@getmonoceros/workbench 1.13.1 → 1.13.3

package/dist/bin.js

@@ -129,19 +129,19 @@ function wrapText(text, width, continuationIndent) {
   if (current.length > 0) lines.push(current.replace(/\s+$/, ""));
   return lines.map((l, i) => i === 0 ? l : continuationIndent + l).join("\n");
 }
-function alignTable(rows, indent) {
+function alignTable(rows, indent, opts = {}) {
   if (rows.length === 0) return "";
-  const labelWidth = Math.max(...rows.map((r) => visibleLen(r[0])));
+  const labelWidth = opts.fixedLabelWidth ?? Math.max(...rows.map((r) => visibleLen(r[0])));
   const gutter = "    ";
   const descWidth = terminalWidth() - indent.length - labelWidth - gutter.length;
   const continuationIndent = " ".repeat(
     indent.length + labelWidth + gutter.length
   );
   return rows.map(([left, right]) => {
-    const pad = " ".repeat(labelWidth - visibleLen(left));
+    const pad = " ".repeat(Math.max(0, labelWidth - visibleLen(left)));
     const wrapped = wrapText(right, descWidth, continuationIndent);
     return `${indent}${left}${pad}${gutter}${wrapped}`;
-  }).join("\n");
+  }).join(opts.rowGap ? "\n\n" : "\n");
 }
 function collectSubCommands(cmd) {
   const subs = cmd.subCommands ?? {};
@@ -167,6 +167,7 @@ function renderCommandsBlock(entries) {
     arr.push(entry2);
     byGroup.set(entry2.group, arr);
   }
+  const labelWidth = Math.max(...entries.map((e) => visibleLen(cyan(e.name))));
   const renderSection = (label, items) => {
     if (items.length === 0) return;
     lines.push("");
@@ -176,7 +177,9 @@ function renderCommandsBlock(entries) {
       cyan(e.name),
       e.description
     ]);
-    lines.push(alignTable(rows, ""));
+    lines.push(
+      alignTable(rows, "", { fixedLabelWidth: labelWidth, rowGap: true })
+    );
   };
   for (const { key, label } of GROUPS) {
     renderSection(label, byGroup.get(key) ?? []);
@@ -251,25 +254,25 @@ function detectHelpRequest(argv, main2) {
   const separatorIdx = argv.indexOf("--");
   if (helpIdx === -1) return null;
   if (separatorIdx !== -1 && separatorIdx < helpIdx) return null;
-  const path21 = [];
+  const path20 = [];
   const tokens = argv.slice(
     0,
     separatorIdx === -1 ? argv.length : separatorIdx
   );
   let cursor = main2;
   const mainName = (main2.meta ?? {}).name ?? "monoceros";
-  path21.push(mainName);
+  path20.push(mainName);
   for (const tok of tokens) {
     if (tok.startsWith("-")) continue;
     const subs = cursor.subCommands ?? {};
     if (tok in subs) {
       cursor = subs[tok];
-      path21.push(tok);
+      path20.push(tok);
       continue;
     }
     break;
   }
-  return { path: path21, cmd: cursor };
+  return { path: path20, cmd: cursor };
 }
 async function maybeRenderHelp(argv, main2) {
   const hit = detectHelpRequest(argv, main2);
@@ -356,13 +359,12 @@ var FeatureEntrySchema = z.object({
   options: z.record(z.string(), FeatureOptionValueSchema).optional()
 });
 var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function isValidEmail(value) {
+  return EMAIL_RE.test(value);
+}
 var GitUserSchema = z.object({
   name: z.union([z.literal(""), z.null(), z.string().min(1)]).nullish().transform((v) => typeof v === "string" && v.length > 0 ? v : void 0),
-  email: z.union([
-    z.literal(""),
-    z.null(),
-    z.string().regex(EMAIL_RE, "Invalid email")
-  ]).nullish().transform((v) => typeof v === "string" && v.length > 0 ? v : void 0)
+  email: z.union([z.literal(""), z.null(), z.string().min(1)]).nullish().transform((v) => typeof v === "string" && v.length > 0 ? v : void 0)
 });
 var RepoEntrySchema = z.object({
   url: z.string().regex(
@@ -717,6 +719,23 @@ function interpolateServices(services, vars) {
   });
   return { services: resolved, missing };
 }
+var GIT_IDENTITY_VAR = {
+  name: "GIT_USER_NAME",
+  email: "GIT_USER_EMAIL"
+};
+function hasVarPlaceholder(value) {
+  return /\$\{[A-Za-z_][A-Za-z0-9_]*\}/.test(value);
+}
+function resolveGitUserFields(user, vars) {
+  const resolve = (raw) => {
+    if (raw === void 0) return {};
+    const r = interpolate(raw, vars);
+    if (r.missing.length > 0) return {};
+    const trimmed = r.value.trim();
+    return trimmed.length > 0 ? { value: trimmed } : {};
+  };
+  return { name: resolve(user.name), email: resolve(user.email) };
+}
 function interpolateFeatures(features, vars) {
   const missing = [];
   const out = {};
@@ -1362,7 +1381,15 @@ var MonocerosConfigSchema = z2.object({
     // `git: null` for an empty mapping, which zod's plain
