@tested/cli 0.1.5 → 0.1.7

package/dist/td.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { Command as Command10 } from "commander";
+import { Command as Command11 } from "commander";
 
 // src/commands/init.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "fs";
 import { join } from "path";
-import "commander";
+import { Option } from "commander";
 import { simpleGit } from "simple-git";
 
 // src/output/ui.ts
@@ -115,6 +115,15 @@ function formatCliError(message) {
       "or pass --token <token> (avoid on shared hosts: visible in ps)"
     ]);
   }
+  if (/git base ref .+ not found/i.test(m)) {
+    const refMatch = m.match(/git base ref "([^"]+)" not found/i);
+    const ref = refMatch?.[1] ?? "the requested ref";
+    return errorBlock(`git base ref "${ref}" not found`, [
+      "That ref is not in this repository.",
+      "Pass --base HEAD~1 (or a branch / commit that exists)",
+      "or set `base:` in .tested.yaml"
+    ]);
+  }
   if (/invalid PR number/i.test(m)) {
     return errorBlock("invalid PR number", [
       m.replace(/^invalid PR number\s*/i, "").replace(/^—\s*/, "") || m,
@@ -209,6 +218,16 @@ var PRE_PUSH_HOOK_BODY = `#!/usr/bin/env sh
 # Installed by \`tested init\`. Skip with \`git push --no-verify\`.
 tested diff
 `;
+function resolveInitHooks(opts) {
+  if (!opts.hooks) return false;
+  const env = opts.env ?? process.env;
+  const ci = env.CI === "1" || env.CI === "true" || env.GITHUB_ACTIONS === "true";
+  const isTTY = opts.isTTY ?? Boolean(process.stdin.isTTY);
+  if ((!isTTY || ci) && !opts.force) {
+    return false;
+  }
+  return true;
+}
 async function runInit(opts) {
   const { cwd, force, hooks } = opts;
   const pkgJsonPath = join(cwd, "package.json");
@@ -294,13 +313,13 @@ function formatInitResultHuman(result) {
   return lines.join("\n");
 }
 function registerInitCommand(program2) {
-  program2.command("init").description("Initialize tested.dev in the current project (writes .tested.yaml)").option("--force", "Overwrite an existing .tested.yaml", false).option("--no-hooks", "Skip installing the husky pre-push hook").option("--json", "Emit JSON instead of human text", false).action(async (opts) => {
+  program2.command("init").description("Initialize tested.dev in the current project (writes .tested.yaml)").option("--force", "Overwrite an existing .tested.yaml", false).option("--hooks", "Install husky pre-push hook (skipped by default in CI / non-TTY)", false).addOption(new Option("--no-hooks").hideHelp()).option("--json", "Emit JSON instead of human text", false).action(async (opts) => {
     try {
-      if (opts.hooks && !process.stdin.isTTY && !opts.force) {
+      if (opts.hooks && !resolveInitHooks({ hooks: true, force: opts.force })) {
         process.stderr.write(
           errorBlock(
             "--hooks in a non-TTY environment requires --force to confirm",
-            ["Would install a git hook unattended."]
+            ["Would install a git hook unattended.", "Omit --hooks to init without a hook."]
