@todoist/doistbot-cli 0.0.0-stage → 1.0.16

package/dist/auth.js

@@ -0,0 +1,202 @@
+import { spawn } from 'child_process';
+import { homedir } from 'os';
+import path from 'path';
+import {} from '@earendil-works/pi-ai';
+import { getEnvApiKeys } from './env.js';
+import { createFileStore } from './file-store.js';
+import { promptInput } from './input.js';
+import { createCompositeStore, createKeyringStore, SecureStoreUnavailableError, } from './secure-store.js';
+import { writeLine } from './terminal.js';
+const GEMINI_ACCOUNT_NAME = 'gemini-api-key';
+const OPENROUTER_ACCOUNT_NAME = 'openrouter-api-key';
+export function createGeminiKeyStore() {
+    return createCompositeStore(createKeyringStore(GEMINI_ACCOUNT_NAME), createFileStore(GEMINI_ACCOUNT_NAME));
+}
+export function createOpenRouterKeyStore() {
+    return createCompositeStore(createKeyringStore(OPENROUTER_ACCOUNT_NAME), createFileStore(OPENROUTER_ACCOUNT_NAME));
+}
+export const OPENAI_CODEX_PROVIDER_ID = 'openai-codex';
+export const PI_AUTH_API_KEY = `pi-auth://${OPENAI_CODEX_PROVIDER_ID}`;
+const OPENAI_CODEX_BROWSER_LOGIN_METHOD = 'browser';
+export async function createPiAuthRuntime() {
+    // Pi's own CLI installs its npm Undici implementation before initializing
+    // ModelRuntime. SDK consumers must do the same on Node 26 so compressed OAuth
+    // responses are decoded before response.json() parses them.
+    const { install } = await import('undici');
+    install();
+    const { ModelRuntime } = await import('@earendil-works/pi-coding-agent');
+    return await ModelRuntime.create({
+        authPath: path.join(homedir(), '.pi', 'agent', 'auth.json'),
+        allowModelNetwork: false,
+        modelsPath: null,
+        refreshOnCreate: false,
+    });
+}
+export function getBrowserOpenCommand(platform, url) {
+    if (platform === 'darwin') {
+        return { command: 'open', args: [url] };
+    }
+    if (platform === 'win32') {
+        return { command: 'cmd', args: ['/c', 'start', '', url] };
+    }
+    return { command: 'xdg-open', args: [url] };
+}
+/**
+ * Check that the stored OAuth session is usable, not just present.
+ * The Pi model runtime returns the cached access token when unexpired; when
+ * expired it attempts one cross-process-locked refresh and persists the result.
+ * Refresh failures preserve the stored credentials. Unexpected storage errors
+ * propagate.
+ */
+export async function getOpenAICodexAuthState(runtime) {
+    const resolvedRuntime = runtime ?? (await createPiAuthRuntime());
+    const credentials = await resolvedRuntime.listCredentials();
+    if (!credentials.some(({ providerId, type }) => providerId === OPENAI_CODEX_PROVIDER_ID && type === 'oauth')) {
+        return 'missing';
+    }
+    try {
+        const auth = await resolvedRuntime.getAuth(OPENAI_CODEX_PROVIDER_ID);
+        return auth?.auth.apiKey ? 'ready' : 'refresh-failed';
+    }
+    catch (error) {
+        if (typeof error === 'object' &&
+            error !== null &&
+            'code' in error &&
+            error.code === 'oauth') {
+            return 'refresh-failed';
+        }
+        throw error;
+    }
+}
+export async function loginOpenAICodex(runtime) {
+    const resolvedRuntime = runtime ?? (await createPiAuthRuntime());
+    await resolvedRuntime.login(OPENAI_CODEX_PROVIDER_ID, 'oauth', createOpenAICodexBrowserLoginInteraction());
+}
+export async function logoutOpenAICodex(runtime) {
+    const resolvedRuntime = runtime ?? (await createPiAuthRuntime());
+    await resolvedRuntime.logout(OPENAI_CODEX_PROVIDER_ID);
+}
+export async function readStoredGeminiApiKey(store = createGeminiKeyStore()) {
+    const result = await store.getSecret();
+    const trimmed = result.value?.trim();
+    return trimmed ? { value: trimmed, backend: result.backend } : { value: undefined };
+}
+export async function getStoredGeminiApiKey(store = createGeminiKeyStore()) {
+    return (await readStoredGeminiApiKey(store)).value;
+}
+export async function readStoredOpenRouterApiKey(store = createOpenRouterKeyStore()) {
+    const result = await store.getSecret();
+    const trimmed = result.value?.trim();
+    return trimmed ? { value: trimmed, backend: result.backend } : { value: undefined };
+}
+export async function getStoredOpenRouterApiKey(store = createOpenRouterKeyStore()) {
+    return (await readStoredOpenRouterApiKey(store)).value;
+}
+export async function saveGeminiApiKey(apiKey, store = createGeminiKeyStore()) {
+    const normalized = apiKey.trim();
+    if (!normalized) {
+        throw new Error('Gemini API key cannot be empty');
+    }
+    try {
+        return await store.setSecret(normalized);
+    }
+    catch (error) {
+        if (error instanceof SecureStoreUnavailableError) {
+            throw new SecureStoreUnavailableError(`${error.message} Set GEMINI_API_KEY in your environment instead.`);
+        }
+        throw error;
+    }
+}
+export async function saveOpenRouterApiKey(apiKey, store = createOpenRouterKeyStore()) {
+    const normalized = apiKey.trim();
+    if (!normalized) {
+        throw new Error('OpenRouter API key cannot be empty');
+    }
+    try {
+        return await store.setSecret(normalized);
+    }
+    catch (error) {
+        if (error instanceof SecureStoreUnavailableError) {
+            throw new SecureStoreUnavailableError(`${error.message} Set OPENROUTER_API_KEY in your environment instead.`);
+        }
+        throw error;
+    }
+}
+export async function deleteOpenRouterApiKey(store = createOpenRouterKeyStore()) {
+    return await store.deleteSecret();
+}
+export async function deleteGeminiApiKey(store = createGeminiKeyStore()) {
+    return await store.deleteSecret();
+}
+export async function getAuthStatus({ env = process.env, runtime, geminiStore = createGeminiKeyStore(), openRouterStore = createOpenRouterKeyStore(), } = {}) {
+    const envApiKeys = getEnvApiKeys(env);
+    const geminiStored = envApiKeys.gemini
+        ? { value: undefined }
+        : await readStoredGeminiApiKey(geminiStore).catch(() => ({ value: undefined }));
+    const openRouterStored = envApiKeys.openrouter
+        ? { value: undefined }
+        : await readStoredOpenRouterApiKey(openRouterStore).catch(() => ({ value: undefined }));
+    const openAICodexAuthState = await getOpenAICodexAuthState(runtime);
+    return {
+        openai: openAICodexAuthState === 'missing'
+            ? { configured: false, source: undefined }
+            : {
+                configured: true,
+                source: 'pi-auth',
+                refreshFailed: openAICodexAuthState === 'refresh-failed',
+            },
+        gemini: envApiKeys.gemini
+            ? { configured: true, source: 'env' }
+            : {
+                configured: geminiStored.value !== undefined,
+                source: geminiStored.value !== undefined
+                    ? geminiStored.backend === 'file'
+                        ? 'file'
+                        : 'keychain'
+                    : undefined,
+            },
+        openrouter: envApiKeys.openrouter
+            ? { configured: true, source: 'env' }
+            : {
+                configured: openRouterStored.value !== undefined,
+                source: openRouterStored.value !== undefined
+                    ? openRouterStored.backend === 'file'
+                        ? 'file'
+                        : 'keychain'
+                    : undefined,
+            },
+    };
+}
+function createOpenAICodexBrowserLoginInteraction() {
+    return {
+        notify: (event) => {
+            if (event.type === 'auth_url') {
+                openUrlInBrowser(event.url);
+                writeLine('Open this URL in your browser:');
+                writeLine(event.url);
+                if (event.instructions) {
+                    writeLine(event.instructions);
+                }
+            }
+            else if (event.type === 'info' || event.type === 'progress') {
+                writeLine(event.message);
+            }
+        },
+        prompt: async (prompt) => {
+            if (prompt.type === 'select') {
+                const browserOption = prompt.options.find(({ id }) => id === OPENAI_CODEX_BROWSER_LOGIN_METHOD);
+                if (!browserOption) {
+                    throw new Error('OpenAI Codex did not provide a browser login option');
+                }
+                return browserOption.id;
+            }
+            return await promptInput(`${prompt.message} `, prompt.signal);
+        },
+    };
+}
+function openUrlInBrowser(url) {
+    const { command, args } = getBrowserOpenCommand(process.platform, url);
+    const child = spawn(command, args, { detached: true, stdio: 'ignore' });
+    child.on('error', () => undefined);
+    child.unref();
+}

package/dist/config.js

@@ -0,0 +1,145 @@
+import { getOpenAICodexAuthState, getStoredGeminiApiKey, getStoredOpenRouterApiKey, PI_AUTH_API_KEY, } from './auth.js';
+import { getEnvApiKeys } from './env.js';
+export const SUPPORTED_CLI_REVIEW_MODELS = [
+    'openai',
+    'deepseek',
+    'gemini',
+    'zai',
+];
+export function parseCliReviewModels(value) {
+    const models = value.split(',').map((model) => model.trim().toLowerCase());
+    if (models.some((model) => model.length === 0)) {
+        throw new Error(`--models requires a comma-separated list of: ${SUPPORTED_CLI_REVIEW_MODELS.join(', ')}`);
+    }
+    const supportedModels = new Set(SUPPORTED_CLI_REVIEW_MODELS);
+    const unsupportedModels = [...new Set(models.filter((model) => !supportedModels.has(model)))];
+    if (unsupportedModels.length > 0) {
+        throw new Error(`Unsupported review model(s): ${unsupportedModels.join(', ')}. Choose from: ${SUPPORTED_CLI_REVIEW_MODELS.join(', ')}`);
+    }
+    return [...new Set(models)];
+}
+const REQUIRED_CLI_AUTH_PROVIDERS = [{ provider: 'openai', label: 'OpenAI' }];
+const ALL_REVIEW_FOCUSES = [
+    'general',
+    'security',
+    'reuse',
+    'quality',
+    'efficiency',
+    'tests',
+    'standards',
+];
+const OPENROUTER_REVIEW_MODELS = ['deepseek', 'zai'];
+const CLI_GEMINI_REVIEW_MODEL = 'gemini-3.8-flash';
+function createCliGeminiCredential(apiKey) {
+    return {
+        apiKey,
+        modelName: CLI_GEMINI_REVIEW_MODEL,
+    };
+}
+function createCliGeminiSummaryModel(credential) {
+    if (!credential) {
+        return undefined;
+    }
+    return {
+        provider: 'gemini',
+        credential,
+        modelName: CLI_GEMINI_REVIEW_MODEL,
+    };
+}
+export async function getApiKeys(env = process.env, auth = {
+    getStoredGeminiApiKey,
+    getStoredOpenRouterApiKey,
+    getOpenAICodexAuthState,
+}, providers) {
+    const selectedProviders = providers ? new Set(providers) : undefined;
+    const needsGemini = !selectedProviders || selectedProviders.has('gemini');
+    const needsOpenRouter = !selectedProviders || selectedProviders.has('deepseek') || selectedProviders.has('zai');
+    const needsOpenAI = !selectedProviders || selectedProviders.has('openai');
+    const envApiKeys = getEnvApiKeys(env);
+    const storedGeminiApiKey = needsGemini && !envApiKeys.gemini
+        ? await auth.getStoredGeminiApiKey().catch(() => undefined)
+        : undefined;
+    const storedOpenRouterApiKey = needsOpenRouter && !envApiKeys.openrouter
+        ? await auth.getStoredOpenRouterApiKey().catch(() => undefined)
+        : undefined;
+    // Explicit non-OpenAI runs must not refresh an unrelated OAuth session.
