@opentig/cli 0.2.1 → 0.2.2

package/dist/server.mjs

@@ -1,6 +1,6 @@
 import { fileURLToPath, pathToFileURL } from "node:url";
 import path, { extname, delimiter, resolve, join, isAbsolute, dirname } from "node:path";
-import { randomUUID, randomBytes, createHmac, createHash, timingSafeEqual } from "node:crypto";
+import { randomUUID, randomBytes, createHash, createHmac, timingSafeEqual } from "node:crypto";
 import { stat, access, realpath, mkdir, open, rename, chmod, rm, appendFile, readFile, mkdtemp, writeFile, lstat, readdir, cp } from "node:fs/promises";
 import os, { constants, homedir, networkInterfaces } from "node:os";
 import { ChildProcess, execFile, spawnSync, spawn } from "node:child_process";
@@ -17,6 +17,7 @@ import { Transform, getDefaultHighWaterMark, Duplex, Writable, Readable, PassThr
 import { finished } from "node:stream/promises";
 import path$1 from "node:path/win32";
 import { createServer, isIP } from "node:net";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { createServer as createServer$1 } from "node:http";
 import WebSocket, { WebSocketServer } from "ws";
 function aiExecutablePathsKey(paths) {
@@ -12194,7 +12195,7 @@ function superRefine(fn, params) {
   return /* @__PURE__ */ _superRefine(fn, params);
 }
 function redactSensitiveText(value) {
-  const withoutHeaders = value.replace(/\b(authorization|cookie|set-cookie)\s*[:=]\s*[^\s,;]+/gi, "$1=[redacted]").replace(/\b(token|secret|password)\s*[:=]\s*[^\s,;]+/gi, "$1=[redacted]");
+  const withoutHeaders = value.replace(/\b(?:github_pat_|gh[opusr]_)[A-Za-z0-9_]{16,}/g, "[redacted]").replace(/\bauthorization\s*[:=]\s*(?:bearer|basic)\s+[^\s,;]+/gi, "authorization=[redacted]").replace(/\b(authorization|cookie|set-cookie)\s*[:=]\s*[^\s,;]+/gi, "$1=[redacted]").replace(/\b(token|secret|password)\s*[:=]\s*[^\s,;]+/gi, "$1=[redacted]");
   return withoutHeaders.replace(/https?:\/\/[^\s"'<>]+/gi, (candidate) => redactUrl(candidate));
 }
 function redactUrl(candidate) {
@@ -14835,6 +14836,450 @@ class RepositoryWatcher {
     this.onChange(this.active.id, scope);
   }
 }
+const OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/;
+const REPO_PATTERN = /^[A-Za-z0-9._-]+$/;
+function parseGitHubRemote(url) {
+  const trimmed = url.trim();
+  if (!trimmed) return null;
+  let rest = null;
+  const https = /^https?:\/\/(?:[^@/\s]+@)?github\.com\/(.+)$/i.exec(trimmed);
+  const ssh = /^ssh:\/\/(?:[^@/\s]+@)?github\.com(?::\d+)?\/(.+)$/i.exec(trimmed);
+  const scp = /^(?:[^@\s]+)@github\.com:(.+)$/i.exec(trimmed);
+  const git = /^git:\/\/github\.com\/(.+)$/i.exec(trimmed);
+  if (https) rest = https[1] ?? null;
+  else if (ssh) rest = ssh[1] ?? null;
+  else if (scp) rest = scp[1] ?? null;
+  else if (git) rest = git[1] ?? null;
+  if (!rest) return null;
+  const segments = rest.replace(/\/+$/, "").split("/");
+  if (segments.length !== 2) return null;
+  const owner = segments[0] ?? "";
+  const repo = (segments[1] ?? "").replace(/\.git$/i, "");
+  if (!OWNER_PATTERN.test(owner) || !repo || repo === "." || repo === ".." || !REPO_PATTERN.test(repo)) return null;
+  return { nameWithOwner: `${owner}/${repo}` };
+}
+function parseSshRemote(url) {
+  const trimmed = url.trim();
+  const ssh = /^ssh:\/\/(?:(\w[\w.-]*)@)?([A-Za-z0-9][A-Za-z0-9._-]*)(?::(\d+))?\/(.+)$/i.exec(trimmed);
+  const scp = /^(?:(\w[\w.-]*)@)?([A-Za-z0-9][A-Za-z0-9._-]*):(.+)$/.exec(trimmed);
+  const match = ssh ?? scp;
+  if (!match) return null;
+  const parsed = parseGitHubRemote(`https://github.com/${ssh ? match[4] : match[3]}`);
+  if (!parsed) return null;
+  return { destination: `${match[1] ? `${match[1]}@` : ""}${match[2]}`, port: ssh ? match[3] ?? null : null, ...parsed };
+}
+const GITHUB_LOGIN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/;
+function parseGitHubAuthStatus(raw) {
+  const input = JSON.parse(raw);
+  if (!input || typeof input !== "object" || !("hosts" in input) || !input.hosts || typeof input.hosts !== "object") throw new Error("Invalid gh status");
+  const entries = input.hosts["github.com"] ?? [];
+  if (!Array.isArray(entries) || entries.length > 100) throw new Error("Invalid gh accounts");
+  const accounts = [];
+  for (const entry of entries) {
+    if (!entry || typeof entry !== "object" || typeof entry.login !== "string" || !GITHUB_LOGIN.test(entry.login)) continue;
+    accounts.push({
+      host: "github.com",
+      login: entry.login,
+      active: entry.active === true,
+      state: entry.state === "success" ? "authenticated" : entry.state === "error" ? "invalid" : "unknown",
+      storage: entry.tokenSource === "keyring" ? "keyring" : typeof entry.tokenSource === "string" && (entry.tokenSource === "oauth_token" || /(?:^|[/\\])hosts\.yml$/.test(entry.tokenSource)) ? "file" : "unknown",
+      ...typeof entry.scopes === "string" && /^[A-Za-z0-9_:, -]{0,500}$/.test(entry.scopes) ? { scopes: entry.scopes } : {}
+    });
+  }
+  return { accounts, activeLogin: accounts.find((account) => account.active)?.login ?? null };
+}
+const GH_ENV = { GH_HOST: "github.com", GH_PROMPT_DISABLED: "1", GH_NO_UPDATE_NOTIFIER: "1", GH_PAGER: "cat", NO_COLOR: "1" };
+const GH_PRIVATE_ENV = ["GITHUB_TOKEN", "GH_DEBUG", "DEBUG"];
+async function identifySshAccount(remote, runner) {
+  const ssh = parseSshRemote(remote);
+  if (!ssh) return null;
+  try {
+    const config2 = await runner.run("ssh", ["-G", ...ssh.port ? ["-p", ssh.port] : [], "--", ssh.destination], {
+      cwd: os.homedir(),
+      timeoutMs: 5e3,
+      maxOutputBytes: 64 * 1024
+    });
+    const hostname = config2.stdout.split(/\r?\n/).find((line) => /^hostname\s/i.test(line))?.trim().split(/\s+/)[1];
+    if (config2.exitCode !== 0 || hostname?.toLowerCase() !== "github.com") return null;
+    const result = await runner.run("ssh", [
+      "-T",
+      "-o",
+      "BatchMode=yes",
+      "-o",
+      "StrictHostKeyChecking=yes",
+      "-o",
+      "ConnectTimeout=5",
+      "-o",
+      "ConnectionAttempts=1",
+      "-o",
+      "RemoteCommand=none",
+      "-o",
+      "UpdateHostKeys=no",
+      ...ssh.port ? ["-p", ssh.port] : [],
+      "--",
+      ssh.destination
+    ], { cwd: os.homedir(), timeoutMs: 1e4, maxOutputBytes: 64 * 1024 });
+    if (result.exitCode !== 0 && result.exitCode !== 1) return null;
+    const login2 = /^Hi ([A-Za-z0-9-]+)! You've successfully authenticated, but GitHub does not provide shell access\.\s*$/m.exec(`${result.stdout}
+${result.stderr}`)?.[1];
+    return login2 && GITHUB_LOGIN.test(login2) ? login2 : null;
+  } catch {
+    return null;
+  }
+}
+async function accountAuthentication(login2, executable, runner, operation) {
+  try {
+    const result = await runner.run(executable.executable, ["auth", "token", "--hostname", "github.com", ...login2 ? ["--user", login2] : []], {
+      cwd: os.homedir(),
+      env: { ...executable.env, ...GH_ENV },
+      removeEnv: login2 ? ["GH_TOKEN", ...GH_PRIVATE_ENV] : ["GH_DEBUG", "DEBUG"],
+      timeoutMs: 1e4,
+      maxOutputBytes: 8 * 1024
+    });
+    const token = result.stdout.trim();
+    if (result.exitCode === 0 && /^[A-Za-z0-9_]{20,4096}$/.test(token)) return { env: { GH_TOKEN: token }, removeEnv: GH_PRIVATE_ENV };
+    if (/unknown flag.*user/i.test(result.stderr)) throw new GhOperationError({
+      code: "GH_CLI_INCOMPATIBLE",
+      operation,
+      message: "Update GitHub CLI to a version supporting multiple accounts and auth token --user."
+    });
+  } catch (error) {
+    if (error instanceof GhOperationError) throw error;
+  }
+  throw new GhOperationError({
+    code: login2 ? "GH_ACCOUNT_MISSING" : "GH_AUTH_REQUIRED",
+    operation,
+    message: login2 ? `GitHub CLI has no usable saved credentials for @${login2}. Sign in as ${login2} on the backend host and check Settings → GitHub again. SSH and GitHub CLI authentication are separate.` : "GitHub CLI has no usable credentials. Sign in on the backend host and check Settings → GitHub again."
