@tested/cli 0.1.4 → 0.1.6

package/README.md

@@ -25,7 +25,7 @@ CI uses the composite Action (`tested-hq/cli/action@main`). It installs `@tested
 ```yaml
 - uses: tested-hq/cli/action@main
   with:
-    version: 0.1.4
+    version: 0.1.6
     token: ${{ secrets.TESTED_TOKEN }}
 ```
 
@@ -38,6 +38,8 @@ tested run              # writes coverage even if tests fail
 tested diff             # report (exit 0)
 tested check            # gate (exit 1 if under threshold)
 tested push --pr <n>    # needs TESTED_TOKEN
+tested token            # mint URL from git remote + env names
+tested whoami           # whether a token is set (never prints it)
 ```
 
 ## Security
@@ -51,7 +53,7 @@ tested push --pr <n>    # needs TESTED_TOKEN
 |---------|--------|
 | Ingest token | Prefer `TESTED_TOKEN` / `TESTED_INGEST_TOKEN` / `TESTED_TOKEN_FILE` (mode `0600`). Avoid `--token` on shared hosts — it appears on process argv (`ps`). |
 | Safe run args | In CI, non-interactive shells, or when `TESTED_SAFE_RUN=1`, `tested run` rejects `--watch` / `--watchAll` and `--config` paths outside the repo root. |
-| API URL | Ingest posts only to `https://` (or `http://localhost`). Redirects with Bearer token are refused. |
+| API URL | Ingest posts only to `https://app.tested.dev` / `*.tested.dev` (or `http://localhost`). Other HTTPS hosts need `TESTED_ALLOW_CUSTOM_API_URL=1`. Redirects with Bearer token are refused. |
 | MCP hosts | For always-on agent hosts, set `TESTED_ALLOWED_CWDS` (see `@tested/mcp`) so tools cannot target arbitrary directories. |
 
 ## Agent loop
@@ -68,7 +70,7 @@ tested push --pr <n>        # share URL on app.tested.dev (needs token)
 
 Human output is monochrome editorial craft: restrained color via picocolors (green / yellow / red for status only). ASCII badges (`[PASS]` / `[FAIL]`) and metric bars. Honors `NO_COLOR` and non-TTY (no ornaments when color is unsupported).
 
-`--json` on every command keeps agent schemas stable.
+`--json` is available on setup, doctor, init, run, diff, check, push, token, whoami, explain, and ignores. `tested run --json` is tested's own summary (command, exit, coverage path). It is not forwarded to the test runner.
 
 ## Dogfood
 
@@ -133,7 +135,7 @@ If `thresholds` is missing from `.tested.yaml`, `tested check` prints a notice o
 ```yaml
 - uses: tested-hq/cli/action@main
   with:
-    version: 0.1.4
+    version: 0.1.6
     push: true
     pr-number: ${{ github.event.pull_request.number }}
     token: ${{ secrets.TESTED_TOKEN }}
@@ -167,8 +169,8 @@ $ tested push
 | `TESTED_TOKEN` / `TESTED_INGEST_TOKEN` / `TESTED_TOKEN_FILE` | Ingest auth (**preferred** — not on argv) |
 | `--token` | Ingest auth (works; warns on TTY; visible in `ps`) |
 | `--pr` / `GITHUB_PR_NUMBER` / `PR_NUMBER` | PR number (required) |
-| `--url` / `TESTED_API_URL` | API base (default `https://app.tested.dev`) |
-| `--owner` / `--name` | Repo identity (default: parse `origin` remote) |
+| `--url` / `TESTED_API_URL` | API base (default `https://app.tested.dev`; other hosts need `TESTED_ALLOW_CUSTOM_API_URL=1`) |
+| `--owner` / `--name` | Repo identity (default: `GITHUB_REPOSITORY`, else `origin` remote) |
 | `--pr-title`, `--author`, `--base-ref`, `--head-ref` | PR metadata overrides |
 | `--base` | Git base for the coverage diff (same as `tested diff --base`) |
 | `--run-url` | Optional CI run URL |
@@ -176,8 +178,9 @@ $ tested push
 
 ### `tested run` extra args
 
-Extra args are forwarded to the runner via argv (no shell). In CI /
-non-interactive mode / when `TESTED_SAFE_RUN=1`:
+`tested run` writes `coverage/coverage-final.json` even when the suite fails (Vitest `--coverage.reportOnFailure`). Extra args are forwarded to the runner via argv (no shell). `--json` is consumed by tested and is not forwarded.
+
+In CI / non-interactive mode / when `TESTED_SAFE_RUN=1`:
 
 - `--watch`, `--watchAll`, `-w` are **rejected** (hang risk)
 - `--config` / `-c` paths that resolve **outside the repo root** are **rejected**

package/dist/td.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { Command as Command10 } from "commander";
+import { Command as Command11 } from "commander";
 
 // src/commands/init.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "fs";
 import { join } from "path";
-import "commander";
+import { Option } from "commander";
 import { simpleGit } from "simple-git";
 
