[cppla]

Summary

• Return an error (exit code 1) if autocar token cannot write its complete credential to stdout.
• Use a fixed diagnostic rather than propagating a writer error that might contain the generated token. Do not retry partial output.
• Preserve URL-safe base64/newline output and --bytes; --out permissions, no-overwrite behavior, and silent file mode are unchanged.
• Introduce an internal writer-injected helper to test the output path without mutating process-global stdout.

Evidence and validation

• Before the fix, a real closed stdout file reproduced runToken(nil) == nil despite failure to deliver the token.
• Regressions cover a closed file, an error that embeds the token, a short write without an error, successful 16/32/128-byte encodings, and file output never touching stdout. Error cases verify command exit code 1 and a fixed secret-free diagnostic.
• Go 1.26.8: targeted regressions and all cmd/autocar tests passed with -race; go vet ./cmd/autocar and git diff --check passed.
• Independent review found no blocking issues. Full GitHub checks must pass before merge.

No transport, protocol, configuration, dependency, Docker deployment, release publication, or comparative experiment changes.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.