@vigilbase/cli 0.2.2 → 0.2.4

package/dist/lib/one-client.js

@@ -7,6 +7,7 @@ import { validateOneOrigin } from './config.js';
 import { validateStripePortalUrl } from './open-url.js';
 import { parseJsonResponse, requestText } from './network.js';
 import { oneErrorHint } from './one-error-hints.js';
+import { SCAN_FAILED_MESSAGE } from './format.js';
 import { retryAfterSeconds, VigilbaseApiError } from './client.js';
 /**
  * Tools that require Vigilbase One authentication (auth-required scanners).
@@ -59,7 +60,13 @@ export function resolveToolDefinition(toolName, publicTools, oneBaseUrl) {
     if (!isOneAuthRequiredTool(toolName))
         return null;
     const authRequired = ONE_AUTH_REQUIRED_TOOL_DEFINITIONS[toolName];
-    const origin = oneBaseUrl.replace(/\/+$/, '');
+    // Public-only commands defer checking --one-url / VIGILBASE_ONE_URL. Don't echo a value that fails the check: it can
+    // hold URL credentials or a token in its path or query. The paths stay relative.
+    let origin = '';
+    try {
+        origin = validateOneOrigin(oneBaseUrl);
+    }
+    catch { /* left relative */ }
     return {
         ...authRequired,
         uiUrl: authRequired.uiUrl.startsWith('http')
@@ -101,6 +108,7 @@ export class VigilbaseOneClient {
         }
         const send = () => requestText(this.config, url, {
             ...init,
+            option: '--one-url',
             headers: {
                 Accept: 'application/json',
                 ...(this.accessToken ? { Authorization: `Bearer ${this.accessToken}` } : {}),
@@ -133,9 +141,12 @@ export class VigilbaseOneClient {
         const hint = response.ok ? undefined : oneErrorHint({
             method: init?.method ?? 'GET', path, status: response.status, code: errorDetails.code, hasCustomerScope: options?.hasCustomerScope,
         });
+        // Every message below is the CLI's own; One's error text stays in the body, which is never printed.
         if (response.status === 401 || response.status === 403) {
-            throw new VigilbaseApiError(message ||
-                'Authentication required. Run `vigilbase login`.', { status: response.status, body: parsed, code: errorDetails.code, hint });
+            throw new VigilbaseApiError(message || (response.status === 401
+                ? 'Authentication required. Run `vigilbase login`.'
+                // Signed in, but One refuses this user or this request: logging in again won't help.
+                : "You don't have access to this."), { status: response.status, body: parsed, code: errorDetails.code, hint, isCliAuthored: true });
         }
         if (response.status === 429) {
             throw new VigilbaseApiError(message || 'Rate limit exceeded.', {
@@ -143,18 +154,21 @@ export class VigilbaseOneClient {
                 body: parsed,
                 retryAfterSec: retryAfterSeconds(response, body),
                 code: errorDetails.code,
+                isCliAuthored: true,
             });
         }
         const allowed = options?.allowStatuses ?? [];
         if (!response.ok && !allowed.includes(response.status)) {
             throw new VigilbaseApiError(message ||
-                `Request failed (HTTP ${response.status})`, { status: response.status, body: parsed, code: errorDetails.code, hint });
+                `Request failed (HTTP ${response.status}).`, { status: response.status, body: parsed, code: errorDetails.code, hint, isCliAuthored: true });
         }
         if (!z.record(z.string(), z.unknown()).safeParse(body).success) {
             throw new VigilbaseApiError('Invalid One API response. Expected a JSON object.', { status: response.status });
         }
         if (parsed.success === false || ('ok' in parsed && parsed.ok === false)) {
-            throw new VigilbaseApiError('One API reported an unsuccessful operation.', { status: response.status, body: parsed, code: errorDetails.code });
+            throw new VigilbaseApiError('One API reported an unsuccessful operation.', {
+                status: response.status, body: parsed, code: errorDetails.code, isCliAuthored: true,
+            });
         }
         return parsed;
     }
@@ -170,7 +184,7 @@ export class VigilbaseOneClient {
