altalandi 0.3.1 → 0.5.0

package/README.md

@@ -96,6 +96,9 @@ altalandi "Some English or Icelandic text."
 echo "some text" | altalandi --domain marketing
 altalandi --json "..."                 # full JSON response
 altalandi --fast "..."                 # skip the meaning + nativeness gates
+altalandi --diff --file draft.txt      # show before, after and every change with its reason
+altalandi --review --file in.txt --out out.txt   # for agents: one block to show as it is
+altalandi --report --file draft.txt    # also write a Markdown report to ./altalandi-reports/
 ```
 
 | flag | default | meaning |
@@ -103,8 +106,37 @@ altalandi --fast "..."                 # skip the meaning + nativeness gates
 | `--domain` | `general` | `general` \| `marketing` \| `data-analysis` \| `childrens-fiction` |
 | `--register` | `neutral` | `formal` \| `neutral` \| `warm` |
 | `--json` | off | print the full API response |
+| `--diff` | off | print the text before and after, then each change with its reason, on `stderr` (coloured in a terminal; `NO_COLOR` turns colour off) |
+| `--review` | off | print one Markdown block on `stdout`, made to be shown as it is: the verdict, the text before and after, each change with its reason, what the call cost and the balance and free units left. Exits on the outcome: `0` rewritten and verified or no change needed, `3` refused or unverified, `4` out of credit |
+| `--no-store` | off | send `contribute: false`: this text is never kept. Without it, free use (calls covered by the free daily units) is kept with personal data scrubbed, to improve the service; paid use is kept only with consent ([privacy](https://altalandi.is/personuvernd#textabanki)) |
+| `--out <file>` | | write the refined text to `<file>` (UTF-8); with `--review` the block names it when the text is shortened |
+| `--report` | off | also write `./altalandi-reports/altalandi-<time>-<id>.md`: input, output, a table of every change (before, after, reason, layer), warnings and the verdict |
+| `--report-dir <dir>` | | write the report to `<dir>` instead (implies `--report`) |
 | `--fast` | off | `preserveMeaning:false`, `scoreNativeness:false`, `onlyImprove:false`, `polishPass:false`, `scoring:"none"` — normally one model call (structured input can still add a structure-preserving retry) |
 
+## Before and after
+
+`--diff` prints what the website shows inline, in the terminal:
+
+```text
+── Fyrir ───────────────────────────────────
+Vertu viss um að ná út til okkar ef þú hefur einhverjar spurningar.
+
+── Eftir ───────────────────────────────────
+Ekki hika við að hafa samband ef einhverjar spurningar vakna.
+
+── Breytingar (1) ──────────────────────────
+1. − Vertu viss um að ná út til okkar ef þú hefur einhverjar spurningar.
+   + Ekki hika við að hafa samband ef einhverjar spurningar vakna.
+   ↳ <the reason the engine gives>
+
+Endurskrifað og merking staðfest · innfæddni 91/100
+```
+
+`--report` (or `ALTALANDI_REPORT=1`) writes the same content as a Markdown file
+you can keep or share. Reports are off by default because they contain your text.
+`stdout` stays the refined text alone either way, so piping is unaffected.
+
 ## The meaning guarantee
 
 Altalandi never silently changes meaning. For Icelandic input where the rewrite
@@ -138,6 +170,9 @@ the explicit verification opt-out and exits 0 after a successful API response.
 |-----|---------|---------|
 | `ALTALANDI_API_KEY` | — | your key (Bearer). Mint at https://altalandi.is/portal |
 | `ALTALANDI_BASE_URL` | `https://altalandi.is/api` | API base (override for self-hosting) |
+| `ALTALANDI_DIFF` | — | `1` = always print the before/after (as `--diff`) |
+| `ALTALANDI_REPORT` | — | `1` = always write a report (as `--report`) |
+| `ALTALANDI_REPORT_DIR` | `./altalandi-reports` | where reports go |
 
 MIT licensed. Calls are paid from the account's prepaid credit (a 500 kr trial,
 then credit bought in the portal); a call the credit cannot cover exits with the

package/altalandi.mjs

@@ -10,6 +10,7 @@
 // meaning verdict, API warnings, and the diff.
