@prover-coder-ai/docker-git 1.0.15 → 1.0.17

package/src/docker-git/menu-project-auth-data.ts

@@ -0,0 +1,292 @@
+import * as FileSystem from "@effect/platform/FileSystem"
+import * as Path from "@effect/platform/Path"
+import { Effect, Match, pipe } from "effect"
+
+import { AuthError } from "@effect-template/lib/shell/errors"
+import { normalizeAccountLabel } from "@effect-template/lib/usecases/auth-helpers"
+import { ensureEnvFile, findEnvValue, readEnvText, upsertEnvKey } from "@effect-template/lib/usecases/env-file"
+import type { AppError } from "@effect-template/lib/usecases/errors"
+import { defaultProjectsRoot } from "@effect-template/lib/usecases/menu-helpers"
+import type { ProjectItem } from "@effect-template/lib/usecases/projects"
+import { autoSyncState } from "@effect-template/lib/usecases/state-repo"
+
+import { countAuthAccountDirectories } from "./menu-auth-helpers.js"
+import { buildLabeledEnvKey, countKeyEntries, normalizeLabel } from "./menu-labeled-env.js"
+import { hasClaudeAccountCredentials } from "./menu-project-auth-claude.js"
+import type { MenuEnv, ProjectAuthFlow, ProjectAuthSnapshot } from "./menu-types.js"
+
+export type ProjectAuthMenuAction = ProjectAuthFlow | "Refresh" | "Back"
+
+type ProjectAuthMenuItem = {
+  readonly action: ProjectAuthMenuAction
+  readonly label: string
+}
+
+export type ProjectAuthPromptStep = {
+  readonly key: "label"
+  readonly label: string
+  readonly required: boolean
+  readonly secret: boolean
+}
+
+const projectAuthMenuItems: ReadonlyArray<ProjectAuthMenuItem> = [
+  { action: "ProjectGithubConnect", label: "Project: GitHub connect label" },
+  { action: "ProjectGithubDisconnect", label: "Project: GitHub disconnect" },
+  { action: "ProjectGitConnect", label: "Project: Git connect label" },
+  { action: "ProjectGitDisconnect", label: "Project: Git disconnect" },
+  { action: "ProjectClaudeConnect", label: "Project: Claude connect label" },
+  { action: "ProjectClaudeDisconnect", label: "Project: Claude disconnect" },
+  { action: "Refresh", label: "Refresh snapshot" },
+  { action: "Back", label: "Back to main menu" }
+]
+
+const flowSteps: Readonly<Record<ProjectAuthFlow, ReadonlyArray<ProjectAuthPromptStep>>> = {
+  ProjectGithubConnect: [
+    { key: "label", label: "Label (empty = default)", required: false, secret: false }
+  ],
+  ProjectGithubDisconnect: [],
+  ProjectGitConnect: [
+    { key: "label", label: "Label (empty = default)", required: false, secret: false }
+  ],
+  ProjectGitDisconnect: [],
+  ProjectClaudeConnect: [
+    { key: "label", label: "Label (empty = default)", required: false, secret: false }
+  ],
+  ProjectClaudeDisconnect: []
+}
+
+const resolveCanonicalLabel = (value: string): string => {
+  const normalized = normalizeLabel(value)
+  return normalized.length === 0 || normalized === "DEFAULT" ? "default" : normalized
+}
+
+const githubTokenBaseKey = "GITHUB_TOKEN"
+const gitTokenBaseKey = "GIT_AUTH_TOKEN"
+const gitUserBaseKey = "GIT_AUTH_USER"
+
+const projectGithubLabelKey = "GITHUB_AUTH_LABEL"
+const projectGitLabelKey = "GIT_AUTH_LABEL"
+const projectClaudeLabelKey = "CLAUDE_AUTH_LABEL"
+
+const defaultGitUser = "x-access-token"
+
+type ProjectAuthEnvText = {
+  readonly fs: FileSystem.FileSystem
+  readonly path: Path.Path
+  readonly globalEnvPath: string
+  readonly projectEnvPath: string
+  readonly claudeAuthPath: string
+  readonly globalEnvText: string
+  readonly projectEnvText: string
+}
+
+const buildGlobalEnvPath = (cwd: string): string => `${defaultProjectsRoot(cwd)}/.orch/env/global.env`
+const buildClaudeAuthPath = (cwd: string): string => `${defaultProjectsRoot(cwd)}/.orch/auth/claude`
+
+const loadProjectAuthEnvText = (