                     throw new VigilbaseApiError('Authentication required.', { status: 401 });
                 this.accessToken = token;
             }
-            const load = () => requestText(this.config, provider.userinfoEndpoint, { headers: { Authorization: `Bearer ${this.accessToken}`, Accept: 'application/json', 'User-Agent': this.config.userAgent } });
+            const load = () => requestText(this.config, provider.userinfoEndpoint, { option: '--auth-url', headers: { Authorization: `Bearer ${this.accessToken}`, Accept: 'application/json', 'User-Agent': this.config.userAgent } });
             let { response, text } = await load();
             if (response.status === 401 && this.managed) {
                 const token = await managedAccessToken(this.config, this.accessToken);
@@ -188,7 +202,7 @@ export class VigilbaseOneClient {
         }
         const { response, body } = await this.request('/api/auth/get-session');
         if (!response.ok) {
-            throw new VigilbaseApiError(`Failed to load One session (HTTP ${response.status})`, { status: response.status, body });
+            throw new VigilbaseApiError(`Failed to load One session (HTTP ${response.status})`, { status: response.status, body, isCliAuthored: true });
         }
         const schema = z.object({
             session: z.record(z.string(), z.unknown()).nullable().optional(),
@@ -283,10 +297,70 @@ export class VigilbaseOneClient {
         return this.requestJson(`/api/tool-runs/${encodeURIComponent(id)}`);
     }
     async executeTool(toolName, target) {
-        return this.requestJson(`/api/tools/${encodeURIComponent(toolName)}/execute`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ target }),
-        }, { allowStatuses: [422] });
+        try {
+            return await this.requestJson(`/api/tools/${encodeURIComponent(toolName)}/execute`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ target }),
+            }, { allowStatuses: [422] });
+        }
+        catch (error) {
+            const unassessed = unassessedScan(error);
+            if (unassessed)
+                return unassessed;
+            throw failedScanError(error) ?? error;
+        }
     }
 }
+/** One's answer when the scan itself failed, for example when com ran out of memory. */
+const failedScanSchema = z.object({
+    success: z.literal(false),
+    data: z.object({ status: z.literal('failed'), toolRunId: z.unknown().optional() }).passthrough(),
+}).passthrough();
+const unassessedScanSchema = z.object({
+    code: z.literal('scan_unassessed'),
+    data: z.object({
+        toolRunId: z.unknown().optional(),
+        result: z.object({ status: z.literal('error'), message: z.string() }).passthrough(),
+    }),
+});
+/**
+ * A scan the scanner ran but could not assess (a bot verification challenge, an
+ * error page). The result carries the scanner's message, which the formatter
+ * prints bounded like any scanner result; One's error text stays unused.
+ */
+function unassessedScan(error) {
+    if (!(error instanceof VigilbaseApiError) || error.status !== 422)
+        return undefined;
+    const unassessed = unassessedScanSchema.safeParse(error.body);
+    if (!unassessed.success)
+        return undefined;
+    const toolRunId = z.string().uuid().safeParse(unassessed.data.data.toolRunId);
+    return {
+        success: false,
+        code: 'scan_unassessed',
+        data: {
+            toolRunId: toolRunId.success ? toolRunId.data : undefined,
+            status: 'failed',
+            grade: null,
+            gradeScore: null,
+            result: unassessed.data.data.result,
+        },
+    };
+}
+/** com's copy for a 422 failed scan, with the run One recorded; One's error text stays hidden. */
+function failedScanError(error) {
+    if (!(error instanceof VigilbaseApiError) || error.status !== 422)
+        return undefined;
+    const failed = failedScanSchema.safeParse(error.body);
+    if (!failed.success)
+        return undefined;
+    const toolRunId = z.string().uuid().safeParse(failed.data.data.toolRunId);
+    return new VigilbaseApiError(SCAN_FAILED_MESSAGE, {
+        status: 422,
+        body: error.body,
+        code: error.code,
+        isCliAuthored: true,
+        toolRunId: toolRunId.success ? toolRunId.data : undefined,
+    });
+}