     // `.optional()` would reject.
     git: z2.object({
-      user: GitUserSchema.optional()
+      // Strict email here: monoceros-config defaults are not tied to
+      // any container `<name>.env`, so `${VAR}` placeholders make no
+      // sense and the format can (and should) be validated at load
+      // time — unlike the container/repo `git.user`, which defers to
+      // apply after interpolation.
+      user: GitUserSchema.optional().refine(
+        (u) => u?.email === void 0 || isValidEmail(u.email),
+        { message: "Invalid email in defaults.git.user", path: ["email"] }
+      )
     }).nullish(),
     // .nullish() for the same reason as `git` — the sample keeps
     // `features:` uncommented as a category marker.
@@ -2823,6 +2850,17 @@ function setContainerGitUserInDoc(doc, user) {
   relocateLeakedSectionComments(doc);
   return true;
 }
+function ensureContainerGitUserPlaceholder(doc) {
+  const gitNode = doc.get("git", true);
+  if (gitNode && isMap2(gitNode)) {
+    const userNode = gitNode.get("user", true);
+    if (userNode && isMap2(userNode)) return false;
+  }
+  return setContainerGitUserInDoc(doc, {
+    name: `\${${GIT_IDENTITY_VAR.name}}`,
+    email: `\${${GIT_IDENTITY_VAR.email}}`
+  });
+}
 function relocateLeakedSectionComments(doc) {
   const root = doc.contents;
   if (!root || !isMap2(root)) return;
@@ -3132,8 +3170,8 @@ function removeRepoFromDoc(doc, urlOrPath) {
     if (!isMap2(item)) return false;
     const url = item.get("url");
     if (url === urlOrPath) return true;
-    const path21 = item.get("path");
-    const effectivePath = typeof path21 === "string" ? path21 : typeof url === "string" ? deriveRepoName(url) : void 0;
+    const path20 = item.get("path");
+    const effectivePath = typeof path20 === "string" ? path20 : typeof url === "string" ? deriveRepoName(url) : void 0;
     return effectivePath === urlOrPath;
   });
   if (idx < 0) return false;
@@ -3226,7 +3264,7 @@ async function runAddRepo(input) {
       "Missing repo URL. Usage: monoceros add-repo <containername> <url>."
     );
   }
-  const path21 = (input.path ?? deriveRepoName(url)).trim();
+  const path20 = (input.path ?? deriveRepoName(url)).trim();
   const hasName = typeof input.gitName === "string" && input.gitName.trim().length > 0;
   const hasEmail = typeof input.gitEmail === "string" && input.gitEmail.trim().length > 0;
   if (hasName !== hasEmail) {
@@ -3234,6 +3272,14 @@ async function runAddRepo(input) {
       "--git-name and --git-email must be set together. Pass both, or neither."
     );
   }
+  if (hasEmail) {
+    const email = input.gitEmail.trim();
+    if (!isValidEmail(email) && !hasVarPlaceholder(email)) {
+      throw new Error(
+        `Invalid --git-email '${email}': must be a valid email or a \${VAR} placeholder resolved from <name>.env.`
+      );
+    }
+  }
   const explicitProvider = normalizeProvider(input.provider);
   let host;
   try {
@@ -3255,7 +3301,7 @@ async function runAddRepo(input) {
   const providerToWrite = !canonical && explicitProvider ? explicitProvider : void 0;
   const entry2 = {
     url,
-    path: path21,
+    path: path20,
     ...hasName && hasEmail ? {
       gitUser: {
         name: input.gitName.trim(),
@@ -3264,7 +3310,23 @@ async function runAddRepo(input) {
     } : {},
     ...providerToWrite ? { provider: providerToWrite } : {}
   };
-  const result = await mutate(input, (doc) => addRepoToDoc(doc, entry2));
+  let gitUserScaffolded = false;
+  const result = await mutate(input, (doc) => {
+    const repoAdded = addRepoToDoc(doc, entry2);
+    if (repoAdded) gitUserScaffolded = ensureContainerGitUserPlaceholder(doc);
+    return repoAdded;
+  });
+  if (result.status === "updated" && gitUserScaffolded) {
+    const home = input.monocerosHome ?? monocerosHome();
+    await ensureEnvGitignored(containerConfigsDir(home));
+    await ensureEnvVars(containerEnvPath(input.name, home), input.name, [
+      GIT_IDENTITY_VAR.name,
+      GIT_IDENTITY_VAR.email
+    ]);
+    (input.logger ?? defaultLogger()).info(
+      `Added a container git.user with \${${GIT_IDENTITY_VAR.name}}/\${${GIT_IDENTITY_VAR.email}} placeholders and seeded ${input.name}.env \u2014 fill them or leave blank to use your global git identity.`
+    );
+  }
   if (result.status === "updated") {
     await tryCloneInRunningContainer(input, entry2);
   }
@@ -4078,7 +4140,7 @@ var addServiceCommand = defineCommand7({
 import { defineCommand as defineCommand8 } from "citty";
 
