@cspeach/cli 0.6.0

package/dist/commands/config-set.js

@@ -0,0 +1,245 @@
+import chalk from 'chalk';
+import { loadConfig, saveConfig, isValidWriteMode } from '../config/loader.js';
+/**
+ * Mutable keys exposed via `cspeach config set`.
+ * Any key not in this set is rejected with an error listing valid keys.
+ */
+const MUTABLE_KEYS = new Set([
+    'proxy_url',
+    'default_model',
+    'effort',
+    'telemetry',
+    'classifier.safe_mode',
+    'write_mode',
+    'llm.mode',
+    'llm.ai_hub_base_url',
+    'llm.ai_hub_model_alias',
+    'llm.local_base_url',
+    'llm.local_model',
+    // Virtual keys that route to keychain (not saved to config.toml):
+    'llm.byok_key',
+    'llm.ai_hub_token',
+]);
+// SAP-scoped key pattern: sap.<alias>.auto_approve
+const SAP_AUTO_APPROVE_RE = /^sap\.([A-Z0-9_-]{2,32})\.auto_approve$/;
+const EFFORT_VALUES = ['low', 'medium', 'high', 'xhigh', 'max'];
+const TELEMETRY_VALUES = ['minimal', 'full'];
+const AUTO_APPROVE_VALUES = ['never', 'low', 'medium'];
+const LLM_MODE_VALUES = ['managed', 'byok', 'ai-hub', 'local'];
+/**
+ * Thrown on validation failure. The outer CLI dispatcher converts to
+ * `console.error` + `process.exit(exitCode)`. Throwing instead of calling
+ * `process.exit` directly means tests can assert behaviour WITHOUT mocking
+ * `process.exit` (which, when mocked to return `undefined`, causes the
+ * `never`-typed function to fall through and hit the switch with an
+ * undefined `key`). See §3 `runConfigSet` wiring in Task 13 for the wrap.
+ */
+export class ConfigSetError extends Error {
+    exitCode = 1;
+    constructor(msg) {
+        super(msg);
+        this.name = 'ConfigSetError';
+    }
+}
+function err(msg) {
+    throw new ConfigSetError(`[config set] ${msg}`);
+}
+/**
+ * Executes `cspeach config set <key> <value>`.
+ * Exits process with code 1 on validation error.
+ */
+export async function runConfigSet(args) {
+    if (args.length < 2) {
+        err('Usage: cspeach config set <key> <value>\n  Valid keys: ' + [...MUTABLE_KEYS].join(', ') + ', sap.<alias>.auto_approve');
+    }
+    const [key, ...rest] = args;
+    const value = rest.join(' ').trim();
+    if (!key || !value) {
+        err('Both key and value are required.');
+    }
+    // SAP-scoped key: sap.<alias>.auto_approve
+    const sapMatch = SAP_AUTO_APPROVE_RE.exec(key);
+    if (sapMatch) {
+        const alias = sapMatch[1];
+        if (!AUTO_APPROVE_VALUES.includes(value)) {
+            err(`Invalid value for ${key}. Allowed: ${AUTO_APPROVE_VALUES.join(', ')}`);
+        }
+        const cfg = await loadConfig();
+        if (!cfg.sap[alias]) {
+            err(`SAP system "${alias}" not found in config. Add it first with: cspeach config add-sap`);
+        }
+        cfg.sap[alias].auto_approve = value;
+        await saveConfig(cfg);
+        console.log(chalk.green(`Set ${key} = ${value}`));
+        return;
+    }
+    // Virtual keys that store secrets in the OS keychain instead of config.toml.
