getownit 0.0.0-stage → 0.1.0

package/dist/debrief.js

@@ -0,0 +1,116 @@
+import { ApiError } from './api.js';
+import { paint, sentence, spinner, wrap } from './ui.js';
+const MAX_ANSWER_CHARS = 2000;
+export const RESUME_HINT = 'Run "ownit interview" when you\'re ready.';
+const KIND_LABEL = { why: 'why', how: 'how', next: "what's next" };
+function isSkip(answer) {
+    return /^(s|skip|:skip)$/i.test(answer.trim());
+}
+/** Runs one debrief: asks each question, grades answers, and offers follow-ups until every question passes. */
+export async function runDebrief(api, prompter, target) {
+    const out = prompter.out;
+    const c = paint(out);
+    const commitWord = target.commits.length === 1 ? 'commit' : 'commits';
+    out.write(`\n${c.bold('Ownit debrief')} ${c.dim(`· ${target.repo} · ${target.commits.length} ${commitWord} · ${target.diff.changedLines} changed ${target.diff.changedLines === 1 ? 'line' : 'lines'}`)}\n`);
+    const payload = {
+        commits: target.commits,
+        diff: target.diff.diff,
+        diff_truncated: target.diff.truncated,
+    };
+    let start;
+    const spin = spinner(out, 'Nemotron is reading your push…');
+    try {
+        start = await api.request('POST', '/api/interview/start', {
+            repo: target.repo,
+            base_sha: target.baseSha,
+            head_sha: target.headSha,
+            changed_lines: target.diff.changedLines,
+            push_id: target.pushId,
+            ...payload,
+        });
+    }
+    catch (error) {
+        spin.stop();
+        return failure(out, error);
+    }
+    spin.stop();
+    let session = start.session;
+    out.write(c.dim(`Answer in your own words, up to 5 sentences. Rough is fine. Type "s" to skip.\n`));
+    for (const first of start.questions) {
+        let question = first;
+        let followUp = false;
+        for (;;) {
+            const label = `Question ${question.idx + 1}/${start.total}`;
+            out.write(`\n${c.bold(c.cyan(label))} ${c.dim(`(${KIND_LABEL[question.kind]}${followUp ? ', follow-up' : ''})`)}\n`);
+            out.write(`${wrap(question.text)}\n`);
+            let answer;
+            do
+                answer = await prompter.ask(c.bold('> '));
+            while (answer !== null && !answer.trim());
+            if (answer === null) {
+                out.write(`\n${c.yellow('Debrief paused.')} ${RESUME_HINT}\n`);
+                return { status: 'pending', reason: 'debrief paused' };
+            }
+            if (isSkip(answer))
+                return skip(api, out, session);
+            const grading = spinner(out, 'Checking your answer…');
+            let result;
+            try {
+                result = await api.request('POST', '/api/interview/answer', {
+                    session,
+                    idx: question.idx,
+                    answer: answer.slice(0, MAX_ANSWER_CHARS),
+                    ...payload,
+                });
+            }
+            catch (error) {
+                grading.stop();
+                return failure(out, error);
+            }
+            grading.stop();
+            session = result.session;
+            if (result.pass) {
+                out.write(`${c.green('✓ Passed.')}\n${c.dim(wrap(result.feedback))}\n`);
+                break;
+            }
+            out.write(`${c.yellow('Not quite yet.')}\n${wrap(result.feedback)}\n`);
+            if (!result.followup)
+                return { status: 'pending', reason: 'no follow-up question' };
+            out.write(c.dim("Here's another angle on the same topic:\n"));
+            question = result.followup;
+            followUp = true;
+        }
+    }
+    out.write(`\n${c.green(c.bold('✓ Push verified.'))} ${c.dim(`${target.commits.length} ${commitWord} owned. Nice work.`)}\n`);
+    return { status: 'verified' };
+}
+async function skip(api, out, session) {
+    try {
+        await api.request('POST', '/api/interview/skip', { session });
+    }
+    catch (error) {
+        return failure(out, error);
+    }
+    out.write(`${paint(out).dim('Skipped. This push is recorded as skipped.')}\n`);
+    return { status: 'skipped' };
+}
+/** Prints a one-line reason. Provider problems stay out of the stats until retried. */
+function failure(out, error) {
+    const c = paint(out);
+    if (error instanceof ApiError) {
+        if (error.isProviderError) {
+            out.write(`${c.yellow('Ownit:')} ${error.message} This push won't count until you retry. ${RESUME_HINT}\n`);
+            return { status: 'provider_error', reason: error.message };
+        }
+        if (error.code === 'already_resolved') {
+            const status = error.body.status ?? 'verified';
+            out.write(`${c.dim(`Ownit: this push is already ${status}.`)}\n`);
+            return { status };
+        }
+        out.write(`${c.yellow('Ownit:')} ${sentence(error.message)} ${RESUME_HINT}\n`);
+        return { status: 'pending', reason: error.message };
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    out.write(`${c.yellow('Ownit:')} ${sentence(message)} ${RESUME_HINT}\n`);
+    return { status: 'pending', reason: message };
+}

