getownit 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Yoseph Naoom
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,19 @@
-# Temporary Holding Version
+# getownit
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The `ownit` command. Right after you `git push`, it runs a short debrief in your terminal about
+what you just shipped: why, how, and what's next. NVIDIA Nemotron (on Nebius or NVIDIA) writes the questions
+and grades your answers generously.
+
+```sh
+npm i -g getownit
+ownit login       # GitHub device flow
+ownit key set     # pick Nebius or NVIDIA, then paste your key; stored only in ~/.ownit/config.json
+ownit init        # in a repo: installs the pre-push hook
+```
+
+On each push: `Debrief now? [Y/n/s=skip]`. Ownit never blocks a push. Pending debriefs can be
+finished any time with `ownit interview`.
+
+Your code and answers are never stored, and your key is never stored or logged by the server.
+
+Full documentation: [github.com/Yoosseph/ownit](https://github.com/Yoosseph/ownit).

package/dist/api.js

@@ -0,0 +1,57 @@
+import { readConfig, serverUrl } from './config.js';
+import { modelKey } from './providers.js';
+export class ApiError extends Error {
+    status;
+    code;
+    body;
+    constructor(message, 
+    /** HTTP status, or 0 when the server could not be reached. */
+    status, code, body = {}) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.body = body;
+        this.name = 'ApiError';
+    }
+    get isProviderError() {
+        return this.code === 'provider_error';
+    }
+}
+export function createApi(config = readConfig(), env = process.env) {
+    const server = serverUrl(config, env);
+    const model = modelKey(config, env);
+    return {
+        server,
+        async request(method, path, body, options = {}) {
+            const headers = { accept: 'application/json', 'user-agent': 'getownit-cli' };
+            if (body !== undefined)
+                headers['content-type'] = 'application/json';
+            if (config.token)
+                headers.authorization = `Bearer ${config.token}`;
+            // Only debrief calls need the key; the worker uses it for that request and discards it.
+            if (model && path.startsWith('/api/interview/')) {
+                headers['x-model-key'] = model.key;
+                headers['x-model-provider'] = model.provider;
+            }
+            let response;
+            try {
+                response = await fetch(`${server}${path}`, {
+                    method,
+                    headers,
+                    body: body === undefined ? undefined : JSON.stringify(body),
+                    signal: AbortSignal.timeout(options.timeoutMs ?? 180_000),
+                });
+            }
+            catch (error) {
+                const reason = error instanceof Error && error.name === 'TimeoutError' ? 'timed out' : 'unreachable';
+                throw new ApiError(`Ownit server ${reason} (${server})`, 0, 'network');
+            }
+            const json = (await response.json().catch(() => ({})));
+            if (!response.ok) {
+                const message = typeof json.message === 'string' ? json.message : `Ownit server returned ${response.status}`;
+                throw new ApiError(message, response.status, typeof json.error === 'string' ? json.error : 'http', json);
+            }
+            return json;
+        },
+    };
+}

package/dist/commands/badge.js

@@ -0,0 +1,19 @@
+import { readConfig, serverUrl } from '../config.js';
+import { githubRepo } from '../git.js';
+/** The README Markdown for a repo's badge: the badge image, linking to the repo's page. */
+export function badgeMarkdown(origin, repo) {
+    const [owner = '', name = ''] = repo.split('/');
+    const path = `${encodeURIComponent(owner)}/${encodeURIComponent(name)}`;
+    return `[![Ownit](${origin}/badge/${path}.svg)](${origin}/${path})`;
+}
+/** `ownit badge`: prints the Markdown on stdout, so it can be piped (`ownit badge | clip`). */
+export function badgeCommand() {
+    const repo = githubRepo();
+    if (!repo) {
+        process.stderr.write('Ownit: no GitHub remote found. Run this in a repo set up with "ownit init".\n');
+        return 1;
+    }
+    process.stderr.write(`Add this to your README to show ${repo}'s Ownit badge:\n\n`);
+    process.stdout.write(`${badgeMarkdown(serverUrl(readConfig()), repo)}\n`);
+    return 0;
+}