 // src/output/ui.ts
@@ -115,6 +115,15 @@ function formatCliError(message) {
       "or pass --token <token> (avoid on shared hosts: visible in ps)"
     ]);
   }
+  if (/git base ref .+ not found/i.test(m)) {
+    const refMatch = m.match(/git base ref "([^"]+)" not found/i);
+    const ref = refMatch?.[1] ?? "the requested ref";
+    return errorBlock(`git base ref "${ref}" not found`, [
+      "That ref is not in this repository.",
+      "Pass --base HEAD~1 (or a branch / commit that exists)",
+      "or set `base:` in .tested.yaml"
+    ]);
+  }
   if (/invalid PR number/i.test(m)) {
     return errorBlock("invalid PR number", [
       m.replace(/^invalid PR number\s*/i, "").replace(/^—\s*/, "") || m,
@@ -209,6 +218,16 @@ var PRE_PUSH_HOOK_BODY = `#!/usr/bin/env sh
 # Installed by \`tested init\`. Skip with \`git push --no-verify\`.
 tested diff
 `;
+function resolveInitHooks(opts) {
+  if (!opts.hooks) return false;
+  const env = opts.env ?? process.env;
+  const ci = env.CI === "1" || env.CI === "true" || env.GITHUB_ACTIONS === "true";
+  const isTTY = opts.isTTY ?? Boolean(process.stdin.isTTY);
+  if ((!isTTY || ci) && !opts.force) {
+    return false;
+  }
+  return true;
+}
 async function runInit(opts) {
   const { cwd, force, hooks } = opts;
   const pkgJsonPath = join(cwd, "package.json");
@@ -294,13 +313,13 @@ function formatInitResultHuman(result) {
   return lines.join("\n");
 }
 function registerInitCommand(program2) {
-  program2.command("init").description("Initialize tested.dev in the current project (writes .tested.yaml)").option("--force", "Overwrite an existing .tested.yaml", false).option("--no-hooks", "Skip installing the husky pre-push hook").option("--json", "Emit JSON instead of human text", false).action(async (opts) => {
+  program2.command("init").description("Initialize tested.dev in the current project (writes .tested.yaml)").option("--force", "Overwrite an existing .tested.yaml", false).option("--hooks", "Install husky pre-push hook (skipped by default in CI / non-TTY)", false).addOption(new Option("--no-hooks").hideHelp()).option("--json", "Emit JSON instead of human text", false).action(async (opts) => {
     try {
-      if (opts.hooks && !process.stdin.isTTY && !opts.force) {
+      if (opts.hooks && !resolveInitHooks({ hooks: true, force: opts.force })) {
         process.stderr.write(
           errorBlock(
             "--hooks in a non-TTY environment requires --force to confirm",
-            ["Would install a git hook unattended."]
+            ["Would install a git hook unattended.", "Omit --hooks to init without a hook."]
           )
         );
         process.exit(1);
@@ -308,7 +327,7 @@ function registerInitCommand(program2) {
       const result = await runInit({
         cwd: process.cwd(),
         force: opts.force,
-        hooks: opts.hooks
+        hooks: resolveInitHooks({ hooks: opts.hooks, force: opts.force })
       });
       if (opts.json) {
         process.stdout.write(JSON.stringify(buildInitJsonOutput(result), null, 2) + "\n");
@@ -617,8 +636,35 @@ async function openRepo(cwd) {
   const repoRoot = (await git.revparse(["--show-toplevel"])).trim();
   return { git, repoRoot };
 }
-async function resolveBase(ctx, base) {
-  return (await ctx.git.revparse([base])).trim();
+async function tryRevparse(ctx, ref) {
+  try {
+    const sha = (await ctx.git.revparse([ref])).trim();
+    return sha || null;
+  } catch {
+    return null;
+  }
+}
+function missingGitRefMessage(ref) {
+  return `git base ref "${ref}" not found`;
+}
+async function resolveEffectiveBase(ctx, requested) {
+  const requestedSha = await tryRevparse(ctx, requested);
+  if (!requestedSha) {
+    throw new Error(missingGitRefMessage(requested));
+  }
+  const head = await headSha(ctx);
+  if (requestedSha !== head) {
+    return { ref: requested, sha: requestedSha };
+  }
+  const upstream = await tryRevparse(ctx, "@{upstream}");
+  if (upstream && upstream !== head) {
+    return { ref: "@{upstream}", sha: upstream };
+  }
+  const parent = await tryRevparse(ctx, "HEAD~1");
+  if (parent) {
+    return { ref: "HEAD~1", sha: parent };
+  }
+  return { ref: requested, sha: requestedSha };
 }
 async function headSha(ctx) {
   return (await ctx.git.revparse(["HEAD"])).trim();
@@ -914,8 +960,8 @@ function buildDiffOutput(args) {
 async function computeDiff(opts) {
   const { cwd, config } = opts;
   const ctx = opts.ctx ?? await openRepo(cwd);
-  const baseRef = assertSafeGitRef(opts.baseRef ?? config.base);
-  const base = await resolveBase(ctx, baseRef);
+  const requested = assertSafeGitRef(opts.baseRef ?? config.base);
+  const { ref: baseRef, sha: base } = await resolveEffectiveBase(ctx, requested);
   const head = await headSha(ctx);
   const diffText = await unifiedDiff(ctx, base);
   const addedByFile = parseUnifiedDiff(diffText);
@@ -965,7 +1011,24 @@ async function computeDiff(opts) {
 
