@getollie/cli 0.0.4 → 0.2.0

package/dist/index.js

@@ -0,0 +1,944 @@
+#!/usr/bin/env node
+
+// src/sandbox/just-bash.ts
+import { realpathSync, statSync } from "fs";
+import { Bash, InMemoryFs, MountableFs, ReadWriteFs } from "just-bash";
+
+// src/sandbox/git/index.ts
+import { posix as posix2 } from "path";
+import { createTwoFilesPatch } from "diff";
+import * as git from "isomorphic-git";
+import { defineCommand } from "just-bash";
+
+// src/sandbox/git/fs-adapter.ts
+import { posix } from "path";
+var ROOT = "/workspace";
+function safePath(path) {
+  if (path.includes("\0") || path.includes("\\")) {
+    throw Object.assign(new Error("Invalid virtual Git path"), { code: "EINVAL" });
+  }
+  const normalized = posix.resolve(path);
+  if (normalized !== ROOT && !normalized.startsWith(`${ROOT}/`)) {
+    throw Object.assign(new Error("Git path is outside /workspace"), { code: "EACCES" });
+  }
+  return normalized;
+}
+function normalizeError(error) {
+  if (error instanceof Error) {
+    const coded = error;
+    if (!coded.code) {
+      if (/not found|does not exist|enoent/i.test(error.message)) coded.code = "ENOENT";
+      else if (/exist/i.test(error.message)) coded.code = "EEXIST";
+      else if (/directory/i.test(error.message)) coded.code = "ENOTDIR";
+      else coded.code = "EIO";
+    }
+    throw coded;
+  }
+  throw Object.assign(new Error("Virtual filesystem operation failed"), { code: "EIO" });
+}
+async function ensureParent(fs, path) {
+  const parent = posix.dirname(path);
+  if (!await fs.exists(parent)) await fs.mkdir(parent, { recursive: true });
+}
+function statShape(stat) {
+  const typeMode = stat.isDirectory ? 16384 : stat.isSymbolicLink ? 40960 : 32768;
+  const mode = typeMode | stat.mode & 4095;
+  return {
+    isFile: () => stat.isFile,
+    isDirectory: () => stat.isDirectory,
+    isSymbolicLink: () => stat.isSymbolicLink,
+    mode,
+    size: stat.size,
+    mtime: stat.mtime,
+    mtimeMs: stat.mtime.getTime(),
+    ctimeMs: stat.mtime.getTime(),
+    ino: 0,
+    uid: 0,
+    gid: 0,
+    dev: 0
+  };
+}
+function createGitFs(fs) {
+  const promises = {
+    async readFile(path, options) {
+      try {
+        const virtualPath2 = safePath(path);
+        const encoding = typeof options === "string" ? options : options?.encoding;
+        return encoding ? fs.readFile(virtualPath2, "utf8") : fs.readFileBuffer(virtualPath2);
+      } catch (error) {
+        normalizeError(error);
+      }
+    },
+    async writeFile(path, data) {
+      try {
+        const virtualPath2 = safePath(path);
+        await ensureParent(fs, virtualPath2);
+        await fs.writeFile(virtualPath2, data);
+      } catch (error) {
+        normalizeError(error);
+      }
+    },
+    async unlink(path) {
+      try {
+        await fs.rm(safePath(path));
+      } catch (error) {
+        normalizeError(error);
+      }
+    },
+    async readdir(path) {
+      try {
+        return await fs.readdir(safePath(path));
+      } catch (error) {
+        normalizeError(error);
+      }
+    },
+    async mkdir(path) {
+      try {
+        await fs.mkdir(safePath(path), { recursive: true });
+      } catch (error) {
+        normalizeError(error);
+      }
+    },
+    async rmdir(path) {
+      try {
+        await fs.rm(safePath(path));
+      } catch (error) {
+        normalizeError(error);
+      }
+    },
+    async rename(from, to) {
+      try {
+        await ensureParent(fs, safePath(to));
+        await fs.mv(safePath(from), safePath(to));
+      } catch (error) {
+        normalizeError(error);
+      }
+    },
+    async stat(path) {
+      try {
+        return statShape(await fs.stat(safePath(path)));
+      } catch (error) {
+        normalizeError(error);
+      }
+    },
+    async lstat(path) {
+      try {
+        return statShape(await fs.lstat(safePath(path)));
+      } catch (error) {
+        normalizeError(error);
+      }
+    },
+    async readlink(path) {
+      try {
+        return await fs.readlink(safePath(path));
+      } catch (error) {
+        normalizeError(error);
+      }
+    },
+    async symlink(target, path) {