 
 import { refine } from "./client.mjs";
+import { beforeAfterText, costLines, outcomeOf, reportEnabled, reviewMarkdown, writeReport } from "./report.mjs";
 import { readCredentials, resolveKey, runLogin, runLogout, runWhoami } from "./auth.mjs";
 
 const args = process.argv.slice(2);
@@ -71,7 +72,7 @@ applied · 1 the check or the update failed.`);
 }
 
 if (!handled) {
-const opts = { domain: "general", register: "neutral", json: false, fast: false };
+const opts = { domain: "general", register: "neutral", json: false, fast: false, diff: false, review: false, report: undefined };
 const positional = [];
 for (let i = 0; i < args.length; i++) {
   const a = args[i];
@@ -83,6 +84,12 @@ for (let i = 0; i < args.length; i++) {
   else if (a === "--base-url") opts.baseUrl = args[++i];
   else if (a === "--key") opts.key = args[++i];
   else if (a === "--file") opts.file = args[++i];
+  else if (a === "--diff") opts.diff = true;
+  else if (a === "--review") opts.review = true;
+  else if (a === "--out") opts.out = args[++i];
+  else if (a === "--no-store") opts.noStore = true;
+  else if (a === "--report") opts.report = true;
+  else if (a === "--report-dir") { opts.report = true; opts.reportDir = args[++i]; }
   else positional.push(a);
 }
 
@@ -92,7 +99,9 @@ function help() {
 Usage:
   altalandi login                       connect this computer to your account (once)
   altalandi "text to refine"
-  altalandi --file draft.txt            read the text from a file (best for agents)
+  altalandi --file draft.txt            read the text from a file
+  altalandi --review --file in.txt --out out.txt
+                                        for agents: one block to show as it is
   echo "text" | altalandi
   altalandi --domain marketing --register warm "text"
 
@@ -110,6 +119,14 @@ Options:
   --fast       no polish, no nativeness score, no meaning gate — normally one writer call
                (structured input can still add a structure-preserving retry)
   --json       print the full JSON response
+  --diff       show the text before and after, and every change with its reason (stderr)
+  --review     print one Markdown block on stdout to show the user as it is: verdict,
+               before, after, every change with its reason, the cost and the balance
+  --out        write the refined text to this UTF-8 file (use with --review)
+  --no-store   don't keep this text: free use is otherwise kept, scrubbed of personal
+               data, to improve the service (paid use is kept only with consent)
+  --report     also write a Markdown report (input, output, changes, reasons, verdict)
+               to ./altalandi-reports/  (or --report-dir <dir>; ALTALANDI_REPORT=1 turns it on)
   --file       read the text from a UTF-8 file instead of an argument
   --base-url   API base  (default $ALTALANDI_BASE_URL or https://altalandi.is/api)
 
@@ -150,6 +167,7 @@ const requestOptions = {
   baseUrl,
   domain: opts.domain,
   register: opts.register,
+  ...(opts.noStore ? { contribute: false } : {}),
 };
 // --fast disables every optional quality/verification pass. The writer can
 // still retry once when it drops document structure, as documented in --help.
@@ -163,13 +181,42 @@ if (opts.fast) {
   requestOptions.scoring = "none";
 }
 
+// /v1/me before and after the call gives the cost and the balance for the
+// review block. Best-effort: a failed lookup only blanks those lines.
+async function me() {
+  try {
+    const res = await fetch(`${baseUrl}/v1/me`, {
+      headers: { authorization: `Bearer ${key}`, accept: "application/json" },
+      signal: AbortSignal.timeout(15_000),
+    });
+    return res.ok ? await res.json() : null;
+  } catch { return null; }
+}
+const meBefore = opts.review ? await me() : null;
+
 try {
   // refine() owns a single 300-second AbortController deadline across fetch
   // and response-body parsing, matching the hosted package API.
   const data = await refine(text, requestOptions);
-  const verificationFailed = !opts.fast && data.meaningPreserved !== true;
+  // --review exits on the outcome the block states: a vetoed rewrite returns
+  // the original with meaningPreserved true, and must not read as a success.