package/dist/diff.js

@@ -0,0 +1,174 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import ignore from 'ignore';
+import { EMPTY_TREE, git, tryGit } from './git.js';
+export const DIFF_CHAR_CAP = 60_000;
+const LOCKFILES = new Set([
+    'package-lock.json', 'npm-shrinkwrap.json', 'yarn.lock', 'pnpm-lock.yaml', 'bun.lock', 'bun.lockb',
+    'Cargo.lock', 'Gemfile.lock', 'poetry.lock', 'Pipfile.lock', 'uv.lock', 'pdm.lock', 'composer.lock',
+    'go.sum', 'flake.lock', 'mix.lock', 'pubspec.lock', 'Podfile.lock', 'packages.lock.json', 'gradle.lockfile',
+    'Package.resolved', 'deno.lock',
+]);
+// Built-in rules, in .gitignore syntax. A .ownitignore at the repo root adds more.
+const BUILTIN_IGNORES = [
+    'node_modules/', 'dist/', 'build/', 'out/', '.next/', '.nuxt/', 'coverage/', 'vendor/', '__generated__/',
+    '*.min.js', '*.min.css', '*.map', '*.bundle.js', '*.chunk.js',
+    '*.pb.go', '*_pb2.py', '*_pb2_grpc.py', '*.pb.ts', '*.generated.*', '*.g.dart', '*.freezed.dart',
+    '*.snap',
+];
+const BINARY_EXTENSIONS = /\.(png|jpe?g|gif|webp|ico|bmp|tiff?|psd|pdf|zip|gz|tgz|bz2|xz|7z|rar|jar|war|class|so|dylib|dll|exe|bin|o|a|wasm|woff2?|ttf|otf|eot|mp[34]|mov|avi|webm|wav|ogg|flac|sqlite|db)$/i;
+const GENERATED_MARKER = /@generated|DO NOT EDIT|auto-?generated|generated by /i;
+function unquote(path) {
+    if (!path.startsWith('"'))
+        return path;
+    try {
+        return JSON.parse(path);
+    }
+    catch {
+        return path.slice(1, -1);
+    }
+}
+function pathFromHeader(header) {
+    const plus = header.match(/^\+\+\+ (?:b\/)?(.+)$/m)?.[1];
+    if (plus && plus !== '/dev/null')
+        return unquote(plus);
+    const minus = header.match(/^--- (?:a\/)?(.+)$/m)?.[1];
+    if (minus && minus !== '/dev/null')
+        return unquote(minus);
+    const renamed = header.match(/^rename to (.+)$/m)?.[1];
+    if (renamed)
+        return unquote(renamed);
+    const first = header.split('\n')[0] ?? '';
+    const idx = first.lastIndexOf(' b/');
+    return unquote(idx >= 0 ? first.slice(idx + 3) : first.replace(/^diff --git a\//, ''));
+}
+/** Splits `git diff` output into per-file header and body. */
+export function parseDiff(text) {
+    const files = [];
+    const chunks = text.split(/^(?=diff --git )/m).filter((c) => c.startsWith('diff --git '));
+    for (const chunk of chunks) {
+        const hunkStart = chunk.search(/^@@ /m);
+        const header = hunkStart === -1 ? chunk : chunk.slice(0, hunkStart);
+        const body = hunkStart === -1 ? '' : chunk.slice(hunkStart);
+        files.push({
+            path: pathFromHeader(header),
+            header: header.endsWith('\n') ? header : `${header}\n`,
+            body,
+            binary: /^Binary files .* differ$/m.test(header) || /^GIT binary patch$/m.test(header),
+        });
+    }
+    return files;
+}
+/** Counts added and removed lines inside hunks only. */
+export function countChangedLines(body) {
+    let count = 0;
+    for (const line of body.split('\n')) {
+        if ((line.startsWith('+') || line.startsWith('-')) && !line.startsWith('+++ ') && !line.startsWith('--- '))
+            count++;
+    }
+    return count;
+}
+/** Returns the reason a file is excluded from the debrief, or null to keep it. */
+export function ignoreRules(ownitignore = '') {
+    const builtin = ignore().add(BUILTIN_IGNORES);
+    const custom = ignore().add(ownitignore);
+    return (path, file) => {
+        const name = path.split('/').pop() ?? path;
+        if (LOCKFILES.has(name))
+            return 'lockfile';
+        if (builtin.ignores(path))
+            return 'generated or build output';
+        if (custom.ignores(path))
+            return '.ownitignore';
+        if (file?.binary || BINARY_EXTENSIONS.test(path))
+            return 'binary';
+        if (file) {
