@bobfrankston/npmglobalize 1.0.199 → 1.0.201

package/lib/git.js

@@ -1,748 +0,0 @@
-/**
- * npmglobalize — Git operations, command execution, and push protection.
- * Depends on: types (leaf), config (leaf)
- */
-import fs from 'fs';
-import path from 'path';
-import { execSync } from 'child_process';
-import { spawnSafe, colors } from './types.js';
-// ── Group 1: Low-level utilities (private) ──────────────────────────
-/**
- * Remove 'nul' files from a directory tree (Windows reserved name issue).
- * These files break git and npm on Windows. Uses \\?\ prefix to bypass name validation.
- */
-export function removeNulFiles(dir, visited = new Set()) {
-    const resolved = path.resolve(dir);
-    if (visited.has(resolved))
-        return 0;
-    visited.add(resolved);
-    let count = 0;
-    try {
-        const entries = fs.readdirSync(dir, { withFileTypes: true });
-        for (const entry of entries) {
-            const full = path.join(dir, entry.name);
-            if (entry.isDirectory() && !entry.isSymbolicLink() && entry.name !== 'node_modules') {
-                count += removeNulFiles(full, visited);
-            }
-            else if (entry.name === 'nul') {
-                try {
-                    fs.unlinkSync(path.join('\\\\?\\', path.resolve(full)));
-                    count++;
-                }
-                catch {
-                    // Ignore deletion errors
-                }
-            }
-        }
-    }
-    catch {
-        // Ignore read errors (permissions, etc.)
-    }
-    return count;
-}
-/** Repair a corrupted git index by rebuilding it.
- *  Handles "invalid object" / "Error building trees" errors caused by
- *  stale entries in .git/index referencing missing objects. */
-export function repairGitIndex(cwd) {
-    const indexPath = path.join(cwd, '.git', 'index');
-    try {
-        console.log(colors.yellow('Detected corrupted git index — rebuilding...'));
-        // Delete the corrupted index
-        if (fs.existsSync(indexPath)) {
-            fs.unlinkSync(indexPath);
-        }
-        // Rebuild from HEAD (reset index to match last commit)
-        const resetResult = spawnSafe('git', ['reset'], {
-            encoding: 'utf-8',
-            stdio: 'pipe',
-            cwd,
-            env: process.env
-        });
-        if (resetResult.status !== 0) {
-            // If no commits yet, just proceed — git add -A will build a fresh index
-            const stderr = resetResult.stderr || '';
-            if (!stderr.includes('does not have any commits')) {
-                console.error(colors.red('Failed to reset git index:'), stderr.trim());
-                return false;
-            }
-        }
-        // Re-stage all files
-        const addResult = spawnSafe('git', ['add', '-A'], {
-            encoding: 'utf-8',
-            stdio: 'pipe',
-            cwd,
-            env: process.env
-        });
-        if (addResult.status !== 0) {
-            console.error(colors.red('Failed to re-add files after index rebuild:'), (addResult.stderr || '').trim());
-            return false;
-        }
-        console.log(colors.green('✓ Git index rebuilt successfully'));
-        return true;
-    }
-    catch (err) {
-        console.error(colors.red('Failed to repair git index:'), err.message);
-        return false;
-    }
-}
-/** Parse file paths from git add "Permission denied" / "unable to index file" errors.
