@vigilbase/cli 0.2.3 → 0.2.4

package/dist/lib/network.js

@@ -1,9 +1,13 @@
+import { isSystemTrustConfigured } from './system-trust.js';
 export class NetworkError extends Error {
     code;
+    hint;
     status = 0;
-    constructor(message, code, cause) {
+    /** `hint` is printed after the error; doctor, which is the connectivity check, leaves it out. */
+    constructor(message, code, cause, hint) {
         super(message, { cause });
         this.code = code;
+        this.hint = hint;
         this.name = 'NetworkError';
     }
 }
@@ -18,21 +22,70 @@ function errorCodes(error, seen = new Set()) {
         ...(Array.isArray(item.errors) ? item.errors.flatMap((e) => errorCodes(e, seen)) : []),
     ];
 }
+/** Messages along the cause chain: undici reports a blocked port or a refused redirect only by message. */
+function causeMessages(error, seen = new Set()) {
+    if (!error || typeof error !== 'object' || seen.has(error))
+        return [];
+    seen.add(error);
+    const item = error;
+    return [...(typeof item.message === 'string' ? [item.message] : []), ...causeMessages(item.cause, seen)];
+}
 export function networkError(error, url, timeoutMs, timedOut) {
     // Never echo query strings, URL credentials, request bodies, or raw causes.
-    const endpoint = new URL(url).origin;
+    const { origin: endpoint, port } = new URL(url);
     const codes = errorCodes(error);
     const code = codes[0] ?? 'NETWORK_ERROR';
+    const messages = causeMessages(error);
     if (timedOut || codes.some((c) => /TIMEOUT|ETIMEDOUT/.test(c))) {
         return new NetworkError(`Request to ${endpoint} timed out after ${timeoutMs}ms. Check your connection or increase --timeout.`, 'TIMEOUT', error);
     }
+    if (messages.includes('bad port')) {
+        return new NetworkError(`Node's fetch refuses port ${port} of ${endpoint} (a port the Fetch standard blocks). Use another port.`, 'BLOCKED_PORT', error);
+    }
+    if (messages.includes('unexpected redirect')) {
+        return new NetworkError(`${endpoint} answered with a redirect, which the CLI does not follow.`, 'UNEXPECTED_REDIRECT', error);
+    }
     if (codes.some((c) => /CERT|SELF_SIGNED|UNABLE_TO_VERIFY|UNABLE_TO_GET_ISSUER/.test(c))) {
-        return new NetworkError(`TLS certificate verification failed for ${endpoint} (${code}). Use Node 22.19+ or Node 24.5+ for automatic system certificate trust. If your organization uses a private CA, configure NODE_EXTRA_CA_CERTS with its trusted PEM certificate.`, code, error);
+        // Without system trust (older Node), the OS certificate store isn't used at all.
+        const upgrade = isSystemTrustConfigured() ? '' : ' Use Node 22.19+ or Node 24.5+ for automatic system certificate trust.';
+        return new NetworkError(`TLS certificate verification failed for ${endpoint} (${code}).${upgrade} If your organization uses a private CA, configure NODE_EXTRA_CA_CERTS with its trusted PEM certificate.`, code, error);
     }
     if (codes.some((c) => c === 'ENOTFOUND' || c === 'EAI_AGAIN')) {
         return new NetworkError(`Cannot resolve ${endpoint} (${code}). Check DNS, your VPN, and the configured API URL.`, code, error);
     }
-    return new NetworkError(`Cannot connect to ${endpoint} (${code}). Check your connection, VPN, proxy settings, and API URL. Run \`vigilbase doctor\` for connectivity checks.`, code, error);
+    return new NetworkError(`Cannot connect to ${endpoint} (${code}). Check your connection, VPN, proxy settings, and API URL.`, code, error, 'Run `vigilbase doctor` for connectivity checks.');
+}
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/** The option that sets this origin, when the caller didn't name it. */
+function optionFor(config, origin) {
+    if (origin === config.publicBaseUrl)
+        return '--base-url';