+    const openAICodexAuthState = needsOpenAI ? await auth.getOpenAICodexAuthState() : 'missing';
+    const openRouterApiKey = envApiKeys.openrouter || storedOpenRouterApiKey;
+    const apiKeys = {};
+    const geminiApiKey = needsGemini ? envApiKeys.gemini || storedGeminiApiKey : undefined;
+    if (geminiApiKey) {
+        apiKeys.gemini = createCliGeminiCredential(geminiApiKey);
+    }
+    if (needsOpenRouter && openRouterApiKey) {
+        if (!selectedProviders || selectedProviders.has('deepseek')) {
+            apiKeys.deepseek = { apiKey: openRouterApiKey, piProviderId: 'openrouter' };
+        }
+        if (!selectedProviders) {
+            apiKeys.grok = { apiKey: openRouterApiKey, piProviderId: 'openrouter' };
+        }
+        if (!selectedProviders || selectedProviders.has('zai')) {
+            apiKeys.zai = { apiKey: openRouterApiKey, piProviderId: 'openrouter' };
+        }
+    }
+    if (openAICodexAuthState === 'ready') {
+        apiKeys.openai = PI_AUTH_API_KEY;
+    }
+    return apiKeys;
+}
+export function getMissingRequiredCliAuthProviders(status) {
+    return REQUIRED_CLI_AUTH_PROVIDERS.filter(({ provider }) => {
+        const providerStatus = status[provider];
+        return !providerStatus.configured || providerStatus.refreshFailed === true;
+    }).map(({ label }) => label);
+}
+export function getMissingRequiredCliReviewAuthProviders(apiKeys) {
+    return REQUIRED_CLI_AUTH_PROVIDERS.filter(({ provider }) => {
+        switch (provider) {
+            case 'openai':
+                return !apiKeys.openai;
+        }
+        return false;
+    }).map(({ label }) => label);
+}
+export function formatMissingRequiredCliAuthProviders(missingProviders) {
+    return `${missingProviders.join(' and ')} authentication unavailable (not configured, or the session could not be refreshed); run \`doistbot auth login\``;
+}
+export function getCliReviewRouting(apiKeys, selectedModels) {
+    if (selectedModels !== undefined) {
+        if (selectedModels.length === 0) {
+            throw new Error('At least one review model must be selected.');
+        }
+        const focusModels = [...selectedModels];
+        return {
+            reviewModelsEnabled: focusModels,
+            reviewModelsByFocus: Object.fromEntries(ALL_REVIEW_FOCUSES.map((focus) => [focus, focusModels])),
+            geminiFallbackFocuses: [],
+            ...(selectedModels.includes('gemini') &&
+                !selectedModels.includes('zai') &&
+                apiKeys.gemini
+                ? { reviewSummaryModel: createCliGeminiSummaryModel(apiKeys.gemini) }
+                : {}),
+        };
+    }
+    const hasGemini = Boolean(apiKeys.gemini);
+    const hasOpenRouter = Boolean(apiKeys.deepseek && apiKeys.zai);
+    if (hasGemini && hasOpenRouter) {
+        return {
+            reviewModelsEnabled: ['openai', ...OPENROUTER_REVIEW_MODELS],
+            geminiFallbackFocuses: ALL_REVIEW_FOCUSES,
+        };
+    }
+    const focusModels = [
+        'openai',
+        ...(hasGemini ? ['gemini'] : []),
+        ...(hasOpenRouter ? OPENROUTER_REVIEW_MODELS : []),
+    ];
+    return {
+        reviewModelsEnabled: focusModels,
+        reviewModelsByFocus: Object.fromEntries(ALL_REVIEW_FOCUSES.map((focus) => [focus, focusModels])),
+        geminiFallbackFocuses: [],
+        ...(hasGemini && !hasOpenRouter
+            ? { reviewSummaryModel: createCliGeminiSummaryModel(apiKeys.gemini) }
+            : {}),
+    };
+}

package/dist/env.js

@@ -0,0 +1,10 @@
+function getEnvValue(value) {
+    return value?.trim() || undefined;
+}
+export function getEnvApiKeys(env = process.env) {
+    return {
+        gemini: getEnvValue(env.GEMINI_API_KEY),
+        openai: getEnvValue(env.OPENAI_KEY) || getEnvValue(env.OPENAI_API_KEY),
+        openrouter: getEnvValue(env.OPENROUTER_API_KEY),
+    };
+}

package/dist/file-store.js

@@ -0,0 +1,112 @@
+import { randomUUID } from 'crypto';
+import { promises as fs } from 'fs';
+import { homedir } from 'os';
+import path from 'path';
+import { describeError, SecureStoreUnavailableError, } from './secure-store.js';
+export const FILE_STORE_PATH = path.join(homedir(), '.doistbot', 'credentials.json');
+const FILE_BACKEND = 'file';
