@coldic3/slipway 1.0.0

package/dist/slipway.mjs

@@ -0,0 +1,1928 @@
+#!/usr/bin/env node
+import { createRequire as __slipwayRequire } from 'node:module'; const require = __slipwayRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/env.ts
+function slipwayEnv(name, env = process.env) {
+  return env[`SLIPWAY_${name}`] || void 0;
+}
+var init_env = __esm({
+  "src/env.ts"() {
+    "use strict";
+  }
+});
+
+// src/util/exec.ts
+import { spawn } from "node:child_process";
+function run(cmd, args, opts = {}) {
+  return new Promise((resolve2) => {
+    const child = spawn(cmd, args, {
+      cwd: opts.cwd,
+      env: opts.env ?? process.env,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    let timer;
+    if (opts.timeoutMs) {
+      timer = setTimeout(() => {
+        stderr += `
+[slipway] timed out after ${opts.timeoutMs} ms`;
+        child.kill("SIGKILL");
+      }, opts.timeoutMs);
+    }
+    child.stdout.on("data", (d) => stdout += d);
+    child.stderr.on("data", (d) => stderr += d);
+    child.on("error", (err) => {
+      if (timer) clearTimeout(timer);
+      resolve2({ code: err.code === "ENOENT" ? 127 : 1, stdout, stderr: stderr + String(err.message) });
+    });
+    child.on("close", (code) => {
+      if (timer) clearTimeout(timer);
+      resolve2({ code: code ?? 1, stdout, stderr });
+    });
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(opts.input ?? "");
+  });
+}
+async function runOk(cmd, args, opts = {}) {
+  const r = await run(cmd, args, opts);
+  if (r.code !== 0) throw new ExecError(`${cmd} ${args.join(" ")}`, r);
+  return r;
+}
+async function git(cwd, args, env) {
+  const r = await runOk("git", args, { cwd, env: env ?? process.env });
+  return r.stdout.trim();
+}
+var ExecError;
+var init_exec = __esm({
+  "src/util/exec.ts"() {
+    "use strict";
+    ExecError = class extends Error {
+      constructor(cmd, result) {
+        super(`Command failed (exit ${result.code}): ${cmd}
+${result.stderr || result.stdout}`.trim());
+        this.cmd = cmd;
+        this.result = result;
+      }
+      cmd;
+      result;
+    };
+  }
+});
+
+// src/config.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+function slipwayHome() {
+  return slipwayEnv("HOME") || join(homedir(), ".slipway");
+}
+function configPath() {
+  return join(slipwayHome(), "config.json");
+}
+function loadConfig() {
+  const p = configPath();
+  if (!existsSync(p)) {
+    throw new Error(`Slipway is not configured (${p} missing). Run "slipway init" first.`);
+  }
+  return JSON.parse(readFileSync(p, "utf8"));
+}
+function saveConfig(config) {
+  mkdirSync(slipwayHome(), { recursive: true, mode: 448 });
+  const p = configPath();
+  writeFileSync(p, JSON.stringify(config, null, 2) + "\n", { mode: 384 });
+  chmodSync(p, 384);
+}
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    init_env();
+  }
+});
+
+// src/util/git-auth.ts
+function basicAuthArgs(user, token) {
+  const b64 = Buffer.from(`${user}:${token}`).toString("base64");
+  return ["-c", `http.extraHeader=Authorization: Basic ${b64}`];
+}
+function bearerAuthArgs(urlPrefix, token) {
+  const b64 = Buffer.from(`x-access-token:${token}`).toString("base64");
+  return ["-c", `http.${urlPrefix}.extraHeader=Authorization: Basic ${b64}`];
+}
+function parseGitHubRemote(url) {
+  const m = /github\.com[:/]([^/]+)\/([^/]+?)(?:\.git)?\/?$/.exec(url.trim());
+  return m ? `${m[1]}/${m[2]}` : null;
+}
+var init_git_auth = __esm({
+  "src/util/git-auth.ts"() {
+    "use strict";
+  }
+});
+
+// src/gitea/client.ts
+var GiteaError, GiteaClient;
+var init_client = __esm({
+  "src/gitea/client.ts"() {
+    "use strict";
+    GiteaError = class extends Error {
+      constructor(status2, method, path, body) {
+        super(`Gitea API ${method} ${path} failed: ${status2} ${body.slice(0, 500)}`);
+        this.status = status2;
+        this.method = method;
+        this.path = path;
+        this.body = body;
+      }
+      status;
+      method;
+      path;
+      body;
+    };
+    GiteaClient = class {
+      constructor(baseUrl, auth, fetchImpl = fetch) {
+        this.baseUrl = baseUrl;
+        this.auth = auth;
+        this.fetchImpl = fetchImpl;
+      }
+      baseUrl;
+      auth;
+      fetchImpl;
+      async req(method, path, body, accept = "application/json") {
+        const headers = { accept, "content-type": "application/json" };
+        if (typeof this.auth === "string") headers.authorization = `token ${this.auth}`;
+        else headers.authorization = "Basic " + Buffer.from(this.auth.basic.join(":")).toString("base64");
+        const res = await this.fetchImpl(this.baseUrl.replace(/\/$/, "") + "/api/v1" + path, {
+          method,
+          headers,
+          body: body === void 0 ? void 0 : JSON.stringify(body)
+        });
+        const text = await res.text();
+        if (!res.ok) throw new GiteaError(res.status, method, path, text);
+        if (accept !== "application/json") return text;
+        return text ? JSON.parse(text) : void 0;
+      }
+      /** Fetches all pages of a list endpoint. */
+      async all(path) {
+        const out = [];
+        const sep = path.includes("?") ? "&" : "?";
+        for (let page = 1; page < 100; page++) {
+          const items = await this.req("GET", `${path}${sep}limit=50&page=${page}`);
+          out.push(...items);
+          if (items.length < 50) break;
+        }
+        return out;
+      }
+      version() {
+        return this.req("GET", "/version");
+      }
+      // ---- users & tokens -------------------------------------------------------
+      async createToken(username, name, scopes) {
+        try {
+          await this.req("DELETE", `/users/${username}/tokens/${encodeURIComponent(name)}`);
+        } catch (e) {
+          if (!(e instanceof GiteaError && e.status === 404)) throw e;
+        }
+        const t = await this.req("POST", `/users/${username}/tokens`, { name, scopes });
+        return t.sha1;
+      }
+      // ---- repos ------------------------------------------------------------------
+      createRepo(name, description = "") {
+        return this.req("POST", "/user/repos", { name, description, private: true, auto_init: false, default_branch: "main" });
+      }
+      getRepo(owner, repo) {
+        return this.req("GET", `/repos/${owner}/${repo}`);
+      }
+      editRepo(owner, repo, opts) {
+        return this.req("PATCH", `/repos/${owner}/${repo}`, opts);
+      }
+      addCollaborator(owner, repo, user, permission) {
+        return this.req("PUT", `/repos/${owner}/${repo}/collaborators/${user}`, { permission });
+      }
+      listBranchProtections(owner, repo) {
+        return this.req("GET", `/repos/${owner}/${repo}/branch_protections`);
+      }
+      createBranchProtection(owner, repo, opts) {
+        return this.req("POST", `/repos/${owner}/${repo}/branch_protections`, opts);
+      }
+      editBranchProtection(owner, repo, name, opts) {
+        return this.req("PATCH", `/repos/${owner}/${repo}/branch_protections/${encodeURIComponent(name)}`, opts);
+      }
+      // ---- pulls --------------------------------------------------------------------
+      getPull(owner, repo, idx) {
+        return this.req("GET", `/repos/${owner}/${repo}/pulls/${idx}`);
+      }
+      listPulls(owner, repo, state = "open") {
+        return this.all(`/repos/${owner}/${repo}/pulls?state=${state}`);
+      }
+      createPull(owner, repo, opts) {
+        return this.req("POST", `/repos/${owner}/${repo}/pulls`, opts);
+      }
+      editPull(owner, repo, idx, opts) {
+        return this.req("PATCH", `/repos/${owner}/${repo}/pulls/${idx}`, opts);
+      }
+      closePull(owner, repo, idx) {
+        return this.editPull(owner, repo, idx, { state: "closed" });
+      }
+      mergePull(owner, repo, idx, style = "merge") {
+        return this.req("POST", `/repos/${owner}/${repo}/pulls/${idx}/merge`, { Do: style });
+      }
+      pullDiff(owner, repo, idx) {
+        return this.req("GET", `/repos/${owner}/${repo}/pulls/${idx}.diff`, void 0, "text/plain");
+      }
+      listReviews(owner, repo, idx) {
+        return this.all(`/repos/${owner}/${repo}/pulls/${idx}/reviews`);
+      }
+      listReviewComments(owner, repo, idx, reviewId) {
+        return this.req("GET", `/repos/${owner}/${repo}/pulls/${idx}/reviews/${reviewId}/comments`);
+      }
+      createReview(owner, repo, idx, opts) {
+        return this.req("POST", `/repos/${owner}/${repo}/pulls/${idx}/reviews`, opts);
+      }
+      replyToComment(owner, repo, idx, commentId, body) {
+        return this.req("POST", `/repos/${owner}/${repo}/pulls/${idx}/comments/${commentId}/replies`, { body });
+      }
+      resolveComment(owner, repo, commentId) {
+        return this.req("POST", `/repos/${owner}/${repo}/pulls/comments/${commentId}/resolve`);
+      }
+      /** All review comments (with review metadata), oldest review first. */
+      async allReviewComments(owner, repo, idx) {
+        const reviews = await this.listReviews(owner, repo, idx);
+        const out = [];
+        for (const review of reviews) {
+          for (const comment of await this.listReviewComments(owner, repo, idx, review.id)) out.push({ review, comment });
+        }
+        return out;
+      }
+      /**
+       * Feedback the agent still has to address: inline threads with no resolver (a thread = path+line,
+       * resolved if any comment in it is resolved), from non-dismissed reviews, not written by the agent.
+       * The body of the latest non-dismissed "request changes" review is returned first as a general item (id 0).
