@aspruyt/xfg 6.0.0 → 6.0.2

package/dist/sync/commit-push-manager.js

@@ -1,5 +1,5 @@
 import { createCommitStrategy } from "../vcs/index.js";
-import { getRepoDisplayName } from "../shared/repo-detector.js";
+import { getRepoDisplayName } from "../repo/index.js";
 import { toErrorMessage } from "../shared/type-guards.js";
 export class CommitPushManager {
     log;
@@ -22,6 +22,7 @@ export class CommitPushManager {
             path,
             content: info.content,
             ...(info.mode ? { mode: info.mode } : {}),
+            ...(info.modeOnly ? { modeOnly: true } : {}),
         }));
         this.log.info("Staging changes...");
         await gitOps.stageAll();
@@ -35,6 +36,7 @@ export class CommitPushManager {
             const result = await commitStrategy.commit({
                 repoInfo,
                 branchName: pushBranch,
+                baseBranch: options.baseBranch,
                 message: commitMessage,
                 fileChanges: changes,
                 workDir,
@@ -47,10 +49,10 @@ export class CommitPushManager {
             return { success: true };
         }
         catch (error) {
-            return this.rethrowIfUnexpectedCommitError(error, isDirectMode, pushBranch, repoInfo);
+            return this.classifyCommitError(error, isDirectMode, pushBranch, repoInfo);
         }
     }
-    rethrowIfUnexpectedCommitError(error, isDirectMode, pushBranch, repoInfo) {
+    classifyCommitError(error, isDirectMode, pushBranch, repoInfo) {
         const repoName = getRepoDisplayName(repoInfo);
         const message = toErrorMessage(error);
         if (isDirectMode &&

package/dist/sync/file-sync-orchestrator.d.ts

@@ -1,5 +1,5 @@
 import type { RepoConfig } from "../config/index.js";
-import type { RepoInfo } from "../shared/repo-detector.js";
+import type { RepoInfo } from "../repo/index.js";
 import type { ILogger } from "../shared/logger.js";
 import type { IFileWriter, IManifestManager, SessionContext, ProcessorOptions, FileSyncResult, IFileSyncOrchestrator } from "./types.js";
 export declare class FileSyncOrchestrator implements IFileSyncOrchestrator {

package/dist/sync/file-sync-strategy.d.ts

@@ -1,5 +1,5 @@
 import type { RepoConfig } from "../config/index.js";
-import type { RepoInfo } from "../shared/repo-detector.js";
+import type { RepoInfo } from "../repo/index.js";
 import type { IWorkStrategy, WorkResult, SessionContext, ProcessorOptions, IFileSyncOrchestrator } from "./types.js";
 /**
  * Strategy that performs full file synchronization.

