agent-dag 1.43.0 → 1.45.0

package/src/server/cswap-admin.mjs

@@ -17,10 +17,13 @@
 // first account's record. Nothing upstream prevents it, so every mutation here
 // goes through one mutex.
 import { AsyncLocalStorage } from "node:async_hooks";
+import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
 import { join } from "node:path";
-import { looksMissing, run, runDetached, runInteractive } from "./exec.mjs";
+import { looksMissing, pathLookup, run, runDetached, runInteractive } from "./exec.mjs";
 import { backupRoot, invalidateClaudeAccountsCache } from "./claude-accounts.mjs";
+import { claudeCliCandidates } from "./claude-dir.mjs";
 import { cswapBin } from "./cswap-install.mjs";
 import { PRODUCT } from "./brand.mjs";
 
@@ -77,8 +80,79 @@ export function withStoreLock(fn) {
 // import, remove, rename, reorder — failed with cmd.exe's "is not recognized",
 // while the read-only half of the panel worked, because it was already using
 // the resolver. Reported from Windows on 2026-08-14.
+
+/**
+ * Which `claude` the account surface runs: the configured one, else the first
+ * candidate this machine actually has, else the bare name.
+ *
+ * WHY THIS IS NOT `AGENTS_DECK_CLAUDE ?? "claude"` ANY MORE (#570). That was
+ * the whole of this module's resolution, and it feeds every child the accounts
+ * panel starts — `claude auth status --json` for `currentIdentity`, and the
+ * `claude auth login` whose output the sign-in dialog reads a link out of. On a
+ * machine whose `claude` is at `~/.local/bin/claude` but whose deck was started
+ * from something that never sourced a shell rc — a LaunchAgent, a systemd user
+ * unit, pm2, a desktop shortcut — the bare name is an ENOENT, so the login
+ * child is dead within milliseconds, the flow reports `no_url`, and the dialog
+ * shows "the claude CLI could not be run: not on PATH. Set AGENTS_DECK_CLAUDE
+ * to its full path." That sentence is a real remedy and it is why this was a
+ * smaller bug than #553; it is still a request to spell out a path the deck had
+ * already found for itself, because `hasClaudeInstalled()` stat'ed that exact
+ * file at boot to decide this was a Claude machine, and since #553 the quota
+ * panel beside this one runs the same binary without being told anything.
+ *
+ * SO IT READS THE SAME LIST, ON THE SAME TERMS #553 SETTLED ON. The list is
+ * `claudeCliCandidates` in claude-dir.mjs, whose other two readers are
+ * `hasClaudeInstalled()` — the boot question this module's whole surface hangs
+ * off — and `quotaClaudeBin` in quota.mjs. This is the same question at a third
+ * site, so nothing here is decided again:
+ *
+ *   - AGENTS_DECK_CLAUDE first, and it is the one thing that skips the list
+ *     entirely. It is documented in the README as "full path to the `claude`
+ *     CLI", it is what the failure message above tells people to set, and
+ *     someone who set it has already been through this once — second-guessing
+ *     them with a stat would be answering a question they have closed. An empty
+ *     value reads as unset, the way `AGENTS_DECK_CSWAP` does in cswapBin.
+ *   - Then the candidate list's own order, unchanged: PATH first on POSIX, the
+ *     two known install directories first on Windows. Preferring a different
+ *     copy would silently change which binary signs somebody in on every
+ *     machine that has two, and a `claude auth login` that suddenly runs a
+ *     different binary is a credential path, not a detail.
+ *   - The bare name is only answered with when PATH actually holds it, and
+ *     `pathLookup` is a yes/no gate rather than the path it found, so spawn's
+ *     own resolution — and, on Windows, exec.mjs's PATHEXT walk, since `claude`
+ *     there is `claude.exe` or `claude.cmd` and never the bare word — stays in
+ *     charge of the PATH case exactly as before.
+ *   - The absolute candidates are stat'ed only once PATH has come up empty, so
+ *     the common case costs one stat rather than a directory walk. Against what
+ *     follows it — a whole Claude Code process, and a browser sign-in a human
+ *     is walking through — that is not a cost worth naming.
+ *
+ * Pure, with the platform, environment, home directory and existence check all
+ * parameters, so the Windows branch is checkable from the platforms this repo
+ * is actually developed on. Exported for that test rather than for a caller
+ * (#383): `claudeBin` below is the only one, and it hands back the real
+ * machine's answer.
+ */
+export function adminClaudeBin(platform = process.platform, env = process.env,
+                               home = homedir(), exists = existsSync) {
+  if (env.AGENTS_DECK_CLAUDE) return env.AGENTS_DECK_CLAUDE;
+  const sep = platform === "win32" ? "\\" : "/";
+  // process.env is case-insensitive on Windows; an injected plain object in a
+  // test is not, and %Path% is how the variable is actually spelled there.
+  const pathEnv = env.PATH ?? env.Path ?? env.path ?? "";
+  for (const c of claudeCliCandidates(platform, env, home)) {
+    if (c.includes(sep)) { if (exists(c)) return c; }
+    else if (pathLookup(c, platform, { pathEnv, exists })) return c;
+  }
+  // Nothing on PATH and nothing at any known install directory. The bare name
+  // is still the right last resort — POSIX `execvp` and cmd.exe's own search
+  // both deserve their turn at a layout no list here knows — and the ENOENT it
+  // produces is what failureText turns into the AGENTS_DECK_CLAUDE sentence.
+  return "claude";
+}
+
 async function claudeBin() {
-  return process.env.AGENTS_DECK_CLAUDE ?? "claude";
+  return adminClaudeBin();
 }
 
