flowsprite 0.1.0 → 0.1.4

package/dist/output.js

@@ -1,12 +1,64 @@
-import { redact } from "./redact.js";
+import { printable, redact } from "./redact.js";
 /**
  * `sinks` is injected so a test can record every line without a process.
  * The bin wires `console.log` / `console.error`.
  */
 export function createWriter(sinks) {
     return {
-        out: (line) => sinks.out(redact(line)),
-        err: (line) => sinks.err(redact(line)),
+        out: (line) => sinks.out(scrubLines(redact(line))),
+        err: (line) => sinks.err(scrubLines(redact(line))),
+    };
+}
+/** `printable` per line, keeping the newlines that separate them. */
+function scrubLines(text) {
+    return text.split("\n").map(printable).join("\n");
+}
+/**
+ * FLO-509 — a status line redrawn IN PLACE on a terminal: carriage return, the
+ * redacted text, erase-to-end-of-line, and NO newline. `settle()` ends a line
+ * left dangling; `wireDeps` settles it before every writer and reveal line, and
+ * the bin settles it in its catch and SIGINT paths, so a later result or error
+ * never lands glued to the end of a countdown.
+ *
+ * Redacted and scrubbed like `out`/`err`, BEFORE this function adds its own
+ * carriage return and erase sequence: this is exit 2 of the five listed above,
+ * so it gets the same guarantee rather than relying on callers.
+ */
+export function createStatusLine(write) {
+    let dangling = false;
+    return {
+        progress: (line) => {
+            write(`\r${scrubLines(redact(line))}\x1b[K`);
+            dangling = true;
+        },
+        settle: () => {
+            if (!dangling)
+                return;
+            dangling = false;
+            write("\n");
+        },
+    };
+}
+/**
+ * FLO-509 — the Ctrl-C handler for a terminal with a status line: end the
+ * dangling countdown line, then RE-RAISE the signal. Without the settle, node dies
+ * mid-line and the next prompt lands glued to "Still waiting — 14:55 left" in
+ * shells that do not add a newline.
+ *
+ * RE-RAISE, NOT EXIT: the listener is process-wide, so every command run at a
+ * terminal (`setup`, `mcp`, `doctor`) reaches it. The bin installs it with
+ * `process.once`, so by the time `reraise` runs the listener is gone and the
+ * re-sent SIGINT meets node's default action — on POSIX the process dies BY THE
+ * SIGNAL, as it did before this handler existed (measured in a pty on node
+ * v26.8.1, macOS, FLO-509), rather than with an ordinary exit status.
+ * UNVERIFIED on Windows: node emulates `process.kill(pid, "SIGINT")` as a forced
+ * termination and console writes there can be asynchronous, so the settling
+ * newline may not land before the process ends (no worse than before FLO-509).
+ */
+export function settleThenReraise(status, reraise) {
+    return () => {
+        status.settle();
+        reraise();
     };
 }
 /** A writer that records, for tests and for the doctor's dry runs. */

package/dist/redact.js

@@ -1,41 +1,55 @@
+import { GH_TOKEN_RE } from "./ghLogin.js";
 /**
- * Rewrite every Flowsprite bearer token in a string to a stub.
+ * Rewrite every credential this CLI can hold, wherever it appears in a string,
+ * to a stub that keeps the prefix and the last few characters.
  *
  * NO IMPORTABLE REDACTOR EXISTS IN THIS REPO (measured at f301c49: `fp_user_`
  * appears in lib/ and scripts/ only as comments and a type guard), so this is
  * the CLI's own, re-stated rather than shared.
  *
- * THE TOKEN GRAMMAR IS TAKEN FROM THE MINTER, not guessed: `generateRawToken`
- * in `convex/lib/mcpCrypto.ts` emits `fp_live_` or `fp_user_` followed by 32
- * characters drawn from `[A-Za-z0-9-_]`. The suffix alphabet CONTAINS `_`, so
- * the match is greedy over that class — stopping at the first underscore would
- * leave most of the secret on the screen.
- *
- * THE SET THIS COVERS IS EXACTLY `fp_user_` AND `fp_live_`, and nothing else —
- * stated so the next reader does not assume it is a general secret scrubber.
