@strato-dan/commit 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DAN Systems
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,232 @@
+<div align="center">
+
+<img src="assets/dan-mark.svg" alt="[DAN] COMMIT" width="84" height="84">
+
+# [DAN] COMMIT
+
+**Reads your real diff, writes a real commit message. One command, on your own machine.**
+
+[![CI](https://github.com/STRATO-DAN/dan-oss-commit/actions/workflows/ci.yml/badge.svg)](https://github.com/STRATO-DAN/dan-oss-commit/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/@strato-dan/commit.svg)](https://www.npmjs.com/package/@strato-dan/commit)
+[![runtime deps](https://img.shields.io/badge/runtime%20deps-0-2e9e56.svg)](#dependencies)
+[![docs](https://img.shields.io/badge/docs-README-blue.svg)](#use)
+[![license](https://img.shields.io/badge/license-MIT-informational.svg)](LICENSE)
+
+</div>
+
+> **⚡ Zero install · zero runtime dependencies.** No `npm install`, no build step —
+> `npx @strato-dan/commit` runs it and `npm test` tests it. Pure Node standard library (Node ≥ 18).
+> The **Generate** button uses an API key you already have (env var, not an install); everything
+> else works with no key. Full breakdown under [Dependencies](#dependencies).
+
+Analyses your real staged (or unstaged) changes and writes a real commit message from the real
+diff — not a template, not a guess. One command, no backend to deploy, runs entirely on your own
+machine against your own git repo.
+
+## Use
+
+```bash
+npx @strato-dan/commit
+```
+
+Run it inside any real git repository. It opens `http://127.0.0.1:4870` (loopback only — never
+reachable from another machine) showing:
+
+- the real repo/branch you're in
+- the real diff about to be committed (staged changes if any exist, otherwise unstaged)
+- a **Generate** button that sends that real diff to a real LLM and writes a real message
+- a **Commit** button that runs the real `git commit` with whatever message is in the box —
+  generated, edited, or written from scratch
+
+## Examples
+
+[`examples/read-diff-and-generate.mjs`](examples/read-diff-and-generate.mjs) uses this package's
+own library functions directly (no UI, no server) to read a real diff and generate a real commit
+message from it:
+
+```bash
+node examples/read-diff-and-generate.mjs            # against the current directory
+node examples/read-diff-and-generate.mjs /path/to/repo   # against any other real git repo
+```
+
+### Worked example (no API key needed to follow along)
+
+Create a throwaway repo, make a change, and run the example with **no API key set**. It prints the
+real diff, then tells you plainly that it's skipping generation because no key is configured — it
+never invents a message:
+
+```bash
+# a throwaway repo you can delete afterwards
+mkdir /tmp/dan-commit-demo && cd /tmp/dan-commit-demo
+git init -q -b main
+git config user.email dev@example.com && git config user.name Dev
+printf 'export function greet(name) {\n  return "Hello, " + name;\n}\n' > greet.js
+git add -A && git commit -q -m "Add greet function"
+
+# make a real change and stage it
+printf 'export function greet(name) {\n  if (!name) return "Hello there";\n  return "Hello, " + name + "!";\n}\n' > greet.js
+git add -A
+
+# from a checkout of this repo, point the example at that repo
+node examples/read-diff-and-generate.mjs /tmp/dan-commit-demo
+```
+
+Real output from exactly the steps above:
+
+```
+Repo: /tmp/dan-commit-demo
+Branch: main
+
+Real diff (staged), 241 chars:
+
+diff --git a/greet.js b/greet.js
+index 34bc9a3..226d3e8 100644
+--- a/greet.js
++++ b/greet.js
+@@ -1,3 +1,4 @@
+ export function greet(name) {
+-  return "Hello, " + name;
++  if (!name) return "Hello there";
++  return "Hello, " + name + "!";
+ }
+
+
+No ANTHROPIC_API_KEY or OPENAI_API_KEY set — skipping message generation.
+This is the same honest message the real UI shows; nothing is fabricated here.
+```
+
+## Tests
+
+Real unit + integration tests, run against a real temporary git repo (they shell out to the real
+`git` binary rather than mocking it), on Node's own built-in test runner — no install step and no
+dependencies to add:
+
+```bash
+npm test
+```
+
+Observed on the current tree: **12 tests, all passing**.
+
+```
+# tests 12
+# pass 12
+# fail 0
+```
+
+## Requirements
+
+- Node.js 18+
+- A real `git` repository
+- One of `ANTHROPIC_API_KEY` or `OPENAI_API_KEY` set in your environment, for the Generate
+  button. Everything else (reading the diff, committing) works without either key.
+
+```bash
+export ANTHROPIC_API_KEY=sk-ant-...
+# or
+export OPENAI_API_KEY=sk-...
+```
+
+## Configuration
+
+| Env var | Default | What it does |
+|---|---|---|
+| `DAN_OSS_COMMIT_PORT` | `4870` | Local port |
+| `DAN_OSS_COMMIT_MODEL` | provider default | Model name passed to the API |
+
+## What it never does
+
+- Never sends your diff anywhere except the LLM API you've configured, with your own key.
+- Never stages files you didn't ask it to (only stages everything if you tick the box, and only
+  when the diff shown was unstaged to begin with).
+- Never fabricates a commit message when no API key is set — it tells you plainly instead.
+- Never listens on anything but `127.0.0.1`.
+
+## When to use this
+
+- **Best fit**: you want a real, fast, drafted commit message from your actual diff, without
+  standing up a backend or sending anything anywhere except the LLM API you already have a key
+  for. Reading the diff and committing work with zero setup even without a key.
+- **Best fit**: you already have an Anthropic or OpenAI key for other work and want your commit
+  messages written from real content instead of typed from memory or left as `wip`.
+
+**Honest flip side**: if you want commit-message generation with *no* external API call at all —
+not even opt-in — this isn't the right fit today; there's no local/offline model option. If you
+need multi-provider comparison (generate from both Anthropic and OpenAI and pick), that's also not
+built — `configuredProvider()` picks one deterministically, it doesn't call both.
+
+## Dependencies
+
+**Runtime dependencies: none.** Pure Node standard library — nothing to install to run it or test it.
+
+| | |
+|---|---|
+| **Runtime dependencies** | **0** — Node standard library only |
+| **Install to run** | none — `npx @strato-dan/commit` |
+| **Install to test** | none — `npm test` uses Node's built-in test runner |
+| **Node** | ≥ 18 |
+| **API key** | `ANTHROPIC_API_KEY` **or** `OPENAI_API_KEY` — only for the **Generate** button, and it's your own existing key as an env var, not an installed package. Reading the diff and committing need no key. |
+| **Dev-only** | `husky` — pulled in only if you clone to contribute; never needed to use the tool |
+
+## Project contents
+
+| Path | What it is |
+|---|---|
+| `bin/dan-oss-commit.js` | The real CLI entry point — starts the server, opens your browser. |
+| `src/server.js` | The loopback-only HTTP server and its routes. |
+| `src/git.js` | Every real `git` call this tool makes (`execFile`, array args, never shell). |
+| `src/llm.js` | The real Anthropic/OpenAI API call that generates a commit message. |
+| `public/` | The plain HTML/CSS/vanilla-JS frontend served at `127.0.0.1`. |
+| `examples/` | Runnable example code using the library functions directly, no UI. |
+| `test/` | Real unit + integration tests (`npm test`, Node's own built-in test runner) — against a real temporary git repo, not a mocked one. |
+
+## FAQ
+
+**Does it work without an API key?** Yes — reading the real diff and committing both work with no
+key at all. Only the **Generate** button needs one.
+
+**Which LLM does it use?** Whichever of `ANTHROPIC_API_KEY` / `OPENAI_API_KEY` you have set. If
+both are set, `configuredProvider()` picks one deterministically (see `src/llm.js`) — it doesn't
+call both or let you choose per-request yet.
+
+**Can I use a local/self-hosted model instead?** Not yet. This is a real, current limitation, not
+a design decision to exclude it forever — a local-model provider is a reasonable future addition
+if there's real demand for it.
+
+**Does it work on Windows?** The server and git calls are cross-platform (Node stdlib + `git`
+itself). The browser auto-open now uses the standard-correct Windows invocation — `cmd /c start ""
+<url>` run through `execFile` with no shell (`start` is a `cmd` builtin, not an executable, so it
+has to run via `cmd`; the empty `""` is the window-title argument `start` expects). Honest caveat:
+this path hasn't yet been runtime-tested on a real Windows machine — it follows the
+documented-correct approach, but it's flagged as unverified rather than claimed as tested. The tool
+itself still starts and works regardless, since the browser open is best-effort and never the
+reason it fails to launch.
+
+**What happens with a merge conflict or a repo with zero commits yet?** It runs without crashing
+and surfaces git's own real output either way. On a repo with zero commits yet (`git init` run,
+nothing committed — an unborn HEAD), `currentBranch()` still reads the real branch name where
+`rev-parse --abbrev-ref HEAD` would fail — a real bug found and fixed during this tool's own build,
+and covered by a passing test, not an assumption. During a merge conflict, `git diff --staged`
+reports the unmerged path exactly as git itself does, so the tool shows git's real state rather
+than erroring.
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md)
+for how to file an issue or submit a PR. Maintainers may use AI tools to help review
+contributions — please don't include personal information in an issue, PR, or commit beyond
+what's needed to describe the change.
+
+## Releasing
+
+See [RELEASING.md](RELEASING.md) —
+the same version-bump/tag/publish process applies to every DAN-OSS tool, this one included.
+
+## License
+
+MIT (code) — see `LICENSE`. The "DAN" name and logo are trademarked and not covered by the MIT
+grant — see `TRADEMARK.md`.
+
+---
+
+**[DAN] MEMORY SMASH** — the full codebase-memory engine this tool's commit-analysis capability
+also lives inside — is coming soon.