 /** Slot → email for everything currently in the store, plus the active slot. */
@@ -212,7 +286,71 @@ export function loginState() {
   return { state, url: url ?? null, error: error ?? null, account: account ?? null, expiresAt: expiresAt ?? null };
 }
 
+/**
+ * What an address may be made of before it becomes an argv element.
+ *
+ * NOT AN RFC 5322 PARSER, and it should not be read as one. RFC 5322 permits
+ * quoted local parts, spaces inside them, comments in parentheses and bracketed
+ * address literals; a regex that accepted all of that would accept precisely the
+ * shapes this exists to keep out. The job here is narrower and worth stating
+ * plainly: keep a FLAG-SHAPED or WHITESPACE-BEARING string out of a spawn's
+ * argument vector. Anything it wrongly refuses is an address nobody has ever
+ * typed into this dialog; anything it wrongly accepts is inert as an argument,
+ * which is the only property being defended. Whether the address exists is
+ * Anthropic's question, asked a moment later by the CLI itself.
+ *
+ * `--email` was the field the alias allowlist below missed. `email.includes("@")`
+ * was the whole of its validation and the value came straight off the request
+ * body, so the two residuals exec.mjs documents were both reachable through it
+ * on Windows, where `claude` is a `.cmd` shim and the vector goes through
+ * `cmd.exe /d /s /c`: an interior newline is a command separator inside that one
+ * quoted line, and `%USERPROFILE%` expands inside quotes with no escape
+ * available. `"a@b\ncalc.exe"` and `"%USERPROFILE%@x"` both satisfy
+ * `includes("@")`, and both are payloads alias-charset.test.ts already pins as
+ * refused for the other field.
+ *
+ * The leading-character rule is the same argv-position rule ALIAS_OK now carries.
+ * `-x@y.z` starts with a dash, so a child parser reads it as an option rather
+ * than as the value of `--email`, and what happens next depends entirely on
+ * which options that CLI happens to define.
+ */
+const EMAIL_OK =
+  /^[A-Za-z0-9][A-Za-z0-9._%+-]{0,63}@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$/;
+
+// The SMTP forward-path limit. The pattern above bounds each PIECE — 64 for the
+// local part, 63 per label — and a domain may carry any number of labels, so
+// without this the whole is unbounded. A bound belongs here for the reason
+// ALIAS_OK has one: on Windows the value ends up inside a single cmd.exe command
+// line, which has a hard length limit of its own.
+const EMAIL_MAX_LENGTH = 254;
+
+/**
+ * The `--email` value `claude auth login` should be given, or a refusal.
+ *
+ * Three answers rather than two, and the third is the one that matters: `null`
+ * means NO ADDRESS WAS OFFERED, which is the only shape the deck's own dialog
+ * sends (`AddAccountDialog` posts a bare `{action:"login"}`) and which must stay
+ * an ordinary sign-in with no flag appended. A value that is present and
+ * unusable is refused outright instead of being quietly dropped: dropping it
+ * would run a DIFFERENT sign-in from the one that was asked for and call it a
+ * success, and this route is reachable by anything holding the deck token.
+ */
+function loginEmailArg(email) {
+  if (email == null) return { ok: true, email: null };
+  if (typeof email !== "string") return { ok: false };
+  const clean = email.trim();
+  if (!clean) return { ok: true, email: null };
+  if (clean.length > EMAIL_MAX_LENGTH || !EMAIL_OK.test(clean)) return { ok: false };
+  return { ok: true, email: clean };
+}
+
 export async function startLogin({ email } = {}) {
+  // Argv position is settled first, before any state moves. A refusal here must
+  // not cancel a sign-in that is already running — the caller asked for
+  // something the deck will not do, and the flow already in flight is not part
+  // of that bargain.
+  const wanted = loginEmailArg(email);
+  if (!wanted.ok) return { ok: false, reason: "bad_email", ...loginState() };
   // Registering is the half that writes to the store; interrupting it would
   // leave an account half-recorded, so that one is refused. A flow merely
   // waiting for a code is not precious — it is most often the one abandoned by
@@ -225,7 +363,7 @@ export async function startLogin({ email } = {}) {
     await cancelLogin();
   }
   if (!_starting) {
-    _starting = spawnLogin(email).finally(() => { _starting = null; });
+    _starting = spawnLogin(wanted.email).finally(() => { _starting = null; });
   }
   const flow = await _starting;
 