+            const firstAdded = file.body
+                .split('\n')
+                .filter((l) => l.startsWith('+'))
+                .slice(0, 15)
+                .join('\n');
+            if (GENERATED_MARKER.test(firstAdded))
+                return 'generated';
+            // Minified: very long added lines.
+            if (file.body.split('\n').some((l) => l.length > 2000))
+                return 'minified';
+        }
+        return null;
+    };
+}
+/** Cuts text to at most `limit` characters at a line boundary. */
+function cutLines(text, limit) {
+    if (text.length <= limit)
+        return { text, droppedLines: 0 };
+    let end = text.lastIndexOf('\n', limit);
+    if (end <= 0)
+        end = 0;
+    const kept = text.slice(0, end + (end ? 1 : 0));
+    const droppedLines = text.slice(kept.length).split('\n').filter(Boolean).length;
+    return { text: kept, droppedLines };
+}
+/**
+ * Fits the diff under `cap` characters. Every file header is kept; the body
+ * budget is shared fairly, so one huge file cannot crowd out the rest.
+ */
+export function truncateFiles(files, cap = DIFF_CHAR_CAP) {
+    const headerChars = files.reduce((sum, f) => sum + f.header.length, 0);
+    let remaining = Math.max(0, cap - headerChars);
+    const bodies = new Map();
+    let truncated = false;
+    const bySize = [...files].sort((a, b) => a.body.length - b.body.length);
+    bySize.forEach((file, i) => {
+        const share = Math.floor(remaining / (bySize.length - i));
+        if (file.body.length <= share) {
+            bodies.set(file, file.body);
+            remaining -= file.body.length;
+            return;
+        }
+        truncated = true;
+        const marker = (n) => `[ownit: ${n} more lines of this file not shown]\n`;
+        const { text, droppedLines } = cutLines(file.body, Math.max(0, share - marker(999999).length));
+        const body = `${text}${marker(droppedLines)}`;
+        bodies.set(file, body);
+        remaining -= body.length;
+    });
+    return { text: files.map((f) => f.header + (bodies.get(f) ?? '')).join(''), truncated };
+}
+/** Filters ignored files out of a raw diff, then truncates what is left. */
+export function prepareDiff(raw, check, cap = DIFF_CHAR_CAP) {
+    const kept = [];
+    const omitted = [];
+    for (const file of parseDiff(raw)) {
+        const reason = check(file.path, file);
+        if (reason)
+            omitted.push({ path: file.path, reason });
+        else
+            kept.push(file);
+    }
+    const changedLines = kept.reduce((sum, f) => sum + countChangedLines(f.body), 0);
+    const { text, truncated } = truncateFiles(kept, cap);
+    const note = omitted.length
+        ? `\n# Not shown (ignored by ownit): ${omitted.map((o) => `${o.path} (${o.reason})`).join(', ')}\n`
+        : '';
+    return { diff: text + note, truncated, changedLines, files: kept.length, omitted };
+}
+/** Reads .ownitignore from the pushed commit, falling back to the working tree. */
+export function readOwnitignore(head, cwd = process.cwd()) {
+    const committed = tryGit(['show', `${head}:.ownitignore`], cwd);
+    if (committed !== null)
+        return committed;
+    const root = tryGit(['rev-parse', '--show-toplevel'], cwd)?.trim();
+    try {
+        return root ? readFileSync(join(root, '.ownitignore'), 'utf8') : '';
+    }
+    catch {
+        return '';
+    }
+}
+/** Builds the filtered diff for one or more ranges (a null base means the empty tree). */
+export function buildDiff(ranges, cwd = process.cwd()) {
+    const raw = ranges
+        .map(({ base, head }) => git(['diff', '--no-color', '--no-ext-diff', '--find-renames', '--unified=3', base ?? EMPTY_TREE, head], cwd))
+        .join('');
+    return prepareDiff(raw, ignoreRules(readOwnitignore(ranges[0].head, cwd)));
+}