 // src/apply/index.ts
-import { existsSync as existsSync8, promises as fs12 } from "fs";
+import { existsSync as existsSync7, promises as fs11 } from "fs";
 import { consola as consola11 } from "consola";
 
 // src/config/state.ts
@@ -4520,230 +4582,11 @@ function runLogs(opts) {
   );
 }
 
-// src/devcontainer/repo-reachability.ts
-import { spawn as spawn6 } from "child_process";
-var realGitLsRemote = (url) => {
-  return new Promise((resolve, reject) => {
-    const child = spawn6("git", ["ls-remote", "--heads", "--", url], {
-      stdio: ["ignore", "pipe", "pipe"],
-      env: {
-        ...process.env,
-        GIT_TERMINAL_PROMPT: "0"
-      }
-    });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.on("data", (chunk) => {
-      stdout += chunk.toString();
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk.toString();
-    });
-    child.on("error", reject);
-    child.on(
-      "exit",
-      (code) => resolve({ stdout, stderr, exitCode: code ?? 0 })
-    );
-  });
-};
-function classifyStderr(stderr) {
-  const s = stderr.toLowerCase();
-  if (s.includes("could not resolve host") || s.includes("name or service not known") || s.includes("temporary failure in name resolution") || s.includes("no address associated with hostname")) {
-    return "dns";
-  }
-  if (s.includes("repository not found") || s.includes("may not have access") || s.includes("no longer exists") || s.includes("don't have permission") || s.includes("could not be found") || s.includes("the requested url returned error: 404")) {
-    return "not-found-or-no-access";
-  }
-  if (s.includes("authentication failed") || s.includes("could not read username") || s.includes("incorrect username or password") || s.includes("the requested url returned error: 401") || s.includes("the requested url returned error: 403")) {
-    return "auth-failed";
-  }
-  return "unknown";
-}
-async function checkRepoReachability(repos, options = {}) {
-  const spawnFn = options.spawn ?? realGitLsRemote;
-  const results = [];
-  for (const repo of repos) {
-    let result;
-    try {
-      result = await spawnFn(repo.url);
-    } catch (err) {
-      results.push({
-        url: repo.url,
-        ok: false,
-        kind: "unknown",
-        detail: err instanceof Error ? err.message : String(err)
-      });
-      continue;
-    }
-    if (result.exitCode === 0) {
-      results.push({ url: repo.url, ok: true, detail: "" });
-      continue;
-    }
-    results.push({
-      url: repo.url,
-      ok: false,
-      kind: classifyStderr(result.stderr),
-      detail: result.stderr.trim()
-    });
-  }
-  return results;
-}
-function formatUnreachableReposError(failures) {
-  const byKind = /* @__PURE__ */ new Map();
-  for (const f of failures) {
-    const kind = f.kind ?? "unknown";
-    const list = byKind.get(kind) ?? [];
-    list.push(f);
-    byKind.set(kind, list);
-  }
-  const totalUrls = failures.length;
-  const lines = [
-    totalUrls === 1 ? `Cannot reach declared repo: ${failures[0].url}` : `Cannot reach ${totalUrls} declared repos:`,
-    ""
-  ];
-  const sectionOrder = [
-    "not-found-or-no-access",
-    "auth-failed",
-    "dns",
-    "unknown"
-  ];
-  for (const kind of sectionOrder) {
-    const entries = byKind.get(kind);
-    if (!entries || entries.length === 0) continue;
-    lines.push(headerForKind(kind));
-    for (const e of entries) {
-      lines.push(`  \u2022 ${e.url}`);
-      if (e.detail) {
-        for (const detailLine of e.detail.split("\n")) {
-          const trimmed = detailLine.trim();
-          if (trimmed) lines.push(`      git: ${trimmed}`);
-        }
-      }
-    }
-    for (const advice of adviceForKind(kind)) {
-      lines.push(`    - ${advice}`);
-    }
-    lines.push("");
-  }
-  lines.push(`Then re-run ${cyan2("monoceros apply")}.`);
-  return lines.join("\n");
-}
-function headerForKind(kind) {
-  switch (kind) {
-    case "not-found-or-no-access":
-      return "Repository not found (or your credentials don't grant access):";
-    case "auth-failed":
-      return "Authentication failed (credentials are present but rejected):";
-    case "dns":
-      return "Host unreachable (DNS / VPN / offline \u2014 git couldn't resolve the hostname):";
-    case "unknown":
-      return "Unrecognised git error:";
-  }
-}
-function adviceForKind(kind) {
-  switch (kind) {
-    case "not-found-or-no-access":
-      return [
-        "Re-check the URL for typos (case-sensitive on most hosts).",
-        "Verify the repo still exists / is not archived in a way that hides it.",
-        "Ensure your token covers this org / workspace and has read scope (GitHub: `repo`; GitLab: `read_repository`; Bitbucket: repo read)."
-      ];
-    case "auth-failed":
-      return [
-        "Token may be expired or revoked \u2014 regenerate it from the provider UI.",
-        "Re-run the provider CLI login (gh auth login / glab auth login) \u2014 Monoceros picks up the refreshed token on the next apply."
-      ];
-    case "dns":
-      return [
-        "Check your internet / VPN \u2014 corporate Git hosts often require VPN.",
-        "Verify the hostname spelling in the yml."
-      ];
-    case "unknown":
-      return [
-        "Run `git ls-remote <url>` manually on the host to see the raw error."
-      ];
-  }
-}
-
-// src/devcontainer/repo-clone.ts
-import { spawn as spawn7 } from "child_process";
-import { existsSync as existsSync7, promises as fs10 } from "fs";
-import path13 from "path";
-var realGitClone = (url, dest) => {
-  return new Promise((resolve, reject) => {
-    const child = spawn7("git", ["clone", "--", url, dest], {
-      stdio: ["ignore", "pipe", "pipe"],
-      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
-    });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.on("data", (c) => {
-      stdout += c.toString();
-    });
-    child.stderr.on("data", (c) => {
-      stderr += c.toString();
-    });
-    child.on("error", reject);
-    child.on(
-      "exit",
-      (code) => resolve({ stdout, stderr, exitCode: code ?? 0 })
-    );
-  });
-};
-async function cloneReposHostSide(containerRoot, repos, options = {}) {
-  const spawnFn = options.spawn ?? realGitClone;
-  const results = [];
-  for (const repo of repos) {
-    const dest = path13.join(containerRoot, "projects", repo.path);
-    if (existsSync7(dest)) {
-      results.push({ path: repo.path, url: repo.url, status: "skipped" });
-      continue;
-    }
-    await fs10.mkdir(path13.dirname(dest), { recursive: true });
-    let r;
-    try {
-      r = await spawnFn(repo.url, dest);
-    } catch (err) {
-      results.push({
-        path: repo.path,
-        url: repo.url,
-        status: "failed",
-        detail: err instanceof Error ? err.message : String(err)
-      });
-      continue;
-    }
-    results.push(
-      r.exitCode === 0 ? { path: repo.path, url: repo.url, status: "cloned" } : {
-        path: repo.path,
-        url: repo.url,
-        status: "failed",
-        detail: r.stderr.trim()
-      }
-    );
-  }
-  return results;
-}
-function formatCloneFailuresError(failures) {
-  const lines = failures.length === 1 ? [`Failed to clone declared repo: ${failures[0].url}`, ""] : [`Failed to clone ${failures.length} declared repos:`, ""];
-  for (const f of failures) {
-    lines.push(`  \u2022 ${f.url} \u2192 projects/${f.path}`);
-    if (f.detail) lines.push(`    ${f.detail}`);
-  }
-  lines.push("");
-  lines.push(
-    "Reachability was confirmed earlier, so this is usually a local issue"
-  );
-  lines.push(
-    "(disk space, a leftover non-empty target dir). Fix it and re-run " + cyan2("monoceros apply") + "."
-  );
-  return lines.join("\n");
-}
-
 // src/devcontainer/docker-mode.ts
-import { spawn as spawn8 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 var realDockerInfo = () => {
   return new Promise((resolve, reject) => {
-    const child = spawn8(
+    const child = spawn6(
       "docker",
       ["info", "--format", "{{json .SecurityOptions}}"],
       {
@@ -4802,13 +4645,13 @@ function formatRootlessNotSupportedError() {
 }
 