package/dist/commands/hook.js

@@ -0,0 +1,145 @@
+import { openSync } from 'node:fs';
+import { ReadStream } from 'node:tty';
+import { ApiError, createApi } from '../api.js';
+import { readConfig } from '../config.js';
+import { RESUME_HINT, runDebrief } from '../debrief.js';
+import { buildDiff } from '../diff.js';
+import { githubRepo } from '../git.js';
+import { computePush, parseRefs } from '../pushRange.js';
+import { createPrompter, errorMessage, paint, plural, sentence } from '../ui.js';
+const PROMPT_TIMEOUT_MS = 120_000;
+const QUICK_TIMEOUT_MS = 8_000;
+// Coding agents and CI run git without a person at the keyboard.
+const AGENT_ENV = ['CI', 'CLAUDECODE', 'CODEX_SANDBOX', 'CODEX_CI', 'CURSOR_AGENT', 'GEMINI_CLI', 'AIDER_MODEL', 'OPENCODE'];
+export function isAgentEnvironment(env) {
+    return AGENT_ENV.some((name) => env[name] && env[name] !== '0' && env[name] !== 'false');
+}
+/** The terminal to read answers from, or null when nobody can answer. */
+function openTerminal(env) {
+    if (env.OWNIT_NO_TTY || isAgentEnvironment(env))
+        return null;
+    // The installed hook script redirects stdin from /dev/tty and says so.
+    if (env.OWNIT_TTY === '1')
+        return process.stdin;
+    if (process.platform === 'win32')
+        return null;
+    try {
+        return new ReadStream(openSync('/dev/tty', 'r'));
+    }
+    catch {
+        return null;
+    }
+}
+async function readStdin() {
+    if (process.stdin.isTTY)
+        return '';
+    let text = '';
+    for await (const chunk of process.stdin)
+        text += chunk;
+    return text;
+}
+export function interpretChoice(answer) {
+    if (answer === null)
+        return 'later';
+    const value = answer.trim().toLowerCase();
+    if (value === '' || value === 'y' || value === 'yes')
+        return 'debrief';
+    if (value === 's' || value === 'skip')
+        return 'skip';
+    return 'later';
+}
+async function record(api, repo, push, status) {
+    const res = await api.request('POST', '/api/pushes', { repo, base_sha: push.base, head_sha: push.head, commits: push.commits.map((c) => ({ sha: c.sha })), status }, { timeoutMs: QUICK_TIMEOUT_MS });
+    return res.status;
+}
+async function recordPending(api, repo, push, out) {
+    await record(api, repo, push, 'pending');
+    out.write(`Ownit: push recorded as pending. ${RESUME_HINT}\n`);
+    return 0;
+}
+/**
+ * What the server already recorded for these commits, so a verified push is not
+ * asked again. Only an unreachable server is an error; anything else means unknown.
+ */
+async function knownStatus(api, repo, push) {
+    const known = await api
+        .request('POST', '/api/pushes/lookup', { repo, head_sha: push.head, shas: push.commits.map((x) => x.sha) }, { timeoutMs: QUICK_TIMEOUT_MS })
+        .catch((error) => {
+        if (error instanceof ApiError && error.code === 'network')
+            throw error;
+        return { status: null };
+    });
+    return known.status;
+}
+/** Asks whether to debrief now, then debriefs, records a skip, or leaves the push pending. */
+async function askAndDebrief(api, terminal, repo, push, out) {
+    const c = paint(out);
+    const prompter = createPrompter(terminal, out);
+    try {
+        const n = push.commits.length;
+        const answer = await prompter.ask(`${c.bold('Ownit')} ${c.dim(`(${n} ${plural(n, 'commit')} to ${repo})`)} Debrief now? [Y/n/s=skip] `, PROMPT_TIMEOUT_MS);
+        const choice = interpretChoice(answer);
+        if (choice === 'skip') {
+            await record(api, repo, push, 'skipped');
+            out.write(c.dim('Ownit: skipped. Push continues.\n'));
+            return 0;
+        }
+        if (choice === 'later')
+            return await recordPending(api, repo, push, out);
+        await runDebrief(api, prompter, {
+            repo,
+            baseSha: push.base,
+            headSha: push.head,
+            commits: push.commits,
+            diff: buildDiff(push.ranges),
+        });
+        return 0;
+    }
+    finally {
+        prompter.close();
+        if (terminal !== process.stdin)
+            terminal.destroy();
+    }
+}
+function continueReason(error) {
+    return error instanceof ApiError && error.code === 'network'
+        ? `${sentence(error.message)} The push continues and will show as pending.`
+        : `${sentence(errorMessage(error))} The push continues.`;
+}
+/** `ownit hook pre-push <remote> <url>`. Always exits 0: the debrief never blocks a push. */
+export async function hookCommand(argv, env = process.env) {
+    const [event, remote = '', url = ''] = argv;
+    if (event !== 'pre-push')
+        return 0;
+    const out = process.stderr;
+    const c = paint(out);
+    try {
+        const refs = env.OWNIT_REFS ?? (await readStdin());
+        const repo = githubRepo(process.cwd(), url || remote);
+        if (!repo)
+            return 0;
+        const push = computePush(parseRefs(refs), remote);
+        if (!push)
+            return 0;
+        const config = readConfig(env);
+        if (!config.token) {
+            out.write(`Ownit: not logged in, so no debrief this time. Run "ownit login". The push continues.\n`);
+            return 0;
+        }
+        const api = createApi(config, env);
+        const known = await knownStatus(api, repo, push);
+        // Skipped pushes are asked again: they stay unverified until debriefed.
+        if (known === 'verified') {
+            out.write(c.dim(`Ownit: this push is already ${known}.\n`));
+            return 0;
+        }
+        const terminal = openTerminal(env);
+        if (!terminal)
+            return await recordPending(api, repo, push, out);
+        return await askAndDebrief(api, terminal, repo, push, out);
+    }
+    catch (error) {
+        out.write(`${c.yellow('Ownit:')} ${continueReason(error)} ${RESUME_HINT}\n`);
+        return 0;
+    }
+}

