@meistrari/tela-cli 0.3.0 → 0.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/tela-cli",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "type": "module",
   "bin": {
     "tela": "cli.ts"

package/src/commands/status.ts

@@ -31,6 +31,9 @@ export function renderStatusReport(report: StatusReport, options: RenderOptions
         { label: 'Workspace', value: report.config.workspace ?? '<signed out>' },
         { label: 'Organization', value: report.config.forgejoOrganization ?? '<not selected>' },
         { label: 'Forgejo user', value: report.config.forgejoUserRegistered == null ? '<unknown>' : (report.config.forgejoUserRegistered ? 'registered' : 'pending') },
+        { label: 'Git SSH key', value: report.config.gitSshKeyTitle ?? '<missing>' },
+        { label: 'Git SSH public key', value: report.config.gitSshPublicKeyPath ?? '<missing>' },
+        { label: 'Git SSH private key', value: report.config.gitSshPrivateKeyPath ?? '<missing>' },
         { label: 'Access token', value: report.config.accessToken ?? '<missing>' },
         { label: 'Session expiry', value: report.config.sessionExpiresAt ? new Date(report.config.sessionExpiresAt).toISOString() : '<missing>' },
         { label: 'Refresh token', value: report.config.hasRefreshToken ? 'present' : 'missing' },

package/src/config.ts

@@ -5,9 +5,13 @@ import { listOrganizations, provisionForgejoUser } from './agent-api.ts'
 import type { FetchLike } from './auth.ts'
 import { createUserFacingError } from './errors.ts'
 import {
+    createGitSshKey,
     ensureForgejoUserAccess,
+    inferSshPrivateKeyPath,
     listDiscoveredSshPublicKeys,
     loadSshPublicKey,
+    resolveSshPrivateKeyPath,
+    validateSshPrivateKeyPath,
     validateSshPublicKeyPath,
     type SelectedSshPublicKey,
 } from './forgejo.ts'
@@ -15,6 +19,7 @@ import type {
     TelaCliAuthState,
     TelaCliConfig,
     TelaCliForgejoOrganization,
+    TelaCliGitSshKey,
     TelaEnvironment,
 } from './types.ts'
 
@@ -213,6 +218,18 @@ function normalizeForgejoOrganization(
     }
 }
 
+function normalizeGitSshKey(gitSshKey: TelaCliConfig['gitSshKey']): TelaCliGitSshKey | null {
+    if (!gitSshKey) {
+        return null
+    }
+
+    return {
+        title: ensureNonEmpty(String(gitSshKey.title ?? ''), 'Git SSH key title'),
+        publicKeyPath: expandHome(ensureNonEmpty(String(gitSshKey.publicKeyPath ?? ''), 'Git SSH public key path')),
+        privateKeyPath: expandHome(ensureNonEmpty(String(gitSshKey.privateKeyPath ?? ''), 'Git SSH private key path')),
+    }
+}
+
 function normalizeConfig(config: TelaCliConfig): TelaCliConfig {
     const environment = ensureEnvironment(config.environment)
     const auth = normalizeAuth(config.auth)
@@ -229,6 +246,7 @@ function normalizeConfig(config: TelaCliConfig): TelaCliConfig {
         auth,
         forgejoOrganization: auth ? normalizeForgejoOrganization(config.forgejoOrganization) : null,
         forgejoUserRegistered: Boolean(config.forgejoUserRegistered),
+        gitSshKey: normalizeGitSshKey(config.gitSshKey),
     }
 }
 
@@ -257,6 +275,7 @@ function parseJsonConfig(input: string): TelaCliConfig {
         auth,
         forgejoOrganization: parsed.forgejoOrganization as TelaCliConfig['forgejoOrganization'] ?? null,
         forgejoUserRegistered: Boolean(parsed.forgejoUserRegistered ?? false),
+        gitSshKey: parsed.gitSshKey as TelaCliConfig['gitSshKey'] ?? null,
     })
 }
 
@@ -317,6 +336,25 @@ async function promptForSshPublicKey(prompts: PromptModule): Promise<SelectedSsh
     return loadSshPublicKey(promptValue(customPath))
 }
 
+async function promptForSshPrivateKeyPath(
+    prompts: PromptModule,
+    sshKey: SelectedSshPublicKey,
+): Promise<string> {
+    const privateKeyPath = await prompts.text({
+        message: 'SSH private key path',
+        defaultValue: inferSshPrivateKeyPath(sshKey.path),
+        placeholder: sshKey.path.endsWith('.pub')
+            ? sshKey.path.slice(0, -4)
+            : '~/.ssh/id_ed25519',
+        validate: validateSshPrivateKeyPath,
+    })
+    if (prompts.isCancel(privateKeyPath)) {
+        cancelSetup(prompts)
+    }
+
+    return resolveSshPrivateKeyPath(promptValue(privateKeyPath))
+}
+
 function getHomeDir(): string {
     return process.env.HOME || homedir()
 }
@@ -700,6 +738,7 @@ export async function setupConfigInteractive(options: {
     }
 
     const sshKey = await promptForSshPublicKey(prompts)
+    const privateKeyPath = await promptForSshPrivateKeyPath(prompts, sshKey)
 
     const resolvedSetup = {
         ...resolveEnvironmentConfigForPreset(environment, customValues),
@@ -718,6 +757,7 @@ export async function setupConfigInteractive(options: {
         auth,
         forgejoOrganization: null,
         forgejoUserRegistered: false,
+        gitSshKey: createGitSshKey(sshKey, privateKeyPath),
     })
     const organization = await resolveForgejoOrganizationInteractive({
         prompts,

