@foldrun/core 1.4.1 → 2.0.0

package/src/git-hook.ts

@@ -1,73 +0,0 @@
-// The pre-receive check, run by git inside a push.
-//
-// git feeds "<old> <new> <ref>" lines on stdin. For a push to main, read the
-// tree at the new commit straight from the object store and run the deploy
-// checks on it. Any issue: print them and exit non-zero — the push is refused
-// and the person sees exactly what a dashboard deploy would have told them,
-// in their terminal, before anything changed.
-//
-// Runs as its own process under git's environment. GIT_DIR is set by git.
-
-import fs from "node:fs";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { deployIssues, runsInFlight } from "./deploy.ts";
-
-const dir = process.env.GIT_DIR;
-if (!dir) process.exit(0);
-
-// `_library.git` is the account shelf, not a workspace: it holds tools,
-// skills and knowledge and has no agents by definition. The workspace rules
-// refused every push to it with "no agents". Its sync (syncLibraryFromTree)
-// validates what it accepts on receive; nothing here to add yet.
-// Inside a hook git sets GIT_DIR relative to the repo ("."), so resolve it
-// against the cwd before asking for its name.
-if (path.basename(path.resolve(process.cwd(), dir)) === "_library.git") process.exit(0);
-
-const input = fs.readFileSync(0, "utf8");
-const git = (args: string[]) => {
-  const r = spawnSync("git", ["--git-dir", dir, ...args], { maxBuffer: 64 * 1024 * 1024 });
-  return r.status === 0 ? r.stdout.toString() : null;
-};
-
-// The client is gone by the time the deploy runs, so this is the only moment
-// a person can be told their push will not take effect yet. A warning, not a
-// refusal: the commit is fine and the scheduler applies it when the runs end.
-const here = path.basename(path.resolve(process.cwd(), dir));
-if (here.endsWith(".git")) {
-  const workspace = here.slice(0, -4);
-  const tenant = path.basename(path.resolve(process.cwd(), dir, "..", ".."));
-  try {
-    const live = runsInFlight(tenant, workspace);
-    if (live.length) {
-      process.stderr.write(
-        `\nfoldrun: ${live.length} run${live.length === 1 ? " is" : "s are"} in flight, so this push is not live yet.\n` +
-          `  It is on main and will be applied automatically when they finish.\n\n`,
-      );
-    }
-  } catch {
-    // A warning that cannot be computed must never fail a push.
-  }
-}
-
-let refused = false;
-for (const line of input.split("\n").filter(Boolean)) {
-  const [, newSha, ref] = line.split(" ");
-  if (ref !== "refs/heads/main" || /^0+$/.test(newSha)) continue;
-  const tree = git(["ls-tree", "-r", "--name-only", newSha]) ?? "";
-  const files = tree
-    .split("\n")
-    .filter(Boolean)
-    .flatMap((p) => {
-      const content = git(["show", `${newSha}:${p}`]);
-      return content === null ? [] : [{ path: p, content }];
-    });
-  const issues = deployIssues(files);
-  if (issues.length) {
-    refused = true;
-    process.stderr.write(`\nfoldrun: refusing this push — ${issues.length} problem${issues.length === 1 ? "" : "s"} the checks would have stopped at deploy:\n`);
-    for (const i of issues) process.stderr.write(`  ${i.where}: ${i.message}\n`);
-    process.stderr.write(`\nFix and push again. (foldrun check runs the same rules locally.)\n\n`);
-  }
-}
-process.exit(refused ? 1 : 0);

package/src/git.ts

@@ -1,117 +0,0 @@
-// git push → deployed.
-//
-// A workspace is markdown, so there is no build to run: a push is a fetch of
-// the tree at that commit, a check, and a swap. This module is the GitHub half
-// — the secret a repository signs with, the payload shape, and pulling the
-// tarball. `deploy.ts` decides whether the result is allowed to go live.
-//
-// The tarball, not a clone: one HTTP call, no git binary, no working copy kept
-// on the server. A markdown workspace is a few hundred kilobytes.