- *  Matches lines like: error: open("data/PingDB.mdf"): Permission denied
- *                  and: error: unable to index file 'data/PingDB.mdf' */
-export function parseDeniedFiles(errText) {
-    const files = [];
-    for (const line of errText.split('\n')) {
-        // error: open("path"): Permission denied
-        let m = line.match(/error:\s*open\(["'](.+?)["']\):\s*Permission denied/i);
-        if (m) {
-            files.push(m[1]);
-            continue;
-        }
-        // error: unable to index file 'path'
-        m = line.match(/error:\s*unable to index file\s+['"](.+?)['"]/i);
-        if (m) {
-            files.push(m[1]);
-            continue;
-        }
-    }
-    return files;
-}
-// ── Group 2: Command execution ──────────────────────────────────────
-/** Run a command and return success status */
-export function runCommand(cmd, args, options = {}) {
-    const { silent = false, verbose = false, showCommand = false, cwd } = options;
-    try {
-        // Use shell:true for npm/gh commands which need it on Windows
-        const needsShell = cmd === 'npm' || cmd === 'npm.cmd' || cmd === 'gh';
-        // Show command for important actions (install, etc.) or in verbose mode
-        if (!silent && (showCommand || verbose)) {
-            console.log(colors.cyan(`> ${cmd} ${args.join(' ')}`));
-        }
-        const result = spawnSafe(cmd, args, {
-            encoding: 'utf-8',
-            stdio: silent ? 'pipe' : 'inherit',
-            cwd,
-            env: process.env, // Always inherit environment variables
-            shell: needsShell // Only use shell for npm commands
-        });
-        // For non-silent commands, we can't capture output when using 'inherit'
-        // So we return empty string for output, but the user sees it in the terminal
-        if (!silent) {
-            return {
-                success: result.status === 0,
-                output: '',
-                stderr: ''
-            };
-        }
-        const output = result.stdout || '';
-        const stderr = result.stderr || '';
-        return {
-            success: result.status === 0,
-            output: output,
-            stderr: stderr
-        };
-    }
-    catch (error) {
-        return { success: false, output: '', stderr: error.message };
-    }
-}
-/** Extract GitHub repo identifier from repository field */
-export function getGitHubRepo(pkg) {
-    if (!pkg.repository)
-        return null;
-    const repo = typeof pkg.repository === 'string' ? pkg.repository : pkg.repository.url;
-    if (!repo)
-        return null;
-    // Handle various GitHub URL formats
-    // git+https://github.com/owner/repo.git
-    // https://github.com/owner/repo
-    // github:owner/repo
-    // owner/repo
-    const match = repo.match(/github\.com[\/:]([^\/]+\/[^\/\.]+)/);
-    if (match) {
-        return match[1]; // Returns "owner/repo"
-    }
-    // Already in owner/repo format
-    if (/^[^\/]+\/[^\/]+$/.test(repo)) {
-        return repo;
-    }
-    return null;
-}
-/** Run a command and throw on failure */
-export function runCommandOrThrow(cmd, args, options = {}) {
-    const needsShell = cmd === 'npm' || cmd === 'npm.cmd' || cmd === 'gh';
-    const result = spawnSafe(cmd, args, {
-        encoding: 'utf-8',
-        stdio: 'pipe',
-        cwd: options.cwd,
-        env: process.env,
-        shell: needsShell
-    });
-    const stdout = result.stdout || '';
-    const stderr = result.stderr || '';
-    const output = stdout + stderr;
-    if (result.status !== 0) {
-        // Detect git safe.directory ownership issue and auto-fix
-        if (cmd === 'git' && stderr.includes('dubious ownership')) {
-            console.log(colors.yellow('Git "dubious ownership" error — directory owner SID differs from current user.'));
-            console.log(colors.yellow('Adding safe.directory \'*\' to global git config...'));
-            const fix = spawnSafe('git', ['config', '--global', '--add', 'safe.directory', '*'], {
-                encoding: 'utf-8',
-                stdio: 'pipe',
-                shell: true
-            });
-            if (fix.status === 0) {
-                console.log(colors.green('✓ Fixed. Retrying...'));
-                // Retry the original command
-                const retry = spawnSafe(cmd, args, {
-                    encoding: 'utf-8',
-                    stdio: 'pipe',
-                    cwd: options.cwd,
-                    env: process.env,
-                    shell: needsShell
-                });
-                if (retry.status === 0) {
-                    return (retry.stdout || '') + (retry.stderr || '');
-                }
