packages/stack-cli/src/lib/emulator-paths.ts (1)

79-91: ⚡ Quick win

Replace Date.now() with performance.now() for elapsed-time measurement.

Date.now() is used here to compute a deadline and measure remaining time — exactly the use-case for performance.now().

As per coding guidelines: "Use performance.now() instead of Date.now() for measuring elapsed real time."

performance is a global in Node.js 16+; if the project must support earlier Node, import it from perf_hooks.

♻️ Proposed fix

 export async function pollInternalPck(timeoutMs: number): Promise<string | null> {
   const pckPath = internalPckPath();
-  const deadline = Date.now() + timeoutMs;
+  const deadline = performance.now() + timeoutMs;
   let delay = 50;
   while (true) {
     try {
       const contents = readFileSync(pckPath, "utf-8").trim();
       if (contents) return contents;
     } catch (e) {
       if ((e as NodeJS.ErrnoException).code !== "ENOENT") throw e;
     }
-    if (Date.now() >= deadline) return null;
-    const remaining = deadline - Date.now();
+    if (performance.now() >= deadline) return null;
+    const remaining = deadline - performance.now();
     await new Promise((r) => setTimeout(r, Math.min(delay, remaining)));
     delay = Math.min(delay * 2, 2000);
   }
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/stack-cli/src/lib/emulator-paths.ts` around lines 79 - 91, Replace
the uses of Date.now() used for elapsed-time/deadline calculation in the polling
loop inside emulator-paths.ts (the code that sets deadline = Date.now() +
timeoutMs and checks Date.now() >= deadline and computes remaining) with
performance.now() to measure elapsed time; ensure you either use the global
performance (Node 16+) or import { performance } from "perf_hooks" at the top if
globals are not available, and update all references (deadline, remaining
calculation, and delay scheduling) so they consistently use performance.now()
while leaving readFileSync(pckPath, "utf-8") and the retry/backoff logic
unchanged.

packages/stack-cli/src/commands/init.ts (1)

274-287: 💤 Low value

Drop the unused _flags parameter from these handlers.

_flags is no longer threaded into auth resolution, and both call sites in runInit already pass flags only because the signature still demands it. Removing the parameter (and the corresponding flags argument at the call sites) makes the obsolete data flow disappear instead of relying on the underscore convention.

♻️ Proposed fix

-async function handleCreateCloud(_flags: Record<string, unknown>, opts: InitOptions, outputDir: string): Promise<{ configPath?: string }> {
+async function handleCreateCloud(opts: InitOptions, outputDir: string): Promise<{ configPath?: string }> {
   const sessionAuth = await ensureLoggedInSession();
   ...
 }

-async function handleLinkFromCloud(_flags: Record<string, unknown>, opts: InitOptions, outputDir: string): Promise<{ configPath?: string }> {
+async function handleLinkFromCloud(opts: InitOptions, outputDir: string): Promise<{ configPath?: string }> {
   const sessionAuth = await ensureLoggedInSession();
   ...
 }

And update the call sites in runInit (lines 130/140) to drop flags. If flags is otherwise unused in runInit, you can also drop the const flags = program.opts(); line.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/stack-cli/src/commands/init.ts` around lines 274 - 287, Remove the
unused _flags parameter from both handler signatures (handleCreateCloud and
handleLinkFromCloud) and update their call sites in runInit to stop passing
flags; specifically, delete the first parameter in each function definition and
remove the corresponding argument where they are invoked (and if runInit no
longer uses flags at all, also remove the const flags = program.opts()
declaration). Ensure only these two function names are changed so auth
resolution no longer receives obsolete flag data.

packages/stack-cli/src/lib/auth.ts (1)

217-220: 💤 Low value

Avoid silent catch-all on res.text().

.catch(() => "") swallows any failure (transport error mid-stream, abort, etc.) without observability. Since you're already inside an error-reporting branch, prefer explicit handling that surfaces the read failure in the resulting message instead of pretending the body was empty.

♻️ Proposed fix

   if (!res.ok) {
-    const body = await res.text().catch(() => "");
-    throw new AuthError(`Local emulator sign-in failed (${res.status} ${res.statusText})${body ? `: ${body}` : ""}. Make sure the emulator is running with NEXT_PUBLIC_STACK_IS_LOCAL_EMULATOR=true.`);
+    let body = "";
+    let bodyReadError: unknown = null;
+    try {
+      body = await res.text();
+    } catch (err) {
+      bodyReadError = err;
+    }
+    const detail = body
+      ? `: ${body}`
+      : bodyReadError
+        ? ` (failed to read response body: ${bodyReadError instanceof Error ? bodyReadError.message : String(bodyReadError)})`
+        : "";
+    throw new AuthError(`Local emulator sign-in failed (${res.status} ${res.statusText})${detail}. Make sure the emulator is running with NEXT_PUBLIC_STACK_IS_LOCAL_EMULATOR=true.`);
   }

As per coding guidelines, "NEVER try-catch-all, NEVER void a promise, and NEVER use .catch(console.error)." and "errors are never silently swallowed".

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/stack-cli/src/lib/auth.ts` around lines 217 - 220, The current
catch-all on res.text() silences read failures; change the logic around the
failed response branch so you attempt to read the body but surface any body-read
error in the thrown AuthError instead of returning an empty string. Concretely,
wrap the await res.text() call in a try/catch that captures the thrown error
(e.g., bodyReadError) and include either the body or the
bodyReadError.message/stack in the new AuthError message (reference res,
res.text(), and AuthError) so transport/stream errors are visible in logs rather
than being silently swallowed.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes