@getmonoceros/workbench 1.36.9 → 1.37.1

package/dist/bin.js

@@ -74,7 +74,7 @@ ${issues}`);
   }
   return result.data;
 }
-var SOLUTION_NAME_RE, APT_PACKAGE_NAME_RE, RUNTIME_VERSION_RE, FEATURE_REF_RE, INSTALL_URL_RE, REPO_URL_RE, REPO_PATH_RE, REGEX, PROVIDER_VALUES, KNOWN_PROVIDER_HOSTS, CONFIG_SCHEMA_VERSION, FeatureOptionValueSchema, FeatureEntrySchema, EMAIL_RE, GitUserSchema, RepoEntrySchema, PortEntrySchema, RoutingSchema, SERVICE_NAME_RE, ServiceEnvValueSchema, ServiceHealthcheckSchema, SERVICE_RESTART_VALUES, ServiceObjectSchema, LanguageOptionValueSchema, LanguageEntrySchema, SolutionConfigSchema;
+var SOLUTION_NAME_RE, APT_PACKAGE_NAME_RE, RUNTIME_VERSION_RE, FEATURE_REF_RE, INSTALL_URL_RE, REPO_URL_RE, REPO_PATH_RE, REGEX, PROVIDER_VALUES, PROVIDER_LABEL, GIT_CREDENTIAL_USERNAME, REPO_DOCS_URL, KNOWN_PROVIDER_HOSTS, CONFIG_SCHEMA_VERSION, FeatureOptionValueSchema, FeatureEntrySchema, EMAIL_RE, GitUserSchema, RepoEntrySchema, PortEntrySchema, RoutingSchema, SERVICE_NAME_RE, ServiceEnvValueSchema, ServiceHealthcheckSchema, SERVICE_RESTART_VALUES, ServiceObjectSchema, LanguageOptionValueSchema, LanguageEntrySchema, SolutionConfigSchema;
 var init_schema = __esm({
   "src/config/schema.ts"() {
     "use strict";
@@ -93,12 +93,18 @@ var init_schema = __esm({
       repoUrl: REPO_URL_RE,
       repoPath: REPO_PATH_RE
     };
-    PROVIDER_VALUES = [
-      "github",
-      "gitlab",
-      "bitbucket",
-      "gitea"
-    ];
+    PROVIDER_VALUES = ["github", "gitlab", "bitbucket"];
+    PROVIDER_LABEL = {
+      github: "GitHub",
+      gitlab: "GitLab",
+      bitbucket: "Bitbucket"
+    };
+    GIT_CREDENTIAL_USERNAME = {
+      github: "oauth2",
+      gitlab: "oauth2",
+      bitbucket: "x-bitbucket-api-token-auth"
+    };
+    REPO_DOCS_URL = "https://getmonoceros.build/docs/concepts/git-and-repos/";
     KNOWN_PROVIDER_HOSTS = {
       "github.com": "github",
       "gitlab.com": "gitlab",
@@ -394,6 +400,9 @@ function containerLogsDir(name, home = monocerosHome()) {
 function monocerosConfigPath(home = monocerosHome()) {
   return path.join(home, "monoceros-config.yml");
 }
+function globalEnvPath(home = monocerosHome()) {
+  return path.join(home, "monoceros-config.env");
+}
 function prettyPath(p) {
   const home = os.homedir();
   if (!home) return p;
@@ -645,6 +654,9 @@ function wrapToComment(text, width) {
 function featureOptionVarName(ref, optionKey) {
   const leaf = ref.split("/").pop() ?? ref;
   const id = leaf.split("@")[0].split(":")[0];
+  if (optionKey === "apiToken" && PROVIDER_TOKEN_VAR[id]) {
+    return PROVIDER_TOKEN_VAR[id];
+  }
   const idSnake = id.replace(/[^A-Za-z0-9]+/g, "_").toUpperCase();
   const optSnake = optionKey.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").toUpperCase();
   return `${idSnake}_${optSnake}`;
@@ -655,11 +667,15 @@ function featureOptionHints(summary, ref, activeKeys = []) {
     return { key, envVar, placeholder: `\${${envVar}}` };
   });
 }
-var FEATURE_HEADER_WIDTH;
+var FEATURE_HEADER_WIDTH, PROVIDER_TOKEN_VAR;
 var init_feature_doc = __esm({
   "src/init/feature-doc.ts"() {
     "use strict";
     FEATURE_HEADER_WIDTH = 76 - 2;
+    PROVIDER_TOKEN_VAR = {
+      "github-cli": "GITHUB_API_TOKEN",
+      "gitlab-cli": "GITLAB_API_TOKEN"
+    };
   }
 });
 
@@ -1167,6 +1183,7 @@ function makePalette(isTty2) {
     underline: (s) => wrap(s, ANSI_UNDERLINE2),
     cyan: (s) => wrap(s, ANSI_CYAN2),
     green: (s) => wrap(s, ANSI_GREEN),
+    yellow: (s) => wrap(s, ANSI_YELLOW),
     dim: (s) => wrap(s, ANSI_GREY2),
     sectionLine: (label) => wrap(`\u25B8 ${label}`, ANSI_BOLD2, ANSI_UNDERLINE2)
   };
@@ -1174,7 +1191,7 @@ function makePalette(isTty2) {
 function colorsFor(stream) {
   return makePalette(stream.isTTY ?? false);
 }
-var ESC, ANSI_BOLD2, ANSI_UNDERLINE2, ANSI_CYAN2, ANSI_GREEN, ANSI_GREY2, ANSI_RESET2, ANSI_RE2, stderrPalette, bold2, underline2, cyan2, green, dim, sectionLine;
+var ESC, ANSI_BOLD2, ANSI_UNDERLINE2, ANSI_CYAN2, ANSI_GREEN, ANSI_YELLOW, ANSI_GREY2, ANSI_RESET2, ANSI_RE2, stderrPalette, bold2, underline2, cyan2, green, yellow, dim, sectionLine;
 var init_format = __esm({
   "src/util/format.ts"() {
     "use strict";
@@ -1183,6 +1200,7 @@ var init_format = __esm({
     ANSI_UNDERLINE2 = `${ESC}4m`;
     ANSI_CYAN2 = `${ESC}36m`;
     ANSI_GREEN = `${ESC}32m`;
+    ANSI_YELLOW = `${ESC}33m`;
     ANSI_GREY2 = `${ESC}90m`;
     ANSI_RESET2 = `${ESC}0m`;
     ANSI_RE2 = /\x1b\[[0-9;]*m/g;
@@ -1191,13 +1209,13 @@ var init_format = __esm({
     underline2 = stderrPalette.underline;
     cyan2 = stderrPalette.cyan;
     green = stderrPalette.green;
+    yellow = stderrPalette.yellow;
     dim = stderrPalette.dim;
     sectionLine = stderrPalette.sectionLine;
   }
 });
 
