@doist/doistbot-cli 1.0.0 → 1.0.2

package/dist/actions/auth.js

@@ -1,50 +1,157 @@
 import { deleteGeminiApiKey, getAuthStatus, loginOpenAICodex, logoutOpenAICodex, saveGeminiApiKey, } from '../auth.js';
-import { promptHiddenInput } from '../input.js';
+import { getEnvApiKeys } from '../env.js';
+import { FILE_STORE_PATH } from '../file-store.js';
+import { promptHiddenInput, promptMultiSelect } from '../input.js';
+import { getSecureStoreLabel } from '../secure-store.js';
 import { writeLine } from '../terminal.js';
-export async function runAuthSetup() {
-    const status = await getAuthStatus();
-    writeLine('1. OpenAI Codex');
-    writeLine();
-    if (status.openai.source === 'pi-auth') {
-        writeLine('✓ OpenAI already configured (pi-auth).');
+const AUTH_LOGOUT_PROVIDER_CONFIGS = [
+    {
+        clear: async ({ logoutOpenAICodex }) => {
+            await logoutOpenAICodex();
+            return '✓ OpenAI stored auth cleared.';
+        },
+        envWarning: (env) => getEnvApiKeys(env).openai
+            ? 'OpenAI is still configured from an environment variable.'
+            : undefined,
+        name: 'OpenAI Codex',
+        value: 'openai',
+    },
+    {
+        clear: async ({ deleteGeminiApiKey }) => {
+            const deleted = await deleteGeminiApiKey();
+            return deleted
+                ? '✓ Gemini stored API key cleared.'
+                : 'Gemini had no stored API key to clear.';
+        },
+        envWarning: (env) => getEnvApiKeys(env).gemini
+            ? 'Gemini is still configured from GEMINI_API_KEY.'
+            : undefined,
+        name: 'Gemini',
+        value: 'gemini',
+    },
+];
+const AUTH_LOGOUT_PROVIDERS = AUTH_LOGOUT_PROVIDER_CONFIGS.map(({ value }) => value);
+export const AUTH_LOGOUT_PROVIDER_USAGE = `${AUTH_LOGOUT_PROVIDERS.join('|')}|all`;
+export async function runAuthSetup(dependencies = {}) {
+    const deps = {
+        getAuthStatus,
+        isInteractive: process.stdin.isTTY === true,
+        loginOpenAICodex,
+        promptHiddenInput,
+        saveGeminiApiKey,
+        writeLine,
+        ...dependencies,
+    };
+    const status = await deps.getAuthStatus();
+    deps.writeLine('1. OpenAI Codex');
+    deps.writeLine();
+    if (status.openai.configured) {
+        deps.writeLine(formatOpenAIConfiguredMessage(status.openai.source));
     }
     else {
-        if (!process.stdin.isTTY) {
+        if (!deps.isInteractive) {
             throw new Error('Cannot configure OpenAI Codex auth in non-interactive mode.');
         }
-        if (status.openai.source === 'env') {
-            writeLine('OpenAI API key detected; configuring OpenAI Codex auth for local reviews.');
-        }
-        await loginOpenAICodex();
-        writeLine();
-        writeLine('✓ OpenAI configured.');
+        await deps.loginOpenAICodex();
+        deps.writeLine();
+        deps.writeLine('✓ OpenAI configured.');
     }
-    writeLine();
-    writeLine('2. Gemini API key');
-    writeLine();
+    deps.writeLine();
+    deps.writeLine('2. Gemini API key');
+    deps.writeLine();
     if (status.gemini.source === 'env') {
-        writeLine('✓ Gemini already configured from GEMINI_API_KEY.');
+        deps.writeLine('✓ Gemini already configured from GEMINI_API_KEY.');
         return;
     }
     if (status.gemini.source === 'keychain') {
-        writeLine('✓ Gemini already configured in the system credential manager.');
+        deps.writeLine(`✓ Gemini already configured in the ${getSecureStoreLabel()}.`);
         return;
     }
-    if (!process.stdin.isTTY) {
+    if (status.gemini.source === 'file') {
+        deps.writeLine(`✓ Gemini already configured (${FILE_STORE_PATH}).`);
+        return;
+    }
+    if (!deps.isInteractive) {
         throw new Error('Cannot prompt for Gemini API key in non-interactive mode. Set GEMINI_API_KEY instead.');
