@popoverinstall/cli 0.8.1 → 0.9.0

package/dist/repos.js

@@ -0,0 +1,1002 @@
+import { createInterface } from "node:readline/promises";
+import { defaultApiUrl, loadCredentials } from "@popoverinstall/shared";
+import { keyReader } from "./pager.js";
+import { box, glyph, style } from "./theme.js";
+import { bad, c, dim, ok, warn } from "./ui.js";
+import { WORKSPACE_REPO_CAP, tildify, whereAmI, } from "./repo-scan.js";
+const KNOWN_REFUSALS = [
+    "not_admin",
+    "github_not_linked",
+    "github_scope_missing",
+    "not_repo_admin",
+    "not_github",
+    "github_org_restricted",
+];
+// ---------------------------------------------------------------------------
+// Entry point
+// ---------------------------------------------------------------------------
+export async function reposCommand(argv) {
+    const asJson = argv.includes("--json");
+    const assumeYes = argv.includes("--yes") || argv.includes("-y");
+    const words = argv.filter((a) => !a.startsWith("-"));
+    // `--help` is stripped by the filter above, so it has to be looked for before the default
+    // takes over — otherwise `popover repos --help` silently runs the report instead.
+    const sub = argv.includes("--help") || argv.includes("-h") ? "help" : (words[0] ?? "list");
+    // Joined rather than requiring quotes, the same way `popover rename` takes a name: a team
+    // called "Team Rocket" is what people type, and insisting on shell quoting would be
+    // pedantry about word splitting.
+    const team = words.slice(1).join(" ").trim() || undefined;
+    switch (sub) {
+        case "list":
+            return report({ asJson });
+        case "add":
+            return add({ asJson, assumeYes, team });
+        case "rm":
+        case "remove":
+            if (asJson) {
+                // Not an oversight, and said in the one place a script would find out. `--json` exists
+                // for `/popover:repos`, which deliberately cannot remove: removal takes other people's
+                // agents out of scope and should be typed by a person who meant it.
+                return fail(true, "removal_is_interactive", "`popover repos rm` has no --json mode.", [
+                    "Removing a repo cuts other people's agents out of scope, so it is deliberately not",
+                    "something an agent can drive. Run `popover repos rm` in a terminal.",
+                ]);
+            }
+            return remove({ team });
+        case "help":
+            usage();
+            return 0;
+        default:
+            if (asJson) {
+                return fail(true, "bad_command", `Unknown repos command: ${sub}`, [
+                    "Valid forms: `popover repos --json` and `popover repos add [team] --json`.",
+                ]);
+            }
+            bad(`Unknown repos command: ${sub}`);
+            usage();
+            return 1;
+    }
+}
+function usage() {
+    console.log(`
+${c.bold("popover repos")} — which repositories your teams treat as one product
+
+  ${c.bold("popover repos")}                What this repo is on, and what your teams have listed
+  ${c.bold("popover repos add")} [team]     Register this repo with a team you administer
+  ${c.bold("popover repos rm")} [team]      Remove it
+
+  There is no repo argument: which repo you mean comes from where you are standing,
+  because registering one proves you hold it rather than that you can name it.
+
+  Inside Claude Code, ${c.cyan("/popover:repos")} reports and adds. It does not remove.
+`);
+}
+// ---------------------------------------------------------------------------
+// popover repos
+// ---------------------------------------------------------------------------
+async function report({ asJson }) {
+    const place = whereAmI(process.cwd());
+    const credentials = loadCredentials();
+    if (!credentials) {
+        if (asJson) {
+            console.log(JSON.stringify({ ok: false, error: "not_signed_in", ...placeJson(place) }));
+            return 1;
+        }
+        // The local half is still worth printing. Somebody running this while signed out is
+        // usually asking "what does popover think this directory is", and that answer needs no
+        // account.
+        renderPlace(place);
+        bad("This machine is not signed in, so nothing about your teams can be shown.");
+        dim("Run `popover login` first.");
+        return 1;
+    }
+    const view = await fetchView(credentials.device_token);
+    if (!view.ok) {
+        // The local half still gets printed. Half an answer beats none when the reason for
+        // running this was that something is not working, and what popover thinks this directory
+        // is happens to be the most common answer to that.
+        if (!asJson)
+            renderPlace(place);
+        return reportApiFailure(view, asJson);
+    }
+    if (asJson) {
+        console.log(JSON.stringify({ ok: true, ...placeJson(place), ...viewJson(place, view.body) }));
+        return 0;
+    }
+    renderPlace(place, view.body);
+    renderTeams(view.body);
+    renderOthers(place, view.body);
+    return 0;
+}
+// ---------------------------------------------------------------------------
+// popover repos add
+// ---------------------------------------------------------------------------
+async function add(opts) {
+    const { asJson } = opts;
+    const place = whereAmI(process.cwd());
+    const here = placeRepos(place);
+    if (here.length === 0)
+        return nothingHere(place, asJson);
+    const credentials = loadCredentials();
+    if (!credentials) {
+        return fail(asJson, "not_signed_in", "This machine is not signed in.", [
+            "Run `popover login` first — registering a repo happens against your account, not this",
+            "directory alone.",
+        ]);
+    }
+    const view = await fetchView(credentials.device_token);
+    if (!view.ok)
+        return reportApiFailure(view, asJson);
+    const { teams } = view.body;
+    if (teams.length === 0) {
+        return fail(asJson, "no_teams", "You are not on a team yet, so there is no list to add to.", [
+            `Create or join one at ${dashboard()}, then run this again.`,
+        ]);
+    }
+    const chosen = await pickTeam(teams, opts);
+    if (chosen.kind === "cancelled") {
+        dim("Nothing added.");
+        return 0;
+    }
+    if (chosen.kind === "failed")
+        return chosen.code;
+    const team = chosen.team;
+    // Named teams are listed rather than hidden, so the refusal is about permission rather than
+    // the team appearing not to exist — §4. This is the one branch a member of a big team hits
+    // most, and it is the reason `admins` is worth asking the API for.
