orizu 0.5.23 → 0.5.24

package/README.md

@@ -86,12 +86,15 @@ Install the CLI globally with your package manager:
 | pnpm | `pnpm add -g orizu` |
 | Bun | `bun add -g orizu` |
 
-Then run the guided setup — it signs you in, initializes the local workspace
-contract, installs global coding-agent skill symlinks, and shows the next
-command for repo-specific Orizu adoption:
+Then run the guided setup — it signs you in, asks you to choose or create a
+team and project, initializes the local workspace contract, installs the shared
+`~/.agents/skills/orizu` skill plus selected native targets, and optionally
+launches Claude, Codex, or Pi:
 
 ```bash
 orizu setup
+# Scripts use explicit choices after `orizu login --headless`:
+orizu setup --team acme --project support-agent --agent codex --non-interactive
 ```
 
 To repair or customize skill installs later, run the companion skill installer
@@ -137,9 +140,8 @@ Agents are first-class users of this CLI: **every command supports `--json`**
 (as a prefix, `orizu --json teams list`, or a trailing flag) and emits a single
 machine-readable JSON document instead of formatted text. Discover the full
 command surface, including global options, with `orizu capabilities --json`.
-Hosted agents may read and sync instruction sets and prepare complete manifests. A local coding agent using the user's token runs instruction create, push, shape,
-archive, and restore itself after plan ratification. It gathers only read-only pointer-resolution and binding evidence; a human curator executes every production/default pointer command on every surface.
-In a hosted session, a human curator using the local CLI must run both categories.
+Hosted agents may read and sync instruction sets, create profile seeds, run shape add/remove with team-scoped curator authority, and prepare complete manifests. A local coding agent using the user's token runs instruction create, push, shape add/remove, archive, and restore itself after plan ratification. It gathers only read-only pointer-resolution and binding evidence; a human curator executes every production/default pointer command on every surface.
+In a hosted session, a human curator using the local CLI must run create/push, archive/restore, and every pointer command; shape add/remove stays agent-runnable because it creates unpromoted heads only.
 
 ## Authentication
 
@@ -152,6 +154,12 @@ orizu login
 This will open a browser tab for you to login with. You must either have an account on the [Orizu platform](https://orizu.ai) or it will help you create one.
 Approving the login creates a personal access token for the CLI and stores it in your local Orizu credentials file. You can revoke CLI tokens from the Personal Tokens page in Orizu.
 
+In an SSH or display-less Linux session, the CLI automatically prints an approval URL and polls for completion instead of opening a local browser. Force this mode when needed with:
+
+```bash
+orizu login --headless
+```
+
 **Check the signed-in user**
 
 ```bash
@@ -239,12 +247,12 @@ orizu logout
     <td colspan="2"><strong>Report comments</strong></td>
   </tr>
   <tr>
-    <td>List report comments</td>
-    <td><code>orizu comments list --prompt &lt;promptIdOrName&gt; --project ops-eval/support-qa</code><br><code>orizu comments list --run &lt;runId&gt;</code><br><code>orizu comments list --task &lt;taskId&gt;</code></td>
+    <td>List report or README comments</td>
+    <td><code>orizu comments list --prompt &lt;promptIdOrName&gt; --project ops-eval/support-qa</code><br><code>orizu comments list --run &lt;runId&gt;</code><br><code>orizu comments list --task &lt;taskId&gt;</code><br><code>orizu comments list --dataset &lt;datasetIdOrName&gt; --project ops-eval/support-qa</code></td>
   </tr>
   <tr>
     <td>Add or update comments</td>
-    <td><code>orizu comments add --run &lt;runId&gt; --body @comment.md --anchor "Summary" --lines 4:6</code><br><code>orizu comments reply &lt;commentId&gt; --body "Fixed"</code><br><code>orizu comments resolve &lt;commentId&gt;</code></td>
+    <td><code>orizu comments add --run &lt;runId&gt; --body @comment.md --anchor "Summary" --lines 4:6</code><br><code>orizu comments add --dataset &lt;datasetIdOrName&gt; --project ops-eval/support-qa --body "Clarify this README" --anchor "Summary" --lines 4:6</code><br><code>orizu comments reply &lt;commentId&gt; --body "Fixed"</code><br><code>orizu comments resolve &lt;commentId&gt;</code></td>