@@ -236,7 +374,14 @@ export async function startLogin({ email } = {}) {
   // waiting only for a url meant this POST sat open for the whole fifteen
   // seconds afterwards: a spinner in front of a user whose answer was ready
   // almost immediately.
-  await waitFor(() => flow.url || flow.state === "failed", 15_000);
+  await waitFor(() => flow.url || flow.state === "failed" || flow.state === "done", 15_000);
+  // A sign-in that got somewhere without a link this could read is still a
+  // sign-in, and since #708 the done handler can carry one all the way to
+  // `done` on its own. Saying "no url" over that would throw a completed login
+  // away at the last step, which is the whole of the bug being fixed.
+  if (!flow.url && (flow.state === "registering" || flow.state === "done")) {
+    return { ok: true, ...loginState() };
+  }
   if (!flow.url) {
     flow.child.kill();
     // Same identity check as the done handler below, and for a sharper reason:
@@ -277,7 +422,10 @@ async function spawnLogin(email) {
   const identity = await currentIdentity();
 
   const args = ["auth", "login"];
-  if (typeof email === "string" && email.includes("@")) args.push("--email", email);
+  // Already through loginEmailArg, which is the only caller's boundary: this is
+  // either an address that cannot be read as a flag or null, and null is the
+  // ordinary case.
+  if (email) args.push("--email", email);
 