package/dist/lib/open-url.js

@@ -1,5 +1,6 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { validateOneOrigin } from './config.js';
+import { isCi } from './platform.js';
 /** Stripe Customer Portal uses this exact host; never trust a returned URL by type alone. */
 export function validateStripePortalUrl(raw) {
     if (typeof raw !== 'string' || /[\u0000-\u0020\u007f-\u009f]/.test(raw)) {
@@ -23,7 +24,7 @@ export function validateStripePortalUrl(raw) {
 export function isHeadlessEnvironment(env = process.env) {
     if (env.VIGILBASE_CLI_NO_OPEN === '1')
         return true;
-    if (env.CI === '1' || env.CI === 'true')
+    if (isCi(env))
         return true;
     if (env.GITHUB_ACTIONS === 'true')
         return true;

package/dist/lib/platform.d.ts

@@ -1,2 +1,4 @@
 /** The host platform. A function rather than a constant so tests can simulate Windows. */
 export declare function platform(): NodeJS.Platform;
+/** Running in CI: `CI` set to anything but `0` or `false` (any case). */
+export declare function isCi(env?: NodeJS.ProcessEnv): boolean;

package/dist/lib/platform.js

@@ -2,3 +2,8 @@
 export function platform() {
     return process.platform;
 }
+/** Running in CI: `CI` set to anything but `0` or `false` (any case). */
+export function isCi(env = process.env) {
+    const value = env.CI;
+    return value !== undefined && value !== '' && value !== '0' && value.toLowerCase() !== 'false';
+}

package/dist/lib/progress.d.ts

@@ -1,19 +1,34 @@
 import { type Writer } from './format.js';
+/** Where SIGINT arrives: the process, or a plain emitter in tests. */
+type SignalSource = {
+    once(event: 'SIGINT', listener: () => void): unknown;
+    removeListener(event: 'SIGINT', listener: () => void): unknown;
+    listenerCount(event: 'SIGINT'): number;
+};
 export type ProgressHandle = {
     stop: (finalMessage?: string) => void;
 };
 /**
- * Live indeterminate progress on stderr while a scan/request is in flight.
- * Disabled for --json, non-TTY, CI, and NO_COLOR-style quiet environments.
+ * Live indeterminate progress on stderr while a scan/request is in flight; see
+ * shouldShowProgress for when it is on. Ctrl-C clears the line before the process exits.
  */
 export declare function startProgress(label: string, options: {
     isEnabled: boolean;
-    stderr?: NodeJS.WritableStream;
+    stderr?: NodeJS.WritableStream & {
+        columns?: number;
+    };
     /** Soft expected duration used to fill the bar (ms). */
     expectedMs?: number;
+    signals?: SignalSource;
+    exit?: (code: number) => void;
 }): ProgressHandle;
+/**
+ * Progress shows for text output on a terminal stderr, except in CI, with TERM=dumb or with
+ * VIGILBASE_CLI_NO_PROGRESS=1. NO_COLOR does not turn it off: the spinner has no colour.
+ */
 export declare function shouldShowProgress(mode: 'text' | 'json', env?: NodeJS.ProcessEnv, stderr?: {
     isTTY?: boolean;
 }): boolean;
 /** Tiny helper so call sites stay readable. */
 export declare function withProgress<T>(label: string, mode: 'text' | 'json', work: () => Promise<T>, writer?: Writer): Promise<T>;
+export {};

