@caddis/cli 0.4.18 → 0.4.20

package/bundles/codex/.codex/skills/devops/port-to-github/scripts/Publish-PortToGitHub.ps1

@@ -0,0 +1,156 @@
+<#
+.SYNOPSIS
+  Create the GitHub repository (empty) and push a staged mirror to it, then prove every ref landed.
+
+.DESCRIPTION
+  - Pushes with an EXPLICIT refspec (heads and tags). Never --mirror: a server's hidden refs
+    (refs/pull/*) are refused by GitHub, and --mirror would also DELETE anything on GitHub the
+    stage lacks.
+  - Never force-pushes. If the GitHub repo already exists it must be empty, or every one of its
+    branches must be an ancestor of (or equal to) the staged branch of the same name. Otherwise it
+    refuses: pushing on top of unrelated history welds a fake ancestry in permanently.
+  - Verifies by SHA with Compare-PortRefs.ps1 and exits 1 if any ref differs.
+
+  Uses the gh CLI for the API and your normal git credential helper for the push
+  (run `gh auth setup-git` once if git cannot authenticate to github.com).
+#>
+[CmdletBinding(SupportsShouldProcess)]
+param(
+    [Parameter(Mandatory)][string]$Name,
+    [string]$Owner,
+    [string]$Repo,
+    [ValidateSet('private', 'internal', 'public')][string]$Visibility,
+    [string]$Description,
+    [string]$StagingRoot,
+    [string]$ConfigPath,
+    # Allow pushing into an existing NON-empty repo whose history is compatible (fast-forward only).
+    [switch]$AllowExisting,
+    # The staged branches already contain .github/workflows; pushing them WILL run those
+    # workflows (a deploy job included). Pass only after reading them.
+    [switch]$AllowWorkflowRuns
+)
+
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'PortCommon.ps1')
+
+$config = Get-PortConfig $ConfigPath
+$stage = Join-Path (Get-PortStagingRoot $config $StagingRoot) $Name
+$mirror = Join-Path $stage 'mirror.git'
+$manifestPath = Join-Path $stage 'manifest.json'
+if (-not (Test-Path -LiteralPath $mirror)) { throw "No staged mirror at $mirror. Run Get-PortSource.ps1 first." }
+$manifest = Get-Content -LiteralPath $manifestPath -Raw | ConvertFrom-Json
+
+$readinessPath = Join-Path $stage 'readiness.json'
+if (-not (Test-Path -LiteralPath $readinessPath)) { throw "No readiness report. Run Test-PortReadiness.ps1 -Name $Name first." }
+$readiness = Get-Content -LiteralPath $readinessPath -Raw | ConvertFrom-Json
+if (-not $readiness.ready) { throw "Readiness has $(@($readiness.blockers).Count) blocker(s). Fix them and re-run Test-PortReadiness.ps1 before publishing." }
+$live = @()
+if ($readiness.PSObject.Properties.Name -contains 'branchesWithGithubWorkflows') { $live = @($readiness.branchesWithGithubWorkflows) }
+if ($live.Count -gt 0 -and -not $AllowWorkflowRuns) {
+    throw "Branch(es) $($live -join ', ') contain .github/workflows. The push will RUN them on GitHub (deploy jobs included). Read them, then re-run with -AllowWorkflowRuns - or remove/disable them in the source first."
+}
+
+# The stage must still hold exactly what Get-PortSource recorded. Anything else (a stray fetch,
+# a hand edit, a second tool) would be pushed and then "verified" against itself.
+$nowRefs = @(Invoke-PortGit @('-C', $mirror, 'for-each-ref', '--format=%(refname:short) %(objectname)', 'refs/heads', 'refs/tags') | Sort-Object)
+$wasRefs = @(@($manifest.heads) + @($manifest.tags) | Where-Object { $_ } | Sort-Object)
+$drift = @(Compare-Object $wasRefs $nowRefs)
+$extra = @(Invoke-PortGit @('-C', $mirror, 'for-each-ref', '--format=%(refname)') | Where-Object { $_ -and $_ -notlike 'refs/heads/*' -and $_ -notlike 'refs/tags/*' })
+if ($drift.Count -gt 0 -or $extra.Count -gt 0) {
+    $d = @($drift | ForEach-Object { "$($_.SideIndicator) $($_.InputObject)" }) + @($extra | ForEach-Object { "extra $_" })
+    throw "The staged mirror no longer matches manifest.json (=> added, <= missing):`n  $($d -join "`n  ")`nRe-run Get-PortSource.ps1 -Force to rebuild the stage."
+}
+
+if (-not $Owner) { $Owner = Get-PortConfigValue $config 'owner' $null }
+if (-not $Owner) { throw 'No -Owner and no "owner" in the config file.' }
+if (-not $Repo) { $Repo = $Name }
+if (-not $Visibility) { $Visibility = Get-PortConfigValue $config 'visibility' 'private' }
+$full = "$Owner/$Repo"
+$url = "https://github.com/$full.git"
+
+# ---- 1. Who am I, and can I see the owner -------------------------------------------------------
+$login = (& gh api user --jq .login 2>&1)
+if ($LASTEXITCODE -ne 0) { throw "gh is not signed in: $login. Run gh auth login." }
+Write-PortStep "Signed in to GitHub as $login; target $full ($Visibility)"
+
+# ---- 2. Does the repo exist? -----------------------------------------------------------------------
+$exists = $false
+$null = & gh api "repos/$full" --jq .full_name 2>$null
+if ($LASTEXITCODE -eq 0) { $exists = $true }
+$global:LASTEXITCODE = 0
+
+if ($exists) {
+    $remoteRefs = @(Invoke-PortGit @('ls-remote', '--heads', $url))
+    if ($remoteRefs.Count -eq 0 -or -not ($remoteRefs -join '')) {
+        Write-PortStep "$full exists and is empty. Using it."