+    if (origin === config.oneBaseUrl)
+        return '--one-url';
+    if (origin === config.identityBaseUrl)
+        return '--auth-url';
+    return undefined;
+}
+/** A redirect the CLI refuses, naming only the target's origin: its path and query may carry tokens. */
+function redirectError(config, url, response, named) {
+    const { origin } = new URL(url);
+    let target;
+    try {
+        const location = new URL(response.headers.get('location') ?? '', url);
+        if ((location.protocol === 'https:' || location.protocol === 'http:') && location.origin !== origin)
+            target = location.origin;
+    }
+    catch {
+        // An unparsable Location: say only that it redirected.
+    }
+    // Public, One and Identity may share an origin, so the caller's service decides the option.
+    const option = named ?? optionFor(config, origin);
+    const message = !target
+        ? `${origin} answered with a redirect (HTTP ${response.status}), which the CLI does not follow.`
+        : option
+            ? `${origin} redirected (HTTP ${response.status}) to ${target}. Set ${option} to that origin.`
+            : `${origin} redirected (HTTP ${response.status}) to ${target}, which the CLI does not follow.`;
+    return new NetworkError(message, 'UNEXPECTED_REDIRECT');
 }
 export const MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
 /** Bound decoded bytes even when Content-Length is absent, compressed, or dishonest. */
@@ -97,22 +150,33 @@ export function anySignal(signals) {
         signal.addEventListener('abort', onAbort, { once: true });
     return { signal: controller.signal, dispose };
 }
-/** Keep the timeout active until the complete response body has been read. */
-export async function requestText(config, url, init = {}) {
+/**
+ * Keep the timeout active until the complete response body has been read. `option` names the option that sets the
+ * service's origin, for the message when it redirects.
+ */
+export async function requestText(config, url, { option, ...init } = {}) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), config.timeoutMs);
     const { signal, dispose } = init.signal
         ? anySignal([init.signal, controller.signal])
         : { signal: controller.signal, dispose: () => undefined };
     try {
-        // Never forward token-bearing POST bodies (or credentials) through redirects.
-        // 'manual' is honoured because it surfaces the 3xx without following it.
-        const response = await fetch(url, { ...init, signal, redirect: init.redirect === 'manual' ? 'manual' : 'error' });
+        // Never follow redirects: they could carry token-bearing POST bodies (or credentials) elsewhere.
+        // 'manual' surfaces the 3xx, which is refused here unless the caller asked for it.
+        const response = await fetch(url, { ...init, signal, redirect: 'manual' });
+        if (init.redirect !== 'manual' && REDIRECT_STATUSES.has(response.status) && response.headers.has('location')) {
+            await response.body?.cancel().catch(() => undefined);
+            throw redirectError(config, url, response, option);
+        }
         return { response, text: await readBoundedBody(response, signal) };
     }
     catch (error) {
         if (error instanceof NetworkError)
             throw error;
+        // Fetch refuses a header value (a token with a newline) before sending anything. Its message holds the value.
+        if (error instanceof TypeError && error.cause === undefined && /header/i.test(error.message)) {
+            throw Object.assign(new Error('A request header contains characters HTTP does not allow, so nothing was sent.'), { code: 'INVALID_ARGUMENT' });
+        }
         if (init.signal?.aborted) {
             throw new NetworkError('Request cancelled.', 'CANCELLED', error);
         }