package/dist/lib/progress.js

@@ -1,15 +1,58 @@
 import { sanitizeTerminal } from './format.js';
+import { isCi } from './platform.js';
 const SPINNER = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
 const BAR_WIDTH = 24;
+/** Back to the start of the line and erase it. */
+const CLEAR_LINE = '\r\x1b[2K';
 function renderBar(ratio) {
     const clamped = Math.max(0, Math.min(1, ratio));
     const filled = Math.round(clamped * BAR_WIDTH);
     const empty = BAR_WIDTH - filled;
     return `${'█'.repeat(filled)}${'░'.repeat(empty)}`;
 }
+const ZERO_WIDTH = /[\p{M}\u200b-\u200f\u2060-\u2064\ufe00-\ufe0f\ufeff]/u;
+const WIDE = /[\u1100-\u115f\u2e80-\u303e\u3041-\ua4cf\uac00-\ud7a3\uf900-\ufaff\ufe30-\ufe4f\uff00-\uff60\uffe0-\uffe6\u{20000}-\u{3fffd}\p{Extended_Pictographic}]/u;
+/** Terminal columns of one code point: CJK and emoji take two, combining marks none. */
+function charWidth(char) {
+    if (ZERO_WIDTH.test(char))
+        return 0;
+    return WIDE.test(char) ? 2 : 1;
+}
+function displayWidth(text) {
+    let width = 0;
+    for (const char of text)
+        width += charWidth(char);
+    return width;
+}
+/**
+ * One frame within `columns - 1` terminal columns, so the terminal never wraps it: the bar
+ * goes first, then the label is cut with an ellipsis.
+ */
+function fitFrame(spin, label, bar, elapsedSec, columns) {
+    const width = Math.max(1, columns - 1);
+    const suffix = `  ${elapsedSec}s`;
+    const full = `${spin} ${label}  ${bar}${suffix}`;
+    if (displayWidth(full) <= width)
+        return full;
+    const room = width - 2 - suffix.length;
+    if (displayWidth(label) <= room)
+        return `${spin} ${label}${suffix}`;
+    if (room < 2)
+        return spin;
+    let cut = '';
+    let used = 0;
+    for (const char of label) {
+        const next = charWidth(char);
+        if (used + next > room - 1)
+            break;
+        cut += char;
+        used += next;
+    }
+    return `${spin} ${cut.trimEnd()}…${suffix}`;
+}
 /**
- * Live indeterminate progress on stderr while a scan/request is in flight.
- * Disabled for --json, non-TTY, CI, and NO_COLOR-style quiet environments.
+ * Live indeterminate progress on stderr while a scan/request is in flight; see
+ * shouldShowProgress for when it is on. Ctrl-C clears the line before the process exits.
  */
 export function startProgress(label, options) {
     label = sanitizeTerminal(label).replace(/[\n\t]/g, ' ');
@@ -17,6 +60,8 @@ export function startProgress(label, options) {
     if (!options.isEnabled) {
         return { stop: () => undefined };
     }
+    const signals = options.signals ?? process;
+    const exit = options.exit ?? ((code) => process.exit(code));
     const expectedMs = options.expectedMs ?? 8_000;
     const started = Date.now();
     let frame = 0;
@@ -31,31 +76,48 @@ export function startProgress(label, options) {
         const soft = Math.min(0.92, ratio);
         const spin = SPINNER[frame % SPINNER.length];
         frame += 1;
-        const line = `\r${spin} ${label}  ${renderBar(soft)}  ${elapsedSec}s`;
-        stream.write(line);
+        // Read the width every frame: the terminal may be resized.
+        stream.write(`${CLEAR_LINE}${fitFrame(spin, label, renderBar(soft), elapsedSec, stream.columns || 80)}`);
+    };
+    const close = () => {
+        closed = true;
+        clearInterval(timer);
+        signals.removeListener('SIGINT', onSigint);
+        stream.write(CLEAR_LINE);
+    };
+    // Without this, Ctrl-C kills the process mid-frame and the prompt lands on the spinner line.
+    // Another SIGINT listener (the checkup's cleanup) exits itself; alone, exit as Ctrl-C would.
+    const onSigint = () => {
+        if (closed)
+            return;
+        close();
+        if (signals.listenerCount('SIGINT') === 0)
+            exit(130);
     };
     draw();
     const timer = setInterval(draw, 80);
     timer.unref?.();
+    signals.once('SIGINT', onSigint);
     return {
         stop: (finalMessage) => {
             if (closed)
                 return;
-            closed = true;
-            clearInterval(timer);
-            const elapsedSec = ((Date.now() - started) / 1000).toFixed(1);
-            const clear = `\r${' '.repeat(Math.max(60, label.length + BAR_WIDTH + 20))}\r`;
-            stream.write(clear);
+            close();
             if (finalMessage) {
+                const elapsedSec = ((Date.now() - started) / 1000).toFixed(1);
                 stream.write(`${sanitizeTerminal(finalMessage).replace(/[\n\t]/g, ' ')} (${elapsedSec}s)\n`);
             }
         },
     };
 }
+/**
+ * Progress shows for text output on a terminal stderr, except in CI, with TERM=dumb or with
+ * VIGILBASE_CLI_NO_PROGRESS=1. NO_COLOR does not turn it off: the spinner has no colour.
+ */
 export function shouldShowProgress(mode, env = process.env, stderr = process.stderr) {
     if (mode === 'json')
         return false;
-    if (env.CI === '1' || env.CI === 'true')
+    if (isCi(env) || (env.TERM ?? '').toLowerCase() === 'dumb')
         return false;
     if (env.VIGILBASE_CLI_NO_PROGRESS === '1')
         return false;