+    }
+    else {
+        if (-not $AllowExisting) {
+            throw "$full already exists and has $($remoteRefs.Count) branch(es). Check it shares history with the source (see SKILL.md, 'An existing repo'), then re-run with -AllowExisting, or delete it and re-run."
+        }
+        Write-PortStep "$full exists with history. Checking every GitHub branch is an ancestor of the staged branch."
+        # --no-tags: without it git auto-follows the OTHER repo's tags into the stage, and the
+        # next push would publish them. Found by the dogfood run, 2026-09-19.
+        Invoke-PortGit @('-C', $mirror, 'fetch', '-q', '--no-tags', $url, '+refs/heads/*:refs/port-check/*') | Out-Null
+        try {
+            foreach ($line in $remoteRefs) {
+                $sha, $ref = $line -split "`t", 2
+                $b = $ref.Substring(11)
+                $local = Invoke-PortGit -AllowFailure @('-C', $mirror, 'rev-parse', '--verify', '-q', "refs/heads/$b")
+                if ($local.ExitCode -ne 0) { continue }   # branch only on GitHub: left alone
+                $anc = Invoke-PortGit -AllowFailure @('-C', $mirror, 'merge-base', '--is-ancestor', $sha, ($local.Output -join ''))
+                if ($anc.ExitCode -ne 0) {
+                    throw "GitHub branch '$b' ($($sha.Substring(0,12))) is NOT an ancestor of the staged '$b'. The histories are unrelated or diverged. Refusing: resolve this by hand."
+                }
+            }
+        }
+        finally {
+            foreach ($r in @(Invoke-PortGit @('-C', $mirror, 'for-each-ref', '--format=%(refname)', 'refs/port-check'))) {
+                if ($r) { Invoke-PortGit @('-C', $mirror, 'update-ref', '-d', $r) | Out-Null }
+            }
+        }
+        Write-PortOk 'Every GitHub branch is an ancestor. The push is a fast-forward.'
+    }
+}
+else {
+    if ($PSCmdlet.ShouldProcess($full, "Create $Visibility GitHub repository")) {
+        $createArgs = @('repo', 'create', $full, "--$Visibility", '--disable-wiki')
+        if ($Description) { $createArgs += @('--description', $Description) }
+        $out = & gh @createArgs 2>&1
+        if ($LASTEXITCODE -ne 0) { throw "gh repo create failed: $out" }
+        Write-PortOk "Created $full"
+    }
+    else { Write-Host "WhatIf: would create $full"; return }
+}
+
+# ---- 3. Push -------------------------------------------------------------------------------------------
+if ($PSCmdlet.ShouldProcess($full, 'Push refs/heads/* and refs/tags/*')) {
+    Write-PortStep "Pushing branches and tags to $full"
+    # --no-verify is NOT used: no hooks exist in a fresh bare mirror anyway.
+    Invoke-PortGit @('-C', $mirror, 'push', '--porcelain', $url, 'refs/heads/*:refs/heads/*', 'refs/tags/*:refs/tags/*') | Out-Null
+}
+else { Write-Host "WhatIf: would push to $url"; return }
+
+# ---- 4. Default branch ---------------------------------------------------------------------------------
+$def = $manifest.defaultBranch
+$cur = (& gh api "repos/$full" --jq .default_branch 2>$null)
+if ($cur -ne $def) {
+    & gh api -X PATCH "repos/$full" -f "default_branch=$def" --silent 2>&1 | Out-Null
+    if ($LASTEXITCODE -ne 0) { Write-PortWarn "Could not set the default branch to $def. Set it by hand." }
+}
+
+# ---- 5. Prove it by SHA ---------------------------------------------------------------------------------
+Write-PortStep 'Verifying every branch and tag by SHA'
+$mode = if ($exists) { 'LeftInRight' } else { 'Equal' }
+& (Join-Path $PSScriptRoot 'Compare-PortRefs.ps1') -Left $mirror -Right $url -Mode $mode -LeftLabel 'staged' -RightLabel 'github'
+$verified = ($LASTEXITCODE -eq 0)
+
+$manifest | Add-Member -NotePropertyName github -NotePropertyValue ([pscustomobject]@{
+        repo = $full; url = $url; pushedAt = (Get-Date).ToString('o'); pushedBy = $login; verified = $verified; defaultBranch = $def
+    }) -Force
+$manifest.status = if ($verified) { 'published' } else { 'publish-unverified' }
+ConvertTo-PortJsonFile $manifest $manifestPath
+
+if (-not $verified) { Write-PortFail "Push finished but refs do not match. Do NOT continue to CI or cutover."; exit 1 }
+Write-PortOk "Published $full - https://github.com/$full"
+exit 0

package/bundles/codex/.codex/skills/devops/port-to-github/scripts/Switch-CheckoutOrigin.ps1

@@ -0,0 +1,182 @@
+<#
+.SYNOPSIS
+  Repoint an existing checkout (a deploy target, a dev box) from its old origin to GitHub,
+  prove it still agrees with GitHub, and roll back by itself if it does not.
