@lizard-build/cli 4.0.66 → 4.0.68

package/src/commands/domain-owned.ts

@@ -24,6 +24,22 @@ interface DnsRecord { name: string; type: DnsType; value: string; ttl: number; p
 const DNS_TYPES: DnsType[] = ["A", "AAAA", "CNAME", "ALIAS", "MX", "TXT", "URL301"];
 
 const SESSION_HINT = "Domains bought on Lizard need `lizard login` or an API key without scopes (a scoped key cannot reach them).";
+/** Changing a bought domain needs a login: an API key can read it but not repoint it, so a
+ *  leaked key cannot take the domain or its email. */
+const WRITE_HINT = "Changing a domain bought on Lizard needs `lizard login` (an API key can read its records but not change them).";
+
+function writeError(err: unknown): never {
+  if (err instanceof APIError && err.status === 401) throw new Error(WRITE_HINT);
+  throw err;
+}
+
+const POINTING: DnsType[] = ["A", "AAAA", "CNAME", "ALIAS", "URL301"];
+/** Records connecting `names` would replace, leaving out ones nobody would miss: the
+ *  registrar's parking page and a previous Lizard target. */
+export function recordsToReplace(records: DnsRecord[], names: string[]): DnsRecord[] {
+  return records.filter((r) => names.includes(r.name) && POINTING.includes(r.type)
+    && !/(^|\.)parkingpage\.namecheap\.com\.?$/i.test(r.value) && !/(^|\.)onlizard\.com\.?$/i.test(r.value));
+}
 
 async function listOwned(): Promise<OwnedDomain[]> {
   const r = await api.get<{ orders: OwnedDomain[] }>("/api/domains/orders").catch((err: unknown) => {
@@ -43,13 +59,37 @@ export async function findOwnedDomain(hostname: string): Promise<OwnedDomain | n
     .sort((a, b) => b.domain.length - a.domain.length)[0] ?? null;
 }
 
-/** Points `hostname` (the bought domain, or a subdomain of it) at a service: DNS and attach in one call. */
-export async function connectOwned(order: OwnedDomain, hostname: string, service: { id: string; name: string }) {
+/** Points `hostname` (the bought domain, or a subdomain of it) at a service: DNS and attach
+ *  in one call. Records it would replace, and a hostname attached to another service, need
+ *  a yes at the terminal or --force, so one command cannot quietly take a working site down. */
+export async function connectOwned(order: OwnedDomain, hostname: string, service: { id: string; name: string }, force: boolean) {
   const host = hostname.toLowerCase().replace(/\.$/, "");
-  const r = await api.post<{ ok: boolean; attached: string[]; note?: string }>(
+  const names = host === order.domain ? ["@", "www"] : [host.slice(0, -(order.domain.length + 1))];
+  let move = force;
+  if (!force) {
+    const dns = await api.get<{ records: DnsRecord[] }>(`/api/domains/orders/${encodeURIComponent(order.id)}/dns`);
+    const replaced = recordsToReplace(dns.records, names);
+    if (replaced.length) {
+      const list = replaced.map((r) => `${r.name} ${r.type} ${r.value}`).join(", ");
+      if (!isTTY() || isJSONMode()) throw new Error(`This replaces existing records on ${order.domain}: ${list}. Run again with --force to replace them.`);
+      printRecords(order.domain, replaced);
+      const ok = await p.confirm({ message: `Replace ${replaced.length === 1 ? "this record" : "these records"} so ${host} points at ${service.name}?` });
+      if (p.isCancel(ok) || !ok) process.exit(5);
+    }
+  }
+  const connect = (forceMove: boolean) => api.post<{ ok: boolean; attached: string[]; note?: string }>(
     `/api/domains/orders/${encodeURIComponent(order.id)}/connect`,
-    { appId: service.id, hostname: host },
+    { appId: service.id, hostname: host, force: forceMove },
   );
+  const r = await connect(move).catch(async (err: unknown) => {
+    if (err instanceof APIError && err.status === 409 && !move && isTTY() && !isJSONMode()) {
+      const ok = await p.confirm({ message: `${err.message} Move it to ${service.name}?` });
+      if (p.isCancel(ok) || !ok) process.exit(5);
+      move = true;
+      return connect(true).catch(writeError);
+    }
+    return writeError(err);
+  });
   if (isJSONMode()) {
     printJSON({ ...r, domain: order.domain, hostname: host, service: service.name });
     return;
@@ -193,7 +233,7 @@ To point a name at a Lizard service, use: lizard domain api.example.com --servic
         throw new Error(`Unknown action "${action}". Use set, add or rm (or nothing to list).`);
       }
 
