@meistrari/tela-cli 0.4.0 → 0.5.0

package/README.md

@@ -14,6 +14,18 @@ This installs the package globally and adds a `tela` alias to your `~/.zshrc`. A
 source ~/.zshrc
 ```
 
+## Default command
+
+### `tela`
+
+List workspace repositories that are available to sync locally.
+
+When to use: Run this with no subcommand when you want to see which workspace repositories are available before using `tela sync <repo>`.
+
+Examples:
+- `tela` — Render the available repositories in a human-readable table
+- `tela --json` — Emit the available repositories as JSON
+
 ## Commands
 
 ### `setup`
@@ -29,7 +41,7 @@ Examples:
 
 Clone or update a Tela repository, or refresh the current checkout
 
-When to use: Use this before coding to get a clean local checkout, or to refresh every repository under the configured clone root.
+When to use: Use this before coding to get a clean local checkout, or to refresh every repository under the configured clone root. SSH-backed sync automatically accepts first-seen host keys during clone and update flows.
 
 Examples:
 - `tela sync agent-api` — Clone or update a specific repository under the clone root
@@ -38,14 +50,14 @@ Examples:
 
 ### `run`
 
-Run the local agent repository with Claude
+Run the local agent repository with project-scoped Claude
 
-When to use: Use this from inside an agent repository when you want Claude to follow the local contract files, show its progress live, and produce the expected result artifact.
+When to use: Use this from inside an agent repository when you want Claude to follow the repo-local contract files, ignore user/global Claude config by default, show its progress live, and produce the expected result artifact.
 
 Examples:
-- `tela run` — Run the current agent repository with the live viewer
-- `tela run --plain` — Force scrollback-first text output
-- `tela run --json` — Emit the final execution and artifact envelope as JSON
+- `tela run` — Run the current agent repository with project-scoped Claude and the live viewer
+- `tela run --plain` — Force project-scoped execution with scrollback-first text output
+- `tela run --json` — Emit the final project-scoped execution and artifact envelope as JSON
 
 ### `push`
 
@@ -96,6 +108,11 @@ Examples:
 - Human output is structured for terminal use with grouped summaries and next actions.
 - `--json` is available on read-heavy flows and on `tela run` for the final execution envelope.
 
+## `tela run` scope
+
+- `tela run` loads project-scoped Claude settings by default and excludes user/global Claude config.
+- Remaining external inputs are explicit: Claude's built-in system prompt, managed enterprise settings, auth/provider credentials, minimal shell runtime environment, and the default model when `agent.config.json` does not set one.
+
 ## First run
 
 1. `tela setup`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/tela-cli",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "type": "module",
   "bin": {
     "tela": "cli.ts"

package/src/agent-api.ts

@@ -1,10 +1,15 @@
 import { buildAgentApiHeaders, type FetchLike } from './auth.ts'
 import type {
+    AgentRepoSummary,
+    AvailableRepositorySummary,
     AgentFeedbackItem,
     AgentFeedbackListResponse,
     ForgejoUserCreateResponse,
     ForgejoUserSshKeyInput,
     OrganizationListResponse,
+    OrganizationSummary,
+    RepositoryListItemResponse,
+    RepositoryListResponse,
     RepositoryLookupResponse,
     TelaCliConfig,
     TelaCliForgejoOrganization,
@@ -45,6 +50,39 @@ function isForgejoOrganization(value: unknown): value is TelaCliForgejoOrganizat
     return typeof candidate.id === 'string' && typeof candidate.name === 'string'
 }
 
+function isOrganizationSummary(value: unknown): value is OrganizationSummary {
+    if (!value || typeof value !== 'object') {
+        return false
+    }
+
+    const candidate = value as Partial<OrganizationSummary>
+    return typeof candidate.id === 'string'
+        && typeof candidate.workspaceId === 'string'
+        && typeof candidate.name === 'string'
+}
+
+function isAgentRepoSummary(value: unknown): value is AgentRepoSummary {
+    if (!value || typeof value !== 'object') {
+        return false
+    }
+
+    const candidate = value as Partial<AgentRepoSummary>
+    return typeof candidate.id === 'string'