package/dist/sync/file-writer.js

@@ -30,6 +30,7 @@ export class FileWriter {
         const { gitOps, log } = deps;
         const fileChanges = new Map();
         const diffStats = createDiffStats();
+        const modeCache = new Map();
         for (const file of files) {
             const filePath = join(workDir, file.fileName);
             const fileExistsLocal = existsSync(filePath);
@@ -64,31 +65,54 @@ export class FileWriter {
             const action = fileExistsLocal ? "update" : "create";
             const existingContent = gitOps.getFileContent(file.fileName);
             const changed = gitOps.wouldChange(file.fileName, fileContent);
+            const desiredMode = shouldBeExecutable(file)
+                ? "100755"
+                : "100644";
+            const currentMode = await gitOps.getFileMode(file.fileName);
+            modeCache.set(file.fileName, currentMode);
+            const modeDiffers = currentMode !== null && currentMode !== desiredMode;
             if (changed) {
                 const writeResult = {
                     fileName: file.fileName,
                     content: fileContent,
                     action,
-                    // mode is only set on changed files — unchanged files won't trigger a
-                    // fixup commit, which is correct since their mode was set on a prior sync
-                    ...(shouldBeExecutable(file) ? { mode: "100755" } : {}),
+                    ...(desiredMode === "100755" || modeDiffers
+                        ? { mode: desiredMode }
+                        : {}),
                 };
-                // Compute raw diff lines for text files (all modes)
                 if (!isBinaryFile(file.fileName)) {
                     writeResult.diffLines = computeUnifiedDiff(existingContent, fileContent);
                 }
                 fileChanges.set(file.fileName, writeResult);
             }
+            else if (modeDiffers) {
+                fileChanges.set(file.fileName, {
+                    fileName: file.fileName,
+                    content: null,
+                    action: "update",
+                    mode: desiredMode,
+                    modeOnly: true,
+                });
+            }
             if (dryRun) {
-                const status = getFileStatus(existingContent !== null, changed);
-                incrementDiffStats(diffStats, status);
-                const diffLines = generateDiff(existingContent, fileContent);
-                log.fileDiff(file.fileName, status, diffLines);
+                if (changed) {
+                    const status = getFileStatus(existingContent !== null, changed);
+                    incrementDiffStats(diffStats, status);
+                    const diffLines = generateDiff(existingContent, fileContent);
+                    log.fileDiff(file.fileName, status, diffLines);
+                }
+                else if (modeDiffers) {
+                    incrementDiffStats(diffStats, "MODIFIED");
+                    log.info(`Would change mode: ${file.fileName} ${currentMode} -> ${desiredMode}`);
+                }
             }
             else if (changed) {
                 incrementDiffStats(diffStats, action === "create" ? "NEW" : "MODIFIED");
                 gitOps.writeFile(file.fileName, fileContent);
             }
+            else if (modeDiffers) {
+                incrementDiffStats(diffStats, "MODIFIED");
+            }
         }
         // Separate pass for executable permissions: git add must happen after file
         // content is written, and setExecutable needs the file to already be tracked.
@@ -97,10 +121,20 @@ export class FileWriter {
             if (tracked?.action === "skip") {
                 continue;
             }
-            if (shouldBeExecutable(file)) {
-                log.info(`Setting executable: ${file.fileName}`);
+            const desired = shouldBeExecutable(file);
+            const currentMode = modeCache.get(file.fileName) ?? null;
+            if (desired && currentMode !== "100755") {
+                log.info(ctx.dryRun
+                    ? `Would set executable: ${file.fileName}`
+                    : `Setting executable: ${file.fileName}`);
                 await gitOps.setExecutable(file.fileName);
             }
+            else if (!desired && currentMode === "100755") {
+                log.info(ctx.dryRun
+                    ? `Would clear executable: ${file.fileName}`
+                    : `Clearing executable: ${file.fileName}`);
+                await gitOps.clearExecutable(file.fileName);
+            }
         }
         return { fileChanges, diffStats };
     }

package/dist/sync/repository-processor.d.ts

@@ -1,5 +1,5 @@
 import type { RepoConfig } from "../config/index.js";
-import type { RepoInfo } from "../shared/repo-detector.js";
+import type { RepoInfo } from "../repo/index.js";
 import type { ILogger } from "../shared/logger.js";
 import { type GitHubAppTokenManager } from "../vcs/index.js";
 import type { IFileWriter, IManifestManager, IBranchManager, IAuthOptionsBuilder, IRepositorySession, ICommitPushManager, IFileSyncOrchestrator, IPRMergeHandler, ISyncWorkflow, IRepositoryProcessor, GitOpsFactory, ProcessorOptions, ProcessorResult } from "./types.js";

package/dist/sync/repository-session.d.ts

@@ -1,4 +1,4 @@
-import type { RepoInfo } from "../shared/repo-detector.js";
+import type { RepoInfo } from "../repo/index.js";
 import type { ILogger } from "../shared/logger.js";
 import type { GitOpsFactory, SessionOptions, SessionContext, IRepositorySession } from "./types.js";
 export declare class RepositorySession implements IRepositorySession {