     }
-    writeLine('Doistbot requires a Gemini API key. Please create one at https://aistudio.google.com/app/api-keys and paste it here.');
-    await saveGeminiApiKey(await promptHiddenInput('Gemini API key: '));
-    writeLine();
-    writeLine('✓ Gemini configured.');
+    deps.writeLine('Doistbot requires a Gemini API key. Please create one at https://aistudio.google.com/app/api-keys and paste it here.');
+    const backend = await deps.saveGeminiApiKey(await deps.promptHiddenInput('Gemini API key: '));
+    deps.writeLine();
+    if (backend === 'file') {
+        deps.writeLine(`Note: ${getSecureStoreLabel()} unavailable; key stored in ${FILE_STORE_PATH} with 0600 permissions.`);
+    }
+    deps.writeLine('✓ Gemini configured.');
 }
 export async function runAuthStatus() {
     const status = await getAuthStatus();
     writeLine(`OpenAI: ${status.openai.configured ? `configured (${status.openai.source ?? 'unknown'})` : 'not configured'}`);
     writeLine(`Gemini: ${status.gemini.configured ? `configured (${status.gemini.source ?? 'unknown'})` : 'not configured'}`);
 }
-export async function runAuthLogout() {
-    await logoutOpenAICodex();
-    await deleteGeminiApiKey();
-    writeLine('DoistBot CLI auth cleared.');
+export async function runAuthLogout(target, dependencies = {}) {
+    const deps = {
+        deleteGeminiApiKey,
+        env: process.env,
+        isInteractive: process.stdin.isTTY === true,
+        logoutOpenAICodex,
+        promptProviderSelection: promptLogoutProviderSelection,
+        writeLine,
+        ...dependencies,
+    };
+    const providers = await resolveLogoutProviders(target, deps);
+    const providerConfigs = providers.map(getAuthLogoutProviderConfig);
+    const clearMessages = await Promise.all(providerConfigs.map((config) => config.clear(deps)));
+    for (const message of clearMessages) {
+        deps.writeLine(message);
+    }
+    for (const config of providerConfigs) {
+        const warning = config.envWarning(deps.env);
+        if (warning) {
+            deps.writeLine(warning);
+        }
+    }
+}
+async function resolveLogoutProviders(target, dependencies) {
+    if (target === undefined) {
+        if (!dependencies.isInteractive) {
+            throw new Error(`Provider required in non-interactive mode. Use \`doistbot auth logout ${AUTH_LOGOUT_PROVIDER_USAGE}\`.`);
+        }
+        return await dependencies.promptProviderSelection();
+    }
+    const normalized = target.toLowerCase();
+    if (normalized === 'all') {
+        return [...AUTH_LOGOUT_PROVIDERS];
+    }
+    if (isAuthLogoutProvider(normalized)) {
+        return [normalized];
+    }
+    throw new Error(`Usage: doistbot auth logout [${AUTH_LOGOUT_PROVIDER_USAGE}]`);
+}
+function isAuthLogoutProvider(value) {
+    return AUTH_LOGOUT_PROVIDERS.includes(value);
+}
+function getAuthLogoutProviderConfig(provider) {
+    const config = AUTH_LOGOUT_PROVIDER_CONFIGS.find(({ value }) => value === provider);
+    if (!config) {
+        throw new Error(`Unsupported auth logout provider: ${provider}`);
+    }
+    return config;
+}
+async function promptLogoutProviderSelection() {
+    return await promptMultiSelect({
+        message: 'Select providers to log out:',
+        choices: AUTH_LOGOUT_PROVIDER_CONFIGS.map(({ name, value }) => ({ name, value })),
+    });
+}
+function formatOpenAIConfiguredMessage(source) {
+    switch (source) {
+        case 'pi-auth':
+            return '✓ OpenAI already configured (pi-auth).';
+        case 'env':
+            return '✓ OpenAI already configured from the environment.';
+        case 'keychain':
+            return '✓ OpenAI already configured (keychain).';
+        case 'file':
+        case undefined:
+            return '✓ OpenAI already configured.';
+    }
 }