   </tr>
   <tr>
     <td colspan="2"><strong>Diff comments</strong></td>
@@ -412,4 +420,4 @@ Use `--json` on supported task and app commands when automation needs structured
 ## More Documentation
 
 - [docs/cli.md](docs/cli.md): complete CLI guide and command reference
-- [skills/orizu-cli/references/cli-reference.md](skills/orizu-cli/references/cli-reference.md): compact command matrix and end-to-end flows
+- [skills/orizu/references/cli-reference.md](skills/orizu/references/cli-reference.md): compact command matrix and end-to-end flows

package/dist/child-output-tee.d.ts

@@ -0,0 +1,48 @@
+import { Readable, Writable } from 'node:stream';
+declare class FileDescriptorSink extends Writable {
+    private readonly descriptor;
+    private readonly activeWriteCancellations;
+    private isLiveOutputAvailable;
+    private relay;
+    constructor(descriptor: number);
+    _write(chunk: Buffer, _encoding: BufferEncoding, callback: (error?: Error | null) => void): void;
+    prepare(): Promise<void>;
+    cancelPendingWrites(): void;
+    private relayProcess;
+}
+export declare const childOutputSinks: {
+    stdout: FileDescriptorSink;
+    stderr: FileDescriptorSink;
+};
+export interface PipedChild {
+    stdout: Readable;
+    stderr: Readable;
+    exited: Promise<number | null>;
+    signalCode: NodeJS.Signals | null;
+    kill(signal?: number | NodeJS.Signals): void;
+}
+export declare function spawnPipedChild(command: string, args: string[], environment: NodeJS.ProcessEnv): Promise<PipedChild>;
+export declare function writeChildStderr(text: string): Promise<void>;
+export interface ChildOutputForwarding {
+    completed: Promise<void>;
+    failure: Promise<Error>;
+    failureReason(): Error | undefined;
+    expectSourceClose(): void;
+    stopLiveOutput(): void;
+}
+export interface ChildOutputCapture {
+    stdout(chunk: string): void;
+    stderr(chunk: string): void;
+}
+export declare function completePipedChild(child: PipedChild, forwarding: readonly ChildOutputForwarding[]): Promise<number | null>;
+export declare function runPipedChild(command: string, args: string[], environment: NodeJS.ProcessEnv, onSpawn: () => Promise<void>, capture: ChildOutputCapture, observeChild?: (child: PipedChild) => void): Promise<{
+    status: number | null;
+    error?: Error;
+}>;
+/**
+ * Forward a child stream live while retaining a bounded caller-owned copy.
+ * Transient sink slowness pushes back; a stall degrades safely to capture-only.
+ */
+export declare function teeChildOutput(source: Readable, destination: Writable, capture: (chunk: string) => void): ChildOutputForwarding;
+export {};
+//# sourceMappingURL=child-output-tee.d.ts.map

package/dist/child-output-tee.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-output-tee.d.ts","sourceRoot":"","sources":["../src/child-output-tee.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAsHhD,cAAM,kBAAmB,SAAQ,QAAQ;IAK3B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAJvC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAwB;IACjE,OAAO,CAAC,qBAAqB,CAAO;IACpC,OAAO,CAAC,KAAK,CAA6B;gBAEb,UAAU,EAAE,MAAM;IAItC,MAAM,CACb,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,cAAc,EACzB,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GACvC,IAAI;IAgCD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAK9B,mBAAmB,IAAI,IAAI;IAS3B,OAAO,CAAC,YAAY;CAiCrB;AAED,eAAO,MAAM,gBAAgB;;;CAG5B,CAAA;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,QAAQ,CAAA;IAChB,MAAM,EAAE,QAAQ,CAAA;IAChB,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC9B,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;IACjC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;CAC7C;AAqDD,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,WAAW,EAAE,MAAM,CAAC,UAAU,GAC7B,OAAO,CAAC,UAAU,CAAC,CAiDrB;AAoCD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWlE;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACxB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IACvB,aAAa,IAAI,KAAK,GAAG,SAAS,CAAA;IAClC,iBAAiB,IAAI,IAAI,CAAA;IACzB,cAAc,IAAI,IAAI,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAuCD,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,SAAS,qBAAqB,EAAE,GAC3C,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA6CxB;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC5B,OAAO,EAAE,kBAAkB,EAC3B,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GACzC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC,CAqBnD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,QAAQ,EAChB,WAAW,EAAE,QAAQ,EACrB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAC/B,qBAAqB,CA2DvB"}

