@prover-coder-ai/docker-git 1.0.42 → 1.0.43

package/dist/src/docker-git/main.js

@@ -1211,6 +1211,38 @@ var ensureGhAuthImage = (fs, path, cwd, buildLabel) => ensureDockerImage(fs, pat
 	buildLabel
 });
 //#endregion
+//#region ../lib/src/usecases/github-api-helpers.ts
+/**
+* Run `gh api <args>` inside the auth Docker container and return trimmed stdout.
+*
+* @pure false
+* @effect CommandExecutor (Docker)
+* @invariant exits with CommandFailedError on non-zero exit code
+* @complexity O(1)
+*/
+var runGhApiCapture = (cwd, hostPath, token, args) => runDockerAuthCapture(buildDockerAuthSpec({
+	cwd,
+	image: ghImageName,
+	hostPath,
+	containerPath: ghAuthDir,
+	env: `GH_TOKEN=${token}`,
+	args: ["api", ...args],
+	interactive: false
+}), [0], (exitCode) => new CommandFailedError({
+	command: `gh api ${args.join(" ")}`,
+	exitCode
+})).pipe(Effect.map((raw) => raw.trim()));
+/**
+* Like `runGhApiCapture` but returns `null` instead of failing on API errors
+* (e.g. HTTP 404 / non-zero exit code).
+*
+* @pure false
+* @effect CommandExecutor (Docker)
+* @invariant never fails — errors become null
+* @complexity O(1)
+*/
+var runGhApiNullable = (cwd, hostPath, token, args) => runGhApiCapture(cwd, hostPath, token, args).pipe(Effect.catchTag("CommandFailedError", () => Effect.succeed("")), Effect.map((raw) => raw.length === 0 ? null : raw));
+//#endregion
 //#region ../lib/src/usecases/runtime.ts
 var withFsPathContext = (run) => Effect.gen(function* (_) {
 	return yield* _(run({
@@ -1228,20 +1260,7 @@ var resolveGithubToken$1 = (envText) => {
 	const labeled = entries.find((entry) => entry.key.startsWith("GITHUB_TOKEN__"));
 	return labeled && labeled.value.trim().length > 0 ? labeled.value.trim() : null;
 };
-var runGhApiCapture = (cwd, hostPath, token, args) => runDockerAuthCapture(buildDockerAuthSpec({
-	cwd,
-	image: ghImageName,
-	hostPath,
-	containerPath: ghAuthDir,
-	env: `GH_TOKEN=${token}`,
-	args: ["api", ...args],
-	interactive: false
-}), [0], (exitCode) => new CommandFailedError({
-	command: `gh api ${args.join(" ")}`,
-	exitCode
-})).pipe(Effect.map((raw) => raw.trim()));
-var runGhApiCloneUrl = (cwd, hostPath, token, args) => runGhApiCapture(cwd, hostPath, token, args).pipe(Effect.catchTag("CommandFailedError", () => Effect.succeed("")), Effect.map((raw) => raw.length === 0 ? null : raw));
-var resolveViewerLogin = (cwd, hostPath, token) => Effect.gen(function* (_) {
+var resolveViewerLogin$1 = (cwd, hostPath, token) => Effect.gen(function* (_) {
 	const command = "gh api /user --jq .login";
 	const raw = yield* _(runGhApiCapture(cwd, hostPath, token, [
 		"/user",
@@ -1254,12 +1273,12 @@ var resolveViewerLogin = (cwd, hostPath, token) => Effect.gen(function* (_) {
 	})));
 	return raw;
 });
-var resolveRepoCloneUrl = (cwd, hostPath, token, fullName) => runGhApiCloneUrl(cwd, hostPath, token, [
+var resolveRepoCloneUrl = (cwd, hostPath, token, fullName) => runGhApiNullable(cwd, hostPath, token, [
 	`/repos/${fullName}`,
 	"--jq",
 	".clone_url"
 ]);
-var createFork = (cwd, hostPath, token, owner, repo) => runGhApiCloneUrl(cwd, hostPath, token, [
+var createFork = (cwd, hostPath, token, owner, repo) => runGhApiNullable(cwd, hostPath, token, [