 // src/commands/push.ts
 var DEFAULT_API_BASE = "https://app.tested.dev";
+var DEFAULT_API_HOST = "app.tested.dev";
 var LOCAL_HTTP_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+var SAFE_GITHUB_REPOSITORY_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+function isAllowedApiHost(hostname) {
+  const host = hostname.toLowerCase();
+  return host === "tested.dev" || host === DEFAULT_API_HOST || host.endsWith(".tested.dev");
+}
+function isLocalDevHost(hostname) {
+  const host = hostname.toLowerCase();
+  return LOCAL_HTTP_HOSTS.has(host) || host.endsWith(".localhost");
+}
+function parseGitHubRepository(repo) {
+  const raw = repo?.trim();
+  if (!raw || !SAFE_GITHUB_REPOSITORY_RE.test(raw)) return null;
+  const [owner, name] = raw.split("/");
+  if (!owner || !name) return null;
+  return { owner, name };
+}
 var tokenArgvWarned = false;
 function readTokenFile(filePath, opts) {
   const read = opts?.readFileSyncFn ?? readFileSync2;
@@ -1022,7 +1085,7 @@ function resolveToken(opts) {
   }
   return null;
 }
-function assertSafeApiBase(raw) {
+function assertSafeApiBase(raw, opts = {}) {
   const trimmed = raw.trim();
   if (!trimmed) {
     throw new Error("API URL must not be empty");
@@ -1039,9 +1102,14 @@ function assertSafeApiBase(raw) {
     throw new Error("API URL must not embed credentials");
   }
   const host = u.hostname.toLowerCase();
-  const isLocalHttpHost = LOCAL_HTTP_HOSTS.has(host) || host.endsWith(".localhost");
+  const local = isLocalDevHost(host);
   if (u.protocol === "https:") {
-  } else if (u.protocol === "http:" && isLocalHttpHost) {
+    if (!local && !isAllowedApiHost(host) && !opts.allowCustom) {
+      throw new Error(
+        `API URL host "${u.hostname}" is not allowed. Ingest tokens are sent to this host. Use https://app.tested.dev, or set TESTED_ALLOW_CUSTOM_API_URL=1 for a private endpoint.`
+      );
+    }
+  } else if (u.protocol === "http:" && local) {
   } else {
     throw new Error(
       `API URL must use https:// (http:// allowed only for localhost). Got ${u.protocol}//${u.host}`
@@ -1051,12 +1119,16 @@ function assertSafeApiBase(raw) {
   const pathPart = !path || path === "/" ? "" : path;
   return `${u.origin}${pathPart}`;
 }
+function allowCustomApiUrl(env) {
+  const raw = env.TESTED_ALLOW_CUSTOM_API_URL;
+  return raw === "1" || raw === "true";
+}
 function resolveApiBase(opts) {
   const env = opts.env ?? process.env;
   const flag = opts.flag?.trim();
   const fromEnv = env.TESTED_API_URL?.trim();
   const raw = flag || fromEnv || DEFAULT_API_BASE;
-  return assertSafeApiBase(raw);
+  return assertSafeApiBase(raw, { allowCustom: allowCustomApiUrl(env) });
 }
 function redactGitRemote(url) {
   const scrubbed = url.replace(/\/\/([^/@\s]+)@/g, "//***@");
@@ -1403,6 +1475,13 @@ async function executePush(cli, deps) {
   }
   let owner = cli.owner;
   let name = cli.name;
+  if (!owner || !name) {
+    const fromActions = parseGitHubRepository(env.GITHUB_REPOSITORY);
+    if (fromActions) {
+      owner = owner ?? fromActions.owner;
+      name = name ?? fromActions.name;
+    }
+  }
   if (!owner || !name) {
     let origin;
     try {
@@ -1767,7 +1846,8 @@ async function runDoctor(deps) {
   const rawApi = env.TESTED_API_URL;
   if (rawApi !== void 0 && rawApi !== "") {
     try {
-      const normalized = assertSafe(rawApi);
+      const allowCustom = env.TESTED_ALLOW_CUSTOM_API_URL === "1" || env.TESTED_ALLOW_CUSTOM_API_URL === "true";
+      const normalized = assertSafe(rawApi, { allowCustom });
       checks.push({
         id: "api_url",
         label: "API URL",
@@ -1881,7 +1961,7 @@ import pc3 from "picocolors";
 // package.json
 var package_default = {
   name: "@tested/cli",
-  version: "0.1.4",
+  version: "0.1.6",
   description: "Coverage your agent can use. CLI for patch + project coverage with agent-readable JSON output.",
   license: "MIT",
   homepage: "https://tested.dev",
@@ -2126,6 +2206,26 @@ import { existsSync as existsSync5 } from "fs";
 import { isAbsolute as isAbsolute3, resolve as resolve5, sep as sep2 } from "path";
 import { spawn } from "child_process";
 import "commander";
+function splitRunArgs(extraArgs) {
+  let json = false;
+  const forwarded = [];
+  let passthrough = false;
+  for (const a of extraArgs) {
+    if (!passthrough && a === "--") {
+      passthrough = true;
+      continue;
+    }
+    if (!passthrough && (a === "--json" || a === "--json=true")) {
+      json = true;
+      continue;
+    }
+    forwarded.push(a);
+  }
+  return { json, forwarded };
+}
+function buildRunJsonOutput(input) {
+  return { schemaVersion: 1, ...input };
+}
 function resolveRunCommand(opts) {
   const runner = opts.runner ?? "vitest";
   switch (runner) {
@@ -2208,12 +2308,15 @@ function assertSafeRunArgs(extraArgs, repoRoot) {
 }
 function registerRunCommand(program2) {
   program2.command("run").description(
-    "Run the user's test suite with coverage enabled (runner read from .tested.yaml; defaults to vitest)"
-  ).allowUnknownOption(true).argument("[args...]", "Extra arguments forwarded to the runner").action(async (extraArgs) => {
+    "Run the project test suite with coverage (writes coverage even if tests fail)"
+  ).option("--json", "Emit tested JSON summary (not forwarded to the runner)", false).allowUnknownOption(true).argument("[args...]", "Extra arguments forwarded to the runner").action(async (extraArgs, opts) => {
     const cwd = process.cwd();
+    const split = splitRunArgs(extraArgs ?? []);
+    const json = Boolean(opts.json) || split.json;
+    const forwarded = split.forwarded;
     try {
       if (shouldEnforceSafeRun()) {
-        assertSafeRunArgs(extraArgs, cwd);
+        assertSafeRunArgs(forwarded, cwd);
       }
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
@@ -2225,14 +2328,28 @@ function registerRunCommand(program2) {
     const coveragePath = resolve5(cwd, config.coverage.path);
     const { command, args } = resolveRunCommand({
       runner: config.testRunner,
-      extraArgs
+      extraArgs: forwarded
     });
-    process.stderr.write(heading("tested.dev \u2014 running tests with coverage") + "\n");
-    process.stderr.write(dim(`${command} ${args.join(" ")}`) + "\n\n");
+    if (!json) {
+      process.stderr.write(heading("tested.dev \u2014 running tests with coverage") + "\n");
+      process.stderr.write(dim(`${command} ${args.join(" ")}`) + "\n\n");
+    }
     const child = spawn(command, args, { stdio: "inherit" });
     child.on("exit", (code) => {
       const exit = code ?? 1;
       const coverageWritten = existsSync5(coveragePath);
+      if (json) {
+        const payload = buildRunJsonOutput({
+          command,
+          args,
+          exitCode: exit,
+          coverageWritten,
+          coveragePath: config.coverage.path
+        });
+        process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