package/src/diagnostics.ts

@@ -2,6 +2,7 @@ import { accessSync, constants, existsSync, statSync } from 'node:fs'
 import { dirname } from 'node:path'
 import { buildAgentApiHeaders } from './auth.ts'
 import { inspectSavedConfig, redactSecret } from './config.ts'
+import { resolveSshPrivateKeyPath } from './forgejo.ts'
 import {
     findRepositoryRoot,
     getCurrentBranch,
@@ -57,6 +58,9 @@ export interface StatusReport {
         workspace?: string
         forgejoOrganization?: string
         forgejoUserRegistered?: boolean
+        gitSshKeyTitle?: string
+        gitSshPublicKeyPath?: string
+        gitSshPrivateKeyPath?: string
         accessToken?: string
         sessionExpiresAt?: number
         hasRefreshToken?: boolean
@@ -264,6 +268,7 @@ function buildStatusNextActions(
     hasAuth: boolean,
     hasForgejoOrganization: boolean,
     hasForgejoAccess: boolean,
+    hasGitSshKey: boolean,
 ): string[] {
     const actions: string[] = []
 
@@ -279,6 +284,9 @@ function buildStatusNextActions(
     else if (!hasForgejoAccess) {
         actions.push('Run `tela setup` again to provision Forgejo access with your SSH key.')
     }
+    else if (!hasGitSshKey) {
+        actions.push('Run `tela setup` again to choose the SSH key Tela should force on Git operations.')
+    }
 
     if (!repo.inRepository) {
         actions.push('Run `tela sync <repo>` or change into a cloned repository before mutating commands.')
@@ -329,6 +337,17 @@ export async function createStatusReport(
         if (!configInspection.config.forgejoUserRegistered) {
             warnings.push('Forgejo user access is not provisioned yet.')
         }
+        if (!configInspection.config.gitSshKey) {
+            warnings.push('Git SSH key selection is missing.')
+        }
+        else {
+            try {
+                resolveSshPrivateKeyPath(configInspection.config.gitSshKey.privateKeyPath)
+            }
+            catch (error) {
+                warnings.push(`Configured Git SSH private key is unavailable: ${error instanceof Error ? error.message : String(error)}`)
+            }
+        }
     }
 
     if (!gitAvailable) {
@@ -362,6 +381,7 @@ export async function createStatusReport(
         Boolean(configInspection.config?.auth),
         Boolean(configInspection.config?.forgejoOrganization),
         Boolean(configInspection.config?.forgejoUserRegistered),
+        Boolean(configInspection.config?.gitSshKey),
     )
 
     return {
@@ -379,6 +399,9 @@ export async function createStatusReport(
             workspace: configInspection.config?.auth?.workspace.title,
             forgejoOrganization: configInspection.config?.forgejoOrganization?.name,
             forgejoUserRegistered: configInspection.config?.forgejoUserRegistered,
+            gitSshKeyTitle: configInspection.config?.gitSshKey?.title,
+            gitSshPublicKeyPath: configInspection.config?.gitSshKey?.publicKeyPath,
+            gitSshPrivateKeyPath: configInspection.config?.gitSshKey?.privateKeyPath,
             accessToken: configInspection.config?.auth ? redactSecret(configInspection.config.auth.session.accessToken) : undefined,
             sessionExpiresAt: configInspection.config?.auth?.session.expiresAt,
             hasRefreshToken: Boolean(configInspection.config?.auth?.session.refreshToken),
@@ -474,6 +497,47 @@ function buildCloneRootCheck(cloneRoot: string | undefined): DoctorCheck {
     }
 }
 
+function buildGitSshKeyCheck(gitSshKey: {
+    title?: string
+    publicKeyPath?: string
+    privateKeyPath?: string
+}): DoctorCheck {
+    if (!gitSshKey.privateKeyPath) {
+        return {
+            id: 'git-ssh-key',
+            group: 'access',
+            status: 'warn',
+            summary: 'No Git SSH key is configured.',
+            fixes: ['Run `tela setup` again and choose the SSH key to force on Git operations.'],
+        }
+    }
+
+    try {
+        const privateKeyPath = resolveSshPrivateKeyPath(gitSshKey.privateKeyPath)
+        return {
+            id: 'git-ssh-key',
+            group: 'access',
+            status: 'pass',
+            summary: `Git SSH key is configured: ${gitSshKey.title ?? '<unnamed>'}.`,
+            fixes: ['No action required.'],
+            evidence: [
+                gitSshKey.publicKeyPath ? `public key: ${gitSshKey.publicKeyPath}` : '',
+                `private key: ${privateKeyPath}`,
+            ].filter(Boolean),
+        }
+    }
+    catch (error) {
+        return {
+            id: 'git-ssh-key',
+            group: 'access',
+            status: 'fail',
+            summary: 'Configured Git SSH private key is unavailable.',
+            fixes: ['Restore the private key file or run `tela setup` again and choose another SSH key.'],
+            evidence: [error instanceof Error ? error.message : String(error)],
+        }
+    }
+}
+
 function buildRepoChecks(repo: RepoSnapshot): DoctorCheck[] {
     if (!repo.inRepository) {
         return [
@@ -688,6 +752,12 @@ export async function createDoctorReport(
                 ? ['No action required.']
                 : ['Run `tela setup` again and complete SSH-key provisioning for Forgejo access.'],
         })
+
+        checks.push(buildGitSshKeyCheck({
+            title: configInspection.config.gitSshKey?.title,
+            publicKeyPath: configInspection.config.gitSshKey?.publicKeyPath,
+            privateKeyPath: configInspection.config.gitSshKey?.privateKeyPath,
+        }))
     }
 
     const nextActions = buildNextActions(checks)

package/src/forgejo.ts

@@ -8,6 +8,7 @@ import type {
     ForgejoUserCreateResponse,
     ForgejoUserSshKeyInput,
     TelaCliConfig,
+    TelaCliGitSshKey,
     TelaCliForgejoOrganization,
 } from './types.ts'
 