+    if (!team.isAdmin) {
+        const lines = refusal("not_admin", { team, verb: "add" });
+        return fail(asJson, "not_admin", lines.headline, lines.hints);
+    }
+    const plan = planAdd(here, team, view.body);
+    if (plan.add.length === 0) {
+        return nothingToAdd(plan, team, asJson);
+    }
+    // The workspace case: everything found at once, behind one confirmation. A prompt per repo
+    // would be three prompts for the layout this feature exists to serve.
+    if (plan.add.length > 1 && !opts.assumeYes) {
+        const answer = await confirmAll(plan, team, place, asJson);
+        if (answer !== "yes")
+            return answer === "no" ? 0 : 1;
+    }
+    const added = [];
+    const failed = [];
+    for (const entry of plan.add) {
+        const result = await postRepo(credentials.device_token, team.id, entry.remote);
+        if (result.ok) {
+            added.push(entry.remote);
+            continue;
+        }
+        // Reported per repo rather than abandoning the batch. Two repos in one workspace can fail
+        // for genuinely different reasons — one is on GitHub and one is not, one is in an
+        // organization that has approved us and one is not — and stopping at the first would hide
+        // the second behind a retry.
+        const lines = refusalFor(result, entry.remote, team, "add", entry.repo);
+        failed.push({
+            remote: entry.remote,
+            reason: result.reason ?? String(result.status),
+            message: lines.headline,
+            hints: lines.hints,
+        });
+    }
+    if (asJson) {
+        console.log(JSON.stringify({
+            ok: added.length > 0,
+            team: { id: team.id, name: team.name },
+            added,
+            already: plan.already.map((r) => r.remote),
+            unpublished: plan.unpublished.map((r) => r.remote),
+            failed,
+        }));
+        return added.length > 0 ? 0 : 1;
+    }
+    for (const remote of added)
+        ok(`${remote} is on ${team.name}.`);
+    for (const entry of failed) {
+        bad(entry.message);
+        for (const hint of entry.hints)
+            dim(hint);
+    }
+    if (added.length > 0) {
+        dim(`Agents in ${added.length === 1 ? "it" : "them"} can see each other now, as long as both ` +
+            `people are on ${team.name} and both are in a repo on its list.`);
+    }
+    return added.length > 0 ? 0 : 1;
+}
+/** Everything the plan found was already listed, or holds no key. Say which. */
+function nothingToAdd(plan, team, asJson) {
+    if (asJson) {
+        console.log(JSON.stringify({
+            ok: true,
+            team: { id: team.id, name: team.name },
+            added: [],
+            already: plan.already.map((r) => r.remote),
+            unpublished: plan.unpublished.map((r) => r.remote),
+            failed: [],
+        }));
+        return 0;
+    }
+    for (const repo of plan.already)
+        ok(`${repo.remote} is already on ${team.name}.`);
+    for (const repo of plan.unpublished) {
+        bad(`popover holds no key for ${repo.remote}, so there is nothing to register.`);
+        for (const hint of unpublishedHints(repo))
+            dim(hint);
+    }
+    return plan.already.length > 0 && plan.unpublished.length === 0 ? 0 : 1;
+}
+/**
+ * Why a repo you are plainly standing in has no key on the server, and what to do about it.
+ *
+ * This is checked here rather than left to the API because the API cannot tell the difference.
+ * `register_team_repo` raises the same "no session of this user holds a key" for a clone
+ * popover has never seen and for a shallow clone it has seen and deliberately refused to key —
+ * and the second is both common (every CI-style `--depth 1` checkout) and fixable in one
+ * command, while the first needs a session to exist at all.
+ */
+function unpublishedHints(repo) {
+    if (repo.shallow) {
+        return [
+            "This is a shallow clone. popover will not key one, because the first commit it can see",
+            "is the graft boundary and that differs with every --depth — two teammates cloned at",
+            "different depths would be silently invisible to each other. `git fetch --unshallow`",
+            "here, then run this again.",
+        ];
+    }
+    return [
+        "Registering proves possession rather than naming a repo, and the proof comes from a",
+        "session your daemon has published from this clone. Open Claude Code here for a moment",
+        "(or check `popover status`), then run this again.",
+    ];
+}
+// ---------------------------------------------------------------------------
+// popover repos rm
+// ---------------------------------------------------------------------------
+async function remove({ team: typed }) {
+    const place = whereAmI(process.cwd());
+    const here = placeRepos(place);
+    if (here.length === 0)
+        return nothingHere(place, false);
+    const credentials = loadCredentials();
+    if (!credentials) {
+        bad("This machine is not signed in.");
+        dim("Run `popover login` first.");
+        return 1;
+    }
+    const view = await fetchView(credentials.device_token);
+    if (!view.ok)
+        return reportApiFailure(view, false);
+    /*
+     * Only the teams that actually list something here are offered.
