@ozyman42/ozy-cli 0.4.6-windows-x64.0 → 0.4.6

package/src/modules/cli/agent-client/impl.ts

@@ -0,0 +1,152 @@
+import { Effect, Layer, Match, Option, pipe, Data, FileSystem, Schedule, Result } from "effect";
+import { effunct, implementing, type EffectGen } from "effective-modules";
+import { FetchHttpClient } from "effect/unstable/http";
+import { RpcClient, RpcSerialization } from "effect/unstable/rpc";
+import { AgentRpcGroup } from "@/modules/ssh-agent/session/interface-rpc";
+import { cliModules } from "..";
+import { type AgentRpcClient, type IAgentClient, AgentClientError } from "./interface";
+import { AGENT_CMD_PATH, AGENT_PID_FILE_PATH, AGENT_PORT_FILE_PATH, AGENT_SOCK_FILE_PATH, CURRENT_VERSION } from "@/common/constants";
+import { readFileSync, rmSync } from "node:fs";
+import { log } from "@/common/log";
+
+function makeAgentClientLayer(port: number) {
+  return pipe(
+    RpcClient.layerProtocolHttp({ url: `http://localhost:${port}/rpc` }),
+    Layer.provideMerge(RpcSerialization.layerJson),
+    Layer.provideMerge(FetchHttpClient.layer)
+  );
+}
+
+class NoResponseError extends Data.TaggedError("NoResponseError")<{}> {
+  public toString() { return "No response from agent."; }
+}
+
+class NonMatchingVersionError extends Data.TaggedError("NonMatchingVersionError")<{
+  cliVersion: string;
+  agentVersion: string;
+}> {
+  public toString() {
+    return `Agent running but with mismatched version ${this.agentVersion} compared to CLI version ${this.cliVersion}`;
+  }
+}
+
+type PingError = NoResponseError | NonMatchingVersionError;
+
+export class AgentClientImpl extends implementing(cliModules.AgentClient).uses(FileSystem.FileSystem) implements IAgentClient {
+  private *readPortFromFile(): EffectGen<Option.Option<number>, never> {
+    const result = yield* pipe(
+      this.getDependency(FileSystem.FileSystem).readFileString(AGENT_PORT_FILE_PATH),
+      Effect.result
+    );
+    if (Result.isFailure(result)) return Option.none();
+    const port = parseInt(result.success.trim());
+    if (isNaN(port) || port <= 0 || port > 65535) {
+      log(`Read out of bounds port ${port}`);
+      return Option.none();
+    }
+    return Option.some(port);
+  }
+
+  private *pingAtPort(port: number): EffectGen<void, PingError> {
+    yield* Effect.scoped(
+      Effect.gen(function* () {
+        const client = yield* RpcClient.make(AgentRpcGroup);
+        const { version } = yield* pipe(
+          client.GetVersion({}),
+          Effect.catchTag("RpcClientError", () => new NoResponseError())
+        );
+        if (version !== CURRENT_VERSION)
+          yield* new NonMatchingVersionError({ cliVersion: CURRENT_VERSION, agentVersion: version });
+      })
+    ).pipe(Effect.provide(makeAgentClientLayer(port)));
+  }
+
+  private *ping(): EffectGen<{ port: number }, PingError> {
+    const portOption = yield* effunct(this.readPortFromFile)();
+    if (Option.isNone(portOption)) return yield* new NoResponseError();
+    const port = portOption.value;
+    yield* effunct(this.pingAtPort)(port);
+    return { port };
+  }
+
+  private *waitForPidFile(expectedPid: number): EffectGen<void, string> {
+    const fs = this.getDependency(FileSystem.FileSystem);
+    yield* pipe(
+      Effect.retry(
+        pipe(
+          fs.readFileString(AGENT_PID_FILE_PATH),
+          Effect.catchTag("PlatformError", () => Effect.fail("pid file not yet written")),
+          Effect.flatMap(content => {
+            const pid = parseInt(content.trim());
+            return pid === expectedPid
+              ? Effect.void
+              : Effect.fail(`PID mismatch: expected ${expectedPid}, got ${pid}`);
+          })
+        ),
+        Schedule.spaced("50 millis")
+      ),
+      Effect.timeout("5 seconds"),
+      Effect.mapError(() => "Agent did not start within 5 seconds")
+    );
+  }
+