package/dist/child-output-tee.js

@@ -0,0 +1,512 @@
+import { spawn, spawnSync } from 'node:child_process';
+import { closeSync, constants, mkdtempSync, openSync, read as readFileDescriptor, rmSync, } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Readable, Writable } from 'node:stream';
+const CHILD_OUTPUT_PREFETCH_MAX_BYTES = 64 * 1024;
+const CHILD_OUTPUT_READ_BUFFER_BYTES = 16 * 1024;
+const EMPTY_FIFO_INITIAL_RETRY_MS = 4;
+const EMPTY_FIFO_MAX_RETRY_MS = 64;
+const FORWARDING_FAILURE_TERMINATION_TIMEOUT_MS = 250, LIVE_OUTPUT_STALL_TIMEOUT_MS = 1_500;
+const LIVE_OUTPUT_RELAY_SCRIPT = [
+    "const { writeSync } = require('node:fs')",
+    'process.stdout._handle?.setBlocking(true)',
+    'let buffered = Buffer.alloc(0)',
+    'process.stdin.on(\'data\', chunk => {',
+    '  buffered = Buffer.concat([buffered, chunk])',
+    '  while (buffered.length >= 4) {',
+    '    const length = buffered.readUInt32BE(0)',
+    '    if (buffered.length < length + 4) return',
+    '    const payload = buffered.subarray(4, length + 4)',
+    '    buffered = buffered.subarray(length + 4)',
+    '    for (let offset = 0; offset < payload.length; )',
+    '      offset += writeSync(1, payload, offset, payload.length - offset)',
+    "    writeSync(3, '1')",
+    '  }',
+    '})',
+    "writeSync(3, 'R')",
+].join('\n');
+class FileDescriptorSource extends Readable {
+    descriptor;
+    readBuffer = Buffer.allocUnsafe(CHILD_OUTPUT_READ_BUFFER_BYTES);
+    emptyRetryMilliseconds = EMPTY_FIFO_INITIAL_RETRY_MS;
+    isReadPending = false;
+    retryTimer;
+    pendingDestroy;
+    constructor(descriptor) {
+        super({ highWaterMark: CHILD_OUTPUT_PREFETCH_MAX_BYTES });
+        this.descriptor = descriptor;
+    }
+    _read() {
+        if (this.isReadPending || this.retryTimer || this.descriptor === undefined)
+            return;
+        this.isReadPending = true;
+        readFileDescriptor(this.descriptor, this.readBuffer, 0, this.readBuffer.byteLength, null, (error, bytesRead) => {
+            this.isReadPending = false;
+            if (this.pendingDestroy) {
+                this.finishDestroy();
+                return;
+            }
+            if (error) {
+                if (error.code === 'EINTR') {
+                    this._read();
+                    return;
+                }
+                if (['EAGAIN', 'EWOULDBLOCK'].includes(error.code ?? '')) {
+                    const delay = this.emptyRetryMilliseconds;
+                    this.emptyRetryMilliseconds = Math.min(EMPTY_FIFO_MAX_RETRY_MS, this.emptyRetryMilliseconds * 2);
+                    this.retryTimer = setTimeout(() => {
+                        this.retryTimer = undefined;
+                        this._read();
+                    }, delay);
+                    return;
+                }
+                this.destroy(error);
+                return;
+            }
+            if (bytesRead === 0) {
+                this.push(null);
+                return;
+            }
+            this.emptyRetryMilliseconds = EMPTY_FIFO_INITIAL_RETRY_MS;
+            this.push(Buffer.from(this.readBuffer.subarray(0, bytesRead)));
+        });
+    }
+    _destroy(error, callback) {
+        if (this.retryTimer)
+            clearTimeout(this.retryTimer);
+        this.retryTimer = undefined;
+        this.pendingDestroy = { error, callback };
+        if (!this.isReadPending)
+            this.finishDestroy();
+    }
+    finishDestroy() {
+        const pendingDestroy = this.pendingDestroy;
+        if (!pendingDestroy)
+            return;
+        this.pendingDestroy = undefined;
+        const descriptor = this.descriptor;
+        this.descriptor = undefined;
+        try {
+            if (descriptor !== undefined)
+                closeSync(descriptor);
+            pendingDestroy.callback(pendingDestroy.error);
+        }
+        catch (error) {