+        && typeof candidate.workspaceId === 'string'
+        && typeof candidate.organizationId === 'string'
+        && typeof candidate.repository === 'string'
+}
+
+function isRepositoryListItemResponse(value: unknown): value is RepositoryListItemResponse {
+    if (!value || typeof value !== 'object') {
+        return false
+    }
+
+    const candidate = value as Partial<RepositoryListItemResponse>
+    return isOrganizationSummary(candidate.organization)
+        && isAgentRepoSummary(candidate.agentRepo)
+}
+
 export class AgentApiError extends Error {
     constructor(
         message: string,
@@ -173,6 +211,44 @@ export async function listOrganizations(
     return payload.organizations
 }
 
+export async function listAvailableRepositories(
+    config: TelaCliConfig,
+    fetchFn: FetchLike = fetch,
+): Promise<AvailableRepositorySummary[]> {
+    const headers = await buildAgentApiHeaders(config, { fetchFn })
+    const response = await fetchFn(
+        joinUrl(config.agentApiUrl, '/v3/agents/repositories'),
+        {
+            method: 'GET',
+            headers,
+            signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS),
+        },
+    )
+
+    const responseText = await response.text()
+    const payload = parseJsonBody(responseText) as RepositoryListResponse | null
+
+    if (!response.ok) {
+        throw new AgentApiError(
+            payload?.error ?? `Agent API repository listing failed with status ${response.status}`,
+            response.status,
+            responseText,
+        )
+    }
+
+    if (!payload
+        || payload.success !== true
+        || !Array.isArray(payload.repositories)
+        || !payload.repositories.every(isRepositoryListItemResponse)) {
+        throw new AgentApiError('Agent API repository listing returned an invalid payload', response.status, responseText)
+    }
+
+    return payload.repositories.map(repository => ({
+        ...repository,
+        syncStatus: 'available' as const,
+    }))
+}
+
 export async function provisionForgejoUser(
     input: {
         organizationName: string

package/src/claude.ts

@@ -0,0 +1,101 @@
+import { commandExists, runCommand } from './process.ts'
+
+export interface ClaudeCliVersion {
+    major: number
+    minor: number
+    patch: number
+}
+
+export interface ClaudeCliInspection {
+    available: boolean
+    version?: string
+    parsedVersion?: ClaudeCliVersion
+    supportsProjectScopedRun: boolean
+    problem?: 'missing' | 'unparseable' | 'unsupported'
+    detail?: string
+}
+
+export const MIN_CLAUDE_VERSION_FOR_PROJECT_SCOPED_RUN: ClaudeCliVersion = {
+    major: 2,
+    minor: 1,
+    patch: 108,
+}
+
+export function formatClaudeCliVersion(version: ClaudeCliVersion): string {
+    return `${version.major}.${version.minor}.${version.patch}`
+}
+
+export function compareClaudeCliVersions(left: ClaudeCliVersion, right: ClaudeCliVersion): number {
+    if (left.major !== right.major) {
+        return left.major - right.major
+    }
+
+    if (left.minor !== right.minor) {
+        return left.minor - right.minor
+    }
+
+    return left.patch - right.patch
+}
+
+export function parseClaudeCliVersion(raw: string): ClaudeCliVersion | null {
+    const match = raw.match(/\b(\d+)\.(\d+)\.(\d+)\b/)
+    if (!match) {
+        return null
+    }
+
+    return {
+        major: Number(match[1]),
+        minor: Number(match[2]),
+        patch: Number(match[3]),
+    }
+}
+
+export async function inspectClaudeCli(options: {
+    commandExistsFn?: typeof commandExists
+    runCommandFn?: typeof runCommand
+} = {}): Promise<ClaudeCliInspection> {
+    const commandExistsFn = options.commandExistsFn ?? commandExists
+    const runCommandFn = options.runCommandFn ?? runCommand
+
+    if (!await commandExistsFn('claude')) {
+        return {
+            available: false,
+            supportsProjectScopedRun: false,
+            problem: 'missing',
+            detail: '`claude` is not available on PATH.',
+        }
+    }
+
+    const result = await runCommandFn(['claude', '--version'], { allowFailure: true })
+    const output = `${result.stdout}\n${result.stderr}`.trim()
+    const parsedVersion = parseClaudeCliVersion(output)
+
+    if (!parsedVersion) {
+        return {