 // src/devcontainer/credentials.ts
-import { spawn } from "child_process";
 import { promises as fs3 } from "fs";
 import path5 from "path";
 function resolveProvider(host, explicit) {
@@ -1220,128 +1238,6 @@ function uniqueHttpsHosts(repos) {
   }
   return [...byHost.values()];
 }
-function installCommandForOS(opts) {
-  const withBrewBootstrap = (cmd) => [
-    "",
-    cyan2(BREW_INSTALL_COMMAND),
-    cyan2(cmd),
-    "",
-    dim("(Skip the first line if you already have Homebrew.)")
-  ].join("\n");
-  if (process.platform === "darwin") return withBrewBootstrap(opts.brew);
-  if (opts.linuxBrew) return withBrewBootstrap(opts.linuxBrew);
-  return `See ${opts.linuxDocsUrl} for package instructions.`;
-}
-function providerSetupHint(host, provider) {
-  if (provider === "github") {
-    const isSaas = host.toLowerCase() === "github.com";
-    const hostArg = isSaas ? "" : ` --hostname ${host}`;
-    const install = installCommandForOS({
-      brew: "brew install gh",
-      linuxBrew: "brew install gh",
-      linuxDocsUrl: "https://github.com/cli/cli#installation"
-    });
-    return {
-      title: `${host} \u2014 GitHub`,
-      body: [
-        "Install the GitHub CLI:",
-        install,
-        "",
-        "Then run once:",
-        cyan2(`gh auth login${hostArg}`),
-        cyan2(`gh auth setup-git${hostArg}`),
-        "",
-        "`gh auth login` walks through OAuth in your browser.",
-        "`gh auth setup-git` wires gh into git as a credential helper."
-      ].join("\n")
-    };
-  }
-  if (provider === "gitlab") {
-    const isSaas = host.toLowerCase() === "gitlab.com";
-    const hostArg = isSaas ? "" : ` --hostname ${host}`;
-    const install = installCommandForOS({
-      brew: "brew install glab",
-      linuxBrew: "brew install glab",
-      linuxDocsUrl: "https://gitlab.com/gitlab-org/cli#installation"
-    });
-    return {
-      title: `${host} \u2014 GitLab`,
-      body: [
-        "Install the GitLab CLI (glab):",
-        install,
-        "",
-        "Then run once:",
-        cyan2(`glab auth login${hostArg}`),
-        "",
-        "Choose `HTTPS` when asked for git-protocol, then accept",
-        '"Authenticate Git with your GitLab credentials" \u2014 glab',
-        "configures itself as the git credential helper."
-      ].join("\n")
-    };
-  }
-  if (provider === "bitbucket") {
-    const isCloud = host.toLowerCase() === "bitbucket.org";
-    if (isCloud) {
-      return {
-        title: `${host} \u2014 Bitbucket Cloud`,
-        body: [
-          "Bitbucket has no first-party CLI for git-credentials, so this",
-          "is a manual one-time setup. Generate an Atlassian API token at",
-          "https://id.atlassian.com/manage-profile/security/api-tokens",
-          "",
-          "Then store it via your OS credential helper:",
-          cyan2(
-            `git credential approve <<< $'protocol=https\\nhost=${host}\\nusername=<your-atlassian-email>\\npassword=<token>\\n'`
-          )
-        ].join("\n")
-      };
-    }
-    return {
-      title: `${host} \u2014 Bitbucket Data Center`,
-      body: [
-        "Bitbucket has no first-party CLI for git-credentials, so this",
-        "is a manual one-time setup. Generate a personal HTTP access",
-        `token in your Bitbucket UI: profile picture (top right on ${host})`,
-        "\u2192 Manage account \u2192 HTTP access tokens \u2192 Create token. Give it",
-        "at least repo-read + repo-write scopes for the repos you need.",
-        "",
-        "Then store it via your OS credential helper:",
-        cyan2(
-          `git credential approve <<< $'protocol=https\\nhost=${host}\\nusername=<your-bitbucket-username>\\npassword=<token>\\n'`
-        )
-      ].join("\n")
-    };
-  }
-  return {
-    title: `${host} \u2014 Gitea`,
-    body: [
-      "Gitea has no first-party CLI helper for git-credentials (the",
-      "`tea` CLI logs into its own config, not into your git credential",
-      "helper), so this is a manual one-time setup. Generate an access",
-      `token in your Gitea UI: profile picture (top right on ${host}) \u2192`,
-      'Settings \u2192 Applications \u2192 "Generate New Token". Give it at',
-      "least the `read:repository` scope (add `write:repository` if you",
-      "need push from the container).",
-      "",
-      "Then store it via your OS credential helper:",
-      cyan2(
-        `git credential approve <<< $'protocol=https\\nhost=${host}\\nusername=<your-gitea-username>\\npassword=<token>\\n'`
-      )
-    ].join("\n")
-  };
-}
-function parseCredentialFillOutput(output) {
-  const result = {};
-  for (const line of output.split("\n")) {
-    const eqIdx = line.indexOf("=");
-    if (eqIdx <= 0) continue;
-    const key = line.slice(0, eqIdx);
-    const value = line.slice(eqIdx + 1);
-    if (key === "username") result.username = value;
-    if (key === "password") result.password = value;
-  }
-  return result;
-}
 function formatCredentialLine(host, username, password) {
   const encUser = encodeURIComponent(username);
   const encPass = encodeURIComponent(password);
@@ -1350,76 +1246,30 @@ function formatCredentialLine(host, username, password) {
 async function collectGitCredentials(devContainerRoot, hosts, options = {}) {
   const credsDir = path5.join(devContainerRoot, ".monoceros");
   const credentialsPath = path5.join(credsDir, "git-credentials");
-  const spawnFn = options.spawn ?? realGitCredentialFill;
-  const approveFn = options.approve ?? realGitCredentialApprove;
-  const logger = options.logger ?? { info: () => {
-  }, warn: () => {
-  } };
   const lines = [];
   const perHost = [];
   for (const { host, provider } of hosts) {
-    if (provider === "unknown") {
-      perHost.push({
-        host,
-        provider: "github",
-        // placeholder — never rendered because pre-flight already bailed
-        status: "no-credentials",
-        detail: "provider not declared (internal: should not reach here)"
-      });
-      continue;
-    }
-    logger.info(`Fetching credentials for ${host} from host git\u2026`);
-    const input = `protocol=https
-host=${host}
-
-`;
-    let result;
-    try {
-      result = await spawnFn(input);
-    } catch (err) {
-      const detail = err instanceof Error ? err.message : String(err);
-      perHost.push({ host, provider, status: "spawn-error", detail });
-      continue;
-    }
-    if (result.exitCode !== 0) {
-      perHost.push({
-        host,
-        provider,
-        status: "non-zero-exit",
-        detail: `exit code ${result.exitCode}`
-      });
-      continue;
-    }
-    const { username, password } = parseCredentialFillOutput(result.stdout);
-    if (!username || !password) {
+    const known = provider === "unknown" ? "github" : provider;
+    const pat = options.patByHost?.get(host);
+    if (pat) {
+      lines.push(
+        formatCredentialLine(host, GIT_CREDENTIAL_USERNAME[known], pat)
+      );
+      perHost.push({ host, provider: known, status: "ok", detail: "" });
+    } else {
       perHost.push({
         host,
-        provider,
-        status: "no-credentials",
-        detail: "host credential helper returned no username/password"
+        provider: known,
+        status: "no-token",
+        detail: "no personal access token configured"
       });
-      continue;
-    }
-    lines.push(formatCredentialLine(host, username, password));
-    perHost.push({ host, provider, status: "ok", detail: "" });
-    const approveInput = `protocol=https
-host=${host}
-username=${username}
-password=${password}
-
-`;
-    try {
-      await approveFn(approveInput);
-    } catch {
     }
   }
   await fs3.mkdir(credsDir, { recursive: true });
   await fs3.writeFile(
     credentialsPath,
     lines.join("\n") + (lines.length > 0 ? "\n" : ""),
-    {
-      mode: 384
-    }
+    { mode: 384 }
   );
   return {
     hostsWritten: lines.length,
@@ -1428,95 +1278,146 @@ password=${password}
     credentialsPath
   };
 }
-function formatMissingCredentialsError(missing) {
-  if (missing.length === 1) {
-    const m = missing[0];
-    const hint = providerSetupHint(m.host, m.provider);
-    return [
-      `Missing Git credentials: ${hint.title}`,
-      "",
-      hint.body,
-      "",
-      `Then re-run ${cyan2("monoceros apply")}.`
-    ].join("\n");
-  }
-  const lines = [
-    `Missing Git credentials for ${missing.length} hosts:`,
-    ""
-  ];
-  for (const m of missing) {
-    const hint = providerSetupHint(m.host, m.provider);
-    lines.push(hint.title);
-    lines.push("");
-    lines.push(hint.body);
-    lines.push("");
-  }
-  lines.push(`Then re-run ${cyan2("monoceros apply")}.`);
-  return lines.join("\n");
-}
 function formatUnknownProviderError(hosts) {
   const sorted = [...new Set(hosts)].sort();
   const lines = [
     sorted.length === 1 ? `Unknown Git provider for host ${sorted[0]}.` : `Unknown Git provider for ${sorted.length} hosts: ${sorted.join(", ")}.`,
     "",
     "Monoceros auto-detects only github.com / gitlab.com / bitbucket.org.",
-    "For any other host (self-hosted GitLab, Gitea, Bitbucket Server, \u2026)",
-    "declare the provider explicitly in the yml. Edit the repo entry:",
+    "For any other host (self-hosted GitLab, GitHub Enterprise, Bitbucket",
+    "Data Center) declare the provider explicitly in the yml. Edit the",
+    "repo entry:",
     "",
     cyan2("  repos:"),
     cyan2(`    - url: https://${sorted[0]}/\u2026`),
-    cyan2("      provider: gitlab   # or: github, bitbucket, gitea"),
+    cyan2("      provider: gitlab   # or: github, bitbucket"),
     "",
-    `Or re-add with ${cyan2("monoceros add-repo <name> <url> --provider=<github|gitlab|bitbucket|gitea>")}.`
+    `Or re-add with ${cyan2("monoceros add-repo <name> <url> --provider=<github|gitlab|bitbucket>")}.`
   ];
   return lines.join("\n");
 }
-var realGitCredentialFill, realGitCredentialApprove, BREW_INSTALL_COMMAND;
 var init_credentials = __esm({
   "src/devcontainer/credentials.ts"() {
     "use strict";
     init_schema();
     init_format();
-    realGitCredentialFill = (input) => {
-      return new Promise((resolve, reject) => {
-        const child = spawn("git", ["credential", "fill"], {
-          stdio: ["pipe", "pipe", "inherit"],
-          env: {
-            ...process.env,
-            GIT_TERMINAL_PROMPT: "0"
-          }
-        });
-        let stdout = "";
-        child.stdout.on("data", (chunk) => {
-          stdout += chunk.toString();
-        });
-        child.on("error", reject);
-        child.on("exit", (code) => resolve({ stdout, exitCode: code ?? 0 }));
-        child.stdin.write(input);
-        child.stdin.end();
-      });
-    };
-    realGitCredentialApprove = (input) => {
-      return new Promise((resolve, reject) => {
-        const child = spawn("git", ["credential", "approve"], {
-          stdio: ["pipe", "ignore", "inherit"],
-          env: {
-            ...process.env,
-            GIT_TERMINAL_PROMPT: "0"
-          }
-        });
-        child.on("error", reject);
-        child.on("exit", () => resolve());
-        child.stdin.write(input);
-        child.stdin.end();
-      });
-    };
-    BREW_INSTALL_COMMAND = '/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"';
+  }
+});
+
+// src/apply/repo-token.ts
+import { promises as fs4 } from "fs";
+function workspaceSegment(url) {
+  let ws;
+  try {
+    ws = new URL(url).pathname.split("/").filter(Boolean)[0];
+  } catch {
+    return void 0;
+  }
+  return ws ? ws.replace(/[^A-Za-z0-9]+/g, "_").toUpperCase() : void 0;
+}
+function tokenVarCandidates(provider, url) {
+  const p = provider.toUpperCase();
+  const vars = [`${p}_API_TOKEN`];
+  const segment = workspaceSegment(url);
+  if (segment) vars.push(`GIT_TOKEN__${p}_${segment}`);
+  vars.push(`GIT_TOKEN__${p}`);
+  return vars;
+}
+function resolveRepoTokens(config, catalog, envVars) {
+  const features = config.features.map((f) => ({
+    ...f,
+    ...f.options ? { options: { ...f.options } } : {}
+  }));
+  const hostTokens = /* @__PURE__ */ new Map();
+  const used = [];
+  const missing = [];
+  for (const repo of config.repos ?? []) {
+    if (!repo.url.startsWith("https://")) continue;
+    let host;
+    try {
+      host = new URL(repo.url).hostname;
+    } catch {
+      continue;
+    }
+    const provider = resolveProvider(host, repo.provider);
+    if (provider === "unknown") continue;
+    const ref = catalog.get(provider)?.file.contributes.features?.[0]?.ref;
+    const tried = tokenVarCandidates(provider, repo.url);
+    const hit = tried.find((v) => (envVars[v] ?? "").trim().length > 0);
+    if (!hit) {
+      missing.push({ host, provider, tried });
+      continue;
+    }
+    const token = envVars[hit].trim();
+    hostTokens.set(host, token);
+    used.push({ host, provider, varName: hit });
+    if (ref) {
+      const feature = features.find((f) => f.ref === ref);
+      if (feature) feature.options = { ...feature.options, apiToken: token };
+    }
+  }
+  return {
+    features,
+    hostTokens,
+    used,
+    missing
+  };
+}
+async function resolveContainerRepoTokens(name, home, catalog) {
+  const ymlPath = containerConfigPath(name, home);
+  const { config } = parseConfig(await fs4.readFile(ymlPath, "utf8"), ymlPath);
+  const envVars = {
+    ...readEnvFile(globalEnvPath(home)),
+    ...readEnvFile(containerEnvPath(name, home))
+  };
+  return resolveRepoTokens(config, catalog, envVars);
+}
+function formatTokenUse(use) {
+  return `${PROVIDER_LABEL[use.provider]} (${use.host}) \u2192 ${use.varName}`;
+}
+function formatUnauthenticatedRepos(missing, containerName2) {
+  const lines = [
+    bold2(yellow("\u26A0  Repo access \u2014 action needed")),
+    "",
+    yellow("   Some repositories are UNAUTHENTICATED:")
+  ];
+  for (const m of missing) {
+    lines.push(`     \u2022 ${PROVIDER_LABEL[m.provider]} (${m.host})`);
+  }
+  lines.push(
+    "",
+    bold2("   Public repositories still clone (read-only). But:"),
+    "     \u2022 gh / glab in the container are not logged in.",
+    "     \u2022 pushing, and cloning/pulling PRIVATE repositories, fails.",
+    "     \u2022 branches, PRs/MRs \u2014 anything that writes to the remote \u2014 fails.",
+    "",
+    bold2("   Set a token, then re-apply:")
+  );
+  for (const m of missing) {
+    const featureVar = m.tried.find((v) => !v.startsWith("GIT_TOKEN__"));
+    const sharedVar = m.tried.find((v) => v.startsWith("GIT_TOKEN__"));
+    lines.push(
+      `     \u2022 ${PROVIDER_LABEL[m.provider]}: ${cyan2(featureVar)} in container-configs/${containerName2}.env,`,
+      `       or ${cyan2(sharedVar)} in monoceros-config.env`
+    );
+  }
+  lines.push("", `   Details: ${cyan2(REPO_DOCS_URL)}`);
+  return lines.join("\n");
+}
+var init_repo_token = __esm({
+  "src/apply/repo-token.ts"() {
+    "use strict";
+    init_schema();
+    init_io();
+    init_env_file();
+    init_paths();
+    init_credentials();
+    init_format();
   }
 });
 