 // src/devcontainer/identity.ts
-import { spawn as spawn9 } from "child_process";
-import { promises as fs11 } from "fs";
-import path14 from "path";
+import { spawn as spawn7 } from "child_process";
+import { promises as fs10 } from "fs";
+import path13 from "path";
 import { consola as consola10 } from "consola";
 var realGitConfigGet = (key) => {
   return new Promise((resolve, reject) => {
-    const child = spawn9("git", ["config", "--global", "--get", key], {
+    const child = spawn7("git", ["config", "--global", "--get", key], {
       stdio: ["ignore", "pipe", "inherit"]
     });
     let stdout = "";
@@ -4918,8 +4761,8 @@ async function resolveIdentityWithPrompt(options = {}) {
   };
 }
 async function collectGitIdentity(devContainerRoot, options = {}) {
-  const gitconfigDir = path14.join(devContainerRoot, ".monoceros");
-  const gitconfigPath = path14.join(gitconfigDir, "gitconfig");
+  const gitconfigDir = path13.join(devContainerRoot, ".monoceros");
+  const gitconfigPath = path13.join(gitconfigDir, "gitconfig");
   const logger = options.logger ?? { info: () => {
   }, warn: () => {
   } };
@@ -4932,8 +4775,8 @@ async function collectGitIdentity(devContainerRoot, options = {}) {
   const lines = ["[user]"];
   if (resolved.name !== void 0) lines.push(`	name = ${resolved.name}`);
   if (resolved.email !== void 0) lines.push(`	email = ${resolved.email}`);
-  await fs11.mkdir(gitconfigDir, { recursive: true });
-  await fs11.writeFile(gitconfigPath, lines.join("\n") + "\n");
+  await fs10.mkdir(gitconfigDir, { recursive: true });
+  await fs10.writeFile(gitconfigPath, lines.join("\n") + "\n");
   return {
     ...resolved.name !== void 0 ? { name: resolved.name } : {},
     ...resolved.email !== void 0 ? { email: resolved.email } : {},
@@ -4976,7 +4819,7 @@ async function readKeyFromHost(spawnFn, key, logger) {
 }
 async function readExistingGitconfig(filePath) {
   try {
-    const content = await fs11.readFile(filePath, "utf8");
+    const content = await fs10.readFile(filePath, "utf8");
     const result = {};
     const nameMatch = /^\s*name\s*=\s*(.+?)\s*$/m.exec(content);
     const emailMatch = /^\s*email\s*=\s*(.+?)\s*$/m.exec(content);
@@ -5009,7 +4852,7 @@ ${sectionLine(label)}
     );
   }
   const ymlPath = containerConfigPath(opts.name, home);
-  if (!existsSync8(ymlPath)) {
+  if (!existsSync7(ymlPath)) {
     throw new Error(
       `No such config: ${ymlPath}. Run \`monoceros init <template> ${opts.name}\` first.`
     );
@@ -5040,6 +4883,44 @@ ${sectionLine(label)}
   }
   createOpts.services = interpServices.services;
   if (createOpts.features) createOpts.features = interpFeatures.features;
+  const gitUserErrors = [];
+  let containerGitOverride;
+  if (parsed.config.git?.user) {
+    const f = resolveGitUserFields(parsed.config.git.user, envVars);
+    if (f.email.value !== void 0 && !isValidEmail(f.email.value)) {
+      gitUserErrors.push(
+        `git.user.email resolved to "${f.email.value}", which is not a valid email`
+      );
+    }
+    const override2 = {
+      ...f.name.value !== void 0 ? { name: f.name.value } : {},
+      ...f.email.value !== void 0 ? { email: f.email.value } : {}
+    };
+    if (Object.keys(override2).length > 0) containerGitOverride = override2;
+  }
+  for (const repo of createOpts.repos ?? []) {
+    if (!repo.gitUser) continue;
+    const f = resolveGitUserFields(repo.gitUser, envVars);
+    if (f.name.value === void 0 || f.email.value === void 0) {
+      delete repo.gitUser;
+      continue;
+    }
+    if (!isValidEmail(f.email.value)) {
+      gitUserErrors.push(
+        `repos[${repo.path}].git.user.email resolved to "${f.email.value}", which is not a valid email`
+      );
+      continue;
+    }
+    repo.gitUser = { name: f.name.value, email: f.email.value };
+  }
+  if (gitUserErrors.length > 0) {
+    throw new Error(
+      `Invalid git identity after resolving ${prettyPath(envPath)}:
+` + gitUserErrors.map((e) => `  - ${e}`).join("\n") + `
+
+Fix the value in the env file (or the yml).`
+    );
+  }
   validateOptions(createOpts);
   logger.success(`yml validated ${dim(`(${prettyPath(ymlPath)})`)}`);
   const hasRepos = (createOpts.repos ?? []).length > 0;
@@ -5054,7 +4935,7 @@ ${sectionLine(label)}
       ...opts.identitySpawn ? { spawn: opts.identitySpawn } : {},
       ...opts.identityPrompt ? { prompt: opts.identityPrompt } : {},
       ...opts.identityScopePrompt ? { scopePrompt: opts.identityScopePrompt } : {},
-      ...parsed.config.git?.user ? { containerOverride: parsed.config.git.user } : {},
+      ...containerGitOverride ? { containerOverride: containerGitOverride } : {},
       ...globalConfig?.defaults?.git?.user ? { defaults: globalConfig.defaults.git.user } : {},
       logger: idLogger
     });
@@ -5077,16 +4958,6 @@ ${sectionLine(label)}
       throw new Error(formatMissingCredentialsError(missing));
     }
   }
-  const declaredRepos = createOpts.repos ?? [];
-  if (declaredRepos.length > 0) {
-    const reachability = await checkRepoReachability(declaredRepos, {
-      ...opts.reachabilitySpawn ? { spawn: opts.reachabilitySpawn } : {}
-    });
-    const unreachable = reachability.filter((r) => !r.ok);
-    if (unreachable.length > 0) {
-      throw new Error(formatUnreachableReposError(unreachable));
-    }
-  }
   section("Scaffold");
   const dockerMode = await detectDockerMode({
     ...opts.dockerInfoSpawn ? { spawn: opts.dockerInfoSpawn } : {}
@@ -5094,7 +4965,7 @@ ${sectionLine(label)}
   if (dockerMode === "rootless") {
     throw new Error(formatRootlessNotSupportedError());
   }
-  await fs12.mkdir(targetDir, { recursive: true });
+  await fs11.mkdir(targetDir, { recursive: true });
   await writeScaffold(createOpts, targetDir, { dockerMode });
   await writeStateFile(
     targetDir,
@@ -5105,23 +4976,6 @@ ${sectionLine(label)}
     })
   );
   logger.success(`materialized into ${prettyPath(targetDir)}`);
-  const reposToClone = createOpts.repos ?? [];
-  if (reposToClone.length > 0) {
-    const cloneResults = await cloneReposHostSide(targetDir, reposToClone, {
-      ...opts.cloneSpawn ? { spawn: opts.cloneSpawn } : {}
-    });
-    for (const r of cloneResults) {
-      if (r.status === "cloned") {
-        logger.success(`cloned ${cyan2(r.path)} ${dim(`(${r.url})`)}`);
-      } else if (r.status === "skipped") {
-        logger.info(`projects/${r.path} already present \u2014 skipped clone`);
-      }
-    }
-    const cloneFailures = cloneResults.filter((r) => r.status === "failed");
-    if (cloneFailures.length > 0) {
-      throw new Error(formatCloneFailuresError(cloneFailures));
-    }
-  }
   section("Container");
   const featureRefs = parsed.config.features.map((f) => f.ref);
   if (featureRefs.length > 0) {
@@ -5169,8 +5023,8 @@ ${sectionLine(label)}
   return { targetDir, configPath: ymlPath, containerExitCode: exitCode };
 }
 async function assertSafeTargetDir(targetDir, expectedOrigin) {
-  if (!existsSync8(targetDir)) return;
-  const entries = await fs12.readdir(targetDir);
+  if (!existsSync7(targetDir)) return;
+  const entries = await fs11.readdir(targetDir);
   if (entries.length === 0) return;
   const state = await readStateFile(targetDir);
   if (state) {
@@ -5240,7 +5094,7 @@ async function persistPromptedIdentity(prompted, ymlPath, home, logger) {
   }
   if (wantContainer) {
     try {
-      const text = await fs12.readFile(ymlPath, "utf8");
+      const text = await fs11.readFile(ymlPath, "utf8");
       const parsed = parseConfig(text, ymlPath);
       const changed = setContainerGitUserInDoc(parsed.doc, {
         name: prompted.name,
@@ -5248,7 +5102,7 @@ async function persistPromptedIdentity(prompted, ymlPath, home, logger) {
       });
       if (changed) {
         const out = stringifyConfig(parsed.doc);
-        await fs12.writeFile(ymlPath, out, "utf8");
+        await fs11.writeFile(ymlPath, out, "utf8");
         logger.info(
           `Saved identity in this container \u2014 wrote git.user into ${prettyPath(ymlPath)}.`
         );
@@ -5262,7 +5116,7 @@ async function persistPromptedIdentity(prompted, ymlPath, home, logger) {
 }
 