+       */
+      async unresolvedComments(owner, repo, idx, agentLogin) {
+        const reviews = await this.listReviews(owner, repo, idx);
+        const live = reviews.filter((r) => !r.dismissed);
+        const all = [];
+        for (const review of reviews) {
+          for (const comment of await this.listReviewComments(owner, repo, idx, review.id)) all.push({ review, comment });
+        }
+        const key = (c) => `${c.path}:${c.position || c.original_position}`;
+        const resolved = new Set(all.filter(({ comment }) => comment.resolver).map(({ comment }) => key(comment)));
+        const out = [];
+        const lastRejected = [...live].reverse().find((r) => r.state === "REQUEST_CHANGES" && r.user?.login !== agentLogin);
+        if (lastRejected?.body?.trim()) {
+          out.push({ id: 0, path: "", line: 0, body: lastRejected.body.trim(), author: lastRejected.user?.login ?? "", diffHunk: "" });
+        }
+        for (const { review, comment } of all) {
+          if (review.dismissed || comment.resolver || comment.user.login === agentLogin || resolved.has(key(comment))) continue;
+          out.push({
+            id: comment.id,
+            path: comment.path,
+            line: comment.position || comment.original_position,
+            body: comment.body,
+            author: comment.user.login,
+            diffHunk: comment.diff_hunk ?? ""
+          });
+        }
+        return out;
+      }
+      // ---- issues/comments/labels ---------------------------------------------------
+      comment(owner, repo, idx, body) {
+        return this.req("POST", `/repos/${owner}/${repo}/issues/${idx}/comments`, { body });
+      }
+      listComments(owner, repo, idx) {
+        return this.all(`/repos/${owner}/${repo}/issues/${idx}/comments`);
+      }
+      /** Admin: create a user (requires the owner/admin token). */
+      adminCreateUser(opts) {
+        return this.req("POST", "/admin/users", { ...opts, must_change_password: false, send_notify: false });
+      }
+      adminEditUser(username, opts) {
+        return this.req("PATCH", `/admin/users/${username}`, { ...opts, login_name: username, source_id: 0, must_change_password: false });
+      }
+      createOrg(name) {
+        return this.req("POST", "/orgs", { username: name, visibility: "private", repo_admin_change_team_access: false });
+      }
+      listTeams(org) {
+        return this.req("GET", `/orgs/${org}/teams`);
+      }
+      createTeam(org, name) {
+        return this.req("POST", `/orgs/${org}/teams`, {
+          name,
+          description: "Slipway reviewers: write access to every review repo, no repo admin",
+          permission: "write",
+          units_map: { "repo.code": "write", "repo.pulls": "write" },
+          includes_all_repositories: true,
+          can_create_org_repo: false
+        });
+      }
+      addTeamMember(teamId, username) {
+        return this.req("PUT", `/teams/${teamId}/members/${username}`);
+      }
+      createOrgRepo(org, name, description = "") {
+        return this.req("POST", `/orgs/${org}/repos`, { name, description, private: true, auto_init: false, default_branch: "main" });
+      }
+      /** Moves a repo (with its PRs, reviews and comments) to another owner. As site admin the transfer is immediate. */
+      transferRepo(owner, repo, newOwner) {
+        return this.req("POST", `/repos/${owner}/${repo}/transfer`, { new_owner: newOwner });
+      }
+    };
+  }
+});
+
+// src/runtime/downloads.ts
+import { createHash } from "node:crypto";
+import { chmodSync as chmodSync2, createWriteStream, existsSync as existsSync4, mkdirSync as mkdirSync5, mkdtempSync, renameSync, rmSync as rmSync2 } from "node:fs";
+import { join as join6 } from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { Transform } from "node:stream";
+function giteaUrl(suffix) {
+  return `https://dl.gitea.com/gitea/${GITEA_VERSION}/gitea-${GITEA_VERSION}-${suffix}`;
+}
+function gitleaksUrl(suffix) {
+  return `https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_${suffix}.tar.gz`;
+}
+function platform(os = process.platform, arch = process.arch) {
+  const key = `${os}-${arch}`;
+  if (key in GITEA) return key;
+  throw new Error(`Slipway runs on macOS and Linux (x64, arm64); this machine is ${os}/${arch}`);
+}
+function giteaArtifact(p = platform()) {
+  return GITEA[p];
+}
+function gitleaksArtifact(p = platform()) {
+  return GITLEAKS[p];
+}
+function binDir() {
+  return slipwayEnv("BIN_DIR") || join6(slipwayHome(), "bin");
+}
+async function download(a, dest, fetchImpl = fetch) {
+  const res = await fetchImpl(a.url);
+  if (!res.ok || !res.body) throw new Error(`download failed: ${a.url} (HTTP ${res.status})`);
+  const part = `${dest}.part`;
+  const hash = createHash("sha256");
+  const tap = new Transform({ transform(chunk, _enc, cb) {
+    hash.update(chunk);
+    cb(null, chunk);
+  } });
+  try {
+    await pipeline(Readable.fromWeb(res.body), tap, createWriteStream(part, { mode: 493 }));
+    const got = hash.digest("hex");
+    if (got !== a.sha256) throw new Error(`checksum mismatch for ${a.url}: expected ${a.sha256}, got ${got}`);
+    renameSync(part, dest);
+  } finally {
+    rmSync2(part, { force: true });
+  }
+}
+async function ensureGitea(log, fetchImpl = fetch) {
+  const dest = giteaBinPath();
+  if (existsSync4(dest)) return dest;
+  mkdirSync5(binDir(), { recursive: true });
+  log(`downloading Gitea ${GITEA_VERSION} (about 110 MB, once)\u2026`);
+  await download(giteaArtifact(), dest, fetchImpl);
+  chmodSync2(dest, 493);
+  return dest;
+}
+async function ensureGitleaks(log, fetchImpl = fetch) {
+  if ((await run("gitleaks", ["version"])).code === 0) return "gitleaks";
+  const dest = gitleaksBinPath();
+  if (existsSync4(dest)) return dest;
+  mkdirSync5(binDir(), { recursive: true });
+  log(`downloading gitleaks ${GITLEAKS_VERSION} (secret scanner, once)\u2026`);
+  const tmp = mkdtempSync(join6(binDir(), ".gitleaks-"));
+  try {
+    const tgz = join6(tmp, "gitleaks.tar.gz");
+    await download(gitleaksArtifact(), tgz, fetchImpl);
+    await runOk("tar", ["-xzf", tgz, "-C", tmp, "gitleaks"]);
+    chmodSync2(join6(tmp, "gitleaks"), 493);
+    renameSync(join6(tmp, "gitleaks"), dest);
+  } finally {
+    rmSync2(tmp, { recursive: true, force: true });
+  }
+  return dest;
+}
+var GITEA_VERSION, GITLEAKS_VERSION, GITEA, GITLEAKS, giteaBinPath, gitleaksBinPath;
+var init_downloads = __esm({
+  "src/runtime/downloads.ts"() {
+    "use strict";
+    init_config();
+    init_env();
+    init_exec();
+    GITEA_VERSION = "28.3.0";
+    GITLEAKS_VERSION = "8.30.1";
+    GITEA = {
+      "darwin-arm64": { url: giteaUrl("darwin-arm64"), sha256: "0aca8f1f1d6a0b31abc2c7e5c40feec18f3e45ab0c7b11deaef259794ce45812" },
+      "darwin-x64": { url: giteaUrl("darwin-amd64"), sha256: "4420bb44df8047cd4f3bec9162d559c0245dee7ef3b58bc5540d7a1eefd8b94f" },
+      "linux-arm64": { url: giteaUrl("linux-arm64"), sha256: "24d146e8f5c986b86e5a3311e3ec349ded35202cba056952ab5b585511ace82d" },
+      "linux-x64": { url: giteaUrl("linux-amd64"), sha256: "5f834e8f04986f3b9206cf14743b5a6e6996ceddc238dac6409866ebda2a0686" }
+    };
+    GITLEAKS = {
+      "darwin-arm64": { url: gitleaksUrl("darwin_arm64"), sha256: "b40ab0ae55c505963e365f271a8d3846efbc170aa17f2607f13df610a9aeb6a5" },
+      "darwin-x64": { url: gitleaksUrl("darwin_x64"), sha256: "dfe101a4db2255fc85120ac7f3d25e4342c3c20cf749f2c20a18081af1952709" },
+      "linux-arm64": { url: gitleaksUrl("linux_arm64"), sha256: "e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080" },
+      "linux-x64": { url: gitleaksUrl("linux_x64"), sha256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb" }
+    };
+    giteaBinPath = () => join6(binDir(), `gitea-${GITEA_VERSION}`);
+    gitleaksBinPath = () => join6(binDir(), `gitleaks-${GITLEAKS_VERSION}`);
+  }
+});
+
+// src/github/client.ts
+var GitHubClient;
+var init_client2 = __esm({
+  "src/github/client.ts"() {
+    "use strict";
+    GitHubClient = class {
+      constructor(apiBase, token) {
+        this.apiBase = apiBase;
+        this.token = token;
+      }
+      apiBase;
+      token;
+      async req(method, path, body) {
+        const res = await fetch(this.apiBase.replace(/\/$/, "") + path, {
+          method,
+          headers: {
+            authorization: `Bearer ${this.token}`,
+            accept: "application/vnd.github+json",
+            "x-github-api-version": "2022-11-28",
+            "content-type": "application/json",
+            "user-agent": "slipway"
+          },
+          body: body === void 0 ? void 0 : JSON.stringify(body)
+        });
+        const text = await res.text();
+        if (!res.ok) throw new Error(`GitHub API ${method} ${path} failed: ${res.status} ${text.slice(0, 500)}`);
+        return text ? JSON.parse(text) : void 0;
+      }
+      /** Creates the PR or, if an open PR for the same head exists, updates its title/body/base. */
+      async upsertPull(input) {
+        const [owner] = input.repo.split("/");
+        const q = new URLSearchParams({ head: `${owner}:${input.head}`, state: "open" });
+        const existing = await this.req("GET", `/repos/${input.repo}/pulls?${q}`);
+        if (existing.length > 0) {
+          const pr2 = existing[0];
+          await this.req("PATCH", `/repos/${input.repo}/pulls/${pr2.number}`, { title: input.title, body: input.body, base: input.base });
+          return { number: pr2.number, html_url: pr2.html_url, updated: true };
+        }
+        const pr = await this.req("POST", `/repos/${input.repo}/pulls`, {
+          head: input.head,
+          base: input.base,
+          title: input.title,
+          body: input.body,
+          draft: input.draft,
+          maintainer_can_modify: true
+        });
+        return { number: pr.number, html_url: pr.html_url, updated: false };
+      }
+    };
+  }
+});
+
+// src/util/lease-refs.ts
+function leaseRef(kind, branch) {
+  return `refs/slipway/${kind}/${branch}`;
+}
+async function readLease(repoDir, ref, env) {
+  const res = await run("git", ["rev-parse", "-q", "--verify", ref], { cwd: repoDir, env });
+  return res.code === 0 ? res.stdout.trim() : "";
+}
+async function writeLease(repoDir, ref, sha, env) {
