
+ * whatever it points at, so a symlink counts as "not our file" and is reported as such.
+ *
+ * A file being present IS a complete download — writes go through a temp file and a rename
+ * below, so a crash mid-write can never leave a short file at the final path.
+ */
+export function existingDownload(path) {
+    let st;
+    try {
+        st = lstatSync(path);
+    }
+    catch {
+        return null;
+    }
+    if (st.isSymbolicLink())
+        return { symlink: true };
+    if (!st.isFile())
+        return null;
+    return { size: st.size };
+}
+/**
+ * Write the downloaded bytes, atomically and without ever following a symlink.
+ *
+ * `wx` on the temp file so we only ever create, never clobber; `rename` to publish, which
+ * REPLACES a symlink sitting at the destination rather than writing through it (the one
+ * escape a plain write would allow). A leftover temp file from a killed proxy is removed
+ * first — it is inside a directory only this code writes to, and its name is ours.
+ */
+export function writeDownloadedFile(target, bytes, root) {
+    mkdirSync(target.dir, { recursive: true, mode: 0o700 });
+    ensureCacheIgnored(root);
+    const tmp = `${target.path}.part-${process.pid}`;
+    try {
+        unlinkSync(tmp);
+    }
+    catch {
+        /* nothing to clean up */
+    }
+    writeFileSync(tmp, bytes, { flag: "wx", mode: 0o600 });
+    renameSync(tmp, target.path);
+}
+/**
+ * Make the download directory ignore itself, once.
+ *
+ * A customer's certificate, production log or crash dump lands in their working tree, and the
+ * agent working there is about to commit something. A `.gitignore` holding `*` inside the
+ * directory covers everything in it (itself included) without touching the repo's own
+ * `.gitignore`, which is a file we have no business editing.
+ */
+export function ensureCacheIgnored(root) {
+    const dir = downloadDir(root);
+    try {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        writeFileSync(join(dir, ".gitignore"), "*\n", { flag: "wx", mode: 0o600 });
+    }
+    catch {
+        /* already there (the common case), or unwritable — never fail a download over this */
+    }
+}
+/** The tool the proxy advertises in place of the server's inline variant. It names the
+ *  directory because the model has no other way to learn where the file will appear, and
+ *  says the bytes never enter the context so nobody "helpfully" asks for base64 instead. */
+export function localFetchToolDef(root) {
+    return {
+        name: FETCH_TOOL_NAME,
+        description: "Read a FILE attached to an issue, in ONE call. Give the attachment id (from " +
+            "list_attachments); your local retasc proxy downloads it with the credential it already " +
+            "holds and writes it to disk, then hands you the path — read it with your normal file " +
+            "tools. You do NOT need an API key for this and must not go looking for one, and you " +
+            "must not curl the download URL yourself: the whole point is that the key stays in the " +
+            `proxy. Files land under ${downloadDir(root)} (one folder per attachment, never ` +
+            "overwritten, git-ignored); copy it elsewhere yourself if you want it kept. Works at any " +
+            "size up to the 50MB attachment limit, and the bytes never pass through your context. " +
+            "For a link attachment (one saved with save_attachment) there is nothing to download — " +
+            "fetch its URL yourself.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                attachment: { type: "string", description: "Attachment id, e.g. from list_attachments." },
+            },
+            required: ["attachment"],
+        },
+    };
+}
+/**
+ * Put the local tool into a `tools/list` result: replace the server's entry of the same name
+ * (so the agent sees the shape this environment can actually serve, not the inline fallback)
+ * or append it when the server has none. Appending matters — the proxy needs only
+ * `get_attachment` to do its job, so it can offer to-disk downloads against a server deployed
+ * before the inline variant existed.
+ */
+export function mergeFetchTool(tools, root) {
+    if (!Array.isArray(tools))
+        return tools;
+    const local = localFetchToolDef(root);
+    const idx = tools.findIndex((t) => t && typeof t === "object" && t.name === FETCH_TOOL_NAME);
+    if (idx === -1)
+        return [...tools, local];
+    const merged = [...tools];
+    merged[idx] = local;
+    return merged;
+}
+/** Does this JSON-RPC message want a LOCAL download? Any call to the tool does: unlike the
+ *  upload pair there is no second argument shape to tell them apart, and when a proxy is
+ *  present writing to disk is always the better answer — it costs the agent no context and
+ *  has no size ceiling. */
+export function isLocalFetchCall(msg) {
+    const m = msg;
+    return !!m && m.method === "tools/call" && m.params?.name === FETCH_TOOL_NAME;
+}
+/** Turn a download HTTP failure into something the agent can act on — same contract as the
+ *  upload side: the status carries the meaning, and a bare "HTTP 402" tells an agent nothing
+ *  it can relay to the human who alone can fix it. */
+export function downloadFailureMessage(status, body) {
+    const detail = body.trim() ? ` — ${body.trim()}` : "";
+    switch (status) {
+        case 401:
+            return `download rejected: this proxy's key no longer authenticates${detail}`;
+        case 402:
+            return (`download refused for billing${detail}. PASS THIS TO YOUR HUMAN — you cannot fix it ` +
+                `yourself, only an owner can, and until they do every call will keep failing.`);
+        case 404:
+            return `download rejected: no such attachment in this project, or it has no stored file${detail}`;
+        default:
+            return `download failed with HTTP ${status}${detail}`;
+    }
+}

package/dist/lib/outcome.js

@@ -0,0 +1,102 @@
+/**
+ * What `bind` reports when an AGENT is driving it (RTSC-713).