package/dist/actions/doctor.js

@@ -1,8 +1,8 @@
 import { getAuthStatus } from '../auth.js';
-import { getApiKeys } from '../config.js';
+import { getEnvApiKeys } from '../env.js';
 import { checkGit, checkPiDependency, checkRepository, checkSandboxBuild } from '../runtime.js';
 import { renderDiagnosticCheck } from '../terminal.js';
-function getConfiguredProviders({ apiKeys, status, }) {
+export function getConfiguredProviders({ status, }) {
     return [
         status.openai.configured
             ? `OpenAI (${status.openai.source === 'pi-auth'
@@ -10,15 +10,18 @@ function getConfiguredProviders({ apiKeys, status, }) {
                 : (status.openai.source ?? 'configured')})`
             : undefined,
         status.gemini.configured ? `Gemini (${status.gemini.source ?? 'configured'})` : undefined,
-        apiKeys.anthropic ? 'Anthropic (env)' : undefined,
     ].filter((provider) => provider !== undefined);
 }
-async function checkAuth() {
-    const [status, apiKeys] = await Promise.all([getAuthStatus(), getApiKeys()]);
-    const configured = getConfiguredProviders({ apiKeys, status });
-    return configured.length > 0
-        ? { ok: true, message: `${configured.join(', ')} configured` }
-        : { ok: false, message: 'run `doistbot auth`' };
+export async function checkAuth({ env = process.env, getStatus = getAuthStatus, } = {}) {
+    const status = await getStatus({ env });
+    const configured = getConfiguredProviders({ status });
+    if (configured.length > 0) {
+        return { ok: true, message: `${configured.join(', ')} configured` };
+    }
+    if (getEnvApiKeys(env).anthropic) {
+        return { ok: true, message: 'provider auth configured' };
+    }
+    return { ok: false, message: 'run `doistbot auth`' };
 }
 export async function runDoctor() {
     await renderDiagnosticCheck('git', checkGit);

package/dist/actions/review-usage.js

@@ -0,0 +1,20 @@
+const REVIEW_USAGE_COMMANDS = ['doistbot review [staged]', 'db review [staged]'];
+const REVIEW_SETUP_COMMANDS = [
+    'doistbot review',
+    'doistbot review staged',
+    'db review',
+    'db review staged',
+];
+export function formatReviewUsage() {
+    return `Usage: ${formatCommandList(REVIEW_USAGE_COMMANDS)}`;
+}
+export function formatSetupCompleteMessage() {
+    return `Setup complete. Run ${formatCommandList(REVIEW_SETUP_COMMANDS)} from a git repository.`;
+}
+function formatCommandList(commands) {
+    const quotedCommands = commands.map((command) => `\`${command}\``);
+    if (quotedCommands.length <= 2) {
+        return quotedCommands.join(' or ');
+    }
+    return `${quotedCommands.slice(0, -1).join(', ')}, or ${quotedCommands.at(-1)}`;
+}

package/dist/actions/review.js

@@ -1,6 +1,7 @@
 import { getApiKeys } from '../config.js';
 import { getRepositoryRoot, loadSandboxFormatModule, loadSandboxReviewModule } from '../runtime.js';
 import { formatReviewProgress, renderAlert, renderMarkdown, withSpinner, writeLine, } from '../terminal.js';
+import { formatReviewUsage } from './review-usage.js';
 const LOCAL_REVIEW_SOURCE_STAGED = 'staged';
 const PROVIDER_DISPLAY_NAMES = {
     gemini: 'Gemini',
@@ -88,7 +89,7 @@ function formatReviewOutput({ formatReviewForTerminal, review, }) {
 }
 export async function runReview(sourceArg) {
     if (sourceArg !== undefined && sourceArg !== LOCAL_REVIEW_SOURCE_STAGED) {
-        throw new Error('Usage: doistbot review [staged]');
+        throw new Error(formatReviewUsage());
     }
     const source = sourceArg === LOCAL_REVIEW_SOURCE_STAGED ? LOCAL_REVIEW_SOURCE_STAGED : 'base';
     const reviewModule = await loadSandboxReviewModule();

