@prover-coder-ai/docker-git 1.0.15 → 1.0.17

package/src/docker-git/menu-select.ts

@@ -1,53 +1,19 @@
-import { runDockerComposeDown } from "@effect-template/lib/shell/docker"
-import type { AppError } from "@effect-template/lib/usecases/errors"
-import { mcpPlaywrightUp } from "@effect-template/lib/usecases/mcp-playwright"
-import {
-  connectProjectSshWithUp,
-  deleteDockerGitProject,
-  listRunningProjectItems,
-  type ProjectItem
-} from "@effect-template/lib/usecases/projects"
-
-import { Effect, Match, pipe } from "effect"
-
-import { buildConnectEffect, isConnectMcpToggleInput } from "./menu-select-connect.js"
-import { loadRuntimeByProject, runtimeForSelection } from "./menu-select-runtime.js"
-import { resetToMenu, resumeTui, suspendTui } from "./menu-shared.js"
-import type {
-  MenuEnv,
-  MenuKeyInput,
-  MenuRunner,
-  MenuViewContext,
-  SelectProjectRuntime,
-  ViewState
-} from "./menu-types.js"
-
-type SelectContext = MenuViewContext & {
-  readonly activeDir: string | null
-  readonly runner: MenuRunner
-  readonly setSshActive: (active: boolean) => void
-  readonly setSkipInputs: (update: (value: number) => number) => void
-}
+import { Match } from "effect"
 
-const emptyRuntimeByProject = (): Readonly<Record<string, SelectProjectRuntime>> => ({})
-
-export const startSelectView = (
-  items: ReadonlyArray<ProjectItem>,
-  purpose: "Connect" | "Down" | "Info" | "Delete",
-  context: Pick<SelectContext, "setView" | "setMessage">,
-  runtimeByProject: Readonly<Record<string, SelectProjectRuntime>> = emptyRuntimeByProject()
-) => {
-  context.setMessage(null)
-  context.setView({
-    _tag: "SelectProject",
-    purpose,
-    items,
-    runtimeByProject,
-    selected: 0,
-    confirmDelete: false,
-    connectEnableMcpPlaywright: false
-  })
-}
+import {
+  runAuthSelection,
+  runConnectSelection,
+  runDeleteSelection,
+  runDownSelection,
+  runInfoSelection,
+  type SelectContext
+} from "./menu-select-actions.js"
+import { isConnectMcpToggleInput } from "./menu-select-connect.js"
+import { runtimeForSelection } from "./menu-select-runtime.js"
+import { resetToMenu } from "./menu-shared.js"
+import type { MenuKeyInput, ViewState } from "./menu-types.js"
+
+export { startSelectView } from "./menu-select-view.js"
 
 const clampIndex = (value: number, size: number): number => {
   if (size <= 0) {
@@ -123,122 +89,8 @@ const handleSelectNavigation = (
   return false
 }
 