           )
         );
         process.exit(1);
@@ -308,7 +327,7 @@ function registerInitCommand(program2) {
       const result = await runInit({
         cwd: process.cwd(),
         force: opts.force,
-        hooks: opts.hooks
+        hooks: resolveInitHooks({ hooks: opts.hooks, force: opts.force })
       });
       if (opts.json) {
         process.stdout.write(JSON.stringify(buildInitJsonOutput(result), null, 2) + "\n");
@@ -612,17 +631,85 @@ import { resolve as resolve3 } from "path";
 
 // src/git.ts
 import { simpleGit as simpleGit2 } from "simple-git";
+
+// src/git-ref.ts
+var SAFE_GIT_REF_RE = /^[A-Za-z0-9_./@~^-]{1,256}$/;
+function assertSafeGitRef(ref) {
+  if (!ref) {
+    throw new Error("git ref must not be empty");
+  }
+  if (ref.startsWith("-")) {
+    throw new Error(`git ref must not start with '-': ${ref}`);
+  }
+  if (!SAFE_GIT_REF_RE.test(ref)) {
+    throw new Error(
+      `git ref contains invalid characters or is too long (max 256): ${ref}`
+    );
+  }
+  return ref;
+}
+
+// src/git.ts
 async function openRepo(cwd) {
   const git = simpleGit2({ baseDir: cwd });
   const repoRoot = (await git.revparse(["--show-toplevel"])).trim();
   return { git, repoRoot };
 }
-async function resolveBase(ctx, base) {
-  return (await ctx.git.revparse([base])).trim();
+async function tryRevparse(ctx, ref) {
+  try {
+    const sha = (await ctx.git.revparse([ref])).trim();
+    return sha || null;
+  } catch {
+    return null;
+  }
+}
+function missingGitRefMessage(ref) {
+  return `git base ref "${ref}" not found`;
+}
+async function resolveEffectiveBase(ctx, requested) {
+  const requestedSha = await tryRevparse(ctx, requested);
+  if (!requestedSha) {
+    throw new Error(missingGitRefMessage(requested));
+  }
+  const head = await headSha(ctx);
+  if (requestedSha !== head) {
+    return { ref: requested, sha: requestedSha };
+  }
+  const upstream = await tryRevparse(ctx, "@{upstream}");
+  if (upstream && upstream !== head) {
+    return { ref: "@{upstream}", sha: upstream };
+  }
+  const parent = await tryRevparse(ctx, "HEAD~1");
+  if (parent) {
+    return { ref: "HEAD~1", sha: parent };
+  }
+  return { ref: requested, sha: requestedSha };
 }
 async function headSha(ctx) {
   return (await ctx.git.revparse(["HEAD"])).trim();
 }
+async function fetchOriginRef(ctx, ref) {
+  const spec = ref.startsWith("origin/") ? ref.slice("origin/".length) : ref;
+  try {
+    assertSafeGitRef(spec);
+  } catch {
+    return false;
+  }
+  try {
+    await ctx.git.raw(["fetch", "--depth=1", "origin", spec]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function resolveAfterFetch(ctx, ref) {
+  if (await tryRevparse(ctx, ref)) return ref;
+  if (!ref.startsWith("origin/")) {
+    const originRef = `origin/${ref}`;
+    if (await tryRevparse(ctx, originRef)) return originRef;
+  }
+  return tryRevparse(ctx, "FETCH_HEAD");
+}
 async function unifiedDiff(ctx, base) {
   try {
     const mergeBase = (await ctx.git.raw(["merge-base", base, "HEAD"])).trim();
@@ -653,23 +740,6 @@ async function gitUserName(ctx) {
   }
 }
 
-// src/git-ref.ts
-var SAFE_GIT_REF_RE = /^[A-Za-z0-9_./@~^-]{1,256}$/;
-function assertSafeGitRef(ref) {
-  if (!ref) {
-    throw new Error("git ref must not be empty");
-  }
-  if (ref.startsWith("-")) {
-    throw new Error(`git ref must not start with '-': ${ref}`);
-  }
-  if (!SAFE_GIT_REF_RE.test(ref)) {
-    throw new Error(
-      `git ref contains invalid characters or is too long (max 256): ${ref}`
-    );
-  }
-  return ref;
-}
-
 // src/core/istanbul.ts
 import { readFile as readFile2 } from "fs/promises";