 // src/devcontainer/locate-running.ts
-import { spawn as spawn2 } from "child_process";
+import { spawn } from "child_process";
 async function findRunningContainerByLocalFolder(containerPath, opts = {}) {
   const docker = opts.docker ?? realDockerLookup;
   const result = await docker([
@@ -1537,7 +1438,7 @@ var init_locate_running = __esm({
     "use strict";
     realDockerLookup = (args) => {
       return new Promise((resolve, reject) => {
-        const child = spawn2("docker", args, {
+        const child = spawn("docker", args, {
           stdio: ["ignore", "pipe", "pipe"]
         });
         let stdout = "";
@@ -1557,7 +1458,7 @@ var init_locate_running = __esm({
     };
     realContainerExec = (containerId, argv) => {
       return new Promise((resolve, reject) => {
-        const child = spawn2("docker", ["exec", containerId, ...argv], {
+        const child = spawn("docker", ["exec", containerId, ...argv], {
           // Inherit stdio so live git output reaches the user.
           stdio: ["ignore", "inherit", "inherit"]
         });
@@ -1569,7 +1470,7 @@ var init_locate_running = __esm({
 });
 
 // src/config/global.ts
-import { promises as fs4 } from "fs";
+import { promises as fs5 } from "fs";
 import { z as z3 } from "zod";
 import { isMap, Pair, parseDocument as parseDocument2, Scalar, YAMLMap } from "yaml";
 async function readMonocerosConfig(opts = {}) {
@@ -1577,7 +1478,7 @@ async function readMonocerosConfig(opts = {}) {
   const filePath = monocerosConfigPath(home);
   let text;
   try {
-    text = await fs4.readFile(filePath, "utf8");
+    text = await fs5.readFile(filePath, "utf8");
   } catch {
     return void 0;
   }
@@ -1613,7 +1514,7 @@ async function writeGlobalDefaultGitUser(user, opts = {}) {
   const filePath = monocerosConfigPath(home);
   let text;
   try {
-    text = await fs4.readFile(filePath, "utf8");
+    text = await fs5.readFile(filePath, "utf8");
   } catch {
     text = void 0;
   }
@@ -1630,8 +1531,8 @@ async function writeGlobalDefaultGitUser(user, opts = {}) {
       `      email: ${user.email}`,
       ""
     ].join("\n");
-    await fs4.mkdir(home, { recursive: true });
-    await fs4.writeFile(filePath, fresh, "utf8");
+    await fs5.mkdir(home, { recursive: true });
+    await fs5.writeFile(filePath, fresh, "utf8");
     return { filePath, created: true, alreadySet: false };
   }
   const doc = parseDocument2(text, { prettyErrors: true });
@@ -1652,7 +1553,7 @@ async function writeGlobalDefaultGitUser(user, opts = {}) {
   userMap.set("name", user.name);
   userMap.set("email", user.email);
   const newText = String(doc);
-  await fs4.writeFile(filePath, newText, "utf8");
+  await fs5.writeFile(filePath, newText, "utf8");
   return { filePath, created: false, alreadySet: false };
 }
 function ensureMap(doc, key) {
@@ -1913,8 +1814,8 @@ var init_components = __esm({
 });
 
 // src/proxy/index.ts
-import { spawn as spawn3 } from "child_process";
-import { promises as fs5 } from "fs";
+import { spawn as spawn2 } from "child_process";
+import { promises as fs6 } from "fs";
 import path6 from "path";
 function proxyDynamicDir(home) {
   return path6.join(home ?? monocerosHome(), "traefik", "dynamic");
@@ -1922,7 +1823,7 @@ function proxyDynamicDir(home) {
 async function ensureProxy(opts = {}) {
   const docker = opts.docker ?? realDocker;
   const dyn = proxyDynamicDir(opts.monocerosHome);
-  await fs5.mkdir(dyn, { recursive: true });
+  await fs6.mkdir(dyn, { recursive: true });
   const netInspect = await docker(["network", "inspect", PROXY_NETWORK_NAME]);
   if (netInspect.exitCode !== 0) {
     const create = await docker(["network", "create", PROXY_NETWORK_NAME]);
@@ -2028,7 +1929,7 @@ var init_proxy = __esm({
     PROXY_RESTART_POLICY = "unless-stopped";
     defaultDockerExec = (args) => {
       return new Promise((resolve, reject) => {
-        const child = spawn3("docker", args, {
+        const child = spawn2("docker", args, {
           stdio: ["ignore", "pipe", "pipe"]
         });
         let stdout = "";
@@ -2051,7 +1952,7 @@ var init_proxy = __esm({
 });
 
 // src/proxy/dynamic.ts
-import { promises as fs6 } from "fs";
+import { promises as fs7 } from "fs";
 import path7 from "path";
 async function writeDynamicConfig(name, ports, opts = {}) {
   if (ports.length === 0) {
@@ -2060,14 +1961,14 @@ async function writeDynamicConfig(name, ports, opts = {}) {
     );
   }
   const dir = proxyDynamicDir(opts.monocerosHome);
-  await fs6.mkdir(dir, { recursive: true });
+  await fs7.mkdir(dir, { recursive: true });
   const file = path7.join(dir, `${name}.yml`);
-  await fs6.writeFile(file, renderDynamicConfig(name, ports), "utf8");
+  await fs7.writeFile(file, renderDynamicConfig(name, ports), "utf8");
   return file;
 }
 async function removeDynamicConfig(name, opts = {}) {
   const file = path7.join(proxyDynamicDir(opts.monocerosHome), `${name}.yml`);
-  await fs6.rm(file, { force: true });
+  await fs7.rm(file, { force: true });
 }
 function renderDynamicConfig(name, ports) {
   const lines = [];
@@ -2712,8 +2613,8 @@ var init_claude_settings = __esm({
 });
 
 // src/devcontainer/ssh-attach.ts
-import { spawn as spawn4 } from "child_process";
-import { promises as fs7 } from "fs";
+import { spawn as spawn3 } from "child_process";
+import { promises as fs8 } from "fs";
 import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
 import os2 from "os";
 import path9 from "path";
@@ -2735,7 +2636,7 @@ async function ensureKeypair(targetDir, name, keygen, logger) {
   if (existsSync6(privateKey) && existsSync6(publicKey)) {
     return { privateKey, publicKey };
   }
-  await fs7.mkdir(path9.dirname(privateKey), { recursive: true });
+  await fs8.mkdir(path9.dirname(privateKey), { recursive: true });
   try {
     const res = await keygen([
       "-t",
@@ -2812,10 +2713,10 @@ async function ensureInclude(userSshDir, home) {
   const configPath = path9.join(userSshDir, "config");
   const includeTarget = path9.join(sshHomeDir(home), "config.d", "*");
   const includeLine = `Include "${includeTarget}"`;
-  await fs7.mkdir(userSshDir, { recursive: true });
+  await fs8.mkdir(userSshDir, { recursive: true });
   let existing = "";
   try {
-    existing = await fs7.readFile(configPath, "utf8");
+    existing = await fs8.readFile(configPath, "utf8");
   } catch {
     existing = "";
   }
@@ -2826,13 +2727,13 @@ ${includeLine}
 `;
   const next = existing.length > 0 ? `${prefix}
 ${existing}` : prefix;
-  await fs7.writeFile(configPath, next, { mode: 384 });
-  await fs7.chmod(configPath, 384).catch(() => {
+  await fs8.writeFile(configPath, next, { mode: 384 });
+  await fs8.chmod(configPath, 384).catch(() => {
   });
 }
 function runCapture(cmd, args) {
   return new Promise((resolve, reject) => {
-    const child = spawn4(cmd, args, {
+    const child = spawn3(cmd, args, {
       stdio: ["ignore", "pipe", "ignore"]
     });
     let stdout = "";
@@ -2929,26 +2830,26 @@ async function upsertMarkedBlock(configPath, hostAlias, body) {
   const section = `${begin}
 ${body}
 ${end}`;
-  await fs7.mkdir(path9.dirname(configPath), { recursive: true });
+  await fs8.mkdir(path9.dirname(configPath), { recursive: true });
   let existing = "";
   try {
-    existing = await fs7.readFile(configPath, "utf8");
+    existing = await fs8.readFile(configPath, "utf8");
   } catch {
     existing = "";
   }
   const re = new RegExp(`${escapeRegExp2(begin)}[\\s\\S]*?${escapeRegExp2(end)}`);
   if (re.test(existing)) {
-    await fs7.writeFile(configPath, existing.replace(re, section));
+    await fs8.writeFile(configPath, existing.replace(re, section));
     return;
   }
   const sep = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
-  await fs7.writeFile(configPath, `${existing}${sep}${section}
+  await fs8.writeFile(configPath, `${existing}${sep}${section}
 `);
 }
 async function removeMarkedBlock(configPath, hostAlias) {
   let existing = "";
   try {
-    existing = await fs7.readFile(configPath, "utf8");
+    existing = await fs8.readFile(configPath, "utf8");
   } catch {
     return;
   }
@@ -2957,7 +2858,7 @@ async function removeMarkedBlock(configPath, hostAlias) {
     `\\n?${escapeRegExp2(begin)}[\\s\\S]*?${escapeRegExp2(end)}\\n?`,
     "g"
   );
-  await fs7.writeFile(
+  await fs8.writeFile(
     configPath,
     existing.replace(re, "\n").replace(/\n{3,}/g, "\n\n")
   );
@@ -2972,10 +2873,10 @@ async function setupWindowsBridge(name, hostAlias, privateKey, directPort, deps,
     return;
   }
   const monoDir = path9.join(profile.homeWsl, ".ssh", "monoceros");
-  await fs7.mkdir(monoDir, { recursive: true });
+  await fs8.mkdir(monoDir, { recursive: true });
   const keyDst = path9.join(monoDir, name);
-  await fs7.rm(keyDst, { force: true });
-  await fs7.copyFile(privateKey, keyDst);
+  await fs8.rm(keyDst, { force: true });
+  await fs8.copyFile(privateKey, keyDst);
   const keyWin = `${profile.homeWin}\\.ssh\\monoceros\\${name}`;
   await upsertMarkedBlock(
     path9.join(profile.homeWsl, ".ssh", "config"),
@@ -2991,7 +2892,7 @@ async function removeWindowsBridge(name, hostAlias, deps) {
   if (!deps.isWsl()) return;
   const profile = await deps.resolveProfile();
   if (!profile) return;
-  await fs7.rm(path9.join(profile.homeWsl, ".ssh", "monoceros", name), {
+  await fs8.rm(path9.join(profile.homeWsl, ".ssh", "monoceros", name), {
     force: true
   });
   await removeMarkedBlock(
@@ -3012,16 +2913,16 @@ async function setupSshAttach(opts) {
   const configEntry = sshConfigEntryPath(opts.home, opts.name);
   const winDeps = resolveWindowsDeps(opts.windows);
   const directPort = winDeps.isWsl() ? opts.windowsDirectPort ?? null : null;
-  await fs7.mkdir(path9.dirname(proxyScript), { recursive: true });
-  await fs7.mkdir(path9.dirname(configEntry), { recursive: true });
-  await fs7.writeFile(
+  await fs8.mkdir(path9.dirname(proxyScript), { recursive: true });
+  await fs8.mkdir(path9.dirname(configEntry), { recursive: true });
+  await fs8.writeFile(
     proxyScript,
     proxyScriptContent(opts.name, opts.targetDir),
     { mode: 493 }
   );
-  await fs7.chmod(proxyScript, 493).catch(() => {
+  await fs8.chmod(proxyScript, 493).catch(() => {
   });
-  await fs7.writeFile(
+  await fs8.writeFile(
     configEntry,
     configEntryContent(
       opts.name,
@@ -3049,17 +2950,17 @@ async function setupSshAttach(opts) {
   return { hostAlias, configured: true };
 }
 async function upsertKnownHost(knownHostsPath, hostId, typeAndKey) {
-  await fs7.mkdir(path9.dirname(knownHostsPath), { recursive: true });
+  await fs8.mkdir(path9.dirname(knownHostsPath), { recursive: true });
   let existing = "";
   try {
-    existing = await fs7.readFile(knownHostsPath, "utf8");
+    existing = await fs8.readFile(knownHostsPath, "utf8");
   } catch {
     existing = "";
   }
   const kept = existing.split("\n").filter((l) => l.trim().length > 0 && l.split(/\s+/)[0] !== hostId);
   const next = `${[...kept, `${hostId} ${typeAndKey}`].join("\n")}
 `;
-  await fs7.writeFile(knownHostsPath, next);
+  await fs8.writeFile(knownHostsPath, next);
 }
 async function recordHostKey(opts) {
   const pubPath = path9.join(
@@ -3071,7 +2972,7 @@ async function recordHostKey(opts) {
   );
   let line = "";
   try {
-    line = (await fs7.readFile(pubPath, "utf8")).trim();
+    line = (await fs8.readFile(pubPath, "utf8")).trim();
   } catch {
     return;
   }
@@ -3097,8 +2998,8 @@ async function recordHostKey(opts) {
   }
 }
 async function removeSshAttach(home, name, windows) {
-  await fs7.rm(sshProxyScriptPath(home, name), { force: true });
-  await fs7.rm(sshConfigEntryPath(home, name), { force: true });
+  await fs8.rm(sshProxyScriptPath(home, name), { force: true });
+  await fs8.rm(sshConfigEntryPath(home, name), { force: true });
   try {
     await removeWindowsBridge(
       name,
@@ -3114,7 +3015,7 @@ var init_ssh_attach = __esm({
     "use strict";
     realKeygen = (args) => {
       return new Promise((resolve, reject) => {
-        const child = spawn4("ssh-keygen", args, {
+        const child = spawn3("ssh-keygen", args, {
           stdio: ["ignore", "ignore", "pipe"]
         });
         let stderr = "";
@@ -3289,13 +3190,26 @@ var init_opencode_config = __esm({
 });
 
