@quonfig/cli 0.0.25 → 0.0.27

package/dist/commands/workspace.js

@@ -1,54 +1,121 @@
 import { BaseCommand } from '../index.js';
 import { getApiUrl } from '../util/domain-urls.js';
 import { getValidAccessToken } from '../util/get-valid-token.js';
-import { getActiveProfile, loadAuthConfig } from '../util/token-storage.js';
+import { tryParseWorkspacePin } from '../util/quonfig-json.js';
+import { findOrgIdBySlug, getActiveProfile, loadAuthConfig, loadTokens } from '../util/token-storage.js';
 const UUID_PATTERN = /^[\da-f]{8}(?:-[\da-f]{4}){3}-[\da-f]{12}$/i;
 export default class Workspace extends BaseCommand {
-    static description = 'Show the current workspace';
+    static description = 'Show the active workspace, all org tokens, and every (org, workspace) the user can reach';
     static examples = ['<%= config.bin %> <%= command.id %>'];
     async run() {
-        // API-key mode: resolve the workspace from QUONFIG_WORKSPACE via the server
-        // so we show the workspace the key is actually scoped to, not whatever
-        // the local OAuth config happens to point at.
         if (process.env.QUONFIG_API_KEY) {
             return this.runApiKeyMode();
         }
-        const authConfig = await loadAuthConfig();
-        if (!authConfig || Object.keys(authConfig.profiles).length === 0) {
+        const store = await loadTokens();
+        if (!store || Object.keys(store.tokensByOrg).length === 0) {
             return this.err('Not logged in. Run `qfg login` first.');
         }
-        const activeProfileName = getActiveProfile();
-        const profile = authConfig.profiles[activeProfileName] || authConfig.profiles[authConfig.defaultProfile || 'default'];
-        if (!profile) {
-            return this.err('No workspace configured. Run `qfg login` first.');
-        }
-        const workspaceSlug = profile.workspaceSlug || profile.workspaceName || profile.workspace;
-        const orgLine = profile.organizationName ? `${profile.organizationName} / ` : '';
-        this.log(`Workspace:    ${orgLine}${workspaceSlug}`);
-        this.log(`ID:           ${profile.workspace}`);
-        this.log(`\nTo switch:    qfg workspace switch`);
-        this.log(`To pin in a project, add to .env:`);
-        this.log(`  QUONFIG_WORKSPACE=${workspaceSlug}`);
-        return {
-            organizationName: profile.organizationName,
-            workspace: profile.workspace,
-            workspaceSlug,
-        };
-    }
-    async runApiKeyMode() {
-        const override = process.env.QUONFIG_WORKSPACE;
-        if (!override) {
-            return this.err('QUONFIG_API_KEY is set but QUONFIG_WORKSPACE is not. Set QUONFIG_WORKSPACE=<workspace-slug> (UUIDs also work).');
-        }
-        // getValidAccessToken short-circuits when QUONFIG_API_KEY is set.
