@ultimat3/cli 1.2.0 → 3.0.0

package/src/errors.ts

@@ -1,136 +1,8 @@
-// The X_* codes owned by @ultimat3/cli. Every one names the exact command that resolves it,
-// because the CLI is the surface an agent reads first — a failure here has to be actionable
-// without a doc lookup or a second round-trip.
-import { registerErrorCodes, UltimateError } from '@ultimat3/core';
-
-/** Codes this package declares and owns. */
-export const CLI_OWNED_ERROR_CODES = [
-  'X_CLI_UNKNOWN_COMMAND',
-  'X_CLI_BAD_FLAG',
-  'X_VERIFY_FAILED',
-  'X_NOT_IN_APP',
-  'X_BUN_VERSION',
-  'X_TEST_NO_FILES',
-  'X_TEST_SHARD_FAILED',
-  'X_SCAFFOLD_PATH_ESCAPE',
-  'X_GENERATE_JSON_INVALID',
-  'X_APP_PACKAGE_INVALID',
-  'X_ERROR_CODE_UNKNOWN',
-  'X_DECLARATION_UNKNOWN',
-  'X_JOB_UNKNOWN',
-  'X_FIX_TARGET_UNKNOWN',
-  'X_ERROR_FIX_INVALID',
-  'X_ERROR_CODE_UNDOCUMENTED',
-  'X_ERROR_CODE_UNREGISTERED',
-  // Reported as `Finding`s rather than thrown, and unregistered until now because of it — so
-  // `x errors explain X_TYPECHECK_FAILED` refused a code `x verify` had just printed. A finding
-  // carries an `X_*` code to the same reader a throw does; the registry is what makes that code
-  // explainable, unique and documented-or-fail, so a code the CLI emits is a code the CLI owns.
-  'X_CLI_UNEXPECTED',
-  'X_TYPECHECK_FAILED',
-  'X_LINT_FAILED',
-  'X_TEST_FAILED',
-  'X_FILE_TOO_LONG',
-  'X_PACKAGE_SHAPE',
-  'X_RELEASE_VERSION_SKEW',
-  'X_MANIFEST_STALE',
-  'X_BUDGET_UNMEASURED',
-  'X_BUILD_FAILED',
-  'X_BUILD_ENTRY_MISSING',
-  'X_DEPLOY_FAILED',
-  // The two the container's own environment can get wrong. A PaaS injects `PORT` and a supervisor
-  // injects `ROLE`; both arrive as strings from outside the app, so both are validated at boot
-  // rather than defaulted — a web role that quietly bound 3000 when the platform said 8080 fails
-  // its health check with nothing in the log that names the cause.
-  'X_ROLE_UNKNOWN',
-  'X_PORT_INVALID',
-  'X_GENERATE_CONFLICT',
-  'X_PORT_IN_USE',
-  'X_DB_GEN_FAILED',
-  'X_DB_MIGRATE_FAILED',
-  'X_DB_BRANCH_FAILED',
-  'X_DB_STUDIO_FAILED',
-  // The five app-surface boundary codes. `@ultimat3/render` owns the *rule* (`checkSurfaceBoundary`)
-  // and the CLI owns the diagnostic, because `x verify` and `x fix boundary` are the two commands
-  // that report it — see `app-boundaries.ts`, which holds the one rule-to-code table.
-  'X_BOUNDARY_SITE_TO_APP',
-  'X_BOUNDARY_SHARED_LEAF',
-  'X_BOUNDARY_APP_TO_API',
-  'X_BOUNDARY_ROUTE_TO_DB',
-  'X_BOUNDARY_SERVICE_TO_HTTP',
-] as const;
-
-/**
- * `X_NOT_IMPLEMENTED` is `@ultimat3/core`'s — `CliNotImplementedError` and every planned command
- * throw it, and none of them may declare a title for it. The CLI is the process that imports every
- * package (`error-catalog.ts`), so a title declared twice here is the one that would win by load
- * order rather than by ownership.
- */
-export const CLI_BORROWED_ERROR_CODES = ['X_NOT_IMPLEMENTED'] as const;
-
-/** Every code the CLI can throw: the ones it owns plus the one it borrows. */
-export const CLI_ERROR_CODES = [...CLI_OWNED_ERROR_CODES, ...CLI_BORROWED_ERROR_CODES] as const;
-
-export type CliOwnedErrorCode = (typeof CLI_OWNED_ERROR_CODES)[number];
-export type CliErrorCode = (typeof CLI_ERROR_CODES)[number];
-
-/**
- * Registered titles, so `x errors list` enumerates the CLI's codes alongside every other
- * package's instead of leaving a hole an agent has to read source to fill. Typed over