 	"-X",
 	"POST",
 	`/repos/${owner}/${repo}/forks`,
@@ -1277,7 +1296,7 @@ var resolveGithubForkUrl = (repoUrl, envGlobalPath) => withFsPathContext(({ cwd,
 	const ghRoot = resolvePathFromCwd(path, cwd, ghAuthRoot);
 	yield* _(fs.makeDirectory(ghRoot, { recursive: true }));
 	yield* _(ensureGhAuthImage(fs, path, cwd, "gh api"));
-	const viewer = yield* _(resolveViewerLogin(cwd, ghRoot, token));
+	const viewer = yield* _(resolveViewerLogin$1(cwd, ghRoot, token));
 	if (viewer.toLowerCase() === repo.owner.toLowerCase()) return null;
 	const existingFork = yield* _(resolveRepoCloneUrl(cwd, ghRoot, token, `${viewer}/${repo.repo}`));
 	if (existingFork !== null) return existingFork;
@@ -1588,28 +1607,15 @@ var resolveComposeResourceLimits = (template, hostResources) => {
 //#region ../lib/src/usecases/resource-limits.ts
 var resolveTemplateResourceLimits = (template) => Effect.succeed(withDefaultResourceLimitIntent(template));
 //#endregion
-//#region ../lib/src/usecases/state-repo/env.ts
-var isTruthyEnv = (value) => {
-	const normalized = value.trim().toLowerCase();
-	return normalized === "1" || normalized === "true" || normalized === "yes" || normalized === "on";
-};
-var isFalsyEnv = (value) => {
-	const normalized = value.trim().toLowerCase();
-	return normalized === "0" || normalized === "false" || normalized === "no" || normalized === "off";
-};
-var autoSyncStrictEnvKey = "DOCKER_GIT_STATE_AUTO_SYNC_STRICT";
-var defaultSyncMessage = "chore(state): sync";
-var isAutoSyncEnabled = (envValue, hasRemote) => {
-	if (envValue === void 0) return hasRemote;
-	if (envValue.trim().length === 0) return hasRemote;
-	if (isFalsyEnv(envValue)) return false;
-	if (isTruthyEnv(envValue)) return true;
-	return true;
-};
-//#endregion
 //#region ../lib/src/usecases/state-repo/git-commands.ts
 var successExitCode = Number(ExitCode(0));
-var gitBaseEnv$1 = { GIT_TERMINAL_PROMPT: "0" };
+var gitBaseEnv$1 = {
+	GIT_TERMINAL_PROMPT: "0",
+	GIT_AUTHOR_NAME: "docker-git",
+	GIT_AUTHOR_EMAIL: "docker-git@users.noreply.github.com",
+	GIT_COMMITTER_NAME: "docker-git",
+	GIT_COMMITTER_EMAIL: "docker-git@users.noreply.github.com"
+};
 var git = (cwd, args, env = gitBaseEnv$1) => runCommandWithExitCodes({
 	cwd,
 	command: "git",
@@ -1641,6 +1647,68 @@ var hasOriginRemote = (root) => Effect.map(gitExitCode(root, [
 	"origin"
 ]), (exit) => exit === successExitCode);
 //#endregion
+//#region ../lib/src/usecases/state-repo/adopt-remote.ts
+var adoptRemoteHistoryIfOrphan = (root, repoRef, env) => Effect.gen(function* (_) {
+	const fetchExit = yield* _(gitExitCode(root, [
+		"fetch",
+		"origin",
+		repoRef
+	], env));
+	if (fetchExit !== successExitCode) {
+		yield* _(Effect.logWarning(`git fetch origin ${repoRef} failed (exit ${fetchExit}); starting fresh history`));
+		return;
+	}
+	const remoteRef = `origin/${repoRef}`;
+	if ((yield* _(gitExitCode(root, [
+		"show-ref",
+		"--verify",
+		"--quiet",
+		`refs/remotes/${remoteRef}`
+	], env))) !== successExitCode) return;
+	if ((yield* _(gitExitCode(root, ["rev-parse", "HEAD"], env))) !== successExitCode) {
+		yield* _(git(root, ["reset", remoteRef], env));
+		yield* _(gitExitCode(root, ["checkout-index", "--all"], env));