package/dist/commands/init.js

@@ -0,0 +1,73 @@
+import { parseArgs } from 'node:util';
+import { createApi } from '../api.js';
+import { git, githubRepo } from '../git.js';
+import { hookLocation, installHook, MANAGED_SNIPPET, uninstallHook } from '../hooks.js';
+import { errorMessage, paint, sentence } from '../ui.js';
+import { badgeMarkdown } from './badge.js';
+/** Installs the pre-push hook where git looks for it, or explains how to add it to a hook manager. */
+function installHookHere(out) {
+    const c = paint(out);
+    const location = hookLocation();
+    if (location.kind === 'manual') {
+        out.write(`Ownit: ${location.reason}, so add these lines to the end of .husky/pre-push (create the file if needed):\n\n`);
+        out.write(`${MANAGED_SNIPPET}\n\n`);
+        return;
+    }
+    const result = installHook(location.dir);
+    out.write(`${c.green('✓')} ${result.updated ? 'Updated' : 'Installed'} the pre-push hook in ${location.dir}`);
+    out.write(location.via === 'core.hooksPath' ? ' (from core.hooksPath).\n' : '.\n');
+    if (result.chained)
+        out.write(`  Your existing hook is now pre-push.local and still runs first.\n`);
+}
+/** Registers the repo with the Ownit server and shows what to do next. */
+async function registerRepo(repo, out) {
+    const c = paint(out);
+    try {
+        const api = createApi();
+        const registered = await api.request('POST', '/api/repos', { repo }, { timeoutMs: 15_000 });
+        out.write(`${c.green('✓')} Registered ${c.bold(registered.repo)} with Ownit (tracked since ${registered.tracked_since.slice(0, 10)}).\n`);
+        if (!registered.installed) {
+            out.write(`\nNext: install the Ownit GitHub App on ${registered.repo} so pushes get check runs and count on the badge:\n`);
+            out.write(`  ${registered.install_url ?? 'see docs/github-app.md'}\n`);
+        }
+        if (registered.page_url)
+            out.write(`\nYour repo's page: ${registered.page_url}\n`);
+        // The page URL carries the server's public origin, which can differ from the API address.
+        const origin = registered.page_url ? new URL(registered.page_url).origin : api.server;
+        out.write(`\nAdd the badge to your README (run "ownit badge" to see this again):\n  ${badgeMarkdown(origin, registered.repo)}\n`);
+    }
+    catch (error) {
+        out.write(`${c.yellow('Ownit:')} the hook is installed, but registering ${repo} failed: ${sentence(errorMessage(error))}\n`);
+        out.write('Run "ownit init" again once that is fixed.\n');
+        return 1;
+    }
+    return 0;
+}
+/** `ownit init [--repo owner/name]` */
+export async function initCommand(argv) {
+    const { values } = parseArgs({ args: argv, options: { repo: { type: 'string' } } });
+    const out = process.stderr;
+    if (values.repo)
+        git(['config', 'ownit.repo', values.repo]);
+    const repo = githubRepo();
+    if (!repo) {
+        out.write('Ownit: no GitHub remote found. Add one, or run "ownit init --repo owner/name".\n');
+        return 1;
+    }
+    installHookHere(out);
+    return registerRepo(repo, out);
+}
+export async function uninstallCommand() {
+    const out = process.stderr;
+    const location = hookLocation();
+    if (location.kind === 'manual') {
+        out.write(`Ownit: remove the Ownit lines from your pre-push hook in ${location.dir}.\n`);
+        return 0;
+    }
+    const result = uninstallHook(location.dir);
+    if (!result.removed)
+        out.write('Ownit: no Ownit hook installed here.\n');
+    else
+        out.write(`Removed the Ownit pre-push hook.${result.restored ? ' Restored your previous hook.' : ''}\n`);
+    return 0;
+}