+  const verificationFailed = opts.review
+    ? ["refused", "unverified"].includes(outcomeOf(data)) && !(opts.fast && outcomeOf(data) === "unverified")
+    : !opts.fast && data.meaningPreserved !== true;
+
+  if (opts.out) {
+    const { writeFile } = await import("node:fs/promises");
+    try { await writeFile(opts.out, String(data.output ?? "") + "\n", "utf8"); }
+    catch (e) { console.error(`Could not write ${opts.out}: ${e.message}`); process.exitCode = 1; }
+  }
 
-  if (opts.json) {
+  if (opts.review) {
+    const meAfter = await me();
+    // Without --out the block is the only copy of a paid result: never shorten it.
+    process.stdout.write(reviewMarkdown(text, data, {
+      before: meBefore, after: meAfter, fullTextAt: opts.out || "", maxChars: opts.out ? 1500 : Infinity,
+    }));
+  } else if (opts.json) {
     process.stdout.write(JSON.stringify(data, null, 2) + "\n");
     if (verificationFailed) {
       console.error("Meaning verification did not pass; JSON was printed, exiting with status 3.");
@@ -187,7 +234,20 @@ try {
     for (const warning of Array.isArray(data.warnings) ? data.warnings : []) {
       console.error(`⚠ ${warning}`);
     }
-    for (const d of data.diffs || []) console.error(`  − ${d.before}\n  + ${d.after}  (${d.reason})`);
+    if (opts.diff || process.env.ALTALANDI_DIFF === "1") {
+      console.error("\n" + beforeAfterText(text, data, { color: Boolean(process.stderr.isTTY) && !process.env.NO_COLOR }));
+    } else {
+      for (const d of data.diffs || []) console.error(`  − ${d.before}\n  + ${d.after}  (${d.reason})`);
+    }
+  }
+
+  if (reportEnabled(opts.report)) {
+    try {
+      const path = await writeReport(text, data, { domain: opts.domain, register: opts.register }, opts.reportDir);
+      console.error(`Skýrsla: ${path}`);
+    } catch (e) {
+      console.error(`Could not write the report: ${e.message}`);
+    }
   }
 
   // stdout/JSON is intentionally written first so callers can inspect the
@@ -195,6 +255,17 @@ try {
   // verified success. --fast is the explicit opt-out from this contract.
   if (verificationFailed) process.exitCode = 3;
 } catch (e) {
+  if (opts.review) {
+    // The block still comes out, so the user sees why and what is left.
+    const head = e.status === 402 ? "Ekki næg inneign fyrir þetta kall"
+      : e.status === 429 ? "Of mörg köll í einu eða á mínútu; reyndu aftur eftir smá stund"
+      : e.status === 401 ? "Lykillinn er ógildur eða afturkallaður (`npx altalandi login`)"
+      : `Kallið mistókst: ${e.message}`;
+    const lines = [`**Altalandi:** ${head}`, "", "Textanum var ekki breytt.", "", "**Kostnaður**",
+      "- Þetta kall: 0 kr.", ...costLines({}, null, meBefore).slice(1)];
+    if (e.status === 402 && !lines.some((l) => l.includes("/portal"))) lines.push("- Bæta við inneign: https://altalandi.is/portal");
+    process.stdout.write(lines.join("\n") + "\n");
+  }
   console.error("Request failed:", e.message);
   if (e.status === 402) console.error("→ Add credit at https://altalandi.is/portal (automatic top-up is available there).");
   if (e.status === 401) console.error("→ The key is invalid or revoked. Run:  npx altalandi login");

package/auth.mjs

@@ -1,215 +1,223 @@
-// `altalandi login` — connect this computer to an Altalandi account once.