+		yield* _(Effect.log(`Adopted remote history from ${remoteRef}`));
+		return;
+	}
+	if ((yield* _(gitExitCode(root, [
+		"merge-base",
+		"HEAD",
+		remoteRef
+	], env))) === successExitCode) return;
+	yield* _(Effect.logWarning(`Local history has no common ancestor with ${remoteRef}; merging unrelated histories`));
+	if ((yield* _(gitExitCode(root, [
+		"merge",
+		"--allow-unrelated-histories",
+		"--no-edit",
+		remoteRef
+	], env))) === successExitCode) {
+		yield* _(Effect.log(`Merged unrelated histories from ${remoteRef}`));
+		return;
+	}
+	yield* _(gitExitCode(root, ["merge", "--abort"], env));
+	yield* _(Effect.logWarning(`Merge conflict with ${remoteRef}; sync will open a PR for manual resolution`));
+});
+//#endregion
+//#region ../lib/src/usecases/state-repo/env.ts
+var isTruthyEnv = (value) => {
+	const normalized = value.trim().toLowerCase();
+	return normalized === "1" || normalized === "true" || normalized === "yes" || normalized === "on";
+};
+var isFalsyEnv = (value) => {
+	const normalized = value.trim().toLowerCase();
+	return normalized === "0" || normalized === "false" || normalized === "no" || normalized === "off";
+};
+var autoSyncStrictEnvKey = "DOCKER_GIT_STATE_AUTO_SYNC_STRICT";
+var defaultSyncMessage = "chore(state): sync";
+var isAutoSyncEnabled = (envValue, hasRemote) => {
+	if (envValue === void 0) return hasRemote;
+	if (envValue.trim().length === 0) return hasRemote;
+	if (isFalsyEnv(envValue)) return false;
+	if (isTruthyEnv(envValue)) return true;
+	return true;
+};
+//#endregion
 //#region ../lib/src/usecases/state-repo/github-auth.ts
 var githubTokenKey = "GITHUB_TOKEN";
 var githubHttpsRemoteRe = /^https:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?$/;
@@ -4378,7 +4446,7 @@ var commitAllIfNeeded = (root, message, env) => Effect.gen(function* (_) {
 	], env));
 });
 var sanitizeBranchComponent = (value) => value.trim().replaceAll(" ", "-").replaceAll(":", "-").replaceAll("..", "-").replaceAll("@{", "-").replaceAll("\\", "-").replaceAll("^", "-").replaceAll("~", "-");
-var rebaseOntoOriginIfPossible = (root, baseBranch, env) => Effect.gen(function* (_) {
+var pullRemoteAndRestoreLocal = (root, baseBranch, env) => Effect.gen(function* (_) {
 	const fetchExit = yield* _(gitExitCode(root, [
 		"fetch",
 		"origin",
@@ -4393,10 +4461,26 @@ var rebaseOntoOriginIfPossible = (root, baseBranch, env) => Effect.gen(function*
 		"--verify",
 		"--quiet",
 		`refs/remotes/origin/${baseBranch}`
-	], env))) !== successExitCode) return "skipped";
-	if ((yield* _(gitExitCode(root, ["rebase", `origin/${baseBranch}`], env))) === successExitCode) return "ok";
-	yield* _(gitExitCode(root, ["rebase", "--abort"], env));
-	return "conflict";
+	], env))) !== successExitCode) return;
+	yield* _(git(root, ["add", "-A"], env));
+	const stashExit = yield* _(gitExitCode(root, ["stash", "--include-untracked"], env));
+	yield* _(git(root, [
+		"reset",
+		"--hard",
+		`origin/${baseBranch}`
+	], env));
+	if (stashExit === successExitCode) {
+		if ((yield* _(gitExitCode(root, ["stash", "pop"], env))) !== successExitCode) {
+			yield* _(gitExitCode(root, [
+				"checkout",
+				"--theirs",
+				"--",
+				"."