- * Those are the only two prefixes `generateRawToken` can emit and the only
- * credentials this CLI ever holds. The OTHER value worth never printing, the
- * device code, is not covered here and does not need to be: it is 64 hex
- * characters with no marker to match on, and it is kept off the screen BY
- * CONSTRUCTION instead — `cli/src/login.ts` prints `user_code` and
- * `verification_uri_complete` and never passes `device_code` to the writer, which
- * the AC3 acceptance oracle pins (`printedTheDeviceCode: false`). A setup-link
- * token is the same shape and the same story, except that one is DELIBERATELY
- * shown: it is the thing the person has to open.
+ * THE RULE FOR WHAT IS COVERED: every credential this CLI can hold, by the
+ * grammar of whoever mints it — the Flowsprite token grammar from the minter
+ * (`generateRawToken` in `convex/lib/mcpCrypto.ts`: `fp_live_` or `fp_user_`
+ * followed by characters from `[A-Za-z0-9-_]`; the suffix alphabet CONTAINS
+ * `_`, so the match is greedy over that class — stopping at the first
+ * underscore would leave most of the secret on the screen), and the GitHub
+ * token grammar from gh's own prefixes (`GH_TOKEN_RE`, `cli/src/ghLogin.ts`:
+ * `gho_`/`ghp_`/`ghu_`/`ghs_`/`ghr_` and `github_pat_`, at a word boundary with
+ * a minimum suffix, since FLO-517 reads `gh auth token` and sends it as a
+ * bearer). The members are enumerated in the two regexes and nowhere else.
+ * THE WORD BOUNDARY IS A TRADE: a GitHub token glued to a word character
+ * (`9gho_…`, `_gho_…`) is NOT redacted, so that `highs_score` is not (the AC2
+ * oracle's control). That is acceptable because this redactor is the SECOND
+ * net for that token: by construction it never reaches the writer at all —
+ * `cli/src/login.ts` sends it as a request header and prints only fixed
+ * sentences, which the same oracle pins over every arm.
+ * This is NOT a general secret scrubber: a value with no marker to match on is
+ * kept off the screen BY CONSTRUCTION instead — the device code (64 hex
+ * characters) is never passed to the writer by `cli/src/login.ts`, which the
+ * AC3 acceptance oracle pins (`printedTheDeviceCode: false`). A setup-link token
+ * is the same shape and the same story, except that one is DELIBERATELY shown:
+ * it is the thing the person has to open.
  *
  * Applied by the shared writer (`cli/src/output.ts`), so the redaction is a
  * property of the ONE place lines leave this process, not of each caller
  * remembering. A caller that bypassed the writer would bypass this.
  */
-const TOKEN = /fp_(?:user|live)_[A-Za-z0-9_-]+/g;
+const TOKEN = new RegExp(`fp_(?:user|live)_[A-Za-z0-9_-]+|${GH_TOKEN_RE.source}`, "g");
 /** How many trailing characters survive, so a person can tell two tokens apart. */
 const KEEP_LAST = 4;
+/** The marker the grammar pinned: `fp_user_`/`fp_live_`, `gho_`-style, or `github_pat_`. */
+function prefixLength(match) {
+    if (match.startsWith("fp_"))
+        return "fp_user_".length;
+    if (match.startsWith("github_pat_"))
+        return "github_pat_".length;
+    return "gho_".length;
+}
 export function redact(text) {
     return text.replace(TOKEN, (match) => {
-        // `fp_user_` / `fp_live_` — a fixed 8 characters, so this is a slice, not a
-        // search: the prefix is the part the grammar above already pinned.
-        const prefix = match.slice(0, "fp_user_".length);
-        const suffix = match.slice("fp_user_".length);
+        // The prefix is a fixed width per family, so this is a slice, not a search.
+        const prefix = match.slice(0, prefixLength(match));
+        const suffix = match.slice(prefix.length);
         // A suffix at or under the keep length would be echoed whole. It cannot be a
         // real token (the minter always emits 32), and truncating to nothing would
         // be indistinguishable from an empty value — so the stub says "..." and
@@ -45,3 +59,17 @@ export function redact(text) {
         return `${prefix}...${suffix.slice(-KEEP_LAST)}`;
     });
 }
+/**
+ * Server-supplied text made safe to print: every C0 control (0x00-0x1F), DEL
+ * (0x7F) and C1 control (0x80-0x9F) becomes a space, so a stored error cannot
+ * move the cursor, recolour the terminal or forge a second line.
