@prover-coder-ai/docker-git 1.0.15 → 1.0.17

package/src/docker-git/cli/usage.ts

@@ -28,7 +28,7 @@ Commands:
   sessions            List/kill/log container terminal processes
   ps, status          Show docker compose status for all docker-git projects
   down-all            Stop all docker-git containers (docker compose down)
-  auth                Manage GitHub/Codex auth for docker-git
+  auth                Manage GitHub/Codex/Claude Code auth for docker-git
   state               Manage docker-git state directory via git (sync across machines)
 
 Options:
@@ -40,7 +40,6 @@ Options:
   --container-name <name>   Docker container name (default: dg-<repo>)
   --service-name <name>     Compose service name (default: dg-<repo>)
   --volume-name <name>      Docker volume name (default: dg-<repo>-home)
-  --secrets-root <path>     Host root for shared secrets (default: n/a)
   --authorized-keys <path>  Host path to authorized_keys (default: <projectsRoot>/authorized_keys)
   --env-global <path>       Host path to shared env file (default: <projectsRoot>/.orch/env/global.env)
   --env-project <path>      Host path to project env file (default: ./.orch/env/project.env)
@@ -72,6 +71,7 @@ Container runtime env (set via .orch/env/project.env):
 Auth providers:
   github, gh         GitHub CLI auth (tokens saved to env file)
   codex             Codex CLI auth (stored under .orch/auth/codex)
+  claude, cc        Claude Code CLI auth (OAuth cache stored under .orch/auth/claude)
 
 Auth actions:
   login             Run login flow and store credentials
@@ -80,7 +80,8 @@ Auth actions:
 
 Auth options:
   --label <label>        Account label (default: default)
-  --token <token>        GitHub token override (login only)
+  --token <token>        GitHub token override (login only; useful for non-interactive/CI)
+  --web                 Force OAuth web flow (login only; ignores --token)
   --scopes <scopes>      GitHub scopes (login only, default: repo,workflow,read:org)
   --env-global <path>    Env file path for GitHub tokens (default: <projectsRoot>/.orch/env/global.env)
   --codex-auth <path>    Codex auth root path (default: <projectsRoot>/.orch/auth/codex)

package/src/docker-git/menu-actions.ts

@@ -12,10 +12,11 @@ import {
 import { runDockerComposeUpWithPortCheck } from "@effect-template/lib/usecases/projects-up"
 import { Effect, Match, pipe } from "effect"
 
+import { openAuthMenu } from "./menu-auth.js"
 import { startCreateView } from "./menu-create.js"
-import { loadSelectView } from "./menu-select.js"
-import { resumeTui, suspendTui } from "./menu-shared.js"
-import { type MenuEnv, type MenuRunner, type MenuState, type ViewState } from "./menu-types.js"
+import { loadSelectView } from "./menu-select-load.js"
+import { withSuspendedTui, writeErrorAndPause } from "./menu-shared.js"
+import { type MenuEnv, type MenuRunner, type MenuState, type MenuViewContext } from "./menu-types.js"
 
 // CHANGE: keep menu actions and input parsing in a dedicated module
 // WHY: reduce cognitive complexity in the TUI entry
@@ -39,9 +40,7 @@ export type MenuContext = {
   readonly state: MenuState
   readonly runner: MenuRunner
   readonly exit: () => void
-  readonly setView: (view: ViewState) => void
-  readonly setMessage: (message: string | null) => void
-}
+} & MenuViewContext
 
 export type MenuSelectionContext = MenuContext & {
   readonly selected: number
@@ -50,6 +49,8 @@ export type MenuSelectionContext = MenuContext & {
 
