@quatronic/qore 0.1.1 → 0.1.2

package/dist/cli.js

@@ -39,6 +39,11 @@ var EXIT = {
   QORE_RESOURCE_NOT_FOUND: 5,
   QORE_ACCESS_DENIED: 5,
   QORE_NO_DEVELOPER_ACCESS: 5,
+  QORE_GITHUB_NOT_LINKED: 5,
+  QORE_REPO_NO_ACCESS: 5,
+  QORE_REPO_ACCESS_PENDING: 5,
+  QORE_GIT_AUTH: 5,
+  QORE_WORKSPACE_CONFLICT: 2,
   QORE_AUTH_UNAVAILABLE: 6,
   QORE_AUTH_BUSY: 6,
   QORE_API_UNREACHABLE: 6,
@@ -125,7 +130,7 @@ function processIo(interactive) {
   };
 }
 function createWaitForEnter(input, output) {
-  return (message, signal) => new Promise((resolve3, reject) => {
+  return (message, signal) => new Promise((resolve5, reject) => {
     const rl = createInterface({ input, output, terminal: true });
     const onAbort = () => {
       rl.close();
@@ -134,7 +139,7 @@ function createWaitForEnter(input, output) {
     const done = () => {
       signal.removeEventListener("abort", onAbort);
       rl.close();
-      resolve3();
+      resolve5();
     };
     signal.addEventListener("abort", onAbort, { once: true });
     rl.on("SIGINT", () => {
@@ -150,8 +155,8 @@ function createWaitForEnter(input, output) {
 import { Command, CommanderError } from "commander";
 
 // src/core/api/http.ts
-function abortableFetch(fetch2, signal) {
-  return (input, init) => fetch2(input, { ...init, signal: init?.signal ? AbortSignal.any([init.signal, signal]) : signal });
+function abortableFetch(fetch3, signal) {
+  return (input, init) => fetch3(input, { ...init, signal: init?.signal ? AbortSignal.any([init.signal, signal]) : signal });
 }
 var TLS = /* @__PURE__ */ new Set([
   "SELF_SIGNED_CERT_IN_CHAIN",
@@ -197,12 +202,12 @@ var BY_SERVER_CODE = {
   "tenant.not_found": "QORE_RESOURCE_NOT_FOUND",
   "module.app_ambiguous": "QORE_APP_AMBIGUOUS"
 };
-function byStatus(status) {
-  if (status === 403) return "QORE_ACCESS_DENIED";
-  if (status === 404) return "QORE_RESOURCE_NOT_FOUND";
-  if (status === 426) return "QORE_UPGRADE_REQUIRED";
-  if (status === 429) return "QORE_RATE_LIMITED";
-  if (status === 502 || status === 503 || status === 504) return "QORE_API_UNAVAILABLE";
+function byStatus(status2) {
+  if (status2 === 403) return "QORE_ACCESS_DENIED";
+  if (status2 === 404) return "QORE_RESOURCE_NOT_FOUND";
+  if (status2 === 426) return "QORE_UPGRADE_REQUIRED";
+  if (status2 === 429) return "QORE_RATE_LIMITED";
+  if (status2 === 502 || status2 === 503 || status2 === 504) return "QORE_API_UNAVAILABLE";
   return "QORE_INTERNAL";
 }
 async function problemToError(res) {
@@ -269,7 +274,7 @@ function jsonFromArgv(argv2) {
   return argvBeforeSeparator(argv2).some((a) => a === "--json" || a.startsWith("--json="));
 }
 function requestLog(ctx) {
-  return ctx.opts().verbose ? (line) => ctx.io.err(line) : void 0;
+  return ctx.opts().verbose ? (line2) => ctx.io.err(line2) : void 0;
 }
 function buildProgram(deps2, io2, signal, register, setExitCode) {
   const program = new Command("qore").description("Qore developer CLI").option("--portal <name|url>", "prod, staging, or a portal URL (default: the portal you last logged in to, else prod)").option("--json", "print exactly one JSON document on stdout").option("--no-input", "never prompt").option("--verbose", "log request lines (never secrets)").option("--no-color", "disable colours").exitOverride().configureOutput({ writeOut: (s) => io2.out(s.trimEnd()), writeErr: (s) => io2.err(s.trimEnd()) });
@@ -301,55 +306,9 @@ async function run(argv2, deps2, io2, signal, register) {
   }
 }
 
-// src/cli/commands/env.ts
-import { randomBytes as randomBytes2 } from "crypto";
-import { chmod as chmod2, readFile as readFile3, realpath as realpath3, rename as rename2, unlink, writeFile as writeFile2 } from "fs/promises";
-import { basename as basename2, dirname as dirname3, join as join6, relative as relative2 } from "path";
-
-// src/core/context/repoConfig.ts
-import { readFile } from "fs/promises";
-import { join } from "path";
-var FORBIDDEN = ["portal", "api", "apiOrigin", "issuer", "tenant", "tenantId", "app", "appId", "module", "moduleId"];
-var KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var invalid = (msg, details) => new QoreError("QORE_CONTEXT_INVALID", `.qore.json: ${msg}`, { hint: "Fix .qore.json in the repository root; see the $schema it names.", details });
-function moduleDefaults(type) {
-  return type === "frontend" ? { envFile: ".env.local", localSecrets: ["SESSION_COOKIE_SECRET"] } : { envFile: ".env", localSecrets: [] };
-}
-async function readRepoConfig(root) {
-  let raw;
-  try {
-    raw = await readFile(join(root, ".qore.json"), "utf8");
-  } catch (e) {
-    if (e.code === "ENOENT") return {};
-    throw e;
-  }
-  let doc;
-  try {
-    doc = JSON.parse(raw);
-  } catch {
-    throw invalid("not valid JSON");
-  }
-  if (!doc || typeof doc !== "object" || Array.isArray(doc)) throw invalid("must be an object");
-  const v = doc.schemaVersion === void 0 ? 1 : doc.schemaVersion;
-  if (!Number.isInteger(v) || v < 1) throw invalid("schemaVersion must be a positive integer");
-  if (v > 1) {
-    throw new QoreError("QORE_CONTEXT_UNSUPPORTED", `.qore.json schemaVersion ${v} is newer than this qore`, { hint: "Run: npm i -g @quatronic/qore" });
-  }
-  for (const f of FORBIDDEN) if (f in doc) throw invalid(`"${f}" is not allowed \u2014 .qore.json never selects a portal or a resource`, { field: f });
-  const out = {};
-  if (doc.envFile !== void 0) {
-    if (typeof doc.envFile !== "string" || !doc.envFile) throw invalid("envFile must be a non-empty string");
-    out.envFile = doc.envFile;
-  }
-  if (doc.localSecrets !== void 0) {
-    if (!Array.isArray(doc.localSecrets) || !doc.localSecrets.every((k) => typeof k === "string" && KEY.test(k))) {
-      throw invalid("localSecrets must be a list of env key names");
-    }
-    if (new Set(doc.localSecrets).size !== doc.localSecrets.length) throw invalid("localSecrets must not contain duplicates");
-    out.localSecrets = doc.localSecrets;
-  }
-  return out;
-}
+// src/cli/commands/clone.ts
+import { join as join6, relative as relative2, resolve as resolve2 } from "path";
+import { Option } from "commander";
 
 // src/core/api/meta.ts
 var SUPPORTED = ["v1"];
@@ -365,10 +324,10 @@ function compareVersions(a, b) {
   if (!pa[4] && pb[4]) return 1;
   return 0;
 }
-async function fetchMeta(fetch2, apiOrigin) {
+async function fetchMeta(fetch3, apiOrigin) {
   let res;
   try {
-    res = await fetch2(`${apiOrigin}/api/cli/meta`, { headers: { accept: "application/json" } });
+    res = await fetch3(`${apiOrigin}/api/cli/meta`, { headers: { accept: "application/json" } });
   } catch (e) {
     throw fetchError(e, new URL(apiOrigin).host);
   }
@@ -436,44 +395,6 @@ function requireCapability(meta, capability, apiOrigin) {
   });
 }
 
-// src/core/context/resolver.ts
-import { join as join5 } from "path";
-
-// src/core/auth/tokenStore.ts
-var TokenStore = class {
-  constructor(kc, hash) {
-    this.kc = kc;
-    this.hash = hash;
-  }
-  kc;
-  hash;
-  async read(suffix) {
-    const raw = await this.kc.get(`${this.hash}:${suffix}`);
-    if (raw === null) return null;
-    try {
-      return JSON.parse(raw);
-    } catch {
-      return null;
-    }
-  }
-  getRefresh() {
-    return this.read("refresh");
-  }
-  getAccess() {
-    return this.read("access");
-  }
-  setRefresh(v) {
-    return this.kc.set(`${this.hash}:refresh`, JSON.stringify(v));
-  }
-  setAccess(v) {
-    return this.kc.set(`${this.hash}:access`, JSON.stringify(v));
-  }
-  async clear() {
-    await this.kc.delete(`${this.hash}:access`);
-    await this.kc.delete(`${this.hash}:refresh`);
-  }
-};
-
 // src/core/profiles.ts
 import { createHash } from "crypto";
 var BUILTIN_PORTALS = {
@@ -623,6 +544,41 @@ var RefreshCoordinator = class {
   }
 };
 
+// src/core/auth/tokenStore.ts
+var TokenStore = class {
+  constructor(kc, hash) {
+    this.kc = kc;
+    this.hash = hash;
+  }
+  kc;
+  hash;
+  async read(suffix) {
+    const raw = await this.kc.get(`${this.hash}:${suffix}`);
+    if (raw === null) return null;
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return null;
+    }
+  }
+  getRefresh() {
+    return this.read("refresh");
+  }
+  getAccess() {
+    return this.read("access");
+  }
+  setRefresh(v) {
+    return this.kc.set(`${this.hash}:refresh`, JSON.stringify(v));
+  }
+  setAccess(v) {
+    return this.kc.set(`${this.hash}:access`, JSON.stringify(v));
+  }
+  async clear() {
+    await this.kc.delete(`${this.hash}:access`);
+    await this.kc.delete(`${this.hash}:refresh`);
+  }
+};
+
 // src/core/session.ts
 function loginHint(portal) {
   return portal.builtin === "prod" ? "Run `qore login`." : `Run \`qore login --portal ${portal.builtin ?? portal.apiOrigin}\`.`;
@@ -646,17 +602,74 @@ async function openSession(deps2, portal, command, onRequest) {
   return { profile, api, tokens, refresh };
 }
 