+  });
+}
+function redactCommandToken(value, auth) {
+  const token = auth.env?.GH_TOKEN;
+  return token ? value.split(token).join("[redacted]") : value;
+}
+function gitShellQuote(value) {
+  return `'${value.replace(/\\/g, "/").replace(/'/g, `'\\''`)}'`;
+}
+function managedGitHubPath(value) {
+  try {
+    const url = new URL(value);
+    if (!/^https:\/\/github\.com\//i.test(value) || url.protocol !== "https:" || url.hostname !== "github.com" || url.port || url.username || url.password || url.search || url.hash) return null;
+    if (!/^\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(url.pathname)) return null;
+    return url.pathname.slice(1);
+  } catch {
+    return null;
+  }
+}
+async function createCredentialBroker(url, login2, token) {
+  const allowedPath = managedGitHubPath(url);
+  if (!allowedPath) throw new Error("Managed authentication requires one plain github.com HTTPS repository URL.");
+  const directory = await mkdtemp(path.join(os.tmpdir(), "opentig-git-auth-"));
+  const key = randomBytes(32).toString("hex");
+  const server = createServer$1((request, response) => {
+    response.setHeader("Connection", "close");
+    if (request.method !== "POST" || request.url !== "/" || request.headers["x-opentig-key"] !== key) {
+      response.writeHead(403).end();
+      return;
+    }
+    let body = "";
+    request.setTimeout(5e3, () => request.destroy());
+    request.on("data", (data) => {
+      body += data.toString("utf8");
+      if (body.length > 8192) request.destroy();
+    });
+    request.on("end", () => {
+      const fields = body.trim().split("\n").map((line) => line.replace(/\r$/, "").split(/=(.*)/s));
+      const value = Object.fromEntries(fields.map(([name, field]) => [name, field]));
+      const unique = ["protocol", "host", "path"].every((name) => fields.filter(([key2]) => key2 === name).length === 1);
+      if (!unique || value.protocol !== "https" || value.host !== "github.com" || value.path !== allowedPath) {
+        response.writeHead(403).end();
+        return;
+      }
+      response.end(`username=${login2}
+password=${token}
+
+`);
+    });
+  });
+  const dispose = async () => {
+    server.closeAllConnections();
+    if (server.listening) await new Promise((resolve2) => server.close(() => resolve2()));
+    await rm(directory, { recursive: true, force: true });
+  };
+  try {
+    server.listen(0, "127.0.0.1");
+    await once(server, "listening");
+    const port = server.address().port;
+    const headers = path.join(directory, "headers");
+    const helper = path.join(directory, "helper.sh");
+    await writeFile(headers, `X-OpenTig-Key: ${key}
+`, { mode: 384 });
+    await writeFile(helper, `#!/bin/sh
+[ "$1" = get ] || exit 0
+curl --disable --silent --fail --noproxy '*' --max-time 10 --proto '=http' --header @${gitShellQuote(headers)} --data-binary @- http://127.0.0.1:${port}/ || exit 1
+`, { mode: 448 });
+    return { helper: `!sh ${gitShellQuote(helper)}`, directory, dispose };
+  } catch (error) {
+    await dispose();
+    throw error;
+  }
+}
+const read$1 = { operation: "repository-access", readOnly: true, maxOutputBytes: 1024 * 1024 };
+const unchecked = () => ({ state: "unchecked" });
+const digest = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+class RepositoryGitAccess {
+  constructor(git, repositories, accounts, runner) {
+    this.git = git;
+    this.repositories = repositories;
+    this.accounts = accounts;
+    this.runner = runner;
+  }
+  git;
+  repositories;
+  accounts;
+  runner;
+  sessions = new AsyncLocalStorage();
+  checks = /* @__PURE__ */ new Map();
+  latest = /* @__PURE__ */ new Map();
+  install() {
+    this.git.network = (cwd, args, options, execute) => this.scope(cwd, () => this.execute(args, options, execute));
+    this.git.authenticationKey = (cwd) => {
+      const repository = this.repositories.recents().find((item) => item.path === cwd);
+      return repository ? digest([this.accounts.selection(repository), this.accounts.revisionFor(repository)]) : "";
+    };
+    this.git.networkScope = (cwd, task) => this.scope(cwd, task);
+  }
+  async scope(cwd, task) {
+    if (this.sessions.getStore()?.repository.path === cwd) return task();
+    const repository = this.repositories.recents().find((item) => item.path === cwd);
+    if (!repository) throw new Error("The repository must be open before remote operations.");
+    return this.sessions.run({ repository, selection: this.accounts.selection(repository), revision: this.accounts.revisionFor(repository) }, task);
+  }
+  async config(repository, key, all = false) {
+    try {
+      return (await this.git.run(repository.path, ["config", all ? "--get-all" : "--get", key], read$1)).stdout.toString("utf8").trim();
+    } catch (error) {
+      if (error instanceof GitOperationError && error.detail.exitCode === 1) return "";
+      throw error;
+    }
+  }
+  async resolve(repository, push, selected) {
+    const branch = (await this.git.run(repository.path, ["branch", "--show-current"], read$1)).stdout.toString("utf8").trim() || null;
+    const remotes = (await this.git.run(repository.path, ["remote"], read$1)).stdout.toString("utf8").trim().split(/\r?\n/).filter(Boolean);
+    let remote = selected;
+    if (!remote) for (const key of [...push ? [`branch.${branch}.pushRemote`, "remote.pushDefault"] : [], `branch.${branch}.remote`]) {
+      remote = await this.config(repository, key);
+      if (remote) break;
+    }
+    if (!remote && !push && remotes.includes("origin")) remote = "origin";
+    remote ||= remotes.length === 1 ? remotes[0] : void 0;
+    let urls = [];
+    if (remote === ".") urls = ["."];
+    else if (remote && remotes.includes(remote)) urls = (await this.git.run(repository.path, ["remote", "get-url", ...push ? ["--push", "--all"] : [], "--", remote], read$1)).stdout.toString("utf8").trim().split(/\r?\n/).filter(Boolean);
+    else if (selected && !remotes.includes(selected)) {
+      urls = [(await this.git.run(repository.path, ["ls-remote", "--get-url", "--", selected], { ...read$1, operation: "resolve-git-url" })).stdout.toString("utf8").trim()];
+    }
+    return { branch, remotes, remote: remote ?? null, urls };
+  }
+  async publication(repositoryId, selected) {
+    const repository = this.repositories.get(repositoryId);
+    const selection = this.accounts.selection(repository);
+    const revision2 = this.accounts.revisionFor(repository);
+    const target = await this.resolve(repository, true, selected);
+    let oid = null;
+    try {
+      oid = (await this.git.run(repository.path, ["rev-parse", "--verify", "HEAD"], read$1)).stdout.toString("utf8").trim();
+    } catch {
+    }
+    const managed = selection.mode === "account" && selection.gitMode === "managed";
+    const compatible = target.urls.length === 1 && !!managedGitHubPath(target.urls[0]);
+    const configuration = (await this.git.run(repository.path, ["config", "--null", "--list"], read$1)).stdout.toString("utf8");
+    const upstreamRemote = await this.config(repository, `branch.${target.branch}.remote`);
+    const merge2 = await this.config(repository, `branch.${target.branch}.merge`, true);
+    const pushDefault = await this.config(repository, "push.default") || "simple";
+    const targetRef = target.branch ? target.remote === upstreamRemote && merge2 && ["simple", "upstream"].includes(pushDefault) ? merge2 : `refs/heads/${target.branch}` : null;
+    const unsafe = merge2 && (merge2.includes("\n") || !["simple", "upstream", "current"].includes(pushDefault) || pushDefault === "simple" && target.remote === upstreamRemote && merge2 !== `refs/heads/${target.branch}` || pushDefault === "upstream" && target.remote !== upstreamRemote || await this.config(repository, `remote.${target.remote}.push`) || await this.config(repository, `remote.${target.remote}.mirror`) === "true");
+    const blocked = selected && selected !== "." && !target.remotes.includes(selected) ? "The selected push remote is not configured. Review the repository remotes." : unsafe ? "The push refspec, mirror or push.default configuration requires review in Git before publishing." : target.urls.length > 1 ? "This remote has multiple push URLs. Choose a single destination in Git configuration before publishing." : target.remote && !target.urls.length ? "The configured push remote is unavailable." : managed && target.urls.some(isGitHubHttp) && !compatible ? "Managed Git requires a plain github.com HTTPS destination. Review the URL or use external authentication." : void 0;
+    return {
+      ...target,
+      urls: target.urls.map(redactSensitiveText),
+      repositoryId,
+      oid,
+      targetRef,
+      id: digest([repository.commonDir, selection, revision2, target, oid, configuration]),
+      mode: managed && compatible ? "managed" : "external",
+      login: managed && compatible && selection.mode === "account" ? selection.login : null,
+      ...blocked ? { blocked } : {}
+    };
+  }
+  async assertPublication(repositoryId, expected, remote) {
+    const current = await this.publication(repositoryId, remote);
+    if (expected && expected !== current.id) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: "push", message: "The account, branch or destination changed. Review the publication context and try again." });
+    if (current.blocked) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: "push", message: current.blocked });
+    return current;
+  }
+  async status(repositoryId, force = false, apiContext) {
+    const publication = await this.publication(repositoryId);
+    const repository = this.repositories.get(repositoryId);
+    const previous = this.checks.get(repositoryId);
+    const value = previous?.publication.id === publication.id ? structuredClone(previous) : {
+      publication,
+      identity: unchecked(),
+      api: unchecked(),
+      read: publication.mode === "external" ? { state: "external" } : unchecked(),
+      write: unchecked(),
+      checkedAt: null
+    };
+    const last = this.latest.get(repositoryId);
+    if (last) value.lastOperation = last;
+    if (!force) {
+      if (value.checkedAt && Date.now() - Date.parse(value.checkedAt) > 6e4) for (const key of ["identity", "api", "read", "write"]) {
+        if (value[key].state === "ok") value[key] = { state: "stale", message: value[key].message ?? "Check access again for a current result." };
+      }
+      return value;
+    }
+    value.identity = unchecked();
+    value.api = unchecked();
+    value.write = unchecked();
+    value.read = publication.mode === "external" ? { state: "external" } : unchecked();
+    const selection = this.accounts.selection(repository);
+    if (selection.mode !== "account") {
+      value.identity = { state: "unchecked", message: "Choose a saved account to pin access for this repository." };
+    } else {
+      try {
+        this.accounts.refreshAuthentication();
+        const { auth, executable } = await this.accounts.authenticate(repository, apiContext?.remote ?? "", apiContext?.nameWithOwner ?? "", "repository-access");
+        value.identity = { state: "ok" };
+        const origin = await this.resolve(repository, false, "origin");