-//
-// Device login, the same pattern as `gh auth login`: the CLI asks the API for a
-// short code, the user opens altalandi.is/tengja, signs in or creates an
-// account, and approves. The CLI then receives a key for that account exactly
-// once and stores it in the user's config directory. The key never passes
-// through a chat, a prompt, the clipboard or shell history.
-//
-// Afterwards every `altalandi` call finds the key on its own, so an agent (the
-// Claude Code skill, a script) needs no environment variable at all.
-//
-// Zero dependencies, like the rest of the CLI.
-
-import { spawn } from "node:child_process";
-import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { existsSync, readFileSync } from "node:fs";
-import { homedir, hostname } from "node:os";
-import path from "node:path";
-
-import { skillStatus, skillTarget, writeSkill } from "./update.mjs";
-
-export const DEFAULT_BASE_URL = "https://altalandi.is/api";
-
-/** Where the key is stored. ALTALANDI_CONFIG_DIR overrides (tests, CI). */
-export function configDir({ env = process.env, home = homedir(), platform = process.platform } = {}) {
-  if (env.ALTALANDI_CONFIG_DIR) return env.ALTALANDI_CONFIG_DIR;
-  if (platform === "win32") return path.join(env.APPDATA || path.join(home, "AppData", "Roaming"), "altalandi");
-  return path.join(env.XDG_CONFIG_HOME || path.join(home, ".config"), "altalandi");
-}
-
-export function credentialsFile(opts) {
-  return path.join(configDir(opts), "credentials.json");
-}
-
-/** The stored credentials, or null. Never throws. */
-export function readCredentials(opts) {
-  try {
-    const data = JSON.parse(readFileSync(credentialsFile(opts), "utf8"));
-    return data && typeof data.apiKey === "string" && data.apiKey ? data : null;
-  } catch {
-    return null;
-  }
-}
-
-/** Key resolution order: explicit flag, ALTALANDI_API_KEY, stored login. */
-export function resolveKey({ flag, env = process.env, ...opts } = {}) {
-  if (flag) return { key: flag, source: "flag" };
-  const fromEnv = env.ALTALANDI_API_KEY || env.ALTALANDI_KEY;
-  if (fromEnv) return { key: fromEnv, source: "env" };
-  const stored = readCredentials({ env, ...opts });
-  return stored ? { key: stored.apiKey, source: "login", username: stored.username } : { key: "", source: "none" };
-}
-
-async function saveCredentials(data, opts) {
-  const dir = configDir(opts);
-  await mkdir(dir, { recursive: true });
-  const file = credentialsFile(opts);
-  await writeFile(file, JSON.stringify(data, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
-  try { await chmod(file, 0o600); } catch { /* Windows: the per-user profile directory is the protection */ }
-  return file;
-}
-
-function clientName(env = process.env) {
-  const where = (hostname() || "").split(".")[0].slice(0, 24);
-  const who = env.CLAUDECODE || env.CLAUDE_CODE_ENTRYPOINT ? "Claude Code" : "altalandi CLI";
-  return where ? `${who} á ${where}` : who;
-}
-
-function openBrowser(url) {
-  try {
-    const [cmd, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]]
-      : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
-    const child = spawn(cmd, args, { stdio: "ignore", detached: true, windowsHide: true });
-    child.on("error", () => {});
-    child.unref();
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-
-async function postJson(fetchImpl, url, body) {
-  const res = await fetchImpl(url, {
-    method: "POST",
-    headers: { "content-type": "application/json", accept: "application/json" },
-    body: JSON.stringify(body),
-  });
-  let data = {};
-  try { data = await res.json(); } catch { /* keep {} */ }
-  return { status: res.status, data };
-}
-
-/**
- * Run the device login. Returns an exit code.
