@meistrari/tela-cli 0.4.0 → 0.5.0

package/src/git.ts

@@ -1,6 +1,14 @@
 import { basename } from 'node:path'
-import { randomUUID } from 'node:crypto'
-import { CommandError, runCommand, runShell } from './process.ts'
+import { inspectSavedConfig } from './config.ts'
+import { createUserFacingError } from './errors.ts'
+import { resolveSshPrivateKeyPath } from './forgejo.ts'
+import {
+    CommandError,
+    runCommand,
+    type CommandResult,
+    type RunCommandOptions,
+} from './process.ts'
+import type { TelaCliGitSshKey } from './types.ts'
 
 export interface GitStatusEntry {
     index: string
@@ -15,8 +23,192 @@ export interface GitStatusCounts {
     total: number
 }
 
+type GitSshHostKeyPolicy = 'default' | 'accept-new'
+
+interface GitRunOptions extends Omit<RunCommandOptions, 'env'> {
+    requireConfiguredSsh?: boolean
+    sshHostKeyPolicy?: GitSshHostKeyPolicy
+}
+
+function quoteForShell(value: string): string {
+    return `'${value.replaceAll('\'', `'"'"'`)}'`
+}
+
+export function buildGitSshCommand(
+    privateKeyPath: string,
+    options: {
+        hostKeyPolicy?: GitSshHostKeyPolicy
+    } = {},
+): string {
+    const args = [
+        `-i ${quoteForShell(privateKeyPath)}`,
+        '-o IdentitiesOnly=yes',
+    ]
+
+    if (options.hostKeyPolicy === 'accept-new') {
+        args.push('-o StrictHostKeyChecking=accept-new')
+    }
+
+    return `ssh ${args.join(' ')}`
+}
+
+export function isSshRemoteUrl(remoteUrl: string): boolean {
+    const trimmed = remoteUrl.trim()
+    return /^ssh:\/\//i.test(trimmed) || /^[^\s@]+@[^\s:]+:.+$/.test(trimmed)
+}
+
+function resolveConfiguredGitSshKey(requireConfiguredSsh: boolean): TelaCliGitSshKey | null {
+    const inspection = inspectSavedConfig()
+    if (!inspection.exists) {
+        if (requireConfiguredSsh) {
+            throw createUserFacingError({
+                code: 'git_ssh_key_config_missing',
+                summary: 'Tela CLI is not configured with a Git SSH key.',
+                fixes: [
+                    'Run `tela setup` and choose the SSH key to force on Git operations.',
+                ],
+            })
+        }
+
+        return null
+    }
+
+    if (!inspection.valid || !inspection.config) {
+        if (requireConfiguredSsh) {
+            throw createUserFacingError({
+                code: 'git_ssh_key_config_invalid',
+                summary: 'Tela CLI config is invalid, so the Git SSH key could not be loaded.',
+                details: inspection.error,
+                fixes: [
+                    'Run `tela setup` to rewrite the config and choose the SSH key again.',
+                ],
+            })
+        }
+
+        return null
+    }
+
+    if (!inspection.config.gitSshKey) {
+        if (requireConfiguredSsh) {
+            throw createUserFacingError({
+                code: 'git_ssh_key_missing',
+                summary: 'No Git SSH key is configured.',
+                fixes: [
+                    'Run `tela setup` again and choose the SSH key to use for Git operations.',
+                ],
+            })
+        }
+
+        return null
+    }
+
+    try {
+        return {
+            ...inspection.config.gitSshKey,
+            privateKeyPath: resolveSshPrivateKeyPath(inspection.config.gitSshKey.privateKeyPath),
+        }
+    }
+    catch (error) {
+        if (requireConfiguredSsh) {
+            throw createUserFacingError({
+                code: 'git_ssh_key_invalid',
+                summary: 'The configured Git SSH private key is unavailable.',
+                details: error instanceof Error ? error.message : String(error),
+                fixes: [