+      try {
+        await fs.symlink(target, safePath(path));
+      } catch (error) {
+        normalizeError(error);
+      }
+    },
+    async chmod(path, mode) {
+      try {
+        await fs.chmod(safePath(path), mode);
+      } catch (error) {
+        normalizeError(error);
+      }
+    },
+    async utimes(path, atime, mtime) {
+      try {
+        await fs.utimes(safePath(path), atime, mtime);
+      } catch (error) {
+        normalizeError(error);
+      }
+    }
+  };
+  return { promises };
+}
+
+// src/sandbox/git/http-adapter.ts
+function isPrivateLiteralHost(hostname) {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (host === "localhost" || host.endsWith(".localhost") || host === "::1") return true;
+  const octets = host.split(".").map(Number);
+  if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet))) return false;
+  return octets[0] === 10 || octets[0] === 127 || octets[0] === 169 && octets[1] === 254 || octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31 || octets[0] === 192 && octets[1] === 168;
+}
+function validateRemoteUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Only absolute HTTPS remote URLs are supported");
+  }
+  if (url.protocol !== "https:") throw new Error("Only HTTPS remote URLs are supported");
+  if (url.username || url.password) throw new Error("Remote URLs must not contain credentials");
+  if (url.hash) throw new Error("Remote URLs must not contain fragments");
+  if (isPrivateLiteralHost(url.hostname)) {
+    throw new Error("Remote URLs must not target local or private hosts");
+  }
+  return url.toString();
+}
+async function collectBody(body, signal) {
+  if (!body) return new Uint8Array();
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of body) {
+    if (signal?.aborted) throw new Error("Git operation was aborted");
+    chunks.push(chunk);
+    size += chunk.byteLength;
+  }
+  const result = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    result.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return result;
+}
+async function* oneChunk(body) {
+  yield body;
+}
+function createGitHttp(ctx) {
+  return {
+    async request(request) {
+      if (!ctx.fetch) throw new Error("Network access is not configured for this sandbox");
+      if (ctx.signal?.aborted) throw new Error("Git operation was aborted");
+      const url = validateRemoteUrl(request.url);
+      const bytes = await collectBody(request.body, ctx.signal);
+      const response = await ctx.fetch(url, {
+        method: request.method ?? "GET",
+        headers: request.headers,
+        // SecureFetch forwards BodyInit values unchanged, but its public type is narrower.
+        body: bytes.length > 0 ? bytes : void 0,
+        followRedirects: true
+      });
+      if (ctx.signal?.aborted) throw new Error("Git operation was aborted");
+      const finalUrl = validateRemoteUrl(response.url);
+      return {
+        url: finalUrl,
+        method: request.method,
+        headers: response.headers,
+        body: oneChunk(response.body),
+        statusCode: response.status,
+        statusMessage: response.statusText
+      };
+    }
+  };
+}
+
+// src/sandbox/git/index.ts
+var WORKSPACE = "/workspace";
+var VERSION = "ollie-git/0.1 (isomorphic-git)";
+var COMMANDS = [
+  "init",
+  "clone",
+  "status",
+  "add",
+  "commit",
+  "log",
+  "diff",
+  "branch",
+  "checkout",
+  "remote",
+  "config",
+  "fetch",
+  "pull",
+  "push"
+];
+var UsageError = class extends Error {
+};
+function ok(stdout = "") {
+  return { stdout, stderr: "", exitCode: 0 };
+}
+function usage(message) {
+  throw new UsageError(message ?? "unsupported arguments");
+}
+function assertNotAborted(ctx) {
+  if (ctx.signal?.aborted) throw new Error("operation aborted");
+}
+function virtualPath(ctx, input = ".") {
+  if (input.includes("\0") || input.includes("\\")) throw new Error("invalid path");
+  const resolved = ctx.fs.resolvePath(ctx.cwd, input);
+  if (resolved !== WORKSPACE && !resolved.startsWith(`${WORKSPACE}/`)) {
+    throw new Error("path is outside /workspace");
+  }
+  return resolved;
+}
+async function repositoryDir(ctx) {