-                // Retry also failed
-                const retryStderr = retry.stderr || '';
-                if (retryStderr.trim()) {
-                    console.error(colors.red(retryStderr.trim()));
-                }
-                throw new Error(`Command failed after safe.directory fix: ${cmd} ${args.join(' ')}`);
-            }
-            throw new Error('Failed to add safe.directory to git config.');
-        }
-        // Detect corrupted git index and auto-repair
-        if (cmd === 'git' && (stderr.includes('invalid object') || stderr.includes('Error building trees'))) {
-            if (options.cwd && repairGitIndex(options.cwd)) {
-                // Retry the original command
-                const retry = spawnSafe(cmd, args, {
-                    encoding: 'utf-8',
-                    stdio: 'pipe',
-                    cwd: options.cwd,
-                    env: process.env,
-                    shell: needsShell
-                });
-                if (retry.status === 0) {
-                    return (retry.stdout || '') + (retry.stderr || '');
-                }
-                const retryStderr = retry.stderr || '';
-                if (retryStderr.trim()) {
-                    console.error(colors.red(retryStderr.trim()));
-                }
-                throw new Error(`Command failed after git index repair: ${cmd} ${args.join(' ')}`);
-            }
-        }
-        // Show the error output
-        if (stderr.trim()) {
-            console.error(colors.red(stderr.trim()));
-        }
-        if (stdout.trim()) {
-            console.log(stdout.trim());
-        }
-        throw new Error(`Command failed with exit code ${result.status}: ${cmd} ${args.join(' ')}`);
-    }
-    return output;
-}
-// ── Group 3: Git status ─────────────────────────────────────────────
-export function getGitStatus(cwd) {
-    const status = {
-        isRepo: false,
-        hasRemote: false,
-        hasUncommitted: false,
-        hasUnpushed: false,
-        hasMergeConflict: false,
-        isDetachedHead: false,
-        currentBranch: '',
-        remoteBranch: '',
-        isBehindRemote: false
-    };
-    // Check if git repo
-    const gitDir = path.join(cwd, '.git');
-    if (!fs.existsSync(gitDir)) {
-        return status;
-    }
-    status.isRepo = true;
-    // Check for merge conflicts
-    const mergeHead = path.join(gitDir, 'MERGE_HEAD');
-    status.hasMergeConflict = fs.existsSync(mergeHead);
-    // Get branch info
-    try {
-        const branch = execSync('git rev-parse --abbrev-ref HEAD', { cwd, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'ignore'] }).trim();
-        status.currentBranch = branch;
-        status.isDetachedHead = branch === 'HEAD';
-    }
-    catch (error) {
-        // Ignore - might be no commits yet
-    }
-    // Check for remote
-    try {
-        const remote = execSync('git remote', { cwd, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'ignore'] }).trim();
-        status.hasRemote = remote.length > 0;
-    }
-    catch (error) {
-        // Ignore
-    }
-    // Check for uncommitted changes
-    try {
-        const statusOutput = execSync('git status --porcelain', { cwd, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'ignore'] });
-        status.hasUncommitted = statusOutput.trim().length > 0;
-    }
-    catch (error) {
-        // Ignore
-    }
-    // Check for unpushed commits
-    if (status.hasRemote && !status.isDetachedHead && status.currentBranch) {
-        try {
-            const unpushed = execSync(`git log origin/${status.currentBranch}..HEAD --oneline`, {
-                cwd,
-                encoding: 'utf-8',
-                stdio: ['pipe', 'pipe', 'ignore']
-            }).trim();
-            status.hasUnpushed = unpushed.length > 0;
-        }
-        catch (error) {
-            // Ignore - might not have tracking branch
-        }
-        // Check if local is behind remote
-        try {
-            const behind = execSync(`git log HEAD..origin/${status.currentBranch} --oneline`, {
-                cwd,
-                encoding: 'utf-8',
-                stdio: ['pipe', 'pipe', 'ignore']
-            }).trim();
-            status.isBehindRemote = behind.length > 0;
-        }
-        catch (error) {
-            // Ignore - might not have tracking branch
-        }
-    }
-    return status;
-}
-/** Validate package.json for release */
-export function validatePackageJson(pkg) {
-    const errors = [];
-    const warnings = [];
-    if (!pkg.repository) {
-        errors.push('Missing repository field - required for npm packages');
-    }
-    if (!pkg.description) {