package/dist/sync/sync-workflow.d.ts

@@ -1,5 +1,5 @@
 import type { RepoConfig } from "../config/index.js";
-import { type RepoInfo } from "../shared/repo-detector.js";
+import { type RepoInfo } from "../repo/index.js";
 import type { DebugInfoLog } from "../shared/logger.js";
 import type { ISyncWorkflow, IWorkStrategy, IAuthOptionsBuilder, IRepositorySession, IBranchManager, ICommitPushManager, IPRMergeHandler, ProcessorOptions, ProcessorResult } from "./types.js";
 /**

package/dist/sync/sync-workflow.js

@@ -1,4 +1,4 @@
-import { getRepoDisplayName } from "../shared/repo-detector.js";
+import { getRepoDisplayName } from "../repo/index.js";
 import { safeCleanup } from "../shared/cleanup-utils.js";
 /**
  * Orchestrates the common sync workflow steps.
@@ -69,6 +69,7 @@ export class SyncWorkflow {
                 fileChanges: workResult.fileChanges,
                 commitMessage: workResult.commitMessage,
                 pushBranch,
+                baseBranch: session.baseBranch,
                 isDirectMode,
                 hasAppCredentials: options.hasAppCredentials,
             });

package/dist/sync/types.d.ts

@@ -1,6 +1,7 @@
 import type { FileContent, RepoConfig } from "../config/index.js";
-import type { RepoInfo } from "../shared/repo-detector.js";
-import type { ILocalGitOps, IGitOps, GitAuthOptions, GitOpsOptions, FileAction } from "../vcs/index.js";
+import type { RepoInfo } from "../repo/index.js";
+import type { ActiveAction } from "../settings/index.js";
+import type { ILocalGitOps, IGitOps, GitAuthOptions, GitOpsOptions, FileAction, FileActionKind } from "../vcs/index.js";
 import type { DiffStats } from "./diff-utils.js";
 import type { ILogger } from "../shared/logger.js";
 import type { XfgManifest } from "./manifest.js";
@@ -9,11 +10,12 @@ export type GitOpsFactory = (options: GitOpsOptions, auth?: GitAuthOptions, retr
 export interface FileWriteResult {
     fileName: string;
     content: string | null;
-    action: "create" | "update" | "delete" | "skip";
+    action: FileActionKind;
     diffLines?: string[];
     /** Git file mode. Only set for executable files ("100755"). "100644" is included
      *  in the union for type completeness — non-executable files omit this field. */
     mode?: "100755" | "100644";
+    modeOnly?: true;
 }
 export interface FileWriteContext {
     repoInfo: RepoInfo;
@@ -105,6 +107,7 @@ export interface CommitPushOptions extends RunContext {
     fileChanges: Map<string, FileWriteResult>;
     commitMessage: string;
     pushBranch: string;
+    baseBranch: string;
     isDirectMode: boolean;
     hasAppCredentials?: boolean;
 }
@@ -137,7 +140,7 @@ export interface ProcessorOptions {
 }
 export interface FileChangeDetail {
     path: string;
-    action: "create" | "update" | "delete";
+    action: ActiveAction;
     diffLines?: string[];
 }
 export interface ProcessorResult {