+
+.DESCRIPTION
+  Works on a local path, or on a remote box over WinRM (-ComputerName).
+
+  -Mode Inspect   print origin, branch, HEAD, dirty count. Changes nothing.
+  -Mode Switch    record the old URL in a local state file, keep it as a second remote
+                  (-KeepOldAs), set origin to -NewUrl, fetch, and require HEAD to be contained
+                  in some origin/* branch. On ANY failure the old URL is restored at once.
+  -Mode Rollback  put the old URL back from the state file and remove the remote Switch added.
+
+  A deploy host usually holds NO GitHub credential of its own: CI supplies one per run.
+  -VerifyWithGhToken passes your current gh token to that ONE fetch as an HTTP header in the
+  process environment. It is never written to disk or to git config, and it is gone when the
+  command ends. Without it, a private repo fetch on such a host fails and the switch rolls back.
+
+  If the old URL embedded a credential (user:secret@host), the state file stores it WITHOUT
+  the credential and says so. Rotate that credential.
+#>
+[CmdletBinding(SupportsShouldProcess)]
+param(
+    [Parameter(Mandatory)][string]$Path,
+    [string]$ComputerName,
+    [pscredential]$Credential,
+    [ValidateSet('Inspect', 'Switch', 'Rollback')][string]$Mode = 'Inspect',
+    [string]$NewUrl,
+    [string]$KeepOldAs,
+    [string]$StateFile,
+    [string]$StagingRoot,
+    [string]$ConfigPath,
+    [switch]$VerifyWithGhToken
+)
+
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'PortCommon.ps1')
+$config = Get-PortConfig $ConfigPath
+if (-not $KeepOldAs) { $KeepOldAs = Get-PortConfigValue $config 'oldRemoteName' 'old-origin' }
+
+$where = if ($ComputerName) { $ComputerName } else { $env:COMPUTERNAME }
+if (-not $StateFile) {
+    $dir = Join-Path (Get-PortStagingRoot $config $StagingRoot) 'cutover'
+    New-Item -ItemType Directory -Force -Path $dir | Out-Null
+    $safe = ($Path -replace '[:\\/ ]+', '_').Trim('_')
+    $StateFile = Join-Path $dir "$where-$safe.json"
+}
+
+# One script block, run locally or remotely. Windows PowerShell 5.1 compatible. Native stderr
+# must not become a terminating error, so git runs under 'Continue' and is judged by exit code.
+$block = {
+    param($P, $M, $New, $KeepAs, $OldUrl, $RestoreUrl, $AddedRemote, $Token)
+    $ErrorActionPreference = 'Continue'
+    function G { $o = & git -c safe.directory=* -C $P @args 2>&1; $c = $LASTEXITCODE; return @{ code = $c; out = @($o | ForEach-Object { "$_" }) } }
+    $r = @{ ok = $false; origin = $null; branch = $null; head = $null; dirty = 0; remotes = @(); message = $null; addedRemote = $false; rolledBack = $false }
+    if (-not (Test-Path -LiteralPath $P)) { $r.message = "Path not found: $P"; return $r }
+    $o = G remote get-url origin
+    if ($o.code -ne 0) { $r.message = "No origin remote in $P"; return $r }
+    $r.origin = ($o.out -join '')
+    $b = G symbolic-ref --short HEAD; if ($b.code -eq 0) { $r.branch = ($b.out -join '') }
+    $hd = G rev-parse --verify -q HEAD
+    if ($hd.code -ne 0 -or -not ($hd.out -join '')) { $r.message = "$P has no commit at HEAD (empty or unborn repository)"; return $r }
+    $r.head = ($hd.out -join '')
+    $r.dirty = @((G status --porcelain).out | Where-Object { $_ }).Count
+    $r.remotes = @((G remote).out)
+
+    if ($M -eq 'Inspect') { $r.ok = $true; return $r }
+
+    if ($M -eq 'Rollback') {
+        $s = G remote set-url origin $OldUrl
+        if ($s.code -ne 0) { $r.message = "set-url failed: $($s.out -join ' ')"; return $r }
+        if ($AddedRemote -and ($r.remotes -contains $KeepAs)) { G remote remove $KeepAs | Out-Null }
+        $r.origin = $OldUrl; $r.ok = $true; $r.message = 'rolled back'; return $r
+    }
+
+    # Switch
+    if ($r.origin -eq $New) { $r.ok = $true; $r.message = 'origin already points at the new URL'; return $r }
+    if (-not ($r.remotes -contains $KeepAs)) {
+        $a = G remote add $KeepAs $OldUrl
+        if ($a.code -ne 0) { $r.message = "could not add remote ${KeepAs}: $($a.out -join ' ')"; return $r }
+        $r.addedRemote = $true
+    }
+    $s = G remote set-url origin $New
+    if ($s.code -ne 0) { $r.message = "set-url failed: $($s.out -join ' ')"; return $r }
+
+    # From here origin points at the new URL. ANY failure, including an exception, must restore it.
