@tailglow/cli 0.9.5 → 0.9.15

package/src/login-command.js

@@ -62,13 +62,16 @@ const WITHDRAWN_MESSAGES = {
 function openBrowser(url) {
   let command = "xdg-open";
   let args = [url];
+
   if (process.platform === "darwin") command = "open";
   if (process.platform === "win32") {
     command = "rundll32";
     args = ["url.dll,FileProtocolHandler", url];
   }
+
   try {
     const child = spawn(command, args, { stdio: "ignore", detached: true });
+
     child.on("error", () => {});
     child.unref();
   } catch {
@@ -87,18 +90,22 @@ function openBrowser(url) {
 function readVerificationUrl(value) {
   /** @type {URL | null} */
   let url = null;
+
   try {
     url = new URL(String(value));
   } catch {
     url = null;
   }
+
   const is_secure = url?.protocol === "https:";
   const is_local = url?.protocol === "http:" && LOCAL_HOSTNAMES.has(url.hostname);
+
   if (!url || !(is_secure || is_local)) {
     throw new Error(
       "The API answered with a sign-in link that is not an https address. Check --api-url."
     );
   }
+
   return url.href;
 }
 
@@ -108,6 +115,7 @@ export function createLoginContext() {
   let indicator = null;
   /** @type {ReturnType<typeof setInterval> | undefined} */
   let countdown;
+
   return {
     config_path: CLI_CONFIGS.CONFIG_PATH,
     fetch_impl: fetch,
@@ -115,6 +123,7 @@ export function createLoginContext() {
     emits_json: (flags) => shouldEmitJson(flags),
     choose_method: async () => {
       log.info("Use `tglow help` to browse commands without signing in.");
+
       const answer = await select({
         message: "How do you want to sign in?",
         options: [
@@ -129,7 +138,9 @@ export function createLoginContext() {
           { value: "cancel", label: "Cancel" }
         ]
       });
+
       if (isCancel(answer) || answer === "cancel") return null;
+
       return answer === "api_key" ? "api_key" : "account";
     },
     open_browser: openBrowser,
@@ -139,17 +150,22 @@ export function createLoginContext() {
     progress: {
       start: (text, expires_at) => {
         indicator ??= spinner();
+
         const message = () => {
           if (expires_at === undefined) return text;
+
           const seconds = Math.max(0, Math.ceil((expires_at - Date.now()) / 1_000));
+
           return `${text} (code expires in ${Math.floor(seconds / 60)}:${String(seconds % 60).padStart(2, "0")})`;
         };
+
         indicator.start(message());
         clearInterval(countdown);
         countdown = setInterval(() => indicator?.message(message()), 1_000);
       },
       stop: (text, outcome = "success") => {
         clearInterval(countdown);
+
         if (outcome === "cancel") indicator?.cancel(text);
         else if (outcome === "error") indicator?.error(text);
         else indicator?.stop(text);
@@ -167,9 +183,13 @@ export function createLoginContext() {
  */
 export async function shouldOfferLogin(flags, context) {
   if (flags.help || context.emits_json(flags) || !context.is_interactive()) return false;
+
   const config = await loadConfig(context.config_path);
+
   if (resolveSetting("api_key", { flags, config })) return false;
+
   const login = readStoredLogin(config);
+
   return !login || !isSameApiUrl(login.api_url, resolveApiUrl({ flags, config }));
 }
 
@@ -179,8 +199,10 @@ export async function shouldOfferLogin(flags, context) {
  */
 function readSwitch(flags, name) {
   const value = flags[name];
+
   if (value === undefined || value === false || value === "false") return false;
   if (value === true || value === "true") return true;
+
   throw new Error(`--${name} takes no value, or =true / =false. Received "${String(value)}".`);
 }
 
@@ -194,12 +216,15 @@ function readSwitch(flags, name) {
  */
 function refuseUnexpected(words, flags, allowed) {
   const unknown = Object.keys(flags).filter((flag) => !allowed.has(flag));
+
   if (unknown.length > 0) {
     throw new Error(
       `Unknown flag${unknown.length === 1 ? "" : "s"}: ${unknown.map((flag) => `--${flag}`).join(", ")}.`
     );
   }
+
   const extra = words.filter((word) => word !== undefined);
+
   if (extra.length > 0) {
     throw new Error(`Unexpected argument${extra.length === 1 ? "" : "s"}: ${extra.join(", ")}.`);
   }
@@ -216,6 +241,7 @@ function respond(view, { text, fields, code = 0 }) {
 /** @param {import("./types.d.ts").ApiResponse | null} payload @param {number} status */
 function describeRefusal(payload, status) {
   const message = payload?.error?.message || payload?.message || `HTTP ${status}`;
+
   return `${status} ${sanitizeText(String(message))}`;
 }
 
