@kimchi-dev/kimchictl 0.0.2

package/src/cli.ts

@@ -0,0 +1,16 @@
+import { run } from "./run.js"
+import { maybeNotifyUpdate } from "./updates/check.js"
+
+// Executable CLI target: `bun build --compile src/cli.ts`, `bun run dev`,
+// and the published dist/cli.js behind bin/kimchictl.mjs. Self-executes on
+// import; never imported as a library (run.ts is the library surface).
+const argv = process.argv.slice(2)
+const code = await run(argv)
+
+// Daily background update notice: prints to stderr, never fails the command.
+// Skipped for `ssh` — its stdio belongs to the SSH session / proxy bridge,
+// where any extra bytes would corrupt the stream.
+if (argv[0] !== "ssh") {
+	await maybeNotifyUpdate()
+}
+process.exitCode = code

package/src/commands/completion.test.ts

@@ -0,0 +1,31 @@
+import { afterEach, describe, expect, it, vi } from "vitest"
+import { captureConsole } from "../test-support.js"
+import { runCompletion } from "./completion.js"
+import { guardCommand } from "./guard.js"
+
+afterEach(() => {
+	vi.restoreAllMocks()
+})
+
+const guard = guardCommand(runCompletion)
+
+describe("kimchictl completion", () => {
+	it.each(["bash", "zsh", "fish"])("prints %s completions with the command surface", async (shell) => {
+		const { lines } = captureConsole()
+
+		const code = await guard([shell])
+
+		expect(code).toBe(0)
+		const script = lines.join("\n")
+		for (const name of ["login", "workspace", "ssh", "update"]) {
+			expect(script).toContain(name)
+		}
+	})
+
+	it("rejects unsupported shells with a usage error", async () => {
+		const { errors } = captureConsole()
+
+		expect(await guard(["powershell"])).toBe(2)
+		expect(errors[0]).toContain("bash, zsh, fish")
+	})
+})

package/src/commands/completion.ts

@@ -0,0 +1,77 @@
+import { parseFlags, UsageError } from "./flags.js"
+
+/**
+ * Shell completions — deliberately minimal: complete top-level command names
+ * plus workspace subverbs; expand on demand rather than building a full spec.
+ */
+
+const TOP_LEVEL = ["login", "logout", "whoami", "workspace", "ws", "ssh", "update", "completion", "version", "help"]
+const WORKSPACE_VERBS = ["create", "list", "get", "delete", "--output", "--desc", "--force", "--no-wait", "--help"]
+
+const BASH = `# kimchictl bash completion — source this file or place it in /etc/bash_completion.d/
+_kimchictl() {
+  local cur prev
+  cur="\${COMP_WORDS[COMP_CWORD]}"
+  prev="\${COMP_WORDS[COMP_CWORD-1]}"
+  if [ "$COMP_CWORD" -eq 1 ]; then
+    COMPREPLY=( $(compgen -W "${TOP_LEVEL.join(" ")}" -- "$cur") )
+    return 0
+  fi
+  case "\${COMP_WORDS[1]}" in
+    workspace|ws)
+      [ "$COMP_CWORD" -eq 2 ] && COMPREPLY=( $(compgen -W "${WORKSPACE_VERBS.join(" ")}" -- "$cur") ) ;;
+    completion)
+      [ "$COMP_CWORD" -eq 2 ] && COMPREPLY=( $(compgen -W "bash zsh fish" -- "$cur") ) ;;
+  esac
+  return 0
+}
+complete -F _kimchictl kimchictl
+`
+
+const ZSH_COMMANDS = TOP_LEVEL.map((c) => `"${c}"`).join(" ")
+
+const ZSH = `#compdef kimchictl
+# kimchictl zsh completion — place in a directory on $fpath as _kimchictl
+_kimchictl() {
+  local -a commands=${ZSH_COMMANDS}
+  if (( CURRENT == 2 )); then
+    _arguments "1:command:(\${commands})"
+    return
+  fi
+  case "$words[2]" in
+    workspace|ws)
+      (( CURRENT == 3 )) && _arguments "2:verb:(${WORKSPACE_VERBS.join(" ")})" ;;
+    completion)
+      (( CURRENT == 3 )) && _arguments "2:shell:(bash zsh fish)" ;;
+  esac
+}
+_kimchictl "$@"
+`
+
+const FISH = `# kimchictl fish completion — place in ~/.config/fish/completions/kimchictl.fish
+complete -c kimchictl -f
+complete -c kimchictl -n '__fish_use_subcommand' -a '${TOP_LEVEL.join(" ")}'
+complete -c kimchictl -n '__fish_seen_subcommand_from workspace ws' -a '${WORKSPACE_VERBS.join(" ")}'
+complete -c kimchictl -n '__fish_seen_subcommand_from completion' -a 'bash zsh fish'
+`
+
+export async function runCompletion(args: string[]): Promise<number> {
+	const { positionals } = parseFlags("completion", args, {})
+	const shell = positionals[0]
+	if (positionals.length > 1) {
+		throw new UsageError("kimchictl completion: expected one shell (bash|zsh|fish)")
+	}
+	switch (shell) {
+		case "bash":
+			console.log(BASH)
+			return 0
+		case "zsh":
+			console.log(ZSH)
+			return 0
+		case "fish":
+			console.log(FISH)
+			return 0
+		default:
+			throw new UsageError(`kimchictl completion: unsupported shell '${shell ?? ""}' — one of: bash, zsh, fish`)
+	}
+}