+        const authConfig = await loadAuthConfig();
+        const orgEntries = Object.entries(store.tokensByOrg);
+        const orgSlugsWithTokens = orgEntries
+            .map(([orgId, t]) => t.org_slug ?? orgId)
+            .sort((a, b) => a.localeCompare(b));
+        const firstOrgId = orgEntries[0][0];
         let jwt;
         try {
-            jwt = await getValidAccessToken();
+            jwt = await getValidAccessToken(firstOrgId, this.verboseLog);
         }
         catch (error) {
             return this.err(error instanceof Error ? error.message : String(error));
         }
-        let entries = [];
+        const allWorkspaces = await this.fetchWorkspaces(jwt);
+        const defaultProfilePin = this.profilePin(authConfig, allWorkspaces);
+        const activePin = this.activePin(store, authConfig, allWorkspaces, defaultProfilePin);
+        this.log(`Active workspace: ${activePin ?? '(none)'}`);
+        this.log(`Default profile:  ${defaultProfilePin ?? '(none)'}`);
+        this.log(`Orgs with tokens: ${orgSlugsWithTokens.length > 0 ? orgSlugsWithTokens.join(', ') : '(none)'}`);
+        this.log('');
+        this.log('All token-minted orgs and workspaces:');
+        const grouped = groupByOrg(orgEntries, allWorkspaces);
+        if (grouped.length === 0) {
+            this.log('  (no workspaces visible — run `qfg login` to refresh)');
+        }
+        else {
+            for (const group of grouped) {
+                this.log(`  ${group.orgSlug}:`);
+                if (group.workspaces.length === 0) {
+                    this.log('    (no workspaces yet — `qfg workspace create` to add one)');
+                    continue;
+                }
+                for (const w of group.workspaces) {
+                    const pin = `${group.orgSlug}/${w.workspaceSlug}`;
+                    const marker = pin === defaultProfilePin ? ' (default)' : '';
+                    this.log(`    - ${pin}${marker}`);
+                }
+            }
+        }
+        const totalWorkspaces = grouped.reduce((sum, g) => sum + g.workspaces.length, 0);
+        if (totalWorkspaces > 1) {
+            this.log('');
+            this.log('To switch the default workspace: qfg workspace switch');
+        }
+        return {
+            activeWorkspace: activePin,
+            defaultProfile: defaultProfilePin,
+            orgsWithTokens: orgSlugsWithTokens,
+            orgs: grouped.map((g) => ({
+                orgSlug: g.orgSlug,
+                workosOrgId: g.workosOrgId,
+                workspaces: g.workspaces.map((w) => ({
+                    workspaceId: w.workspaceId,
+                    workspaceSlug: w.workspaceSlug,
+                    pin: `${g.orgSlug}/${w.workspaceSlug}`,
+                })),
+            })),
+        };
+    }
+    /**
+     * Pin the default-profile workspaceId to org/ws form by looking it up in
+     * the workspaces list. Returns undefined if the auth config is empty or
+     * the saved workspace doesn't appear in the listing.
+     */
+    profilePin(authConfig, allWorkspaces) {
+        if (!authConfig)
+            return undefined;
+        const activeProfileName = getActiveProfile();
+        const profile = authConfig.profiles[activeProfileName] || authConfig.profiles[authConfig.defaultProfile || 'default'];
+        if (!profile)
+            return undefined;
+        const match = allWorkspaces.find((w) => w.workspaceId === profile.workspace);
+        if (!match)
+            return undefined;
+        const orgSlug = match.organizationSlug ?? slugFromName(match.organizationName);
+        if (!orgSlug)
+            return undefined;
+        return `${orgSlug}/${match.workspaceSlug}`;
+    }
+    /**
+     * QUONFIG_WORKSPACE wins over the default profile (matches the resolution
+     * order in get-client.ts/resolve-workspace.ts). Bare slugs are ignored
+     * here — the status command does NOT throw on a stale env-var, just
+     * shows the default profile instead.