- * `CliOwnedErrorCode`, so adding a code without a title is a build error.
- */
-export const CLI_ERROR_TITLES: Readonly<Record<CliOwnedErrorCode, string>> = {
-  X_CLI_UNKNOWN_COMMAND: 'not a command in the registry',
-  X_CLI_BAD_FLAG: 'unknown flag, missing value, or a value the command refuses',
-  X_VERIFY_FAILED: 'at least one x verify step failed',
-  X_NOT_IN_APP: 'the command needs an app root and found none',
-  X_BUN_VERSION: 'Bun is older than the framework floor',
-  X_TEST_NO_FILES: 'the test selection matched no files',
-  X_TEST_SHARD_FAILED: 'a test shard exited non-zero',
-  X_SCAFFOLD_PATH_ESCAPE: 'a generated path resolves outside the directory it is written into',
-  X_GENERATE_JSON_INVALID: "a generator's own merge: 'json' output does not parse as a JSON object",
-  X_APP_PACKAGE_INVALID: "the app's package.json supplies no name and version",
-  X_ERROR_CODE_UNKNOWN: 'no package registered this error code',
-  X_DECLARATION_UNKNOWN: 'no declaration with this name is registered',
-  X_JOB_UNKNOWN: 'the queue holds no job with this id',
-  X_FIX_TARGET_UNKNOWN: 'the named file is not one of the app source files',
-  X_ERROR_FIX_INVALID: "an error's fix line is not a runnable instruction",
-  X_ERROR_CODE_UNDOCUMENTED: 'a shipped error code has no row in the error reference',
-  X_ERROR_CODE_UNREGISTERED: 'the error reference documents a code no package registers',
-  X_CLI_UNEXPECTED: 'the CLI itself failed',
-  X_TYPECHECK_FAILED: 'tsc failed',
-  X_LINT_FAILED: 'Biome failed',
-  X_TEST_FAILED: 'a test type failed',
-  X_FILE_TOO_LONG: 'a source file is over 500 lines',
-  X_PACKAGE_SHAPE: 'a workspace package is missing a contract file',
-  X_RELEASE_VERSION_SKEW: 'a workspace is not at the lockstep version',
-  X_MANIFEST_STALE: 'openapi.json is stale',
-  X_BUDGET_UNMEASURED: 'a route declares a budget the build never measured',
-  X_BUILD_FAILED: 'x build failed',
-  X_BUILD_ENTRY_MISSING: "the build target's entry file is not in the app",
-  X_DEPLOY_FAILED: 'a deploy step failed',
-  X_ROLE_UNKNOWN: 'ROLE names something that is not a role',
-  X_PORT_INVALID: 'PORT is not a TCP port number',
-  X_GENERATE_CONFLICT: 'a generator would overwrite a file',
-  X_PORT_IN_USE: 'the dev port is taken',
-  X_DB_GEN_FAILED: 'x db gen failed',
-  X_DB_MIGRATE_FAILED: 'x db migrate failed',
-  X_DB_BRANCH_FAILED: 'an x db branch step failed',
-  X_DB_STUDIO_FAILED: 'x db studio failed',
-  X_BOUNDARY_SITE_TO_APP: 'site/ imported app/',
-  X_BOUNDARY_SHARED_LEAF: 'shared/ imported a surface',
-  X_BOUNDARY_APP_TO_API: 'app/ imported api/ at runtime',
-  X_BOUNDARY_ROUTE_TO_DB: 'a route touched the database',
-  X_BOUNDARY_SERVICE_TO_HTTP: 'a service imported HTTP',
-};
-
-// One unconditional call, so a second package claiming one of the CLI's codes throws
-// X_ERROR_CODE_DUPLICATE instead of losing silently to whichever module imported first.
-registerErrorCodes(
-  Object.fromEntries(Object.entries(CLI_ERROR_TITLES).map(([code, title]) => [code, { title }])),
-);
-
-export const docsFor = (code: CliErrorCode): string => `https://ultimate.dev/errors/${code}`;
+// The error classes @ultimat3/cli throws. One class per condition, each naming the exact command
+// that resolves it — the codes themselves, their titles and their registration are `./error-codes`,
+// so a package importing a class does not pull the table and vice versa.
+import { UltimateError } from '@ultimat3/core';
+import { docsFor } from './error-codes';
 