package/dist/lib/one-client.js

@@ -60,7 +60,13 @@ export function resolveToolDefinition(toolName, publicTools, oneBaseUrl) {
     if (!isOneAuthRequiredTool(toolName))
         return null;
     const authRequired = ONE_AUTH_REQUIRED_TOOL_DEFINITIONS[toolName];
-    const origin = oneBaseUrl.replace(/\/+$/, '');
+    // Public-only commands defer checking --one-url / VIGILBASE_ONE_URL. Don't echo a value that fails the check: it can
+    // hold URL credentials or a token in its path or query. The paths stay relative.
+    let origin = '';
+    try {
+        origin = validateOneOrigin(oneBaseUrl);
+    }
+    catch { /* left relative */ }
     return {
         ...authRequired,
         uiUrl: authRequired.uiUrl.startsWith('http')
@@ -102,6 +108,7 @@ export class VigilbaseOneClient {
         }
         const send = () => requestText(this.config, url, {
             ...init,
+            option: '--one-url',
             headers: {
                 Accept: 'application/json',
                 ...(this.accessToken ? { Authorization: `Bearer ${this.accessToken}` } : {}),
@@ -177,7 +184,7 @@ export class VigilbaseOneClient {
                     throw new VigilbaseApiError('Authentication required.', { status: 401 });
                 this.accessToken = token;
             }
-            const load = () => requestText(this.config, provider.userinfoEndpoint, { headers: { Authorization: `Bearer ${this.accessToken}`, Accept: 'application/json', 'User-Agent': this.config.userAgent } });
+            const load = () => requestText(this.config, provider.userinfoEndpoint, { option: '--auth-url', headers: { Authorization: `Bearer ${this.accessToken}`, Accept: 'application/json', 'User-Agent': this.config.userAgent } });
             let { response, text } = await load();
             if (response.status === 401 && this.managed) {
                 const token = await managedAccessToken(this.config, this.accessToken);

package/dist/lib/open-url.js

@@ -1,5 +1,6 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { validateOneOrigin } from './config.js';
+import { isCi } from './platform.js';
 /** Stripe Customer Portal uses this exact host; never trust a returned URL by type alone. */
 export function validateStripePortalUrl(raw) {
     if (typeof raw !== 'string' || /[\u0000-\u0020\u007f-\u009f]/.test(raw)) {
@@ -23,7 +24,7 @@ export function validateStripePortalUrl(raw) {
 export function isHeadlessEnvironment(env = process.env) {
     if (env.VIGILBASE_CLI_NO_OPEN === '1')
         return true;
-    if (env.CI === '1' || env.CI === 'true')
+    if (isCi(env))
         return true;
     if (env.GITHUB_ACTIONS === 'true')
         return true;

package/dist/lib/platform.d.ts

@@ -1,2 +1,4 @@
 /** The host platform. A function rather than a constant so tests can simulate Windows. */
 export declare function platform(): NodeJS.Platform;
+/** Running in CI: `CI` set to anything but `0` or `false` (any case). */
+export declare function isCi(env?: NodeJS.ProcessEnv): boolean;

package/dist/lib/platform.js

@@ -2,3 +2,8 @@
 export function platform() {
     return process.platform;
 }
+/** Running in CI: `CI` set to anything but `0` or `false` (any case). */
+export function isCi(env = process.env) {
+    const value = env.CI;
+    return value !== undefined && value !== '' && value !== '0' && value.toLowerCase() !== 'false';
+}

package/dist/lib/progress.d.ts

@@ -1,19 +1,34 @@
 import { type Writer } from './format.js';
+/** Where SIGINT arrives: the process, or a plain emitter in tests. */
+type SignalSource = {
+    once(event: 'SIGINT', listener: () => void): unknown;
+    removeListener(event: 'SIGINT', listener: () => void): unknown;
+    listenerCount(event: 'SIGINT'): number;
+};
 export type ProgressHandle = {
     stop: (finalMessage?: string) => void;
 };
 /**
- * Live indeterminate progress on stderr while a scan/request is in flight.
- * Disabled for --json, non-TTY, CI, and NO_COLOR-style quiet environments.
+ * Live indeterminate progress on stderr while a scan/request is in flight; see
+ * shouldShowProgress for when it is on. Ctrl-C clears the line before the process exits.
  */
 export declare function startProgress(label: string, options: {
     isEnabled: boolean;
-    stderr?: NodeJS.WritableStream;
+    stderr?: NodeJS.WritableStream & {
+        columns?: number;
+    };
     /** Soft expected duration used to fill the bar (ms). */
     expectedMs?: number;
+    signals?: SignalSource;
+    exit?: (code: number) => void;
 }): ProgressHandle;
+/**
+ * Progress shows for text output on a terminal stderr, except in CI, with TERM=dumb or with
+ * VIGILBASE_CLI_NO_PROGRESS=1. NO_COLOR does not turn it off: the spinner has no colour.
+ */
 export declare function shouldShowProgress(mode: 'text' | 'json', env?: NodeJS.ProcessEnv, stderr?: {
     isTTY?: boolean;
 }): boolean;
 /** Tiny helper so call sites stay readable. */
 export declare function withProgress<T>(label: string, mode: 'text' | 'json', work: () => Promise<T>, writer?: Writer): Promise<T>;
+export {};