+     */
+    activePin(store, _authConfig, allWorkspaces, fallback) {
+        const env = process.env.QUONFIG_WORKSPACE;
+        if (env) {
+            const pin = tryParseWorkspacePin(env);
+            if (pin) {
+                const orgId = findOrgIdBySlug(store, pin.orgSlug);
+                if (orgId) {
+                    const match = allWorkspaces.find((w) => w.workosOrgId === orgId && w.workspaceSlug === pin.workspaceSlug);
+                    if (match)
+                        return `${pin.orgSlug}/${pin.workspaceSlug}`;
+                }
+            }
+        }
+        return fallback;
+    }
+    async fetchWorkspaces(jwt) {
         try {
             const res = await fetch(`${getApiUrl()}/api/v1/userWorkspaces/list`, {
                 method: 'POST',
@@ -56,13 +123,33 @@ export default class Workspace extends BaseCommand {
                 body: JSON.stringify({ json: {} }),
             });
             if (!res.ok) {
-                return this.err(`Failed to resolve workspace (HTTP ${res.status}). Check that QUONFIG_API_KEY is valid.`);
+                this.verboseLog('workspace: userWorkspaces/list non-OK', { status: res.status });
+                return [];
             }
             const body = (await res.json());
-            entries = body.json ?? body ?? [];
+            const list = (body.json ?? body);
+            return Array.isArray(list) ? list : [];
         }
         catch (error) {
-            return this.err(`Failed to resolve workspace "${override}": ${error instanceof Error ? error.message : String(error)}`);
+            this.verboseLog('workspace: userWorkspaces/list failed', { error: String(error) });
+            return [];
+        }
+    }
+    async runApiKeyMode() {
+        const override = process.env.QUONFIG_WORKSPACE;
+        if (!override) {
+            return this.err('QUONFIG_API_KEY is set but QUONFIG_WORKSPACE is not. Set QUONFIG_WORKSPACE=<workspace-slug> (UUIDs also work).');
+        }
+        let jwt;
+        try {
+            jwt = await getValidAccessToken('');
+        }
+        catch (error) {
+            return this.err(error instanceof Error ? error.message : String(error));
+        }
+        const entries = await this.fetchWorkspaces(jwt);
+        if (entries.length === 0) {
+            return this.err(`Failed to resolve workspace "${override}" — no entries returned.`);
         }
         const match = UUID_PATTERN.test(override)
             ? entries.find((w) => w.workspaceId === override)
@@ -71,14 +158,44 @@ export default class Workspace extends BaseCommand {
             const available = entries.map((w) => w.workspaceSlug).join(', ') || '(none)';
             return this.err(`Workspace "${override}" not accessible with this API key. Available: ${available}.`);
         }
-        const orgLine = match.organizationName ? `${match.organizationName} / ` : '';
-        this.log(`Workspace:    ${orgLine}${match.workspaceSlug}  (API key mode)`);
-        this.log(`ID:           ${match.workspaceId}`);
-        this.log(`Source:       QUONFIG_API_KEY + QUONFIG_WORKSPACE=${override}`);
+        const orgSlug = match.organizationSlug ?? slugFromName(match.organizationName) ?? '(unknown-org)';
+        const pin = `${orgSlug}/${match.workspaceSlug}`;
+        this.log(`Active workspace: ${pin}  (API key mode)`);
+        this.log(`ID:               ${match.workspaceId}`);
+        this.log(`Source:           QUONFIG_API_KEY + QUONFIG_WORKSPACE=${override}`);
         return {
+            activeWorkspace: pin,
             organizationName: match.organizationName,
             workspace: match.workspaceId,
             workspaceSlug: match.workspaceSlug,
         };
     }
 }
+/**
+ * Group server-side workspaces by the orgs we hold tokens for, preserving
+ * orgs with no workspaces (so the user sees that they're a member but
+ * haven't created anything there yet). Sorted alphabetically by org slug.
