orizu 0.5.49 → 0.5.50

package/src/skill-installer.ts

@@ -12,7 +12,6 @@ import {
   renameSync,
   rmdirSync,
   rmSync,
-  symlinkSync,
   unlinkSync,
   writeFileSync,
 } from 'fs'
@@ -87,6 +86,10 @@ export interface SkillInstallResult {
   path: string
   action: 'created' | 'updated' | 'would-create' | 'would-update'
   mode: 'link' | 'copy' | 'section'
+  /** Where a person's own folder at the path was moved before replacing it. */
+  backup?: string
+  /** Why a person's folder, or part of it, is still beside the skill. */
+  warning?: string
 }
 
 export interface SkillInstallMeta {
@@ -384,7 +387,7 @@ export function resolveEffectiveInstallMode(
   return isStableSkillSourcePath(sourceRoot) ? 'link' : 'copy'
 }
 
-function shouldCopySkillPath(sourceRoot: string, sourcePath: string): boolean {
+export function shouldCopySkillPath(sourceRoot: string, sourcePath: string): boolean {
   const rel = relative(sourceRoot, sourcePath).replace(/\\/g, '/')
   if (!rel) {
     return true
@@ -402,15 +405,6 @@ function shouldCopySkillPath(sourceRoot: string, sourcePath: string): boolean {
   ) && !rel.endsWith('.pyc') && !rel.endsWith('.pyo')
 }
 
-function copySkillTree(sourceDir: string, targetDir: string) {
-  rmSync(targetDir, { recursive: true, force: true })
-  mkdirSync(dirname(targetDir), { recursive: true })
-  cpSync(sourceDir, targetDir, {
-    recursive: true,
-    filter: sourcePath => shouldCopySkillPath(sourceDir, sourcePath),
-  })
-}
-
 function stripFrontmatter(markdown: string): string {
   const match = markdown.match(/^---\r?\n[\s\S]*?\r?\n---\r?\n/)
   if (!match) {
@@ -537,16 +531,10 @@ export function readSkillMeta(targetDir: string): SkillInstallMeta | null {
   }
 }
 
-function linkSkillTree(sourceDir: string, targetDir: string) {
-  rmSync(targetDir, { recursive: true, force: true })
-  mkdirSync(dirname(targetDir), { recursive: true })
-  symlinkSync(sourceDir, targetDir, 'dir')
-}
-
-export function installSkillTarget(
+export async function installSkillTarget(
   target: SkillInstallTarget,
   options?: SkillInstallOptions
-): SkillInstallResult {
+): Promise<SkillInstallResult> {
   const source = resolveSkillSource()
   const targetPath = getSkillInstallPath(target, options)
 
@@ -570,18 +558,23 @@ export function installSkillTarget(
     throw new Error(`${targetPath} already exists. Pass --yes to replace it.`)
   }
 
-  if (mode === 'link') {
-    linkSkillTree(source.root, targetPath)
-  } else {
-    copySkillTree(source.root, targetPath)
-    writeSkillMeta(targetPath, source, options)
-  }
+  const { runSkillFolderReplacement } = await import('./skill-install-workflow.js')
+  const { backup, warning } = await runSkillFolderReplacement({
+    sourceRoot: source.root,
+    targetPath,
+    // `section` is only AGENTS.md, handled above.
+    mode: mode === 'link' ? 'link' : 'copy',
+    backupPath: uniqueBackupPath(SKILL_NAME, target, options),
+    writeMarker: dir => writeSkillMeta(dir, source, options),
+  })
 
   return {
     target,
     path: targetPath,
     action: exists ? 'updated' : 'created',
     mode,
+    ...(backup ? { backup } : {}),
+    ...(warning ? { warning } : {}),
   }
 }
 
@@ -849,9 +842,9 @@ function backupDirectoryFor(options?: SkillInstallOptions): string {
   return resolve(resolveHome(options), '.orizu', 'skill-backups')
 }
 
