orizu 0.5.50 → 0.5.52

package/dist/credentials.js

@@ -9,6 +9,11 @@ import { canonicalServerUrl, normalizeBaseUrl } from './global-flags.js';
 function isNodeError(error) {
     return error instanceof Error;
 }
+// The system's short error code (EACCES, EPERM), never the message: messages
+// from fs calls carry paths, and this one goes to the terminal.
+function errorCode(error) {
+    return isNodeError(error) && typeof error.code === 'string' ? error.code : 'unknown error';
+}
 export function getConfigDir() {
     if (process.env.ORIZU_CONFIG_DIR) {
         return process.env.ORIZU_CONFIG_DIR;
@@ -20,7 +25,7 @@ function getCredentialsPath() {
 }
 const DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS = 2_000;
 const MAX_CREDENTIALS_LOCK_TIMEOUT_MS = 10_000;
-const CREDENTIALS_LOCK_RETRY_MS = 20;
+export const CREDENTIALS_LOCK_RETRY_MS = 20;
 let heldCredentialsLock = null;
 const credentialsTransactionOwner = new AsyncLocalStorage();
 function getCredentialsLockPath() {
@@ -38,58 +43,74 @@ function readLockDuration(name, fallback, maximum = Number.MAX_SAFE_INTEGER) {
 function sleepSync(milliseconds) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
 }
-function acquireCredentialsLock() {
+export function credentialsLockTimeoutMs() {
+    return readLockDuration('ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS', DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS, MAX_CREDENTIALS_LOCK_TIMEOUT_MS);
+}
+export function credentialsLockTimeoutError(timeoutMs) {
+    return new Error(`ORIZU_CREDENTIALS_LOCK_TIMEOUT: credentials mutation did not acquire the lock within ${timeoutMs}ms. Verify no Orizu process is running, then remove credentials.json.lock manually.`);
+}
+/**
+ * One try at the cross-process lock. Returns null when another owner holds
+ * it. The waits between tries belong to the caller: a blocking one below for
+ * synchronous writers, an Effect sleep in credentials-transaction.ts.
+ */
+export function tryAcquireCredentialsLock() {
     const dir = getConfigDir();
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     chmodSync(dir, 0o700);
     const lockPath = getCredentialsLockPath();
-    const timeoutMs = readLockDuration('ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS', DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS, MAX_CREDENTIALS_LOCK_TIMEOUT_MS);
-    const deadline = Date.now() + timeoutMs;
-    while (true) {
-        const metadata = JSON.stringify({
-            version: 1,
-            pid: process.pid,
-            hostname: hostname(),
-            createdAt: Date.now(),
-            instanceId: randomBytes(16).toString('hex'),
-        });
-        const tempPath = join(dir, `.credentials.json.lock.${process.pid}.${randomBytes(8).toString('hex')}.tmp`);
+    const metadata = JSON.stringify({
+        version: 1,
+        pid: process.pid,
+        hostname: hostname(),
+        createdAt: Date.now(),
+        instanceId: randomBytes(16).toString('hex'),
+    });
+    const tempPath = join(dir, `.credentials.json.lock.${process.pid}.${randomBytes(8).toString('hex')}.tmp`);
+    try {
+        const fd = openSync(tempPath, 'wx', 0o600);
         try {
-            const fd = openSync(tempPath, 'wx', 0o600);
-            try {
-                writeFileSync(fd, metadata, 'utf8');
-                fsyncSync(fd);
-                chmodSync(tempPath, 0o600);
-            }
-            finally {
-                closeSync(fd);
-            }
-            try {
-                // link(2) publishes the already-complete inode without replacing an
-                // existing owner. No contender ever unlinks the canonical lock.
-                linkSync(tempPath, lockPath);
-            }
-            catch (error) {
-                if (!(isNodeError(error) && error.code === 'EEXIST'))
-                    throw error;
-                if (Date.now() >= deadline) {
-                    throw new Error(`ORIZU_CREDENTIALS_LOCK_TIMEOUT: credentials mutation did not acquire the lock within ${timeoutMs}ms. Verify no Orizu process is running, then remove credentials.json.lock manually.`);