package/src/commands/flags.ts

@@ -0,0 +1,29 @@
+import { type ParseArgsOptionsConfig, parseArgs } from "node:util"
+
+/** Bad CLI input — surfaced with exit code 2, distinct from runtime failures (1). */
+export class UsageError extends Error {
+	constructor(message: string) {
+		super(message)
+		this.name = "UsageError"
+	}
+}
+
+export type FlagValues = Record<string, string | boolean | undefined>
+
+/**
+ * Strict flag parsing with a uniform usage-error shape across commands.
+ * Values keep their raw type (declared options are TypeScript-blind here —
+ * narrow at the call site, relying on the declared option `type`).
+ */
+export function parseFlags(
+	command: string,
+	args: string[],
+	options: ParseArgsOptionsConfig,
+): { values: FlagValues; positionals: string[] } {
+	try {
+		const parsed = parseArgs({ args, options, strict: true, allowPositionals: true })
+		return { values: parsed.values as FlagValues, positionals: parsed.positionals }
+	} catch (err) {
+		throw new UsageError(`kimchictl ${command}: ${err instanceof Error ? err.message : String(err)}`)
+	}
+}

package/src/commands/guard.ts

@@ -0,0 +1,44 @@
+import { AmbiguousWorkspaceError, WorkspaceNotFoundError } from "../api/resolver.js"
+import { TemplatesUnavailableError } from "../api/templates.js"
+import { RemoteAuthError, RemoteNetworkError } from "../api/types.js"
+import { ModelsFetchError } from "../auth/models-providers.js"
+import { NotLoggedInError } from "../auth/resolve.js"
+import { BridgeError } from "../ssh/bridge.js"
+import { UsageError } from "./flags.js"
+
+/**
+ * Convert known domain errors into a clean message + exit code instead of a
+ * stack trace. Unknown errors rethrow so real bugs stay loud.
+ * A wrapped handler still fits CommandDefinition["run"] (deps optional).
+ *
+ *   ✗ <message>            → 1  (auth/network/usage-state errors)
+ *   kimchictl cmd: <usage> → 2  (flag parsing)
+ */
+export function guardCommand<TDeps>(
+	handler: (args: string[], deps?: TDeps) => Promise<number>,
+): (args: string[], deps?: TDeps) => Promise<number> {
+	return async (args, deps) => {
+		try {
+			return await handler(args, deps)
+		} catch (err) {
+			if (err instanceof UsageError) {
+				console.error(err.message)
+				return 2
+			}
+			if (
+				err instanceof NotLoggedInError ||
+				err instanceof ModelsFetchError ||
+				err instanceof TemplatesUnavailableError ||
+				err instanceof WorkspaceNotFoundError ||
+				err instanceof AmbiguousWorkspaceError ||
+				err instanceof BridgeError ||
+				err instanceof RemoteAuthError ||
+				err instanceof RemoteNetworkError
+			) {
+				console.error(`✗ ${err.message}`)
+				return 1
+			}
+			throw err
+		}
+	}
+}