+    if (key === 'llm.byok_key' || key === 'llm.ai_hub_token') {
+        // Support stdin piping for secrets: `echo "key" | cspeach config set llm.byok_key -`
+        let secret = value;
+        if (secret === '-') {
+            if (process.stdin.isTTY) {
+                const { password } = await import('@inquirer/prompts');
+                secret = await password({ message: `${key} (input masked):`, mask: '*' });
+            }
+            else {
+                const chunks = [];
+                for await (const c of process.stdin)
+                    chunks.push(c);
+                secret = Buffer.concat(chunks).toString('utf8').trim();
+            }
+        }
+        else {
+            console.log(chalk.yellow(`WARN: secret passed as shell argument — will land in shell history. Prefer: cat key.txt | cspeach config set ${key} -`));
+        }
+        const { default: keytar } = await import('keytar');
+        if (key === 'llm.byok_key') {
+            await keytar.setPassword('cspeach.anthropic', 'api-key', secret);
+        }
+        else {
+            await keytar.setPassword('cspeach.ai-hub', 'token', secret);
+        }
+        console.log(chalk.green(`✓ Secret stored in OS keychain (service: ${key === 'llm.byok_key' ? 'cspeach.anthropic' : 'cspeach.ai-hub'})`));
+        return;
+    }
+    // Top-level mutable keys
+    if (!MUTABLE_KEYS.has(key)) {
+        err(`Unknown key "${key}". Valid keys: ${[...MUTABLE_KEYS].join(', ')}, sap.<alias>.auto_approve`);
+    }
+    const cfg = await loadConfig();
+    switch (key) {
+        case 'proxy_url':
+            // Basic URL validation
+            try {
+                new URL(value);
+            }
+            catch {
+                err(`"${value}" is not a valid URL.`);
+            }
+            cfg.proxy_url = value;
+            break;
+        case 'default_model':
+            if (!value.startsWith('claude-')) {
+                err(`model must start with "claude-", got "${value}".`);
+            }
+            cfg.default_model = value;
+            break;
+        case 'effort':
+            if (!EFFORT_VALUES.includes(value)) {
+                err(`Invalid effort value "${value}". Allowed: ${EFFORT_VALUES.join(', ')}`);
+            }
+            cfg.effort = value;
+            break;
+        case 'telemetry':
+            if (!TELEMETRY_VALUES.includes(value)) {
+                err(`Invalid telemetry value "${value}". Allowed: ${TELEMETRY_VALUES.join(', ')}`);
+            }
+            cfg.telemetry = value;
+            break;
+        case 'classifier.safe_mode':
+            if (value !== 'true' && value !== 'false') {
+                err(`classifier.safe_mode must be "true" or "false".`);
+            }
+            cfg.classifier.safe_mode = value === 'true';
+            break;
+        case 'write_mode':
+            if (!isValidWriteMode(value)) {
+                err(`Invalid value for write_mode. Must be one of: auto, approval-gated, advisory-only`);
+            }
+            cfg.write_mode = value;
+            break;
+        case 'llm.mode':
+            if (!LLM_MODE_VALUES.includes(value)) {
+                err(`Invalid llm.mode "${value}". Allowed: ${LLM_MODE_VALUES.join(', ')}`);
+            }
+            cfg.llm.mode = value;
+            break;
+        case 'llm.ai_hub_base_url':
+            try {
+                new URL(value);
+            }
+            catch {
+                err(`"${value}" is not a valid URL.`);
+            }
+            cfg.llm.ai_hub_base_url = value;
+            break;
+        case 'llm.ai_hub_model_alias':
+            if (value.length === 0)
+                err('ai_hub_model_alias cannot be empty.');
+            cfg.llm.ai_hub_model_alias = value;
+            break;
+        case 'llm.local_base_url':
+            try {
+                new URL(value);
+            }
+            catch {
+                err(`"${value}" is not a valid URL.`);
+            }
+            cfg.llm.local_base_url = value;
+            break;
+        case 'llm.local_model':
+            if (value.length === 0)
+                err('local_model cannot be empty.');
+            cfg.llm.local_model = value;
+            break;
+        default:
+            err(`Unhandled key "${key}".`);
+    }
+    await saveConfig(cfg);
+    console.log(chalk.green(`Set ${key} = ${value}`));
+}
+/**
+ * Pure predicate: would `cspeach config set <key> <value>` accept this pair?
+ * Returns `true` if the value would pass validation for the given key, `false`
+ * otherwise (including for unknown keys or unsupported SAP-scoped patterns).
+ *
+ * Does not load or mutate any config — safe to call in unit tests.
+ * Keep in sync with the switch statement in `runConfigSet`.