+export function createFileStore(account, filePath = FILE_STORE_PATH) {
+    return {
+        async getSecret() {
+            const data = await readCredentialsFile(filePath);
+            const raw = data[account];
+            if (typeof raw !== 'string' || raw.length === 0) {
+                return { value: null };
+            }
+            return { value: raw, backend: FILE_BACKEND };
+        },
+        async setSecret(secret) {
+            assertWritableOnThisPlatform();
+            const data = await readCredentialsFile(filePath);
+            data[account] = secret;
+            await writeCredentialsFile(filePath, data);
+            return FILE_BACKEND;
+        },
+        async deleteSecret() {
+            const data = await readCredentialsFile(filePath);
+            if (!(account in data)) {
+                return false;
+            }
+            delete data[account];
+            if (Object.keys(data).length === 0) {
+                await removeFile(filePath);
+            }
+            else {
+                assertWritableOnThisPlatform();
+                await writeCredentialsFile(filePath, data);
+            }
+            return true;
+        },
+    };
+}
+function assertWritableOnThisPlatform() {
+    if (process.platform === 'win32') {
+        throw new SecureStoreUnavailableError('File-based credential fallback is not supported on Windows because POSIX 0600 permissions cannot be enforced. Use Windows Credential Manager or set an API key environment variable.');
+    }
+}
+async function readCredentialsFile(filePath) {
+    let raw;
+    try {
+        raw = await fs.readFile(filePath, 'utf8');
+    }
+    catch (error) {
+        if (isNotFoundError(error)) {
+            return {};
+        }
+        throw new SecureStoreUnavailableError(`Failed to read credentials file at ${filePath}: ${describeError(error)}`);
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            throw new Error('credentials file is not a JSON object');
+        }
+        const result = {};
+        for (const [key, value] of Object.entries(parsed)) {
+            if (typeof value === 'string') {
+                result[key] = value;
+            }
+        }
+        return result;
+    }
+    catch (error) {
+        throw new SecureStoreUnavailableError(`Credentials file at ${filePath} is corrupt: ${describeError(error)}`);
+    }
+}
+async function writeCredentialsFile(filePath, data) {
+    const dir = path.dirname(filePath);
+    try {
+        await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+        await fs.chmod(dir, 0o700);
+    }
+    catch (error) {
+        throw new SecureStoreUnavailableError(`Failed to create credentials directory ${dir}: ${describeError(error)}`);
+    }
+    const tmpPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+    const payload = `${JSON.stringify(data, null, 2)}\n`;
+    try {
+        await fs.writeFile(tmpPath, payload, { mode: 0o600 });
+        await fs.chmod(tmpPath, 0o600);
+        await fs.rename(tmpPath, filePath);
+    }
+    catch (error) {
+        await removeFile(tmpPath).catch(() => undefined);
+        throw new SecureStoreUnavailableError(`Failed to write credentials file at ${filePath}: ${describeError(error)}`);
+    }
+}
+async function removeFile(filePath) {
+    try {
+        await fs.unlink(filePath);
+    }
+    catch (error) {
+        if (isNotFoundError(error)) {
+            return;
+        }
+        throw new SecureStoreUnavailableError(`Failed to remove credentials file at ${filePath}: ${describeError(error)}`);
+    }
+}
+function isNotFoundError(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        'code' in error &&
+        error.code === 'ENOENT');
+}

package/dist/index.js

@@ -0,0 +1,164 @@
+#!/usr/bin/env node
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import { Command, Option } from 'commander';
+import { AUTH_LOGOUT_PROVIDER_USAGE, runAuthLogout, runAuthSetup, runAuthStatus, } from './actions/auth.js';
+import { runDoctor } from './actions/doctor.js';
+import { runReview } from './actions/review.js';
+import { formatReviewUsage } from './actions/review-usage.js';
+import { runSetup } from './actions/setup.js';
+import { parseCliReviewModels, SUPPORTED_CLI_REVIEW_MODELS } from './config.js';