+// src/core/workspace/apps.ts
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var tenantCandidates = (tenants) => tenants.map((t) => ({ kind: "tenant", id: t.id, slug: t.slug, name: t.name }));
+async function resolveAppRef(deps2, session, arg, tenantFlag) {
+  if (UUID.test(arg)) return { appId: arg, tenant: null };
+  const me = await session.api.get("/api/cli/v1/me");
+  let tenant;
+  if (tenantFlag) {
+    const found = me.tenants.find((t) => t.slug === tenantFlag);
+    if (!found) {
+      throw new QoreError("QORE_RESOURCE_NOT_FOUND", `No tenant "${tenantFlag}" for this account`, {
+        candidates: tenantCandidates(me.tenants)
+      });
+    }
+    tenant = { id: found.id, slug: found.slug };
+  } else if (session.profile.activeTenant) {
+    const active = session.profile.activeTenant;
+    const found = me.tenants.find((t) => t.id === active.id);
+    if (!found) {
+      throw new QoreError("QORE_TENANT_ACCESS_LOST", `You no longer have developer access to ${active.slug}`, {
+        hint: "Run `qore tenant use <slug>`.",
+        candidates: tenantCandidates(me.tenants)
+      });
+    }
+    tenant = { id: found.id, slug: found.slug };
+  } else if (me.tenants.length === 1) {
+    tenant = { id: me.tenants[0].id, slug: me.tenants[0].slug };
+  } else {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `Which tenant is "${arg}" in?`, {
+      hint: "Run `qore tenant use <slug>`, or pass --tenant <slug>.",
+      candidates: tenantCandidates(me.tenants)
+    });
+  }
+  try {
+    const { id } = await session.api.get(
+      `/api/cli/v1/tenants/${encodeURIComponent(tenant.id)}/apps/resolve?slug=${encodeURIComponent(arg)}`
+    );
+    return { appId: id, tenant };
+  } catch (e) {
+    if (e instanceof QoreError && e.code === "QORE_RESOURCE_NOT_FOUND" && !e.hint) {
+      throw new QoreError(e.code, e.message, {
+        hint: "Check the slug; `qore whoami` lists the apps you can see.",
+        status: e.status,
+        requestId: e.requestId,
+        candidates: e.candidates,
+        serverCode: e.serverCode,
+        details: e.details,
+        cause: e.cause
+      });
+    }
+    throw e;
+  }
+}
+
+// src/core/workspace/apply.ts
+import { join as join4, relative } from "path";
+
 // src/core/context/cache.ts
-import { join as join3 } from "path";
+import { join as join2 } from "path";
 
 // src/core/jsonFile.ts
-import { chmod, mkdir, readFile as readFile2, rename, writeFile } from "fs/promises";
-import { join as join2 } from "path";
+import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { join } from "path";
 import { randomBytes } from "crypto";
 async function readJson(file) {
   let raw;
   try {
-    raw = await readFile2(file, "utf8");
+    raw = await readFile(file, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw e;
@@ -665,10 +678,10 @@ async function readJson(file) {
 }
 async function writeJsonAtomic(dir2, name, data) {
   await mkdir(dir2, { recursive: true, mode: 448 });
-  const tmp = join2(dir2, `.${name}.${randomBytes(6).toString("hex")}.tmp`);
+  const tmp = join(dir2, `.${name}.${randomBytes(6).toString("hex")}.tmp`);
   await writeFile(tmp, JSON.stringify(data, null, 2) + "\n", { mode: 384 });
   await chmod(tmp, 384);
-  await rename(tmp, join2(dir2, name));
+  await rename(tmp, join(dir2, name));
 }
 
 // src/core/context/cache.ts
@@ -682,7 +695,7 @@ var ResolutionCache = class {
   now;
   async load() {
     try {
-      const f = await readJson(join3(this.dir, "repos.json"));
+      const f = await readJson(join2(this.dir, "repos.json"));
       if (f && f.schemaVersion === 1 && typeof f.entries === "object" && f.entries) return f;
     } catch {
     }
@@ -765,25 +778,589 @@ function repoKey(url) {
   return `${host.toLowerCase()}/${owner.toLowerCase()}/${repo.toLowerCase()}`;
 }
 