+  project: ProjectItem
+): Effect.Effect<ProjectAuthEnvText, AppError, MenuEnv> =>
+  Effect.gen(function*(_) {
+    const fs = yield* _(FileSystem.FileSystem)
+    const path = yield* _(Path.Path)
+    const globalEnvPath = buildGlobalEnvPath(process.cwd())
+    const claudeAuthPath = buildClaudeAuthPath(process.cwd())
+    yield* _(ensureEnvFile(fs, path, globalEnvPath))
+    yield* _(ensureEnvFile(fs, path, project.envProjectPath))
+    const globalEnvText = yield* _(readEnvText(fs, globalEnvPath))
+    const projectEnvText = yield* _(readEnvText(fs, project.envProjectPath))
+    return {
+      fs,
+      path,
+      globalEnvPath,
+      projectEnvPath: project.envProjectPath,
+      claudeAuthPath,
+      globalEnvText,
+      projectEnvText
+    }
+  })
+
+export const readProjectAuthSnapshot = (
+  project: ProjectItem
+): Effect.Effect<ProjectAuthSnapshot, AppError, MenuEnv> =>
+  pipe(
+    loadProjectAuthEnvText(project),
+    Effect.flatMap(({ claudeAuthPath, fs, globalEnvPath, globalEnvText, path, projectEnvPath, projectEnvText }) =>
+      pipe(
+        countAuthAccountDirectories(fs, path, claudeAuthPath),
+        Effect.map((claudeAuthEntries) => ({
+          projectDir: project.projectDir,
+          projectName: project.displayName,
+          envGlobalPath: globalEnvPath,
+          envProjectPath: projectEnvPath,
+          claudeAuthPath,
+          githubTokenEntries: countKeyEntries(globalEnvText, githubTokenBaseKey),
+          gitTokenEntries: countKeyEntries(globalEnvText, gitTokenBaseKey),
+          claudeAuthEntries,
+          activeGithubLabel: findEnvValue(projectEnvText, projectGithubLabelKey),
+          activeGitLabel: findEnvValue(projectEnvText, projectGitLabelKey),
+          activeClaudeLabel: findEnvValue(projectEnvText, projectClaudeLabelKey)
+        }))
+      )
+    )
+  )
+
+const missingSecret = (
+  provider: string,
+  label: string,
+  envPath: string
+): AuthError =>
+  new AuthError({
+    message: `${provider} not connected: label '${label}' not found in ${envPath}`
+  })
+
+type ProjectEnvUpdateSpec = {
+  readonly fs: FileSystem.FileSystem
+  readonly rawLabel: string
+  readonly canonicalLabel: string
+  readonly globalEnvPath: string
+  readonly globalEnvText: string
+  readonly projectEnvText: string
+  readonly claudeAuthPath: string
+}
+
+const updateProjectGithubConnect = (spec: ProjectEnvUpdateSpec): Effect.Effect<string, AppError> => {
+  const key = buildLabeledEnvKey(githubTokenBaseKey, spec.rawLabel)
+  const token = findEnvValue(spec.globalEnvText, key)
+  if (token === null) {
+    return Effect.fail(missingSecret("GitHub token", spec.canonicalLabel, spec.globalEnvPath))
+  }
+  const withGitToken = upsertEnvKey(spec.projectEnvText, "GIT_AUTH_TOKEN", token)
+  const withGhToken = upsertEnvKey(withGitToken, "GH_TOKEN", token)
+  const withoutGitLabel = upsertEnvKey(withGhToken, projectGitLabelKey, "")
+  return Effect.succeed(upsertEnvKey(withoutGitLabel, projectGithubLabelKey, spec.canonicalLabel))
+}
+
+const clearProjectGitLabels = (envText: string): string => {
+  const withoutGhToken = upsertEnvKey(envText, "GH_TOKEN", "")
+  const withoutGitLabel = upsertEnvKey(withoutGhToken, projectGitLabelKey, "")
+  return upsertEnvKey(withoutGitLabel, projectGithubLabelKey, "")
+}
+
+const updateProjectGithubDisconnect = (spec: ProjectEnvUpdateSpec): Effect.Effect<string> => {
+  const withoutGitToken = upsertEnvKey(spec.projectEnvText, "GIT_AUTH_TOKEN", "")
+  return Effect.succeed(clearProjectGitLabels(withoutGitToken))
+}
+
+const updateProjectGitConnect = (spec: ProjectEnvUpdateSpec): Effect.Effect<string, AppError> => {
+  const tokenKey = buildLabeledEnvKey(gitTokenBaseKey, spec.rawLabel)