@@ -234,9 +260,11 @@ async function startLogin(method, context, api_url) {
     fetch_impl: context.fetch_impl,
     timeout_ms: LOGIN_CONFIGS.REQUEST_TIMEOUT_MS
   });
+
   if (!ok) throw new Error(`Could not start signing in: ${describeRefusal(payload, status)}`);
 
   const data = /** @type {Record<string, unknown>} */ (payload?.data ?? {});
+
   for (const name of ["id", "user_code", "verification_url", "poll_secret"]) {
     if (typeof data[name] !== "string") {
       throw new Error(`The API answered without a ${name}. Check --api-url.`);
@@ -244,9 +272,11 @@ async function startLogin(method, context, api_url) {
   }
 
   const expires_at = Date.parse(String(data.expires_at));
+
   if (!Number.isFinite(expires_at)) {
     throw new Error("The API answered without a valid sign-in expiry. Check --api-url.");
   }
+
   /** @type {import("./types.d.ts").PendingLogin} */
   const pending = {
     id: String(data.id),
@@ -258,6 +288,7 @@ async function startLogin(method, context, api_url) {
     started_at: context.now(),
     expires_at
   };
+
   await updateConfig((current) => ({ ...current, pending_login: pending }), context.config_path);
   return pending;
 }
@@ -286,6 +317,7 @@ async function pollLogin(pending, context) {
 
   /** @type {Awaited<ReturnType<typeof sendRequest>>} */
   let response;
+
   try {
     response = await sendRequest({
       method: "POST",
@@ -312,6 +344,7 @@ async function pollLogin(pending, context) {
     data.credential && typeof data.credential === "object"
       ? /** @type {Record<string, unknown>} */ (data.credential)
       : null;
+
   return {
     status: typeof data.status === "string" ? data.status : "retry",
     status_reason: typeof data.status_reason === "string" ? data.status_reason : null,
@@ -340,25 +373,35 @@ async function pollUntilAnswered(
   let interval_ms = LOGIN_CONFIGS.DEFAULT_INTERVAL_MS;
   let wait_ms = poll_first ? 0 : interval_ms;
   let last_status = null;
+
   while (true) {
     if (context.now() + wait_ms >= deadline_ms) {
       if (poll_at_deadline) {
         // Keep the server's polling interval even when the expiry falls between two polls.
         if (wait_ms > 0) await context.sleep(wait_ms);
+
         const result = await pollLogin(pending, context);
+
         if (!["pending", "slow_down", "retry"].includes(result.status)) return result;
+
         last_status = result.status;
       }
+
       const status = last_status === "retry" ? "unreachable" : "pending";
+
       return { status, status_reason: null, interval_ms, credential: null };
     }
+
     if (wait_ms > 0) await context.sleep(wait_ms);
 