+// src/core/trust.ts
+import { realpath } from "fs/promises";
+function trustKey(root, platform) {
+  return platform === "win32" ? root.toLowerCase() : root;
+}
+async function keyOf(deps2, root) {
+  let real = root;
+  try {
+    real = await realpath(root);
+  } catch (e) {
+    if (e.code !== "ENOENT") throw e;
+  }
+  return trustKey(real, deps2.platform);
+}
+async function isTrusted(deps2, root, moduleId) {
+  const cfg = await deps2.config.read();
+  return (cfg.trustedRepos?.[await keyOf(deps2, root)] ?? []).includes(moduleId);
+}
+async function trust(deps2, root, moduleId) {
+  const key = await keyOf(deps2, root);
+  await deps2.config.update((c) => {
+    const repos = c.trustedRepos ??= {};
+    const list = new Set(repos[key] ?? []);
+    list.add(moduleId);
+    repos[key] = [...list];
+  });
+}
+
+// src/core/workspace/plan.ts
+import { join as join3 } from "path";
+var SEGMENT = /^[A-Za-z0-9_.-]+$/;
+function isSupportedRepoUrl(repoUrl) {
+  let u;
+  try {
+    u = new URL(repoUrl);
+  } catch {
+    return false;
+  }
+  if (u.protocol !== "https:" || !u.hostname || u.hostname.startsWith("-")) return false;
+  if (u.username || u.password || u.search || u.hash) return false;
+  const segments = u.pathname.replace(/\/+$/, "").split("/").slice(1);
+  return segments.length === 2 && segments.every((s) => SEGMENT.test(s) && !s.startsWith("-") && s !== "." && s !== "..");
+}
+function unsupportedRepoUrlError(slug, repoUrl) {
+  return new QoreError("QORE_INTERNAL", `${slug}: unsupported repository URL ${JSON.stringify(repoUrl)}`, {
+    hint: "This looks like a portal bug \u2014 please report it."
+  });
+}
+function cloneUrl(repoUrl, protocol) {
+  if (!isSupportedRepoUrl(repoUrl)) throw unsupportedRepoUrlError("module", repoUrl);
+  if (protocol === "https") return repoUrl;
+  const u = new URL(repoUrl);
+  return `git@${u.hostname}:${u.pathname.replace(/^\/+/, "").replace(/\/+$/, "").replace(/\.git$/, "")}.git`;
+}
+function planWorkspace(root, modules, dirs, strayRepos2) {
+  const actions = modules.map((module) => {
+    const dir2 = join3(root, module.slug);
+    if (!module.repoUrl) return { module, dir: dir2, kind: "no-repo", reason: "no repository yet" };
+    if (!isSupportedRepoUrl(module.repoUrl)) return { module, dir: dir2, kind: "unsupported", reason: "unsupported repository URL" };
+    const info = dirs[module.slug] ?? { exists: false, empty: false, isRepo: false, remotes: [] };
+    if (!info.exists || info.empty) return { module, dir: dir2, kind: "clone" };
+    if (!info.isRepo) return { module, dir: dir2, kind: "conflict", reason: "not a git repository" };
+    const want = repoKey(module.repoUrl);
+    const origin = info.remotes.find((r) => r.name === "origin");
+    if (want !== null && origin && repoKey(origin.url) === want) return { module, dir: dir2, kind: "present" };
+    return { module, dir: dir2, kind: "conflict", reason: `re-pointed: ${origin?.url ?? "no origin remote"}`, origin: origin?.url ?? null };
+  });
+  const slugs = new Set(modules.map((m) => m.slug));
+  return { actions, removed: strayRepos2.filter((s) => !slugs.has(s)) };
+}
+
+// src/core/workspace/diagnose.ts
+var ACCESS_CODES = /* @__PURE__ */ new Set(["QORE_GITHUB_NOT_LINKED", "QORE_REPO_NO_ACCESS", "QORE_REPO_ACCESS_PENDING"]);
+var lastLines = (s, n) => s.split(/\r?\n/).map((l) => l.trim()).filter(Boolean).slice(-n);
+function classifyCloneFailure(stderr, m, app, protocol) {
+  const url = isSupportedRepoUrl(m.repoUrl) ? cloneUrl(m.repoUrl, protocol) : m.repoUrl;
+  const details = { module: m.slug, protocol, url };
+  if (/SAML SSO|single sign-on/i.test(stderr)) {
+    const link = /https:\/\/\S+/.exec(stderr)?.[0];
+    return new QoreError("QORE_GIT_AUTH", `GitHub wants SSO authorisation for ${m.slug}`, {
+      hint: `Authorise your ${protocol === "ssh" ? "SSH key" : "token"} for the organisation${link ? `: ${link}` : ""}.`,
+      details: { ...details, reason: "sso" }
+    });
+  }
+  if (/Host key verification failed/.test(stderr)) {
+    const host = /\bfor ([\w.-]+) and you have requested strict checking/.exec(stderr)?.[1] ?? "github.com";
+    return new QoreError("QORE_GIT_AUTH", `ssh could not verify ${host}'s host key (${m.slug})`, {
+      hint: `Run \`ssh -T git@${host}\` once to accept its host key (or to see why it changed), then run \`qore sync\`.`,
+      details: { ...details, protocol: "ssh", reason: "host-key" }
+    });
+  }
+  if (/Permission denied \(publickey\)/.test(stderr)) {
+    return new QoreError("QORE_GIT_AUTH", `GitHub refused your SSH key for ${m.slug}`, {
+      hint: "Check with `ssh -T git@github.com`, or clone over https: `--protocol https` after `gh auth login`.",
+      details: { ...details, protocol: "ssh" }
+    });
+  }
+  if (/could not read Username|Authentication failed|Invalid username or (password|token)/i.test(stderr)) {
+    return new QoreError("QORE_GIT_AUTH", `git has no GitHub credentials for ${m.slug}`, {
+      hint: "`gh auth login` sets up git credentials; or use `--protocol ssh`.",
+      details: { ...details, protocol: "https" }
+    });
+  }
+  if (/Repository not found|repository '.*' not found/i.test(stderr)) {
+    if (!m.githubLinked) {
+      return new QoreError("QORE_GITHUB_NOT_LINKED", `Your GitHub account is not linked in Qore (${m.slug})`, {
+        hint: `Link your GitHub account at ${app.accountUrl}, then run \`qore sync\`.`,
+        details
+      });
+    }
+    if (m.repoAccess === "none") {
+      const filtered = m.devTeamIds?.length ? app.devTeams.filter((t) => m.devTeamIds.includes(t.id)) : [];
+      const moduleTeams = filtered.length ? filtered : app.devTeams;
+      const teams = moduleTeams.map((t) => `"${t.name}"`).join(" or ");
+      const emails = [...new Set(moduleTeams.flatMap((t) => t.maintainers))].join(", ");
+      return new QoreError("QORE_REPO_NO_ACCESS", `No repository access to ${m.slug}`, {
+        hint: teams ? `Ask a maintainer of dev team ${teams} for a seat${emails ? `: ${emails}` : ""}.` : `Ask your tenant owner which dev team builds ${m.slug}.`,
+        details: { ...details, devTeams: moduleTeams.map((t) => t.name) }
+      });
+    }
+    const owner = repoKey(m.repoUrl)?.split("/")[1];
+    const invitation = owner ? ` https://github.com/orgs/${owner}/invitation` : "";
+    return new QoreError("QORE_REPO_ACCESS_PENDING", `GitHub does not grant ${m.slug} yet`, {
+      hint: `Access was granted recently, or your invitation to the GitHub organisation is not accepted yet:${invitation} \u2014 then retry in a minute.`,
+      details
+    });
+  }
+  return new QoreError("QORE_INTERNAL", `Cloning ${m.slug} failed`, {
+    hint: [...lastLines(stderr, 3), `\`git clone ${url}\``].join("\n"),
+    details
+  });
+}
+function classifyPullFailure(stderr) {
+  if (/Not possible to fast-forward/i.test(stderr)) return "diverged";
+  return lastLines(stderr, 1)[0] ?? "pull failed";
+}
+
+// src/core/workspace/apply.ts
+function toFailure(slug, e) {
+  if (e instanceof QoreError && e.code !== "QORE_GIT_UNAVAILABLE") {
+    return { slug, status: "failed", error: { code: e.code, message: e.message, hint: e.hint } };
+  }
+  throw e;
+}
+function conflictResult(deps2, action) {
+  const dir2 = relative(deps2.cwd, action.dir) || ".";
+  const what = action.reason === "not a git repository" ? "it is not a git repository" : action.origin ? `its origin is ${action.origin}, not ${action.module.repoUrl}` : "it has no origin remote";
+  const message = action.reason === "not a git repository" ? `${dir2} is not a git repository` : action.origin ? `${dir2} holds another repository (its origin is ${action.origin}, not ${action.module.repoUrl})` : `${dir2} has no origin remote`;
+  return {
+    slug: action.module.slug,
+    status: "conflict",
+    reason: action.reason,
+    error: { code: "QORE_WORKSPACE_CONFLICT", message, hint: `Move ${dir2} aside (${what}), then run \`qore sync\`.` }
+  };
+}
+async function applyActions(deps2, o) {
+  const cache = new ResolutionCache(join4(deps2.config.dir, "cache"), deps2.now);
+  const results = [];
+  for (const action of o.actions) {
+    let result;
+    switch (action.kind) {
+      case "present":
+        result = { slug: action.module.slug, status: "present" };
+        break;
+      case "conflict":
+        result = conflictResult(deps2, action);
+        break;
+      case "unsupported": {
+        const e = unsupportedRepoUrlError(action.module.slug, action.module.repoUrl ?? "");
+        result = { slug: action.module.slug, status: "failed", reason: action.reason, error: { code: e.code, message: e.message, hint: e.hint } };
+        break;
+      }
+      case "no-repo":
+        result = { slug: action.module.slug, status: "no-repo", reason: action.reason };
+        break;
+      case "clone": {
+        try {
+          const url = cloneUrl(action.module.repoUrl, o.protocol);
+          const r = await deps2.git.clone(url, action.dir);
+          if (r.ok) {
+            await trust(deps2, action.dir, action.module.id);
+            const key = repoKey(action.module.repoUrl);
+            if (key) await cache.put(o.portal.apiOrigin, key, action.module.id);
+            result = { slug: action.module.slug, status: "cloned", dir: action.dir };
+          } else {
+            const err = classifyCloneFailure(r.stderr, action.module, o.app, o.protocol);
+            result = { slug: action.module.slug, status: "failed", error: { code: err.code, message: err.message, hint: err.hint } };
+          }
+        } catch (e) {
+          result = toFailure(action.module.slug, e);
+        }
+        break;
+      }
+    }
+    results.push(result);
+    o.onResult(result);
+  }
+  return results;
+}
+async function syncPresent(deps2, results, actions, pull, ctx) {
+  const bySlug = new Map(actions.map((a) => [a.module.slug, a]));
+  for (const result of results) {
+    if (result.status !== "present") continue;
+    const action = bySlug.get(result.slug);
+    if (!action) continue;
+    let fetchRes;
+    try {
+      fetchRes = await deps2.git.fetch(action.dir);
+    } catch (e) {
+      Object.assign(result, toFailure(result.slug, e));
+      continue;
+    }
+    if (!fetchRes.ok) {
+      const err = classifyCloneFailure(fetchRes.stderr, action.module, ctx.app, ctx.protocol);
+      result.status = "failed";
+      result.error = { code: err.code, message: err.message, hint: err.hint };
+      continue;
+    }
+    result.status = "fetched";
+    if (!pull) continue;
+    let st;
+    try {
+      st = await deps2.git.status(action.dir);
+    } catch (e) {
+      Object.assign(result, toFailure(result.slug, e));
+      continue;
+    }
+    if (!st.ok) {
+      result.status = "skipped";
+      result.reason = classifyPullFailure(st.stderr);
+      continue;
+    }
+    if (st.dirty) {
+      result.status = "skipped";
+      result.reason = "uncommitted changes";
+      continue;
+    }
+    if (!st.upstream) {
+      result.status = "skipped";
+      result.reason = "no upstream branch";
+      continue;
+    }
+    let pullRes;
+    try {
+      pullRes = await deps2.git.pullFfOnly(action.dir);
+    } catch (e) {
+      Object.assign(result, toFailure(result.slug, e));
+      continue;
+    }
+    if (!pullRes.ok) {
+      result.status = "skipped";
+      result.reason = classifyPullFailure(pullRes.stderr);
+      continue;
+    }
+    result.status = "pulled";
+  }
+}
+
+// src/core/workspace/file.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { mkdir as mkdir2, readFile as readFile2, rename as rename2, rm, writeFile as writeFile2 } from "fs/promises";
+import { dirname, join as join5, resolve } from "path";
+var WORKSPACE_FILE = "qore.workspace.json";
+var UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var invalid = (file, msg) => new QoreError("QORE_CONTEXT_INVALID", `${file}: ${msg}`, { hint: "Fix or delete the file; `qore clone <app>` writes a fresh one." });
+async function readAt(dir2) {
+  const file = join5(dir2, WORKSPACE_FILE);
+  let raw;
+  try {
+    raw = await readFile2(file, "utf8");
+  } catch (e) {
+    const code = e.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return null;
+    throw new QoreError("QORE_CONTEXT_INVALID", `${file}: cannot be read (${code ?? "unknown error"})`, {
+      hint: "Fix its permissions, or remove it; `qore clone <app>` writes a fresh one.",
+      cause: e
+    });
+  }
+  let doc;
+  try {
+    doc = JSON.parse(raw);
+  } catch {
+    throw invalid(file, "not valid JSON");
+  }
+  const v = doc?.schemaVersion;
+  if (!Number.isInteger(v) || v < 1) throw invalid(file, "schemaVersion must be a positive integer");
+  if (v > 1) throw new QoreError("QORE_CONTEXT_UNSUPPORTED", `${file} is newer than this qore`, { hint: "Run: npm i -g @quatronic/qore" });
+  if (typeof doc.portal !== "string" || !/^https?:\/\//.test(doc.portal)) throw invalid(file, "portal must be a portal URL");
+  if (typeof doc.appId !== "string" || !UUID2.test(doc.appId)) throw invalid(file, "appId must be an app id");
+  return { root: dir2, portal: new URL(doc.portal).origin.toLowerCase(), appId: doc.appId };
+}
+async function readWorkspace(dir2) {
+  return readAt(dir2);
+}
+async function findWorkspace(start, home) {
+  let dir2 = resolve(start);
+  const stop = resolve(home);
+  for (; ; ) {
+    const ws = await readAt(dir2);
+    if (ws) return ws;
+    const up = dirname(dir2);
+    if (dir2 === stop || up === dir2) return null;
+    dir2 = up;
+  }
+}
+async function writeWorkspace(root, o) {
+  await mkdir2(root, { recursive: true });
+  const tmp = join5(root, `.${WORKSPACE_FILE}.${randomBytes2(6).toString("hex")}.tmp`);
+  try {
+    await writeFile2(tmp, JSON.stringify({ schemaVersion: 1, portal: o.portal, appId: o.appId }, null, 2) + "\n", { mode: 438 });
+    await rename2(tmp, join5(root, WORKSPACE_FILE));
+  } catch (e) {
+    await rm(tmp, { force: true }).catch(() => {
+    });
+    throw new QoreError("QORE_INTERNAL", `could not write ${join5(root, WORKSPACE_FILE)}`, { cause: e });
+  }
+}
+async function workspacePortal(deps2, ws) {
+  const portal = resolvePortal(ws.portal, void 0);
+  const label2 = portal.builtin ?? portal.apiOrigin;
+  const profile = (await deps2.config.read()).profiles[portal.apiOrigin];
+  const loggedIn = profile && await new TokenStore(deps2.keychain, profileHash(profile.apiOrigin, profile.issuer)).getRefresh();
+  if (!loggedIn) {
+    throw new QoreError("QORE_NOT_LOGGED_IN", `This workspace belongs to ${label2}, which you are not logged in to`, {
+      hint: `Run \`qore login --portal ${label2}\`.`
+    });
+  }
+  return portal;
+}
+
+// src/core/workspace/safety.ts
+var SAFE_SEGMENT = /^[a-z0-9][a-z0-9-]*$/;
+var WINDOWS_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/;
+function isSafeSlug(slug) {
+  return SAFE_SEGMENT.test(slug) && !WINDOWS_RESERVED.test(slug);
+}
+function unsafeSlugError(slug) {
+  return new QoreError("QORE_INTERNAL", `"${slug}" is not a safe directory name`, {
+    hint: "This looks like a portal bug \u2014 please report it."
+  });
+}
+
+// src/cli/workspaceReport.ts
+function exitFor(results) {
+  const failures = results.filter((r) => r.status === "failed" || r.status === "conflict");
+  if (failures.length === 0) return null;
+  const ok = results.some((r) => ["cloned", "present", "fetched", "pulled", "skipped"].includes(r.status));
+  const code = (r) => r.status === "conflict" ? "QORE_WORKSPACE_CONFLICT" : r.error?.code ?? "QORE_INTERNAL";
+  const nonAccess = failures.find((r) => !ACCESS_CODES.has(code(r)));
+  if (ok && !nonAccess) return null;
+  const first = nonAccess ?? failures[0];
+  const moduleCount = results.filter((r) => r.status !== "removed").length;
+  return new QoreError(code(first), `${failures.length} of ${moduleCount} modules need attention`, {
+    hint: first.error?.hint,
+    details: { results }
+  });
+}
+var FAILURE_LABELS = {
+  QORE_GITHUB_NOT_LINKED: "GitHub not linked",
+  QORE_REPO_NO_ACCESS: "no repository access",
+  QORE_REPO_ACCESS_PENDING: "access pending",
+  QORE_GIT_AUTH: "git authentication"
+};
+function firstSentenceLower(hint) {
+  if (!hint) return "";
+  let sentence = hint;
+  const re = /\. (?=\S)/g;
+  let m;
+  while (m = re.exec(hint)) {
+    const before = hint.slice(0, m.index);
+    const backtickCount = (before.match(/`/g) ?? []).length;
+    if (backtickCount % 2 === 0) {
+      sentence = hint.slice(0, m.index + 1);
+      break;
+    }
+  }
+  sentence = sentence.trim();
+  return sentence.length ? sentence[0].toLowerCase() + sentence.slice(1) : sentence;
+}
+function failedLine(r) {
+  const label2 = FAILURE_LABELS[r.error?.code ?? ""] ?? "failed";
+  const detail2 = firstSentenceLower(r.error?.hint);
+  return `\u2717 ${r.slug}   ${label2}${detail2 ? ` \u2014 ${detail2}` : ""}`;
+}
+function line(r, conflictCount) {
+  switch (r.status) {
+    case "cloned":
+      return `\u2713 ${r.slug}   cloned${r.dir ? `  \u2192 ${r.dir}` : ""}`;
+    case "pulled":
+      return `\u2713 ${r.slug}   pulled`;
+    case "present":
+      return `  ${r.slug}   present`;
+    case "skipped":
+      return `! ${r.slug}   skipped \u2014 ${r.reason}`;
+    case "no-repo":
+      return `  ${r.slug}   ${r.reason ?? "no repository yet"}`;
+    case "removed":
+      return `! ${r.slug}   not a module of this app \u2014 left in place`;
+    case "conflict": {
+      const detail2 = conflictCount > 1 ? firstSentenceLower(r.error?.hint) : "";
+      return `\u2717 ${r.slug}   ${r.reason ?? "conflict"}${detail2 ? ` \u2014 ${detail2}` : ""}`;
+    }
+    case "failed":
+      return failedLine(r);
+    case "fetched":
+      return `  ${r.slug}   fetched`;
+  }
+}
+function renderResults(io2, results, json2) {
+  if (json2) {
+    renderJson(io2, { results });
+    return;
+  }
+  const conflictCount = results.filter((r) => r.status === "conflict").length;
+  let i = 0;
+  while (i < results.length) {
+    const r = results[i];
+    if (r.status === "fetched" || r.status === "pulled") {
+      const group = [r];
+      let j = i + 1;
+      while (j < results.length && results[j].status === r.status) {
+        group.push(results[j]);
+        j++;
+      }
+      io2.out(`  ${group.map((g) => g.slug).join(", ")}   ${r.status}`);
+      i = j;
+      continue;
+    }
+    io2.out(line(r, conflictCount));
+    i++;
+  }
+}
+function reportWorkspaceRun(io2, results, json2) {
+  const err = exitFor(results);
+  if (!err || !json2) renderResults(io2, results, json2);
+  return err;
+}
+
+// src/cli/commands/clone.ts
+function asFailure(slug, e) {
+  if (e instanceof QoreError && e.code !== "QORE_GIT_UNAVAILABLE") {
+    return { slug, status: "failed", error: { code: e.code, message: e.message, hint: e.hint } };
+  }
+  throw e;
+}
+async function resolveApp(deps2, io2, session, appArg, tenantFlag) {
+  try {
+    return await resolveAppRef(deps2, session, appArg, tenantFlag);
+  } catch (e) {
+    if (!(e instanceof QoreError) || e.code !== "QORE_CONTEXT_REQUIRED" && e.code !== "QORE_TENANT_ACCESS_LOST") throw e;
+    if (!io2.interactive || !e.candidates?.length) throw e;
+    const slug = await io2.select("Select a tenant", e.candidates.map((c) => ({ name: c.name ?? c.slug, value: c.slug })));
+    return resolveAppRef(deps2, session, appArg, slug);
+  }
+}
+function registerClone(program, ctx) {
+  program.command("clone").description("Clone an app's modules into a new workspace directory").argument("<app>", "app slug or id").argument("[dir]", "target directory (default: the app's slug)").option("--tenant <slug>", "tenant the app slug belongs to, when it is not your active one").addOption(new Option("--protocol <https|ssh>", "clone URL protocol").choices(["https", "ssh"]).default("https")).action(async (appArg, dirArg, flags) => {
+    const { deps: deps2, io: io2 } = ctx;
+    const g = ctx.opts();
+    const cfg = await deps2.config.read();
+    const portal = resolvePortal(g.portal, cfg.defaultProfile);
+    const onRequest = g.verbose ? (l) => io2.err(l) : void 0;
+    const session = await openSession(deps2, portal, "clone", onRequest);
+    await ensureCapability(deps2, portal.apiOrigin, "app.modules");
+    const ref = await resolveApp(deps2, io2, session, appArg, flags.tenant);
+    const app = await session.api.get(`/api/cli/v1/apps/${encodeURIComponent(ref.appId)}/modules`);
+    if (dirArg === void 0 && !isSafeSlug(app.app.slug)) throw unsafeSlugError(app.app.slug);
+    const dirLabel = dirArg ?? app.app.slug;
+    const root = resolve2(deps2.cwd, dirLabel);
+    const info = await deps2.git.inspect(root);
+    if (info.exists && !info.empty) {
+      const ws = await readWorkspace(root);
+      if (!ws || ws.appId !== app.app.id || ws.portal !== portal.apiOrigin) {
+        throw new QoreError("QORE_WORKSPACE_CONFLICT", `${root} exists and is not the workspace of ${app.app.slug}`, {
+          hint: `Pick another directory: qore clone ${appArg} <dir>.`
+        });
+      }
+    }
+    await writeWorkspace(root, { portal: portal.apiOrigin, appId: app.app.id });
+    const dirs = {};
+    const modulesForPlan = [];
+    const earlyFailures = [];
+    for (const m of app.modules) {
+      if (!isSafeSlug(m.slug)) {
+        earlyFailures.push(asFailure(m.slug, unsafeSlugError(m.slug)));
+        continue;
+      }
+      try {
+        dirs[m.slug] = await deps2.git.inspect(join6(root, m.slug));
+        modulesForPlan.push(m);
+      } catch (e) {
+        earlyFailures.push(asFailure(m.slug, e));
+      }
+    }
+    const { actions } = planWorkspace(root, modulesForPlan, dirs, []);
+    const applied = await applyActions(deps2, { portal, app, actions, protocol: flags.protocol, onResult: () => {
+    } });
+    for (const r of applied) {
+      if (r.status === "cloned" && r.dir) r.dir = relative2(deps2.cwd, r.dir) || ".";
+    }
+    const results = [...earlyFailures, ...applied];
+    const err = reportWorkspaceRun(io2, results, Boolean(g.json));
+    if (!g.json) {
+      io2.out(`\u2713 Wrote ${join6(dirLabel, "qore.workspace.json")}`);
+      const first = results.find((r) => r.status === "cloned" || r.status === "present");
+      if (first && !err) io2.out(`Next: cd ${join6(dirLabel, first.slug)} && qore env pull`);
+    }
+    if (err) throw err;
+  });
+}
+
+// src/cli/commands/env.ts
+import { randomBytes as randomBytes3 } from "crypto";
+import { chmod as chmod2, readFile as readFile4, realpath as realpath3, rename as rename3, unlink, writeFile as writeFile3 } from "fs/promises";
+import { basename as basename2, dirname as dirname4, join as join10, relative as relative5 } from "path";
+
+// src/core/context/repoConfig.ts
+import { readFile as readFile3 } from "fs/promises";
+import { join as join7 } from "path";
+var FORBIDDEN = ["portal", "api", "apiOrigin", "issuer", "tenant", "tenantId", "app", "appId", "module", "moduleId"];
+var KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var invalid2 = (msg, details) => new QoreError("QORE_CONTEXT_INVALID", `.qore.json: ${msg}`, { hint: "Fix .qore.json in the repository root; see the $schema it names.", details });
+function moduleDefaults(type) {
+  return type === "frontend" ? { envFile: ".env.local", localSecrets: ["SESSION_COOKIE_SECRET"] } : { envFile: ".env", localSecrets: [] };
+}
+async function readRepoConfig(root) {
+  let raw;
+  try {
+    raw = await readFile3(join7(root, ".qore.json"), "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return {};
+    throw e;
+  }
+  let doc;
+  try {
+    doc = JSON.parse(raw);
+  } catch {
+    throw invalid2("not valid JSON");
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) throw invalid2("must be an object");
+  const v = doc.schemaVersion === void 0 ? 1 : doc.schemaVersion;
+  if (!Number.isInteger(v) || v < 1) throw invalid2("schemaVersion must be a positive integer");
+  if (v > 1) {
+    throw new QoreError("QORE_CONTEXT_UNSUPPORTED", `.qore.json schemaVersion ${v} is newer than this qore`, { hint: "Run: npm i -g @quatronic/qore" });
+  }
+  for (const f of FORBIDDEN) if (f in doc) throw invalid2(`"${f}" is not allowed \u2014 .qore.json never selects a portal or a resource`, { field: f });
+  const out = {};
+  if (doc.envFile !== void 0) {
+    if (typeof doc.envFile !== "string" || !doc.envFile) throw invalid2("envFile must be a non-empty string");
+    out.envFile = doc.envFile;
+  }
+  if (doc.localSecrets !== void 0) {
+    if (!Array.isArray(doc.localSecrets) || !doc.localSecrets.every((k) => typeof k === "string" && KEY.test(k))) {
+      throw invalid2("localSecrets must be a list of env key names");
+    }
+    if (new Set(doc.localSecrets).size !== doc.localSecrets.length) throw invalid2("localSecrets must not contain duplicates");
+    out.localSecrets = doc.localSecrets;
+  }
+  return out;
+}
+
+// src/core/context/resolver.ts
+import { isAbsolute, join as join9, relative as relative3 } from "path";
+
 // src/core/context/repoRoot.ts
 import { stat } from "fs/promises";
-import { dirname, join as join4, resolve } from "path";
+import { dirname as dirname2, join as join8, resolve as resolve3 } from "path";
 async function findRepoRoot(start) {
-  let dir2 = resolve(start);
+  let dir2 = resolve3(start);
   for (; ; ) {
     try {
-      await stat(join4(dir2, ".git"));
+      await stat(join8(dir2, ".git"));
       return dir2;
     } catch {
     }
-    const up = dirname(dir2);
+    const up = dirname2(dir2);
     if (up === dir2) return null;
     dir2 = up;
   }
 }
 
