@prover-coder-ai/docker-git 1.0.16 → 1.0.18

package/dist/src/docker-git/cli/parser-auth.js

@@ -1,5 +1,5 @@
 import { Either, Match } from "effect";
-import { defaultTemplateConfig } from "@effect-template/lib/core/domain";
+import {} from "@effect-template/lib/core/domain";
 import { parseRawOptions } from "./parser-options.js";
 const missingArgument = (name) => ({
     _tag: "MissingRequiredOption",
@@ -14,20 +14,27 @@ const normalizeLabel = (value) => {
     const trimmed = value?.trim() ?? "";
     return trimmed.length === 0 ? null : trimmed;
 };
+const defaultEnvGlobalPath = ".docker-git/.orch/env/global.env";
+const defaultCodexAuthPath = ".docker-git/.orch/auth/codex";
+const defaultClaudeAuthPath = ".docker-git/.orch/auth/claude";
 const resolveAuthOptions = (raw) => ({
-    envGlobalPath: raw.envGlobalPath ?? defaultTemplateConfig.envGlobalPath,
-    codexAuthPath: raw.codexAuthPath ?? defaultTemplateConfig.codexAuthPath,
+    envGlobalPath: raw.envGlobalPath ?? defaultEnvGlobalPath,
+    codexAuthPath: raw.codexAuthPath ?? defaultCodexAuthPath,
+    claudeAuthPath: defaultClaudeAuthPath,
     label: normalizeLabel(raw.label),
     token: normalizeLabel(raw.token),
-    scopes: normalizeLabel(raw.scopes)
+    scopes: normalizeLabel(raw.scopes),
+    authWeb: raw.authWeb === true
 });
-const buildGithubCommand = (action, options) => Match.value(action).pipe(Match.when("login", () => Either.right({
-    _tag: "AuthGithubLogin",
-    label: options.label,
-    token: options.token,
-    scopes: options.scopes,
-    envGlobalPath: options.envGlobalPath
-})), Match.when("status", () => Either.right({
+const buildGithubCommand = (action, options) => Match.value(action).pipe(Match.when("login", () => options.authWeb && options.token !== null
+    ? Either.left(invalidArgument("--token", "cannot be combined with --web"))
+    : Either.right({
+        _tag: "AuthGithubLogin",
+        label: options.label,
+        token: options.authWeb ? null : options.token,
+        scopes: options.scopes,
+        envGlobalPath: options.envGlobalPath
+    })), Match.when("status", () => Either.right({
     _tag: "AuthGithubStatus",
     envGlobalPath: options.envGlobalPath
 })), Match.when("logout", () => Either.right({
@@ -48,7 +55,20 @@ const buildCodexCommand = (action, options) => Match.value(action).pipe(Match.wh
     label: options.label,
     codexAuthPath: options.codexAuthPath
 })), Match.orElse(() => Either.left(invalidArgument("auth action", `unknown action '${action}'`))));
-const buildAuthCommand = (provider, action, options) => Match.value(provider).pipe(Match.when("github", () => buildGithubCommand(action, options)), Match.when("gh", () => buildGithubCommand(action, options)), Match.when("codex", () => buildCodexCommand(action, options)), Match.orElse(() => Either.left(invalidArgument("auth provider", `unknown provider '${provider}'`))));
+const buildClaudeCommand = (action, options) => Match.value(action).pipe(Match.when("login", () => Either.right({
+    _tag: "AuthClaudeLogin",
+    label: options.label,
+    claudeAuthPath: options.claudeAuthPath
+})), Match.when("status", () => Either.right({
+    _tag: "AuthClaudeStatus",
+    label: options.label,
+    claudeAuthPath: options.claudeAuthPath
+})), Match.when("logout", () => Either.right({
+    _tag: "AuthClaudeLogout",
+    label: options.label,
+    claudeAuthPath: options.claudeAuthPath
+})), Match.orElse(() => Either.left(invalidArgument("auth action", `unknown action '${action}'`))));
+const buildAuthCommand = (provider, action, options) => Match.value(provider).pipe(Match.when("github", () => buildGithubCommand(action, options)), Match.when("gh", () => buildGithubCommand(action, options)), Match.when("codex", () => buildCodexCommand(action, options)), Match.when("claude", () => buildClaudeCommand(action, options)), Match.when("cc", () => buildClaudeCommand(action, options)), Match.orElse(() => Either.left(invalidArgument("auth provider", `unknown provider '${provider}'`))));
 // CHANGE: parse docker-git auth subcommands
 // WHY: keep auth flows in the same typed CLI parser
 // QUOTE(ТЗ): "система авторизации"