+ *
+ * It lives beside `redact` because the two are applied together at the one
+ * place a line leaves the process, the writer (`cli/src/output.ts`), per line.
+ * A newline is a C0 too, which is why the writer splits on it BEFORE calling
+ * this: the endpoint pretty-prints tool JSON across lines, and those lines are
+ * meant to stay lines.
+ */
+export function printable(text) {
+    return text.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ");
+}

package/dist/setup.js

@@ -1,4 +1,6 @@
 import { toolJson } from "./mcpClient.js";
+import { clock, minutesSpan } from "./messages.js";
+import { printable } from "./redact.js";
 /**
  * The setup plane, driven from a terminal.
  *
@@ -171,46 +173,309 @@ export function planBindArgs(input) {
         args: { sandboxId: connection, installationId, repoOwner: parts[0], repoName: parts[1] },
     };
 }
+/**
+ * C6 — the ONE instruction block a link step prints, CLI-owned. The server's
+ * `instructions` field is deliberately NOT printed: it repeated this sentence
+ * and named an MCP tool (`setup_status`) a terminal user cannot call.
+ */
+export function linkInstructions(url, expiresInSeconds) {
+    const seconds = expiresInSeconds ?? LINK_POLL_MAX_MS / 1000;
+    return [
+        "Open this link in a browser signed in to Flowsprite as the same account, in this same workspace:",
+        `  ${printable(url)}`,
+        LINK_SECRET_LINE,
+        `The link works once and expires in ${minutesSpan(seconds)}.`,
+    ];
+}
+/** Card eecc9d6f N12 — directly under every setup link. */
+export const LINK_SECRET_LINE = "This link is a one-time secret for your account — don't paste it in chat or share it.";
+// ------------------------------------------------------------- setup's steps (N3)
+/**
+ * Card eecc9d6f N3 — the three steps `setup` names, ONE table. A ladder rung
+ * maps onto a step by `stepOfRung`; `skipped` is what a step that needed no
+ * work this run says (step 1's is built at the call, it names the login).
+ */
+export const SETUP_STEPS = [
+    { label: "approve this login", skipped: "" },
+    { label: "connect Salesforce", skipped: "Salesforce is already connected" },
+    { label: "connect GitHub + create the private repo", skipped: "GitHub is already connected and every org has its repository" },
+];
+/**
+ * The step a rung belongs to. `first_sync` comes AFTER step 3 (null: it opens
+ * no step, but reaching it means steps 2 and 3 needed nothing); `done` and
+ * `web_only` open none.
+ */
+export function stepOfRung(kind) {
+    if (kind === "connect_salesforce")
+        return 2;
+    if (kind === "connect_github" || kind === "bind_repo")
+        return 3;
+    return null;
+}
+/**
+ * Prints "Step n/3: <label>" the first time a step is entered and "Step n/3:
+ * skipped — <why>" for every earlier step the run never entered. `current()` is
+ * the step a rerun would be at (N14).
+ */
+export function createStepTracker(writer) {
+    let at = 0;
+    const total = SETUP_STEPS.length;
+    const skipTo = (step) => {
+        for (let n = at + 1; n < step; n++)
+            writer.out(`Step ${n}/${total}: skipped — ${SETUP_STEPS[n - 1].skipped}`);
+    };
+    return {
+        current: () => Math.min(Math.max(at, 1), total),
+        enter(step) {
+            if (step <= at)
+                return;
+            skipTo(step);
+            writer.out(`Step ${step}/${total}: ${SETUP_STEPS[step - 1].label}`);
+            at = step;
+        },
+        skip(step, why) {
+            if (step <= at)
+                return;
+            skipTo(step);
+            writer.out(`Step ${step}/${total}: skipped — ${why}`);
+            at = step;
+        },
+        /** Past the last step (the first sync): every step not entered is reported skipped. */
+        finishSteps() {
+            skipTo(total + 1);
+            at = Math.max(at, total);
+        },
+    };
+}
+/**
+ * Card eecc9d6f N4 — printed once, before the first wait on the browser. The
+ * numbers are the code's own bounds: the device code's TTL ceiling and the link
+ * step's wait budget. `loginSeconds` is null when this run will NOT log in (step
+ * 1 skipped, G9a): the notice then names only the links.