-
-import crypto from "node:crypto";
-import { installKey } from "./webhook.ts";
-
-/** GitHub refuses to fetch anything larger, and neither should we. */
-const MAX_TARBALL = 25 * 1024 * 1024;
-
-/**
- * The secret a repository signs its pushes with.
- *
- * Derived rather than stored, exactly like a flow's webhook token: HMAC of the
- * workspace's identity under the install key. Nothing new to persist, unique
- * per workspace, and rotating FOLDRUN_SECRET_KEY invalidates every connection
- * at once.
- */
-export function gitSecret(tenant: string, workspace: string): string {
-  return crypto
-    .createHmac("sha256", installKey())
-    .update(`git/${tenant}/${workspace}`)
-    .digest("hex");
-}
-
-export function gitHookPath(tenant: string, workspace: string): string {
-  return `/api/git/${tenant}/${workspace}`;
-}
-
-/**
- * Whether a request really came from the repository it claims to.
- *
- * Compared in constant time: a byte-by-byte early return leaks the expected
- * signature to anyone willing to time enough requests. The raw body is
- * required — re-serializing parsed JSON changes bytes GitHub signed.
- */
-export function verifySignature(secret: string, rawBody: string, header: string | null): boolean {
-  if (!header) return false;
-  const expected = `sha256=${crypto.createHmac("sha256", secret).update(rawBody).digest("hex")}`;
-  const a = Buffer.from(expected);
-  const b = Buffer.from(header);
-  return a.length === b.length && crypto.timingSafeEqual(a, b);
-}
-
-export interface PushEvent {
-  repo: string;
-  /** Full ref, e.g. refs/heads/main. */
-  ref: string;
-  branch: string;
-  commit: string;
-  message: string | null;
-  pusher: string | null;
-}
-
-/** What we need out of a GitHub push payload, or null if it isn't one. */
-export function parsePush(payload: unknown): PushEvent | null {
-  if (!payload || typeof payload !== "object") return null;
-  const p = payload as Record<string, any>;
-  const repo = p.repository?.full_name;
-  const ref = p.ref;
-  const commit = p.after;
-  if (typeof repo !== "string" || typeof ref !== "string" || typeof commit !== "string") {
-    return null;
-  }
-  // A deleted branch reports all zeros and ships no tree.
-  if (/^0+$/.test(commit)) return null;
-  return {
-    repo,
-    ref,
-    branch: ref.replace(/^refs\/heads\//, ""),
-    commit,
-    message: typeof p.head_commit?.message === "string" ? p.head_commit.message : null,
-    pusher: typeof p.pusher?.name === "string" ? p.pusher.name : null,
-  };
-}
-
-/**
- * The repository at one commit, as a gzipped tarball.
- *
- * A token is only needed for a private repository. It is read from the
- * environment rather than taken as an argument so a caller cannot be tricked
- * into forwarding one somewhere else.
- */
-export async function fetchTarball(repo: string, commit: string): Promise<Buffer> {
-  if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) throw new Error(`refusing to fetch "${repo}"`);
-  if (!/^[0-9a-f]{7,40}$/i.test(commit)) throw new Error(`refusing to fetch commit "${commit}"`);
-
-  const headers: Record<string, string> = {
-    accept: "application/vnd.github+json",
-    "user-agent": "foldrun",
-    "x-github-api-version": "2022-11-28",
-  };
-  const token = process.env.GITHUB_TOKEN;
-  if (token) headers.authorization = `Bearer ${token}`;
-
-  const res = await fetch(`https://api.github.com/repos/${repo}/tarball/${commit}`, { headers });
-  if (!res.ok) {
-    throw new Error(
-      `GitHub returned ${res.status} for ${repo}@${commit.slice(0, 8)}` +
-        (res.status === 404 && !token
-          ? " — a private repository needs GITHUB_TOKEN set on the server"
-          : ""),
-    );
-  }
-
-  const buf = Buffer.from(await res.arrayBuffer());
-  if (buf.length > MAX_TARBALL) {
-    throw new Error(`${repo} is ${Math.round(buf.length / 1e6)}MB — too large to deploy`);
-  }
-  return buf;
-}

package/src/gitrepo.ts

@@ -1,439 +0,0 @@
-// A git repository per workspace — the platform as the remote.