+     *
+     * `add` picks among teams you administer; `rm` picks among teams that have this repo,
+     * which is a different set and a smaller one. Offering a team that lists nothing here would
+     * be offering a no-op, and — worse in a workspace — inviting a removal of the wrong repo.
+     */
+    const listings = removable(here, view.body);
+    if (listings.length === 0) {
+        warn(`Nothing here is on any of your teams' lists.`);
+        dim("`popover repos` shows what is where.");
+        return 0;
+    }
+    let target = listings[0];
+    if (listings.length > 1) {
+        if (typed) {
+            const matches = listings.filter((l) => matchesTeam(l.team, typed));
+            if (matches.length !== 1) {
+                bad(matches.length === 0
+                    ? `Nothing here is listed on a team matching "${typed}".`
+                    : `"${typed}" matches ${matches.map((m) => m.team.name).join(", ")}. Name one exactly.`);
+                for (const l of listings)
+                    dim(`${l.remote} is on ${l.team.name}`);
+                return 1;
+            }
+            target = matches[0];
+        }
+        else {
+            const picked = await chooseListing(listings);
+            if (!picked) {
+                dim("Nothing removed.");
+                return 0;
+            }
+            target = picked;
+        }
+    }
+    else if (typed && !matchesTeam(target.team, typed)) {
+        bad(`${target.remote} is on ${target.team.name}, not on a team matching "${typed}".`);
+        return 1;
+    }
+    if (!target.team.isAdmin) {
+        const lines = refusal("not_admin", { team: target.team, verb: "remove" });
+        bad(lines.headline);
+        for (const hint of lines.hints)
+            dim(hint);
+        return 1;
+    }
+    const result = await deleteRepo(credentials.device_token, target.team.id, target.remote);
+    if (!result.ok) {
+        const lines = refusalFor(result, target.remote, target.team, "remove");
+        bad(lines.headline);
+        for (const hint of lines.hints)
+            dim(hint);
+        return 1;
+    }
+    ok(`${target.remote} is off ${target.team.name}.`);
+    // Said plainly rather than left to be discovered. This is the sentence that makes removal
+    // worth thinking about before typing, and it is true of everyone on the team, not just you.
+    dim(`Agents in it and agents in ${target.team.name}'s other repos stop seeing each other at the`);
+    dim("next check — immediately for a new ask, and within the roster TTL for a cached roster.");
+    return 0;
+}
+/** Every (repo here, team that lists it) pair. A fork can be listed under `upstream`. */
+function removable(here, view) {
+    const listings = [];
+    for (const repo of here) {
+        for (const remote of repo.remotes) {
+            const row = view.repos.find((r) => r.remote === remote);
+            if (!row)
+                continue;
+            for (const teamId of row.teams) {
+                const team = view.teams.find((t) => t.id === teamId);
+                if (team)
+                    listings.push({ team, remote, repo });
+            }
+        }
+    }
+    return listings;
+}
+/**
+ * Sort the repos in front of us into the three things that can be true of them.
+ *
+ * The subtle part is *which remote* gets registered for a clone that has several. A fork has
+ * `origin = alice/backend` and `upstream = acme/backend` and publishes a key for each, so the
+ * remote to register is the first one the server confirms a key for — not blindly the primary,
+ * which would produce a refusal ("no key for alice/backend") that is true, unhelpful, and
+ * avoidable with information we already hold.
+ *
+ * When the server confirms none of them the repo is `unpublished`, which is checked here
+ * rather than discovered from a 4xx, because only this side knows whether the cause is a
+ * shallow clone.
+ */
+export function planAdd(here, team, view) {
+    const plan = { add: [], already: [], unpublished: [] };
+    for (const repo of here) {
+        const rows = repo.remotes
+            .map((remote) => view.repos.find((r) => r.remote === remote))
+            .filter((r) => r !== undefined);
+        if (rows.length === 0) {
+            plan.unpublished.push(repo);
+            continue;
+        }
+        if (rows.some((r) => r.teams.includes(team.id))) {
+            plan.already.push(repo);
+            continue;
+        }
+        // `repo.remotes` is primary-first and `rows` preserves that order, so `origin` still wins
+        // whenever the server knows about it.
+        plan.add.push({ repo, remote: rows[0].remote });
+    }
+    return plan;
+}
+/**
+ * Which teams a typed argument could mean.
+ *
+ * Matched by id, then by exact name, then by prefix — the same widening a person expects from
+ * `popover rename B1`. Case-insensitive, because a team called "Quolabs" is typed `quolabs`.
+ * Returns every match rather than picking one: two teams whose names share a prefix is a real
+ * arrangement, and silently registering a repo with the wrong one is not recoverable by the
+ * person who did it.
+ */
+export function resolveTeam(teams, typed) {
+    const needle = typed.trim().toLowerCase();
+    if (!needle)
+        return [];
+    const byId = teams.filter((t) => t.id.toLowerCase() === needle);
+    if (byId.length > 0)
+        return byId;
+    const exact = teams.filter((t) => t.name.toLowerCase() === needle);
+    if (exact.length > 0)
+        return exact;
+    return teams.filter((t) => t.name.toLowerCase().startsWith(needle));
+}
+function matchesTeam(team, typed) {
+    return resolveTeam([team], typed).length === 1;
+}
+/**
+ * One actionable sentence per reason, plus what to do about it.