+  private *startAgent(): EffectGen<{ pid: number; port: number }, string | PingError> {
+    const proc = Bun.spawn([AGENT_CMD_PATH], { stdout: "ignore", stderr: "ignore" });
+    yield* effunct(this.waitForPidFile)(proc.pid);
+    const { port } = yield* effunct(this.ping)();
+    log(`Started agent at PID ${proc.pid}`);
+    return { pid: proc.pid, port };
+  }
+
+  *killIfRunning(): EffectGen<void, string> {
+    try {
+      // Throws if file missing
+      const pidFileContent = readFileSync(AGENT_PID_FILE_PATH, "utf-8");
+      const PID = parseInt(pidFileContent.trim());
+      // If doesn't exist, below line throws
+      process.kill(PID, 0);
+      log(`Killing agent on PID ${PID}`);
+      process.kill(PID, "SIGTERM");
+      yield* Effect.sleep(500);
+    } catch { }
+    try { rmSync(AGENT_PID_FILE_PATH); } catch {}
+    try { rmSync(AGENT_PORT_FILE_PATH); } catch {}
+    try { rmSync(AGENT_SOCK_FILE_PATH); } catch {}
+  }
+
+  private *ensureRunning(): EffectGen<{ port: number }, string> {
+    const pingResult = yield* pipe(effunct(this.ping)(), Effect.result);
+    if (Result.isSuccess(pingResult)) return pingResult.success;
+    log(pingResult.failure.toString());
+    yield* Match.value(pingResult.failure).pipe(
+      Match.tag("NonMatchingVersionError", () => effunct(this.killIfRunning)()),
+      Match.tag("NoResponseError", () => effunct(this.killIfRunning)()),
+      Match.exhaustive
+    );
+    return yield* pipe(
+      effunct(this.startAgent)(),
+      Effect.mapError(err =>
+        typeof err === "string" ?
+          err :
+          `Failed to start agent due to ${err.name}: ${err.toString()}`
+      )
+    );
+  }
+
+  *usingClient<A, E>(use: (client: AgentRpcClient) => EffectGen<A, E>): EffectGen<A, AgentClientError<E>> {
+    const { port } = yield* pipe(
+      effunct(this.ensureRunning)(),
+      Effect.mapError(reason => new AgentClientError.ClientError({ reason }))
+    );
+    return yield* pipe(
+      Effect.scoped(
+        Effect.gen(function* () {
+          const client = yield* RpcClient.make(AgentRpcGroup);
+          return yield* use(client);
+        })
+      ),
+      Effect.provide(makeAgentClientLayer(port)),
+      Effect.mapError(e => new AgentClientError.UsageError({ cause: e }))
+    );
+  }
+}

package/src/modules/cli/agent-client/interface.ts

@@ -0,0 +1,17 @@
+import type { EffectGen } from "effective-modules";
+import type { AgentRpcGroup } from "@/modules/ssh-agent/session/interface-rpc";
+import type { RpcClient, RpcClientError as RpcClientErrorModule, RpcGroup } from "effect/unstable/rpc";
+import { Data } from "effect";
+
+export type AgentRpcClient = RpcClient.RpcClient<RpcGroup.Rpcs<AgentRpcGroup>, RpcClientErrorModule.RpcClientError>;
+
+export namespace AgentClientError {
+  export class UsageError<E> extends Data.TaggedError("AgentClientUsageError")<{ readonly cause: E }> {}
+  export class ClientError extends Data.TaggedError("AgentClientError")<{ readonly reason: string }> {}
+}
+export type AgentClientError<E> = AgentClientError.UsageError<E> | AgentClientError.ClientError;
+
+export interface IAgentClient {
+  killIfRunning(): EffectGen<void, string>;
+  usingClient<A, E>(use: (client: AgentRpcClient) => EffectGen<A, E>): EffectGen<A, AgentClientError<E>>;
+}

package/src/modules/cli/git/impl.ts

@@ -0,0 +1,133 @@
+import { implementing, type EffectGen } from "effective-modules";
+import { cliModules } from "..";
+import { commonModules } from "@/modules/common";
+import { $ } from 'bun';
+import type { IGit, SetupRepoInput } from "./interface";
+import { Effect, Option, pipe } from "effect";
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { SSH_KEYGEN_CMD_PATH, STANDARD_REMOTE_PREFIX } from "@/common/constants";
+import { Gitmodules } from "./submodule/gitmodules";
+import { readGitState } from "./submodule/git-state";