+        process.exit(exit);
+        return;
+      }
       if (exit === 0) {
         process.stderr.write("\n");
         process.stderr.write(tip("tested diff") + "\n");
@@ -2347,24 +2464,21 @@ function formatHuman(out, opts = {}) {
       );
     }
   }
+  const patchFiles = out.files.filter((f) => f.patchCoverage !== null);
   if (isEmptyPatch(out.patch)) {
     lines.push("");
     lines.push(dim("No executable lines in the patch \u2014 patch gate does not apply."));
-  } else if (out.files.length > 0) {
+  } else if (patchFiles.length > 0) {
     lines.push("");
     lines.push(heading("Files in diff:"));
-    const anyPatch = out.files.some((f) => f.patchCoverage !== null);
-    if (!anyPatch) {
-      lines.push(dim(`  (project coverage \u2014 ${EMPTY_PATCH_REASON})`));
-    }
-    for (const f of out.files) {
-      const hasPatch = f.patchCoverage !== null;
-      const pctPart = hasPatch ? coloredPctCell(f.patchCoverage) : coloredPctCell(f.projectCoverage);
-      lines.push(`  ${pctPart}  ${f.path}`);
+    for (const f of patchFiles) {
+      const pct3 = f.patchCoverage;
+      if (pct3 === null) continue;
+      lines.push(`  ${coloredPctCell(pct3)}  ${f.path}`);
       if (f.uncoveredRanges.length > 0) {
         const ranges = formatRangeList(f.uncoveredRanges);
         lines.push(dim(`             uncovered: ${ranges}`));
-      } else if (hasPatch) {
+      } else {
         lines.push(dim("             fully covered in patch"));
       }
     }
@@ -2648,17 +2762,150 @@ function formatIgnoresList(patterns, asJson) {
   if (asJson) return JSON.stringify({ ignores: [...patterns] });
   return patterns.join("\n");
 }
+async function printIgnores(asJson) {
+  const config = await loadConfig({ cwd: process.cwd() });
+  process.stdout.write(formatIgnoresList(config.ignores, asJson) + "\n");
+}
 function registerIgnoresCommand(program2) {
-  const cmd = program2.command("ignores").description("Inspect the canonical ignore list");
-  cmd.command("list").description("Print all ignore patterns (defaults + user)").option("--json", "Emit JSON", false).action(async (opts) => {
-    const config = await loadConfig({ cwd: process.cwd() });
-    process.stdout.write(formatIgnoresList(config.ignores, opts.json) + "\n");
+  program2.command("ignores").description("List ignore patterns (defaults + user). `list` is optional.").argument("[subcommand]", 'optional "list" (the default)').option("--json", "Emit JSON", false).action(async (subcommand, opts) => {
+    if (subcommand !== void 0 && subcommand !== "list") {
+      throw new Error(`unknown ignores subcommand "${subcommand}". Try: tested ignores list`);
+    }
+    await printIgnores(opts.json);
+  });
+}
+
+// src/commands/token.ts
+import "commander";
+async function resolveRepoIdentity(opts) {
+  try {
+    const open = opts.openRepoFn ?? openRepo;
+    const getUrl = opts.remoteUrlFn ?? remoteUrl;
+    const ctx = await open(opts.cwd);
+    const url = await getUrl(ctx, "origin");
+    const parsed = parseGitHubRemote(url);
+    return parsed ?? { owner: null, name: null };
+  } catch {
+    return { owner: null, name: null };
+  }
+}
+function tokenSourceFromEnv(env) {
+  if (env.TESTED_TOKEN) return "TESTED_TOKEN";
+  if (env.TESTED_INGEST_TOKEN) return "TESTED_INGEST_TOKEN";
+  if (env.TESTED_TOKEN_FILE) return "TESTED_TOKEN_FILE";
+  return "token";
+}
+function formatTokenHuman(identity) {
+  const lines = [
+    heading("tested.dev \u2014 token"),
+    "",
+    ...tokenMintGuidance(identity).map((line) => dim(`  ${line}`)),
+    ""
+  ];
+  return lines.join("\n");
+}
+function formatTokenJson(identity) {
+  return JSON.stringify(
+    {
+      schemaVersion: 1,
+      mintUrl: ingestTokenSettingsUrl(identity.owner, identity.name),
+      envNames: [...INGEST_TOKEN_ENV_NAMES],
+      owner: identity.owner,
+      name: identity.name
+    },
+    null,
+    2
+  ) + "\n";
+}
+function formatWhoamiHuman(result) {
+  const lines = [heading("tested.dev \u2014 whoami"), ""];
+  if (result.tokenSet) {
+    lines.push(dim(`  token: set via ${result.source} (value not shown)`));
+  } else {
+    lines.push(dim("  token: not set"));
+    for (const line of tokenMintGuidance(result.identity)) {
+      lines.push(dim(`  ${line}`));
+    }
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+function formatWhoamiJson(result) {
+  return JSON.stringify(
+    {
+      schemaVersion: 1,
+      tokenSet: result.tokenSet,
+      source: result.source,
+      mintUrl: ingestTokenSettingsUrl(result.identity.owner, result.identity.name),
+      envNames: [...INGEST_TOKEN_ENV_NAMES]
+    },
+    null,
+    2
+  ) + "\n";
+}
+async function runToken(opts) {
+  const identity = await resolveRepoIdentity(opts);
+  const stdout = opts.json ? formatTokenJson(identity) : formatTokenHuman(identity);
+  return { stdout, exitCode: 0 };
+}
+async function runWhoami(opts) {
+  const env = opts.env ?? process.env;
+  const identity = await resolveRepoIdentity(opts);
+  const resolve7 = opts.resolveTokenFn ?? resolveToken;
+  let tokenSet = false;
+  let source = null;
+  try {
+    const token = resolve7({ env, isTTY: false, warn: () => {
+    } });
+    tokenSet = Boolean(token);
+    source = tokenSet ? tokenSourceFromEnv(env) : null;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      stdout: "",
+      stderr: formatCliError(message),
+      exitCode: 1
+    };
+  }
+  const result = { tokenSet, source, identity, exitCode: tokenSet ? 0 : 1 };
+  const stdout = opts.json ? formatWhoamiJson(result) : formatWhoamiHuman(result);
+  return { stdout, stderr: "", exitCode: result.exitCode };
+}
+function registerTokenCommand(program2) {
+  program2.command("token").description("Print the ingest-token mint URL and accepted env names").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+    try {
+      const result = await runToken({ cwd: process.cwd(), json: opts.json });
+      process.stdout.write(result.stdout.endsWith("\n") ? result.stdout : result.stdout + "\n");
+      process.exitCode = result.exitCode;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(formatCliError(message));
+      process.exitCode = 1;
+    }
+  });
+}
+function registerWhoamiCommand(program2) {
+  program2.command("whoami").description("Report whether an ingest token is set (never prints the value)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+    try {
+      const result = await runWhoami({ cwd: process.cwd(), json: opts.json });
+      if (result.stderr) process.stderr.write(result.stderr);
+      if (result.stdout) {
+        process.stdout.write(
+          result.stdout.endsWith("\n") ? result.stdout : result.stdout + "\n"
+        );
+      }
+      process.exitCode = result.exitCode;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(errorBlock(message));
+      process.exitCode = 1;
+    }
   });
 }
 