+import { writeErrorLine } from './terminal.js';
+import { notifyAndRefreshCliUpdateCache, notifyIfCliUpdateAvailable } from './update-check.js';
+export { getSandboxRoot } from './runtime.js';
+function getPackageVersion() {
+    const packageJsonPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../package.json');
+    try {
+        const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+        return typeof packageJson.version === 'string' ? packageJson.version : '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+const PACKAGE_VERSION = getPackageVersion();
+const LOCAL_REVIEW_SOURCE_STAGED = 'staged';
+function getUpdateCacheEntrypointPath() {
+    return fileURLToPath(new URL('./update-cache-entrypoint.js', import.meta.url));
+}
+function parseReviewInput(sourceArg, options = {}) {
+    if (sourceArg !== undefined && sourceArg !== LOCAL_REVIEW_SOURCE_STAGED) {
+        throw new Error(formatReviewUsage());
+    }
+    if (sourceArg === LOCAL_REVIEW_SOURCE_STAGED && options.base) {
+        throw new Error(formatReviewUsage());
+    }
+    const reviewOptions = {
+        json: options.json === true,
+        ...(options.models !== undefined ? { models: parseCliReviewModels(options.models) } : {}),
+    };
+    if (options.base !== undefined) {
+        return { source: { kind: 'base-ref', ref: options.base }, ...reviewOptions };
+    }
+    return {
+        source: sourceArg === LOCAL_REVIEW_SOURCE_STAGED ? LOCAL_REVIEW_SOURCE_STAGED : 'base',
+        ...reviewOptions,
+    };
+}
+export function createProgram({ runAuthLogout: authLogout = runAuthLogout, runAuthSetup: authSetup = runAuthSetup, runAuthStatus: authStatus = runAuthStatus, runDoctor: doctor = runDoctor, runSetup: setup = runSetup, runReview: review = runReview, runAutomaticUpdateCheck: automaticUpdateCheck = async () => await notifyAndRefreshCliUpdateCache({
+    currentVersion: PACKAGE_VERSION,
+    updateCacheEntrypointPath: getUpdateCacheEntrypointPath(),
+}), runUpdateCheck: updateCheck = async () => await notifyIfCliUpdateAvailable({ currentVersion: PACKAGE_VERSION }), } = {}) {
+    const program = new Command();
+    const automaticUpdateCommands = new Set();
+    function withAutomaticUpdateCheck(command) {
+        automaticUpdateCommands.add(command);
+        return command;
+    }
+    function shouldRunAutomaticUpdateCheck(actionCommand) {
+        if (!automaticUpdateCommands.has(actionCommand)) {
+            return false;
+        }
+        if (actionCommand.name() === 'review' && actionCommand.opts().json) {
+            return false;
+        }
+        return true;
+    }
+    program
+        .name('doistbot')
+        .description('Doistbot local self-review CLI')
+        .version(PACKAGE_VERSION)
+        .hook('postAction', async (_thisCommand, actionCommand) => {
+        if (shouldRunAutomaticUpdateCheck(actionCommand)) {
+            await automaticUpdateCheck();
+        }
+    });
+    withAutomaticUpdateCheck(program
+        .command('doctor')
+        .description('Diagnose local Doistbot CLI setup')
+        .action(async () => await doctor()));
+    withAutomaticUpdateCheck(program
+        .command('setup')
+        .description('Check prerequisites and configure local provider auth')
+        .action(async () => await setup()));
+    const authCommand = withAutomaticUpdateCheck(program
+        .command('auth')
+        .description('Authenticate Doistbot CLI with local review providers')
+        .action(async () => await authSetup()));
+    withAutomaticUpdateCheck(authCommand
+        .command('status')
+        .description('Show provider authentication status')
+        .action(async () => await authStatus()));
+    withAutomaticUpdateCheck(authCommand
+        .command('login')
+        .description('Configure provider authentication')
+        .action(async () => await authSetup()));
+    withAutomaticUpdateCheck(authCommand
+        .command('logout [provider]')
+        .description(`Clear stored Doistbot CLI auth for ${AUTH_LOGOUT_PROVIDER_USAGE}`)
+        .action(async (provider) => await authLogout(provider)));
+    withAutomaticUpdateCheck(program
+        .command('review [source]')
+        .description('Run a local self-review. Use `staged` to review only staged changes.')