package/dist/commands/interview.js

@@ -0,0 +1,82 @@
+import { parseArgs } from 'node:util';
+import { createApi } from '../api.js';
+import { buildDiff } from '../diff.js';
+import { runDebrief } from '../debrief.js';
+import { githubRepo, listCommits, objectExists, resolveCommit } from '../git.js';
+import { rangeForRecordedPush } from '../pushRange.js';
+import { createPrompter, paint, plural } from '../ui.js';
+export async function interviewCommand(argv) {
+    const { values } = parseArgs({
+        args: argv,
+        options: { range: { type: 'string' }, repo: { type: 'string' } },
+        allowPositionals: false,
+    });
+    const out = process.stderr;
+    const repo = values.repo ?? githubRepo();
+    if (!repo) {
+        out.write('Ownit: cannot tell which GitHub repo this is. Run "ownit init" or pass --repo owner/name.\n');
+        return 1;
+    }
+    const api = createApi();
+    const prompter = createPrompter(process.stdin, out);
+    try {
+        if (values.range)
+            return exitCode(await debriefRange(api, prompter, repo, values.range));
+        return await debriefOpenPushes(api, prompter, repo);
+    }
+    finally {
+        prompter.close();
+    }
+}
+function exitCode(outcome) {
+    return outcome && (outcome.status === 'verified' || outcome.status === 'skipped') ? 0 : 1;
+}
+async function debriefRange(api, prompter, repo, range) {
+    const match = range.match(/^(.+?)\.\.(.+)$/);
+    if (!match) {
+        prompter.out.write('Ownit: --range must look like A..B.\n');
+        return null;
+    }
+    const base = resolveCommit(match[1]);
+    const head = resolveCommit(match[2]);
+    const commits = listCommits([`${base}..${head}`]);
+    if (!commits.length) {
+        prompter.out.write(`Ownit: no commits in ${range}.\n`);
+        return null;
+    }
+    return runDebrief(api, prompter, { repo, baseSha: base, headSha: head, commits, diff: buildDiff([{ base, head }]) });
+}
+/** Resolves pending and provider_error pushes, newest first. */
+async function debriefOpenPushes(api, prompter, repo) {
+    const out = prompter.out;
+    const c = paint(out);
+    const { pushes } = await api.request('GET', `/api/pushes/open?repo=${encodeURIComponent(repo)}`);
+    if (!pushes.length) {
+        out.write(`${c.green('✓')} Nothing to debrief for ${repo}.\n`);
+        return 0;
+    }
+    out.write(`${pushes.length} ${plural(pushes.length, 'push', 'pushes')} waiting for a debrief in ${repo}.\n`);
+    let code = 0;
+    for (const push of pushes) {
+        const missing = [push.head_sha, ...push.commits].find((sha) => !objectExists(sha));
+        if (missing) {
+            out.write(c.yellow(`Ownit: commit ${missing.slice(0, 7)} is not in this clone. Run "git fetch" and try again.\n`));
+            code = 1;
+            continue;
+        }
+        const range = rangeForRecordedPush(push.base_sha, push.head_sha, push.commits);
+        const known = new Set(push.commits);
+        const commits = listCommits([range.base ? `${range.base}..${range.head}` : range.head]).filter((x) => known.has(x.sha));
+        const outcome = await runDebrief(api, prompter, {
+            repo,
+            baseSha: range.base,
+            headSha: range.head,
+            commits: commits.length ? commits : listCommits(['-1', range.head]),
+            diff: buildDiff([range]),
+            pushId: push.id,
+        });
+        if (outcome.status === 'pending' || outcome.status === 'provider_error')
+            return 1;
+    }
+    return code;
+}