-        warnings.push('Missing description field');
-    }
-    if (!pkg.name) {
-        errors.push('Missing name field');
-    }
-    if (!pkg.version) {
-        errors.push('Missing version field');
-    }
-    // Print warnings
-    for (const w of warnings) {
-        console.log(`  Warning: ${w}`);
-    }
-    return errors;
-}
-// ── Group 4: Git tags ───────────────────────────────────────────────
-/** Get the latest git tag (if any) */
-export function getLatestGitTag(cwd) {
-    try {
-        const result = spawnSafe('git', ['describe', '--tags', '--abbrev=0'], {
-            encoding: 'utf-8',
-            stdio: 'pipe',
-            cwd
-        });
-        if (result.status === 0 && result.stdout) {
-            return result.stdout.trim();
-        }
-        return null;
-    }
-    catch (error) {
-        return null;
-    }
-}
-/** Check if a git tag exists */
-export function gitTagExists(cwd, tag) {
-    try {
-        const result = spawnSafe('git', ['tag', '-l', tag], {
-            encoding: 'utf-8',
-            stdio: 'pipe',
-            cwd
-        });
-        return result.status === 0 && result.stdout.trim() === tag;
-    }
-    catch (error) {
-        return false;
-    }
-}
-/** Delete a git tag */
-export function deleteGitTag(cwd, tag) {
-    try {
-        const result = spawnSafe('git', ['tag', '-d', tag], {
-            encoding: 'utf-8',
-            stdio: 'pipe',
-            cwd
-        });
-        return result.status === 0;
-    }
-    catch (error) {
-        return false;
-    }
-}
-/** Get all git tags */
-export function getAllGitTags(cwd) {
-    try {
-        const result = spawnSafe('git', ['tag', '-l'], {
-            encoding: 'utf-8',
-            stdio: 'pipe',
-            cwd
-        });
-        if (result.status === 0 && result.stdout) {
-            return result.stdout.trim().split('\n').filter(t => t.trim());
-        }
-        return [];
-    }
-    catch (error) {
-        return [];
-    }
-}
-/** Parse version from tag (e.g., 'v1.2.3' -> [1, 2, 3]) */
-export function parseVersionTag(tag) {
-    const match = tag.match(/^v?(\d+)\.(\d+)\.(\d+)/);
-    if (!match)
-        return null;
-    return [parseInt(match[1]), parseInt(match[2]), parseInt(match[3])];
-}
-/** Compare two version arrays (returns -1 if a < b, 0 if equal, 1 if a > b) */
-export function compareVersions(a, b) {
-    for (let i = 0; i < 3; i++) {
-        if (a[i] < b[i])
-            return -1;
-        if (a[i] > b[i])
-            return 1;
-    }
-    return 0;
-}
-/** Fix version/tag mismatches */
-export function fixVersionTagMismatch(cwd, pkg, verbose = false) {
-    const pkgVersion = pkg.version;
-    if (!pkgVersion) {
-        return false; // No version in package.json
-    }
-    const currentVersion = parseVersionTag(pkgVersion);
-    if (!currentVersion) {
-        console.error(colors.yellow(`Warning: Could not parse package.json version: ${pkgVersion}`));
-        return false;
-    }
-    const allTags = getAllGitTags(cwd);
-    const tagsToDelete = [];
-    // Find all tags that are >= current package.json version
-    for (const tag of allTags) {
-        const tagVersion = parseVersionTag(tag);
-        if (tagVersion && compareVersions(tagVersion, currentVersion) >= 0) {
-            tagsToDelete.push(tag);
-        }
-    }
-    if (tagsToDelete.length === 0) {
-        if (verbose) {
-            console.log(`No conflicting tags found (package.json is at v${pkgVersion})`);
-        }
-        return false;
-    }
-    // Silently clean up tags unless verbose mode
-    if (verbose) {
-        console.log(colors.yellow(`\nVersion/tag mismatch detected:`));
-        console.log(`  package.json version: ${pkgVersion}`);
-        console.log(`  Conflicting tags found: ${tagsToDelete.join(', ')}`);
-        console.log(colors.yellow('Deleting conflicting tags...'));
-    }
-    let deletedAny = false;
-    for (const tag of tagsToDelete) {
-        if (deleteGitTag(cwd, tag)) {
-            if (verbose) {
-                console.log(colors.green(`  ✓ Deleted tag ${tag}`));
-            }
-            deletedAny = true;
-        }
-        else {
-            console.error(colors.red(`  ✗ Failed to delete tag ${tag}`));
-        }
-    }
-    return deletedAny;
-}
-// ── Group 5: npm install helpers (private) ──────────────────────────
-/** Reliable synchronous sleep — works regardless of stdio/TTY state.
- *  (Windows `timeout /t` exits immediately when stdio is piped, which broke
- *  the previous spawn-based sleep.) */
-function sleepSync(ms) {
-    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
-/** Wait for a package version to appear on the npm registry.