package/src/commands/help.ts

@@ -0,0 +1,20 @@
+import type { CommandDefinition } from "./registry.js"
+
+/** Print top-level usage. Hidden commands are deliberately omitted. */
+export function printHelp(commands: readonly CommandDefinition[], log: (line: string) => void = console.log): void {
+	log(`kimchictl — manage kimchi remote workspaces
+`)
+	log(`Usage:
+  kimchictl <command> [options]
+`)
+	log(`Commands:`)
+	const visible = commands.filter((c) => !c.hidden)
+	const width = Math.max(...visible.map((c) => c.name.length))
+	for (const command of visible) {
+		log(`  ${command.name.padEnd(width)}  ${command.summary}`)
+	}
+	log(`
+Global flags:
+  -h, --help     Show this help
+  -v, --version  Print the version`)
+}

package/src/commands/login.test.ts

@@ -0,0 +1,159 @@
+import { readFileSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { afterEach, describe, expect, it, vi } from "vitest"
+import {
+	captureConsole,
+	cleanupTempDirs,
+	jsonResponse,
+	makeTempDir,
+	sharedConfigPath,
+	stubAgentDirEnv,
+	stubFetch,
+} from "../test-support.js"
+import { runLogin } from "./login.js"
+
+afterEach(() => {
+	cleanupTempDirs()
+	vi.unstubAllEnvs()
+	vi.restoreAllMocks()
+})
+
+const aiEnablerOnlyFetch = stubFetch(async () => jsonResponse({ models: [{ slug: "m1", provider: "ai-enabler" }] }))
+
+describe("kimchictl login --api-key", () => {
+	it("stores the key in auth.json and config.json (shared with the harness)", async () => {
+		const dir = makeTempDir()
+		const { home } = stubAgentDirEnv(dir)
+		const { lines, errors } = captureConsole()
+
+		const fetch = stubFetch(async () =>
+			jsonResponse({
+				models: [
+					{ slug: "m1", provider: "ai-enabler" },
+					{ slug: "m2", provider: "anthropic" },
+				],
+			}),
+		)
+
+		const code = await runLogin(["--api-key", "test-key"], { fetch })
+
+		expect(code).toBe(0)
+		expect(JSON.parse(readFileSync(join(dir, "auth.json"), "utf-8"))).toEqual({
+			"kimchi-dev": { type: "api_key", key: "test-key" },
+			"kimchi-dev/anthropic": { type: "api_key", key: "test-key" },
+		})
+		expect(JSON.parse(readFileSync(sharedConfigPath(home), "utf-8"))).toEqual({ apiKey: "test-key" })
+		expect(lines.some((l) => l.includes("Logged in to Kimchi"))).toBe(true)
+		// First login finishes the SSH integration automatically (with notice).
+		expect(errors.some((l) => l.includes("SSH integration configured"))).toBe(true)
+	})
+
+	it("unions provider ids from an existing harness models.json", async () => {
+		const dir = makeTempDir()
+		stubAgentDirEnv(dir)
+		writeFileSync(
+			join(dir, "models.json"),
+			JSON.stringify({ providers: { "kimchi-dev": {}, "kimchi-dev/openai": {}, ollama: {} } }),
+		)
+		captureConsole()
+
+		const code = await runLogin(["--api-key", "test-key"], { fetch: aiEnablerOnlyFetch })
+
+		expect(code).toBe(0)
+		expect(JSON.parse(readFileSync(join(dir, "auth.json"), "utf-8"))).toEqual({
+			"kimchi-dev": { type: "api_key", key: "test-key" },
+			"kimchi-dev/openai": { type: "api_key", key: "test-key" },
+		})
+	})
+
+	it("rejects an invalid key (401) and writes nothing", async () => {
+		const dir = makeTempDir()