-      const saved = await api.put<{ records: DnsRecord[]; version: string }>(path, { version: current.version, records });
+      const saved = await api.put<{ records: DnsRecord[]; version: string }>(path, { version: current.version, records }).catch(writeError);
       if (isJSONMode()) return printJSON({ domain: order.domain, ...saved });
       success(`${summary} on ${order.domain}`);
       printRecords(order.domain, saved.records);

package/src/commands/domain.ts

@@ -46,7 +46,7 @@ export function registerDomain(program: Command) {
     .option("-s, --service <name>", "Service name or ID")
     .option("-p, --project <id>", "Project name, slug, or ID")
     .option("--port <n>", "Port to expose", parseIntOption)
-    .option("-f, --force", "Move the domain here if it's attached to another of your services")
+    .option("-f, --force", "Move the domain here if it's attached to another of your services; on a domain bought on Lizard, also replace its existing records without asking")
     .action(async (hostname: string | undefined, opts, _cmd) => {
       const projectId = await resolveProjectId(opts.project);
       const service = await getActiveService(opts.service, projectId);
@@ -108,7 +108,7 @@ export function registerDomain(program: Command) {
       // Bought on Lizard: set the DNS record and attach, nothing for the user to copy.
       const owned = await findOwnedDomain(hostname);
       if (owned) {
-        await connectOwned(owned, hostname, service);
+        await connectOwned(owned, hostname, service, !!opts.force);
         return;
       }
 

package/src/commands/git-hosting.ts

@@ -4,16 +4,18 @@ import { spawnSync } from "node:child_process";
 import { readFileSync, writeFileSync, existsSync, statSync } from "node:fs";
 import { basename } from "node:path";
 import { APIError } from "../lib/api.js";
-import { validToken } from "../lib/auth.js";
 import { isJSONMode, printJSON, table, success, info, warn, link } from "../lib/format.js";
 import {
-  lg, qs, seg, segs, resolveRepo, repoPath, myLogin, cloneURL, gitURL, gitURLs, helperCommand, ago, ACTIVE_RUN,
+  lg, qs, seg, segs, resolveRepo, repoPath, myLogin, gitURL, ago, ACTIVE_RUN,
 } from "../lib/lizard-git.js";
+import * as wc from "../lib/checkout.js";
 
 /**
  * Lizard Git (lizard.build/git) from the terminal: repositories, issues, pull requests,
  * reviews, CI runs, releases, secrets, collaborators, webhooks, branch rules, labels,
- * notifications, tokens, and the credential helper that lets plain `git` push and pull.
+ * notifications, tokens; and working copies: clone, status, diff, commit, sync, switch. Lizard
+ * Git is Scion-style (no git protocol): a checkout holds files and .lizard-git/checkout.json, and
+ * every commit is made on the server (lib/checkout.ts).
  *
  * Registered under `lizard git`, next to the GitHub integration commands.
  */
@@ -55,69 +57,163 @@ function bodyFrom(opts: { body?: string; bodyFile?: string }): string | undefine
 