   const child = runInteractive(await claudeBin(), args, { timeout: LOGIN_TIMEOUT_MS });
   // A sign-in outlives the request that started it, so it can also outlive the
@@ -326,18 +474,136 @@ async function spawnLogin(email) {
     // A newline ended that line; whatever comes next is a new one.
     if (!partial) countedOnLine = 0;
   });
-  // The child dying before the code was accepted is a failure of the login, not
-  // of the deck; say so rather than leaving the dialog spinning.
-  child.done.then((r) => {
+  // The child ending before a code was pasted USED to be read as a failure, and
+  // on this CLI that is the ordinary end of a sign-in that worked (#708).
+  //
+  // `claude auth login` 2.1.246 does two things at once: it prints
+  // "Paste code here if prompted > " and blocks on stdin, AND it listens on a
+  // loopback port for the OAuth callback. Which half finishes the exchange is
+  // not decided by the CLI's version — it is decided by whether the browser
+  // that opened can reach this machine's loopback. On the deck's own machine it
+  // can, so the CLI takes the code itself, prints "Login successful." and exits
+  // 0 while the deck is still sitting in `awaiting_code`; the page that
+  // authorised says "You're all set up" and never shows a code to paste. On a
+  // deck reached from another machine it cannot, the page shows the code, and
+  // the paste path below is the one that runs.
+  //
+  // So the exit alone is not the verdict. The verdict is the identity, and
+  // `claude auth status --json` is the oracle this module already trusts for
+  // it — asked here against the identity recorded before the flow started.
+  child.done.then(async (r) => {
     if (flow !== _login) return;
-    if (flow.state === "awaiting_url" || flow.state === "awaiting_code") {
+    if (flow.state !== "awaiting_url" && flow.state !== "awaiting_code") return;
+    // Answered before any await, so that a `claude` which cannot be run at all
+    // is still reported within milliseconds: startLogin waits on this state to
+    // decide whether to keep holding its POST open, and the sentence naming
+    // AGENTS_DECK_CLAUDE is the only one in the flow that names a fix. Nothing
+    // was signed in either way, so there is nothing to ask about.
+    if (r.timedOut || cannotRun(r)) {
       flow.state = "failed";
-      flow.error = r.timedOut ? "the sign-in window expired" : failureText(r, "claude auth login") || "sign-in ended without a code";
+      flow.error = loginFailureText(r);
+      return;
     }
+    // Claimed before asking, for the same reason submitLoginCode claims it: a
+    // code posted while the question is out would otherwise register the same
+    // login a second time, with a second `cswap add` racing this one.
+    flow.state = "registering";
+    const identity = await currentIdentity();
+    if (flow !== _login) return;
+    // A clean exit with somebody logged in is a completed sign-in, including
+    // the re-sign-in of an account the deck already holds — an identity that
+    // did not CHANGE is not an identity that did not arrive. A dirty exit
+    // counts only when the identity moved, which is a login that landed in
+    // spite of whatever the CLI complained about on its way out.
+    if (identity && (r.ok || identity.email !== flow.previousEmail)) {
+      await registerSignedIn(flow, identity);
+      return;
+    }
+    flow.state = "failed";
+    flow.error = loginFailureText(r);
+  }).catch((err) => {
+    // This handler answers nobody's request — its promise is dropped — so a
+    // throw anywhere in it would be an unhandled rejection AND a dialog left
+    // spinning on `registering` until the poll gave up. It was three lines of
+    // synchronous assignment before; it now shells out twice.
+    console.error(`${PRODUCT} sign-in: the sign-in could not be finished:`, err?.message ?? err);
+    if (flow !== _login) return;
+    flow.state = "failed";
+    flow.error = "the sign-in could not be finished — see the deck's log";
   });
   return flow;
 }
 
+/** A run that never reached the CLI at all — nothing can have been signed in. */
+function cannotRun(r) {
+  return r?.code === "ENOENT" || looksMissing(`${r?.stderr ?? ""}\n${r?.stdout ?? ""}`, "", r?.code);
+}
+
+/**
+ * Why a sign-in failed, in words meant for the person who pressed the button.
+ *
+ * The child's own output is offered only when it is a diagnosis — see
+ * failureText, which since #708 refuses a line that announces success or is
+ * merely the prompt the CLI was still sitting on. What it printed is not thrown
+ * away; it goes to the deck's log, where an operator can read it, rather than
+ * onto a dialog as the reason.
+ */
+function loginFailureText(r) {
+  // One line, the way ccusage's `note` says everything it says: an operator
+  // watching the terminal is reading it beside the deck's own repainted status
+  // rows, and the escapes in it are a login link's OSC-8 wrapper.
+  //
+  // stderr goes LAST because the line is cut from the front. What should be
+  // lost to the bound is the CLI's chatter — the greeting and a sign-in link
+  // that is 400 characters by itself — never its complaint.
+  const tail = stripTerminalEscapes(`${r?.stdout ?? ""}\n${r?.stderr ?? ""}`).replace(/\s+/g, " ").trim();
+  if (tail) console.error(`${PRODUCT} sign-in: claude auth login did not complete:`, tail.slice(-300));
+  if (r?.timedOut) return "the sign-in window expired";
+  return failureText(r, "claude auth login", "the sign-in did not complete — nothing new was signed in");
+}
+
+/**
+ * Everything after the sign-in itself: confirm who we are now, record it with
+ * claude-swap, and put the previously-active account back in front.
+ *
+ * Shared by the two ways a sign-in can end (#708) — a code pasted into the
+ * prompt, and the CLI finishing the exchange through its own loopback callback
+ * — because the steps after it are identical and have to stay identical. An
+ * account the deck skipped `cswap add` for is signed in at the CLI level and
+ * invisible to the panel, with the account the user was on left switched away
+ * from.
+ *
+ * Returns the same `{ok, ...loginState()}` both callers answer their request
+ * with; the done handler simply drops it.
+ */
+async function registerSignedIn(flow, identity) {
+  return withStoreLock(async () => {
+    const add = await run(await cswapBin(), ["add"], { timeout: CSWAP_TIMEOUT_MS });
+    if (!add.ok) {
+      flow.state = "failed";
+      flow.error = addFailureText(add);
+      await restoreActive(flow.previousActive);
+      return { ok: false, reason: "add_failed", ...loginState() };
+    }
+
+    const after = await readStore();
+    const slot = newSlot(flow.before, after);
+    // No new slot means the account was already managed and cswap refreshed its
+    // credentials in place. That is a success with a different sentence.
+    const num = slot ?? Object.keys(after.emails).find(k => after.emails[k] === identity.email) ?? null;
+
+    await restoreActive(flow.previousActive);
+    invalidateClaudeAccountsCache();
+    // Collect straight away, so the new row shows numbers instead of "never
+    // collected" until the next poll — the same nudge seedFirstAccount uses.
+    runDetached(await cswapBin(), ["list"]);
+
+    flow.state = "done";
+    flow.account = { num, email: identity.email, added: slot != null };
+    return { ok: true, ...loginState() };
+  });
+}
+
 /**
  * Hand the code back, then register whatever it signed us in as.
  *
@@ -374,7 +640,11 @@ export async function submitLoginCode(code) {
   }
   if (!r.ok) {
     flow.state = "failed";
-    flow.error = r.timedOut ? "the sign-in window expired" : failureText(r, "claude auth login") || "the code was not accepted";
+    // The `|| "the code was not accepted"` this used to end with could never
+    // run: failureText always answered with something, if only an exit status.
+    // The sentence is where it can be reached now — as the fallback failureText
+    // reaches for when the CLI printed nothing worth repeating.
+    flow.error = r.timedOut ? "the sign-in window expired" : failureText(r, "claude auth login", "the code was not accepted");
     return { ok: false, reason: "login_failed", ...loginState() };
   }
 