-const runWithSuspendedTui = (
-  context: Pick<SelectContext, "runner" | "setMessage" | "setSkipInputs">,
-  effect: Effect.Effect<void, AppError, MenuEnv>,
-  onResume: () => void,
-  doneMessage: string
-) => {
-  context.runner.runEffect(
-    pipe(
-      Effect.sync(suspendTui),
-      Effect.zipRight(effect),
-      Effect.ensuring(
-        Effect.sync(() => {
-          resumeTui()
-          onResume()
-          context.setSkipInputs(() => 2)
-        })
-      ),
-      Effect.tap(() =>
-        Effect.sync(() => {
-          context.setMessage(doneMessage)
-        })
-      )
-    )
-  )
-}
-
-const runConnectSelection = (
-  selected: ProjectItem,
-  context: SelectContext,
-  enableMcpPlaywright: boolean
-) => {
-  context.setMessage(
-    enableMcpPlaywright
-      ? `Enabling Playwright MCP for ${selected.displayName}, then connecting...`
-      : `Connecting to ${selected.displayName}...`
-  )
-  context.setSshActive(true)
-  runWithSuspendedTui(
-    context,
-    buildConnectEffect(selected, enableMcpPlaywright, {
-      connectWithUp: (item) =>
-        connectProjectSshWithUp(item).pipe(
-          Effect.mapError((error): AppError => error)
-        ),
-      enableMcpPlaywright: (projectDir) =>
-        mcpPlaywrightUp({ _tag: "McpPlaywrightUp", projectDir, runUp: false }).pipe(
-          Effect.asVoid,
-          Effect.mapError((error): AppError => error)
-        )
-    }),
-    () => {
-      context.setSshActive(false)
-    },
-    "SSH session ended. Press Esc to return to the menu."
-  )
-}
-
-const runDownSelection = (selected: ProjectItem, context: SelectContext) => {
-  context.setMessage(`Stopping ${selected.displayName}...`)
-  context.runner.runEffect(
-    pipe(
-      Effect.sync(suspendTui),
-      Effect.zipRight(runDockerComposeDown(selected.projectDir)),
-      Effect.zipRight(listRunningProjectItems),
-      Effect.flatMap((items) =>
-        pipe(
-          loadRuntimeByProject(items),
-          Effect.map((runtimeByProject) => ({ items, runtimeByProject }))
-        )
-      ),
-      Effect.tap(({ items, runtimeByProject }) =>
-        Effect.sync(() => {
-          if (items.length === 0) {
-            resetToMenu(context)
-            context.setMessage("No running docker-git containers.")
-            return
-          }
-          startSelectView(items, "Down", context, runtimeByProject)
-          context.setMessage("Container stopped. Select another to stop, or Esc to return.")
-        })
-      ),
-      Effect.ensuring(
-        Effect.sync(() => {
-          resumeTui()
-          context.setSkipInputs(() => 2)
-        })
-      ),
-      Effect.asVoid
-    )
-  )
-}
-
-const runInfoSelection = (selected: ProjectItem, context: SelectContext) => {
-  context.setMessage(`Details for ${selected.displayName} are shown on the right. Press Esc to return to the menu.`)
-}
-
-const runDeleteSelection = (selected: ProjectItem, context: SelectContext) => {
-  context.setMessage(`Deleting ${selected.displayName}...`)
-  runWithSuspendedTui(
-    context,
-    deleteDockerGitProject(selected).pipe(
-      Effect.tap(() =>
-        Effect.sync(() => {
-          if (context.activeDir === selected.projectDir) {
-            context.setActiveDir(null)
-          }
-          context.setView({ _tag: "Menu" })
-        })
-      )
-    ),
-    () => {
-      // Only return to menu on success (see Effect.tap above).
-    },
-    "Project deleted."
-  )
-}
+const formatSshSessionsLabel = (sshSessions: number): string =>
+  sshSessions === 1 ? "1 active SSH session" : `${sshSessions} active SSH sessions`
 
 const handleSelectReturn = (
   view: Extract<ViewState, { readonly _tag: "SelectProject" }>,
@@ -251,15 +103,17 @@ const handleSelectReturn = (
     return
   }
   const selectedRuntime = runtimeForSelection(view, selected)
-  const sshSessionsLabel = selectedRuntime.sshSessions === 1
-    ? "1 active SSH session"
-    : `${selectedRuntime.sshSessions} active SSH sessions`
+  const sshSessionsLabel = formatSshSessionsLabel(selectedRuntime.sshSessions)
 
   Match.value(view.purpose).pipe(
     Match.when("Connect", () => {
       context.setActiveDir(selected.projectDir)
       runConnectSelection(selected, context, view.connectEnableMcpPlaywright)
     }),
+    Match.when("Auth", () => {
+      context.setActiveDir(selected.projectDir)
+      runAuthSelection(selected, context)
+    }),
     Match.when("Down", () => {
       if (selectedRuntime.sshSessions > 0 && !view.confirmDelete) {
         context.setMessage(
@@ -289,30 +143,3 @@ const handleSelectReturn = (
     Match.exhaustive
   )
 }
-
-export const loadSelectView = <E>(
-  effect: Effect.Effect<ReadonlyArray<ProjectItem>, E, MenuEnv>,
-  purpose: "Connect" | "Down" | "Info" | "Delete",
-  context: Pick<SelectContext, "setView" | "setMessage">
-): Effect.Effect<void, E, MenuEnv> =>
-  pipe(
-    effect,
-    Effect.flatMap((items) =>
-      pipe(
-        loadRuntimeByProject(items),
-        Effect.flatMap((runtimeByProject) =>
-          Effect.sync(() => {
-            if (items.length === 0) {
-              context.setMessage(
-                purpose === "Down"
-                  ? "No running docker-git containers."
-                  : "No docker-git projects found."
-              )
-              return
-            }
-            startSelectView(items, purpose, context, runtimeByProject)
-          })
-        )
-      )
-    )
-  )

package/src/docker-git/menu-shared.ts

@@ -1,5 +1,7 @@
 import type { MenuViewContext, ViewState } from "./menu-types.js"
 
