@mediamonks/canopy-cli 0.7.32 → 0.7.33

package/dist/docs/cli-create.md

@@ -19,6 +19,7 @@ canopy create existing-app --no-scaffold  # register only, no files written
 - `--slug <slug>` — the URL slug; the project will live at `https://<slug>.<site-domain>`. Lowercase letters, digits and dashes only. Defaults to a slugified version of the name (prompted on a TTY).
 - `--template <id>` — starter to scaffold: `static` (plain HTML/CSS/JS, no build step, untyped SDK from the platform — simplest apps), `spa` (Vite + React + TypeScript with the typed SDK from npm — best for real SDK use or growth), or `worker` (`spa` plus a backend worker in `worker/` — for server-side code: secrets, schedules, calling external APIs). A picker appears when omitted on a TTY; `static` is the default otherwise.
 - `--scaffold` / `--no-scaffold` — whether to write `./<slug>/` from the template. When neither is given, the CLI scaffolds unless the current directory already has a `canopy.json` (in which case it assumes you're registering an existing app and only registers).
+- `--repo` / `--no-repo` — also create a git repository for the project on Canopy and set up the new folder to push to it (see [`canopy repo`](https://docs.canopy.website/cli/repo)). When neither is given, an interactive run asks (default no) on sites that offer repositories; non-interactive runs create none.
 - `--profile <site>` — global flag (or `CANOPY_PROFILE`): which site to create the project on. The chosen profile is pinned into the scaffolded `canopy.json`.
 
 ## How it works

package/dist/docs/cli-repo.md

@@ -0,0 +1,87 @@
+---
+title: canopy repo
+description: Create, clone and set up the project's git repository on Canopy.
+---
+
+`canopy repo` manages the project's git repository. A project has at most one: a
+Canopy repository, which Canopy keeps for it, or its own GitHub repository.
+Once a folder is set up, you use plain git. The CLI signs git in on every push
+and pull, so you never handle a password or token.
+
+## Usage
+
+```bash
+canopy repo show [--json]
+canopy repo create
+canopy repo clone <slug> [folder]
+canopy repo connect
+canopy repo delete [--yes]
+```
+
+## Arguments & flags
+
+`show`, `create`, `connect` and `delete` resolve the project the usual way:
+`canopy.json` in the target folder, or `--project <slug>`. All of them honour
+the global `--profile <site>` / `CANOPY_PROFILE`.
+
+- `show` — whether the project has a repository, and if so its remote, when it
+  was created and when it was last pushed to.
+  - `--json` — the same as JSON, for scripts and agents.
+- `create` — create the project's Canopy repository. Owners, editors and
+  platform admins can. Run it in the project's folder and the folder is set up
+  too.
+- `clone <slug> [folder]` — clone the project's repository into a new folder
+  (the slug by default), ready to push.
+- `connect` — set up an existing folder.
+  - If the folder isn't a git repository yet, it is initialised on branch `main`.
+  - If it has no `origin`, the Canopy repository becomes `origin`.
+  - If `origin` points somewhere else, the Canopy repository is added as
+    `canopy`.
+- `delete` — delete the repository and all its history. Owner only. Asks you to
+  type the slug.
+  - `--yes` — skip that question.
+
+## How it works
+
+Setting up a folder (`create`, `clone`, `connect`) does two things:
+
+1. It points a remote at the project's repository.
+2. It registers the CLI as git's credential helper for that one repository.
+
+Nothing secret is written into the folder or its git settings. On each push or
+pull, git asks the CLI for credentials. The CLI exchanges your `canopy login`
+for a short-lived token that only works for this repository, keeps it in
+`~/.canopy` for up to an hour, and gets a new one when needed. `canopy logout`
+throws them away.
+
+Pushing doesn't deploy. Run `canopy deploy` for that.
+
+## Examples
+
+```bash
+canopy repo create
+git add -A && git commit -m "First version" && git push -u origin main
+```
+
+Creates the repository for the project in this folder and pushes the code.
+
+```bash
+canopy repo clone my-tool
+```
+
+Clones a teammate's project into `./my-tool`, ready to push.
+
+```bash
+canopy repo show --json
+```
+
+```json
+{
+  "kind": "canopy",
+  "remote": "https://monks.ghe.com/canopy/my-tool.git",
+  "created_at": "2026-10-21T09:12:00Z",
+  "last_push_at": "2026-10-21T09:15:42Z"
+}
+```
+
+Read the [git guide](https://docs.canopy.website/guides/git) for the bigger picture.

package/dist/docs/getting-started.md

@@ -93,6 +93,9 @@ Then open the live site:
 canopy open
 ```
 
+Want your code in git too, without a GitHub account? `canopy repo create` gives
+the project a repository on Canopy — see [Keep your code in git](https://docs.canopy.website/guides/git).
+
 ## Where to go next
 
 Everything the CLI can do is documented and available offline. List the topics:

package/dist/docs/git.md

@@ -0,0 +1,86 @@
+---
+title: Keep your code in git
+description: Give your project a git repository on Canopy — history, backup and sharing, no GitHub account needed.
+---
+
+Every project can have one git repository. If you already use GitHub, keep using
+it. If you don't have a GitHub account, Canopy can keep a private repository for
+your project instead. Your code then has history and a backup, and teammates and
+their agents can pick it up.
+
+A Canopy repository is for storing code. Pushing to it doesn't deploy anything —
+`canopy deploy` still does that.
+
+## Create one
+
+From your project folder:
+
+```bash
+canopy repo create
+```
+
+That creates the repository and sets up the folder, so from then on it is plain
+git:
+
+```bash
+git add -A
+git commit -m "First version"
+git push -u origin main
+```
+
+New projects can get one straight away with `canopy create my-tool --repo`. You
+can also create one from the dashboard, on the project's **Deploys** tab.