- *   0 logged in · 1 failed or expired · 2 bad usage
- */
-export async function runLogin(flags = {}, io = {}) {
-  const env = io.env || process.env;
-  const fetchImpl = io.fetch || globalThis.fetch;
-  const log = io.log || ((m) => console.error(m));
-  const base = (flags.baseUrl || env.ALTALANDI_BASE_URL || DEFAULT_BASE_URL).replace(/\/$/, "");
-  const wait = io.sleep || sleep;
-
-  let start;
-  try {
-    start = await postJson(fetchImpl, `${base}/v1/device/start`, { clientName: clientName(env) });
-  } catch (e) {
-    log(`Náði ekki sambandi við Altalandi (${e.message}).`);
-    return 1;
-  }
-  if (start.status !== 200 || !start.data.deviceCode) {
-    log(`Innskráning fór ekki af stað: ${start.data.detail || `HTTP ${start.status}`}`);
-    return 1;
-  }
-  const { deviceCode, userCode, verificationUriComplete, verificationUri, interval = 3, expiresIn = 600 } = start.data;
-
-  log("");
-  log("  Tengdu þessa tölvu við Altalandi-aðganginn þinn:");
-  log("");
-  log(`    1. Opnaðu   ${verificationUriComplete}`);
-  log(`    2. Skráðu þig inn eða stofnaðu aðgang (500 kr. prufuinneign fylgir)`);
-  log(`    3. Staðfestu kóðann   ${userCode}`);
-  log("");
-  log(`  (Connect this computer: open the link, sign in or sign up, confirm the code.`);
-  log(`   Code page: ${verificationUri})`);
-  log("");
-  if (!flags.noBrowser && !io.noBrowser) openBrowser(verificationUriComplete);
-  log("  Bíð eftir staðfestingu…");
-
-  const deadline = Date.now() + expiresIn * 1000;
-  let result = null;
-  while (Date.now() < deadline) {
-    await wait(Math.max(1, interval) * 1000);
-    let poll;
-    try {
-      poll = await postJson(fetchImpl, `${base}/v1/device/token`, { deviceCode });
-    } catch {
-      continue; // transient network error: keep waiting until the code expires
-    }
-    if (poll.status === 200 && poll.data.status === "approved") { result = poll.data; break; }
-    if (poll.status === 200 && poll.data.status === "pending") continue;
-    if (poll.status === 429) { await wait(10_000); continue; }
-    log(`  Kóðinn rann út eða var hafnað. Keyrðu \`altalandi login\` aftur.`);
-    return 1;
-  }
-  if (!result) {
-    log(`  Kóðinn rann út. Keyrðu \`altalandi login\` aftur.`);
-    return 1;
-  }
-
-  const file = await saveCredentials({
-    apiKey: result.apiKey,
-    username: result.username,
-    baseUrl: base === DEFAULT_BASE_URL ? undefined : base,
-    savedAt: new Date().toISOString(),
-  }, { env });
-  log("");
-  log(`  ✓ Tengt sem ${result.username}. Lykillinn er vistaður í ${file}`);
-
-  // Install or refresh the Claude Code skill — the point of logging in for most
-  // people. Only where Claude Code exists; never create ~/.claude for someone who
-  // does not use it. --no-skill opts out.