+		stubAgentDirEnv(dir)
+		const { errors } = captureConsole()
+		const fetch = stubFetch(async () => new Response("nope", { status: 401, statusText: "Unauthorized" }))
+
+		const code = await runLogin(["--api-key", "bad-key"], { fetch })
+
+		expect(code).toBe(1)
+		expect(errors[0]).toMatch(/Invalid API key/)
+		expect(() => readFileSync(join(dir, "auth.json"))).toThrow()
+	})
+
+	it("fails hard when verification is unreachable for --api-key", async () => {
+		const dir = makeTempDir()
+		stubAgentDirEnv(dir)
+		const { errors } = captureConsole()
+		const fetch = stubFetch(async () => new Response("down", { status: 503, statusText: "Unavailable" }))
+
+		const code = await runLogin(["--api-key", "key"], { fetch })
+
+		expect(code).toBe(1)
+		expect(errors[0]).toMatch(/Could not verify the API key/)
+	})
+
+	it("treats an empty --api-key as a usage error", async () => {
+		stubAgentDirEnv(makeTempDir())
+		const { errors } = captureConsole()
+
+		expect(await runLogin(["--api-key", "  "])).toBe(2)
+		expect(errors[0]).toMatch(/--api-key must not be empty/)
+	})
+})
+
+describe("kimchictl login (browser)", () => {
+	it("completes the OAuth round trip and saves the token", async () => {
+		const dir = makeTempDir()
+		stubAgentDirEnv(dir)
+		captureConsole()
+
+		const code = await runLogin([], {
+			interactive: true,
+			fetch: aiEnablerOnlyFetch,
+			open: async (url) => {
+				const parsed = new URL(url)
+				const callback = new URL(decodeURIComponent(parsed.searchParams.get("callback") ?? ""))
+				callback.searchParams.set("state", parsed.searchParams.get("state") ?? "")
+				callback.searchParams.set("token", "browser-token")
+				await fetch(callback)
+			},
+		})
+
+		expect(code).toBe(0)
+		expect(JSON.parse(readFileSync(join(dir, "auth.json"), "utf-8"))).toEqual({
+			"kimchi-dev": { type: "api_key", key: "browser-token" },
+		})
+	})
+
+	it("keeps the credential with a warning when the metadata fetch is unreachable", async () => {
+		const dir = makeTempDir()
+		stubAgentDirEnv(dir)
+		const { errors } = captureConsole()
+		const downFetch = stubFetch(async () => new Response("down", { status: 503, statusText: "Unavailable" }))
+
+		const code = await runLogin([], {
+			interactive: true,
+			fetch: downFetch,
+			open: async (url) => {
+				const parsed = new URL(url)
+				const callback = new URL(decodeURIComponent(parsed.searchParams.get("callback") ?? ""))
+				callback.searchParams.set("state", parsed.searchParams.get("state") ?? "")
+				callback.searchParams.set("token", "browser-token")
+				await fetch(callback)
+			},
+		})
+
+		expect(code).toBe(0)
+		expect(JSON.parse(readFileSync(join(dir, "auth.json"), "utf-8"))).toEqual({
+			"kimchi-dev": { type: "api_key", key: "browser-token" },
+		})
+		expect(errors.some((l) => l.includes("Could not refresh the Kimchi model list"))).toBe(true)
+	})
+
+	it("requires a TTY without --api-key", async () => {
+		stubAgentDirEnv(makeTempDir())
+		const { errors } = captureConsole()
+		const code = await runLogin([], { interactive: false })
+		expect(code).toBe(1)
+		expect(errors[0]).toMatch(/requires a TTY/)
+	})
+})