-function uniqueBackupPath(install: LegacySkillInstall, options?: SkillInstallOptions): string {
+function uniqueBackupPath(name: string, target: SkillInstallTarget, options?: SkillInstallOptions): string {
   const stamp = new Date().toISOString().replace(/[-:]/g, '').replace(/\.\d+Z$/, 'Z')
-  const base = join(backupDirectoryFor(options), `${LEGACY_SKILL_NAME}-${stamp}-${install.target}`)
+  const base = join(backupDirectoryFor(options), `${name}-${stamp}-${target}`)
   let candidate = base
   for (let attempt = 2; pathEntryExists(candidate); attempt += 1) {
     candidate = `${base}-${attempt}`
@@ -903,16 +896,16 @@ function removeLegacySkillInstall(
     removeLink(install.path)
     return null
   }
-  const backupPath = uniqueBackupPath(install, options)
+  const backupPath = uniqueBackupPath(LEGACY_SKILL_NAME, install.target, options)
   moveToBackup(install.path, backupPath)
   return backupPath
 }
 
-function replaceOneLegacySkillInstall(
+async function replaceOneLegacySkillInstall(
   install: LegacySkillInstall,
   options: LegacySkillReplaceOptions | undefined,
   heldBackReason: string | null
-): LegacySkillReplacement {
+): Promise<LegacySkillReplacement> {
   const installedPath = getSkillInstallPath(install.target, options)
   const needsInstall = !pathEntryExists(installedPath)
   const result = {
@@ -933,7 +926,7 @@ function replaceOneLegacySkillInstall(
   let didInstall = false
   try {
     if (needsInstall) {
-      installSkillTarget(install.target, {
+      await installSkillTarget(install.target, {
         ...options,
         overwrite: false,
         dryRun: false,
@@ -988,9 +981,9 @@ function heldBackReasonFor(
   return blockingLink ? `${blockingLink.path} links to it and is left in place` : null
 }
 
-export function replaceLegacySkillInstalls(
+export async function replaceLegacySkillInstalls(
   options?: LegacySkillReplaceOptions
-): { replacements: LegacySkillReplacement[], problems: LegacySkillProblem[] } {
+): Promise<{ replacements: LegacySkillReplacement[], problems: LegacySkillProblem[] }> {
   const { installs, problems } = findLegacySkillInstalls(options)
   // Remove links before folders, so no link is left pointing at a moved folder.
   const ordered = [
@@ -998,10 +991,10 @@ export function replaceLegacySkillInstalls(
     ...installs.filter(install => install.kind === 'directory'),
   ]
   const reasons = new Map(ordered.map(install => [install, heldBackReasonFor(install, installs, options)]))
-  return {
-    replacements: ordered.map(install =>
-      replaceOneLegacySkillInstall(install, options, reasons.get(install) ?? null)
-    ),
-    problems,
+  // One at a time, in order: links go before the folders they point to.
+  const replacements: LegacySkillReplacement[] = []
+  for (const install of ordered) {
+    replacements.push(await replaceOneLegacySkillInstall(install, options, reasons.get(install) ?? null))
   }
+  return { replacements, problems }
 }