 // src/core/context/resolver.ts
-var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var HINT_FLAG = "cd into a module repository, or pass --module <slug|id>.";
 var RESOLVE = "/api/cli/v1/repos/resolve";
 var SKIPPABLE = /* @__PURE__ */ new Set([
@@ -794,22 +1371,22 @@ var SKIPPABLE = /* @__PURE__ */ new Set([
   "QORE_SESSION_EXPIRED"
 ]);
 var label = (p) => p.builtin ?? p.apiOrigin;
-function byPreference(remotes) {
+function byPreference(remotes2) {
   const rank = (r) => r.name === "origin" ? 0 : r.name === "upstream" ? 1 : 2;
-  return [...remotes].sort((a, b) => rank(a) - rank(b));
+  return [...remotes2].sort((a, b) => rank(a) - rank(b));
 }
-var preferred = (remotes) => byPreference(remotes)[0];
+var preferred = (remotes2) => byPreference(remotes2)[0];
 async function repoRemotes(deps2) {
   const root = await findRepoRoot(deps2.cwd);
   if (!root) return null;
-  let remotes;
+  let remotes2;
   try {
-    remotes = await deps2.git.remotes(root);
+    remotes2 = await deps2.git.remotes(root);
   } catch (e) {
     if (e instanceof QoreError && e.code !== "QORE_GIT_UNAVAILABLE") return { root, keyed: [], gitError: e };
     throw e;
   }
-  const keyed = remotes.map((r) => ({ ...r, key: repoKey(r.url) })).filter((r) => r.key !== null);
+  const keyed = remotes2.map((r) => ({ ...r, key: repoKey(r.url) })).filter((r) => r.key !== null);
   return { root, keyed };
 }
 function detail(session, id) {
@@ -841,13 +1418,28 @@ async function flagOverrides(deps2, session, portal, cache, moduleId) {
     return void 0;
   }
 }
-async function byFlag(deps2, o, cache) {
-  const cfg = await deps2.config.read();
-  const portal = resolvePortal(o.portal, cfg.defaultProfile);
+async function flagPortal(deps2, portalArg, ws) {
+  if (!portalArg && ws) return workspacePortal(deps2, ws);
+  return resolvePortal(portalArg, (await deps2.config.read()).defaultProfile);
+}
+async function workspaceAppModules(session, portal, ws) {
+  try {
+    return await session.api.get(`/api/cli/v1/apps/${encodeURIComponent(ws.appId)}/modules`);
+  } catch (e) {
+    if (e instanceof QoreError && e.code === "QORE_RESOURCE_NOT_FOUND" && portal.apiOrigin !== ws.portal) {
+      const p = resolvePortal(ws.portal, void 0);
+      const name = p.builtin ?? p.apiOrigin;
+      throw withDetails(e, { workspacePortal: p.apiOrigin }, `This workspace belongs to ${name}; drop --portal, or pass --portal ${name}.`);
+    }
+    throw e;
+  }
+}
+async function byFlag(deps2, o, cache, ws) {
+  const portal = await flagPortal(deps2, o.portal, ws);
   const session = await openSession(deps2, portal, o.command, o.onRequest);
   await ensureCapability(deps2, portal.apiOrigin, "repo.resolve");
   let id = o.module;
-  if (!UUID.test(id)) {
+  if (!UUID3.test(id)) {
     let tenantId = o.tenant ?? session.profile.activeTenant?.id;
     if (!tenantId) {
       const me = await session.api.get("/api/cli/v1/me");
@@ -872,14 +1464,47 @@ async function byFlag(deps2, o, cache) {
   const module = await detail(session, id);
   const overrides = await flagOverrides(deps2, session, portal, cache, module.id);
   const repoRoot = await findRepoRoot(deps2.cwd);
-  return { portal, session, module, source: overrides ? { kind: "flag", overrides } : { kind: "flag" }, repoRoot };
+  return { portal, session, module, source: overrides ? { kind: "flag", overrides } : { kind: "flag" }, repoRoot, workspace: ws };
+}
+var isBelow = (root, dir2) => {
+  const rel = relative3(root, dir2);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+};
+async function inWorkspaceRoot(deps2, ws) {
+  if (!ws) return false;
+  const repoRoot = await findRepoRoot(deps2.cwd);
+  return repoRoot === null || isBelow(repoRoot, ws.root);
+}
+async function inWorkspace(deps2, o, ws, portal) {
+  const session = await openSession(deps2, portal, o.command, o.onRequest);
+  if (o.choose) {
+    return { portal, session, module: await detail(session, o.choose), source: { kind: "workspace" }, repoRoot: null, workspace: ws };
+  }
+  await ensureCapability(deps2, portal.apiOrigin, "app.modules");
+  const app = await workspaceAppModules(session, portal, ws);
+  const candidates = app.modules.map((m) => ({
+    kind: "module",
+    id: m.id,
+    slug: m.slug,
+    name: m.name,
+    tenant: app.app.tenant.slug,
+    remote: "workspace"
+  }));
+  throw new QoreError("QORE_CONTEXT_REQUIRED", "In a workspace root \u2014 which module?", {
+    hint: "cd into a module, or pass --module <slug>.",
+    candidates
+  });
 }
-function profileOrder(cfg, cachedOrigins, portalArg) {
+async function workspaceRoot(deps2) {
+  const ws = await readWorkspace(deps2.cwd);
+  return ws && await inWorkspaceRoot(deps2, ws) ? ws : null;
+}
+function profileOrder(cfg, cachedOrigins, portalArg, wsPortal) {
   if (portalArg) return [resolvePortal(portalArg, cfg.defaultProfile)];
   const rank = (o) => o === BUILTIN_PORTALS.prod.apiOrigin ? 0 : o === BUILTIN_PORTALS.staging.apiOrigin ? 1 : 2;
   const rest = Object.keys(cfg.profiles).sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
   const cached = cachedOrigins.filter((c) => cfg.profiles[c]);
-  const origins = [...cached, resolvePortal(void 0, cfg.defaultProfile).apiOrigin, ...rest];
+  const origins = [...wsPortal ? [wsPortal.apiOrigin] : [], ...cached, resolvePortal(void 0, cfg.defaultProfile).apiOrigin, ...rest];
   return [...new Set(origins)].filter((c) => cfg.profiles[c]).map((c) => resolvePortal(c, void 0));
 }
 function withDetails(e, extra, hint) {
@@ -893,7 +1518,7 @@ function withDetails(e, extra, hint) {
     cause: e
   });
 }
-async function onProfile(deps2, o, cache, portal, keyed, keys, repoRoot, unsupported) {
+async function onProfile(deps2, o, cache, portal, keyed, keys, repoRoot, workspace, unsupported) {
   const session = await openSession(deps2, portal, o.command, o.onRequest);
   try {
     await ensureCapability(deps2, portal.apiOrigin, "repo.resolve");
@@ -910,7 +1535,7 @@ async function onProfile(deps2, o, cache, portal, keyed, keys, repoRoot, unsuppo
   if (hits.length > 0 && hits.every((h) => h.id === hits[0].id)) {
     const { remote: r, id: id2 } = hits[0];
     try {
-      return { portal, session, module: await detail(session, id2), source: { kind: "remote", remote: r.name, url: r.url }, repoRoot };
+      return { portal, session, module: await detail(session, id2), source: { kind: "remote", remote: r.name, url: r.url }, repoRoot, workspace };
     } catch (e) {
       if (!(e instanceof QoreError) || e.code !== "QORE_RESOURCE_NOT_FOUND") throw e;
       for (const h of hits) await cache.drop(portal.apiOrigin, h.remote.key);
@@ -938,7 +1563,7 @@ async function onProfile(deps2, o, cache, portal, keyed, keys, repoRoot, unsuppo
   const matchedKeys = new Set(matches.filter((m) => m.module.id === id).map((m) => m.repoKey));
   if (ids.length === 1) for (const k of matchedKeys) await cache.put(portal.apiOrigin, k, id);
   const remote = preferred(keyed.filter((r) => matchedKeys.has(r.key)));
-  return { portal, session, module: await detail(session, id), source: { kind: "remote", remote: remote.name, url: remote.url }, repoRoot };
+  return { portal, session, module: await detail(session, id), source: { kind: "remote", remote: remote.name, url: remote.url }, repoRoot, workspace };
 }
 async function anyLoggedIn(deps2, cfg) {
   for (const p of Object.values(cfg.profiles)) {
@@ -947,13 +1572,16 @@ async function anyLoggedIn(deps2, cfg) {
   return false;
 }
 async function resolveModuleContext(deps2, o) {
-  const cache = new ResolutionCache(join5(deps2.config.dir, "cache"), deps2.now);
-  if (o.module) return byFlag(deps2, o, cache);
+  const cache = new ResolutionCache(join9(deps2.config.dir, "cache"), deps2.now);
+  const ws = await findWorkspace(deps2.cwd, deps2.home);
+  if (o.module) return byFlag(deps2, o, cache, ws);
   const cfg = await deps2.config.read();
   const first = resolvePortal(o.portal, cfg.defaultProfile);
+  const wsPortal = ws && !o.portal ? await workspacePortal(deps2, ws) : void 0;
   if (o.portal || !await anyLoggedIn(deps2, cfg)) {
     await openSession(deps2, first, o.command);
   }
+  if (ws && await inWorkspaceRoot(deps2, ws)) return inWorkspace(deps2, o, ws, wsPortal ?? first);
   const repo = await repoRemotes(deps2);
   if (repo === null) throw new QoreError("QORE_CONTEXT_REQUIRED", "Not inside a module repository", { hint: HINT_FLAG });
   const { root, keyed, gitError } = repo;
@@ -971,11 +1599,11 @@ async function resolveModuleContext(deps2, o) {
   const skipped = [];
   const skipErrors = [];
   let unsupported;
-  for (const portal of profileOrder(cfg, await cache.originsFor(keys), o.portal)) {
+  for (const portal of profileOrder(cfg, await cache.originsFor(keys), o.portal, wsPortal)) {
     tried.push(label(portal));
     let capabilityMissing = false;
     try {
-      const mc = await onProfile(deps2, o, cache, portal, keyed, keys, root, (e) => {
+      const mc = await onProfile(deps2, o, cache, portal, keyed, keys, root, ws, (e) => {
         capabilityMissing = true;
         unsupported ??= e;
         skipped.push({ profile: label(portal), code: e.code, message: e.message });
@@ -1015,6 +1643,8 @@ function pickApp(mc, app) {
   }
   if (apps.length === 1) return apps[0];
   if (apps.length === 0) throw new QoreError("QORE_RESOURCE_NOT_FOUND", `${mc.module.slug} is not part of an app you can read`);
+  const wsApp = mc.workspace && apps.find((a) => a.id === mc.workspace.appId);
+  if (wsApp) return wsApp;
   throw new QoreError("QORE_APP_AMBIGUOUS", `${mc.module.slug} is part of several apps`, { hint: "Pass --app <slug>.", candidates: appCandidates(apps) });
 }
 