+            available: true,
+            supportsProjectScopedRun: false,
+            problem: 'unparseable',
+            detail: output || 'Claude CLI version output was empty.',
+        }
+    }
+
+    const version = formatClaudeCliVersion(parsedVersion)
+    if (compareClaudeCliVersions(parsedVersion, MIN_CLAUDE_VERSION_FOR_PROJECT_SCOPED_RUN) < 0) {
+        return {
+            available: true,
+            version,
+            parsedVersion,
+            supportsProjectScopedRun: false,
+            problem: 'unsupported',
+            detail: `Claude CLI ${version} is older than the required ${formatClaudeCliVersion(MIN_CLAUDE_VERSION_FOR_PROJECT_SCOPED_RUN)}.`,
+        }
+    }
+
+    return {
+        available: true,
+        version,
+        parsedVersion,
+        supportsProjectScopedRun: true,
+        detail: `Claude CLI ${version} supports project-scoped runs.`,
+    }
+}

package/src/commands/metadata.ts

@@ -32,7 +32,7 @@ const COMMANDS: CommandMetadata[] = [
         name: 'sync',
         summary: 'Clone or update a Tela repository, or refresh the current checkout',
         argumentHint: '[repo]',
-        whenToUse: 'Use this before coding to get a clean local checkout, or to refresh every repository under the configured clone root.',
+        whenToUse: 'Use this before coding to get a clean local checkout, or to refresh every repository under the configured clone root. SSH-backed sync automatically accepts first-seen host keys during clone and update flows.',
         examples: [
             {
                 command: 'tela sync agent-api',
@@ -52,20 +52,20 @@ const COMMANDS: CommandMetadata[] = [
     },
     {
         name: 'run',
-        summary: 'Run the local agent repository with Claude',
-        whenToUse: 'Use this from inside an agent repository when you want Claude to follow the local contract files, show its progress live, and produce the expected result artifact.',
+        summary: 'Run the local agent repository with project-scoped Claude',
+        whenToUse: 'Use this from inside an agent repository when you want Claude to follow the repo-local contract files, ignore user/global Claude config by default, show its progress live, and produce the expected result artifact.',
         examples: [
             {
                 command: 'tela run',
-                description: 'Run the current agent repository with the live viewer',
+                description: 'Run the current agent repository with project-scoped Claude and the live viewer',
             },
             {
                 command: 'tela run --plain',
-                description: 'Force scrollback-first text output',
+                description: 'Force project-scoped execution with scrollback-first text output',
             },
             {
                 command: 'tela run --json',
-                description: 'Emit the final execution and artifact envelope as JSON',
+                description: 'Emit the final project-scoped execution and artifact envelope as JSON',
             },
         ],
         supportsJson: true,
@@ -176,6 +176,18 @@ export function renderReadmeMarkdown(): string {
         'source ~/.zshrc',
         '```',
         '',
+        '## Default command',
+        '',
+        '### `tela`',
+        '',
+        'List workspace repositories that are available to sync locally.',
+        '',
+        'When to use: Run this with no subcommand when you want to see which workspace repositories are available before using `tela sync <repo>`.',
+        '',
+        'Examples:',
+        '- `tela` — Render the available repositories in a human-readable table',
+        '- `tela --json` — Emit the available repositories as JSON',
+        '',
         '## Commands',
         '',
     ]
@@ -205,6 +217,11 @@ export function renderReadmeMarkdown(): string {
     lines.push('- Human output is structured for terminal use with grouped summaries and next actions.')
     lines.push('- `--json` is available on read-heavy flows and on `tela run` for the final execution envelope.')
     lines.push('')
+    lines.push('## `tela run` scope')
+    lines.push('')
+    lines.push('- `tela run` loads project-scoped Claude settings by default and excludes user/global Claude config.')