+    $fail = $null
+    $env:GIT_TERMINAL_PROMPT = '0'
+    try {
+        if ($Token) {
+            $env:GIT_CONFIG_COUNT = '1'
+            $env:GIT_CONFIG_KEY_0 = 'http.https://github.com/.extraheader'
+            $env:GIT_CONFIG_VALUE_0 = 'AUTHORIZATION: basic ' + [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("x-access-token:$Token"))
+        }
+        $f = G fetch -q origin
+        $contained = @()
+        if ($f.code -eq 0) { $contained = @((G for-each-ref --contains HEAD --format='%(refname)' refs/remotes/origin).out | Where-Object { $_ }) }
+        if ($f.code -ne 0) { $fail = "fetch from the new origin failed (exit $($f.code)): $(($f.out | Select-Object -First 3) -join ' ')" }
+        elseif ($contained.Count -eq 0) { $fail = "HEAD $($r.head.Substring(0,12)) is not contained in any origin/* branch: this checkout has commits GitHub does not" }
+    }
+    catch { $fail = "verification threw: $($_.Exception.Message)" }
+    finally {
+        Remove-Item Env:GIT_CONFIG_COUNT, Env:GIT_CONFIG_KEY_0, Env:GIT_CONFIG_VALUE_0 -ErrorAction SilentlyContinue
+    }
+    if ($fail) {
+        G remote set-url origin $RestoreUrl | Out-Null
+        if ($r.addedRemote) { G remote remove $KeepAs | Out-Null; $r.addedRemote = $false }
+        $r.rolledBack = $true; $r.message = $fail; return $r
+    }
+    $r.origin = $New; $r.ok = $true; $r.message = "HEAD is contained in: $($contained -join ', ')"; return $r
+}
+
+function Invoke-Block($ArgList) {
+    if ($ComputerName) {
+        $sa = @{ ComputerName = $ComputerName; ScriptBlock = $block; ArgumentList = $ArgList }
+        if ($Credential) { $sa.Credential = $Credential }
+        return Invoke-Command @sa
+    }
+    return & $block @ArgList
+}
+
+# Always inspect first.
+$now = Invoke-Block @($Path, 'Inspect', $null, $KeepOldAs, $null, $null, $false, $null)
+if (-not $now.ok) { throw "[$where] $($now.message)" }
+$clean = Remove-UrlCredential $now.origin
+Write-Host ("[{0}] {1}`n    origin : {2}`n    branch : {3}   HEAD {4}   uncommitted: {5}   remotes: {6}" -f $where, $Path, $clean.Url, $now.branch, $now.head.Substring(0, 12), $now.dirty, ($now.remotes -join ', '))
+if ($clean.HadCredential) { Write-PortWarn 'The current origin URL EMBEDS A CREDENTIAL. It is shown without it. Rotate that credential after the cutover.' }
+if ($Mode -eq 'Inspect') { exit 0 }
+
+if ($Mode -eq 'Switch') {
+    if (-not $NewUrl) { throw '-NewUrl is required for -Mode Switch.' }
+    if ($now.dirty -gt 0) { Write-PortWarn "The checkout has $($now.dirty) uncommitted change(s). A deploy that resets the tree will discard them. Look before you continue." }
+    if (-not $PSCmdlet.ShouldProcess("$where $Path", "Set origin to $NewUrl")) { exit 0 }
+    $token = $null
+    if ($VerifyWithGhToken) {
+        $token = (& gh auth token 2>$null)
+        if ($LASTEXITCODE -ne 0 -or -not $token) { throw 'gh auth token returned nothing. Sign in with gh auth login, or drop -VerifyWithGhToken.' }
+    }
+    # Record the rollback BEFORE changing anything.
+    $state = [ordered]@{
+        computer = $where; path = $Path; oldUrl = $clean.Url; oldUrlHadCredential = $clean.HadCredential
+        newUrl = $NewUrl; keepOldAs = $KeepOldAs; addedRemote = $false; switchedAt = (Get-Date).ToString('o'); headAtSwitch = $now.head
+    }
+    ConvertTo-PortJsonFile $state $StateFile
+    # The second remote gets the credential-free URL. On failure the ORIGINAL value is restored.
+    try {
+        $res = Invoke-Block @($Path, 'Switch', $NewUrl, $KeepOldAs, $clean.Url, $now.origin, $false, $token)
+    }
+    catch {
+        # The call itself failed (e.g. the WinRM transport dropped). The remote side may or may
+        # not have changed origin. Put the ORIGINAL value back; leave the kept remote for a human.
+        $token = $null
+        Write-PortFail "[$where] Switch call failed: $($_.Exception.Message). Restoring the original origin."