package/TRADEMARK.md

@@ -0,0 +1,18 @@
+# Trademark & Branding Notice
+
+The MIT license in this repository (see `LICENSE`) covers the **source code only**.
+
+**"DAN"**, the **"[DAN]"** wordmark, and the DAN logo are trademarks of DAN Systems and are
+**not** part of the MIT grant.
+
+In practice:
+
+- ✅ You may fork this code, modify it, redistribute it, and use it in your own projects.
+- ❌ You may **not** strip the DAN name/logo and present the result as your own.
+- ❌ You may **not** use the DAN name or logo to market a fork or a derivative product without
+  written permission.
+- ✅ The code is free. The brand is not.
+
+This applies at every scale — from a single install onward, no threshold.
+
+If you're not sure whether your use is covered, ask before shipping it.

package/bin/dan-oss-commit.js

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+// [DAN] COMMIT — real CLI entry. Starts the local server (loopback only), opens the browser,
+// and exits cleanly on Ctrl-C. No global install required — `npx dan-oss-commit` in any real
+// git repo.
+import { listen } from "../src/server.js";
+import { execFile } from "node:child_process";
+
+const cwd = process.cwd();
+const port = Number(process.env.DAN_OSS_COMMIT_PORT) || 4870;
+
+const server = await listen(port, cwd);
+const url = `http://127.0.0.1:${port}`;
+
+console.log(`[DAN] COMMIT running at ${url}`);
+console.log(`Reading real changes in: ${cwd}`);
+console.log("Ctrl-C to stop.\n");
+
+// Best-effort browser open — never the reason the tool fails to start. execFile (no shell); on Windows
+// `start` is a cmd builtin, so it must run via cmd.exe rather than be exec'd as if it were a binary.
+const [openerCmd, openerArgs] =
+  process.platform === "darwin" ? ["open", [url]]
+    : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]]
+      : ["xdg-open", [url]];
+execFile(openerCmd, openerArgs, () => {});
+
+process.on("SIGINT", () => {
+  server.close(() => process.exit(0));
+});

package/examples/read-diff-and-generate.mjs

@@ -0,0 +1,38 @@
+// Real, runnable example — uses this package's own library functions directly, not the CLI/UI.
+// Run it from inside any real git repo (including this one):
+//
+//   node examples/read-diff-and-generate.mjs
+//   node examples/read-diff-and-generate.mjs /path/to/some/other/repo
+//
+// Shows the real diff dan-oss-commit would show you, and generates a real commit message from
+// it if you have ANTHROPIC_API_KEY or OPENAI_API_KEY set — same two functions the UI itself
+// calls, `realDiff` and `generateCommitMessage`, nothing re-implemented for the example.
+import { realDiff, currentBranch } from "../src/git.js";
+import { generateCommitMessage, configuredProvider } from "../src/llm.js";
+
+const cwd = process.argv[2] || process.cwd();
+
+const branch = await currentBranch(cwd);
+console.log(`Repo: ${cwd}`);
+console.log(`Branch: ${branch ?? "(detached HEAD)"}`);
+
+const { diff, source } = await realDiff(cwd);
+
+if (source === "none") {
+  console.log("No staged or unstaged changes — nothing to show or generate from.");
+  process.exit(0);
+}
+
+console.log(`\nReal diff (${source}), ${diff.length} chars:\n`);
+console.log(diff.slice(0, 2000) + (diff.length > 2000 ? "\n... (truncated for this example)" : ""));
+
+const provider = configuredProvider();
+if (!provider) {
+  console.log("\nNo ANTHROPIC_API_KEY or OPENAI_API_KEY set — skipping message generation.");
+  console.log("This is the same honest message the real UI shows; nothing is fabricated here.");
+  process.exit(0);
+}
+
+console.log(`\nGenerating a real commit message via ${provider}...`);
+const { message } = await generateCommitMessage(diff);
+console.log(`\nGenerated message:\n\n${message}`);