-                }
-                sleepSync(Math.min(CREDENTIALS_LOCK_RETRY_MS, Math.max(1, deadline - Date.now())));
-                continue;
-            }
-            let resolveReleased = () => { };
-            const released = new Promise(resolve => { resolveReleased = resolve; });
-            return { path: lockPath, metadata, depth: 1, released, resolveReleased };
+            writeFileSync(fd, metadata, 'utf8');
+            fsyncSync(fd);
+            chmodSync(tempPath, 0o600);
         }
         finally {
-            // The unique owner-only preparation link is never retained, whether
-            // publication succeeds, loses to an owner, or fails unexpectedly.
-            rmSync(tempPath, { force: true });
+            closeSync(fd);
+        }
+        try {
+            // link(2) publishes the already-complete inode without replacing an
+            // existing owner. No contender ever unlinks the canonical lock.
+            linkSync(tempPath, lockPath);
+        }
+        catch (error) {
+            if (isNodeError(error) && error.code === 'EEXIST')
+                return null;
+            throw error;
         }
+        let resolveReleased = () => { };
+        const released = new Promise(resolve => { resolveReleased = resolve; });
+        return { path: lockPath, metadata, depth: 1, released, resolveReleased };
+    }
+    finally {
+        // The unique owner-only preparation link is never retained, whether
+        // publication succeeds, loses to an owner, or fails unexpectedly.
+        rmSync(tempPath, { force: true });
     }
 }
-function releaseCredentialsLock(lock) {
+/** Blocks the process between tries; only for synchronous writers. */
+function acquireCredentialsLock() {
+    const timeoutMs = credentialsLockTimeoutMs();
+    const deadline = Date.now() + timeoutMs;
+    while (true) {
+        const lock = tryAcquireCredentialsLock();
+        if (lock)
+            return lock;
+        if (Date.now() >= deadline)
+            throw credentialsLockTimeoutError(timeoutMs);
+        sleepSync(Math.min(CREDENTIALS_LOCK_RETRY_MS, Math.max(1, deadline - Date.now())));
+    }
+}
+export function releaseCredentialsLock(lock) {
     let currentMetadata;
     try {
         currentMetadata = readFileSync(lock.path, 'utf8');
@@ -129,17 +150,30 @@ export function withCredentialsTransactionLock(operation) {
     }
     const lock = acquireCredentialsLock();
     heldCredentialsLock = lock;
+    let failed = false;
     try {
         return operation();
     }
+    catch (error) {
+        failed = true;
+        throw error;
+    }
     finally {
         heldCredentialsLock = null;
-        try {
-            releaseCredentialsLock(lock);
-        }
-        finally {
-            lock.resolveReleased();
-        }
+        endTransaction(lock, failed);
+    }
+}
+/** Release the lock if it is still ours. A release error never hides the transaction's own error. */
+function endTransaction(lock, failed) {
+    try {
+        releaseCredentialsLock(lock);
+    }
+    catch (releaseError) {
+        if (!failed)
+            throw releaseError;
+    }
+    finally {
+        lock.resolveReleased();
     }
 }
 /**
@@ -147,7 +181,10 @@ export function withCredentialsTransactionLock(operation) {
  * synchronous credential writes are admitted only from this transaction's
  * async execution context; unrelated same-process work must wait or fail.
  */
-export async function withCredentialsTransactionLockAsync(operation) {
+export async function withCredentialsTransactionLockAsync(operation, 
+// How to wait for the cross-process lock. The default blocks the process
+// between tries; stored-login commands pass credentials-transaction.ts's.
+acquire = acquireCredentialsLock) {
     const lockPath = getCredentialsLockPath();
     const currentOwner = credentialsTransactionOwner.getStore();
     if (heldCredentialsLock) {
@@ -163,7 +200,7 @@ export async function withCredentialsTransactionLockAsync(operation) {