+    lines.push('- Remaining external inputs are explicit: Claude\'s built-in system prompt, managed enterprise settings, auth/provider credentials, minimal shell runtime environment, and the default model when `agent.config.json` does not set one.')
+    lines.push('')
     lines.push('## First run')
     lines.push('')
     lines.push('1. `tela setup`')

package/src/commands/run.ts

@@ -1,9 +1,16 @@
+import { existsSync } from 'node:fs'
 import { readFile } from 'node:fs/promises'
 import { basename, join } from 'node:path'
+import {
+    formatClaudeCliVersion,
+    inspectClaudeCli,
+    MIN_CLAUDE_VERSION_FOR_PROJECT_SCOPED_RUN,
+} from '../claude.ts'
 import { getRepositoryRoot } from '../git.ts'
 import { createUserFacingError } from '../errors.ts'
 import {
     commandExists,
+    runCommand,
     runInteractiveCommand,
     runStreamingCommand,
     spawnStreamingCommand,
@@ -37,6 +44,7 @@ export interface PreparedLocalAgentRun {
     config: AgentRunConfig
     resultKind: 'json' | 'markdown'
     resultPath: string
+    mcpConfigPath?: string
 }
 
 export interface RunStepSummary {
@@ -110,6 +118,8 @@ export interface RunLocalAgentCommandOptions {
     contract?: PreparedLocalAgentRun
     surface?: RunOutputSurface
     commandExists?: typeof commandExists
+    inspectClaudeCli?: typeof inspectClaudeCli
+    runCommand?: typeof runCommand
     runInteractiveCommand?: typeof runInteractiveCommand
     runStreamingCommand?: typeof runStreamingCommand
     spawnStreamingCommand?: typeof spawnStreamingCommand
@@ -1130,6 +1140,88 @@ function parseAgentConfig(path: string, content: string): AgentRunConfig {
     }
 }
 
+const CLAUDE_RUN_ENV_DENYLIST = new Set([
+    'CLAUDE_CONFIG_DIR',
+    'CLAUDE_ENV_FILE',
+    'ANTHROPIC_MODEL',
+    'ANTHROPIC_CUSTOM_MODEL_OPTION',
+    'ANTHROPIC_CUSTOM_MODEL_OPTION_NAME',
+    'ANTHROPIC_CUSTOM_MODEL_OPTION_DESCRIPTION',
+    'ANTHROPIC_CUSTOM_MODEL_OPTION_SUPPORTED_CAPABILITIES',
+    'ANTHROPIC_DEFAULT_OPUS_MODEL',
+    'ANTHROPIC_DEFAULT_OPUS_MODEL_NAME',
+    'ANTHROPIC_DEFAULT_OPUS_MODEL_DESCRIPTION',
+    'ANTHROPIC_DEFAULT_OPUS_MODEL_SUPPORTED_CAPABILITIES',
+    'ANTHROPIC_DEFAULT_SONNET_MODEL',
+    'ANTHROPIC_DEFAULT_SONNET_MODEL_NAME',
+    'ANTHROPIC_DEFAULT_SONNET_MODEL_DESCRIPTION',
+    'ANTHROPIC_DEFAULT_SONNET_MODEL_SUPPORTED_CAPABILITIES',
+    'ANTHROPIC_DEFAULT_HAIKU_MODEL',
+    'ANTHROPIC_DEFAULT_HAIKU_MODEL_NAME',
+    'ANTHROPIC_DEFAULT_HAIKU_MODEL_DESCRIPTION',
+    'ANTHROPIC_DEFAULT_HAIKU_MODEL_SUPPORTED_CAPABILITIES',
+    'CLAUDE_CODE_SUBAGENT_MODEL',
+])
+
+function buildClaudeRunEnvironment(
+    baseEnv: NodeJS.ProcessEnv = process.env,
+): Record<string, string | undefined> {
+    return Object.fromEntries(
+        Object.entries(baseEnv).filter(([key]) => !CLAUDE_RUN_ENV_DENYLIST.has(key)),
+    )
+}
+
+function buildUnsupportedClaudeVersionError(detail: string | undefined): ReturnType<typeof createUserFacingError> {
+    const requiredVersion = formatClaudeCliVersion(MIN_CLAUDE_VERSION_FOR_PROJECT_SCOPED_RUN)
+
+    return createUserFacingError({
+        code: 'run_claude_version_unsupported',