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@strato-dan/commit",
+  "version": "0.1.0",
+  "description": "[DAN] COMMIT — analyses your staged changes and writes a real commit message from the real diff. One command, no backend to deploy.",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "dan-oss-commit": "bin/dan-oss-commit.js"
+  },
+  "scripts": {
+    "prepare": "husky || true",
+    "test": "node --test test/*.test.mjs"
+  },
+  "devDependencies": {
+    "husky": "^9.1.7"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "files": [
+    "bin",
+    "src",
+    "public",
+    "examples",
+    "LICENSE",
+    "TRADEMARK.md"
+  ],
+  "keywords": [
+    "git",
+    "commit-message",
+    "ai",
+    "cli",
+    "developer-tools"
+  ],
+  "author": "DAN Systems",
+  "homepage": "https://github.com/STRATO-DAN/dan-oss-commit",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/STRATO-DAN/dan-oss-commit.git"
+  }
+}

package/public/app.js

@@ -0,0 +1,169 @@
+// [DAN] COMMIT — real client logic. No framework, plain fetch + DOM, matching the "plain
+// HTML/CSS/JS" spec this tool is built to.
+
+const $ = (id) => document.getElementById(id);
+let currentSource = "none";
+
+function escapeHtml(s) {
+  return s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]));
+}
+
+// Light diff highlighting — colour only, per real unified-diff line prefix. Never changes the text.
+function renderDiff(text) {
+  return text.split("\n").map((line) => {
+    let cls = "";
+    if (line.startsWith("+++") || line.startsWith("---") || line.startsWith("diff ") || line.startsWith("index ")) cls = "meta";
+    else if (line.startsWith("@@")) cls = "hunk";
+    else if (line.startsWith("+")) cls = "add";
+    else if (line.startsWith("-")) cls = "del";
+    const safe = escapeHtml(line);
+    return cls ? `<span class="${cls}">${safe}</span>` : safe;
+  }).join("\n");
+}
+
+// Summary-line char count (git convention: <=50 ideal, >72 too long) + copy-button enablement.
+function updateMsgMeta() {
+  const v = $("message").value;
+  const n = v.split("\n")[0].length;
+  const el = $("charCount");
+  el.textContent = `${n} character${n === 1 ? "" : "s"} in the summary line` + (n > 72 ? " — over 72, consider shortening" : "");
+  el.style.color = n > 72 ? "var(--dan-red)" : "";
+  $("copyMsg").disabled = !v.trim();
+}
+
+async function loadStatus() {
+  const res = await fetch("/api/status");
+  const data = await res.json();
+  if (!data.isRepo) {
+    $("status").textContent = `${data.cwd} is not a real git repository.`;
+    return false;
+  }
+  const branch = data.branch ? escapeHtml(data.branch) : "(no branch yet)";
+  const commitsNote = data.hasCommits ? "" : " — no commits yet";
+  // Real local absolute path (carries the OS username on most machines) never rendered — the
+  // repo's own folder name is enough context, matching this product's own "privacy is the
+  // architecture" line rather than leaking a filesystem detail nobody asked to see.
+  const rawRepoName = data.cwd.split("/").filter(Boolean).pop() || "this repo";
+  // Real trademark rule, not cosmetic: "DAN" never appears bare, always bracketed (TRADEMARK.md).
+  // A folder literally named "DAN-something" would otherwise print the one bare "DAN" on the
+  // whole page — render it as the real product-name form instead of the raw folder slug.
+  const danMatch = rawRepoName.match(/^DAN[-_](.+)$/i);
+  const repoName = danMatch
+    ? `<span class="dan-br">[</span>DAN<span class="dan-br">]</span> ${escapeHtml(danMatch[1].replace(/[-_]/g, " "))}`
+    : escapeHtml(rawRepoName);
+  $("status").innerHTML = `<strong>${branch}</strong>${commitsNote} — ${repoName}` +
+    (data.provider ? "" : ` <span style="color: var(--dan-red)">— no ANTHROPIC_API_KEY / OPENAI_API_KEY set, Generate will fail honestly until one is</span>`);
+
+  // Real disclosure, not a placeholder: names the ACTUAL configured provider, since "on-device" /
+  // "privacy is the architecture" sits right above this action in the sidebar and Generate
+  // genuinely does send your diff to a real third-party cloud API with your own key — say so
+  // plainly rather than let that read as a contradiction.
+  const providerName = data.provider === "anthropic" ? "Anthropic" : data.provider === "openai" ? "OpenAI" : null;
+  $("providerDisclosure").textContent = providerName
+    ? `Generate sends your real diff to ${providerName}'s API, using your own key. Nothing else reads it.`
+    : "";
+  return true;
+}
+
+async function loadDiff() {
+  const res = await fetch("/api/diff");
+  const data = await res.json();
+  if (!data.ok) {
+    $("diff").textContent = data.reason;
+    return;
+  }
+  currentSource = data.source;
+  if (data.source === "none") {
+    $("diff").textContent = "No real changes — nothing staged, nothing unstaged.";
+    $("files").innerHTML = "";
+    return;
+  }
+  $("diff").innerHTML = renderDiff(data.diff);
+  $("files").innerHTML = data.files
+    .map((f) => `<li><span class="file-status ${f.status[0]}">${f.status[0]}</span><span>${escapeHtml(f.path)}</span></li>`)
+    .join("") + `<li class="hint" style="margin-top:6px;">source: ${data.source}</li>`;
+}
+
+async function generate() {
+  const btn = $("generate");
+  const status = $("genStatus");
+  btn.disabled = true;
+  status.innerHTML = `<span class="dan-seal"></span> Reading the real diff and asking the real model…`;
+  try {
+    const diffRes = await fetch("/api/diff");
+    const diffData = await diffRes.json();
+    if (!diffData.ok || diffData.source === "none") {
+      status.textContent = "No real changes to describe.";
+      return;
+    }
+    const res = await fetch("/api/generate", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ diff: diffData.diff }),
+    });
+    const data = await res.json();
+    if (!data.ok) {
+      status.textContent = data.reason;
+      return;
+    }
+    $("message").value = data.message;
+    $("commit").disabled = false;
+    updateMsgMeta();
+    status.textContent = `Generated via ${data.provider}${data.truncated ? " (diff truncated for length)" : ""}.`;
+  } catch (err) {
+    status.textContent = `Failed: ${err.message}`;
+  } finally {
+    btn.disabled = false;
+  }
+}
+
+async function commit() {
+  const status = $("commitStatus");
+  const message = $("message").value.trim();
+  if (!message) {
+    status.textContent = "Write or generate a message first.";
+    return;
+  }
+  const stageAll = $("stageAll").checked && currentSource === "unstaged";
+  $("commit").disabled = true;
+  status.textContent = "Committing…";
+  try {
+    const res = await fetch("/api/commit", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ message, stageAll }),
+    });
+    const data = await res.json();
+    if (!data.ok) {
+      status.textContent = data.reason;
+      $("commit").disabled = false;
+      return;
+    }
+    status.innerHTML = `Committed — <strong>${data.sha}</strong>`;
+    $("message").value = "";
+    updateMsgMeta();
+    await loadDiff();
+  } catch (err) {
+    status.textContent = `Failed: ${err.message}`;
+    $("commit").disabled = false;
+  }
+}
+
+$("generate").addEventListener("click", generate);
+$("commit").addEventListener("click", commit);
+$("message").addEventListener("input", () => { $("commit").disabled = !$("message").value.trim(); updateMsgMeta(); });
+$("copyMsg").addEventListener("click", async () => {
+  const btn = $("copyMsg");
+  try {
+    await navigator.clipboard.writeText($("message").value);
+    btn.textContent = "Copied ✓";
+  } catch {
+    btn.textContent = "Copy failed";
+  }
+  setTimeout(() => { btn.textContent = "Copy"; }, 1400);
+});
+
+(async () => {
+  const ok = await loadStatus();
+  if (ok) await loadDiff();
+})();