package/src/stored-session-requests.ts

@@ -0,0 +1,316 @@
+import { Cause, Effect, Exit, Result, Schema } from 'effect'
+
+import {
+  clearServerCredentialsIfCurrent,
+  credentialsEqual,
+  getServerCredentials,
+  rememberResolvedBearer,
+  updateServerCredentialsIfCurrent,
+  withCredentialsTransactionLockAsync,
+} from './credentials.js'
+import { assertSecureTokenTransport, credentialRequestRedirectPolicy } from './http.js'
+import { describeLogoutHttpFailure, describeLogoutTransportFailure } from './logout-diagnostic.js'
+import { ServerCredentials, SessionServerCredentials } from './types.js'
+
+// Requests signed with a stored login (`orizu login`): the sign-in refresh, the
+// request and its one replay after a 401, and logout. Loaded only on that path;
+// ORIZU_TOKEN and ORIZU_TOKEN_FILE requests stay in http.ts and never load this.
+
+function isSessionCredentials(credentials: ServerCredentials): credentials is SessionServerCredentials {
+  return 'accessToken' in credentials
+}
+
+function rememberSessionCredentials(credentials: SessionServerCredentials): SessionServerCredentials {
+  rememberResolvedBearer(credentials.accessToken)
+  rememberResolvedBearer(credentials.refreshToken)
+  return credentials
+}
+
+function getAuthorizationToken(credentials: ServerCredentials): string {
+  return isSessionCredentials(credentials)
+    ? rememberSessionCredentials(credentials).accessToken
+    : rememberResolvedBearer(credentials.apiKey)
+}
+
+function isExpired(expiresAt: number): boolean {
+  const nowUnix = Math.floor(Date.now() / 1000)
+  return expiresAt <= nowUnix + 30
+}
+
+function boundedTimeoutMs(name: string, fallback: number, maximum: number): number {
+  const configured = Number(process.env[name])
+  if (!Number.isSafeInteger(configured) || configured <= 0) return fallback
+  return Math.min(configured, maximum)
+}
+
+const isRedirectRefusal = (error: unknown) => error instanceof TypeError
+  && error.cause instanceof Error && /redirect/i.test(error.cause.message)
+
+/** fetch under the CLI's redirect policy, saying so when that policy refused a redirect. */
+async function credentialFetch(baseUrl: string, path: string, init: RequestInit): Promise<Response> {
+  const policy = credentialRequestRedirectPolicy()
+  try {
+    return await fetch(`${baseUrl}${path}`, { ...init, ...policy })
+  } catch (error) {
+    if (policy.redirect === 'error' && isRedirectRefusal(error)) {
+      throw new Error(`Refusing to follow a redirect from ${baseUrl} with CLI credentials.`, { cause: error })
+    }
+    throw error
+  }
+}
+
+/**
+ * Runs `program`, stopped by the caller's signal or `stop`. A stop by either
+ * rejects with that signal's reason, as an aborted fetch would.
+ */
+async function runStoppable<A>(program: Effect.Effect<A, unknown>, ...signals: Array<AbortSignal | null | undefined>): Promise<A> {
+  const present = signals.filter((signal): signal is AbortSignal => Boolean(signal))
+  const exit = await Effect.runPromiseExit(program, { signal: AbortSignal.any(present) })
+  if (Exit.isSuccess(exit)) return exit.value
+  const stoppedBy = present.find(signal => signal.aborted)
+  if (stoppedBy && Cause.hasInterruptsOnly(exit.cause)) throw stoppedBy.reason
+  throw Cause.squash(exit.cause)
+}
+
+const RefreshReply = Schema.Struct({
+  accessToken: Schema.NonEmptyString,
+  refreshToken: Schema.NonEmptyString,
+  expiresAt: Schema.Finite,
+})
+
+const INVALID_REFRESH = 'Server returned invalid refresh credentials. Run `orizu login` again.'
+
+function refreshRequest(baseUrl: string, credentials: SessionServerCredentials): Effect.Effect<SessionServerCredentials, Error> {
+  const timeoutMs = boundedTimeoutMs('ORIZU_CREDENTIALS_REFRESH_TIMEOUT_MS', 10_000, 30_000)
+  const refreshToken = rememberResolvedBearer(credentials.refreshToken)
+  return Effect.tryPromise({
+    try: async signal => {
+      const response = await credentialFetch(baseUrl, '/api/cli/auth/refresh', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ refreshToken }),
+        signal,
+      })
+      if (!response.ok) throw new Error('Session expired. Run `orizu login` again.')
+      // Reading the body stays under the deadline too.
+      try {
+        return await response.json() as unknown
+      } catch (error) {
+        throw error instanceof SyntaxError ? new Error(INVALID_REFRESH) : error
+      }
+    },
+    catch: cause => cause instanceof Error ? cause : new Error(String(cause)),
+  }).pipe(
+    Effect.timeoutOrElse({