- *  First-time publishes (brand-new package name) take much longer to
- *  propagate than version bumps — npm has no cached metadata to update,
- *  so the registry/CDN can take several minutes before the package is
- *  resolvable. We wait longer and re-probe `npm view` for the version
- *  string until it shows up (or we hit the cap). */
-export function waitForNpmVersion(pkgName, version, isNewPackage = false, maxWaitMs) {
-    const effectiveMaxWait = maxWaitMs ?? (isNewPackage ? 600000 : 180000);
-    const interval = isNewPackage ? 5000 : 3000;
-    const maxAttempts = Math.ceil(effectiveMaxWait / interval);
-    const suffix = isNewPackage ? ' (new package, may take several minutes)' : '';
-    process.stdout.write(`Waiting for ${pkgName}@${version} on npm registry${suffix}`);
-    for (let i = 0; i < maxAttempts; i++) {
-        const result = spawnSafe('npm', ['view', `${pkgName}@${version}`, 'version'], {
-            shell: process.platform === 'win32',
-            stdio: ['pipe', 'pipe', 'pipe'],
-            encoding: 'utf-8'
-        });
-        if (result.status === 0 && result.stdout?.trim() === version) {
-            process.stdout.write(' ready\n');
-            return true;
-        }
-        process.stdout.write('.');
-        sleepSync(interval);
-    }
-    process.stdout.write(' timed out\n');
-    return false;
-}
-/** Run npm install -g with retries for registry propagation delay.
- *  Brand-new packages (first-time publish) take much longer to become
- *  installable than version bumps, so we use longer waits and more
- *  attempts when `isNewPackage` is true. */
-export function installGlobalWithRetry(pkgSpec, cwd, isNewPackage = false, maxRetries) {
-    const retries = maxRetries ?? (isNewPackage ? 6 : 3);
-    const delaySec = isNewPackage ? 30 : 10;
-    let result = runCommand('npm', ['install', '-g', pkgSpec], { cwd, silent: false, showCommand: true });
-    for (let attempt = 1; attempt < retries && !result.success; attempt++) {
-        console.log(colors.yellow(`  Retrying install (attempt ${attempt + 1}/${retries}) in ${delaySec} seconds...`));
-        sleepSync(delaySec * 1000);
-        result = runCommand('npm', ['install', '-g', pkgSpec], { cwd, silent: false, showCommand: true });
-    }
-    return result;
-}
-// ── Group 6: Push protection ────────────────────────────────────────
-/** Detect OAuth credentials type from a specific JSON file path.
- *  Returns 'installed' (public app ID, safe) or 'web' (real secret) or null. */
-function detectCredentialsTypeFromFile(filePath) {
-    if (!fs.existsSync(filePath))
-        return null;
-    try {
-        const content = fs.readFileSync(filePath, 'utf-8');
-        const parsed = JSON.parse(content);
-        if (parsed.installed)
-            return 'installed';
-        if (parsed.web)
-            return 'web';
-        return null; // Unknown format (e.g., Microsoft OAuth)
-    }
-    catch {
-        return null;
-    }
-}
-/** Detect OAuth credentials.json type: "installed" (public app ID, safe to include) or "web" (has real secret, must ignore).
