Stream stderr live for long-running commands instead of buffer-and-replay

[devantler]

🤖 Generated by the Daily AI Engineer

Evidence & problem

errorhandler.Executor.Execute captures the whole run’s stderr into an in-memory buffer so a failing command’s stderr can be normalized into one clean CommandError. As of #6216 that buffer is flushed to the real stderr for non-failing runs — but only after cmd.Execute() returns.

For long-running commands this means live notices appear too late to be useful:

• workload intercept writes intercepting inbound traffic … press Ctrl-C to stop (pkg/.../workload/intercept.go) then blocks — the instruction only replays after interception has already ended.
• open web replays its browser-launch fallback only after the web server stops.

(Flagged by a Codex P2 review on #6216. This is pre-existing behaviour — before #6216 these notices were captured and discarded, so #6216 is strictly an improvement; the ideal is live streaming.)

Why it is not a one-line change

Naively teeing stderr live and into the capture buffer would double-print on failures (the raw stderr live plus the normalized CommandError main.go prints) — which defeats the capture’s whole purpose (turn a failing command’s messy stderr into one clean message). A correct fix needs a way to distinguish warnings/notices (stream live) from error output (capture + normalize), which stderr does not carry today.

Candidate directions (to evaluate)

• A tee writer that streams live, with the failure path reconstructing the normalized message without re-printing already-streamed content.
• A dedicated warning/notice sink (e.g. a notify-level writer) that bypasses the capture entirely, leaving only genuine error output buffered for normalization.
• Opting specific long-running commands out of capture.

Acceptance criteria

• A long-running command’s startup notice reaches the real stderr while the command is still running, not after it returns.
• A failing command still prints exactly one normalized error (no double / raw + normalized output).
• Non-failing runs still surface their warnings (the fix(cli): surface stderr warnings on non-failing commands #6216 behaviour is preserved).
• Regression tests cover live-notice delivery and the no-double-print failure case.

Size: M. Impact: correct, timely UX for long-running commands (workload intercept, open web, …).

[coderabbitai]

🔗 Related PRs

#5539 - feat(workload): stream live Hubble flows with ksail workload network --follow [closed]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

🤖 Generated by the Daily AI Engineer

Concurrent-instance note (I filed #6218 for the same finding before seeing this — closing that as a duplicate of this issue).

One correction to "why it is not a one-line change": the capture can be removed entirely rather than tee'd, which sidesteps the double-print problem and the need to distinguish warnings from error output in the stream.

The executor only captures stderr to normalize Cobra's error line — but Cobra also returns that same error, and every real ksail command sets SilenceUsage, so err.Error() already carries the full message. So:

• Set cmd.SilenceErrors = true (executor owns error reporting; Cobra no longer prints its error line).
• Drop the capture; normalize(err.Error()) instead of normalize(buffer).
• Commands write warnings/notices straight to the real stderr — live, on every exit path (success, real error, custom-exit).

No tee, so no double-print on failure (Cobra's error line is never written to the stream — main.go prints the single normalized message). Verified against the real binary: ksail workload watch prints watching: … / press Ctrl+C to stop to stderr while running; the unknown-command message is unchanged for real commands (the only snapshot delta was a synthetic test whose root omitted SilenceUsage). This also happens to subsume #6216's custom-exit fix at the root.

Full reference implementation (executor.go + RED/GREEN tests + snapshot update, all green: go test ./pkg/cli/... ., golangci-lint 0) is prepared locally and can be pushed as a focused PR here once #6216 has merged (to avoid an executor.go collision on that branch).