+ *
+ * Written out longhand rather than generated, because the differences between them are the
+ * whole point and a template would flatten exactly the two that are easiest to confuse:
+ * `github_not_linked` and `github_scope_missing`. Most people who sign up for popover sign up
+ * *with GitHub*, which links an account with Clerk's default scopes and no `repo` — so the
+ * second is the common case, and telling that person "you have no GitHub account" sends them
+ * to link a second one and get the same refusal again.
+ */
+export function refusal(reason, ctx = {}) {
+    const team = ctx.team?.name ?? "that team";
+    const remote = ctx.remote ?? "this repo";
+    const url = `${dashboard()}/repos`;
+    switch (reason) {
+        case "not_admin": {
+            const verb = ctx.verb === "remove" ? "remove a repo" : "add a repo";
+            const admins = ctx.team?.admins?.filter(Boolean) ?? [];
+            return {
+                headline: `You need to be an admin of ${team} to ${verb}.`,
+                hints: [
+                    admins.length > 0
+                        ? `Ask ${humanList(admins)}, or ${ctx.verb === "remove" ? "remove" : "add"} it from ${url}`
+                        : `Ask an admin of ${team}, or ${ctx.verb === "remove" ? "remove" : "add"} it from ${url}`,
+                ],
+            };
+        }
+        case "github_not_linked":
+            return {
+                headline: "popover has no GitHub account for you, and registering a repo needs one.",
+                hints: [
+                    `Adding ${shortRepo(remote)} to ${team} means proving on GitHub that you administer`,
+                    `it, which we cannot do without a linked account. Link one at ${url}, then run this`,
+                    "again. Nothing else changes meanwhile: agents already in this repo still see each",
+                    "other exactly as before.",
+                ],
+            };
+        case "github_scope_missing":
+            return {
+                // Deliberately opens by confirming the account exists. Somebody who signed in with
+                // GitHub reads the first line and stops, so the first line has to be true for them.
+                headline: "Your GitHub account is linked, but has not granted popover access to repos.",
+                hints: [
+                    "Signing in with GitHub does not grant it: repository access is a much heavier",
+                    "consent screen, so it is asked for separately and only at the moment you add a repo.",
+                    `Grant it at ${url}, then run this again.`,
+                ],
+            };
+        case "not_repo_admin":
+            return {
+                headline: `GitHub says you are not an admin of ${shortRepo(remote)}.`,
+                hints: [
+                    `Being an admin of ${team} is not enough — the repository half of the check is`,
+                    "GitHub's, and it is what stops anyone registering a repo they merely hold a copy of.",
+                    "Ask someone with admin rights on the repository to add it.",
+                ],
+            };
+        case "not_github":
+            return {
+                headline: `Only GitHub repos can be registered, and ${shortRepo(remote)} is on ${host(remote)}.`,
+                hints: [
+                    "There is nothing to check ownership against there, so it cannot go on a team's list.",
+                    "This costs you nothing you had: agents in it still see each other the way they always",
+                    "have — same repo, same team. It is only the cross-repo list that needs GitHub.",
+                ],
+            };
+        case "github_org_restricted":
+            return {
+                // Never "that repo does not exist". GitHub answers 404 here, but we only ever ask
+                // about a repository the caller demonstrably has a clone of, so a 404 means access is
+                // being withheld — reporting it as absence would send somebody to check their spelling
+                // for as long as it took them to give up.
+                headline: `The ${owner(remote)} organization has not approved popover on GitHub.`,
+                hints: [
+                    `GitHub will not answer for ${shortRepo(remote)} at all, which for a repo you have a`,
+                    "clone of means access is being withheld rather than that it is missing. This is",
+                    "GitHub's OAuth App access restrictions, and it applies however much scope you grant.",
+                    `An owner of ${owner(remote)} approves popover under the organization's settings, in`,
+                    "Third-party access. Then run this again.",
+                ],
+            };
+    }
+}
+/**
+ * Turn an API failure into text, mapping an unknown reason to something honest.
+ *
+ * Exported for the tests rather than for other callers: the three branches below all exist to
+ * stop a non-refusal being rendered as a refusal, and each of them is one careless edit away
+ * from telling somebody to go and change permissions they have.
+ */
+export function refusalFor(result, remote, team, verb = "add", repo) {
+    if (result.status === 403 && result.reason && KNOWN_REFUSALS.includes(result.reason)) {
+        return refusal(result.reason, { team, remote, verb });
+    }
+    /*
+     * Possession, not permission — and the difference is the whole reason this is a 409 rather
+     * than one of the six reasons above. The caller may well administer both the team and the
+     * repository; what is missing is a session of theirs holding a key for this remote.
+     *
+     * `planAdd` normally catches this before a request is made, using the repo list the server
+     * itself just sent. Reaching here means the two disagreed — the session was swept between
+     * the GET and the POST, or the remote is on the list under a key published by somebody
+     * else's clone — so the local reasons are still the useful ones, since only this side knows
+     * whether the clone is shallow.
+     */
+    if (result.status === 409) {
+        return {
+            headline: `popover holds no key for ${shortRepo(remote)}, so there is nothing to register.`,
+            hints: repo ? unpublishedHints(repo) : [result.message ?? ""].filter(Boolean),
+        };
+    }
+    // A GitHub outage is not a refusal, and must never be rendered as one: "we could not find
+    // out" sent through the `not_repo_admin` wording would have somebody changing permissions on
+    // GitHub over a timeout.