+
+## Work on it from another machine (or hand it to a teammate)
+
+Anyone on the project can clone it:
+
+```bash
+canopy repo clone my-tool
+```
+
+Already have the code in a folder? Set that folder up instead:
+
+```bash
+canopy repo connect
+```
+
+If the folder already pushes somewhere else (say your own GitHub), that stays
+`origin` and the Canopy repository is added as a second remote called `canopy`.
+
+## Signing in
+
+You never type a password or paste a token. The Canopy CLI signs git in for you
+on every push and pull, using your `canopy login`. When that sign-in expires, git
+stops and tells you to run `canopy login` again.
+
+Who can do what follows the project's members:
+
+- Owners and editors can pull and push.
+- Platform admins can pull.
+- Nobody else gets in.
+
+Remove someone from the project and they can no longer push or pull, even from
+a copy they already cloned.
+
+## Git apps (GitHub Desktop, VS Code, Tower, …)
+
+Set the folder up once with `canopy repo clone` or `canopy repo connect` in a
+terminal. After that, git apps that use the git installed on your computer push
+and pull as usual. Apps that bring their own git or ask for a password can't
+sign in to a Canopy repository; use the terminal for those.
+
+## Good to know
+
+- **Keep secrets out.** Files like `.env` and `.dev.vars` are ignored by the
+  project templates; secrets belong in `canopy secrets`.
+- **There is no branch protection.** Anyone who can push can rewrite history, so
+  avoid force-pushes on `main`.
+- **Deleting is for good.** `canopy repo delete` (owner only) removes the
+  repository and all its history. Deleting the project deletes its repository
+  too.
+- **Moving to your own GitHub later** is ordinary git: create an empty
+  repository there, then `git remote add github <its url>` and
+  `git push github --all`.
+
+See the [`canopy repo` reference](https://docs.canopy.website/cli/repo) for every command and flag.

package/dist/docs/index.json

@@ -67,6 +67,11 @@
           "title": "CI and deploy tokens",
           "summary": "Push-to-main deploys using a project-scoped deploy token."
         },
+        {
+          "slug": "git",
+          "title": "Keep your code in git",
+          "summary": "Give your project a git repository on Canopy — history, backup and sharing, no GitHub account needed."
+        },
         {
           "slug": "agent-tools",
           "title": "Agent tools (MCP)",
@@ -251,6 +256,11 @@
           "title": "canopy token",
           "summary": "Create, list, and revoke project-scoped deploy tokens for CI and push-to-main deploys."
         },
+        {
+          "slug": "cli-repo",
+          "title": "canopy repo",
+          "summary": "Create, clone and set up the project's git repository on Canopy."
+        },
         {
           "slug": "cli-egress",
           "title": "canopy egress",

package/dist/{docs-CtNH5kbN.mjs → docs-BP5jmD10.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-YGjjin4p.mjs";
+import { t as version } from "./package-CQIPmdcO.mjs";
 import { n as siteConfig } from "./site-DM2J10CB.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
 import { r as reportErrors } from "./ui-C_jSc1Kz.mjs";

package/dist/{feedback-_L3vqktY.mjs → feedback-5oPSxAz0.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-YGjjin4p.mjs";
+import { t as version } from "./package-CQIPmdcO.mjs";
 import { a as projectDirArgs, c as resolveProject, d as tryResolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
 import { a as apiUpload, i as apiRequest, r as apiDownload } from "./api-C4rMhE7i.mjs";
 import { r as reportErrors, t as formatDateTime } from "./ui-C_jSc1Kz.mjs";

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "./package-YGjjin4p.mjs";
+import { t as version } from "./package-CQIPmdcO.mjs";
 import { r as siteHeaderLine, t as setInvocationProfile } from "./site-DM2J10CB.mjs";
 import { a as notifyOfUpdate, o as runRefresh } from "./version-check-CcsA1QjI.mjs";
 import { defineCommand, runMain } from "citty";
@@ -62,13 +62,13 @@ const main = defineCommand({
 		description: "canopy — create and deploy vibecoded projects"
 	},
 	subCommands: {
-		login: () => import("./login-B-m-i8uu.mjs").then((m) => m.loginCommand),
-		whoami: () => import("./login-B-m-i8uu.mjs").then((m) => m.whoamiCommand),
-		logout: () => import("./login-B-m-i8uu.mjs").then((m) => m.logoutCommand),
-		create: () => import("./projects-CN2YhCZn.mjs").then((m) => m.createCommand),
-		init: () => import("./projects-CN2YhCZn.mjs").then((m) => m.initCommand),
-		projects: () => import("./projects-CN2YhCZn.mjs").then((m) => m.projectsCommand),
-		delete: () => import("./projects-CN2YhCZn.mjs").then((m) => m.deleteCommand),
+		login: () => import("./login-D0J5s_Ex.mjs").then((m) => m.loginCommand),
+		whoami: () => import("./login-D0J5s_Ex.mjs").then((m) => m.whoamiCommand),
+		logout: () => import("./login-D0J5s_Ex.mjs").then((m) => m.logoutCommand),
+		create: () => import("./projects-DQAhCZm8.mjs").then((m) => m.createCommand),
+		init: () => import("./projects-DQAhCZm8.mjs").then((m) => m.initCommand),
+		projects: () => import("./projects-DQAhCZm8.mjs").then((m) => m.projectsCommand),