+  await git(repoDir, ["update-ref", ref, sha], env);
+}
+var init_lease_refs = __esm({
+  "src/util/lease-refs.ts"() {
+    "use strict";
+    init_exec();
+  }
+});
+
+// src/promote/git.ts
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync5 } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join8 } from "node:path";
+function hardenedGitEnv(env) {
+  const forced = [
+    ["core.hooksPath", "/dev/null"],
+    ["core.fsmonitor", "false"],
+    ["commit.gpgsign", "false"]
+  ];
+  const n = Number(env.GIT_CONFIG_COUNT || 0);
+  const out = { ...env, GIT_CONFIG_COUNT: String(n + forced.length) };
+  forced.forEach(([k, v], i) => {
+    out[`GIT_CONFIG_KEY_${n + i}`] = k;
+    out[`GIT_CONFIG_VALUE_${n + i}`] = v;
+  });
+  return out;
+}
+async function prepareBranch(o) {
+  const env = hardenedGitEnv(o.env ?? process.env);
+  const promoteRef = `refs/slipway/promote/${o.branch}`;
+  const upstream = `refs/remotes/origin/${o.base}`;
+  await git(o.repoDir, [...o.originAuthArgs ?? [], "fetch", "--quiet", "origin", `+refs/heads/${o.base}:${upstream}`], env);
+  await git(o.repoDir, [...o.reviewAuthArgs, "-c", "credential.helper=", "fetch", "--quiet", o.reviewUrl, `+refs/heads/${o.branch}:${promoteRef}`], env);
+  const fetchedHead = await git(o.repoDir, ["rev-parse", promoteRef], env);
+  const baseSha = await git(o.repoDir, ["rev-parse", upstream], env);
+  const behindBy = Number(await git(o.repoDir, ["rev-list", "--count", `${fetchedHead}..${baseSha}`], env));
+  if (behindBy > 0) {
+    await run("git", ["update-ref", "-d", promoteRef], { cwd: o.repoDir, env });
+    return { ok: false, behindBy };
+  }
+  const worktree = mkdtempSync2(join8(tmpdir(), "slipway-promote-"));
+  rmSync5(worktree, { recursive: true });
+  await git(o.repoDir, ["worktree", "add", "--quiet", "--detach", worktree, fetchedHead], env);
+  const cleanup = async () => {
+    await run("git", ["worktree", "remove", "--force", worktree], { cwd: o.repoDir, env });
+    rmSync5(worktree, { recursive: true, force: true });
+    await run("git", ["worktree", "prune"], { cwd: o.repoDir, env });
+    await run("git", ["update-ref", "-d", promoteRef], { cwd: o.repoDir, env });
+  };
+  return { ok: true, worktree, head: fetchedHead, baseSha, fetchedHead, cleanup };
+}
+async function pushToOrigin(o) {
+  const env = hardenedGitEnv(o.env ?? process.env);
+  const recordRef = leaseRef("promoted", o.branch);
+  const githubRef = `refs/slipway/github/${o.branch}`;
+  const recorded = await readLease(o.repoDir, recordRef, env);
+  await run("git", ["update-ref", "-d", githubRef], { cwd: o.repoDir, env });
+  await run("git", [...o.authArgs, "fetch", "--quiet", "origin", `+refs/heads/${o.branch}:${githubRef}`], { cwd: o.repoDir, env });
+  const seen = await run("git", ["rev-parse", "-q", "--verify", githubRef], { cwd: o.repoDir, env });
+  const remote = seen.code === 0 ? seen.stdout.trim() : "";
+  let expected = "";
+  if (remote && remote !== recorded) {
+    const contained = await run("git", ["merge-base", "--is-ancestor", remote, o.reviewedHead], { cwd: o.repoDir, env });
+    if (contained.code !== 0) {
+      throw new PushRejectedError(
+        `The GitHub branch ${o.branch} has commits that are not in the Slipway PR (GitHub is at ${remote.slice(0, 8)}). Bring them into the Slipway branch (e.g. rebase onto origin/${o.branch}), push and get it re-approved, or delete the GitHub branch; then promote again.`
+      );
+    }
+    expected = remote;
+  } else if (remote) {
+    expected = recorded;
+  }
+  const push = await run("git", [...o.authArgs, "push", "--quiet", `--force-with-lease=refs/heads/${o.branch}:${expected}`, "origin", `HEAD:refs/heads/${o.branch}`], { cwd: o.worktree, env });
+  if (push.code !== 0) {
+    if (/stale info|rejected/.test(push.stderr)) {
+      throw new PushRejectedError(`The GitHub branch ${o.branch} changed while promoting. Promote again.`);
+    }
+    throw new Error(`git push to GitHub failed: ${push.stderr.trim().split("\n").slice(-3).join(" ")}`);
+  }
+  await writeLease(o.repoDir, recordRef, await git(o.worktree, ["rev-parse", "HEAD"], env), env);
+}
+var PushRejectedError;
+var init_git = __esm({
+  "src/promote/git.ts"() {
+    "use strict";
+    init_exec();
+    init_lease_refs();
+    PushRejectedError = class extends Error {
+    };
+  }
+});
+
+// src/core/approval.ts
+function isApprovedByOwner(reviews, owner, headSha) {
+  const verdicts = reviews.filter((r) => r.user?.login === owner && !r.dismissed && (r.state === "APPROVED" || r.state === "REQUEST_CHANGES"));
+  const last = verdicts.at(-1);
+  return !!last && last.state === "APPROVED" && (!last.commit_id || last.commit_id === headSha);
+}
+var init_approval = __esm({
+  "src/core/approval.ts"() {
+    "use strict";
+  }
+});
+
+// src/promote/secrets.ts
+import { existsSync as existsSync8 } from "node:fs";
+async function localGitleaks(runner = defaultRunner2, downloaded = gitleaksBinPath()) {
+  if ((await runner("gitleaks", ["version"])).code !== 127) return "gitleaks";
+  return existsSync8(downloaded) ? downloaded : void 0;
+}
+async function scanSecrets(repoDir, range, runner = defaultRunner2, downloaded) {
+  const common = ["git", "--no-banner", "--redact", "--exit-code", "1", "--report-format", "json", "--report-path", "-", "--log-opts", range];
+  const local = await localGitleaks(runner, downloaded);
+  let r = local ? await runner(local, [...common, repoDir]) : { code: 127, stdout: "", stderr: "" };
+  if (r.code === 127) {
+    r = await runner("docker", [
+      "run",
+      "--rm",
+      "-v",
+      `${repoDir}:/repo:ro`,
+      "-e",
+      "GIT_CONFIG_COUNT=1",
+      "-e",
+      "GIT_CONFIG_KEY_0=safe.directory",
+      "-e",
+      "GIT_CONFIG_VALUE_0=*",
+      GITLEAKS_IMAGE,
+      ...common,
+      "/repo"
+    ]);
+    if (r.code === 127 || r.code !== 0 && r.code !== 1 && /Cannot connect|not found|docker daemon/i.test(r.stderr)) {
+      return { ok: false, findings: [], error: "gitleaks is not available (run slipway up to download it, install gitleaks, or start Docker); promotion is blocked" };
+    }
+  }
+  if (r.code !== 0 && r.code !== 1) return { ok: false, findings: [], error: `gitleaks failed (exit ${r.code}): ${r.stderr.slice(-500)}` };
+  let raw = [];
+  try {
+    raw = r.stdout.trim() ? JSON.parse(r.stdout) : [];
+  } catch {
+    return { ok: false, findings: [], error: `could not parse gitleaks output: ${r.stdout.slice(0, 200)}` };
+  }
+  const findings = raw.map((f) => ({ rule: f.RuleID, file: f.File, line: f.StartLine, commit: f.Commit }));
+  if (r.code === 1 && findings.length === 0) return { ok: false, findings, error: "gitleaks reported leaks but no findings were parsed" };
+  return { ok: findings.length === 0, findings };
+}
+var GITLEAKS_IMAGE, defaultRunner2;
+var init_secrets = __esm({
+  "src/promote/secrets.ts"() {
+    "use strict";
+    init_downloads();
+    init_exec();
+    GITLEAKS_IMAGE = "zricethezav/gitleaks:v8.30.1";
+    defaultRunner2 = (cmd, args) => run(cmd, args, { timeoutMs: 5 * 6e4 });
+  }
+});
+
+// src/promote/promote.ts
+async function promote(o, d) {
+  const fail = (code, message) => {
+    d.log(message);
+    return { code, message };
+  };
+  if (!d.githubToken) return fail(EXIT.ERROR, "No GitHub token: log in with `gh auth login` (or set SLIPWAY_GITHUB_TOKEN)");
+  const entry = d.config.repos[o.repo];
+  if (!entry) return fail(EXIT.ERROR, `Unknown repo "${o.repo}"`);
+  const owner = d.config.org;
+  const approver = d.config.reviewer.username;
+  const pr = await d.gitea.getPull(owner, o.repo, o.pr);
+  if (pr.state !== "open") return fail(EXIT.ERROR, `PR #${o.pr} is ${pr.state}; only open PRs can be promoted`);
+  const approved = isApprovedByOwner(await d.gitea.listReviews(owner, o.repo, o.pr), approver, pr.head.sha);
+  if (!approved && !o.force) {
+    return fail(EXIT.NOT_APPROVED, `PR #${o.pr} is not approved by ${approver} at its current head. Approve it in Gitea.`);
+  }
+  const base = o.base ?? entry.base;
+  const branch = pr.head.ref;
+  d.log(`preparing ${branch} (exact promotion onto origin/${base})`);
+  const originAuthArgs = await d.originAuth(entry.path);
+  const prep = await d.prepare({
+    repoDir: entry.path,
+    reviewUrl: `${d.config.giteaUrl.replace(/\/$/, "")}/${owner}/${o.repo}.git`,
+    reviewAuthArgs: basicAuthArgs(d.actor.username, d.actor.token),
+    originAuthArgs,
+    branch,
+    base
+  });
+  if (!prep.ok) {
+    await d.gitea.comment(
+      owner,
+      o.repo,
+      o.pr,
+      `\u26A0\uFE0F Promotion blocked: the branch is ${prep.behindBy} commit(s) behind \`origin/${base}\`. Slipway promotes exactly what was reviewed, so rebase the branch onto \`origin/${base}\` in Slipway (resolving conflicts), push it, and approve it again.`
+    );
+    return fail(EXIT.CONFLICT, `branch is ${prep.behindBy} commit(s) behind origin/${base}: rebase it in Slipway, push, and approve again`);
+  }
+  try {
+    if (prep.fetchedHead !== pr.head.sha && !o.force) {
+      return fail(EXIT.NOT_APPROVED, `PR #${o.pr} changed after its approval check (${pr.head.sha.slice(0, 8)} \u2192 ${prep.fetchedHead.slice(0, 8)}); review the new commits and approve again.`);
+    }
+    const scan = await d.scan(entry.path, `${prep.baseSha}..${prep.head}`);
+    if (!scan.ok) {
+      const list = scan.findings.map((f) => `- \`${f.rule}\` in \`${f.file}:${f.line}\` (commit ${f.commit.slice(0, 8)})`).join("\n");
+      await d.gitea.comment(owner, o.repo, o.pr, scan.error ? `\u26A0\uFE0F Promotion blocked: the secret scan could not run (${scan.error}).` : `\u26A0\uFE0F Promotion blocked: gitleaks found possible secrets:
+
+${list}
+
+Remove them from the history (not just the latest commit) and rotate the credentials.`);
+      return fail(EXIT.SECRETS, scan.error ?? `secret scan found ${scan.findings.length} issue(s)`);
+    }
+    if (o.testCmd) {
+      d.log(`running tests: ${o.testCmd}`);
+      const t = await d.runTests(o.testCmd, prep.worktree);
+      if (t.code !== 0) {
+        const tail2 = (t.stdout + "\n" + t.stderr).trim().split("\n").slice(-40).join("\n");
+        await d.gitea.comment(owner, o.repo, o.pr, `\u26A0\uFE0F Promotion blocked: \`${o.testCmd}\` failed (exit ${t.code}).