+                    'Restore the configured private key file, or run `tela setup` again and choose another SSH key.',
+                ],
+                cause: error,
+            })
+        }
+
+        return null
+    }
+}
+
+function buildGitEnv(
+    requireConfiguredSsh: boolean,
+    sshHostKeyPolicy: GitSshHostKeyPolicy = 'default',
+): Record<string, string> | undefined {
+    const gitSshKey = resolveConfiguredGitSshKey(requireConfiguredSsh)
+    if (!gitSshKey) {
+        return undefined
+    }
+
+    return {
+        GIT_SSH_COMMAND: buildGitSshCommand(gitSshKey.privateKeyPath, {
+            hostKeyPolicy: sshHostKeyPolicy,
+        }),
+    }
+}
+
+async function runGitCommand(
+    args: string[],
+    options: GitRunOptions = {},
+): Promise<CommandResult> {
+    const env = buildGitEnv(
+        Boolean(options.requireConfiguredSsh),
+        options.sshHostKeyPolicy,
+    )
+
+    return await runCommand(
+        ['git', ...args],
+        {
+            ...options,
+            env: env ? env : undefined,
+        },
+    )
+}
+
+async function getRemoteUrlInternal(cwd: string, remote: string): Promise<string | null> {
+    const result = await runGitCommand(['remote', 'get-url', remote], { cwd, allowFailure: true })
+    if (result.exitCode !== 0) {
+        return null
+    }
+
+    return result.stdout.trim() || null
+}
+
+async function remoteRequiresConfiguredSsh(cwd: string, remote: string): Promise<boolean> {
+    const remoteUrl = await getRemoteUrlInternal(cwd, remote)
+    return Boolean(remoteUrl && isSshRemoteUrl(remoteUrl))
+}
+
+async function anyRemoteRequiresConfiguredSsh(cwd: string): Promise<boolean> {
+    const result = await runGitCommand(['remote'], { cwd, allowFailure: true })
+    if (result.exitCode !== 0) {
+        return false
+    }
+
+    const remotes = result.stdout
+        .split(/\r?\n/)
+        .map(line => line.trim())
+        .filter(Boolean)
+
+    for (const remote of remotes) {
+        if (await remoteRequiresConfiguredSsh(cwd, remote)) {
+            return true
+        }
+    }
+
+    return false
+}
+
+async function upstreamRequiresConfiguredSsh(cwd: string): Promise<boolean> {
+    const upstream = await getUpstreamBranch(cwd)
+    if (!upstream) {
+        return false
+    }
+
+    const separator = upstream.indexOf('/')
+    if (separator <= 0) {
+        return false
+    }
+
+    return await remoteRequiresConfiguredSsh(cwd, upstream.slice(0, separator))
+}
+
 export async function findRepositoryRoot(cwd: string): Promise<string | null> {
-    const result = await runCommand(['git', 'rev-parse', '--show-toplevel'], { cwd, allowFailure: true })
+    const result = await runGitCommand(['rev-parse', '--show-toplevel'], { cwd, allowFailure: true })
     if (result.exitCode !== 0) {
         return null
     }
@@ -35,7 +227,7 @@ export async function getRepositoryRoot(cwd: string): Promise<string> {
 
 export async function assertGitRepository(cwd: string): Promise<void> {
     try {
-        await runCommand(['git', 'rev-parse', '--is-inside-work-tree'], { cwd })
+        await runGitCommand(['rev-parse', '--is-inside-work-tree'], { cwd })
     }
     catch (error) {
         if (error instanceof CommandError) {
@@ -46,24 +238,36 @@ export async function assertGitRepository(cwd: string): Promise<void> {
 }
 
 export async function cloneRepository(remoteUrl: string, targetDir: string): Promise<void> {
-    await runCommand(['git', 'clone', remoteUrl, targetDir])
+    await runGitCommand(['clone', remoteUrl, targetDir], {
+        requireConfiguredSsh: isSshRemoteUrl(remoteUrl),
+        // Sync accepts first-seen SSH host keys automatically, but changed host keys still fail.
+        sshHostKeyPolicy: 'accept-new',
+    })
 }
 
