Summary
The interactive prompts in prompt.ts (the API-key prompt in setup/auth configure, the target prompt in agent install) write the question and masking characters to stdout, and the Configuring profile … prelude in auth.ts defaults to stdout as well.
On any interactive path this mixes UI text into stdout. Under --output json it breaks the contract that stdout is a single JSON document — a machine consumer doing JSON.parse(stdout) fails on the prompt text. The repo already enforces "stdout is a pure result stream" (the stdoutPurity helper, §8.1), but the interactive prompt path was missed.
Suggested fix
Default prompts and the informational prelude to stderr — they're interactive UI, not result data. stderr is still the user's TTY, so prompts stay visible; stdout carries only the result. Callers that inject explicit streams are unaffected.
I have a PR ready for this.
Summary
The interactive prompts in
prompt.ts(the API-key prompt insetup/auth configure, the target prompt inagent install) write the question and masking characters to stdout, and theConfiguring profile …prelude inauth.tsdefaults to stdout as well.On any interactive path this mixes UI text into stdout. Under
--output jsonit breaks the contract that stdout is a single JSON document — a machine consumer doingJSON.parse(stdout)fails on the prompt text. The repo already enforces "stdout is a pure result stream" (thestdoutPurityhelper, §8.1), but the interactive prompt path was missed.Suggested fix
Default prompts and the informational prelude to stderr — they're interactive UI, not result data. stderr is still the user's TTY, so prompts stay visible; stdout carries only the result. Callers that inject explicit streams are unaffected.
I have a PR ready for this.