package/dist/git.js

@@ -0,0 +1,76 @@
+import { spawnSync } from 'node:child_process';
+export const ZERO_SHA = /^0+$/;
+export const EMPTY_TREE = '4b825dc642cb6eb9a060e54bf8d69288fbee4904';
+export class GitError extends Error {
+}
+/** Runs git and returns stdout. Throws GitError with stderr on a non-zero exit. */
+export function git(args, cwd = process.cwd()) {
+    const result = spawnSync('git', ['-c', 'core.quotePath=false', ...args], {
+        cwd,
+        encoding: 'utf8',
+        maxBuffer: 256 * 1024 * 1024,
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    if (result.error)
+        throw new GitError(`git ${args[0]} failed: ${result.error.message}`);
+    if (result.status !== 0)
+        throw new GitError(result.stderr.trim() || `git ${args.join(' ')} exited with ${result.status}`);
+    return result.stdout;
+}
+/** Like git(), but returns null instead of throwing. */
+export function tryGit(args, cwd = process.cwd()) {
+    try {
+        return git(args, cwd);
+    }
+    catch {
+        return null;
+    }
+}
+export function objectExists(sha, cwd = process.cwd()) {
+    return tryGit(['cat-file', '-e', `${sha}^{commit}`], cwd) !== null;
+}
+export function repoRoot(cwd = process.cwd()) {
+    return git(['rev-parse', '--show-toplevel'], cwd).trim();
+}
+export function resolveCommit(rev, cwd = process.cwd()) {
+    return git(['rev-parse', '--verify', `${rev}^{commit}`], cwd).trim();
+}
+/** Commits in `revs` (rev-list syntax), oldest first. */
+export function listCommits(revs, cwd = process.cwd()) {
+    const out = git(['log', '--reverse', '--format=%H%x1f%B%x1e', ...revs, '--'], cwd);
+    return out
+        .split('\x1e')
+        .map((chunk) => chunk.replace(/^\s+/, ''))
+        .filter(Boolean)
+        .map((chunk) => {
+        const [sha, message = ''] = chunk.split('\x1f');
+        return { sha: sha.trim(), message: message.trim() };
+    });
+}
+/** "owner/name" from a GitHub remote URL, or null for other hosts. */
+export function parseGitHubRemote(url) {
+    const match = url.trim().match(/github\.com[:/]+([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/i);
+    return match ? `${match[1]}/${match[2]}` : null;
+}
+/** The GitHub repo for this checkout: `ownit.repo` config, else the given remote, else origin. */
+export function githubRepo(cwd = process.cwd(), remote) {
+    const configured = tryGit(['config', '--get', 'ownit.repo'], cwd)?.trim();
+    if (configured)
+        return configured;
+    for (const name of [remote, 'origin']) {
+        if (!name)
+            continue;
+        const url = /[:/]/.test(name) ? name : tryGit(['remote', 'get-url', name], cwd)?.trim();
+        const parsed = url ? parseGitHubRemote(url) : null;
+        if (parsed)
+            return parsed;
+    }
+    return null;
+}
+export function gitConfigGet(key, cwd = process.cwd()) {
+    return tryGit(['config', '--get', key], cwd)?.trim() || null;
+}
+/** The shared .git directory (the same for every worktree). */
+export function gitCommonDir(cwd = process.cwd()) {
+    return git(['rev-parse', '--path-format=absolute', '--git-common-dir'], cwd).trim();
+}