package/dist/lib/system-trust.d.ts

@@ -4,4 +4,6 @@ type SystemTrustApi = {
 };
 /** CLI startup only: preserve bundled/extra CAs and add OS-managed trust. */
 export declare function configureSystemTrust(api?: SystemTrustApi): boolean;
+/** Whether configureSystemTrust added the OS certificates; TLS advice suggests a newer Node only when it couldn't. */
+export declare function isSystemTrustConfigured(): boolean;
 export {};

package/dist/lib/system-trust.js

@@ -1,4 +1,5 @@
 import * as tls from 'node:tls';
+let isConfigured = false;
 /** CLI startup only: preserve bundled/extra CAs and add OS-managed trust. */
 export function configureSystemTrust(api = tls) {
     if (!api.getCACertificates || !api.setDefaultCACertificates)
@@ -6,5 +7,10 @@ export function configureSystemTrust(api = tls) {
     api.setDefaultCACertificates([
         ...new Set([...api.getCACertificates('default'), ...api.getCACertificates('system')]),
     ]);
+    isConfigured = true;
     return true;
 }
+/** Whether configureSystemTrust added the OS certificates; TLS advice suggests a newer Node only when it couldn't. */
+export function isSystemTrustConfigured() {
+    return isConfigured;
+}

package/dist/lib/tui.d.ts

@@ -290,7 +290,7 @@ export declare class Tui {
     /** Raw mode off, the frame cleared, the cursor shown; nothing more is drawn. */
     private restore;
     private detachSignals;
-    /** Print the cancel message; exit with `code` unless another listener for `signal` will (it exits 130 after cleaning up). */
+    /** Print the cancel message; exit with `code` unless another listener for `signal` will (it cleans up and ends the command with CANCELLED). */
     private cancel;
     private readonly onSigint;
     private readonly onSigterm;