+  let current = virtualPath(ctx);
+  while (current === WORKSPACE || current.startsWith(`${WORKSPACE}/`)) {
+    if (await ctx.fs.exists(posix2.join(current, ".git"))) return current;
+    if (current === WORKSPACE) break;
+    current = posix2.dirname(current);
+  }
+  throw new Error("not a git repository (or any parent up to /workspace)");
+}
+function optionValue(args, names) {
+  let value;
+  const rest = [];
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index];
+    if (arg && names.includes(arg)) {
+      const next = args[++index];
+      if (!next) usage(`${arg} requires a value`);
+      value = next;
+    } else if (arg && names.some((name) => arg.startsWith(`${name}=`))) {
+      value = arg.slice(arg.indexOf("=") + 1);
+    } else if (arg) rest.push(arg);
+  }
+  return { value, rest };
+}
+function flag(args, names) {
+  let enabled = false;
+  const rest = args.filter((arg) => {
+    if (names.includes(arg)) {
+      enabled = true;
+      return false;
+    }
+    return true;
+  });
+  return { enabled, rest };
+}
+function rejectOptions(args) {
+  const unknown = args.find((arg) => arg.startsWith("-"));
+  if (unknown) usage(`unsupported option '${unknown}'`);
+}
+function positiveInteger(value, option) {
+  if (value === void 0) return void 0;
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) usage(`${option} requires a positive integer`);
+  return parsed;
+}
+function authFor(context, url) {
+  if (!url || !context.options.resolveAuth) return void 0;
+  return async () => context.options.resolveAuth?.(url);
+}
+async function remoteUrl(context, dir, remote) {
+  const value = await git.getConfig({ fs: context.fs, dir, path: `remote.${remote}.url` });
+  if (!value) throw new Error(`remote '${remote}' has no URL`);
+  return validateRemoteUrl(value);
+}
+var GLOBAL_CONFIG_PATH = "/home/user/.gitconfig";
+async function readGlobalConfig(ctx) {
+  if (!await ctx.fs.exists(GLOBAL_CONFIG_PATH)) return /* @__PURE__ */ new Map();
+  const values = /* @__PURE__ */ new Map();
+  let section = "";
+  for (const rawLine of (await ctx.fs.readFile(GLOBAL_CONFIG_PATH)).split("\n")) {
+    const line = rawLine.trim();
+    const sectionMatch = /^\[([^\]]+)\]$/.exec(line);
+    if (sectionMatch?.[1]) {
+      section = sectionMatch[1].trim().toLowerCase();
+      continue;
+    }
+    const valueMatch = /^([^=]+)=(.*)$/.exec(line);
+    if (section && valueMatch?.[1] !== void 0 && valueMatch[2] !== void 0) {
+      values.set(`${section}.${valueMatch[1].trim().toLowerCase()}`, valueMatch[2].trim());
+    }
+  }
+  return values;
+}
+async function writeGlobalConfig(ctx, values) {
+  const sections = /* @__PURE__ */ new Map();
+  for (const [path, value] of [...values].sort(([left], [right]) => left.localeCompare(right))) {
+    const separator = path.indexOf(".");
+    if (separator < 1) usage("config key must contain a section");
+    const section = path.slice(0, separator);
+    const name = path.slice(separator + 1);
+    const entries = sections.get(section) ?? [];
+    entries.push([name, value]);
+    sections.set(section, entries);
+  }
+  const content = [...sections].map(
+    ([section, entries]) => `[${section}]
+${entries.map(([key, value]) => `	${key} = ${value}`).join("\n")}`
+  ).join("\n");
+  await ctx.fs.mkdir(posix2.dirname(GLOBAL_CONFIG_PATH), { recursive: true });
+  await ctx.fs.writeFile(GLOBAL_CONFIG_PATH, content ? `${content}
+` : "");
+}
+async function handleInit(context, args) {
+  const branchOpt = optionValue(args, ["-b", "--initial-branch"]);
+  rejectOptions(branchOpt.rest);
+  if (branchOpt.rest.length > 1) usage("git init accepts at most one directory");
+  const dir = virtualPath(context.command, branchOpt.rest[0]);
+  await context.command.fs.mkdir(dir, { recursive: true }).catch(async () => {
+    if (!await context.command.fs.exists(dir))
+      throw new Error("cannot create repository directory");
+  });
+  await git.init({ fs: context.fs, dir, defaultBranch: branchOpt.value ?? "main" });
+  return ok(`Initialized empty Git repository in ${posix2.join(dir, ".git")}/
+`);
+}
+async function handleStatus(context, args) {