@@ -95,6 +96,49 @@ export function validateSshPublicKeyPath(value: string): string | undefined {
     }
 }
 
+export function inferSshPrivateKeyPath(publicKeyPath: string): string {
+    const expandedPath = expandHome(publicKeyPath.trim())
+    return expandedPath.endsWith('.pub')
+        ? expandedPath.slice(0, -4)
+        : expandedPath
+}
+
+export function resolveSshPrivateKeyPath(filePath: string): string {
+    const expandedPath = expandHome(filePath.trim())
+    if (!expandedPath) {
+        throw new Error('SSH private key path is required')
+    }
+
+    if (!existsSync(expandedPath)) {
+        throw new Error(`SSH private key file does not exist: ${expandedPath}`)
+    }
+
+    const stats = statSync(expandedPath)
+    if (!stats.isFile()) {
+        throw new Error(`SSH private key path is not a file: ${expandedPath}`)
+    }
+
+    return expandedPath
+}
+
+export function validateSshPrivateKeyPath(value: string): string | undefined {
+    try {
+        resolveSshPrivateKeyPath(value)
+        return undefined
+    }
+    catch (error) {
+        return error instanceof Error ? error.message : 'SSH private key path is invalid'
+    }
+}
+
+export function createGitSshKey(sshKey: SelectedSshPublicKey, privateKeyPath: string): TelaCliGitSshKey {
+    return {
+        title: sshKey.title,
+        publicKeyPath: sshKey.path,
+        privateKeyPath: resolveSshPrivateKeyPath(privateKeyPath),
+    }
+}
+
 export function listDiscoveredSshPublicKeys(): SelectedSshPublicKey[] {
     const sshDirectory = getSshDirectory()
     if (!existsSync(sshDirectory)) {

package/src/git.ts

@@ -1,6 +1,14 @@
 import { basename } from 'node:path'
-import { randomUUID } from 'node:crypto'
-import { CommandError, runCommand, runShell } from './process.ts'
+import { inspectSavedConfig } from './config.ts'
+import { createUserFacingError } from './errors.ts'
+import { resolveSshPrivateKeyPath } from './forgejo.ts'
+import {
+    CommandError,
+    runCommand,
+    type CommandResult,
+    type RunCommandOptions,
+} from './process.ts'
+import type { TelaCliGitSshKey } from './types.ts'
 
 export interface GitStatusEntry {
     index: string
@@ -15,8 +23,167 @@ export interface GitStatusCounts {
     total: number
 }
 