 const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
 
+/** The checkout this directory is in, or a clear error. */
+function needCheckout(): string {
+  const root = wc.findCheckout();
+  if (!root) throw new APIError(400, "not in a Lizard Git checkout (lizard git clone owner/name)");
+  return root;
+}
+
+/** `lizard git status` inside a checkout: your changes. */
+export function checkoutStatus(): boolean {
+  const root = wc.findCheckout();
+  if (!root) return false;
+  const c = wc.loadCheckout(root);
+  const ch = wc.changesOf(c, wc.scanWorking(root, c));
+  out({ repo: c.repo, branch: c.branch, commit: c.base, sparse: c.sparse, ...ch }, () => {
+    info(`${chalk.bold(c.repo)} on ${chalk.cyan(c.branch)} at ${c.base.slice(0, 12)}${c.sparse ? chalk.dim(` (sparse: ${c.sparse.join(", ")})`) : ""}`);
+    const n = ch.added.length + ch.modified.length + ch.deleted.length;
+    if (!n) return info(chalk.dim("no changes"));
+    for (const p of ch.modified) info(`  ${chalk.yellow("modified")}  ${p}`);
+    for (const p of ch.added) info(`  ${chalk.green("added")}     ${p}`);
+    for (const p of ch.deleted) info(`  ${chalk.red("deleted")}   ${p}`);
+    info(chalk.dim(`  commit them: lizard git commit -m "..."`));
+  });
+  return true;
+}
+
 function repoOpt(c: Command): Command {
-  return c.option("-R, --repo <owner/name>", "Repository (default: the Lizard Git remote of this checkout)");
+  return c.option("-R, --repo <owner/name>", "Repository (default: the one this checkout is of)");
 }
 
 export function registerLizardGit(git: Command) {
   git.description("Lizard Git (lizard.build/git) repositories, pull requests, CI; and GitHub integration");
 
-  // ── Sign-in for plain git ────────────────────────────────────────────
+  // ── Working copies ───────────────────────────────────────────────────
   git
-    .command("setup")
-    .description("Let git push and pull Lizard Git repositories with your Lizard sign-in (credential helper)")
-    .option("--local", "Only for the repository in this directory")
-    .action(async (opts: { local?: boolean }) => {
-      const scope = opts.local ? "--local" : "--global";
-      // For lizard.build/git only (git matches the path: the rest of lizard.build never gets
-      // the helper), and the old git.lizard.build for clones made before.
-      for (const url of gitURLs()) {
-        // An empty value first resets helpers inherited for this address; then ours.
-        for (const value of ["", helperCommand()]) {
-          const r = spawnSync("git", ["config", scope, value ? "--add" : "--replace-all", `credential.${url}.helper`, value], { encoding: "utf8" });
-          if (r.status !== 0) throw new APIError(500, `git config failed: ${r.stderr || r.error?.message}`);
-        }
-        spawnSync("git", ["config", scope, `credential.${url}.username`, "lizard"]);
-      }
-      const who = await myLogin();
-      out({ helper: helperCommand(), scope: opts.local ? "local" : "global", host: gitURL(), login: who }, () => {
-        success(`git now signs in to ${gitURL()} as ${chalk.bold(who)} (${opts.local ? "this repository" : "every repository"})`);
-        info(chalk.dim(`  Try: lizard git clone ${who}/<repo>`));
-      });
+    .command("clone")
+    .description("Check out a Lizard Git repository: only files, fetched on demand by hash (no history to download)")
+    .argument("<repo>", "owner/name, or name for one of yours")
+    .argument("[dir]", "Directory (default: the repository name)")
+    .option("-b, --branch <name>", "Branch (default: the repository's default branch)")
+    .option("--sparse <paths>", "Only these folders or files, comma-separated (a sparse checkout fetches nothing else)")
+    .action(async (repoArg: string, dir: string | undefined, opts: { branch?: string; sparse?: string }) => {
+      const repo = await resolveRepo(repoArg);
+      const target = dir ?? repo.split("/")[1];
+      const sparse = list(opts.sparse)?.map((x) => x.replace(/^\/+|\/+$/g, "")) ?? null;
+      const c = await wc.clone(repo, target, opts.branch, sparse, (m) => !isJSONMode() && process.stderr.write(chalk.dim(`  ${m}\r`)));
+      if (!isJSONMode()) process.stderr.write("\x1b[2K");
+      done({ repo, dir: target, branch: c.branch, commit: c.base, files: Object.keys(c.files).length, sparse },
+        `Checked out ${repo} (${c.branch} at ${c.base.slice(0, 12)}, ${Object.keys(c.files).length} files) into ${target}`);
     });
 
