feat: release 2.7.0-rc3

command/init.ts

@@ -8,11 +8,11 @@ import { createCompose, projectName } from "../lib/scaffold";
 import {
   appArgs,
   appInputFromArgs,
-  resolveAppInput,
   terminalPrompt,
   type AppInput,
   type ScaffoldPrompt,
 } from "./add";
+import { resolveScaffoldInput } from "../lib/scaffold-prompts";
 import { resolveComposeFile } from "../lib/yaml";
 import { basename } from "node:path";
 import { join } from "node:path";
@@ -62,13 +62,13 @@ export async function initializeProject(
   const defaultProject = projectName(
     config.projectConfigured ? config.project : basename(root),
   );
-  const project = projectName(
-    input.project ??
-      (input.nonInteractive
-        ? defaultProject
-        : await prompt("Project name", defaultProject)),
-  );
-  const app = await resolveAppInput(root, input, prompt);
+  const resolved = await resolveScaffoldInput(root, input, prompt, {
+    defaultProject,
+    project:
+      input.project ?? (config.projectConfigured ? config.project : undefined),
+  });
+  const project = resolved.project!;
+  const app = resolved.app;
   const login = dependencies.login ?? interactiveLogin;
   let session = await (dependencies.session ?? readSession)();
   if (!session) session = await login();
@@ -90,11 +90,45 @@ export async function initializeProject(
         );
         // The server grant is idempotent. A GET cannot establish ownership of it:
         // another client may grant the same fingerprint before our POST.
-        if (!alreadyTrusted)
-          await request(trustPath, {
-            method: "POST",
-            json: { fingerprint: identity.fingerprint },
-          });
+        if (!alreadyTrusted) {
+          try {
+            await request(trustPath, {
+              method: "POST",
+              json: { fingerprint: identity.fingerprint },
+            });
+          } catch (error) {
+            // A 401 is an explicit authentication denial; let the normal login
+            // retry run without probing using the rejected session.
+            if (error instanceof KuberApiError && error.status === 401)
+              throw error;
+
+            // Client errors (other than auth denial) are definite rejection.
+            const definitelyRejected =
+              error instanceof KuberApiError &&
+              error.status >= 400 &&
+              error.status < 500;
+            if (definitelyRejected) throw error;
+
+            let registration: boolean | undefined;
+            try {
+              const current = await request<WorkspaceTrustResponse>(trustPath);
+              if (Array.isArray(current?.fingerprints))
+                registration = current.fingerprints.includes(
+                  identity.fingerprint,
+                );
+            } catch {
+              // The POST may have committed despite its failed response.
+            }
+
+            if (registration !== false) {
+              remoteRegistered = true;
+              throw new Error(
+                "Could not confirm whether server registration succeeded. Generated project files were kept; check kuber trust status and run kuber trust to repair local trust if needed.",
+              );
+            }
+            throw error;
+          }
+        }
         remoteRegistered = true;
         try {
           await (dependencies.persistTrust ?? updateTrust)((records) => [