+interface GitRunOptions extends Omit<RunCommandOptions, 'env'> {
+    requireConfiguredSsh?: boolean
+}
+
+function quoteForShell(value: string): string {
+    return `'${value.replaceAll('\'', `'"'"'`)}'`
+}
+
+export function buildGitSshCommand(privateKeyPath: string): string {
+    return `ssh -i ${quoteForShell(privateKeyPath)} -o IdentitiesOnly=yes`
+}
+
+export function isSshRemoteUrl(remoteUrl: string): boolean {
+    const trimmed = remoteUrl.trim()
+    return /^ssh:\/\//i.test(trimmed) || /^[^\s@]+@[^\s:]+:.+$/.test(trimmed)
+}
+
+function resolveConfiguredGitSshKey(requireConfiguredSsh: boolean): TelaCliGitSshKey | null {
+    const inspection = inspectSavedConfig()
+    if (!inspection.exists) {
+        if (requireConfiguredSsh) {
+            throw createUserFacingError({
+                code: 'git_ssh_key_config_missing',
+                summary: 'Tela CLI is not configured with a Git SSH key.',
+                fixes: [
+                    'Run `tela setup` and choose the SSH key to force on Git operations.',
+                ],
+            })
+        }
+
+        return null
+    }
+
+    if (!inspection.valid || !inspection.config) {
+        if (requireConfiguredSsh) {
+            throw createUserFacingError({
+                code: 'git_ssh_key_config_invalid',
+                summary: 'Tela CLI config is invalid, so the Git SSH key could not be loaded.',
+                details: inspection.error,
+                fixes: [
+                    'Run `tela setup` to rewrite the config and choose the SSH key again.',
+                ],
+            })
+        }
+
+        return null
+    }
+
+    if (!inspection.config.gitSshKey) {
+        if (requireConfiguredSsh) {
+            throw createUserFacingError({
+                code: 'git_ssh_key_missing',
+                summary: 'No Git SSH key is configured.',
+                fixes: [
+                    'Run `tela setup` again and choose the SSH key to use for Git operations.',
+                ],
+            })
+        }
+
+        return null
+    }
+
+    try {
+        return {
+            ...inspection.config.gitSshKey,
+            privateKeyPath: resolveSshPrivateKeyPath(inspection.config.gitSshKey.privateKeyPath),
+        }
+    }
+    catch (error) {
+        if (requireConfiguredSsh) {
+            throw createUserFacingError({
+                code: 'git_ssh_key_invalid',
+                summary: 'The configured Git SSH private key is unavailable.',
+                details: error instanceof Error ? error.message : String(error),
+                fixes: [
+                    'Restore the configured private key file, or run `tela setup` again and choose another SSH key.',
+                ],
+                cause: error,
+            })
+        }
+
+        return null
+    }
+}
+
+function buildGitEnv(requireConfiguredSsh: boolean): Record<string, string> | undefined {
+    const gitSshKey = resolveConfiguredGitSshKey(requireConfiguredSsh)
+    if (!gitSshKey) {
+        return undefined
+    }
+
+    return {
+        GIT_SSH_COMMAND: buildGitSshCommand(gitSshKey.privateKeyPath),
+    }
+}
+
+async function runGitCommand(
+    args: string[],
+    options: GitRunOptions = {},
+): Promise<CommandResult> {
+    const env = buildGitEnv(Boolean(options.requireConfiguredSsh))
+
+    return await runCommand(
+        ['git', ...args],
+        {
+            ...options,
+            env: env ? env : undefined,
+        },
+    )
+}
+
+async function getRemoteUrlInternal(cwd: string, remote: string): Promise<string | null> {
+    const result = await runGitCommand(['remote', 'get-url', remote], { cwd, allowFailure: true })
+    if (result.exitCode !== 0) {
+        return null
+    }
+
+    return result.stdout.trim() || null
+}
+
+async function remoteRequiresConfiguredSsh(cwd: string, remote: string): Promise<boolean> {
+    const remoteUrl = await getRemoteUrlInternal(cwd, remote)
+    return Boolean(remoteUrl && isSshRemoteUrl(remoteUrl))
+}
+
+async function anyRemoteRequiresConfiguredSsh(cwd: string): Promise<boolean> {
+    const result = await runGitCommand(['remote'], { cwd, allowFailure: true })
+    if (result.exitCode !== 0) {
+        return false
+    }
+
+    const remotes = result.stdout
+        .split(/\r?\n/)
+        .map(line => line.trim())
+        .filter(Boolean)
+
+    for (const remote of remotes) {
+        if (await remoteRequiresConfiguredSsh(cwd, remote)) {
+            return true
+        }
+    }
+
+    return false
+}
+
+async function upstreamRequiresConfiguredSsh(cwd: string): Promise<boolean> {
+    const upstream = await getUpstreamBranch(cwd)
+    if (!upstream) {
+        return false
+    }
+
+    const separator = upstream.indexOf('/')
+    if (separator <= 0) {
+        return false
+    }
+
+    return await remoteRequiresConfiguredSsh(cwd, upstream.slice(0, separator))
+}
+
 export async function findRepositoryRoot(cwd: string): Promise<string | null> {
-    const result = await runCommand(['git', 'rev-parse', '--show-toplevel'], { cwd, allowFailure: true })
+    const result = await runGitCommand(['rev-parse', '--show-toplevel'], { cwd, allowFailure: true })
     if (result.exitCode !== 0) {
         return null
     }
@@ -35,7 +202,7 @@ export async function getRepositoryRoot(cwd: string): Promise<string> {
 
 export async function assertGitRepository(cwd: string): Promise<void> {
     try {
-        await runCommand(['git', 'rev-parse', '--is-inside-work-tree'], { cwd })
+        await runGitCommand(['rev-parse', '--is-inside-work-tree'], { cwd })
     }
     catch (error) {
         if (error instanceof CommandError) {
@@ -46,24 +213,32 @@ export async function assertGitRepository(cwd: string): Promise<void> {
 }
 
 export async function cloneRepository(remoteUrl: string, targetDir: string): Promise<void> {
-    await runCommand(['git', 'clone', remoteUrl, targetDir])
+    await runGitCommand(['clone', remoteUrl, targetDir], {
+        requireConfiguredSsh: isSshRemoteUrl(remoteUrl),
+    })
 }
 
 export async function getOriginUrl(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'remote', 'get-url', 'origin'], { cwd })
+    const result = await runGitCommand(['remote', 'get-url', 'origin'], { cwd })
     return result.stdout.trim()
 }
 
 export async function fetchOrigin(cwd: string): Promise<void> {
-    await runCommand(['git', 'fetch', 'origin', '--prune'], { cwd })
+    await runGitCommand(['fetch', 'origin', '--prune'], {
+        cwd,
+        requireConfiguredSsh: await remoteRequiresConfiguredSsh(cwd, 'origin'),
+    })
 }
 
 export async function fetchAllRemotes(cwd: string): Promise<void> {
-    await runCommand(['git', 'fetch', '--all', '--prune'], { cwd })
+    await runGitCommand(['fetch', '--all', '--prune'], {
+        cwd,
+        requireConfiguredSsh: await anyRemoteRequiresConfiguredSsh(cwd),
+    })
 }
 
 export async function getWorktreeStatus(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'status', '--short'], { cwd })
+    const result = await runGitCommand(['status', '--short'], { cwd })
     return result.stdout.trim()
 }
 