                 heldCredentialsLock.depth -= 1;
             }
         }
-        const timeoutMs = readLockDuration('ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS', DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS, MAX_CREDENTIALS_LOCK_TIMEOUT_MS);
+        const timeoutMs = credentialsLockTimeoutMs();
         let timer;
         const didRelease = await Promise.race([
             heldCredentialsLock.released.then(() => true),
@@ -171,26 +208,25 @@ export async function withCredentialsTransactionLockAsync(operation) {
         ]);
         if (timer)
             clearTimeout(timer);
-        if (!didRelease) {
-            throw new Error(`ORIZU_CREDENTIALS_LOCK_TIMEOUT: credentials mutation did not acquire the lock within ${timeoutMs}ms. Verify no Orizu process is running, then remove credentials.json.lock manually.`);
-        }
-        return await withCredentialsTransactionLockAsync(operation);
+        if (!didRelease)
+            throw credentialsLockTimeoutError(timeoutMs);
+        return await withCredentialsTransactionLockAsync(operation, acquire);
     }
-    const lock = acquireCredentialsLock();
+    const lock = await acquire();
     const owner = Symbol('credentials-transaction-owner');
     lock.asyncOwner = owner;
     heldCredentialsLock = lock;
+    let failed = false;
     try {
         return await credentialsTransactionOwner.run(owner, operation);
     }
+    catch (error) {
+        failed = true;
+        throw error;
+    }
     finally {
         heldCredentialsLock = null;
-        try {
-            releaseCredentialsLock(lock);
-        }
-        finally {
-            lock.resolveReleased();
-        }
+        endTransaction(lock, failed);
     }
 }
 function assertCredentialsLockHeld() {
@@ -244,18 +280,24 @@ function writeCredentials(config) {
     const tempPath = join(dir, `.credentials.json.${process.pid}.${randomBytes(8).toString('hex')}.tmp`);
     const payload = JSON.stringify(config, null, 2) + '\n';
     try {
-        const fd = openSync(tempPath, 'wx', 0o600);
         try {
-            writeFileSync(fd, payload, 'utf-8');
-            fsyncSync(fd);
+            const fd = openSync(tempPath, 'wx', 0o600);
+            try {
+                writeFileSync(fd, payload, 'utf-8');
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+            chmodSync(tempPath, 0o600);
+            // Never delete the destination to emulate replacement. If this platform
+            // cannot atomically replace it, preserve the old file and surface the error.
+            renameSync(tempPath, path);
         }
-        finally {
-            closeSync(fd);
+        catch (error) {
+            // Until the rename succeeds the saved file is untouched.
+            throw new Error(`ORIZU_CREDENTIALS_WRITE_FAILED: could not save sign-ins to ${path} (${errorCode(error)}). The saved file is unchanged.`, { cause: error });
         }
-        chmodSync(tempPath, 0o600);
-        // Never delete the destination to emulate replacement. If this platform
-        // cannot atomically replace it, preserve the old file and surface the error.
-        renameSync(tempPath, path);
         chmodSync(path, 0o600);
     }
     finally {
@@ -271,12 +313,15 @@ function createEmptyCredentialsConfig() {
         servers: {},
     };
 }
+// A missing file, invalid JSON or an unknown format start empty (the "log in
+// again" recovery). A file that exists but cannot be read is never replaced:
+// that would delete every other saved sign-in.
 function loadCredentialsConfigForWrite() {
     try {
         return loadCredentialsConfig() || createEmptyCredentialsConfig();
     }
-    catch {
-        return createEmptyCredentialsConfig();
+    catch (error) {
+        throw new Error(`ORIZU_CREDENTIALS_READ_FAILED: could not read ${getCredentialsPath()} (${errorCode(error)}). Saved sign-ins were not changed. Move it aside, then run \`orizu login\` again.`, { cause: error });
     }
 }
 export function loadCredentialsConfig() {