+        const apiUrl = origin.urls[0] ?? "";
+        const apiPath = apiContext?.nameWithOwner ?? managedGitHubPath(apiUrl) ?? /^git@github\.com:([\w.-]+\/[\w.-]+)$/.exec(apiUrl)?.[1];
+        const checkApi = async (name) => {
+          try {
+            const result = await this.runner.run(executable.executable, ["api", `repos/${name.replace(/\.git$/, "")}`], {
+              cwd: repository.path,
+              env: { ...executable.env, ...GH_ENV, ...auth.env },
+              ...auth.removeEnv ? { removeEnv: auth.removeEnv } : {},
+              timeoutMs: 15e3,
+              maxOutputBytes: 128 * 1024
+            });
+            if (result.exitCode !== 0) {
+              const check = accessError(redactCommandToken(result.stderr, auth));
+              return { check, write: check };
+            }
+            const data = JSON.parse(result.stdout);
+            return { check: { state: "ok" }, write: typeof data.permissions?.push === "boolean" ? { state: data.permissions.push ? "ok" : "inaccessible", message: data.permissions.push ? "Write permission declared by GitHub; branch policies still apply." : "GitHub does not declare write permission." } : unchecked() };
+          } catch (error) {
+            const check = accessError(redactCommandToken(messageOf(error), auth));
+            return { check, write: check };
+          }
+        };
+        if (apiPath) value.api = (await checkApi(apiPath)).check;
+        const destination = publication.urls[0];
+        const pushPath = destination && managedGitHubPath(destination);
+        if (pushPath) value.write = (await checkApi(pushPath)).write;
+        if (publication.mode === "managed" && destination && !publication.blocked) {
+          try {
+            await this.git.withNetworkContext(repository.path, () => this.git.run(repository.path, ["ls-remote", "--", destination, "HEAD"], { ...read$1, timeoutMs: 3e4 }));
+            value.read = { state: "ok", message: "Read verified at the push destination. This does not guarantee a push." };
+          } catch (error) {
+            value.read = accessError(messageOf(error));
+          }
+        }
+      } catch (error) {
+        if (value.identity.state === "ok") value.api = accessError(messageOf(error));
+        else value.identity = accessError(messageOf(error));
+      }
+    }
+    if ((await this.publication(repositoryId)).id !== publication.id) return this.status(repositoryId, false, apiContext);
+    value.checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+    this.checks.set(repositoryId, value);
+    return value;
+  }
+  async execute(args, options, execute) {
+    const session = this.sessions.getStore();
+    const { repository, selection } = session;
+    let index = 0;
+    while (args[index] === "-c") index += 2;
+    const command2 = args[index];
+    if (command2 === "ls-remote" && args.includes("--get-url")) return execute(args, options);
+    const selected = args.slice(index + 1).find((arg) => !arg.startsWith("-"));
+    const target = await this.resolve(repository, command2 === "push", selected);
+    if (target.urls.length !== 1) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: options.operation, message: "The remote destination is ambiguous. Configure or choose a single remote URL." });
+    const url = target.urls[0];
+    if (selected?.includes("://") && selected !== url) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: options.operation, message: "URL rewriting changes the reviewed destination again. Resolve the chained rewrite before checking or publishing." });
+    const managed = selection.mode === "account" && selection.gitMode === "managed" && isGitHubHttp(url);
+    let broker;
+    let token = "";
+    try {
+      if (managed) {
+        if (!managedGitHubPath(url)) throw new Error("Managed Git cannot send credentials to this destination. Use external authentication for unsupported URLs.");
+        if (!session.auth) {
+          if (session.revision !== this.accounts.revisionFor(repository)) throw new Error("The repository account changed before the operation started. Review and retry.");
+          session.auth = await this.accounts.authenticate(repository, url, managedGitHubPath(url), options.operation);
+          if (session.revision !== this.accounts.revisionFor(repository) || digest(session.auth.context.selection) !== digest(selection)) throw new Error("The repository account changed before authentication completed. Review and retry.");
+        }
+        if (command2 === "fetch" && !selected && target.remote) args = [...args, "--", target.remote];
+        token = session.auth.auth.env?.GH_TOKEN ?? "";
+        broker = await createCredentialBroker(url, selection.login, token);
+        const config2 = (await this.git.run(repository.path, ["config", "--name-only", "--list"], read$1)).stdout.toString("utf8").trim().split(/\r?\n/);
+        const overrides = [...new Set(config2)].flatMap((key) => {
+          if (/^credential\..*helper$/i.test(key)) return ["-c", `${key}=`];
+          if (/^http\..*extraheader$/i.test(key)) return ["-c", `${key}=`];
+          if (/^http\..*followredirects$/i.test(key)) return ["-c", `${key}=false`];
+          if (/^http\..*sslverify$/i.test(key)) return ["-c", `${key}=true`];
+          if (/^credential\..*usehttppath$/i.test(key)) return ["-c", `${key}=true`];
+          return [];
+        });
+        args = [
+          ...overrides,
+          "-c",
+          "credential.helper=",
+          "-c",
+          `credential.helper=${broker.helper}`,
+          "-c",
+          "credential.useHttpPath=true",
+          "-c",
+          "core.askPass=",
+          "-c",
+          "http.extraHeader=",
+          "-c",
+          "http.followRedirects=false",
+          "-c",
+          "http.sslVerify=true",
+          "-c",
+          "fetch.recurseSubmodules=false",
+          "-c",
+          "push.recurseSubmodules=no",
+          ...args
+        ];
+      }
+      if (options.publication) await this.assertPublication(options.publication.repositoryId, options.publication.id, options.publication.remote);
+      const result = await execute(args, { ...options, ...managed ? { managed: true, managedSecrets: [token] } : {} });
+      this.latest.set(repository.id, { operation: options.operation, url: redactSensitiveText(url), login: managed && selection.mode === "account" ? selection.login : null, at: (/* @__PURE__ */ new Date()).toISOString(), ok: true });
+      return result;
+    } catch (error) {
+      const message = redactSensitiveText(token ? messageOf(error).split(token).join("[redacted]") : messageOf(error));
+      this.latest.set(repository.id, { operation: options.operation, url: redactSensitiveText(url), login: managed && selection.mode === "account" ? selection.login : null, at: (/* @__PURE__ */ new Date()).toISOString(), ok: false, message });
+      if (error instanceof GitOperationError) throw error;
+      throw new GitOperationError({ code: "UNKNOWN", operation: options.operation, message });
+    } finally {
+      await broker?.dispose();
+    }
+  }
+}
+function messageOf(error) {
+  return error instanceof Error ? error.message : "Could not check remote access.";
+}
+function accessError(message) {
+  return { state: /401|bad credentials|expired|revoked|no usable saved credentials/i.test(message) ? "expired" : /404|403|not found|denied|not accessible/i.test(message) ? "inaccessible" : "offline", message: redactSensitiveText(message).slice(0, 1500) };
+}
+function isGitHubHttp(value) {
+  try {
+    const url = new URL(value);
+    return ["http:", "https:"].includes(url.protocol) && url.hostname === "github.com";
+  } catch {
+    return false;
+  }
+}
 function normalizeLockKey(value) {
   const unified = value.replace(/\\/g, "/").replace(/\/+$/, "");
   return process.platform === "win32" ? unified.toLowerCase() : unified;
@@ -14845,7 +15290,21 @@ class GitProcess {
   activeControllers = /* @__PURE__ */ new Set();
   idleWaiters = /* @__PURE__ */ new Set();
   closePromise = null;
+  authenticationKey;
+  network;
+  networkScope;
+  withNetworkContext(cwd, task) {
+    return this.networkScope ? this.networkScope(cwd, task) : task();
+  }
   run(cwd, args, options) {
+    let index = 0;
+    while (args[index] === "-c") index += 2;
+    if (this.network && ["fetch", "push", "ls-remote"].includes(args[index] ?? "")) {
+      return this.network(cwd, args, options, (next, settings) => this.runDirect(cwd, next, settings));
+    }
+    return this.runDirect(cwd, args, options);
+  }
+  runDirect(cwd, args, options) {
     const globalArgs = ["--no-pager"];
     if (options.readOnly) globalArgs.push("--no-optional-locks");
     return this.spawnGit(cwd, [...globalArgs, ...args], options);
@@ -14901,6 +15360,10 @@ class GitProcess {
         LC_ALL: "C"
       }).filter((entry) => entry[1] !== void 0)
     );
+    if (options.managed) for (const key of Object.keys(environment)) {
+      if (/^(GH_TOKEN|GITHUB_TOKEN|GH_DEBUG|SSLKEYLOGFILE|GIT_SSL_NO_VERIFY|GIT_ASKPASS|SSH_ASKPASS|GIT_CONFIG.*|GIT_TRACE.*|GIT_CURL_VERBOSE)$/i.test(key)) delete environment[key];
+    }
+    const sanitize = (value) => redactSensitiveText((options.managedSecrets ?? []).reduce((text2, secret) => text2.split(secret).join("[redacted]"), value));
     const resolvedCommand = resolveProcessCommand("git", cwd, environment);
     const outputLimit = new AbortController();
     const lifecycle = new AbortController();
@@ -14940,8 +15403,8 @@ class GitProcess {
       childPid = subprocess.pid;
       if (childPid) this.activeChildren.add(childPid);
       const result = await subprocess;
-      const stdout = Buffer.from(result.stdout);
-      const stderr = Buffer.from(result.stderr);
+      const stdout = options.managed ? Buffer.from(sanitize(Buffer.from(result.stdout).toString("utf8"))) : Buffer.from(result.stdout);
+      const stderr = Buffer.from(sanitize(Buffer.from(result.stderr).toString("utf8")));
       if (overLimit || result.isMaxBuffer) {
         if (options.truncateOverflow) return { stdout, stderr, exitCode: 0, truncated: true };
         throw new GitOperationError({ code: "OUTPUT_LIMIT", operation: options.operation, message: "Git output exceeded the safety limit." });
@@ -14952,11 +15415,11 @@ class GitProcess {
       if (result.exitCode === void 0 || !resolvedCommand.found) {
         throw this.mapError(options.operation, Object.assign(new Error("Git was not found in PATH."), { code: "ENOENT" }));
       }
-      if (result.exitCode !== 0) throw this.fromExit(options.operation, result.exitCode, stderr.toString("utf8"));
+      if (result.exitCode !== 0) throw this.fromExit(options.operation, result.exitCode, sanitize(`${stderr.toString("utf8")}${options.operation.includes("push") || options.operation === "publish-branch" ? "\n" + stdout.toString("utf8") : ""}`));
       return { stdout, stderr, exitCode: result.exitCode };
     } catch (error) {
       if (error instanceof GitOperationError) throw error;
-      throw this.mapError(options.operation, error);