+        summary: `\`tela run\` requires Claude CLI ${requiredVersion} or newer for project-scoped runs.`,
+        details: detail,
+        fixes: [
+            'Update Claude CLI before using `tela run`.',
+            'Run `claude --version` to confirm the installed version.',
+        ],
+    })
+}
+
+function buildClaudeBaseCommand(prepared: PreparedLocalAgentRun): string[] {
+    const command = [
+        'claude',
+        '--setting-sources',
+        'project',
+    ]
+
+    if (prepared.mcpConfigPath) {
+        command.push('--strict-mcp-config', '--mcp-config', prepared.mcpConfigPath)
+    }
+
+    if (prepared.config.model) {
+        command.push('--model', prepared.config.model)
+    }
+
+    return command
+}
+
+function buildClaudeCommand(
+    prepared: PreparedLocalAgentRun,
+    mode: RunMode,
+): string[] {
+    const command = buildClaudeBaseCommand(prepared)
+
+    if (mode === 'one-shot') {
+        command.push(
+            '-p',
+            '--output-format',
+            'stream-json',
+            '--verbose',
+        )
+    }
+
+    command.push(INITIAL_PROMPT)
+    return command
+}
+
 async function resolveRepositoryRoot(cwd: string): Promise<string> {
     try {
         return await getRepositoryRoot(cwd)
@@ -1176,12 +1268,19 @@ async function validateRequiredFiles(repoRoot: string): Promise<void> {
 export async function prepareLocalAgentRun(options: {
     cwd?: string
     commandExists?: typeof commandExists
+    inspectClaudeCli?: typeof inspectClaudeCli
+    runCommand?: typeof runCommand
 } = {}): Promise<PreparedLocalAgentRun> {
     const cwd = options.cwd ?? process.cwd()
-    const commandExistsFn = options.commandExists ?? commandExists
     const repoRoot = await resolveRepositoryRoot(cwd)
+    const inspectClaudeCliFn = options.inspectClaudeCli ?? inspectClaudeCli
+
+    const claudeInspection = await inspectClaudeCliFn({
+        commandExistsFn: options.commandExists,
+        runCommandFn: options.runCommand,
+    })
 
-    if (!await commandExistsFn('claude')) {
+    if (!claudeInspection.available) {
         throw createUserFacingError({
             code: 'run_claude_missing',
             summary: 'Claude CLI is not available on PATH.',
@@ -1189,6 +1288,10 @@ export async function prepareLocalAgentRun(options: {
         })
     }
 
+    if (!claudeInspection.supportsProjectScopedRun) {
+        throw buildUnsupportedClaudeVersionError(claudeInspection.detail)
+    }
+
     await validateRequiredFiles(repoRoot)
 
     const [outputFormatContent, agentConfigContent] = await Promise.all([
@@ -1209,6 +1312,9 @@ export async function prepareLocalAgentRun(options: {
         config,
         resultKind,
         resultPath: join(repoRoot, 'output', resultKind === 'json' ? 'result.json' : 'result.md'),
+        mcpConfigPath: existsSync(join(repoRoot, '.mcp.json'))
+            ? join(repoRoot, '.mcp.json')
+            : undefined,
     }
 }
 
@@ -1375,13 +1481,10 @@ async function runInteractiveAgent(
         writeLine(options.writeStdout, 'Launching Claude in interactive chat mode. Tela will resume after Claude exits.')