 const actionLabel = (action: MenuAction): string =>
   Match.value(action).pipe(
+    Match.when({ _tag: "Auth" }, () => "Auth profiles"),
+    Match.when({ _tag: "ProjectAuth" }, () => "Project auth"),
     Match.when({ _tag: "Up" }, () => "docker compose up"),
     Match.when({ _tag: "Status" }, () => "docker compose ps"),
     Match.when({ _tag: "Logs" }, () => "docker compose logs"),
@@ -67,19 +68,13 @@ const runWithSuspendedTui = (
     pipe(
       Effect.sync(() => {
         context.setMessage(`${label}...`)
-        suspendTui()
       }),
-      Effect.zipRight(effect),
+      Effect.zipRight(withSuspendedTui(effect, { onError: (error) => writeErrorAndPause(renderError(error)) })),
       Effect.tap(() =>
         Effect.sync(() => {
           context.setMessage(`${label} finished.`)
         })
       ),
-      Effect.ensuring(
-        Effect.sync(() => {
-          resumeTui()
-        })
-      ),
       Effect.asVoid
     )
   )
@@ -140,6 +135,8 @@ const handleMenuAction = (
     Match.when({ _tag: "Quit" }, () => Effect.succeed(quitOutcome)),
     Match.when({ _tag: "Create" }, () => Effect.succeed(continueOutcome(state))),
     Match.when({ _tag: "Select" }, () => Effect.succeed(continueOutcome(state))),
+    Match.when({ _tag: "Auth" }, () => Effect.succeed(continueOutcome(state))),
+    Match.when({ _tag: "ProjectAuth" }, () => Effect.succeed(continueOutcome(state))),
     Match.when({ _tag: "Info" }, () => Effect.succeed(continueOutcome(state))),
     Match.when({ _tag: "Delete" }, () => Effect.succeed(continueOutcome(state))),
     Match.when({ _tag: "Up" }, () =>
@@ -171,6 +168,22 @@ const runSelectAction = (context: MenuContext) => {
   context.runner.runEffect(loadSelectView(listProjectItems, "Connect", context))
 }
 
+const runAuthProfilesAction = (context: MenuContext) => {
+  context.setMessage(null)
+  openAuthMenu({
+    state: context.state,
+    runner: context.runner,
+    setView: context.setView,
+    setMessage: context.setMessage,
+    setActiveDir: context.setActiveDir
+  })
+}
+
+const runProjectAuthAction = (context: MenuContext) => {
+  context.setMessage(null)
+  context.runner.runEffect(loadSelectView(listProjectItems, "Auth", context))
+}
+
 const runDownAllAction = (context: MenuContext) => {
   context.setMessage(null)
   runWithSuspendedTui(downAllDockerGitProjects, context, "Stopping all docker-git containers")
@@ -222,6 +235,12 @@ export const handleMenuActionSelection = (action: MenuAction, context: MenuConte
     Match.when({ _tag: "Select" }, () => {
       runSelectAction(context)
     }),
+    Match.when({ _tag: "Auth" }, () => {
+      runAuthProfilesAction(context)
+    }),
+    Match.when({ _tag: "ProjectAuth" }, () => {
+      runProjectAuthAction(context)
+    }),
     Match.when({ _tag: "Info" }, () => {
       runInfoAction(context)
     }),