 /** An unknown command or subcommand. Carries a suggestion so the retry is one keystroke away. */
 export class UnknownCommandError extends UltimateError {
@@ -160,6 +32,49 @@ export class BadFlagError extends UltimateError {
   }
 }
 
+/**
+ * A required POSITIONAL argument that was not given. Its own class rather than a `BadFlagError`,
+ * because the cause then names a flag that does not exist — `x errors --json` reported
+ * `--code on "x errors"` and sent an agent straight into a second `X_CLI_BAD_FLAG` for the
+ * `--code` flag it had just been told about — and rather than `X_CLI_UNKNOWN_COMMAND`, which said
+ * "x g route is not a command" about a command form that is. `example` is a REAL invocation:
+ * `x g route <name>` pasted into a shell is a redirect, not a command.
+ */
+export class MissingPositionalError extends UltimateError {
+  constructor(input: { command: string; positional: string; example: string }) {
+    super({
+      code: 'X_CLI_BAD_FLAG',
+      cause: `"x ${input.command}" needs a <${input.positional}> positional and got none`,
+      fix: input.example,
+      docs: docsFor('X_CLI_BAD_FLAG'),
+    });
+  }
+}
+
+/**
+ * A command that declares subcommands, invoked with none and declaring no `defaultSubcommand`.
+ *
+ * `X_CLI_BAD_FLAG` is the code a missing positional already takes (`MissingPositionalError`), and a
+ * subcommand is one — a second code for "you left out an argument" is the synonym the registry
+ * exists to prevent. Its own class because the cause must not name a flag: the parser answered
+ * `subcommands[0]` before this existed, so `x db` ran `gen` and wrote a migration file nobody asked
+ * for. Help is the fix because which of six was meant is exactly what the caller did not say.
+ *
+ * `x help <command>`, never `x <command> --help`: the parser resolves the subcommand AFTER the
+ * flag loop, so `x db --help` throws THIS error again — a fix line that reproduces its own
+ * failure, verbatim, forever. `x help db` prints the subcommand list and the flags.
+ */
+export class MissingSubcommandError extends UltimateError {
+  constructor(input: { command: string; known: readonly string[] }) {
+    super({
+      code: 'X_CLI_BAD_FLAG',
+      cause: `"x ${input.command}" takes a subcommand and got none (one of: ${input.known.join(', ')})`,
+      fix: `x help ${input.command}`,
+      docs: docsFor('X_CLI_BAD_FLAG'),
+    });
+  }
+}
+
 /** At least one `x verify` step failed. The step findings carry the per-step fixes. */
 export class VerifyFailedError extends UltimateError {
   constructor(input: { failed: readonly string[] }) {
@@ -211,7 +126,7 @@ export class NoTestFilesError extends UltimateError {
     super({
       code: 'X_TEST_NO_FILES',
       cause: `no *.test.ts files${where} under ${input.root}`,
-      fix: parts.length === 0 ? 'x test --cwd <repo root>' : 'x test',
+      fix: parts.length === 0 ? 'x test --json   # run it from the repo root' : 'x test',
       docs: docsFor('X_TEST_NO_FILES'),
     });
   }
@@ -282,7 +197,7 @@ export class AppPackageInvalidError extends UltimateError {
     super({
       code: 'X_APP_PACKAGE_INVALID',
       cause: `${input.path} ${input.problem}, so the manifest has no app name or version to gate on`,
-      fix: 'bun pm pkg set name=<app> version=0.1.0',
+      fix: 'bun pm pkg set name=my-app version=0.1.0',
       docs: docsFor('X_APP_PACKAGE_INVALID'),
     });
   }
@@ -374,12 +289,28 @@ export class BuildEntryMissingError extends UltimateError {
     super({
       code: 'X_BUILD_ENTRY_MISSING',
       cause: `x build --target ${input.target} builds from ${input.entry}, and the app does not have it`,
-      fix: `x new <name> writes ${input.entry} — copy it from a fresh scaffold into this app`,
+      fix: `x new scratch-app --dry-run --json   # its file list carries ${input.entry}; copy that file into this app`,
       docs: docsFor('X_BUILD_ENTRY_MISSING'),
     });
   }
 }
 