+      duration: timeoutMs,
+      orElse: () => Effect.fail(new Error(`ORIZU_CREDENTIALS_REFRESH_TIMEOUT: session refresh exceeded ${timeoutMs}ms.`)),
+    }),
+    Effect.flatMap(data => {
+      const decoded = Schema.decodeUnknownResult(RefreshReply)(data)
+      if (Result.isFailure(decoded) || decoded.success.expiresAt === 0) return Effect.fail(new Error(INVALID_REFRESH))
+      const refreshed = rememberSessionCredentials({ credentialType: 'session', ...decoded.success })
+      if (isExpired(refreshed.expiresAt)) {
+        return Effect.fail(new Error(
+          'ORIZU_CREDENTIALS_REFRESH_UNUSABLE: refreshed session expires within the 30-second safety window.'
+        ))
+      }
+      return Effect.succeed(refreshed)
+    }),
+  )
+}
+
+const LOCK_STOP_SIGNALS = ['SIGINT', 'SIGTERM'] as const
+
+/**
+ * Stop handling for the time the credentials lock is held across a refresh.
+ * Without it a Ctrl-C ends the CLI with credentials.json.lock left behind, and
+ * every later refresh and logout fails until someone deletes it by hand. The
+ * handlers are added before the lock is taken and removed after it is
+ * released, so no stop lands between the two. A stop aborts the refresh; the
+ * lock is released as it unwinds; then the CLI ends by the same signal, unless
+ * the caller's own request was cancelled by it: then the command that owns the
+ * stop (run-gepa, a download) reports and ends the CLI itself. Other listeners
+ * don't count as owners: the git step's listener steps aside whenever another
+ * one is present.
+ */
+function lockStopWindow(callerSignal: AbortSignal | null | undefined) {
+  const controller = new AbortController()
+  let stoppedBy: NodeJS.Signals | null = null
+  const handlers = LOCK_STOP_SIGNALS.map(signal => ({
+    signal,
+    handle: () => {
+      if (stoppedBy) return
+      stoppedBy = signal
+      controller.abort(new Error(`Session refresh stopped by ${signal}.`))
+    },
+  }))
+  return {
+    signal: controller.signal,
+    listen(): void { for (const entry of handlers) process.on(entry.signal, entry.handle) },
+    unlisten(): void { for (const entry of handlers) process.off(entry.signal, entry.handle) },
+    /**
+     * After the lock is released and the handlers are gone: end by the stop
+     * signal, if there was one. With no listener left the signal ends the CLI
+     * at once; a remaining listener gets it when the event loop next polls,
+     * which a second check phase is always after. If the CLI is still running
+     * then, a listener owns the stop
+     * (run-gepa may not have cancelled the request yet), and the refresh fails
+     * with the stop as its reason so the command can unwind and end itself.
+     */
+    async endIfStopped(): Promise<void> {
+      if (!stoppedBy || callerSignal?.aborted) return
+      process.kill(process.pid, stoppedBy)
+      for (let turn = 0; turn < 2; turn += 1) await new Promise(resolve => setImmediate(resolve))
+    },
+  }
+}
+
+interface StoredRefreshResult {
+  status: 'refreshed' | 'changed'
+  credentials: ServerCredentials | null
+}
+
+async function refreshStoredCredentialsIfCurrent(
+  baseUrl: string,
+  expected: ServerCredentials,
+  callerSignal?: AbortSignal | null
+): Promise<StoredRefreshResult> {
+  if (!isSessionCredentials(expected)) {
+    throw new Error('API key credentials do not refresh. Run `orizu login` again if access fails.')
+  }
+  assertSecureTokenTransport(baseUrl)
+  const stop = lockStopWindow(callerSignal)
+  stop.listen()
+  try {
+    return await withCredentialsTransactionLockAsync(async () => {
+      const current = getServerCredentials(baseUrl)
+      if (!current || !credentialsEqual(current, expected)) {
+        return { status: 'changed', credentials: current }
+      }
+      const refreshed = await runStoppable(refreshRequest(baseUrl, expected), callerSignal, stop.signal)
+      // Written inside the lock's own async context, never from the Effect fiber.
+      if (!updateServerCredentialsIfCurrent(baseUrl, expected, refreshed)) {
+        return { status: 'changed', credentials: getServerCredentials(baseUrl) }
+      }
+      return { status: 'refreshed', credentials: refreshed }
+    })
+  } finally {
+    stop.unlisten()
+    await stop.endIfStopped()
+  }
+}
+
+function requireCurrentCredentials(baseUrl: string, credentials: ServerCredentials | null): ServerCredentials {
+  if (credentials) return credentials
+  throw new Error(`Not logged in for ${baseUrl}. Run \`orizu login --server ${baseUrl}\` (or \`--local\`) first.`)
