A failed write to stdout is now reported as what it is: the command finished but its output could not be written, exit 1, with no public bug-report request. The --json path emits the ordinary error object, and jsonout's own writes carry the same message. A missing git is likewise named as missing rather than mistaken for a missing checkout, with exit 2, and the checkout probes propagate a spawn failure instead of turning it into false.
Every HTTP client atgc hands to jacquard — handle resolution, the OAuth client, and the DPoP path — now enforces the same response-size limit and an overall deadline as the rest of clients::http. jacquard's own reqwest transport buffers whole bodies, so a hostile handle domain could grow RSS without bound; the bound refuses both an endless body and a trickled one with exit 6 and a message naming the host.
The remaining items keep exit codes and terminal output honest: report classifies its write failure rather than matching prose, a refused knot versions read maps by error name and status, tag cursors that are not numbers are errors, push output is cleaned before reaching the terminal, ls-remote matches the exact branch ref, and building the shared clients returns an error instead of a fallback that panicked or dropped the redirect policy.
🤖 Generated with Claude Code