+      throw this.mapError(options.operation, Object.assign(new Error(sanitize(error instanceof Error ? error.message : "Could not start Git.")), { code: error?.code }));
     } finally {
       if (childPid) this.activeChildren.delete(childPid);
       this.activeControllers.delete(lifecycle);
@@ -15482,10 +15945,10 @@ class GitRemoteBranches {
     });
     return { branch, ...mappings[0], branchName: mappings[0].sourceRef.slice("refs/heads/".length) };
   }
-  async destination(target, run) {
+  async destination(target, run, root) {
     const fetchUrls = (await run(["remote", "get-url", "--all", "--", target.remote], read)).stdout.toString("utf8").trim().split(/\r?\n/);
     const pushUrls = (await run(["remote", "get-url", "--push", "--all", "--", target.remote], read)).stdout.toString("utf8").trim().split(/\r?\n/);
-    const id = createHash("sha256").update(JSON.stringify([target.remote, target.sourceRef, fetchUrls, pushUrls])).digest("hex");
+    const id = createHash("sha256").update(JSON.stringify([target.remote, target.sourceRef, fetchUrls, pushUrls, this.git.authenticationKey?.(root)])).digest("hex");
     const blocked = fetchUrls.length !== 1 || pushUrls.length !== 1 || fetchUrls[0] !== pushUrls[0] ? "Fetch and push destinations differ or have multiple URLs. Manage remote deletion outside OpenTig." : null;
     return { id, blocked, url: fetchUrls[0] };
   }
@@ -15499,7 +15962,7 @@ class GitRemoteBranches {
     const run = this.reader(this.repositories.get(repositoryId).path);
     const target = await this.target(fullName, run);
     if (!target) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: "remote-branch-details", message: "The remote reference no longer exists. Fetch branches again." });
-    const destination = await this.destination(target, run);
+    const destination = await this.destination(target, run, this.repositories.get(repositoryId).path);
     let blocked = destination.blocked;
     let defaultRef = null;
     let remoteState = "unchecked";
@@ -15547,7 +16010,7 @@ class GitRemoteBranches {
       const target = await this.target(request.fullName, run);
       if (!target) return { status: "missing" };
       if (target.branch.oid !== request.expectedOid) return { status: "stale" };
-      const destination = await this.destination(target, run);
+      const destination = await this.destination(target, run, repository.path);
       if (destination.id !== request.destinationId) return { status: "destination-changed" };
       if (destination.blocked) return { status: "rejected", message: destination.blocked };
       try {
@@ -15616,6 +16079,11 @@ class GitRepositoryOperations {
   git;
   repositories;
   files;
+  access;
+  publicationContext(repositoryId, remote) {
+    if (!this.access) throw new Error("Repository access is unavailable.");
+    return this.access.publication(repositoryId, remote);
+  }
   knownOids = /* @__PURE__ */ new Map();
   authorship;
   remoteBranches;
@@ -15626,10 +16094,10 @@ class GitRepositoryOperations {
     return this.remoteBranches.create(request);
   }
   deleteRemoteBranch(request) {
-    return this.remoteBranches.delete(request);
+    return this.git.withNetworkContext(this.repositories.get(request.repositoryId).path, () => this.remoteBranches.delete(request));
   }
   fetchBranches(repositoryId) {
-    return this.remoteBranches.fetch(repositoryId);
+    return this.git.withNetworkContext(this.repositories.get(repositoryId).path, () => this.remoteBranches.fetch(repositoryId));
   }
   getCommitAuthorship(repositoryId) {
     return this.authorship.get(repositoryId);
@@ -16040,6 +16508,9 @@ ${base}
     }, repository.commonDir);
   }
   async fetch(repositoryId) {
+    return this.git.withNetworkContext(this.repositories.get(repositoryId).path, () => this.fetchInContext(repositoryId));
+  }
+  async fetchInContext(repositoryId) {
     const repository = this.repositories.get(repositoryId);
     try {
       await this.runFetch(repository.path, "fetch");
@@ -16051,6 +16522,9 @@ ${base}
     return { status: "success", ahead: status.ahead, behind: status.behind };
   }
   async pull(repositoryId) {
+    return this.git.withNetworkContext(this.repositories.get(repositoryId).path, () => this.pullInContext(repositoryId));
+  }
+  async pullInContext(repositoryId) {
     const repository = this.repositories.get(repositoryId);
     let status = await this.repositories.status(repositoryId, false);
     const existingConflicts = conflictPaths(status);
@@ -16127,7 +16601,47 @@ ${base}
     const nextStatus = await this.repositories.status(repositoryId, false);
     return { status: "success", commits, restoredLocalChanges: hasLocalChanges, rebased, localCommits: nextStatus.ahead };
   }
-  async push(repositoryId, publish) {
+  async push(repositoryId, publish, expectedContext) {
+    if (this.access) return this.pushWithContext(repositoryId, publish, expectedContext);
+    return this.legacyPush(repositoryId, publish);
+  }
+  async pushWithContext(repositoryId, publish, expectedContext) {
+    const repository = this.repositories.get(repositoryId);
+    try {
+      const reviewed = await this.access.assertPublication(repositoryId, expectedContext, publish?.remote);
+      return await this.git.withNetworkContext(repository.path, () => this.git.runWriteTask(repository.path, async (run) => {
+        const context = await this.access.assertPublication(repositoryId, reviewed.id, publish?.remote);
+        const status = await this.repositories.status(repositoryId, false);
+        const conflicts = conflictPaths(status);
+        if (conflicts.length) return { status: "blocked-conflicts", files: conflicts };
+        if (status.operation) return { status: "blocked-operation", operation: status.operation };
+        if (!context.branch || !context.oid || !context.targetRef) return { status: "rejected", reason: "configuration", message: "Check out a branch with a commit before publishing." };
+        if (publish && (publish.expectedBranch !== context.branch || publish.expectedOid !== context.oid)) return { status: "rejected", reason: "configuration", message: "The branch changed. Review and try again." };
+        if (!context.remote) return context.remotes.length ? { status: "remote-required", branch: context.branch, oid: context.oid, remotes: context.remotes } : { status: "rejected", reason: "configuration", message: "No remote is configured." };
+        const result = await run([
+          "-c",
+          `remote.${context.remote}.mirror=false`,
+          "push",
+          "--porcelain",
+          "--no-follow-tags",
+          ...!status.upstream ? ["--set-upstream"] : [],
+          "--",
+          context.remote,
+          `refs/heads/${context.branch}:${context.targetRef}`
+        ], {
+          operation: "push",
+          timeoutMs: 12e4,
+          maxOutputBytes: 4 * 1024 * 1024,
+          publication: { repositoryId, id: context.id, ...publish?.remote ? { remote: publish.remote } : {} }
+        });
+        if (!status.upstream) return { status: "published", branch: context.branch, remote: context.remote };
+        return result.stdout.toString("utf8").includes("[up to date]") ? { status: "up-to-date" } : { status: "success", commits: status.ahead };
+      }, repository.commonDir));
+    } catch (error) {
+      return pushFailure(error);
+    }
+  }
+  async legacyPush(repositoryId, publish) {
     const repository = this.repositories.get(repositoryId);
     let status = await this.repositories.status(repositoryId, false);
     const existingConflicts = conflictPaths(status);
@@ -16625,24 +17139,20 @@ function bounded(value, limit) {
 }
 function pushFailure(error) {
   const detail = error instanceof GitOperationError ? error.detail : null;
-  const raw = `${detail?.stderr ?? ""}
-${detail?.message ?? (error instanceof Error ? error.message : "")}`.toLowerCase();
-  if (/authentication failed|permission denied|could not read username|access denied|publickey/.test(raw)) {
-    return { status: "rejected", reason: "authentication", message: "The remote rejected the credentials or you do not have permission to push." };
-  }
-  if (/non-fast-forward|fetch first|stale info|failed to push some refs/.test(raw)) {
-    return { status: "rejected", reason: "remote-changed", message: "The remote contains new changes. Update the branch and try again." };
-  }
-  if (/hook declined|pre-receive hook|protected branch|remote rejected/.test(raw)) {
-    return { status: "rejected", reason: "hook", message: "The server rejected the push because of a rule or branch protection." };
-  }
-  if (/could not resolve host|unable to access|connection timed out|connection reset|network is unreachable/.test(raw)) {
-    return { status: "rejected", reason: "network", message: "Could not connect to the remote. Check your network and try again." };
-  }
-  if (/upstream branch .* does not match|no upstream branch|push\.default/.test(raw)) {
-    return { status: "rejected", reason: "configuration", message: "The local branch and its upstream do not allow a safe push with the current configuration." };
-  }
-  return { status: "rejected", reason: "unknown", message: "Git rejected the push. No force push was performed." };
+  const message = redactSensitiveText(detail?.stderr || detail?.message || (error instanceof Error ? error.message : "Git rejected the push.")).trim().slice(0, 3e3);
+  const raw = message.toLowerCase();
+  let reason = "unknown";
+  let explanation = "";
+  if (/repository not found|repository .* not found|(?:http|error:)\s*404/.test(raw)) {
+    reason = "inaccessible";
+    explanation = "The repository is missing or inaccessible to this account. ";
+  } else if (/authentication failed|could not read username|bad credentials|expired|revoked|no usable saved credentials|publickey|(?:http|error:)\s*401/.test(raw)) reason = "authentication";
+  else if (/protected branch|hook declined|pre-receive hook|remote rejected|gh006|gh013|repository rule/.test(raw)) reason = "hook";
+  else if (/permission.*denied|write access.*not granted|access denied|(?:http|error:)\s*403/.test(raw)) reason = "permission";
+  else if (/non-fast-forward|fetch first|stale info/.test(raw)) reason = "remote-changed";
+  else if (/could not resolve host|unable to access|connection.*(timed out|reset|refused)|network is unreachable|(?:http|error:)\s*50[0-4]/.test(raw)) reason = "network";
+  else if (detail?.code === "INVALID_ARGUMENT" || /upstream branch .* does not match|no upstream branch|push\.default|context|account changed/.test(raw)) reason = "configuration";
+  return { status: "rejected", reason, message: explanation + message };
 }
 function makeDiffResult(path2, buffer) {
   const patch = buffer.toString("utf8");
@@ -16654,7 +17164,6 @@ const MAX_REPOSITORY_PROJECTS = 50;
 const MAX_PROJECT_NAME_LENGTH = 60;
 const MAX_REPOSITORIES_PER_PROJECT = 200;
 const MAX_REPOSITORY_KEY_LENGTH = 2048;
-const UNASSIGNED_RECENT_LIMIT = 10;
 function normalizeRepositoryKey(commonDir) {
   return commonDir.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
 }
@@ -16682,8 +17191,23 @@ class RepositoryService {
     return this.openPath(recent.path);
   }