+}
+
+/**
+ * Marks an error raised after the server answered 401 and before the request
+ * was sent again: the server refused the request, so nothing was written
+ * (ORI-2431). The message is unchanged.
+ */
+function markRequestRejected(error: unknown): unknown {
+  if (error instanceof Error && Object.isExtensible(error)) Object.assign(error, { requestRejected: true })
+  return error
+}
+
+export interface StoredRequestOptions {
+  baseUrl: string
+  credentials: ServerCredentials
+  allowRefresh: boolean
+  /** Messages when another login replaced the stored one, before the first request and before the replay. */
+  changedBeforeRequest: string
+  changedBeforeReplay: string
+  /** Called with each refreshed login as soon as it is stored, even if the send after it fails. */
+  onRefreshed?: (credentials: ServerCredentials) => void
+}
+
+/**
+ * Refresh first when the login has expired, then send. On a 401, refresh once
+ * and send once more, only if the stored login is still the one this request
+ * used. `onRequestStart` runs before each send, never for the refresh.
+ */
+export async function storedRequest(
+  options: StoredRequestOptions,
+  path: string,
+  init: RequestInit,
+  onRequestStart?: () => void
+): Promise<Response> {
+  const { baseUrl } = options
+  let credentials = options.credentials
+  const refresh = async (changedMessage: string) => {
+    const result = await refreshStoredCredentialsIfCurrent(baseUrl, credentials, init.signal)
+    if (result.status === 'changed') throw new Error(changedMessage)
+    credentials = requireCurrentCredentials(baseUrl, result.credentials)
+    options.onRefreshed?.(credentials)
+  }
+  const send = () => {
+    onRequestStart?.()
+    return credentialFetch(baseUrl, path, {
+      ...init,
+      headers: { ...(init.headers || {}), Authorization: `Bearer ${getAuthorizationToken(credentials)}` },
+    })
+  }
+
+  let didRefresh = false
+  if (options.allowRefresh && isSessionCredentials(credentials) && isExpired(credentials.expiresAt)) {
+    await refresh(options.changedBeforeRequest)
+    didRefresh = true
+  }
+  let response = await send()
+  if (options.allowRefresh && response.status === 401 && isSessionCredentials(credentials) && !didRefresh) {
+    try {
+      await refresh(options.changedBeforeReplay)
+    } catch (error) {
+      // A stop by the caller's own signal is the caller's to describe.
+      throw error === init.signal?.reason ? error : markRequestRejected(error)
+    }
+    response = await send()
+  }
+  return response
+}
+
+export interface LogoutResult {
+  remoteError: string | null
+  localCredentialCleared: boolean
+}
+
+/**
+ * Revoke the login on the server within ORIZU_LOGOUT_TIMEOUT_MS, then remove it
+ * locally only if it is still the stored one: another login saved meanwhile is kept.
+ */
+export async function storedLogout(
+  baseUrl: string,
+  credentialKey: string,
+  credentials: ServerCredentials,
+  callerSignal?: AbortSignal | null
+): Promise<LogoutResult> {
+  const authorizationToken = getAuthorizationToken(credentials)
+  const refreshToken = isSessionCredentials(credentials) ? rememberResolvedBearer(credentials.refreshToken) : null
+  const secrets = [authorizationToken, ...(refreshToken !== null ? [refreshToken] : [])]
+  const timeoutMs = boundedTimeoutMs('ORIZU_LOGOUT_TIMEOUT_MS', 10_000, 30_000)
+  const timeoutError = Object.assign(new Error(`ORIZU_LOGOUT_TIMEOUT: remote logout exceeded ${timeoutMs}ms.`), { name: 'TimeoutError' })
+  const remote = Effect.tryPromise({
+    try: async signal => {
+      assertSecureTokenTransport(baseUrl)
+      const response = await credentialFetch(baseUrl, '/api/cli/auth/logout', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${authorizationToken}` },
+        body: refreshToken !== null ? JSON.stringify({ refreshToken }) : undefined,
+        signal,
+      })
+      return response.ok ? null : await describeLogoutHttpFailure(response, secrets)
+    },
+    catch: error => error,
+  }).pipe(Effect.timeoutOrElse({ duration: timeoutMs, orElse: () => Effect.fail(timeoutError) }))
+
+  let remoteError: string | null
+  try {
+    remoteError = await runStoppable(remote, callerSignal)
+  } catch (error) {
+    remoteError = describeLogoutTransportFailure(error, secrets)
+  }
+  const localCredentialCleared = clearServerCredentialsIfCurrent(credentialKey, credentials)
+  return { remoteError, localCredentialCleared }
+}