package/dist/src/docker-git/cli/parser.js

@@ -16,7 +16,7 @@ const helpCommand = { _tag: "Help", message: usageText };
 const menuCommand = { _tag: "Menu" };
 const statusCommand = { _tag: "Status" };
 const downAllCommand = { _tag: "DownAll" };
-const parseCreate = (args) => Either.flatMap(parseRawOptions(args), buildCreateCommand);
+const parseCreate = (args) => Either.flatMap(parseRawOptions(args), (raw) => buildCreateCommand(raw));
 // CHANGE: parse CLI arguments into a typed command
 // WHY: enforce deterministic, pure parsing before any effects run
 // QUOTE(ТЗ): "Надо написать CLI команду с помощью которой мы будем создавать докер образы"

package/dist/src/docker-git/cli/usage.js

@@ -25,7 +25,7 @@ Commands:
   sessions            List/kill/log container terminal processes
   ps, status          Show docker compose status for all docker-git projects
   down-all            Stop all docker-git containers (docker compose down)
-  auth                Manage GitHub/Codex auth for docker-git
+  auth                Manage GitHub/Codex/Claude Code auth for docker-git
   state               Manage docker-git state directory via git (sync across machines)
 
 Options:
@@ -37,7 +37,6 @@ Options:
   --container-name <name>   Docker container name (default: dg-<repo>)
   --service-name <name>     Compose service name (default: dg-<repo>)
   --volume-name <name>      Docker volume name (default: dg-<repo>-home)
-  --secrets-root <path>     Host root for shared secrets (default: n/a)
   --authorized-keys <path>  Host path to authorized_keys (default: <projectsRoot>/authorized_keys)
   --env-global <path>       Host path to shared env file (default: <projectsRoot>/.orch/env/global.env)
   --env-project <path>      Host path to project env file (default: ./.orch/env/project.env)
@@ -69,6 +68,7 @@ Container runtime env (set via .orch/env/project.env):
 Auth providers:
   github, gh         GitHub CLI auth (tokens saved to env file)
   codex             Codex CLI auth (stored under .orch/auth/codex)
+  claude, cc        Claude Code CLI auth (OAuth cache stored under .orch/auth/claude)
 
 Auth actions:
   login             Run login flow and store credentials
@@ -77,7 +77,8 @@ Auth actions:
 
 Auth options:
   --label <label>        Account label (default: default)
-  --token <token>        GitHub token override (login only)
+  --token <token>        GitHub token override (login only; useful for non-interactive/CI)
+  --web                 Force OAuth web flow (login only; ignores --token)
   --scopes <scopes>      GitHub scopes (login only, default: repo,workflow,read:org)
   --env-global <path>    Env file path for GitHub tokens (default: <projectsRoot>/.orch/env/global.env)
   --codex-auth <path>    Codex auth root path (default: <projectsRoot>/.orch/auth/codex)