 // src/cli.ts
 function createProgram() {
-  const program2 = new Command10();
+  const program2 = new Command11();
   program2.name("tested").description(
     [
       "Coverage your agent can use.",
@@ -2674,6 +2921,8 @@ function createProgram() {
   registerDiffCommand(program2);
   registerCheckCommand(program2);
   registerPushCommand(program2);
+  registerTokenCommand(program2);
+  registerWhoamiCommand(program2);
   registerExplainCommand(program2);
   registerIgnoresCommand(program2);
   return program2;

package/dist/tested.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { Command as Command10 } from "commander";
+import { Command as Command11 } from "commander";
 
 // src/commands/init.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "fs";
 import { join } from "path";
-import "commander";
+import { Option } from "commander";
 import { simpleGit } from "simple-git";
 
 // src/output/ui.ts
@@ -115,6 +115,15 @@ function formatCliError(message) {
       "or pass --token <token> (avoid on shared hosts: visible in ps)"
     ]);
   }
+  if (/git base ref .+ not found/i.test(m)) {
+    const refMatch = m.match(/git base ref "([^"]+)" not found/i);
+    const ref = refMatch?.[1] ?? "the requested ref";
+    return errorBlock(`git base ref "${ref}" not found`, [
+      "That ref is not in this repository.",
+      "Pass --base HEAD~1 (or a branch / commit that exists)",
+      "or set `base:` in .tested.yaml"
+    ]);
+  }
   if (/invalid PR number/i.test(m)) {
     return errorBlock("invalid PR number", [
       m.replace(/^invalid PR number\s*/i, "").replace(/^—\s*/, "") || m,
@@ -209,6 +218,16 @@ var PRE_PUSH_HOOK_BODY = `#!/usr/bin/env sh
 # Installed by \`tested init\`. Skip with \`git push --no-verify\`.
 tested diff
 `;
+function resolveInitHooks(opts) {
+  if (!opts.hooks) return false;
+  const env = opts.env ?? process.env;
+  const ci = env.CI === "1" || env.CI === "true" || env.GITHUB_ACTIONS === "true";
+  const isTTY = opts.isTTY ?? Boolean(process.stdin.isTTY);
+  if ((!isTTY || ci) && !opts.force) {
+    return false;
+  }
+  return true;
+}
 async function runInit(opts) {
   const { cwd, force, hooks } = opts;
   const pkgJsonPath = join(cwd, "package.json");
@@ -294,13 +313,13 @@ function formatInitResultHuman(result) {
   return lines.join("\n");
 }
 function registerInitCommand(program2) {
-  program2.command("init").description("Initialize tested.dev in the current project (writes .tested.yaml)").option("--force", "Overwrite an existing .tested.yaml", false).option("--no-hooks", "Skip installing the husky pre-push hook").option("--json", "Emit JSON instead of human text", false).action(async (opts) => {
+  program2.command("init").description("Initialize tested.dev in the current project (writes .tested.yaml)").option("--force", "Overwrite an existing .tested.yaml", false).option("--hooks", "Install husky pre-push hook (skipped by default in CI / non-TTY)", false).addOption(new Option("--no-hooks").hideHelp()).option("--json", "Emit JSON instead of human text", false).action(async (opts) => {
     try {
-      if (opts.hooks && !process.stdin.isTTY && !opts.force) {
+      if (opts.hooks && !resolveInitHooks({ hooks: true, force: opts.force })) {
         process.stderr.write(
           errorBlock(
             "--hooks in a non-TTY environment requires --force to confirm",
-            ["Would install a git hook unattended."]
+            ["Would install a git hook unattended.", "Omit --hooks to init without a hook."]
           )
         );
         process.exit(1);
@@ -308,7 +327,7 @@ function registerInitCommand(program2) {
       const result = await runInit({
         cwd: process.cwd(),
         force: opts.force,
-        hooks: opts.hooks
+        hooks: resolveInitHooks({ hooks: opts.hooks, force: opts.force })
       });
       if (opts.json) {
         process.stdout.write(JSON.stringify(buildInitJsonOutput(result), null, 2) + "\n");
@@ -617,8 +636,35 @@ async function openRepo(cwd) {
   const repoRoot = (await git.revparse(["--show-toplevel"])).trim();
   return { git, repoRoot };
 }
-async function resolveBase(ctx, base) {
-  return (await ctx.git.revparse([base])).trim();
+async function tryRevparse(ctx, ref) {
+  try {
+    const sha = (await ctx.git.revparse([ref])).trim();
+    return sha || null;
+  } catch {
+    return null;
+  }
+}
+function missingGitRefMessage(ref) {
+  return `git base ref "${ref}" not found`;
+}
+async function resolveEffectiveBase(ctx, requested) {
+  const requestedSha = await tryRevparse(ctx, requested);
+  if (!requestedSha) {
+    throw new Error(missingGitRefMessage(requested));
+  }
+  const head = await headSha(ctx);
+  if (requestedSha !== head) {
+    return { ref: requested, sha: requestedSha };
+  }
+  const upstream = await tryRevparse(ctx, "@{upstream}");
+  if (upstream && upstream !== head) {
+    return { ref: "@{upstream}", sha: upstream };
+  }
+  const parent = await tryRevparse(ctx, "HEAD~1");
+  if (parent) {
+    return { ref: "HEAD~1", sha: parent };
+  }
+  return { ref: requested, sha: requestedSha };
 }
 async function headSha(ctx) {
   return (await ctx.git.revparse(["HEAD"])).trim();
@@ -914,8 +960,8 @@ function buildDiffOutput(args) {
 async function computeDiff(opts) {
   const { cwd, config } = opts;
   const ctx = opts.ctx ?? await openRepo(cwd);
-  const baseRef = assertSafeGitRef(opts.baseRef ?? config.base);
-  const base = await resolveBase(ctx, baseRef);
+  const requested = assertSafeGitRef(opts.baseRef ?? config.base);
+  const { ref: baseRef, sha: base } = await resolveEffectiveBase(ctx, requested);
   const head = await headSha(ctx);
   const diffText = await unifiedDiff(ctx, base);
   const addedByFile = parseUnifiedDiff(diffText);
@@ -965,7 +1011,24 @@ async function computeDiff(opts) {
 