+/**
+ * A client entry would not compile. `X_BUILD_FAILED`, not a code of its own: an island is a bundle
+ * entry point like any other, and the target's own logs are what says which line. The fix builds
+ * exactly that one file, so the next message an author reads is the compiler's and not the CLI's.
+ */
+export class IslandBuildFailedError extends UltimateError {
+  constructor(input: { file: string; logs: string }) {
+    super({
+      code: 'X_BUILD_FAILED',
+      cause: `${input.file} is an island entry point and would not bundle: ${input.logs}`,
+      fix: `bun build --target browser ${input.file}`,
+      docs: docsFor('X_BUILD_FAILED'),
+    });
+  }
+}
+
 /**
  * `ROLE` selects what a container is. One image runs every role, so a typo is a process that would
  * otherwise start, serve nothing and report healthy — the one failure a rolling deploy cannot see.
@@ -389,12 +320,35 @@ export class RoleUnknownError extends UltimateError {
     super({
       code: 'X_ROLE_UNKNOWN',
       cause: `ROLE="${input.role}" is not a role (known: ${input.known.join(', ')})`,
-      fix: `docker run -e ROLE=web <image>   # one of: ${input.known.join(', ')}`,
+      fix: `docker run -e ROLE=web my-app:latest   # one of: ${input.known.join(', ')}`,
       docs: docsFor('X_ROLE_UNKNOWN'),
     });
   }
 }
 
+/**
+ * The enqueue side and the claim side are looking at two different queues.
+ *
+ * `startServices` builds the drivers and captures them; `loadApp` imports the app's modules after
+ * it, and a module calling `setJobDriver()` at import time moves the ambient slot without touching
+ * the captured object. The worker then claims from what was captured while every
+ * `handle.enqueue()` publishes to what is ambient — jobs that are accepted, acknowledged, visible
+ * in `/_x` and never run. Refused at boot, because the alternative is a deployment that only ever
+ * looks healthy.
+ */
+export class RuntimeDriverSplitError extends UltimateError {
+  constructor(input: { driver: string; ambient: string; captured: string }) {
+    super({
+      code: 'X_RUNTIME_DRIVER_SPLIT',
+      // Both names are printed even when they are the same string — two `memory` drivers are two
+      // queues, and "they match" is exactly the reading that makes this bug invisible.
+      cause: `an app module installed a ${input.driver} driver (ambient: "${input.ambient}") that is not the object this boot captured ("${input.captured}"), so enqueues and claims would use different queues`,
+      fix: `pass the driver to the boot instead of installing it from an app module: runRole({ root, env, runtime: { ${input.driver}: yourDriver } })`,
+      docs: docsFor('X_RUNTIME_DRIVER_SPLIT'),
+    });
+  }
+}
+
 /**
  * Every PaaS injects `PORT` and expects the process to bind exactly it. Defaulting past a value
  * that will not parse is how a deploy comes up on 3000, fails the platform's health probe, and
@@ -407,12 +361,32 @@ export class PortInvalidError extends UltimateError {
     super({
       code: 'X_PORT_INVALID',
       cause: `${name}="${input.value}" is not a TCP port number between 0 and 65535`,
-      fix: `docker run -e ${name}=${name === 'PORT' ? 3000 : 9090} <image>`,
+      fix: `docker run -e ${name}=${name === 'PORT' ? 3000 : 9090} my-app:latest`,
       docs: docsFor('X_PORT_INVALID'),
     });
   }
 }
 