+            pendingDestroy.callback(error instanceof Error ? error : new Error(String(error)));
+        }
+    }
+}
+class FileDescriptorSink extends Writable {
+    descriptor;
+    activeWriteCancellations = new Set();
+    isLiveOutputAvailable = true;
+    relay;
+    constructor(descriptor) {
+        super({ highWaterMark: 16 * 1024 });
+        this.descriptor = descriptor;
+    }
+    _write(chunk, _encoding, callback) {
+        if (!this.isLiveOutputAvailable) {
+            callback();
+            return;
+        }
+        let relay;
+        let hasSettled = false;
+        const settle = (error) => {
+            if (hasSettled)
+                return;
+            hasSettled = true;
+            if (error)
+                this.isLiveOutputAvailable = false;
+            this.activeWriteCancellations.delete(cancel);
+            relay?.acknowledgements.off('data', acknowledge);
+            relay?.child.off('exit', relayExited);
+            callback(error);
+        };
+        const acknowledge = () => settle();
+        const relayExited = () => settle(new Error('live output relay exited before write acknowledgement'));
+        const cancel = () => settle();
+        this.activeWriteCancellations.add(cancel);
+        try {
+            relay = this.relayProcess();
+        }
+        catch (error) {
+            settle(errorFromUnknown(error));
+            return;
+        }
+        void relay.ready.then(() => {
+            if (hasSettled)
+                return;
+            relay.acknowledgements.once('data', acknowledge);
+            relay.child.once('exit', relayExited);
+            const frame = Buffer.allocUnsafe(chunk.byteLength + 4);
+            frame.writeUInt32BE(chunk.byteLength);
+            chunk.copy(frame, 4);
+            relay.input.write(frame, error => { if (error)
+                settle(error); });
+        }).catch(error => settle(errorFromUnknown(error)));
+    }
+    async prepare() {
+        if (!this.isLiveOutputAvailable)
+            return;
+        await this.relayProcess().ready;
+    }
+    cancelPendingWrites() {
+        this.isLiveOutputAvailable = false;
+        const relay = this.relay;
+        this.relay = undefined;
+        relay?.input.destroy();
+        relay?.child.kill('SIGKILL');
+        for (const cancel of [...this.activeWriteCancellations])
+            cancel();
+    }
+    relayProcess() {
+        if (this.relay)
+            return this.relay;
+        const child = spawn('node', ['-e', LIVE_OUTPUT_RELAY_SCRIPT], {
+            stdio: ['pipe', this.descriptor, 'ignore', 'pipe'],
+        });
+        const input = child.stdin;
+        const acknowledgements = child.stdio[3];
+        if (!input || !acknowledgements)
+            throw new Error('live output relay has no control pipes');
+        child.on('error', () => { });
+        input.on('error', () => { });
+        acknowledgements.on('error', () => { });
+        const ready = new Promise((resolve, reject) => {
+            acknowledgements.once('data', chunk => {
+                if (chunk.includes('R'.charCodeAt(0)))
+                    resolve();
+                else
+                    reject(new Error('live output relay sent an invalid readiness acknowledgement'));
+            });
+            child.once('exit', () => reject(new Error('live output relay exited before readiness')));
+            child.once('error', reject);
+        });
+        void ready.catch(() => { });
+        child.unref();
+        void ready.then(() => {
+            input.unref?.();
+            acknowledgements.unref?.();
+        }, () => { });
+        const relay = { child, input, acknowledgements, ready };
+        child.once('exit', () => {
+            if (this.relay?.child !== child)
+                return;
+            this.relay = undefined;
+        });
+        this.relay = relay;
+        return relay;
+    }
+}
+export const childOutputSinks = {
+    stdout: new FileDescriptorSink(1),
+    stderr: new FileDescriptorSink(2),
+};
+const POST_LEADER_CAPTURE_DRAIN_TIMEOUT_MS = 250;
+function closeDescriptor(descriptor) {
+    if (descriptor === undefined)
+        return;
+    try {
+        closeSync(descriptor);
+    }
+    catch {
+        // Best-effort cleanup after another operation has already failed.