package/src/commands/login.ts

@@ -0,0 +1,94 @@
+import { kimchiProviderIdsFromModelsJson, syncSharedAuth } from "../auth/auth-file.js"
+import { authenticateViaBrowser } from "../auth/browser-login.js"
+import { writeApiKeyToConfig } from "../auth/config-file.js"
+import { fetchKimchiProviderIds, ModelsFetchError } from "../auth/models-providers.js"
+import { resolveAuthJsonPath, resolveConfigJsonPath, resolveModelsJsonPath } from "../auth/paths.js"
+import { ensureSshIntegration } from "../ssh/connect.js"
+import { parseFlags } from "./flags.js"
+import { isInteractive } from "./prompt.js"
+
+export interface LoginDeps {
+	/** Browser opener override (tests). */
+	open?: (url: string) => Promise<unknown>
+	fetch?: typeof globalThis.fetch
+	env?: NodeJS.ProcessEnv
+	/** Override TTY interactivity detection (tests). */
+	interactive?: boolean
+}
+
+/**
+ * `kimchictl login` — obtain an API key (browser OAuth or --api-key) and
+ * store it in the harness's shared credential files:
+ *   - auth.json: one `{ type: "api_key", key }` per Kimchi provider id
+ *     (ids from an existing models.json plus a fresh metadata fetch)
+ *   - config.json: the `apiKey` field
+ * …so the harness picks the login up without its own `kimchi login`.
+ */
+export async function runLogin(args: string[], deps: LoginDeps = {}): Promise<number> {
+	const { values } = parseFlags("login", args, {
+		"api-key": { type: "string" },
+	})
+	const env = deps.env ?? process.env
+
+	const authPath = resolveAuthJsonPath(env)
+	const configPath = resolveConfigJsonPath(env)
+	const modelsPath = resolveModelsJsonPath(env)
+
+	let apiKey: string
+	const apiKeyFlag = values["api-key"]
+	const apiKeyProvided = apiKeyFlag !== undefined
+	if (apiKeyProvided) {
+		// parseArgs guarantees a string here (--api-key is declared type: "string").
+		apiKey = typeof apiKeyFlag === "string" ? apiKeyFlag.trim() : ""
+		if (!apiKey) {
+			console.error("kimchictl login: --api-key must not be empty")
+			return 2
+		}
+	} else {
+		const interactive = deps.interactive ?? isInteractive()
+		if (!interactive) {
+			console.error("kimchictl login: interactive login requires a TTY; use --api-key for non-interactive mode")
+			return 1
+		}
+		const { token } = await authenticateViaBrowser({
+			open: deps.open,
+			onBrowserUrl: (url) => console.log(`If the browser does not open, visit:\n${url}`),
+		})
+		apiKey = token
+	}
+
+	// Validate the key against the models metadata API and derive the full
+	// Kimchi provider-id set (kimchi-dev + kimchi-dev/<upstream>) in one call.
+	let fetchedIds: string[] = []
+	try {
+		fetchedIds = await fetchKimchiProviderIds(apiKey, { fetch: deps.fetch })
+	} catch (err) {
+		if (err instanceof ModelsFetchError && err.status === 401) {
+			console.error("✗ Invalid API key. Please check the key and try again.")
+			return 1
+		}
+		const detail = err instanceof Error ? err.message : String(err)
+		if (apiKeyProvided) {
+			// Mirror the harness's strict api-key login: an unverifiable key is not saved.
+			console.error(`✗ Could not verify the API key (${detail}). Try again later.`)
+			return 1
+		}
+		// Browser login: the token came from the web app seconds ago, so keep it and
+		// fall back to the ids we know. (Harness: non-strict refresh with cache fallback.)
+		console.error(
+			`⚠ Could not refresh the Kimchi model list (${detail}); saving the base credential. ` +
+				`Run \`kimchictl login\` again when the endpoint is reachable to pick up sub-provider credentials.`,
+		)
+	}
+
+	const providerIds = [...new Set([...kimchiProviderIdsFromModelsJson(modelsPath), ...fetchedIds])]
+	await syncSharedAuth(authPath, apiKey, providerIds)
+	writeApiKeyToConfig(configPath, apiKey)
+
+	console.log(`✓ Logged in to Kimchi — credentials saved to ${authPath}`)
+	console.log("  Shared with the kimchi coding harness; no second login needed there.")
+	// First login is the natural moment to finish the native SSH integration
+	// (automatic-with-notice; KIMCHICTL_NO_SSH_SETUP opts out).
+	await ensureSshIntegration({ env })
+	return 0
+}