+        try { $null = Invoke-Block @($Path, 'Rollback', $null, $KeepOldAs, $now.origin, $null, $false, $null) } catch { Write-PortFail "[$where] Restore ALSO failed. Set origin back by hand to the URL in $StateFile." }
+        exit 1
+    }
+    $token = $null
+    if (-not $res.ok) {
+        if ($res.rolledBack) { Write-PortFail "[$where] Switch failed and was ROLLED BACK: $($res.message)" }
+        else { Write-PortFail "[$where] Switch failed: $($res.message)" }
+        Remove-Item -LiteralPath $StateFile -ErrorAction SilentlyContinue
+        exit 1
+    }
+    $state.addedRemote = [bool]$res.addedRemote
+    ConvertTo-PortJsonFile $state $StateFile
+    Write-PortOk "[$where] origin -> $NewUrl. $($res.message)"
+    Write-Host "    old origin kept as remote '$KeepOldAs'. Rollback: $($MyInvocation.MyCommand.Name) -Path '$Path'$(if ($ComputerName) { " -ComputerName $ComputerName" }) -Mode Rollback"
+    Write-Host "    state: $StateFile"
+    exit 0
+}
+
+if ($Mode -eq 'Rollback') {
+    if (-not (Test-Path -LiteralPath $StateFile)) { throw "No state file at $StateFile. Pass -StateFile." }
+    $state = Get-Content -LiteralPath $StateFile -Raw | ConvertFrom-Json
+    if (-not $PSCmdlet.ShouldProcess("$where $Path", "Set origin back to $($state.oldUrl)")) { exit 0 }
+    $res = Invoke-Block @($Path, 'Rollback', $null, $state.keepOldAs, $state.oldUrl, $null, [bool]$state.addedRemote, $null)
+    if (-not $res.ok) { Write-PortFail "[$where] Rollback failed: $($res.message)"; exit 1 }
+    if ($state.oldUrlHadCredential) { Write-PortWarn 'The old URL had an embedded credential. It was restored WITHOUT it; the credential helper must supply one.' }
+    Write-PortOk "[$where] origin restored to $($state.oldUrl)"
+    exit 0
+}

package/bundles/codex/.codex/skills/devops/port-to-github/scripts/Test-PortReadiness.ps1

@@ -0,0 +1,218 @@
+<#
+.SYNOPSIS
+  Inspect a staged repository and list what will break or leak when it moves to GitHub.
+
+.DESCRIPTION
+  Reads <staging>\<Name>\mirror.git (written by Get-PortSource.ps1). Changes nothing.
+  Writes <staging>\<Name>\readiness.json and prints a report.
+
+  BLOCKERS (exit 1): a file over 100 MB anywhere in history, Git LFS content, a workflow
+  containing an empty expression, a likely live credential in the current tree.
+  WARNINGS: everything a human must decide: CI credentials, dependency hosts, runner labels,
+  hardcoded references to the old host, secret-looking files in past history.
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)][string]$Name,
+    [string]$StagingRoot,
+    [string]$ConfigPath
+)
+
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'PortCommon.ps1')
+
+$config = Get-PortConfig $ConfigPath
+$stage = Join-Path (Get-PortStagingRoot $config $StagingRoot) $Name
+$mirror = Join-Path $stage 'mirror.git'
+if (-not (Test-Path -LiteralPath $mirror)) { throw "No staged mirror at $mirror. Run Get-PortSource.ps1 first." }
+$manifest = Get-Content -LiteralPath (Join-Path $stage 'manifest.json') -Raw | ConvertFrom-Json
+$branch = $manifest.defaultBranch
+
+$blockers = New-Object System.Collections.Generic.List[string]
+$warnings = New-Object System.Collections.Generic.List[string]
+$report = [ordered]@{ name = $Name; defaultBranch = $branch; checkedAt = (Get-Date).ToString('o') }
+
+function MGit([string[]]$a) { Invoke-PortGit (@('-C', $mirror) + $a) }
+function MGitTry([string[]]$a) { Invoke-PortGit -AllowFailure (@('-C', $mirror) + $a) }
+
+# ---- 1. Size: GitHub refuses any blob over 100 MB, in ANY commit, not just the tip ----------
+Write-PortStep 'Checking object sizes across all history'
+$big = @()
+foreach ($line in (MGit @('cat-file', '--batch-all-objects', '--batch-check=%(objecttype) %(objectsize) %(objectname)'))) {
+    $t, $s, $o = $line -split ' '
+    if ($t -eq 'blob' -and [int64]$s -gt 50MB) { $big += [pscustomobject]@{ sha = $o; bytes = [int64]$s } }
+}
+if ($big.Count -gt 0) {
+    $paths = @{}
+    foreach ($l in (MGit @('rev-list', '--objects', '--all'))) {
+        $sha, $p = $l -split ' ', 2
+        if ($p -and ($big.sha -contains $sha)) { $paths[$sha] = $p }
+    }
+    foreach ($b in $big) {
+        $p = $paths[$b.sha]
+        $mb = [math]::Round($b.bytes / 1MB, 1)
+        if ($b.bytes -gt 100MB) { $blockers.Add("File over 100 MB in history: $p ($mb MB). GitHub rejects the push. Rewrite history (git filter-repo) or move it to LFS/releases first.") }
+        else { $warnings.Add("Large file in history: $p ($mb MB). GitHub warns above 50 MB.") }
+    }
+}
+$report.largeBlobs = $big.Count
+
+# ---- 2. LFS ---------------------------------------------------------------------------------
+$attrs = MGitTry @('show', "${branch}:.gitattributes")
+if ($attrs.ExitCode -eq 0 -and (($attrs.Output -join "`n") -match 'filter=lfs')) {
+    $blockers.Add('The repository uses Git LFS. LFS objects are not in a git mirror; push them separately (git lfs fetch --all from the source, git lfs push --all to GitHub) before declaring the port done.')