+/**
+ * `x env` was run in an app whose `app.config.ts` exports no `envSchema`. Not a silent success:
+ * writing a `.env.example` with no variables in it, or reporting "0 declared variables, all
+ * present", both read as a working environment declaration to whoever runs the command next.
+ *
+ * `X_CONFIG_INVALID` is core's code for "a configuration this process cannot boot on — env or
+ * `app.config.ts`", which is exactly this; the CLI names it in `CLI_BORROWED_ERROR_CODES` rather
+ * than minting a synonym.
+ */
+export class EnvSchemaMissingError extends UltimateError {
+  constructor(input: { subcommand: string }) {
+    super({
+      code: 'X_CONFIG_INVALID',
+      cause: `x env ${input.subcommand} needs the env declaration, and app.config.ts exports no "envSchema"`,
+      fix: "add to app.config.ts: export const envSchema = { DATABASE_URL: { type: 'url', description: 'Postgres connection URL' } } satisfies EnvSchema; export const env = defineEnv(envSchema);",
+      docs: docsFor('X_CONFIG_INVALID'),
+    });
+  }
+}
+
 /** An interface-complete command path whose remote/native half is not written yet. */
 export class CliNotImplementedError extends UltimateError {
   constructor(input: { feature: string; fix: string }) {
@@ -424,3 +398,92 @@ export class CliNotImplementedError extends UltimateError {
     });
   }
 }
+
+/**
+ * The process could not obtain a storage disk to write to.
+ *
+ * Thrown at boot rather than at the first upload, and with a `fix` naming the two real options —
+ * a writable volume or an object store — because the failure it replaces was a bare `EROFS` from
+ * inside Bun's `mkdirSync`, with no code, no fix, and no mention of storage. A hardened container
+ * (`readOnlyRootFilesystem: true`) CrashLooped 22 times on it before anyone could tell what the
+ * process wanted.
+ */
+export class StorageUnwritableError extends UltimateError {
+  constructor(cause: string, fix: string) {
+    super({ code: 'X_STORAGE_UNWRITABLE', cause, fix, docs: docsFor('X_STORAGE_UNWRITABLE') });
+  }
+}
+
+/**
+ * A non-local boot that fell through to the embedded disk with no `STORAGE_SIGNING_SECRET`. The
+ * key it would sign with is a string published in this repo, and `acceptSignedUpload` trusts a
+ * signed `maxBytes`/`contentType` over the app's own `uploadPolicy` — so anyone holding it mints
+ * an unlimited upload of any type, for any key, including another org's.
+ *
+ * `X_ENV_MISSING`, the code `@ultimat3/storage` already refuses this with, rather than a CLI twin:
+ * two codes for one condition is what `cmd-doctor.ts` says out loud about the PWA pair. What this
+ * adds is the sentence storage cannot write — that the disk itself was a fallback nobody chose.
+ * The fix names object storage first, because that is the answer for most deployments; the volume
+ * rung is behind the `#`, so the line still runs verbatim.
+ */
+export class LocalDiskUnsafeError extends UltimateError {
+  constructor(input: { environment: string; root: string }) {
+    super({
+      code: 'X_ENV_MISSING',
+      cause:
+        `no S3_ENDPOINT/S3_BUCKET, so this ${input.environment} process fell back to the embedded ` +
+        `disk at ${input.root} — and with no STORAGE_SIGNING_SECRET it would sign upload grants ` +
+        'with the development key published in @ultimat3/storage',
+      fix: 'export S3_ENDPOINT=https://s3.example.com S3_BUCKET=my-app-uploads   # or keep the disk on a mounted volume: export STORAGE_SIGNING_SECRET="$(openssl rand -hex 32)"',
+      docs: docsFor('X_ENV_MISSING'),
+    });
+  }
+}
+
+/**
+ * `x secrets edit` decrypts into a buffer and hands it to `$EDITOR`. There is no fallback editor:
+ * guessing one and opening a decrypted file in it is the last place a surprise belongs.
+ */
+export class SecretsEditorMissingError extends UltimateError {
+  constructor(input: { vars: readonly string[] }) {
+    super({
+      code: 'X_SECRETS_EDITOR_MISSING',
+      cause: `x secrets edit opens the decrypted secrets in an editor and none of ${input.vars.join(', ')} is set`,
+      fix: 'EDITOR=nano x secrets edit',
+      docs: docsFor('X_SECRETS_EDITOR_MISSING'),
+    });
+  }
+}
+
+/**
+ * The editor exited non-zero — a crash, or a deliberate abort. The buffer is discarded either way
+ * and the committed file is left exactly as it was: resealing a buffer whose editor failed would
+ * commit whatever half-written state the crash left behind.
+ */
+export class SecretsEditFailedError extends UltimateError {
+  constructor(input: { editor: string; code: number }) {
+    super({
+      code: 'X_SECRETS_EDIT_FAILED',
+      cause: `"${input.editor}" exited ${input.code}, so the decrypted buffer was discarded and the committed secrets file was not rewritten`,
+      fix: 'x secrets edit',
+      docs: docsFor('X_SECRETS_EDIT_FAILED'),
+    });
+  }
+}
+
+/**
+ * `x secrets init` would overwrite a file that already exists. `X_GENERATE_CONFLICT` is this
+ * package's own code for exactly that, and a second name for "a generator would clobber something"
+ * is the duplication the code registry exists to prevent. Losing a master key is unrecoverable —
+ * the committed file it opens is then ciphertext nobody can read again.
+ */
+export class SecretsExistsError extends UltimateError {
+  constructor(input: { path: string; fix: string }) {
+    super({
+      code: 'X_GENERATE_CONFLICT',
+      cause: `${input.path} already exists, and x secrets init would replace it`,
+      fix: input.fix,
+      docs: docsFor('X_GENERATE_CONFLICT'),
+    });
+  }
+}