- *  Returns null if no credentials.json exists or it can't be parsed. */
-export function detectCredentialsType(cwd) {
-    return detectCredentialsTypeFromFile(path.join(cwd, 'credentials.json'));
-}
-/** Parse GitHub push protection (GH013) error output and extract secret details + unblock URLs. */
-export function parsePushProtection(errorOutput, cwd) {
-    const result = { detected: false, secrets: [], allInstalledOAuth: false };
-    if (!errorOutput)
-        return result;
-    // Strip 'remote: ' prefixes for easier parsing
-    const cleaned = errorOutput.replace(/^remote:\s*/gm, '');
-    if (!cleaned.includes('GH013') && !cleaned.toLowerCase().includes('push protection')) {
-        return result;
-    }
-    result.detected = true;
-    // Match secret blocks using a single regex across any dash characters
-    // Pattern: "-- Type Name ---..." then "path: file:line" then "unblock-secret/id" URL
-    // Handles em-dash (—), en-dash (–), and regular dash (-)
-    const secretRegex = /[-\u2014\u2013]{2,}\s+(.+?)\s+[-\u2014\u2013]{2,}[\s\S]*?path:\s+(\S+?)(?::\d+)?\s[\s\S]*?(https:\/\/github\.com\/\S+\/unblock-secret\/\S+)/g;
-    let match;
-    while ((match = secretRegex.exec(cleaned)) !== null) {
-        result.secrets.push({
-            type: match[1].trim(),
-            file: match[2].trim(),
-            unblockUrl: match[3].trim()
-        });
-    }
-    // If regex didn't match (encoding issues), fall back to finding unblock URLs + paths
-    if (result.secrets.length === 0) {
-        const urlRegex = /(https:\/\/github\.com\/\S+\/unblock-secret\/\S+)/g;
-        const pathRegex = /path:\s+(\S+?)(?::\d+)?\s/g;
-        const urls = [];
-        const files = [];
-        let m;
-        while ((m = urlRegex.exec(cleaned)) !== null)
-            urls.push(m[1].trim());
-        while ((m = pathRegex.exec(cleaned)) !== null)
-            files.push(m[1].trim());
-        // Try to detect secret type from text
-        const hasOAuth = cleaned.toLowerCase().includes('oauth');
-        const secretType = hasOAuth ? 'Google OAuth Credential' : 'Secret';
-        for (let i = 0; i < Math.max(urls.length, files.length); i++) {
-            result.secrets.push({
-                type: secretType,
-                file: files[i] || '',
-                unblockUrl: urls[i] || ''
-            });
-        }
-    }
-    // Check if all detected secrets are from Google OAuth installed apps (safe to include)
-    if (result.secrets.length > 0) {
-        result.allInstalledOAuth = result.secrets.every(s => {
-            if (!s.file)
-                return false;
-            // Check by type name OR by inspecting the actual credential file
-            const credType = detectCredentialsTypeFromFile(path.join(cwd, s.file));
-            if (credType === 'installed')
-                return true;
-            // Also match if the type name mentions OAuth (even if file check failed)
-            return s.type.toLowerCase().includes('oauth') && credType !== 'web';
-        });
-    }
-    return result;
-}
-/** Try to auto-bypass push protection for installed OAuth secrets via gh API.
- *  Returns true if all bypasses succeeded and push should be retried. */
-function tryAutoBypassPushProtection(ppInfo, cwd) {
-    if (!ppInfo.allInstalledOAuth || ppInfo.secrets.length === 0)
-        return false;
-    // Check if gh CLI is available
-    const ghCheck = runCommand('gh', ['auth', 'status'], { cwd, silent: true });
-    if (!ghCheck.success)
-        return false;
-    // Extract repo owner/name from unblock URLs or git remote
-    let repo = '';
-    for (const s of ppInfo.secrets) {
-        if (s.unblockUrl) {
-            const repoMatch = s.unblockUrl.match(/github\.com\/([^/]+\/[^/]+)\//);
-            if (repoMatch) {
-                repo = repoMatch[1];
-                break;
-            }
-        }
-    }
-    if (!repo)
-        return false;
-    let allBypassed = true;
-    for (const s of ppInfo.secrets) {
-        if (!s.unblockUrl) {
-            allBypassed = false;
-            continue;
-        }
-        // Extract placeholder_id from unblock URL (last path segment)
-        const idMatch = s.unblockUrl.match(/\/unblock-secret\/(\S+)/);
-        if (!idMatch) {
-            allBypassed = false;
-            continue;
-        }
-        const placeholderId = idMatch[1];
-        console.log(colors.cyan(`  Bypassing push protection for: ${s.type} (false_positive — installed app ID)...`));
-        const bypassResult = runCommand('gh', [
-            'api', `repos/${repo}/secret-scanning/push-protection-bypasses`,
-            '-X', 'POST',
-            '-f', 'reason=false_positive',
-            '-f', `placeholder_id=${placeholderId}`
-        ], { cwd, silent: true });
-        if (!bypassResult.success) {
-            allBypassed = false;
-        }
-    }
-    return allBypassed;
-}
-/** Display push protection guidance based on the type of secrets detected. */
-export function showPushProtectionGuidance(ppInfo) {
-    console.error('');
-    console.error(colors.yellow('GitHub Push Protection blocked the push — secrets detected in commits.'));
-    if (ppInfo.allInstalledOAuth) {
-        console.error(colors.cyan('These are Google OAuth credentials for a desktop/installed app.'));
-        console.error(colors.cyan('The "client_secret" is just a public app identifier, not a real secret.'));
-        console.error(colors.cyan('(Google docs: "the client_secret is obviously not treated as a secret")'));
-        console.error('');
-        console.error('To unblock, visit each URL below and allow the secret:');
-    }
-    else {
-        console.error('');
-        console.error('To unblock, review each secret and visit the URL to allow or remove it:');
-    }
-    for (const s of ppInfo.secrets) {
-        console.error(`  ${s.type}: ${s.file}`);
-        if (s.unblockUrl) {
-            console.error(`    ${colors.cyan(s.unblockUrl)}`);
-        }
-    }
-    console.error('');
-    console.error('After unblocking, re-run the push or re-run npmglobalize.');
-}
-/** Push to git with push-protection detection and auto-bypass for installed OAuth.