package/dist/hooks.js

@@ -0,0 +1,103 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+import { gitCommonDir, gitConfigGet, repoRoot } from './git.js';
+// Hook chaining and core.hooksPath handling follow the approach of
+// parthh01/sphinx (MIT): keep the user's hook and run it first, and find the
+// directory git actually uses before installing.
+export const HOOK_MARKER = '# ownit-managed-hook';
+const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+const shPath = (value) => (process.platform === 'win32' ? value.replaceAll('\\', '/') : value);
+/** The absolute node binary and CLI entry used when `ownit` is not on PATH (e.g. GUI clients). */
+export function launcher() {
+    const entry = process.argv[1] ? realpathSync(process.argv[1]) : '';
+    return { node: shPath(process.execPath), cli: shPath(entry) };
+}
+/**
+ * The pre-push script. It runs pre-push.local first (its failure blocks the
+ * push), then the debrief with the terminal on stdin. Ownit itself never blocks
+ * a push: the script always ends with exit 0.
+ */
+export function hookScript(fallback = launcher()) {
+    return `#!/bin/sh
+${HOOK_MARKER}
+# Installed by "ownit init". Remove with "ownit uninstall". Your previous hook, if any, is pre-push.local.
+hook_dir=$(dirname "$0")
+refs=$(cat)
+if [ -x "$hook_dir/pre-push.local" ]; then
+  if [ -n "$refs" ]; then printf '%s\\n' "$refs"; fi | "$hook_dir/pre-push.local" "$@" || exit $?
+fi
+[ -n "$refs" ] || exit 0
+[ "\${OWNIT_SKIP:-}" = "1" ] && exit 0
+[ -n "\${OWNIT_HOOK_ACTIVE:-}" ] && exit 0
+OWNIT_REFS=$refs
+OWNIT_HOOK_ACTIVE=1
+export OWNIT_REFS OWNIT_HOOK_ACTIVE
+if command -v ownit >/dev/null 2>&1; then
+  set -- ownit hook pre-push "$@"
+elif [ -f ${quote(fallback.cli)} ]; then
+  set -- ${quote(fallback.node)} ${quote(fallback.cli)} hook pre-push "$@"
+else
+  echo 'Ownit: CLI not found, so no debrief this time. Push continues.' >&2
+  exit 0
+fi
+tty=\${OWNIT_TTY_DEVICE:-/dev/tty}
+if [ -z "\${OWNIT_NO_TTY:-}" ] && (exec <"$tty") 2>/dev/null; then
+  OWNIT_TTY=1 "$@" <"$tty"
+else
+  "$@" </dev/null
+fi
+exit 0
+`;
+}
+/** Lines to append to a pre-push hook owned by a hook manager such as husky. */
+export const MANAGED_SNIPPET = `# Ownit debrief (never blocks the push). Keep this at the end: it reads stdin.
+export OWNIT_REFS="$(cat)"
+if (exec </dev/tty) 2>/dev/null; then OWNIT_TTY=1 ownit hook pre-push "$@" </dev/tty; else ownit hook pre-push "$@" </dev/null; fi || true`;
+/** Where git looks for hooks in this repo, and whether Ownit can install there. */
+export function hookLocation(cwd = process.cwd()) {
+    const root = repoRoot(cwd);
+    const configured = gitConfigGet('core.hooksPath', cwd);
+    if (!configured)
+        return { kind: 'install', dir: join(gitCommonDir(cwd), 'hooks'), via: 'default' };
+    const dir = isAbsolute(configured) ? configured : resolve(root, configured);
+    if (/(^|[\\/])\.husky([\\/]|$)/.test(configured) || existsSync(join(root, '.husky'))) {
+        return { kind: 'manual', dir, manager: 'husky', reason: 'husky manages this repo\'s hooks' };
+    }
+    return { kind: 'install', dir, via: 'core.hooksPath' };
+}
+export function isOwnitHook(file) {
+    try {
+        return readFileSync(file, 'utf8').includes(HOOK_MARKER);
+    }
+    catch {
+        return false;
+    }
+}
+/** Writes the hook, moving an existing non-Ownit hook to pre-push.local. */
+export function installHook(dir, script = hookScript()) {
+    mkdirSync(dir, { recursive: true });
+    const file = join(dir, 'pre-push');
+    const local = join(dir, 'pre-push.local');
+    const updated = existsSync(file) && isOwnitHook(file);
+    if (existsSync(file) && !updated) {
+        if (existsSync(local)) {
+            throw new Error(`${file} exists and so does ${local}. Merge them by hand, then rerun "ownit init".`);
+        }
+        renameSync(file, local);
+    }
+    writeFileSync(file, script, { mode: 0o755 });
+    chmodSync(file, 0o755);
+    return { file, chained: existsSync(local), updated };
+}
+/** Removes the Ownit hook and restores pre-push.local as pre-push. */
+export function uninstallHook(dir) {
+    const file = join(dir, 'pre-push');
+    const local = join(dir, 'pre-push.local');
+    if (!isOwnitHook(file))
+        return { removed: false, restored: false };
+    rmSync(file);
+    const restored = existsSync(local);
+    if (restored)
+        renameSync(local, file);
+    return { removed: true, restored };
+}