+
+\`\`\`
+${tail2}
+\`\`\``);
+        return fail(EXIT.TESTS, `tests failed (exit ${t.code})`);
+      }
+    }
+    const fresh = await d.gitea.getPull(owner, o.repo, o.pr);
+    d.log(`pushing ${branch} to origin`);
+    try {
+      await d.push({ repoDir: entry.path, worktree: prep.worktree, branch, reviewedHead: prep.fetchedHead, authArgs: originAuthArgs });
+    } catch (e) {
+      if (!(e instanceof PushRejectedError)) throw e;
+      await d.gitea.comment(owner, o.repo, o.pr, `\u26A0\uFE0F Promotion blocked: ${e.message}`);
+      return fail(EXIT.ERROR, e.message);
+    }
+    const gh = await d.github.upsertPull({ repo: entry.github, head: branch, base, title: fresh.title, body: fresh.body ?? "", draft: o.draft });
+    await d.gitea.comment(owner, o.repo, o.pr, `\u{1F6A2} Promoted to GitHub: ${gh.html_url}`);
+    await d.gitea.closePull(owner, o.repo, o.pr);
+    d.log(`promoted \u2192 ${gh.html_url}`);
+    return { code: EXIT.OK, url: gh.html_url };
+  } finally {
+    await prep.cleanup();
+  }
+}
+async function githubOriginAuth(repoDir, token) {
+  const url = (await run("git", ["remote", "get-url", "origin"], { cwd: repoDir })).stdout.trim();
+  const m = /^(https:\/\/[^/]+\/)/.exec(url);
+  return m && token ? bearerAuthArgs(m[1], token) : [];
+}
+function runShell(cmd, cwd) {
+  return run("sh", ["-c", cmd], { cwd, timeoutMs: 30 * 6e4 });
+}
+var EXIT;
+var init_promote = __esm({
+  "src/promote/promote.ts"() {
+    "use strict";
+    init_approval();
+    init_exec();
+    init_git_auth();
+    init_git();
+    init_secrets();
+    EXIT = { OK: 0, ERROR: 1, CONFLICT: 2, SECRETS: 3, TESTS: 4, NOT_APPROVED: 5 };
+  }
+});
+
+// src/promote/github-token.ts
+async function githubToken(runner = (c, a) => run(c, a, { timeoutMs: 15e3 })) {
+  const env = slipwayEnv("GITHUB_TOKEN");
+  if (env) return env;
+  const r = await runner("gh", ["auth", "token"]);
+  if (r.code === 127) throw new Error("The GitHub CLI (gh) is not installed. Install it and run: gh auth login");
+  const token = r.stdout.trim();
+  if (r.code !== 0 || !token) throw new Error("The GitHub CLI is not logged in. Run: gh auth login");
+  return token;
+}
+var init_github_token = __esm({
+  "src/promote/github-token.ts"() {
+    "use strict";
+    init_env();
+    init_exec();
+  }
+});
+
+// src/promote/cli.ts
+var cli_exports = {};
+__export(cli_exports, {
+  defaultPromoteDeps: () => defaultPromoteDeps,
+  githubApiBase: () => githubApiBase,
+  parsePromoteFlags: () => parsePromoteFlags,
+  runPromoteCli: () => runPromoteCli
+});
+import { parseArgs } from "node:util";
+function githubApiBase() {
+  return slipwayEnv("GITHUB_API") || "https://api.github.com";
+}
+function defaultPromoteDeps(log, token, actor) {
+  const config = loadConfig();
+  const who = actor ?? config.admin;
+  return {
+    config,
+    githubToken: token,
+    actor: who,
+    gitea: new GiteaClient(config.giteaUrl, who.token),
+    github: new GitHubClient(githubApiBase(), token),
+    prepare: prepareBranch,
+    push: pushToOrigin,
+    scan: (dir, range) => scanSecrets(dir, range),
+    runTests: runShell,
+    originAuth: (dir) => githubOriginAuth(dir, token),
+    log
+  };
+}
+function parsePromoteFlags(args) {
+  const { values, positionals } = parseArgs({
+    args,
+    allowPositionals: true,
+    options: {
+      draft: { type: "boolean" },
+      base: { type: "string" },
+      "test-cmd": { type: "string" },
+      force: { type: "boolean" }
+    }
+  });
+  return {
+    positionals,
+    draft: !!values.draft,
+    base: values.base,
+    testCmd: values["test-cmd"] ?? slipwayEnv("TEST_CMD") ?? void 0,
+    force: !!values.force
+  };
+}
+async function runPromoteCli(args, log) {
+  const { positionals, ...flags } = parsePromoteFlags(args);
+  const [repo, prStr] = positionals;
+  const pr = Number(prStr);
+  if (!repo || !Number.isInteger(pr)) throw new Error("usage: slipway promote <repo> <pr-number> [flags]");
+  let token = "";
+  try {
+    token = await githubToken();
+  } catch (e) {
+    log(e.message);
+    return 1;
+  }
+  const r = await promote({ repo, pr, ...flags }, defaultPromoteDeps(log, token));
+  if (r.code === 5) log("(to promote anyway, add --force)");
+  if (r.url) console.log(r.url);
+  return r.code;
+}
+var init_cli = __esm({
+  "src/promote/cli.ts"() {
+    "use strict";
+    init_env();
+    init_config();
+    init_client();
+    init_client2();
+    init_git();
+    init_promote();
+    init_github_token();
+    init_secrets();
+  }
+});
+
+// src/cli.ts
+import { realpathSync } from "node:fs";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { parseArgs as parseArgs2 } from "node:util";
+
+// src/init.ts
+import { createInterface } from "node:readline/promises";
+
+// src/agents/index.ts
+init_env();
+init_exec();
+var defaultRunner = (cmd, args) => run(cmd, args, { timeoutMs: 3e5 });
+var GITHUB_REPO = "coldic3/slipway";
+function marketplaceSource() {
+  return slipwayEnv("MARKETPLACE") || GITHUB_REPO;
+}
+var isRemote = (source) => /^[\w.-]+\/[\w.-]+$/.test(source) || /^(https?|git@)/.test(source);
+var already = (r) => /already/i.test(r.stdout + r.stderr);
+var claudeCode = {
+  id: "claude-code",
+  label: "Claude Code",
+  async install(log, runner = defaultRunner) {
+    const source = marketplaceSource();
+    const manual = [`/plugin marketplace add ${source}`, "/plugin install slipway@slipway"];
+    if ((await runner("claude", ["--version"])).code !== 0) return { done: false, manual };
+    log(`adding the Slipway plugin marketplace (${source})`);
+    const add = await runner("claude", ["plugin", "marketplace", "add", source, ...isRemote(source) ? ["--sparse", ".claude-plugin", "plugin"] : []]);
+    if (add.code !== 0) {
+      if (!already(add)) return { done: false, manual: [`(claude plugin marketplace add failed: ${(add.stderr || add.stdout).trim()})`, ...manual] };
+      await runner("claude", ["plugin", "marketplace", "update", "slipway"]);
+    }
+    log("installing the plugin slipway@slipway");
+    const inst = await runner("claude", ["plugin", "install", "slipway@slipway"]);
+    if (inst.code !== 0) {
+      if (!already(inst)) return { done: false, manual: [`(claude plugin install failed: ${(inst.stderr || inst.stdout).trim()})`, ...manual.slice(1)] };
+      await runner("claude", ["plugin", "update", "slipway@slipway"]);
+    }
+    return { done: true };
+  }
+};
+var AGENTS = [claudeCode];
+
+// src/instance.ts
+init_config();
+init_env();
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
+var RUNTIMES = ["native", "docker"];
+var DEFAULT_PORT = 3514;
+function instancePath() {
+  return join2(slipwayHome(), "instance.json");
+}
+function loadInstance() {
+  const p = instancePath();
+  if (!existsSync2(p)) return void 0;
+  return JSON.parse(readFileSync2(p, "utf8"));
+}
+function saveInstance(i) {
+  mkdirSync2(slipwayHome(), { recursive: true, mode: 448 });
+  writeFileSync2(instancePath(), JSON.stringify(i, null, 2) + "\n", { mode: 384 });
+}
+function parsePort(value) {
+  const n = typeof value === "number" ? value : Number(String(value).trim());
+  if (!Number.isInteger(n) || n < 1024 || n > 65535) throw new Error(`invalid port "${value}": use a number between 1024 and 65535`);
+  return n;
+}
+function resolvePort(flag, instance, env = process.env) {
+  if (flag !== void 0 && flag !== "") return parsePort(flag);
+  const fromEnv = slipwayEnv("PORT", env);
+  if (fromEnv) return parsePort(fromEnv);
+  return instance?.port ?? DEFAULT_PORT;
+}
+function parseRuntime(value) {
+  if (RUNTIMES.includes(value)) return value;
+  throw new Error(`unknown runtime "${value}": use native or docker`);
+}
+function giteaUrlFor(port) {
+  return `http://127.0.0.1:${port}`;
+}
+
+// src/runtime/port.ts
+import { connect, createServer } from "node:net";
+async function portFree(port, host = "127.0.0.1") {
+  const answers = await new Promise((resolve2) => {
+    const s = connect({ port, host });
+    s.once("connect", () => {
+      s.destroy();
+      resolve2(true);
+    });
+    s.once("error", () => resolve2(false));
+    s.setTimeout(1e3, () => {
+      s.destroy();
+      resolve2(false);
+    });
+  });
+  if (answers) return false;
+  return new Promise((resolve2) => {
+    const srv = createServer();
+    srv.once("error", () => resolve2(false));
+    srv.listen({ port, host, exclusive: true }, () => srv.close(() => resolve2(true)));
+  });
+}
+async function nextFreePort(from, tries = 100, free = portFree) {
+  for (let p = from; p < from + tries && p <= 65535; p++) if (await free(p)) return p;
+  return void 0;
+}
+var PortBusyError = class extends Error {
+  constructor(port, suggestion) {
+    super(
+      `port ${port} is already in use by another program, so Slipway cannot start there.