 // src/version.ts
-var CLI_VERSION = true ? "1.13.1" : "dev";
+var CLI_VERSION = true ? "1.13.3" : "dev";
 
 // src/commands/_dispatch.ts
 import { consola as consola12 } from "consola";
@@ -5323,7 +5177,7 @@ function renderCompletionScript(shell) {
       '  COMPREPLY=( $(compgen -W "$candidates" -- "$cur") )',
       "  # Suppress the trailing space when bash narrowed the candidate",
       "  # set to a single token that ends with `=` \u2014 those are value-",
-      "  # flags (`--with=`, `--with-ports=`, \u2026) where the user types the",
+      "  # flags (`--with-features=`, `--with-ports=`, \u2026) where the user types the",
       "  # value immediately after.",
       '  if [[ ${#COMPREPLY[@]} -eq 1 && "${COMPREPLY[0]}" == *= ]]; then',
       "    compopt -o nospace",
@@ -5396,6 +5250,10 @@ var completionCommand = defineCommand9({
   meta: {
     name: "completion",
     group: "tooling",
+    // Hidden from `monoceros --help`: the install scripts wire up
+    // completion automatically; manual setup is documented in
+    // docs/commands/completion.md. Still runnable directly.
+    hidden: true,
     description: "Print a shell completion script for bash, zsh or PowerShell to stdout. Pipe the output into a file your shell loads at startup. The install scripts (install.sh / install.ps1) call this automatically."
   },
   args: {
@@ -5422,8 +5280,8 @@ var completionCommand = defineCommand9({
 import { defineCommand as defineCommand10 } from "citty";
 
 // src/completion/resolve.ts
-import { existsSync as existsSync9, promises as fs13 } from "fs";
-import path15 from "path";
+import { existsSync as existsSync8, promises as fs12 } from "fs";
+import path14 from "path";
 async function resolveCompletions(line, point, opts = {}) {
   const { prev, current } = parseCompletionLine(line, point);
   const ctx = { prev, current, opts };
@@ -5571,9 +5429,9 @@ function filterPrefix(values, fragment) {
 }
 async function listContainerNames(ctx) {
   const home = ctx.opts.monocerosHome ?? monocerosHome();
-  const dir = path15.join(home, "container-configs");
-  if (!existsSync9(dir)) return [];
-  const entries = await fs13.readdir(dir);
+  const dir = path14.join(home, "container-configs");
+  if (!existsSync8(dir)) return [];
+  const entries = await fs12.readdir(dir);
   return entries.filter((e) => e.endsWith(".yml")).map((e) => e.slice(0, -".yml".length)).sort();
 }
 async function listFeatureComponents() {
@@ -5791,6 +5649,8 @@ var __completeCommand = defineCommand10({
   meta: {
     name: "__complete",
     group: "internal",
+    // Internal plumbing for the shell wrappers — never shown in help.
+    hidden: true,
     description: "Internal \u2014 shell completion engine. Used by the wrappers emitted by `monoceros completion <shell>`. Output one candidate completion per line."
   },
   args: {
@@ -5828,8 +5688,8 @@ import { defineCommand as defineCommand11 } from "citty";
 import { consola as consola14 } from "consola";
 