+ */
+export function validateValue(key, value) {
+    // SAP-scoped key: sap.<alias>.auto_approve
+    if (SAP_AUTO_APPROVE_RE.test(key)) {
+        return AUTO_APPROVE_VALUES.includes(value);
+    }
+    if (!MUTABLE_KEYS.has(key))
+        return false;
+    switch (key) {
+        case 'proxy_url':
+            try {
+                new URL(value);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        case 'default_model':
+            return value.startsWith('claude-');
+        case 'effort':
+            return EFFORT_VALUES.includes(value);
+        case 'telemetry':
+            return TELEMETRY_VALUES.includes(value);
+        case 'classifier.safe_mode':
+            return value === 'true' || value === 'false';
+        case 'write_mode':
+            return isValidWriteMode(value);
+        case 'llm.mode':
+            return LLM_MODE_VALUES.includes(value);
+        case 'llm.ai_hub_base_url':
+        case 'llm.local_base_url':
+            try {
+                new URL(value);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        case 'llm.ai_hub_model_alias':
+        case 'llm.local_model':
+            return value.length > 0;
+        case 'llm.byok_key':
+        case 'llm.ai_hub_token':
+            return value.length > 0; // Secrets pass through if non-empty; no format check
+        default:
+            return false;
+    }
+}

package/dist/commands/config-show.js

@@ -0,0 +1,159 @@
+import chalk from 'chalk';
+import { loadConfig } from '../config/loader.js';
+/**
+ * Dotted paths of keys that must never appear in plaintext config output.
+ * SAP passwords live in the keychain and should never land in config.toml,
+ * but we list the LLM mode secrets here defensively so an accidental drift
+ * that writes them into the TOML file is redacted on display.
+ *
+ * Keep synchronised with the keychain services in auth/api-key.ts and
+ * sap/onboarding.ts — any secret that is keychain-only should appear here
+ * if it has a corresponding virtual config path.
+ */
+const REDACTED_KEYS = new Set([
+    'llm.byok_key', // Anthropic API key — keychain "cspeach.anthropic"
+    'llm.ai_hub_token', // SAP AI Hub bearer — keychain "cspeach.ai-hub"
+]);
+function formatTomlValue(value) {
+    if (typeof value === 'string')
+        return `"${value}"`;
+    if (typeof value === 'boolean')
+        return String(value);
+    if (typeof value === 'number')
+        return String(value);
+    return JSON.stringify(value);
+}
+/**
+ * Per-mode required keys inside `[llm]`. Listed here so config show can point
+ * out what is missing for a given mode without reading docs. Secrets live in
+ * the keychain (byok_key, ai_hub_token) and are not surfaced by this helper —
+ * doctor reports their presence separately.
+ */
+const LLM_REQUIRED_KEYS_BY_MODE = {
+    managed: [],
+    byok: [],
+    'ai-hub': ['ai_hub_base_url', 'ai_hub_model_alias'],
+    local: ['local_base_url', 'local_model'],
+};
+function printLlmMissingHints(llm) {
+    if (typeof llm !== 'object' || llm === null)
+        return;
+    const mode = llm['mode'];
+    if (typeof mode !== 'string')
+        return;
+    const required = LLM_REQUIRED_KEYS_BY_MODE[mode];
+    if (!required || required.length === 0)
+        return;
+    for (const key of required) {
+        const value = llm[key];
+        if (value === undefined || value === null || value === '') {
+            console.log(`${key} = ${chalk.red('<not set>')}`);
+        }
+    }
+}
+function printConfigAsToml(cfg, prefix = '') {
+    // Emit scalars before nested objects — otherwise a top-level scalar that
+    // follows a nested table (e.g. `write_mode` declared after `ui` in the
+    // config shape) would render underneath `[ui]` in TOML, which reparses as
+    // `ui.write_mode` instead of a top-level key.
+    const entries = Object.entries(cfg);
+    const scalars = entries.filter(([, v]) => !(typeof v === 'object' && v !== null && !Array.isArray(v)));
+    const tables = entries.filter(([, v]) => typeof v === 'object' && v !== null && !Array.isArray(v));
+    for (const [k, v] of scalars) {
+        const fullKey = prefix ? `${prefix}.${k}` : k;
+        if (REDACTED_KEYS.has(fullKey)) {
+            console.log(`${k} = [REDACTED]`);
+        }
+        else {
+            console.log(`${k} = ${formatTomlValue(v)}`);
+            // Surface an explanatory hint for advisory-only mode so users understand
+            // the implication (writes proposed, never executed) without having to
+            // read the docs.