+}
+
+# ---- 3. Secrets ---------------------------------------------------------------------------------
+Write-PortStep 'Scanning for credentials'
+$liveSecretPatterns = @('gh[pousr]_[A-Za-z0-9]{36,}', 'github_pat_[A-Za-z0-9_]{40,}', 'AKIA[0-9A-Z]{16}', '-----BEGIN [A-Z ]*PRIVATE KEY-----', 'xox[baprs]-[A-Za-z0-9-]{10,}')
+$grepArgs = @('grep', '-I', '-l', '-E')
+$liveHits = @()
+foreach ($p in $liveSecretPatterns) {
+    $g = MGitTry ($grepArgs + @('-e', $p, $branch))
+    if ($g.ExitCode -eq 0) { $liveHits += $g.Output }
+}
+foreach ($h in ($liveHits | Sort-Object -Unique)) { $blockers.Add("Likely live credential in the current tree: $h. Remove it and ROTATE it; history still holds it.") }
+
+# The same patterns across ALL history. A token committed once and deleted later is gone from
+# the tip but still readable by anyone who can clone the new repo. -G matches commits whose
+# diff adds or removes a matching line (extended regex).
+$histPattern = $liveSecretPatterns -join '|'
+$histOut = @(MGit @('log', '--all', "-G$histPattern", '--format=@@%h', '--name-only'))
+$cur = $null
+$histHits = @{}
+foreach ($l in $histOut) {
+    if (-not $l) { continue }
+    if ($l.StartsWith('@@')) { $cur = $l.Substring(2); continue }
+    if (-not $histHits.ContainsKey($l)) { $histHits[$l] = @() }
+    $histHits[$l] += $cur
+}
+foreach ($file in ($histHits.Keys | Sort-Object)) {
+    $tipName = "${branch}:$file"
+    if ($liveHits -contains $tipName) { continue }   # already reported as a current-tree blocker
+    $blockers.Add("Likely credential in PAST history: $file (commit(s) $(($histHits[$file] | Select-Object -Unique) -join ', ')). It is gone from the tip but ships with the history. ROTATE it, then either accept that or rewrite history (git filter-repo) before publishing.")
+}
+$report.historySecretFiles = @($histHits.Keys)
+
+$pwHits = MGitTry @('grep', '-I', '-l', '-i', '-E', '-e', '(password|passwd|pwd|api[_-]?key|secret)[[:space:]]*[:=][[:space:]]*[''"][^''" ]{8,}[''"]', $branch)
+if ($pwHits.ExitCode -eq 0) {
+    foreach ($h in $pwHits.Output) { $warnings.Add("Possible hardcoded password or key: $h. Check it is a placeholder or test value.") }
+}
+
+$treeFiles = @(MGit @('ls-tree', '-r', '--name-only', $branch))
+foreach ($f in $treeFiles) {
+    if (Test-PortSecretName (Split-Path $f -Leaf)) { $warnings.Add("Secret-type file tracked in the current tree: $f. Check it holds no real value.") }
+}
+$histNames = @(MGit @('log', '--all', '--format=', '--name-only') | Where-Object { $_ } | Sort-Object -Unique)
+$histSecret = @($histNames | Where-Object { (Test-PortSecretName (Split-Path $_ -Leaf)) -and ($treeFiles -notcontains $_) })
+foreach ($f in $histSecret) { $warnings.Add("Secret-type file existed in PAST history: $f. It will be public to anyone who can read the new repo. Rotate what it held, or rewrite history first.") }
+
+# ---- 4. CI ----------------------------------------------------------------------------------
+Write-PortStep 'Inventorying CI'
+$ciFiles = @($treeFiles | Where-Object {
+        $_ -match '^\.(gitea|github|forgejo)/workflows/[^/]+\.ya?ml$' -or
+        $_ -in @('.gitlab-ci.yml', 'Jenkinsfile', 'azure-pipelines.yml', 'bitbucket-pipelines.yml', '.drone.yml', '.woodpecker.yml')
+    })
+$report.ciFiles = $ciFiles
+$workflows = @()
+foreach ($f in $ciFiles) {
+    $text = (MGit @('show', "${branch}:$f")) -join "`n"
+    $lines = $text -split "`n"
+    $wf = [ordered]@{ file = $f; emptyExpressions = @(); credentialLines = @(); runsOn = @(); hosts = @(); dispatchOnly = $false }
+    for ($i = 0; $i -lt $lines.Count; $i++) {
+        $ln = $lines[$i]
+        if ($ln -match '\$\{\{\s*\}\}') { $wf.emptyExpressions += ($i + 1) }
+        if ($ln -match 'secrets\.|github\.token|(?i)token\s*:|_TOKEN\b|_USER\b|PASSWORD') { $wf.credentialLines += ("{0}: {1}" -f ($i + 1), $ln.Trim()) }
+        if ($ln -match '^\s*runs-on:\s*(.+)$') { $wf.runsOn += $Matches[1].Trim() }
+        foreach ($m in [regex]::Matches($ln, 'https?://([A-Za-z0-9.-]+(:\d+)?)')) { $wf.hosts += $m.Groups[1].Value }
+    }
+    $wf.runsOn = @($wf.runsOn | Sort-Object -Unique)
+    $wf.hosts = @($wf.hosts | Where-Object { $_ -notmatch '^(github\.com|api\.github\.com|localhost|127\.0\.0\.1)' } | Sort-Object -Unique)
+    if ($text -match '(?m)^on:\s*(\[\s*)?workflow_dispatch' -and $text -notmatch '(?m)^\s+(push|pull_request)\s*:') { $wf.dispatchOnly = $true }
+    if ($wf.emptyExpressions.Count -gt 0) {
+        $msg = "$f has an empty `${{ }} on line(s) $($wf.emptyExpressions -join ', '). GitHub rejects the WHOLE file (startup_failure, zero jobs), even inside a comment in a run: block."