package/dist/commands/key.js

@@ -0,0 +1,79 @@
+import { readConfig, updateConfig } from '../config.js';
+import { describeKey, isProvider, modelKey, PROVIDER_IDS, PROVIDERS, providerByPrefix } from '../providers.js';
+import { readSecret } from '../secret.js';
+import { createPrompter } from '../ui.js';
+const CHOICES = PROVIDER_IDS.join('|');
+/** The provider named on the command line, else one picked from a menu. */
+async function chooseProvider(arg) {
+    const out = process.stderr;
+    if (arg) {
+        const id = arg.toLowerCase();
+        if (isProvider(id))
+            return id;
+        // Never echo the argument: people paste the key itself here.
+        out.write(`Ownit: "ownit key set" takes a provider (${CHOICES}), not the key. Keys typed on the command line end up in your shell history, so run "ownit key set" and paste the key at the hidden prompt. If that was a real key, consider rotating it.\n`);
+        return undefined;
+    }
+    // Piped input is the key itself, so there is no line to spare for the menu.
+    if (!process.stdin.isTTY) {
+        out.write(`Ownit: name the provider when piping a key, e.g. "ownit key set ${PROVIDER_IDS[0]}". Use one of: ${CHOICES}.\n`);
+        return undefined;
+    }
+    out.write('Which provider is this key for?\n');
+    PROVIDER_IDS.forEach((id, i) => out.write(`  ${i + 1}) ${PROVIDERS[id].name.padEnd(8)} keys at ${PROVIDERS[id].keyUrl}\n`));
+    const prompter = createPrompter(process.stdin, out);
+    const answer = ((await prompter.ask(`Choose 1-${PROVIDER_IDS.length} [1]: `)) ?? '').trim().toLowerCase();
+    prompter.close();
+    if (!answer)
+        return PROVIDER_IDS[0];
+    const picked = isProvider(answer) ? answer : PROVIDER_IDS[Number(answer) - 1];
+    if (!picked)
+        out.write(`Ownit: "${answer}" is not one of the choices; nothing changed.\n`);
+    return picked;
+}
+async function setKey(providerArg) {
+    const out = process.stderr;
+    const provider = await chooseProvider(providerArg);
+    if (!provider)
+        return 1;
+    const { name } = PROVIDERS[provider];
+    // Read from a prompt or stdin, never argv, so the key stays out of shell history.
+    const key = (await readSecret(`${name} API key (input hidden): `)).trim();
+    if (!key) {
+        out.write('Ownit: no key entered; nothing changed.\n');
+        return 1;
+    }
+    const looksLike = providerByPrefix(key);
+    if (looksLike && looksLike !== provider) {
+        out.write(`Ownit: that key looks like it is for ${PROVIDERS[looksLike].name}. Run "ownit key set ${looksLike}" instead; nothing changed.\n`);
+        return 1;
+    }
+    updateConfig({ provider, apiKey: key, nebiusKey: undefined });
+    out.write(`Saved your ${name} key to ~/.ownit/config.json. It is sent only with debrief requests and never stored by Ownit.\n`);
+    return 0;
+}
+function clearKey() {
+    updateConfig({ provider: undefined, apiKey: undefined, nebiusKey: undefined });
+    process.stderr.write('Removed your API key.\n');
+    return 0;
+}
+function showKey() {
+    const model = modelKey(readConfig());
+    process.stderr.write(model ? `API key set (${describeKey(model)}).\n` : 'No API key set. Run "ownit key set" with a Nebius or NVIDIA key.\n');
+    return 0;
+}
+/** `ownit key set [provider] | clear | status` */
+export async function keyCommand(argv) {
+    const [action = 'status', providerArg] = argv;
+    switch (action) {
+        case 'set':
+            return setKey(providerArg);
+        case 'clear':
+            return clearKey();
+        case 'status':
+            return showKey();
+        default:
+            process.stderr.write(`Usage: ownit key set [${CHOICES}] | clear | status\n`);
+            return 1;
+    }
+}