+` + (suggestion ? `Start it on a free port instead (Slipway remembers it for later runs):
+  slipway up --port ${suggestion}` : "Pick a free port with: slipway up --port <port>") + "\nor set SLIPWAY_PORT."
+    );
+    this.port = port;
+    this.suggestion = suggestion;
+  }
+  port;
+  suggestion;
+};
+
+// src/init.ts
+init_exec();
+init_git_auth();
+var NONE = "none";
+async function chooseAgent(opts, ask, agents) {
+  if (opts.agent) {
+    if (opts.agent === NONE) return void 0;
+    const a = agents.find((x) => x.id === opts.agent);
+    if (!a) throw new Error(`unknown agent "${opts.agent}": use ${[...agents.map((x) => x.id), NONE].join(", ")}`);
+    return a;
+  }
+  if (!ask) return agents[0];
+  const menu = [...agents.map((a, i) => `  ${i + 1}) ${a.label}`), `  ${agents.length + 1}) None for now (only the review server)`].join("\n");
+  for (; ; ) {
+    const answer = await ask(`Which AI agent should open PRs through Slipway?
+${menu}
+Choose [1]: `);
+    const n = answer === "" ? 1 : Number(answer);
+    if (n >= 1 && n <= agents.length) return agents[n - 1];
+    if (n === agents.length + 1) return void 0;
+    const byName = agents.find((a) => a.id === answer.toLowerCase() || a.label.toLowerCase() === answer.toLowerCase());
+    if (byName) return byName;
+  }
+}
+async function askPort(e, ask) {
+  for (; ; ) {
+    const q = e.suggestion ? `Port ${e.port} is already used by another program. Use ${e.suggestion} instead? [Y/n, or type a port]: ` : `Port ${e.port} is already used by another program. Which port should Slipway use? `;
+    const a = (await ask(q)).toLowerCase();
+    if (e.suggestion && (a === "" || a === "y" || a === "yes")) return e.suggestion;
+    if (a === "n" || a === "no") throw new Error("Slipway needs a free port; run slipway init --port <port> when you have one");
+    try {
+      return parsePort(a);
+    } catch (err) {
+      if (a) process.stderr.write(`${err.message}
+`);
+    }
+  }
+}
+var yes = (a) => a === "" || /^y(es)?$/i.test(a);
+async function init(opts, d) {
+  const ask = opts.yes ? void 0 : d.ask;
+  const agents = d.agents ?? AGENTS;
+  const agent = await chooseAgent(opts, ask, agents);
+  let port = opts.port;
+  let instance;
+  for (; ; ) {
+    try {
+      instance = await d.up({ port, runtime: opts.docker ? "docker" : void 0, log: d.log });
+      break;
+    } catch (e) {
+      if (!(e instanceof PortBusyError) || !ask) throw e;
+      port = await askPort(e, ask);
+    }
+  }
+  const config = await d.setup(d.log);
+  let install;
+  if (agent) install = await agent.install(d.log);
+  let repo;
+  const here = await d.repoHere(config);
+  if (here && ask && yes(await ask(`Register ${here} for review in Slipway? [Y/n]: `))) {
+    repo = (await d.addRepo(here, d.log)).name;
+  }
+  if (!await d.ghLoggedIn()) d.log("warning: the GitHub CLI is not logged in; promotion to GitHub needs it: gh auth login");
+  return { config, instance, agent, install, repo };
+}
+function initSummary(r, here) {
+  const lines = [
+    "",
+    `Slipway is ready: ${r.config.giteaUrl}`,
+    `  login: ${r.config.reviewer.username} / ${r.config.reviewer.password}  (tick "Remember this device")`
+  ];
+  if (r.agent && r.install?.done) lines.push(`  ${r.agent.label}: plugin installed (restart running sessions to load it)`);
+  if (r.agent && r.install && !r.install.done) lines.push(`  ${r.agent.label}: finish in ${r.agent.label}:`, ...r.install.manual.map((m) => `    ${m}`));
+  if (r.repo) lines.push(`  repo registered: ${r.repo}`);
+  else lines.push(`  next: slipway repo add ${here ?? "<path-to-your-clone>"}`);
+  if (r.agent) lines.push("", `Then tell ${r.agent.label}: "Implement X and open a Slipway PR".`);
+  return lines.join("\n");
+}
+function terminalAsk() {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  return { ask: async (q) => (await rl.question(q)).trim(), close: () => rl.close() };
+}
+async function repoHere(config, cwd = process.cwd()) {
+  const top = await run("git", ["rev-parse", "--show-toplevel"], { cwd });
+  if (top.code !== 0) return void 0;
+  const path = top.stdout.trim();
+  if (Object.values(config.repos).some((r) => r.path === path)) return void 0;
+  const origin = await run("git", ["remote", "get-url", "origin"], { cwd: path });
+  return origin.code === 0 && parseGitHubRemote(origin.stdout) ? path : void 0;
+}
+async function ghLoggedIn() {
+  return (await run("gh", ["auth", "status"])).code === 0;
+}
+
+// src/cli.ts
+init_config();
+
+// src/runtime/index.ts
+init_config();
+init_env();
+import { existsSync as existsSync6, rmSync as rmSync4 } from "node:fs";
+
+// src/setup/repo.ts
+init_config();
+init_client();
+init_exec();
+init_git_auth();
+import { basename, resolve } from "node:path";
+
+// src/setup/sync.ts
+init_config();
+init_exec();
+init_git_auth();
+async function syncBase(o) {
+  const env = o.env ?? process.env;
+  const fetch2 = await run("git", ["fetch", "--quiet", "origin", `+refs/heads/${o.base}:refs/remotes/origin/${o.base}`], { cwd: o.repoDir, env, timeoutMs: 6e4 });
+  if (fetch2.code !== 0) throw new Error(`could not fetch ${o.base} from GitHub (origin): ${fetch2.stderr.trim().split("\n").pop()}`);
+  await git(o.repoDir, [...o.authArgs, "-c", "credential.helper=", "push", "--quiet", "--force", o.giteaRepoUrl, `refs/remotes/origin/${o.base}:refs/heads/${o.base}`], env);
+}
+async function syncMain(name) {
+  const config = loadConfig();
+  const repo = config.repos[name];
+  if (!repo) throw new Error(`Unknown repo "${name}". Known: ${Object.keys(config.repos).join(", ") || "(none)"}`);
+  await syncBase({
+    repoDir: repo.path,
+    base: repo.base,
+    giteaRepoUrl: `${config.giteaUrl.replace(/\/$/, "")}/${config.org}/${name}.git`,
+    authArgs: basicAuthArgs(config.admin.username, config.admin.token)
+  });
+}
+
+// src/setup/repo.ts
+function giteaRemoteUrl(config, name) {
+  return `${config.giteaUrl.replace(/\/$/, "")}/${config.org}/${name}.git`;
+}
+var NO_MERGE_SETTINGS = {
+  allow_merge_commits: false,
+  allow_rebase: false,
+  allow_rebase_explicit: false,
+  allow_squash_merge: false,
+  allow_fast_forward_only_merge: false,
+  allow_manual_merge: false,
+  autodetect_manual_merge: false,
+  has_wiki: false,
+  has_projects: false,
+  has_releases: false,
+  has_packages: false,
+  has_actions: false
+};
+function protectionFor(base, admin) {
+  return {
+    rule_name: base,
+    branch_name: base,
+    enable_push: true,
+    enable_push_whitelist: true,
+    push_whitelist_usernames: [admin],
+    enable_force_push: true,
+    enable_force_push_allowlist: true,
+    force_push_allowlist_usernames: [admin],
+    enable_merge_whitelist: true,
+    merge_whitelist_usernames: [],
+    block_admin_merge_override: true,
+    block_on_rejected_reviews: true
+  };
+}
+async function applyRepoAccess(config, name, base) {
+  const admin = new GiteaClient(config.giteaUrl, config.admin.token);
+  await admin.editRepo(config.org, name, { ...NO_MERGE_SETTINGS, default_branch: base });
+  if (config.reviewer.username !== config.admin.username) await admin.addCollaborator(config.org, name, config.reviewer.username, "write");
+  if (config.claude) await admin.addCollaborator(config.org, name, config.claude.username, "write");
+  const protections = await admin.listBranchProtections(config.org, name).catch(() => []);
+  if (protections.some((p) => p.rule_name === base)) await admin.editBranchProtection(config.org, name, base, protectionFor(base, config.admin.username));
+  else await admin.createBranchProtection(config.org, name, protectionFor(base, config.admin.username));
+}
+async function setReviewRemote(config, name, clonePath) {
+  const url = giteaRemoteUrl(config, name);
+  const hasReview = (await run("git", ["remote", "get-url", "review"], { cwd: clonePath })).code === 0;
+  await git(clonePath, hasReview ? ["remote", "set-url", "review", url] : ["remote", "add", "review", url]);
+}
+async function addRepo(opts) {
+  const log = opts.log ?? (() => {
+  });
+  const config = loadConfig();
+  const path = resolve(opts.path);
+  const top = await git(path, ["rev-parse", "--show-toplevel"]);
+  const name = opts.name ?? basename(top);
+  const base = opts.base ?? "main";
+  let github = opts.github;
+  if (!github) {
+    const origin = await run("git", ["remote", "get-url", "origin"], { cwd: top });
+    github = parseGitHubRemote(origin.stdout) ?? void 0;
+    if (!github) throw new Error('Cannot infer the GitHub repo from remote "origin"; pass --github owner/name');
+  }
+  const admin = new GiteaClient(config.giteaUrl, config.admin.token);
+  try {
+    await admin.createOrgRepo(config.org, name, `Slipway review station for ${github}`);
+    log(`created Gitea repo ${config.org}/${name}`);
+  } catch (e) {
+    if (!(e instanceof GiteaError && e.status === 409)) throw e;
+    log(`Gitea repo ${config.org}/${name} already exists`);
+  }
+  await setReviewRemote(config, name, top);
+  config.repos[name] = { path: top, base, github };
+  saveConfig(config);
+  await syncMain(name);
+  await applyRepoAccess(config, name, base);
+  return { name, url: giteaRemoteUrl(config, name) };
+}
+
+// src/runtime/custom.ts
+init_config();
+import { cpSync, existsSync as existsSync3, mkdirSync as mkdirSync3, rmSync } from "node:fs";
+import { dirname as dirname2, join as join4 } from "node:path";
+
+// src/paths.ts
+import { dirname, join as join3 } from "node:path";
+import { fileURLToPath } from "node:url";
+var SLIPWAY_ROOT = join3(dirname(fileURLToPath(import.meta.url)), "..");
+
+// src/runtime/custom.ts
+var SHIPPED_CUSTOM = join4(SLIPWAY_ROOT, "gitea");
+function customDir() {
+  return join4(slipwayHome(), "gitea", "custom");
+}
+function syncCustom(dest = customDir(), source = SHIPPED_CUSTOM) {
+  if (!existsSync3(source)) throw new Error(`Slipway's Gitea branding is missing at ${source}: the installation is incomplete`);
+  rmSync(dest, { recursive: true, force: true });
+  mkdirSync3(dirname2(dest), { recursive: true });
+  cpSync(source, dest, { recursive: true });
+}
+
+// src/runtime/docker.ts
+init_config();
+init_env();
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3, join as join5 } from "node:path";
+init_exec();
+
+// src/runtime/settings.ts
+function giteaSettings(port) {
+  return {
+    "": { APP_NAME: "Slipway", RUN_MODE: "prod" },
+    server: {
+      ROOT_URL: `http://127.0.0.1:${port}/`,
+      LANDING_PAGE: "login",
+      DISABLE_SSH: "true",
+      // Avatars from Gravatar by e-mail (ADR 0001).