@@ -1042,8 +1672,8 @@ async function fetchLocalEnv(deps2, mc, app) {
 // src/core/env/merge.ts
 function parseEnv(contents) {
   const map = /* @__PURE__ */ new Map();
-  for (const line of contents.split("\n")) {
-    const m = line.replace(/\r$/, "").match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+  for (const line2 of contents.split("\n")) {
+    const m = line2.replace(/\r$/, "").match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
     if (m?.[1] !== void 0 && m[2] !== void 0) map.set(m[1], m[2]);
   }
   return map;
@@ -1095,11 +1725,11 @@ function planEnvUpdate({
 function renderEnv(original, merged) {
   const seen = /* @__PURE__ */ new Set();
   const lines = original.split("\n");
-  const out = lines.map((line) => {
-    const m = line.replace(/\r$/, "").match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
-    if (!m?.[1]) return line;
+  const out = lines.map((line2) => {
+    const m = line2.replace(/\r$/, "").match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!m?.[1]) return line2;
     const key = m[1];
-    if (!merged.has(key)) return line;
+    if (!merged.has(key)) return line2;
     seen.add(key);
     return `${key}=${merged.get(key) ?? ""}`;
   });
@@ -1116,8 +1746,8 @@ function renderEnv(original, merged) {
 }
 