+ */
+export function browserWaitNotice(loginSeconds) {
+    const links = `up to ${minutesSpan(LINK_POLL_MAX_MS / 1000)} for each link`;
+    return (`Setup waits on your browser: ${loginSeconds === null ? links : `up to ${minutesSpan(loginSeconds)} to approve the login, and ${links}`}. ` +
+        "Keep this command running; if it stops, rerun `flowsprite setup` and it continues from the checklist's current step.");
+}
+/** Card eecc9d6f N14 — the last line of every `setup` run that does not succeed. */
+export function rerunHint(login, step) {
+    const where = `it picks up at step ${step} (or later, if you finish that step in the browser first)`;
+    if (login === "stored")
+        return `Rerun \`flowsprite setup\` to continue — your login is saved, and ${where}.`;
+    if (login === "supplied") {
+        return `Rerun \`flowsprite setup\` with the same --token or FLOWSPRITE_TOKEN to continue (nothing was saved; \`flowsprite login --token <t> --save\` stores it) — ${where}.`;
+    }
+    return "Rerun `flowsprite setup` to continue — it starts at step 1, logging this terminal in.";
+}
+/** The `purpose` a minted link carries in `pendingLinks` — the set is `convex/setupLinks.ts purposeValidator`. */
+const LINK_PURPOSE = {
+    salesforce: "salesforce_connect",
+    github: "github_install",
+};
+/**
+ * The provider's ids in a `setup_status` payload, as strings.
+ *
+ * github: `installations[].installationId` — a NUMBER in the tool's validator
+ * (`convex/mcpSetup.ts installationDetail`), stringified so one set type holds
+ * both. salesforce: `connections[].id` — a document id, already a string.
+ * Anything else-shaped is dropped, never coerced from `undefined` to "undefined".
+ */
+export function idsOf(provider, status) {
+    const root = asObject(status);
+    if (root === null)
+        return [];
+    const out = [];
+    if (provider === "github") {
+        for (const i of asArray(root.installations)) {
+            if (typeof i.installationId === "number")
+                out.push(String(i.installationId));
+        }
+    }
+    else {
+        for (const c of asArray(root.connections)) {
+            if (typeof c.id === "string" && c.id.length > 0)
+                out.push(c.id);
+        }
+    }
+    return out;
+}
+/**
+ * What is already connected, for the sentence printed before a link is minted.
+ *
+ * THE RULE: the writer keeps newlines for whole documents and multi-line
+ * refusals; a field spliced INTO a sentence is scrubbed here, or a newline in
+ * it forges a line (driven: a displayName "Acme\nDone." printed an exact
+ * `Done.` line). `nextAction.text` is a whole-field print and stays as it is.
+ */
+function connectedNames(provider, status) {
+    const root = asObject(status);
+    if (root === null)
+        return [];
+    const rows = provider === "github" ? asArray(root.installations) : asArray(root.connections);
+    const field = provider === "github" ? "accountLogin" : "displayName";
+    return rows.flatMap((r) => (typeof r[field] === "string" ? [printable(r[field])] : []));
+}
 /**
  * Run one browser-leg step: mint the link, show it, then watch `setup_status`
- * until the step is no longer the next one.
+ * until a NEW provider id appears.
+ *
+ * DONE IS A NEW ID, NEVER THE LADDER MOVING. The previous version returned
+ * `done` when the planner's next step was no longer this one — which is also
+ * true from the FIRST poll whenever this step was never the next one (GitHub
+ * already connected, Salesforce not yet connected, a second org being added),
+ * so `connect github` printed "Done." after five seconds with nothing done and a
+ * live-link slot burnt. So the id set is read BEFORE the mint (`before` is the
+ * payload the caller already holds, else read here), and done ⇔ some id in a
+ * poll is outside that set. A link that is CONSUMED is not done either: it is
+ * consumed when the person clicks Go, before the provider round-trip, and
+ * re-authorizing an org that is already connected REFRESHES its row without a
+ * new id — so a consumed link is reported as progress, and the end-of-wait
+ * sentence says whether the link was used.
  *
  * THE STOP CONDITIONS ARE THREE AND THEY ARE DIFFERENT. The link's own
- * `expiresAt` passing means the person must be handed a fresh link (this returns
- * `expired` and says so); the overall budget running out means the CLI stops
- * waiting but the link may still be good (`timeout`); and the step completing is
- * read from the PLANNER moving on, not from a field this module interprets
- * itself.