+  const userKey = buildLabeledEnvKey(gitUserBaseKey, spec.rawLabel)
+  const token = findEnvValue(spec.globalEnvText, tokenKey)
+  if (token === null) {
+    return Effect.fail(missingSecret("Git credentials", spec.canonicalLabel, spec.globalEnvPath))
+  }
+  const defaultUser = findEnvValue(spec.globalEnvText, gitUserBaseKey) ?? defaultGitUser
+  const user = findEnvValue(spec.globalEnvText, userKey) ?? defaultUser
+  const withToken = upsertEnvKey(spec.projectEnvText, "GIT_AUTH_TOKEN", token)
+  const withUser = upsertEnvKey(withToken, "GIT_AUTH_USER", user)
+  const withGhToken = upsertEnvKey(withUser, "GH_TOKEN", token)
+  const withGitLabel = upsertEnvKey(withGhToken, projectGitLabelKey, spec.canonicalLabel)
+  return Effect.succeed(upsertEnvKey(withGitLabel, projectGithubLabelKey, spec.canonicalLabel))
+}
+
+const updateProjectGitDisconnect = (spec: ProjectEnvUpdateSpec): Effect.Effect<string> => {
+  const withoutToken = upsertEnvKey(spec.projectEnvText, "GIT_AUTH_TOKEN", "")
+  const withoutUser = upsertEnvKey(withoutToken, "GIT_AUTH_USER", "")
+  return Effect.succeed(clearProjectGitLabels(withoutUser))
+}
+
+const updateProjectClaudeConnect = (spec: ProjectEnvUpdateSpec): Effect.Effect<string, AppError> => {
+  const accountLabel = normalizeAccountLabel(spec.rawLabel, "default")
+  const accountPath = `${spec.claudeAuthPath}/${accountLabel}`
+  return Effect.gen(function*(_) {
+    const exists = yield* _(spec.fs.exists(accountPath))
+    if (!exists) {
+      return yield* _(Effect.fail(missingSecret("Claude Code login", spec.canonicalLabel, spec.claudeAuthPath)))
+    }
+
+    const hasCredentials = yield* _(
+      hasClaudeAccountCredentials(spec.fs, accountPath),
+      Effect.orElseSucceed(() => false)
+    )
+    if (hasCredentials) {
+      return upsertEnvKey(spec.projectEnvText, projectClaudeLabelKey, spec.canonicalLabel)
+    }
+
+    return yield* _(Effect.fail(missingSecret("Claude Code login", spec.canonicalLabel, spec.claudeAuthPath)))
+  })
+}
+
+const updateProjectClaudeDisconnect = (spec: ProjectEnvUpdateSpec): Effect.Effect<string> => {
+  return Effect.succeed(upsertEnvKey(spec.projectEnvText, projectClaudeLabelKey, ""))
+}
+
+const resolveProjectEnvUpdate = (
+  flow: ProjectAuthFlow,
+  spec: ProjectEnvUpdateSpec
+): Effect.Effect<string, AppError> =>
+  Match.value(flow).pipe(
+    Match.when("ProjectGithubConnect", () => updateProjectGithubConnect(spec)),
+    Match.when("ProjectGithubDisconnect", () => updateProjectGithubDisconnect(spec)),
+    Match.when("ProjectGitConnect", () => updateProjectGitConnect(spec)),
+    Match.when("ProjectGitDisconnect", () => updateProjectGitDisconnect(spec)),
+    Match.when("ProjectClaudeConnect", () => updateProjectClaudeConnect(spec)),
+    Match.when("ProjectClaudeDisconnect", () => updateProjectClaudeDisconnect(spec)),
+    Match.exhaustive
+  )
+
+export const writeProjectAuthFlow = (
+  project: ProjectItem,
+  flow: ProjectAuthFlow,
+  values: Readonly<Record<string, string>>
+): Effect.Effect<void, AppError, MenuEnv> =>
+  pipe(
+    loadProjectAuthEnvText(project),
+    Effect.flatMap(({ claudeAuthPath, fs, globalEnvPath, globalEnvText, projectEnvPath, projectEnvText }) => {
+      const rawLabel = values["label"] ?? ""
+      const canonicalLabel = resolveCanonicalLabel(rawLabel)
+      const spec: ProjectEnvUpdateSpec = {
+        fs,
+        rawLabel,
+        canonicalLabel,
+        globalEnvPath,
+        globalEnvText,
+        projectEnvText,
+        claudeAuthPath
+      }
+      const nextProjectEnv = resolveProjectEnvUpdate(flow, spec)
+      const syncMessage = Match.value(flow).pipe(