-  if (!flags.noSkill) {
-    const target = skillTarget({ env });
-    const status = await skillStatus({ target });
-    if (status === "missing" || status === "outdated") {
-      const { file: skillFile, backup } = await writeSkill({ target });
-      log(`  ✓ Claude Code-hæfnin „altalandi" sett upp: ${skillFile}${backup ? ` (eldri útgáfa afrituð í ${backup})` : ""}`);
-    } else if (status === "current") {
-      log(`  ✓ Claude Code-hæfnin „altalandi" er þegar uppfærð.`);
-    } else if (status === "absent") {
-      log(`  (Claude Code fannst ekki á þessari tölvu, svo hæfnin var ekki sett upp.)`);
-    }
-  }
-  log("");
-  log(`  Prófaðu:   altalandi "Make sure to reach out to us today."`);
-  log(`  Eða segðu Claude:  „Skrifaðu þetta á góðri íslensku með Altalandi."`);
-  return 0;
-}
-
-export async function runLogout(io = {}) {
-  const env = io.env || process.env;
-  const log = io.log || ((m) => console.error(m));
-  const file = credentialsFile({ env });
-  if (!existsSync(file)) { log("Engin vistuð innskráning."); return 0; }
-  await rm(file, { force: true });
-  log(`Innskráning fjarlægð (${file}). Lykillinn sjálfur er enn virkur þar til þú afturkallar hann á https://altalandi.is/portal`);
-  return 0;
-}
-
-export async function runWhoami(flags = {}, io = {}) {
-  const env = io.env || process.env;
-  const fetchImpl = io.fetch || globalThis.fetch;
-  const out = io.out || ((m) => console.log(m));
-  const log = io.log || ((m) => console.error(m));
-  const { key, source } = resolveKey({ flag: flags.key, env });
-  if (!key) { log("Ekki innskráð(ur). Keyrðu: npx altalandi login"); return 2; }
-  const stored = readCredentials({ env });
-  const base = (flags.baseUrl || env.ALTALANDI_BASE_URL || stored?.baseUrl || DEFAULT_BASE_URL).replace(/\/$/, "");
-  let res;
-  try {
-    res = await fetchImpl(`${base}/v1/me`, { headers: { authorization: `Bearer ${key}`, accept: "application/json" } });
-  } catch (e) {
-    log(`Náði ekki sambandi við Altalandi (${e.message}).`);
-    return 1;
-  }
-  if (res.status === 401) { log("Lykillinn er ógildur eða afturkallaður. Keyrðu: npx altalandi login"); return 1; }
-  if (!res.ok) { log(`Villa: HTTP ${res.status}`); return 1; }
-  const me = await res.json();
-  if (flags.json) out(JSON.stringify({ ...me, keySource: source }, null, 2));
-  else out(`${me.username ?? "(lykill án aðgangs)"} · inneign ${me.balanceIsk ?? "—"} kr. · lykill ${me.keyId} (${source})`);
-  return 0;
-}
+// `altalandi login` — connect this computer to an Altalandi account once.
+//
+// Device login, the same pattern as `gh auth login`: the CLI asks the API for a
+// short code, the user opens altalandi.is/tengja, signs in or creates an
+// account, and approves. The CLI then receives a key for that account exactly
+// once and stores it in the user's config directory. The key never passes
+// through a chat, a prompt, the clipboard or shell history.
+//
+// Afterwards every `altalandi` call finds the key on its own, so an agent (the
+// Claude Code skill, a script) needs no environment variable at all.
+//
+// Zero dependencies, like the rest of the CLI.
+
+import { spawn } from "node:child_process";
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { existsSync, readFileSync } from "node:fs";
+import { homedir, hostname } from "node:os";
+import path from "node:path";
+
+import { skillStatus, skillTarget, writeSkill } from "./update.mjs";
+
+export const DEFAULT_BASE_URL = "https://altalandi.is/api";
+
+/** Where the key is stored. ALTALANDI_CONFIG_DIR overrides (tests, CI). */
+export function configDir({ env = process.env, home = homedir(), platform = process.platform } = {}) {
+  if (env.ALTALANDI_CONFIG_DIR) return env.ALTALANDI_CONFIG_DIR;
+  if (platform === "win32") return path.join(env.APPDATA || path.join(home, "AppData", "Roaming"), "altalandi");
+  return path.join(env.XDG_CONFIG_HOME || path.join(home, ".config"), "altalandi");
+}
+
+export function credentialsFile(opts) {
+  return path.join(configDir(opts), "credentials.json");
+}
+
+/** The stored credentials, or null. Never throws. */
+export function readCredentials(opts) {
+  try {
+    const data = JSON.parse(readFileSync(credentialsFile(opts), "utf8"));
+    return data && typeof data.apiKey === "string" && data.apiKey ? data : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Key resolution order: explicit flag, ALTALANDI_API_KEY, stored login. */