 // src/init/index.ts
-import { existsSync as existsSync10, promises as fs14 } from "fs";
-import path16 from "path";
+import { existsSync as existsSync9, promises as fs13 } from "fs";
+import path15 from "path";
 import { consola as consola13 } from "consola";
 
 // src/init/generator.ts
@@ -5897,6 +5757,7 @@ function generateComposedYml(name, composed, lookupManifest, repoUrls = [], port
     lines.push("");
   }
   if (repoUrls.length > 0) {
+    pushGitIdentityBlock(lines);
     pushSectionHeader(
       lines,
       REPOS_HEADER,
@@ -6014,6 +5875,7 @@ function generateDocumentedYml(name, catalog, lookupManifest, repoUrls = [], por
     lines.push("");
   }
   if (repoUrls.length > 0) {
+    pushGitIdentityBlock(lines);
     pushSectionHeader(
       lines,
       REPOS_HEADER,
@@ -6093,6 +5955,20 @@ function pushServiceEntry(out, svc) {
 var FEATURES_HEADER_ACTIVE = "A Monoceros dev-container is shaped by features \u2014 pluggable units that drop tooling (AI assistants, language CLIs, cloud SDKs, \u2026) into the container and bring their own options. The features active for this container are listed below; adjust their options as needed. Shared credentials used across containers belong in monoceros-config.yml under `defaults.features.<ref>` rather than here. Full catalog: `monoceros list-components`.";
 var FEATURES_HEADER_DOCUMENTED = "A Monoceros dev-container is shaped by features \u2014 pluggable units that drop tooling (AI assistants, language CLIs, cloud SDKs, \u2026) into the container and bring their own options. Un-comment the blocks below for the features you want active. Shared credentials used across containers belong in monoceros-config.yml under `defaults.features.<ref>` rather than here. Full catalog: `monoceros list-components`.";
 var REPOS_HEADER = "Git repositories cloned into `projects/` on container start-up. HTTPS URLs only. The provider is auto-detected for github.com / gitlab.com / bitbucket.org; for any other host (self-hosted GitLab, Gitea, \u2026) declare `provider:` explicitly. Add more later with `monoceros add-repo`.";
+var GIT_IDENTITY_HEADER = "Git committer identity for commits made inside the container. The ${VAR} values resolve from <name>.env at apply time \u2014 fill them there, or leave them blank to fall back to your global git config (or a one-time prompt). Override per repo under repos[].git.user.";
+function pushGitIdentityBlock(lines) {
+  pushSectionHeader(
+    lines,
+    GIT_IDENTITY_HEADER,
+    /* commented */
+    false
+  );
+  lines.push("git:");
+  lines.push("  user:");
+  lines.push(`    name: \${${GIT_IDENTITY_VAR.name}}`);
+  lines.push(`    email: \${${GIT_IDENTITY_VAR.email}}`);
+  lines.push("");
+}
 function routingHeader(name) {
   return `Container ports exposed to the host through Traefik. Reach them in your browser as ${name}-<port>.localhost (e.g. ${name}-3000.localhost). The first entry is the default route and is also reachable as the bare ${name}.localhost. Manage the list with \`monoceros add-port\`.`;
 }
@@ -6179,7 +6055,7 @@ async function runInit(opts) {
     );
   }
   const dest = containerConfigPath(opts.name, home);
-  if (existsSync10(dest)) {
+  if (existsSync9(dest)) {
     throw new Error(
       `Config already exists: ${dest}. Delete it manually before re-running \`monoceros init\` \u2014 this protects any hand-edits.`
     );
@@ -6237,17 +6113,6 @@ async function runInit(opts) {
     seenPorts.add(raw);
     ports.push(raw);
   }
-  let promptedIdentity;
-  if (repos.length > 0) {
-    const globalConfig = await readMonocerosConfig({ monocerosHome: home });
-    promptedIdentity = await resolveIdentityWithPrompt({
-      ...opts.identitySpawn ? { spawn: opts.identitySpawn } : {},
-      ...opts.identityPrompt ? { prompt: opts.identityPrompt } : {},
-      ...opts.identityScopePrompt ? { scopePrompt: opts.identityScopePrompt } : {},
-      ...globalConfig?.defaults?.git?.user ? { defaults: globalConfig.defaults.git.user } : {},
-      logger: { info: logger.info, warn: logger.info }
-    });
-  }
   let text;
   const composed = resolveComposedInit(catalog, {
     languages: opts.languages ?? [],
@@ -6261,9 +6126,9 @@ async function runInit(opts) {
   } else {
     text = generateComposedYml(opts.name, composed, lookup, repos, ports);
   }
-  await fs14.mkdir(containerConfigsDir(home), { recursive: true });
+  await fs13.mkdir(containerConfigsDir(home), { recursive: true });
   await ensureEnvGitignored(containerConfigsDir(home));
-  await fs14.writeFile(dest, text, "utf8");
+  await fs13.writeFile(dest, text, "utf8");
   const envPath = containerEnvPath(opts.name, home);
   const seedVars = {};
   for (const f of composed.features) {
@@ -6280,55 +6145,14 @@ async function runInit(opts) {
       Object.assign(seedVars, curatedServiceEnvDefaults(svc.name));
     }
   }
-  await ensureEnvVars(envPath, opts.name, seedVars);
-  if (promptedIdentity?.prompted) {
-    const { name, email, scope } = promptedIdentity.prompted;
-    if (scope === "g" || scope === "b") {
-      try {
-        const result = await writeGlobalDefaultGitUser(
-          { name, email },
-          { monocerosHome: home }
-        );
-        if (result.alreadySet) {
-          logger.info(
-            `monoceros-config.yml already had a defaults.git.user \u2014 left it alone.`
-          );
-        } else if (result.created) {
-          logger.info(
-            `Saved identity globally \u2014 created ${prettyPath(result.filePath)} with defaults.git.user.`
-          );
-        } else {
-          logger.info(
-            `Saved identity globally to ${prettyPath(result.filePath)}.`
-          );
-        }
-      } catch (err) {
-        logger.info(
-          `Could not persist identity to monoceros-config.yml: ${err instanceof Error ? err.message : String(err)}. \`monoceros apply\` will re-prompt.`
-        );
-      }
-    }
-    if (scope === "c" || scope === "b") {
-      try {
-        const written = await fs14.readFile(dest, "utf8");
-        const parsed = parseConfig(written, dest);
-        const changed = setContainerGitUserInDoc(parsed.doc, { name, email });
-        if (changed) {
-          await fs14.writeFile(dest, stringifyConfig(parsed.doc), "utf8");
-          logger.info(
-            `Saved identity in ${prettyPath(dest)} (container-level git.user).`
-          );
-        }
-      } catch (err) {
-        logger.info(
-          `Could not persist identity into ${prettyPath(dest)}: ${err instanceof Error ? err.message : String(err)}. \`monoceros apply\` will re-prompt.`
-        );
-      }
-    }
+  if (repos.length > 0) {
+    seedVars[GIT_IDENTITY_VAR.name] = "";
+    seedVars[GIT_IDENTITY_VAR.email] = "";
   }
+  await ensureEnvVars(envPath, opts.name, seedVars);
   const documented = !anyComposed;
-  const ymlRel = path16.relative(home, dest);
-  const envRel = path16.relative(home, envPath);
+  const ymlRel = path15.relative(home, dest);
+  const envRel = path15.relative(home, envPath);
   if (documented) {
     logger.success(`Wrote documented default to ${ymlRel} and ${envRel}.`);
     logger.info(
@@ -6594,7 +6418,7 @@ var listComponentsCommand = defineCommand12({
   meta: {
     name: "list-components",
     group: "discovery",
-    description: "Print the components catalog used by `monoceros init --with=\u2026`, grouped by category (Languages, Services, Features). Component names render in cyan, descriptions in default colour; when piped, the formatting drops out and lines become `name<TAB>description` for grep/awk-friendly consumption."
+    description: "Print the components catalog used by `monoceros init --with-languages=\u2026 / --with-services=\u2026 / --with-features=\u2026`, grouped by category (Languages, Services, Features). Component names render in cyan, descriptions in default colour; when piped, the formatting drops out and lines become `name<TAB>description` for grep/awk-friendly consumption."
   },
   args: {},
   async run() {
@@ -6863,8 +6687,8 @@ import { consola as consola20 } from "consola";
 import { createInterface } from "readline/promises";
 