 import { isAbsolute, relative, resolve } from "path";
@@ -914,8 +984,8 @@ function buildDiffOutput(args) {
 async function computeDiff(opts) {
   const { cwd, config } = opts;
   const ctx = opts.ctx ?? await openRepo(cwd);
-  const baseRef = assertSafeGitRef(opts.baseRef ?? config.base);
-  const base = await resolveBase(ctx, baseRef);
+  const requested = assertSafeGitRef(opts.baseRef ?? config.base);
+  const { ref: baseRef, sha: base } = await resolveEffectiveBase(ctx, requested);
   const head = await headSha(ctx);
   const diffText = await unifiedDiff(ctx, base);
   const addedByFile = parseUnifiedDiff(diffText);
@@ -1124,6 +1194,125 @@ function sanitizeAuthor(name) {
 function toBranchName(ref) {
   return ref.replace(/^refs\/heads\//, "").replace(/^refs\/remotes\//, "").replace(/^origin\//, "");
 }
+var GITHUB_COMMIT_SHA_RE = /^[0-9a-f]{40,64}$/i;
+function githubApiToken(env) {
+  const raw = env.GITHUB_TOKEN ?? env.GH_TOKEN;
+  if (raw === void 0 || raw === "") return null;
+  return raw;
+}
+function parseGitHubPullBase(parsed) {
+  if (!parsed || typeof parsed !== "object" || !("base" in parsed)) return null;
+  const base = parsed.base;
+  if (!base || typeof base !== "object") return null;
+  const ref = "ref" in base ? base.ref : void 0;
+  const sha = "sha" in base ? base.sha : void 0;
+  if (typeof ref !== "string" || typeof sha !== "string") return null;
+  if (!GITHUB_COMMIT_SHA_RE.test(sha)) return null;
+  try {
+    return { ref: assertSafeGitRef(ref), sha: assertSafeGitRef(sha) };
+  } catch {
+    return null;
+  }
+}
+async function fetchGitHubPullBase(opts) {
+  if (!parseGitHubRepository(`${opts.owner}/${opts.name}`)) return null;
+  if (!Number.isInteger(opts.prNumber) || opts.prNumber <= 0) return null;
+  const fetchFn = opts.fetchFn ?? globalThis.fetch;
+  const url = `https://api.github.com/repos/${opts.owner}/${opts.name}/pulls/${opts.prNumber}`;
+  const headers = {
+    Accept: "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28",
+    "User-Agent": "tested-cli"
+  };
+  const token = githubApiToken(opts.env ?? process.env);
+  if (token) headers.Authorization = `Bearer ${token}`;
+  let res;
+  try {
+    res = await fetchFn(url, { method: "GET", redirect: "manual", headers });
+  } catch {
+    return null;
+  }
+  if (res.status !== 200) return null;
+  try {
+    return parseGitHubPullBase(JSON.parse(await res.text()));
+  } catch {
+    return null;
+  }
+}
+async function resolvePrPushBase(opts) {
+  let requested;
+  try {
+    requested = assertSafeGitRef(opts.requested);
+  } catch {
+    return void 0;
+  }
+  if (await tryRevparse(opts.ctx, requested)) return requested;
+  const branch = toBranchName(requested) || "main";
+  const originRef = `origin/${branch}`;
+  if (originRef !== requested && await tryRevparse(opts.ctx, originRef)) {
+    return originRef;
+  }
+  let prBase = null;
+  if (opts.owner && opts.name) {
+    prBase = await fetchGitHubPullBase({
+      owner: opts.owner,
+      name: opts.name,
+      prNumber: opts.prNumber,
+      ...opts.fetchFn ? { fetchFn: opts.fetchFn } : {},
+      ...opts.env ? { env: opts.env } : {}
+    });
+  }
+  if (prBase && await tryRevparse(opts.ctx, prBase.sha)) return prBase.sha;
+  const fetchTargets = [];
+  if (prBase) {
+    fetchTargets.push(prBase.sha, prBase.ref);
+  }
+  fetchTargets.push(branch);
+  let announced = false;
+  const seen = /* @__PURE__ */ new Set();
+  for (const target of fetchTargets) {
+    if (seen.has(target)) continue;
+    seen.add(target);
+    let spec;
+    try {
+      spec = assertSafeGitRef(target);
+    } catch {
+      continue;
+    }
+    if (!announced) {