package/public/fonts/LICENSES.md

@@ -0,0 +1,24 @@
+# [DAN] BRAND PACK v1 — font licences
+
+All three bundled fonts are **SIL Open Font License 1.1**, which permits redistribution
+and bundling, including in commercial products, provided the fonts are not sold on their
+own and the licence travels with them.
+
+| font | licence | upstream |
+|---|---|---|
+| JetBrains Mono | SIL OFL 1.1 | JetBrains |
+| Doto | SIL OFL 1.1 | Google Fonts |
+| Inter | SIL OFL 1.1 | Rasmus Andersson |
+
+Latin subset only, retrieved 2026-07-24, verified `wOF2` magic on every file.
+
+## 🔴 NOT BUNDLED, AND MUST NEVER BE
+
+**SF Pro / SF Pro Display / SF Mono — Apple.** Licensed for use *on Apple systems*, not for
+redistribution. We reference them through the system font stack, where the OS supplies them,
+which is free and correct. **Putting an SF Pro file in this folder would be a licence
+breach.** Same for Segoe UI (Microsoft) — referenced, never shipped.
+
+The rule generalises: **bundle only OFL/Apache/MIT-licensed faces; reference everything else
+through the system stack.** Any new font added here needs its licence checked and recorded
+in this table first.

package/public/icons.js

@@ -0,0 +1,55 @@
+// [DAN] COMMIT — dot-matrix icons, copied deliberately (same "copy, don't cross-repo-depend"
+// discipline as style.css's own fonts/tokens) from DAN's own
+// internal brand-pack source of truth, not cross-repo-linked. Only the four concepts this page
+// actually uses are ported, not the whole matched-icon-set library — this is a static site with
+// four fixed section headers, not a product that needs the full icon vocabulary.
+//
+// Real convention this preserves: "line" form (SVG) for buttons/menus/nav, "dot" form
+// (bitmap-grid) for status/brand/hero moments — this page uses dot form for its section
+// headers, matching what a brand-pack "hero" label calls for over a plain SVG glyph.
+(function () {
+  var RED = "#f25b4f", OK = "#2e9e56";
+  var ACCENT = { on: "currentColor", ok: OK, red: RED };
+
+  // [name, 7x7 dot bitmap, accent] — exact bitmaps copied from the canonical source, not redrawn.
+  var ICONS = {
+    folder: { rows: ["0000000","1110000","1111110","1000010","1000010","1111110","0000000"], accent: "on" },
+    doc:    { rows: ["1111100","1000110","1000101","1000001","1000001","1000001","1111111"], accent: "on" },
+    code:   { rows: ["0000000","0010010","0100100","1001000","0100100","0010010","0000000"], accent: "on" },
+    check:  { rows: ["0000000","0000010","0000110","1001100","1011000","0110000","0000000"], accent: "ok" },
+  };
+
+  function dot(name, px) {
+    var e = ICONS[name];
+    if (!e) return "";
+    px = px || 12;
+    var acc = ACCENT[e.accent] || "currentColor";
+    var cols = e.rows[0].length;
+    var gap = Math.max(1, Math.round(px * 0.42));
+    var out = '<span class="dan-idg" style="grid-template-columns:repeat(' + cols + ',' + px + 'px);gap:' + gap + 'px">';
+    e.rows.join("").split("").forEach(function (c) {
+      var fill = c === "1" ? acc : null;
+      out += '<i class="dan-idp" style="width:' + px + 'px;height:' + px + 'px;' +
+        (fill ? "background:" + fill : "box-shadow:inset 0 0 0 1px rgba(128,128,128,.30)") + '"></i>';
+    });
+    return out + "</span>";
+  }
+
+  window.DANIcons = { dot: dot };
+
+
+  // [DAN] brand favicon — red brackets · white DAN · charcoal ground. Injected from this one
+  // shared script so every page carries the mark without a per-file <link> to forget.
+  (function () {
+    if (document.querySelector('link[rel="icon"]')) return;
+    var svg = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">' +
+      '<rect width="64" height="64" rx="13" fill="#1e1e22"/>' +
+      '<text x="32" y="41" text-anchor="middle" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-weight="800" font-size="21" letter-spacing="-1">' +
+      '<tspan fill="#f25b4f">[</tspan><tspan fill="#ffffff">DAN</tspan><tspan fill="#f25b4f">]</tspan>' +
+      '</text></svg>';
+    var link = document.createElement("link");
+    link.rel = "icon"; link.type = "image/svg+xml";
+    link.href = "data:image/svg+xml," + encodeURIComponent(svg);
+    document.head.appendChild(link);
+  })();
+})();

package/public/index.html

@@ -0,0 +1,87 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>[DAN] COMMIT</title>
+<link rel="stylesheet" href="/style.css">
+<script src="/icons.js"></script>
+</head>
+<body>
+  <header>
+    <a class="dan-logo" href="/"><span class="dan-br">[</span>DAN<span class="dan-br">]</span> COMMIT</a>
+    <span class="tagline">Real diff in. Real commit message out.</span>
+  </header>
+
+  <aside class="intro-box">
+    <p class="intro-heading dan-dot">Sovereign <span class="dan-br">[</span>AI<span class="dan-br">]</span> system of <span class="dan-br">[</span>Systems<span class="dan-br">]</span></p>
+    <p><span class="dan-br">[</span>DAN<span class="dan-br">]</span> is a sovereign AI system of
+      systems — the Digital Architecture Network. Built edge-first, on-device, in the UAE.</p>
+    <p class="intro-strong">Privacy is the architecture, not the afterthought.</p>
+    <p class="intro-mono dan-dot">
+      <span class="dan-br">[</span>DAN<span class="dan-br">]</span> — DIGITAL ARCHITECTURE NETWORK, LET'S GO <span class="dan-br">[</span>BEYOND<span class="dan-br">]</span>
+    </p>
+    <p class="intro-mono">
+      STRATO MESH NETWORK<br>
+      <span class="site-text">www.thedubai.ai</span>
+    </p>
+  </aside>
+
+  <div class="layout">
+  <main>
+    <div class="dan-card">
+      <h2><span id="icon-repo"></span>Repo</h2>
+      <div id="status">Reading real repo state…</div>
+    </div>
+
+    <div class="dan-card">
+      <h2><span id="icon-files"></span>Changed files</h2>
+      <ul class="file-list" id="files"></ul>
+    </div>
+
+    <div class="dan-card">
+      <h2><span id="icon-diff"></span>Real diff</h2>
+      <pre class="diff" id="diff">Reading the real diff…</pre>
+    </div>
+
+    <div class="dan-card">
+      <h2><span id="icon-commit"></span>Commit message</h2>
+      <p class="hint" id="providerDisclosure"></p>
+      <div class="actions">
+        <button class="dan-btn" id="generate">Generate from the real diff</button>
+        <span class="hint" id="genStatus"></span>
+      </div>
+      <div style="margin-top: 14px;">
+        <textarea id="message" placeholder="Write your own, or click Generate above."></textarea>
+        <div class="msg-meta">
+          <span class="hint" id="charCount">0 characters in the summary line</span>
+          <button class="dan-btn-ghost" id="copyMsg" disabled>Copy</button>
+        </div>
+      </div>
+      <div class="actions">
+        <button class="dan-btn" id="commit" disabled>Commit</button>
+        <label class="hint"><input type="checkbox" id="stageAll"> stage all changes first (unstaged diff only)</label>
+        <span class="hint" id="commitStatus"></span>
+      </div>
+    </div>
+  </main>
+  </div>
+
+  <footer>
+    <strong><span class="dan-br">[</span>DAN<span class="dan-br">]</span> MEMORY SMASH</strong> —
+    the full codebase-memory engine this tool's commit-analysis capability also lives inside —
+    is coming soon.
+  </footer>
+
+  <script>
+    // px=3 — a small inline glyph beside an h2 label, not the sidebar's own headline-scale use
+    // of the dot font. At the library's default (12px/cell) a 7-wide icon renders ~100px, far
+    // bigger than the text it's meant to sit beside — this stacked it above the heading instead.
+    document.getElementById("icon-repo").innerHTML = DANIcons.dot("folder", 3);
+    document.getElementById("icon-files").innerHTML = DANIcons.dot("doc", 3);
+    document.getElementById("icon-diff").innerHTML = DANIcons.dot("code", 3);
+    document.getElementById("icon-commit").innerHTML = DANIcons.dot("check", 3);
+  </script>
+  <script type="module" src="/app.js"></script>
+</body>
+</html>