+		delete: () => import("./projects-DQAhCZm8.mjs").then((m) => m.deleteCommand),
 		dev: () => import("./dev-MoHHjQh1.mjs").then((m) => m.devCommand),
 		deploy: () => import("./deploy-Ka2lHkyy.mjs").then((m) => m.deployCommand),
 		promote: () => import("./deploy-Ka2lHkyy.mjs").then((m) => m.promoteCommand),
@@ -79,19 +79,20 @@ const main = defineCommand({
 		egress: () => import("./egress-If_Gsx_M.mjs").then((m) => m.egressCommand),
 		secrets: () => import("./secrets-BSEjZnxg.mjs").then((m) => m.secretsCommand),
 		schedule: () => import("./schedule-C5lMf3ny.mjs").then((m) => m.scheduleCommand),
-		feedback: () => import("./feedback-_L3vqktY.mjs").then((m) => m.feedbackCommand),
+		feedback: () => import("./feedback-5oPSxAz0.mjs").then((m) => m.feedbackCommand),
 		db: () => import("./db-BB6O6085.mjs").then((m) => m.dbCommand),
 		usage: () => import("./usage-CUYrWxv0.mjs").then((m) => m.usageCommand),
 		ai: () => import("./ai-DHLnyqfq.mjs").then((m) => m.aiCommand),
 		open: () => import("./open-DcaQKi1v.mjs").then((m) => m.openCommand),
-		docs: () => import("./docs-CtNH5kbN.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-CM7R-4Bq.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-ChcSZW8i.mjs").then((m) => m.upgradeCommand),
+		docs: () => import("./docs-BP5jmD10.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-Dg7dQF0k.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-huJDjhrV.mjs").then((m) => m.upgradeCommand),
 		logs: () => import("./logs-DQQOawOG.mjs").then((m) => m.logsCommand),
-		mcp: () => import("./mcp-RcN17Z2v.mjs").then((m) => m.mcpCommand)
+		mcp: () => import("./mcp-DXfTYVN_.mjs").then((m) => m.mcpCommand),
+		repo: () => import("./repo-1RQ1vBMv.mjs").then((m) => m.repoCommand)
 	}
 });
-const quiet = process.argv[2] === "mcp" && process.argv[3] === "serve";
+const quiet = process.argv[2] === "mcp" && process.argv[3] === "serve" || process.argv[2] === "repo" && process.argv[3] === "credential";
 if (process.argv[2] !== "upgrade" && !quiet) notifyOfUpdate(version);
 if (!quiet && process.argv[2] && process.argv[2] !== "--help" && process.argv[2] !== "-h") console.error(siteHeaderLine(version));
 await runMain(main);

package/dist/{login-B-m-i8uu.mjs → login-D0J5s_Ex.mjs}

@@ -1,5 +1,6 @@
 import { _ as writeConfigFile, f as clearAllProfileTokens, g as upsertProfileAuth, h as setActiveProfile, m as readConfigFile, n as siteConfig, p as listBakedProfiles, v as getBakedProfile, y as isProfileId } from "./site-DM2J10CB.mjs";
 import { n as openBrowser, r as reportErrors } from "./ui-C_jSc1Kz.mjs";
+import { n as clearRepoTokenCache } from "./repo-credential-CNDRM-tG.mjs";
 import { defineCommand } from "citty";
 import { hostname } from "node:os";
 import * as p from "@clack/prompts";
@@ -98,8 +99,9 @@ const logoutCommand = defineCommand({
 			if (!result.ok) failed.push(`${id} (${result.error})`);
 		}
 		clearAllProfileTokens();
+		clearRepoTokenCache();
 		if (args.local) {
-			console.log("Logged out locally — tokens removed from ~/.canopy/config.json but still valid on the platform until they expire. Revoke them from the dashboard's Account page.");
+			console.log("Logged out locally — tokens removed from ~/.canopy but still valid on the platform until they expire (git repository tokens within the hour). Revoke them from the dashboard's Account page.");
 			return;
 		}
 		if (failed.length === 0) {

package/dist/{mcp-RcN17Z2v.mjs → mcp-DXfTYVN_.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-YGjjin4p.mjs";
+import { t as version } from "./package-CQIPmdcO.mjs";
 import { d as tryResolveProject, l as stagingUrl, n as siteConfig, s as projectUrl } from "./site-DM2J10CB.mjs";
 import { i as apiRequest, t as ApiError } from "./api-C4rMhE7i.mjs";
 import { t as liveDevServer } from "./dev-server-file-Dk9pk4AR.mjs";

package/dist/{package-YGjjin4p.mjs → package-CQIPmdcO.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.32";
+var version = "0.7.33";
 //#endregion
 export { version as t };

package/dist/{projects-CN2YhCZn.mjs → projects-DQAhCZm8.mjs}

@@ -1,6 +1,7 @@
 import { n as siteConfig, s as projectUrl, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
 import { i as apiRequest } from "./api-C4rMhE7i.mjs";
 import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-C_jSc1Kz.mjs";
+import { r as offerRepoOnCreate } from "./repo-Bb9ntNa4.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";
@@ -105,6 +106,11 @@ const createCommand = defineCommand({
 			type: "boolean",
 			description: "Scaffold ./<slug>/ from the starter template",
 			negativeDescription: "Only register — no files written"
+		},
+		repo: {
+			type: "boolean",
+			description: "Also create a git repository for the project on Canopy",
+			negativeDescription: "Don't create a git repository (no question asked)"
 		}
 	},
 	run: reportErrors("create", async ({ args }) => {
@@ -166,14 +172,20 @@ const createCommand = defineCommand({
 				...tryReadCanopyJson(targetDir),
 				slug
 			});
+			const remote = await offerRepoOnCreate(slug, targetDir, args.repo);
 			const steps = [
 				`cd ${slug}`,
 				...template.needsInstall ? ["npm install"] : [],
+				...remote ? [`git add -A && git commit -m "Initial commit" && git push -u ${remote} main`] : [],