 // src/core/env/pull.ts
-import { lstat, realpath } from "fs/promises";
-import { basename, dirname as dirname2, isAbsolute, relative, resolve as resolve2, sep } from "path";
+import { lstat, realpath as realpath2 } from "fs/promises";
+import { basename, dirname as dirname3, isAbsolute as isAbsolute2, relative as relative4, resolve as resolve4, sep } from "path";
 var outside = (target) => new QoreError("QORE_CONTEXT_INVALID", `The env file must be inside the repository (got ${target})`, {
   hint: "Use a path inside the repository for --target or .qore.json envFile."
 });
@@ -1125,29 +1755,29 @@ var symlinked = (target) => new QoreError("QORE_CONTEXT_INVALID", `The env file
   hint: "Use a path inside the repository for --target or .qore.json envFile."
 });
 function inside(root, p) {
-  const rel = relative(root, p);
-  return rel !== "" && rel !== ".." && !rel.startsWith(".." + sep) && !isAbsolute(rel);
+  const rel = relative4(root, p);
+  return rel !== "" && rel !== ".." && !rel.startsWith(".." + sep) && !isAbsolute2(rel);
 }
 async function resolveTarget(root, target, base = root) {
-  const realRoot = await realpath(root);
-  const realBase = base === root ? realRoot : await realpath(base);
-  const abs = resolve2(realBase, target);
-  if (!isAbsolute(target) && !inside(realRoot, abs)) throw outside(target);
+  const realRoot = await realpath2(root);
+  const realBase = base === root ? realRoot : await realpath2(base);
+  const abs = resolve4(realBase, target);
+  if (!isAbsolute2(target) && !inside(realRoot, abs)) throw outside(target);
   let parent;
   try {
-    parent = await realpath(dirname2(abs));
+    parent = await realpath2(dirname3(abs));
   } catch (e) {
     if (e.code !== "ENOENT") throw e;
     throw new QoreError("QORE_CONTEXT_INVALID", `The directory for ${target} does not exist`, {
       hint: "Create the parent directory, or point --target / .qore.json envFile at an existing one."
     });
   }
-  const final = resolve2(parent, basename(abs));
+  const final = resolve4(parent, basename(abs));
   if (!inside(realRoot, final)) throw outside(target);
   try {
     const st = await lstat(final);
     if (st.isSymbolicLink()) throw symlinked(target);
-    const realFinal = await realpath(final);
+    const realFinal = await realpath2(final);
     if (!inside(realRoot, realFinal)) throw outside(target);
   } catch (e) {
     if (e instanceof QoreError) throw e;
@@ -1217,6 +1847,7 @@ async function appFor(ctx, mc, app) {
 }
 function sourceText(mc) {
   if (mc.source.kind === "remote") return mc.source.remote;
+  if (mc.source.kind === "workspace") return WORKSPACE_FILE;
   return mc.source.overrides ? `--module, overrides ${mc.source.overrides}` : "--module";
 }
 function contextLine(mc, app) {
@@ -1230,39 +1861,11 @@ function contextJson(mc, app) {
     tenant: mc.module.tenant,
     app: app ?? null,
     module: { id, slug, name, type, access },
-    source: mc.source.kind === "remote" ? mc.source.remote : "--module",
+    source: mc.source.kind === "remote" ? mc.source.remote : mc.source.kind === "workspace" ? WORKSPACE_FILE : "--module",
     ...mc.source.kind === "flag" && mc.source.overrides ? { overrides: mc.source.overrides } : {}
   };
 }
 
-// src/core/trust.ts
-import { realpath as realpath2 } from "fs/promises";
-function trustKey(root, platform) {
-  return platform === "win32" ? root.toLowerCase() : root;
-}
-async function keyOf(deps2, root) {
-  let real = root;
-  try {
-    real = await realpath2(root);
-  } catch (e) {
-    if (e.code !== "ENOENT") throw e;
-  }
-  return trustKey(real, deps2.platform);
-}
-async function isTrusted(deps2, root, moduleId) {
-  const cfg = await deps2.config.read();
-  return (cfg.trustedRepos?.[await keyOf(deps2, root)] ?? []).includes(moduleId);
-}
-async function trust(deps2, root, moduleId) {
-  const key = await keyOf(deps2, root);
-  await deps2.config.update((c) => {
-    const repos = c.trustedRepos ??= {};
-    const list = new Set(repos[key] ?? []);
-    list.add(moduleId);
-    repos[key] = [...list];
-  });
-}
-
 // src/cli/trustPrompt.ts
 async function ensureTrusted(ctx, mc, app, o) {
   const root = mc.repoRoot ?? ctx.deps.cwd;
@@ -1290,7 +1893,7 @@ async function ensureTrusted(ctx, mc, app, o) {
 var maskLen = (v) => v === void 0 ? "(unset)" : `\u2022\u2022\u2022\u2022 (${v.length} chars)`;
 async function readOrNull(p) {
   try {
-    return await readFile3(p, "utf8");
+    return await readFile4(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw e;
@@ -1298,12 +1901,12 @@ async function readOrNull(p) {
 }
 async function writeSecurely(target, text) {
   const base = basename2(target);
-  const tmpName = base.endsWith(".local") ? `${base.slice(0, -".local".length)}.qore-${randomBytes2(6).toString("hex")}.local` : `${base}.qore-${randomBytes2(6).toString("hex")}.tmp`;
-  const tmp = join6(dirname3(target), tmpName);
+  const tmpName = base.endsWith(".local") ? `${base.slice(0, -".local".length)}.qore-${randomBytes3(6).toString("hex")}.local` : `${base}.qore-${randomBytes3(6).toString("hex")}.tmp`;
+  const tmp = join10(dirname4(target), tmpName);
   try {
-    await writeFile2(tmp, text, { mode: 384, flag: "wx" });
+    await writeFile3(tmp, text, { mode: 384, flag: "wx" });
     await chmod2(tmp, 384);
-    await rename2(tmp, target);
+    await rename3(tmp, target);
   } finally {
     await unlink(tmp).catch(() => {
     });
@@ -1324,7 +1927,7 @@ function registerEnv(program, ctx) {
     const target = f.target ? await resolveTarget(mc.repoRoot, f.target, deps2.cwd) : await resolveTarget(mc.repoRoot, cfg.envFile ?? defaults.envFile);
     await ensureTrusted(ctx, mc, app, { yes: f.yes });
     const existing = await readOrNull(target);
-    const example = existing === null ? await readOrNull(join6(dirname3(target), ".env.example")) : null;
+    const example = existing === null ? await readOrNull(join10(dirname4(target), ".env.example")) : null;
     const local = await fetchLocalEnv(deps2, mc, app);
     const inputs = {
       existing,
@@ -1333,7 +1936,7 @@ function registerEnv(program, ctx) {
       managed: local.managedKeys,
       localSecrets: cfg.localSecrets ?? defaults.localSecrets,
       defaultChoice: f.usePortal ? "use-portal" : "keep",
-      random: () => randomBytes2(32).toString("hex")
+      random: () => randomBytes3(32).toString("hex")
     };
     let plan = planPull(inputs);
     if (plan.conflicts.length && io2.interactive && !f.usePortal) {
@@ -1365,7 +1968,7 @@ function registerEnv(program, ctx) {
     } else {
       await writeSecurely(target, plan.text);
     }
-    const rel = relative2(await realpath3(mc.repoRoot), target);
+    const rel = relative5(await realpath3(mc.repoRoot), target);
     if (g.json) {
       const names = {
         created: plan.created,
@@ -1426,8 +2029,8 @@ function mapOidcError(e, host) {
   if (err === "access_denied") return new QoreError("QORE_LOGIN_DENIED", "The login was denied in the browser");
   if (err === "expired_token") return new QoreError("QORE_LOGIN_EXPIRED", "The login code expired", { hint: "Run `qore login` again." });
   if (err === "invalid_grant") return new QoreError("QORE_SESSION_EXPIRED", "Your session has ended", { hint: "Run `qore login`." });
-  const status = e.status;
-  if (status && status >= 500) return new QoreError("QORE_AUTH_UNAVAILABLE", "Keycloak is unavailable", { cause: e });
+  const status2 = e.status;
+  if (status2 && status2 >= 500) return new QoreError("QORE_AUTH_UNAVAILABLE", "Keycloak is unavailable", { cause: e });
   if (e instanceof TypeError) return unreachable(e, host);
   const cause = e?.cause;
   if (cause instanceof TypeError) return unreachable(cause, host);
@@ -1683,10 +2286,54 @@ function table(rows) {
 }
 