 export async function getOriginUrl(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'remote', 'get-url', 'origin'], { cwd })
+    const result = await runGitCommand(['remote', 'get-url', 'origin'], { cwd })
     return result.stdout.trim()
 }
 
 export async function fetchOrigin(cwd: string): Promise<void> {
-    await runCommand(['git', 'fetch', 'origin', '--prune'], { cwd })
+    await runGitCommand(['fetch', 'origin', '--prune'], {
+        cwd,
+        requireConfiguredSsh: await remoteRequiresConfiguredSsh(cwd, 'origin'),
+        sshHostKeyPolicy: 'accept-new',
+    })
 }
 
 export async function fetchAllRemotes(cwd: string): Promise<void> {
-    await runCommand(['git', 'fetch', '--all', '--prune'], { cwd })
+    await runGitCommand(['fetch', '--all', '--prune'], {
+        cwd,
+        requireConfiguredSsh: await anyRemoteRequiresConfiguredSsh(cwd),
+        sshHostKeyPolicy: 'accept-new',
+    })
 }
 
 export async function getWorktreeStatus(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'status', '--short'], { cwd })
+    const result = await runGitCommand(['status', '--short'], { cwd })
     return result.stdout.trim()
 }
 
@@ -72,12 +276,12 @@ export async function isWorktreeDirty(cwd: string): Promise<boolean> {
 }
 
 export async function stageAll(cwd: string): Promise<void> {
-    await runCommand(['git', 'add', '-A'], { cwd })
+    await runGitCommand(['add', '-A'], { cwd })
 }
 
 export async function getCurrentBranch(cwd: string): Promise<string> {
     try {
-        const result = await runCommand(['git', 'symbolic-ref', '--quiet', '--short', 'HEAD'], { cwd })
+        const result = await runGitCommand(['symbolic-ref', '--quiet', '--short', 'HEAD'], { cwd })
         return result.stdout.trim()
     }
     catch (error) {
@@ -89,8 +293,8 @@ export async function getCurrentBranch(cwd: string): Promise<string> {
 }
 
 export async function getUpstreamBranch(cwd: string): Promise<string | null> {
-    const result = await runCommand(
-        ['git', 'rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{upstream}'],
+    const result = await runGitCommand(
+        ['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{upstream}'],
         { cwd, allowFailure: true },
     )
 
@@ -102,15 +306,23 @@ export async function getUpstreamBranch(cwd: string): Promise<string | null> {
 }
 
 export async function pullCurrentBranch(cwd: string): Promise<void> {
-    await runCommand(['git', 'pull', '--ff-only'], { cwd })
+    await runGitCommand(['pull', '--ff-only'], {
+        cwd,
+        requireConfiguredSsh: await upstreamRequiresConfiguredSsh(cwd),
+        sshHostKeyPolicy: 'accept-new',
+    })
 }
 
 export async function pullDefaultBranch(cwd: string, defaultBranch: string): Promise<void> {
-    await runCommand(['git', 'pull', '--ff-only', 'origin', defaultBranch], { cwd })
+    await runGitCommand(['pull', '--ff-only', 'origin', defaultBranch], {
+        cwd,
+        requireConfiguredSsh: await remoteRequiresConfiguredSsh(cwd, 'origin'),
+        sshHostKeyPolicy: 'accept-new',
+    })
 }
 
 export async function getShortStatus(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'status', '--short'], { cwd })
+    const result = await runGitCommand(['status', '--short'], { cwd })
     return result.stdout
 }
 