+			], env));
+			yield* _(git(root, ["add", "-A"], env));
+			yield* _(gitExitCode(root, ["stash", "drop"], env));
+		}
+	}
 });
 var pushToNewBranch = (root, baseBranch, originPushTarget, env) => Effect.gen(function* (_) {
 	const headShort = yield* _(gitCapture$1(root, [
@@ -4422,15 +4506,9 @@ var getCurrentBranch = (root, env) => gitCapture$1(root, [
 var runStateSyncOps = (root, originUrl, message, env, options) => Effect.gen(function* (_) {
 	const originPushTarget = resolveOriginPushTarget(options?.originPushUrlOverride ?? null);
 	yield* _(normalizeLegacyStateProjects(root));
-	yield* _(commitAllIfNeeded(root, resolveSyncMessage(message), env));
 	const baseBranch = resolveBaseBranch(yield* _(getCurrentBranch(root, env)));
-	if ((yield* _(rebaseOntoOriginIfPossible(root, baseBranch, env))) === "conflict") {
-		const prBranch = yield* _(pushToNewBranch(root, baseBranch, originPushTarget, env));
-		const compareUrl = tryBuildGithubCompareUrl(originUrl, baseBranch, prBranch);
-		yield* _(Effect.logWarning(`State sync needs manual merge: pushed changes to branch '${prBranch}'.`));
-		yield* _(logOpenPr(originUrl, baseBranch, prBranch, compareUrl));
-		return;
-	}
+	yield* _(pullRemoteAndRestoreLocal(root, baseBranch, env));
+	yield* _(commitAllIfNeeded(root, resolveSyncMessage(message), env));
 	const pushExit = yield* _(gitExitCode(root, [
 		"push",
 		"--no-verify",
@@ -4517,7 +4595,7 @@ var autoSyncState = (message) => Effect.gen(function* (_) {
 	onFailure: (error) => Effect.logWarning(`State auto-sync failed: ${String(error)}`),
 	onSuccess: () => Effect.void
 }), Effect.asVoid);
-var cloneStateRepo = (root, input) => Effect.gen(function* (_) {
+var cloneStateRepo = (root, input, env) => Effect.gen(function* (_) {
 	const cloneBranchExit = yield* _(runCommandExitCode({
 		cwd: root,
 		command: "git",
@@ -4528,7 +4606,7 @@ var cloneStateRepo = (root, input) => Effect.gen(function* (_) {
 			input.repoUrl,
 			root
 		],
-		env: gitBaseEnv$1
+		env
 	}));
 	if (cloneBranchExit === successExitCode) return;
 	yield* _(Effect.logWarning(`git clone --branch ${input.repoRef} failed (exit ${cloneBranchExit}); retrying without --branch`));
@@ -4540,58 +4618,63 @@ var cloneStateRepo = (root, input) => Effect.gen(function* (_) {
 			input.repoUrl,
 			root
 		],
-		env: gitBaseEnv$1
+		env
 	}));
 	if (cloneDefaultExit !== successExitCode) return yield* _(Effect.fail(new CommandFailedError({
 		command: "git clone",
 		exitCode: cloneDefaultExit
 	})));
 }).pipe(Effect.asVoid);
-var initRepoIfNeeded = (fs, path, root, input) => Effect.gen(function* (_) {
+var initRepoIfNeeded = (fs, path, root, input, env) => Effect.gen(function* (_) {
 	yield* _(fs.makeDirectory(root, { recursive: true }));
 	const gitDir = path.join(root, ".git");
 	if (yield* _(fs.exists(gitDir))) return;
 	if ((yield* _(fs.readDirectory(root))).length === 0) {
-		yield* _(cloneStateRepo(root, input));
+		yield* _(cloneStateRepo(root, input, env));
 		yield* _(Effect.log(`State dir cloned: ${root}`));
 		return;
 	}
-	yield* _(git(root, ["init"], gitBaseEnv$1));
+	yield* _(git(root, ["init", "--initial-branch=main"], env));
 }).pipe(Effect.asVoid);
-var ensureOriginRemote = (root, repoUrl) => Effect.gen(function* (_) {
+var ensureOriginRemote = (root, repoUrl, env) => Effect.gen(function* (_) {
 	if ((yield* _(gitExitCode(root, [
 		"remote",
 		"set-url",
 		"origin",
 		repoUrl
-	], gitBaseEnv$1))) === successExitCode) return;