 // src/create/scaffold.ts
-import { existsSync as existsSync8, promises as fs8 } from "fs";
+import { existsSync as existsSync8, promises as fs9 } from "fs";
 import path11 from "path";
 function deriveRepoName(url) {
   const lastSep = Math.max(url.lastIndexOf("/"), url.lastIndexOf(":"));
   const tail = url.slice(lastSep + 1);
   return tail.replace(/\.git$/, "");
 }
+function cloneUrl(url) {
+  try {
+    const u = new URL(url);
+    if (u.username || u.password) {
+      u.username = "";
+      u.password = "";
+      return u.toString();
+    }
+    return url;
+  } catch {
+    return url;
+  }
+}
 function validateOptions(opts) {
   if (!opts.name || !/^[a-zA-Z0-9._-]+$/.test(opts.name)) {
     throw new Error(
@@ -4075,10 +3989,11 @@ function buildPostCreateScript(opts) {
       if (parent) {
         lines.push(`mkdir -p "projects/${parent}"`);
       }
+      const url = cloneUrl(repo.url);
       lines.push(
         `if [ ! -d "projects/${repo.path}" ]; then`,
-        `  echo "\u2192 Cloning ${repo.path} from ${repo.url}\u2026"`,
-        `  git clone "${repo.url}" "projects/${repo.path}"`,
+        `  echo "\u2192 Cloning ${repo.path} from ${url}\u2026"`,
+        `  git clone "${url}" "projects/${repo.path}"`,
         `else`,
         `  echo "\u2192 projects/${repo.path} already exists, skipping clone"`,
         `fi`
@@ -4097,15 +4012,15 @@ function buildPostCreateScript(opts) {
 }
 async function writePostCreateScript(devcontainerDir, opts) {
   const dest = path11.join(devcontainerDir, "post-create.sh");
-  await fs8.writeFile(dest, buildPostCreateScript(opts));
-  await fs8.chmod(dest, 493);
+  await fs9.writeFile(dest, buildPostCreateScript(opts));
+  await fs9.chmod(dest, 493);
 }
 async function writeIfChanged(filePath, content) {
   try {
-    if (await fs8.readFile(filePath, "utf8") === content) return false;
+    if (await fs9.readFile(filePath, "utf8") === content) return false;
   } catch {
   }
-  await fs8.writeFile(filePath, content);
+  await fs9.writeFile(filePath, content);
   return true;
 }
 async function writeScaffold(opts, targetDir, scaffoldOpts = {}) {
@@ -4115,36 +4030,36 @@ async function writeScaffold(opts, targetDir, scaffoldOpts = {}) {
   const projectsDir = path11.join(targetDir, "projects");
   const homeDir = path11.join(targetDir, "home");
   const dataDir = path11.join(targetDir, "data");
-  await fs8.mkdir(devcontainerDir, { recursive: true });
-  await fs8.mkdir(monocerosDir, { recursive: true });
-  await fs8.mkdir(projectsDir, { recursive: true });
-  await fs8.mkdir(homeDir, { recursive: true });
+  await fs9.mkdir(devcontainerDir, { recursive: true });
+  await fs9.mkdir(monocerosDir, { recursive: true });
+  await fs9.mkdir(projectsDir, { recursive: true });
+  await fs9.mkdir(homeDir, { recursive: true });
   if (needsCompose(opts)) {
-    await fs8.mkdir(dataDir, { recursive: true });
+    await fs9.mkdir(dataDir, { recursive: true });
     for (const svc of opts.services) {
       const hasDataVolume = svc.volumes.some((v) => v.split(":")[0] === "data");
       if (hasDataVolume) {
-        await fs8.mkdir(path11.join(dataDir, svc.name), { recursive: true });
+        await fs9.mkdir(path11.join(dataDir, svc.name), { recursive: true });
       }
     }
     for (const dir of serviceVolumeHostDirs(opts.services, opts.repos)) {
-      await fs8.mkdir(path11.join(targetDir, dir), { recursive: true });
+      await fs9.mkdir(path11.join(targetDir, dir), { recursive: true });
     }
   }
   const containerGitignore = path11.join(targetDir, ".gitignore");
-  await fs8.writeFile(
+  await fs9.writeFile(
     containerGitignore,
     "/home/\n/.monoceros/\n/data/\n/AGENTS.md\n/CLAUDE.md\n"
   );
   const gitkeep = path11.join(projectsDir, ".gitkeep");
   if (!existsSync8(gitkeep)) {
-    await fs8.writeFile(gitkeep, "");
+    await fs9.writeFile(gitkeep, "");
   }
-  await fs8.writeFile(
+  await fs9.writeFile(
     path11.join(monocerosDir, ".gitignore"),
     "git-credentials*\ngitconfig\nglobal-gitignore\n"
   );
-  await fs8.writeFile(
+  await fs9.writeFile(
     path11.join(monocerosDir, "global-gitignore"),
     ".monoceros/\n"
   );
@@ -4155,26 +4070,26 @@ async function writeScaffold(opts, targetDir, scaffoldOpts = {}) {
   );
   const featuresDir = path11.join(devcontainerDir, "features");
   if (existsSync8(featuresDir)) {
-    await fs8.rm(featuresDir, { recursive: true, force: true });
+    await fs9.rm(featuresDir, { recursive: true, force: true });
   }
   const resolvedFeatures = resolveFeatures(opts);
   for (const f of resolvedFeatures) {
     if (!f.localSourceDir || !f.localName) continue;
     const dest = path11.join(featuresDir, f.localName);
-    await fs8.mkdir(dest, { recursive: true });
-    const entries = await fs8.readdir(f.localSourceDir, { withFileTypes: true });
+    await fs9.mkdir(dest, { recursive: true });
+    const entries = await fs9.readdir(f.localSourceDir, { withFileTypes: true });
     for (const entry2 of entries) {
       if (!entry2.isFile()) continue;
       if (entry2.name === "component.yml" || entry2.name === "devcontainer-feature.json") {
         continue;
       }
-      await fs8.cp(
+      await fs9.cp(
         path11.join(f.localSourceDir, entry2.name),
         path11.join(dest, entry2.name)
       );
     }
     if (f.generatedManifest) {
-      await fs8.writeFile(
+      await fs9.writeFile(
         path11.join(dest, "devcontainer-feature.json"),
         JSON.stringify(f.generatedManifest, null, 2) + "\n"
       );
@@ -4182,13 +4097,13 @@ async function writeScaffold(opts, targetDir, scaffoldOpts = {}) {
   }
   for (const f of resolvedFeatures) {
     for (const sub of f.persistentHomePaths) {
-      await fs8.mkdir(path11.join(homeDir, sub), { recursive: true });
+      await fs9.mkdir(path11.join(homeDir, sub), { recursive: true });
     }
     for (const entry2 of f.persistentHomeFiles) {
       const filePath = path11.join(homeDir, entry2.path);
-      await fs8.mkdir(path11.dirname(filePath), { recursive: true });
+      await fs9.mkdir(path11.dirname(filePath), { recursive: true });
       if (!existsSync8(filePath)) {
-        await fs8.writeFile(filePath, entry2.initialContent);
+        await fs9.writeFile(filePath, entry2.initialContent);
       }
     }
   }
@@ -4199,29 +4114,29 @@ async function writeScaffold(opts, targetDir, scaffoldOpts = {}) {
   if (needsCompose(opts)) {
     await writeIfChanged(composePath, buildComposeYaml(opts, dockerMode));
   } else if (existsSync8(composePath)) {
-    await fs8.rm(composePath);
+    await fs9.rm(composePath);
   }
   const workspacePath = path11.join(targetDir, `${opts.name}.code-workspace`);
   let existingWorkspace;
   try {
-    const raw = await fs8.readFile(workspacePath, "utf8");
+    const raw = await fs9.readFile(workspacePath, "utf8");
     existingWorkspace = JSON.parse(raw);
   } catch {
     existingWorkspace = void 0;
   }
   const generated = buildCodeWorkspaceJson(opts);
   const merged = mergeCodeWorkspace(existingWorkspace, generated);
-  await fs8.writeFile(workspacePath, JSON.stringify(merged, null, 2) + "\n");
+  await fs9.writeFile(workspacePath, JSON.stringify(merged, null, 2) + "\n");
   const vscodeDir = path11.join(targetDir, ".vscode");
   const settingsPath = path11.join(vscodeDir, "settings.json");
   let existingSettings;
   try {
-    existingSettings = JSON.parse(await fs8.readFile(settingsPath, "utf8"));
+    existingSettings = JSON.parse(await fs9.readFile(settingsPath, "utf8"));
   } catch {
     existingSettings = void 0;
   }
-  await fs8.mkdir(vscodeDir, { recursive: true });
-  await fs8.writeFile(
+  await fs9.mkdir(vscodeDir, { recursive: true });
+  await fs9.writeFile(
     settingsPath,
     JSON.stringify(mergeVscodeSettings(existingSettings), null, 2) + "\n"
   );
@@ -4976,7 +4891,7 @@ var init_markers = __esm({
 });
 