+ * `expiresAt` passing means the person must be handed a fresh link (`expired`);
+ * the overall budget running out means the CLI stops waiting but the link may
+ * still be good (`timeout`); and `done` is the new id above.
  */
-export async function runLinkStep(deps, tool, args, stepKind) {
+export async function runLinkStep(deps, tool, args, provider, before) {
+    if (before === undefined) {
+        const read = await deps.client.callTool("setup_status", {});
+        if (!read.ok)
+            return { kind: "failed", message: read.message };
+        before = toolJson(read);
+    }
+    const already = new Set(idsOf(provider, before));
+    const connected = asObject(asObject(asObject(before)?.workspace)?.[provider])?.connected === true;
+    // A snapshot that contradicts itself is not a baseline: "connected" with no
+    // row listed means a NEW row could not be told from the one it forgot, so
+    // this fails closed rather than minting a link it could never resolve.
+    if (connected && already.size === 0) {
+        return {
+            kind: "failed",
+            message: `Flowsprite says ${provider === "github" ? "GitHub" : "a Salesforce org"} is connected to this workspace but lists nothing for it. Run \`flowsprite status\` and try again.`,
+        };
+    }
+    if (already.size > 0) {
+        const names = connectedNames(provider, before);
+        const who = names.length > 0 ? ` (${names.join(", ")})` : "";
+        deps.writer.out(provider === "github"
+            ? `GitHub is already connected to this workspace${who}. This link installs the Flowsprite app on another account or organization.`
+            : `A Salesforce org is already connected to this workspace${who}. This link connects another org; signing in to one that is already connected only refreshes it.`);
+    }
+    const mintedAt = deps.now();
     const minted = await deps.client.callTool(tool, args);
     if (!minted.ok)
         return { kind: "failed", message: minted.message };
     const payload = asObject(toolJson(minted));
     if (payload === null || typeof payload.url !== "string") {
-        return { kind: "failed", message: `${tool} did not return a link.` };
+        return { kind: "failed", message: "Flowsprite did not return a link for this step. Run `flowsprite status` and try again." };
     }
     const url = payload.url;
     const expiresAt = typeof payload.expiresAt === "number" ? payload.expiresAt : null;
-    deps.writer.out(`Open this link in a browser where you are signed in to Flowsprite:`);
-    deps.writer.out(`  ${url}`);
-    if (typeof payload.instructions === "string")
-        deps.writer.out(payload.instructions);
+    // Server clock minus ours, latency-inclusive (the mint's round trip is folded
+    // in, which only makes the cutoff below more conservative). The mint answers
+    // `expiresAt = serverNow + ttl` AND the ttl itself (`expiresInSeconds`, both
+    // tools in convex/mcpSetup.ts — pinned by setup.test.ts), so the server's
+    // "now" is read off the response rather than mirrored as a constant here. A
+    // mint without the ttl gives NO skew (null): the used inference below is then
+    // skipped entirely — the CLI clock alone cannot tell an expiry from a use —
+    // and expiry falls back to the CLI clock.
+    const ttlMs = typeof payload.expiresInSeconds === "number" ? payload.expiresInSeconds * 1000 : null;
+    const skew = expiresAt === null || ttlMs === null ? null : expiresAt - ttlMs - mintedAt;
+    /** `now` on the server's clock, as far as the mint let us measure it. */
+    const serverNow = (now) => now + (skew ?? 0);
+    const expiresInSeconds = typeof payload.expiresInSeconds === "number" && payload.expiresInSeconds > 0
+        ? payload.expiresInSeconds
+        : null;
+    for (const line of linkInstructions(url, expiresInSeconds))
+        deps.writer.out(line);
     deps.writer.out("Waiting for you to finish in the browser...");
+    let used = false;
     const deadline = deps.now() + LINK_POLL_MAX_MS;
     for (;;) {
         await deps.sleep(LINK_POLL_INTERVAL_MS);
         const status = await deps.client.callTool("setup_status", {});
         if (!status.ok)
             return { kind: "failed", message: status.message };
-        if (planNextStep(toolJson(status)).kind !== stepKind)
+        const now = deps.now();
+        const current = toolJson(status);
+        // ponytail: done is a WORKSPACE-WIDE new provider id, so a connect finished
+        // by another member during this wait is attributed to this link, and two
+        // same-purpose links minted in the same millisecond share the (purpose,
+        // expiresAt) fingerprint below. A per-link id in the mint response and in
+        // `pendingLinks` closes both; that is a server change (DEBT row), not this card.