- *  Returns true if push succeeded (possibly after auto-bypass). */
-export function pushWithProtection(cwd, verbose) {
-    let pushResult = runCommand('git', ['push'], { cwd, silent: true });
-    if (pushResult.success) {
-        if (verbose)
-            console.log(colors.green('  ✓ Pushed to remote'));
-        return true;
-    }
-    // Check for "Everything up-to-date" — git sometimes returns non-zero
-    // alongside transient errors even though there's nothing to push
-    const combined = (pushResult.output + ' ' + pushResult.stderr).toLowerCase();
-    if (combined.includes('everything up-to-date')) {
-        if (verbose)
-            console.log(colors.green('  ✓ Already up-to-date'));
-        return true;
-    }
-    // No upstream branch — auto-set and retry
-    if (combined.includes('no upstream branch') || combined.includes('has no upstream')) {
-        if (verbose)
-            console.log(colors.yellow('  No upstream branch — setting upstream...'));
-        const branchResult = runCommand('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd, silent: true });
-        const branch = branchResult.output.trim() || 'master';
-        pushResult = runCommand('git', ['push', '--set-upstream', 'origin', branch], { cwd, silent: true });
-        if (pushResult.success) {
-            if (verbose)
-                console.log(colors.green('  ✓ Pushed to remote (set upstream)'));
-            return true;
-        }
-    }
-    // Transient network errors (HTTP 408, RPC failed, unexpected disconnect) — retry once
-    if (/rpc failed|curl \d+|unexpected disconnect|hung up unexpectedly/i.test(pushResult.stderr)) {
-        console.log(colors.yellow('Git push failed with transient error — retrying...'));
-        pushResult = runCommand('git', ['push'], { cwd, silent: true });
-        if (pushResult.success) {
-            if (verbose)
-                console.log(colors.green('  ✓ Pushed to remote (retry)'));
-            return true;
-        }
-        const retryCombo = (pushResult.output + ' ' + pushResult.stderr).toLowerCase();
-        if (retryCombo.includes('everything up-to-date')) {
-            if (verbose)
-                console.log(colors.green('  ✓ Already up-to-date'));
-            return true;
-        }
-    }
-    const ppInfo = parsePushProtection(pushResult.stderr, cwd);
-    if (!ppInfo.detected) {
-        console.error(colors.red('Git push failed:'));
-        if (pushResult.stderr)
-            console.error(pushResult.stderr);
-        return false;
-    }
-    // Try auto-bypass for installed OAuth credentials
-    if (ppInfo.allInstalledOAuth && tryAutoBypassPushProtection(ppInfo, cwd)) {
-        console.log(colors.green('  ✓ Auto-bypassed push protection (installed OAuth — not a real secret)'));
-        const retryPush = runCommand('git', ['push'], { cwd, silent: true });
-        if (retryPush.success) {
-            if (verbose)
-                console.log(colors.green('  ✓ Pushed to remote'));
-            return true;
-        }
-        console.error(colors.yellow('Push still failed after bypass:'));
-        if (retryPush.stderr)
-            console.error(retryPush.stderr);
-        return false;
-    }
-    // Can't auto-bypass — show manual guidance
-    showPushProtectionGuidance(ppInfo);
-    return false;
-}
-//# sourceMappingURL=git.js.map