+  const shortFlag = flag(args, ["-s", "--short", "--porcelain"]);
+  rejectOptions(shortFlag.rest);
+  if (shortFlag.rest.length) usage();
+  const dir = await repositoryDir(context.command);
+  const matrix = await git.statusMatrix({ fs: context.fs, dir });
+  const lines = matrix.filter(([, head, workdir, stage]) => head !== workdir || workdir !== stage).map(([path, head, workdir, stage]) => {
+    let x = " ";
+    let y = " ";
+    if (head === 0 && stage !== 0) x = "A";
+    else if (head !== stage) x = stage === 0 ? "D" : "M";
+    if (workdir !== stage) y = workdir === 0 ? "D" : "M";
+    if (head === 0 && stage === 0 && workdir !== 0) return `?? ${path}`;
+    return `${x}${y} ${path}`;
+  });
+  if (shortFlag.enabled) return ok(lines.length ? `${lines.join("\n")}
+` : "");
+  const branch2 = await git.currentBranch({ fs: context.fs, dir }) ?? "HEAD detached";
+  return ok(
+    `On branch ${branch2}
+${lines.length ? `${lines.join("\n")}
+` : "nothing to commit, working tree clean\n"}`
+  );
+}
+async function handleAdd(context, args) {
+  const separator = args.indexOf("--");
+  const optionArgs = separator < 0 ? args : args.slice(0, separator);
+  const literalPaths = separator < 0 ? [] : args.slice(separator + 1);
+  const allFlag = flag(optionArgs, ["-A", "--all"]);
+  rejectOptions(allFlag.rest);
+  const paths = [...allFlag.rest, ...literalPaths];
+  if (!allFlag.enabled && paths.length === 0) usage("nothing specified");
+  const dir = await repositoryDir(context.command);
+  const all = allFlag.enabled || paths.includes(".");
+  if (all) {
+    const matrix = await git.statusMatrix({ fs: context.fs, dir });
+    for (const [filepath, , workdir, stage] of matrix) {
+      assertNotAborted(context.command);
+      if (workdir === stage) continue;
+      if (workdir === 0) await git.remove({ fs: context.fs, dir, filepath });
+      else await git.add({ fs: context.fs, dir, filepath });
+    }
+  } else {
+    for (const filepath of paths) {
+      if (filepath.startsWith("/") || filepath.split("/").some((segment) => segment === ".." || segment === ".git"))
+        throw new Error("invalid pathspec");
+      await git.add({ fs: context.fs, dir, filepath });
+    }
+  }
+  return ok();
+}
+function parseAuthor(value) {
+  const match = /^(.*?)\s*<([^<>]+)>$/.exec(value);
+  if (!match?.[1] || !match[2]) usage("--author must be 'Name <email>'");
+  return { name: match[1].trim(), email: match[2] };
+}
+async function handleCommit(context, args) {
+  const messageOpt = optionValue(args, ["-m", "--message"]);
+  const authorOpt = optionValue(messageOpt.rest, ["--author"]);
+  rejectOptions(authorOpt.rest);
+  if (authorOpt.rest.length || !messageOpt.value) usage("git commit requires -m <message>");
+  const dir = await repositoryDir(context.command);
+  const globalConfig = await readGlobalConfig(context.command);
+  const repoName = await git.getConfig({ fs: context.fs, dir, path: "user.name" });
+  const repoEmail = await git.getConfig({ fs: context.fs, dir, path: "user.email" });
+  const configuredAuthor = repoName && repoEmail ? { name: repoName, email: repoEmail } : globalConfig.get("user.name") && globalConfig.get("user.email") ? {
+    name: globalConfig.get("user.name"),
+    email: globalConfig.get("user.email")
+  } : context.options.author;
+  const author = authorOpt.value ? parseAuthor(authorOpt.value) : configuredAuthor;
+  const matrix = await git.statusMatrix({ fs: context.fs, dir });
+  if (!matrix.some(([, headStatus, , stageStatus]) => headStatus !== stageStatus)) {
+    const message = matrix.some(([, , workdirStatus, stageStatus]) => workdirStatus !== stageStatus) ? "no changes added to commit" : "nothing to commit, working tree clean";
+    throw new Error(message);
+  }
+  const oid = await git.commit({ fs: context.fs, dir, message: messageOpt.value, author });
+  const branch2 = await git.currentBranch({ fs: context.fs, dir }) ?? "detached HEAD";
+  return ok(`[${branch2} ${oid.slice(0, 7)}] ${messageOpt.value.split("\n")[0]}
+`);
+}
+async function handleLog(context, args) {
+  const countOpt = optionValue(args, ["-n", "--max-count"]);