package/src/docker-git/menu-auth-data.ts

@@ -0,0 +1,184 @@
+import * as FileSystem from "@effect/platform/FileSystem"
+import * as Path from "@effect/platform/Path"
+import { Effect, Match, pipe } from "effect"
+
+import { ensureEnvFile, parseEnvEntries, readEnvText, upsertEnvKey } from "@effect-template/lib/usecases/env-file"
+import { type AppError } from "@effect-template/lib/usecases/errors"
+import { defaultProjectsRoot } from "@effect-template/lib/usecases/menu-helpers"
+import { autoSyncState } from "@effect-template/lib/usecases/state-repo"
+
+import { countAuthAccountDirectories } from "./menu-auth-helpers.js"
+import { buildLabeledEnvKey, countKeyEntries, normalizeLabel } from "./menu-labeled-env.js"
+import type { AuthFlow, AuthSnapshot, MenuEnv } from "./menu-types.js"
+
+export type AuthMenuAction = AuthFlow | "Refresh" | "Back"
+
+type AuthMenuItem = {
+  readonly action: AuthMenuAction
+  readonly label: string
+}
+
+export type AuthEnvFlow = Extract<AuthFlow, "GithubRemove" | "GitSet" | "GitRemove">
+
+export type AuthPromptStep = {
+  readonly key: "label" | "token" | "user"
+  readonly label: string
+  readonly required: boolean
+  readonly secret: boolean
+}
+
+const authMenuItems: ReadonlyArray<AuthMenuItem> = [
+  { action: "GithubOauth", label: "GitHub: login via OAuth (web)" },
+  { action: "GithubRemove", label: "GitHub: remove token" },
+  { action: "GitSet", label: "Git: add/update credentials" },
+  { action: "GitRemove", label: "Git: remove credentials" },
+  { action: "ClaudeOauth", label: "Claude Code: login via OAuth (web)" },
+  { action: "ClaudeLogout", label: "Claude Code: logout (clear cache)" },
+  { action: "Refresh", label: "Refresh snapshot" },
+  { action: "Back", label: "Back to main menu" }
+]
+
+const flowSteps: Readonly<Record<AuthFlow, ReadonlyArray<AuthPromptStep>>> = {
+  GithubOauth: [
+    { key: "label", label: "Label (empty = default)", required: false, secret: false }
+  ],
+  GithubRemove: [
+    { key: "label", label: "Label to remove (empty = default)", required: false, secret: false }
+  ],
+  GitSet: [
+    { key: "label", label: "Label (empty = default)", required: false, secret: false },
+    { key: "token", label: "Git auth token", required: true, secret: true },
+    { key: "user", label: "Git auth user (empty = x-access-token)", required: false, secret: false }
+  ],
+  GitRemove: [
+    { key: "label", label: "Label to remove (empty = default)", required: false, secret: false }
+  ],
+  ClaudeOauth: [
+    { key: "label", label: "Label (empty = default)", required: false, secret: false }
+  ],
+  ClaudeLogout: [
+    { key: "label", label: "Label to logout (empty = default)", required: false, secret: false }
+  ]
+}
+
+const flowTitle = (flow: AuthFlow): string =>
+  Match.value(flow).pipe(
+    Match.when("GithubOauth", () => "GitHub OAuth"),
+    Match.when("GithubRemove", () => "GitHub remove"),
+    Match.when("GitSet", () => "Git credentials"),
+    Match.when("GitRemove", () => "Git remove"),
+    Match.when("ClaudeOauth", () => "Claude Code OAuth"),
+    Match.when("ClaudeLogout", () => "Claude Code logout"),
+    Match.exhaustive
+  )
+
+export const successMessage = (flow: AuthFlow, label: string): string =>
+  Match.value(flow).pipe(
+    Match.when("GithubOauth", () => `Saved GitHub token (${label}).`),
+    Match.when("GithubRemove", () => `Removed GitHub token (${label}).`),
+    Match.when("GitSet", () => `Saved Git credentials (${label}).`),
+    Match.when("GitRemove", () => `Removed Git credentials (${label}).`),
+    Match.when("ClaudeOauth", () => `Saved Claude Code login (${label}).`),
+    Match.when("ClaudeLogout", () => `Logged out Claude Code (${label}).`),
+    Match.exhaustive
+  )
+
+const buildGlobalEnvPath = (cwd: string): string => `${defaultProjectsRoot(cwd)}/.orch/env/global.env`
+const buildClaudeAuthPath = (cwd: string): string => `${defaultProjectsRoot(cwd)}/.orch/auth/claude`