package/dist/commands/login.js

@@ -0,0 +1,118 @@
+import { parseArgs } from 'node:util';
+import { ApiError, createApi } from '../api.js';
+import { readConfig, serverUrl, updateConfig } from '../config.js';
+import { describeKey, modelKey } from '../providers.js';
+import { readSecret } from '../secret.js';
+import { paint } from '../ui.js';
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** POSTs a form to github.com's OAuth endpoints. OWNIT_GITHUB_URL overrides the host in tests. */
+async function githubOAuth(path, form) {
+    const base = (process.env.OWNIT_GITHUB_URL || 'https://github.com').replace(/\/+$/, '');
+    let response;
+    try {
+        response = await fetch(`${base}${path}`, {
+            method: 'POST',
+            headers: { accept: 'application/json', 'content-type': 'application/x-www-form-urlencoded', 'user-agent': 'getownit-cli' },
+            body: new URLSearchParams(form).toString(),
+            signal: AbortSignal.timeout(30_000),
+        });
+    }
+    catch {
+        throw new Error('could not reach github.com');
+    }
+    if (!response.ok)
+        throw new Error(`github.com returned ${response.status}`);
+    return (await response.json());
+}
+/**
+ * Polls GitHub until the user authorizes the device code. Returns the GitHub
+ * token, or the reason the login ended without one.
+ */
+async function pollForAccessToken(clientId, start) {
+    let interval = Math.max(start.interval, 0) * 1000;
+    const deadline = Date.now() + start.expires_in * 1000;
+    while (Date.now() < deadline) {
+        await sleep(interval);
+        const reply = await githubOAuth('/login/oauth/access_token', {
+            client_id: clientId,
+            device_code: start.device_code,
+            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+        });
+        if (reply.access_token)
+            return { token: reply.access_token };
+        if (reply.error === 'authorization_pending')
+            continue;
+        if (reply.error === 'slow_down') {
+            interval = Math.max(interval + 5000, (reply.interval ?? 0) * 1000);
+            continue;
+        }
+        return { failure: `login ${reply.error === 'access_denied' ? 'was cancelled' : `failed (${reply.error ?? 'unknown error'})`}.` };
+    }
+    return { failure: 'the login code expired.' };
+}
+/** For self-hosted or local servers: reads a session token from stdin. */
+async function loginWithToken() {
+    const out = process.stderr;
+    const token = (await readSecret('Ownit session token: ')).trim();
+    if (!/^ownit_[\w-]{20,}$/.test(token)) {
+        out.write('Ownit: that does not look like an Ownit session token.\n');
+        return 1;
+    }
+    updateConfig({ token, login: undefined });
+    out.write(`${paint(out).green('✓')} Saved the session token.\n`);
+    return 0;
+}
+/**
+ * The GitHub device flow runs here, from the user's own IP (GitHub rate-limits
+ * its login endpoints per IP, which shared server IPs hit). The server then
+ * verifies the identity, drops the GitHub token, and issues an Ownit session token.
+ */
+async function deviceFlowLogin() {
+    const out = process.stderr;
+    const c = paint(out);
+    const api = createApi({ ...readConfig(), token: undefined });
+    const { github_client_id: clientId } = await api.request('GET', '/auth/config');
+    const start = await githubOAuth('/login/device/code', { client_id: clientId });
+    out.write(`\nOpen ${c.bold(start.verification_uri)} and enter the code ${c.bold(c.cyan(start.user_code))}\n`);
+    out.write(c.dim('Waiting for you to authorize Ownit on GitHub…\n'));
+    const result = await pollForAccessToken(clientId, start);
+    if ('failure' in result) {
+        out.write(`Ownit: ${result.failure} Run "ownit login" to try again.\n`);
+        return 1;
+    }
+    // The GitHub token goes to the Ownit server once, to prove who you are, and is not kept anywhere.
+    const session = await api.request('POST', '/auth/github', { access_token: result.token });
+    updateConfig({ token: session.token, login: session.login });
+    out.write(`${c.green('✓')} Logged in as ${c.bold(session.login)} on ${serverUrl(readConfig())}.\n`);
+    return 0;
+}
+/** `ownit login [--server URL] [--with-token]` */
+export async function loginCommand(argv) {
+    const { values } = parseArgs({ args: argv, options: { server: { type: 'string' }, 'with-token': { type: 'boolean' } } });
+    if (values.server)
+        updateConfig({ server: values.server.replace(/\/+$/, '') });
+    return values['with-token'] ? loginWithToken() : deviceFlowLogin();
+}
+export async function logoutCommand() {
+    const config = readConfig();
+    if (config.token) {
+        await createApi(config)
+            .request('DELETE', '/auth/session', undefined, { timeoutMs: 10_000 })
+            .catch((error) => {
+            if (!(error instanceof ApiError))
+                throw error;
+        });
+    }
+    updateConfig({ token: undefined, login: undefined });
+    process.stderr.write('Logged out. Your API key is still saved; remove it with "ownit key clear".\n');
+    return 0;
+}
+export async function whoamiCommand() {
+    const config = readConfig();
+    const out = process.stderr;
+    out.write(`Server:     ${serverUrl(config)}\n`);
+    out.write(`GitHub:     ${config.token ? (config.login ?? 'logged in') : 'not logged in (run "ownit login")'}\n`);
+    const model = modelKey(config);
+    out.write(`API key:    ${model ? `set (${describeKey(model)})` : 'not set (run "ownit key set")'}\n`);
+    return 0;
+}