+import { fixGitConfig, fixModuleDirs, fixIndexGitlinks } from "./submodule/fix";
+import { printSyncState, printFixes } from "./submodule/printer";
+
+export class GitImpl extends implementing(cliModules.Git).uses(commonModules.OSPlatform, commonModules.SSHConfig) implements IGit {
+  private parseOwnerRepo(remote: string): Effect.Effect<{ owner: string; repo: string }, string> {
+    const sshMatch = remote.match(/^git@[^:]+:([^/]+)\/(.+?)(?:\.git)?$/);
+    if (sshMatch) return Effect.succeed({ owner: sshMatch[1]!, repo: sshMatch[2]! });
+    const httpsMatch = remote.match(/^https?:\/\/[^/]+\/([^/]+)\/(.+?)(?:\.git)?$/);
+    if (httpsMatch) return Effect.succeed({ owner: httpsMatch[1]!, repo: httpsMatch[2]! });
+    return Effect.fail(`Cannot parse owner/repo from remote: ${remote}`);
+  }
+  
+  *resolveOwnerAndRepo(maybeOwnerAndRepo: Option.Option<string>): EffectGen<{ owner: string; repo: string; }, string> {
+    if (Option.isSome(maybeOwnerAndRepo)) {
+      const parts = maybeOwnerAndRepo.value.split('/');
+      const [owner, repo] = parts;
+      if (parts.length !== 2 || !owner || !repo)
+        return yield* Effect.fail(`Cannot parse remote error: Expected "owner/repo", got "${maybeOwnerAndRepo.value}"`);
+      return { owner, repo };
+    }
+
+    if (!(yield* this.isGitRepository())) {
+      yield* Effect.fail(`not in git repo: Current directory is not a git repository`);
+    }
+
+    const remoteOption = yield* this.getRemoteOrigin();
+    if (Option.isNone(remoteOption)) {
+      return yield* Effect.fail(`no remote origin: No remote.origin.url — pass owner/repo as argument to clone instead`);
+    }
+
+    return yield* this.parseOwnerRepo(remoteOption.value);
+  }
+  *isGitRepository(): EffectGen<boolean> {
+    return yield* pipe(
+      Effect.tryPromise(async () => {
+        await $`git rev-parse --is-inside-work-tree`.quiet();
+        return true;
+      }),
+      Effect.catchTag("UnknownError", () => Effect.succeed(false))
+    );
+  }
+  *getRemoteOrigin(): EffectGen<Option.Option<string>> {
+    return yield* pipe(
+      Effect.tryPromise(async() => {
+        return Option.some((await $`git config --get remote.origin.url`.quiet()).text().trim());
+      }),
+      Effect.catchTag("UnknownError", () => Effect.succeed(Option.none()))
+    )
+  }
+  *clone(owner: string, repo: string): EffectGen<void, string> {
+    const result = Bun.spawnSync(['git', 'clone', '--recurse-submodules', `${STANDARD_REMOTE_PREFIX}${owner}/${repo}.git`], { stdout: 'inherit', stderr: 'inherit' });
+    if (result.exitCode !== 0)
+      return yield* Effect.fail(`git clone failed with exit code ${result.exitCode}`);
+    process.chdir(`./${repo}`);
+  }
+  *setLocalConfig(key: string, value: string): EffectGen<void, string> {
+    yield* Effect.tryPromise({
+      try: async () => { await $`git config --local ${key} ${value}`.quiet(); },
+      catch: (e) => `git config ${key}: ${e instanceof Error ? e.message : String(e)}`,
+    });
+  }
+  private *configureRepo({ dir, remoteURL, user, pubkeyPath }: SetupRepoInput): EffectGen<void, string> {
+    yield* Effect.log(`Configuring ${dir}`);
+    yield* Effect.tryPromise({
+      try: async () => {
+        const configs: [string, string][] = [
+          ['remote.origin.url', remoteURL],
+          ['user.name', user.name],
+          ['user.email', user.email],
+          ['user.signingkey', pubkeyPath],
+          ['gpg.format', 'ssh'],
+          ['gpg.ssh.program', SSH_KEYGEN_CMD_PATH],
+          ['commit.gpgsign', 'true'],
+          ['tag.gpgsign', 'true'],
+        ];
+        for (const [k, v] of configs) {
+          const r = Bun.spawnSync(['git', 'config', '--local', k, v], { cwd: dir, stdout: 'pipe', stderr: 'pipe' });
+          if (r.exitCode !== 0) {
+            const err = new TextDecoder().decode(r.stderr);