package/dist/lib/progress.js

@@ -1,15 +1,58 @@
 import { sanitizeTerminal } from './format.js';
+import { isCi } from './platform.js';
 const SPINNER = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
 const BAR_WIDTH = 24;
+/** Back to the start of the line and erase it. */
+const CLEAR_LINE = '\r\x1b[2K';
 function renderBar(ratio) {
     const clamped = Math.max(0, Math.min(1, ratio));
     const filled = Math.round(clamped * BAR_WIDTH);
     const empty = BAR_WIDTH - filled;
     return `${'█'.repeat(filled)}${'░'.repeat(empty)}`;
 }
+const ZERO_WIDTH = /[\p{M}\u200b-\u200f\u2060-\u2064\ufe00-\ufe0f\ufeff]/u;
+const WIDE = /[\u1100-\u115f\u2e80-\u303e\u3041-\ua4cf\uac00-\ud7a3\uf900-\ufaff\ufe30-\ufe4f\uff00-\uff60\uffe0-\uffe6\u{20000}-\u{3fffd}\p{Extended_Pictographic}]/u;
+/** Terminal columns of one code point: CJK and emoji take two, combining marks none. */
+function charWidth(char) {
+    if (ZERO_WIDTH.test(char))
+        return 0;
+    return WIDE.test(char) ? 2 : 1;
+}
+function displayWidth(text) {
+    let width = 0;
+    for (const char of text)
+        width += charWidth(char);
+    return width;
+}
+/**
+ * One frame within `columns - 1` terminal columns, so the terminal never wraps it: the bar
+ * goes first, then the label is cut with an ellipsis.
+ */
+function fitFrame(spin, label, bar, elapsedSec, columns) {
+    const width = Math.max(1, columns - 1);
+    const suffix = `  ${elapsedSec}s`;
+    const full = `${spin} ${label}  ${bar}${suffix}`;
+    if (displayWidth(full) <= width)
+        return full;
+    const room = width - 2 - suffix.length;
+    if (displayWidth(label) <= room)
+        return `${spin} ${label}${suffix}`;
+    if (room < 2)
+        return spin;
+    let cut = '';
+    let used = 0;
+    for (const char of label) {
+        const next = charWidth(char);
+        if (used + next > room - 1)
+            break;
+        cut += char;
+        used += next;
+    }
+    return `${spin} ${cut.trimEnd()}…${suffix}`;
+}
 /**
- * Live indeterminate progress on stderr while a scan/request is in flight.
- * Disabled for --json, non-TTY, CI, and NO_COLOR-style quiet environments.
+ * Live indeterminate progress on stderr while a scan/request is in flight; see
+ * shouldShowProgress for when it is on. Ctrl-C clears the line before the process exits.
  */
 export function startProgress(label, options) {
     label = sanitizeTerminal(label).replace(/[\n\t]/g, ' ');
@@ -17,6 +60,8 @@ export function startProgress(label, options) {
     if (!options.isEnabled) {
         return { stop: () => undefined };
     }
+    const signals = options.signals ?? process;
+    const exit = options.exit ?? ((code) => process.exit(code));
     const expectedMs = options.expectedMs ?? 8_000;
     const started = Date.now();
     let frame = 0;
@@ -31,31 +76,48 @@ export function startProgress(label, options) {
         const soft = Math.min(0.92, ratio);
         const spin = SPINNER[frame % SPINNER.length];
         frame += 1;
-        const line = `\r${spin} ${label}  ${renderBar(soft)}  ${elapsedSec}s`;
-        stream.write(line);
+        // Read the width every frame: the terminal may be resized.
+        stream.write(`${CLEAR_LINE}${fitFrame(spin, label, renderBar(soft), elapsedSec, stream.columns || 80)}`);
+    };
+    const close = () => {
+        closed = true;
+        clearInterval(timer);
+        signals.removeListener('SIGINT', onSigint);
+        stream.write(CLEAR_LINE);
+    };
+    // Without this, Ctrl-C kills the process mid-frame and the prompt lands on the spinner line.
+    // Another SIGINT listener (the checkup's cleanup) exits itself; alone, exit as Ctrl-C would.
+    const onSigint = () => {
+        if (closed)
+            return;
+        close();
+        if (signals.listenerCount('SIGINT') === 0)
+            exit(130);
     };
     draw();
     const timer = setInterval(draw, 80);
     timer.unref?.();
+    signals.once('SIGINT', onSigint);
     return {
         stop: (finalMessage) => {
             if (closed)
                 return;
-            closed = true;
-            clearInterval(timer);
-            const elapsedSec = ((Date.now() - started) / 1000).toFixed(1);
-            const clear = `\r${' '.repeat(Math.max(60, label.length + BAR_WIDTH + 20))}\r`;
-            stream.write(clear);
+            close();
             if (finalMessage) {
+                const elapsedSec = ((Date.now() - started) / 1000).toFixed(1);
                 stream.write(`${sanitizeTerminal(finalMessage).replace(/[\n\t]/g, ' ')} (${elapsedSec}s)\n`);
             }
         },
     };
 }
+/**
+ * Progress shows for text output on a terminal stderr, except in CI, with TERM=dumb or with
+ * VIGILBASE_CLI_NO_PROGRESS=1. NO_COLOR does not turn it off: the spinner has no colour.
+ */
 export function shouldShowProgress(mode, env = process.env, stderr = process.stderr) {
     if (mode === 'json')
         return false;
-    if (env.CI === '1' || env.CI === 'true')
+    if (isCi(env) || (env.TERM ?? '').toLowerCase() === 'dumb')
         return false;
     if (env.VIGILBASE_CLI_NO_PROGRESS === '1')
         return false;