package/dist/vcs/{azure-pr-strategy.d.ts → ado-pr-strategy.d.ts}

@@ -3,7 +3,7 @@ import { BasePRStrategy } from "./pr-strategy.js";
 import type { IPRStrategyLogger } from "./pr-strategy.js";
 import type { PRStrategyOptions, CloseExistingPROptions, MergeOptions, MergeResult } from "./types.js";
 import type { ICommandExecutor } from "../shared/command-executor.js";
-export declare class AzurePRStrategy extends BasePRStrategy {
+export declare class AdoPRStrategy extends BasePRStrategy {
     constructor(executor: ICommandExecutor, log?: IPRStrategyLogger);
     private getOrgUrl;
     private buildPRUrl;
@@ -12,7 +12,7 @@ export declare class AzurePRStrategy extends BasePRStrategy {
      * Returns the raw PR ID string, or null if none found.
      */
     private findExistingPRId;
-    checkExistingPR(options: CloseExistingPROptions): Promise<string | null>;
+    findExistingPRUrl(options: CloseExistingPROptions): Promise<string | null>;
     closeExistingPR(options: CloseExistingPROptions): Promise<boolean>;
     create(options: PRStrategyOptions): Promise<PRResult>;
     /**

package/dist/vcs/{azure-pr-strategy.js → ado-pr-strategy.js}

@@ -1,16 +1,16 @@
 import { existsSync, writeFileSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { escapeShellArg } from "../shared/shell-utils.js";
-import { assertAzureDevOpsRepo, } from "../shared/repo-detector.js";
+import { assertAzureDevOpsRepo, } from "../repo/index.js";
 import { SyncError } from "../shared/errors.js";
 import { BasePRStrategy } from "./pr-strategy.js";
 import { withRetry, isPermanentError } from "../shared/retry-utils.js";
 import { toErrorMessage } from "../shared/type-guards.js";
 import { safeCleanup } from "../shared/cleanup-utils.js";
 import { NO_OP_DEBUG_LOG } from "../shared/logger.js";
-import { sanitizeCredentials } from "../shared/sanitize-utils.js";
+import { sanitizeCredentials } from "./sanitize-utils.js";
 import { getStderr } from "../shared/command-executor.js";
-export class AzurePRStrategy extends BasePRStrategy {
+export class AdoPRStrategy extends BasePRStrategy {
     constructor(executor, log) {
         super(executor, log);
         this.bodyFilePath = ".pr-description.md";
@@ -43,7 +43,7 @@ export class AzurePRStrategy extends BasePRStrategy {
             return null;
         }
     }
-    async checkExistingPR(options) {
+    async findExistingPRUrl(options) {
         const { repoInfo, branchName, baseBranch, workDir, retries = 3 } = options;
         assertAzureDevOpsRepo(repoInfo, "Azure PR strategy");
         const azureRepoInfo = repoInfo;

package/dist/vcs/authenticated-git-ops.d.ts

@@ -33,6 +33,8 @@ export declare class AuthenticatedGitOps implements IGitOps {
     createBranch(branchName: string): Promise<void>;
     writeFile(fileName: string, content: string): void;
     setExecutable(fileName: string): Promise<void>;
+    clearExecutable(fileName: string): Promise<void>;
+    getFileMode(fileName: string): Promise<"100755" | "100644" | null>;
     getFileContent(fileName: string): string | null;
     wouldChange(fileName: string, content: string): boolean;
     hasChanges(): Promise<boolean>;

package/dist/vcs/authenticated-git-ops.js

@@ -45,6 +45,12 @@ export class AuthenticatedGitOps {
     setExecutable(fileName) {
         return this.localOps.setExecutable(fileName);
     }
+    clearExecutable(fileName) {
+        return this.localOps.clearExecutable(fileName);
+    }
+    getFileMode(fileName) {
+        return this.localOps.getFileMode(fileName);
+    }
     getFileContent(fileName) {
         return this.localOps.getFileContent(fileName);
     }

package/dist/vcs/commit-strategy-selector.d.ts

@@ -1,4 +1,4 @@
-import { type RepoInfo } from "../shared/repo-detector.js";
+import { type RepoInfo } from "../repo/index.js";
 import type { ICommitStrategy } from "./types.js";
 import { GitHubAppTokenManager } from "./github-app-token-manager.js";
 import type { ICommandExecutor } from "../shared/command-executor.js";