+        Match.when("ProjectGithubConnect", () =>
+          `chore(state): project auth gh ${canonicalLabel} ${project.displayName}`),
+        Match.when("ProjectGithubDisconnect", () =>
+          `chore(state): project auth gh logout ${project.displayName}`),
+        Match.when(
+          "ProjectGitConnect",
+          () => `chore(state): project auth git ${canonicalLabel} ${project.displayName}`
+        ),
+        Match.when("ProjectGitDisconnect", () => `chore(state): project auth git logout ${project.displayName}`),
+        Match.when(
+          "ProjectClaudeConnect",
+          () => `chore(state): project auth claude ${canonicalLabel} ${project.displayName}`
+        ),
+        Match.when("ProjectClaudeDisconnect", () => `chore(state): project auth claude logout ${project.displayName}`),
+        Match.exhaustive
+      )
+      return pipe(
+        nextProjectEnv,
+        Effect.flatMap((nextText) => fs.writeFileString(projectEnvPath, nextText)),
+        Effect.zipRight(autoSyncState(syncMessage))
+      )
+    }),
+    Effect.asVoid
+  )
+
+export const projectAuthViewSteps = (flow: ProjectAuthFlow): ReadonlyArray<ProjectAuthPromptStep> => flowSteps[flow]
+
+export const projectAuthMenuLabels = (): ReadonlyArray<string> => projectAuthMenuItems.map((item) => item.label)
+
+export const projectAuthMenuActionByIndex = (index: number): ProjectAuthMenuAction | null => {
+  const item = projectAuthMenuItems[index]
+  return item ? item.action : null
+}
+
+export const projectAuthMenuSize = (): number => projectAuthMenuItems.length

package/src/docker-git/menu-project-auth.ts

@@ -0,0 +1,271 @@
+import { Effect, Match, pipe } from "effect"
+
+import type { AppError } from "@effect-template/lib/usecases/errors"
+import type { ProjectItem } from "@effect-template/lib/usecases/projects"
+
+import { nextBufferValue } from "./menu-buffer-input.js"
+import { handleMenuNumberInput, submitPromptStep } from "./menu-input-utils.js"
+import {
+  type ProjectAuthMenuAction,
+  projectAuthMenuActionByIndex,
+  projectAuthMenuSize,
+  projectAuthViewSteps,
+  readProjectAuthSnapshot,
+  writeProjectAuthFlow
+} from "./menu-project-auth-data.js"
+import { resetToMenu } from "./menu-shared.js"
+import type {
+  MenuEnv,
+  MenuKeyInput,
+  MenuRunner,
+  MenuViewContext,
+  ProjectAuthFlow,
+  ProjectAuthSnapshot,
+  ViewState
+} from "./menu-types.js"
+
+type ProjectAuthContext = Pick<MenuViewContext, "setView" | "setMessage" | "setActiveDir"> & {
+  readonly runner: MenuRunner
+}
+
+type ProjectAuthContextWithProject = ProjectAuthContext & {
+  readonly project: ProjectItem
+}
+
+const startProjectAuthMenu = (
+  project: ProjectItem,
+  snapshot: ProjectAuthSnapshot,
+  context: Pick<MenuViewContext, "setView" | "setMessage">
+) => {
+  context.setView({ _tag: "ProjectAuthMenu", selected: 0, project, snapshot })
+  context.setMessage(null)
+}
+
+const startProjectAuthPrompt = (
+  project: ProjectItem,
+  snapshot: ProjectAuthSnapshot,
+  flow: ProjectAuthFlow,
+  context: Pick<MenuViewContext, "setView" | "setMessage">
+) => {
+  context.setView({
+    _tag: "ProjectAuthPrompt",
+    flow,
+    step: 0,
+    buffer: "",
+    values: {},
+    project,
+    snapshot
+  })
+  context.setMessage(null)
+}
+
+const loadProjectAuthMenuView = (
+  project: ProjectItem,
+  context: Pick<MenuViewContext, "setView" | "setMessage">
+): Effect.Effect<void, AppError, MenuEnv> =>
+  pipe(
+    readProjectAuthSnapshot(project),
+    Effect.tap((snapshot) =>
+      Effect.sync(() => {
+        startProjectAuthMenu(project, snapshot, context)
+      })
+    ),
+    Effect.asVoid
+  )
+
+const successMessage = (flow: ProjectAuthFlow, label: string): string =>