package/dist/lib/system-trust.d.ts

@@ -4,4 +4,6 @@ type SystemTrustApi = {
 };
 /** CLI startup only: preserve bundled/extra CAs and add OS-managed trust. */
 export declare function configureSystemTrust(api?: SystemTrustApi): boolean;
+/** Whether configureSystemTrust added the OS certificates; TLS advice suggests a newer Node only when it couldn't. */
+export declare function isSystemTrustConfigured(): boolean;
 export {};

package/dist/lib/system-trust.js

@@ -1,4 +1,5 @@
 import * as tls from 'node:tls';
+let isConfigured = false;
 /** CLI startup only: preserve bundled/extra CAs and add OS-managed trust. */
 export function configureSystemTrust(api = tls) {
     if (!api.getCACertificates || !api.setDefaultCACertificates)
@@ -6,5 +7,10 @@ export function configureSystemTrust(api = tls) {
     api.setDefaultCACertificates([
         ...new Set([...api.getCACertificates('default'), ...api.getCACertificates('system')]),
     ]);
+    isConfigured = true;
     return true;
 }
+/** Whether configureSystemTrust added the OS certificates; TLS advice suggests a newer Node only when it couldn't. */
+export function isSystemTrustConfigured() {
+    return isConfigured;
+}

package/dist/lib/tui.d.ts

@@ -290,7 +290,7 @@ export declare class Tui {
     /** Raw mode off, the frame cleared, the cursor shown; nothing more is drawn. */
     private restore;
     private detachSignals;
-    /** Print the cancel message; exit with `code` unless another listener for `signal` will (it exits 130 after cleaning up). */
+    /** Print the cancel message; exit with `code` unless another listener for `signal` will (it cleans up and ends the command with CANCELLED). */
     private cancel;
     private readonly onSigint;
     private readonly onSigterm;