+    if (result.status === 503 && result.error === "github_unavailable") {
+        return {
+            headline: `GitHub could not be reached, so nobody could check who administers ${shortRepo(remote)}.`,
+            hints: [
+                "Nothing was changed, and this is not a permissions problem. Try again in a moment.",
+                ...(result.message ? [result.message] : []),
+            ],
+        };
+    }
+    // The team came from the GET a moment ago, so a 404 here is a membership that changed
+    // underneath the command rather than a route that does not exist.
+    if (result.status === 404 && result.error === "not_found") {
+        return {
+            headline: `You are not on ${team.name} any more.`,
+            hints: ["Run `popover repos` again to see where you actually stand."],
+        };
+    }
+    if (result.status === 403) {
+        // A newer backend with a reason this build has never heard of. Relayed rather than
+        // guessed at: mapping it to the nearest known reason would produce confident instructions
+        // for the wrong problem.
+        return {
+            headline: `${team.name} refused that (${result.reason ?? "no reason given"}).`,
+            hints: [
+                `Adding ${shortRepo(remote)} was refused for a reason this version does not know about.`,
+                "Run `popover update` — and if it persists, the dashboard will explain it.",
+            ],
+        };
+    }
+    // Anything else our API took the trouble to write a sentence about. Relayed rather than
+    // replaced by a status code, because a backend newer than this build knows things this file
+    // does not, and "failed (422)" is not one of them.
+    if (result.ours && result.message) {
+        return { headline: result.message, hints: httpHints(result) };
+    }
+    return {
+        headline: httpHeadline(result, `${verb === "remove" ? "Removing" : "Adding"} ${shortRepo(remote)}`),
+        hints: httpHints(result),
+    };
+}
+/**
+ * The device token, on every request.
+ *
+ * `Authorization: Bearer <device_token>` rather than the token in a JSON body, which is what
+ * `/api/device/session` and `/api/fork/*` do. Not a new credential and not a new flow — the
+ * same long-lived token `popover login` wrote, sent the standard way — but a different place
+ * to put it, and the reason is that one of these three routes is a GET with no body to put it
+ * in. Splitting the scheme across methods would be worse than moving it for all three.
+ */
+function authHeaders(deviceToken) {
+    return { authorization: `Bearer ${deviceToken}`, "content-type": "application/json" };
+}
+async function fetchView(deviceToken) {
+    const result = await request(deviceToken, "GET", `${dashboard()}/api/teams/repos`);
+    if (!result.ok)
+        return result;
+    // Everything downstream indexes into these two arrays. Checked once, here, rather than
+    // defended against at forty call sites — and checked at all because the thing most likely
+    // to answer this route is not this route. See `ApiFailure.malformed`.
+    if (!isReposView(result.body)) {
+        return { ok: false, status: 200, ours: false, malformed: true };
+    }
+    return result;
+}
+/** Shape only. The server is trusted about contents; it is not trusted to be the server. */
+function isReposView(body) {
+    if (typeof body !== "object" || body === null)
+        return false;
+    const { teams, repos } = body;
+    return Array.isArray(teams) && Array.isArray(repos);
+}
+async function postRepo(deviceToken, teamId, remote) {
+    return request(deviceToken, "POST", `${dashboard()}/api/teams/${encodeURIComponent(teamId)}/repos`, { remote });
+}
+async function deleteRepo(deviceToken, teamId, remote) {
+    return request(deviceToken, "DELETE", `${dashboard()}/api/teams/${encodeURIComponent(teamId)}/repos`, { remote });
+}
+async function request(deviceToken, method, url, body) {
+    let res;
+    try {
+        res = await fetch(url, {
+            method,
+            headers: authHeaders(deviceToken),
+            ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            // Long enough for a cold serverless function plus a GitHub round trip, which is what a
+            // POST actually costs, and short enough that a wedged network does not look like a hang.
+            signal: AbortSignal.timeout(20_000),
+        });
+    }
+    catch (err) {
+        // Reported as a status of 0, which nothing else can produce, so `httpHeadline` can say
+        // "could not reach" rather than inventing a code.
+        return { ok: false, status: 0, ours: false, error: String(err) };
+    }
+    if (res.ok) {
+        // 204 on DELETE, and a 201 with no body is legal too. `json()` on an empty body throws,
+        // and throwing on success would report a removal that happened as one that did not.