+      OFFLINE_MODE: "false"
+    },
+    database: { DB_TYPE: "sqlite3" },
+    security: {
+      INSTALL_LOCK: "true",
+      // Local-only instance: "Remember this device" lasts a year (ADR 0005).
+      LOGIN_REMEMBER_DAYS: "365",
+      // Default login is slipway / slipway (7 chars); Gitea's default minimum is 8 (ADR 0005).
+      MIN_PASSWORD_LENGTH: "6",
+      PASSWORD_CHECK_PWN: "false",
+      ALLOWED_HOST_LIST: "loopback,private"
+    },
+    service: {
+      DISABLE_REGISTRATION: "true",
+      REQUIRE_SIGNIN_VIEW: "true",
+      ENABLE_TIMETRACKING: "false",
+      DEFAULT_ENABLE_TIMETRACKING: "false",
+      ENABLE_PASSKEY_AUTHENTICATION: "false"
+    },
+    ui: { DEFAULT_THEME: "gitea-dark", THEMES: "gitea-dark", SHOW_USER_EMAIL: "false" },
+    "ui.meta": { AUTHOR: "Slipway", DESCRIPTION: "Review AI pull requests, then launch them to GitHub" },
+    i18n: { LANGS: "en-US", NAMES: "English" },
+    picture: { DISABLE_GRAVATAR: "false", GRAVATAR_SOURCE: "gravatar" },
+    other: {
+      SHOW_FOOTER_VERSION: "false",
+      SHOW_FOOTER_TEMPLATE_LOAD_TIME: "false",
+      SHOW_FOOTER_POWERED_BY: "false",
+      ENABLE_FEED: "false"
+    },
+    repository: {
+      DEFAULT_BRANCH: "main",
+      DEFAULT_PRIVATE: "private",
+      DISABLED_REPO_UNITS: "repo.issues,repo.ext_issues,repo.wiki,repo.ext_wiki,repo.projects,repo.releases,repo.packages,repo.actions",
+      DEFAULT_REPO_UNITS: "repo.code,repo.pulls",
+      DISABLE_STARS: "true",
+      DISABLE_MIGRATIONS: "true",
+      DISABLE_FORKS: "true"
+    },
+    packages: { ENABLED: "false" },
+    actions: { ENABLED: "false" },
+    webhook: { DELIVER_TIMEOUT: "15" },
+    mailer: { ENABLED: "false" },
+    log: { LEVEL: "Warn" }
+  };
+}
+function mergeSettings(...all) {
+  const out = {};
+  for (const s of all) for (const [sec, kv] of Object.entries(s)) out[sec] = { ...out[sec], ...kv };
+  return out;
+}
+function renderIni(s) {
+  const lines = ["; Generated by Slipway on every `slipway up`. Do not edit: change src/runtime/settings.ts instead."];
+  const root = s[""] ?? {};
+  for (const [k, v] of Object.entries(root)) lines.push(`${k} = ${v}`);
+  for (const [sec, kv] of Object.entries(s)) {
+    if (sec === "") continue;
+    lines.push("", `[${sec}]`);
+    for (const [k, v] of Object.entries(kv)) lines.push(`${k} = ${v}`);
+  }
+  return lines.join("\n") + "\n";
+}
+function renderEnv(s) {
+  const lines = [];
+  for (const [sec, kv] of Object.entries(s)) for (const [k, v] of Object.entries(kv)) lines.push(`GITEA__${sec}__${k}=${v}`);
+  return lines.join("\n") + "\n";
+}
+
+// src/runtime/docker.ts
+var COMPOSE_FILE = join5(SLIPWAY_ROOT, "docker", "compose.yaml");
+var DEFAULT_PROJECT = "slipway";
+function composeProject() {
+  return slipwayEnv("PROJECT") || DEFAULT_PROJECT;
+}
+function dockerEnvFile() {
+  return join5(slipwayHome(), "docker", "gitea.env");
+}
+function composeEnv(port) {
+  return {
+    ...process.env,
+    SLIPWAY_PROJECT: composeProject(),
+    SLIPWAY_PORT: String(port),
+    SLIPWAY_GITEA_ENV: dockerEnvFile(),
+    SLIPWAY_GITEA_CUSTOM: customDir()
+  };
+}
+var composeArgs = (args) => ["compose", "-f", COMPOSE_FILE, ...args];
+function writeDockerEnv(port) {
+  mkdirSync4(dirname3(dockerEnvFile()), { recursive: true, mode: 448 });
+  writeFileSync3(dockerEnvFile(), renderEnv(giteaSettings(port)), { mode: 384 });
+}
+async function dockerUp(port) {
+  if ((await run("docker", ["version"])).code !== 0) {
+    throw new Error("Docker is not running (or not installed). Start Docker, or use the default runtime without --docker.");
+  }
+  writeDockerEnv(port);
+  await runOk("docker", composeArgs(["up", "-d", "--wait"]), { env: composeEnv(port), timeoutMs: 3e5 });
+}
+async function dockerDown(port, purge) {
+  writeDockerEnv(port);
+  await runOk("docker", composeArgs(["down", ...purge ? ["-v"] : []]), { env: composeEnv(port) });
+}
+async function dockerRunning(port) {
+  const r = await run("docker", composeArgs(["ps", "--status", "running", "-q", "gitea"]), { env: composeEnv(port) });
+  return r.code === 0 && r.stdout.trim() !== "";
+}
+function dockerAdmin(port, args) {
+  return run("docker", composeArgs(["exec", "-T", "gitea", "gitea", ...args]), { env: composeEnv(port) });
+}
+
+// src/runtime/index.ts
+init_downloads();
+
+// src/runtime/health.ts
+async function giteaHealthy(url) {
+  try {
+    return (await fetch(`${url}/api/healthz`, { signal: AbortSignal.timeout(2e3) })).ok;
+  } catch {
+    return false;
+  }
+}
+async function waitForGitea(url, timeoutMs = 6e4, failed = () => void 0) {
+  const until = Date.now() + timeoutMs;
+  let last = "";
+  while (Date.now() < until) {
+    const why = failed();
+    if (why) throw new Error(why);
+    try {
+      const r = await fetch(`${url}/api/healthz`, { signal: AbortSignal.timeout(2e3) });
+      if (r.ok) return;
+      last = `HTTP ${r.status}`;
+    } catch (e) {
+      last = String(e);
+    }
+    await new Promise((r) => setTimeout(r, 500));
+  }
+  throw new Error(`Gitea at ${url} did not become ready: ${last}`);
+}
+
+// src/runtime/native.ts
+init_config();
+import { spawn as spawn2 } from "node:child_process";
+import { closeSync, existsSync as existsSync5, mkdirSync as mkdirSync6, openSync, readFileSync as readFileSync3, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { userInfo } from "node:os";
+import { join as join7 } from "node:path";
+init_exec();
+function nativePaths(home = slipwayHome()) {
+  const dir = join7(home, "gitea");
+  return {
+    dir,
+    ini: join7(dir, "app.ini"),
+    secrets: join7(dir, "secrets.json"),
+    pid: join7(dir, "gitea.pid"),
+    data: join7(dir, "data"),
+    log: join7(dir, "log"),
+    custom: customDir()
+  };
+}
+var SECRET_NAMES = ["SECRET_KEY", "INTERNAL_TOKEN", "JWT_SECRET", "LFS_JWT_SECRET"];
+function giteaGlobalArgs(p) {
+  return ["--config", p.ini, "--work-path", p.dir, "--custom-path", p.custom];
+}
+function giteaEnv() {
+  const env = {};
+  for (const [k, v] of Object.entries(process.env)) if (!k.startsWith("GITEA")) env[k] = v;
+  return env;
+}
+function nativeSettings(port, p, secrets, runUser) {
+  return mergeSettings(giteaSettings(port), {
+    "": { RUN_USER: runUser, WORK_PATH: p.dir },
+    server: {
+      PROTOCOL: "http",
+      // Security invariant: loopback only.