package/dist/lib/tui.js

@@ -9,15 +9,13 @@
  * echoed into the timeline, and Ctrl-C arrives as a key), a hidden cursor, and
  * SIGINT, SIGTERM and exit listeners that always restore both. Ctrl-C prints
  * the cancel message and is re-raised as SIGINT, so the other SIGINT listeners
- * (the cf runner and the cf install clean up, then exit 130) still run; with
+ * (the cf runner and the cf install stop cf or npm, clean up and end the
+ * command with CANCELLED, which exits 130, or 143 for SIGTERM) still run; with
  * none, the session exits 130 itself.
  */
 import { StringDecoder } from 'node:string_decoder';
 import { shouldUseColor } from './banner.js';
-/** Set, and not `0` or `false`. */
-function isSet(value) {
-    return value !== undefined && value !== '' && value !== '0' && value.toLowerCase() !== 'false';
-}
+import { isCi } from './platform.js';
 /**
  * The rich UI's features, or null for the plain line output: `--json`, stdin
  * or stderr not a terminal (pipes, files), TERM=dumb, or CI set.
@@ -28,7 +26,7 @@ export function terminalFeatures(options) {
         return null;
     if (!stdin?.isTTY || typeof stdin.setRawMode !== 'function' || !stderr?.isTTY)
         return null;
-    if ((env.TERM ?? '').toLowerCase() === 'dumb' || isSet(env.CI))
+    if ((env.TERM ?? '').toLowerCase() === 'dumb' || isCi(env))
         return null;
     return {
         color: shouldUseColor(stderr, env),
@@ -786,7 +784,7 @@ export class Tui {
         this.signals.removeListener('SIGTERM', this.onSigterm);
         this.signals.removeListener('exit', this.onExit);
     }
-    /** Print the cancel message; exit with `code` unless another listener for `signal` will (it exits 130 after cleaning up). */
+    /** Print the cancel message; exit with `code` unless another listener for `signal` will (it cleans up and ends the command with CANCELLED). */
     cancel(signal, code) {
         if (this.interrupted || this.closed)
             return;

package/dist/local/cloudflare-checkup/cf/child-env.js

@@ -66,10 +66,8 @@ export function buildChildEnv(parent, options) {
 }
 /** Variable names (never values) a cf child would receive, for `--dry-run` output. */
 export function childEnvVariableNames(parent, authMode, platform = process.platform) {
-    const names = Object.keys(buildChildEnv(parent, { purpose: 'api', authMode, accountId: '0'.repeat(32), platform }));
-    if (authMode === 'env' && !names.includes(CF_TOKEN_ENV))
-        names.push(CF_TOKEN_ENV);
-    return names.sort();
+    // The token is listed only when it is set (and copied): without it a real run stops with CF_AUTH_REQUIRED.
+    return Object.keys(buildChildEnv(parent, { purpose: 'api', authMode, accountId: '0'.repeat(32), platform })).sort();
 }
 /** Shown in profile and default modes when the token variable is set in the parent shell. */
 export function strippedTokenNotice(authMode) {

package/dist/local/cloudflare-checkup/cf/install.d.ts

@@ -23,13 +23,14 @@
  *   directory is deleted (CF_INSTALL_FAILED). Only then is it renamed into
  *   place, so a half-finished install is never used. `locateCf` still applies
  *   its identity checks to the result.
- * - Ctrl-C while npm runs kills npm and removes the staging directory. Staging
+ * - Ctrl-C (or SIGTERM, SIGHUP) while npm runs kills npm and removes the
+ *   staging directory, then the install rejects with CANCELLED. Staging
  *   directories left by a crash or a closed terminal are removed by the next
  *   install once they are older than the npm timeout (a concurrent install is
  *   always younger), and by `logout`.
  */
 import { type ChildProcess, type SpawnOptions } from 'node:child_process';
-import { LocalCheckupError } from '../errors.js';
+import { LocalCheckupError, type CancelSignalSource } from '../errors.js';
 /** The cf release the CLI installs; `integrity` is npm's `dist.integrity` for it. */
 export declare const MANAGED_CF: Readonly<{
     version: "1.0.0-beta.13";
@@ -97,6 +98,7 @@ export declare function installManagedCf(options: {
     replace?: boolean;
     /** Runs first on Ctrl-C during the install (the caller stops its spinner). */
     onInterrupt?: () => void;
+    signals?: CancelSignalSource;
 }): Promise<string>;
 /** `logout`: remove every managed cf version (and any staging leftovers). */
 export declare function removeManagedCf(configDir: string): Promise<{