+    }
+}
+function createOutputFifo(name) {
+    const root = mkdtempSync(join(tmpdir(), 'orizu-child-output-'));
+    const fifoPath = join(root, name);
+    let anchorDescriptor;
+    let readDescriptor;
+    let writeDescriptor;
+    try {
+        const creation = spawnSync('mkfifo', [fifoPath], { stdio: 'ignore' });
+        if (creation.error)
+            throw creation.error;
+        if (creation.status !== 0) {
+            throw new Error(`mkfifo exited with status ${creation.status ?? 'unknown'}`);
+        }
+        // The temporary read/write anchor prevents either open from waiting for
+        // its peer. The child inherits the blocking write end; the parent polls a
+        // nonblocking read end so descendant-held descriptors remain cancellable.
+        anchorDescriptor = openSync(fifoPath, constants.O_RDWR | constants.O_NONBLOCK);
+        readDescriptor = openSync(fifoPath, constants.O_RDONLY | constants.O_NONBLOCK);
+        writeDescriptor = openSync(fifoPath, constants.O_WRONLY);
+        closeDescriptor(anchorDescriptor);
+        anchorDescriptor = undefined;
+        const source = new FileDescriptorSource(readDescriptor);
+        readDescriptor = undefined;
+        rmSync(root, { force: true, recursive: true });
+        return { source, writeDescriptor };
+    }
+    catch (error) {
+        closeDescriptor(writeDescriptor);
+        closeDescriptor(readDescriptor);
+        closeDescriptor(anchorDescriptor);
+        rmSync(root, { force: true, recursive: true });
+        throw error;
+    }
+}
+export async function spawnPipedChild(command, args, environment) {
+    const stdout = createOutputFifo('stdout');
+    let stderr;
+    try {
+        stderr = createOutputFifo('stderr');
+    }
+    catch (error) {
+        stdout.source.destroy();
+        closeDescriptor(stdout.writeDescriptor);
+        throw error;
+    }
+    let child;
+    try {
+        // Begin the bounded parent-side drain before an immediate child crash can
+        // strand bytes in the child's userland stdout/stderr buffers.
+        stdout.source.read(0);
+        stderr.source.read(0);
+        child = spawn(command, args, {
+            env: environment,
+            stdio: ['inherit', stdout.writeDescriptor, stderr.writeDescriptor],
+        });
+    }
+    catch (error) {
+        stdout.source.destroy();
+        stderr.source.destroy();
+        throw error;
+    }
+    finally {
+        closeDescriptor(stdout.writeDescriptor);
+        closeDescriptor(stderr.writeDescriptor);
+    }
+    // `close` also waits for descendant-held stdio descriptors. Observe the
+    // leader's exit so completePipedChild can enforce its bounded EOF grace.