package/dist/lib/tui.js

@@ -9,15 +9,13 @@
  * echoed into the timeline, and Ctrl-C arrives as a key), a hidden cursor, and
  * SIGINT, SIGTERM and exit listeners that always restore both. Ctrl-C prints
  * the cancel message and is re-raised as SIGINT, so the other SIGINT listeners
- * (the cf runner and the cf install clean up, then exit 130) still run; with
+ * (the cf runner and the cf install stop cf or npm, clean up and end the
+ * command with CANCELLED, which exits 130, or 143 for SIGTERM) still run; with
  * none, the session exits 130 itself.
  */
 import { StringDecoder } from 'node:string_decoder';
 import { shouldUseColor } from './banner.js';
-/** Set, and not `0` or `false`. */
-function isSet(value) {
-    return value !== undefined && value !== '' && value !== '0' && value.toLowerCase() !== 'false';
-}
+import { isCi } from './platform.js';
 /**
  * The rich UI's features, or null for the plain line output: `--json`, stdin
  * or stderr not a terminal (pipes, files), TERM=dumb, or CI set.
@@ -28,7 +26,7 @@ export function terminalFeatures(options) {
         return null;
     if (!stdin?.isTTY || typeof stdin.setRawMode !== 'function' || !stderr?.isTTY)
         return null;
-    if ((env.TERM ?? '').toLowerCase() === 'dumb' || isSet(env.CI))
+    if ((env.TERM ?? '').toLowerCase() === 'dumb' || isCi(env))
         return null;
     return {
         color: shouldUseColor(stderr, env),
@@ -786,7 +784,7 @@ export class Tui {
         this.signals.removeListener('SIGTERM', this.onSigterm);
         this.signals.removeListener('exit', this.onExit);
     }
-    /** Print the cancel message; exit with `code` unless another listener for `signal` will (it exits 130 after cleaning up). */
+    /** Print the cancel message; exit with `code` unless another listener for `signal` will (it cleans up and ends the command with CANCELLED). */
     cancel(signal, code) {
         if (this.interrupted || this.closed)
             return;

package/dist/local/cloudflare-checkup/cf/child-env.js

@@ -66,10 +66,8 @@ export function buildChildEnv(parent, options) {
 }
 /** Variable names (never values) a cf child would receive, for `--dry-run` output. */
 export function childEnvVariableNames(parent, authMode, platform = process.platform) {
-    const names = Object.keys(buildChildEnv(parent, { purpose: 'api', authMode, accountId: '0'.repeat(32), platform }));
-    if (authMode === 'env' && !names.includes(CF_TOKEN_ENV))
-        names.push(CF_TOKEN_ENV);
-    return names.sort();
+    // The token is listed only when it is set (and copied): without it a real run stops with CF_AUTH_REQUIRED.
+    return Object.keys(buildChildEnv(parent, { purpose: 'api', authMode, accountId: '0'.repeat(32), platform })).sort();
 }
 /** Shown in profile and default modes when the token variable is set in the parent shell. */
 export function strippedTokenNotice(authMode) {

package/dist/local/cloudflare-checkup/cf/install.d.ts

@@ -23,13 +23,14 @@
  *   directory is deleted (CF_INSTALL_FAILED). Only then is it renamed into
  *   place, so a half-finished install is never used. `locateCf` still applies
  *   its identity checks to the result.
- * - Ctrl-C while npm runs kills npm and removes the staging directory. Staging
+ * - Ctrl-C (or SIGTERM, SIGHUP) while npm runs kills npm and removes the
+ *   staging directory, then the install rejects with CANCELLED. Staging
  *   directories left by a crash or a closed terminal are removed by the next
  *   install once they are older than the npm timeout (a concurrent install is
  *   always younger), and by `logout`.
  */
 import { type ChildProcess, type SpawnOptions } from 'node:child_process';
-import { LocalCheckupError } from '../errors.js';
+import { LocalCheckupError, type CancelSignalSource } from '../errors.js';
 /** The cf release the CLI installs; `integrity` is npm's `dist.integrity` for it. */
 export declare const MANAGED_CF: Readonly<{
     version: "1.0.0-beta.13";
@@ -97,6 +98,7 @@ export declare function installManagedCf(options: {
     replace?: boolean;
     /** Runs first on Ctrl-C during the install (the caller stops its spinner). */
     onInterrupt?: () => void;
+    signals?: CancelSignalSource;
 }): Promise<string>;
 /** `logout`: remove every managed cf version (and any staging leftovers). */
 export declare function removeManagedCf(configDir: string): Promise<{