package/dist/local/cloudflare-checkup/cf/install.js

@@ -23,7 +23,8 @@
  *   directory is deleted (CF_INSTALL_FAILED). Only then is it renamed into
  *   place, so a half-finished install is never used. `locateCf` still applies
  *   its identity checks to the result.
- * - Ctrl-C while npm runs kills npm and removes the staging directory. Staging
+ * - Ctrl-C (or SIGTERM, SIGHUP) while npm runs kills npm and removes the
+ *   staging directory, then the install rejects with CANCELLED. Staging
  *   directories left by a crash or a closed terminal are removed by the next
  *   install once they are older than the npm timeout (a concurrent install is
  *   always younger), and by `logout`.
@@ -32,7 +33,7 @@ import { spawn as nodeSpawn } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { chmod, lstat, mkdir, mkdtemp, readdir, readFile, realpath, rename, rm, stat } from 'node:fs/promises';
 import path from 'node:path';
-import { LocalCheckupError } from '../errors.js';
+import { CANCEL_SIGNALS, CheckupCancelledError, LocalCheckupError } from '../errors.js';
 /** The cf release the CLI installs; `integrity` is npm's `dist.integrity` for it. */
 export const MANAGED_CF = Object.freeze({
     version: '1.0.0-beta.13',
@@ -220,25 +221,38 @@ export async function removeStaleStaging(root, maxAgeMs = STALE_STAGING_MS, now
     return removed;
 }
 /**
- * Ctrl-C while npm runs: kill npm, wait briefly for it to exit, remove the
- * staging directory, then exit 130 (as `withCfRunner` does for cf).
+ * SIGINT, SIGTERM or SIGHUP while installing: kill npm and reject `interrupted`
+ * with CANCELLED; `closed` settles once npm has exited (2 s at most).
  */
-function onInterrupt(staging, running, before) {
-    return () => {
-        before?.();
-        const child = running();
-        const closed = child && child.exitCode === null && child.signalCode === null
-            ? new Promise((resolve) => {
-                child.once('close', () => resolve());
-                setTimeout(resolve, 2_000).unref?.();
-            })
-            : Promise.resolve();
-        child?.kill('SIGKILL');
-        void closed
-            .then(() => rm(staging, { recursive: true, force: true, maxRetries: 3 }))
-            .catch(() => undefined)
-            .finally(() => process.exit(130));
+function listenForCancel(signals, running, before) {
+    let interrupt = () => undefined;
+    const state = {
+        error: null,
+        closed: Promise.resolve(),
+        interrupted: new Promise((_resolve, reject) => { interrupt = reject; }),
+        stop: () => { for (const { signal, listener } of listeners)
+            signals.removeListener(signal, listener); },
     };
+    const listeners = CANCEL_SIGNALS.map((signal) => {
+        const listener = () => {
+            if (state.error)
+                return;
+            state.error = new CheckupCancelledError(signal);
+            before?.();
+            const child = running();
+            if (child && child.exitCode === null && child.signalCode === null) {
+                state.closed = new Promise((resolve) => {
+                    child.once('close', () => resolve());
+                    setTimeout(resolve, 2_000).unref?.();
+                });
+            }
+            child?.kill('SIGKILL');
+            interrupt(state.error);
+        };
+        signals.on(signal, listener);
+        return { signal, listener };
+    });
+    return state;
 }
 /**
  * Install the pinned cf into `<configDir>/cf/<version>/` and return its
@@ -257,17 +271,21 @@ export async function installManagedCf(options) {
     // realpath: npm keys its lockfile relative to the real prefix, so a symlinked path would not match `node_modules/cf`.
     const staging = await realpath(await mkdtemp(path.join(root, `${STAGING_PREFIX}${MANAGED_CF.version}-`)));
     let npmChild = null;
-    const interrupted = onInterrupt(staging, () => npmChild, options.onInterrupt);
-    process.once('SIGINT', interrupted);
-    try {
+    const cancel = listenForCancel(options.signals ?? process, () => npmChild, options.onInterrupt);
+    // After a cancel, the install stops at its next step instead of carrying on beside the cleanup.
+    const stopIfCancelled = () => { if (cancel.error)
+        throw cancel.error; };
+    const install = async () => {
         if (process.platform !== 'win32')
             await chmod(staging, 0o700);
+        stopIfCancelled();
         const result = await runNpm(options.spawn ?? nodeSpawn, npmInstallArgv(npmCli, staging), {
             cwd: staging,
             env: npmChildEnv(options.env),
             timeoutMs: options.timeoutMs ?? NPM_INSTALL_TIMEOUT_MS,
             onSpawn: (child) => { npmChild = child; },
         });
+        stopIfCancelled();
         if (result.spawnFailed)
             throw new CfInstallError('npm could not be started, so cf was not installed.');
         if (result.timedOut)
@@ -277,6 +295,7 @@ export async function installManagedCf(options) {
         if (!(await verifyManagedInstall(staging))) {
             throw new CfInstallError(`The installed cf does not match the pinned cf@${MANAGED_CF.version} integrity; it was deleted.`);
         }
+        stopIfCancelled();
         const installDir = managedCfInstallDir(options.configDir);
         // A leftover install that failed verification is replaced; a verified one (a concurrent run) is kept unless it is being replaced.
         if (!options.replace && await findManagedCf(options.configDir))
@@ -291,10 +310,22 @@ export async function installManagedCf(options) {
             throw new CfInstallError('The installed cf could not be moved into place.');
         }
         return managedCfPackageDir(installDir);
+    };
+    const task = install();
+    try {
+        return await Promise.race([task, cancel.interrupted]);
+    }
+    catch (error) {
+        throw cancel.error ?? error;
     }
     finally {
-        process.removeListener('SIGINT', interrupted);
-        await rm(staging, { recursive: true, force: true }).catch(() => undefined);
+        cancel.stop();
+        await cancel.closed;
+        // A cancelled install must stop before staging is removed under it; an npm that never closes holds it up 2 s at most.
+        if (cancel.error) {
+            await Promise.race([task.catch(() => undefined), new Promise((resolve) => setTimeout(resolve, 2_000))]);
+        }
+        await rm(staging, { recursive: true, force: true, maxRetries: 3 }).catch(() => undefined);
     }
 }
 /** `logout`: remove every managed cf version (and any staging leftovers). */