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAsLA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAEhE,eAAO,MAAM,wBAAwB,GAAI,iBAAiB,MAAM;;;EACJ,CAAA;AAE5D,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AA+sCtD,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CA0B1G;AAED,eAAO,MAAM,iBAAiB,SAAU,CAAA;AACxC,eAAO,MAAM,uBAAuB,QAAkB,CAAA;AACtD,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAexH;AAmMD,wBAAsB,IAAI,CAAC,OAAO,WAAwB,iBAiiBzD;AA8DD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAEhF,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAuLA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAEhE,eAAO,MAAM,wBAAwB,GAAI,iBAAiB,MAAM;;;EACJ,CAAA;AAE5D,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAmqCtD,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CA0B1G;AAED,eAAO,MAAM,iBAAiB,SAAU,CAAA;AACxC,eAAO,MAAM,uBAAuB,QAAkB,CAAA;AACtD,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAexH;AAmMD,wBAAsB,IAAI,CAAC,OAAO,WAAwB,iBAiiBzD;AAuED,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAEhF,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/index.js

@@ -62,7 +62,8 @@ import { killSwitchCommand } from './kill-switch-cli.js';
 import { egressAllowlistCommand } from './egress-allowlist-cli.js';
 import { teamConnectorsCommand } from './team-connectors-cli.js';
 import { inspectExistingWorkspaceTeam, getWorkspaceRoot } from './workspace.js';
-import { writeLastErrorRecord, extractLastErrorCode } from './last-error-record.js';
+import { errorOutputSecrets, writeLastErrorRecord, extractLastErrorCode } from './last-error-record.js';
+import { redactSecrets } from './secret-redaction.js';
 export { loadInstructionSet } from './instruction-set-loader.js';
 export const materializeRunnerVersion = (runnerVersionId) => materializeRegisteredRunnerVersion(runnerVersionId, false);
 export { parseJsonResponse, sanitizeTerminalText } from './json-response.js';
@@ -123,26 +124,21 @@ async function logOptimizationEvent() {
     if (!eventType || eventType.startsWith('--') || !runId || !Number.isInteger(sequence) || sequence <= 0) {
         throw new Error('Usage: orizu log <event_type> --run-id <id> --sequence <n> --payload @event.json');
     }
-    const response = await authedFetch(`/api/cli/optimization-runs/${encodeURIComponent(runId)}/events`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            eventId: getArg('--event-id') || randomUUID(),
-            sequence,
-            eventType,
-            eventLayer: getArg('--event-layer') || 'core',
-            optimizerFamily: getArg('--optimizer-family'),
-            iteration: getArg('--iteration') ? Number(getArg('--iteration')) : undefined,
-            candidateId: getArg('--candidate-id'),
-            parentCandidateId: getArg('--parent-candidate-id'),
-            childCandidateId: getArg('--child-candidate-id'),
-            payload,
-        }),
-    });
-    if (!response.ok) {
-        throw new Error(`Failed to log event: ${await response.text()}`);
-    }
-    const data = await parseJsonResponse(response, 'Optimization event log');
+    const writes = await import('./cli-write-commands.js');
+    const data = await writes.sendCommandWrite(writes.optimizationEvent(runId, {
+        eventId: getArg('--event-id') || randomUUID(),
+        sequence,
+        eventType,
+        eventLayer: getArg('--event-layer') || 'core',
+        optimizerFamily: getArg('--optimizer-family'),
+        iteration: getArg('--iteration') ? Number(getArg('--iteration')) : undefined,
+        candidateId: getArg('--candidate-id'),
+        parentCandidateId: getArg('--parent-candidate-id'),
+        childCandidateId: getArg('--child-candidate-id'),
+        payload,
+    }), { json: hasJsonFlag(), print: printLine });
+    if (!data)
+        return;
     if (hasJsonFlag()) {
         printJson({ eventId: data.eventId });
         return;
@@ -822,25 +818,20 @@ async function startOptimizationRun() {
             trackedScope: 'best_candidate',
         })),
     ];
-    const response = await authedFetch(`/api/cli/optimization-runs?project=${encodeURIComponent(project)}`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            optimizerVersionId,
-            promptVersionIds,
-            judgeVersionIds,
-            scorers,
-            datasetVersionId,
-            splitSetId,
-            trainSplitName: getArg('--train-split') || undefined,
-            validationSplitName: getArg('--validation-split') || undefined,
-            metadata,
-        }),
-    });
-    if (!response.ok) {
-        throw new Error(`Failed to start optimization run: ${await response.text()}`);
-    }
-    const data = await parseJsonResponse(response, 'Optimization run start');
+    const writes = await import('./cli-write-commands.js');
+    const data = await writes.sendCommandWrite(writes.optimizationStart(project, {
+        optimizerVersionId,
+        promptVersionIds,
+        judgeVersionIds,
+        scorers,
+        datasetVersionId,
+        splitSetId,
+        trainSplitName: getArg('--train-split') || undefined,
+        validationSplitName: getArg('--validation-split') || undefined,
+        metadata,
+    }), { json: hasJsonFlag(), print: printLine });
+    if (!data)
+        return;
     if (hasJsonFlag()) {
         printJson(data);
         return;
@@ -897,15 +888,10 @@ async function updateOptimizationRunLifecycle(action) {
             body.resultPromptVersionId = resultPromptVersionId;
         }
     }
-    const response = await authedFetch(`/api/cli/optimization-runs/${encodeURIComponent(runId)}`, {
-        method: 'PATCH',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify(body),
-    });
-    if (!response.ok) {
-        throw new Error(`Failed to update optimization run: ${await response.text()}`);
-    }
-    const data = await parseJsonResponse(response, 'Optimization run update');
+    const writes = await import('./cli-write-commands.js');
+    const data = await writes.sendCommandWrite(writes.optimizationLifecycle(runId, body), { json: hasJsonFlag(), print: printLine });
+    if (!data)
+        return;
     if (hasJsonFlag()) {
         printJson(data);
         return;
@@ -1805,9 +1791,17 @@ function isCliEntrypoint() {
         return false;
     }
 }
+// A secret this process holds (a login code, its verifier, a poll token, a
+// bearer, a forwarded runner key) is never printed, even when a server echoes
+// it back in an error. last-error.json hides the same values. Scrubbed again
+// after control characters are stripped, so one inside a secret can't hide it.
+function printErrorWithoutSecrets(message) {
+    const secrets = errorOutputSecrets();
+    printError(redactSecrets(sanitizeTerminalText(redactSecrets(message, { secrets })), { secrets }));
+}
 if (isCliEntrypoint()) {
     const rawArgs = process.argv.slice(2);
-    withPassiveUpdateNotice(rawArgs, getCliVersion, printError, args => 
+    withPassiveUpdateNotice(rawArgs, getCliVersion, printErrorWithoutSecrets, args => 
     // ORI-2429: the process-boundary adapter stays a Promise (ADR-038 guide); the record write is Effect-owned and never replaces this error.
     main(args).catch(async (error) => {
         const message = error instanceof Error ? error.message : 'Unknown error';