+      HTTP_ADDR: "127.0.0.1",
+      HTTP_PORT: String(port),
+      DOMAIN: "127.0.0.1",
+      APP_DATA_PATH: p.data,
+      START_SSH_SERVER: "false",
+      LFS_START_SERVER: "false",
+      LFS_JWT_SECRET: secrets.LFS_JWT_SECRET
+    },
+    database: { PATH: join7(p.data, "gitea.db") },
+    repository: { ROOT: join7(p.data, "repositories") },
+    security: { SECRET_KEY: secrets.SECRET_KEY, INTERNAL_TOKEN: secrets.INTERNAL_TOKEN },
+    oauth2: { JWT_SECRET: secrets.JWT_SECRET },
+    log: { MODE: "file", ROOT_PATH: p.log }
+  });
+}
+async function ensureSecrets(bin, p) {
+  if (existsSync5(p.secrets)) return JSON.parse(readFileSync3(p.secrets, "utf8"));
+  const out = {};
+  for (const name of SECRET_NAMES) out[name] = (await runOk(bin, ["generate", "secret", name], { env: giteaEnv() })).stdout.trim();
+  mkdirSync6(p.dir, { recursive: true, mode: 448 });
+  writeFileSync4(p.secrets, JSON.stringify(out, null, 2) + "\n", { mode: 384 });
+  return out;
+}
+async function writeAppIni(bin, port, p = nativePaths()) {
+  const secrets = await ensureSecrets(bin, p);
+  mkdirSync6(p.data, { recursive: true });
+  mkdirSync6(p.log, { recursive: true });
+  writeFileSync4(p.ini, renderIni(nativeSettings(port, p, secrets, userInfo().username)), { mode: 384 });
+}
+function readPid(p = nativePaths()) {
+  if (!existsSync5(p.pid)) return void 0;
+  const n = Number(readFileSync3(p.pid, "utf8").trim());
+  return Number.isInteger(n) && n > 0 ? n : void 0;
+}
+async function isGiteaProcess(pid) {
+  try {
+    process.kill(pid, 0);
+  } catch {
+    return false;
+  }
+  const r = await run("ps", ["-p", String(pid), "-o", "command="]);
+  return r.code === 0 && /gitea/.test(r.stdout);
+}
+async function nativeRunning(port, p = nativePaths()) {
+  const pid = readPid(p);
+  return pid !== void 0 && await isGiteaProcess(pid) && await giteaHealthy(giteaUrlFor(port));
+}
+async function nativeStart(bin, port, p = nativePaths()) {
+  const out = openSync(join7(p.log, "stdout.log"), "a");
+  let exited;
+  try {
+    const child = spawn2(bin, [...giteaGlobalArgs(p), "web"], { cwd: p.dir, detached: true, stdio: ["ignore", out, out], env: giteaEnv() });
+    child.once("exit", (code) => {
+      exited = `Gitea exited right after start (code ${code}). Its log: ${join7(p.log, "stdout.log")}
+${tail(join7(p.log, "stdout.log"))}`;
+    });
+    child.once("error", (e) => {
+      exited = `cannot start Gitea (${bin}): ${e.message}`;
+    });
+    if (child.pid) writeFileSync4(p.pid, `${child.pid}
+`);
+    child.unref();
+  } finally {
+    closeSync(out);
+  }
+  await waitForGitea(giteaUrlFor(port), 6e4, () => exited);
+}
+function tail(file, lines = 15) {
+  try {
+    return readFileSync3(file, "utf8").trimEnd().split("\n").slice(-lines).join("\n");
+  } catch {
+    return "";
+  }
+}
+async function nativeStop(p = nativePaths()) {
+  const pid = readPid(p);
+  if (pid === void 0 || !await isGiteaProcess(pid)) {
+    rmSync3(p.pid, { force: true });
+    return false;
+  }
+  process.kill(pid, "SIGTERM");
+  const until = Date.now() + 15e3;
+  while (Date.now() < until && await isGiteaProcess(pid)) await new Promise((r) => setTimeout(r, 200));
+  if (await isGiteaProcess(pid)) process.kill(pid, "SIGKILL");
+  rmSync3(p.pid, { force: true });
+  return true;
+}
+function nativePurge(p = nativePaths()) {
+  rmSync3(p.dir, { recursive: true, force: true });
+}
+function nativeAdmin(bin, args, p = nativePaths()) {
+  return run(bin, [...giteaGlobalArgs(p), ...args], { cwd: p.dir, env: giteaEnv() });
+}
+
+// src/runtime/index.ts
+function resolveRuntime(flag, instance) {
+  if (flag) return flag;
+  const env = slipwayEnv("RUNTIME");
+  if (env) return parseRuntime(env);
+  return instance?.runtime ?? "native";
+}
+async function isRunning(i) {
+  return i.runtime === "native" ? nativeRunning(i.port) : dockerRunning(i.port);
+}
+async function up(opts = {}) {
+  const log = opts.log ?? (() => {
+  });
+  const prev = loadInstance();
+  const runtime = resolveRuntime(opts.runtime, prev);
+  if (prev && prev.runtime !== runtime) {
+    throw new Error(
+      `Slipway already runs with the ${prev.runtime} runtime here; switching to ${runtime} would start with empty data.
+To start over on ${runtime}: slipway down --purge, then slipway up${runtime === "docker" ? " --docker" : ""}.`
+    );
+  }
+  const port = resolvePort(opts.port, prev);
+  if (prev && await isRunning(prev)) {
+    if (prev.port === port && (runtime === "docker" || prev.giteaBin?.endsWith(`gitea-${GITEA_VERSION}`))) {
+      log(`already running at ${giteaUrlFor(port)}`);
+      if (runtime === "native") await ensureGitleaks(log);
+      return prev;
+    }
+    log("restarting Gitea (new port or Gitea version)");
+    await stop(prev);
+  }
+  if (!await portFree(port)) throw new PortBusyError(port, await nextFreePort(port + 1));
+  syncCustom();
+  let instance;
+  if (runtime === "native") {
+    const bin = await ensureGitea(log);
+    await writeAppIni(bin, port);
+    log(`starting Gitea ${GITEA_VERSION} on ${giteaUrlFor(port)}`);
+    await nativeStart(bin, port);
+    instance = { runtime, port, giteaBin: bin };
+    await ensureGitleaks(log);
+  } else {
+    log(`starting Gitea in Docker on ${giteaUrlFor(port)}`);
+    await dockerUp(port);
+    instance = { runtime, port };
+  }
+  saveInstance(instance);
+  await retargetConfig(port, log);
+  return instance;
+}
+async function stop(i) {
+  if (i.runtime === "native") await nativeStop();
+  else await dockerDown(i.port, false);
+}
+async function down(opts = {}) {
+  const i = loadInstance();
+  if (!i) return;
+  if (i.runtime === "native") {
+    await nativeStop();
+    if (opts.purge) nativePurge();
+  } else {
+    await dockerDown(i.port, !!opts.purge);
+  }
+  if (opts.purge) rmSync4(instancePath(), { force: true });
+}
+function giteaAdmin(args) {
+  const i = loadInstance();
+  if (!i) throw new Error("Slipway is not running here yet. Run: slipway up");
+  if (i.runtime === "docker") return dockerAdmin(i.port, args);
+  if (!i.giteaBin) throw new Error("the instance has no Gitea binary recorded. Run: slipway up");
+  return nativeAdmin(i.giteaBin, args);
+}
+function defaultGiteaUrl() {
+  return slipwayEnv("GITEA_URL") || giteaUrlFor(resolvePort(void 0, loadInstance()));
+}
+async function retargetConfig(port, log) {
+  if (!existsSync6(configPath()) || slipwayEnv("GITEA_URL")) return;
+  const config = loadConfig();
+  const url = giteaUrlFor(port);
+  if (config.giteaUrl.replace(/\/$/, "") === url) return;
+  config.giteaUrl = url;
+  saveConfig(config);
+  for (const [name, entry] of Object.entries(config.repos)) {
+    if (existsSync6(entry.path)) await setReviewRemote(config, name, entry.path).catch(() => {
+    });
+  }
+  log(`Slipway moved to ${url} (config and review remotes updated)`);
+}
+async function status() {
+  const instance = loadInstance();
+  if (!instance) return { running: false };
+  return { instance, running: await isRunning(instance), url: giteaUrlFor(instance.port) };
+}
+
+// src/setup/bootstrap.ts
+init_config();
+init_client();
+import { randomBytes } from "node:crypto";
+import { existsSync as existsSync7 } from "node:fs";
+var DEFAULT_OWNER = "slipway";
+var DEFAULT_PASSWORD = "slipway";
+var DEFAULT_ADMIN = "admin";
+var DEFAULT_ORG = "repos";
+var REVIEWERS_TEAM = "reviewers";
+var OWNER_TOKEN_SCOPES = ["all"];
+async function ensureUser(username, email, password, admin) {
+  const create = await giteaAdmin([
+    "admin",
+    "user",
+    "create",
+    "--username",
+    username,
+    "--password",
+    password,
+    "--email",
+    email,
+    "--must-change-password=false",
+    ...admin ? ["--admin"] : []
+  ]);
+  if (create.code !== 0 && !/already exists/.test(create.stdout + create.stderr)) {
+    throw new Error(`Creating Gitea user ${username} failed: ${create.stderr || create.stdout}`);
+  }
+  const pw = await giteaAdmin(["admin", "user", "change-password", "--username", username, "--password", password, "--must-change-password=false"]);
+  if (pw.code !== 0) throw new Error(`Setting password for ${username} failed: ${pw.stderr || pw.stdout}`);
+}
+async function tokenWorks(giteaUrl2, token, username) {
+  try {
+    const me = await new GiteaClient(giteaUrl2, token).req("GET", "/user");
+    return me.login === username;
+  } catch {
+    return false;
+  }
+}
+function resolveOwnerCredentials(opts, previous) {
+  const username = opts.ownerUser || previous?.owner.username || DEFAULT_OWNER;
+  const password = opts.ownerPassword || (previous?.owner.username === username ? previous.owner.password : DEFAULT_PASSWORD);
+  return { username, password };
+}
+async function keepValidClaude(previous, works) {
+  return previous && await works(previous) ? previous : void 0;
+}
+async function tokenFor(giteaUrl2, account, previousToken, name) {
+  if (previousToken && await tokenWorks(giteaUrl2, previousToken, account.username)) return previousToken;
+  return new GiteaClient(giteaUrl2, { basic: [account.username, account.password] }).createToken(account.username, name, OWNER_TOKEN_SCOPES);
+}
+async function bootstrap(opts) {
+  const log = opts.log ?? (() => {
+  });
+  const previous = existsSync7(configPath()) ? loadConfig() : void 0;
+  const giteaUrl2 = opts.giteaUrl ?? previous?.giteaUrl ?? defaultGiteaUrl();
+  await waitForGitea(giteaUrl2);
+  const adminUser = opts.adminUser ?? previous?.admin.username ?? DEFAULT_ADMIN;
+  const keepAdmin = previous?.admin.username === adminUser ? previous.admin : void 0;
+  const adminPassword = keepAdmin?.password ?? randomBytes(18).toString("base64url");
+  await ensureUser(adminUser, `${adminUser}@slipway.local`, adminPassword, true);
+  const adminToken = await tokenFor(giteaUrl2, { username: adminUser, password: adminPassword }, keepAdmin?.token, "slipway-admin");
