2 files changed, 27 insertions, 9 deletions
diff --git a/cmd/hakurei/command.go b/cmd/hakurei/command.go
index 0ce3b71c..c3b9d85d 100644
--- a/cmd/hakurei/command.go
+++ b/cmd/hakurei/command.go
@@ -82,8 +82,7 @@ func buildCommand(out io.Writer) command.Command {
 				passwdFunc = func() {
 					var us string
 					if uid, err := std.Uid(aid); err != nil {
-						hlog.PrintBaseError(err, "cannot obtain uid from setuid wrapper:")
-						os.Exit(1)
+						fatal("cannot obtain uid from setuid wrapper:", err)
 					} else {
 						us = strconv.Itoa(uid)
 					}
@@ -260,11 +259,33 @@ func runApp(config *hst.Config) {
 
 	rs := new(app.RunState)
 	if sa, err := a.Seal(config); err != nil {
-		hlog.PrintBaseError(err, "cannot seal app:")
-		internal.Exit(1)
+		hlog.BeforeExit()
+		fatal("cannot seal app:", err)
 	} else {
-		internal.Exit(app.PrintRunStateErr(rs, sa.Run(rs)))
+		hlog.BeforeExit()
+		os.Exit(app.PrintRunStateErr(rs, sa.Run(rs)))
 	}
 
 	*(*int)(nil) = 0 // not reached
 }
+
+// fatal prints the error message according to [container.GetErrorMessage], or fallback
+// prepended to err if an error message is not available, followed by a call to [os.Exit](1).
+func fatal(fallback string, err error) {
+	m, ok := container.GetErrorMessage(err)
+	if !ok {
+		log.Fatal(fallback, err)
+		return
+	}
+
+	// this indicates the error message has already reached stderr, outside the current process's control;
+	// this is only reached when hsu fails for any reason, as we do not want a second error message following hsu
+	// TODO(ophestra): handle the hsu error here instead of relying on a magic string
+	if m == "\x00" {
+		hlog.Verbose("*"+fallback, err)
+		os.Exit(1)
+		return
+	}
+
+	log.Fatal(m)
+}
diff --git a/cmd/hakurei/print.go b/cmd/hakurei/print.go
index 15798a20..9e1ede90 100644
--- a/cmd/hakurei/print.go
+++ b/cmd/hakurei/print.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"io"
 	"log"
-	"os"
 	"slices"
 	"strconv"
 	"strings"
@@ -14,7 +13,6 @@ import (
 
 	"hakurei.app/hst"
 	"hakurei.app/internal/app/state"
-	"hakurei.app/internal/hlog"
 	"hakurei.app/system/dbus"
 )
 
@@ -26,8 +24,7 @@ func printShowSystem(output io.Writer, short, flagJSON bool) {
 
 	// get hid by querying uid of identity 0
 	if uid, err := std.Uid(0); err != nil {
-		hlog.PrintBaseError(err, "cannot obtain uid from setuid wrapper:")
-		os.Exit(1)
+		fatal("cannot obtain uid from setuid wrapper:", err)
 	} else {
 		info.User = (uid / 10000) - 100
 	}