package/dist/last-error-record.d.ts

@@ -29,6 +29,13 @@ export interface LastErrorRecordInput {
 export interface WriteLastErrorRecordOptions {
     configDir?: string;
 }
+/**
+ * The values no error output may show: this process's remembered secrets, the
+ * current bearer and runner-forwarded keys. last-error.json and the terminal's
+ * error line both use this list. Longest first, so a secret inside another
+ * can't leave part of the longer one behind.
+ */
+export declare function errorOutputSecrets(): string[];
 export declare function extractLastErrorCode(error: unknown): string | null;
 export declare function isStringWithinCap(value: unknown, maximumCharacters: number, wasTruncated: boolean): value is string;
 export declare function boundedServerBaseUrl(value: string | null | undefined): string | null;

package/dist/last-error-record.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"last-error-record.d.ts","sourceRoot":"","sources":["../src/last-error-record.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,aAAa,EAAE,OAAO,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAC1C,eAAO,MAAM,mBAAmB,oBAAoB,CAAA;AACpD,eAAO,MAAM,4BAA4B,WAAa,CAAA;AACtD,eAAO,MAAM,4BAA4B,gBAAgB,CAAA;AAezD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,GAAG,CAAC,EAAE,IAAI,CAAA;CACX;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AA8ID,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAKlE;AAUD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,EACd,iBAAiB,EAAE,MAAM,EACzB,YAAY,EAAE,OAAO,GACpB,KAAK,IAAI,MAAM,CAMjB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIpF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,eAAe,CA0DjF;AAED,wBAAgB,sBAAsB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED,wBAAsB,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAQ7F"}
+{"version":3,"file":"last-error-record.d.ts","sourceRoot":"","sources":["../src/last-error-record.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,aAAa,EAAE,OAAO,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAC1C,eAAO,MAAM,mBAAmB,oBAAoB,CAAA;AACpD,eAAO,MAAM,4BAA4B,WAAa,CAAA;AACtD,eAAO,MAAM,4BAA4B,gBAAgB,CAAA;AAezD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,GAAG,CAAC,EAAE,IAAI,CAAA;CACX;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AA6HD;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAI7C;AAsBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAKlE;AAUD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,EACd,iBAAiB,EAAE,MAAM,EACzB,YAAY,EAAE,OAAO,GACpB,KAAK,IAAI,MAAM,CAMjB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIpF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,eAAe,CA0DjF;AAED,wBAAgB,sBAAsB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED,wBAAsB,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAQ7F"}