+import { Effect, pipe } from "effect"
+
 // CHANGE: share menu escape handling across flows
 // WHY: avoid duplicated logic in TUI handlers
 // QUOTE(ТЗ): "А ты можешь сделать удобный выбор проектов?"
@@ -13,10 +15,31 @@ import type { MenuViewContext, ViewState } from "./menu-types.js"
 
 type MenuResetContext = Pick<MenuViewContext, "setView" | "setMessage">
 
-type StdoutWrite = typeof process.stdout.write
+type OutputWrite = typeof process.stdout.write
 
 let stdoutPatched = false
 let stdoutMuted = false
+let baseStdoutWrite: OutputWrite | null = null
+let baseStderrWrite: OutputWrite | null = null
+
+const wrapWrite = (baseWrite: OutputWrite): OutputWrite =>
+(
+  chunk: string | Uint8Array,
+  encoding?: BufferEncoding | ((err?: Error | null) => void),
+  cb?: (err?: Error | null) => void
+) => {
+  if (stdoutMuted) {
+    const callback = typeof encoding === "function" ? encoding : cb
+    if (typeof callback === "function") {
+      callback()
+    }
+    return true
+  }
+  if (typeof encoding === "function") {
+    return baseWrite(chunk, encoding)
+  }
+  return baseWrite(chunk, encoding, cb)
+}
 
 const disableMouseModes = (): void => {
   // Disable xterm/urxvt mouse tracking and "alternate scroll" mode (wheel -> arrow keys).
@@ -39,28 +62,116 @@ const ensureStdoutPatched = (): void => {
   if (stdoutPatched) {
     return
   }
-  const baseWrite: StdoutWrite = process.stdout.write.bind(process.stdout)
-  const mutedWrite: StdoutWrite = (
-    chunk: string | Uint8Array,
-    encoding?: BufferEncoding | ((err?: Error | null) => void),
-    cb?: (err?: Error | null) => void
-  ) => {
-    if (stdoutMuted) {
-      const callback = typeof encoding === "function" ? encoding : cb
-      if (typeof callback === "function") {
-        callback()
-      }
-      return true
+  baseStdoutWrite = process.stdout.write.bind(process.stdout)
+  baseStderrWrite = process.stderr.write.bind(process.stderr)
+
+  process.stdout.write = wrapWrite(baseStdoutWrite)
+  process.stderr.write = wrapWrite(baseStderrWrite)
+  stdoutPatched = true
+}
+
+// CHANGE: allow writing to the terminal even while stdout is muted
+// WHY: we mute Ink renders during interactive commands, but still need to show prompts/errors
+// REF: user-request-2026-02-18-tui-output-hidden
+// SOURCE: n/a
+// PURITY: SHELL
+// EFFECT: n/a
+// INVARIANT: bypasses the mute wrapper safely
+export const writeToTerminal = (text: string): void => {
+  ensureStdoutPatched()
+  const write = baseStdoutWrite ?? process.stdout.write.bind(process.stdout)
+  write(text)
+}
+
+// CHANGE: keep the user on the primary screen until they acknowledge
+// WHY: otherwise output from failed docker/gh commands gets hidden again when TUI resumes
+// REF: user-request-2026-02-18-tui-output-hidden
+// SOURCE: n/a
+// PURITY: SHELL
+// EFFECT: Effect<void, never, never>
+// INVARIANT: no-op when stdin/stdout aren't TTY (CI/e2e)
+export const pauseForEnter = (
+  prompt = "Press Enter to return to docker-git..."
+): Effect.Effect<void> => {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    return Effect.void
+  }
+
+  return Effect.async((resume) => {
+    // Ensure the prompt isn't glued to the last command line.
+    writeToTerminal(`\n${prompt}\n`)
+    process.stdin.resume()
+
+    const cleanup = () => {
+      process.stdin.off("data", onData)
     }
-    if (typeof encoding === "function") {
-      return baseWrite(chunk, encoding)
+
+    const onData = () => {
+      cleanup()
+      resume(Effect.void)
     }
-    return baseWrite(chunk, encoding, cb)
+
+    process.stdin.on("data", onData)
+
+    return Effect.sync(() => {
+      cleanup()
+    })
+  }).pipe(Effect.asVoid)
+}
+
+export const writeErrorAndPause = (renderedError: string): Effect.Effect<void> =>
+  pipe(
+    Effect.sync(() => {
+      writeToTerminal(`\n[docker-git] ${renderedError}\n`)
+    }),
+    Effect.zipRight(pauseForEnter()),
+    Effect.asVoid
+  )
+
+export const withSuspendedTui = <A, E, R>(
+  effect: Effect.Effect<A, E, R>,
+  options?: {
+    readonly onError?: (error: E) => Effect.Effect<void>
+    readonly onResume?: () => void
   }
-  process.stdout.write = mutedWrite
-  stdoutPatched = true
+): Effect.Effect<A, E, R> => {
+  const withError = options?.onError
+    ? pipe(effect, Effect.tapError((error) => Effect.ignore(options.onError?.(error) ?? Effect.void)))
+    : effect
+
+  return pipe(
+    Effect.sync(suspendTui),
+    Effect.zipRight(withError),
+    Effect.ensuring(
+      Effect.sync(() => {
+        resumeTui()
+        options?.onResume?.()
+      })
+    )
+  )
+}
+
+export type SkipInputsContext = {
+  readonly setSkipInputs: (update: (value: number) => number) => void
+}
+
+export type SshActiveContext = {
+  readonly setSshActive: (active: boolean) => void
 }
 