+  const onelineFlag = flag(countOpt.rest, ["--oneline"]);
+  rejectOptions(onelineFlag.rest);
+  if (onelineFlag.rest.length > 1) usage();
+  const depth = countOpt.value ? Number.parseInt(countOpt.value, 10) : 20;
+  if (!Number.isFinite(depth) || depth < 1) usage("invalid max count");
+  const dir = await repositoryDir(context.command);
+  const commits = await git.log({ fs: context.fs, dir, ref: onelineFlag.rest[0] ?? "HEAD", depth });
+  if (onelineFlag.enabled) {
+    return ok(
+      commits.map((entry) => `${entry.oid.slice(0, 7)} ${entry.commit.message.split("\n")[0]}`).join("\n") + (commits.length ? "\n" : "")
+    );
+  }
+  return ok(
+    commits.map(
+      (entry) => `commit ${entry.oid}
+Author: ${entry.commit.author.name} <${entry.commit.author.email}>
+
+    ${entry.commit.message.trim().replaceAll("\n", "\n    ")}
+`
+    ).join("\n")
+  );
+}
+async function handleDiff(context, args) {
+  const cachedFlag = flag(args, ["--cached", "--staged"]);
+  rejectOptions(cachedFlag.rest);
+  const dir = await repositoryDir(context.command);
+  const selected = cachedFlag.rest.map((path) => path.replace(/^\.\//, "").replace(/\/$/, ""));
+  const decoder = new TextDecoder();
+  const patch = (filepath, oldBytes, newBytes) => {
+    if (oldBytes.includes(0) || newBytes.includes(0)) {
+      return `Binary files a/${filepath} and b/${filepath} differ
+`;
+    }
+    return createTwoFilesPatch(
+      `a/${filepath}`,
+      `b/${filepath}`,
+      decoder.decode(oldBytes),
+      decoder.decode(newBytes),
+      "",
+      "",
+      { context: 3 }
+    );
+  };
+  const matrix = await git.statusMatrix({
+    fs: context.fs,
+    dir,
+    filepaths: selected.length ? selected : void 0
+  });
+  const stageOids = /* @__PURE__ */ new Map();
+  await git.walk({
+    fs: context.fs,
+    dir,
+    trees: [git.STAGE()],
+    map: async (filepath, [entry]) => {
+      if (entry && await entry.type() !== "tree") stageOids.set(filepath, await entry.oid());
+    }
+  });
+  const head = await git.resolveRef({ fs: context.fs, dir, ref: "HEAD" }).catch(() => void 0);
+  const empty = new Uint8Array();
+  const readStage = async (filepath) => {
+    const oid = stageOids.get(filepath);
+    return oid ? (await git.readBlob({ fs: context.fs, dir, oid })).blob : empty;
+  };
+  const patches = [];
+  for (const [filepath, headStatus, workdirStatus, stageStatus] of matrix) {
+    const changed = cachedFlag.enabled ? headStatus !== stageStatus : workdirStatus !== stageStatus;
+    if (!changed) continue;
+    const oldBytes = cachedFlag.enabled ? head && headStatus !== 0 ? (await git.readBlob({ fs: context.fs, dir, oid: head, filepath })).blob : empty : await readStage(filepath);
+    const newBytes = cachedFlag.enabled ? await readStage(filepath) : workdirStatus === 0 ? empty : await context.command.fs.readFileBuffer(posix2.join(dir, filepath));
+    patches.push(patch(filepath, oldBytes, newBytes));
+  }
+  return ok(patches.join(""));
+}
+async function handleBranch(context, args) {
+  const deleteFlag = flag(args, ["-d", "-D", "--delete"]);
+  rejectOptions(deleteFlag.rest);
+  const dir = await repositoryDir(context.command);
+  if (deleteFlag.enabled) {
+    if (deleteFlag.rest.length !== 1) usage("branch deletion requires one name");
+    await git.deleteBranch({ fs: context.fs, dir, ref: deleteFlag.rest[0] });
+    return ok(`Deleted branch ${deleteFlag.rest[0]}.
+`);
+  }
+  if (deleteFlag.rest.length) {
+    if (deleteFlag.rest.length > 2) usage();
+    await git.branch({
+      fs: context.fs,
+      dir,
+      ref: deleteFlag.rest[0],
+      object: deleteFlag.rest[1]
+    });
+    return ok();
+  }
+  const [branches, current] = await Promise.all([
+    git.listBranches({ fs: context.fs, dir }),
+    git.currentBranch({ fs: context.fs, dir })
+  ]);
+  return ok(
+    branches.map((name) => `${name === current ? "*" : " "} ${name}`).join("\n") + (branches.length ? "\n" : "")
+  );
+}
+async function readCheckoutBlob(context, dir, commitOid, filepath) {
+  let treeOid = (await git.readCommit({ fs: context.fs, dir, oid: commitOid })).commit.tree;