+	], env))) === successExitCode) return;
 	yield* _(git(root, [
 		"remote",
 		"add",
 		"origin",
 		repoUrl
-	], gitBaseEnv$1));
+	], env));
 });
-var checkoutBranchBestEffort = (root, repoRef) => Effect.gen(function* (_) {
+var checkoutBranchBestEffort = (root, repoRef, env) => Effect.gen(function* (_) {
 	const checkoutExit = yield* _(gitExitCode(root, [
 		"checkout",
 		"-B",
 		repoRef
-	], gitBaseEnv$1));
+	], env));
 	if (checkoutExit === successExitCode) return;
 	yield* _(Effect.logWarning(`git checkout -B ${repoRef} failed (exit ${checkoutExit})`));
 });
-var stateInit = (input) => Effect.gen(function* (_) {
-	const fs = yield* _(FileSystem.FileSystem);
-	const path = yield* _(Path.Path);
-	const root = resolveStateRoot(path, process.cwd());
-	yield* _(initRepoIfNeeded(fs, path, root, input));
-	yield* _(ensureOriginRemote(root, input.repoUrl));
-	yield* _(checkoutBranchBestEffort(root, input.repoRef));
-	yield* _(ensureStateGitignore(fs, path, root));
-	yield* _(Effect.log(`State dir ready: ${root}`));
-	yield* _(Effect.log(`Remote: ${input.repoUrl}`));
-}).pipe(Effect.asVoid);
+var stateInit = (input) => {
+	const doInit = (env) => Effect.gen(function* (_) {
+		const fs = yield* _(FileSystem.FileSystem);
+		const path = yield* _(Path.Path);
+		const root = resolveStateRoot(path, process.cwd());
+		yield* _(initRepoIfNeeded(fs, path, root, input, env));
+		yield* _(ensureOriginRemote(root, input.repoUrl, env));
+		yield* _(adoptRemoteHistoryIfOrphan(root, input.repoRef, env));
+		yield* _(checkoutBranchBestEffort(root, input.repoRef, env));
+		yield* _(ensureStateGitignore(fs, path, root));
+		yield* _(Effect.log(`State dir ready: ${root}`));
+		yield* _(Effect.log(`Remote: ${input.repoUrl}`));
+	}).pipe(Effect.asVoid);
+	const token = input.token?.trim() ?? "";
+	return token.length > 0 && isGithubHttpsRemote(input.repoUrl) ? withGithubAskpassEnv(token, doInit) : doInit(gitBaseEnv$1);
+};
 var stateStatus = Effect.gen(function* (_) {
 	const output = yield* _(gitCapture$1(resolveStateRoot(yield* _(Path.Path), process.cwd()), [
 		"status",
@@ -6266,6 +6349,87 @@ var authCodexStatus = (command) => withCodexAuth(command, ({ accountPath, cwd })
 }));
 var authCodexLogout = (command) => withCodexAuth(command, ({ accountPath, cwd }) => runCodexLogout(cwd, accountPath)).pipe(Effect.zipRight(autoSyncState(`chore(state): auth codex logout ${normalizeAccountLabel(command.label, "default")}`)));
 //#endregion
+//#region ../lib/src/usecases/state-repo-github.ts
+var dotDockerGitRepoName = ".docker-git";
+var defaultStateRef = "main";
+var resolveViewerLogin = (cwd, hostPath, token) => Effect.gen(function* (_) {
+	const raw = yield* _(runGhApiCapture(cwd, hostPath, token, [
+		"/user",
+		"--jq",
+		".login"
+	]));
+	if (raw.length === 0) return yield* _(Effect.fail(new CommandFailedError({
+		command: "gh api /user --jq .login",
+		exitCode: 1
+	})));
+	return raw;
+});
+var getRepoCloneUrl = (cwd, hostPath, token, login) => runGhApiNullable(cwd, hostPath, token, [
+	`/repos/${login}/${dotDockerGitRepoName}`,
+	"--jq",
+	".clone_url"
+]);
+var createStateRepo = (cwd, hostPath, token) => runGhApiNullable(cwd, hostPath, token, [
+	"-X",
+	"POST",
+	"/user/repos",
+	"-f",
+	`name=${dotDockerGitRepoName}`,
+	"-f",
+	"private=false",
+	"-f",
+	"auto_init=true",
+	"--jq",
+	".clone_url"
+]);
+/**
+* Ensures the .docker-git state repository exists on GitHub and is initialised locally.