   git
-    .command("credential")
-    .description("git credential helper (used by `lizard git setup`; not run by hand)")
-    .argument("[operation]", "get, store or erase")
-    .action(async (op?: string) => {
-      if (op !== "get") return; // store/erase: nothing kept, nothing to forget
-      const input = readFileSync(0, "utf8");
-      const fields = Object.fromEntries(input.split("\n").filter(Boolean).map((l) => l.split(/=(.*)/s).slice(0, 2)));
-      // Only for Lizard Git itself, over the same protocol (git always says both).
-      if (!gitURLs().some((u) => { const w = new URL(u); return fields.host === w.host && fields.protocol === w.protocol.replace(":", ""); })) return;
-      const token = process.env.LIZARD_GIT_TOKEN || validToken();
-      if (!token) {
-        process.stderr.write("lizard: not signed in; run `lizard login`\n");
+    .command("init")
+    .description("Make this folder the checkout of an empty repository (then lizard git commit)")
+    .argument("<repo>", "owner/name, or name for one of yours")
+    .action(async (repoArg: string) => {
+      const repo = await resolveRepo(repoArg);
+      const c = await wc.initHere(repo, process.cwd());
+      done({ repo, branch: c.branch }, `This folder is now ${repo} (${c.branch}); commit with lizard git commit -m "..."`);
+    });
+
+  git
+    .command("diff")
+    .description("Your changes in this checkout against the commit it's at")
+    .argument("[paths...]", "Only these files or folders")
+    .option("--name-only", "Only the changed paths")
+    .action(async (paths: string[], opts: { nameOnly?: boolean }) => {
+      const root = needCheckout();
+      const c = wc.loadCheckout(root);
+      const local = wc.scanWorking(root, c);
+      const ch = wc.changesOf(c, local);
+      const pick = (p: string) => !paths.length || paths.some((x) => p === x || p.startsWith(x.replace(/\/+$/, "") + "/"));
+      const all = [...ch.added.map((p) => ["added", p]), ...ch.modified.map((p) => ["modified", p]), ...ch.deleted.map((p) => ["deleted", p])].filter(([, p]) => pick(p));
+      if (isJSONMode() || opts.nameOnly) {
+        out(all.map(([status, path]) => ({ status, path })), () => all.forEach(([, p]) => console.log(p)));
         return;
       }
-      process.stdout.write(`username=lizard\npassword=${token}\n`);
+      const before = await wc.getBlobs(c.repo, all.filter(([k]) => k !== "added").map(([, p]) => c.files[p].h));
+      for (const [kind, p] of all) {
+        const old = kind === "added" ? "" : before.get(c.files[p].h)!.toString();
+        const cur = kind === "deleted" ? "" : readFileSync(`${root}/${p}`, "utf8");
+        if (old.includes("\0") || cur.includes("\0")) {
+          console.log(chalk.bold(`Binary ${p} ${kind}`));
+          continue;
+        }
+        if (old.length + cur.length > 4 << 20) {
+          console.log(chalk.bold(`${p}: ${kind} (too large to show)`));
+          continue;
+        }
+        for (const line of wc.unifiedDiff(old, cur, p).split("\n")) {
+          console.log(line.startsWith("+") && !line.startsWith("+++") ? chalk.green(line) : line.startsWith("-") && !line.startsWith("---") ? chalk.red(line) : line.startsWith("@@") ? chalk.cyan(line) : line);
+        }
+      }
     });
 