     const result = await pollLogin(pending, context);
+
     last_status = result.status;
     interval_ms = Math.max(interval_ms, result.interval_ms);
+
     if (result.status === "slow_down") interval_ms += LOGIN_CONFIGS.SLOW_DOWN_STEP_MS;
     if (!["pending", "slow_down", "retry"].includes(result.status)) return result;
+
     wait_ms = interval_ms;
   }
 }
@@ -373,6 +416,7 @@ async function pollUntilAnswered(
  */
 async function removeIssuedCredential(login, context) {
   const is_session = login.type === "session";
+
   try {
     const { ok, status, payload } = await sendRequest({
       method: is_session ? "POST" : "DELETE",
@@ -385,9 +429,11 @@ async function removeIssuedCredential(login, context) {
       fetch_impl: context.fetch_impl,
       timeout_ms: LOGIN_CONFIGS.REQUEST_TIMEOUT_MS
     });
+
     if (ok) return "removed";
     if (payload?.error?.code === "auth_invalid_credentials") return "already_gone";
     if (status >= 500) return "unreachable";
+
     return "refused";
   } catch {
     return "unreachable";
@@ -434,13 +480,17 @@ async function finishLogin(pending, credential, view, context) {
   // narrowing of a local would lose it.
   /** @type {{ previous: import("./types.d.ts").StoredLogin | null; is_current: boolean }} */
   const swap = { previous: null, is_current: false };
+
   try {
     await updateConfig((current) => {
       // `tglow logout` or `tglow login --new` discarded this sign-in while it waited.
       if (readPendingLogin(current)?.id !== pending.id) return current;
+
       swap.is_current = true;
       swap.previous = readStoredLogin(current);
+
       const { pending_login: _collected, ...rest } = current;
+
       return { ...rest, login };
     }, context.config_path);
   } catch (err) {
@@ -450,6 +500,7 @@ async function finishLogin(pending, credential, view, context) {
       outcome === "removed" || outcome === "already_gone"
         ? "so it was ended"
         : `and it is still active: remove it in ${describeCleanupPlace(login)}`;
+
     throw new Error(
       `${err instanceof Error ? err.message : String(err)}\n` +
         `The sign-in was approved, but its credential could not be stored here, ${fate}. Run \`tglow login --new\` to start again.`
@@ -462,6 +513,7 @@ async function finishLogin(pending, credential, view, context) {
     const text = is_removed
       ? "This sign-in was cancelled here while it waited, so its credential was ended instead of stored."
       : `This sign-in was cancelled here while it waited, so its credential was not stored. Remove it in ${describeCleanupPlace(login)}.`;
+
     return respond(view, {
       text,
       fields: { status: "cancelled", credential_id: login.id, removed: outcome, error: text },
@@ -471,6 +523,7 @@ async function finishLogin(pending, credential, view, context) {
 
   const replaced = swap.previous;
   let cleanup = "none";
+
   if (replaced && replaced.secret !== login.secret) {
     cleanup = await removeIssuedCredential(replaced, context);
   }
@@ -479,11 +532,13 @@ async function finishLogin(pending, credential, view, context) {
   const lines = [
     `Signed in as ${sanitizeText(login.email)} (team ${sanitizeText(login.team_id)}, ${kind}).`
   ];
+
   if (replaced && (cleanup === "refused" || cleanup === "unreachable")) {
     lines.push(
       `Could not remove the credential this replaced. Remove it in ${describeCleanupPlace(replaced)}.`
     );
   }
+
   lines.push(`Stored in ${context.config_path}, readable only by you.`);
 
   return respond(view, {
@@ -509,7 +564,9 @@ async function finishLogin(pending, credential, view, context) {
 async function forgetPendingLogin(pending_id, context) {
   await updateConfig((current) => {
     if (readPendingLogin(current)?.id !== pending_id) return current;
+
     const { pending_login: _forgotten, ...rest } = current;
+
     return rest;
   }, context.config_path);
 }
@@ -525,10 +582,13 @@ function describeEnded(result) {
       "If this terminal never received it, remove the unused one in the Tailglow app."
     );
   }
+
   if (result.status === "revoked") {
     const why = WITHDRAWN_MESSAGES[result.status_reason ?? ""] ?? "its approval no longer holds";
+
     return `The approval was withdrawn: ${why}.`;
   }
+
   return `The sign-in ended (${result.status}).`;
 }
 
@@ -540,6 +600,7 @@ function respondEnded(view, result) {
   // A collected sign-in stays pending for the process that collected it, so only --new replaces it.
   const next = result.status === "consumed" ? "tglow login --new" : "tglow login";
   const message = `${describeEnded(result)} Run \`${next}\` to start again.`;
+
   return respond(view, {
     text: message,
     fields: { status: result.status, status_reason: result.status_reason, error: message },
@@ -553,6 +614,7 @@ function respondEnded(view, result) {
  */
 function respondUnreachable(view, pending) {
   const text = `Could not reach ${sanitizeText(pending.api_url)}. The sign-in is kept: check the connection, then run \`tglow login --wait\`.`;
+
   return respond(view, {
     text,
     fields: { status: "unreachable", api_url: pending.api_url, error: text },
@@ -569,6 +631,7 @@ function respondPending(view, pending, { code = 0, is_waiting = false } = {}) {
   const next = "tglow login --wait";
   const opening = is_waiting ? "Still waiting for approval." : "To sign in, open this link:";
   const link = sanitizeText(pending.verification_url);
+
   return respond(view, {
     text: [
       opening,
@@ -659,24 +722,30 @@ const LOGIN_FLAGS = new Set(["json", "help", "api-url", "method", "wait", "new"]
  */
 export async function runLoginCommand(words, flags, context = createLoginContext()) {
   refuseUnexpected(words, flags, LOGIN_FLAGS);
+
   const view = { json: context.emits_json(flags) };
+
   if (readSwitch(flags, "help")) {
     return respond(view, { text: renderLoginHelp(), fields: describeLoginForMachines() });
   }
 