+            if (fullKey === 'write_mode' && v === 'advisory-only') {
+                console.log(chalk.yellow('  → Advisory mode: writes will be proposed, never executed.'));
+            }
+        }
+    }
+    for (const [k, v] of tables) {
+        const fullKey = prefix ? `${prefix}.${k}` : k;
+        console.log('');
+        console.log(chalk.cyan(`[${fullKey}]`));
+        printConfigAsToml(v, fullKey);
+        // Mode-aware extras for the `[llm]` section — print required keys that
+        // are empty as `<not set>` so a user who ran `cspeach config set llm.mode
+        // ai-hub` without also setting the base URL can see what is still
+        // missing.
+        if (fullKey === 'llm') {
+            printLlmMissingHints(v);
+        }
+    }
+}
+/**
+ * Resolve a dotted key path in the config object.
+ * e.g. 'sap.S4H-DEV' → cfg.sap['S4H-DEV']
+ *      'sap.S4H-DEV.auto_approve' → cfg.sap['S4H-DEV'].auto_approve
+ */
+function resolveDottedKey(cfg, keyPath) {
+    const parts = keyPath.split('.');
+    let current = cfg;
+    for (const part of parts) {
+        if (current === null || typeof current === 'undefined')
+            return undefined;
+        if (typeof current !== 'object')
+            return undefined;
+        // Own-property only — prevents `__proto__` / `constructor` traversal
+        // from returning an inherited value (which then gets printed as if it
+        // were a user-configured key).
+        if (!Object.prototype.hasOwnProperty.call(current, part))
+            return undefined;
+        current = current[part];
+    }
+    return current;
+}
+/**
+ * Executes `cspeach config show [key]`.
+ * Without argument: prints full config as TOML (secrets redacted).
+ * With argument: prints single resolved value.
+ */
+export async function runConfigShow(args) {
+    const cfg = await loadConfig();
+    if (args.length === 0) {
+        // Full config dump
+        console.log('');
+        console.log(chalk.gray('# ~/.cspeach/config.toml'));
+        printConfigAsToml(cfg);
+        console.log('');
+        return;
+    }
+    const keyPath = args[0];
+    const resolved = resolveDottedKey(cfg, keyPath);
+    if (resolved === undefined) {
+        console.error(chalk.red(`[config show] Key "${keyPath}" not found.`));
+        process.exit(1);
+    }
+    if (REDACTED_KEYS.has(keyPath)) {
+        console.log('[REDACTED]');
+        return;
+    }
+    if (typeof resolved === 'object' && resolved !== null) {
+        // Sub-object (e.g. sap.S4H-DEV) — print as TOML section
+        console.log('');
+        console.log(chalk.cyan(`[${keyPath}]`));
+        for (const [k, v] of Object.entries(resolved)) {
+            const subKey = `${keyPath}.${k}`;
+            if (REDACTED_KEYS.has(subKey)) {
+                console.log(`${k} = [REDACTED]`);
+            }
+            else {
+                console.log(`${k} = ${formatTomlValue(v)}`);
+            }
+        }
+        console.log('');
+    }
+    else {
+        console.log(String(resolved));
+        if (keyPath === 'write_mode' && resolved === 'advisory-only') {
+            console.log(chalk.yellow('  → Advisory mode: writes will be proposed, never executed.'));
+        }
+    }
+}

package/dist/commands/help.js

@@ -0,0 +1,93 @@
+import chalk from 'chalk';
+import { SKILL_CATALOG } from '../skill-catalog.js';
+// Workflow order: plan → understand → modify → build → upgrade → ship.
+const CATEGORY_ORDER = [
+    'Pre-Coding',
+    'Read / Analyze',
+    'Modify / Fix',
+    'Create / Generate',
+    'Upgrade / Migrate',
+    'Ship / Release',
+];
+const NAME_COL_PAD = 28; // padded width of "/skill-name"
+const NAME_GUTTER = 2; // leading 2-space indent
+const DESC_GUTTER = 1; // 1 space between name col and description
+const NAME_COL_WIDTH = NAME_GUTTER + NAME_COL_PAD + DESC_GUTTER; // 31
+const MAX_DESC_LINES = 2;
+const MIN_DESC_WIDTH = 40;
+const DEFAULT_TERM_WIDTH = 100;
+/**
+ * Word-wrap a description into at most `maxLines` lines of `width` chars each.
+ * If content overflows, the last line is suffixed with `…`.