package/public/style.css

@@ -0,0 +1,242 @@
+/* [DAN] COMMIT — brand tokens + fonts copied deliberately from DAN's own brand source of
+   truth, same "copy, verify, don't cross-repo-depend" discipline. Fonts are the real,
+   self-hosted OFL files (public/fonts/, LICENSES.md alongside) — no external font fetch, same
+   "no third-party beacon on a page whose pitch is privacy" reasoning the source file states.
+
+   🔴 NO GREY TEXT — every foreground is full ink (--dan-text), never --dan-text-2/--dan-text-3.
+   De-emphasis comes from size/weight, not colour. Red is the one signal colour, theme-invariant. */
+@font-face {
+  font-family: "JetBrains Mono";
+  src: url("fonts/JetBrainsMono-latin.woff2") format("woff2");
+  font-weight: 100 800;
+  font-style: normal;
+  font-display: swap;
+}
+@font-face {
+  font-family: "Doto";
+  src: url("fonts/Doto-latin.woff2") format("woff2");
+  font-weight: 100 900;
+  font-style: normal;
+  font-display: swap;
+}
+
+:root {
+  /* native controls (number spinners, <select> arrow, scrollbars) follow the theme */
+  color-scheme: light dark;
+  --dan-red: #f25b4f;
+  --dan-font: -apple-system, BlinkMacSystemFont, "SF Pro Display", "Segoe UI Variable Text",
+    "Segoe UI", Roboto, Ubuntu, Cantarell, "Noto Sans", system-ui, sans-serif;
+  --dan-mono: "JetBrains Mono", ui-monospace, SFMono-Regular, "SF Mono", "Cascadia Mono",
+    Consolas, "DejaVu Sans Mono", "Liberation Mono", monospace;
+  --dan-dot: "Doto", "JetBrains Mono", ui-monospace, "Cascadia Mono", Consolas,
+    "DejaVu Sans Mono", monospace;
+
+  --dan-bg: #f5f5f3;
+  --dan-bg-2: #ffffff;
+  --dan-text: #16161a;
+  --dan-border: rgba(0, 0, 0, 0.12);
+  --dan-border-2: rgba(0, 0, 0, 0.2);
+  --dan-btn-text: #ffffff;
+  --dan-ok: #2e9e56;
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+    --dan-bg: #1b1b1f;
+    --dan-bg-2: #232329;
+    --dan-text: #f5f5f7;
+    --dan-border: rgba(255, 255, 255, 0.12);
+    --dan-border-2: rgba(255, 255, 255, 0.2);
+    --dan-btn-text: #0e0e11;
+    --dan-ok: #3ecb72;
+  }
+}
+
+* { box-sizing: border-box; }
+html, body { margin: 0; }
+/* 🔴 REAL BUG FOUND + FIXED: `height: 100%` + `display: flex; flex-direction: column` clips a
+   flex child to the viewport's own height instead of letting it grow — once real page content
+   (cards + diff + footer) got taller than one screen, the footer stopped following it in normal
+   flow and rendered floating mid-page, overlapping the Commit-message card. `min-height` lets the
+   body grow past the viewport when real content needs more room, same as a plain (non-flex) page
+   already would. */
+html, body { min-height: 100%; }
+/* Real scrollbar ink, same "no grey, full ink" rule as everything else — the default OS
+   scrollbar (dark thumb on a light track, or invisible-in-dark-mode in some browsers) doesn't
+   follow the page's own theme reliably, so this states it explicitly for both engines. */
+* { scrollbar-color: var(--dan-text) var(--dan-bg-2); scrollbar-width: thin; }
+*::-webkit-scrollbar { width: 10px; height: 10px; }
+*::-webkit-scrollbar-track { background: var(--dan-bg-2); }
+*::-webkit-scrollbar-thumb { background: var(--dan-text); border-radius: 6px; border: 2px solid var(--dan-bg-2); }
+/* 🔴 REAL BUG FOUND + FIXED: `.layout { flex: 1 }` inside a flex column body grows to fill
+   leftover vertical space below short page content — real space, so selecting text and dragging
+   (or a keyboard select-all) paints the selection highlight across that empty box too, all the
+   way down to the footer/viewport edge, not just the text. Grid rows (auto content / 1fr / auto)
+   give the exact same "push the footer down" behavior without a flex item that grows past its own
+   content, so there's no leftover box for the browser to paint a selection into. */
+body {
+  background: var(--dan-bg);
+  color: var(--dan-text);
+  font-family: var(--dan-font);
+  line-height: 1.45;
+  -webkit-font-smoothing: antialiased;
+  display: grid;
+  grid-template-rows: auto 1fr auto;
+  min-height: 100vh;
+}
+
+.dan-br { color: var(--dan-red); }
+.dan-logo { font-family: var(--dan-mono); font-weight: 800; font-size: 22px; letter-spacing: 0.02em; color: var(--dan-text); text-decoration: none; }
+.dan-logo .dan-br { margin: 0 0.1em; }
+
+header {
+  height: 54px; box-sizing: border-box; display: flex; align-items: center;
+  justify-content: space-between; padding: 0 20px; border-bottom: 1px solid var(--dan-border);
+  flex-shrink: 0;
+}
+header .tagline { font-size: 12.5px; font-weight: 600; }
+
+.layout {
+  padding: 16px 20px; min-height: 0;
+}
+
+/* 🔴 the red box — real company intro, pinned to the TRUE viewport edge (not the centered
+   content column's own edge) and wide enough to hold the tagline on one real line. Fixed, not
+   in-flow, so it never fights the centered `.layout` column for width; `.layout` gets real
+   left padding on the same breakpoint so its own content never sits under it. Hidden below that
+   breakpoint so mobile stays one column, same as before. */
+.intro-box {
+  /* 🔴 REAL BUG FOUND + FIXED: the sidebar sat flush under the header (top: 54px) while the first
+     real card sat 16px lower (`.layout`'s own top padding) — their top EDGES never lined up,
+     verified via getBoundingClientRect (70 vs 54). top: 86px matches that same offset now that the
+     box floats 16px in from the edges instead of sitting flush against them (see below). */
+  position: fixed; left: 16px; top: 86px; bottom: 16px; width: 352px; overflow-y: auto;
+  border: 1px solid var(--dan-red); border-radius: 14px;
+  box-shadow: 0 2px 14px rgba(0, 0, 0, 0.07);
+  padding: 22px; background: color-mix(in srgb, var(--dan-red) 7%, var(--dan-bg-2));
+  font-size: 12.5px; line-height: 1.55;
+}
+.intro-box p { margin: 0 0 12px; }
+.intro-box p:last-child { margin-bottom: 0; }
+.intro-heading { font-weight: 700; letter-spacing: 0.015em; font-size: 11.5px; white-space: nowrap; }
+.intro-strong { font-weight: 700; }
+.intro-mono { font-family: var(--dan-mono); font-size: 11px; letter-spacing: 0.02em; }
+.intro-mono.dan-dot { font-size: 9.5px; letter-spacing: 0.01em; white-space: nowrap; }
+.site-text { color: var(--dan-text); } /* real text, not a hyperlink — never navigates */