+
+type AuthEnvText = {
+  readonly fs: FileSystem.FileSystem
+  readonly path: Path.Path
+  readonly globalEnvPath: string
+  readonly claudeAuthPath: string
+  readonly envText: string
+}
+
+const loadAuthEnvText = (
+  cwd: string
+): Effect.Effect<AuthEnvText, AppError, MenuEnv> =>
+  Effect.gen(function*(_) {
+    const fs = yield* _(FileSystem.FileSystem)
+    const path = yield* _(Path.Path)
+    const globalEnvPath = buildGlobalEnvPath(cwd)
+    const claudeAuthPath = buildClaudeAuthPath(cwd)
+    yield* _(ensureEnvFile(fs, path, globalEnvPath))
+    const envText = yield* _(readEnvText(fs, globalEnvPath))
+    return { fs, path, globalEnvPath, claudeAuthPath, envText }
+  })
+
+export const readAuthSnapshot = (
+  cwd: string
+): Effect.Effect<AuthSnapshot, AppError, MenuEnv> =>
+  pipe(
+    loadAuthEnvText(cwd),
+    Effect.flatMap(({ claudeAuthPath, envText, fs, globalEnvPath, path }) =>
+      pipe(
+        countAuthAccountDirectories(fs, path, claudeAuthPath),
+        Effect.map((claudeAuthEntries) => ({
+          globalEnvPath,
+          claudeAuthPath,
+          totalEntries: parseEnvEntries(envText).filter((entry) => entry.value.trim().length > 0).length,
+          githubTokenEntries: countKeyEntries(envText, "GITHUB_TOKEN"),
+          gitTokenEntries: countKeyEntries(envText, "GIT_AUTH_TOKEN"),
+          gitUserEntries: countKeyEntries(envText, "GIT_AUTH_USER"),
+          claudeAuthEntries
+        }))
+      )
+    )
+  )
+
+export const writeAuthFlow = (
+  cwd: string,
+  flow: AuthEnvFlow,
+  values: Readonly<Record<string, string>>
+): Effect.Effect<void, AppError, MenuEnv> =>
+  pipe(
+    loadAuthEnvText(cwd),
+    Effect.flatMap(({ envText, fs, globalEnvPath }) => {
+      const label = values["label"] ?? ""
+      const canonicalLabel = (() => {
+        const normalized = normalizeLabel(label)
+        return normalized.length === 0 || normalized === "DEFAULT" ? "default" : normalized
+      })()
+      const token = (values["token"] ?? "").trim()
+      const user = (values["user"] ?? "").trim()
+      const nextText = Match.value(flow).pipe(
+        Match.when("GithubRemove", () => upsertEnvKey(envText, buildLabeledEnvKey("GITHUB_TOKEN", label), "")),
+        Match.when("GitSet", () => {
+          const withToken = upsertEnvKey(envText, buildLabeledEnvKey("GIT_AUTH_TOKEN", label), token)
+          const resolvedUser = user.length > 0 ? user : "x-access-token"
+          return upsertEnvKey(withToken, buildLabeledEnvKey("GIT_AUTH_USER", label), resolvedUser)
+        }),
+        Match.when("GitRemove", () => {
+          const withoutToken = upsertEnvKey(envText, buildLabeledEnvKey("GIT_AUTH_TOKEN", label), "")
+          return upsertEnvKey(withoutToken, buildLabeledEnvKey("GIT_AUTH_USER", label), "")
+        }),
+        Match.exhaustive
+      )
+      const syncMessage = Match.value(flow).pipe(
+        Match.when("GithubRemove", () => `chore(state): auth gh logout ${canonicalLabel}`),
+        Match.when("GitSet", () => `chore(state): auth git ${canonicalLabel}`),
+        Match.when("GitRemove", () => `chore(state): auth git logout ${canonicalLabel}`),
+        Match.exhaustive
+      )
+      return pipe(
+        fs.writeFileString(globalEnvPath, nextText),
+        Effect.zipRight(autoSyncState(syncMessage))
+      )
+    }),
+    Effect.asVoid
+  )
+
+export const authViewTitle = (flow: AuthFlow): string => flowTitle(flow)
+
+export const authViewSteps = (flow: AuthFlow): ReadonlyArray<AuthPromptStep> => flowSteps[flow]
+
+export const authMenuLabels = (): ReadonlyArray<string> => authMenuItems.map((item) => item.label)
+
+export const authMenuActionByIndex = (index: number): AuthMenuAction | null => {
+  const item = authMenuItems[index]
+  return item ? item.action : null
+}
+
+export const authMenuSize = (): number => authMenuItems.length