+            throw new Error(`git config ${k} failed: ${err.trim()}`);
+          }
+        }
+      },
+      catch: (e) => e instanceof Error ? e.message : String(e),
+    });
+  }
+  private *syncSubmoduleState(repoRoot: string, topLevelRoot: string): EffectGen<Gitmodules, string> {
+    const gitmodules = yield* Gitmodules.fromRepoRoot(repoRoot);
+    if (gitmodules.list.length === 0) return gitmodules;
+    const submodulePaths = gitmodules.list.map(m => m.path);
+    const state = yield* readGitState(repoRoot, submodulePaths);
+    printSyncState(gitmodules, state);
+    const fixResults = yield* Effect.all(
+      [
+        fixGitConfig(repoRoot, gitmodules),
+        fixModuleDirs(repoRoot, gitmodules, state.moduleDirs, state.orphanModuleDirs, topLevelRoot),
+        fixIndexGitlinks(repoRoot, gitmodules, state.index),
+      ],
+      { concurrency: "unbounded" },
+    );
+    printFixes(fixResults.flat());
+    return gitmodules;
+  }
+  *setupRepo(input: SetupRepoInput): EffectGen<void, string> {
+    yield* this.setupRepoAt(input, input.dir);
+  }
+  private *setupRepoAt(input: SetupRepoInput, topLevelRoot: string): EffectGen<void, string> {
+    yield* this.configureRepo(input);
+    if (!existsSync(resolve(input.dir, '.gitmodules'))) return;
+    const gitmodules = yield* this.syncSubmoduleState(input.dir, topLevelRoot);
+    for (const m of gitmodules.list) {
+      const subDir = resolve(input.dir, m.path);
+      if (!existsSync(subDir)) continue;
+      yield* this.setupRepoAt({
+        dir: subDir,
+        remoteURL: m.url,
+        user: input.user,
+        pubkeyPath: input.pubkeyPath
+      }, topLevelRoot);
+    }
+  }
+}

package/src/modules/cli/git/interface.ts

@@ -0,0 +1,23 @@
+import { type EffectGen} from "effective-modules";
+import { Option } from "effect";
+
+export interface GitUser {
+  name: string;
+  email: string;
+}
+
+export interface SetupRepoInput {
+  dir: string;
+  user: GitUser;
+  pubkeyPath: string;
+  remoteURL: string;
+}
+
+export interface IGit {
+  isGitRepository(): EffectGen<boolean>;
+  getRemoteOrigin(): EffectGen<Option.Option<string>>;
+  resolveOwnerAndRepo(maybeOwnerAndRepo: Option.Option<string>): EffectGen<{owner: string; repo: string;}, string>;
+  clone(owner: string, repo: string): EffectGen<void, string>;
+  setLocalConfig(key: string, value: string): EffectGen<void, string>;
+  setupRepo(params: SetupRepoInput): EffectGen<void, string>;
+}

package/src/modules/cli/git/submodule/fix.ts

@@ -0,0 +1,298 @@
+import { existsSync, statSync } from "node:fs";
+import { readFile, writeFile, rename, mkdir, rm } from "node:fs/promises";
+import { resolve, join, dirname, relative } from "node:path";
+import { Effect } from "effect";
+import type { Gitmodules } from "./gitmodules";
+import type { ModuleDirInfo, IndexGitlink } from "./git-state";
+import { resolveGitDir } from "./resolve-git-dir";
+
+export interface Fix {
+  location: string[];
+  action: "synced" | "deleted";
+  detail?: string;
+}
+
+function parseConfigSubmoduleValues(content: string): Map<string, { url?: string; path?: string }> {
+  const entries = new Map<string, { url?: string; path?: string }>();
+  let current: { url?: string; path?: string } | null = null;
+
+  for (const line of content.split("\n")) {
+    const headerMatch = line.match(/^\[submodule "(.+)"\]$/);
+    if (headerMatch) {
+      current = {};
+      entries.set(headerMatch[1]!, current);
+      continue;
+    }
+    if (!current) continue;
+    const kvMatch = line.match(/^\s+(\w+)\s*=\s*(.+)$/);
+    if (!kvMatch) continue;
+    const [, key, value] = kvMatch;
+    if (key === "url" || key === "path") current[key] = value!.trim();
+  }
+
+  return entries;
+}
+
+// Drops any stanza whose name isn't a valid submodule, is a stale duplicate, or
+// has url/path values that no longer match .gitmodules — so it can be re-added fresh.