   const is_waiting = readSwitch(flags, "wait");
   const is_new = readSwitch(flags, "new");
+
   if (is_waiting && (is_new || flags.method !== undefined)) {
     throw new Error("--wait finishes the pending sign-in, so it takes no --new or --method.");
   }
 
   /** @type {"account" | "api_key" | null} */
   let requested_method = null;
+
   if (flags.method !== undefined) {
     const method = METHOD_FLAGS[/** @type {keyof typeof METHOD_FLAGS} */ (String(flags.method))];
+
     if (!method) {
       throw new Error(`--method must be account or api-key, received "${String(flags.method)}".`);
     }
+
     requested_method = method === "api_key" ? "api_key" : "account";
   }
 
@@ -684,6 +753,7 @@ export async function runLoginCommand(words, flags, context = createLoginContext
   const api_url = resolveApiUrl({ flags, config });
   const interactive = !view.json && context.is_interactive();
   let pending = readPendingLogin(config);
+
   if (pending && context.now() - pending.started_at > LOGIN_CONFIGS.PENDING_FORGET_MS) {
     await forgetPendingLogin(pending.id, context);
     pending = null;
@@ -697,19 +767,24 @@ export async function runLoginCommand(words, flags, context = createLoginContext
         `The waiting sign-in is for ${pending.api_url}. Pass --api-url ${pending.api_url}.`
       );
     }
+
     const result = await pollUntilAnswered(pending, context, {
       deadline_ms: context.now() + LOGIN_CONFIGS.WAIT_BUDGET_MS,
       poll_first: true
     });
+
     if (result.status === "pending") {
       return respondPending(view, pending, { code: LOGIN_CONFIGS.EXIT_PENDING, is_waiting: true });
     }
+
     if (result.status === "unreachable") return respondUnreachable(view, pending);
     if (result.status === "approved" && result.credential) {
       return finishLogin(pending, result.credential, view, context);
     }
+
     // Another process holding this sign-in collected it, and that process clears it.
     if (result.status !== "consumed") await forgetPendingLogin(pending.id, context);
+
     return respondEnded(view, result);
   }
 
@@ -720,16 +795,20 @@ export async function runLoginCommand(words, flags, context = createLoginContext
     !is_new &&
     isSameApiUrl(pending.api_url, api_url) &&
     (requested_method === null || requested_method === pending.method);
+
   if (pending && reusable) {
     let result = await pollLogin(pending, context);
+
     // A poll inside the server's interval answers slow_down without reading the sign-in.
     if (result.status === "slow_down") {
       await context.sleep(result.interval_ms);
       result = await pollLogin(pending, context);
     }
+
     if (result.status === "approved" && result.credential) {
       return finishLogin(pending, result.credential, view, context);
     }
+
     if (["pending", "slow_down", "retry"].includes(result.status)) {
       if (!interactive) return respondPending(view, pending);
     } else if (result.status === "consumed") {
@@ -744,21 +823,29 @@ export async function runLoginCommand(words, flags, context = createLoginContext
 
   if (!pending) {
     let method = requested_method;
+
     if (!method) method = interactive ? await context.choose_method() : "account";
     if (!method) return { output: "Cancelled.", code: 1 };
+
     pending = await startLogin(method, context, api_url);
+
     if (!interactive) return respondPending(view, pending);
   }
 