@@ -156,22 +368,22 @@ export async function getStatusCounts(cwd: string): Promise<GitStatusCounts> {
 }
 
 export async function getStagedDiff(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'diff', '--cached'], { cwd })
+    const result = await runGitCommand(['diff', '--cached'], { cwd })
     return result.stdout
 }
 
 export async function getDiffAgainstHead(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'diff', 'HEAD', '--'], { cwd })
+    const result = await runGitCommand(['diff', 'HEAD', '--'], { cwd })
     return result.stdout
 }
 
 export async function getRecentLog(cwd: string, count = 10): Promise<string> {
-    const result = await runCommand(['git', 'log', '--oneline', `-${count}`], { cwd, allowFailure: true })
+    const result = await runGitCommand(['log', '--oneline', `-${count}`], { cwd, allowFailure: true })
     return result.stdout
 }
 
 export async function getStagedFiles(cwd: string): Promise<string[]> {
-    const result = await runCommand(['git', 'diff', '--cached', '--name-only', '--diff-filter=ACMRTUXB'], { cwd })
+    const result = await runGitCommand(['diff', '--cached', '--name-only', '--diff-filter=ACMRTUXB'], { cwd })
     return result.stdout
         .split(/\r?\n/)
         .map(line => line.trim())
@@ -179,7 +391,7 @@ export async function getStagedFiles(cwd: string): Promise<string[]> {
 }
 
 export async function getChangedFilesAgainstHead(cwd: string): Promise<string[]> {
-    const result = await runCommand(['git', 'diff', '--name-only', 'HEAD', '--diff-filter=ACMRTUXB'], { cwd })
+    const result = await runGitCommand(['diff', '--name-only', 'HEAD', '--diff-filter=ACMRTUXB'], { cwd })
     return result.stdout
         .split(/\r?\n/)
         .map(line => line.trim())
@@ -187,7 +399,7 @@ export async function getChangedFilesAgainstHead(cwd: string): Promise<string[]>
 }
 
 export async function getDiffStatAgainstHead(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'diff', '--stat', 'HEAD'], { cwd, allowFailure: true })
+    const result = await runGitCommand(['diff', '--stat', 'HEAD'], { cwd, allowFailure: true })
     return result.stdout.trim()
 }
 
@@ -203,48 +415,43 @@ export function buildFallbackCommitMessage(files: string[]): string {
     return `Update ${basename(files[0]!) || files[0]} and ${files.length - 1} other files`
 }
 
-function buildCommitDelimiter(message: string): string {
-    let delimiter = `__TELA_COMMIT_${randomUUID().replace(/-/g, '_')}__`
-    while (message.includes(delimiter)) {
-        delimiter = `__TELA_COMMIT_${randomUUID().replace(/-/g, '_')}__`
-    }
-    return delimiter
-}
-
 export async function commitWithMessage(cwd: string, message: string): Promise<void> {
-    const delimiter = buildCommitDelimiter(message)
-    const script = [
-        'git commit -F - <<\'__TELA_COMMIT__\'',
-        message,
-        '__TELA_COMMIT__',
-    ].join('\n').replaceAll('__TELA_COMMIT__', delimiter)
-
-    await runShell(script, { cwd })
+    await runGitCommand(['commit', '-F', '-'], {
+        cwd,
+        input: message,
+    })
 }
 
 export async function pushBranch(cwd: string, branch: string, setUpstream: boolean): Promise<void> {
     const args = setUpstream
-        ? ['git', 'push', '--set-upstream', 'origin', branch]
-        : ['git', 'push']
-    await runCommand(args, { cwd })
+        ? ['push', '--set-upstream', 'origin', branch]
+        : ['push']
+    const requireConfiguredSsh = setUpstream
+        ? await remoteRequiresConfiguredSsh(cwd, 'origin')
+        : await upstreamRequiresConfiguredSsh(cwd)
+
+    await runGitCommand(args, {
+        cwd,
+        requireConfiguredSsh,
+    })
 }
 