+export function resolveKey({ flag, env = process.env, ...opts } = {}) {
+  if (flag) return { key: flag, source: "flag" };
+  const fromEnv = env.ALTALANDI_API_KEY || env.ALTALANDI_KEY;
+  if (fromEnv) return { key: fromEnv, source: "env" };
+  const stored = readCredentials({ env, ...opts });
+  return stored ? { key: stored.apiKey, source: "login", username: stored.username } : { key: "", source: "none" };
+}
+
+async function saveCredentials(data, opts) {
+  const dir = configDir(opts);
+  await mkdir(dir, { recursive: true });
+  const file = credentialsFile(opts);
+  await writeFile(file, JSON.stringify(data, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+  try { await chmod(file, 0o600); } catch { /* Windows: the per-user profile directory is the protection */ }
+  return file;
+}
+
+function clientName(env = process.env) {
+  const where = (hostname() || "").split(".")[0].slice(0, 24);
+  const who = env.CLAUDECODE || env.CLAUDE_CODE_ENTRYPOINT ? "Claude Code" : "altalandi CLI";
+  return where ? `${who} á ${where}` : who;
+}
+
+function openBrowser(url) {
+  try {
+    const [cmd, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]]
+      : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true, windowsHide: true });
+    child.on("error", () => {});
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+async function postJson(fetchImpl, url, body) {
+  const res = await fetchImpl(url, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify(body),
+  });
+  let data = {};
+  try { data = await res.json(); } catch { /* keep {} */ }
+  return { status: res.status, data };
+}
+
+/**
+ * Run the device login. Returns an exit code.
+ *   0 logged in · 1 failed or expired · 2 bad usage
+ */
+export async function runLogin(flags = {}, io = {}) {
+  const env = io.env || process.env;
+  const fetchImpl = io.fetch || globalThis.fetch;
+  const log = io.log || ((m) => console.error(m));
+  const base = (flags.baseUrl || env.ALTALANDI_BASE_URL || DEFAULT_BASE_URL).replace(/\/$/, "");
+  const wait = io.sleep || sleep;
+
+  let start;
+  try {
+    start = await postJson(fetchImpl, `${base}/v1/device/start`, { clientName: clientName(env) });
+  } catch (e) {
+    log(`Náði ekki sambandi við Altalandi (${e.message}).`);
+    return 1;
+  }
+  if (start.status !== 200 || !start.data.deviceCode) {
+    log(`Innskráning fór ekki af stað: ${start.data.detail || `HTTP ${start.status}`}`);
+    return 1;
+  }
+  const { deviceCode, userCode, verificationUriComplete, verificationUri, interval = 3, expiresIn = 600 } = start.data;
+
+  log("");
+  log("  Tengdu þessa tölvu við Altalandi-aðganginn þinn:");
+  log("");
+  log(`    1. Opnaðu   ${verificationUriComplete}`);
+  log(`    2. Skráðu þig inn eða stofnaðu aðgang (500 kr. prufuinneign fylgir)`);
+  log(`    3. Staðfestu kóðann   ${userCode}`);
+  log("");
+  log(`  (Connect this computer: open the link, sign in or sign up, confirm the code.`);
+  log(`   Code page: ${verificationUri})`);
+  log("");
+  if (!flags.noBrowser && !io.noBrowser) openBrowser(verificationUriComplete);
+  log("  Bíð eftir staðfestingu…");
+
+  const deadline = Date.now() + expiresIn * 1000;
+  let result = null;
+  while (Date.now() < deadline) {
+    await wait(Math.max(1, interval) * 1000);
+    let poll;
+    try {
+      poll = await postJson(fetchImpl, `${base}/v1/device/token`, { deviceCode });
+    } catch {
+      continue; // transient network error: keep waiting until the code expires
+    }
+    if (poll.status === 200 && poll.data.status === "approved") { result = poll.data; break; }
+    if (poll.status === 200 && poll.data.status === "pending") continue;
+    if (poll.status === 429) { await wait(10_000); continue; }
+    log(`  Kóðinn rann út eða var hafnað. Keyrðu \`altalandi login\` aftur.`);
+    return 1;
+  }
+  if (!result) {
+    log(`  Kóðinn rann út. Keyrðu \`altalandi login\` aftur.`);
+    return 1;
+  }
+
+  const file = await saveCredentials({
+    apiKey: result.apiKey,
+    username: result.username,
+    baseUrl: base === DEFAULT_BASE_URL ? undefined : base,
+    savedAt: new Date().toISOString(),
+  }, { env });
+  log("");
+  log(`  ✓ Tengt sem ${result.username}. Lykillinn er vistaður í ${file}`);
+
+  // Install or refresh the Claude Code skill — the point of logging in for most
+  // people. Only where Claude Code exists; never create ~/.claude for someone who
+  // does not use it. --no-skill opts out.