package/dist/src/docker-git/menu-actions.js

@@ -5,9 +5,10 @@ import { renderError } from "@effect-template/lib/usecases/errors";
 import { downAllDockerGitProjects, listProjectItems, listProjectStatus, listRunningProjectItems } from "@effect-template/lib/usecases/projects";
 import { runDockerComposeUpWithPortCheck } from "@effect-template/lib/usecases/projects-up";
 import { Effect, Match, pipe } from "effect";
+import { openAuthMenu } from "./menu-auth.js";
 import { startCreateView } from "./menu-create.js";
 import { loadSelectView } from "./menu-select-load.js";
-import { resumeTui, suspendTui } from "./menu-shared.js";
+import { withSuspendedTui, writeErrorAndPause } from "./menu-shared.js";
 import {} from "./menu-types.js";
 // CHANGE: keep menu actions and input parsing in a dedicated module
 // WHY: reduce cognitive complexity in the TUI entry
@@ -24,15 +25,12 @@ const continueOutcome = (state) => ({
     state
 });
 const quitOutcome = { _tag: "Quit" };
-const actionLabel = (action) => Match.value(action).pipe(Match.when({ _tag: "Up" }, () => "docker compose up"), Match.when({ _tag: "Status" }, () => "docker compose ps"), Match.when({ _tag: "Logs" }, () => "docker compose logs"), Match.when({ _tag: "Down" }, () => "docker compose down"), Match.when({ _tag: "DownAll" }, () => "docker compose down (all projects)"), Match.orElse(() => "action"));
+const actionLabel = (action) => Match.value(action).pipe(Match.when({ _tag: "Auth" }, () => "Auth profiles"), Match.when({ _tag: "ProjectAuth" }, () => "Project auth"), Match.when({ _tag: "Up" }, () => "docker compose up"), Match.when({ _tag: "Status" }, () => "docker compose ps"), Match.when({ _tag: "Logs" }, () => "docker compose logs"), Match.when({ _tag: "Down" }, () => "docker compose down"), Match.when({ _tag: "DownAll" }, () => "docker compose down (all projects)"), Match.orElse(() => "action"));
 const runWithSuspendedTui = (effect, context, label) => {
     context.runner.runEffect(pipe(Effect.sync(() => {
         context.setMessage(`${label}...`);
-        suspendTui();
-    }), Effect.zipRight(effect), Effect.tap(() => Effect.sync(() => {
+    }), Effect.zipRight(withSuspendedTui(effect, { onError: (error) => writeErrorAndPause(renderError(error)) })), Effect.tap(() => Effect.sync(() => {
         context.setMessage(`${label} finished.`);
-    })), Effect.ensuring(Effect.sync(() => {
-        resumeTui();
     })), Effect.asVoid));
 };
 const requireActiveProject = (context) => {
@@ -51,7 +49,7 @@ const withProjectConfig = (state, setMessage, f) => pipe(readProjectConfig(state
         : Effect.fail(error),
     onSuccess: (config) => pipe(f(config), Effect.as(continueOutcome(state)))
 }));
-const handleMenuAction = (state, setMessage, action) => Match.value(action).pipe(Match.when({ _tag: "Quit" }, () => Effect.succeed(quitOutcome)), Match.when({ _tag: "Create" }, () => Effect.succeed(continueOutcome(state))), Match.when({ _tag: "Select" }, () => Effect.succeed(continueOutcome(state))), Match.when({ _tag: "Info" }, () => Effect.succeed(continueOutcome(state))), Match.when({ _tag: "Delete" }, () => Effect.succeed(continueOutcome(state))), Match.when({ _tag: "Up" }, () => withProjectConfig(state, setMessage, () => runDockerComposeUpWithPortCheck(state.activeDir ?? state.cwd).pipe(Effect.asVoid))), Match.when({ _tag: "Status" }, () => withProjectConfig(state, setMessage, () => runDockerComposePs(state.activeDir ?? state.cwd))), Match.when({ _tag: "Logs" }, () => withProjectConfig(state, setMessage, () => runDockerComposeLogs(state.activeDir ?? state.cwd))), Match.when({ _tag: "Down" }, () => withProjectConfig(state, setMessage, () => runDockerComposeDown(state.activeDir ?? state.cwd))), Match.when({ _tag: "DownAll" }, () => pipe(downAllDockerGitProjects, Effect.as(continueOutcome(state)))), Match.exhaustive);
+const handleMenuAction = (state, setMessage, action) => Match.value(action).pipe(Match.when({ _tag: "Quit" }, () => Effect.succeed(quitOutcome)), Match.when({ _tag: "Create" }, () => Effect.succeed(continueOutcome(state))), Match.when({ _tag: "Select" }, () => Effect.succeed(continueOutcome(state))), Match.when({ _tag: "Auth" }, () => Effect.succeed(continueOutcome(state))), Match.when({ _tag: "ProjectAuth" }, () => Effect.succeed(continueOutcome(state))), Match.when({ _tag: "Info" }, () => Effect.succeed(continueOutcome(state))), Match.when({ _tag: "Delete" }, () => Effect.succeed(continueOutcome(state))), Match.when({ _tag: "Up" }, () => withProjectConfig(state, setMessage, () => runDockerComposeUpWithPortCheck(state.activeDir ?? state.cwd).pipe(Effect.asVoid))), Match.when({ _tag: "Status" }, () => withProjectConfig(state, setMessage, () => runDockerComposePs(state.activeDir ?? state.cwd))), Match.when({ _tag: "Logs" }, () => withProjectConfig(state, setMessage, () => runDockerComposeLogs(state.activeDir ?? state.cwd))), Match.when({ _tag: "Down" }, () => withProjectConfig(state, setMessage, () => runDockerComposeDown(state.activeDir ?? state.cwd))), Match.when({ _tag: "DownAll" }, () => pipe(downAllDockerGitProjects, Effect.as(continueOutcome(state)))), Match.exhaustive);
 const runCreateAction = (context) => {
     startCreateView(context.setView, context.setMessage);
 };
@@ -59,6 +57,20 @@ const runSelectAction = (context) => {
     context.setMessage(null);
     context.runner.runEffect(loadSelectView(listProjectItems, "Connect", context));
 };
+const runAuthProfilesAction = (context) => {
+    context.setMessage(null);
+    openAuthMenu({
+        state: context.state,
+        runner: context.runner,
+        setView: context.setView,
+        setMessage: context.setMessage,
+        setActiveDir: context.setActiveDir
+    });
+};
+const runProjectAuthAction = (context) => {
+    context.setMessage(null);
+    context.runner.runEffect(loadSelectView(listProjectItems, "Auth", context));
+};
 const runDownAllAction = (context) => {
     context.setMessage(null);
     runWithSuspendedTui(downAllDockerGitProjects, context, "Stopping all docker-git containers");
@@ -99,6 +111,10 @@ export const handleMenuActionSelection = (action, context) => {
         runCreateAction(context);
     }), Match.when({ _tag: "Select" }, () => {
         runSelectAction(context);
+    }), Match.when({ _tag: "Auth" }, () => {
+        runAuthProfilesAction(context);
+    }), Match.when({ _tag: "ProjectAuth" }, () => {
+        runProjectAuthAction(context);
     }), Match.when({ _tag: "Info" }, () => {
         runInfoAction(context);
     }), Match.when({ _tag: "Delete" }, () => {