+      announced = true;
+      opts.onProgress?.("fetching base\u2026");
+    }
+    if (!await fetchOriginRef(opts.ctx, spec)) continue;
+    const resolved = await resolveAfterFetch(opts.ctx, spec);
+    if (resolved) return resolved;
+    if (prBase && await tryRevparse(opts.ctx, prBase.sha)) return prBase.sha;
+  }
+  return void 0;
+}
+async function peekRepoIdentity(opts) {
+  let owner = opts.owner;
+  let name = opts.name;
+  if (!owner || !name) {
+    const fromActions = parseGitHubRepository(opts.env.GITHUB_REPOSITORY);
+    if (fromActions) {
+      owner = owner ?? fromActions.owner;
+      name = name ?? fromActions.name;
+    }
+  }
+  if (!owner || !name) {
+    try {
+      const origin = await remoteUrl(opts.ctx, "origin");
+      const parsed = parseGitHubRemote(origin);
+      if (parsed) {
+        owner = owner ?? parsed.owner;
+        name = name ?? parsed.name;
+      }
+    } catch {
+    }
+  }
+  return { owner: owner ?? null, name: name ?? null };
+}
 function buildIngestBody(input) {
   const baseRefName = toBranchName(input.baseRef);
   return {
@@ -1316,16 +1505,16 @@ function formatMissingTokenError(opts) {
     "or pass --token <token> (avoid on shared hosts: visible in ps)"
   ]);
 }
-function formatPushError(status, message, code) {
+function formatPushError(status, message, code, identity) {
   if (status === 0) {
     return errorBlock(message);
   }
   const normalized = (code ?? message).toLowerCase();
-  if (normalized.includes("token_required") || normalized.includes("invalid token") || normalized.includes("unauthorized") || status === 401) {
+  if (normalized.includes("token_required") || normalized.includes("invalid token") || normalized.includes("unauthorized") || normalized.includes("invalid credentials") || status === 401) {
     return errorBlock("ingest auth failed", [
       message,
       "",
-      ...tokenMintGuidance(),
+      ...tokenMintGuidance(identity),
       "or --token"
     ]);
   }
@@ -1414,21 +1603,41 @@ async function executePush(cli, deps) {
   }
   const config = await loadConfigFn({ cwd: deps.cwd });
   const ctx = await openRepoFn(deps.cwd);
-  onProgress("computing diff\u2026");
+  const peeked = await peekRepoIdentity({
+    ...cli.owner !== void 0 ? { owner: cli.owner } : {},
+    ...cli.name !== void 0 ? { name: cli.name } : {},
+    env,
+    ctx
+  });
   let diff;
   try {
+    let baseOverride = cli.base;
+    if (baseOverride === void 0 && prNumber !== null) {
+      const resolved = await resolvePrPushBase({
+        ctx,
+        requested: config.base,
+        prNumber,
+        ...peeked.owner != null ? { owner: peeked.owner } : {},
+        ...peeked.name != null ? { name: peeked.name } : {},
+        fetchFn,
+        env,
+        onProgress
+      });
+      if (resolved !== void 0) baseOverride = resolved;
+    }
+    onProgress("computing diff\u2026");
     diff = await computeDiffFn({
       cwd: deps.cwd,
       config,
-      ...cli.base !== void 0 ? { baseRef: cli.base } : {},
+      ...baseOverride !== void 0 ? { baseRef: baseOverride } : {},
       ctx
     });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     return { exitCode: 1, stdout: "", stderr: errorBlock(message) };
   }
-  let owner = cli.owner;
-  let name = cli.name;
+  let owner = cli.owner ?? peeked.owner ?? void 0;
+  let name = cli.name ?? peeked.name ?? void 0;
   if (!owner || !name) {
     const fromActions = parseGitHubRepository(env.GITHUB_REPOSITORY);
     if (fromActions) {
@@ -1516,7 +1725,10 @@ async function executePush(cli, deps) {
     return {
       exitCode: 1,
       stdout: "",