 // src/briefing/index.ts
-import { promises as fs9 } from "fs";
+import { promises as fs10 } from "fs";
 import path12 from "path";
 async function writeBriefing(input) {
   const subCommands = input.subCommands ?? await loadSubCommandsDynamic();
@@ -4994,8 +4909,8 @@ async function writeBriefing(input) {
   await writeMarkerAware(path12.join(input.targetDir, "AGENTS.md"), agentsBody);
   await writeMarkerAware(path12.join(input.targetDir, "CLAUDE.md"), claudeBody);
   const monocerosDir = path12.join(input.targetDir, ".monoceros");
-  await fs9.mkdir(monocerosDir, { recursive: true });
-  await fs9.writeFile(
+  await fs10.mkdir(monocerosDir, { recursive: true });
+  await fs10.writeFile(
     path12.join(monocerosDir, "commands.md"),
     commandsBody,
     "utf8"
@@ -5016,18 +4931,18 @@ function featureDisplayMap(components) {
 async function writeMarkerAware(filePath, body) {
   let existing = null;
   try {
-    existing = await fs9.readFile(filePath, "utf8");
+    existing = await fs10.readFile(filePath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
   if (existing) {
     const updated = replaceMarkerBlock(existing, body);
     if (updated !== null) {
-      await fs9.writeFile(filePath, updated, "utf8");
+      await fs10.writeFile(filePath, updated, "utf8");
       return;
     }
   }
-  await fs9.writeFile(filePath, wrapWithMarkers(body), "utf8");
+  await fs10.writeFile(filePath, wrapWithMarkers(body), "utf8");
 }
 async function loadSubCommandsDynamic() {
   const mod = await Promise.resolve().then(() => (init_main(), main_exports));
@@ -5519,7 +5434,7 @@ var init_yml = __esm({
 });
 
 // src/modify/index.ts
-import { promises as fs10 } from "fs";
+import { promises as fs11 } from "fs";
 import { consola as consola2 } from "consola";
 import { createPatch } from "diff";
 import path13 from "path";
@@ -5603,7 +5518,7 @@ function runAddAptPackages(input) {
 async function refreshBriefingFromYml(name, home) {
   const targetDir = containerDir(name, home);
   try {
-    await fs10.access(targetDir);
+    await fs11.access(targetDir);
   } catch {
     return;
   }
@@ -5691,6 +5606,23 @@ async function runAddRepo(input) {
       `Added a container git.user with \${${GIT_IDENTITY_VAR.name}}/\${${GIT_IDENTITY_VAR.email}} placeholders and seeded ${input.name}.env \u2014 fill them or leave blank to use your global git identity.`
     );
   }
+  if (result.status === "updated" && host) {
+    const home = input.monocerosHome ?? monocerosHome();
+    const prov = resolveProvider(host, entry2.provider);
+    const featureShort = prov === "github" ? "github" : prov === "gitlab" ? "gitlab" : void 0;
+    if (featureShort) {
+      const yml = await fs11.readFile(
+        containerConfigPath(input.name, home),
+        "utf8"
+      );
+      const cfg = parseConfig(yml).config;
+      const ref = (await resolveFeatureRefOrShortname(featureShort)).ref;
+      const present = (cfg.features ?? []).some((f) => f.ref === ref);
+      if (!present) {
+        await runAddFeature({ ...input, ref: featureShort });
+      }
+    }
+  }
   if (result.status === "updated") {
     await tryCloneInRunningContainer(input, entry2);
     await refreshBriefingFromYml(
@@ -5738,26 +5670,25 @@ async function tryCloneInRunningContainer(input, entry2) {
     return;
   }
   try {
-    const credsResult = await collectGitCredentials(
-      root,
-      [{ host: urlHost, provider }],
-      {
-        ...input.credentialsSpawn ? { spawn: input.credentialsSpawn } : {},
+    const { hostTokens } = await resolveContainerRepoTokens(
+      input.name,
+      home,
+      await loadComponentCatalog()
+    );
+    if (hostTokens.get(urlHost)) {
+      await collectGitCredentials(root, [{ host: urlHost, provider }], {
+        patByHost: hostTokens,
         logger: { info: () => {
         }, warn: (m) => logger.warn(m) }
-      }
-    );
-    const status = credsResult.perHost.find((h) => h.host === urlHost);
-    if (!status || status.status !== "ok") {
-      const detail = status?.detail ? `: ${status.detail}` : "";
+      });
+    } else {
       logger.warn(
-        `No HTTPS credentials available for ${urlHost}${detail}. The yml is updated; set up credentials (e.g. \`gh auth login\`) and re-run \`monoceros apply ${input.name}\` or rerun this add-repo.`
+        `No access token set for ${urlHost} \u2014 cloning will fail if this repo is private. Set one (see ${REPO_DOCS_URL}) and re-run.`
       );
-      return;
     }
   } catch (err) {
     logger.warn(
-      `Credential fetch for ${urlHost} failed: ${err instanceof Error ? err.message : String(err)}. The yml is updated.`
+      `Could not resolve a token for ${urlHost}: ${err instanceof Error ? err.message : String(err)}. The yml is updated; run \`monoceros apply ${input.name}\` to clone.`
     );
     return;
   }
@@ -5774,7 +5705,7 @@ async function tryCloneInRunningContainer(input, entry2) {
     `  exit 0`,
     `fi`,
     `mkdir -p ${shquote(parentRel)}`,
-    `git -c ${shquote(`credential.helper=${credentialHelper}`)} clone ${shquote(entry2.url)} ${shquote(targetRel)}`
+    `git -c ${shquote(`credential.helper=${credentialHelper}`)} clone ${shquote(cloneUrl(entry2.url))} ${shquote(targetRel)}`
   ];
   if (entry2.gitUser) {
     script.push(
@@ -6021,7 +5952,7 @@ async function mutate(opts, apply) {
   const logger = opts.logger ?? defaultLogger();
   let oldText;
   try {
-    oldText = await fs10.readFile(ymlPath, "utf8");
+    oldText = await fs11.readFile(ymlPath, "utf8");
   } catch {
     throw new Error(
       `No such config: ${ymlPath}. Run \`monoceros init <template> ${opts.name}\` first.`
@@ -6046,7 +5977,7 @@ async function mutate(opts, apply) {
       return { status: "aborted" };
     }
   }
-  await fs10.writeFile(ymlPath, newText, "utf8");
+  await fs11.writeFile(ymlPath, newText, "utf8");
   logger.success(`Updated ${ymlPath}.`);
   logger.info(
     `Run \`monoceros apply ${opts.name}\` to rebuild the dev-container and pick up the change.`
@@ -6125,6 +6056,8 @@ var init_modify = __esm({
     init_feature_doc();
     init_manifest();
     init_credentials();
+    init_repo_token();
+    init_schema();
     init_locate_running();
     init_global();
     init_schema();
@@ -6400,7 +6333,7 @@ var init_add_repo = __esm({
         },
         provider: {
           type: "string",
-          description: "Git provider for credential-helper guidance: github | gitlab | bitbucket | gitea. Required when the URL host is not github.com, gitlab.com, or bitbucket.org \u2014 Monoceros uses this to suggest the right auth (gh / glab / a provider token) on missing credentials."
+          description: "Git provider: github | gitlab | bitbucket. Required when the URL host is not github.com, gitlab.com, or bitbucket.org, so Monoceros knows which provider token to use for cloning."
         },
         yes: {
           type: "boolean",
@@ -6596,7 +6529,7 @@ var init_add_service = __esm({
 });
 
 // src/config/state.ts
-import { promises as fs11 } from "fs";
+import { promises as fs12 } from "fs";
 import path14 from "path";
 function buildStateFile(opts) {
   return {
@@ -6612,7 +6545,7 @@ function stateFilePath(targetDir) {
 }
 async function readStateFile(targetDir) {
   try {
-    const content = await fs11.readFile(stateFilePath(targetDir), "utf8");
+    const content = await fs12.readFile(stateFilePath(targetDir), "utf8");
     return JSON.parse(content);
   } catch {
     return void 0;
@@ -6620,8 +6553,8 @@ async function readStateFile(targetDir) {
 }
 async function writeStateFile(targetDir, state) {
   const monocerosDir = path14.join(targetDir, ".monoceros");
-  await fs11.mkdir(monocerosDir, { recursive: true });
-  await fs11.writeFile(
+  await fs12.mkdir(monocerosDir, { recursive: true });
+  await fs12.writeFile(
     stateFilePath(targetDir),
     JSON.stringify(state, null, 2) + "\n"
   );
@@ -6634,7 +6567,7 @@ var init_state = __esm({
 });
 
 // src/devcontainer/app-control.ts
-import { promises as fs12 } from "fs";
+import { promises as fs13 } from "fs";
 import path15 from "path";
 function findRunningContainer(name, opts = {}) {
   return findRunningContainerByLocalFolder(containerDir(name), {
@@ -6657,7 +6590,7 @@ async function hasWantedApps(name, home) {
   async function anyPid(dir) {
     let entries;
     try {
-      entries = await fs12.readdir(dir, { withFileTypes: true });
+      entries = await fs13.readdir(dir, { withFileTypes: true });
     } catch {
       return false;
     }
@@ -6684,7 +6617,7 @@ var init_app_control = __esm({
 });
 
 // src/devcontainer/browser-bridge.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { existsSync as existsSync9, promises as fsp4, readFileSync as readFileSync5 } from "fs";
 import http from "http";
 import path16 from "path";
@@ -6742,7 +6675,7 @@ function openInBrowser(url) {
   const psOpen = `Start-Process '${url.replace(/'/g, "''")}'`;
   const [cmd, args] = platform === "darwin" ? ["open", [url]] : platform === "win32" || wsl ? ["powershell.exe", ["-NoProfile", "-Command", psOpen]] : ["xdg-open", [url]];
   try {
-    const child = spawn5(cmd, args, {
+    const child = spawn4(cmd, args, {
       stdio: "ignore",
       detached: true
     });
@@ -6948,7 +6881,7 @@ var init_runtime_pull_hint = __esm({
 });
 
 // src/devcontainer/cli.ts
-import { spawn as spawn6 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 import { readFileSync as readFileSync6 } from "fs";
 import { createRequire } from "module";
 import path17 from "path";
@@ -6976,7 +6909,7 @@ var init_cli = __esm({
       const env = { ...process.env, DOCKER_CLI_HINTS: "false" };
       return new Promise((resolve, reject) => {
         if (options.interactive) {
-          const child2 = spawn6(process.execPath, [binPath, ...args], {
+          const child2 = spawn5(process.execPath, [binPath, ...args], {
             cwd,
             env,
             stdio: "inherit"
@@ -6985,7 +6918,7 @@ var init_cli = __esm({
           child2.on("exit", (code) => resolve(code ?? 0));
           return;
         }
-        const child = spawn6(process.execPath, [binPath, ...args], {
+        const child = spawn5(process.execPath, [binPath, ...args], {
           cwd,
           env,
           stdio: ["ignore", "pipe", "pipe"]
@@ -7033,14 +6966,14 @@ var init_cli = __esm({
 });
 
 // src/devcontainer/compose.ts
-import { spawn as spawn7 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 import { existsSync as existsSync10 } from "fs";
 import path18 from "path";
 import { Writable } from "stream";
 import { consola as consola10 } from "consola";
 function spawnDockerComposeTo(opts) {
   return (args, cwd) => new Promise((resolve, reject) => {
-    const child = spawn7("docker", ["compose", ...args], {
+    const child = spawn6("docker", ["compose", ...args], {
       cwd,
       stdio: ["inherit", "pipe", "pipe"]
     });
@@ -7368,7 +7301,7 @@ var init_compose = __esm({
     init_proxy();
     spawnDockerCompose = (args, cwd) => {
       return new Promise((resolve, reject) => {
-        const child = spawn7("docker", ["compose", ...args], {
+        const child = spawn6("docker", ["compose", ...args], {
           cwd,
           stdio: ["inherit", "pipe", "pipe"]
         });
@@ -7380,7 +7313,7 @@ var init_compose = __esm({
     };
     spawnDocker = (args) => {
       return new Promise((resolve, reject) => {
-        const child = spawn7("docker", args, {
+        const child = spawn6("docker", args, {
           stdio: ["ignore", "pipe", "pipe"]
         });
         let stdout = "";
@@ -7405,7 +7338,7 @@ var init_compose = __esm({
 });
 