+  Match.value(flow).pipe(
+    Match.when("ProjectGithubConnect", () => `Connected GitHub label (${label}) to project.`),
+    Match.when("ProjectGithubDisconnect", () => "Disconnected GitHub from project."),
+    Match.when("ProjectGitConnect", () => `Connected Git label (${label}) to project.`),
+    Match.when("ProjectGitDisconnect", () => "Disconnected Git from project."),
+    Match.when("ProjectClaudeConnect", () => `Connected Claude label (${label}) to project.`),
+    Match.when("ProjectClaudeDisconnect", () => "Disconnected Claude from project."),
+    Match.exhaustive
+  )
+
+const runProjectAuthEffect = (
+  project: ProjectItem,
+  flow: ProjectAuthFlow,
+  values: Readonly<Record<string, string>>,
+  label: string,
+  context: ProjectAuthContext
+) => {
+  context.runner.runEffect(
+    pipe(
+      writeProjectAuthFlow(project, flow, values),
+      Effect.zipRight(readProjectAuthSnapshot(project)),
+      Effect.tap((snapshot) =>
+        Effect.sync(() => {
+          startProjectAuthMenu(project, snapshot, context)
+          context.setMessage(successMessage(flow, label))
+        })
+      ),
+      Effect.asVoid
+    )
+  )
+}
+
+const submitProjectAuthPrompt = (
+  view: Extract<ViewState, { readonly _tag: "ProjectAuthPrompt" }>,
+  context: ProjectAuthContext
+) => {
+  const steps = projectAuthViewSteps(view.flow)
+  submitPromptStep(
+    view,
+    steps,
+    context,
+    () => {
+      startProjectAuthMenu(view.project, view.snapshot, context)
+    },
+    (nextValues) => {
+      const rawLabel = (nextValues["label"] ?? "").trim()
+      const label = rawLabel.length > 0 ? rawLabel : "default"
+      runProjectAuthEffect(view.project, view.flow, nextValues, label, context)
+    }
+  )
+}
+
+const runProjectAuthAction = (
+  action: ProjectAuthMenuAction,
+  view: Extract<ViewState, { readonly _tag: "ProjectAuthMenu" }>,
+  context: ProjectAuthContext
+) => {
+  if (action === "Back") {
+    resetToMenu(context)
+    return
+  }
+  if (action === "Refresh") {
+    context.runner.runEffect(loadProjectAuthMenuView(view.project, context))
+    return
+  }
+
+  if (
+    action === "ProjectGithubDisconnect" || action === "ProjectGitDisconnect" || action === "ProjectClaudeDisconnect"
+  ) {
+    runProjectAuthEffect(view.project, action, {}, "default", context)
+    return
+  }
+
+  startProjectAuthPrompt(view.project, view.snapshot, action, context)
+}
+
+const setProjectAuthMenuSelection = (
+  view: Extract<ViewState, { readonly _tag: "ProjectAuthMenu" }>,
+  selected: number,
+  context: Pick<MenuViewContext, "setView">
+) => {
+  context.setView({ ...view, selected })
+}
+
+const shiftProjectAuthMenuSelection = (
+  view: Extract<ViewState, { readonly _tag: "ProjectAuthMenu" }>,
+  delta: number,
+  context: Pick<MenuViewContext, "setView">
+) => {
+  const menuSize = projectAuthMenuSize()
+  const selected = (view.selected + delta + menuSize) % menuSize
+  setProjectAuthMenuSelection(view, selected, context)
+}
+
+const runProjectAuthMenuSelection = (
+  selected: number,
+  view: Extract<ViewState, { readonly _tag: "ProjectAuthMenu" }>,
+  context: ProjectAuthContext
+) => {
+  const action = projectAuthMenuActionByIndex(selected)
+  if (action === null) {
+    return
+  }
+  runProjectAuthAction(action, view, context)
+}
+
+const handleProjectAuthMenuNumberInput = (
+  input: string,
+  view: Extract<ViewState, { readonly _tag: "ProjectAuthMenu" }>,
+  context: ProjectAuthContext
+) => {
+  handleMenuNumberInput(
+    input,
+    context,
+    projectAuthMenuActionByIndex,
+    (action) => {
+      runProjectAuthAction(action, view, context)
+    }
+  )
+}
+
+const handleProjectAuthMenuInput = (
+  input: string,