+  if (!flags.noSkill) {
+    const target = skillTarget({ env });
+    const status = await skillStatus({ target });
+    if (status === "missing" || status === "outdated") {
+      const { file: skillFile, backup } = await writeSkill({ target });
+      log(`  ✓ Claude Code-hæfnin „altalandi" sett upp: ${skillFile}${backup ? ` (eldri útgáfa afrituð í ${backup})` : ""}`);
+    } else if (status === "current") {
+      log(`  ✓ Claude Code-hæfnin „altalandi" er þegar uppfærð.`);
+    } else if (status === "absent") {
+      log(`  (Claude Code fannst ekki á þessari tölvu, svo hæfnin var ekki sett upp.)`);
+    }
+  }
+  log("");
+  log(`  Prófaðu:   altalandi "Make sure to reach out to us today."`);
+  log(`  Eða segðu Claude:  „Skrifaðu þetta á góðri íslensku með Altalandi."`);
+  return 0;
+}
+
+export async function runLogout(io = {}) {
+  const env = io.env || process.env;
+  const log = io.log || ((m) => console.error(m));
+  const file = credentialsFile({ env });
+  if (!existsSync(file)) { log("Engin vistuð innskráning."); return 0; }
+  await rm(file, { force: true });
+  log(`Innskráning fjarlægð (${file}). Lykillinn sjálfur er enn virkur þar til þú afturkallar hann á https://altalandi.is/portal`);
+  return 0;
+}
+
+export async function runWhoami(flags = {}, io = {}) {
+  const env = io.env || process.env;
+  const fetchImpl = io.fetch || globalThis.fetch;
+  const out = io.out || ((m) => console.log(m));
+  const log = io.log || ((m) => console.error(m));
+  const { key, source } = resolveKey({ flag: flags.key, env });
+  if (!key) { log("Ekki innskráð(ur). Keyrðu: npx altalandi login"); return 2; }
+  const stored = readCredentials({ env });
+  const base = (flags.baseUrl || env.ALTALANDI_BASE_URL || stored?.baseUrl || DEFAULT_BASE_URL).replace(/\/$/, "");
+  let res;
+  try {
+    res = await fetchImpl(`${base}/v1/me`, { headers: { authorization: `Bearer ${key}`, accept: "application/json" } });
+  } catch (e) {
+    log(`Náði ekki sambandi við Altalandi (${e.message}).`);
+    return 1;
+  }
+  if (res.status === 401) { log("Lykillinn er ógildur eða afturkallaður. Keyrðu: npx altalandi login"); return 1; }
+  if (!res.ok) { log(`Villa: HTTP ${res.status}`); return 1; }
+  const me = await res.json();
+  if (flags.json) out(JSON.stringify({ ...me, keySource: source }, null, 2));
+  else {
+    const { formatInt, formatIsk } = await import("./report.mjs");
+    const free = me.freeUnitsLeftToday != null && me.freeDailyUnits != null
+      ? `ókeypis eftir í dag ${formatInt(me.freeUnitsLeftToday)} af ${formatInt(me.freeDailyUnits)} einingum`
+      : me.freeDailyUnits ? `ókeypis ${formatInt(me.freeDailyUnits)} einingar á dag` : "";
+    out([me.username ?? "(lykill án aðgangs)",
+      `inneign ${me.balanceIsk != null ? formatIsk(me.balanceIsk) : "—"}`,
+      free, `lykill ${me.keyId} (${source})`].filter(Boolean).join(" · "));
+  }
+  return 0;
+}