package/dist/src/docker-git/menu-auth-data.js

@@ -0,0 +1,90 @@
+import * as FileSystem from "@effect/platform/FileSystem";
+import * as Path from "@effect/platform/Path";
+import { Effect, Match, pipe } from "effect";
+import { ensureEnvFile, parseEnvEntries, readEnvText, upsertEnvKey } from "@effect-template/lib/usecases/env-file";
+import {} from "@effect-template/lib/usecases/errors";
+import { defaultProjectsRoot } from "@effect-template/lib/usecases/menu-helpers";
+import { autoSyncState } from "@effect-template/lib/usecases/state-repo";
+import { countAuthAccountDirectories } from "./menu-auth-helpers.js";
+import { buildLabeledEnvKey, countKeyEntries, normalizeLabel } from "./menu-labeled-env.js";
+const authMenuItems = [
+    { action: "GithubOauth", label: "GitHub: login via OAuth (web)" },
+    { action: "GithubRemove", label: "GitHub: remove token" },
+    { action: "GitSet", label: "Git: add/update credentials" },
+    { action: "GitRemove", label: "Git: remove credentials" },
+    { action: "ClaudeOauth", label: "Claude Code: login via OAuth (web)" },
+    { action: "ClaudeLogout", label: "Claude Code: logout (clear cache)" },
+    { action: "Refresh", label: "Refresh snapshot" },
+    { action: "Back", label: "Back to main menu" }
+];
+const flowSteps = {
+    GithubOauth: [
+        { key: "label", label: "Label (empty = default)", required: false, secret: false }
+    ],
+    GithubRemove: [
+        { key: "label", label: "Label to remove (empty = default)", required: false, secret: false }
+    ],
+    GitSet: [
+        { key: "label", label: "Label (empty = default)", required: false, secret: false },
+        { key: "token", label: "Git auth token", required: true, secret: true },
+        { key: "user", label: "Git auth user (empty = x-access-token)", required: false, secret: false }
+    ],
+    GitRemove: [
+        { key: "label", label: "Label to remove (empty = default)", required: false, secret: false }
+    ],
+    ClaudeOauth: [
+        { key: "label", label: "Label (empty = default)", required: false, secret: false }
+    ],
+    ClaudeLogout: [
+        { key: "label", label: "Label to logout (empty = default)", required: false, secret: false }
+    ]
+};
+const flowTitle = (flow) => Match.value(flow).pipe(Match.when("GithubOauth", () => "GitHub OAuth"), Match.when("GithubRemove", () => "GitHub remove"), Match.when("GitSet", () => "Git credentials"), Match.when("GitRemove", () => "Git remove"), Match.when("ClaudeOauth", () => "Claude Code OAuth"), Match.when("ClaudeLogout", () => "Claude Code logout"), Match.exhaustive);
+export const successMessage = (flow, label) => Match.value(flow).pipe(Match.when("GithubOauth", () => `Saved GitHub token (${label}).`), Match.when("GithubRemove", () => `Removed GitHub token (${label}).`), Match.when("GitSet", () => `Saved Git credentials (${label}).`), Match.when("GitRemove", () => `Removed Git credentials (${label}).`), Match.when("ClaudeOauth", () => `Saved Claude Code login (${label}).`), Match.when("ClaudeLogout", () => `Logged out Claude Code (${label}).`), Match.exhaustive);
+const buildGlobalEnvPath = (cwd) => `${defaultProjectsRoot(cwd)}/.orch/env/global.env`;
+const buildClaudeAuthPath = (cwd) => `${defaultProjectsRoot(cwd)}/.orch/auth/claude`;
+const loadAuthEnvText = (cwd) => Effect.gen(function* (_) {
+    const fs = yield* _(FileSystem.FileSystem);
+    const path = yield* _(Path.Path);
+    const globalEnvPath = buildGlobalEnvPath(cwd);