package/src/commands/logout.test.ts

@@ -0,0 +1,89 @@
+import { readFileSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { afterEach, describe, expect, it, vi } from "vitest"
+import {
+	captureConsole,
+	cleanupTempDirs,
+	makeTempDir,
+	sharedConfigPath,
+	stubAgentDirEnv,
+	writeSharedConfigJson,
+} from "../test-support.js"
+import { runLogout } from "./logout.js"
+
+afterEach(() => {
+	cleanupTempDirs()
+	vi.unstubAllEnvs()
+	vi.restoreAllMocks()
+})
+
+function seedCredentials(dir: string, home: string): void {
+	writeFileSync(
+		join(dir, "auth.json"),
+		JSON.stringify({
+			"kimchi-dev": { type: "api_key", key: "key" },
+			"kimchi-dev/openai": { type: "api_key", key: "key" },
+			anthropic: { type: "api_key", key: "keep" },
+		}),
+	)
+	writeSharedConfigJson(home, { apiKey: "key", other: true })
+}
+
+describe("kimchictl logout", () => {
+	it("removes shared credentials with --force (both files, other entries preserved)", async () => {
+		const dir = makeTempDir()
+		const { home } = stubAgentDirEnv(dir)
+		seedCredentials(dir, home)
+		const { lines } = captureConsole()
+
+		expect(await runLogout(["--force"])).toBe(0)
+
+		expect(JSON.parse(readFileSync(join(dir, "auth.json"), "utf-8"))).toEqual({
+			anthropic: { type: "api_key", key: "keep" },
+		})
+		expect(JSON.parse(readFileSync(sharedConfigPath(home), "utf-8"))).toEqual({ other: true })
+		expect(lines.some((l) => l.includes("Logged out"))).toBe(true)
+	})
+
+	it("confirms via the prompt by default (interactive path)", async () => {
+		const dir = makeTempDir()
+		const { home } = stubAgentDirEnv(dir)
+		seedCredentials(dir, home)
+		const { errors } = captureConsole()
+
+		expect(await runLogout([], { confirm: async () => true })).toBe(0)
+		expect(errors[0]).toMatch(/also signs out the kimchi coding harness/)
+		expect(JSON.parse(readFileSync(sharedConfigPath(home), "utf-8"))).toEqual({ other: true })
+	})
+
+	it("leaves everything untouched when the confirmation is declined", async () => {
+		const dir = makeTempDir()
+		const { home } = stubAgentDirEnv(dir)
+		seedCredentials(dir, home)
+		const { lines } = captureConsole()
+
+		expect(await runLogout([], { confirm: async () => false })).toBe(0)
+
+		expect(lines.some((l) => l.includes("Aborted"))).toBe(true)
+		expect(JSON.parse(readFileSync(join(dir, "auth.json"), "utf-8"))["kimchi-dev"]).toBeDefined()
+		expect(JSON.parse(readFileSync(sharedConfigPath(home), "utf-8")).apiKey).toBe("key")
+	})
+
+	it("requires --force when non-interactive", async () => {
+		const dir = makeTempDir()
+		const { home } = stubAgentDirEnv(dir)
+		seedCredentials(dir, home)
+		const { errors } = captureConsole()
+
+		expect(await runLogout([], { interactive: false })).toBe(1)
+		expect(errors.some((l) => l.includes("--force"))).toBe(true)
+		expect(JSON.parse(readFileSync(join(dir, "auth.json"), "utf-8"))["kimchi-dev"]).toBeDefined()
+	})
+
+	it("reports when already logged out", async () => {
+		stubAgentDirEnv(makeTempDir())
+		const { lines } = captureConsole()
+		expect(await runLogout([])).toBe(0)
+		expect(lines).toEqual(["Not logged in."])
+	})
+})