package/dist/last-error-record.js

@@ -116,6 +116,19 @@ function serializeRecord(record) {
 function isSerializedRecordTooLarge(record) {
     return Buffer.byteLength(serializeRecord(record), 'utf8') > LAST_ERROR_FILE_MAX_BYTES;
 }
+/** Shorter values are left alone: replacing them would garble ordinary text. */
+const MIN_ERROR_OUTPUT_SECRET_LENGTH = 8;
+/**
+ * The values no error output may show: this process's remembered secrets, the
+ * current bearer and runner-forwarded keys. last-error.json and the terminal's
+ * error line both use this list. Longest first, so a secret inside another
+ * can't leave part of the longer one behind.
+ */
+export function errorOutputSecrets() {
+    return [...new Set([...resolveActiveProcessSecrets(), ...runnerForwardedSecretValues()])]
+        .filter(secret => typeof secret === 'string' && secret.length >= MIN_ERROR_OUTPUT_SECRET_LENGTH)
+        .sort((left, right) => right.length - left.length);
+}
 function resolveActiveProcessSecrets() {
     const rememberedSecrets = getSecretsSeenThisProcess();
     try {
@@ -230,8 +243,7 @@ export async function writeLastErrorRecord(input, options = {}) {
             ...input,
             homeDir: input.homeDir === undefined ? resolveHomeDir() : input.homeDir,
             secrets: [
-                ...resolveActiveProcessSecrets(),
-                ...runnerForwardedSecretValues(),
+                ...errorOutputSecrets(),
                 ...(input.secrets ?? []),
             ],
         });

package/dist/login-flow.d.ts

@@ -0,0 +1,37 @@
+export interface LoginFlowDependencies {
+    parseJsonResponse: <T>(response: Response, context: string) => Promise<T>;
+    printProgress: (message: string) => void;
+    sanitizeTerminalText: (text: string) => string;
+    validateBrowserUrl: (url: string, expectedOrigin?: string) => URL;
+    sleep?: (milliseconds: number) => Promise<void>;
+}
+export interface CompletedLogin {
+    apiKey: string;
+    user: {
+        id: string;
+        email: string | null;
+    };
+}
+export declare function shouldUseHeadlessLogin({ isForced, platform, environment, }: {
+    isForced: boolean;
+    platform?: NodeJS.Platform;
+    environment?: Record<string, string | undefined>;
+}): boolean;
+export declare const POLL_INTERVAL_MS = 2000;
+/** For tests: the headless wait alone, returning the authorization code. */
+export declare function waitForHeadlessAuthorization(input: {
+    baseUrl: string;
+    codeChallenge: string;
+}, dependencies: LoginFlowDependencies, signal?: AbortSignal): Promise<string>;
+/**
+ * Waits for the person to approve the login (in the browser, or by polling
+ * when headless), then exchanges the code. `callbackPort` undefined means
+ * headless. `signal` stops it, closing the loopback server.
+ */
+export declare function completeLogin(input: {
+    baseUrl: string;
+    codeVerifier: string;
+    codeChallenge: string;
+    callbackPort?: number;
+}, dependencies: LoginFlowDependencies, signal?: AbortSignal): Promise<CompletedLogin>;
+//# sourceMappingURL=login-flow.d.ts.map

package/dist/login-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-flow.d.ts","sourceRoot":"","sources":["../src/login-flow.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;IACzE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IACxC,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9C,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,KAAK,GAAG,CAAA;IACjE,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAChD;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CAC3C;AAED,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,EACR,QAA2B,EAC3B,WAAyB,GAC1B,EAAE;IACD,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CACjD,GAAG,OAAO,CAMV;AA2ID,eAAO,MAAM,gBAAgB,OAAQ,CAAA;AA2JrC,4EAA4E;AAC5E,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,EACjD,YAAY,EAAE,qBAAqB,EACnC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EAC9F,YAAY,EAAE,qBAAqB,EACnC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,cAAc,CAAC,CAOzB"}