+*
+* On GitHub auth, immediately:
+* 1. Resolve the authenticated user's login via the GitHub API
+* 2. Check whether `<login>/.docker-git` exists on GitHub
+* 3. If missing, create the repository (public, auto-initialised with a README)
+* 4. Initialise the local `~/.docker-git` directory as a clone of that repository
+*
+* All failures are swallowed and logged as warnings so they never abort the auth
+* flow itself.
+*
+* @param token - A valid GitHub personal-access or OAuth token
+* @returns Effect<void, never, GithubStateRepoRuntime>
+*
+* @pure false
+* @effect FileSystem, CommandExecutor (Docker gh CLI, git)
+* @invariant ∀token ∈ ValidTokens: ensureStateDotDockerGitRepo(token) → cloned(~/.docker-git) ∨ warned
+* @precondition token.length > 0
+* @postcondition ~/.docker-git is a git repo with origin pointing to github.com/<login>/.docker-git
+* @complexity O(1) API calls
+* @throws Never - all errors are caught and logged
+*/
+var ensureStateDotDockerGitRepo = (token) => withFsPathContext(({ cwd, fs, path }) => Effect.gen(function* (_) {
+	const ghRoot = resolvePathFromCwd(path, cwd, ghAuthRoot);
+	yield* _(fs.makeDirectory(ghRoot, { recursive: true }));
+	yield* _(ensureGhAuthImage(fs, path, cwd, "gh api"));
+	const login = yield* _(resolveViewerLogin(cwd, ghRoot, token));
+	let cloneUrl = yield* _(getRepoCloneUrl(cwd, ghRoot, token, login));
+	if (cloneUrl === null) {
+		yield* _(Effect.log(`Creating .docker-git repository for ${login}...`));
+		cloneUrl = yield* _(createStateRepo(cwd, ghRoot, token));
+	}
+	if (cloneUrl === null) {
+		yield* _(Effect.logWarning(`Could not resolve or create .docker-git repository for ${login}`));
+		return;
+	}
+	yield* _(Effect.log(`Initializing state repository: ${cloneUrl}`));
+	yield* _(stateInit({
+		repoUrl: cloneUrl,
+		repoRef: defaultStateRef,
+		token
+	}));
+})).pipe(Effect.matchEffect({
+	onFailure: (error) => Effect.logWarning(`State repo setup failed: ${error instanceof Error ? error.message : String(error)}`),
+	onSuccess: () => Effect.void
+}));
+//#endregion
 //#region ../lib/src/usecases/auth-github.ts
 var ensureGithubOrchLayout = (cwd, envGlobalPath) => migrateLegacyOrchLayout(cwd, {
 	envGlobalPath,
@@ -6363,6 +6527,7 @@ var runGithubInteractiveLogin = (cwd, fs, path, envPath, command) => Effect.gen(
 	const resolved = yield* _(resolveGithubTokenFromGh(cwd, accountPath));
 	yield* _(ensureEnvFile$1(fs, path, envPath));
 	yield* _(persistGithubToken(fs, envPath, buildGithubTokenKey(command.label), resolved));
+	return resolved;
 });
 var authGithubLogin = (command) => withFsPathContext(({ cwd, fs, path }) => Effect.gen(function* (_) {
 	yield* _(ensureGithubOrchLayout(cwd, command.envGlobalPath));
@@ -6373,10 +6538,11 @@ var authGithubLogin = (command) => withFsPathContext(({ cwd, fs, path }) => Effe
 	if (token.length > 0) {
 		yield* _(ensureEnvFile$1(fs, path, envPath));
 		yield* _(persistGithubToken(fs, envPath, key, token));
+		yield* _(ensureStateDotDockerGitRepo(token));
 		yield* _(autoSyncState(`chore(state): auth gh ${label}`));
 		return;
 	}
-	yield* _(runGithubInteractiveLogin(cwd, fs, path, envPath, command));
+	yield* _(ensureStateDotDockerGitRepo(yield* _(runGithubInteractiveLogin(cwd, fs, path, envPath, command))));
 	yield* _(autoSyncState(`chore(state): auth gh ${label}`));
 }));
 var authGithubStatus = (command) => withEnvContext(command.envGlobalPath, ({ current, envPath }) => Effect.gen(function* (_) {