+  const segments = filepath.split("/").filter(Boolean);
+  for (let index = 0; index < segments.length; index++) {
+    const entries = (await git.readTree({ fs: context.fs, dir, oid: treeOid })).tree;
+    const entry = entries.find((candidate) => candidate.path === segments[index]);
+    if (!entry) throw new Error(`path '${filepath}' does not exist in the selected ref`);
+    if (entry.mode === "120000") throw new Error("symbolic links are not supported in the sandbox");
+    if (index === segments.length - 1) {
+      if (entry.type !== "blob") throw new Error(`path '${filepath}' is not a file`);
+      return (await git.readBlob({ fs: context.fs, dir, oid: entry.oid })).blob;
+    }
+    if (entry.type !== "tree") throw new Error(`path '${filepath}' is not a file`);
+    treeOid = entry.oid;
+  }
+  throw new Error("invalid checkout path");
+}
+async function handleCheckout(context, args) {
+  const separator = args.indexOf("--");
+  const commandArgs = separator >= 0 ? args.slice(0, separator) : args;
+  const filepaths = separator >= 0 ? args.slice(separator + 1) : [];
+  const createOpt = optionValue(commandArgs, ["-b"]);
+  const forceFlag = flag(createOpt.rest, ["-f", "--force"]);
+  rejectOptions(forceFlag.rest);
+  const dir = await repositoryDir(context.command);
+  if (filepaths.length) {
+    if (createOpt.value || forceFlag.rest.length > 1) usage();
+    if (filepaths.some((path) => path.startsWith("/") || path.split("/").includes(".."))) {
+      throw new Error("invalid checkout path");
+    }
+    const ref = forceFlag.rest[0] ?? "HEAD";
+    const oid = await git.resolveRef({ fs: context.fs, dir, ref });
+    for (const filepath of filepaths) {
+      const blob = await readCheckoutBlob(context, dir, oid, filepath);
+      await context.command.fs.writeFile(posix2.join(dir, filepath), blob);
+    }
+    return ok();
+  }
+  if (separator >= 0) usage("checkout requires at least one path after --");
+  if (createOpt.value) {
+    if (forceFlag.rest.length > 1) usage();
+    await git.branch({
+      fs: context.fs,
+      dir,
+      ref: createOpt.value,
+      object: forceFlag.rest[0],
+      checkout: true
+    });
+    await git.checkout({ fs: context.fs, dir, ref: createOpt.value, force: forceFlag.enabled });
+    return ok(`Switched to a new branch '${createOpt.value}'
+`);
+  }
+  if (forceFlag.rest.length !== 1) usage("checkout requires one branch or ref");
+  await git.checkout({ fs: context.fs, dir, ref: forceFlag.rest[0], force: forceFlag.enabled });
+  return ok(`Switched to '${forceFlag.rest[0]}'
+`);
+}
+async function handleRemote(context, args) {
+  const dir = await repositoryDir(context.command);
+  if (!args.length || args.length === 1 && args[0] === "-v") {
+    const remotes = await git.listRemotes({ fs: context.fs, dir });
+    const verbose = args[0] === "-v";
+    return ok(
+      remotes.map(
+        ({ remote, url }) => verbose ? `${remote}	${url} (fetch)
+${remote}	${url} (push)` : remote
+      ).join("\n") + (remotes.length ? "\n" : "")
+    );
+  }
+  const [action, name, value, ...rest] = args;
+  if (rest.length || !name) usage();
+  if (action === "add") {
+    if (!value) usage("remote add requires a URL");
+    validateRemoteUrl(value);
+    await git.addRemote({ fs: context.fs, dir, remote: name, url: value });
+    return ok();
+  }
+  if (action === "remove" || action === "rm") {
+    if (value) usage();
+    await git.deleteRemote({ fs: context.fs, dir, remote: name });
+    return ok();
+  }
+  if (action === "get-url") {
+    if (value) usage();
+    const url = await remoteUrl(context, dir, name);
+    return ok(`${url}
+`);
+  }
+  if (action === "set-url") {
+    if (!value) usage();
+    validateRemoteUrl(value);
+    await git.setConfig({ fs: context.fs, dir, path: `remote.${name}.url`, value });
+    return ok();
+  }
+  usage();
+}
+async function handleConfig(context, args) {
+  const globalFlag = flag(args, ["--global"]);
+  const unsetFlag = flag(globalFlag.rest, ["--unset"]);
+  const listFlag = flag(unsetFlag.rest, ["--list", "-l"]);
+  rejectOptions(listFlag.rest);
+  const globalValues = globalFlag.enabled ? await readGlobalConfig(context.command) : void 0;