package/src/docker-git/menu-auth-helpers.ts

@@ -0,0 +1,30 @@
+import type * as FileSystem from "@effect/platform/FileSystem"
+import type * as Path from "@effect/platform/Path"
+import { Effect } from "effect"
+
+import type { AppError } from "@effect-template/lib/usecases/errors"
+
+export const countAuthAccountDirectories = (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  root: string
+): Effect.Effect<number, AppError> =>
+  Effect.gen(function*(_) {
+    const exists = yield* _(fs.exists(root))
+    if (!exists) {
+      return 0
+    }
+    const entries = yield* _(fs.readDirectory(root))
+    let count = 0
+    for (const entry of entries) {
+      if (entry === ".image") {
+        continue
+      }
+      const fullPath = path.join(root, entry)
+      const info = yield* _(fs.stat(fullPath))
+      if (info.type === "Directory") {
+        count += 1
+      }
+    }
+    return count
+  })

package/src/docker-git/menu-auth.ts

@@ -0,0 +1,311 @@
+import { Effect, Match, pipe } from "effect"
+
+import { authClaudeLogin, authClaudeLogout, authGithubLogin, claudeAuthRoot } from "@effect-template/lib/usecases/auth"
+import type { AppError } from "@effect-template/lib/usecases/errors"
+import { renderError } from "@effect-template/lib/usecases/errors"
+
+import {
+  type AuthMenuAction,
+  authMenuActionByIndex,
+  authMenuSize,
+  authViewSteps,
+  readAuthSnapshot,
+  successMessage,
+  writeAuthFlow
+} from "./menu-auth-data.js"
+import { nextBufferValue } from "./menu-buffer-input.js"
+import { handleMenuNumberInput, submitPromptStep } from "./menu-input-utils.js"
+import { pauseOnError, resetToMenu, resumeSshWithSkipInputs, withSuspendedTui } from "./menu-shared.js"
+import type {
+  AuthFlow,
+  AuthSnapshot,
+  MenuEnv,
+  MenuKeyInput,
+  MenuRunner,
+  MenuState,
+  MenuViewContext,
+  ViewState
+} from "./menu-types.js"
+
+type AuthContext = MenuViewContext & {
+  readonly state: MenuState
+  readonly runner: MenuRunner
+}
+
+type AuthInputContext = AuthContext & {
+  readonly setSshActive: (active: boolean) => void
+  readonly setSkipInputs: (update: (value: number) => number) => void
+}
+
+type AuthPromptView = Extract<ViewState, { readonly _tag: "AuthPrompt" }>
+
+const defaultLabel = (value: string): string => {
+  const trimmed = value.trim()
+  return trimmed.length > 0 ? trimmed : "default"
+}
+
+const startAuthMenuWithSnapshot = (
+  snapshot: AuthSnapshot,
+  context: Pick<MenuViewContext, "setView" | "setMessage">
+) => {
+  context.setView({ _tag: "AuthMenu", selected: 0, snapshot })
+  context.setMessage(null)
+}
+
+const startAuthPrompt = (
+  snapshot: AuthSnapshot,
+  flow: AuthFlow,
+  context: Pick<MenuViewContext, "setView" | "setMessage">
+) => {
+  context.setView({
+    _tag: "AuthPrompt",
+    flow,
+    step: 0,
+    buffer: "",
+    values: {},
+    snapshot
+  })
+  context.setMessage(null)
+}
+
+const resolveLabelOption = (values: Readonly<Record<string, string>>): string | null => {
+  const labelValue = (values["label"] ?? "").trim()
+  return labelValue.length > 0 ? labelValue : null
+}
+
+const resolveAuthPromptEffect = (
+  view: AuthPromptView,
+  cwd: string,
+  values: Readonly<Record<string, string>>
+): Effect.Effect<void, AppError, MenuEnv> => {
+  const labelOption = resolveLabelOption(values)