-      stderr: formatPushError(result.status, result.message, result.code)
+      stderr: formatPushError(result.status, result.message, result.code, {
+        owner,
+        name
+      })
     };
   }
   const formatted = formatPushSuccess(result.data, cli.json);
@@ -1915,7 +2127,7 @@ import pc3 from "picocolors";
 // package.json
 var package_default = {
   name: "@tested/cli",
-  version: "0.1.5",
+  version: "0.1.7",
   description: "Coverage your agent can use. CLI for patch + project coverage with agent-readable JSON output.",
   license: "MIT",
   homepage: "https://tested.dev",
@@ -2160,6 +2372,26 @@ import { existsSync as existsSync5 } from "fs";
 import { isAbsolute as isAbsolute3, resolve as resolve5, sep as sep2 } from "path";
 import { spawn } from "child_process";
 import "commander";
+function splitRunArgs(extraArgs) {
+  let json = false;
+  const forwarded = [];
+  let passthrough = false;
+  for (const a of extraArgs) {
+    if (!passthrough && a === "--") {
+      passthrough = true;
+      continue;
+    }
+    if (!passthrough && (a === "--json" || a === "--json=true")) {
+      json = true;
+      continue;
+    }
+    forwarded.push(a);
+  }
+  return { json, forwarded };
+}
+function buildRunJsonOutput(input) {
+  return { schemaVersion: 1, ...input };
+}
 function resolveRunCommand(opts) {
   const runner = opts.runner ?? "vitest";
   switch (runner) {
@@ -2242,12 +2474,15 @@ function assertSafeRunArgs(extraArgs, repoRoot) {
 }
 function registerRunCommand(program2) {
   program2.command("run").description(
-    "Run the user's test suite with coverage enabled (runner read from .tested.yaml; defaults to vitest)"
-  ).allowUnknownOption(true).argument("[args...]", "Extra arguments forwarded to the runner").action(async (extraArgs) => {
+    "Run the project test suite with coverage (writes coverage even if tests fail)"
+  ).option("--json", "Emit tested JSON summary (not forwarded to the runner)", false).allowUnknownOption(true).argument("[args...]", "Extra arguments forwarded to the runner").action(async (extraArgs, opts) => {
     const cwd = process.cwd();
+    const split = splitRunArgs(extraArgs ?? []);
+    const json = Boolean(opts.json) || split.json;
+    const forwarded = split.forwarded;
     try {
       if (shouldEnforceSafeRun()) {
-        assertSafeRunArgs(extraArgs, cwd);
+        assertSafeRunArgs(forwarded, cwd);
       }
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
@@ -2259,14 +2494,28 @@ function registerRunCommand(program2) {
     const coveragePath = resolve5(cwd, config.coverage.path);
     const { command, args } = resolveRunCommand({
       runner: config.testRunner,
-      extraArgs
+      extraArgs: forwarded
     });
-    process.stderr.write(heading("tested.dev \u2014 running tests with coverage") + "\n");
-    process.stderr.write(dim(`${command} ${args.join(" ")}`) + "\n\n");
+    if (!json) {
+      process.stderr.write(heading("tested.dev \u2014 running tests with coverage") + "\n");
+      process.stderr.write(dim(`${command} ${args.join(" ")}`) + "\n\n");
+    }
     const child = spawn(command, args, { stdio: "inherit" });
     child.on("exit", (code) => {
       const exit = code ?? 1;
       const coverageWritten = existsSync5(coveragePath);
+      if (json) {
+        const payload = buildRunJsonOutput({
+          command,
+          args,
+          exitCode: exit,
+          coverageWritten,
+          coveragePath: config.coverage.path
+        });
+        process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
+        process.exit(exit);
+        return;
+      }
       if (exit === 0) {
         process.stderr.write("\n");