+@media (max-width: 940px) { .intro-box { display: none; } }
+
+/* [DAN] dot-matrix accent — the brand pack's own `.dan-dot` label/tagline treatment, real font
+   (self-hosted Doto, public/fonts/), sized big per spec rather than the pack's own small-label
+   default, since this is the page's own headline moment, not a small inline tag. */
+.dan-dot { font-family: var(--dan-dot); font-weight: 900; text-transform: uppercase; letter-spacing: 0.05em; color: var(--dan-text); }
+.dan-dot .dan-br { margin: 0 0.05em; }
+
+main { max-width: 720px; margin: 0 auto; }
+
+.dan-card {
+  background: var(--dan-bg-2); border: 1px solid var(--dan-border); border-radius: 14px;
+  padding: 14px 16px; margin-bottom: 12px;
+}
+
+.dan-btn {
+  display: inline-flex; align-items: center; justify-content: center; gap: 8px;
+  background: var(--dan-red); color: #1b1b20; font-family: var(--dan-font);
+  font-size: 14px; font-weight: 600; padding: 12px 20px; border-radius: 10px;
+  text-decoration: none; border: 0; cursor: pointer; transition: opacity 0.2s, transform 0.2s;
+}
+.dan-btn:hover { opacity: 0.9; transform: translateY(-1px); }
+.dan-btn:disabled { opacity: 0.4; cursor: not-allowed; transform: none; }
+
+.dan-btn-ghost {
+  display: inline-flex; align-items: center; gap: 8px; font-family: var(--dan-mono);
+  font-size: 12px; font-weight: 600; letter-spacing: 0.05em; color: var(--dan-text);
+  border: 1px solid var(--dan-border-2); border-radius: 8px; padding: 9px 16px;
+  background: transparent; cursor: pointer;
+}
+.dan-btn-ghost:hover { border-color: var(--dan-red); color: var(--dan-red); }
+
+h1 { font-size: 20px; margin: 0 0 4px; }
+h2 {
+  font-size: 14px; font-weight: 700; margin: 0 0 10px; text-transform: uppercase; letter-spacing: 0.04em;
+  display: flex; align-items: center; gap: 8px;
+}
+
+/* Dot-matrix icon grid — matches the brand pack's own `.dan-idg`/`.dan-idp` render shape
+   (dan-icons.js's `dot()`), same pixel-cell technique, ported into public/icons.js above. */
+.dan-idg { display: inline-grid; vertical-align: middle; }
+.dan-idp { border-radius: 50%; display: block; }
+
+.file-list { list-style: none; margin: 0; padding: 0; font-family: var(--dan-mono); font-size: 12.5px; }
+.file-list li { display: flex; gap: 10px; padding: 3px 0; }
+.file-status { width: 14px; text-align: center; font-weight: 700; }
+.file-status.M { color: var(--dan-text); }
+.file-status.A { color: var(--dan-ok); }
+.file-status.D { color: var(--dan-red); }
+
+pre.diff {
+  background: var(--dan-bg); border: 1px solid var(--dan-border); border-radius: 10px;
+  padding: 10px 12px; font-family: var(--dan-mono); font-size: 11.5px; overflow-x: auto;
+  max-height: 160px; overflow-y: auto; white-space: pre-wrap; word-break: break-word;
+}
+/* light syntax highlighting on the real diff — added/removed/hunk lines, colour only. */
+pre.diff .add  { color: #2e9e56; }
+pre.diff .del  { color: var(--dan-red); }
+pre.diff .hunk { color: #2563eb; font-weight: 600; }
+pre.diff .meta { opacity: 0.65; }
+@media (prefers-color-scheme: dark) {
+  pre.diff .add  { color: #3ecb72; }
+  pre.diff .hunk { color: #5b8cff; }
+}
+
+/* summary char-count + copy button under the message box */
+.msg-meta { display: flex; justify-content: space-between; align-items: center; gap: 10px; margin-top: 8px; }
+.msg-meta .hint { font-variant-numeric: tabular-nums; }
+
+textarea#message {
+  width: 100%; min-height: 70px; font-family: var(--dan-mono); font-size: 13px;
+  background: var(--dan-bg); color: var(--dan-text); border: 1px solid var(--dan-border);
+  border-radius: 10px; padding: 10px 12px; resize: vertical;
+}
+textarea#message:focus { outline: none; border-color: var(--dan-red); }
+
+.actions { display: flex; gap: 10px; align-items: center; margin-top: 12px; flex-wrap: wrap; }
+.hint { font-size: 13.5px; font-weight: 500; }
+#providerDisclosure { margin: 0 0 10px; }
+#providerDisclosure:empty { display: none; }
+.actions label.hint { display: inline-flex; align-items: center; gap: 7px; }
+.actions label.hint input[type="checkbox"] { width: 17px; height: 17px; accent-color: var(--dan-red); }
+
+.dan-seal { --dan-sz: 16px; display: inline-block; width: var(--dan-sz); height: var(--dan-sz);
+  border-radius: 50%; vertical-align: middle;
+  background: conic-gradient(from 0deg, transparent 0 62%, var(--dan-red) 85%, transparent 92%);
+  -webkit-mask: radial-gradient(closest-side, transparent 62%, #000 63%);
+  mask: radial-gradient(closest-side, transparent 62%, #000 63%);
+  animation: dan-seal-spin 0.9s linear infinite;
+}
+@keyframes dan-seal-spin { to { transform: rotate(1turn); } }
+.hidden { display: none !important; }
+
+footer {
+  padding: 20px 20px 40px; border-top: 1px solid var(--dan-border);
+  font-size: 12.5px; font-weight: 500;
+}
+footer a { color: var(--dan-red); text-decoration: none; }
+footer a:hover { text-decoration: underline; }
+footer p { margin: 0 0 12px; }
+footer .footer-brand { font-family: var(--dan-mono); font-size: 11.5px; letter-spacing: 0.02em; }
+
+/* 🔴 REAL BUG FOUND + FIXED: this override must come AFTER the base `.layout`/`footer` rules in
+   source order — CSS media queries carry no special cascade priority of their own, so an earlier
+   media-query rule loses to a later plain rule of equal specificity regardless of which one is
+   "supposed" to win. footer's own shorthand `padding` (declared later, in the base rules above)
+   was silently resetting this block's `padding-left` back to 20px every time. Real fix: put
+   width-dependent overrides at the END of the file, where the cascade actually respects them. */
+@media (min-width: 941px) {
+  /* 🔴 REAL BUG FOUND + FIXED: this used to be `padding-left: 400px` on TOP of `.layout`'s own
+     `margin: 0 auto` centering in the FULL viewport width — the two never agreed, leaving a real,
+     unexplained ~180px dead gap between the sidebar's own right edge (380px) and where the cards
+     actually started (560px on a 1280px screen). `margin-left` on the outer `.layout`/`footer`
+     containers offsets them by exactly the sidebar's real width; `main`'s own `margin: 0 auto`
+     then centers the cards in whatever space genuinely remains, not in the full viewport. */
+  .layout { margin-left: 392px; }
+  footer { margin-left: 392px; }
+}