+    const claudeAuthPath = buildClaudeAuthPath(cwd);
+    yield* _(ensureEnvFile(fs, path, globalEnvPath));
+    const envText = yield* _(readEnvText(fs, globalEnvPath));
+    return { fs, path, globalEnvPath, claudeAuthPath, envText };
+});
+export const readAuthSnapshot = (cwd) => pipe(loadAuthEnvText(cwd), Effect.flatMap(({ claudeAuthPath, envText, fs, globalEnvPath, path }) => pipe(countAuthAccountDirectories(fs, path, claudeAuthPath), Effect.map((claudeAuthEntries) => ({
+    globalEnvPath,
+    claudeAuthPath,
+    totalEntries: parseEnvEntries(envText).filter((entry) => entry.value.trim().length > 0).length,
+    githubTokenEntries: countKeyEntries(envText, "GITHUB_TOKEN"),
+    gitTokenEntries: countKeyEntries(envText, "GIT_AUTH_TOKEN"),
+    gitUserEntries: countKeyEntries(envText, "GIT_AUTH_USER"),
+    claudeAuthEntries
+})))));
+export const writeAuthFlow = (cwd, flow, values) => pipe(loadAuthEnvText(cwd), Effect.flatMap(({ envText, fs, globalEnvPath }) => {
+    const label = values["label"] ?? "";
+    const canonicalLabel = (() => {
+        const normalized = normalizeLabel(label);
+        return normalized.length === 0 || normalized === "DEFAULT" ? "default" : normalized;
+    })();
+    const token = (values["token"] ?? "").trim();
+    const user = (values["user"] ?? "").trim();
+    const nextText = Match.value(flow).pipe(Match.when("GithubRemove", () => upsertEnvKey(envText, buildLabeledEnvKey("GITHUB_TOKEN", label), "")), Match.when("GitSet", () => {
+        const withToken = upsertEnvKey(envText, buildLabeledEnvKey("GIT_AUTH_TOKEN", label), token);
+        const resolvedUser = user.length > 0 ? user : "x-access-token";
+        return upsertEnvKey(withToken, buildLabeledEnvKey("GIT_AUTH_USER", label), resolvedUser);
+    }), Match.when("GitRemove", () => {
+        const withoutToken = upsertEnvKey(envText, buildLabeledEnvKey("GIT_AUTH_TOKEN", label), "");
+        return upsertEnvKey(withoutToken, buildLabeledEnvKey("GIT_AUTH_USER", label), "");
+    }), Match.exhaustive);
+    const syncMessage = Match.value(flow).pipe(Match.when("GithubRemove", () => `chore(state): auth gh logout ${canonicalLabel}`), Match.when("GitSet", () => `chore(state): auth git ${canonicalLabel}`), Match.when("GitRemove", () => `chore(state): auth git logout ${canonicalLabel}`), Match.exhaustive);
+    return pipe(fs.writeFileString(globalEnvPath, nextText), Effect.zipRight(autoSyncState(syncMessage)));
+}), Effect.asVoid);
+export const authViewTitle = (flow) => flowTitle(flow);
+export const authViewSteps = (flow) => flowSteps[flow];
+export const authMenuLabels = () => authMenuItems.map((item) => item.label);
+export const authMenuActionByIndex = (index) => {
+    const item = authMenuItems[index];
+    return item ? item.action : null;
+};
+export const authMenuSize = () => authMenuItems.length;

package/dist/src/docker-git/menu-auth-helpers.js

@@ -0,0 +1,20 @@
+import { Effect } from "effect";
+export const countAuthAccountDirectories = (fs, path, root) => Effect.gen(function* (_) {
+    const exists = yield* _(fs.exists(root));
+    if (!exists) {
+        return 0;
+    }
+    const entries = yield* _(fs.readDirectory(root));
+    let count = 0;
+    for (const entry of entries) {
+        if (entry === ".image") {
+            continue;
+        }
+        const fullPath = path.join(root, entry);
+        const info = yield* _(fs.stat(fullPath));
+        if (info.type === "Directory") {
+            count += 1;
+        }
+    }
+    return count;
+});