-//
-//   git remote add foldrun https://app.foldrun.io/git/<tenant>/<workspace>.git
-//   git push foldrun main          → deploys, commit on record
-//   git clone …/<workspace>.git    → the workspace, with its whole history
-//
-// One bare repository per workspace on the data volume. Every change the
-// platform makes — a dashboard save, a deploy, a deletion — is a commit into
-// it, made with git's own plumbing against a scratch index so no working copy
-// is ever kept. Every change a person makes is a push into it. So there is
-// one history, it is real git, and anyone can take it away with `git clone`.
-//
-// This deliberately stops at being a remote. Pull requests, reviews and
-// issues are a forge, which is a product; GitHub and GitLab remain a fine
-// mirror for anyone who wants that on top.
-//
-// history.ts delegates here when a repository exists, so the History page,
-// the per-file panel and Observe's eval attribution all read git without
-// knowing it. The journal it kept before stays as the fallback for an install
-// without a git binary.
-
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { dataRoot } from "./paths.ts";
-import type { DiffOp, Revision, RevisionFile, RevisionSummary } from "./history.ts";
-
-const SAFE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,120}$/;
-const safe = (v: string, what: string) => {
-  if (!SAFE.test(v)) throw new Error(`illegal ${what}: ${v}`);
-  return v;
-};
-
-/** Where a workspace's bare repository lives. `@library` is the account shelf. */
-export function repoDir(tenant: string, scope: string): string {
-  safe(tenant, "tenant");
-  const name = scope === "@library" ? "_library" : safe(scope, "workspace");
-  return path.join(dataRoot(), tenant, ".git", `${name}.git`);
-}
-
-let gitChecked: boolean | null = null;
-/** Is there a git binary? Checked once; an install without one keeps the journal. */
-export function gitAvailable(): boolean {
-  if (gitChecked === null) {
-    gitChecked = spawnSync("git", ["--version"], { stdio: "ignore" }).status === 0;
-  }
-  return gitChecked;
-}
-
-function git(dir: string, args: string[], opts: { input?: string | Buffer; env?: Record<string, string> } = {}) {
-  const r = spawnSync("git", ["--git-dir", dir, ...args], {
-    input: opts.input,
-    env: { ...process.env, GIT_TERMINAL_PROMPT: "0", ...opts.env },
-    maxBuffer: 64 * 1024 * 1024,
-  });
-  if (r.status !== 0) {
-    throw new Error(`git ${args[0]} failed: ${(r.stderr?.toString() ?? "").trim().slice(0, 500)}`);
-  }
-  return r.stdout.toString();
-}
-
-export function repoExists(tenant: string, scope: string): boolean {
-  return fs.existsSync(path.join(repoDir(tenant, scope), "HEAD"));
-}
-
-/** Create the repository if it is not there. Idempotent. */
-export function ensureRepo(tenant: string, scope: string): string {
-  const dir = repoDir(tenant, scope);
-  if (!fs.existsSync(path.join(dir, "HEAD"))) {
-    fs.mkdirSync(path.dirname(dir), { recursive: true });
-    spawnSync("git", ["init", "--bare", "--quiet", "--initial-branch=main", dir], { stdio: "ignore" });
-    // Pushes over HTTP need this; it is the one config a bare remote wants.
-    git(dir, ["config", "http.receivepack", "true"]);
-  }
-  installHooks(dir);
-  return dir;
-}
-
-export function headSha(tenant: string, scope: string, ref = "refs/heads/main"): string | null {
-  if (!repoExists(tenant, scope)) return null;
-  const r = spawnSync("git", ["--git-dir", repoDir(tenant, scope), "rev-parse", "--verify", "--quiet", ref]);
-  return r.status === 0 ? r.stdout.toString().trim() : null;
-}
-
-/**
- * Apply a change set as one commit on main, using plumbing against a scratch
- * index seeded from HEAD. No working copy, no checkout: each changed path is
- * hashed straight from its content into the object store.
- *
- * Returns the new commit, or null when the tree did not change.