@@ -385,31 +655,7 @@ export async function submitLoginCode(code) {
     return { ok: false, reason: "no_identity", ...loginState() };
   }
 
-  return withStoreLock(async () => {
-    const add = await run(await cswapBin(), ["add"], { timeout: CSWAP_TIMEOUT_MS });
-    if (!add.ok) {
-      flow.state = "failed";
-      flow.error = addFailureText(add);
-      await restoreActive(flow.previousActive);
-      return { ok: false, reason: "add_failed", ...loginState() };
-    }
-
-    const after = await readStore();
-    const slot = newSlot(flow.before, after);
-    // No new slot means the account was already managed and cswap refreshed its
-    // credentials in place. That is a success with a different sentence.
-    const num = slot ?? Object.keys(after.emails).find(k => after.emails[k] === identity.email) ?? null;
-
-    await restoreActive(flow.previousActive);
-    invalidateClaudeAccountsCache();
-    // Collect straight away, so the new row shows numbers instead of "never
-    // collected" until the next poll — the same nudge seedFirstAccount uses.
-    runDetached(await cswapBin(), ["list"]);
-
-    flow.state = "done";
-    flow.account = { num, email: identity.email, added: slot != null };
-    return { ok: true, ...loginState() };
-  });
+  return registerSignedIn(flow, identity);
 }
 