package/src/exec.ts

@@ -5,7 +5,10 @@
 // `UltimateError` straight from core rather than a class in `./errors`: this module is imported by
 // every command, and `./errors` runs `registerErrorCodes` on import — a subprocess boundary must
 // not decide when the CLI's registry is populated. `X_CLI_UNEXPECTED` is owned there all the same.
-import { UltimateError } from '@ultimat3/core';
+import { renderThrowable, UltimateError } from '@ultimat3/core';
+// `shell-quote.ts` is a leaf — it imports nothing, so the subprocess boundary stays importable
+// from anywhere, this file's header rule about a single boundary included.
+import { quoteArg } from './shell-quote';
 
 export interface ExecResult {
   readonly command: readonly string[];
@@ -27,6 +30,43 @@ export type Runner = (command: readonly string[], options: ExecOptions) => Promi
 /** performance.now(), not Date.now(): the test preload freezes the wall clock on purpose. */
 const now = (): number => performance.now();
 
+/**
+ * The failure mode this file's header already promised was identical everywhere, and the one it
+ * never coded. `x deploy` on a machine without `docker` threw Bun's own `Error: Executable not
+ * found in $PATH`; `dispatch.ts` rendered it as `X_CLI_UNEXPECTED` with `fix: x doctor --json`,
+ * and `runDoctor` checks nothing about an absent binary — an instruction that cannot close the
+ * error is axiom 4 inverted. The code stays `X_CLI_UNEXPECTED` (the CLI already owns it for a
+ * failure of its own machinery); what changes is that the fix names the program to install.
+ *
+ * The program name goes through `quoteArg` at BOTH references: `docker compose` or any name a
+ * shell would resplit produced a `fix:` that runs something else, which is axiom 4 inverted twice
+ * in one line.
+ *
+ * The thrown value goes through core's render helper and is never interpolated: an `unknown`
+ * reaching a `cause:` through `${…}` is what `bun run error-render` refuses, and this one is
+ * genuinely unknown — Bun raises `ENOENT` for a missing program, `EACCES` for an unrunnable one.
+ *
+ * The return type is inferred so this stays one statement of `Bun.spawn`'s own shape.
+ */
+function spawnOrRefuse(command: readonly string[], options: ExecOptions) {
+  const [head = '', ...rest] = command;
+  try {
+    return Bun.spawn([head, ...rest], {
+      cwd: options.cwd,
+      env: options.env === undefined ? Bun.env : { ...Bun.env, ...options.env },
+      stdin: options.stdin === undefined ? 'ignore' : new TextEncoder().encode(options.stdin),
+      stdout: 'pipe',
+      stderr: 'pipe',
+    });
+  } catch (error) {
+    throw new UltimateError({
+      code: 'X_CLI_UNEXPECTED',
+      cause: `the CLI could not run "${head}" from ${options.cwd}: ${renderThrowable(error)}`,
+      fix: `install ${quoteArg(head)} and put it on PATH, then re-run — confirm with: command -v ${quoteArg(head)}`,
+    });
+  }
+}
+
 export const exec: Runner = async (command, options) => {
   const started = now();
   const [head, ...rest] = command;
@@ -40,13 +80,7 @@ export const exec: Runner = async (command, options) => {
       fix: 'pass the program as the first element: exec(["bun", "test"], { cwd })',
     });
   }
-  const proc = Bun.spawn([head, ...rest], {
-    cwd: options.cwd,
-    env: options.env === undefined ? Bun.env : { ...Bun.env, ...options.env },
-    stdin: options.stdin === undefined ? 'ignore' : new TextEncoder().encode(options.stdin),
-    stdout: 'pipe',
-    stderr: 'pipe',
-  });
+  const proc = spawnOrRefuse([head, ...rest], options);
   const [stdout, stderr, code] = await Promise.all([
     new Response(proc.stdout).text(),
     new Response(proc.stderr).text(),