package/dist/index.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { hookCommand } from './commands/hook.js';
+import { initCommand, uninstallCommand } from './commands/init.js';
+import { interviewCommand } from './commands/interview.js';
+import { badgeCommand } from './commands/badge.js';
+import { keyCommand } from './commands/key.js';
+import { loginCommand, logoutCommand, whoamiCommand } from './commands/login.js';
+const HELP = `ownit: debrief the code you just pushed.
+
+Usage:
+  ownit login [--server URL]       Sign in with GitHub (device flow)
+  ownit logout                     Sign out
+  ownit whoami                     Show server, login, and key status
+  ownit init [--repo owner/name]   Install the pre-push hook in this repo
+  ownit interview                  Debrief pushes that are still pending
+  ownit interview --range A..B     Debrief a commit range
+  ownit key set [nebius|nvidia]    Save your model API key (stored locally)
+  ownit key clear|status           Remove or show it
+  ownit badge                      Print this repo's badge Markdown for your README
+  ownit uninstall                  Remove the pre-push hook
+  ownit help                       Show this help
+
+Set OWNIT_SKIP=1 to push once without a debrief prompt (the push is pending).
+`;
+function version() {
+    const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+    return pkg.version;
+}
+async function main(argv) {
+    const [command, ...rest] = argv;
+    switch (command) {
+        case 'login':
+            return loginCommand(rest);
+        case 'logout':
+            return logoutCommand();
+        case 'whoami':
+        case 'status':
+            return whoamiCommand();
+        case 'init':
+            return initCommand(rest);
+        case 'uninstall':
+            return uninstallCommand();
+        case 'hook':
+            return hookCommand(rest);
+        case 'interview':
+            return interviewCommand(rest);
+        case 'key':
+            return keyCommand(rest);
+        case 'badge':
+            return badgeCommand();
+        case '--version':
+        case '-v':
+            process.stdout.write(`${version()}\n`);
+            return 0;
+        case undefined:
+        case 'help':
+        case '--help':
+        case '-h':
+            process.stdout.write(HELP);
+            return 0;
+        default:
+            process.stderr.write(`Unknown command "${command}".\n\n${HELP}`);
+            return 1;
+    }
+}
+main(process.argv.slice(2)).then((code) => {
+    process.exitCode = code;
+}, (error) => {
+    process.stderr.write(`Ownit: ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+});