package/dist/actions/setup.js

@@ -1,6 +1,7 @@
 import { checkGit, checkPiDependency, checkSandboxBuild } from '../runtime.js';
 import { renderDiagnosticCheck, writeLine } from '../terminal.js';
 import { runAuthSetup } from './auth.js';
+import { formatSetupCompleteMessage } from './review-usage.js';
 export async function runSetup() {
     writeLine('Checking DoistBot CLI prerequisites...');
     await renderDiagnosticCheck('git', checkGit);
@@ -9,5 +10,5 @@ export async function runSetup() {
     writeLine();
     await runAuthSetup();
     writeLine();
-    writeLine('Setup complete. Run `doistbot review` or `doistbot review staged` from a git repository.');
+    writeLine(formatSetupCompleteMessage());
 }

package/dist/auth.js

@@ -2,8 +2,13 @@ import { spawn } from 'child_process';
 import { homedir } from 'os';
 import path from 'path';
 import { getEnvApiKeys } from './env.js';
+import { createFileStore } from './file-store.js';
 import { promptInput } from './input.js';
-import { createGeminiKeyStore } from './secure-store.js';
+import { createCompositeStore, createKeyringStore, SecureStoreUnavailableError, } from './secure-store.js';
+const GEMINI_ACCOUNT_NAME = 'gemini-api-key';
+export function createGeminiKeyStore() {
+    return createCompositeStore(createKeyringStore(GEMINI_ACCOUNT_NAME), createFileStore(GEMINI_ACCOUNT_NAME));
+}
 export const OPENAI_CODEX_PROVIDER_ID = 'openai-codex';
 export const PI_AUTH_API_KEY = `pi-auth://${OPENAI_CODEX_PROVIDER_ID}`;
 export async function createPiAuthStorage() {
@@ -31,25 +36,37 @@ export async function logoutOpenAICodex(storage) {
     const resolvedStorage = storage ?? (await createPiAuthStorage());
     resolvedStorage.logout(OPENAI_CODEX_PROVIDER_ID);
 }
+export async function readStoredGeminiApiKey(store = createGeminiKeyStore()) {
+    const result = await store.getSecret();
+    const trimmed = result.value?.trim();
+    return trimmed ? { value: trimmed, backend: result.backend } : { value: undefined };
+}
 export async function getStoredGeminiApiKey(store = createGeminiKeyStore()) {
-    const key = (await store.getSecret())?.trim();
-    return key || undefined;
+    return (await readStoredGeminiApiKey(store)).value;
 }
 export async function saveGeminiApiKey(apiKey, store = createGeminiKeyStore()) {
     const normalized = apiKey.trim();
     if (!normalized) {
         throw new Error('Gemini API key cannot be empty');
     }
-    await store.setSecret(normalized);
+    try {
+        return await store.setSecret(normalized);
+    }
+    catch (error) {
+        if (error instanceof SecureStoreUnavailableError) {
+            throw new SecureStoreUnavailableError(`${error.message} Set GEMINI_API_KEY in your environment instead.`);
+        }
+        throw error;
+    }
 }
 export async function deleteGeminiApiKey(store = createGeminiKeyStore()) {
     return await store.deleteSecret();
 }
 export async function getAuthStatus({ env = process.env, storage, geminiStore = createGeminiKeyStore(), } = {}) {
     const envApiKeys = getEnvApiKeys(env);
-    const geminiStoredKey = envApiKeys.gemini
-        ? undefined
-        : await getStoredGeminiApiKey(geminiStore).catch(() => undefined);
+    const geminiStored = envApiKeys.gemini
+        ? { value: undefined }
+        : await readStoredGeminiApiKey(geminiStore).catch(() => ({ value: undefined }));
     const openAICodexAuthConfigured = await hasOpenAICodexAuth(storage);
     return {
         openai: openAICodexAuthConfigured
@@ -61,8 +78,12 @@ export async function getAuthStatus({ env = process.env, storage, geminiStore =
         gemini: envApiKeys.gemini
             ? { configured: true, source: 'env' }
             : {
-                configured: geminiStoredKey !== undefined,
-                source: geminiStoredKey !== undefined ? 'keychain' : undefined,
+                configured: geminiStored.value !== undefined,
+                source: geminiStored.value !== undefined
+                    ? geminiStored.backend === 'file'
+                        ? 'file'
+                        : 'keychain'
+                    : undefined,
             },
     };
 }