+        # GitHub parses only .github/workflows. A .gitea/.forgejo file is inert on GitHub until
+        # phase 4 copies it, so it is a warning here and a blocker there.
+        if ($f -like '.github/*') { $blockers.Add($msg) } else { $warnings.Add("$msg Fix it when translating (phase 4).") }
+    }
+    if ($wf.dispatchOnly) { $warnings.Add("$f triggers only on workflow_dispatch. If this is a FROZEN copy, generate the GitHub workflow from the last live version in history instead.") }
+    if ($wf.hosts.Count -gt 0) { $warnings.Add("$f references non-GitHub host(s): $($wf.hosts -join ', '). Each needs a credential that works FROM GitHub's runners, or the step breaks.") }
+    $workflows += [pscustomobject]$wf
+}
+$report.workflows = $workflows
+# Workflows already under .github/workflows RUN on GitHub the moment their branch is pushed.
+# Check every branch, not only the default one: a push of any branch fires its own workflows.
+$liveOnPush = @()
+foreach ($h in @(MGit @('for-each-ref', '--format=%(refname:short)', 'refs/heads'))) {
+    $ls = MGitTry @('ls-tree', '--name-only', "${h}:.github/workflows")
+    if ($ls.ExitCode -eq 0 -and ($ls.Output -join '')) { $liveOnPush += $h }
+}
+$report.branchesWithGithubWorkflows = $liveOnPush
+if ($liveOnPush.Count -gt 0) {
+    $warnings.Add("$($liveOnPush.Count) branch(es) already contain .github/workflows ($($liveOnPush -join ', ')). Publishing PUSHES them, which fires every push-triggered workflow - including any deploy job. Publish refuses unless you pass -AllowWorkflowRuns after reading those workflows.")
+}
+
+$otherCi = @($ciFiles | Where-Object { $_ -notmatch '^\.(gitea|github|forgejo)/workflows/' })
+if ($otherCi.Count -gt 0) {
+    $warnings.Add("Non-Actions CI found ($($otherCi -join ', ')). It will not run on GitHub; it must be rewritten as a GitHub Actions workflow.")
+}
+if ($ciFiles.Count -eq 0) { $warnings.Add('No CI found. After the port nothing builds, tests or deploys this app automatically.') }
+
+# ---- 5. Dependencies that live on another host --------------------------------------------------
+Write-PortStep 'Checking dependency pins'
+$depHosts = @()
+foreach ($f in ($treeFiles | Where-Object { $_ -match '(^|/)(pyproject\.toml|requirements[^/]*\.txt|setup\.cfg|package\.json|\.npmrc|\.pypirc|pip\.conf|go\.mod|Cargo\.toml)$' })) {
+    $text = (MGit @('show', "${branch}:$f")) -join "`n"
+    foreach ($m in [regex]::Matches($text, '(git\+)?(https?|ssh)://(?:[^@/\s]+@)?([A-Za-z0-9.-]+(:\d+)?)/')) {
+        $h = $m.Groups[3].Value
+        if ($h -match '^(pypi\.org|files\.pythonhosted\.org|registry\.npmjs\.org|github\.com)$') {
+            if ($h -eq 'github.com' -and $m.Groups[1].Value) { $depHosts += [pscustomobject]@{ file = $f; host = $h } }
+            continue
+        }
+        $depHosts += [pscustomobject]@{ file = $f; host = $h }
+    }
+    if ($text -match '(?m)^\s*registry\s*=') { $warnings.Add("$f sets a custom package registry. CI on GitHub needs a credential for it, or the install fails.") }
+}
+$report.dependencyHosts = $depHosts
+foreach ($h in ($depHosts | Group-Object host)) {
+    $warnings.Add("Dependencies pinned from $($h.Name) in: $((($h.Group.file) | Sort-Object -Unique) -join ', '). CI and every deploy host need a read credential for THAT host, chosen per host.")
+}
+
+# ---- 6. References to the old host --------------------------------------------------------------
+$oldHost = $null
+if ($manifest.sourceKind -eq 'url') {
+    if ($manifest.source -match '^[a-z]+://(?:[^@/]+@)?(?<h>[^/:]+)') { $oldHost = $Matches.h }
+    elseif ($manifest.source -match '^[^@\s]+@(?<h>[^:\s]+):') { $oldHost = $Matches.h }   # scp form: git@host:org/repo.git
+}
+if ($oldHost) {
+    $ref = MGitTry @('grep', '-I', '-l', '-F', '-e', $oldHost, $branch)
+    if ($ref.ExitCode -eq 0) {
+        $files = @($ref.Output | ForEach-Object { $_ -replace "^${branch}:", '' })
+        $report.oldHostReferences = $files
+        $warnings.Add("$($files.Count) file(s) still name the old host $oldHost ($($files[0..([math]::Min(4, $files.Count - 1))] -join ', ')$(if ($files.Count -gt 5) { ', ...' })). Decide per file: a dependency pin (keep, needs a credential) or an origin reference (change).")