+  const adminApi = new GiteaClient(giteaUrl2, adminToken);
+  const { username: reviewerUser, password: reviewerPassword } = resolveOwnerCredentials(opts, previous ? { owner: previous.reviewer } : void 0);
+  await ensureUser(reviewerUser, opts.ownerEmail ?? `${reviewerUser}@slipway.local`, reviewerPassword, false);
+  const reviewerToken = await tokenFor(
+    giteaUrl2,
+    { username: reviewerUser, password: reviewerPassword },
+    previous?.reviewer.username === reviewerUser ? previous.reviewer.token : void 0,
+    "slipway-reviewer"
+  );
+  const org = opts.org ?? previous?.org ?? DEFAULT_ORG;
+  try {
+    await adminApi.createOrg(org);
+    log(`created organization ${org}`);
+  } catch (e) {
+    if (!(e instanceof GiteaError && (e.status === 409 || e.status === 422))) throw e;
+  }
+  if (reviewerUser !== adminUser) {
+    const team = (await adminApi.listTeams(org)).find((t) => t.name === REVIEWERS_TEAM) ?? await adminApi.createTeam(org, REVIEWERS_TEAM);
+    await adminApi.addTeamMember(team.id, reviewerUser);
+  }
+  const claude = await keepValidClaude(previous?.claude, (a) => tokenWorks(giteaUrl2, a.token, a.username));
+  const config = {
+    giteaUrl: giteaUrl2,
+    admin: { username: adminUser, password: adminPassword, token: adminToken },
+    reviewer: { username: reviewerUser, password: reviewerPassword, token: reviewerToken },
+    org,
+    ...claude ? { claude } : {},
+    repos: previous?.repos ?? {}
+  };
+  for (const [name, entry] of Object.entries(config.repos)) {
+    const inOrg = await adminApi.getRepo(org, name).then(() => true, (e) => e instanceof GiteaError && e.status === 404 ? false : Promise.reject(e));
+    if (!inOrg) {
+      const from = previous?.org ?? reviewerUser;
+      await adminApi.transferRepo(from, name, org);
+      log(`moved ${from}/${name} \u2192 ${org}/${name}`);
+    }
+    await applyRepoAccess(config, name, entry.base);
+    if (existsSync7(entry.path)) await setReviewRemote(config, name, entry.path);
+  }
+  await adminApi.adminEditUser(reviewerUser, { admin: false });
+  saveConfig(config);
+  return config;
+}
+
+// package.json
+var package_default = {
+  name: "@coldic3/slipway",
+  version: "1.0.0",
+  description: "A local review station for AI-agent pull requests: review in a local Gitea, promote the approved commits to GitHub",
+  keywords: [
+    "ai",
+    "code-review",
+    "pull-requests",
+    "gitea",
+    "github",
+    "claude-code",
+    "mcp"
+  ],
+  homepage: "https://github.com/coldic3/slipway#readme",
+  bugs: {
+    url: "https://github.com/coldic3/slipway/issues"
+  },
+  repository: {
+    type: "git",
+    url: "git+https://github.com/coldic3/slipway.git"
+  },
+  license: "MIT",
+  author: "Kevin Kaniaburka",
+  type: "module",
+  bin: {
+    slipway: "dist/slipway.mjs"
+  },
+  files: [
+    "dist/slipway.mjs",
+    "gitea/",
+    "docker/compose.yaml"
+  ],
+  os: [
+    "darwin",
+    "linux"
+  ],
+  engines: {
+    node: ">=22"
+  },
+  publishConfig: {
+    access: "public"
+  },
+  scripts: {
+    slipway: "tsx src/cli.ts",
+    typecheck: "tsc --noEmit",
+    test: "npm run test:unit && npm run test:functional",
+    "test:unit": "vitest run tests/unit",
+    "test:functional": "vitest run tests/functional",
+    "test:e2e": "playwright test",
+    "test:all": "npm test && npm run test:e2e",
+    "build:plugin": "node scripts/build-plugin.mjs",
+    "build:brand": "node scripts/build-brand.mjs && node scripts/stamp-assets.mjs",
+    build: "npm run build:cli && npm run build:plugin",
+    "build:cli": "node scripts/build-cli.mjs",
+    prepack: "npm run build:cli"
+  },
+  devDependencies: {
+    "@modelcontextprotocol/sdk": "^1.32.2",
+    "@playwright/test": "^1.65.0",
+    "@types/node": "^26.6.6",
+    esbuild: "^0.28.2",
+    tsx: "^4.23.15",
+    typescript: "^5.9.3",
+    vitest: "^5.1.0",
+    zod: "^4.6.7"
+  }
+};
+
+// src/version.ts
+var VERSION = package_default.version;
+
+// src/cli.ts
+var HELP = `slipway ${VERSION}: a local review station for AI-agent PRs (Gitea \u2192 GitHub)
+
+Start here:
+  slipway init [--agent claude-code|none] [--port 3514] [--docker] [--yes]
+                                     set everything up: the server, your login, your agent's plugin, this repo
+
+Server:
+  slipway up [--port N] [--docker]   start Slipway's Gitea on 127.0.0.1 (default port 3514, remembered)
+  slipway down [--purge]             stop it (--purge deletes all review data)
+  slipway status                     runtime, port, running or not
+
+Setup:
+  slipway setup [--user slipway] [--password slipway] [--email e] [--org repos] [--admin-user admin]
+                                     your login (a plain reviewer), the technical admin and the org (idempotent)
+  slipway repo add <path> [--name n] [--github owner/repo] [--base main]
+                                     register a local clone: Gitea repo, protection, remote "review"
+  slipway sync-main <repo>           push origin/<base> to Gitea <base> (force)
+
+Promotion (usually done by your agent):
+  slipway promote <repo> <pr> [--draft] [--base b] [--test-cmd "npm test"] [--force]
+                                     publish an approved PR's exact commits to GitHub (token: SLIPWAY_GITHUB_TOKEN or \`gh auth token\`)
+
+Environment: SLIPWAY_PORT, SLIPWAY_RUNTIME (native|docker), SLIPWAY_HOME (default ~/.slipway).
+`;
+async function main(argv) {
+  const [cmd, sub, ...rest] = argv;
+  const log = (m) => console.error(`slipway: ${m}`);
+  switch (cmd) {
+    case void 0:
+    case "-h":
+    case "--help":
+    case "help":
+      console.log(HELP);
+      return 0;
+    case "-v":
+    case "--version":
+    case "version":
+      console.log(VERSION);
+      return 0;
+    case "init": {
+      const { values } = parseArgs2({
+        args: argv.slice(1),
+        options: { agent: { type: "string" }, port: { type: "string" }, docker: { type: "boolean" }, yes: { type: "boolean", short: "y" } }
+      });
+      const terminal = process.stdin.isTTY && !values.yes ? terminalAsk() : void 0;
+      try {
+        let here;
+        const r = await init(values, {
+          ask: terminal?.ask,
+          log,
+          up,
+          setup: (l) => bootstrap({ log: l }),
+          addRepo: (path, l) => addRepo({ path, log: l }),
+          repoHere: async (c) => here = await repoHere(c),
+          ghLoggedIn
+        });
+        console.error(initSummary(r, here));
+      } finally {
+        terminal?.close();
+      }
+      return 0;
+    }
+    case "up": {
+      const { values } = parseArgs2({ args: argv.slice(1), options: { port: { type: "string" }, docker: { type: "boolean" } } });
+      const i = await up({ port: values.port, runtime: values.docker ? "docker" : void 0, log });
+      log(`Slipway is up at http://127.0.0.1:${i.port} (${i.runtime})`);
+      return 0;
+    }
+    case "down": {
+      const { values } = parseArgs2({ args: argv.slice(1), options: { purge: { type: "boolean" } } });
+      await down({ purge: values.purge });
+      return 0;
+    }
+    case "status": {
+      const s = await status();
+      if (!s.instance) {
+        console.log("not set up here yet: run slipway init");
+        return 1;
+      }
+      let configured = "";
+      try {
+        const c = loadConfig();
+        configured = `, login ${c.reviewer.username}, ${Object.keys(c.repos).length} repo(s)`;
+      } catch {
+        configured = ", not set up: run slipway setup";
+      }
+      console.log(`${s.running ? "running" : "stopped"} at ${s.url} (${s.instance.runtime}${configured})`);
+      return s.running ? 0 : 3;
+    }
+    case "setup": {
+      const { values } = parseArgs2({
+        args: argv.slice(1),
+        options: {
+          user: { type: "string" },
+          email: { type: "string" },
+          password: { type: "string" },
+          "gitea-url": { type: "string" },
+          "admin-user": { type: "string" },
+          org: { type: "string" }
+        }
+      });
+      const c = await bootstrap({
+        ownerUser: values.user,
+        ownerEmail: values.email,
+        ownerPassword: values.password,
+        giteaUrl: values["gitea-url"],
+        adminUser: values["admin-user"],
+        org: values.org,
+        log
+      });
+      log(`ready: ${c.giteaUrl} (login: ${c.reviewer.username} / ${c.reviewer.password}; repos live in "${c.org}")`);
+      return 0;
+    }
+    case "repo": {
+      if (sub !== "add") throw new Error("usage: slipway repo add <path> ...");
+      const { values, positionals } = parseArgs2({
+        args: rest,
+        allowPositionals: true,
+        options: { name: { type: "string" }, github: { type: "string" }, base: { type: "string" } }
+      });
+      const r = await addRepo({ path: positionals[0] ?? ".", name: values.name, github: values.github, base: values.base, log });
+      log(`repo ${r.name} ready \u2192 ${r.url}`);
+      return 0;
+    }
+    case "sync-main": {
+      if (!sub) throw new Error("usage: slipway sync-main <repo>");
+      await syncMain(sub);
+      log(`synced ${sub}`);
+      return 0;
+    }
+    case "promote": {
+      const { runPromoteCli: runPromoteCli2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
+      return runPromoteCli2(argv.slice(1), log);
+    }
+    default:
+      console.error(`Unknown command: ${cmd}
+
+${HELP}`);
+      return 1;
+  }
+}
+function isMain() {
+  if (!process.argv[1]) return false;
+  try {
+    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath2(import.meta.url));
+  } catch {
+    return false;
+  }
+}
+if (isMain()) {
+  main(process.argv.slice(2)).then(
+    (code) => process.exit(code),
+    (err) => {
+      console.error(`slipway: error: ${err.message}`);
+      process.exit(1);
+    }
+  );
+}
+export {
+  main
+};