- */
-export function commitChanges(
-  tenant: string,
-  scope: string,
-  files: RevisionFile[],
-  meta: { by?: string; message?: string; at?: string } = {},
-): string | null {
-  const dir = ensureRepo(tenant, scope);
-  const parent = headSha(tenant, scope);
-  const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "foldrun-index-"));
-  const index = path.join(scratch, "index");
-  // update-index insists on a work tree even when every entry arrives as
-  // --cacheinfo and nothing on disk is read. The scratch directory is one.
-  const env = { GIT_INDEX_FILE: index, GIT_WORK_TREE: scratch };
-  try {
-    if (parent) git(dir, ["read-tree", parent], { env });
-    for (const f of files) {
-      if (f.after === null) {
-        if (parent) git(dir, ["update-index", "--force-remove", "--", f.path], { env });
-        continue;
-      }
-      const blob = git(dir, ["hash-object", "-w", "--stdin"], { input: f.after }).trim();
-      // Executable where code lives, matching what the writers chmod on disk.
-      const mode = /\.(py|sh|mjs|js|rb)$/.test(f.path) && /(^|\/)(scripts|tools)\//.test(f.path) ? "100755" : "100644";
-      git(dir, ["update-index", "--add", "--cacheinfo", `${mode},${blob},${f.path}`], { env });
-    }
-    const tree = git(dir, ["write-tree"], { env }).trim();
-    if (parent && git(dir, ["rev-parse", `${parent}^{tree}`]).trim() === tree) return null;
-
-    const who = meta.by ?? "system";
-    const email = who.includes("@") ? who : `${who}@foldrun`;
-    const name = who.includes("@") ? who.split("@")[0] : who;
-    const date = meta.at ? new Date(meta.at).toISOString() : new Date().toISOString();
-    const commit = git(
-      dir,
-      ["commit-tree", tree, ...(parent ? ["-p", parent] : []), "-m", meta.message ?? describe(files)],
-      {
-        env: {
-          GIT_AUTHOR_NAME: name, GIT_AUTHOR_EMAIL: email, GIT_AUTHOR_DATE: date,
-          GIT_COMMITTER_NAME: "foldrun", GIT_COMMITTER_EMAIL: "platform@foldrun", GIT_COMMITTER_DATE: date,
-        },
-      },
-    ).trim();
-    git(dir, ["update-ref", "refs/heads/main", commit, ...(parent ? [parent] : [])]);
-    return commit;
-  } finally {
-    fs.rmSync(scratch, { recursive: true, force: true });
-  }
-}
-
-function describe(files: RevisionFile[]): string {
-  if (files.length === 1) {
-    const f = files[0];
-    return `${f.before === null ? "created" : f.after === null ? "deleted" : "edited"} ${f.path}`;
-  }
-  return `changed ${files.length} files`;
-}
-
-// ------------------------------------------------------------------ reading
-
-const SEP = "";
-
-/** Commits on main, newest first, as the same summary the journal gave. */
-export function listCommits(
-  tenant: string,
-  scope: string,
-  opts: { forPath?: string; limit?: number; ref?: string } = {},
-): RevisionSummary[] {
-  if (!headSha(tenant, scope, opts.ref)) return [];
-  const dir = repoDir(tenant, scope);
-  const out = git(dir, [
-    "log",
-    opts.ref ?? "refs/heads/main",
-    `--max-count=${opts.limit ?? 200}`,
-    `--format=%H${SEP}%aI${SEP}%ae${SEP}%s`,
-    "--name-only",
-    ...(opts.forPath ? ["--", opts.forPath] : []),
-  ]);
-  const rows: RevisionSummary[] = [];
-  let current: RevisionSummary | null = null;