package/src/commands/logout.ts

@@ -0,0 +1,53 @@
+import { clearSharedAuth, readSavedApiKey } from "../auth/auth-file.js"
+import { readApiKeyFromConfig, writeApiKeyToConfig } from "../auth/config-file.js"
+import { resolveAuthJsonPath, resolveConfigJsonPath } from "../auth/paths.js"
+import { parseFlags } from "./flags.js"
+import { confirm, isInteractive } from "./prompt.js"
+
+export interface LogoutDeps {
+	/** Confirmation override (tests). */
+	confirm?: () => Promise<boolean>
+	env?: NodeJS.ProcessEnv
+	/** Override TTY interactivity detection (tests). */
+	interactive?: boolean
+}
+
+/**
+ * `kimchictl logout` — remove the shared Kimchi credential from BOTH
+ * auth.json and config.json. This signs out the kimchi coding harness too
+ * (the credential is shared by design), which the user must acknowledge.
+ */
+export async function runLogout(args: string[], deps: LogoutDeps = {}): Promise<number> {
+	const { values } = parseFlags("logout", args, {
+		force: { type: "boolean", short: "f" },
+	})
+	const env = deps.env ?? process.env
+
+	const authPath = resolveAuthJsonPath(env)
+	const configPath = resolveConfigJsonPath(env)
+
+	const hasCredential = readSavedApiKey(authPath) !== undefined || readApiKeyFromConfig(configPath) !== undefined
+	if (!hasCredential) {
+		console.log("Not logged in.")
+		return 0
+	}
+
+	if (!values.force) {
+		console.error("This also signs out the kimchi coding harness (the login is shared).")
+		const interactive = deps.interactive ?? isInteractive()
+		const ok = await (deps.confirm ? deps.confirm() : interactive ? confirm("Log out everywhere? [y/N] ") : false)
+		if (!ok) {
+			if (!deps.confirm && !interactive) {
+				console.error("kimchictl logout: not interactive — re-run with --force to confirm")
+				return 1
+			}
+			console.log("Aborted.")
+			return 0
+		}
+	}
+
+	await clearSharedAuth(authPath)
+	writeApiKeyToConfig(configPath, undefined)
+	console.log("✓ Logged out of Kimchi (kimchictl and the kimchi harness).")
+	return 0
+}

package/src/commands/prompt.ts

@@ -0,0 +1,21 @@
+import { createInterface } from "node:readline/promises"
+
+/** True when an interactive prompt can be shown (both streams are terminals). */
+export function isInteractive(): boolean {
+	return Boolean(process.stdin.isTTY && process.stdout.isTTY)
+}
+
+/**
+ * Ask a y/N question on the TTY. Anything but exactly "y" or "yes"
+ * (case-insensitive) counts as no. Only call when isInteractive() — callers
+ * must supply the non-interactive fallback (`--force` hint or a default).
+ */
+export async function confirm(question: string): Promise<boolean> {
+	const rl = createInterface({ input: process.stdin, output: process.stdout })
+	try {
+		const answer = await rl.question(question)
+		return /^(y|yes)$/i.test(answer.trim())
+	} finally {
+		rl.close()
+	}
+}