package/dist/config.js

@@ -0,0 +1,46 @@
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+// The hosted Ownit server. Self-hosters point the CLI elsewhere with `ownit login --server`.
+export const DEFAULT_SERVER = 'https://ownit.ownit-worker.workers.dev';
+export function configDir(env = process.env) {
+    return env.OWNIT_HOME || join(homedir(), '.ownit');
+}
+export function configPath(env = process.env) {
+    return join(configDir(env), 'config.json');
+}
+export function readConfig(env = process.env) {
+    try {
+        const value = JSON.parse(readFileSync(configPath(env), 'utf8'));
+        return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+    }
+    catch {
+        return {};
+    }
+}
+/** Writes atomically with owner-only permissions, since the file holds secrets. */
+export function writeConfig(config, env = process.env) {
+    const dir = configDir(env);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const file = configPath(env);
+    const temp = `${file}.${process.pid}.tmp`;
+    writeFileSync(temp, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+    renameSync(temp, file);
+    try {
+        chmodSync(file, 0o600);
+    }
+    catch {
+        // Windows ignores POSIX modes.
+    }
+}
+export function updateConfig(patch, env = process.env) {
+    const next = { ...readConfig(env), ...patch };
+    for (const key of Object.keys(next))
+        if (next[key] === undefined)
+            delete next[key];
+    writeConfig(next, env);
+    return next;
+}
+export function serverUrl(config, env = process.env) {
+    return (env.OWNIT_SERVER || config.server || DEFAULT_SERVER).replace(/\/+$/, '');
+}