package/dist/config.js

@@ -10,8 +10,8 @@ export async function getApiKeys(env = process.env, auth = {
         : await auth.getStoredGeminiApiKey().catch(() => undefined);
     const openAICodexAuthConfigured = await auth.hasOpenAICodexAuth();
     return {
+        anthropic: envApiKeys.anthropic,
         gemini: envApiKeys.gemini || storedGeminiApiKey,
         openai: openAICodexAuthConfigured ? PI_AUTH_API_KEY : envApiKeys.openai,
-        anthropic: envApiKeys.anthropic,
     };
 }

package/dist/env.js

@@ -3,8 +3,8 @@ function getEnvValue(value) {
 }
 export function getEnvApiKeys(env = process.env) {
     return {
+        anthropic: getEnvValue(env.ANTHROPIC_KEY) || getEnvValue(env.ANTHROPIC_API_KEY),
         gemini: getEnvValue(env.GEMINI_API_KEY),
         openai: getEnvValue(env.OPENAI_KEY) || getEnvValue(env.OPENAI_API_KEY),
-        anthropic: getEnvValue(env.ANTHROPIC_KEY) || getEnvValue(env.ANTHROPIC_API_KEY),
     };
 }

package/dist/file-store.js

@@ -0,0 +1,112 @@
+import { randomUUID } from 'crypto';
+import { promises as fs } from 'fs';
+import { homedir } from 'os';
+import path from 'path';
+import { describeError, SecureStoreUnavailableError, } from './secure-store.js';
+export const FILE_STORE_PATH = path.join(homedir(), '.doistbot', 'credentials.json');
+const FILE_BACKEND = 'file';
+export function createFileStore(account, filePath = FILE_STORE_PATH) {
+    return {
+        async getSecret() {
+            const data = await readCredentialsFile(filePath);
+            const raw = data[account];
+            if (typeof raw !== 'string' || raw.length === 0) {
+                return { value: null };
+            }
+            return { value: raw, backend: FILE_BACKEND };
+        },
+        async setSecret(secret) {
+            assertWritableOnThisPlatform();
+            const data = await readCredentialsFile(filePath);
+            data[account] = secret;
+            await writeCredentialsFile(filePath, data);
+            return FILE_BACKEND;
+        },
+        async deleteSecret() {
+            const data = await readCredentialsFile(filePath);
+            if (!(account in data)) {
+                return false;
+            }
+            delete data[account];
+            if (Object.keys(data).length === 0) {
+                await removeFile(filePath);
+            }
+            else {
+                assertWritableOnThisPlatform();
+                await writeCredentialsFile(filePath, data);
+            }
+            return true;
+        },
+    };
+}
+function assertWritableOnThisPlatform() {
+    if (process.platform === 'win32') {
+        throw new SecureStoreUnavailableError('File-based credential fallback is not supported on Windows because POSIX 0600 permissions cannot be enforced. Use Windows Credential Manager or set GEMINI_API_KEY.');
+    }
+}
+async function readCredentialsFile(filePath) {
+    let raw;
+    try {
+        raw = await fs.readFile(filePath, 'utf8');
+    }
+    catch (error) {
+        if (isNotFoundError(error)) {
+            return {};
+        }
+        throw new SecureStoreUnavailableError(`Failed to read credentials file at ${filePath}: ${describeError(error)}`);
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            throw new Error('credentials file is not a JSON object');
+        }
+        const result = {};
+        for (const [key, value] of Object.entries(parsed)) {
+            if (typeof value === 'string') {
+                result[key] = value;
+            }
+        }
+        return result;
+    }
+    catch (error) {
+        throw new SecureStoreUnavailableError(`Credentials file at ${filePath} is corrupt: ${describeError(error)}`);
+    }
+}
+async function writeCredentialsFile(filePath, data) {
+    const dir = path.dirname(filePath);
+    try {
+        await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+        await fs.chmod(dir, 0o700);
+    }
+    catch (error) {
+        throw new SecureStoreUnavailableError(`Failed to create credentials directory ${dir}: ${describeError(error)}`);
+    }
+    const tmpPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+    const payload = `${JSON.stringify(data, null, 2)}\n`;
+    try {
+        await fs.writeFile(tmpPath, payload, { mode: 0o600 });
+        await fs.chmod(tmpPath, 0o600);
+        await fs.rename(tmpPath, filePath);
+    }
+    catch (error) {
+        await removeFile(tmpPath).catch(() => undefined);
+        throw new SecureStoreUnavailableError(`Failed to write credentials file at ${filePath}: ${describeError(error)}`);
+    }
+}
+async function removeFile(filePath) {
+    try {
+        await fs.unlink(filePath);
+    }
+    catch (error) {
+        if (isNotFoundError(error)) {
+            return;
+        }
+        throw new SecureStoreUnavailableError(`Failed to remove credentials file at ${filePath}: ${describeError(error)}`);
+    }
+}
+function isNotFoundError(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        'code' in error &&
+        error.code === 'ENOENT');
+}