+  return Match.value(view.flow).pipe(
+    Match.when("GithubOauth", () =>
+      authGithubLogin({
+        _tag: "AuthGithubLogin",
+        label: labelOption,
+        token: null,
+        scopes: null,
+        envGlobalPath: view.snapshot.globalEnvPath
+      })),
+    Match.when("ClaudeOauth", () =>
+      authClaudeLogin({
+        _tag: "AuthClaudeLogin",
+        label: labelOption,
+        claudeAuthPath: claudeAuthRoot
+      })),
+    Match.when("ClaudeLogout", () =>
+      authClaudeLogout({
+        _tag: "AuthClaudeLogout",
+        label: labelOption,
+        claudeAuthPath: claudeAuthRoot
+      })),
+    Match.when("GithubRemove", (flow) => writeAuthFlow(cwd, flow, values)),
+    Match.when("GitSet", (flow) => writeAuthFlow(cwd, flow, values)),
+    Match.when("GitRemove", (flow) => writeAuthFlow(cwd, flow, values)),
+    Match.exhaustive
+  )
+}
+
+const runAuthPromptEffect = (
+  effect: Effect.Effect<void, AppError, MenuEnv>,
+  view: AuthPromptView,
+  label: string,
+  context: AuthInputContext,
+  options: { readonly suspendTui: boolean }
+) => {
+  const withOptionalSuspension = options.suspendTui
+    ? withSuspendedTui(effect, {
+      onError: pauseOnError(renderError),
+      onResume: resumeSshWithSkipInputs(context)
+    })
+    : effect
+
+  context.setSshActive(options.suspendTui)
+  context.runner.runEffect(
+    pipe(
+      withOptionalSuspension,
+      Effect.zipRight(readAuthSnapshot(context.state.cwd)),
+      Effect.tap((snapshot) =>
+        Effect.sync(() => {
+          startAuthMenuWithSnapshot(snapshot, context)
+          context.setMessage(successMessage(view.flow, label))
+        })
+      ),
+      Effect.asVoid
+    )
+  )
+}
+
+const loadAuthMenuView = (
+  cwd: string,
+  context: Pick<MenuViewContext, "setView" | "setMessage">
+): Effect.Effect<void, AppError, MenuEnv> =>
+  pipe(
+    readAuthSnapshot(cwd),
+    Effect.tap((snapshot) =>
+      Effect.sync(() => {
+        startAuthMenuWithSnapshot(snapshot, context)
+      })
+    ),
+    Effect.asVoid
+  )
+
+const runAuthAction = (
+  action: AuthMenuAction,
+  view: Extract<ViewState, { readonly _tag: "AuthMenu" }>,
+  context: AuthContext
+) => {
+  if (action === "Back") {
+    resetToMenu(context)
+    return
+  }
+  if (action === "Refresh") {
+    context.runner.runEffect(loadAuthMenuView(context.state.cwd, context))
+    return
+  }
+  startAuthPrompt(view.snapshot, action, context)
+}
+
+const submitAuthPrompt = (
+  view: AuthPromptView,
+  context: AuthInputContext
+) => {
+  const steps = authViewSteps(view.flow)
+  submitPromptStep(
+    view,
+    steps,
+    context,
+    () => {
+      startAuthMenuWithSnapshot(view.snapshot, context)
+    },
+    (nextValues) => {
+      const label = defaultLabel(nextValues["label"] ?? "")
+      const effect = resolveAuthPromptEffect(view, context.state.cwd, nextValues)
+      runAuthPromptEffect(effect, view, label, context, {
+        suspendTui: view.flow === "GithubOauth" || view.flow === "ClaudeOauth" || view.flow === "ClaudeLogout"
+      })
+    }
+  )
+}
+
+const setAuthMenuSelection = (
+  view: Extract<ViewState, { readonly _tag: "AuthMenu" }>,
+  selected: number,
+  context: AuthContext
+) => {
+  context.setView({
+    ...view,
+    selected