package/dist/local/cloudflare-checkup/cf/install.js

@@ -23,7 +23,8 @@
  *   directory is deleted (CF_INSTALL_FAILED). Only then is it renamed into
  *   place, so a half-finished install is never used. `locateCf` still applies
  *   its identity checks to the result.
- * - Ctrl-C while npm runs kills npm and removes the staging directory. Staging
+ * - Ctrl-C (or SIGTERM, SIGHUP) while npm runs kills npm and removes the
+ *   staging directory, then the install rejects with CANCELLED. Staging
  *   directories left by a crash or a closed terminal are removed by the next
  *   install once they are older than the npm timeout (a concurrent install is
  *   always younger), and by `logout`.
@@ -32,7 +33,7 @@ import { spawn as nodeSpawn } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { chmod, lstat, mkdir, mkdtemp, readdir, readFile, realpath, rename, rm, stat } from 'node:fs/promises';
 import path from 'node:path';
-import { LocalCheckupError } from '../errors.js';
+import { CANCEL_SIGNALS, CheckupCancelledError, LocalCheckupError } from '../errors.js';
 /** The cf release the CLI installs; `integrity` is npm's `dist.integrity` for it. */
 export const MANAGED_CF = Object.freeze({
     version: '1.0.0-beta.13',
@@ -220,25 +221,38 @@ export async function removeStaleStaging(root, maxAgeMs = STALE_STAGING_MS, now
     return removed;
 }
 /**
- * Ctrl-C while npm runs: kill npm, wait briefly for it to exit, remove the
- * staging directory, then exit 130 (as `withCfRunner` does for cf).
+ * SIGINT, SIGTERM or SIGHUP while installing: kill npm and reject `interrupted`
+ * with CANCELLED; `closed` settles once npm has exited (2 s at most).
  */
-function onInterrupt(staging, running, before) {
-    return () => {
-        before?.();
-        const child = running();
-        const closed = child && child.exitCode === null && child.signalCode === null
-            ? new Promise((resolve) => {
-                child.once('close', () => resolve());
-                setTimeout(resolve, 2_000).unref?.();
-            })
-            : Promise.resolve();
-        child?.kill('SIGKILL');
-        void closed
-            .then(() => rm(staging, { recursive: true, force: true, maxRetries: 3 }))
-            .catch(() => undefined)
-            .finally(() => process.exit(130));
+function listenForCancel(signals, running, before) {
+    let interrupt = () => undefined;
+    const state = {
+        error: null,
+        closed: Promise.resolve(),
+        interrupted: new Promise((_resolve, reject) => { interrupt = reject; }),
+        stop: () => { for (const { signal, listener } of listeners)
+            signals.removeListener(signal, listener); },
     };
+    const listeners = CANCEL_SIGNALS.map((signal) => {
+        const listener = () => {
+            if (state.error)
+                return;
+            state.error = new CheckupCancelledError(signal);
+            before?.();
+            const child = running();
+            if (child && child.exitCode === null && child.signalCode === null) {
+                state.closed = new Promise((resolve) => {
+                    child.once('close', () => resolve());
+                    setTimeout(resolve, 2_000).unref?.();
+                });
+            }
+            child?.kill('SIGKILL');
+            interrupt(state.error);
+        };
+        signals.on(signal, listener);
+        return { signal, listener };
+    });
+    return state;
 }
 /**
  * Install the pinned cf into `<configDir>/cf/<version>/` and return its
@@ -257,17 +271,21 @@ export async function installManagedCf(options) {
     // realpath: npm keys its lockfile relative to the real prefix, so a symlinked path would not match `node_modules/cf`.
     const staging = await realpath(await mkdtemp(path.join(root, `${STAGING_PREFIX}${MANAGED_CF.version}-`)));
     let npmChild = null;
-    const interrupted = onInterrupt(staging, () => npmChild, options.onInterrupt);
-    process.once('SIGINT', interrupted);
-    try {
+    const cancel = listenForCancel(options.signals ?? process, () => npmChild, options.onInterrupt);
+    // After a cancel, the install stops at its next step instead of carrying on beside the cleanup.
+    const stopIfCancelled = () => { if (cancel.error)
+        throw cancel.error; };
+    const install = async () => {
         if (process.platform !== 'win32')
             await chmod(staging, 0o700);
+        stopIfCancelled();
         const result = await runNpm(options.spawn ?? nodeSpawn, npmInstallArgv(npmCli, staging), {
             cwd: staging,
             env: npmChildEnv(options.env),
             timeoutMs: options.timeoutMs ?? NPM_INSTALL_TIMEOUT_MS,
             onSpawn: (child) => { npmChild = child; },
         });
+        stopIfCancelled();
         if (result.spawnFailed)
             throw new CfInstallError('npm could not be started, so cf was not installed.');
         if (result.timedOut)
@@ -277,6 +295,7 @@ export async function installManagedCf(options) {
         if (!(await verifyManagedInstall(staging))) {
             throw new CfInstallError(`The installed cf does not match the pinned cf@${MANAGED_CF.version} integrity; it was deleted.`);
         }
+        stopIfCancelled();
         const installDir = managedCfInstallDir(options.configDir);
         // A leftover install that failed verification is replaced; a verified one (a concurrent run) is kept unless it is being replaced.
         if (!options.replace && await findManagedCf(options.configDir))
@@ -291,10 +310,22 @@ export async function installManagedCf(options) {
             throw new CfInstallError('The installed cf could not be moved into place.');
         }
         return managedCfPackageDir(installDir);
+    };
+    const task = install();
+    try {
+        return await Promise.race([task, cancel.interrupted]);
+    }
+    catch (error) {
+        throw cancel.error ?? error;
     }
     finally {
-        process.removeListener('SIGINT', interrupted);
-        await rm(staging, { recursive: true, force: true }).catch(() => undefined);
+        cancel.stop();
+        await cancel.closed;
+        // A cancelled install must stop before staging is removed under it; an npm that never closes holds it up 2 s at most.
+        if (cancel.error) {
+            await Promise.race([task.catch(() => undefined), new Promise((resolve) => setTimeout(resolve, 2_000))]);
+        }
+        await rm(staging, { recursive: true, force: true, maxRetries: 3 }).catch(() => undefined);
     }
 }
 /** `logout`: remove every managed cf version (and any staging leftovers). */