package/dist/src/docker-git/menu-auth.js

@@ -0,0 +1,159 @@
+import { Effect, Match, pipe } from "effect";
+import { authClaudeLogin, authClaudeLogout, authGithubLogin, claudeAuthRoot } from "@effect-template/lib/usecases/auth";
+import { renderError } from "@effect-template/lib/usecases/errors";
+import { authMenuActionByIndex, authMenuSize, authViewSteps, readAuthSnapshot, successMessage, writeAuthFlow } from "./menu-auth-data.js";
+import { nextBufferValue } from "./menu-buffer-input.js";
+import { handleMenuNumberInput, submitPromptStep } from "./menu-input-utils.js";
+import { pauseOnError, resetToMenu, resumeSshWithSkipInputs, withSuspendedTui } from "./menu-shared.js";
+const defaultLabel = (value) => {
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : "default";
+};
+const startAuthMenuWithSnapshot = (snapshot, context) => {
+    context.setView({ _tag: "AuthMenu", selected: 0, snapshot });
+    context.setMessage(null);
+};
+const startAuthPrompt = (snapshot, flow, context) => {
+    context.setView({
+        _tag: "AuthPrompt",
+        flow,
+        step: 0,
+        buffer: "",
+        values: {},
+        snapshot
+    });
+    context.setMessage(null);
+};
+const resolveLabelOption = (values) => {
+    const labelValue = (values["label"] ?? "").trim();
+    return labelValue.length > 0 ? labelValue : null;
+};
+const resolveAuthPromptEffect = (view, cwd, values) => {
+    const labelOption = resolveLabelOption(values);
+    return Match.value(view.flow).pipe(Match.when("GithubOauth", () => authGithubLogin({
+        _tag: "AuthGithubLogin",
+        label: labelOption,
+        token: null,
+        scopes: null,
+        envGlobalPath: view.snapshot.globalEnvPath
+    })), Match.when("ClaudeOauth", () => authClaudeLogin({
+        _tag: "AuthClaudeLogin",
+        label: labelOption,
+        claudeAuthPath: claudeAuthRoot
+    })), Match.when("ClaudeLogout", () => authClaudeLogout({
+        _tag: "AuthClaudeLogout",
+        label: labelOption,
+        claudeAuthPath: claudeAuthRoot
+    })), Match.when("GithubRemove", (flow) => writeAuthFlow(cwd, flow, values)), Match.when("GitSet", (flow) => writeAuthFlow(cwd, flow, values)), Match.when("GitRemove", (flow) => writeAuthFlow(cwd, flow, values)), Match.exhaustive);
+};
+const runAuthPromptEffect = (effect, view, label, context, options) => {
+    const withOptionalSuspension = options.suspendTui
+        ? withSuspendedTui(effect, {
+            onError: pauseOnError(renderError),
+            onResume: resumeSshWithSkipInputs(context)
+        })
+        : effect;
+    context.setSshActive(options.suspendTui);
+    context.runner.runEffect(pipe(withOptionalSuspension, Effect.zipRight(readAuthSnapshot(context.state.cwd)), Effect.tap((snapshot) => Effect.sync(() => {
+        startAuthMenuWithSnapshot(snapshot, context);
+        context.setMessage(successMessage(view.flow, label));
+    })), Effect.asVoid));
+};
+const loadAuthMenuView = (cwd, context) => pipe(readAuthSnapshot(cwd), Effect.tap((snapshot) => Effect.sync(() => {
+    startAuthMenuWithSnapshot(snapshot, context);
+})), Effect.asVoid);
+const runAuthAction = (action, view, context) => {
+    if (action === "Back") {
+        resetToMenu(context);
+        return;
+    }
+    if (action === "Refresh") {
+        context.runner.runEffect(loadAuthMenuView(context.state.cwd, context));
+        return;
+    }
+    startAuthPrompt(view.snapshot, action, context);
+};
+const submitAuthPrompt = (view, context) => {
+    const steps = authViewSteps(view.flow);
+    submitPromptStep(view, steps, context, () => {
+        startAuthMenuWithSnapshot(view.snapshot, context);
+    }, (nextValues) => {
+        const label = defaultLabel(nextValues["label"] ?? "");
+        const effect = resolveAuthPromptEffect(view, context.state.cwd, nextValues);
+        runAuthPromptEffect(effect, view, label, context, {
+            suspendTui: view.flow === "GithubOauth" || view.flow === "ClaudeOauth" || view.flow === "ClaudeLogout"
+        });
+    });
+};
+const setAuthMenuSelection = (view, selected, context) => {
+    context.setView({
+        ...view,
+        selected
+    });
+};
+const shiftAuthMenuSelection = (view, delta, context) => {
+    const menuSize = authMenuSize();
+    const selected = (view.selected + delta + menuSize) % menuSize;
+    setAuthMenuSelection(view, selected, context);
+};
+const runAuthMenuSelection = (selected, view, context) => {
+    const action = authMenuActionByIndex(selected);
+    if (action === null) {
+        return;
+    }
+    runAuthAction(action, view, context);
+};
+const handleAuthMenuNumberInput = (input, view, context) => {
+    handleMenuNumberInput(input, context, authMenuActionByIndex, (action) => {
+        runAuthAction(action, view, context);
+    });
+};
+const handleAuthMenuInput = (input, key, view, context) => {
+    if (key.escape) {
+        resetToMenu(context);
+        return;
+    }
+    if (key.upArrow) {
+        shiftAuthMenuSelection(view, -1, context);
+        return;
+    }
+    if (key.downArrow) {
+        shiftAuthMenuSelection(view, 1, context);
+        return;
+    }
+    if (key.return) {
+        runAuthMenuSelection(view.selected, view, context);
+        return;
+    }
+    handleAuthMenuNumberInput(input, view, context);
+};
+const handleAuthPromptInput = (input, key, view, context) => {
+    if (key.escape) {
+        startAuthMenuWithSnapshot(view.snapshot, context);
+        return;
+    }
+    if (key.return) {
+        submitAuthPrompt(view, context);
+        return;
+    }
+    setAuthPromptBuffer({ input, key, view, context });
+};
+const setAuthPromptBuffer = (args) => {
+    const { context, input, key, view } = args;
+    const nextBuffer = nextBufferValue(input, key, view.buffer);
+    if (nextBuffer === null) {
+        return;
+    }
+    context.setView({ ...view, buffer: nextBuffer });
+};
+export const openAuthMenu = (context) => {
+    context.setMessage("Loading auth profiles...");
+    context.runner.runEffect(loadAuthMenuView(context.state.cwd, context));
+};
+export const handleAuthInput = (input, key, view, context) => {
+    if (view._tag === "AuthMenu") {
+        handleAuthMenuInput(input, key, view, context);
+        return;
+    }
+    handleAuthPromptInput(input, key, view, context);
+};