   async openPath(selectedPath) {
+    const repository = await this.preparePath(selectedPath);
+    await this.settings.touchRepository(repository);
+    return repository;
+  }
+  /** Inspect/cache only: no recent entry, active repository, or persistence. */
+  async preparePath(selectedPath) {
     const repository = await this.inspectPath(selectedPath);
     this.repositories.set(repository.id, repository);
+    return repository;
+  }
+  async completeSetup(id, validate2 = () => void 0) {
+    const prepared = this.get(id);
+    const repository = await this.inspectPath(prepared.path);
+    if (repository.id !== prepared.id || repository.commonDir !== prepared.commonDir) {
+      throw new Error("The repository location changed. Select the folder again.");
+    }
+    validate2();
     await this.settings.touchRepository(repository);
     return repository;
   }
@@ -17180,133 +17704,13 @@ function invalidReplacement(message) {
 }
 const githubAccountSelectionSchema = discriminatedUnion("mode", [
   object({ mode: literal("auto") }),
-  object({ mode: literal("account"), host: literal("github.com"), login: string().regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/) })
+  object({ mode: literal("account"), host: literal("github.com"), login: string().regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/), gitMode: _enum(["external", "managed"]).optional(), useGlobalDefault: boolean().optional() })
 ]);
 const AUTOMATIC_GITHUB_ACCOUNT = { mode: "auto" };
 function githubRepositoryKey(commonDir, platform2 = process.platform) {
   const key = commonDir.replace(/\\/g, "/").replace(/\/+$/, "");
   return platform2 === "win32" ? key.toLowerCase() : key;
 }
-const OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/;
-const REPO_PATTERN = /^[A-Za-z0-9._-]+$/;
-function parseGitHubRemote(url) {
-  const trimmed = url.trim();
-  if (!trimmed) return null;
-  let rest = null;
-  const https = /^https?:\/\/(?:[^@/\s]+@)?github\.com\/(.+)$/i.exec(trimmed);
-  const ssh = /^ssh:\/\/(?:[^@/\s]+@)?github\.com(?::\d+)?\/(.+)$/i.exec(trimmed);
-  const scp = /^(?:[^@\s]+)@github\.com:(.+)$/i.exec(trimmed);
-  const git = /^git:\/\/github\.com\/(.+)$/i.exec(trimmed);
-  if (https) rest = https[1] ?? null;
-  else if (ssh) rest = ssh[1] ?? null;
-  else if (scp) rest = scp[1] ?? null;
-  else if (git) rest = git[1] ?? null;
-  if (!rest) return null;
-  const segments = rest.replace(/\/+$/, "").split("/");
-  if (segments.length !== 2) return null;
-  const owner = segments[0] ?? "";
-  const repo = (segments[1] ?? "").replace(/\.git$/i, "");
-  if (!OWNER_PATTERN.test(owner) || !repo || repo === "." || repo === ".." || !REPO_PATTERN.test(repo)) return null;
-  return { nameWithOwner: `${owner}/${repo}` };
-}
-function parseSshRemote(url) {
-  const trimmed = url.trim();
-  const ssh = /^ssh:\/\/(?:(\w[\w.-]*)@)?([A-Za-z0-9][A-Za-z0-9._-]*)(?::(\d+))?\/(.+)$/i.exec(trimmed);
-  const scp = /^(?:(\w[\w.-]*)@)?([A-Za-z0-9][A-Za-z0-9._-]*):(.+)$/.exec(trimmed);
-  const match = ssh ?? scp;
-  if (!match) return null;
-  const parsed = parseGitHubRemote(`https://github.com/${ssh ? match[4] : match[3]}`);
-  if (!parsed) return null;
-  return { destination: `${match[1] ? `${match[1]}@` : ""}${match[2]}`, port: ssh ? match[3] ?? null : null, ...parsed };
-}
-const GITHUB_LOGIN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/;
-function parseGitHubAuthStatus(raw) {
-  const input = JSON.parse(raw);
-  if (!input || typeof input !== "object" || !("hosts" in input) || !input.hosts || typeof input.hosts !== "object") throw new Error("Invalid gh status");
-  const entries = input.hosts["github.com"] ?? [];
-  if (!Array.isArray(entries) || entries.length > 100) throw new Error("Invalid gh accounts");
-  const accounts = [];
-  for (const entry of entries) {
-    if (!entry || typeof entry !== "object" || typeof entry.login !== "string" || !GITHUB_LOGIN.test(entry.login)) continue;
-    accounts.push({
-      host: "github.com",
-      login: entry.login,
-      active: entry.active === true,
-      state: entry.state === "success" ? "authenticated" : entry.state === "error" ? "invalid" : "unknown",
-      storage: entry.tokenSource === "keyring" ? "keyring" : typeof entry.tokenSource === "string" && (entry.tokenSource === "oauth_token" || /(?:^|[/\\])hosts\.yml$/.test(entry.tokenSource)) ? "file" : "unknown",
-      ...typeof entry.scopes === "string" && /^[A-Za-z0-9_:, -]{0,500}$/.test(entry.scopes) ? { scopes: entry.scopes } : {}
-    });
-  }
-  return { accounts, activeLogin: accounts.find((account) => account.active)?.login ?? null };
-}
-const GH_ENV = { GH_HOST: "github.com", GH_PROMPT_DISABLED: "1", GH_NO_UPDATE_NOTIFIER: "1", GH_PAGER: "cat", NO_COLOR: "1" };
-const GH_PRIVATE_ENV = ["GITHUB_TOKEN", "GH_DEBUG", "DEBUG"];
-async function identifySshAccount(remote, runner) {
-  const ssh = parseSshRemote(remote);
-  if (!ssh) return null;
-  try {
-    const config2 = await runner.run("ssh", ["-G", ...ssh.port ? ["-p", ssh.port] : [], "--", ssh.destination], {
-      cwd: os.homedir(),
-      timeoutMs: 5e3,
-      maxOutputBytes: 64 * 1024
-    });
-    const hostname = config2.stdout.split(/\r?\n/).find((line) => /^hostname\s/i.test(line))?.trim().split(/\s+/)[1];
-    if (config2.exitCode !== 0 || hostname?.toLowerCase() !== "github.com") return null;
-    const result = await runner.run("ssh", [
-      "-T",
-      "-o",
-      "BatchMode=yes",
-      "-o",
-      "StrictHostKeyChecking=yes",
-      "-o",
-      "ConnectTimeout=5",
-      "-o",
-      "ConnectionAttempts=1",
-      "-o",
-      "RemoteCommand=none",
-      "-o",
-      "UpdateHostKeys=no",
-      ...ssh.port ? ["-p", ssh.port] : [],
-      "--",
-      ssh.destination
-    ], { cwd: os.homedir(), timeoutMs: 1e4, maxOutputBytes: 64 * 1024 });
-    if (result.exitCode !== 0 && result.exitCode !== 1) return null;
-    const login2 = /^Hi ([A-Za-z0-9-]+)! You've successfully authenticated, but GitHub does not provide shell access\.\s*$/m.exec(`${result.stdout}
-${result.stderr}`)?.[1];
-    return login2 && GITHUB_LOGIN.test(login2) ? login2 : null;
-  } catch {
-    return null;
-  }
-}
-async function accountAuthentication(login2, executable, runner, operation) {
-  try {
-    const result = await runner.run(executable.executable, ["auth", "token", "--hostname", "github.com", ...login2 ? ["--user", login2] : []], {
-      cwd: os.homedir(),
-      env: { ...executable.env, ...GH_ENV },
-      removeEnv: login2 ? ["GH_TOKEN", ...GH_PRIVATE_ENV] : ["GH_DEBUG", "DEBUG"],
-      timeoutMs: 1e4,
-      maxOutputBytes: 8 * 1024
-    });
-    const token = result.stdout.trim();
-    if (result.exitCode === 0 && /^[A-Za-z0-9_]{20,4096}$/.test(token)) return { env: { GH_TOKEN: token }, removeEnv: GH_PRIVATE_ENV };
-    if (/unknown flag.*user/i.test(result.stderr)) throw new GhOperationError({
-      code: "GH_CLI_INCOMPATIBLE",
-      operation,
-      message: "Update GitHub CLI to a version supporting multiple accounts and auth token --user."
-    });
-  } catch (error) {
-    if (error instanceof GhOperationError) throw error;
-  }
-  throw new GhOperationError({
-    code: login2 ? "GH_ACCOUNT_MISSING" : "GH_AUTH_REQUIRED",
-    operation,
-    message: login2 ? `GitHub CLI has no usable saved credentials for @${login2}. Sign in as ${login2} on the backend host and check Settings → GitHub again. SSH and GitHub CLI authentication are separate.` : "GitHub CLI has no usable credentials. Sign in on the backend host and check Settings → GitHub again."
-  });
-}
-function redactCommandToken(value, auth) {
-  const token = auth.env?.GH_TOKEN;
-  return token ? value.split(token).join("[redacted]") : value;
-}
 const CACHE_MS = 6e4;
 const emptyStatus = () => ({
   installationStatus: "unchecked",
@@ -17338,6 +17742,15 @@ class GitHubAccountsService {
   get authRevision() {
     return this.revision;
   }
+  revisions = /* @__PURE__ */ new Map();
+  defaultRevision = 0;
+  revisionFor(repository) {
+    const selection = this.selection(repository);
+    return Math.max(
+      this.revisions.get(githubRepositoryKey(repository.commonDir)) ?? 0,
+      selection.mode === "account" && selection.useGlobalDefault ? this.defaultRevision : 0
+    );
+  }
   contexts = /* @__PURE__ */ new Map();
   ssh = /* @__PURE__ */ new Map();
   identities = /* @__PURE__ */ new Map();
@@ -17346,20 +17759,20 @@ class GitHubAccountsService {
       this.checking ??= this.check().finally(() => {
         this.checking = null;
       });
-      return this.checking.then((value) => structuredClone(value));
+      return this.checking.then((value) => ({ ...structuredClone(value), defaultLogin: this.settings?.githubDefaultLogin ?? null }));
     }
     this.loading ??= (async () => {
       this.inventory ??= await this.store?.load() ?? emptyStatus();
       return this.inventory;
     })();
-    return this.loading.then(() => structuredClone(this.inventory ?? emptyStatus()));
+    return this.loading.then(() => ({ ...structuredClone(this.inventory ?? emptyStatus()), defaultLogin: this.settings?.githubDefaultLogin ?? null }));
   }
   selection(repository) {
     return this.settings?.githubAccount(repository.commonDir) ?? { ...AUTOMATIC_GITHUB_ACCOUNT };
   }
   context(repository, remote, nameWithOwner) {
     const cached2 = this.contexts.get(repository.id);
-    if (cached2?.remote === remote && cached2.value.revision === this.revision) return structuredClone(cached2.value);
+    if (cached2?.remote === remote && cached2.value.revision === this.revisionFor(repository)) return structuredClone(cached2.value);
     const selection = this.selection(repository);
     return {
       selection,
@@ -17368,20 +17781,41 @@ class GitHubAccountsService {
       source: selection.mode === "account" ? "explicit" : null,
       state: "unchecked",
       checkedAt: null,
-      revision: this.revision
+      revision: this.revisionFor(repository)
     };
   }
   async setSelection(repository, selection) {
     if (!this.settings) throw new Error("GitHub account settings are unavailable.");
-    await this.settings.setGitHubAccount(repository.commonDir, selection);
-    this.invalidate();
+    const saving = this.settings.setGitHubAccount(repository.commonDir, selection);
+    this.invalidate(repository);
+    try {
+      await saving;
+    } catch (error) {
+      this.invalidate(repository);
+      throw error;
+    }
   }
-  invalidate() {
+  async setDefaultAccount(login2) {
+    if (!this.settings) throw new Error("GitHub account settings are unavailable.");
+    this.defaultRevision = ++this.revision;
+    try {
+      await this.settings.setGitHubDefaultLogin(login2);
+    } finally {
+      this.changed(void 0, true);
+    }
+    return this.status();
+  }
+  invalidate(repository) {
     this.revision++;
-    this.contexts.clear();
+    if (repository) {
+      const key = githubRepositoryKey(repository.commonDir);
+      this.revisions.set(key, this.revision);
+    } else {
+      this.contexts.clear();
+    }
     this.ssh.clear();
     this.identities.clear();
-    this.changed();
+    this.changed(repository);
   }
   refreshAuthentication() {