 // src/devcontainer/bridge-daemon.ts
-import { spawn as spawn8 } from "child_process";
+import { spawn as spawn7 } from "child_process";
 import {
   existsSync as existsSync11,
   mkdirSync,
@@ -7442,7 +7375,7 @@ function spawnBridgeDaemon(root) {
     const self = process.argv[1];
     if (!self) return;
     mkdirSync(relayDir(root), { recursive: true });
-    const child = spawn8(
+    const child = spawn7(
       process.execPath,
       [...process.execArgv, self, "__bridge", root],
       {
@@ -7671,8 +7604,11 @@ function createApplyProgress(opts) {
         tail.push(line);
         if (tail.length > TAIL_LINES) tail.shift();
         for (const trig of PHASE_TRIGGERS) {
-          if (trig.pattern.test(line)) {
-            setPhase(trig.label);
+          const m = line.match(trig.pattern);
+          if (m) {
+            setPhase(
+              typeof trig.label === "function" ? trig.label(m) : trig.label
+            );
             break;
           }
         }
@@ -7768,6 +7704,15 @@ var init_apply_progress = __esm({
         pattern: /Start: Run: docker (?:run\b|compose\b.* up\b)/i,
         label: "starting container\u2026"
       },
+      // post-create.sh sub-steps. Repo clones are the long, network-bound
+      // part; surface which repo is being cloned instead of an opaque
+      // "running postCreate…". The marker is the `→ Cloning <path> from …`
+      // line post-create.sh echoes (see create/scaffold.ts). A devcontainer
+      // timestamp prefix is fine — the pattern is unanchored.
+      {
+        pattern: /→ Cloning (\S+) from /,
+        label: (m) => `cloning ${m[1]}\u2026`
+      },
       { pattern: /Running the postCreateCommand/i, label: "running postCreate\u2026" }
     ];
   }
@@ -7941,7 +7886,7 @@ var init_machine_state = __esm({
 });
 
 // src/devcontainer/docker-mode.ts
-import { spawn as spawn9 } from "child_process";
+import { spawn as spawn8 } from "child_process";
 async function detectDockerMode(options = {}) {
   const spawnFn = options.spawn ?? realDockerInfo;
   try {
@@ -7991,7 +7936,7 @@ var init_docker_mode = __esm({
     init_format();
     realDockerInfo = () => {
       return new Promise((resolve, reject) => {
-        const child = spawn9(
+        const child = spawn8(
           "docker",
           ["info", "--format", "{{json .SecurityOptions}}"],
           {
@@ -8010,8 +7955,8 @@ var init_docker_mode = __esm({
 });
 
 // src/devcontainer/identity.ts
-import { spawn as spawn10 } from "child_process";
-import { promises as fs13 } from "fs";
+import { spawn as spawn9 } from "child_process";
+import { promises as fs14 } from "fs";
 import path22 from "path";
 import { consola as consola11 } from "consola";
 async function resolveIdentityWithPrompt(options = {}) {
@@ -8082,8 +8027,8 @@ async function collectGitIdentity(devContainerRoot, options = {}) {
   const lines = ["[user]"];
   if (resolved.name !== void 0) lines.push(`	name = ${resolved.name}`);
   if (resolved.email !== void 0) lines.push(`	email = ${resolved.email}`);
-  await fs13.mkdir(gitconfigDir, { recursive: true });
-  await fs13.writeFile(gitconfigPath, lines.join("\n") + "\n");
+  await fs14.mkdir(gitconfigDir, { recursive: true });
+  await fs14.writeFile(gitconfigPath, lines.join("\n") + "\n");
   return {
     ...resolved.name !== void 0 ? { name: resolved.name } : {},
     ...resolved.email !== void 0 ? { email: resolved.email } : {},
@@ -8126,7 +8071,7 @@ async function readKeyFromHost(spawnFn, key, logger) {
 }
 async function readExistingGitconfig(filePath) {
   try {
-    const content = await fs13.readFile(filePath, "utf8");
+    const content = await fs14.readFile(filePath, "utf8");
     const result = {};
     const nameMatch = /^\s*name\s*=\s*(.+?)\s*$/m.exec(content);
     const emailMatch = /^\s*email\s*=\s*(.+?)\s*$/m.exec(content);
@@ -8143,7 +8088,7 @@ var init_identity = __esm({
     "use strict";
     realGitConfigGet = (key) => {
       return new Promise((resolve, reject) => {
-        const child = spawn10("git", ["config", "--global", "--get", key], {
+        const child = spawn9("git", ["config", "--global", "--get", key], {
           stdio: ["ignore", "pipe", "inherit"]
         });
         let stdout = "";
@@ -8203,7 +8148,7 @@ var init_identity = __esm({
 });
 
 // src/apply/index.ts
-import { existsSync as existsSync12, promises as fs14 } from "fs";
+import { existsSync as existsSync12, promises as fs15 } from "fs";
 import { consola as consola12 } from "consola";
 async function runApply(opts) {
   const home = opts.monocerosHome ?? monocerosHome();
@@ -8243,9 +8188,18 @@ ${sectionLine(label)}
   warnOnDeprecatedFeatureRefs(parsed.config.features, globalConfig, logger);
   const envPath = containerEnvPath(opts.name, home);
   await ensureEnvGitignored(containerConfigsDir(home));
-  const envVars = readEnvFile(envPath);
+  const envVars = {
+    ...readEnvFile(globalEnvPath(home)),
+    ...readEnvFile(envPath),
+    ...opts.env ?? {}
+  };
+  const catalog = await loadComponentCatalog();
+  const repoTokens = resolveRepoTokens(parsed.config, catalog, envVars);
+  for (const use of repoTokens.used) {
+    logger.info(`Repo token: ${formatTokenUse(use)}`);
+  }
   const resolvedFeatures = interpolateFeatureOptions(
-    parsed.config.features,
+    repoTokens.features,
     envVars
   );
   const createOpts = normalizeOptions(
@@ -8327,13 +8281,11 @@ Fix the value in the env file (or the yml).`
     throw new Error(formatUnknownProviderError(unknownProviderHosts));
   }
   if (hostsToFetch.length > 0) {
-    const credResult = await collectGitCredentials(targetDir, hostsToFetch, {
-      ...opts.credentialsSpawn ? { spawn: opts.credentialsSpawn } : {},
-      logger: idLogger
-    });
-    const missing = credResult.perHost.filter((p) => p.status !== "ok");
-    if (missing.length > 0) {
-      throw new Error(formatMissingCredentialsError(missing));
+    if (repoTokens.hostTokens.size > 0) {
+      await collectGitCredentials(targetDir, hostsToFetch, {
+        patByHost: repoTokens.hostTokens,
+        logger: idLogger
+      });
     }
   }
   section("Scaffold");
@@ -8343,7 +8295,7 @@ Fix the value in the env file (or the yml).`
   if (dockerMode === "rootless") {
     throw new Error(formatRootlessNotSupportedError());
   }
-  await fs14.mkdir(targetDir, { recursive: true });
+  await fs15.mkdir(targetDir, { recursive: true });
   await writeScaffold(createOpts, targetDir, { dockerMode });
   await writeStateFile(
     targetDir,
@@ -8567,6 +8519,15 @@ ${stripAnsi(formatted)}
 `);
       }
     }
+    if (repoTokens.missing.length > 0) {
+      const warning = formatUnauthenticatedRepos(repoTokens.missing, opts.name);
+      progressOut.write(`
+${warning}
+`);
+      applyLog.stream.write(`
+${stripAnsi(warning)}
+`);
+    }
     await applyLog.close();
     progressOut.write(`
   ${dim(`log: ${prettyPath(applyLog.path)}`)}
@@ -8582,7 +8543,7 @@ ${stripAnsi(formatted)}
 }
 async function assertSafeTargetDir(targetDir, expectedOrigin) {
   if (!existsSync12(targetDir)) return;
-  const entries = await fs14.readdir(targetDir);
+  const entries = await fs15.readdir(targetDir);
   if (entries.length === 0) return;
   const state = await readStateFile(targetDir);
   if (state) {
@@ -8652,7 +8613,7 @@ async function persistPromptedIdentity(prompted, ymlPath, home, logger) {
   }
   if (wantContainer) {
     try {
-      const text = await fs14.readFile(ymlPath, "utf8");
+      const text = await fs15.readFile(ymlPath, "utf8");
       const parsed = parseConfig(text, ymlPath);
       const changed = setContainerGitUserInDoc(parsed.doc, {
         name: prompted.name,
@@ -8660,7 +8621,7 @@ async function persistPromptedIdentity(prompted, ymlPath, home, logger) {
       });
       if (changed) {
         const out = stringifyConfig(parsed.doc);
-        await fs14.writeFile(ymlPath, out, "utf8");
+        await fs15.writeFile(ymlPath, out, "utf8");
         logger.info(
           `Saved identity in this container \u2014 wrote git.user into ${prettyPath(ymlPath)}.`
         );
@@ -8706,6 +8667,7 @@ var init_apply = __esm({
     init_identity();
     init_global();
     init_yml();
+    init_repo_token();
   }
 });
 
@@ -8760,7 +8722,7 @@ var init_shell = __esm({
 });
 
 // src/open/index.ts
-import { spawn as spawn11 } from "child_process";
+import { spawn as spawn10 } from "child_process";
 import { accessSync, constants, existsSync as existsSync14 } from "fs";
 import path24 from "path";
 import { consola as consola13 } from "consola";
@@ -8796,7 +8758,7 @@ async function resolveEditorBinary(tool) {
   return null;
 }
 function realLaunch(bin, args) {
-  const child = spawn11(bin, args, {
+  const child = spawn10(bin, args, {
     detached: true,
     stdio: "ignore"
   });
@@ -8880,7 +8842,7 @@ var CLI_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    CLI_VERSION = true ? "1.36.9" : "dev";
+    CLI_VERSION = true ? "1.37.1" : "dev";
   }
 });
 
@@ -9114,7 +9076,7 @@ var init_bridge = __esm({
 });
 
 // src/config/launch-config.ts
-import { promises as fs15 } from "fs";
+import { promises as fs16 } from "fs";
 import path25 from "path";
 function launchConfigPath(name, appRel, home) {
   return path25.join(
@@ -9167,7 +9129,7 @@ async function readLaunchConfig(name, appRel, home) {
   const file = launchConfigPath(name, appRel, home);
   let content;
   try {
-    content = await fs15.readFile(file, "utf8");
+    content = await fs16.readFile(file, "utf8");
   } catch {
     return void 0;
   }
@@ -9209,7 +9171,7 @@ async function listApps(name, home) {
   async function walk(at, rel, depth) {
     let entries;
     try {
-      entries = await fs15.readdir(at, { withFileTypes: true });
+      entries = await fs16.readdir(at, { withFileTypes: true });
     } catch {
       return;
     }
@@ -9218,7 +9180,7 @@ async function listApps(name, home) {
     );
     if (hasLaunch) {
       try {
-        await fs15.access(path25.join(at, LAUNCH_DIRNAME, LAUNCH_FILENAME));
+        await fs16.access(path25.join(at, LAUNCH_DIRNAME, LAUNCH_FILENAME));
         if (rel) out.push(rel);
       } catch {
       }
@@ -9249,7 +9211,7 @@ var init_launch_config = __esm({
 });
 