@@ -72,12 +247,12 @@ export async function isWorktreeDirty(cwd: string): Promise<boolean> {
 }
 
 export async function stageAll(cwd: string): Promise<void> {
-    await runCommand(['git', 'add', '-A'], { cwd })
+    await runGitCommand(['add', '-A'], { cwd })
 }
 
 export async function getCurrentBranch(cwd: string): Promise<string> {
     try {
-        const result = await runCommand(['git', 'symbolic-ref', '--quiet', '--short', 'HEAD'], { cwd })
+        const result = await runGitCommand(['symbolic-ref', '--quiet', '--short', 'HEAD'], { cwd })
         return result.stdout.trim()
     }
     catch (error) {
@@ -89,8 +264,8 @@ export async function getCurrentBranch(cwd: string): Promise<string> {
 }
 
 export async function getUpstreamBranch(cwd: string): Promise<string | null> {
-    const result = await runCommand(
-        ['git', 'rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{upstream}'],
+    const result = await runGitCommand(
+        ['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{upstream}'],
         { cwd, allowFailure: true },
     )
 
@@ -102,15 +277,21 @@ export async function getUpstreamBranch(cwd: string): Promise<string | null> {
 }
 
 export async function pullCurrentBranch(cwd: string): Promise<void> {
-    await runCommand(['git', 'pull', '--ff-only'], { cwd })
+    await runGitCommand(['pull', '--ff-only'], {
+        cwd,
+        requireConfiguredSsh: await upstreamRequiresConfiguredSsh(cwd),
+    })
 }
 
 export async function pullDefaultBranch(cwd: string, defaultBranch: string): Promise<void> {
-    await runCommand(['git', 'pull', '--ff-only', 'origin', defaultBranch], { cwd })
+    await runGitCommand(['pull', '--ff-only', 'origin', defaultBranch], {
+        cwd,
+        requireConfiguredSsh: await remoteRequiresConfiguredSsh(cwd, 'origin'),
+    })
 }
 
 export async function getShortStatus(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'status', '--short'], { cwd })
+    const result = await runGitCommand(['status', '--short'], { cwd })
     return result.stdout
 }
 
@@ -156,22 +337,22 @@ export async function getStatusCounts(cwd: string): Promise<GitStatusCounts> {
 }
 
 export async function getStagedDiff(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'diff', '--cached'], { cwd })
+    const result = await runGitCommand(['diff', '--cached'], { cwd })
     return result.stdout
 }
 
 export async function getDiffAgainstHead(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'diff', 'HEAD', '--'], { cwd })
+    const result = await runGitCommand(['diff', 'HEAD', '--'], { cwd })
     return result.stdout
 }
 
 export async function getRecentLog(cwd: string, count = 10): Promise<string> {
-    const result = await runCommand(['git', 'log', '--oneline', `-${count}`], { cwd, allowFailure: true })
+    const result = await runGitCommand(['log', '--oneline', `-${count}`], { cwd, allowFailure: true })
     return result.stdout
 }
 
 export async function getStagedFiles(cwd: string): Promise<string[]> {
-    const result = await runCommand(['git', 'diff', '--cached', '--name-only', '--diff-filter=ACMRTUXB'], { cwd })
+    const result = await runGitCommand(['diff', '--cached', '--name-only', '--diff-filter=ACMRTUXB'], { cwd })
     return result.stdout
         .split(/\r?\n/)
         .map(line => line.trim())
@@ -179,7 +360,7 @@ export async function getStagedFiles(cwd: string): Promise<string[]> {
 }
 
 export async function getChangedFilesAgainstHead(cwd: string): Promise<string[]> {
-    const result = await runCommand(['git', 'diff', '--name-only', 'HEAD', '--diff-filter=ACMRTUXB'], { cwd })
+    const result = await runGitCommand(['diff', '--name-only', 'HEAD', '--diff-filter=ACMRTUXB'], { cwd })
     return result.stdout
         .split(/\r?\n/)
         .map(line => line.trim())
@@ -187,7 +368,7 @@ export async function getChangedFilesAgainstHead(cwd: string): Promise<string[]>
 }
 
 export async function getDiffStatAgainstHead(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'diff', '--stat', 'HEAD'], { cwd, allowFailure: true })
+    const result = await runGitCommand(['diff', '--stat', 'HEAD'], { cwd, allowFailure: true })
     return result.stdout.trim()
 }
 
@@ -203,48 +384,43 @@ export function buildFallbackCommitMessage(files: string[]): string {
     return `Update ${basename(files[0]!) || files[0]} and ${files.length - 1} other files`
 }
 
-function buildCommitDelimiter(message: string): string {
-    let delimiter = `__TELA_COMMIT_${randomUUID().replace(/-/g, '_')}__`
-    while (message.includes(delimiter)) {
-        delimiter = `__TELA_COMMIT_${randomUUID().replace(/-/g, '_')}__`
-    }
-    return delimiter
-}
-
 export async function commitWithMessage(cwd: string, message: string): Promise<void> {
-    const delimiter = buildCommitDelimiter(message)
-    const script = [
-        'git commit -F - <<\'__TELA_COMMIT__\'',
-        message,
-        '__TELA_COMMIT__',
-    ].join('\n').replaceAll('__TELA_COMMIT__', delimiter)
-
-    await runShell(script, { cwd })
+    await runGitCommand(['commit', '-F', '-'], {
+        cwd,
+        input: message,
+    })
 }
 
 export async function pushBranch(cwd: string, branch: string, setUpstream: boolean): Promise<void> {
     const args = setUpstream
-        ? ['git', 'push', '--set-upstream', 'origin', branch]
-        : ['git', 'push']
-    await runCommand(args, { cwd })
+        ? ['push', '--set-upstream', 'origin', branch]
+        : ['push']
+    const requireConfiguredSsh = setUpstream
+        ? await remoteRequiresConfiguredSsh(cwd, 'origin')
+        : await upstreamRequiresConfiguredSsh(cwd)
+
+    await runGitCommand(args, {
+        cwd,
+        requireConfiguredSsh,
+    })
 }
 