     this.ssh.clear();
@@ -17397,7 +17831,7 @@ class GitHubAccountsService {
     return this.detection.promise;
   }
   async authenticate(repository, remote, nameWithOwner, operation) {
-    const revision2 = this.revision;
+    const revision2 = this.revisionFor(repository);
     const selection = this.selection(repository);
     let login2 = selection.mode === "account" ? selection.login : null;
     let source = selection.mode === "account" ? "explicit" : null;
@@ -17445,18 +17879,18 @@ class GitHubAccountsService {
       });
       login2 = verified;
       const context = { selection, nameWithOwner, login: login2, source, state: "ready", checkedAt: (/* @__PURE__ */ new Date()).toISOString(), revision: revision2 };
-      if (revision2 === this.revision) {
+      if (revision2 === this.revisionFor(repository)) {
         const previous = this.contexts.get(repository.id)?.value;
-        if (previous?.state === "ready" && (previous.login?.toLowerCase() !== login2.toLowerCase() || previous.source !== source)) {
-          this.invalidate();
-          context.revision = this.revision;
+        if (previous?.state === "ready" && previous.revision === revision2 && (previous.login?.toLowerCase() !== login2.toLowerCase() || previous.source !== source)) {
+          this.invalidate(repository);
+          context.revision = this.revisionFor(repository);
         }
         this.contexts.set(repository.id, { remote, value: context });
       }
       return { auth, executable, context };
     } catch (error) {
       const message = error instanceof GhOperationError ? error.message : "Could not inspect GitHub authentication. Check Settings → GitHub again.";
-      if (revision2 === this.revision) this.contexts.set(repository.id, { remote, value: {
+      if (revision2 === this.revisionFor(repository)) this.contexts.set(repository.id, { remote, value: {
         selection,
         nameWithOwner,
         login: login2,
@@ -17674,6 +18108,15 @@ function parsePullRequestList(raw) {
   if (!list.success) throw invalidOutput("gh-pr-list");
   return list.data.map((item) => parseSummary(item, "gh-pr-list"));
 }
+function parseBranchPullRequestList(raw, nameWithOwner, branch) {
+  const list = pullRequestArraySchema.safeParse(parseJson(raw, "gh-pr-for-branch"));
+  if (!list.success) throw invalidOutput("gh-pr-for-branch");
+  const headSchema = looseObject({ headRefName: string(), headRepository: looseObject({ nameWithOwner: string() }) });
+  return list.data.filter((item) => {
+    const head = headSchema.safeParse(item);
+    return head.success && head.data.headRefName === branch && head.data.headRepository.nameWithOwner.toLowerCase() === nameWithOwner.toLowerCase();
+  }).map((item) => parseSummary(item, "gh-pr-for-branch"));
+}
 function parsePullRequestDetails(raw) {
   const item = parseJson(raw, "gh-pr-view");
   const summary = parseSummary(item, "gh-pr-view");
@@ -17816,6 +18259,7 @@ class GitHubService {
   runner;
   git;
   repositories;
+  gitAccess;
   accounts;
   async status(forceRefresh = false) {
     if (forceRefresh) this.accounts.refreshAuthentication();
@@ -17832,33 +18276,33 @@ class GitHubService {
     const repository = this.repositories.get(repositoryId);
     const info = await this.repositoryInfo(repositoryId);
     const remote = await this.remote(repositoryId);
-    if (forceRefresh && info.nameWithOwner) {
+    if (forceRefresh && info.nameWithOwner && !this.gitAccess) {
       this.accounts.refreshAuthentication();
       try {
         await this.accounts.authenticate(repository, remote, info.nameWithOwner, "gh-repository-account");
       } catch {
       }
     }
-    return this.accounts.context(repository, remote, info.nameWithOwner);
+    const access2 = await this.gitAccess?.status(repositoryId, forceRefresh, { remote, nameWithOwner: info.nameWithOwner });
+    return { ...this.accounts.context(repository, remote, info.nameWithOwner), ...access2 ? { access: access2 } : {} };
   }
-  async setRepositoryAccount(repositoryId, selection) {
+  async setRepositoryAccount(repositoryId, selection, expectedRevision) {
+    if (expectedRevision !== void 0 && expectedRevision !== this.accounts.revisionFor(this.repositories.get(repositoryId))) throw new Error("The repository account changed in another session. Reopen the account setup and review it.");
     await this.accounts.setSelection(this.repositories.get(repositoryId), selection);
     return this.repositoryAccount(repositoryId);
   }
   async remote(repositoryId) {
     const repository = this.repositories.get(repositoryId);
     try {
-      const output = await this.git.run(repository.path, ["config", "--get", "remote.origin.url"], { operation: "github-remote-url", readOnly: true, maxOutputBytes: 64 * 1024 });
+      const output = await this.git.run(repository.path, ["remote", "get-url", "--", "origin"], { operation: "github-remote-url", readOnly: true, maxOutputBytes: 64 * 1024 });
       return output.stdout.toString("utf8").trim();
     } catch {
       return "";
     }
   }
   async repositoryInfo(repositoryId) {
-    const repository = this.repositories.get(repositoryId);
     try {
-      const output = await this.git.run(repository.path, ["config", "--get", "remote.origin.url"], { operation: "github-remote-url", readOnly: true, maxOutputBytes: 64 * 1024 });
-      const url = output.stdout.toString("utf8");
+      const url = await this.remote(repositoryId);
       let parsed = parseGitHubRemote(url);
       if (!parsed) {
         const ssh = parseSshRemote(url);
@@ -17890,16 +18334,16 @@ class GitHubService {
     const { repository, nameWithOwner, auth, executable } = await this.requireGitHub(repositoryId, operation);
     const branch = validateRef(branchName, operation);
     const openResult = await this.runGh(
-      ["pr", "list", "-R", nameWithOwner, "--head", branch, "--state", "open", "--json", PR_SUMMARY_FIELDS, "--limit", "10"],
+      ["pr", "list", "-R", nameWithOwner, "--head", branch, "--state", "open", "--json", `${PR_SUMMARY_FIELDS},headRepository`, "--limit", "10"],
       { auth, executable, cwd: repository.path, operation, timeoutMs: NETWORK_TIMEOUT_MS, maxOutputBytes: 1024 * 1024 }
     );
-    const openPull = sortPullRequestsNewestFirst(parsePullRequestList(openResult.stdout)).find((pull) => pull.state === "OPEN");
+    const openPull = sortPullRequestsNewestFirst(parseBranchPullRequestList(openResult.stdout, nameWithOwner, branch)).find((pull) => pull.state === "OPEN");
     if (openPull) return openPull;
     const result = await this.runGh(
-      ["pr", "list", "-R", nameWithOwner, "--head", branch, "--state", "all", "--json", PR_SUMMARY_FIELDS, "--limit", "10"],
+      ["pr", "list", "-R", nameWithOwner, "--head", branch, "--state", "all", "--json", `${PR_SUMMARY_FIELDS},headRepository`, "--limit", "10"],
       { auth, executable, cwd: repository.path, operation, timeoutMs: NETWORK_TIMEOUT_MS, maxOutputBytes: 1024 * 1024 }
     );
-    return sortPullRequestsNewestFirst(parsePullRequestList(result.stdout))[0] ?? null;
+    return sortPullRequestsNewestFirst(parseBranchPullRequestList(result.stdout, nameWithOwner, branch))[0] ?? null;
   }
   async getPullRequest(repositoryId, prNumber) {
     const { repository, nameWithOwner, auth, executable } = await this.requireGitHub(repositoryId, "gh-pr-view");
@@ -17983,7 +18427,7 @@ class GitHubService {
     const operation = "gh-pr-create";
     const { repository, nameWithOwner, auth, executable, context } = await this.requireGitHub(input.repositoryId, operation);
     const verifyAccount = () => {
-      if (input.expectedAccount && (input.expectedAccount.revision !== this.accounts.authRevision || input.expectedAccount.revision !== context.revision || input.expectedAccount.login.toLowerCase() !== context.login?.toLowerCase())) {
+      if (input.expectedAccount && (input.expectedAccount.revision !== this.accounts.revisionFor(repository) || input.expectedAccount.revision !== context.revision || input.expectedAccount.login.toLowerCase() !== context.login?.toLowerCase())) {
         throw new GhOperationError({ code: "GH_ACCOUNT_UNRESOLVED", operation, message: "The GitHub account changed. Review the current identity before creating the pull request." });
       }
     };
@@ -18524,10 +18968,11 @@ function normalizeRemoteFetchIntervalSeconds(value) {
     Math.max(MIN_REMOTE_FETCH_INTERVAL_SECONDS, stepped)
   );
 }
-const SETTINGS_SCHEMA_VERSION = 1;
+const SETTINGS_SCHEMA_VERSION = 2;
 const defaults = {
   version: SETTINGS_SCHEMA_VERSION,
   githubAccounts: {},
+  githubDefaultLogin: null,
   recentRepositories: [],
   repositoryProjects: [],
   filesTreeStates: [],
@@ -18632,10 +19077,33 @@ class SettingsStore {
     return { ...this.data.windowBounds };
   }
   githubAccount(commonDir) {
-    return { ...this.data.githubAccounts[githubRepositoryKey(commonDir)] ?? AUTOMATIC_GITHUB_ACCOUNT };
+    const selection = this.data.githubAccounts[githubRepositoryKey(commonDir)] ?? AUTOMATIC_GITHUB_ACCOUNT;
+    if (selection.mode === "account" && selection.useGlobalDefault) {
+      if (!this.data.githubDefaultLogin) throw new Error("Choose an OpenTig default account in Settings → GitHub.");
+      return { ...selection, login: this.data.githubDefaultLogin };
+    }
+    return { ...selection };
+  }
+  get githubDefaultLogin() {
+    return this.data.githubDefaultLogin;
+  }
+  async setGitHubDefaultLogin(login2) {
+    const parsed = githubAccountSelectionSchema.parse({ mode: "account", host: "github.com", login: login2 });
+    if (parsed.mode !== "account") throw new Error("Invalid default account.");
+    const previous = this.data.githubDefaultLogin;
+    this.data.githubDefaultLogin = parsed.login;
+    try {
+      await this.save();
+    } catch (error) {
+      if (this.data.githubDefaultLogin === parsed.login) this.data.githubDefaultLogin = previous;
+      throw error;
+    }
   }
   async setGitHubAccount(commonDir, selection) {
     const parsed = githubAccountSelectionSchema.parse(selection);
+    if (parsed.mode === "account" && parsed.useGlobalDefault && parsed.login.toLowerCase() !== this.data.githubDefaultLogin?.toLowerCase()) {
+      throw new Error("The OpenTig default account changed. Review the current account and try again.");
+    }
     const key = githubRepositoryKey(commonDir);
     const previous = this.data.githubAccounts[key];
     if (parsed.mode === "auto") delete this.data.githubAccounts[key];
@@ -18652,9 +19120,9 @@ class SettingsStore {
   }
   async touchRepository(repository) {
     const recent = { ...repository, lastOpenedAt: (/* @__PURE__ */ new Date()).toISOString() };
-    this.data.recentRepositories = [recent, ...this.data.recentRepositories.filter((item) => item.id !== repository.id)];
+    const existing = this.data.recentRepositories.some((item) => item.id === repository.id);
+    this.data.recentRepositories = existing ? this.data.recentRepositories.map((item) => item.id === repository.id ? recent : item) : [...this.data.recentRepositories, recent];
     this.data.activeRepositoryId = repository.id;
-    this.pruneRecentRepositories();
     await this.save();