+        .option('--base <ref>', 'Review local changes against a specific base ref')
+        .option('--models <models>', `Use only these review models (${SUPPORTED_CLI_REVIEW_MODELS.join(', ')})`)
+        .addOption(new Option('--json', 'Print machine-readable JSON instead of terminal-formatted markdown').hideHelp())
+        .action(async (source, options) => await review(parseReviewInput(source, options))));
+    program
+        .command('update')
+        .description('Check whether a newer Doistbot CLI version is available')
+        .action(async () => await updateCheck());
+    return program;
+}
+export async function runCliEntrypoint({ argv = process.argv, dependencies, exitProcess = exitCliProcess, writeErrorLine: writeError = writeErrorLine, } = {}) {
+    try {
+        await createProgram(dependencies).parseAsync(argv, { from: 'node' });
+        if (shouldForceExitAfterCommand(argv)) {
+            await exitProcess(getProcessExitCode());
+        }
+    }
+    catch (error) {
+        writeError(`Error: ${error.message}`);
+        process.exitCode = 1;
+        if (shouldForceExitAfterCommand(argv)) {
+            await exitProcess(1);
+        }
+    }
+}
+export function shouldForceExitAfterCommand(argv) {
+    const command = argv[2];
+    const authSubcommand = argv[3];
+    return command === 'setup' || (command === 'auth' && authSubcommand !== 'status');
+}
+function flushStream(stream) {
+    if (!stream.writable) {
+        return Promise.resolve();
+    }
+    return new Promise((resolve) => {
+        stream.write('', () => resolve());
+    });
+}
+async function exitCliProcess(code) {
+    await Promise.all([flushStream(process.stdout), flushStream(process.stderr)]);
+    process.exit(code);
+}
+function getProcessExitCode() {
+    return typeof process.exitCode === 'number' ? process.exitCode : 0;
+}
+export function isCliEntrypoint(argvPath, moduleUrl) {
+    if (!argvPath) {
+        return false;
+    }
+    const modulePath = fileURLToPath(moduleUrl);
+    const resolvedArgvPath = path.resolve(argvPath);
+    try {
+        return fs.realpathSync(resolvedArgvPath) === fs.realpathSync(modulePath);
+    }
+    catch {
+        return resolvedArgvPath === modulePath;
+    }
+}
+if (isCliEntrypoint(process.argv[1], import.meta.url)) {
+    await runCliEntrypoint();
+}

package/dist/input.js

@@ -0,0 +1,40 @@
+import { createInterface } from 'node:readline/promises';
+export async function promptInput(prompt, signal) {
+    const rl = createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    try {
+        return await rl.question(prompt, { signal });
+    }
+    finally {
+        rl.close();
+    }
+}
+export function promptHiddenInput(prompt) {
+    if (!process.stdin.isTTY) {
+        return promptInput(prompt);
+    }
+    return promptPassword(prompt);
+}
+export async function promptMultiSelect({ message, choices, }) {
+    const { default: checkbox } = await import('@inquirer/checkbox');
+    return (await checkbox({
+        message,
+        choices,
+        required: true,
+        theme: {
+            icon: {
+                checked: ' ●',
+                cursor: '›',
+                unchecked: ' ○',
+            },
+        },
+    }));
+}
+async function promptPassword(prompt) {
+    const { default: password } = await import('@inquirer/password');
+    return await password({
+        message: prompt.trim().replace(/:$/, ''),
+    });
+}