package/src/git.js

@@ -0,0 +1,86 @@
+// Real git access only — every function here shells out to the user's own `git`, never
+// re-implements git's own diff/status logic. execFile, not exec: arguments are passed as a
+// real array, never interpolated into a shell string, so a branch/file name can never be
+// read as a shell command.
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const run = promisify(execFile);
+
+async function git(cwd, args) {
+  try {
+    const { stdout } = await run("git", args, { cwd, maxBuffer: 1024 * 1024 * 32 });
+    return stdout;
+  } catch (err) {
+    // A real git failure (not a repo, git missing, bad ref) carries useful stderr — surface
+    // it rather than swallowing it into a generic "something went wrong".
+    const detail = err.stderr?.trim() || err.message;
+    throw new Error(`git ${args.join(" ")} failed: ${detail}`);
+  }
+}
+
+export async function isRepo(cwd) {
+  try {
+    await git(cwd, ["rev-parse", "--is-inside-work-tree"]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** The real diff to commit — staged changes if any exist, otherwise all unstaged changes.
+ * Never both silently combined: the caller is told which one it got, so "nothing staged, used
+ * unstaged instead" is a visible fact, not a guess. */
+export async function realDiff(cwd) {
+  const staged = await git(cwd, ["diff", "--staged"]);
+  if (staged.trim()) {
+    return { diff: staged, source: "staged" };
+  }
+  const unstaged = await git(cwd, ["diff"]);
+  return { diff: unstaged, source: unstaged.trim() ? "unstaged" : "none" };
+}
+
+export async function changedFiles(cwd, source) {
+  const args = source === "staged" ? ["diff", "--staged", "--name-status"] : ["diff", "--name-status"];
+  const out = await git(cwd, args);
+  return out
+    .split("\n")
+    .filter(Boolean)
+    .map((line) => {
+      const [status, ...rest] = line.split("\t");
+      return { status, path: rest.join("\t") };
+    });
+}
+
+/** Real commit — stages everything first only if the caller explicitly asked for "unstaged"
+ * source (so the message that was generated from those changes is what actually gets
+ * committed); never silently stages files the diff shown to the user didn't cover. */
+export async function realCommit(cwd, message, { stageAll } = {}) {
+  if (stageAll) {
+    await git(cwd, ["add", "-A"]);
+  }
+  await git(cwd, ["commit", "-m", message]);
+  const sha = (await git(cwd, ["rev-parse", "--short", "HEAD"])).trim();
+  return { sha };
+}
+
+/** `symbolic-ref`, not `rev-parse --abbrev-ref HEAD` — the latter needs HEAD to resolve to a
+ * real commit and fails on a genuinely valid state this tool must still handle: a fresh repo
+ * with `git init` run and nothing committed yet (HEAD is unborn, but the branch name is real and
+ * readable straight from .git/HEAD). */
+export async function currentBranch(cwd) {
+  try {
+    return (await git(cwd, ["symbolic-ref", "--short", "HEAD"])).trim();
+  } catch {
+    return null; // detached HEAD or something symbolic-ref genuinely can't name — honest null, not a guess
+  }
+}
+
+export async function hasCommits(cwd) {
+  try {
+    await git(cwd, ["rev-parse", "--verify", "HEAD"]);
+    return true;
+  } catch {
+    return false;
+  }
+}

package/src/llm.js

@@ -0,0 +1,94 @@
+// Real LLM call, provider-agnostic on purpose — this is a standalone open-source tool with NO
+// tie-in to DAN's own infrastructure (per the product's own locked strategy), so it must work
+// with whatever real API key the end user already has, never a DAN-hosted key or endpoint.
+//
+// Real, honest failure: no key configured is a clear, actionable error, never a silent fallback
+// to a fabricated commit message.
+
+const SYSTEM_PROMPT = `You write git commit messages from a real diff. Rules:
+- First line: a real, specific summary in the imperative mood ("Fix", "Add", "Remove"), under 72 chars.
+- Blank line, then body only if the diff needs more than the summary to explain WHY, not WHAT (the diff already shows what changed).
+- Never invent a reason not visible in the diff. If the "why" isn't clear from the code, describe the change plainly instead of guessing motive.
+- No markdown, no trailing period on the summary line, no AI/tool attribution of any kind.`;
+
+async function callAnthropic(apiKey, diff) {
+  const res = await fetch("https://api.anthropic.com/v1/messages", {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      "x-api-key": apiKey,
+      "anthropic-version": "2023-06-01",
+    },
+    body: JSON.stringify({
+      model: process.env.DAN_OSS_COMMIT_MODEL || "claude-sonnet-5",
+      max_tokens: 400,
+      system: SYSTEM_PROMPT,
+      messages: [{ role: "user", content: `Real diff:\n\n${diff}` }],
+    }),
+  });
+  if (!res.ok) {
+    throw new Error(`Anthropic API error ${res.status}: ${await res.text()}`);
+  }
+  const data = await res.json();
+  return data.content?.[0]?.text?.trim() ?? "";
+}
+
+async function callOpenAI(apiKey, diff) {
+  const res = await fetch("https://api.openai.com/v1/chat/completions", {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${apiKey}`,
+    },
+    body: JSON.stringify({
+      model: process.env.DAN_OSS_COMMIT_MODEL || "gpt-4o-mini",
+      max_tokens: 400,
+      messages: [
+        { role: "system", content: SYSTEM_PROMPT },
+        { role: "user", content: `Real diff:\n\n${diff}` },
+      ],
+    }),
+  });
+  if (!res.ok) {
+    throw new Error(`OpenAI API error ${res.status}: ${await res.text()}`);
+  }
+  const data = await res.json();
+  return data.choices?.[0]?.message?.content?.trim() ?? "";
+}
+
+/** Which provider to use is decided by which real key is actually set — no default provider
+ * baked in, since defaulting to one vendor for everyone would be a real, unwanted tie-in. */
+export function configuredProvider() {
+  if (process.env.ANTHROPIC_API_KEY) return "anthropic";
+  if (process.env.OPENAI_API_KEY) return "openai";
+  return null;
+}
+
+export async function generateCommitMessage(diff) {
+  const provider = configuredProvider();
+  if (!provider) {
+    throw new Error(
+      "No API key configured. Set ANTHROPIC_API_KEY or OPENAI_API_KEY in your environment " +
+        "before generating a message — this tool never guesses at a key or falls back to a " +
+        "fabricated one."
+    );
+  }
+  if (!diff.trim()) {
+    throw new Error("No real changes to describe — the diff is empty.");
+  }
+  // A huge diff is truncated with an honest marker, never silently dropped without saying so —
+  // the model still gets to see the real start of the change, not nothing.
+  const MAX_CHARS = 60000;
+  const truncated = diff.length > MAX_CHARS;
+  const body = truncated
+    ? diff.slice(0, MAX_CHARS) + "\n\n[... diff truncated at 60,000 characters ...]"
+    : diff;
+
+  const text = provider === "anthropic" ? await callAnthropic(process.env.ANTHROPIC_API_KEY, body)
+    : await callOpenAI(process.env.OPENAI_API_KEY, body);
+
+  if (!text) {
+    throw new Error(`${provider} returned an empty response — try again.`);
+  }
+  return { message: text, provider, truncated };
+}