   }
   /**
@@ -18683,12 +19151,8 @@ class SettingsStore {
     });
     this.data.filesTreeStates = normalizeFilesTreeStates(this.data.filesTreeStates.map((state) => state.repositoryId === previousId ? { ...state, repositoryId: repository.id } : state));
     this.data.openFilesStates = normalizeOpenFilesStates(this.data.openFilesStates.map((state) => state.repositoryId === previousId ? { ...state, repositoryId: repository.id } : state));
-    this.data.recentRepositories = [
-      { ...repository, lastOpenedAt: (/* @__PURE__ */ new Date()).toISOString() },
-      ...this.data.recentRepositories.filter((item) => item.id !== previousId && item.id !== repository.id)
-    ];
+    this.data.recentRepositories = this.data.recentRepositories.flatMap((item) => item.id === previousId ? [{ ...repository, lastOpenedAt: (/* @__PURE__ */ new Date()).toISOString() }] : item.id === repository.id ? [] : [item]);
     this.data.activeRepositoryId = repository.id;
-    this.pruneRecentRepositories();
     await this.save();
   }
   /** Forget the whole repository group, never its directories or Git data. */
@@ -18746,7 +19210,6 @@ class SettingsStore {
   async removeRepositoryProject(projectId) {
     this.getProject(projectId);
     this.data.repositoryProjects = this.data.repositoryProjects.filter((project) => project.id !== projectId);
-    this.pruneRecentRepositories();
     await this.save();
     return this.organization;
   }
@@ -18754,19 +19217,44 @@ class SettingsStore {
     const key = normalizeRepositoryKey(repositoryKey);
     if (!key || key.length > MAX_REPOSITORY_KEY_LENGTH || hasControlCharacters$1(key)) throw projectError("Invalid repository.");
     const target = projectId === null ? null : this.getProject(projectId);
-    if (target && !this.data.recentRepositories.some((repository) => normalizeRepositoryKey(repository.commonDir) === key)) {
+    if (!this.data.recentRepositories.some((repository) => normalizeRepositoryKey(repository.commonDir) === key)) {
       throw projectError("Unknown repository.");
     }
+    if (target?.repositoryKeys.includes(key)) return this.organization;
+    if (target && target.repositoryKeys.length >= MAX_REPOSITORIES_PER_PROJECT) throw projectError("This project is full.");
     this.data.repositoryProjects = this.data.repositoryProjects.map((project) => ({
       ...project,
       repositoryKeys: project.repositoryKeys.filter((item) => item !== key)
     }));
     if (target) {
       const refreshed = this.getProject(target.id);
-      if (refreshed.repositoryKeys.length >= MAX_REPOSITORIES_PER_PROJECT) throw projectError("This project is full.");
       refreshed.repositoryKeys.push(key);
     }
-    this.pruneRecentRepositories();
+    await this.save();
+    return this.organization;
+  }
+  async moveRepositoryProject(projectId, toIndex) {
+    this.data.repositoryProjects = moveToIndex(this.data.repositoryProjects, projectId, toIndex, (project) => project.id);
+    await this.save();
+    return this.organization;
+  }
+  /** Move within the assigned project, or within the unassigned repositories. */
+  async moveRepository(repositoryKey, toIndex) {
+    const key = normalizeRepositoryKey(repositoryKey);
+    const keys = [...new Set(this.data.recentRepositories.map((item) => normalizeRepositoryKey(item.commonDir)))];
+    const known = new Set(keys);
+    const project = this.data.repositoryProjects.find((item) => item.repositoryKeys.includes(key));
+    if (project) {
+      const visible = project.repositoryKeys.filter((item) => known.has(item));
+      project.repositoryKeys = [...moveToIndex(visible, key, toIndex, (item) => item), ...project.repositoryKeys.filter((item) => !known.has(item))];
+    } else {
+      const assigned = new Set(this.data.repositoryProjects.flatMap((item) => item.repositoryKeys));
+      const unassigned = moveToIndex(keys.filter((item) => !assigned.has(item)), key, toIndex, (item) => item);
+      let index = 0;
+      const ordered = keys.map((item) => assigned.has(item) ? item : unassigned[index++]);
+      const positions = new Map(ordered.map((item, position) => [item, position]));
+      this.data.recentRepositories = [...this.data.recentRepositories].sort((a2, b) => positions.get(normalizeRepositoryKey(a2.commonDir)) - positions.get(normalizeRepositoryKey(b.commonDir)));
+    }
     await this.save();
     return this.organization;
   }
@@ -18878,15 +19366,6 @@ class SettingsStore {
       throw projectError("A project with this name already exists.");
     }
   }
-  pruneRecentRepositories() {
-    const assigned = new Set(this.data.repositoryProjects.flatMap((project) => project.repositoryKeys));
-    let unassigned = 0;
-    this.data.recentRepositories = this.data.recentRepositories.filter((repository) => {
-      if (repository.id === this.data.activeRepositoryId || assigned.has(normalizeRepositoryKey(repository.commonDir))) return true;
-      unassigned += 1;
-      return unassigned <= UNASSIGNED_RECENT_LIMIT;
-    });
-  }
 }
 function validate(value, defaultDoubleControlShortcutEnabled) {
   const parsed = settingsRecordSchema.safeParse(value);
@@ -18896,8 +19375,16 @@ function validate(value, defaultDoubleControlShortcutEnabled) {
     return data;
   }
   const input = parsed.data;
-  const recentRepositories = Array.isArray(input.recentRepositories) ? input.recentRepositories.filter(isRecent).map(normalizeRecent).slice(0, 10) : [];
+  const recentRepositories = Array.isArray(input.recentRepositories) ? input.recentRepositories.filter(isRecent).map(normalizeRecent) : [];
   const repositoryProjects = normalizeProjects(input.repositoryProjects);
+  if (input.version !== SETTINGS_SCHEMA_VERSION) {
+    const keys = [...new Set(recentRepositories.map((item) => normalizeRepositoryKey(item.commonDir)))];
+    const known = new Set(keys);
+    for (const project of repositoryProjects) {
+      const assigned = new Set(project.repositoryKeys);
+      project.repositoryKeys = [...keys.filter((key) => assigned.has(key)), ...project.repositoryKeys.filter((key) => !known.has(key))];
+    }
+  }
   const filesTreeStates = normalizeFilesTreeStates(input.filesTreeStates);
   const openFilesStates = normalizeOpenFilesStates(input.openFilesStates);
   const parsedPreferences = preferencesRecordSchema.safeParse(input.preferences);
@@ -18926,6 +19413,7 @@ function validate(value, defaultDoubleControlShortcutEnabled) {
   return {
     version: SETTINGS_SCHEMA_VERSION,
     githubAccounts: normalizeGitHubAccounts(input.githubAccounts),
+    githubDefaultLogin: typeof input.githubDefaultLogin === "string" && githubAccountSelectionSchema.safeParse({ mode: "account", host: "github.com", login: input.githubDefaultLogin }).success ? input.githubDefaultLogin : null,
     recentRepositories,
     repositoryProjects,
     filesTreeStates,
@@ -18978,6 +19466,15 @@ function normalizeWorktreePath(value) {
 function cloneProject(project) {
   return { ...project, repositoryKeys: [...project.repositoryKeys] };
 }
+function moveToIndex(items, key, toIndex, keyOf) {
+  const fromIndex = items.findIndex((item2) => keyOf(item2) === key);
+  if (fromIndex < 0) throw projectError("Unknown project or repository.");
+  if (!Number.isSafeInteger(toIndex) || toIndex < 0 || toIndex >= items.length) throw projectError("Invalid ordering position.");
+  const next = [...items];
+  const [item] = next.splice(fromIndex, 1);
+  next.splice(toIndex, 0, item);
+  return next;
+}
 function cloneFilesTreeState(state) {
   return { ...state, expandedPaths: [...state.expandedPaths] };
 }
@@ -19127,8 +19624,14 @@ class OpenTigRuntime {
     this.lastNotifiedAt = Date.now();
     this.onEvent({ type: "repository.changed", repositoryId, scope });
   }
-  publishGitHubAccountsChange() {
-    if (!this.closePromise) this.onEvent({ type: "github.accounts-changed" });
+  publishGitHubAccountsChange(commonDir, defaultOnly = false) {
+    if (this.closePromise) return;
+    const repositories = this.services.repositories.recents();
+    const repositoryIds = defaultOnly ? repositories.filter((repo) => {
+      const selection = this.settings.githubAccount(repo.commonDir);
+      return selection.mode === "account" && selection.useGlobalDefault;
+    }).map((repo) => repo.id) : commonDir ? repositories.filter((repo) => githubRepositoryKey(repo.commonDir) === githubRepositoryKey(commonDir)).map((repo) => repo.id) : void 0;
+    this.onEvent({ type: "github.accounts-changed", ...repositoryIds ? { repositoryIds } : {}, ...defaultOnly ? { inventoryChanged: true } : {} });
   }
   publishActiveRepositoryChange(repository) {
     if (!this.closePromise) this.onEvent({ type: "repository.active-changed", repository });
@@ -19200,9 +19703,13 @@ async function createOpenTigRuntime(options) {
     git,
     settings,
     new GitHubStatusStore(path.join(path.dirname(options.settingsPath), "github-status.json")),
-    () => runtime?.publishGitHubAccountsChange()
+    (repository, defaultOnly) => runtime?.publishGitHubAccountsChange(repository?.commonDir, defaultOnly)
   );
+  const gitAccess = new RepositoryGitAccess(git, repositories, githubAccounts, cliRunner);
+  gitAccess.install();
+  operations.access = gitAccess;
   const github = new GitHubService(cliResolver, cliRunner, git, repositories, githubAccounts);
+  github.gitAccess = gitAccess;
   const events = {
     repositoryChanged: (repositoryId, scope) => {
       runtime?.publishRepositoryChange(repositoryId, scope);
@@ -19369,6 +19876,10 @@ const IPC = {
   projectRename: "projects:rename",
   projectRemove: "projects:remove",
   projectAssign: "projects:assign",
+  projectMove: "projects:move",
+  projectMoveRepository: "projects:move-repository",
+  repositoryPreparePath: "repository:prepare-path",
+  repositoryCompleteSetup: "repository:complete-setup",
   repositoryOpenPath: "repository:open-path",
   repositoryBrowseDirectories: "repository:browse-directories",
   repositoryOpenRecent: "repository:open-recent",
@@ -19419,6 +19930,7 @@ const IPC = {
   worktreeSelect: "refs:select-worktree",
   refsPull: "refs:pull",
   refsPush: "refs:push",
+  refsPushContext: "refs:push-context",
   refsFetch: "refs:fetch",
   localRefsSnapshot: "refs:local-snapshot",
   branchDetails: "refs:branch-details",
@@ -19438,6 +19950,7 @@ const IPC = {
   diagnosticsClear: "diagnostics:clear",
   diagnosticsRecord: "diagnostics:record",
   githubAccountsStatus: "github:accounts-status",
+  githubSetDefaultAccount: "github:set-default-account",
   githubRepositoryAccount: "github:repository-account",
   githubSetRepositoryAccount: "github:set-repository-account",
   githubStatus: "github:status",
@@ -19466,6 +19979,10 @@ const OPEN_TIG_SERVER_COMMANDS = {
   "projects.rename": command(IPC.projectRename, "project-rename", true),
   "projects.remove": command(IPC.projectRemove, "project-remove", true),
   "projects.assign": command(IPC.projectAssign, "project-assign", true),
+  "projects.moveProject": command(IPC.projectMove, "project-move", true),
+  "projects.moveRepository": command(IPC.projectMoveRepository, "project-move-repository", true),
+  "repository.preparePath": command(IPC.repositoryPreparePath, "prepare-path", false),