+  const dir = globalFlag.enabled ? void 0 : await repositoryDir(context.command);
+  if (listFlag.enabled) {
+    if (listFlag.rest.length) usage();
+    if (globalValues) {
+      const output2 = [...globalValues].map(([key2, value2]) => `${key2}=${value2}`).join("\n");
+      return ok(output2 ? `${output2}
+` : "");
+    }
+    const keys = ["user.name", "user.email", "core.repositoryformatversion", "core.bare"];
+    const values = await Promise.all(
+      keys.map(
+        async (key2) => [key2, await git.getConfig({ fs: context.fs, dir, path: key2 })]
+      )
+    );
+    const output = values.filter(([, value2]) => value2 !== void 0).map(([key2, value2]) => `${key2}=${value2}`).join("\n");
+    return ok(output ? `${output}
+` : "");
+  }
+  const [key, value, ...rest] = listFlag.rest;
+  if (rest.length || !key) usage();
+  if (!key.includes(".")) usage("config key must contain a section");
+  if (globalValues) {
+    if (unsetFlag.enabled) {
+      if (value) usage();
+      globalValues.delete(key.toLowerCase());
+      await writeGlobalConfig(context.command, globalValues);
+      return ok();
+    }
+    if (value === void 0) {
+      const found = globalValues.get(key.toLowerCase());
+      return found === void 0 ? { stdout: "", stderr: "", exitCode: 1 } : ok(`${found}
+`);
+    }
+    globalValues.set(key.toLowerCase(), value);
+    await writeGlobalConfig(context.command, globalValues);
+    return ok();
+  }
+  if (unsetFlag.enabled) {
+    if (value) usage();
+    await git.setConfig({ fs: context.fs, dir, path: key, value: void 0 });
+    return ok();
+  }
+  if (value === void 0) {
+    const found = await git.getConfig({ fs: context.fs, dir, path: key });
+    return found === void 0 ? { stdout: "", stderr: "", exitCode: 1 } : ok(`${found}
+`);
+  }
+  await git.setConfig({ fs: context.fs, dir, path: key, value });
+  return ok();
+}
+async function handleClone(context, args) {
+  const branchOpt = optionValue(args, ["-b", "--branch"]);
+  const depthOpt = optionValue(branchOpt.rest, ["--depth"]);
+  const singleFlag = flag(depthOpt.rest, ["--single-branch"]);
+  const noCheckoutFlag = flag(singleFlag.rest, ["--no-checkout"]);
+  rejectOptions(noCheckoutFlag.rest);
+  const [rawUrl, destination, ...rest] = noCheckoutFlag.rest;
+  if (!rawUrl || rest.length) usage("clone requires a URL and optional directory");
+  const url = validateRemoteUrl(rawUrl);
+  const inferred = posix2.basename(new URL(url).pathname).replace(/\.git$/, "") || "repository";
+  const dir = virtualPath(context.command, destination ?? inferred);
+  const depth = positiveInteger(depthOpt.value, "--depth");
+  await git.clone({
+    fs: context.fs,
+    http: context.http,
+    dir,
+    url,
+    ref: branchOpt.value,
+    depth,
+    singleBranch: singleFlag.enabled || Boolean(branchOpt.value),
+    noCheckout: noCheckoutFlag.enabled,
+    onAuth: authFor(context, url)
+  });
+  return ok(`Cloning into '${destination ?? inferred}'...
+`);
+}
+async function handleFetch(context, args) {
+  const depthOpt = optionValue(args, ["--depth"]);
+  rejectOptions(depthOpt.rest);
+  if (depthOpt.rest.length > 2) usage();
+  const dir = await repositoryDir(context.command);
+  const remote = depthOpt.rest[0] ?? "origin";
+  const url = await remoteUrl(context, dir, remote);
+  await git.fetch({
+    fs: context.fs,
+    http: context.http,
+    dir,
+    remote,
+    ref: depthOpt.rest[1],
+    depth: positiveInteger(depthOpt.value, "--depth"),
+    onAuth: authFor(context, url)
+  });
+  return ok();
+}
+async function handlePull(context, args) {
+  const ffFlag = flag(args, ["--ff-only"]);
+  rejectOptions(ffFlag.rest);
+  if (ffFlag.rest.length > 2) usage();
+  const dir = await repositoryDir(context.command);
+  const remote = ffFlag.rest[0] ?? "origin";
+  const url = await remoteUrl(context, dir, remote);
+  await git.pull({
+    fs: context.fs,
+    http: context.http,
+    dir,
+    remote,
+    ref: ffFlag.rest[1],
+    fastForwardOnly: true,
+    // isomorphic-git requires an author even when fastForwardOnly prevents merge commits.