 // src/remove/index.ts
-import { existsSync as existsSync11, promises as fs15 } from "fs";
-import path17 from "path";
+import { existsSync as existsSync10, promises as fs14 } from "fs";
+import path16 from "path";
 import { consola as consola19 } from "consola";
 async function runRemove(opts) {
   const home = opts.monocerosHome ?? monocerosHome();
@@ -6881,9 +6705,9 @@ async function runRemove(opts) {
   const ymlPath = containerConfigPath(opts.name, home);
   const envPath = containerEnvPath(opts.name, home);
   const containerPath = containerDir(opts.name, home);
-  const hasYml = existsSync11(ymlPath);
-  const hasEnv = existsSync11(envPath);
-  const hasContainer = existsSync11(containerPath);
+  const hasYml = existsSync10(ymlPath);
+  const hasEnv = existsSync10(envPath);
+  const hasContainer = existsSync10(containerPath);
   if (!hasYml && !hasContainer) {
     throw new Error(
       `Nothing to remove for '${opts.name}': neither ${ymlPath} nor ${containerPath} exists.`
@@ -6907,30 +6731,30 @@ async function runRemove(opts) {
   let backupPath = null;
   if (!opts.noBackup && (hasYml || hasContainer)) {
     const ts = (opts.now ?? /* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-    backupPath = path17.join(home, "container-backups", `${opts.name}-${ts}`);
-    await fs15.mkdir(backupPath, { recursive: true });
+    backupPath = path16.join(home, "container-backups", `${opts.name}-${ts}`);
+    await fs14.mkdir(backupPath, { recursive: true });
     if (hasYml) {
-      await fs15.copyFile(ymlPath, path17.join(backupPath, `${opts.name}.yml`));
+      await fs14.copyFile(ymlPath, path16.join(backupPath, `${opts.name}.yml`));
     }
     if (hasEnv) {
-      await fs15.copyFile(envPath, path17.join(backupPath, `${opts.name}.env`));
+      await fs14.copyFile(envPath, path16.join(backupPath, `${opts.name}.env`));
     }
     if (hasContainer) {
-      await fs15.cp(containerPath, path17.join(backupPath, "container"), {
+      await fs14.cp(containerPath, path16.join(backupPath, "container"), {
         recursive: true
       });
     }
     logger.info(`Backup written to ${prettyPath(backupPath)}.`);
   }
   if (hasYml) {
-    await fs15.rm(ymlPath, { force: true });
+    await fs14.rm(ymlPath, { force: true });
   }
   if (hasEnv) {
-    await fs15.rm(envPath, { force: true });
+    await fs14.rm(envPath, { force: true });
   }
   if (hasContainer) {
     try {
-      await fs15.rm(containerPath, { recursive: true, force: true });
+      await fs14.rm(containerPath, { recursive: true, force: true });
     } catch (err) {
       const code = err.code;
       if (code !== "EACCES" && code !== "EPERM") {
@@ -6956,7 +6780,7 @@ async function runRemove(opts) {
           `docker-based cleanup of ${containerPath} exited ${exit}. Inspect with \`sudo ls -la ${containerPath}\` and clean manually.`
         );
       }
-      await fs15.rm(containerPath, { recursive: true, force: true });
+      await fs14.rm(containerPath, { recursive: true, force: true });
     }
   }
   logger.success(
@@ -7059,8 +6883,8 @@ import { defineCommand as defineCommand18 } from "citty";
 import { consola as consola22 } from "consola";
 