   git
-    .command("clone")
-    .description("Clone a Lizard Git repository (signed in with your Lizard account)")
-    .argument("<repo>", "owner/name, or name for one of yours")
-    .argument("[dir]", "Directory (default: the repository name)")
-    .action(async (repoArg: string, dir?: string) => {
-      const repo = await resolveRepo(repoArg);
-      // Kept in the clone's config (--config applies before the fetch too): an empty helper
-      // first, so helpers set globally for this host don't answer instead.
-      const args = ["clone", "--config", `credential.${gitURL()}.helper=`, "--config", `credential.${gitURL()}.helper=${helperCommand()}`, cloneURL(repo)];
-      if (dir) args.push(dir);
-      const r = spawnSync("git", args, { stdio: isJSONMode() ? ["ignore", "ignore", "inherit"] : "inherit" });
-      if (r.status !== 0) throw new APIError(500, `git clone failed (exit ${r.status})`);
-      done({ repo, dir: dir ?? repo.split("/")[1], url: cloneURL(repo) }, `Cloned ${repo}`);
+    .command("commit")
+    .description("Commit your changes on the server (nothing to push): if the branch moved, the server puts them on top")
+    .argument("[paths...]", "Only these files or folders (default: every change)")
+    .requiredOption("-m, --message <text>", "Commit message")
+    .option("-b, --branch <name>", "Commit to a new branch, starting at this checkout's commit (and switch to it)")
+    .action(async (paths: string[], opts: { message: string; branch?: string }) => {
+      const root = needCheckout();
+      const c = wc.loadCheckout(root);
+      const r = await wc.commit(root, c, opts.message.endsWith("\n") ? opts.message : opts.message + "\n", paths, opts.branch);
+      const extra = r.sync.updated.length + r.sync.removed.length;
+      done(r, `Committed ${r.files} file(s) to ${r.branch}: ${r.sha.slice(0, 12)}${r.uploaded ? chalk.dim(` (${r.uploaded} uploaded)`) : ""}${extra ? chalk.dim(` · ${extra} file(s) from others' commits updated`) : ""}`);
+    });
+
+  git
+    .command("sync")
+    .alias("pull")
+    .description("Bring this checkout to the branch's latest commit (keeps your changes)")
+    .action(async () => {
+      const root = needCheckout();
+      const c = wc.loadCheckout(root);
+      const r = await wc.sync(root, c);
+      done(r, r.from === r.to ? `Already at ${c.branch}'s latest (${r.to.slice(0, 12)})` :
+        `${c.branch}: ${r.from.slice(0, 12)} -> ${r.to.slice(0, 12)} (${r.updated.length} updated, ${r.removed.length} removed)`);
+    });
+
+  git
+    .command("switch")
+    .description("Switch this checkout to another branch (keeps your changes)")
+    .argument("<branch>")
+    .option("-c, --create", "Create the branch at this checkout's commit first")
+    .action(async (branch: string, opts: { create?: boolean }) => {
+      const root = needCheckout();
+      const c = wc.loadCheckout(root);
+      if (opts.create) await lg.post(`${repoPath(c.repo)}/branches`, { name: branch, from: c.base });
+      const r = await wc.sync(root, c, branch);
+      done({ ...r, branch }, `On ${branch} at ${r.to.slice(0, 12)} (${r.updated.length} updated, ${r.removed.length} removed)`);
+    });
+
+  git
+    .command("sparse")
+    .description("Change which folders this checkout has (comma-separated; \"all\" for everything)")
+    .argument("<paths>")
+    .action(async (paths: string) => {
+      const root = needCheckout();
+      const c = wc.loadCheckout(root);
+      const local = wc.scanWorking(root, c);
+      const ch = wc.changesOf(c, local);
+      if (ch.added.length + ch.modified.length + ch.deleted.length) throw new APIError(409, "commit your changes first (lizard git commit)");
+      const next = paths === "all" ? null : list(paths)!.map((x) => x.replace(/^\/+|\/+$/g, ""));
+      // Drop what leaves the set, then sync with the new set (fetches what joins it).
+      const keep = (p: string) => !next || next.some((x) => p === x || p.startsWith(x + "/"));
+      for (const p of Object.keys(c.files)) {
+        if (!keep(p)) {
+          wc.removeFileAt(root, p);
+          delete c.files[p];
+        }
+      }
+      c.sparse = next;
+      const before = c.base;
+      c.base = ""; // make sync list and fetch everything in the new set
+      const r = await wc.sync(root, c);
+      done({ sparse: next, files: Object.keys(c.files).length, commit: r.to }, `Sparse: ${next ? next.join(", ") : "everything"} (${Object.keys(c.files).length} files at ${(r.to || before).slice(0, 12)})`);
     });
 