 export async function getHeadShortSha(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'rev-parse', '--short', 'HEAD'], { cwd })
+    const result = await runGitCommand(['rev-parse', '--short', 'HEAD'], { cwd })
     return result.stdout.trim()
 }
 
 export async function getHeadCommitHash(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'rev-parse', 'HEAD'], { cwd })
+    const result = await runGitCommand(['rev-parse', 'HEAD'], { cwd })
     return result.stdout.trim()
 }
 
 export async function getHeadCommitMessage(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'log', '-1', '--pretty=%B'], { cwd })
+    const result = await runGitCommand(['log', '-1', '--pretty=%B'], { cwd })
     return result.stdout.trim()
 }
 
 export async function getHeadShortMessage(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'log', '-1', '--pretty=%s'], { cwd })
+    const result = await runGitCommand(['log', '-1', '--pretty=%s'], { cwd })
     return result.stdout.trim()
 }

package/src/ink/screens/setup/setup-screen.tsx

@@ -2,7 +2,9 @@ import React, { useEffect, useMemo, useRef, useState } from 'react'
 import { useInput } from 'ink'
 import { ENVIRONMENT_PRESET_OPTIONS, resolveEnvironmentConfigForPreset } from '../../../config.ts'
 import {
+    inferSshPrivateKeyPath,
     loadSshPublicKey,
+    validateSshPrivateKeyPath,
     validateSshPublicKeyPath,
 } from '../../../forgejo.ts'
 import type { TelaCliAuthState, TelaCliForgejoOrganization } from '../../../types.ts'
@@ -67,6 +69,9 @@ export function SetupScreen(props: SetupScreenProps): React.ReactElement {
         cloneRoot: props.defaults.cloneRoot,
         sshKeySelection: props.sshPublicKeys[0]?.path ?? CUSTOM_SSH_KEY_OPTION,
         sshKeyPath: '',
+        sshPrivateKeyPath: props.sshPublicKeys[0]
+            ? inferSshPrivateKeyPath(props.sshPublicKeys[0].path)
+            : '',
     })
     const [errors, setErrors] = useState<Partial<Record<SetupStepId, string>>>({})
     const [createCloneRoot, setCreateCloneRoot] = useState(true)
@@ -82,6 +87,7 @@ export function SetupScreen(props: SetupScreenProps): React.ReactElement {
     const [result, setResult] = useState<SetupScreenResult | null>(null)
     const authStartedRef = useRef(false)
     const provisionStartedRef = useRef(false)
+    const previousSuggestedPrivateKeyPathRef = useRef(values.sshPrivateKeyPath)
 
     const visibleSteps = useMemo(() => getVisibleEditSteps(values), [values])
     const safeStepIndex = Math.min(stepIndex, Math.max(visibleSteps.length - 1, 0))
@@ -117,6 +123,10 @@ export function SetupScreen(props: SetupScreenProps): React.ReactElement {
 
         return props.sshPublicKeys.find(key => key.path === values.sshKeySelection)
     }, [props.sshPublicKeys, values.sshKeyPath, values.sshKeySelection])
+    const suggestedPrivateKeyPath = useMemo(
+        () => selectedSshKey ? inferSshPrivateKeyPath(selectedSshKey.path) : '',
+        [selectedSshKey],
+    )
     const cloneRootState = useMemo(() => props.inspectCloneRoot(values.cloneRoot), [props, values.cloneRoot])
 
     const breadcrumb = useMemo<BreadcrumbEntry[]>(() => {
@@ -247,6 +257,7 @@ export function SetupScreen(props: SetupScreenProps): React.ReactElement {
             cloneRoot: values.cloneRoot,
             createCloneRoot,
             sshKey: selectedSshKey,
+            sshPrivateKeyPath: values.sshPrivateKeyPath,
             auth: authenticated,
             organization: selectedOrganization,
         }, (event) => {
@@ -267,6 +278,7 @@ export function SetupScreen(props: SetupScreenProps): React.ReactElement {
         resolvedConfig,
         selectedOrganization,
         selectedSshKey,
+        values.sshPrivateKeyPath,
         values.cloneRoot,
     ])
 
@@ -276,6 +288,29 @@ export function SetupScreen(props: SetupScreenProps): React.ReactElement {
         }
     }, [phase, props, result])
 
+    useEffect(() => {
+        setValues((current) => {
+            const previousSuggested = previousSuggestedPrivateKeyPathRef.current
+            previousSuggestedPrivateKeyPathRef.current = suggestedPrivateKeyPath
+
+            if (
+                current.sshPrivateKeyPath
+                && current.sshPrivateKeyPath !== previousSuggested
+            ) {
+                return current
+            }
+
+            if (current.sshPrivateKeyPath === suggestedPrivateKeyPath) {
+                return current
+            }
+
+            return {
+                ...current,
+                sshPrivateKeyPath: suggestedPrivateKeyPath,
+            }
+        })
+    }, [suggestedPrivateKeyPath])
+
     useInput((input, key) => {
         if (phase === 'authenticating' || phase === 'provisioning' || phase === 'done') {
             return
@@ -570,5 +605,7 @@ function validateStep(
             return selectedSshKey ? undefined : 'SSH public key is required'
         case 'sshKeyPath':
             return validateSshPublicKeyPath(values.sshKeyPath)
+        case 'sshPrivateKeyPath':
+            return validateSshPrivateKeyPath(values.sshPrivateKeyPath)
     }
 }

package/src/ink/screens/setup/steps/review-step.tsx

@@ -57,6 +57,7 @@ export function ReviewStep(props: {
                         ? `${props.selectedSshKey.title} (${props.selectedSshKey.path})`
                         : '<missing>'}
                 </Text>
+                <Text>SSH private key: {props.values.sshPrivateKeyPath || '<missing>'}</Text>
                 <Text>
                     Clone root state:
                     {' '}

package/src/ink/screens/setup/steps.ts

@@ -12,6 +12,7 @@ export type SetupStepId =
     | 'cloneRoot'
     | 'sshKey'
     | 'sshKeyPath'
+    | 'sshPrivateKeyPath'
 
 export type SetupStepKind = 'select-environment' | 'select-ssh-key' | 'text'
 