+    author: context.options.author ?? { name: "Ollie Git", email: "git@localhost" },
+    onAuth: authFor(context, url)
+  });
+  return ok("Already up to date or fast-forwarded.\n");
+}
+async function handlePush(context, args) {
+  const forceFlag = flag(args, ["--force", "-f"]);
+  const upstreamFlag = flag(forceFlag.rest, ["--set-upstream", "-u"]);
+  rejectOptions(upstreamFlag.rest);
+  if (upstreamFlag.rest.length > 2) usage();
+  const dir = await repositoryDir(context.command);
+  const remote = upstreamFlag.rest[0] ?? "origin";
+  const ref = upstreamFlag.rest[1] ?? await git.currentBranch({ fs: context.fs, dir });
+  if (!ref) throw new Error("cannot determine branch to push");
+  const url = await remoteUrl(context, dir, remote);
+  const result = await git.push({
+    fs: context.fs,
+    http: context.http,
+    dir,
+    remote,
+    ref,
+    force: forceFlag.enabled,
+    onAuth: authFor(context, url)
+  });
+  if (!result.ok) {
+    const refError = Object.values(result.refs).find((status) => !status.ok)?.error;
+    throw new Error(result.error ?? refError ?? "remote rejected the push");
+  }
+  if (upstreamFlag.enabled) {
+    await git.setConfig({ fs: context.fs, dir, path: `branch.${ref}.remote`, value: remote });
+    await git.setConfig({
+      fs: context.fs,
+      dir,
+      path: `branch.${ref}.merge`,
+      value: `refs/heads/${ref}`
+    });
+  }
+  return ok(`To ${url}
+`);
+}
+var handlers = {
+  init: handleInit,
+  clone: handleClone,
+  status: handleStatus,
+  add: handleAdd,
+  commit: handleCommit,
+  log: handleLog,
+  diff: handleDiff,
+  branch: handleBranch,
+  checkout: handleCheckout,
+  remote: handleRemote,
+  config: handleConfig,
+  fetch: handleFetch,
+  pull: handlePull,
+  push: handlePush
+};
+function redact(message, secrets) {
+  let result = message.replace(/https:\/\/[^\s/@]+@/g, "https://").replaceAll(process.cwd(), "<host>");
+  for (const secret of secrets) {
+    if (secret) result = result.replaceAll(secret, "<redacted>");
+  }
+  return result;
+}
+function createGitCommand(options = {}) {
+  return defineCommand("git", async (args, command) => {
+    const secrets = /* @__PURE__ */ new Set();
+    const safeOptions = options.resolveAuth ? {
+      ...options,
+      resolveAuth: async (url) => {
+        const auth = await options.resolveAuth?.(url);
+        if (auth?.username) secrets.add(auth.username);
+        if (auth?.password) secrets.add(auth.password);
+        return auth;
+      }
+    } : options;
+    try {
+      if (!args.length || args[0] === "help" || args.includes("--help")) {
+        return ok(`usage: git <command> [options]
+
+Supported commands: ${COMMANDS.join(", ")}
+`);
+      }
+      if (args[0] === "--version" || args[0] === "-v") return ok(`${VERSION}
+`);
+      const subcommand = args[0];
+      const handler = subcommand ? handlers[subcommand] : void 0;
+      if (!handler) usage(`'${subcommand ?? ""}' is not a supported git command`);
+      assertNotAborted(command);
+      return await handler(
+        {
+          command,
+          fs: createGitFs(command.fs),
+          http: createGitHttp(command),
+          options: safeOptions
+        },
+        args.slice(1)
+      );
+    } catch (error) {
+      const message = redact(
+        error instanceof Error ? error.message : "unknown Git failure",
+        secrets
+      );
+      const exitCode = error instanceof UsageError ? 129 : /not a git repository|NotFoundError/.test(message) ? 128 : 1;
+      return {
+        stdout: "",
+        stderr: `${error instanceof UsageError ? "error" : "fatal"}: ${message}
+`,
+        exitCode
+      };
+    }
+  });
+}
+
+// src/sandbox/just-bash.ts
+var SANDBOX_WORKSPACE_PATH = "/workspace";
+function canonicalizeWorkspaceRoot(workspaceRoot) {
+  const canonicalRoot = realpathSync(workspaceRoot);
+  if (!statSync(canonicalRoot).isDirectory()) {
+    throw new Error("The sandbox workspace root must be a directory");
+  }
+  return canonicalRoot;
+}
+function createWorkspaceFs(workspaceRoot) {
+  const root = canonicalizeWorkspaceRoot(workspaceRoot);
+  return new MountableFs({
+    base: new InMemoryFs(),
+    mounts: [
+      {
+        mountPoint: SANDBOX_WORKSPACE_PATH,
+        filesystem: new ReadWriteFs({ root, allowSymlinks: false })
+      }
+    ]
+  });
+}
+function createJustBash(workspaceRoot, options = {}) {
+  return new Bash({
+    fs: createWorkspaceFs(workspaceRoot),
+    cwd: SANDBOX_WORKSPACE_PATH,
+    env: {
+      HOME: "/home/user",
+      TERM: "xterm-256color"
+    },
+    python: true,
+    javascript: true,
+    customCommands: options.git === false ? [] : [createGitCommand(options.git)],
+    network: {
+      dangerouslyAllowFullInternetAccess: true,
+      maxResponseSize: 100 * 1024 * 1024
+    }
+  });
+}
+async function isJustBashAvailable() {
+  try {
+    const bash = new Bash();
+    await bash.exec("echo ok");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/index.ts
+var packageName = "@getollie/cli";
+var cliName = "ollie";
+var packageVersion = "0.2.0";
+export {
+  SANDBOX_WORKSPACE_PATH,
+  cliName,
+  createJustBash,
+  isJustBashAvailable,
+  packageName,
+  packageVersion
+};
+//# sourceMappingURL=index.js.map