package/dist/local/cloudflare-checkup/cf/locate.d.ts

@@ -24,6 +24,8 @@ export type CfLocation = {
 export declare function isNodeSupported(version?: string): boolean;
 /** cf runs under this Node via process.execPath; workerd ships no win32-arm64 build. */
 export declare function assertLocalRuntimeSupported(version?: string, platform?: NodeJS.Platform, arch?: string): void;
+/** process.cwd(), which throws for a deleted or unreadable working directory: CWD_UNAVAILABLE instead. */
+export declare function currentDirectory(): string;
 export declare function locateCf(options: {
     cfBin?: string;
     /** The verified managed cf package directory (`findManagedCf`), tried after `--cf-bin`. */

package/dist/local/cloudflare-checkup/cf/locate.js

@@ -56,11 +56,20 @@ function repositoryUrl(repository) {
     }
     return '';
 }
+/** process.cwd(), which throws for a deleted or unreadable working directory: CWD_UNAVAILABLE instead. */
+export function currentDirectory() {
+    try {
+        return process.cwd();
+    }
+    catch {
+        throw new LocalCheckupError('CWD_UNAVAILABLE', 'The current directory no longer exists or cannot be read.');
+    }
+}
 export async function locateCf(options) {
     const platform = options.platform ?? process.platform;
     const p = platform === 'win32' ? path.win32 : path.posix;
     const fs = options.fs ?? nodeFs;
-    const cwd = options.cwd ?? process.cwd();
+    const cwd = options.cwd ?? currentDirectory();
     const home = options.home ?? (envLookup(options.env, platform, platform === 'win32' ? 'USERPROFILE' : 'HOME') || homedir());
     const cwdIsHome = Boolean(home) && p.isAbsolute(home) && p.relative(home, cwd) === '';
     let sawOther = false;