+ */
+function wrapDescription(desc, width, maxLines) {
+    const words = desc.split(/\s+/).filter((w) => w.length > 0);
+    const lines = [];
+    let current = '';
+    let i = 0;
+    while (i < words.length && lines.length < maxLines) {
+        const word = words[i];
+        if (current.length === 0) {
+            // Word longer than width — hard-truncate
+            current = word.length <= width ? word : word.slice(0, width);
+            i++;
+        }
+        else if (current.length + 1 + word.length <= width) {
+            current += ' ' + word;
+            i++;
+        }
+        else {
+            lines.push(current);
+            current = '';
+        }
+    }
+    if (current.length > 0 && lines.length < maxLines) {
+        lines.push(current);
+    }
+    // Overflow → suffix last line with " …"
+    if (i < words.length && lines.length > 0) {
+        const last = lines[lines.length - 1];
+        if (last.length + 2 <= width) {
+            lines[lines.length - 1] = last + ' …';
+        }
+        else {
+            lines[lines.length - 1] = last.slice(0, Math.max(0, width - 2)) + ' …';
+        }
+    }
+    return lines;
+}
+/**
+ * Prints the flat-list /help screen grouped by category.
+ * Cyan category headings, bold skill names, default-color descriptions.
+ * Descriptions wrap to MAX_DESC_LINES lines max, aligned to the name column.
+ */
+export function printHelp() {
+    const termWidth = process.stdout.columns ?? DEFAULT_TERM_WIDTH;
+    const descWidth = Math.max(MIN_DESC_WIDTH, termWidth - NAME_COL_WIDTH);
+    const continuationIndent = ' '.repeat(NAME_COL_WIDTH);
+    console.log('');
+    for (const category of CATEGORY_ORDER) {
+        const skills = SKILL_CATALOG.filter((s) => s.category === category);
+        if (skills.length === 0)
+            continue;
+        console.log(chalk.cyan.bold(category));
+        for (const skill of skills) {
+            const nameCol = ('/' + skill.name).padEnd(NAME_COL_PAD);
+            const descLines = wrapDescription(skill.description, descWidth, MAX_DESC_LINES);
+            const firstLine = descLines[0] ?? '';
+            console.log(`  ${chalk.bold(nameCol)} ${firstLine}`);
+            for (let j = 1; j < descLines.length; j++) {
+                console.log(`${continuationIndent}${descLines[j]}`);
+            }
+        }
+        console.log('');
+    }
+    console.log(chalk.cyan.bold('Shortcuts'));
+    console.log(`  ${chalk.bold('/help'.padEnd(NAME_COL_PAD))} This screen`);
+    console.log(`  ${chalk.bold('/skills'.padEnd(NAME_COL_PAD))} Same as /help`);
+    console.log(`  ${chalk.bold('/ui [auto|ink|classic]'.padEnd(NAME_COL_PAD))} View or change UI rendering mode`);
+    console.log(`  ${chalk.bold('/reroute <skill>'.padEnd(NAME_COL_PAD))} Re-run your last prompt with a different skill`);
+    console.log(`  ${chalk.bold('/new'.padEnd(NAME_COL_PAD))} End the current Q&A chain — next prompt is classified fresh`);
+    console.log(`  ${chalk.bold('/exit'.padEnd(NAME_COL_PAD))} Quit CSPeach`);
+    console.log('');
+}

package/dist/commands/login.js

@@ -0,0 +1,122 @@
+/**
+ * `cspeach login` — device-code flow driver.
+ *
+ * Flow:
+ *   1) POST /v1/auth/device/start → get device_code, user_code, verification_url
+ *   2) Open the browser to verification_url_complete (or print URL if open fails)
+ *   3) Print user_code prominently so customer can read it
+ *   4) Poll /v1/auth/device/poll every interval until verified or maxAttempts
+ *   5) Save api_key + customer_id to ~/.cspeach/auth.json
+ *   6) Call GET /v1/me — if trial_mode === 'byok', prompt for Anthropic key
+ *   7) Re-save auth file with byokAnthropicKey if provided
+ *
+ * Dependencies (open, print, prompt) are injected so the command is
+ * unit-testable without stubbing platform globals.
+ */
+import { writeAuthFile } from '../auth/auth-file.js';
+export async function runLoginCommand(deps) {
+    const proxy = deps.proxyUrl.replace(/\/$/, '');
+    const pollInterval = deps.pollIntervalMs ?? 5000;
+    const maxAttempts = deps.maxAttempts ?? 120; // 120 × 5s = 10 min
+    // 1) Start.