+  key: MenuKeyInput,
+  view: Extract<ViewState, { readonly _tag: "ProjectAuthMenu" }>,
+  context: ProjectAuthContext
+) => {
+  if (key.escape) {
+    resetToMenu(context)
+    return
+  }
+  if (key.upArrow) {
+    shiftProjectAuthMenuSelection(view, -1, context)
+    return
+  }
+  if (key.downArrow) {
+    shiftProjectAuthMenuSelection(view, 1, context)
+    return
+  }
+  if (key.return) {
+    runProjectAuthMenuSelection(view.selected, view, context)
+    return
+  }
+  handleProjectAuthMenuNumberInput(input, view, context)
+}
+
+type SetPromptBufferArgs = {
+  readonly input: string
+  readonly key: MenuKeyInput
+  readonly view: Extract<ViewState, { readonly _tag: "ProjectAuthPrompt" }>
+  readonly context: Pick<MenuViewContext, "setView">
+}
+
+const setProjectAuthPromptBuffer = (args: SetPromptBufferArgs) => {
+  const nextBuffer = nextBufferValue(args.input, args.key, args.view.buffer)
+  if (nextBuffer === null) {
+    return
+  }
+  args.context.setView({ ...args.view, buffer: nextBuffer })
+}
+
+const handleProjectAuthPromptInput = (
+  input: string,
+  key: MenuKeyInput,
+  view: Extract<ViewState, { readonly _tag: "ProjectAuthPrompt" }>,
+  context: ProjectAuthContext
+) => {
+  if (key.escape) {
+    startProjectAuthMenu(view.project, view.snapshot, context)
+    return
+  }
+  if (key.return) {
+    submitProjectAuthPrompt(view, context)
+    return
+  }
+  setProjectAuthPromptBuffer({ input, key, view, context })
+}
+
+export const openProjectAuthMenu = (context: ProjectAuthContextWithProject): void => {
+  context.setMessage(`Loading project auth (${context.project.displayName})...`)
+  context.runner.runEffect(loadProjectAuthMenuView(context.project, context))
+}
+
+export const handleProjectAuthInput = (
+  input: string,
+  key: MenuKeyInput,
+  view: Extract<ViewState, { readonly _tag: "ProjectAuthMenu" | "ProjectAuthPrompt" }>,
+  context: ProjectAuthContext
+) => {
+  if (view._tag === "ProjectAuthMenu") {
+    handleProjectAuthMenuInput(input, key, view, context)
+    return
+  }
+  handleProjectAuthPromptInput(input, key, view, context)
+}

package/src/docker-git/menu-render-auth.ts

@@ -0,0 +1,65 @@
+import { Box, Text } from "ink"
+import React from "react"
+
+import { authMenuLabels, authViewSteps, authViewTitle } from "./menu-auth-data.js"
+import {
+  renderMenuHelp,
+  renderPromptLayout,
+  renderSelectableMenuList,
+  resolvePromptState
+} from "./menu-render-common.js"
+import { renderLayout } from "./menu-render-layout.js"
+import type { AuthSnapshot, ViewState } from "./menu-types.js"
+
+const renderCountLine = (title: string, count: number): string => `${title}: ${count}`
+
+export const renderAuthMenu = (
+  snapshot: AuthSnapshot,
+  selected: number,
+  message: string | null
+): React.ReactElement => {
+  const el = React.createElement
+  const list = renderSelectableMenuList(authMenuLabels(), selected)
+  return renderLayout(
+    "docker-git / Auth profiles",
+    [
+      el(Text, null, `Global env: ${snapshot.globalEnvPath}`),
+      el(Text, null, `Claude auth: ${snapshot.claudeAuthPath}`),
+      el(Text, { color: "gray" }, renderCountLine("Entries", snapshot.totalEntries)),
+      el(Text, { color: "gray" }, renderCountLine("GitHub tokens", snapshot.githubTokenEntries)),
+      el(Text, { color: "gray" }, renderCountLine("Git tokens", snapshot.gitTokenEntries)),
+      el(Text, { color: "gray" }, renderCountLine("Git users", snapshot.gitUserEntries)),
+      el(Text, { color: "gray" }, renderCountLine("Claude logins", snapshot.claudeAuthEntries)),
+      el(Box, { flexDirection: "column", marginTop: 1 }, ...list),
+      renderMenuHelp("Use arrows + Enter, or type a number.")