+export const resumeWithSkipInputs = (context: SkipInputsContext, extra?: () => void) => () => {
+  extra?.()
+  context.setSkipInputs(() => 2)
+}
+
+export const resumeSshWithSkipInputs = (context: SkipInputsContext & SshActiveContext) =>
+  resumeWithSkipInputs(context, () => {
+    context.setSshActive(false)
+  })
+
+export const pauseOnError = <E>(render: (error: E) => string) => (error: E): Effect.Effect<void> =>
+  writeErrorAndPause(render(error))
+
 // CHANGE: toggle stdout write muting for Ink rendering
 // WHY: allow SSH sessions to own the terminal without TUI redraws
 // QUOTE(ТЗ): "при изменении разершения он всё ломает?"
@@ -94,7 +205,9 @@ export const suspendTui = (): void => {
   if (process.stdin.isTTY && typeof process.stdin.setRawMode === "function") {
     process.stdin.setRawMode(false)
   }
-  process.stdout.write("\u001B[?1049l\u001B[2J\u001B[H")
+  // Switch back to the primary screen so interactive commands (ssh/gh/codex)
+  // can render normally. Do not clear it: users may need scrollback (OAuth codes/URLs).
+  process.stdout.write("\u001B[?1049l")
   setStdoutMuted(true)
 }
 
@@ -114,6 +227,7 @@ export const resumeTui = (): void => {
   }
   setStdoutMuted(false)
   disableMouseModes()
+  // Return to the alternate screen for Ink rendering.
   process.stdout.write("\u001B[?1049h\u001B[2J\u001B[H")
   if (process.stdin.isTTY && typeof process.stdin.setRawMode === "function") {
     process.stdin.setRawMode(true)
@@ -128,7 +242,8 @@ export const leaveTui = (): void => {
   // Ensure we don't leave the terminal in a broken "mouse reporting" mode.
   setStdoutMuted(false)
   disableMouseModes()
-  process.stdout.write("\u001B[?1049l\u001B[2J\u001B[H")
+  // Restore the primary screen on exit without clearing it (keeps useful scrollback).
+  process.stdout.write("\u001B[?1049l")
   if (process.stdin.isTTY && typeof process.stdin.setRawMode === "function") {
     process.stdin.setRawMode(false)
   }

package/src/docker-git/menu-types.ts

@@ -40,13 +40,14 @@ export type MenuKeyInput = {
   readonly downArrow?: boolean
   readonly return?: boolean
   readonly escape?: boolean
+  readonly backspace?: boolean
+  readonly delete?: boolean
 }
 
 export type CreateInputs = {
   readonly repoUrl: string
   readonly repoRef: string
   readonly outDir: string
-  readonly secretsRoot: string
   readonly runUp: boolean
   readonly enableMcpPlaywright: boolean
   readonly force: boolean
@@ -70,12 +71,76 @@ export const createSteps: ReadonlyArray<CreateStep> = [
   "force"
 ]
 