@@ -103,6 +104,14 @@ export const EDIT_STEPS: readonly SetupStepDescriptor[] = [
         placeholder: '~/.ssh/id_ed25519.pub',
         visible: values => values.sshKeySelection === CUSTOM_SSH_KEY_OPTION,
     },
+    {
+        id: 'sshPrivateKeyPath',
+        label: 'Private Key Path',
+        question: 'Path to your SSH private key',
+        kind: 'text',
+        placeholder: '~/.ssh/id_ed25519',
+        visible: () => true,
+    },
 ]
 
 export function getVisibleEditSteps(values: SetupFormValues): SetupStepDescriptor[] {
@@ -141,5 +150,7 @@ export function summarizeStep(
                 : (sshKeyTitle ?? values.sshKeySelection)
         case 'sshKeyPath':
             return values.sshKeyPath
+        case 'sshPrivateKeyPath':
+            return values.sshPrivateKeyPath
     }
 }

package/src/ink/screens/setup/types.ts

@@ -13,6 +13,7 @@ export const CUSTOM_SSH_KEY_OPTION = '__custom__'
 export type SetupFormValues = SetupConfigInput & {
     sshKeySelection: string
     sshKeyPath: string
+    sshPrivateKeyPath: string
 }
 
 export interface SetupScreenResult {
@@ -55,6 +56,7 @@ export interface SetupScreenProps {
         input: SetupConfigInput & {
             createCloneRoot: boolean
             sshKey: SelectedSshPublicKey
+            sshPrivateKeyPath: string
             auth: TelaCliAuthState
             organization: TelaCliForgejoOrganization
         },

package/src/program.ts

@@ -14,11 +14,6 @@ import { SyncScreen, type SyncProgressItem } from './ink/screens/sync-screen.tsx
 import { renderCommandScreen } from './ink/runtime.tsx'
 import { listOrganizations } from './agent-api.ts'
 import { authenticateWithDeviceFlow, type SetupAuthEvent } from './auth.ts'
-import {
-    checkAgentApiReachability,
-    getAgentApiOriginCheckStatus,
-    getAgentApiOriginWarning,
-} from './diagnostics.ts'
 import { createUserFacingError } from './errors.ts'
 import {
     getCommandMetadata,
@@ -87,6 +82,7 @@ import {
 } from './config.ts'
 import { findRepositoryRoot, getDiffStatAgainstHead } from './git.ts'
 import {
+    createGitSshKey,
     ensureForgejoUserAccess,
     listDiscoveredSshPublicKeys,
     type SelectedSshPublicKey,
@@ -381,6 +377,7 @@ function summarizeConfigInspection(inspection: ConfigInspection): string {
         { label: 'Workspace', value: inspection.config.auth?.workspace.title ?? '<signed out>' },
         { label: 'Organization', value: inspection.config.forgejoOrganization?.name ?? '<not selected>' },
         { label: 'Forgejo user', value: inspection.config.forgejoUserRegistered ? 'registered' : 'pending' },
+        { label: 'Git SSH key', value: inspection.config.gitSshKey ? `${inspection.config.gitSshKey.title} (${inspection.config.gitSshKey.privateKeyPath})` : '<missing>' },
     ])
 }
 
@@ -411,6 +408,7 @@ async function executeSetupFlow(
     input: SetupConfigInput & {
         createCloneRoot: boolean
         sshKey: SelectedSshPublicKey
+        sshPrivateKeyPath: string
         auth: TelaCliAuthState
         organization: TelaCliForgejoOrganization
     },
@@ -432,6 +430,7 @@ async function executeSetupFlow(
         auth: input.auth,
         forgejoOrganization: input.organization,
         forgejoUserRegistered: false,
+        gitSshKey: createGitSshKey(input.sshKey, input.sshPrivateKeyPath),
     }
     const forgejoProvision = await ensureForgejoUserAccess({
         config: baseConfig,
@@ -453,17 +452,15 @@ async function executeSetupFlow(
         mkdirSync(config.cloneRoot, { recursive: true, mode: 0o755 })
     }
 