 				"canopy dev   (or deploy right away: canopy deploy)"
 			];
 			p.note(steps.join("\n"), `Scaffolded ./${slug}/ (${template.id}) — next`);
 			p.outro(`Live URL (after first deploy): ${projectUrl(project.slug)}`);
-		} else p.outro(existsSync(join(process.cwd(), "canopy.json")) ? "Registered without scaffolding — the existing canopy.json was left unchanged." : "Registered without scaffolding — add a canopy.json to deploy an existing app.");
+		} else {
+			const remote = await offerRepoOnCreate(slug, process.cwd(), args.repo);
+			if (remote) p.log.info(`This folder pushes to the project's git repository as "${remote}".`);
+			p.outro(existsSync(join(process.cwd(), "canopy.json")) ? "Registered without scaffolding — the existing canopy.json was left unchanged." : "Registered without scaffolding — add a canopy.json to deploy an existing app.");
+		}
 	})
 });
 /** Empty enough to scaffold into: missing, or holding only dotfiles (.git, .agents…). */

package/dist/repo-1RQ1vBMv.mjs

@@ -0,0 +1,2 @@
+import { i as repoCommand } from "./repo-Bb9ntNa4.mjs";
+export { repoCommand };

package/dist/repo-Bb9ntNa4.mjs

@@ -0,0 +1,423 @@
+import { a as projectDirArgs, c as resolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
+import { i as apiRequest, o as withContext } from "./api-C4rMhE7i.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-C_jSc1Kz.mjs";
+import { a as parseCredentialInput, i as helperCommand, o as runCredentialHelper, r as fileTokenCache, t as RepoCredentialError } from "./repo-credential-CNDRM-tG.mjs";
+import { defineCommand } from "citty";
+import { existsSync, realpathSync } from "node:fs";
+import { delimiter, join, resolve } from "node:path";
+import { execFile, spawn } from "node:child_process";
+import * as p from "@clack/prompts";
+//#region src/git.ts
+/**
+* The little git the CLI needs for Canopy git repositories (OpenSpec change
+* project-git-repos): find git, run it, and read or write a working copy's
+* local configuration. Only `canopy repo` (and `canopy create --repo`) use
+* it; nothing else in the CLI requires git to be installed.
+*/
+/** Run git and capture its output. Never throws on a non-zero exit. */
+function git(args, opts = {}) {
+	return new Promise((resolve, reject) => {
+		execFile("git", args, {
+			cwd: opts.cwd,
+			maxBuffer: 16 * 1024 * 1024
+		}, (err, stdout, stderr) => {
+			if (err && err.code === "ENOENT") {
+				reject(new GitNotFound());
+				return;
+			}
+			resolve({
+				code: err ? Number(err.code ?? 1) || 1 : 0,
+				stdout: String(stdout),
+				stderr: String(stderr)
+			});
+		});
+	});
+}
+/** Run git with its output on the user's terminal (clone progress and the like). */
+function gitInteractive(args, opts = {}) {
+	return new Promise((resolve, reject) => {
+		const child = spawn("git", args, {
+			cwd: opts.cwd,
+			stdio: "inherit"
+		});
+		child.on("error", (err) => reject(err.code === "ENOENT" ? new GitNotFound() : err));
+		child.on("close", (code) => resolve(code ?? 1));
+	});
+}
+var GitNotFound = class extends Error {
+	constructor() {
+		super("git is not installed (or not on your PATH). Install it from https://git-scm.com/downloads — on a Mac, `xcode-select --install` — and try again.");
+	}
+};
+/** Throws GitNotFound when git is missing; returns the version string otherwise. */
+async function requireGit() {
+	const { stdout } = await git(["--version"]);
+	return stdout.trim();
+}
+/** True when `dir` is inside a git working copy. */
+async function isWorkingCopy(dir) {
+	const { code, stdout } = await git(["rev-parse", "--is-inside-work-tree"], { cwd: dir });
+	return code === 0 && stdout.trim() === "true";
+}
+/** The working copy's remotes, name → fetch URL. */
+async function remotes(dir) {
+	const { stdout } = await git(["remote", "-v"], { cwd: dir });
+	const out = /* @__PURE__ */ new Map();
+	for (const line of stdout.split("\n")) {
+		const match = /^(\S+)\s+(\S+)\s+\(fetch\)$/.exec(line.trim());
+		if (match) out.set(match[1], match[2]);
+	}
+	return out;
+}
+/** Replace every value of a key in the local configuration with `values`, in order. */
+async function setLocalConfig(dir, key, values) {
+	const unset = await git([
+		"config",
+		"--local",
+		"--unset-all",
+		key
+	], { cwd: dir });
+	if (unset.code !== 0 && unset.code !== 5) throw new Error(`git config --unset-all ${key} failed: ${unset.stderr.trim()}`);
+	for (const value of values) {
+		const add = await git([
+			"config",
+			"--local",
+			"--add",
+			key,
+			value
+		], { cwd: dir });
+		if (add.code !== 0) throw new Error(`git config --add ${key} failed: ${add.stderr.trim()}`);
+	}
+}
+//#endregion
+//#region src/repo.ts
+/**
+* canopy repo — the project's git repository (OpenSpec change
+* project-git-repos).
+*
+* A project has at most one repository: a Canopy repository, which Canopy
+* keeps for it, or one it links. For a Canopy repository:
+*
+*  - `create`  makes it, then sets up the current folder when it is the project;
+*  - `clone`   clones it into a new folder;
+*  - `connect` sets up an existing folder;
+*  - `show`    says which repository the project has (`--json` for agents);
+*  - `delete`  removes it and its history (owner only).