package/dist/src/docker-git/menu-buffer-input.js

@@ -0,0 +1,9 @@
+export const nextBufferValue = (input, key, buffer) => {
+    if (key.backspace || key.delete) {
+        return buffer.slice(0, -1);
+    }
+    if (input.length > 0) {
+        return buffer + input;
+    }
+    return null;
+};

package/dist/src/docker-git/menu-create.js

@@ -5,10 +5,11 @@ import * as Path from "@effect/platform/Path";
 import { Effect, Either, Match, pipe } from "effect";
 import { parseArgs } from "./cli/parser.js";
 import { formatParseError, usageText } from "./cli/usage.js";
+import { nextBufferValue } from "./menu-buffer-input.js";
 import { resetToMenu } from "./menu-shared.js";
 import { createSteps } from "./menu-types.js";
 export const buildCreateArgs = (input) => {
-    const args = ["create", "--repo-url", input.repoUrl, "--secrets-root", input.secretsRoot];
+    const args = ["create", "--repo-url", input.repoUrl];
     if (input.repoRef.length > 0) {
         args.push("--repo-ref", input.repoRef);
     }
@@ -61,13 +62,11 @@ const resolveDefaultOutDir = (cwd, repoUrl) => {
 export const resolveCreateInputs = (cwd, values) => {
     const repoUrl = values.repoUrl ?? "";
     const resolvedRepoRef = repoUrl.length > 0 ? resolveRepoInput(repoUrl).repoRef : undefined;
-    const secretsRoot = values.secretsRoot ?? joinPath(defaultProjectsRoot(cwd), "secrets");
     const outDir = values.outDir ?? (repoUrl.length > 0 ? resolveDefaultOutDir(cwd, repoUrl) : "");
     return {
         repoUrl,
         repoRef: values.repoRef ?? resolvedRepoRef ?? "main",
         outDir,
-        secretsRoot,
         runUp: values.runUp !== false,
         enableMcpPlaywright: values.enableMcpPlaywright === true,
         force: values.force === true,
@@ -193,11 +192,8 @@ export const handleCreateInput = (input, key, view, context) => {
         handleCreateReturn({ ...context, view });
         return;
     }
-    if (key.backspace || key.delete) {
-        context.setView({ ...view, buffer: view.buffer.slice(0, -1) });
-        return;
-    }
-    if (input.length > 0) {
-        context.setView({ ...view, buffer: view.buffer + input });
+    const nextBuffer = nextBufferValue(input, key, view.buffer);
+    if (nextBuffer !== null) {
+        context.setView({ ...view, buffer: nextBuffer });
     }
 };

