fix(cli): make stderr redirect portable + survive log rotation

Code review feedback on the inline redirectStderr from 13967d0:

- Critical: syscall.Dup/syscall.Dup2 don't exist on linux/arm64
  (kernel only exposes dup3) and windows. Splits the redirect into
  redirect_stderr_unix.go (uses golang.org/x/sys/unix.Dup/Dup2,
  which abstracts to dup3 on linux/arm64) and redirect_stderr_other.go
  (no-op stub). Verified clean builds for darwin, linux/arm64, windows/amd64.
- Important: write captured stderr to "<cfg.LogFile>.stderr" instead
  of the rotated log itself, so lumberjack can't rename/gzip the file
  out from under our cached fd 2 mid-session.
- Minor: move redirectStderr() call before tui.NewModel so a bad log
  path fails fast before the production loader spawns goroutines.
- Minor: re-attach the orphaned docstring on handleSpinnerTickMsg
  (separated by a blank line, godoc didn't pick it up).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: jingle2008

go.mod

@@ -20,6 +20,7 @@ require (
 	go.uber.org/zap v1.28.0
 	golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90
 	golang.org/x/sync v0.20.0
+	golang.org/x/sys v0.45.0
 	golang.org/x/tools v0.45.0
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 	k8s.io/api v0.36.1
@@ -284,7 +285,6 @@ require (
 	golang.org/x/mod v0.36.0 // indirect
 	golang.org/x/net v0.55.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
 	golang.org/x/telemetry v0.0.0-20260508192327-42602be52be6 // indirect
 	golang.org/x/term v0.43.0 // indirect
 	golang.org/x/text v0.37.0 // indirect

internal/cli/redirect_stderr_other.go

@@ -0,0 +1,12 @@
+//go:build !unix
+
+package cli
+
+// redirectStderr is a no-op on non-unix platforms. The fd-level
+// redirection used on unix targets relies on dup2 syscall semantics
+// that aren't portable to windows/plan9/etc. Anyone running the TUI
+// on a non-unix host will see plugin stderr leak to their terminal —
+// acceptable tradeoff for a TUI primarily targeting unix.
+func redirectStderr(_ string) (func(), error) {
+	return func() {}, nil
+}

internal/cli/redirect_stderr_unix.go

@@ -0,0 +1,49 @@
+//go:build unix
+
+package cli
+
+import (
+	"fmt"
+	"os"
+
+	"golang.org/x/sys/unix"
+)
+
+// redirectStderr points the process's fd 2 at the given file for the
+// duration of the returned closure's lifetime. It's used only by the
+// TUI path: bubbletea's alt-screen has exclusive ownership of the
+// terminal, so any bytes written to fd 2 by client-go's exec auth
+// plugins (oci-cli prints "Abort:" on a non-tty prompt failure) or
+// runtime panic stacks would otherwise interleave with bubbletea's
+// frame writes and corrupt the rendered display.
+//
+// The fd is swapped at the kernel level via unix.Dup2 — not via
+// reassigning os.Stderr — so child processes spawned by exec.Cmd
+// inherit the redirected fd. unix.Dup3-based on linux/arm64,
+// dup2-based on darwin and the other unix targets.
+func redirectStderr(path string) (func(), error) {
+	f, err := os.OpenFile(path, os.O_APPEND|os.O_WRONLY|os.O_CREATE, 0o644)
+	if err != nil {
+		return nil, fmt.Errorf("open stderr sink %q: %w", path, err)
+	}
+	orig, err := unix.Dup(int(os.Stderr.Fd()))
+	if err != nil {
+		_ = f.Close()
+		return nil, fmt.Errorf("dup stderr: %w", err)
+	}
+	if err := unix.Dup2(int(f.Fd()), int(os.Stderr.Fd())); err != nil {
+		_ = f.Close()
+		_ = unix.Close(orig)
+		return nil, fmt.Errorf("redirect stderr: %w", err)
+	}
+	return func() {
+		// Restore so any post-exit writes (e.g., logger Sync errors,
+		// deferred cleanups) reach the user's actual terminal. Order
+		// matters: restore fd 2 before closing f so any stderr write
+		// between the dup2 and the close lands on the real terminal,
+		// not a closed fd.
+		_ = unix.Dup2(orig, int(os.Stderr.Fd()))
+		_ = unix.Close(orig)
+		_ = f.Close()
+	}, nil
+}

internal/cli/root.go

@@ -161,6 +161,18 @@ func runToolkit(ctx context.Context, logger logging.Logger, cfg config.Config, v
 		"category", category,
 	)
 