 // src/commands/push.ts
 var DEFAULT_API_BASE = "https://app.tested.dev";
+var DEFAULT_API_HOST = "app.tested.dev";
 var LOCAL_HTTP_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+var SAFE_GITHUB_REPOSITORY_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+function isAllowedApiHost(hostname) {
+  const host = hostname.toLowerCase();
+  return host === "tested.dev" || host === DEFAULT_API_HOST || host.endsWith(".tested.dev");
+}
+function isLocalDevHost(hostname) {
+  const host = hostname.toLowerCase();
+  return LOCAL_HTTP_HOSTS.has(host) || host.endsWith(".localhost");
+}
+function parseGitHubRepository(repo) {
+  const raw = repo?.trim();
+  if (!raw || !SAFE_GITHUB_REPOSITORY_RE.test(raw)) return null;
+  const [owner, name] = raw.split("/");
+  if (!owner || !name) return null;
+  return { owner, name };
+}
 var tokenArgvWarned = false;
 function readTokenFile(filePath, opts) {
   const read = opts?.readFileSyncFn ?? readFileSync2;
@@ -1022,7 +1085,7 @@ function resolveToken(opts) {
   }
   return null;
 }
-function assertSafeApiBase(raw) {
+function assertSafeApiBase(raw, opts = {}) {
   const trimmed = raw.trim();
   if (!trimmed) {
     throw new Error("API URL must not be empty");
@@ -1039,9 +1102,14 @@ function assertSafeApiBase(raw) {
     throw new Error("API URL must not embed credentials");
   }
   const host = u.hostname.toLowerCase();
-  const isLocalHttpHost = LOCAL_HTTP_HOSTS.has(host) || host.endsWith(".localhost");
+  const local = isLocalDevHost(host);
   if (u.protocol === "https:") {
-  } else if (u.protocol === "http:" && isLocalHttpHost) {
+    if (!local && !isAllowedApiHost(host) && !opts.allowCustom) {
+      throw new Error(
+        `API URL host "${u.hostname}" is not allowed. Ingest tokens are sent to this host. Use https://app.tested.dev, or set TESTED_ALLOW_CUSTOM_API_URL=1 for a private endpoint.`
+      );
+    }
+  } else if (u.protocol === "http:" && local) {
   } else {
     throw new Error(
       `API URL must use https:// (http:// allowed only for localhost). Got ${u.protocol}//${u.host}`
@@ -1051,12 +1119,16 @@ function assertSafeApiBase(raw) {
   const pathPart = !path || path === "/" ? "" : path;
   return `${u.origin}${pathPart}`;
 }
+function allowCustomApiUrl(env) {
+  const raw = env.TESTED_ALLOW_CUSTOM_API_URL;
+  return raw === "1" || raw === "true";
+}
 function resolveApiBase(opts) {
   const env = opts.env ?? process.env;
   const flag = opts.flag?.trim();
   const fromEnv = env.TESTED_API_URL?.trim();
   const raw = flag || fromEnv || DEFAULT_API_BASE;
-  return assertSafeApiBase(raw);
+  return assertSafeApiBase(raw, { allowCustom: allowCustomApiUrl(env) });
 }
 function redactGitRemote(url) {
   const scrubbed = url.replace(/\/\/([^/@\s]+)@/g, "//***@");
@@ -1403,6 +1475,13 @@ async function executePush(cli, deps) {
   }
   let owner = cli.owner;
   let name = cli.name;
+  if (!owner || !name) {
+    const fromActions = parseGitHubRepository(env.GITHUB_REPOSITORY);
+    if (fromActions) {
+      owner = owner ?? fromActions.owner;
+      name = name ?? fromActions.name;
+    }
+  }
   if (!owner || !name) {
     let origin;
     try {
@@ -1767,7 +1846,8 @@ async function runDoctor(deps) {
   const rawApi = env.TESTED_API_URL;
   if (rawApi !== void 0 && rawApi !== "") {
     try {
-      const normalized = assertSafe(rawApi);
+      const allowCustom = env.TESTED_ALLOW_CUSTOM_API_URL === "1" || env.TESTED_ALLOW_CUSTOM_API_URL === "true";
+      const normalized = assertSafe(rawApi, { allowCustom });
       checks.push({
         id: "api_url",
         label: "API URL",
@@ -1881,7 +1961,7 @@ import pc3 from "picocolors";
 // package.json
 var package_default = {
   name: "@tested/cli",
-  version: "0.1.4",
+  version: "0.1.6",
   description: "Coverage your agent can use. CLI for patch + project coverage with agent-readable JSON output.",
   license: "MIT",
   homepage: "https://tested.dev",
@@ -2126,6 +2206,26 @@ import { existsSync as existsSync5 } from "fs";
 import { isAbsolute as isAbsolute3, resolve as resolve5, sep as sep2 } from "path";
 import { spawn } from "child_process";
 import "commander";
+function splitRunArgs(extraArgs) {
+  let json = false;
+  const forwarded = [];
+  let passthrough = false;
+  for (const a of extraArgs) {
+    if (!passthrough && a === "--") {
+      passthrough = true;
+      continue;
+    }
+    if (!passthrough && (a === "--json" || a === "--json=true")) {
+      json = true;
+      continue;
+    }
+    forwarded.push(a);
+  }
+  return { json, forwarded };
+}
+function buildRunJsonOutput(input) {
+  return { schemaVersion: 1, ...input };
+}
 function resolveRunCommand(opts) {
   const runner = opts.runner ?? "vitest";
   switch (runner) {
@@ -2208,12 +2308,15 @@ function assertSafeRunArgs(extraArgs, repoRoot) {
 }
 function registerRunCommand(program2) {