-  for (const line of out.split("\n")) {
-    if (line.includes(SEP)) {
-      const [id, at, by, message] = line.split(SEP);
-      current = { id, at, by: by.endsWith("@foldrun") ? by.replace(/@foldrun$/, "") : by, message, commit: id, paths: [] };
-      rows.push(current);
-    } else if (line.trim() && current) {
-      current.paths.push(line.trim());
-    }
-  }
-  return rows;
-}
-
-/** One commit in full: every changed file with its before and after. */
-export function readCommit(tenant: string, scope: string, sha: string, forPath?: string): Revision | null {
-  if (!repoExists(tenant, scope) || !/^[0-9a-f]{4,40}$/.test(sha)) return null;
-  const dir = repoDir(tenant, scope);
-  const head = spawnSync("git", ["--git-dir", dir, "rev-parse", "--verify", "--quiet", `${sha}^{commit}`]);
-  if (head.status !== 0) return null;
-  const full = head.stdout.toString().trim();
-  const [at, by, ...msg] = git(dir, ["log", "-1", `--format=%aI${SEP}%ae${SEP}%s`, full]).trim().split(SEP);
-  const hasParent = spawnSync("git", ["--git-dir", dir, "rev-parse", "--verify", "--quiet", `${full}^`]).status === 0;
-  const names = git(dir, [
-    "diff-tree", "--no-commit-id", "--name-status", "-r", "--root", full,
-    ...(forPath ? ["--", forPath] : []),
-  ]);
-  const files: RevisionFile[] = [];
-  for (const line of names.split("\n").filter(Boolean)) {
-    const [status, p] = line.split("\t");
-    const before = status === "A" || !hasParent ? null : blob(dir, `${full}^`, p);
-    const after = status === "D" ? null : blob(dir, full, p);
-    files.push({ path: p, before, after });
-  }
-  return {
-    id: full,
-    at,
-    by: by.endsWith("@foldrun") ? by.replace(/@foldrun$/, "") : by,
-    message: msg.join(SEP),
-    commit: full,
-    files,
-  };
-}
-
-function blob(dir: string, rev: string, p: string): string | null {
-  const r = spawnSync("git", ["--git-dir", dir, "show", `${rev}:${p}`], { maxBuffer: 64 * 1024 * 1024 });
-  return r.status === 0 ? r.stdout.toString() : null;
-}
-
-export interface RefInfo {
-  name: string;
-  sha: string;
-  /** Commit subject and time, for a branch list that says what each is. */
-  subject: string;
-  at: string;
-}
-
-export function listRefs(tenant: string, scope: string, kind: "heads" | "tags"): RefInfo[] {
-  if (!repoExists(tenant, scope)) return [];
-  const out = git(repoDir(tenant, scope), [
-    "for-each-ref", `refs/${kind}`, "--sort=-committerdate",
-    `--format=%(refname:short)${SEP}%(objectname)${SEP}%(subject)${SEP}%(committerdate:iso-strict)`,
-  ]);
-  return out.split("\n").filter(Boolean).map((l) => {
-    const [name, sha, subject, at] = l.split(SEP);
-    return { name, sha, subject, at };
-  });
-}
-
-/**
- * The commit a restore means by `to`, on main's history:
- *
- *   a sha or a prefix of one      that commit
- *   a branch or tag name          where it points
- *   an ISO date or time           the last commit on main at or before it
- *   "3d", "12h", "90m", "2w"      the same, that long ago
- *
- * Null when nothing matches — before the first commit, or a name that is
- * not there. Throws on a `to` that cannot be any of these, so a typo is a
- * 400 rather than a silent "nothing found".