+function removeExtraConfigSubmodules(content: string, modules: Gitmodules): { result: string; removed: string[] } {
+  const byName = new Map(modules.list.map((m) => [m.name, m]));
+  const existingValues = parseConfigSubmoduleValues(content);
+
+  const staleNames = new Set<string>();
+  for (const [name, values] of existingValues) {
+    const m = byName.get(name);
+    if (!m || values.url !== m.url || values.path !== m.path) staleNames.add(name);
+  }
+
+  const removed: string[] = [];
+  const seen = new Set<string>();
+  const output: string[] = [];
+  let dropping = false;
+
+  for (const line of content.split("\n")) {
+    const submoduleMatch = line.match(/^\[submodule "(.+)"\]$/);
+    if (submoduleMatch) {
+      const name = submoduleMatch[1]!;
+      if (!staleNames.has(name) && !seen.has(name)) {
+        seen.add(name);
+        dropping = false;
+      } else {
+        removed.push(name);
+        dropping = true;
+      }
+    } else if (/^\[/.test(line)) {
+      dropping = false;
+    }
+    if (!dropping) output.push(line);
+  }
+
+  return { result: output.join("\n"), removed };
+}
+
+async function spawnGit(args: string[], cwd: string): Promise<void> {
+  const proc = Bun.spawn(["git", ...args], { cwd, stdout: "pipe", stderr: "pipe" });
+  const code = await proc.exited;
+  if (code !== 0) {
+    const err = await new Response(proc.stderr).text();
+    throw new Error(`git ${args.join(" ")} exited with code ${code}\n${err.trim()}`);
+  }
+}
+
+export function fixGitConfig(repoRoot: string, modules: Gitmodules): Effect.Effect<Fix[], string> {
+  return Effect.tryPromise({
+    try: async () => {
+      const gitDir = await resolveGitDir(repoRoot);
+      const configPath = resolve(gitDir, "config");
+      const content = await readFile(configPath, "utf8");
+      const { result: afterRemoval, removed } = removeExtraConfigSubmodules(content, modules);
+
+      const existingNames = new Set<string>(
+        [...afterRemoval.matchAll(/^\[submodule "(.+)"\]$/gm)].map((m) => m[1]!)
+      );
+      const missing = modules.list.filter((m) => !existingNames.has(m.name));
+
+      let result = afterRemoval;
+      for (const m of missing) {
+        if (!result.endsWith("\n")) result += "\n";
+        result += `[submodule "${m.name}"]\n\tactive = true\n\turl = ${m.url}\n\tpath = ${m.path}\n`;
+      }
+
+      if (removed.length === 0 && missing.length === 0) return [];
+      await writeFile(configPath, result, "utf8");
+      return [
+        ...removed.map((name) => ({ location: [".git", "config", name], action: "deleted" as const })),
+        ...missing.map((m) => ({ location: [".git", "config", m.name], action: "synced" as const })),
+      ];
+    },
+    catch: (e) => e instanceof Error ? e.message : String(e),
+  });
+}
+
+const GIT_MODULES_MARKER = ".git/modules/";
+
+// A stale redirect's leading "../" prefix can be wrong after a path rename, but the
+// suffix starting at ".git/modules/" always describes a location under the single
+// top-level .git, at any nesting depth — so anchor on that marker instead of trusting
+// the relative resolution.