 // src/restore/index.ts
-import { existsSync as existsSync12, promises as fs16 } from "fs";
-import path18 from "path";
+import { existsSync as existsSync11, promises as fs15 } from "fs";
+import path17 from "path";
 import { consola as consola21 } from "consola";
 async function runRestore(opts) {
   const home = opts.monocerosHome ?? monocerosHome();
@@ -7068,15 +6892,15 @@ async function runRestore(opts) {
     info: (msg) => consola21.info(msg),
     success: (msg) => consola21.success(msg)
   };
-  const backup = path18.resolve(opts.backupPath);
-  if (!existsSync12(backup)) {
+  const backup = path17.resolve(opts.backupPath);
+  if (!existsSync11(backup)) {
     throw new Error(`Backup not found: ${backup}.`);
   }
-  const stat = await fs16.stat(backup);
+  const stat = await fs15.stat(backup);
   if (!stat.isDirectory()) {
     throw new Error(`Backup path is not a directory: ${backup}.`);
   }
-  const entries = await fs16.readdir(backup);
+  const entries = await fs15.readdir(backup);
   const ymlFiles = entries.filter((f) => f.endsWith(".yml"));
   if (ymlFiles.length === 0) {
     throw new Error(
@@ -7090,29 +6914,29 @@ async function runRestore(opts) {
   }
   const ymlFile = ymlFiles[0];
   const name = ymlFile.replace(/\.yml$/, "");
-  const containerInBackup = path18.join(backup, "container");
-  const hasContainer = existsSync12(containerInBackup);
-  const envInBackup = path18.join(backup, `${name}.env`);
-  const hasEnv = existsSync12(envInBackup);
+  const containerInBackup = path17.join(backup, "container");
+  const hasContainer = existsSync11(containerInBackup);
+  const envInBackup = path17.join(backup, `${name}.env`);
+  const hasEnv = existsSync11(envInBackup);
   const destYml = containerConfigPath(name, home);
   const destContainer = containerDir(name, home);
-  if (existsSync12(destYml)) {
+  if (existsSync11(destYml)) {
     throw new Error(
       `Refusing to restore: ${destYml} already exists. Remove the current container first (\`monoceros remove ${name}\`) or rename the existing config.`
     );
   }
-  if (hasContainer && existsSync12(destContainer)) {
+  if (hasContainer && existsSync11(destContainer)) {
     throw new Error(
       `Refusing to restore: ${destContainer} already exists. Remove the current container first (\`monoceros remove ${name}\`).`
     );
   }
-  await fs16.mkdir(containerConfigsDir(home), { recursive: true });
-  await fs16.copyFile(path18.join(backup, ymlFile), destYml);
+  await fs15.mkdir(containerConfigsDir(home), { recursive: true });
+  await fs15.copyFile(path17.join(backup, ymlFile), destYml);
   if (hasEnv) {
-    await fs16.copyFile(envInBackup, containerEnvPath(name, home));
+    await fs15.copyFile(envInBackup, containerEnvPath(name, home));
   }
   if (hasContainer) {
-    await fs16.cp(containerInBackup, destContainer, { recursive: true });
+    await fs15.cp(containerInBackup, destContainer, { recursive: true });
   }
   logger.success(`Restored '${name}' from ${prettyPath(backup)}.`);
   logger.info(
@@ -7370,8 +7194,8 @@ import { defineCommand as defineCommand24 } from "citty";
 import { consola as consola28 } from "consola";
 
 // src/devcontainer/shell.ts
-import { existsSync as existsSync13 } from "fs";
-import path19 from "path";
+import { existsSync as existsSync12 } from "fs";
+import path18 from "path";
 async function runShell(opts) {
   assertContainerExists(opts.root);
   const spawnFn = opts.spawn ?? spawnDevcontainer;
@@ -7394,7 +7218,7 @@ async function runShell(opts) {
   );
 }
 function assertContainerExists(root) {
-  if (!existsSync13(path19.join(root, ".devcontainer"))) {
+  if (!existsSync12(path18.join(root, ".devcontainer"))) {
     throw new Error(
       `No .devcontainer/ at ${root}. Run \`monoceros apply <name>\` first.`
     );
@@ -7606,15 +7430,15 @@ import { defineCommand as defineCommand29 } from "citty";
 import { consola as consola33 } from "consola";
 
 // src/tunnel/run.ts
-import { spawn as spawn10 } from "child_process";
+import { spawn as spawn8 } from "child_process";
 import { consola as consola32 } from "consola";
 
 // src/tunnel/resolve.ts
-import { existsSync as existsSync14 } from "fs";
-import path20 from "path";
+import { existsSync as existsSync13 } from "fs";
+import path19 from "path";
 async function resolveTunnelTarget(opts) {
   const ymlPath = containerConfigPath(opts.name, opts.monocerosHome);
-  if (!existsSync14(ymlPath)) {
+  if (!existsSync13(ymlPath)) {
     throw new Error(
       `No yml profile for '${opts.name}' at ${ymlPath}. Run \`monoceros init ${opts.name}\` first.`
     );
@@ -7622,13 +7446,13 @@ async function resolveTunnelTarget(opts) {
   const parsed = await readConfig(ymlPath);
   const config = parsed.config;
   const containerRoot = containerDir(opts.name, opts.monocerosHome);
-  if (!existsSync14(containerRoot)) {
+  if (!existsSync13(containerRoot)) {
     throw new Error(
       `Container '${opts.name}' is not materialised at ${containerRoot}. Run \`monoceros apply ${opts.name}\` first.`
     );
   }
-  const composePath = path20.join(containerRoot, ".devcontainer", "compose.yaml");
-  const isCompose = existsSync14(composePath);
+  const composePath = path19.join(containerRoot, ".devcontainer", "compose.yaml");
+  const isCompose = existsSync13(composePath);
   const parsedTarget = parseTargetArg(opts.target, config);
   const docker = opts.docker ?? defaultDockerExec;
   if (isCompose) {
@@ -7849,7 +7673,7 @@ function formatLocalPortHeldError(port, address, result) {
 // src/tunnel/run.ts
 var SOCAT_IMAGE = "alpine/socat:1.8.0.3";
 var defaultDockerSpawn = (args) => {
-  const child = spawn10("docker", args, {
+  const child = spawn8("docker", args, {
     stdio: "inherit"
   });
   const exited = new Promise((resolve, reject) => {