+*
+* Setting up a folder points a remote at the repository and registers
+* `canopy repo credential` as git's credential helper for that one
+* repository. No token is ever written
+* into the folder or its git configuration; git asks the helper on each fetch
+* and push, and it hands over a short-lived token for the CLI sign-in.
+*/
+/** Plain words for the API's repository errors. */
+const REPO_FIXES = {
+	repos_not_configured: "Git repositories are not available on this site yet. Use your own GitHub repository instead.",
+	repo_exists: "This project already has a repository — `canopy repo show` says which.",
+	repo_already_linked: "This project is linked to its own GitHub repository; a project has one repository.",
+	repo_name_taken: "A leftover repository with this name exists on the git host. Ask a platform admin to remove it, then try again.",
+	owner_only: "Only the project owner can delete its repository.",
+	no_repo: "This project has no Canopy repository — create one with `canopy repo create`."
+};
+const fetchRepo = (slug) => withContext(apiRequest("GET", `/projects/${slug}/repo`), {
+	action: `read ${slug}'s repository`,
+	fixes: REPO_FIXES
+});
+/**
+* How git should start this CLI for the credential helper: the `canopy` (or
+* `canopy-dev`) on PATH when it is this very install, so upgrades keep
+* working; otherwise this node binary and script, by absolute path.
+*/
+function cliInvocation() {
+	const script = realpathSync(process.argv[1]);
+	for (const dir of (process.env["PATH"] ?? "").split(delimiter)) for (const name of ["canopy", "canopy-dev"]) {
+		const candidate = join(dir, name);
+		try {
+			if (existsSync(candidate) && realpathSync(candidate) === script) return [candidate];
+		} catch {}
+	}
+	return [process.execPath, script];
+}
+/** The git config lines that route this repository's credentials to the helper. */
+function credentialConfig(gitUrl, profile, slug) {
+	const section = `credential.${gitUrl}`;
+	return [[`${section}.helper`, ["", helperCommand(cliInvocation(), profile, slug, gitUrl)]], [`${section}.useHttpPath`, ["true"]]];
+}
+function currentProfile() {
+	const profile = siteConfig().profileId;
+	if (!profile) throw new Error("Git repositories need a named site — pass --profile main, staging or gcp-pilot.");
+	return profile;
+}
+function requireCanopyRepo(slug, repo) {
+	if (repo.kind === "canopy") return repo;
+	if (repo.kind === "linked") throw new Error(`${slug} is linked to ${repo.linked_repository}; use that repository with your own git credentials.`);
+	throw new Error(`${slug} has no repository yet — create one with \`canopy repo create\`.`);
+}
+/**
+* Set up `dir` as a working copy of the project's Canopy repository: a git
+* repository if it isn't one, the remote (`origin`, or `canopy` when origin
+* points elsewhere) and the credential helper. Returns the remote's name.
+*/
+async function connectFolder(dir, slug, repo) {
+	await requireGit();
+	if (!await isWorkingCopy(dir)) {
+		const init = await git([
+			"init",
+			"-q",
+			"-b",
+			"main"
+		], { cwd: dir });
+		if (init.code !== 0) throw new Error(`git init failed: ${init.stderr.trim()}`);
+	}
+	const existing = await remotes(dir);
+	let name = "origin";
+	const already = [...existing].find(([, url]) => url === repo.remote);
+	if (already) name = already[0];
+	else {
+		if (existing.has("origin")) name = "canopy";
+		if (existing.has(name)) throw new Error(`This folder already has a remote named "${name}" pointing elsewhere (${existing.get(name)}). Remove or rename it, then run \`canopy repo connect\` again.`);
+		const add = await git([
+			"remote",
+			"add",
+			name,
+			repo.remote
+		], { cwd: dir });
+		if (add.code !== 0) throw new Error(`git remote add failed: ${add.stderr.trim()}`);
+	}
+	for (const [key, values] of credentialConfig(repo.remote, currentProfile(), slug)) await setLocalConfig(dir, key, values);
+	return name;
+}
+const showCommand = defineCommand({
+	meta: {
+		name: "show",
+		description: "Show the project's git repository"
+	},
+	args: {
+		...projectDirArgs,
+		json: {
+			type: "boolean",
+			default: false,
+			description: "Print JSON (for scripts and agents)"
+		}
+	},
+	run: reportErrors("repo show", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		const repo = await fetchRepo(slug);
+		if (args.json) {
+			console.log(JSON.stringify(repo, null, 2));
+			return;
+		}
+		if (repo.kind === "none") console.log(`${slug} has no git repository. Create one with \`canopy repo create\`.`);
+		else if (repo.kind === "linked") console.log(`${slug} is linked to ${repo.linked_repository}.`);
+		else {
+			console.log(`${slug} has a Canopy git repository.`);
+			console.log(`  remote     ${repo.remote}`);
+			console.log(`  created    ${repo.created_at ? formatDateTime(repo.created_at) : "—"}`);
+			console.log(`  last push  ${repo.last_push_at ? formatDateTime(repo.last_push_at) : "never"}`);
+			console.log(`\nClone it with \`canopy repo clone ${slug}\`.`);
+		}
+	})
+});
+const createCommand = defineCommand({
+	meta: {
+		name: "create",
+		description: "Create a Canopy git repository for the project"
+	},
+	args: { ...projectDirArgs },
+	run: reportErrors("repo create", async ({ args }) => {
+		const { dir, slug } = resolveProject(args);
+		const repo = await withContext(apiRequest("POST", `/projects/${slug}/repo`), {
+			action: `create a git repository for ${slug}`,
+			fixes: REPO_FIXES
+		});
+		p.log.success(`Created a git repository for ${slug}.`);
+		if (tryReadCanopyJson(dir)?.slug === slug) {
+			const remote = await connectFolder(dir, slug, repo);