 // src/cli/commands/status.ts
+var HEAD = ["ENV", "DEPLOY", "COMMIT", "DEPLOYED", "APP HEALTH"];
+var envRow = (e, now) => [e.name, e.paused ? "paused" : e.status, e.commit?.sha ?? "\u2013", ago(e.commit?.deployedAt ?? null, now), uptime(e.health)];
+async function appStatus(ctx, ws, appFlag) {
+  const { deps: deps2, io: io2 } = ctx;
+  const g = ctx.opts();
+  const portal = await flagPortal(deps2, g.portal, ws);
+  const onRequest = g.verbose ? (l) => io2.err(l) : void 0;
+  const session = await openSession(deps2, portal, "status", onRequest);
+  await ensureCapability(deps2, portal.apiOrigin, "app.modules");
+  await ensureCapability(deps2, portal.apiOrigin, "module.status");
+  const am = await workspaceAppModules(session, portal, ws);
+  const { tenant, ...app } = am.app;
+  if (appFlag && appFlag !== app.id && appFlag !== app.slug) {
+    throw new QoreError("QORE_RESOURCE_NOT_FOUND", `This workspace is for ${app.slug}, not "${appFlag}"`, {
+      hint: "Pass --module <slug> --app <slug>."
+    });
+  }
+  if (!g.json) io2.err(`\u2192 ${tenant.name} / ${app.name}  (${WORKSPACE_FILE})`);
+  const modules = [];
+  for (const m of am.modules.filter((x) => x.repoUrl !== null)) {
+    const st = await session.api.get(
+      `/api/cli/v1/modules/${encodeURIComponent(m.id)}/status?app_id=${encodeURIComponent(app.id)}`
+    );
+    modules.push({ module: { id: m.id, slug: m.slug, name: m.name, type: m.type }, environments: st.environments });
+  }
+  if (g.json) {
+    renderJson(io2, { context: { portal: portal.builtin ?? portal.apiOrigin, tenant, app, source: WORKSPACE_FILE }, modules });
+    return;
+  }
+  if (modules.length === 0) {
+    io2.out("No modules with a repository yet.");
+    return;
+  }
+  const now = deps2.now();
+  const rows = [["MODULE", ...HEAD], ...modules.flatMap(({ module, environments }) => environments.length === 0 ? [[module.slug, "\u2013", "no environments yet", "\u2013", "\u2013", "\u2013"]] : environments.map((e) => [module.slug, ...envRow(e, now)]))];
+  for (const line2 of table(rows)) io2.out(line2);
+}
 function registerStatus(program, ctx) {
-  program.command("status").description("Deployment and health per environment for this module").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").action(async (flags) => {
+  program.command("status").description("Deployment and health per environment for this module (or, in a workspace root, the app)").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").action(async (flags) => {
     const { deps: deps2, io: io2 } = ctx;
     const g = ctx.opts();
+    if (!flags.module) {
+      const ws = await workspaceRoot(deps2);
+      if (ws) {
+        await appStatus(ctx, ws, flags.app);
+        return;
+      }
+    }
     const mc = await moduleContextFor(ctx, flags, "status");
     await ensureCapability(deps2, mc.portal.apiOrigin, "module.status");
     const app = await appFor(ctx, mc, flags.app);
@@ -1703,17 +2350,81 @@ function registerStatus(program, ctx) {
       return;
     }
     const now = deps2.now();
-    const rows = [
-      ["ENV", "DEPLOY", "COMMIT", "DEPLOYED", "APP HEALTH"],
-      ...st.environments.map((e) => [
-        e.name,
-        e.paused ? "paused" : e.status,
-        e.commit?.sha ?? "\u2013",
-        ago(e.commit?.deployedAt ?? null, now),
-        uptime(e.health)
-      ])
-    ];
-    for (const line of table(rows)) io2.out(line);
+    const rows = [HEAD, ...st.environments.map((e) => envRow(e, now))];
+    for (const line2 of table(rows)) io2.out(line2);
+  });
+}
+
+// src/cli/commands/sync.ts
+import { lstat as lstat2, readdir } from "fs/promises";
+import { join as join11, relative as relative6 } from "path";
+import { Option as Option2 } from "commander";
+function asFailure2(slug, e) {
+  if (e instanceof QoreError && e.code !== "QORE_GIT_UNAVAILABLE") {
+    return { slug, status: "failed", error: { code: e.code, message: e.message, hint: e.hint } };
+  }
+  throw e;
+}
+async function strayRepos(root, slugs) {
+  let entries;
+  try {
+    entries = (await readdir(root, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+  const names = [];
+  for (const name of entries) {
+    if (slugs.has(name)) continue;
+    try {
+      await lstat2(join11(root, name, ".git"));
+      names.push(name);
+    } catch {
+    }
+  }
+  return names.sort();
+}
+function registerSync(program, ctx) {
+  program.command("sync").description("Clone new modules, fetch present ones, report removed and re-pointed ones").option("--pull", "fast-forward every clean present repository with an upstream").addOption(new Option2("--protocol <https|ssh>", "clone URL protocol").choices(["https", "ssh"]).default("https")).action(async (flags) => {
+    const { deps: deps2, io: io2 } = ctx;
+    const g = ctx.opts();
+    const ws = await findWorkspace(deps2.cwd, deps2.home);
+    if (!ws) {
+      throw new QoreError("QORE_CONTEXT_REQUIRED", "Not inside a workspace", { hint: "Run `qore clone <app>` first." });
+    }
+    const portal = await flagPortal(deps2, g.portal, ws);
+    const onRequest = g.verbose ? (l) => io2.err(l) : void 0;
+    const session = await openSession(deps2, portal, "sync", onRequest);
+    await ensureCapability(deps2, portal.apiOrigin, "app.modules");
+    const app = await workspaceAppModules(session, portal, ws);
+    if (!g.json) io2.err(`\u2192 ${app.app.tenant.name} / ${app.app.name}  (qore.workspace.json)`);
+    const slugs = new Set(app.modules.map((m) => m.slug));
+    const dirs = {};
+    const earlyFailures = [];
+    const modulesForPlan = [];
+    for (const m of app.modules) {
+      if (!isSafeSlug(m.slug)) {
+        earlyFailures.push(asFailure2(m.slug, unsafeSlugError(m.slug)));
+        continue;
+      }
+      try {
+        dirs[m.slug] = await deps2.git.inspect(join11(ws.root, m.slug));
+        modulesForPlan.push(m);
+      } catch (e) {
+        earlyFailures.push(asFailure2(m.slug, e));
+      }
+    }
+    const strays = await strayRepos(ws.root, slugs);
+    const { actions, removed } = planWorkspace(ws.root, modulesForPlan, dirs, strays);
+    const applied = await applyActions(deps2, { portal, app, actions, protocol: flags.protocol, onResult: () => {
+    } });
+    await syncPresent(deps2, applied, actions, Boolean(flags.pull), { app, protocol: flags.protocol });
+    for (const r of applied) {
+      if (r.status === "cloned" && r.dir) r.dir = relative6(deps2.cwd, r.dir) || ".";
+    }
+    const removedResults = removed.map((slug) => ({ slug, status: "removed", reason: "not a module of this app \u2014 left in place" }));
+    const results = [...earlyFailures, ...applied, ...removedResults];
+    const err = reportWorkspaceRun(io2, results, Boolean(g.json));
+    if (err) throw err;
   });
 }
 
@@ -1832,6 +2543,8 @@ var COMMANDS = [
   registerStatus,
   registerEnv,
   registerRun,
+  registerClone,
+  registerSync,
   registerVersion
 ];
 
@@ -1867,8 +2580,8 @@ async function maybeNotifyUpdate(deps2, io2, o, timeoutMs = DEFAULT_TIMEOUT_MS)
 }
 
 // src/core/config.ts
-import { readFile as readFile4 } from "fs/promises";
-import { join as join7 } from "path";
+import { readFile as readFile5 } from "fs/promises";
+import { join as join12 } from "path";
 var empty = () => ({ schemaVersion: 1, profiles: {} });
 var ConfigStore = class {
   constructor(dir2) {
@@ -1876,12 +2589,12 @@ var ConfigStore = class {
   }
   dir;
   get file() {
-    return join7(this.dir, "config.json");
+    return join12(this.dir, "config.json");
   }
   async read() {
     let raw;
     try {
-      raw = await readFile4(this.file, "utf8");
+      raw = await readFile5(this.file, "utf8");
     } catch (e) {
       if (e.code === "ENOENT") return empty();
       throw e;
@@ -1906,51 +2619,136 @@ var ConfigStore = class {
 };
 