   program2.command("run").description(
-    "Run the user's test suite with coverage enabled (runner read from .tested.yaml; defaults to vitest)"
-  ).allowUnknownOption(true).argument("[args...]", "Extra arguments forwarded to the runner").action(async (extraArgs) => {
+    "Run the project test suite with coverage (writes coverage even if tests fail)"
+  ).option("--json", "Emit tested JSON summary (not forwarded to the runner)", false).allowUnknownOption(true).argument("[args...]", "Extra arguments forwarded to the runner").action(async (extraArgs, opts) => {
     const cwd = process.cwd();
+    const split = splitRunArgs(extraArgs ?? []);
+    const json = Boolean(opts.json) || split.json;
+    const forwarded = split.forwarded;
     try {
       if (shouldEnforceSafeRun()) {
-        assertSafeRunArgs(extraArgs, cwd);
+        assertSafeRunArgs(forwarded, cwd);
       }
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
@@ -2225,14 +2328,28 @@ function registerRunCommand(program2) {
     const coveragePath = resolve5(cwd, config.coverage.path);
     const { command, args } = resolveRunCommand({
       runner: config.testRunner,
-      extraArgs
+      extraArgs: forwarded
     });
-    process.stderr.write(heading("tested.dev \u2014 running tests with coverage") + "\n");
-    process.stderr.write(dim(`${command} ${args.join(" ")}`) + "\n\n");
+    if (!json) {
+      process.stderr.write(heading("tested.dev \u2014 running tests with coverage") + "\n");
+      process.stderr.write(dim(`${command} ${args.join(" ")}`) + "\n\n");
+    }
     const child = spawn(command, args, { stdio: "inherit" });
     child.on("exit", (code) => {
       const exit = code ?? 1;
       const coverageWritten = existsSync5(coveragePath);
+      if (json) {
+        const payload = buildRunJsonOutput({
+          command,
+          args,
+          exitCode: exit,
+          coverageWritten,
+          coveragePath: config.coverage.path
+        });
+        process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
+        process.exit(exit);
+        return;
+      }
       if (exit === 0) {
         process.stderr.write("\n");
         process.stderr.write(tip("tested diff") + "\n");
@@ -2347,24 +2464,21 @@ function formatHuman(out, opts = {}) {
       );
     }
   }
+  const patchFiles = out.files.filter((f) => f.patchCoverage !== null);
   if (isEmptyPatch(out.patch)) {
     lines.push("");
     lines.push(dim("No executable lines in the patch \u2014 patch gate does not apply."));
-  } else if (out.files.length > 0) {
+  } else if (patchFiles.length > 0) {
     lines.push("");
     lines.push(heading("Files in diff:"));
-    const anyPatch = out.files.some((f) => f.patchCoverage !== null);
-    if (!anyPatch) {
-      lines.push(dim(`  (project coverage \u2014 ${EMPTY_PATCH_REASON})`));
-    }
-    for (const f of out.files) {
-      const hasPatch = f.patchCoverage !== null;
-      const pctPart = hasPatch ? coloredPctCell(f.patchCoverage) : coloredPctCell(f.projectCoverage);
-      lines.push(`  ${pctPart}  ${f.path}`);
+    for (const f of patchFiles) {
+      const pct3 = f.patchCoverage;
+      if (pct3 === null) continue;
+      lines.push(`  ${coloredPctCell(pct3)}  ${f.path}`);
       if (f.uncoveredRanges.length > 0) {
         const ranges = formatRangeList(f.uncoveredRanges);
         lines.push(dim(`             uncovered: ${ranges}`));
-      } else if (hasPatch) {
+      } else {
         lines.push(dim("             fully covered in patch"));
       }
     }
@@ -2648,17 +2762,150 @@ function formatIgnoresList(patterns, asJson) {
   if (asJson) return JSON.stringify({ ignores: [...patterns] });
   return patterns.join("\n");
 }
+async function printIgnores(asJson) {
+  const config = await loadConfig({ cwd: process.cwd() });
+  process.stdout.write(formatIgnoresList(config.ignores, asJson) + "\n");
+}
 function registerIgnoresCommand(program2) {
-  const cmd = program2.command("ignores").description("Inspect the canonical ignore list");
-  cmd.command("list").description("Print all ignore patterns (defaults + user)").option("--json", "Emit JSON", false).action(async (opts) => {
-    const config = await loadConfig({ cwd: process.cwd() });
-    process.stdout.write(formatIgnoresList(config.ignores, opts.json) + "\n");
+  program2.command("ignores").description("List ignore patterns (defaults + user). `list` is optional.").argument("[subcommand]", 'optional "list" (the default)').option("--json", "Emit JSON", false).action(async (subcommand, opts) => {
+    if (subcommand !== void 0 && subcommand !== "list") {
+      throw new Error(`unknown ignores subcommand "${subcommand}". Try: tested ignores list`);
+    }
+    await printIgnores(opts.json);
+  });
+}
+
+// src/commands/token.ts
+import "commander";
+async function resolveRepoIdentity(opts) {
+  try {