+			p.log.info(`This folder pushes to it as "${remote}". Commit and push as usual:`);
+			console.log(`  git add -A && git commit -m "Initial commit" && git push -u ${remote} main`);
+		} else p.log.info(`Clone it with \`canopy repo clone ${slug}\`.`);
+	})
+});
+const connectCommand = defineCommand({
+	meta: {
+		name: "connect",
+		description: "Set up a folder to push to the project's Canopy git repository"
+	},
+	args: { ...projectDirArgs },
+	run: reportErrors("repo connect", async ({ args }) => {
+		const { dir, slug } = resolveProject(args);
+		const remote = await connectFolder(dir, slug, requireCanopyRepo(slug, await fetchRepo(slug)));
+		p.log.success(`This folder now pushes to ${slug}'s repository as "${remote}".`);
+	})
+});
+const cloneCommand = defineCommand({
+	meta: {
+		name: "clone",
+		description: "Clone a project's Canopy git repository"
+	},
+	args: {
+		slug: {
+			type: "positional",
+			description: "Project slug",
+			required: true
+		},
+		target: {
+			type: "positional",
+			description: "Folder to clone into (defaults to the slug)",
+			required: false
+		}
+	},
+	run: reportErrors("repo clone", async ({ args }) => {
+		const slug = args.slug;
+		const repo = requireCanopyRepo(slug, await fetchRepo(slug));
+		await requireGit();
+		const target = resolve(args.target ?? slug);
+		const code = await gitInteractive([
+			"clone",
+			...credentialConfig(repo.remote, currentProfile(), slug).flatMap(([key, values]) => values.flatMap((value) => ["-c", `${key}=${value}`])),
+			repo.remote,
+			target
+		]);
+		if (code !== 0) throw new Error(`git clone failed (exit ${code}).`);
+		p.log.success(`Cloned ${slug} into ${target}.`);
+	})
+});
+const deleteCommand = defineCommand({
+	meta: {
+		name: "delete",
+		description: "Delete the project's Canopy git repository and its history"
+	},
+	args: {
+		...projectDirArgs,
+		yes: {
+			type: "boolean",
+			default: false,
+			description: "Skip the type-the-slug confirmation"
+		}
+	},
+	run: reportErrors("repo delete", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		if (!args.yes) {
+			requireTty("pass --yes to delete without confirmation.");
+			if (unwrap(await p.text({ message: `Delete ${slug}'s git repository and all its history? Type the slug to confirm.` })).trim() !== slug) {
+				p.cancel("Aborted.");
+				return;
+			}
+		}
+		await withContext(apiRequest("DELETE", `/projects/${slug}/repo`), {
+			action: `delete ${slug}'s git repository`,
+			fixes: REPO_FIXES
+		});
+		p.log.success(`Deleted ${slug}'s git repository.`);
+	})
+});
+/** Exchange this site's CLI sign-in for a repository token (never a deploy token). */
+async function mintRepoToken(profile, slug) {
+	const config = siteConfig();
+	const login = `run \`canopy login --profile ${profile}\``;
+	if (!config.token) throw new RepoCredentialError(`not signed in to ${profile} — ${login}.`);
+	const path = `/projects/${encodeURIComponent(slug)}/repo/token`;
+	const res = await fetch(`${config.apiUrl}/control/v1${path}`, {
+		method: "POST",
+		headers: { authorization: `Bearer ${config.token}` }
+	}).catch(() => null);
+	if (!res) throw new RepoCredentialError(`could not reach Canopy (${config.apiUrl}).`);
+	if (res.status === 201) return await res.json();
+	const body = await res.json().catch(() => ({}));
+	if (res.status === 401) throw new RepoCredentialError(`your ${profile} sign-in has expired — ${login}.`);
+	if (res.status === 404) throw new RepoCredentialError(`you don't have access to ${slug}'s repository (or it no longer exists).`);
+	throw new RepoCredentialError(body.detail ?? body.error ?? `Canopy answered HTTP ${res.status}.`);
+}
+const credentialCommand = defineCommand({
+	meta: {
+		name: "credential",
+		description: "git credential helper (set up by clone/connect)",
+		hidden: true
+	},
+	args: {
+		action: {
+			type: "positional",
+			description: "get | store | erase",
+			required: true
+		},
+		project: {
+			type: "string",
+			description: "Project slug",
+			required: true
+		},
+		url: {
+			type: "string",
+			description: "Repository URL git talks to",
+			required: true
+		}
+	},
+	run: async ({ args }) => {
+		const profile = siteConfig().profileId;
+		const input = parseCredentialInput(await readStdin());
+		const out = profile ? await runCredentialHelper(args.action, input, {
+			cacheKey: `${profile}/${args.project}`,
+			repoUrl: args.url,
+			cache: fileTokenCache(),
+			mint: () => mintRepoToken(profile, args.project)
+		}) : {
+			stdout: "quit=1\n",
+			stderr: "canopy: this repository's site is unknown — run `canopy repo connect` again.\n"
+		};
+		process.stderr.write(out.stderr);
+		process.stdout.write(out.stdout);
+	}
+});
+async function readStdin() {
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(chunk);
+	return Buffer.concat(chunks).toString("utf8");
+}
+const repoCommand = defineCommand({
+	meta: {
+		name: "repo",
+		description: "The project's git repository (clone, connect, create)"
+	},
+	subCommands: {
+		show: showCommand,
+		clone: cloneCommand,
+		connect: connectCommand,
+		create: createCommand,
+		delete: deleteCommand,
+		credential: credentialCommand
+	}
+});
+/** Whether this site offers Canopy git repositories (the `repos` capability). */
+async function reposAvailable() {
+	const platform = await apiRequest("GET", "/platform").catch(() => null);
+	return Boolean(platform?.capabilities?.repos);
+}
+/**
+* The repository step of `canopy create` (design D-H). `--repo` creates one,
+* `--no-repo` doesn't; otherwise an interactive run is asked (default no) when
+* the site offers repositories and the folder doesn't already push to GitHub.