+export type AuthFlow =
+  | "GithubOauth"
+  | "GithubRemove"
+  | "GitSet"
+  | "GitRemove"
+  | "ClaudeOauth"
+  | "ClaudeLogout"
+
+export interface AuthSnapshot {
+  readonly globalEnvPath: string
+  readonly claudeAuthPath: string
+  readonly totalEntries: number
+  readonly githubTokenEntries: number
+  readonly gitTokenEntries: number
+  readonly gitUserEntries: number
+  readonly claudeAuthEntries: number
+}
+
+export type ProjectAuthFlow =
+  | "ProjectGithubConnect"
+  | "ProjectGithubDisconnect"
+  | "ProjectGitConnect"
+  | "ProjectGitDisconnect"
+  | "ProjectClaudeConnect"
+  | "ProjectClaudeDisconnect"
+
+export interface ProjectAuthSnapshot {
+  readonly projectDir: string
+  readonly projectName: string
+  readonly envGlobalPath: string
+  readonly envProjectPath: string
+  readonly claudeAuthPath: string
+  readonly githubTokenEntries: number
+  readonly gitTokenEntries: number
+  readonly claudeAuthEntries: number
+  readonly activeGithubLabel: string | null
+  readonly activeGitLabel: string | null
+  readonly activeClaudeLabel: string | null
+}
+
 export type ViewState =
   | { readonly _tag: "Menu" }
   | { readonly _tag: "Create"; readonly step: number; readonly buffer: string; readonly values: Partial<CreateInputs> }
+  | { readonly _tag: "AuthMenu"; readonly selected: number; readonly snapshot: AuthSnapshot }
+  | {
+    readonly _tag: "AuthPrompt"
+    readonly flow: AuthFlow
+    readonly step: number
+    readonly buffer: string
+    readonly values: Readonly<Record<string, string>>
+    readonly snapshot: AuthSnapshot
+  }
+  | {
+    readonly _tag: "ProjectAuthMenu"
+    readonly selected: number
+    readonly project: ProjectItem
+    readonly snapshot: ProjectAuthSnapshot
+  }
+  | {
+    readonly _tag: "ProjectAuthPrompt"
+    readonly flow: ProjectAuthFlow
+    readonly step: number
+    readonly buffer: string
+    readonly values: Readonly<Record<string, string>>
+    readonly project: ProjectItem
+    readonly snapshot: ProjectAuthSnapshot
+  }
   | {
     readonly _tag: "SelectProject"
-    readonly purpose: "Connect" | "Down" | "Info" | "Delete"
+    readonly purpose: "Connect" | "Down" | "Info" | "Delete" | "Auth"
     readonly items: ReadonlyArray<ProjectItem>
     readonly runtimeByProject: Readonly<Record<string, SelectProjectRuntime>>
     readonly selected: number
@@ -86,11 +151,15 @@ export type ViewState =
 export type SelectProjectRuntime = {
   readonly running: boolean
   readonly sshSessions: number
+  readonly startedAtIso: string | null
+  readonly startedAtEpochMs: number | null
 }
 
 export const menuItems: ReadonlyArray<{ readonly id: MenuAction; readonly label: string }> = [
   { id: { _tag: "Create" }, label: "Create project" },
   { id: { _tag: "Select" }, label: "Select project" },
+  { id: { _tag: "Auth" }, label: "Auth profiles (keys)" },
+  { id: { _tag: "ProjectAuth" }, label: "Project auth (bind labels)" },
   { id: { _tag: "Info" }, label: "Show connection info" },
   { id: { _tag: "Status" }, label: "docker compose ps" },
   { id: { _tag: "Logs" }, label: "docker compose logs --tail=200" },

package/src/docker-git/menu.ts

@@ -9,7 +9,16 @@ import React, { useEffect, useMemo, useState } from "react"
 
 import { resolveCreateInputs } from "./menu-create.js"
 import { handleUserInput, type InputStage } from "./menu-input-handler.js"
-import { renderCreate, renderMenu, renderSelect, renderStepLabel } from "./menu-render.js"
+import {
+  renderAuthMenu,
+  renderAuthPrompt,
+  renderCreate,
+  renderMenu,
+  renderProjectAuthMenu,
+  renderProjectAuthPrompt,
+  renderSelect,
+  renderStepLabel
+} from "./menu-render.js"
 import { leaveTui, resumeTui } from "./menu-shared.js"
 import { defaultMenuStartupSnapshot, resolveMenuStartupSnapshot } from "./menu-startup.js"
 import { createSteps, type MenuEnv, type MenuState, type ViewState } from "./menu-types.js"
@@ -82,6 +91,22 @@ const renderView = (context: RenderContext) => {
     return renderCreate(label, context.view.buffer, context.message, context.view.step, currentDefaults)
   }
 