     }
 
-    const command = [
-        'claude',
-        ...(prepared.config.model ? ['--model', prepared.config.model] : []),
-        INITIAL_PROMPT,
-    ]
-
-    await runInteractiveCommandFn(command, { cwd: prepared.repoRoot })
+    await runInteractiveCommandFn(buildClaudeCommand(prepared, 'chat'), {
+        cwd: prepared.repoRoot,
+        env: buildClaudeRunEnvironment(),
+    })
 }
 
 async function runOneShotAgent(
@@ -1408,18 +1511,11 @@ async function runOneShotAgent(
     }
 
     let cancelled = false
-    const command = [
-        'claude',
-        '-p',
-        '--output-format',
-        'stream-json',
-        '--verbose',
-        ...(prepared.config.model ? ['--model', prepared.config.model] : []),
-        INITIAL_PROMPT,
-    ]
+    const command = buildClaudeCommand(prepared, 'one-shot')
 
     const handle = spawnStreamingCommandFn(command, {
         cwd: prepared.repoRoot,
+        env: buildClaudeRunEnvironment(),
         allowFailure: true,
         onStdoutLine: async (line) => {
             const trimmed = line.trim()
@@ -1509,6 +1605,8 @@ export async function runLocalAgentCommand(
     const prepared = options.contract ?? await prepareLocalAgentRun({
         cwd: options.cwd ?? process.cwd(),
         commandExists: options.commandExists,
+        inspectClaudeCli: options.inspectClaudeCli,
+        runCommand: options.runCommand,
     })
     const mode: RunMode = prepared.config.isMultiturn ? 'chat' : 'one-shot'
     const tracker = new RunStateTracker(prepared, mode)

package/src/commands/status.ts

@@ -31,6 +31,9 @@ export function renderStatusReport(report: StatusReport, options: RenderOptions
         { label: 'Workspace', value: report.config.workspace ?? '<signed out>' },
         { label: 'Organization', value: report.config.forgejoOrganization ?? '<not selected>' },
         { label: 'Forgejo user', value: report.config.forgejoUserRegistered == null ? '<unknown>' : (report.config.forgejoUserRegistered ? 'registered' : 'pending') },
+        { label: 'Git SSH key', value: report.config.gitSshKeyTitle ?? '<missing>' },
+        { label: 'Git SSH public key', value: report.config.gitSshPublicKeyPath ?? '<missing>' },
+        { label: 'Git SSH private key', value: report.config.gitSshPrivateKeyPath ?? '<missing>' },
         { label: 'Access token', value: report.config.accessToken ?? '<missing>' },
         { label: 'Session expiry', value: report.config.sessionExpiresAt ? new Date(report.config.sessionExpiresAt).toISOString() : '<missing>' },
         { label: 'Refresh token', value: report.config.hasRefreshToken ? 'present' : 'missing' },
@@ -49,7 +52,17 @@ export function renderStatusReport(report: StatusReport, options: RenderOptions
 
     const toolRows = [
         ['git', report.tools.git ? 'available' : 'missing', report.tools.git ? 'ready' : 'install git'],
-        ['claude', report.tools.claude ? 'available' : 'missing', report.tools.claude ? 'ready' : 'required for `tela run`, `tela feedback`, and Claude commit messages'],
+        [
+            'claude',
+            !report.tools.claude
+                ? 'missing'
+                : (report.tools.claudeProjectScopedRunSupported === false ? 'unsupported' : 'available'),
+            !report.tools.claude
+                ? 'required for `tela run`, `tela feedback`, and Claude commit messages'
+                : (report.tools.claudeProjectScopedRunSupported === false
+                    ? (report.tools.claudeDetail ?? `version ${report.tools.claudeVersion ?? '<unknown>'}`)
+                    : (report.tools.claudeVersion ? `version ${report.tools.claudeVersion}` : 'ready')),
+        ],
         [
             'agent-api-origin',