+ *
+ * # Why this exists
+ *
+ * An agent decides whether to keep going from three signals, and all three are
+ * structural rather than semantic: the exit code, which stream the output came on, and
+ * whether the text reads like a fault. Before this module, "signed in, session written,
+ * nothing named yet" fired all three:
+ *
+ *     ✗ UNAUTHENTICATED: Not signed in. Run `npx -y @retasc/cli@1.30.0 login` first
+ *       (no TTY here for the device flow).
+ *
+ * An agent that stops there is reading the signals correctly. The signals were wrong.
+ * Sign-in had succeeded, the session was on disk, and the only thing left was a question
+ * it could have asked its human in one sentence.
+ *
+ * So the rule this module enforces: **the exit code and the framing encode "can I
+ * continue?", not "did something unexpected happen?"** A state the flow can be resumed
+ * from exits 0 on stdout and never says error, however incomplete it is. Only a genuine
+ * dead end — nothing the agent or its human can do from here — exits non-zero.
+ *
+ * # Why not just word the instruction better
+ *
+ * Telling the agent "if you see UNAUTHENTICATED it is fine, keep going" asks a model to
+ * override the strongest stop signal it has on the strength of a sentence it read
+ * earlier. Sometimes it will and sometimes it will not, and which one is not something
+ * this codebase controls. Exiting 0 is deterministic. This is the same reasoning that
+ * put the claim nudge and the setup instructions in the server response rather than in
+ * CLAUDE.md: a mechanism beats advice.
+ *
+ * # Why the states live HERE and not in the server's instruction string
+ *
+ * The obvious alternative was a lookup table in `convex/lib/setupInstructions.ts`: "if
+ * the CLI says X do this, if it says Y do that." That is a second copy of this list,
+ * living in a different language, in a different deploy cycle, maintained by whoever
+ * touches it next. They diverge, and the divergence is invisible until an agent acts on
+ * a state that no longer exists.
+ *
+ * This repo has already paid for that once. `setupInstructions.ts` opens by explaining
+ * it was lifted out of `http.ts` "because it now has TWO readers and they must never
+ * diverge", and RTSC-694 was an entire issue spent collapsing one setup command into one
+ * place. So: the CLI owns its states and each one carries its own next step, and the
+ * server instruction says only "run this, act on what it tells you." Adding a state
+ * costs one change, in this file, and no server string can go stale.
+ *
+ * There is a test that greps for these code strings under `convex/`. If one ever appears
+ * there, the split has been broken.
+ */
+/**
+ * Every terminal outcome of an agent-driven `bind`, in two classes.
+ *
+ * CONTINUABLE — the flow is alive and wants something. Exit 0, stdout, no fault
+ * vocabulary. The agent reads it, asks its human the one question that applies, and runs
+ * the next pass.
+ *
+ * TERMINAL — nothing the agent or its human can do inside this flow. Exit non-zero and
+ * say so plainly, because stopping is genuinely the right move.
+ *
+ * Note where NEEDS_SIGN_IN sits. Reaching a command with no session, having not yet
+ * tried to get one, is CONTINUABLE: the answer is to sign in, not to give up. Only a
+ * sign-in that was attempted and failed is terminal. Collapsing those two was the
+ * original bug.
+ */
+export const CONTINUABLE_STATES = [
+    /** No session, and no attempt has been made yet. The browser door is available. */
+    "NEEDS_SIGN_IN",
+    /** Signed in. Zero orgs, or more than one, so which org this folder is for is unknown. */
+    "NEEDS_ORG",
+    /** Org settled. Zero projects, or more than one, so which project is unknown. */
+    "NEEDS_PROJECT",
+    /**
+     * Signed in, and holding an invitation. The choice is join-or-create and it is the
+     * human's to make.
+     *
+     * NOT called PENDING_INVITE, deliberately: `convex/setupStatus.ts` already has a state
+     * by that name and it means something else — a membership offer the server is
+     * surfacing, rather than the reason `bind` stopped. Two different things sharing one
+     * identifier across the boundary is precisely the confusion this file's split exists to
+     * prevent, so this one is named for the decision it is asking for.
+     */
+    "NEEDS_JOIN_OR_CREATE",
+    /** Everything named and written. The folder is bound; the client must restart. */
+    "BOUND",
+];
+export const TERMINAL_STATES = [
+    /** Sign-in was attempted and did not complete: declined, timed out, or rejected. */
+    "SIGN_IN_FAILED",
+    /** No door exists: no browser reachable and no TTY. SSH and CI land here. */
+    "NO_SIGN_IN_DOOR",
+    /** This folder is already bound and the run was refused rather than silently re-pointed. */
+    "ALREADY_BOUND",
+    /** The credential was refused: revoked key, suspended member, deleted workspace. */
+    "REFUSED",
+];
+export function isContinuable(state) {
+    return CONTINUABLE_STATES.includes(state);
+}
+/** stdout, one line, no trailing prose. Never stderr: see the module header. */
+export function emit(e) {
+    process.stdout.write(JSON.stringify(e) + "\n");
+}