+* A repository that can't be created never fails the project creation.
+* Returns the remote name when the folder was set up.
+*/
+async function offerRepoOnCreate(slug, dir, flag) {
+	if (flag === false) return null;
+	if (flag === void 0) {
+		if (!process.stdin.isTTY || !await reposAvailable()) return null;
+		const origin = await isWorkingCopy(dir).catch(() => false) ? (await remotes(dir)).get("origin") : void 0;
+		if (origin && /github\.com[:/]/.test(origin)) return null;
+		if (!unwrap(await p.confirm({
+			message: "Create a git repository for this project on Canopy?",
+			initialValue: false
+		}))) return null;
+	}
+	try {
+		return await connectFolder(dir, slug, await withContext(apiRequest("POST", `/projects/${slug}/repo`), {
+			action: `create a git repository for ${slug}`,
+			fixes: REPO_FIXES
+		}));
+	} catch (err) {
+		p.log.warn(`The project was created, but its git repository wasn't: ${err instanceof Error ? err.message : String(err)}\nTry again later with \`canopy repo create\`.`);
+		return null;
+	}
+}
+//#endregion
+export { repoCommand as i, connectFolder as n, offerRepoOnCreate as r, cliInvocation as t };

package/dist/repo-credential-CNDRM-tG.mjs

@@ -0,0 +1,118 @@
+import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+/** Why no token could be had — shown to the user, then git is told to quit. */
+var RepoCredentialError = class extends Error {};
+const REPO_TOKEN_CACHE_PATH = join(homedir(), ".canopy", "repo-tokens.json");
+/** The on-disk cache: one JSON object, owner-only. */
+function fileTokenCache(path = REPO_TOKEN_CACHE_PATH) {
+	const read = () => {
+		try {
+			return JSON.parse(readFileSync(path, "utf8"));
+		} catch {
+			return {};
+		}
+	};
+	const write = (all) => {
+		mkdirSync(dirname(path), {
+			recursive: true,
+			mode: 448
+		});
+		writeFileSync(path, `${JSON.stringify(all, null, 2)}\n`, { mode: 384 });
+		chmodSync(path, 384);
+	};
+	return {
+		get: (key) => read()[key],
+		set: (key, value) => write({
+			...read(),
+			[key]: value
+		}),
+		delete: (key) => {
+			const all = read();
+			if (!(key in all)) return;
+			delete all[key];
+			write(all);
+		}
+	};
+}
+/** `canopy logout` forgets every cached repository token. */
+function clearRepoTokenCache(path = REPO_TOKEN_CACHE_PATH) {
+	rmSync(path, { force: true });
+}
+/** git's credential protocol: `key=value` lines, terminated by a blank line or EOF. */
+function parseCredentialInput(text) {
+	const out = /* @__PURE__ */ new Map();
+	for (const line of text.split("\n")) {
+		if (line === "") break;
+		const eq = line.indexOf("=");
+		if (eq > 0) out.set(line.slice(0, eq), line.slice(eq + 1));
+	}
+	return out;
+}
+const normalize = (url) => url.replace(/\/+$/, "").replace(/\.git$/, "");
+/** Whether git is asking about exactly the repository this helper was registered for. */
+function requestMatches(input, repoUrl) {
+	const protocol = input.get("protocol");
+	const host = input.get("host");
+	const path = input.get("path");
+	if (protocol !== "https" || !host || !path) return false;
+	return normalize(`${protocol}://${host}/${path}`) === normalize(repoUrl);
+}
+/** Answer one git credential request. */
+async function runCredentialHelper(action, input, opts) {
+	const now = opts.now ?? Date.now;
+	if (!requestMatches(input, opts.repoUrl)) return {
+		stdout: "",
+		stderr: ""
+	};
+	if (action === "erase") {
+		opts.cache.delete(opts.cacheKey);
+		return {
+			stdout: "",
+			stderr: ""
+		};
+	}
+	if (action !== "get") return {
+		stdout: "",
+		stderr: ""
+	};
+	let token = opts.cache.get(opts.cacheKey);
+	if (!token || Date.parse(token.expires_at) - now() <= 3e5) {
+		try {
+			token = await opts.mint();
+		} catch (err) {
+			opts.cache.delete(opts.cacheKey);
+			return {
+				stdout: "quit=1\n",
+				stderr: `canopy: ${err instanceof RepoCredentialError ? err.message : String(err)}\n`
+			};
+		}
+		opts.cache.set(opts.cacheKey, token);
+	}
+	const expiry = Math.floor(Date.parse(token.expires_at) / 1e3);
+	return {
+		stdout: `username=x-access-token\npassword=${token.token}\npassword_expiry_utc=${expiry}\n`,
+		stderr: ""
+	};
+}
+/**
+* The shell command git runs for the helper, as written into
+* `credential.<url>.helper`. Absolute paths, so GUI git clients without the
+* user's PATH still find it.