 // src/completion/resolve.ts
-import { existsSync as existsSync15, promises as fs16 } from "fs";
+import { existsSync as existsSync15, promises as fs17 } from "fs";
 import path26 from "path";
 async function resolveCompletions(line, point, opts = {}) {
   const { prev, current } = parseCompletionLine(line, point);
@@ -9401,7 +9363,7 @@ async function listContainerNames(ctx) {
   const home = ctx.opts.monocerosHome ?? monocerosHome();
   const dir = path26.join(home, "container-configs");
   if (!existsSync15(dir)) return [];
-  const entries = await fs16.readdir(dir);
+  const entries = await fs17.readdir(dir);
   return entries.filter((e) => e.endsWith(".yml")).map((e) => e.slice(0, -".yml".length)).sort();
 }
 function containerNameFromCtx(ctx) {
@@ -9464,7 +9426,7 @@ async function collectDirs(dir, maxDepth) {
   async function walk(at, rel, depth) {
     let entries;
     try {
-      entries = await fs16.readdir(at, { withFileTypes: true });
+      entries = await fs17.readdir(at, { withFileTypes: true });
     } catch {
       return;
     }
@@ -9808,7 +9770,7 @@ var init_complete = __esm({
 });
 
 // src/update/notifier.ts
-import { spawn as spawn12 } from "child_process";
+import { spawn as spawn11 } from "child_process";
 function isNewerVersion(latest, current) {
   const parse = (v) => {
     const m = /^(\d+)\.(\d+)\.(\d+)/.exec(v.trim());
@@ -9867,7 +9829,7 @@ function spawnBackgroundCheck() {
   const self = process.argv[1];
   if (!self) return;
   try {
-    const child = spawn12(process.execPath, [self, "__update-check"], {
+    const child = spawn11(process.execPath, [self, "__update-check"], {
       detached: true,
       stdio: "ignore"
     });
@@ -10061,162 +10023,6 @@ function generateComposedYml(name, composed, lookupManifest, repoUrls = [], port
   }
   return ensureTrailingNewline(lines.join("\n"));
 }
-function generateDocumentedYml(name, catalog, lookupManifest, repoUrls = [], ports = []) {
-  const byCategory = groupByCategory(catalog);
-  const lines = [];
-  pushHeader(lines, SCHEMA_HEADER_DOCUMENTED, name);
-  lines.push("");
-  lines.push("schemaVersion: 1");
-  lines.push(`name: ${name}`);
-  lines.push(
-    "# Pinned runtime base image, reused on every apply (never auto-bumped)."
-  );
-  lines.push(
-    "# `monoceros upgrade <name>` refreshes the tooling and moves this to the"
-  );
-  lines.push("# latest runtime when a newer one exists.");
-  lines.push(`runtimeVersion: ${DEFAULT_RUNTIME_VERSION}`);
-  lines.push("");
-  if (byCategory.language.length > 0) {
-    pushSectionHeader(
-      lines,
-      LANGUAGES_HEADER,
-      /* commented */
-      true
-    );
-    lines.push("# languages:");
-    for (const c of byCategory.language) {
-      for (const lang of c.file.contributes.languages ?? []) {
-        const ver = LANGUAGE_CATALOG[lang]?.defaultVersion;
-        lines.push(`#   - ${ver ? `${lang}:${ver}` : lang}`);
-      }
-    }
-    lines.push("");
-  }
-  if (byCategory.service.length > 0) {
-    pushSectionHeader(
-      lines,
-      SERVICES_HEADER,
-      /* commented */
-      true
-    );
-    lines.push("# services:");
-    for (const c of byCategory.service) {
-      for (const svc of c.file.contributes.services ?? []) {
-        const body = renderServiceObjectBody(expandCuratedService(svc));
-        lines.push(`#   - ${body[0]}`);
-        for (const line of body.slice(1)) lines.push(`#     ${line}`);
-        const exComment = exampleVolumesComment(
-          curatedServiceExampleVolumes(svc)
-        );
-        if (exComment) {
-          for (const cl of exComment.split("\n")) lines.push(`#    ${cl}`);
-        }
-      }
-    }
-    lines.push("");
-  }
-  if (byCategory.feature.length > 0) {
-    pushSectionHeader(
-      lines,
-      FEATURES_HEADER_DOCUMENTED,
-      /* commented */
-      true
-    );
-    lines.push("# features:");
-    const renderedRefs = /* @__PURE__ */ new Set();
-    const topLevel = byCategory.feature.filter((c) => !c.name.includes("/"));
-    for (const c of topLevel) {
-      for (const f of c.file.contributes.features ?? []) {
-        if (renderedRefs.has(f.ref)) continue;
-        renderedRefs.add(f.ref);
-        lines.push("#");
-        renderFeatureBlock(
-          lines,
-          f,
-          lookupManifest(f.ref),
-          /* commented */
-          true
-        );
-      }
-    }
-    for (const c of byCategory.feature) {
-      if (!c.name.includes("/")) continue;
-      for (const f of c.file.contributes.features ?? []) {
-        if (renderedRefs.has(f.ref)) continue;
-        renderedRefs.add(f.ref);
-        lines.push("#");
-        renderFeatureBlock(
-          lines,
-          f,
-          lookupManifest(f.ref),
-          /* commented */
-          true
-        );
-      }
-    }
-    lines.push("");
-  }
-  if (repoUrls.length > 0) {
-    pushGitIdentityBlock(lines);
-    pushSectionHeader(
-      lines,
-      REPOS_HEADER,
-      /* commented */
-      false
-    );
-    lines.push("repos:");
-    for (const url of repoUrls) {
-      lines.push(`  - url: ${url}`);
-    }
-    lines.push("");
-  } else {
-    pushSectionHeader(
-      lines,
-      REPOS_HEADER,
-      /* commented */
-      true
-    );
-    lines.push("# repos:");
-    lines.push("#   - url: https://github.com/<org>/<repo>.git");
-    lines.push("#     path: <folder>");
-    lines.push("#     provider: github");
-    lines.push("#     git:");
-    lines.push("#       user:");
-    lines.push("#         name: Your Name");
-    lines.push("#         email: you@example.com");
-    lines.push("");
-  }
-  if (ports.length > 0) {
-    pushSectionHeader(
-      lines,
-      routingHeader(name),
-      /* commented */
-      false
-    );
-    lines.push("routing:");
-    lines.push("  ports:");
-    for (const port of ports) {
-      lines.push(`    - ${port}`);
-    }
-    lines.push("  # vscodeAutoForward: false");
-    lines.push("");
-  } else {
-    pushSectionHeader(
-      lines,
-      routingHeader(name),
-      /* commented */
-      true
-    );
-    lines.push("# routing:");
-    lines.push("#   ports:");
-    lines.push("#     - 3000");
-    lines.push("#     - 5173");
-    lines.push("#   vscodeAutoForward: false");
-    lines.push("");
-  }
-  return ensureTrailingNewline(lines.join("\n"));
-}
 function pushServiceEntry(out, svc) {
   if (svc.kind === "custom") {
     const { bodyLines, comment } = renderCustomService(
@@ -10300,24 +10106,10 @@ function renderScalarValue(value) {
   }
   return String(value);
 }
-function groupByCategory(catalog) {
-  const out = {
-    language: [],
-    service: [],
-    feature: []
-  };
-  const sorted = [...catalog.values()].sort(
-    (a, b) => a.name.localeCompare(b.name)
-  );
-  for (const c of sorted) {
-    out[c.file.category].push(c);
-  }
-  return out;
-}
 function ensureTrailingNewline(s) {
   return s.endsWith("\n") ? s : s + "\n";
 }
-var SCHEMA_HEADER_ACTIVE, SCHEMA_HEADER_DOCUMENTED, COMMENT_WIDTH, LANGUAGES_HEADER, SERVICES_HEADER, APT_PACKAGES_HEADER, FEATURES_HEADER_ACTIVE, FEATURES_HEADER_DOCUMENTED, REPOS_HEADER, GIT_IDENTITY_HEADER;
+var SCHEMA_HEADER_ACTIVE, COMMENT_WIDTH, LANGUAGES_HEADER, SERVICES_HEADER, APT_PACKAGES_HEADER, FEATURES_HEADER_ACTIVE, REPOS_HEADER, GIT_IDENTITY_HEADER;
 var init_generator = __esm({
   "src/init/generator.ts"() {
     "use strict";
@@ -10325,21 +10117,19 @@ var init_generator = __esm({
     init_catalog();
     init_service_doc();
     init_env_file();
-    SCHEMA_HEADER_ACTIVE = "# Solution-config \u2014 describes what should be inside your dev-container.\n# Edit any section, then run `monoceros apply <name>` to (re-)build.";
-    SCHEMA_HEADER_DOCUMENTED = "# Solution-config \u2014 describes what should be inside your dev-container.\n# Every section is commented out by default; un-comment what you need\n# (strip one `#` per line of the block), then run `monoceros apply <name>`.";
+    SCHEMA_HEADER_ACTIVE = "# Solution-config: what should be inside your dev-container.\n# Starts minimal; add languages, features, services, or repos with\n# `monoceros add-feature/add-service/add-repo <name>` (see\n# `monoceros list-components`), then `monoceros apply <name>`.";
     COMMENT_WIDTH = 76;
     LANGUAGES_HEADER = "Language runtimes installed inside the dev-container. Pick the ones your projects build against. The catalog of available runtimes is shown by `monoceros list-components`.";
     SERVICES_HEADER = "Sibling containers that run alongside the dev-container (databases, caches, message queues, \u2026). Each service is reachable from inside the dev-container by its name as hostname (e.g. `postgres://postgres:5432`). Activating any service switches the container to docker-compose mode automatically.";
     APT_PACKAGES_HEADER = "Debian/Ubuntu apt packages installed in the dev-container at build time. No curated list \u2014 any apt package name works; an invalid name surfaces as an apt error during build.";
     FEATURES_HEADER_ACTIVE = "A Monoceros dev-container is shaped by features \u2014 pluggable units that drop tooling (AI assistants, language CLIs, cloud SDKs, \u2026) into the container and bring their own options. The features active for this container are listed below; adjust their options as needed. Shared credentials used across containers belong in monoceros-config.yml under `defaults.features.<ref>` rather than here. Full catalog: `monoceros list-components`.";
-    FEATURES_HEADER_DOCUMENTED = "A Monoceros dev-container is shaped by features \u2014 pluggable units that drop tooling (AI assistants, language CLIs, cloud SDKs, \u2026) into the container and bring their own options. Un-comment the blocks below for the features you want active. Shared credentials used across containers belong in monoceros-config.yml under `defaults.features.<ref>` rather than here. Full catalog: `monoceros list-components`.";
-    REPOS_HEADER = "Git repositories cloned into `projects/` on container start-up. HTTPS URLs only. The provider is auto-detected for github.com / gitlab.com / bitbucket.org; for any other host (self-hosted GitLab, Gitea, \u2026) declare `provider:` explicitly. Add more later with `monoceros add-repo`.";
+    REPOS_HEADER = "Git repositories cloned into `projects/` on container start-up. HTTPS URLs only. The provider is auto-detected for github.com / gitlab.com / bitbucket.org; for any other host (self-hosted GitLab, GitHub Enterprise, \u2026) declare `provider:` explicitly. Add more later with `monoceros add-repo`.";
     GIT_IDENTITY_HEADER = "Git committer identity for commits made inside the container. The ${VAR} values resolve from <name>.env at apply time \u2014 fill them there, or leave them blank to fall back to your global git config (or a one-time prompt). Override per repo under repos[].git.user.";
   }
 });
 