+  })
+}
+
+const shiftAuthMenuSelection = (
+  view: Extract<ViewState, { readonly _tag: "AuthMenu" }>,
+  delta: number,
+  context: AuthContext
+) => {
+  const menuSize = authMenuSize()
+  const selected = (view.selected + delta + menuSize) % menuSize
+  setAuthMenuSelection(view, selected, context)
+}
+
+const runAuthMenuSelection = (
+  selected: number,
+  view: Extract<ViewState, { readonly _tag: "AuthMenu" }>,
+  context: AuthContext
+) => {
+  const action = authMenuActionByIndex(selected)
+  if (action === null) {
+    return
+  }
+  runAuthAction(action, view, context)
+}
+
+const handleAuthMenuNumberInput = (
+  input: string,
+  view: Extract<ViewState, { readonly _tag: "AuthMenu" }>,
+  context: AuthContext
+) => {
+  handleMenuNumberInput(input, context, authMenuActionByIndex, (action) => {
+    runAuthAction(action, view, context)
+  })
+}
+
+const handleAuthMenuInput = (
+  input: string,
+  key: MenuKeyInput,
+  view: Extract<ViewState, { readonly _tag: "AuthMenu" }>,
+  context: AuthContext
+) => {
+  if (key.escape) {
+    resetToMenu(context)
+    return
+  }
+  if (key.upArrow) {
+    shiftAuthMenuSelection(view, -1, context)
+    return
+  }
+  if (key.downArrow) {
+    shiftAuthMenuSelection(view, 1, context)
+    return
+  }
+  if (key.return) {
+    runAuthMenuSelection(view.selected, view, context)
+    return
+  }
+  handleAuthMenuNumberInput(input, view, context)
+}
+
+const handleAuthPromptInput = (
+  input: string,
+  key: MenuKeyInput,
+  view: Extract<ViewState, { readonly _tag: "AuthPrompt" }>,
+  context: AuthInputContext
+) => {
+  if (key.escape) {
+    startAuthMenuWithSnapshot(view.snapshot, context)
+    return
+  }
+  if (key.return) {
+    submitAuthPrompt(view, context)
+    return
+  }
+  setAuthPromptBuffer({ input, key, view, context })
+}
+
+type SetAuthPromptBufferArgs = {
+  readonly input: string
+  readonly key: MenuKeyInput
+  readonly view: Extract<ViewState, { readonly _tag: "AuthPrompt" }>
+  readonly context: Pick<MenuViewContext, "setView">
+}
+
+const setAuthPromptBuffer = (
+  args: SetAuthPromptBufferArgs
+) => {
+  const { context, input, key, view } = args
+  const nextBuffer = nextBufferValue(input, key, view.buffer)
+  if (nextBuffer === null) {
+    return
+  }
+  context.setView({ ...view, buffer: nextBuffer })
+}
+
+export const openAuthMenu = (context: AuthContext): void => {
+  context.setMessage("Loading auth profiles...")
+  context.runner.runEffect(loadAuthMenuView(context.state.cwd, context))
+}
+
+export const handleAuthInput = (
+  input: string,
+  key: MenuKeyInput,
+  view: Extract<ViewState, { readonly _tag: "AuthMenu" | "AuthPrompt" }>,
+  context: AuthInputContext
+) => {
+  if (view._tag === "AuthMenu") {
+    handleAuthMenuInput(input, key, view, context)
+    return
+  }
+  handleAuthPromptInput(input, key, view, context)
+}

package/src/docker-git/menu-buffer-input.ts

@@ -0,0 +1,18 @@
+export type BufferInputKey = {
+  readonly backspace?: boolean
+  readonly delete?: boolean
+}
+
+export const nextBufferValue = (
+  input: string,
+  key: BufferInputKey,
+  buffer: string
+): string | null => {
+  if (key.backspace || key.delete) {
+    return buffer.slice(0, -1)
+  }
+  if (input.length > 0) {
+    return buffer + input
+  }
+  return null
+}