 // src/platform/git.ts
-import { execFile } from "child_process";
+import { execFile, execFileSync } from "child_process";
+import { mkdir as mkdir3, readdir as readdir2, stat as stat2 } from "fs/promises";
 import { homedir } from "os";
+import { dirname as dirname5, join as join13 } from "path";
 function parseRemotes(stdout) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
-  for (const line of stdout.split(/\r?\n/)) {
-    const m = /^(\S+)\t(.+) \(fetch\)$/.exec(line);
+  for (const line2 of stdout.split(/\r?\n/)) {
+    const m = /^(\S+)\t(.+) \(fetch\)$/.exec(line2);
     if (!m || seen.has(m[1])) continue;
     seen.add(m[1]);
     out.push({ name: m[1], url: m[2] });
   }
   return out;
 }
-function gitExecOptions() {
-  return { cwd: homedir(), env: { ...process.env, LC_ALL: "C" }, windowsHide: true };
-}
-var systemGit = {
-  remotes(repoRoot) {
-    return new Promise((resolve3, reject) => {
-      execFile(
-        "git",
-        ["-C", repoRoot, "remote", "-v"],
-        gitExecOptions(),
-        (err, stdout, stderr) => {
-          if (err) {
-            if (err.code === "ENOENT") {
-              reject(new QoreError("QORE_GIT_UNAVAILABLE", "git is not installed or not on PATH", {
-                hint: "Install git (https://git-scm.com/downloads) and open a new terminal."
-              }));
-              return;
-            }
-            const last = String(stderr).trim().split(/\r?\n/).pop() ?? "";
-            reject(new QoreError("QORE_INTERNAL", `git remote -v failed in ${repoRoot}`, {
-              hint: last || void 0,
-              details: { command: "git remote -v", cwd: repoRoot },
-              cause: err
-            }));
-            return;
-          }
-          resolve3(parseRemotes(String(stdout)));
-        }
-      );
+var configuredSshCommand = /* @__PURE__ */ new Map();
+function hasConfiguredSshCommand(repoDir) {
+  const key = repoDir ?? "";
+  let v = configuredSshCommand.get(key);
+  if (v === void 0) {
+    const args = repoDir ? ["-C", repoDir, "config", "--get", "core.sshCommand"] : ["config", "--get", "core.sshCommand"];
+    try {
+      v = execFileSync("git", args, {
+        cwd: homedir(),
+        env: { ...process.env, LC_ALL: "C", GIT_TERMINAL_PROMPT: "0" },
+        stdio: ["ignore", "pipe", "ignore"],
+        windowsHide: true,
+        timeout: 5e3
+      }).toString().trim().length > 0;
+    } catch {
+      v = false;
+    }
+    configuredSshCommand.set(key, v);
+  }
+  return v;
+}
+function gitExecOptions(repoDir) {
+  const env = { ...process.env, LC_ALL: "C", GIT_TERMINAL_PROMPT: "0" };
+  if (!env.GIT_HTTP_LOW_SPEED_LIMIT) env.GIT_HTTP_LOW_SPEED_LIMIT = "1000";
+  if (!env.GIT_HTTP_LOW_SPEED_TIME) env.GIT_HTTP_LOW_SPEED_TIME = "60";
+  if (!env.GIT_SSH_COMMAND && !env.GIT_SSH && !hasConfiguredSshCommand(repoDir)) {
+    env.GIT_SSH_COMMAND = "ssh -o BatchMode=yes";
+  }
+  return { cwd: homedir(), env, windowsHide: true, maxBuffer: 8 * 1024 * 1024 };
+}
+function runGit(args, repoDir) {
+  return new Promise((resolve5, reject) => {
+    execFile("git", args, gitExecOptions(repoDir), (err, stdout, stderr) => {
+      if (err && err.code === "ENOENT") {
+        reject(new QoreError("QORE_GIT_UNAVAILABLE", "git is not installed or not on PATH", {
+          hint: "Install git (https://git-scm.com/downloads) and open a new terminal."
+        }));
+        return;
+      }
+      const code = err ? typeof err.code === "number" ? err.code : 1 : 0;
+      resolve5({ code, stdout: String(stdout), stderr: String(stderr), err: err ?? void 0 });
+    });
+  });
+}
+var toResult = (r, command) => r.code === 0 ? { ok: true } : { ok: false, stderr: r.stderr, command };
+async function remotes(repoRoot) {
+  const r = await runGit(["-C", repoRoot, "remote", "-v"], repoRoot);
+  if (r.code !== 0) {
+    const last = r.stderr.trim().split(/\r?\n/).pop() ?? "";
+    throw new QoreError("QORE_INTERNAL", `git remote -v failed in ${repoRoot}`, {
+      hint: last || void 0,
+      details: { command: "git remote -v", cwd: repoRoot },
+      cause: r.err
     });
   }
-};
+  return parseRemotes(r.stdout);
+}
+async function clone(url, dir2) {
+  await mkdir3(dirname5(dir2), { recursive: true });
+  const r = await runGit(["clone", "--", url, dir2]);
+  return toResult(r, "git clone");
+}
+async function fetch(repoRoot) {
+  const r = await runGit(["-C", repoRoot, "fetch"], repoRoot);
+  return toResult(r, "git fetch");
+}
+async function pullFfOnly(repoRoot) {
+  const r = await runGit(["-C", repoRoot, "pull", "--no-rebase", "--ff-only"], repoRoot);
+  return toResult(r, "git pull --no-rebase --ff-only");
+}
+async function status(repoRoot) {
+  const command = "git status --porcelain=v2 --branch";
+  const r = await runGit(["--no-optional-locks", "-C", repoRoot, "status", "--porcelain=v2", "--branch"], repoRoot);
+  if (r.code !== 0) return { ok: false, stderr: r.stderr, command };
+  let branch = null;
+  let upstream = false;
+  let dirty = false;
+  for (const line2 of r.stdout.split(/\r?\n/)) {
+    if (line2.startsWith("# branch.head ")) {
+      const name = line2.slice("# branch.head ".length).trim();
+      branch = name === "(detached)" ? null : name;
+    } else if (line2.startsWith("# branch.upstream ")) {
+      upstream = true;
+    } else if (line2.startsWith("#")) {
+      continue;
+    } else if (line2.trim().length > 0) {
+      dirty = true;
+    }
+  }
+  return { ok: true, dirty, branch, upstream };
+}
+async function statOrThrow(path) {
+  try {
+    return await stat2(path);
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw new QoreError("QORE_INTERNAL", `could not stat ${path}`, { cause: err });
+  }
+}
+async function inspect(dir2) {
+  const st = await statOrThrow(dir2);
+  if (!st) return { exists: false, empty: false, isRepo: false, remotes: [] };
+  if (!st.isDirectory()) return { exists: true, empty: false, isRepo: false, remotes: [] };
+  let entries;
+  try {
+    entries = await readdir2(dir2);
+  } catch (err) {
+    throw new QoreError("QORE_INTERNAL", `could not read ${dir2}`, { cause: err });
+  }
+  const empty2 = entries.length === 0;
+  const isRepo = await statOrThrow(join13(dir2, ".git")) !== void 0;
+  const dirRemotes = isRepo ? await remotes(dir2) : [];
+  return { exists: true, empty: empty2, isRepo, remotes: dirRemotes };
+}
+var systemGit = { remotes, clone, fetch, pullFfOnly, status, inspect };
 
 // src/platform/keychain.ts
 import { Entry } from "@napi-rs/keyring";
@@ -2007,15 +2805,15 @@ var OsKeychain = class {
 };
 
 // src/platform/lock.ts
-import { mkdir as mkdir2, writeFile as writeFile3 } from "fs/promises";
-import { join as join8 } from "path";
+import { mkdir as mkdir4, writeFile as writeFile4 } from "fs/promises";
+import { join as join14 } from "path";
 import lockfile from "proper-lockfile";
 function fileLock(dir2) {
   return async (name, fn) => {
-    const locks = join8(dir2, "locks");
-    await mkdir2(locks, { recursive: true, mode: 448 });
-    const target = join8(locks, `${name}.lock`);
-    await writeFile3(target, "", { flag: "a" });
+    const locks = join14(dir2, "locks");
+    await mkdir4(locks, { recursive: true, mode: 448 });
+    const target = join14(locks, `${name}.lock`);
+    await writeFile4(target, "", { flag: "a" });
     let release;
     let compromised;
     try {
@@ -2057,7 +2855,7 @@ var { ignore: IGNORE, forward: FORWARD } = signalsFor(process.platform);
 function makeSpawner(spawnFn, proc) {
   return {
     run(cmd, args, env) {
-      return new Promise((resolve3, reject) => {
+      return new Promise((resolve5, reject) => {
         let child;
         try {
           child = spawnFn(cmd, args, { stdio: "inherit", shell: false, env, windowsHide: true });
@@ -2082,7 +2880,7 @@ function makeSpawner(spawnFn, proc) {
         });
         child.once("exit", (code, signal) => {
           cleanup();
-          resolve3({ code, signal });
+          resolve5({ code, signal });
         });
       });
     }
@@ -2091,7 +2889,7 @@ function makeSpawner(spawnFn, proc) {
 var crossSpawner = makeSpawner(spawn, process);
 
 // src/version.ts
-var VERSION = true ? "0.1.1" : "0.0.0-dev";
+var VERSION = true ? "0.1.2" : "0.0.0-dev";
 
 // src/cli.ts
 if (process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY) setGlobalDispatcher(new EnvHttpProxyAgent());
@@ -2107,18 +2905,19 @@ process.on("SIGINT", () => {
   }
   ac.abort();
 });
-var fetch = abortableFetch(globalThis.fetch, ac.signal);
+var fetch2 = abortableFetch(globalThis.fetch, ac.signal);
 var deps = {
-  fetch,
+  fetch: fetch2,
   keychain: new OsKeychain(),
   config: new ConfigStore(dir),
   withLock: fileLock(dir),
   now: () => /* @__PURE__ */ new Date(),
-  oidcFor: (issuer) => createOidc({ issuer, clientId: "qore-cli", fetch }),
+  oidcFor: (issuer) => createOidc({ issuer, clientId: "qore-cli", fetch: fetch2 }),
   env: process.env,
   platform: process.platform,
   version: VERSION,
   cwd: process.cwd(),
+  home: homedir2(),
   git: systemGit,
   spawn: crossSpawner,
   raise: (signal) => {