package/dist/pushRange.js

@@ -0,0 +1,57 @@
+import { listCommits, objectExists, tryGit, ZERO_SHA } from './git.js';
+/** Parses the pre-push stdin: "<local ref> <local sha> <remote ref> <remote sha>" per line. */
+export function parseRefs(text) {
+    return text
+        .split(/\r?\n/)
+        .map((line) => line.trim().split(/\s+/))
+        .filter((f) => f.length === 4 && /^[0-9a-f]{40,64}$/.test(f[1]) && /^[0-9a-f]{40,64}$/.test(f[3]))
+        .map(([localRef, localSha, remoteRef, remoteSha]) => ({ localRef: localRef, localSha: localSha, remoteRef: remoteRef, remoteSha: remoteSha }));
+}
+/** First parent of a commit, or null for a root commit. */
+function parentOf(sha, cwd) {
+    return tryGit(['rev-parse', '--verify', '--quiet', `${sha}^1`], cwd)?.trim() || null;
+}
+/**
+ * The commits a `git push` will publish, oldest first, across every updated
+ * ref. Deletions are ignored. For a new branch, commits already on any
+ * remote-tracking branch of that remote are excluded.
+ */
+export function computePush(updates, remote, cwd = process.cwd()) {
+    const seen = new Set();
+    const commits = [];
+    const ranges = [];
+    const isNamedRemote = Boolean(remote) && tryGit(['remote', 'get-url', remote], cwd) !== null;
+    for (const update of updates) {
+        if (ZERO_SHA.test(update.localSha))
+            continue;
+        let revs;
+        let base;
+        if (!ZERO_SHA.test(update.remoteSha) && objectExists(update.remoteSha, cwd)) {
+            revs = [update.localSha, '--not', update.remoteSha];
+            base = tryGit(['merge-base', update.localSha, update.remoteSha], cwd)?.trim() || update.remoteSha;
+        }
+        else {
+            revs = [update.localSha, '--not', isNamedRemote ? `--remotes=${remote}` : '--remotes'];
+            base = null;
+        }
+        const list = listCommits(revs, cwd).filter((c) => !seen.has(c.sha));
+        if (!list.length)
+            continue;
+        if (base === null)
+            base = parentOf(list[0].sha, cwd);
+        for (const c of list)
+            seen.add(c.sha);
+        commits.push(...list);
+        ranges.push({ base, head: update.localSha });
+    }
+    if (!ranges.length)
+        return null;
+    return { base: ranges[0].base, head: ranges[0].head, commits, ranges };
+}
+/** Rebuilds the range of a recorded push from its commit list, for `ownit interview`. */
+export function rangeForRecordedPush(baseSha, headSha, shas, cwd = process.cwd()) {
+    if (baseSha && !ZERO_SHA.test(baseSha) && objectExists(baseSha, cwd))
+        return { base: baseSha, head: headSha };
+    const oldest = shas[0] ?? headSha;
+    return { base: parentOf(oldest, cwd), head: headSha };
+}

package/dist/secret.js

@@ -0,0 +1,47 @@
+import { createInterface } from 'node:readline';
+/** Reads one line without echoing it on a TTY. Piped input is read as-is. */
+export function readSecret(prompt) {
+    const stdin = process.stdin;
+    const out = process.stderr;
+    if (!stdin.isTTY) {
+        return new Promise((resolve) => {
+            const rl = createInterface({ input: stdin });
+            let done = false;
+            rl.once('line', (line) => {
+                done = true;
+                rl.close();
+                resolve(line);
+            });
+            rl.once('close', () => done || resolve(''));
+        });
+    }
+    out.write(prompt);
+    return new Promise((resolve) => {
+        let value = '';
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.setEncoding('utf8');
+        const onData = (chunk) => {
+            for (const ch of chunk) {
+                if (ch === '\r' || ch === '\n' || ch === '\u0004') {
+                    stdin.setRawMode(false);
+                    stdin.pause();
+                    stdin.off('data', onData);
+                    out.write('\n');
+                    resolve(value);
+                    return;
+                }
+                if (ch === '\u0003') {
+                    stdin.setRawMode(false);
+                    out.write('\n');
+                    process.exit(130);
+                }
+                if (ch === '\u007f' || ch === '\b')
+                    value = value.slice(0, -1);
+                else
+                    value += ch;
+            }
+        };
+        stdin.on('data', onData);
+    });
+}