 export async function getHeadShortSha(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'rev-parse', '--short', 'HEAD'], { cwd })
+    const result = await runGitCommand(['rev-parse', '--short', 'HEAD'], { cwd })
     return result.stdout.trim()
 }
 
 export async function getHeadCommitHash(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'rev-parse', 'HEAD'], { cwd })
+    const result = await runGitCommand(['rev-parse', 'HEAD'], { cwd })
     return result.stdout.trim()
 }
 
 export async function getHeadCommitMessage(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'log', '-1', '--pretty=%B'], { cwd })
+    const result = await runGitCommand(['log', '-1', '--pretty=%B'], { cwd })
     return result.stdout.trim()
 }
 
 export async function getHeadShortMessage(cwd: string): Promise<string> {
-    const result = await runCommand(['git', 'log', '-1', '--pretty=%s'], { cwd })
+    const result = await runGitCommand(['log', '-1', '--pretty=%s'], { cwd })
     return result.stdout.trim()
 }

package/src/ink/screens/setup/setup-screen.tsx

@@ -2,7 +2,9 @@ import React, { useEffect, useMemo, useRef, useState } from 'react'
 import { useInput } from 'ink'
 import { ENVIRONMENT_PRESET_OPTIONS, resolveEnvironmentConfigForPreset } from '../../../config.ts'
 import {
+    inferSshPrivateKeyPath,
     loadSshPublicKey,
+    validateSshPrivateKeyPath,
     validateSshPublicKeyPath,
 } from '../../../forgejo.ts'
 import type { TelaCliAuthState, TelaCliForgejoOrganization } from '../../../types.ts'
@@ -67,6 +69,9 @@ export function SetupScreen(props: SetupScreenProps): React.ReactElement {
         cloneRoot: props.defaults.cloneRoot,
         sshKeySelection: props.sshPublicKeys[0]?.path ?? CUSTOM_SSH_KEY_OPTION,
         sshKeyPath: '',
+        sshPrivateKeyPath: props.sshPublicKeys[0]
+            ? inferSshPrivateKeyPath(props.sshPublicKeys[0].path)
+            : '',
     })
     const [errors, setErrors] = useState<Partial<Record<SetupStepId, string>>>({})
     const [createCloneRoot, setCreateCloneRoot] = useState(true)
@@ -82,6 +87,7 @@ export function SetupScreen(props: SetupScreenProps): React.ReactElement {
     const [result, setResult] = useState<SetupScreenResult | null>(null)
     const authStartedRef = useRef(false)
     const provisionStartedRef = useRef(false)
+    const previousSuggestedPrivateKeyPathRef = useRef(values.sshPrivateKeyPath)
 
     const visibleSteps = useMemo(() => getVisibleEditSteps(values), [values])
     const safeStepIndex = Math.min(stepIndex, Math.max(visibleSteps.length - 1, 0))
@@ -117,6 +123,10 @@ export function SetupScreen(props: SetupScreenProps): React.ReactElement {
 
         return props.sshPublicKeys.find(key => key.path === values.sshKeySelection)
     }, [props.sshPublicKeys, values.sshKeyPath, values.sshKeySelection])
+    const suggestedPrivateKeyPath = useMemo(
+        () => selectedSshKey ? inferSshPrivateKeyPath(selectedSshKey.path) : '',
+        [selectedSshKey],
+    )
     const cloneRootState = useMemo(() => props.inspectCloneRoot(values.cloneRoot), [props, values.cloneRoot])
 
     const breadcrumb = useMemo<BreadcrumbEntry[]>(() => {
@@ -247,6 +257,7 @@ export function SetupScreen(props: SetupScreenProps): React.ReactElement {
             cloneRoot: values.cloneRoot,
             createCloneRoot,
             sshKey: selectedSshKey,
+            sshPrivateKeyPath: values.sshPrivateKeyPath,
             auth: authenticated,
             organization: selectedOrganization,
         }, (event) => {
@@ -267,6 +278,7 @@ export function SetupScreen(props: SetupScreenProps): React.ReactElement {
         resolvedConfig,
         selectedOrganization,
         selectedSshKey,
+        values.sshPrivateKeyPath,
         values.cloneRoot,
     ])
 