package/dist/index.js

@@ -3,11 +3,12 @@ import fs from 'fs';
 import path from 'path';
 import { fileURLToPath } from 'url';
 import { Command } from 'commander';
-import { runAuthLogout, runAuthSetup, runAuthStatus } from './actions/auth.js';
+import { AUTH_LOGOUT_PROVIDER_USAGE, runAuthLogout, runAuthSetup, runAuthStatus, } from './actions/auth.js';
 import { runDoctor } from './actions/doctor.js';
 import { runReview } from './actions/review.js';
 import { runSetup } from './actions/setup.js';
 import { writeErrorLine } from './terminal.js';
+import { notifyAndRefreshCliUpdateCache, notifyIfCliUpdateAvailable } from './update-check.js';
 export { getSandboxRoot } from './runtime.js';
 function getPackageVersion() {
     const packageJsonPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../package.json');
@@ -19,44 +20,97 @@ function getPackageVersion() {
         return '0.0.0';
     }
 }
-export function createProgram({ runAuthLogout: authLogout = runAuthLogout, runAuthSetup: authSetup = runAuthSetup, runAuthStatus: authStatus = runAuthStatus, runDoctor: doctor = runDoctor, runSetup: setup = runSetup, runReview: review = runReview, } = {}) {
+const PACKAGE_VERSION = getPackageVersion();
+function getUpdateCacheEntrypointPath() {
+    return fileURLToPath(new URL('./update-cache-entrypoint.js', import.meta.url));
+}
+export function createProgram({ runAuthLogout: authLogout = runAuthLogout, runAuthSetup: authSetup = runAuthSetup, runAuthStatus: authStatus = runAuthStatus, runDoctor: doctor = runDoctor, runSetup: setup = runSetup, runReview: review = runReview, runAutomaticUpdateCheck: automaticUpdateCheck = async () => await notifyAndRefreshCliUpdateCache({
+    currentVersion: PACKAGE_VERSION,
+    updateCacheEntrypointPath: getUpdateCacheEntrypointPath(),
+}), runUpdateCheck: updateCheck = async () => await notifyIfCliUpdateAvailable({ currentVersion: PACKAGE_VERSION }), } = {}) {
     const program = new Command();
+    const automaticUpdateCommands = new Set();
+    function withAutomaticUpdateCheck(command) {
+        automaticUpdateCommands.add(command);
+        return command;
+    }
     program
         .name('doistbot')
         .description('DoistBot local self-review CLI')
-        .version(getPackageVersion());
-    program
+        .version(PACKAGE_VERSION)
+        .hook('postAction', async (_thisCommand, actionCommand) => {
+        if (automaticUpdateCommands.has(actionCommand)) {
+            await automaticUpdateCheck();
+        }
+    });
+    withAutomaticUpdateCheck(program
         .command('doctor')
         .description('Diagnose local DoistBot CLI setup')
-        .action(async () => await doctor());
-    program
+        .action(async () => await doctor()));
+    withAutomaticUpdateCheck(program
         .command('setup')
         .description('Check prerequisites and configure local provider auth')
-        .action(async () => await setup());
-    const authCommand = program
+        .action(async () => await setup()));
+    const authCommand = withAutomaticUpdateCheck(program
         .command('auth')
         .description('Authenticate DoistBot CLI with local review providers')