+function recoverStaleGitDirTarget(redirectContent: string, topLevelRoot: string): string | undefined {
+  const match = redirectContent.match(/^gitdir:\s*(.+)$/m);
+  if (!match) return undefined;
+  const idx = match[1]!.indexOf(GIT_MODULES_MARKER);
+  if (idx === -1) return undefined;
+  return resolve(topLevelRoot, match[1]!.slice(idx).trim());
+}
+
+// Moves existing git data into moduleGitDir instead of abandoning it, whether it's a
+// standalone clone's literal .git directory, or a redirect file (even a stale one
+// left over from a path rename) pointing at git data that still exists.
+async function migrateExistingGitDir(workingTreeDir: string, moduleGitDir: string, topLevelRoot: string): Promise<boolean> {
+  const dotGit = join(workingTreeDir, ".git");
+  if (!existsSync(dotGit)) return false;
+
+  if (statSync(dotGit).isDirectory()) {
+    await mkdir(dirname(moduleGitDir), { recursive: true });
+    await rename(dotGit, moduleGitDir);
+    return true;
+  }
+
+  const content = await readFile(dotGit, "utf8");
+  const target = recoverStaleGitDirTarget(content, topLevelRoot);
+  if (!target || target === moduleGitDir || !existsSync(target)) return false;
+  await mkdir(dirname(moduleGitDir), { recursive: true });
+  await rename(target, moduleGitDir);
+  return true;
+}
+
+export function fixModuleDirs(
+  repoRoot: string,
+  modules: Gitmodules,
+  moduleDirs: ModuleDirInfo[],
+  orphanModuleDirs: string[],
+  topLevelRoot: string,
+): Effect.Effect<Fix[], string> {
+  return Effect.tryPromise({
+    try: async () => {
+      const fixes: Fix[] = [];
+      const modulesRoot = resolve(await resolveGitDir(repoRoot), "modules");
+
+      // Establish each module's git dir (migrating existing data if any exists
+      // anywhere) before the orphan cleanup below runs, so nothing real gets deleted
+      // out from under a path rename.
+      for (const m of modules.list) {
+        const workingTreeDir = resolve(repoRoot, m.path);
+        const moduleGitDir = join(modulesRoot, m.path);
+        if (!existsSync(workingTreeDir)) continue;
+
+        const alreadyEstablished = existsSync(moduleGitDir);
+        let freshlyCloned = false;
+
+        if (!alreadyEstablished) {
+          const migrated = await migrateExistingGitDir(workingTreeDir, moduleGitDir, topLevelRoot);
+          if (migrated) {
+            fixes.push({ location: [".git", "modules", ...m.path.split("/")], action: "synced", detail: "migrated" });
+          } else {
+            await mkdir(dirname(moduleGitDir), { recursive: true });
+            await spawnGit(["clone", "--bare", m.url, moduleGitDir], repoRoot);
+            fixes.push({ location: [".git", "modules", ...m.path.split("/")], action: "synced", detail: "initialized" });
+            freshlyCloned = true;
+          }
+        }
+
+        if (freshlyCloned) {
+          const configFile = join(moduleGitDir, "config");
+          const worktree = relative(moduleGitDir, workingTreeDir);
+          await spawnGit(["config", "-f", configFile, "core.bare", "false"], repoRoot);
+          await spawnGit(["config", "-f", configFile, "core.worktree", worktree], repoRoot);
+        }
+
+        // A bare clone (whether just made above, or left over from a prior buggy
+        // run) never gets an index — populate it from HEAD whenever it's missing,
+        // not only right after we ourselves created it.
+        if (!existsSync(join(moduleGitDir, "index"))) {
+          const headCheck = Bun.spawn(["git", "--git-dir", moduleGitDir, "rev-parse", "--verify", "HEAD"], { stdout: "ignore", stderr: "ignore" });
+          if ((await headCheck.exited) !== 0) await spawnGit(["--git-dir", moduleGitDir, "fetch", "origin"], repoRoot);
+          await spawnGit(["--git-dir", moduleGitDir, "read-tree", "HEAD"], repoRoot);
+          fixes.push({ location: [".git", "modules", ...m.path.split("/")], action: "synced", detail: "populated index" });
+        }
+
+        // Always re-point the working tree's .git redirect — never assume an
+        // existing file is already correct.