+        const parsed = await res.json().catch(() => ({}));
+        return { ok: true, body: parsed };
+    }
+    const parsed = (await res.json().catch(() => null));
+    return {
+        ok: false,
+        status: res.status,
+        ...(typeof parsed?.reason === "string" ? { reason: parsed.reason } : {}),
+        ...(typeof parsed?.error === "string" ? { error: parsed.error } : {}),
+        ...(typeof parsed?.message === "string" ? { message: parsed.message } : {}),
+        ours: typeof parsed?.error === "string",
+    };
+}
+function httpHeadline(result, what) {
+    if (result.status === 0)
+        return `Could not reach ${dashboard()}.`;
+    if (result.malformed)
+        return `${dashboard()} answered, but not with a list of repos.`;
+    if (result.status === 401 && result.ours)
+        return "This machine's credentials were refused.";
+    if (result.status === 401 || result.status === 403) {
+        return `Something between here and ${dashboard()} refused the request (${result.status}).`;
+    }
+    if (result.status === 404)
+        return `${what} is not something this backend knows how to do.`;
+    if (result.status === 429)
+        return "Too many requests. Wait a minute and try again.";
+    if (result.status >= 500)
+        return `${dashboard()} could not complete the request.`;
+    return `${what} failed (${result.status}${result.error ? `: ${result.error}` : ""}).`;
+}
+function httpHints(result) {
+    if (result.status === 0)
+        return ["Check the network, then try again."];
+    if (result.malformed) {
+        return [
+            "Either something is standing in front of the API — an SSO proxy or a protected preview",
+            "answers a signed-out request with a login page rather than a refusal — or this backend",
+            "predates team repos. Check POPOVER_API_URL, then run `popover update`.",
+        ];
+    }
+    if (result.status === 401 && result.ours) {
+        return ["Run `popover login` to reconnect this machine."];
+    }
+    if (result.status === 401 || result.status === 403) {
+        return [
+            "The refusal did not come from popover — an SSO proxy or a protected preview",
+            "deployment answers this way. Signing in again would not help.",
+        ];
+    }
+    if (result.status === 404) {
+        return [
+            "Team repos need a backend that has them. If you are pointed at a preview deployment,",
+            "check POPOVER_API_URL; otherwise run `popover update`.",
+        ];
+    }
+    if (result.status >= 500)
+        return ["Nothing was changed. Try again in a moment."];
+    return [];
+}
+function reportApiFailure(result, asJson) {
+    return fail(asJson, result.malformed ? "unexpected_response" : (result.error ?? `http_${result.status}`), httpHeadline(result, "That"), httpHints(result));
+}
+// ---------------------------------------------------------------------------
+// Rendering
+// ---------------------------------------------------------------------------
+/** The repos this directory could register — one inside a clone, several in a workspace. */
+function placeRepos(place) {
+    if (place.kind === "repo")
+        return [place.repo];
+    if (place.kind === "workspace")
+        return place.repos;
+    return [];
+}
+function renderPlace(place, view) {
+    console.log("");
+    if (place.kind === "none") {
+        console.log(`  ${c.dim(tildify(place.dir))}`);
+        console.log(`  ${noPlaceSentence(place.why)}`);
+        console.log("");
+        return;
+    }
+    if (place.kind === "workspace") {
+        console.log(`  ${c.bold(tildify(place.dir))} ${c.dim(`— ${place.repos.length} repos, none of them this directory`)}`);
+    }
+    else {
+        console.log(`  ${c.bold(tildify(place.dir))}`);
+    }
+    console.log("");
+    for (const repo of placeRepos(place)) {
+        console.log(`  ${c.bold(repo.name)}  ${c.dim(repo.remote)}`);
+        for (const line of repoStatus(repo, view))
+            console.log(`    ${line}`);
+    }
+    console.log("");
+}
+/** Where one local repo stands: the teams listing it, or why it is on none. */
+function repoStatus(repo, view) {
+    if (!view)
+        return [];
+    const rows = repo.remotes
+        .map((remote) => view.repos.find((r) => r.remote === remote))
+        .filter((r) => r !== undefined);
+    const onTeams = view.teams.filter((t) => rows.some((r) => r.teams.includes(t.id)));
+    const lines = onTeams.map((t) => c.green(`on ${t.name}`));
+    if (rows.length === 0) {
+        lines.push(c.yellow(repo.shallow
+            ? "no key — shallow clone, run `git fetch --unshallow`"
+            : "no key yet — popover has published no session from this clone"));
+        return lines;
+    }
+    if (onTeams.length === 0) {
+        // Named alongside the fact, because "on no list" and "you cannot put it on one" are
+        // different situations and only one of them is worth acting on.
+        lines.push(host(repo.remote) === "github.com"
+            ? c.dim("on no list — `popover repos add`")
+            : c.dim(`on no list, and ${host(repo.remote)} repos cannot be listed`));
+    }
+    return lines;
+}
+function renderTeams(view) {
+    for (const team of view.teams) {
+        const listed = view.repos.filter((r) => r.teams.includes(team.id));
+        console.log(`  ${c.bold(team.name)}${team.isAdmin ? c.dim(" · you administer it") : ""}`);
+        if (listed.length === 0) {
+            console.log(`    ${c.dim("no repos listed")}`);
+        }
+        for (const row of listed) {
+            // A null `lastSeen` is a repo on the list that this account has never worked in. Marked
+            // rather than dropped: "the team lists four and you hold two" is the fact somebody
+            // reading this is usually after.
