fix(logs): address the #595 review — cancel the body, surface auth errors, poll for --since

[davidsu]

Follows up #595, which merged with an unactioned review. Three findings from @guyofeck plus @netanelgilad's one-liner. Nothing here overlaps #611 in intent, but both touch logs.ts — whichever lands second will need a trivial rebase.

1. The response body was never cancelled

readLines' finally called releaseLock() and nothing else, so exiting the generator on a typed end frame left the body unconsumed. An unconsumed body keeps its socket alive in the fetch pool, so a long-lived tail's reconnects pile up connections. The finally now cancels; the silence path's own cancel() became redundant and just returns.

Scope check, because the first version of this PR body overstated it: this is client-side hygiene, not a server-side subscriber leak. apper's sse_log_stream returns right after it yields the end frame, and its own finally fires detach() and close_stream() — so on the ordinary 5-minute rollover the server has already let go before the CLI reconnects. The narrow case where an abandoned socket could hold a server-side subscriber is a consumer that walks away from a still-live stream, and the silence path already cancelled explicitly for that. The apper side assessed it independently: bounded to ≤300s by the generator's own lifetime cap, whose finally detaches.

2. Auth failures were classified as transient

buildStreamUrl() and buildStreamAuthHeaders() were evaluated inside the fetch() arguments, i.e. inside the try. A logged-out user's readAuth() throw was therefore caught as {kind: "transient"} and laddered 1+2+4+8s before the real error surfaced through the poll path. Both are now built before the try, so a missing or unrefreshable token propagates immediately.

Repro on main: base44 logs -f --function foo while logged out — a 15s pause before the login error.

3. --since + --follow polls instead of erroring

Before #595 this worked: the first poll passed since through, giving backfill-then-tail. #595 turned it into a hard error, and that shipped in v0.1.13.

This restores the old behaviour as a deliberate compatibility concession, not as a feature. Anyone whose scripts already pair the two flags keeps working. The design intent is unchanged and stream-only: a live tail carries what happens next, --since is not part of the streaming story, and the polling path it falls back to is transitional — it goes away once realtime covers every app. So the combination is accepted with the simplest semantics available and nothing more: a run that asks for the past never attempts the stream. No capability check, no backfill-then-stream handover, no silent gap between the two.

Warning: --since reads the past, so this run polls instead of streaming (lines may lag ~20-30s).

--until and --order stay rejected with --follow.

Docs note: base44-troubleshooter in the skills repo says --since cannot be combined with --follow. That is the right thing for the design and for where this is heading, so it is deliberately not being rewritten to advertise the pairing; at most it earns a one-line "accepted today, polls" aside. The dependency is recorded on the apper side's rollout file with the exact locations, so a future owner can decide.

4. delay is now native

setTimeout from node:timers/promises, replacing the hand-rolled promise wrapper.

Tests

The old spec asserted the rejection. It is replaced with a live-process spec that runs --follow --since, waits for the warning on stderr, and asserts the message is the --since one — the two stream-failure warnings say "not available for this app" or "Could not reach" instead, so that line is proof the stream was skipped rather than attempted and refused.

Full suite 736 passed / 17 skipped; typecheck and lint clean.

🤖 Generated with Claude Code

[github-actions]

🚀 Package Preview Available!

---

Install this PR's preview build with npm:

npm i @base44-preview/cli@0.1.13-pr.612.385bd7a

Prefer not to change any import paths? Install using npm alias so your code still imports base44:

npm i "base44@npm:@base44-preview/cli@0.1.13-pr.612.385bd7a"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "base44": "npm:@base44-preview/cli@0.1.13-pr.612.385bd7a"
  }
}

• 📦 Preview Package: @base44-preview/cli@0.1.13-pr.612.385bd7a
• 🔗 View this commit on GitHub

---

_{Preview published to npm registry — try new features instantly!}