package/src/terminal-key-session.ts

@@ -0,0 +1,88 @@
+// Reads keys from the person's terminal for setup's pickers. Loaded only
+// through `await import(...)`, so commands without a picker never load Effect.
+import { emitKeypressEvents } from 'readline'
+import { stdin as input, stdout as output } from 'process'
+
+import { Effect } from 'effect'
+
+export interface KeypressInfo {
+  name?: string
+  sequence?: string
+  ctrl?: boolean
+}
+
+/** What a key does: nothing yet, finish with a value, or cancel setup. */
+export type KeyOutcome<T> = { kind: 'wait' } | { kind: 'done', value: T } | { kind: 'cancel' }
+
+type RawInput = typeof input & {
+  setRawMode?: (mode: boolean) => void
+  isRaw?: boolean
+}
+
+// The terminal goes into raw mode (keys arrive one by one, nothing is echoed)
+// and, for pickers, the cursor is hidden. The release always undoes both.
+const rawKeys = (hideCursor: boolean) => Effect.acquireRelease(
+  Effect.sync(() => {
+    const rawInput = input as RawInput
+    const wasRaw = Boolean(rawInput.isRaw)
+    emitKeypressEvents(input)
+    if (hideCursor) output.write('\x1b[?25l')
+    input.resume()
+    rawInput.setRawMode?.(true)
+    return wasRaw
+  }),
+  wasRaw => Effect.sync(() => {
+    const rawInput = input as RawInput
+    if (rawInput.setRawMode && !wasRaw) rawInput.setRawMode(false)
+    input.pause()
+    if (hideCursor) output.write('\x1b[?25h')
+  }),
+)
+
+const nextOutcome = <T>(onKey: (key: KeypressInfo) => KeyOutcome<T>) => Effect.acquireUseRelease(
+  Effect.sync(() => ({ listener: null as ((chunk: string, key: KeypressInfo) => void) | null })),
+  held => Effect.callback<T, Error>(resume => {
+    held.listener = (_chunk, key) => {
+      // Ctrl-C arrives as a key in raw mode, so every picker cancels on it.
+      const outcome: KeyOutcome<T> = key.ctrl && key.name === 'c' ? { kind: 'cancel' } : onKey(key)
+      if (outcome.kind === 'done') resume(Effect.succeed(outcome.value))
+      else if (outcome.kind === 'cancel') resume(Effect.fail(new Error('Setup cancelled.')))
+    }
+    input.on('keypress', held.listener)
+  }),
+  held => Effect.sync(() => { if (held.listener) input.off('keypress', held.listener) }),
+)
+
+const STOP_SIGNALS = ['SIGINT', 'SIGTERM'] as const
+
+/**
+ * Hands each key to `onKey` until it finishes or cancels. A SIGINT or SIGTERM
+ * from outside ends the wait, puts the terminal back, then ends the process
+ * by that same signal.
+ */
+export async function readKeys<T>(onKey: (key: KeypressInfo) => KeyOutcome<T>, options: { hideCursor: boolean }): Promise<T> {
+  const controller = new AbortController()
+  const stop: { by: NodeJS.Signals | null } = { by: null }
+  const handlers = STOP_SIGNALS.map(signal => [signal, () => { stop.by = signal; controller.abort() }] as const)
+  for (const [signal, handler] of handlers) process.once(signal, handler)
+  try {
+    const value = await Effect.runPromise(Effect.scoped(Effect.andThen(rawKeys(options.hideCursor), nextOutcome(onKey))), { signal: controller.signal })
+    if (stop.by) return await endBy(stop.by, handlers)
+    return value
+  } catch (error: unknown) {
+    if (!stop.by) throw error
+    return await endBy(stop.by, handlers)
+  } finally {
+    for (const [signal, handler] of handlers) process.removeListener(signal, handler)
+  }
+}
+
+/** Ends the process by the signal that stopped it, once its handlers are gone. */
+async function endBy(signal: NodeJS.Signals, handlers: ReadonlyArray<readonly [NodeJS.Signals, () => void]>): Promise<never> {
+  for (const [name, handler] of handlers) process.removeListener(name, handler)
+  output.write('\n')
+  process.kill(process.pid, signal)
+  // The signal ends the process; if another listener holds it, exit as a shell would.
+  setTimeout(() => process.exit(signal === 'SIGINT' ? 130 : 143), 1_000)
+  return await new Promise<never>(() => {})
+}