 // src/init/index.ts
-import { existsSync as existsSync16, promises as fs17 } from "fs";
+import { existsSync as existsSync16, promises as fs18 } from "fs";
 import path27 from "path";
 import { consola as consola16 } from "consola";
 async function runInit(opts) {
@@ -10412,22 +10202,24 @@ async function runInit(opts) {
     seenPorts.add(raw);
     ports.push(raw);
   }
-  let text;
+  const explicitFeatures = opts.features ?? [];
+  const repoFeatures = [
+    ...new Set(
+      repos.map((u) => KNOWN_PROVIDER_HOSTS[new URL(u).hostname.toLowerCase()]).filter(
+        (p) => p === "github" || p === "gitlab"
+      ).filter((p) => !explicitFeatures.includes(p)).map((p) => catalog.get(p)?.file.contributes.features?.[0]?.ref).filter((ref) => !!ref)
+    )
+  ].filter((ref) => !explicitFeatures.includes(ref));
   const composed = resolveComposedInit(catalog, {
     languages: opts.languages ?? [],
-    features: opts.features ?? [],
+    features: [...explicitFeatures, ...repoFeatures],
     services: opts.services ?? [],
     aptPackages: opts.aptPackages ?? []
   });
-  const anyComposed = composed.languages.length > 0 || composed.features.length > 0 || composed.services.length > 0 || composed.aptPackages.length > 0;
-  if (!anyComposed) {
-    text = generateDocumentedYml(opts.name, catalog, lookup, repos, ports);
-  } else {
-    text = generateComposedYml(opts.name, composed, lookup, repos, ports);
-  }
-  await fs17.mkdir(containerConfigsDir(home), { recursive: true });
+  const text = generateComposedYml(opts.name, composed, lookup, repos, ports);
+  await fs18.mkdir(containerConfigsDir(home), { recursive: true });
   await ensureEnvGitignored(containerConfigsDir(home));
-  await fs17.writeFile(dest, text, "utf8");
+  await fs18.writeFile(dest, text, "utf8");
   const envPath = containerEnvPath(opts.name, home);
   const seedVars = {};
   for (const f of composed.features) {
@@ -10449,21 +10241,13 @@ async function runInit(opts) {
     seedVars[GIT_IDENTITY_VAR.email] = "";
   }
   await ensureEnvVars(envPath, opts.name, seedVars);
-  const documented = !anyComposed;
   const ymlRel = path27.relative(home, dest);
   const envRel = path27.relative(home, envPath);
-  if (documented) {
-    logger.success(`Wrote documented default to ${ymlRel} and ${envRel}.`);
-    logger.info(
-      `Un-comment what you need, then \`monoceros apply ${opts.name}\`.`
-    );
-  } else {
-    logger.success(`Composed into ${ymlRel} and ${envRel}.`);
-    logger.info(
-      `Edit the files if you need to tweak, then \`monoceros apply ${opts.name}\`.`
-    );
-  }
-  return { configPath: dest, documented };
+  logger.success(`Wrote ${ymlRel} and ${envRel}.`);
+  logger.info(
+    `Add components with \`monoceros add-feature/add-service/add-repo ${opts.name}\` (see \`monoceros list-components\`), then \`monoceros apply ${opts.name}\`.`
+  );
+  return { configPath: dest };
 }
 function resolveComposedInit(catalog, raw) {
   return {
@@ -11010,14 +10794,14 @@ var init_list_components = __esm({
 });
 
 // src/commands/logs.ts
-import { spawn as spawn13 } from "child_process";
+import { spawn as spawn12 } from "child_process";
 import path28 from "path";
 import { defineCommand as defineCommand16 } from "citty";
 import { consola as consola20 } from "consola";
 function tailLogFile(file, follow) {
   const [cmd, args] = follow ? ["tail", ["-F", file]] : ["cat", [file]];
   return new Promise((resolve, reject) => {
-    const child = spawn13(cmd, args, { stdio: "inherit" });
+    const child = spawn12(cmd, args, { stdio: "inherit" });
     child.on("error", reject);
     child.on("exit", (code) => resolve(code ?? 0));
   });
@@ -11315,7 +11099,7 @@ var init_remove_feature = __esm({
 });
 
 // src/remove/index.ts
-import { existsSync as existsSync17, promises as fs18 } from "fs";
+import { existsSync as existsSync17, promises as fs19 } from "fs";
 import path29 from "path";
 import { consola as consola24 } from "consola";
 async function runRemove(opts) {
@@ -11362,17 +11146,17 @@ async function runRemove(opts) {
   if (!opts.noBackup && (hasYml || hasContainer)) {
     const ts = (opts.now ?? /* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
     backupPath = path29.join(home, "container-backups", `${opts.name}-${ts}`);
-    await fs18.mkdir(backupPath, { recursive: true });
+    await fs19.mkdir(backupPath, { recursive: true });
     if (hasYml) {
-      await fs18.copyFile(ymlPath, path29.join(backupPath, `${opts.name}.yml`));
+      await fs19.copyFile(ymlPath, path29.join(backupPath, `${opts.name}.yml`));
     }
     if (hasEnv) {
-      await fs18.copyFile(envPath, path29.join(backupPath, `${opts.name}.env`));
+      await fs19.copyFile(envPath, path29.join(backupPath, `${opts.name}.env`));
     }
     if (hasContainer) {
       const dst = path29.join(backupPath, "container");
       try {
-        await fs18.cp(containerPath, dst, { recursive: true });
+        await fs19.cp(containerPath, dst, { recursive: true });
       } catch (err) {
         const code = err.code;
         if (code !== "EACCES" && code !== "EPERM") {
@@ -11381,7 +11165,7 @@ async function runRemove(opts) {
         logger.info(
           `[remove] backup hit ${code} on root-owned files; copying via a throw-away alpine container\u2026`
         );
-        await fs18.mkdir(dst, { recursive: true });
+        await fs19.mkdir(dst, { recursive: true });
         const { exitCode, stderr } = await dockerExec([
           "run",
           "--rm",
@@ -11407,14 +11191,14 @@ async function runRemove(opts) {
     await stopBridgeDaemon(containerPath);
   }
   if (hasYml) {
-    await fs18.rm(ymlPath, { force: true });
+    await fs19.rm(ymlPath, { force: true });
   }
   if (hasEnv) {
-    await fs18.rm(envPath, { force: true });
+    await fs19.rm(envPath, { force: true });
   }
   if (hasContainer) {
     try {
-      await fs18.rm(containerPath, { recursive: true, force: true });
+      await fs19.rm(containerPath, { recursive: true, force: true });
     } catch (err) {
       const code = err.code;
       if (code !== "EACCES" && code !== "EPERM") {
@@ -11436,7 +11220,7 @@ async function runRemove(opts) {
         "-delete"
       ]);
       try {
-        await fs18.rm(containerPath, { recursive: true, force: true });
+        await fs19.rm(containerPath, { recursive: true, force: true });
       } catch (err2) {
         const code2 = err2.code;
         throw new Error(
@@ -11571,7 +11355,7 @@ var init_remove2 = __esm({
 });
 
 // src/restore/index.ts
-import { existsSync as existsSync18, promises as fs19 } from "fs";
+import { existsSync as existsSync18, promises as fs20 } from "fs";
 import path30 from "path";
 import { consola as consola26 } from "consola";
 async function runRestore(opts) {
@@ -11584,11 +11368,11 @@ async function runRestore(opts) {
   if (!existsSync18(backup)) {
     throw new Error(`Backup not found: ${backup}.`);
   }
-  const stat = await fs19.stat(backup);
+  const stat = await fs20.stat(backup);
   if (!stat.isDirectory()) {
     throw new Error(`Backup path is not a directory: ${backup}.`);
   }
-  const entries = await fs19.readdir(backup);
+  const entries = await fs20.readdir(backup);
   const ymlFiles = entries.filter((f) => f.endsWith(".yml"));
   if (ymlFiles.length === 0) {
     throw new Error(
@@ -11618,13 +11402,13 @@ async function runRestore(opts) {
       `Refusing to restore: ${destContainer} already exists. Remove the current container first (\`monoceros remove ${name}\`).`
     );
   }
-  await fs19.mkdir(containerConfigsDir(home), { recursive: true });
-  await fs19.copyFile(path30.join(backup, ymlFile), destYml);
+  await fs20.mkdir(containerConfigsDir(home), { recursive: true });
+  await fs20.copyFile(path30.join(backup, ymlFile), destYml);
   if (hasEnv) {
-    await fs19.copyFile(envInBackup, containerEnvPath(name, home));
+    await fs20.copyFile(envInBackup, containerEnvPath(name, home));
   }
   if (hasContainer) {
-    await fs19.cp(containerInBackup, destContainer, { recursive: true });
+    await fs20.cp(containerInBackup, destContainer, { recursive: true });
   }
   logger.success(`Restored '${name}' from ${prettyPath(backup)}.`);
   logger.info(
@@ -12334,7 +12118,7 @@ var init_port_check2 = __esm({
 });
 
 // src/tunnel/run.ts
-import { spawn as spawn14 } from "child_process";
+import { spawn as spawn13 } from "child_process";
 import { consola as consola34 } from "consola";
 function signalNumber(signal) {
   switch (signal) {
@@ -12424,7 +12208,7 @@ var init_run3 = __esm({
     init_port_check2();
     SOCAT_IMAGE = "alpine/socat:1.8.0.3";
     defaultDockerSpawn = (args) => {
-      const child = spawn14("docker", args, {
+      const child = spawn13("docker", args, {
         stdio: "inherit"
       });
       const exited = new Promise((resolve, reject) => {
@@ -13351,7 +13135,7 @@ var init_prune = __esm({
 });
 
 // src/upgrade/index.ts
-import { existsSync as existsSync21, promises as fs20 } from "fs";
+import { existsSync as existsSync21, promises as fs21 } from "fs";
 import { consola as consola41 } from "consola";
 async function fetchRuntimeVersions() {
   const tokenUrl = `https://ghcr.io/token?service=ghcr.io&scope=repository:${RUNTIME_REPO}:pull`;
@@ -13468,10 +13252,10 @@ async function runUpgrade(opts) {
   for (const name of targets) {
     const ymlPath = containerConfigPath(name, home);
     if (!existsSync21(ymlPath)) continue;
-    const raw = await fs20.readFile(ymlPath, "utf8");
+    const raw = await fs21.readFile(ymlPath, "utf8");
     const updated = setRuntimeVersion(raw, pinVersion);
     if (updated !== raw) {
-      await fs20.writeFile(ymlPath, updated);
+      await fs21.writeFile(ymlPath, updated);
       bumped += 1;
       logger.info(`Pinned '${name}' to runtime ${pinVersion}.`);
     }
@@ -13513,7 +13297,7 @@ function formatPruneLine(prune) {
 }
 async function listContainerNames2(home) {
   try {
-    const entries = await fs20.readdir(containerConfigsDir(home));
+    const entries = await fs21.readdir(containerConfigsDir(home));
     return entries.filter((e) => e.endsWith(".yml")).map((e) => e.slice(0, -".yml".length));
   } catch {
     return [];