+    const exited = new Promise(resolve => child.once('exit', resolve));
+    try {
+        await new Promise((resolve, reject) => {
+            child.once('spawn', resolve);
+            child.once('error', reject);
+        });
+    }
+    catch (error) {
+        stdout.source.destroy();
+        stderr.source.destroy();
+        throw error;
+    }
+    return {
+        stdout: stdout.source,
+        stderr: stderr.source,
+        exited,
+        get signalCode() { return child.signalCode; },
+        kill: signal => { child.kill(signal); },
+    };
+}
+const liveSinkStates = new WeakMap();
+function liveSinkState(destination) {
+    const existing = liveSinkStates.get(destination);
+    if (existing)
+        return existing;
+    const state = { hasFailed: false };
+    destination.on('error', () => { state.hasFailed = true; });
+    liveSinkStates.set(destination, state);
+    return state;
+}
+async function writeLiveOutput(destination, state, text) {
+    if (state.hasFailed)
+        return;
+    await new Promise(resolve => {
+        try {
+            destination.write(text, error => {
+                if (error)
+                    state.hasFailed = true;
+                resolve();
+            });
+        }
+        catch {
+            state.hasFailed = true;
+            resolve();
+        }
+    });
+}
+export async function writeChildStderr(text) {
+    const sink = childOutputSinks.stderr;
+    let timer;
+    const didForward = await Promise.race([
+        writeLiveOutput(sink, liveSinkState(sink), `${text}\n`).then(() => true),
+        new Promise(resolve => {
+            timer = setTimeout(() => resolve(false), LIVE_OUTPUT_STALL_TIMEOUT_MS);
+        }),
+    ]);
+    if (timer)
+        clearTimeout(timer);
+    if (!didForward)
+        sink.cancelPendingWrites();
+}
+function errorFromUnknown(cause) {
+    return cause instanceof Error ? cause : new Error(String(cause));
+}
+async function waitForChildExit(child, timeoutMilliseconds) {
+    let timer;
+    const didExit = await Promise.race([
+        child.exited.then(() => true),
+        new Promise(resolve => {
+            timer = setTimeout(() => resolve(false), timeoutMilliseconds);
+        }),
+    ]);
+    if (timer)
+        clearTimeout(timer);
+    return didExit;
+}
+async function terminateAfterForwardingFailure(child, forwarding, captureDrain, error) {
+    child.kill('SIGTERM');
+    for (const stream of forwarding)
+        stream.stopLiveOutput();
+    child.stdout.destroy();
+    child.stderr.destroy();
+    await captureDrain;
+    if (!await waitForChildExit(child, FORWARDING_FAILURE_TERMINATION_TIMEOUT_MS)) {
+        child.kill('SIGKILL');
+        await waitForChildExit(child, FORWARDING_FAILURE_TERMINATION_TIMEOUT_MS);
+    }
+    throw error;
+}
+export async function completePipedChild(child, forwarding) {
+    const captureDrain = Promise.allSettled(forwarding.map(stream => stream.completed));
+    const firstFailure = Promise.race(forwarding.map(stream => stream.failure));
+    const firstOutcome = await Promise.race([
+        child.exited.then(status => ({ kind: 'exit', status })),
+        firstFailure.then(error => ({ kind: 'failure', error })),
+    ]);
+    if (firstOutcome.kind === 'failure') {
+        return terminateAfterForwardingFailure(child, forwarding, captureDrain, firstOutcome.error);
+    }
+    const status = firstOutcome.status;
+    const waitForCaptureDrain = async () => {
+        let timer;
+        const didDrain = await Promise.race([
+            captureDrain.then(() => true),
+            new Promise(resolve => {
+                timer = setTimeout(() => resolve(false), POST_LEADER_CAPTURE_DRAIN_TIMEOUT_MS);
+            }),
+        ]);
+        if (timer)
+            clearTimeout(timer);
+        return didDrain;
+    };
+    const throwIfCaptureFailed = async () => {
+        await captureDrain;
+        const failure = forwarding.map(stream => stream.failureReason()).find(Boolean);
+        if (failure)
+            throw failure;
+    };
+    // Preserve ordinary live forwarding when EOF is already on its way. If a
+    // blocked sink or descendant-held descriptor prevents that bounded drain,
+    // switch to capture-only before enforcing the same bounded EOF grace.