- */
-export function resolveRestorePoint(
-  tenant: string,
-  scope: string,
-  to: string,
-  now = Date.now(),
-): { sha: string; at: string; by: string; message: string } | null {
-  const t = to.trim();
-  if (!t || t.startsWith("-")) throw Object.assign(new Error(`not a revision or a time: ${to}`), { status: 400 });
-  if (!headSha(tenant, scope)) return null;
-  const dir = repoDir(tenant, scope);
-  let sha: string | null = null;
-  const rel = /^(\d+)\s*(m|h|d|w)$/.exec(t);
-  const moment = rel
-    ? now - Number(rel[1]) * { m: 60_000, h: 3_600_000, d: 86_400_000, w: 604_800_000 }[rel[2] as "m" | "h" | "d" | "w"]
-    : /^\d{4}-\d{2}-\d{2}/.test(t)
-      ? Date.parse(t)
-      : null;
-  if (moment !== null) {
-    if (Number.isNaN(moment)) throw Object.assign(new Error(`not a date: ${to}`), { status: 400 });
-    sha = git(dir, ["log", "-1", "--format=%H", `--until=@${Math.floor(moment / 1000)}`, "refs/heads/main"]).trim() || null;
-  } else {
-    if (!/^[A-Za-z0-9][A-Za-z0-9._/-]{0,120}$/.test(t)) throw Object.assign(new Error(`not a revision or a time: ${to}`), { status: 400 });
-    for (const ref of [/^[0-9a-f]{4,40}$/.test(t) ? `${t}^{commit}` : null, `refs/heads/${t}^{commit}`, `refs/tags/${t}^{commit}`]) {
-      if (!ref) continue;
-      const r = spawnSync("git", ["--git-dir", dir, "rev-parse", "--verify", "--quiet", ref]);
-      if (r.status === 0) {
-        sha = r.stdout.toString().trim();
-        break;
-      }
-    }
-  }
-  if (!sha) return null;
-  const [at, by, ...msg] = git(dir, ["log", "-1", `--format=%cI${SEP}%ae${SEP}%s`, sha]).trim().split(SEP);
-  return { sha, at, by: by.endsWith("@foldrun") ? by.replace(/@foldrun$/, "") : by, message: msg.join(SEP) };
-}
-
-/** The files at a commit, for a browser or a deploy. */
-export function listTree(tenant: string, scope: string, ref = "refs/heads/main"): { path: string; mode: string }[] {
-  if (!headSha(tenant, scope, ref)) return [];
-  return git(repoDir(tenant, scope), ["ls-tree", "-r", "--format=%(objectmode) %(path)", ref])
-    .split("\n")
-    .filter(Boolean)
-    .map((l) => {
-      const [mode, ...rest] = l.split(" ");
-      return { mode, path: rest.join(" ") };
-    });
-}
-
-export function readBlob(tenant: string, scope: string, ref: string, p: string): string | null {
-  if (!repoExists(tenant, scope)) return null;
-  return blob(repoDir(tenant, scope), ref, p);
-}
-
-/** The whole tree at a ref as deploy files — what a push turns into a workspace. */
-export function filesAt(tenant: string, scope: string, ref: string): { path: string; content: string }[] {
-  const dir = repoDir(tenant, scope);
-  return listTree(tenant, scope, ref).flatMap((t) => {
-    const content = blob(dir, ref, t.path);
-    return content === null ? [] : [{ path: t.path, content }];
-  });
-}
-
-/**
- * What a ref would change on main: every file that differs, with both sides.
- * The branch's own commits are `listCommits({ ref })`; this is the net
- * effect, which is what a reviewer reads.
- */
-export function diffRefs(tenant: string, scope: string, base: string, head: string): RevisionFile[] {
-  if (!headSha(tenant, scope, base) || !headSha(tenant, scope, head)) return [];
-  const dir = repoDir(tenant, scope);
-  const out = git(dir, ["diff", "--name-status", `${base}...${head}`]);
-  return out.split("\n").filter(Boolean).map((line) => {
-    const [status, p] = line.split("\t");
-    return {
-      path: p,
-      before: status === "A" ? null : blob(dir, base, p),
-      after: status === "D" ? null : blob(dir, head, p),
-    };
-  });
-}
-
-/**
- * Merge a branch into main and return the new main. A fast-forward when it
- * is one; otherwise a merge commit whose tree is the BRANCH's — the branch
- * is what the person reviewed and chose, and a three-way textual merge of
- * markdown with no one to resolve conflicts would deploy text nobody wrote.
- * Both parents are recorded, so history shows the merge for what it was.