 export async function cancelLogin() {
@@ -600,8 +846,34 @@ export async function removeAccount(num) {
  * list, and it closes the unbounded-length half too: an alias is a short name
  * shown instead of an email, so 64 characters is not a constraint anyone meets
  * by accident.
+ *
+ * The leading `(?!-)` is the half that allowlist missed, and it is not about
+ * quoting at all — it is about ARGV POSITION, which no amount of quoting fixes
+ * because the value arrives intact and is then read as syntax by the CHILD.
+ * `-` is in the character class, so `--unset` matched, and
+ * `setAlias(3, "--unset")` built ["alias", "3", "--unset"] — character for
+ * character claude-swap's own command for CLEARING an alias. Its `_alias_command`
+ * hands that vector to argparse, which sets `unset=True` and leaves `alias_name`
+ * as None; the store dropped the name, cswap printed "Removed alias for
+ * Account 3", exited 0, and the deck reported the rename as a success. Any other
+ * `-x` spelling is consumed the same way — `-h` prints help and exits 0, which
+ * also arrives here as a rename that worked.
+ *
+ * argparse does honour `--` as an end-of-options separator, so
+ * ["alias", "3", "--", "--unset"] would reach `set_alias` as data. It is
+ * deliberately not used: the separator only helps for the one child whose parser
+ * we can read, `claude auth login` is the other spawn on this route and its
+ * parser is not ours to verify, and a value the deck refuses outright cannot be
+ * mangled by a CLI that changes its mind later. The validator is the guard.
+ *
+ * Refusing a leading dash rather than requiring a leading alphanumeric is the
+ * narrower rule, and it is the one the hazard actually describes: `.env` and
+ * `_work` are ordinary positional arguments to every parser involved, while
+ * `acme-corp` — the one dash-bearing name in alias-charset.test.ts's list of
+ * names people use — keeps working because only the FIRST character is
+ * constrained.
  */
-const ALIAS_OK = /^[A-Za-z0-9 ._-]{1,64}$/;
+const ALIAS_OK = /^(?!-)[A-Za-z0-9 ._-]{1,64}$/;
 
 export async function setAlias(num, alias) {
   const n = Number(num);
@@ -675,11 +947,18 @@ export async function moveAccount(num, slot) {
  * Windows it is cmd.exe's two-line "is not recognized …/operable program or
  * batch file.", and `firstUseful` — which takes the LAST line, correctly for
  * every other CLI — leaves the second half on screen by itself.
+ *
+ * The exit status goes to looksMissing beside the text (#552). This is the one
+ * caller with no candidate spelling to compare against, so the shape rules alone
+ * are all the TEXT can offer it — and on a non-English Windows the text says
+ * nothing this recognises. The status does: 9009 is cmd.exe's "no such command"
+ * in every language. Without it, a German user pressing "share…" got the last
+ * line of a translated sentence instead of the sentence about PATH.
  */
-export function failureText(r, what = "cswap") {
+export function failureText(r, what = "cswap", fallback = "") {
   const out = `${r?.stderr ?? ""}\n${r?.stdout ?? ""}`;
   const tool = String(what).split(" ")[0];
-  if (r?.code === "ENOENT" || looksMissing(out)) {
+  if (r?.code === "ENOENT" || looksMissing(out, "", r?.code)) {
     return tool === "claude"
       ? "the claude CLI could not be run: not on PATH. Set AGENTS_DECK_CLAUDE to its full path."
       : "cswap could not be run: not on PATH, and not in the places uv and pipx install to. Set AGENTS_DECK_CSWAP to its full path.";
@@ -689,7 +968,34 @@ export function failureText(r, what = "cswap") {
   // Asked for one anyway, this said "cswap export exited 0", a success code for
   // a command that never completed.
   if (r?.timedOut || r?.code === "ETIMEDOUT") return `${what} took too long and was stopped`;
-  return firstUseful(out) || `${what} exited ${r?.code}`;
+  return diagnosis(r?.stderr) || diagnosis(r?.stdout) || fallback || `${what} exited ${r?.code}`;
+}
+
+/**
+ * A line that is NOT a diagnosis, however it reached us.
+ *
+ * Two shapes were being shown to users as the reason something failed (#708),
+ * both out of `claude auth login`: the CLI's own "Login successful." — a
+ * failure reason containing the word "successful" is not a diagnosis, it is a
+ * dump — and "Paste code here if prompted >", the unterminated prompt it was
+ * still sitting on, which says that something was ASKED and nothing about
+ * anything going wrong.
+ */
+const NOT_A_DIAGNOSIS = /\bsuccess(?:ful|fully)?\b|[>?]\s*$/i;
+
+/**
+ * One stream's last useful line, if it is worth showing a person.
+ *
+ * Split per stream because the two are not equal: a CLI's diagnosis goes to
+ * stderr and its ordinary progress chatter goes to stdout. Reading the LAST
+ * line of the two concatenated — which is what this module did — handed stdout
+ * the answer whenever it had written anything at all, so `claude auth login`
+ * explained itself with the prompt it had printed rather than with the "Login
+ * failed: …" it had put on stderr.
+ */
+function diagnosis(text) {
+  const line = firstUseful(text);
+  return line && !NOT_A_DIAGNOSIS.test(line) ? line : "";
 }
 
 /** The line worth showing a user out of a CLI's output. */