package/dist/vcs/commit-strategy-selector.js

@@ -1,4 +1,4 @@
-import { isGitHubRepo } from "../shared/repo-detector.js";
+import { isGitHubRepo } from "../repo/index.js";
 import { GitCommitStrategy } from "./git-commit-strategy.js";
 import { GraphQLCommitStrategy } from "./graphql-commit-strategy.js";
 import { FileModeFixupCommitStrategy } from "./file-mode-fixup-commit-strategy.js";

package/dist/vcs/file-mode-fixup-commit-strategy.d.ts

@@ -9,10 +9,11 @@ export type GhApiClientFactory = (executor: ICommandExecutor, retries: number, c
  * The GitHub GraphQL createCommitOnBranch mutation cannot set file modes.
  * After the inner strategy (GraphQLCommitStrategy) creates the content commit,
  * this decorator creates a second commit via the REST Git Data API that
- * patches tree modes from 100644 to 100755 for executable files.
+ * patches tree modes to match the desired mode (100755 or 100644).
  *
- * Only activates when fileChanges contain entries with mode "100755".
- * When no executable files are present, delegates directly to the inner strategy.
+ * Activates when fileChanges contain entries with an explicit `mode` field
+ * or `modeOnly` flag. When no such entries are present, delegates directly
+ * to the inner strategy.
  */
 export declare class FileModeFixupCommitStrategy implements ICommitStrategy {
     private readonly inner;
@@ -20,12 +21,13 @@ export declare class FileModeFixupCommitStrategy implements ICommitStrategy {
     private readonly clientFactory;
     constructor(inner: ICommitStrategy, executor: ICommandExecutor, clientFactory?: GhApiClientFactory);
     commit(options: CommitOptions): Promise<CommitResult>;
+    private resolveBranchHeadSha;
     /**
-     * Create a fixup commit that changes file modes from 100644 to 100755.
+     * Create a fixup commit that patches file modes (100644 ↔ 100755).
      *
      * Flow:
-     * 1. GET the content commit to find its tree SHA
-     * 2. GET the tree (recursive) to find blob SHAs for executable files
+     * 1. GET the parent commit to find its tree SHA
+     * 2. GET the tree (recursive) to find blob SHAs for target files
      * 3. POST a new tree with updated modes (base_tree carries forward unchanged)
      * 4. POST a new commit with the new tree
      * 5. PATCH the branch ref to point to the new commit