+    let start;
+    try {
+        const r = await fetch(`${proxy}/v1/auth/device/start`, { method: 'POST' });
+        if (!r.ok) {
+            deps.print(`error: device-start HTTP ${r.status}`);
+            return 2;
+        }
+        start = await r.json();
+    }
+    catch (err) {
+        deps.print(`error: device-start network failure — ${err instanceof Error ? err.message : String(err)}`);
+        return 2;
+    }
+    // 2 + 3) Browser + user_code. The next line auto-opens the browser, so
+    // there's nothing for the user to do — just print honest "opening" wording.
+    deps.print('');
+    deps.print(`Your one-time code:  ${start.user_code}`);
+    deps.print(`Opening browser to:  ${start.verification_url_complete}`);
+    deps.print('');
+    try {
+        await deps.open(start.verification_url_complete);
+    }
+    catch {
+        deps.print(`(browser didn't auto-open — paste this URL manually: ${start.verification_url_complete})`);
+    }
+    // 4) Poll.
+    let polled = null;
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        if (attempt > 0)
+            await sleep(pollInterval);
+        try {
+            const r = await fetch(`${proxy}/v1/auth/device/poll`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ device_code: start.device_code }),
+            });
+            if (r.ok) {
+                polled = await r.json();
+                break;
+            }
+            const errBody = await r.json().catch(() => ({}));
+            if (errBody.error === 'authorization_pending')
+                continue;
+            if (errBody.error === 'expired_token') {
+                deps.print('error: device code expired — run `cspeach login` again');
+                return 3;
+            }
+            deps.print(`error: poll HTTP ${r.status} — ${errBody.error ?? 'unknown'}`);
+            return 4;
+        }
+        catch (err) {
+            deps.print(`(network blip — retrying — ${err instanceof Error ? err.message : String(err)})`);
+            continue;
+        }
+    }
+    if (!polled) {
+        deps.print('error: timed out waiting for browser authorization');
+        return 5;
+    }
+    // 5) Save (non-BYOK part).
+    await writeAuthFile({
+        apiKey: polled.api_key,
+        customerId: polled.customer_id,
+        byokAnthropicKey: null,
+    });
+    deps.print(`✓ Saved API key to ~/.cspeach/auth.json`);
+    // 6) /v1/me — figure out if BYOK is required.
+    try {
+        const r = await fetch(`${proxy}/v1/me`, { headers: { Authorization: `Bearer ${polled.api_key}` } });
+        if (r.ok) {
+            const me = await r.json();
+            deps.print(`✓ Signed in as ${me.email} (${me.plan})`);
+            if (me.trial_mode === 'byok' || me.plan === 'byo-key') {
+                deps.print('');
+                deps.print('This account is BYOK — you provide your own Anthropic API key.');
+                deps.print('Get one at https://console.anthropic.com/settings/keys');
+                const ak = (await deps.prompt('Paste your Anthropic API key (sk-ant-...): ')).trim();
+                if (ak.startsWith('sk-ant-') && ak.length > 20) {
+                    // The non-BYOK save above just persisted these exact values,
+                    // so reading them back from disk would be redundant.
+                    await writeAuthFile({
+                        apiKey: polled.api_key,
+                        customerId: polled.customer_id,
+                        byokAnthropicKey: ak,
+                    });
+                    deps.print('✓ Anthropic key saved');
+                }
+                else {
+                    deps.print('error: Anthropic key looks malformed (must start with sk-ant-). Skipped — run `cspeach login` again later.');
+                }
+            }
+        }
+    }
+    catch (err) {
+        deps.print(`(could not fetch /v1/me — login still succeeded — ${err instanceof Error ? err.message : String(err)})`);
+    }
+    return 0;
+}
+function sleep(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}

package/dist/commands/logout.js

@@ -0,0 +1,17 @@
+/**
+ * `cspeach logout` — delete the device-code-flow auth file. The REPL
+ * will fall back to the keytar-stored API key if one is present.
+ */
+import { deleteAuthFile, readAuthFile } from '../auth/auth-file.js';
+export async function runLogoutCommand(deps) {
+    const before = await readAuthFile();
+    await deleteAuthFile();
+    if (before) {
+        deps.print('✓ Signed out — removed ~/.cspeach/auth.json');
+        deps.print('  (the REPL will use the keytar-stored key if you have one)');
+    }
+    else {
+        deps.print('Already signed out — no auth.json present.');
+    }
+    return 0;
+}