   const verification_url = readVerificationUrl(pending.verification_url);
+
   context.say(`Opening browser\n${verification_url}`);
   context.say(`Check the page shows the code ${sanitizeText(formatUserCode(pending.user_code))}.`);
   context.open_browser(verification_url);
+
   const expires_at = Number.isFinite(pending.expires_at)
     ? Number(pending.expires_at)
     : pending.started_at + LOGIN_CONFIGS.INTERACTIVE_BUDGET_MS;
+
   context.progress.start("Waiting for approval in the browser", expires_at);
+
   let result;
+
   try {
     result = await pollUntilAnswered(pending, context, {
       deadline_ms: expires_at,
@@ -767,28 +854,32 @@ export async function runLoginCommand(words, flags, context = createLoginContext
     });
   } finally {
     let message = "Stopped waiting";
+
     if (result?.status === "approved") message = "Approved";
     else if (result?.status === "pending")
       message = "Stopped waiting. Run `tglow login --wait` to resume.";
     else if (result?.status === "expired")
       message = "Sign-in code expired. Run `tglow login` to try again.";
     else if (result?.status === "unreachable") message = "Could not reach the API";
-    const outcome =
-      result?.status === "approved"
-        ? "success"
-        : ["pending", "expired"].includes(result?.status ?? "")
-          ? "cancel"
-          : "error";
+
+    /** @type {"success" | "cancel" | "error"} */
+    let outcome = "error";
+
+    if (result?.status === "approved") outcome = "success";
+    else if (["pending", "expired"].includes(result?.status ?? "")) outcome = "cancel";
+
     context.progress.stop(message, outcome);
   }
 
   if (result.status === "approved" && result.credential) {
     return finishLogin(pending, result.credential, view, context);
   }
+
   if (result.status === "pending") return { output: "", code: 0 };
   if (result.status === "unreachable") return respondUnreachable(view, pending);
   if (result.status !== "consumed") await forgetPendingLogin(pending.id, context);
   if (result.status === "expired") return { output: "", code: 0 };
+
   return respondEnded(view, result);
 }
 
@@ -800,7 +891,9 @@ export async function runLoginCommand(words, flags, context = createLoginContext
  */
 export async function runLogoutCommand(words, flags, context = createLoginContext()) {
   refuseUnexpected(words, flags, new Set(["json", "help"]));
+
   const view = { json: context.emits_json(flags) };
+
   if (readSwitch(flags, "help")) {
     return respond(view, { text: renderLoginHelp(), fields: describeLoginForMachines() });
   }
@@ -809,8 +902,11 @@ export async function runLogoutCommand(words, flags, context = createLoginContex
   // finishing at the same moment is either stored before this read or cancelled by it.
   const config = await withConfigLock(async () => {
     const stored = await loadConfig(context.config_path);
+
     if (!readPendingLogin(stored)) return stored;
+
     const { pending_login: _discarded, ...rest } = stored;
+
     await saveConfig(rest, context.config_path);
     return rest;
   }, context.config_path);
@@ -822,6 +918,7 @@ export async function runLogoutCommand(words, flags, context = createLoginContex
       typeof config.api_key === "string" || process.env.TAILGLOW_API_KEY
         ? " An API key from TAILGLOW_API_KEY or `tglow config` is still used; logout removes only what `tglow login` stored."
         : "";
+
     return respond(view, {
       text: `Not signed in with \`tglow login\`.${note}`,
       fields: { status: "signed_out", removed: "none" }
@@ -829,6 +926,7 @@ export async function runLogoutCommand(words, flags, context = createLoginContex
   }
 
   const outcome = await removeIssuedCredential(login, context);
+
   if (outcome === "unreachable") {
     return respond(view, {
       text: `Could not reach ${login.api_url} to end the credential, so it is still stored. Run \`tglow logout\` again.`,
@@ -839,7 +937,9 @@ export async function runLogoutCommand(words, flags, context = createLoginContex
 
   await updateConfig((current) => {
     if (readStoredLogin(current)?.secret !== login.secret) return current;
+
     const { login: _removed, ...rest } = current;
+
     return rest;
   }, context.config_path);
 
@@ -850,11 +950,14 @@ export async function runLogoutCommand(words, flags, context = createLoginContex
       code: 1
     });
   }
+
   const kind = login.type === "session" ? "CLI session" : "API key";
   let text = `Signed out. The ${kind} has been ended.`;
+
   if (outcome === "already_gone") {
     text = `Signed out. The API no longer accepted this ${kind}, so it was removed here only.`;
   }
+
   return respond(view, { text, fields: { status: "signed_out", removed: outcome } });
 }
 