+*/
+function helperCommand(cli, profile, slug, repoUrl) {
+	const quote = (s) => `'${s.replaceAll("'", `'\\''`)}'`;
+	return `!${[
+		...cli.map(quote),
+		"repo",
+		"credential",
+		"--profile",
+		quote(profile),
+		"--project",
+		quote(slug),
+		"--url",
+		quote(repoUrl)
+	].join(" ")}`;
+}
+//#endregion
+export { parseCredentialInput as a, helperCommand as i, clearRepoTokenCache as n, runCredentialHelper as o, fileTokenCache as r, RepoCredentialError as t };

package/dist/skill/canopy/SKILL.md

@@ -104,6 +104,11 @@ and never go stale.
 - Work bug reports & feedback: `canopy feedback list | show | comment | status | report`
   — see [Working feedback reports](#working-feedback-reports-issues) below
 - CI credentials: `canopy token create | list | revoke`
+- Git: `canopy repo show --json` (is there a repository, and its remote) ·
+  `canopy repo create` · `canopy repo clone <slug>` · `canopy repo connect`
+  (set up an existing folder). Then plain `git`: the CLI gives git
+  short-lived credentials itself, so never ask for, paste or store a git
+  token. Pushing doesn't deploy — `canopy deploy` does.
 
 ## Working feedback reports (issues)
 
@@ -183,7 +188,8 @@ Non-interactive: `canopy create "My App" --template spa`. **When unsure between
 
 ## Safety rules
 
-- **Destructive commands** — `canopy db restore` and `canopy delete` wipe data.
+- **Destructive commands** — `canopy db restore`, `canopy delete` and
+  `canopy repo delete` (the project's git history) wipe data.
   Confirm intent with the user first, and take a `canopy db snapshot` before
   restores.
 - **Deploys are public.** `canopy deploy` makes a version live. Confirm before

package/dist/{skill-CM7R-4Bq.mjs → skill-Dg7dQF0k.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-YGjjin4p.mjs";
+import { t as version } from "./package-CQIPmdcO.mjs";
 import { r as reportErrors } from "./ui-C_jSc1Kz.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";

package/dist/templates/spa/AGENTS.md

@@ -35,6 +35,19 @@ the [Canopy dashboard](https://dashboard.thanarie.dev).
   `canopy promote` ships the exact tested version. Never promote with failing
   checks.
 
+## Git
+
+Code can live in a git repository Canopy keeps for the project (no GitHub
+account needed). `canopy repo show --json` says whether there is one and gives
+its remote; `canopy repo create` makes one, `canopy repo clone <slug>` or
+`canopy repo connect` sets a folder up. After that it is plain `git` — the CLI
+hands git short-lived credentials by itself:
+
+- Never ask for, paste or store a git token or password.
+- Pushing doesn't deploy — `canopy deploy` still does.
+- The `.github/workflows` file here only runs on GitHub; on a Canopy
+  repository it is kept but never runs.
+
 ## Boundaries
 
 - Do not add auth — the platform authenticates every request before it

package/dist/templates/spa/_gitignore

@@ -2,3 +2,7 @@ node_modules/
 dist/
 .canopy/
 .DS_Store
+# Local secrets never go into git (secrets belong in `canopy secrets`).
+.dev.vars
+.env*
+!.env.example

package/dist/templates/static/AGENTS.md

@@ -34,6 +34,17 @@ the [Canopy dashboard](https://dashboard.thanarie.dev).
   `canopy promote` ships the exact tested version. Never promote with failing
   checks.
 
+## Git
+
+Code can live in a git repository Canopy keeps for the project (no GitHub
+account needed). `canopy repo show --json` says whether there is one and gives
+its remote; `canopy repo create` makes one, `canopy repo clone <slug>` or
+`canopy repo connect` sets a folder up. After that it is plain `git` — the CLI
+hands git short-lived credentials by itself:
+
+- Never ask for, paste or store a git token or password.
+- Pushing doesn't deploy — `canopy deploy` still does.
+
 ## Boundaries
 
 - Do not add auth — the platform authenticates every request before it

package/dist/templates/static/_gitignore

@@ -1,2 +1,6 @@
 .canopy/
 .DS_Store
+# Local secrets never go into git (secrets belong in `canopy secrets`).
+.dev.vars
+.env*
+!.env.example

package/dist/templates/worker/AGENTS.md

@@ -51,6 +51,19 @@ the [Canopy dashboard](https://dashboard.thanarie.dev).
   `canopy promote` ships the exact tested version. Never promote with failing
   checks.
 
+## Git
+
+Code can live in a git repository Canopy keeps for the project (no GitHub
+account needed). `canopy repo show --json` says whether there is one and gives
+its remote; `canopy repo create` makes one, `canopy repo clone <slug>` or
+`canopy repo connect` sets a folder up. After that it is plain `git` — the CLI
+hands git short-lived credentials by itself:
+
+- Never ask for, paste or store a git token or password.
+- Pushing doesn't deploy — `canopy deploy` still does.
+- The `.github/workflows` file here only runs on GitHub; on a Canopy
+  repository it is kept but never runs.
+
 ## Boundaries
 
 - Do not add auth — the platform authenticates every request before it

package/dist/templates/worker/_gitignore

@@ -3,3 +3,6 @@ dist/
 .canopy/
 .dev.vars
 .DS_Store
+# Local secrets never go into git (secrets belong in `canopy secrets`).
+.env*
+!.env.example

package/dist/{upgrade-ChcSZW8i.mjs → upgrade-huJDjhrV.mjs}

@@ -112,7 +112,7 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-CM7R-4Bq.mjs");
+		const { skillInstalled } = await import("./skill-Dg7dQF0k.mjs");
 		const { homedir } = await import("node:os");
 		const refreshGlobal = skillInstalled(homedir());
 		const refreshRepo = process.cwd() !== homedir() && skillInstalled(process.cwd());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.7.32",
+  "version": "0.7.33",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"