package/dist/vcs/file-mode-fixup-commit-strategy.js

@@ -1,7 +1,8 @@
-import { isGitHubRepo } from "../shared/repo-detector.js";
+import { isGitHubRepo } from "../repo/index.js";
 import { GhApiClient } from "../shared/gh-api-utils.js";
 import { parseApiJson } from "../shared/json-utils.js";
 import { SyncError } from "../shared/errors.js";
+import { validateSafeBranchName } from "./graphql-commit-strategy.js";
 const defaultClientFactory = (executor, retries, cwd) => new GhApiClient(executor, retries, cwd);
 /**
  * Decorator that adds a follow-up commit to fix executable file modes.
@@ -9,10 +10,11 @@ const defaultClientFactory = (executor, retries, cwd) => new GhApiClient(executo
  * The GitHub GraphQL createCommitOnBranch mutation cannot set file modes.
  * After the inner strategy (GraphQLCommitStrategy) creates the content commit,
  * this decorator creates a second commit via the REST Git Data API that
- * patches tree modes from 100644 to 100755 for executable files.
+ * patches tree modes to match the desired mode (100755 or 100644).
  *
- * Only activates when fileChanges contain entries with mode "100755".
- * When no executable files are present, delegates directly to the inner strategy.
+ * Activates when fileChanges contain entries with an explicit `mode` field
+ * or `modeOnly` flag. When no such entries are present, delegates directly
+ * to the inner strategy.
  */
 export class FileModeFixupCommitStrategy {
     inner;
@@ -24,26 +26,72 @@ export class FileModeFixupCommitStrategy {
         this.clientFactory = clientFactory;
     }
     async commit(options) {
-        const innerResult = await this.inner.commit(options);
-        // Only non-deleted files can have their mode fixed (deletions have content === null)
-        const executableFiles = options.fileChanges.filter((fc) => fc.mode === "100755" && fc.content !== null);
+        validateSafeBranchName(options.branchName);
+        const executableFiles = options.fileChanges.filter((fc) => fc.modeOnly === true || fc.mode !== undefined);
+        const hasContentChanges = options.fileChanges.some((fc) => !fc.modeOnly);
         if (executableFiles.length === 0) {
-            return innerResult;
+            return this.inner.commit(options);
         }
-        // Safety net: only GitHub repos use the REST Git Data API for fixup.
-        // Currently only composed for GitHub repos in createCommitStrategy(),
-        // but guard defensively in case the decorator is reused elsewhere.
         if (!isGitHubRepo(options.repoInfo)) {
-            return innerResult;
+            return this.inner.commit(options);
+        }
+        let parentSha;
+        let baseResult;
+        if (hasContentChanges) {
+            baseResult = await this.inner.commit(options);
+            parentSha = baseResult.sha;
+        }
+        else {
+            parentSha = await this.resolveBranchHeadSha(options.repoInfo, options.branchName, options.baseBranch, options.workDir, options.retries ?? 3, options.token);
+            baseResult = { sha: parentSha, verified: true, pushed: true };
+        }
+        return await this.createFixupCommit(options.repoInfo, options.branchName, baseResult, executableFiles, options.workDir, options.retries ?? 3, options.token);
+    }
+    async resolveBranchHeadSha(repoInfo, branchName, baseBranch, workDir, retries, token) {
+        validateSafeBranchName(branchName);
+        if (baseBranch !== undefined) {
+            validateSafeBranchName(baseBranch);
+        }
+        const client = this.clientFactory(this.executor, retries, workDir);
+        const apiOpts = { token, host: repoInfo.host };
+        const repoPath = `repos/${repoInfo.owner}/${repoInfo.repo}`;
+        const getBranchRef = async (ref) => {
+            const raw = await client.call("GET", `${repoPath}/git/ref/heads/${ref}`, {
+                options: apiOpts,
+            });
+            const parsed = parseApiJson(raw, "GET git ref");
+            return parsed.object.sha;
+        };
+        try {
+            return await getBranchRef(branchName);
+        }
+        catch (err) {
+            const is404 = err instanceof Error && /\b404\b|Not Found/i.test(err.message);
+            if (!is404 || !baseBranch)
+                throw err;
+            const baseSha = await getBranchRef(baseBranch);
+            try {
+                await client.call("POST", `${repoPath}/git/refs`, {
+                    payload: { ref: `refs/heads/${branchName}`, sha: baseSha },
+                    options: apiOpts,
+                });
+                return baseSha;
+            }
+            catch (createErr) {
+                const alreadyExists = createErr instanceof Error &&
+                    /Reference already exists/i.test(createErr.message);
+                if (!alreadyExists)
+                    throw createErr;
+                return await getBranchRef(branchName);
+            }
         }
-        return await this.createFixupCommit(options.repoInfo, options.branchName, innerResult, executableFiles, options.workDir, options.retries ?? 3, options.token);
     }
     /**
-     * Create a fixup commit that changes file modes from 100644 to 100755.
+     * Create a fixup commit that patches file modes (100644 ↔ 100755).
      *
      * Flow:
-     * 1. GET the content commit to find its tree SHA
-     * 2. GET the tree (recursive) to find blob SHAs for executable files
+     * 1. GET the parent commit to find its tree SHA
+     * 2. GET the tree (recursive) to find blob SHAs for target files
      * 3. POST a new tree with updated modes (base_tree carries forward unchanged)
      * 4. POST a new commit with the new tree
      * 5. PATCH the branch ref to point to the new commit
@@ -63,31 +111,32 @@ export class FileModeFixupCommitStrategy {
         // 2. Get tree entries to find blob SHAs
         const treeRaw = await client.call("GET", `${repoPath}/git/trees/${treeSha}?recursive=1`, { options: apiOpts });
         const treeData = parseApiJson(treeRaw, "GET git tree");
-        const executablePaths = new Set(executableFiles.map((f) => f.path));
         const treeEntries = [];
+        const requestedByPath = new Map(executableFiles.map((f) => [f.path, f]));
         for (const entry of treeData.tree) {
-            if (executablePaths.has(entry.path) &&
-                entry.type === "blob" &&
-                entry.mode !== "100755") {
-                treeEntries.push({
-                    path: entry.path,
-                    mode: "100755",
-                    type: "blob",
-                    sha: entry.sha,
-                });
-            }
+            const requested = requestedByPath.get(entry.path);
+            if (!requested || entry.type !== "blob")
+                continue;
+            const desiredMode = requested.mode ?? "100755";
+            if (entry.mode === desiredMode)
+                continue;
+            treeEntries.push({
+                path: entry.path,
+                mode: desiredMode,
+                type: "blob",
+                sha: entry.sha,
+            });
         }
-        // If tree was truncated (>100k entries), check that all executable files were found
         if (treeData.truncated) {
             const foundPaths = new Set(treeData.tree.filter((e) => e.type === "blob").map((e) => e.path));
-            const missing = [...executablePaths].filter((p) => !foundPaths.has(p));
+            const missing = [...requestedByPath.keys()].filter((p) => !foundPaths.has(p));
             if (missing.length > 0) {
                 throw new SyncError(`File mode fixup incomplete: tree response was truncated (>100k entries) ` +
                     `and ${missing.length} executable file(s) were not found: ${missing.join(", ")}`);
             }
         }
         if (treeEntries.length === 0) {
-            // All requested files are either already 100755 or absent from the tree.
+            // All requested files already have the desired mode or are absent from the tree.
             // Absent files in a non-truncated tree means createCommitOnBranch did not
             // include them (e.g., concurrent deletion) — safe to skip since there is
             // no blob to patch.