         process.stderr.write(tip("tested diff") + "\n");
@@ -2381,24 +2630,21 @@ function formatHuman(out, opts = {}) {
       );
     }
   }
+  const patchFiles = out.files.filter((f) => f.patchCoverage !== null);
   if (isEmptyPatch(out.patch)) {
     lines.push("");
     lines.push(dim("No executable lines in the patch \u2014 patch gate does not apply."));
-  } else if (out.files.length > 0) {
+  } else if (patchFiles.length > 0) {
     lines.push("");
     lines.push(heading("Files in diff:"));
-    const anyPatch = out.files.some((f) => f.patchCoverage !== null);
-    if (!anyPatch) {
-      lines.push(dim(`  (project coverage \u2014 ${EMPTY_PATCH_REASON})`));
-    }
-    for (const f of out.files) {
-      const hasPatch = f.patchCoverage !== null;
-      const pctPart = hasPatch ? coloredPctCell(f.patchCoverage) : coloredPctCell(f.projectCoverage);
-      lines.push(`  ${pctPart}  ${f.path}`);
+    for (const f of patchFiles) {
+      const pct3 = f.patchCoverage;
+      if (pct3 === null) continue;
+      lines.push(`  ${coloredPctCell(pct3)}  ${f.path}`);
       if (f.uncoveredRanges.length > 0) {
         const ranges = formatRangeList(f.uncoveredRanges);
         lines.push(dim(`             uncovered: ${ranges}`));
-      } else if (hasPatch) {
+      } else {
         lines.push(dim("             fully covered in patch"));
       }
     }
@@ -2682,17 +2928,150 @@ function formatIgnoresList(patterns, asJson) {
   if (asJson) return JSON.stringify({ ignores: [...patterns] });
   return patterns.join("\n");
 }
+async function printIgnores(asJson) {
+  const config = await loadConfig({ cwd: process.cwd() });
+  process.stdout.write(formatIgnoresList(config.ignores, asJson) + "\n");
+}
 function registerIgnoresCommand(program2) {
-  const cmd = program2.command("ignores").description("Inspect the canonical ignore list");
-  cmd.command("list").description("Print all ignore patterns (defaults + user)").option("--json", "Emit JSON", false).action(async (opts) => {
-    const config = await loadConfig({ cwd: process.cwd() });
-    process.stdout.write(formatIgnoresList(config.ignores, opts.json) + "\n");
+  program2.command("ignores").description("List ignore patterns (defaults + user). `list` is optional.").argument("[subcommand]", 'optional "list" (the default)').option("--json", "Emit JSON", false).action(async (subcommand, opts) => {
+    if (subcommand !== void 0 && subcommand !== "list") {
+      throw new Error(`unknown ignores subcommand "${subcommand}". Try: tested ignores list`);
+    }
+    await printIgnores(opts.json);
+  });
+}
+
+// src/commands/token.ts
+import "commander";
+async function resolveRepoIdentity(opts) {
+  try {
+    const open = opts.openRepoFn ?? openRepo;
+    const getUrl = opts.remoteUrlFn ?? remoteUrl;
+    const ctx = await open(opts.cwd);
+    const url = await getUrl(ctx, "origin");
+    const parsed = parseGitHubRemote(url);
+    return parsed ?? { owner: null, name: null };
+  } catch {
+    return { owner: null, name: null };
+  }
+}
+function tokenSourceFromEnv(env) {
+  if (env.TESTED_TOKEN) return "TESTED_TOKEN";
+  if (env.TESTED_INGEST_TOKEN) return "TESTED_INGEST_TOKEN";
+  if (env.TESTED_TOKEN_FILE) return "TESTED_TOKEN_FILE";
+  return "token";
+}
+function formatTokenHuman(identity) {
+  const lines = [
+    heading("tested.dev \u2014 token"),
+    "",
+    ...tokenMintGuidance(identity).map((line) => dim(`  ${line}`)),
+    ""
+  ];
+  return lines.join("\n");
+}
+function formatTokenJson(identity) {
+  return JSON.stringify(
+    {
+      schemaVersion: 1,
+      mintUrl: ingestTokenSettingsUrl(identity.owner, identity.name),