+            console.log(`    ${row.remote}${row.lastSeen === null ? c.dim("  (not on this machine)") : ""}`);
+        }
+        console.log("");
+    }
+}
+/** Repos you have sessions in that no team lists, and are not standing in. */
+function renderOthers(place, view) {
+    const hereRemotes = new Set(placeRepos(place).flatMap((r) => r.remotes));
+    const others = view.repos.filter((r) => !hereRemotes.has(r.remote) && r.teams.length === 0 && r.lastSeen !== null);
+    if (others.length === 0)
+        return;
+    console.log(`  ${c.bold("You also work in")}`);
+    for (const row of others) {
+        console.log(`    ${row.remote}${host(row.remote) === "github.com" ? "" : c.dim(`  (${host(row.remote)} — cannot be listed)`)}`);
+    }
+    console.log("");
+    dim("Add one by running `popover repos add` from inside it.");
+    console.log("");
+}
+/** Why this directory offers nothing, in one sentence each. */
+function noPlaceSentence(why) {
+    switch (why) {
+        case "not-a-repo":
+            return "is not a git repository, and nothing directly inside it is one either.";
+        case "no-remote":
+            return "is a git repository with no remote, so there is no shared repo to register.";
+        case "home":
+            return "is your home directory. popover will not treat it as a workspace — its children are usually every repo you have ever cloned rather than one project.";
+        case "filesystem-root":
+            return "is a filesystem root, which popover will not scan.";
+        case "too-many":
+            return `holds more repos than a workspace can publish (the limit is ${WORKSPACE_REPO_CAP}), so it is a code dump rather than a project. Run this from inside one of them instead.`;
+        case "unreadable":
+            return "could not be read.";
+    }
+}
+function nothingHere(place, asJson) {
+    const why = place.kind === "none" ? place.why : "not-a-repo";
+    return fail(asJson, `no_repo_here:${why}`, `There is nothing here to register.`, [
+        `${tildify(place.dir)} ${noPlaceSentence(why)}`,
+        "Which repo you mean comes from where you are standing — registering one proves you hold",
+        "it rather than that you can name it, so there is deliberately no repo argument.",
+    ]);
+}
+function placeJson(place) {
+    return {
+        cwd: place.dir,
+        kind: place.kind,
+        ...(place.kind === "none" ? { why: place.why, message: noPlaceSentence(place.why) } : {}),
+        here: placeRepos(place).map((r) => ({
+            name: r.name,
+            remote: r.remote,
+            remotes: r.remotes,
+            shallow: r.shallow,
+            github: host(r.remote) === "github.com",
+        })),
+    };
+}
+function viewJson(place, view) {
+    const rowFor = (remote) => view.repos.find((r) => r.remote === remote);
+    return {
+        teams: view.teams.map((t) => ({
+            id: t.id,
+            name: t.name,
+            isAdmin: t.isAdmin,
+            ...(t.admins ? { admins: t.admins } : {}),
+            listed: view.repos.filter((r) => r.teams.includes(t.id)).map((r) => r.remote),
+        })),
+        // Every local repo, resolved against what the server knows, so the caller needs no
+        // second pass to work out what is addable.
+        status: placeRepos(place).map((repo) => {
+            const rows = repo.remotes.map(rowFor).filter((r) => r !== undefined);
+            return {
+                remote: repo.remote,
+                published: rows.length > 0,
+                onTeams: view.teams.filter((t) => rows.some((r) => r.teams.includes(t.id))).map((t) => t.id),
+            };
+        }),
+    };
+}
+/**
+ * Which team to add to.
+ *
+ * Named explicitly, it is resolved against *every* team the caller is on — including ones they
+ * do not administer — so that a member who names their team gets the permission refusal rather
+ * than "no such team", which is §4's rule and the difference between a wall and a next step.
+ *
+ * Unnamed, the candidates are the teams they administer, because those are the ones an add can
+ * succeed on. One of them runs without asking; several prompt. Zero is not an ambiguity but a
+ * refusal, and it names the teams so the person can see which one to ask about.
+ */
+async function pickTeam(teams, opts) {
+    if (opts.team) {
+        const matches = resolveTeam(teams, opts.team);
+        if (matches.length === 1)
+            return { kind: "team", team: matches[0] };
+        const code = fail(opts.asJson, matches.length === 0 ? "no_such_team" : "ambiguous_team", matches.length === 0
+            ? `You are not on a team called "${opts.team}".`
+            : `"${opts.team}" matches ${matches.map((t) => t.name).join(", ")}. Name one exactly.`, teams.map((t) => `${t.name}${t.isAdmin ? " (you administer it)" : ""}`));
+        return { kind: "failed", code };
+    }
+    const admin = teams.filter((t) => t.isAdmin);
+    if (admin.length === 0) {
+        // Every team, named, with its admins where we know them. A member of three teams should
+        // not have to guess which of the three this command was even talking about.
+        const lines = teams.flatMap((t) => {
+            const text = refusal("not_admin", { team: t, verb: "add" });
+            return [text.headline, ...text.hints];
+        });
+        const code = fail(opts.asJson, "not_admin", lines[0], lines.slice(1));
+        return { kind: "failed", code };
+    }
+    if (admin.length === 1)
+        return { kind: "team", team: admin[0] };
+    if (opts.asJson || !process.stdin.isTTY || !process.stdout.isTTY) {
+        // A choice, handed back rather than made. In `--json` this is what lets the model put the
+        // options in front of its user with `AskUserQuestion` instead of picking a team on their
+        // behalf — which is a decision about who can see whose agents.
+        const code = fail(opts.asJson, "ambiguous_team", `You administer ${admin.length} teams, so name the one to add to.`, admin.map((t) => `popover repos add ${t.name}`));
+        return { kind: "failed", code };
+    }
+    const shown = admin.slice(0, 9);
+    box({ title: "Add this repo to", lines: shown.map((t, i) => `${style.white(String(i + 1))}  ${t.name}`) });
+    console.log("");
+    if (admin.length > shown.length) {
+        dim(`${admin.length - shown.length} more — name one instead: popover repos add <team>`);
+        console.log("");
+    }
+    if (teams.length > admin.length) {
+        // Never silently omit them: a list that shows one of your three teams looks like a bug in
+        // the roster rather than a statement about permissions.