+    const open = opts.openRepoFn ?? openRepo;
+    const getUrl = opts.remoteUrlFn ?? remoteUrl;
+    const ctx = await open(opts.cwd);
+    const url = await getUrl(ctx, "origin");
+    const parsed = parseGitHubRemote(url);
+    return parsed ?? { owner: null, name: null };
+  } catch {
+    return { owner: null, name: null };
+  }
+}
+function tokenSourceFromEnv(env) {
+  if (env.TESTED_TOKEN) return "TESTED_TOKEN";
+  if (env.TESTED_INGEST_TOKEN) return "TESTED_INGEST_TOKEN";
+  if (env.TESTED_TOKEN_FILE) return "TESTED_TOKEN_FILE";
+  return "token";
+}
+function formatTokenHuman(identity) {
+  const lines = [
+    heading("tested.dev \u2014 token"),
+    "",
+    ...tokenMintGuidance(identity).map((line) => dim(`  ${line}`)),
+    ""
+  ];
+  return lines.join("\n");
+}
+function formatTokenJson(identity) {
+  return JSON.stringify(
+    {
+      schemaVersion: 1,
+      mintUrl: ingestTokenSettingsUrl(identity.owner, identity.name),
+      envNames: [...INGEST_TOKEN_ENV_NAMES],
+      owner: identity.owner,
+      name: identity.name
+    },
+    null,
+    2
+  ) + "\n";
+}
+function formatWhoamiHuman(result) {
+  const lines = [heading("tested.dev \u2014 whoami"), ""];
+  if (result.tokenSet) {
+    lines.push(dim(`  token: set via ${result.source} (value not shown)`));
+  } else {
+    lines.push(dim("  token: not set"));
+    for (const line of tokenMintGuidance(result.identity)) {
+      lines.push(dim(`  ${line}`));
+    }
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+function formatWhoamiJson(result) {
+  return JSON.stringify(
+    {
+      schemaVersion: 1,
+      tokenSet: result.tokenSet,
+      source: result.source,
+      mintUrl: ingestTokenSettingsUrl(result.identity.owner, result.identity.name),
+      envNames: [...INGEST_TOKEN_ENV_NAMES]
+    },
+    null,
+    2
+  ) + "\n";
+}
+async function runToken(opts) {
+  const identity = await resolveRepoIdentity(opts);
+  const stdout = opts.json ? formatTokenJson(identity) : formatTokenHuman(identity);
+  return { stdout, exitCode: 0 };
+}
+async function runWhoami(opts) {
+  const env = opts.env ?? process.env;
+  const identity = await resolveRepoIdentity(opts);
+  const resolve7 = opts.resolveTokenFn ?? resolveToken;
+  let tokenSet = false;
+  let source = null;
+  try {
+    const token = resolve7({ env, isTTY: false, warn: () => {
+    } });
+    tokenSet = Boolean(token);
+    source = tokenSet ? tokenSourceFromEnv(env) : null;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      stdout: "",
+      stderr: formatCliError(message),
+      exitCode: 1
+    };
+  }
+  const result = { tokenSet, source, identity, exitCode: tokenSet ? 0 : 1 };
+  const stdout = opts.json ? formatWhoamiJson(result) : formatWhoamiHuman(result);
+  return { stdout, stderr: "", exitCode: result.exitCode };
+}
+function registerTokenCommand(program2) {
+  program2.command("token").description("Print the ingest-token mint URL and accepted env names").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+    try {
+      const result = await runToken({ cwd: process.cwd(), json: opts.json });
+      process.stdout.write(result.stdout.endsWith("\n") ? result.stdout : result.stdout + "\n");
+      process.exitCode = result.exitCode;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(formatCliError(message));
+      process.exitCode = 1;
+    }
+  });
+}
+function registerWhoamiCommand(program2) {
+  program2.command("whoami").description("Report whether an ingest token is set (never prints the value)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+    try {
+      const result = await runWhoami({ cwd: process.cwd(), json: opts.json });
+      if (result.stderr) process.stderr.write(result.stderr);
+      if (result.stdout) {
+        process.stdout.write(
+          result.stdout.endsWith("\n") ? result.stdout : result.stdout + "\n"
+        );
+      }
+      process.exitCode = result.exitCode;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(errorBlock(message));
+      process.exitCode = 1;
+    }
   });
 }
 
 // src/cli.ts
 function createProgram() {
-  const program2 = new Command10();
+  const program2 = new Command11();
   program2.name("tested").description(
     [
       "Coverage your agent can use.",
@@ -2674,6 +2921,8 @@ function createProgram() {
   registerDiffCommand(program2);
   registerCheckCommand(program2);
   registerPushCommand(program2);
+  registerTokenCommand(program2);
+  registerWhoamiCommand(program2);
   registerExplainCommand(program2);
   registerIgnoresCommand(program2);
   return program2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tested/cli",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Coverage your agent can use. CLI for patch + project coverage with agent-readable JSON output.",
   "license": "MIT",
   "homepage": "https://tested.dev",