package/src/server.js

@@ -0,0 +1,167 @@
+// Real local HTTP server, stdlib only — zero runtime dependencies is a deliberate choice for a
+// one-command install tool (nothing to audit, nothing to go stale, nothing supply-chain-risky
+// pulled in just to serve a handful of local routes).
+//
+// 🔴 LOOPBACK ONLY. Binds to 127.0.0.1, never 0.0.0.0 — this reads the user's own git diff and
+// (on /api/generate) sends it to a real third-party LLM API using the user's own key. Nothing
+// about that should ever be reachable from another machine on the network.
+import http from "node:http";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { isRepo, realDiff, changedFiles, realCommit, currentBranch, hasCommits } from "./git.js";
+import { generateCommitMessage, configuredProvider } from "./llm.js";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const PUBLIC_DIR = path.join(__dirname, "..", "public");
+
+const MIME = {
+  ".html": "text/html; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+};
+
+// 🔴 DNS-rebinding guard. This loopback server reads the user's git diff and can create commits, so it
+// must only answer requests whose Host is loopback — a web page the user visits cannot rebind a hostname
+// to 127.0.0.1 and reach these APIs. HTTP/1.1 requires a Host header, so a missing one is refused.
+function isLoopbackHost(hostHeader) {
+  if (!hostHeader) return false;
+  let host = String(hostHeader).trim().toLowerCase();
+  if (host.startsWith("[")) {
+    host = host.slice(1, host.indexOf("]")); // [::1]:port -> ::1
+  } else {
+    host = host.replace(/:\d+$/, ""); // 127.0.0.1:port / localhost:port -> strip port
+  }
+  return host === "127.0.0.1" || host === "localhost" || host === "::1";
+}
+
+function sendJson(res, status, body) {
+  const data = JSON.stringify(body);
+  res.writeHead(status, { "content-type": "application/json; charset=utf-8" });
+  res.end(data);
+}
+
+function readBody(req) {
+  return new Promise((resolve, reject) => {
+    let chunks = [];
+    let size = 0;
+    req.on("data", (c) => {
+      size += c.length;
+      // Real cap — a runaway/malicious client body must not be read into memory unbounded.
+      if (size > 40 * 1024 * 1024) {
+        reject(new Error("request body too large"));
+        req.destroy();
+        return;
+      }
+      chunks.push(c);
+    });
+    req.on("end", () => {
+      const raw = Buffer.concat(chunks).toString("utf8");
+      if (!raw) return resolve({});
+      try {
+        resolve(JSON.parse(raw));
+      } catch {
+        reject(new Error("invalid JSON body"));
+      }
+    });
+    req.on("error", reject);
+  });
+}
+
+async function serveStatic(req, res, urlPath) {
+  // Real path-traversal guard: resolve against PUBLIC_DIR and refuse anything that escapes it,
+  // rather than trusting the URL's own `..` segments to be well-formed.
+  const rel = urlPath === "/" ? "index.html" : urlPath.replace(/^\/+/, "");
+  const resolved = path.resolve(PUBLIC_DIR, rel);
+  if (resolved !== PUBLIC_DIR && !resolved.startsWith(PUBLIC_DIR + path.sep)) {
+    res.writeHead(403).end("forbidden");
+    return;
+  }
+  try {
+    const data = await fs.readFile(resolved);
+    const ext = path.extname(resolved);
+    res.writeHead(200, { "content-type": MIME[ext] || "application/octet-stream" });
+    res.end(data);
+  } catch {
+    res.writeHead(404).end("not found");
+  }
+}
+
+export function createServer({ cwd = process.cwd() } = {}) {
+  return http.createServer(async (req, res) => {
+    const url = new URL(req.url, "http://127.0.0.1");
+
+    // Refuse any request whose Host isn't loopback (DNS-rebinding guard — see isLoopbackHost).
+    if (!isLoopbackHost(req.headers.host)) {
+      res.writeHead(403).end("forbidden");
+      return;
+    }
+
+    try {
+      if (url.pathname === "/api/status" && req.method === "GET") {
+        const repo = await isRepo(cwd);
+        return sendJson(res, 200, {
+          ok: true,
+          isRepo: repo,
+          cwd,
+          branch: repo ? await currentBranch(cwd) : null,
+          hasCommits: repo ? await hasCommits(cwd) : false,
+          provider: configuredProvider(),
+        });
+      }
+
+      if (url.pathname === "/api/diff" && req.method === "GET") {
+        if (!(await isRepo(cwd))) {
+          return sendJson(res, 200, { ok: false, reason: `${cwd} is not a real git repository.` });
+        }
+        const { diff, source } = await realDiff(cwd);
+        const files = source === "none" ? [] : await changedFiles(cwd, source);
+        return sendJson(res, 200, { ok: true, diff, source, files });
+      }
+
+      if (url.pathname === "/api/generate" && req.method === "POST") {
+        const body = await readBody(req);
+        if (typeof body.diff !== "string") {
+          return sendJson(res, 400, { ok: false, reason: "diff (string) is required" });
+        }
+        try {
+          const result = await generateCommitMessage(body.diff);
+          return sendJson(res, 200, { ok: true, ...result });
+        } catch (err) {
+          return sendJson(res, 200, { ok: false, reason: err.message });
+        }
+      }
+
+      if (url.pathname === "/api/commit" && req.method === "POST") {
+        const body = await readBody(req);
+        if (typeof body.message !== "string" || !body.message.trim()) {
+          return sendJson(res, 400, { ok: false, reason: "message (non-empty string) is required" });
+        }
+        try {
+          const result = await realCommit(cwd, body.message, { stageAll: body.stageAll === true });
+          return sendJson(res, 200, { ok: true, ...result });
+        } catch (err) {
+          return sendJson(res, 200, { ok: false, reason: err.message });
+        }
+      }
+
+      if (req.method === "GET") {
+        return serveStatic(req, res, url.pathname);
+      }
+
+      res.writeHead(404).end("not found");
+    } catch (err) {
+      sendJson(res, 500, { ok: false, reason: err.message });
+    }
+  });
+}
+
+export function listen(port, cwd) {
+  const server = createServer({ cwd });
+  return new Promise((resolve) => {
+    server.listen(port, "127.0.0.1", () => resolve(server));
+  });
+}