-    const [gitAvailable, claudeAvailable, reachability] = await Promise.all([
+    const [gitAvailable, claudeAvailable] = await Promise.all([
         commandExistsFn('git'),
         commandExistsFn('claude'),
-        checkAgentApiReachability(config.agentApiUrl, fetchFn),
     ])
 
     const warnings = [
         !existsSync(config.cloneRoot) ? `Clone root does not exist yet: ${config.cloneRoot}` : undefined,
         gitAvailable ? undefined : '`git` is not available on PATH.',
         claudeAvailable ? undefined : '`claude` is not available on PATH.',
-        getAgentApiOriginWarning(reachability),
     ].filter((warning): warning is string => Boolean(warning))
     const checks = [
         { label: 'auth', status: 'authenticated', detail: `${input.auth.user.email} @ ${input.auth.workspace.title}` },
@@ -472,7 +469,7 @@ async function executeSetupFlow(
         { label: 'clone-root', status: existsSync(config.cloneRoot) ? 'ready' : 'missing', detail: config.cloneRoot },
         { label: 'git', status: gitAvailable ? 'available' : 'missing', detail: gitAvailable ? 'ready' : 'install git' },
         { label: 'claude', status: claudeAvailable ? 'available' : 'missing', detail: claudeAvailable ? 'ready' : 'install Claude CLI' },
-        { label: 'agent-api-origin', status: getAgentApiOriginCheckStatus(reachability), detail: reachability.detail },
+        { label: 'agent-api-origin', status: 'verified', detail: config.agentApiUrl },
     ]
 
     return {
@@ -574,6 +571,7 @@ async function runSetupInk(
                 auth: input.auth,
                 forgejoOrganization: null,
                 forgejoUserRegistered: false,
+                gitSshKey: inspection.config?.gitSshKey ?? null,
             }
             const organizations = await listOrganizations(config, deps.fetchFn ?? fetch)
             if (organizations.length === 0) {
@@ -623,7 +621,6 @@ export async function runSetup(
     const setup = deps.setupConfigInteractive ?? setupConfigInteractive
     const inspect = deps.inspectSavedConfig ?? inspectSavedConfig
     const commandExistsFn = deps.commandExists ?? commandExists
-    const fetchFn = deps.fetchFn ?? fetch
     const authenticate = deps.authenticateWithDeviceFlow ?? authenticateWithDeviceFlow
     const inspection = inspect()
 
@@ -681,17 +678,15 @@ export async function runSetup(
         }
     }
 
-    const [gitAvailable, claudeAvailable, reachability] = await Promise.all([
+    const [gitAvailable, claudeAvailable] = await Promise.all([
         commandExistsFn('git'),
         commandExistsFn('claude'),
-        checkAgentApiReachability(config.agentApiUrl, fetchFn),
     ])
 
     const warnings = [
         cloneRootWarning,
         gitAvailable ? undefined : '`git` is not available on PATH.',
         claudeAvailable ? undefined : '`claude` is not available on PATH.',
-        getAgentApiOriginWarning(reachability),
     ].filter((warning): warning is string => Boolean(warning))
 
     const nextSetupActions = [
@@ -715,6 +710,7 @@ export async function runSetup(
             { label: 'Workspace', value: config.auth?.workspace.title ?? '<missing>' },
             { label: 'Organization', value: config.forgejoOrganization?.name ?? '<missing>' },
             { label: 'Forgejo user', value: config.forgejoUserRegistered ? 'registered' : 'pending' },
+            { label: 'Git SSH key', value: config.gitSshKey ? `${config.gitSshKey.title} (${config.gitSshKey.privateKeyPath})` : '<missing>' },
             { label: 'Session', value: config.auth ? `${redactSecret(config.auth.session.accessToken)} (expires ${new Date(config.auth.session.expiresAt).toISOString()})` : '<missing>' },
         ]), { decorate: runtime.decorate }),
         section('Authentication', DEVICE_FLOW_BROWSER_HELP, { decorate: runtime.decorate }),
@@ -724,10 +720,11 @@ export async function runSetup(
                 { label: 'auth', status: 'authenticated', detail: `${config.auth?.user.email ?? '<missing>'} @ ${config.auth?.workspace.title ?? '<missing>'}` },
                 { label: 'organization', status: config.forgejoOrganization ? 'selected' : 'missing', detail: config.forgejoOrganization?.name ?? 'not selected' },
                 { label: 'forgejo-user', status: config.forgejoUserRegistered ? 'registered' : 'pending', detail: config.forgejoUserRegistered ? 'SSH-key provisioning completed.' : 'SSH-key provisioning is pending.' },
+                { label: 'git-ssh-key', status: config.gitSshKey ? 'configured' : 'missing', detail: config.gitSshKey?.privateKeyPath ?? 'rerun setup to choose an SSH key' },
                 { label: 'clone-root', status: cloneRootCreated ? 'created' : (existsSync(config.cloneRoot) ? 'ready' : 'missing'), detail: config.cloneRoot },
                 { label: 'git', status: gitAvailable ? 'available' : 'missing', detail: gitAvailable ? 'ready' : 'install git' },
                 { label: 'claude', status: claudeAvailable ? 'available' : 'missing', detail: claudeAvailable ? 'ready' : 'install Claude CLI' },
-                { label: 'agent-api-origin', status: getAgentApiOriginCheckStatus(reachability), detail: reachability.detail },
+                { label: 'agent-api-origin', status: 'verified', detail: config.agentApiUrl },
             ]),
             { decorate: runtime.decorate },
         ), { decorate: runtime.decorate }),

package/src/types.ts

@@ -22,6 +22,12 @@ export interface TelaCliForgejoOrganization {
     name: string
 }
 
+export interface TelaCliGitSshKey {
+    title: string
+    publicKeyPath: string
+    privateKeyPath: string
+}
+
 export interface TelaCliAuthState {
     user: TelaCliUser
     workspace: TelaCliWorkspace
@@ -40,6 +46,7 @@ export interface TelaCliConfig {
     auth: TelaCliAuthState | null
     forgejoOrganization: TelaCliForgejoOrganization | null
     forgejoUserRegistered: boolean
+    gitSshKey: TelaCliGitSshKey | null
 }
 
 export interface OrganizationSummary {