+      envNames: [...INGEST_TOKEN_ENV_NAMES],
+      owner: identity.owner,
+      name: identity.name
+    },
+    null,
+    2
+  ) + "\n";
+}
+function formatWhoamiHuman(result) {
+  const lines = [heading("tested.dev \u2014 whoami"), ""];
+  if (result.tokenSet) {
+    lines.push(dim(`  token: set via ${result.source} (value not shown)`));
+  } else {
+    lines.push(dim("  token: not set"));
+    for (const line of tokenMintGuidance(result.identity)) {
+      lines.push(dim(`  ${line}`));
+    }
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+function formatWhoamiJson(result) {
+  return JSON.stringify(
+    {
+      schemaVersion: 1,
+      tokenSet: result.tokenSet,
+      source: result.source,
+      mintUrl: ingestTokenSettingsUrl(result.identity.owner, result.identity.name),
+      envNames: [...INGEST_TOKEN_ENV_NAMES]
+    },
+    null,
+    2
+  ) + "\n";
+}
+async function runToken(opts) {
+  const identity = await resolveRepoIdentity(opts);
+  const stdout = opts.json ? formatTokenJson(identity) : formatTokenHuman(identity);
+  return { stdout, exitCode: 0 };
+}
+async function runWhoami(opts) {
+  const env = opts.env ?? process.env;
+  const identity = await resolveRepoIdentity(opts);
+  const resolve7 = opts.resolveTokenFn ?? resolveToken;
+  let tokenSet = false;
+  let source = null;
+  try {
+    const token = resolve7({ env, isTTY: false, warn: () => {
+    } });
+    tokenSet = Boolean(token);
+    source = tokenSet ? tokenSourceFromEnv(env) : null;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      stdout: "",
+      stderr: formatCliError(message),
+      exitCode: 1
+    };
+  }
+  const result = { tokenSet, source, identity, exitCode: tokenSet ? 0 : 1 };
+  const stdout = opts.json ? formatWhoamiJson(result) : formatWhoamiHuman(result);
+  return { stdout, stderr: "", exitCode: result.exitCode };
+}
+function registerTokenCommand(program2) {
+  program2.command("token").description("Print the ingest-token mint URL and accepted env names").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+    try {
+      const result = await runToken({ cwd: process.cwd(), json: opts.json });
+      process.stdout.write(result.stdout.endsWith("\n") ? result.stdout : result.stdout + "\n");
+      process.exitCode = result.exitCode;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(formatCliError(message));
+      process.exitCode = 1;
+    }
+  });
+}
+function registerWhoamiCommand(program2) {
+  program2.command("whoami").description("Report whether an ingest token is set (never prints the value)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+    try {
+      const result = await runWhoami({ cwd: process.cwd(), json: opts.json });
+      if (result.stderr) process.stderr.write(result.stderr);
+      if (result.stdout) {
+        process.stdout.write(
+          result.stdout.endsWith("\n") ? result.stdout : result.stdout + "\n"
+        );
+      }
+      process.exitCode = result.exitCode;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(errorBlock(message));
+      process.exitCode = 1;
+    }
   });
 }
 
 // src/cli.ts
 function createProgram() {
-  const program2 = new Command10();
+  const program2 = new Command11();
   program2.name("tested").description(
     [
       "Coverage your agent can use.",
@@ -2708,6 +3087,8 @@ function createProgram() {
   registerDiffCommand(program2);
   registerCheckCommand(program2);
   registerPushCommand(program2);
+  registerTokenCommand(program2);
+  registerWhoamiCommand(program2);
   registerExplainCommand(program2);
   registerIgnoresCommand(program2);
   return program2;