+    }
+}
+
+# ---- 7. Carry forward what the source step found -----------------------------------------------
+foreach ($w in $manifest.warnings) { $warnings.Add($w) }
+
+$report.blockers = @($blockers)
+$report.warnings = @($warnings)
+$report.ready = ($blockers.Count -eq 0)
+ConvertTo-PortJsonFile $report (Join-Path $stage 'readiness.json')
+
+Write-Host ''
+Write-Host "Readiness for $Name (branch $branch): $($blockers.Count) blocker(s), $($warnings.Count) warning(s)"
+foreach ($b in $blockers) { Write-PortFail $b }
+foreach ($w in $warnings) { Write-PortWarn $w }
+foreach ($wf in $workflows) {
+    if ($wf.credentialLines.Count -gt 0) {
+        Write-Host ''
+        Write-Host "Credential lines in $($wf.file) - classify EACH as ORIGIN (becomes github.token) or DEPENDENCY (keeps a token for that host):"
+        $wf.credentialLines | ForEach-Object { Write-Host "    $_" }
+    }
+    if ($wf.runsOn.Count -gt 0) { Write-Host "Runner labels in $($wf.file): $($wf.runsOn -join ' | ') - confirm GitHub has runners with these labels." }
+}
+Write-Host "    report: $(Join-Path $stage 'readiness.json')"
+if ($blockers.Count -gt 0) { exit 1 }
+exit 0

package/bundles/codex/.codex/skills/devops/port-to-github/scripts/Test-PortWorkflowParses.ps1

@@ -0,0 +1,62 @@
+<#
+.SYNOPSIS
+  After pushing a feature branch, prove GitHub could PARSE its workflows.
+
+.DESCRIPTION
+  GitHub cannot evaluate the triggers of a workflow file it cannot parse, so an invalid file
+  produces a failed run with ZERO jobs ("startup_failure") on every push, even on a branch its
+  triggers would never match. A valid file whose triggers do not match produces no run at all.
+
+  So, for the pushed commit:
+    a run with conclusion startup_failure, or failure with zero jobs  -> INVALID (exit 1)
+    no run, or runs with real jobs                                     -> parsed (exit 0)
+
+  Waits -WaitSeconds for GitHub to react, because an invalid file's run appears within seconds
+  and "no run" is only meaningful after that window.
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)][string]$Owner,
+    [Parameter(Mandatory)][string]$Repo,
+    [Parameter(Mandatory)][string]$Branch,
+    [string]$Sha,
+    [int]$WaitSeconds = 60
+)
+
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'PortCommon.ps1')
+$full = "$Owner/$Repo"
+
+if (-not $Sha) {
+    $Sha = (& gh api "repos/$full/commits/$Branch" --jq .sha 2>&1)
+    if ($LASTEXITCODE -ne 0) { throw "Branch $Branch not found on ${full}: $Sha" }
+}
+Write-PortStep "Watching $full @ $($Sha.Substring(0,12)) on $Branch for $WaitSeconds s"
+
+$deadline = (Get-Date).AddSeconds($WaitSeconds)
+$invalid = @()
+$runs = @()
+do {
+    Start-Sleep -Seconds 10
+    $json = & gh api "repos/$full/actions/runs?head_sha=$Sha&per_page=50" 2>&1
+    if ($LASTEXITCODE -ne 0) { throw "Cannot list runs: $json" }
+    $runs = @(($json | ConvertFrom-Json).workflow_runs)
+    $invalid = @()
+    foreach ($r in $runs) {
+        if ($r.conclusion -eq 'startup_failure') { $invalid += $r; continue }
+        if ($r.status -eq 'completed' -and $r.conclusion -eq 'failure') {
+            $jobs = (& gh api "repos/$full/actions/runs/$($r.id)/jobs" --jq .total_count 2>$null)
+            if ("$jobs" -eq '0') { $invalid += $r }
+        }
+    }
+    if ($invalid.Count -gt 0) { break }
+} while ((Get-Date) -lt $deadline)
+
+if ($invalid.Count -gt 0) {
+    foreach ($r in $invalid) { Write-PortFail "INVALID workflow: '$($r.name)' ($($r.path)) - $($r.html_url)" }
+    Write-Host '    GitHub gives no line number. Look first for an empty ${{ }}; then bisect by removing jobs from the END (removing a middle job breaks needs: and fails the same way).'
+    exit 1
+}
+if ($runs.Count -eq 0) { Write-PortOk "No run for this commit: every workflow parsed and none matched a branch push. This is the expected result for main-only triggers." }
+else { foreach ($r in $runs) { Write-PortOk "Run '$($r.name)' has real jobs ($($r.status)/$($r.conclusion)): the file parsed. $($r.html_url)" } }
+exit 0

package/bundles/manifest.json

@@ -1,8 +1,8 @@
 {
-  "poolVersion": "1.3.110",
+  "poolVersion": "1.3.112",
   "bundles": {
-    "antigravity-plugin": "1.3.110",
-    "antigravity-plugin-extras": "1.3.29",
+    "antigravity-plugin": "1.3.112",
+    "antigravity-plugin-extras": "1.3.31",
     "codex": "unknown"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caddis/cli",
-  "version": "0.4.18",
+  "version": "0.4.20",
   "description": "Install, update and diagnose the caddis dev harness across every coding agent you use (Claude Code, agy/Antigravity, and more).",
   "keywords": [
     "caddis",