package/dist/vcs/git-ops.d.ts

@@ -9,9 +9,9 @@ export interface GitOpsOptions {
     log?: DebugLog;
 }
 export declare class GitOps implements ILocalGitOps {
-    private readonly _workDir;
+    private readonly workDir;
     private readonly dryRun;
-    private readonly _executor;
+    private readonly executor;
     private readonly log?;
     constructor(options: GitOpsOptions);
     private exec;
@@ -36,6 +36,18 @@ export declare class GitOps implements ILocalGitOps {
      * @param fileName - The file path relative to the work directory
      */
     setExecutable(fileName: string): Promise<void>;
+    /**
+     * Clears the executable bit on a file both on the filesystem and in git's index.
+     * Symmetric inverse of setExecutable.
+     * @param fileName - The file path relative to the work directory
+     */
+    clearExecutable(fileName: string): Promise<void>;
+    /**
+     * Returns the git index mode for a tracked file ("100755" or "100644"),
+     * or null if the file is not tracked.
+     * @param fileName - The file path relative to the work directory
+     */
+    getFileMode(fileName: string): Promise<"100755" | "100644" | null>;
     /**
      * Get the content of a file in the workspace.
      * Returns null if the file doesn't exist.
@@ -70,7 +82,7 @@ export declare class GitOps implements ILocalGitOps {
     /**
      * Stage all changes and commit with the given message.
      * Uses --no-verify to skip pre-commit hooks (config sync should always succeed).
-     * @returns true if a commit was made (or would be made in dry-run mode), false if there were no staged changes
+     * @returns true if a commit was made, or false if there were no staged changes. In dry-run mode, always returns true without inspecting the working tree.
      */
     commit(message: string): Promise<boolean>;
     /**