+    if (await waitForCaptureDrain()) {
+        await throwIfCaptureFailed();
+        return status;
+    }
+    for (const stream of forwarding)
+        stream.stopLiveOutput();
+    if (await waitForCaptureDrain()) {
+        await throwIfCaptureFailed();
+        return status;
+    }
+    for (const stream of forwarding)
+        stream.expectSourceClose();
+    child.stdout.destroy();
+    child.stderr.destroy();
+    await throwIfCaptureFailed();
+    return status;
+}
+export async function runPipedChild(command, args, environment, onSpawn, capture, observeChild) {
+    await Promise.all([childOutputSinks.stdout.prepare(), childOutputSinks.stderr.prepare()]);
+    const child = await spawnPipedChild(command, args, environment);
+    observeChild?.(child);
+    const forwarding = [
+        teeChildOutput(child.stdout, childOutputSinks.stdout, capture.stdout),
+        teeChildOutput(child.stderr, childOutputSinks.stderr, capture.stderr),
+    ];
+    const completion = completePipedChild(child, forwarding);
+    const firstForwardingFailure = Promise.race(forwarding.map(stream => stream.failure)).then(error => { throw error; });
+    try {
+        await Promise.race([onSpawn(), firstForwardingFailure]);
+        const exitCode = await completion;
+        return { status: child.signalCode ? null : exitCode };
+    }
+    catch (cause) {
+        child.kill('SIGTERM');
+        await completion.catch(() => undefined);
+        throw cause;
+    }
+}
+/**
+ * Forward a child stream live while retaining a bounded caller-owned copy.
+ * Transient sink slowness pushes back; a stall degrades safely to capture-only.
+ */
+export function teeChildOutput(source, destination, capture) {
+    let isLiveOutputEnabled = true;
+    let isSourceCloseExpected = false;
+    let unexpectedFailure;
+    let remainingLiveOutputWaitMilliseconds = LIVE_OUTPUT_STALL_TIMEOUT_MS;
+    let liveOutputWaitFinishedAt = performance.now();
+    let resolveLiveOutputStopped = () => { };
+    const liveOutputStopped = new Promise(resolve => { resolveLiveOutputStopped = resolve; });
+    const stopLiveOutput = () => {
+        if (!isLiveOutputEnabled)
+            return;
+        isLiveOutputEnabled = false;
+        if (destination instanceof FileDescriptorSink)
+            destination.cancelPendingWrites();
+        resolveLiveOutputStopped();
+    };
+    const sinkState = liveSinkState(destination);
+    const forward = async (text) => {
+        capture(text);
+        if (!isLiveOutputEnabled)
+            return;
+        const waitStartedAt = performance.now();
+        remainingLiveOutputWaitMilliseconds = Math.min(LIVE_OUTPUT_STALL_TIMEOUT_MS, remainingLiveOutputWaitMilliseconds + waitStartedAt - liveOutputWaitFinishedAt);
+        let stallTimer;
+        const wasForwarded = await Promise.race([
+            writeLiveOutput(destination, sinkState, text).then(() => true),
+            liveOutputStopped.then(() => false),
+            new Promise(resolve => {
+                stallTimer = setTimeout(() => resolve(false), remainingLiveOutputWaitMilliseconds);
+            }),
+        ]);
+        if (stallTimer)
+            clearTimeout(stallTimer);
+        liveOutputWaitFinishedAt = performance.now();
+        remainingLiveOutputWaitMilliseconds -= liveOutputWaitFinishedAt - waitStartedAt;
+        if (!wasForwarded || remainingLiveOutputWaitMilliseconds <= 0)
+            stopLiveOutput();
+    };
+    const completed = (async () => {
+        const decoder = new TextDecoder();
+        for await (const chunk of source) {
+            const text = decoder.decode(chunk, { stream: true });
+            if (text)
+                await forward(text);
+        }
+        const remainder = decoder.decode();
+        if (remainder)
+            await forward(remainder);
+    })();
+    let resolveFailure = () => { };
+    const failure = new Promise(resolve => { resolveFailure = resolve; });
+    void completed.catch(cause => {
+        if (isSourceCloseExpected)
+            return;
+        unexpectedFailure = errorFromUnknown(cause);
+        resolveFailure(unexpectedFailure);
+    });
+    return {
+        completed,
+        failure,
+        failureReason: () => unexpectedFailure,
+        expectSourceClose: () => { isSourceCloseExpected = true; },
+        stopLiveOutput,
+    };
+}

package/dist/cli-auth-browser-page.d.ts

@@ -0,0 +1,2 @@
+export declare function renderCliAuthBrowserPage(status: 'success' | 'error'): string;
+//# sourceMappingURL=cli-auth-browser-page.d.ts.map

package/dist/cli-auth-browser-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-auth-browser-page.d.ts","sourceRoot":"","sources":["../src/cli-auth-browser-page.ts"],"names":[],"mappings":"AAAA,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,CA2G5E"}