+        const dotGit = join(workingTreeDir, ".git");
+        const rel = relative(workingTreeDir, moduleGitDir);
+        const desired = `gitdir: ${rel}\n`;
+        const current = existsSync(dotGit) && !statSync(dotGit).isDirectory()
+          ? await readFile(dotGit, "utf8")
+          : undefined;
+        if (current !== desired) {
+          await writeFile(dotGit, desired, "utf8");
+          fixes.push({ location: [...m.path.split("/"), ".git"], action: "synced" });
+        }
+      }
+
+      const gmByPath = new Map(modules.list.map((m) => [m.path, m]));
+
+      for (const d of moduleDirs) {
+        const gm = gmByPath.get(d.relativePath);
+        if (!gm && existsSync(join(modulesRoot, d.relativePath))) {
+          await rm(join(modulesRoot, d.relativePath), { recursive: true, force: true });
+          fixes.push({ location: [".git", "modules", ...d.relativePath.split("/")], action: "deleted" });
+        }
+      }
+
+      for (const rel of orphanModuleDirs) {
+        if (existsSync(join(modulesRoot, rel))) {
+          await rm(join(modulesRoot, rel), { recursive: true, force: true });
+          fixes.push({ location: [".git", "modules", ...rel.split("/")], action: "deleted" });
+        }
+      }
+
+      for (const m of modules.list) {
+        const moduleGitDir = join(modulesRoot, m.path);
+        if (!existsSync(moduleGitDir)) continue;
+        const configFile = join(moduleGitDir, "config");
+
+        const readConfig = (key: string) =>
+          Bun.spawn(["git", "config", "-f", configFile, key], { cwd: repoRoot, stdout: "pipe", stderr: "pipe" });
+
+        const [currentUrl, currentWorktree] = await Promise.all([
+          new Response(readConfig("remote.origin.url").stdout).text().then(t => t.trim()),
+          new Response(readConfig("core.worktree").stdout).text().then(t => t.trim()),
+        ]);
+
+        const worktree = relative(moduleGitDir, resolve(repoRoot, m.path));
+
+        if (currentUrl !== m.url) {
+          await spawnGit(["config", "-f", configFile, "remote.origin.url", m.url], repoRoot);
+          fixes.push({ location: [".git", "modules", ...m.path.split("/"), "config"], action: "synced", detail: "remote.origin.url" });
+        }
+        if (currentWorktree !== worktree) {
+          await spawnGit(["config", "-f", configFile, "core.worktree", worktree], repoRoot);
+          fixes.push({ location: [".git", "modules", ...m.path.split("/"), "config"], action: "synced", detail: "core.worktree" });
+        }
+      }
+
+      return fixes;
+    },
+    catch: (e) => e instanceof Error ? e.message : String(e),
+  });
+}
+
+export function fixIndexGitlinks(
+  repoRoot: string,
+  modules: Gitmodules,
+  currentIndex: IndexGitlink[],
+): Effect.Effect<Fix[], string> {
+  return Effect.tryPromise({
+    try: async () => {
+      const currentShas = new Map(currentIndex.map((e) => [e.path, e.commit]));
+      const validPaths = new Set(modules.list.map((m) => m.path));
+      const fixes: Fix[] = [];
+
+      for (const entry of currentIndex) {
+        if (!validPaths.has(entry.path)) {
+          await spawnGit(["update-index", "--force-remove", entry.path], repoRoot);
+          fixes.push({ location: [".git", "index"], action: "deleted", detail: entry.path });
+        }
+      }
+
+      for (const m of modules.list) {
+        const workingTree = resolve(repoRoot, m.path);
+        if (!existsSync(workingTree)) continue;
+
+        const shaProc = Bun.spawn(["git", "rev-parse", "HEAD"], { cwd: workingTree, stdout: "pipe", stderr: "pipe" });
+        const sha = (await new Response(shaProc.stdout).text()).trim();
+        if (!/^[0-9a-f]{40}$/.test(sha)) continue;
+
+        const current = currentShas.get(m.path);
+        await spawnGit(["update-index", "--add", "--cacheinfo", `160000,${sha},${m.path}`], repoRoot);
+        if (current !== sha) {
+          fixes.push({ location: [".git", "index"], action: "synced", detail: `${m.path}: ${sha.slice(0, 8)}` });
+        }
+      }
+
+      return fixes;
+    },
+    catch: (e) => e instanceof Error ? e.message : String(e),
+  });
+}