package/dist/local/cloudflare-checkup/cf/locate.d.ts

@@ -24,6 +24,8 @@ export type CfLocation = {
 export declare function isNodeSupported(version?: string): boolean;
 /** cf runs under this Node via process.execPath; workerd ships no win32-arm64 build. */
 export declare function assertLocalRuntimeSupported(version?: string, platform?: NodeJS.Platform, arch?: string): void;
+/** process.cwd(), which throws for a deleted or unreadable working directory: CWD_UNAVAILABLE instead. */
+export declare function currentDirectory(): string;
 export declare function locateCf(options: {
     cfBin?: string;
     /** The verified managed cf package directory (`findManagedCf`), tried after `--cf-bin`. */

package/dist/local/cloudflare-checkup/cf/locate.js

@@ -56,11 +56,20 @@ function repositoryUrl(repository) {
     }
     return '';
 }
+/** process.cwd(), which throws for a deleted or unreadable working directory: CWD_UNAVAILABLE instead. */
+export function currentDirectory() {
+    try {
+        return process.cwd();
+    }
+    catch {
+        throw new LocalCheckupError('CWD_UNAVAILABLE', 'The current directory no longer exists or cannot be read.');
+    }
+}
 export async function locateCf(options) {
     const platform = options.platform ?? process.platform;
     const p = platform === 'win32' ? path.win32 : path.posix;
     const fs = options.fs ?? nodeFs;
-    const cwd = options.cwd ?? process.cwd();
+    const cwd = options.cwd ?? currentDirectory();
     const home = options.home ?? (envLookup(options.env, platform, platform === 'win32' ? 'USERPROFILE' : 'HOME') || homedir());
     const cwdIsHome = Boolean(home) && p.isAbsolute(home) && p.relative(home, cwd) === '';
     let sawOther = false;