-        .action(async () => await authSetup());
-    authCommand
+        .action(async () => await authSetup()));
+    withAutomaticUpdateCheck(authCommand
         .command('status')
         .description('Show provider authentication status')
-        .action(async () => await authStatus());
-    authCommand
+        .action(async () => await authStatus()));
+    withAutomaticUpdateCheck(authCommand
         .command('login')
         .description('Configure provider authentication')
-        .action(async () => await authSetup());
-    authCommand
-        .command('logout')
-        .description('Clear stored DoistBot CLI auth')
-        .action(async () => await authLogout());
-    program
+        .action(async () => await authSetup()));
+    withAutomaticUpdateCheck(authCommand
+        .command('logout [provider]')
+        .description(`Clear stored DoistBot CLI auth for ${AUTH_LOGOUT_PROVIDER_USAGE}`)
+        .action(async (provider) => await authLogout(provider)));
+    withAutomaticUpdateCheck(program
         .command('review [source]')
         .description('Run a local self-review. Use `staged` to review only staged changes.')
-        .action(async (source) => await review(source));
+        .action(async (source) => await review(source)));
+    program
+        .command('update')
+        .description('Check whether a newer DoistBot CLI version is available')
+        .action(async () => await updateCheck());
     return program;
 }
-async function main() {
-    await createProgram().parseAsync(process.argv, { from: 'node' });
+export async function runCliEntrypoint({ argv = process.argv, dependencies, exitProcess = exitCliProcess, writeErrorLine: writeError = writeErrorLine, } = {}) {
+    try {
+        await createProgram(dependencies).parseAsync(argv, { from: 'node' });
+        if (shouldForceExitAfterCommand(argv)) {
+            await exitProcess(getProcessExitCode());
+        }
+    }
+    catch (error) {
+        writeError(`Error: ${error.message}`);
+        process.exitCode = 1;
+        if (shouldForceExitAfterCommand(argv)) {
+            await exitProcess(1);
+        }
+    }
+}
+export function shouldForceExitAfterCommand(argv) {
+    const command = argv[2];
+    const authSubcommand = argv[3];
+    return command === 'setup' || (command === 'auth' && authSubcommand !== 'status');
+}
+function flushStream(stream) {
+    if (!stream.writable) {
+        return Promise.resolve();
+    }
+    return new Promise((resolve) => {
+        stream.write('', () => resolve());
+    });
+}
+async function exitCliProcess(code) {
+    await Promise.all([flushStream(process.stdout), flushStream(process.stderr)]);
+    process.exit(code);
+}
+function getProcessExitCode() {
+    return typeof process.exitCode === 'number' ? process.exitCode : 0;
 }
 export function isCliEntrypoint(argvPath, moduleUrl) {
     if (!argvPath) {
@@ -72,8 +126,5 @@ export function isCliEntrypoint(argvPath, moduleUrl) {
     }
 }
 if (isCliEntrypoint(process.argv[1], import.meta.url)) {
-    await main().catch((error) => {
-        writeErrorLine(`Error: ${error.message}`);
-        process.exitCode = 1;
-    });
+    await runCliEntrypoint();
 }