- */
-export function mergeBranch(
-  tenant: string,
-  scope: string,
-  branch: string,
-  meta: { by?: string } = {},
-): { sha: string; fastForward: boolean } {
-  const dir = repoDir(tenant, scope);
-  const main = headSha(tenant, scope);
-  const head = headSha(tenant, scope, `refs/heads/${safe(branch, "branch")}`);
-  if (!head) throw new Error(`no branch "${branch}"`);
-  if (!main) {
-    git(dir, ["update-ref", "refs/heads/main", head]);
-    return { sha: head, fastForward: true };
-  }
-  const isAncestor = spawnSync("git", ["--git-dir", dir, "merge-base", "--is-ancestor", main, head]).status === 0;
-  if (isAncestor) {
-    git(dir, ["update-ref", "refs/heads/main", head, main]);
-    return { sha: head, fastForward: true };
-  }
-  const tree = git(dir, ["rev-parse", `${head}^{tree}`]).trim();
-  const who = meta.by ?? "foldrun";
-  const email = who.includes("@") ? who : `${who}@foldrun`;
-  const name = who.includes("@") ? who.split("@")[0] : who;
-  const date = new Date().toISOString();
-  const sha = git(dir, ["commit-tree", tree, "-p", main, "-p", head, "-m", `merge ${branch} into main`], {
-    env: {
-      GIT_AUTHOR_NAME: name, GIT_AUTHOR_EMAIL: email, GIT_AUTHOR_DATE: date,
-      GIT_COMMITTER_NAME: "foldrun", GIT_COMMITTER_EMAIL: "platform@foldrun", GIT_COMMITTER_DATE: date,
-    },
-  }).trim();
-  git(dir, ["update-ref", "refs/heads/main", sha, main]);
-  return { sha, fastForward: false };
-}
-
-export function deleteBranch(tenant: string, scope: string, branch: string) {
-  if (branch === "main") throw new Error("main is the default branch");
-  git(repoDir(tenant, scope), ["update-ref", "-d", `refs/heads/${safe(branch, "branch")}`]);
-}
-
-/** Push main to another remote — a GitHub or GitLab mirror. Blocking; callers
- *  run it off the request path. The token never touches disk: it is in the
- *  URL for this one process and nowhere else. */
-export function pushMirror(tenant: string, scope: string, url: string): { ok: boolean; detail: string } {
-  if (!headSha(tenant, scope)) return { ok: false, detail: "nothing to push yet" };
-  const r = spawnSync("git", ["--git-dir", repoDir(tenant, scope), "push", "--quiet", url, "+refs/heads/main:refs/heads/main"], {
-    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
-    timeout: 60_000,
-  });
-  const detail = (r.stderr?.toString() ?? "").trim()
-    // Never echo the URL back: it carries the token.
-    .replaceAll(url, "<mirror>")
-    .slice(0, 500);
-  return { ok: r.status === 0, detail: r.status === 0 ? "pushed" : detail || "push failed" };
-}
-
-/**
- * Where the compiled pre-receive check is, found on disk rather than through
- * require.resolve — a bundler rewrites require.resolve("pkg") into a module
- * id, and the hook was once told to run a script called "51113". Searched
- * from the working directory upward: the monorepo layout, then an installed
- * package. Empty when there is no compiled check (a dev server on the source
- * tree), in which case a push is checked at deploy instead of refused — the
- * same rules, one step later.
- */
-export function hookScriptPath(): string {
-  let dir = process.cwd();
-  for (let i = 0; i < 6; i++) {
-    for (const rel of ["packages/core/dist/src/git-hook.js", "node_modules/@foldrun/core/dist/src/git-hook.js"]) {
-      const candidate = path.join(dir, rel);
-      if (fs.existsSync(candidate)) return candidate;
-    }
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return "";
-}
-
-/**
- * The pre-receive hook: a push that fails the deploy checks is refused with
- * the errors in the pusher's terminal, instead of accepted and then not
- * deployed. The hook shells out to node with the compiled check, so it runs
- * the same rules as a dashboard deploy; which node and which script are
- * passed in the environment by the HTTP route, because a hook inherits git's
- * environment and nothing else.
- */
-export function installHooks(dir: string) {
-  const hooks = path.join(dir, "hooks");
-  fs.mkdirSync(hooks, { recursive: true });
-  const hook = path.join(hooks, "pre-receive");
-  const script = `#!/bin/sh
-# Installed by foldrun. Refuses a push to main whose tree fails the checks.
-[ -n "$FOLDRUN_HOOK_NODE" ] && [ -n "$FOLDRUN_HOOK_SCRIPT" ] || exit 0
-exec "$FOLDRUN_HOOK_NODE" "$FOLDRUN_HOOK_SCRIPT"
-`;
-  if (!fs.existsSync(hook) || fs.readFileSync(hook, "utf8") !== script) {
-    fs.writeFileSync(hook, script, { mode: 0o755 });
-  }
-}
-
-export { type DiffOp };