diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 07530d69..b0d27fad 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,6 +36,7 @@ jobs:
       - name: Install sysroot
         if: runner.os == 'Linux'
         run: |
+          set -eo pipefail
           sudo apt-get update -qq
           if [ "${{ steps.arch.outputs.arch }}" = "arm64" ]; then
             sudo apt-get install -y gcc-10-aarch64-linux-gnu g++-10-aarch64-linux-gnu
@@ -49,6 +50,9 @@ jobs:
           SYSROOT_PATH=$(node scripts/linux/install-sysroot.js ${{ steps.arch.outputs.arch }} | grep "SYSROOT_PATH=" | cut -d= -f2)
           echo "SYSROOT_PATH=$SYSROOT_PATH" >> $GITHUB_ENV
           echo "Sysroot path set to: $SYSROOT_PATH"
+        env:
+          # Set github token for authenticated sysroot download
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install dependencies and build
         run: npm ci
diff --git a/publish.yml b/publish.yml
index 12af8b65..19770cab 100644
--- a/publish.yml
+++ b/publish.yml
@@ -52,6 +52,8 @@ extends:
           - pwsh: |
               Get-ChildItem -Path . -Recurse -Directory -Name "_manifest" | Remove-Item -Recurse -Force
             displayName: 'Delete _manifest folders'
+          - bash: chmod +x prebuilds/darwin-*/spawn-helper
+            displayName: 'Ensure spawn-helper is executable'
           - script: npm ci
             displayName: 'Install dependencies and build'
           # The following script leaves the version unchanged for
@@ -70,6 +72,8 @@ extends:
               branchName: 'refs/heads/main'
               artifactName: 'prebuilds'
               targetPath: 'prebuilds'
+          - bash: chmod +x prebuilds/darwin-*/spawn-helper
+            displayName: 'Ensure spawn-helper is executable'
           - script: npm ci
             displayName: 'Install dependencies and build'
           - script: npm test
diff --git a/scripts/linux/install-sysroot.js b/scripts/linux/install-sysroot.js
index 4b68f2a5..97ac3022 100755
--- a/scripts/linux/install-sysroot.js
+++ b/scripts/linux/install-sysroot.js
@@ -18,6 +18,7 @@ const ghApiHeaders = {
 
 if (process.env.GITHUB_TOKEN) {
   ghApiHeaders.Authorization = 'Basic ' + Buffer.from(process.env.GITHUB_TOKEN).toString('base64');
+  console.error('Using GITHUB_TOKEN for authenticated requests to GitHub API.');
 }
 
 const ghDownloadHeaders = {
@@ -48,29 +49,29 @@ async function fetchUrl(options, retries = 10, retryDelay = 1000) {
         signal: controller.signal
       });
       if (response.ok && (response.status >= 200 && response.status < 300)) {
-        console.log(`Fetch completed: Status ${response.status}.`);
+        console.error(`Fetch completed: Status ${response.status}.`);
         const contents = Buffer.from(await response.arrayBuffer());
         const asset = JSON.parse(contents.toString()).assets.find((a) => a.name === options.assetName);
         if (!asset) {
           throw new Error(`Could not find asset in release of Microsoft/vscode-linux-build-agent @ ${version}`);
         }
-        console.log(`Found asset ${options.assetName} @ ${asset.url}.`);
+        console.error(`Found asset ${options.assetName} @ ${asset.url}.`);
         const assetResponse = await fetch(asset.url, {
           headers: ghDownloadHeaders
         });
         if (assetResponse.ok && (assetResponse.status >= 200 && assetResponse.status < 300)) {
           const assetContents = Buffer.from(await assetResponse.arrayBuffer());
-          console.log(`Fetched response body buffer: ${assetContents.byteLength} bytes`);
+          console.error(`Fetched response body buffer: ${assetContents.byteLength} bytes`);
           if (options.checksumSha256) {
             const actualSHA256Checksum = createHash('sha256').update(assetContents).digest('hex');
             if (actualSHA256Checksum !== options.checksumSha256) {
               throw new Error(`Checksum mismatch for ${asset.url} (expected ${options.checksumSha256}, actual ${actualSHA256Checksum})`);
             }
           }
-          console.log(`Verified SHA256 checksums match for ${asset.url}`);
+          console.error(`Verified SHA256 checksums match for ${asset.url}`);
 					const tarCommand = `tar -xz -C ${options.dest}`;
 					execSync(tarCommand, { input: assetContents });
-					console.log(`Fetch complete!`);
+					console.error(`Fetch complete!`);
 					return;
         }
         throw new Error(`Request ${asset.url} failed with status code: ${assetResponse.status}`);
@@ -81,7 +82,7 @@ async function fetchUrl(options, retries = 10, retryDelay = 1000) {
     }
   } catch (e) {
     if (retries > 0) {
-      console.log(`Fetching failed: ${e}`);
+      console.error(`Fetching failed: ${e}`);
       await new Promise(resolve => setTimeout(resolve, retryDelay));
       return fetchUrl(options, retries - 1, retryDelay);
     }
@@ -122,7 +123,7 @@ async function getSysroot(arch) {
     return result;
   }
 
-  console.log(`Installing ${arch} root image: ${sysroot}`);
+  console.error(`Installing ${arch} root image: ${sysroot}`);
   fs.rmSync(sysroot, { recursive: true, force: true });
   fs.mkdirSync(sysroot, { recursive: true });
 
@@ -139,7 +140,7 @@ async function getSysroot(arch) {
 
 async function main() {
   const arch = process.argv[2] || process.env.ARCH || 'x64';
-  console.log(`Installing sysroot for architecture: ${arch}`);
+  console.error(`Installing sysroot for architecture: ${arch}`);
 
   try {
     const sysrootPath = await getSysroot(arch);
diff --git a/scripts/prebuild.js b/scripts/prebuild.js
index 5460c865..17f1d980 100644
--- a/scripts/prebuild.js
+++ b/scripts/prebuild.js
@@ -31,12 +31,4 @@ if (!fs.existsSync(PREBUILD_DIR)) {
   process.exit(1);
 }
 
-// Ensure spawn-helper has execute permission (may be stripped by npm pack)
-if (process.platform === 'darwin') {
-  const spawnHelper = path.join(PREBUILD_DIR, 'spawn-helper');
-  if (fs.existsSync(spawnHelper)) {
-    fs.chmodSync(spawnHelper, 0o755);
-  }
-}
-
 process.exit(0);
diff --git a/src/unixTerminal.test.ts b/src/unixTerminal.test.ts
index 69647468..c8145700 100644
--- a/src/unixTerminal.test.ts
+++ b/src/unixTerminal.test.ts
@@ -280,12 +280,15 @@ if (process.platform !== 'win32') {
           let sub = '';
           let pid = '';
           p.stdout.on('data', (data) => {
-            if (!data.toString().indexOf('title')) {
-              sub = data.toString().split(' ')[1].slice(0, -1);
-            } else if (!data.toString().indexOf('ready')) {
-              pid = data.toString().split(' ')[1].slice(0, -1);
-              process.kill(parseInt(pid), 'SIGINT');
-              p.kill('SIGINT');
+            const lines = data.toString().split('\n');
+            for (const line of lines) {
+              if (line.startsWith('title ')) {
+                sub = line.split(' ')[1];
+              } else if (line.startsWith('ready ')) {
+                pid = line.split(' ')[1];
+                process.kill(parseInt(pid), 'SIGINT');
+                p.kill('SIGINT');
+              }
             }
           });
           p.on('exit', () => {