+	// Redirect process stderr to a sibling capture file for the
+	// duration of the TUI session — done before model construction so
+	// a misconfigured log-file path fails fast before the loader
+	// spawns goroutines. We use cfg.LogFile + ".stderr" rather than
+	// the rotated log itself so lumberjack can't rename/gzip the file
+	// out from under our cached fd 2 mid-session.
+	restoreStderr, err := redirectStderr(cfg.LogFile + ".stderr")
+	if err != nil {
+		return err
+	}
+	defer restoreStderr()
+
 	model, err := tui.NewModel(
 		tui.WithRepoPath(repoPath),
 		tui.WithKubeConfig(kubeConfig),
@@ -176,19 +188,6 @@ func runToolkit(ctx context.Context, logger logging.Logger, cfg config.Config, v
 		logger.Errorw("failed to create toolkit model", "error", err)
 		return fmt.Errorf("create toolkit model: %w", err)
 	}
-	// Redirect process stderr to the log file for the duration of the
-	// TUI session. The bubbletea alt-screen has exclusive ownership of
-	// the terminal; any bytes written to fd 2 by client-go's exec
-	// auth plugins (oci-cli prints "Abort:" on a non-tty prompt
-	// failure, for instance) or by runtime panic stacks would otherwise
-	// interleave with bubbletea's frame writes. Restored on exit so
-	// post-cleanup writes still reach the user's terminal.
-	restoreStderr, err := redirectStderr(cfg.LogFile)
-	if err != nil {
-		return err
-	}
-	defer restoreStderr()
-
 	p := tea.NewProgram(model, tea.WithAltScreen(), tea.WithContext(ctx))
 	_, err = p.Run()
 	if err != nil && !errors.Is(err, context.Canceled) {
@@ -198,27 +197,3 @@ func runToolkit(ctx context.Context, logger logging.Logger, cfg config.Config, v
 	return nil
 }
 
-// redirectStderr points the process's fd 2 at the given file for the
-// duration of the returned function's lifetime. The restoration
-// function dup2's the original fd back and closes both sides.
-func redirectStderr(path string) (func(), error) {
-	f, err := os.OpenFile(path, os.O_APPEND|os.O_WRONLY|os.O_CREATE, 0o644)
-	if err != nil {
-		return nil, fmt.Errorf("open stderr sink %q: %w", path, err)
-	}
-	orig, err := syscall.Dup(int(os.Stderr.Fd()))
-	if err != nil {
-		_ = f.Close()
-		return nil, fmt.Errorf("dup stderr: %w", err)
-	}
-	if err := syscall.Dup2(int(f.Fd()), int(os.Stderr.Fd())); err != nil {
-		_ = f.Close()
-		_ = syscall.Close(orig)
-		return nil, fmt.Errorf("redirect stderr: %w", err)
-	}
-	return func() {
-		_ = syscall.Dup2(orig, int(os.Stderr.Fd()))
-		_ = syscall.Close(orig)
-		_ = f.Close()
-	}, nil
-}

internal/ui/tui/update_loading.go

@@ -20,12 +20,10 @@ func (m *Model) updateLoadingView(msg tea.Msg) (tea.Model, tea.Cmd) {
 	return m, nil
 }
 
-// Spinner/stopwatch ticks are self-perpetuating: Update on a TickMsg
-// returns the next Tick cmd. We let that chain die when no load is in
-// flight so we don't burn ~10Hz of empty event-loop wakeups idle.
-// beginTask kicks off a fresh chain via tea.Sequence the next time
-// pendingTasks goes 0 → 1.
-
+// handleSpinnerTickMsg advances the spinner one frame and lets the
+// tick chain die when no load is in flight, so we don't burn empty
+// event-loop wakeups idle. beginTask kicks off a fresh chain via
+// tea.Sequence the next time pendingTasks goes 0 → 1.
 func (m *Model) handleSpinnerTickMsg(msg spinner.TickMsg) tea.Cmd {
 	loadingSpinner, cmd := m.loadingSpinner.Update(msg)
 	m.loadingSpinner = &loadingSpinner