@@ -276,6 +288,29 @@ export function SetupScreen(props: SetupScreenProps): React.ReactElement {
         }
     }, [phase, props, result])
 
+    useEffect(() => {
+        setValues((current) => {
+            const previousSuggested = previousSuggestedPrivateKeyPathRef.current
+            previousSuggestedPrivateKeyPathRef.current = suggestedPrivateKeyPath
+
+            if (
+                current.sshPrivateKeyPath
+                && current.sshPrivateKeyPath !== previousSuggested
+            ) {
+                return current
+            }
+
+            if (current.sshPrivateKeyPath === suggestedPrivateKeyPath) {
+                return current
+            }
+
+            return {
+                ...current,
+                sshPrivateKeyPath: suggestedPrivateKeyPath,
+            }
+        })
+    }, [suggestedPrivateKeyPath])
+
     useInput((input, key) => {
         if (phase === 'authenticating' || phase === 'provisioning' || phase === 'done') {
             return
@@ -570,5 +605,7 @@ function validateStep(
             return selectedSshKey ? undefined : 'SSH public key is required'
         case 'sshKeyPath':
             return validateSshPublicKeyPath(values.sshKeyPath)
+        case 'sshPrivateKeyPath':
+            return validateSshPrivateKeyPath(values.sshPrivateKeyPath)
     }
 }

package/src/ink/screens/setup/steps/review-step.tsx

@@ -57,6 +57,7 @@ export function ReviewStep(props: {
                         ? `${props.selectedSshKey.title} (${props.selectedSshKey.path})`
                         : '<missing>'}
                 </Text>
+                <Text>SSH private key: {props.values.sshPrivateKeyPath || '<missing>'}</Text>
                 <Text>
                     Clone root state:
                     {' '}

package/src/ink/screens/setup/steps.ts

@@ -12,6 +12,7 @@ export type SetupStepId =
     | 'cloneRoot'
     | 'sshKey'
     | 'sshKeyPath'
+    | 'sshPrivateKeyPath'
 
 export type SetupStepKind = 'select-environment' | 'select-ssh-key' | 'text'
 
@@ -103,6 +104,14 @@ export const EDIT_STEPS: readonly SetupStepDescriptor[] = [
         placeholder: '~/.ssh/id_ed25519.pub',
         visible: values => values.sshKeySelection === CUSTOM_SSH_KEY_OPTION,
     },
+    {
+        id: 'sshPrivateKeyPath',
+        label: 'Private Key Path',
+        question: 'Path to your SSH private key',
+        kind: 'text',
+        placeholder: '~/.ssh/id_ed25519',
+        visible: () => true,
+    },
 ]
 
 export function getVisibleEditSteps(values: SetupFormValues): SetupStepDescriptor[] {
@@ -141,5 +150,7 @@ export function summarizeStep(
                 : (sshKeyTitle ?? values.sshKeySelection)
         case 'sshKeyPath':
             return values.sshKeyPath
+        case 'sshPrivateKeyPath':
+            return values.sshPrivateKeyPath
     }
 }

package/src/ink/screens/setup/types.ts

@@ -13,6 +13,7 @@ export const CUSTOM_SSH_KEY_OPTION = '__custom__'
 export type SetupFormValues = SetupConfigInput & {
     sshKeySelection: string
     sshKeyPath: string
+    sshPrivateKeyPath: string
 }
 
 export interface SetupScreenResult {
@@ -55,6 +56,7 @@ export interface SetupScreenProps {
         input: SetupConfigInput & {
             createCloneRoot: boolean
             sshKey: SelectedSshPublicKey
+            sshPrivateKeyPath: string
             auth: TelaCliAuthState
             organization: TelaCliForgejoOrganization
         },