+    ],
+    message
+  )
+}
+
+export const renderAuthPrompt = (
+  view: Extract<ViewState, { readonly _tag: "AuthPrompt" }>,
+  message: string | null
+): React.ReactElement => {
+  const el = React.createElement
+  const { prompt, visibleBuffer } = resolvePromptState(authViewSteps(view.flow), view.step, view.buffer)
+  let helpLine = "Enter = next, Esc = cancel."
+  if (view.flow === "GithubOauth" || view.flow === "ClaudeOauth") {
+    helpLine = "Enter = start OAuth, Esc = cancel."
+  } else if (view.flow === "ClaudeLogout") {
+    helpLine = "Enter = logout, Esc = cancel."
+  }
+  return renderPromptLayout({
+    title: `docker-git / Auth / ${authViewTitle(view.flow)}`,
+    header: [
+      el(Text, { color: "gray" }, `Global env: ${view.snapshot.globalEnvPath}`),
+      ...(view.flow === "ClaudeOauth" || view.flow === "ClaudeLogout"
+        ? [el(Text, { color: "gray" }, `Claude auth: ${view.snapshot.claudeAuthPath}`)]
+        : [])
+    ],
+    prompt,
+    visibleBuffer,
+    helpLine,
+    message
+  })
+}

package/src/docker-git/menu-render-common.ts

@@ -0,0 +1,67 @@
+import { Box, Text } from "ink"
+import React from "react"
+
+import { renderLayout } from "./menu-render-layout.js"
+
+export const renderSelectableMenuList = (
+  labels: ReadonlyArray<string>,
+  selected: number
+): ReadonlyArray<React.ReactElement> => {
+  const el = React.createElement
+  return labels.map((label, index) =>
+    el(
+      Text,
+      { key: `${index}-${label}`, color: index === selected ? "green" : "white" },
+      `${index === selected ? ">" : " "} ${index + 1}) ${label}`
+    )
+  )
+}
+
+export const renderMenuHelp = (primaryLine: string): React.ReactElement => {
+  const el = React.createElement
+  return el(
+    Box,
+    { marginTop: 1, flexDirection: "column" },
+    el(Text, { color: "gray" }, primaryLine),
+    el(Text, { color: "gray" }, "Esc returns to the main menu.")
+  )
+}
+
+type PromptStepLike = {
+  readonly label: string
+  readonly secret: boolean
+}
+
+export const resolvePromptState = (
+  steps: ReadonlyArray<PromptStepLike>,
+  step: number,
+  buffer: string
+): { readonly prompt: string; readonly visibleBuffer: string } => {
+  const current = steps[step]
+  const prompt = current?.label ?? "Value"
+  const isSecret = current?.secret === true
+  const visibleBuffer = isSecret ? "*".repeat(buffer.length) : buffer
+  return { prompt, visibleBuffer }
+}
+
+type RenderPromptArgs = {
+  readonly title: string
+  readonly header: ReadonlyArray<React.ReactElement>
+  readonly prompt: string
+  readonly visibleBuffer: string
+  readonly helpLine: string
+  readonly message: string | null
+}
+
+export const renderPromptLayout = (args: RenderPromptArgs): React.ReactElement => {
+  const el = React.createElement
+  return renderLayout(
+    args.title,
+    [
+      ...args.header,
+      el(Box, { marginTop: 1 }, el(Text, null, `${args.prompt}: `), el(Text, { color: "green" }, args.visibleBuffer)),
+      el(Box, { marginTop: 1, flexDirection: "column" }, el(Text, { color: "gray" }, args.helpLine))
+    ],
+    args.message
+  )
+}