             report.tools.agentApiReachable === null

package/src/config.ts

@@ -5,9 +5,13 @@ import { listOrganizations, provisionForgejoUser } from './agent-api.ts'
 import type { FetchLike } from './auth.ts'
 import { createUserFacingError } from './errors.ts'
 import {
+    createGitSshKey,
     ensureForgejoUserAccess,
+    inferSshPrivateKeyPath,
     listDiscoveredSshPublicKeys,
     loadSshPublicKey,
+    resolveSshPrivateKeyPath,
+    validateSshPrivateKeyPath,
     validateSshPublicKeyPath,
     type SelectedSshPublicKey,
 } from './forgejo.ts'
@@ -15,6 +19,7 @@ import type {
     TelaCliAuthState,
     TelaCliConfig,
     TelaCliForgejoOrganization,
+    TelaCliGitSshKey,
     TelaEnvironment,
 } from './types.ts'
 
@@ -213,6 +218,18 @@ function normalizeForgejoOrganization(
     }
 }
 
+function normalizeGitSshKey(gitSshKey: TelaCliConfig['gitSshKey']): TelaCliGitSshKey | null {
+    if (!gitSshKey) {
+        return null
+    }
+
+    return {
+        title: ensureNonEmpty(String(gitSshKey.title ?? ''), 'Git SSH key title'),
+        publicKeyPath: expandHome(ensureNonEmpty(String(gitSshKey.publicKeyPath ?? ''), 'Git SSH public key path')),
+        privateKeyPath: expandHome(ensureNonEmpty(String(gitSshKey.privateKeyPath ?? ''), 'Git SSH private key path')),
+    }
+}
+
 function normalizeConfig(config: TelaCliConfig): TelaCliConfig {
     const environment = ensureEnvironment(config.environment)
     const auth = normalizeAuth(config.auth)
@@ -229,6 +246,7 @@ function normalizeConfig(config: TelaCliConfig): TelaCliConfig {
         auth,
         forgejoOrganization: auth ? normalizeForgejoOrganization(config.forgejoOrganization) : null,
         forgejoUserRegistered: Boolean(config.forgejoUserRegistered),
+        gitSshKey: normalizeGitSshKey(config.gitSshKey),
     }
 }
 
@@ -257,6 +275,7 @@ function parseJsonConfig(input: string): TelaCliConfig {
         auth,
         forgejoOrganization: parsed.forgejoOrganization as TelaCliConfig['forgejoOrganization'] ?? null,
         forgejoUserRegistered: Boolean(parsed.forgejoUserRegistered ?? false),
+        gitSshKey: parsed.gitSshKey as TelaCliConfig['gitSshKey'] ?? null,
     })
 }
 
@@ -317,6 +336,25 @@ async function promptForSshPublicKey(prompts: PromptModule): Promise<SelectedSsh
     return loadSshPublicKey(promptValue(customPath))
 }
 
+async function promptForSshPrivateKeyPath(
+    prompts: PromptModule,
+    sshKey: SelectedSshPublicKey,
+): Promise<string> {
+    const privateKeyPath = await prompts.text({
+        message: 'SSH private key path',
+        defaultValue: inferSshPrivateKeyPath(sshKey.path),
+        placeholder: sshKey.path.endsWith('.pub')
+            ? sshKey.path.slice(0, -4)
+            : '~/.ssh/id_ed25519',
+        validate: validateSshPrivateKeyPath,
+    })
+    if (prompts.isCancel(privateKeyPath)) {
+        cancelSetup(prompts)
+    }
+
+    return resolveSshPrivateKeyPath(promptValue(privateKeyPath))
+}
+
 function getHomeDir(): string {
     return process.env.HOME || homedir()
 }
@@ -700,6 +738,7 @@ export async function setupConfigInteractive(options: {
     }
 
     const sshKey = await promptForSshPublicKey(prompts)
+    const privateKeyPath = await promptForSshPrivateKeyPath(prompts, sshKey)
 
     const resolvedSetup = {
         ...resolveEnvironmentConfigForPreset(environment, customValues),
@@ -718,6 +757,7 @@ export async function setupConfigInteractive(options: {
         auth,
         forgejoOrganization: null,
         forgejoUserRegistered: false,
+        gitSshKey: createGitSshKey(sshKey, privateKeyPath),
     })
     const organization = await resolveForgejoOrganizationInteractive({
         prompts,