+        dim(`${teams.length - admin.length} other ${teams.length - admin.length === 1 ? "team is" : "teams are"} not shown — you are not an admin of ${teams.length - admin.length === 1 ? "it" : "them"}.`);
+        console.log("");
+    }
+    const choice = await chooseNumber(shown.length);
+    return choice === null ? { kind: "cancelled" } : { kind: "team", team: shown[choice] };
+}
+/** Which listing to remove, when this directory is on more than one team's list. */
+async function chooseListing(listings) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        bad("More than one team lists a repo here, and there is nothing to pick with.");
+        for (const l of listings)
+            dim(`popover repos rm ${l.team.name}   (${l.remote})`);
+        return null;
+    }
+    const shown = listings.slice(0, 9);
+    box({
+        title: "Remove from",
+        lines: shown.map((l, i) => `${style.white(String(i + 1))}  ${l.team.name}  ${style.dim(l.remote)}`),
+    });
+    console.log("");
+    const choice = await chooseNumber(shown.length);
+    return choice === null ? null : shown[choice];
+}
+/** A digit, or null for anything meaning "leave it alone". Mirrors `popover rename`'s picker. */
+async function chooseNumber(count) {
+    const range = count === 1 ? "1" : `1-${count}`;
+    process.stdout.write(style.dim(`   ${range} to pick   ${glyph.dot}   q cancel  `));
+    const keys = keyReader();
+    try {
+        for (;;) {
+            const key = await keys.next();
+            if (key === "q" || key === "escape" || key === "quit" || key === "enter")
+                return null;
+            const n = Number.parseInt(key, 10);
+            if (Number.isInteger(n) && n >= 1 && n <= count)
+                return n - 1;
+        }
+    }
+    finally {
+        keys.close();
+        // Raw mode swallowed the echo of whatever ended this, so close the line ourselves.
+        console.log("");
+    }
+}
+/**
+ * The workspace confirmation: everything found, in one question.
+ *
+ * Defaults to yes. The person ran `add` in a directory whose children are the repos, which is
+ * as clear a statement of intent as this command ever gets — and the cost of a wrong yes is a
+ * repo on a list that an admin can remove, not something irreversible.
+ */
+async function confirmAll(plan, team, place, asJson) {
+    const names = plan.add.map((e) => e.repo.name);
+    if (asJson || !process.stdin.isTTY || !process.stdout.isTTY) {
+        // Not a prompt an agent may answer for its user. Handed back as a refusal carrying the
+        // list and the flag that would confirm it, so `/popover:repos` can ask a person.
+        fail(asJson, "needs_confirmation", `${tildify(place.dir)} contains ${plan.add.length} repos not on ${team.name}.`, [...names, `Re-run with --yes to add ${plan.add.length === 2 ? "both" : "all of them"}.`]);
+        return "cannot-ask";
+    }
+    console.log("");
+    console.log(`  ${tildify(place.dir)} contains ${plan.add.length} ${plan.add.length === 1 ? "repo" : "repos"} not on ${team.name}:`);
+    console.log(`    ${names.join("  ")}`);
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = (await rl.question(`  Add ${allOf(plan.add.length)}? [Y/n] `)).trim().toLowerCase();
+        return answer === "" || answer === "y" || answer === "yes" ? "yes" : "no";
+    }
+    finally {
+        rl.close();
+    }
+}
+/** "all three", "both", "all 12" — the shape the question is actually asked in. */
+function allOf(count) {
+    if (count === 2)
+        return "both";
+    const words = ["", "", "", "three", "four", "five", "six", "seven", "eight", "nine", "ten"];
+    return `all ${words[count] ?? String(count)}`;
+}
+/** "Ana Oyelaran or Priya Raman" — an *or*, because asking either of them is enough. */
+function humanList(names) {
+    if (names.length === 1)
+        return names[0];
+    if (names.length === 2)
+        return `${names[0]} or ${names[1]}`;
+    return `${names.slice(0, -1).join(", ")} or ${names[names.length - 1]}`;
+}
+// ---------------------------------------------------------------------------
+// Small shared pieces
+// ---------------------------------------------------------------------------
+/** `github.com` from `github.com/acme/backend`. */
+function host(remote) {
+    return remote.split("/")[0] ?? remote;
+}
+/** `acme/backend` — what GitHub calls it, and what an error should name. */
+function shortRepo(remote) {
+    const parts = remote.split("/");
+    return parts.length > 1 ? parts.slice(1).join("/") : remote;
+}
+/** `acme` — the organization whose owner has to approve us. */
+function owner(remote) {
+    return remote.split("/")[1] ?? "that";
+}
+/**
+ * The origin to talk to, and to send people to.
+ *
+ * `defaultApiUrl()` rather than `credentials.api_url` directly, so `POPOVER_API_URL` points
+ * this at a dev checkout or a preview the same way it does `popover fork`. It still falls back
+ * to the origin this machine signed in to, which is what makes the printed dashboard link land
+ * somewhere the reader is already signed in.
+ */
+function dashboard() {
+    return defaultApiUrl().replace(/\/+$/, "");
+}
+/** The two failure shapes, from one call. Mirrors `popover fork`'s `fail`. */
+function fail(asJson, code, message, hints) {
+    if (asJson) {
+        console.log(JSON.stringify({ ok: false, error: code, message, hints }));
+        return 1;
+    }
+    bad(message);
+    for (const hint of hints)
+        dim(hint);
+    return 1;
+}
+//# sourceMappingURL=repos.js.map