+  "repository.completeSetup": command(IPC.repositoryCompleteSetup, "complete-setup", true),
   "repository.openPath": command(IPC.repositoryOpenPath, "open-path", true),
   "repository.browseDirectories": command(IPC.repositoryBrowseDirectories, "browse-directories", false),
   "repository.openRecent": command(IPC.repositoryOpenRecent, "open-recent", true),
@@ -19515,6 +20032,7 @@ const OPEN_TIG_SERVER_COMMANDS = {
   "refs.listWorktrees": command(IPC.worktreesList, "worktrees", false),
   "refs.selectWorktree": command(IPC.worktreeSelect, "select-worktree", true),
   "refs.pull": command(IPC.refsPull, "pull", true),
+  "refs.pushContext": command(IPC.refsPushContext, "push-context", false),
   "refs.push": command(IPC.refsPush, "push", true),
   "refs.fetch": command(IPC.refsFetch, "fetch", true),
   "refs.localRefsSnapshot": command(IPC.localRefsSnapshot, "local-refs-snapshot", false),
@@ -19533,6 +20051,7 @@ const OPEN_TIG_SERVER_COMMANDS = {
   "ai.cancelGeneration": command(IPC.aiCancelGeneration, "ai-cancel-generation", true),
   "github.accountsStatus": command(IPC.githubAccountsStatus, "gh-accounts-status", false, { timeoutMs: 9e4 }),
   "github.repositoryAccount": command(IPC.githubRepositoryAccount, "gh-repository-account", false, { timeoutMs: 6e4 }),
+  "github.setDefaultAccount": command(IPC.githubSetDefaultAccount, "gh-set-default-account", true),
   "github.setRepositoryAccount": command(IPC.githubSetRepositoryAccount, "gh-set-repository-account", true),
   "github.status": command(IPC.githubStatus, "gh-status", false),
   "github.repositoryInfo": command(IPC.githubRepositoryInfo, "gh-repository-info", false),
@@ -20078,6 +20597,10 @@ function invalidAi(operation) {
 function invalidProject(operation) {
   return new GitOperationError({ code: "INVALID_ARGUMENT", operation, message: "Invalid project data." });
 }
+function orderingIndexArg(value, operation) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw invalidProject(operation);
+  return value;
+}
 function registerServerCommands(registry2, services, host) {
   const serverDefinitions = new Map(
     Object.values(OPEN_TIG_SERVER_COMMANDS).map((definition) => [definition.command, definition])
@@ -20141,6 +20664,22 @@ function registerServerCommands(registry2, services, host) {
   handle(IPC.projectRename, "project-rename", (projectId, name) => services.settings.renameRepositoryProject(projectIdArg(projectId, "project-rename"), projectNameArg(name, "project-rename")));
   handle(IPC.projectRemove, "project-remove", (projectId) => services.settings.removeRepositoryProject(projectIdArg(projectId, "project-remove")));
   handle(IPC.projectAssign, "project-assign", (repositoryKey, projectId) => services.settings.assignRepositoryProject(repositoryKeyArg(repositoryKey, "project-assign"), nullableProjectIdArg(projectId, "project-assign")));
+  handle(IPC.projectMove, "project-move", (projectId, toIndex) => services.settings.moveRepositoryProject(projectIdArg(projectId, "project-move"), orderingIndexArg(toIndex, "project-move")));
+  handle(IPC.projectMoveRepository, "project-move-repository", (repositoryKey, toIndex) => services.settings.moveRepository(repositoryKeyArg(repositoryKey, "project-move-repository"), orderingIndexArg(toIndex, "project-move-repository")));
+  handle(IPC.repositoryPreparePath, "prepare-path", (path2) => services.repositories.preparePath(stringArg(path2, "prepare-path", 32768)));
+  handleWithContext(IPC.repositoryCompleteSetup, "complete-setup", async (context, id, revision2) => {
+    const repositoryId = stringArg(id, "complete-setup", 64);
+    if (typeof revision2 !== "number" || !Number.isSafeInteger(revision2) || revision2 < 0) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: "complete-setup", message: "Invalid account revision." });
+    const repository = await services.repositories.completeSetup(repositoryId, () => {
+      if (revision2 !== services.github.accounts.revisionFor(services.repositories.get(repositoryId))) {
+        throw new Error("The repository account changed. Reload setup and review it again.");
+      }
+    });
+    fileClipboardState(context).pendingCut = null;
+    services.watcher.start(repository);
+    services.events.activeRepositoryChanged(repository);
+    return repository;
+  });
   handleWithContext(IPC.repositoryOpenPath, "open-path", (context, selectedPath) => openRepositoryPath(
     stringArg(selectedPath, "open-path", 32768),
     context
@@ -20440,7 +20979,8 @@ function registerServerCommands(registry2, services, host) {
     return services.operations.removeWorktree(repositoryId, path2, expectedOid, force, deleteBranch);
   });
   handle(IPC.refsPull, "pull", (id) => services.operations.pull(stringArg(id, "pull", 64)));
-  handle(IPC.refsPush, "push", (id, publish) => services.operations.push(stringArg(id, "push", 64), publishBranchArg(publish)));
+  handle(IPC.refsPushContext, "push-context", (id, remote) => services.operations.publicationContext(stringArg(id, "push-context", 64), remote == null ? void 0 : stringArg(remote, "push-context", 512)));
+  handle(IPC.refsPush, "push", (id, publish, expected) => services.operations.push(stringArg(id, "push", 64), publishBranchArg(publish), expected == null ? void 0 : stringArg(expected, "push", 64)));
   handle(IPC.refsFetch, "fetch", (id) => services.operations.fetch(stringArg(id, "fetch", 64)));
   handle(IPC.aiStatuses, "ai-statuses", (forceRefresh) => services.ai.statuses(booleanArg(forceRefresh, "ai-statuses")));
   handleWithContext(IPC.aiGenerateCommitMessage, "ai-generate-commit-message", (context, input) => services.ai.generate(generateCommitMessageArg(input), context.signal));
@@ -20465,11 +21005,13 @@ function registerServerCommands(registry2, services, host) {
     services.ai.cancel(aiString(requestId2, "ai-cancel-generation", 100, true));
   });
   handle(IPC.githubAccountsStatus, "gh-accounts-status", (forceRefresh) => services.github.accounts.status(booleanArg(forceRefresh, "gh-accounts-status")));
+  handle(IPC.githubSetDefaultAccount, "gh-set-default-account", (login2) => services.github.accounts.setDefaultAccount(stringArg(login2, "gh-set-default-account", 39)));
   handle(IPC.githubRepositoryAccount, "gh-repository-account", (id, forceRefresh) => services.github.repositoryAccount(stringArg(id, "gh-repository-account", 64), booleanArg(forceRefresh, "gh-repository-account")));
-  handle(IPC.githubSetRepositoryAccount, "gh-set-repository-account", (id, selection) => {
+  handle(IPC.githubSetRepositoryAccount, "gh-set-repository-account", (id, selection, expectedRevision) => {
     const parsed = githubAccountSelectionSchema.safeParse(selection);
+    if (expectedRevision !== void 0 && (typeof expectedRevision !== "number" || !Number.isSafeInteger(expectedRevision) || expectedRevision < 0)) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: "gh-set-repository-account", message: "Invalid account revision." });
     if (!parsed.success) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: "gh-set-repository-account", message: "Invalid GitHub account selection." });
-    return services.github.setRepositoryAccount(stringArg(id, "gh-set-repository-account", 64), parsed.data);
+    return services.github.setRepositoryAccount(stringArg(id, "gh-set-repository-account", 64), parsed.data, typeof expectedRevision === "number" ? expectedRevision : void 0);
   });
   handle(IPC.githubStatus, "gh-status", (forceRefresh) => services.github.status(booleanArg(forceRefresh, "gh-status")));
   handle(IPC.githubRepositoryInfo, "gh-repository-info", (id) => services.github.repositoryInfo(stringArg(id, "gh-repository-info", 64)));
@@ -20691,9 +21233,9 @@ class PersistentAuthStore {
     });
   }
   renewBrowserSession(token) {
-    const digest = this.digestCredential(token);
+    const digest2 = this.digestCredential(token);
     return this.mutate((sessions) => {
-      const index = sessions.findIndex((session2) => session2.kind !== "desktop" && constantTimeEqual(digest, session2.digest) && this.isActive(session2));
+      const index = sessions.findIndex((session2) => session2.kind !== "desktop" && constantTimeEqual(digest2, session2.digest) && this.isActive(session2));
       if (index < 0) return { next: sessions, result: false };
       const session = sessions[index];
       const expiresAt = sessionExpiry(session.kind, new Date(this.now()).toISOString());
@@ -21256,6 +21798,19 @@ async function handleRequest(context, request, response) {
     }
     return sendJson(response, 404, { error: "Not found." });
   }
+  if (method === "GET" && rawPath === "/api/auth/web-access") {
+    if (!context.auth.authenticate(request.headers)) return sendJson(response, 401, { error: "Authentication required." });
+    const listener = context.listenerAddress();
+    const status = {
+      webAccessEnabled: context.auth.descriptor().browserAccessEnabled,
+      pairingAvailable: context.auth.descriptor().pairingAvailable,
+      listeningOnLan: !isLoopbackAddress(listener.host),
+      listenerHost: listener.host,
+      actualPort: listener.port,
+      ready: context.isReady()
+    };
+    return sendJson(response, 200, status);
+  }
   if (method === "GET" && rawPath === "/api/auth/sessions") {
     const currentSessionId = context.auth.authenticate(request.headers);
     if (!currentSessionId) return sendJson(response, 401, { error: "Authentication required." });
@@ -21275,6 +21830,15 @@ async function handleRequest(context, request, response) {
   }
   if (method === "POST" && rawPath.startsWith("/api/")) {
     if (!isAllowedOrigin(request)) return sendJson(response, 403, { error: "Forbidden origin." });
+    if (rawPath === "/api/auth/pairing-link") {
+      if (!context.auth.authenticate(request.headers)) return sendJson(response, 401, { error: "Authentication required." });
+      if (!context.auth.descriptor().browserAccessEnabled) return sendJson(response, 403, { error: "Web access is disabled.", code: "WEB_ACCESS_DISABLED" });
+      if (!context.isReady()) return sendJson(response, 503, { error: "Server is not ready." });
+      const url = new URL("/pair", request.headers.origin);
+      const pairing = context.auth.createPairingToken();
+      url.hash = new URLSearchParams({ token: pairing.token }).toString();
+      return sendJson(response, 200, { url: url.href, expiresAt: pairing.expiresAt });
+    }
     if (rawPath === "/api/auth/renew") {
       const cookie = await context.auth.renewBrowserCookie(request.headers, requestOriginIsSecure(request));
       if (!cookie) return sendJson(response, 401, { error: "Authentication required." });
@@ -21788,6 +22352,10 @@ class OpenTigServer {
       identity: options.identity,
       mode: options.mode ?? "desktop",
       isReady: () => this.ready,
+      listenerAddress: () => {
+        const address = this.httpServer.address();
+        return { host: address.address, port: address.port };
+      },
       sessionConnectionCount: (sessionId) => this.webSockets.connectionCount(sessionId),
       onSessionsRevoked: (sessionIds) => this.disconnectSessions(sessionIds),
       logger: this.logger,