package/dist/src/docker-git/menu-input-handler.js

@@ -1,5 +1,7 @@
+import { handleAuthInput } from "./menu-auth.js";
 import { handleCreateInput } from "./menu-create.js";
 import { handleMenuInput } from "./menu-menu.js";
+import { handleProjectAuthInput } from "./menu-project-auth.js";
 import { handleSelectInput } from "./menu-select.js";
 const activateInput = (input, key, context) => {
     if (context.inputStage === "active") {
@@ -26,36 +28,51 @@ const shouldHandleMenuInput = (input, key, context) => {
     }
     return activation.allowProcessing;
 };
-export const handleUserInput = (input, key, context) => {
-    if (context.busy || context.sshActive) {
-        return;
-    }
-    if (context.view._tag === "Menu") {
-        if (!shouldHandleMenuInput(input, key, context)) {
-            return;
-        }
-        handleMenuInput(input, key, {
-            selected: context.selected,
-            setSelected: context.setSelected,
-            state: context.state,
-            runner: context.runner,
-            exit: context.exit,
-            setView: context.setView,
-            setMessage: context.setMessage
-        });
-        return;
-    }
-    if (context.view._tag === "Create") {
-        handleCreateInput(input, key, context.view, {
-            state: context.state,
-            setView: context.setView,
-            setMessage: context.setMessage,
-            runner: context.runner,
-            setActiveDir: context.setActiveDir
-        });
+const handleMenuViewInput = (input, key, context) => {
+    if (!shouldHandleMenuInput(input, key, context)) {
         return;
     }
-    handleSelectInput(input, key, context.view, {
+    handleMenuInput(input, key, {
+        selected: context.selected,
+        setSelected: context.setSelected,
+        state: context.state,
+        runner: context.runner,
+        exit: context.exit,
+        setView: context.setView,
+        setMessage: context.setMessage,
+        setActiveDir: context.setActiveDir
+    });
+};
+const handleCreateViewInput = (input, key, view, context) => {
+    handleCreateInput(input, key, view, {
+        state: context.state,
+        setView: context.setView,
+        setMessage: context.setMessage,
+        runner: context.runner,
+        setActiveDir: context.setActiveDir
+    });
+};
+const handleAuthViewInput = (input, key, view, context) => {
+    handleAuthInput(input, key, view, {
+        state: context.state,
+        setView: context.setView,
+        setMessage: context.setMessage,
+        setActiveDir: context.setActiveDir,
+        runner: context.runner,
+        setSshActive: context.setSshActive,
+        setSkipInputs: context.setSkipInputs
+    });
+};
+const handleProjectAuthViewInput = (input, key, view, context) => {
+    handleProjectAuthInput(input, key, view, {
+        runner: context.runner,
+        setView: context.setView,
+        setMessage: context.setMessage,
+        setActiveDir: context.setActiveDir
+    });
+};
+const handleSelectViewInput = (input, key, view, context) => {
+    handleSelectInput(input, key, view, {
         setView: context.setView,
         setMessage: context.setMessage,
         setActiveDir: context.setActiveDir,
@@ -65,3 +82,28 @@ export const handleUserInput = (input, key, context) => {
         setSkipInputs: context.setSkipInputs
     });
 };
+const handleActiveViewInput = (input, key, view, context) => {
+    if (view._tag === "Create") {
+        handleCreateViewInput(input, key, view, context);
+        return;
+    }
+    if (view._tag === "AuthMenu" || view._tag === "AuthPrompt") {
+        handleAuthViewInput(input, key, view, context);
+        return;
+    }
+    if (view._tag === "ProjectAuthMenu" || view._tag === "ProjectAuthPrompt") {
+        handleProjectAuthViewInput(input, key, view, context);
+        return;
+    }
+    handleSelectViewInput(input, key, view, context);
+};
+export const handleUserInput = (input, key, context) => {
+    if (context.busy || context.sshActive) {
+        return;
+    }
+    if (context.view._tag === "Menu") {
+        handleMenuViewInput(input, key, context);
+        return;
+    }
+    handleActiveViewInput(input, key, context.view, context);
+};