+        if (idsOf(provider, current).some((id) => !already.has(id)))
             return { kind: "done" };
+        // The minted link is matched by (purpose, expiresAt). `pendingLinks` lists
+        // only LIVE links by the SERVER'S clock, so a link that has expired leaves it
+        // exactly like one that was opened. Absence is evidence of a use only on a
+        // poll taken more than one poll interval before `expiresAt` by the SERVER's
+        // clock (ours plus the measured skew) — later than that, an expiry reads as
+        // a use. Only when the mint gave a skew to measure that by, and only when the
+        // poll actually CARRIED a `pendingLinks` array: an omitted, null or non-array
+        // field says nothing about the row.
+        const pending = asObject(current)?.pendingLinks;
+        if (!used &&
+            expiresAt !== null &&
+            skew !== null &&
+            serverNow(now) < expiresAt - LINK_POLL_INTERVAL_MS &&
+            Array.isArray(pending)) {
+            const mine = asArray(pending).some((l) => l.purpose === LINK_PURPOSE[provider] && l.expiresAt === expiresAt);
+            if (!mine) {
+                used = true;
+                deps.writer.out("Link opened — finishing the connection in the browser...");
+            }
+        }
         // The link check comes AFTER the status read, so a link that expired in the
-        // same tick as the step completing is reported as the completion it was.
-        const now = deps.now();
-        if (expiresAt !== null && now >= expiresAt)
-            return { kind: "expired" };
+        // same tick as the id appearing is reported as the completion it was. Expiry
+        // is judged on the SERVER's clock (the one that drops the row), the same
+        // estimate the used cutoff uses; the deadline stays a CLI budget.
+        if (expiresAt !== null && serverNow(now) >= expiresAt)
+            return { kind: "expired", used };
         if (now >= deadline)
+            return { kind: "timeout", used };
+        // C8: the link's own expiry by the server's clock when the mint named one,
+        // else the CLI's wait budget — whichever this step will actually stop at.
+        const leftMs = expiresAt === null ? deadline - now : Math.min(expiresAt - serverNow(now), deadline - now);
+        deps.progress?.(`Link expires in ${clock(leftMs / 1000)}`);
+    }
+}
+// ---------------------------------------------------------- repository creation
+/** How long `setup` waits for a repository it just asked Flowsprite to create (FLO-511 DM5). */
+export const REPO_WAIT_MAX_MS = 180_000;
+/**
+ * Wait for a repository `setup_bind_repo` has started creating.
+ *
+ * WHY THIS EXISTS: `hasBinding` is already true while `bootstrapState` is
+ * "creating", so without it the ladder's very next read names the first sync,
+ * and `sfdc_trigger_sync` refuses a repository that is still being created.
+ *
+ * The budget is counted in SLEPT milliseconds, not the clock: the sleeps are the
+ * whole of the wait this module adds, and counting them keeps the bound exact
+ * under an injected sleep that returns at once.
+ */
+export async function waitForRepository(deps, connectionId) {
+    // READ FIRST, then sleep: a repository that finished during the bind's own
+    // round trip is not made to wait five seconds for nothing.
+    for (let slept = 0;; slept += LINK_POLL_INTERVAL_MS) {
+        const status = await deps.client.callTool("setup_status", {});
+        if (!status.ok)
+            return { kind: "error", message: status.message };
+        const conn = asArray(asObject(toolJson(status))?.connections).find((c) => c.id === connectionId);
+        const state = conn?.bootstrapState;
+        if (state === "ready")
+            return { kind: "ready" };
+        if (state === "failed") {
+            const error = typeof conn?.bootstrapError === "string" && conn.bootstrapError.length > 0
+                ? conn.bootstrapError
+                : "no reason was given.";
+            return { kind: "failed", error };
+        }
+        if (state !== "creating")
+            return { kind: "gone" };
+        if (slept >= REPO_WAIT_MAX_MS)
             return { kind: "timeout" };
+        await deps.sleep(LINK_POLL_INTERVAL_MS);
     }
 }