   // ── Repositories ─────────────────────────────────────────────────────
@@ -147,16 +243,16 @@ export function registerLizardGit(git: Command) {
     .argument("<name>")
     .option("--private", "Only you and collaborators can see it")
     .option("-d, --description <text>")
-    .option("--readme", "Start with a README (otherwise empty, ready for a push)")
+    .option("--readme", "Start with a README (otherwise empty)")
     .option("--default-branch <name>", "Default branch (main)")
     .action(async (name: string, opts) => {
       const r = await lg.post<{ owner: string; name: string }>("/api/repos", {
         name, private: !!opts.private, description: opts.description, readme: !!opts.readme, defaultBranch: opts.defaultBranch,
       });
       const full = `${r.owner}/${r.name}`;
-      out({ ...r, url: `${gitURL()}/${full}`, cloneUrl: cloneURL(full) }, () => {
+      out({ ...r, url: `${gitURL()}/${full}` }, () => {
         success(`Created ${chalk.bold(full)}  ${link(`${gitURL()}/${full}`)}`);
-        info(chalk.dim(`  Clone: lizard git clone ${full}    Push: git remote add origin ${cloneURL(full)}`));
+        info(chalk.dim(`  Check out: lizard git clone ${full}    then: lizard git commit -m "..."`));
       });
     });
   repoOpt(repo.command("view").description("A repository's details").argument("[repo]"))
@@ -168,7 +264,7 @@ export function registerLizardGit(git: Command) {
         if (m.repo.description) info(m.repo.description);
         if (m.forkOf) info(chalk.dim(`forked from ${m.forkOf}`));
         info(`default branch ${m.repo.defaultBranch} · ${m.branches} branches · ${m.tags} tags · ${m.openIssues} open issues · ${m.openPulls} open pull requests · ${m.repo.stars} stars`);
-        info(`${link(`${gitURL()}/${r}`)}\nclone: ${m.cloneUrl}`);
+        info(`${link(`${gitURL()}/${r}`)}\ncheck out: lizard git clone ${r}`);
       });
     });
   repoOpt(repo.command("edit").description("Change name, description, visibility or default branch").argument("[repo]"))
@@ -176,13 +272,11 @@ export function registerLizardGit(git: Command) {
     .option("-d, --description <text>")
     .option("--private").option("--public")
     .option("--default-branch <name>")
-    .option("--api-commits", "Also accept commits written through the API by agents without a checkout")
-    .option("--no-api-commits", "Changes only by git push and merged pull requests (the default for new repositories)")
     .action(async (arg: string | undefined, opts) => {
       const r = await resolveRepo(arg ?? opts.repo);
       await lg.patch(repoPath(r), {
         name: opts.name, description: opts.description, defaultBranch: opts.defaultBranch,
-        private: opts.private ? true : opts.public ? false : undefined, apiCommits: opts.apiCommits,
+        private: opts.private ? true : opts.public ? false : undefined,
       });
       done({ ok: true, repo: opts.name ? `${r.split("/")[0]}/${opts.name}` : r }, `Updated ${r}`);
     });
@@ -201,7 +295,7 @@ export function registerLizardGit(git: Command) {
       const r = await resolveRepo(arg ?? opts.repo);
       const f = await lg.post<{ owner: string; name: string }>(`${repoPath(r)}/forks`, { name: opts.name });
       const full = `${f.owner}/${f.name}`;
-      if (opts.clone) spawnSync("git", ["clone", "--config", `credential.${gitURL()}.helper=${helperCommand()}`, cloneURL(full)], { stdio: "inherit" });
+      if (opts.clone) await wc.clone(full, f.name, undefined, null);
       done({ ...f, url: `${gitURL()}/${full}` }, `Forked ${r} to ${chalk.bold(full)}`);
     });
   repoOpt(repo.command("forks").description("Forks of a repository").argument("[repo]"))
@@ -339,9 +433,9 @@ export function registerLizardGit(git: Command) {
       if (pulls) {
         let head = opts.head;
         if (!head) {
-          const b = spawnSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], { encoding: "utf8" });
-          head = b.status === 0 ? b.stdout.trim() : "";
-          if (!head || head === "HEAD") throw new APIError(400, "pass --head <branch>");
+          const root = wc.findCheckout();
+          head = root ? wc.loadCheckout(root).branch : "";
+          if (!head) throw new APIError(400, "pass --head <branch>");
         }
         Object.assign(body, { head, base: opts.base, headRepo: opts.headRepo, draft: !!opts.draft, reviewers: opts.reviewer.length ? opts.reviewer : undefined });
       }
@@ -530,20 +624,15 @@ export function registerLizardGit(git: Command) {
         });
         done(m, `Merged #${n} (${String(m.sha).slice(0, 7)})`);
       });
-    repoOpt(grp.command("checkout").description("Check out a pull request's branch in this clone").argument("<number>", "", int))
+    repoOpt(grp.command("checkout").description("Switch this checkout to a pull request's branch").argument("<number>", "", int))
       .action(async (n: number, opts) => {
-        const r = await resolveRepo(opts.repo);
-        const d = await lg.get<any>(`${repoPath(r)}/issues/${n}`);
-        const local = d.issue.headRepo && d.issue.headRepo !== r ? `pr-${n}` : d.issue.headRef;
-        const remoteRef = d.issue.headRepo && d.issue.headRepo !== r ? `refs/pull/${n}/head` : `refs/heads/${d.issue.headRef}`;
-        const run = (args: string[]) => {
-          const x = spawnSync("git", args, { stdio: isJSONMode() ? ["ignore", "ignore", "inherit"] : "inherit" });
-          if (x.status !== 0) throw new APIError(500, `git ${args[0]} failed`);
-        };
-        run(["fetch", "origin", `+${remoteRef}:refs/remotes/origin/${local}`]);
-        const exists = spawnSync("git", ["rev-parse", "--verify", "--quiet", `refs/heads/${local}`]).status === 0;
-        run(exists ? ["checkout", local] : ["checkout", "-b", local, "--track", `origin/${local}`]);
-        done({ branch: local }, `On branch ${local} (#${n})`);
+        const root = needCheckout();
+        const c = wc.loadCheckout(root);
+        const d = await lg.get<any>(`${repoPath(c.repo)}/issues/${n}`);
+        // A fork's branch is read here under refs/pull/<n>/head: look, don't commit.
+        const target = d.issue.headRepo && d.issue.headRepo !== c.repo ? `pull/${n}/head` : d.issue.headRef;
+        const r = await wc.sync(root, c, target);
+        done({ branch: target, commit: r.to }, `On ${target} (#${n}) at ${r.to.slice(0, 12)}`);
       });
   }
 