@@ -866,7 +969,9 @@ export async function runLogoutCommand(words, flags, context = createLoginContex
  */
 export async function runWhoamiCommand(words, flags, context = createLoginContext()) {
   refuseUnexpected(words, flags, new Set(["json", "help", "api-key", "api-url", "team"]));
+
   const view = { json: context.emits_json(flags) };
+
   if (readSwitch(flags, "help")) {
     return respond(view, { text: renderLoginHelp(), fields: describeLoginForMachines() });
   }
@@ -892,19 +997,23 @@ export async function runWhoamiCommand(words, flags, context = createLoginContex
   // A CLI session removed from its team still identifies the person, which is what they need to
   // know before signing in again.
   const is_refused = response.status === 401 || response.status === 403;
+
   if (is_refused && credential.login?.type === "session" && team_id) {
     const identity = await readAuth(null);
+
     if (identity.ok) {
       response = identity;
       team_refused = true;
     }
   }
+
   if (!response.ok) throw new Error(describeRefusal(response.payload, response.status));
 
   const auth = /** @type {Record<string, unknown>} */ (response.payload?.data ?? {});
   const auth_team_id = typeof auth.team_id === "string" ? auth.team_id : null;
 
   let team_name = null;
+
   if (auth_team_id) {
     const team = await sendRequest({
       method: "GET",
@@ -915,11 +1024,13 @@ export async function runWhoamiCommand(words, flags, context = createLoginContex
     }).catch(() => null);
 
     const team_data = /** @type {Record<string, unknown> | undefined} */ (team?.payload?.data);
+
     if (team?.ok && typeof team_data?.name === "string") team_name = team_data.name;
   }
 
   const is_user = auth.type === "user";
   let credential_label = "API key";
+
   if (credential.login?.type === "session") credential_label = "CLI session (tglow login)";
   if (credential.login?.type === "api_key") credential_label = "API key (tglow login)";
   if (credential.source === "env") credential_label = "API key (TAILGLOW_API_KEY)";
@@ -930,6 +1041,7 @@ export async function runWhoamiCommand(words, flags, context = createLoginContex
     : `API key ${sanitizeText(String(auth.name ?? auth.key_id ?? ""))}`;
 
   let team_line = "No team selected.";
+
   if (auth_team_id)
     team_line = `Team: ${team_name ? `${sanitizeText(team_name)} ` : ""}(${sanitizeText(auth_team_id)})`;
   if (team_refused)

package/src/output.js

@@ -35,6 +35,7 @@ export function sanitizeText(value) {
 
   return value.replaceAll(/[\u0000-\u001f\u007f-\u009f]/g, (character) => {
     if (escapes[character]) return escapes[character];
+
     return `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`;
   });
 }
@@ -45,6 +46,7 @@ function toCell(value) {
   if (typeof value === "string") return sanitizeText(value);
   if (typeof value === "number" || typeof value === "boolean") return String(value);
   if (Array.isArray(value)) return `${value.length} item${value.length === 1 ? "" : "s"}`;
+
   return "{...}";
 }
 
@@ -72,6 +74,7 @@ function selectColumns(rows) {
  */
 export function formatTable(data) {
   const rows = Array.isArray(data) ? data : [data];
+
   if (rows.length === 0) return "No results.";
   if (rows.some((row) => typeof row !== "object" || row === null)) {
     return rows.map((row) => sanitizeText(String(row))).join("\n");
@@ -113,6 +116,7 @@ export function renderResponse(payload, flags, stream = process.stdout) {
   if (shouldEmitJson(flags, stream)) return JSON.stringify(payload, null, 2);
 
   const data = payload && "data" in payload ? payload.data : payload;
+
   if (data === null || data === undefined) {
     return typeof payload?.message === "string" ? sanitizeText(payload.message) : "Done.";
   }
@@ -146,6 +150,7 @@ export function renderPagedResult(
   }
 
   const table = formatTable(data);
+
   if (!truncated) return table;
 
   return `${table}\n\nStopped at the result cap. Continue with:\n  ${sanitizeText(resume_command)}`;
@@ -165,13 +170,19 @@ export function writeCommandResult(
   { stdout = process.stdout, stderr = process.stderr } = {}
 ) {
   if (!output) return;
+
   const stream = code === 0 ? stdout : stderr;
+
   if (!json && stream.isTTY && (code !== 0 || message)) {
     const text = output.split("\n").map(sanitizeText).join("\n");
-    const write =
-      code === LOGIN_CONFIGS.EXIT_PENDING ? log.warn : code === 0 ? log.success : log.error;
+    let write = log.error;
+
+    if (code === LOGIN_CONFIGS.EXIT_PENDING) write = log.warn;
+    else if (code === 0) write = log.success;
+
     write(text, { output: stream });
     return;
   }
+
   stream.write(`${output}\n`);
 }