+  if (context.view._tag === "AuthMenu") {
+    return renderAuthMenu(context.view.snapshot, context.view.selected, context.message)
+  }
+
+  if (context.view._tag === "AuthPrompt") {
+    return renderAuthPrompt(context.view, context.message)
+  }
+
+  if (context.view._tag === "ProjectAuthMenu") {
+    return renderProjectAuthMenu(context.view.snapshot, context.view.selected, context.message)
+  }
+
+  if (context.view._tag === "ProjectAuthPrompt") {
+    return renderProjectAuthPrompt(context.view, context.message)
+  }
+
   return renderSelect({
     purpose: context.view.purpose,
     items: context.view.items,

package/src/docker-git/program.ts

@@ -1,6 +1,9 @@
 import type { Command, ParseError } from "@effect-template/lib/core/domain"
 import { createProject } from "@effect-template/lib/usecases/actions"
 import {
+  authClaudeLogin,
+  authClaudeLogout,
+  authClaudeStatus,
   authCodexLogin,
   authCodexLogout,
   authCodexStatus,
@@ -85,15 +88,18 @@ const handleNonBaseCommand = (command: NonBaseCommand) =>
       Match.when({ _tag: "AuthCodexLogin" }, (cmd) => authCodexLogin(cmd)),
       Match.when({ _tag: "AuthCodexStatus" }, (cmd) => authCodexStatus(cmd)),
       Match.when({ _tag: "AuthCodexLogout" }, (cmd) => authCodexLogout(cmd)),
+      Match.when({ _tag: "AuthClaudeLogin" }, (cmd) => authClaudeLogin(cmd)),
+      Match.when({ _tag: "AuthClaudeStatus" }, (cmd) => authClaudeStatus(cmd)),
+      Match.when({ _tag: "AuthClaudeLogout" }, (cmd) => authClaudeLogout(cmd)),
       Match.when({ _tag: "Attach" }, (cmd) => attachTmux(cmd)),
       Match.when({ _tag: "Panes" }, (cmd) => listTmuxPanes(cmd)),
       Match.when({ _tag: "SessionsList" }, (cmd) => listTerminalSessions(cmd)),
-      Match.when({ _tag: "SessionsKill" }, (cmd) => killTerminalProcess(cmd)),
-      Match.when({ _tag: "SessionsLogs" }, (cmd) => tailTerminalLogs(cmd)),
-      Match.when({ _tag: "ScrapExport" }, (cmd) => exportScrap(cmd)),
-      Match.when({ _tag: "ScrapImport" }, (cmd) => importScrap(cmd))
+      Match.when({ _tag: "SessionsKill" }, (cmd) => killTerminalProcess(cmd))
     )
     .pipe(
+      Match.when({ _tag: "SessionsLogs" }, (cmd) => tailTerminalLogs(cmd)),
+      Match.when({ _tag: "ScrapExport" }, (cmd) => exportScrap(cmd)),
+      Match.when({ _tag: "ScrapImport" }, (cmd) => importScrap(cmd)),
       Match.when({ _tag: "McpPlaywrightUp" }, (cmd) => mcpPlaywrightUp(cmd)),
       Match.exhaustive
     )

package/tests/docker-git/entrypoint-auth.test.ts

@@ -19,7 +19,7 @@ describe("renderEntrypoint auth bridge", () => {
       expect(entrypoint).toContain("GITHUB_TOKEN=\"${GITHUB_TOKEN:-${GH_TOKEN:-}}\"")
       expect(entrypoint).toContain("if [[ -n \"$GH_TOKEN\" || -n \"$GITHUB_TOKEN\" ]]; then")
       expect(entrypoint).toContain(String.raw`printf "export GITHUB_TOKEN=%q\n" "$EFFECTIVE_GITHUB_TOKEN"`)
-      expect(entrypoint).toContain(String.raw`printf "%s\n" "GITHUB_TOKEN=$EFFECTIVE_GITHUB_TOKEN" >> "$SSH_ENV_PATH"`)
+      expect(entrypoint).toContain("docker_git_upsert_ssh_env \"GITHUB_TOKEN\" \"$EFFECTIVE_GITHUB_TOKEN\"")
       expect(entrypoint).toContain("GIT_CREDENTIAL_HELPER_PATH=\"/usr/local/bin/docker-git-credential-helper\"")
       expect(entrypoint).toContain("token=\"$GITHUB_TOKEN\"")
       expect(entrypoint).toContain("token=\"$GH_TOKEN\"")