package/src/commands/git.ts

@@ -7,7 +7,7 @@ import { api, getBaseURL, streamSSE, withScope } from "../lib/api.js";
 import { openURL } from "../lib/auth.js";
 import { resolveProjectScope, resolveService } from "../lib/resolve.js";
 import { success, error, info, fail, isJSONMode, printJSON, isTTY, link } from "../lib/format.js";
-import { registerLizardGit } from "./git-hosting.js";
+import { registerLizardGit, checkoutStatus } from "./git-hosting.js";
 
 interface GitHubInstallation {
   id: number;
@@ -171,9 +171,10 @@ export function registerGit(program: Command) {
   // lizard git status
   git
     .command("status")
-    .description("GitHub: connection and the repositories this project's services deploy from")
+    .description("In a Lizard Git checkout: your changes. Elsewhere: GitHub connection and the repositories this project's services deploy from")
     .option("-p, --project <id>", "Project name, slug, or ID")
     .action(async (opts) => {
+      if (!opts.project && checkoutStatus()) return;
       const { projectId, scope } = await resolveProjectScope(opts.project);
 
       const [githubStatus, services] = await Promise.all([

package/src/index.ts

@@ -146,9 +146,8 @@ program
       topLevel = topLevel.parent;
     }
     if (noAuth.has(topLevel.name())) return;
-    // git runs `lizard git credential get` as its credential helper: it answers from the
-    // stored sign-in or nothing, and must never start an interactive login inside git.
-    if (topLevel.name() === "git" && actionCommand.name() === "credential") return;
+    // Lizard Git with its own token (LIZARD_GIT_TOKEN: CI, agents): no Lizard sign-in needed.
+    if (topLevel.name() === "git" && process.env.LIZARD_GIT_TOKEN) return;
 
     // Require auth — auto-triggers login flow if not logged in
     const creds = await requireAuth();