+ */
+function groupByOrg(tokenEntries, allWorkspaces) {
+    const groups = [];
+    for (const [orgId, tokens] of tokenEntries) {
+        const slugFromToken = tokens.org_slug;
+        const matchingWorkspaces = allWorkspaces.filter((w) => w.workosOrgId === orgId);
+        const slugFromWs = matchingWorkspaces[0]?.organizationSlug;
+        const orgSlug = slugFromToken ?? slugFromWs ?? slugFromName(tokens.org_name) ?? orgId;
+        groups.push({
+            orgSlug,
+            workosOrgId: orgId,
+            workspaces: matchingWorkspaces.sort((a, b) => a.workspaceSlug.localeCompare(b.workspaceSlug)),
+        });
+    }
+    return groups.sort((a, b) => a.orgSlug.localeCompare(b.orgSlug));
+}
+function slugFromName(name) {
+    if (!name)
+        return undefined;
+    return name
+        .toLowerCase()
+        .replaceAll(/[^\da-z]+/g, '-')
+        .replaceAll(/^-|-$/g, '');
+}

package/dist/migrate/local-write.js

@@ -1,15 +1,13 @@
-import { execFile as execFileCb, spawn } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import * as util from 'node:util';
 import { removeQfFromGitignore, writeImportState } from './import-state.js';
 import { writeMigrationReport } from './migration-report.js';
 import { detectDuplicateKeys } from './sources/launch/translate.js';
 import { MIGRATOR_IDENTITY } from '../util/clone-and-stack-push.js';
-const execFile = util.promisify(execFileCb);
+import { runGit, spawnGit } from '../util/git-ops.js';
 const isGitRepo = async (dir) => {
     try {
-        await execFile('git', ['-C', dir, 'rev-parse', '--git-dir']);
+        await runGit(['-C', dir, 'rev-parse', '--git-dir']);
         return true;
     }
     catch {
@@ -17,24 +15,9 @@ const isGitRepo = async (dir) => {
     }
 };
 const hasStagedChanges = async (dir) => {
-    const { stdout } = await execFile('git', ['-C', dir, 'status', '--porcelain']);
+    const { stdout } = await runGit(['-C', dir, 'status', '--porcelain']);
     return stdout.trim().length > 0;
 };
-const gitCommitFromStdin = (cwd, message, env) => new Promise((resolve, reject) => {
-    const child = spawn('git', ['-C', cwd, 'commit', '-F', '-'], { env });
-    let stderr = '';
-    child.stderr.on('data', (d) => {
-        stderr += d.toString();
-    });
-    child.on('error', reject);
-    child.on('close', (code) => {
-        if (code === 0)
-            resolve();
-        else
-            reject(new Error(`git commit exited ${code}: ${stderr}`));
-    });
-    child.stdin.end(message);
-});
 const ensureQuonfigJson = (dir, environments) => {
     const filePath = path.join(dir, 'quonfig.json');
     if (fs.existsSync(filePath))
@@ -46,7 +29,7 @@ const ensureLocalRepo = async (localDir, branch) => {
     fs.mkdirSync(localDir, { recursive: true });
     if (await isGitRepo(localDir))
         return 'reused';
-    await execFile('git', ['init', `--initial-branch=${branch}`, localDir]);
+    await runGit(['init', `--initial-branch=${branch}`, localDir]);
     return 'initialized';
 };
 const writeQuonfigFiles = (dir, changes, source) => {
@@ -94,8 +77,8 @@ export const applyLocalMigration = async (opts) => {
     const branch = opts.branch ?? 'main';
     const author = opts.author ?? MIGRATOR_IDENTITY;
     const action = await ensureLocalRepo(opts.localDir, branch);
-    await execFile('git', ['-C', opts.localDir, 'config', 'user.name', author.name]);
-    await execFile('git', ['-C', opts.localDir, 'config', 'user.email', author.email]);
+    await runGit(['-C', opts.localDir, 'config', 'user.name', author.name]);
+    await runGit(['-C', opts.localDir, 'config', 'user.email', author.email]);
     ensureQuonfigJson(opts.localDir, opts.environments);
     const resolutionEntries = writeQuonfigFiles(opts.localDir, opts.changes, opts.source);
     removeQfFromGitignore(opts.localDir);
@@ -110,18 +93,20 @@ export const applyLocalMigration = async (opts) => {
         ...(skippedConfigs ? { skippedConfigs } : {}),
     };
     writeMigrationReport(opts.localDir, reportData);
-    await execFile('git', ['-C', opts.localDir, 'add', '--all']);
+    await runGit(['-C', opts.localDir, 'add', '--all']);
     if (!(await hasStagedChanges(opts.localDir))) {
         return { action, committed: false, commitSha: null, droppedOverrides, duplicateResolutions, skippedConfigs };
     }
-    await gitCommitFromStdin(opts.localDir, opts.commitMessage, {
-        ...process.env,
-        GIT_AUTHOR_EMAIL: author.email,
-        GIT_AUTHOR_NAME: author.name,
-        GIT_COMMITTER_EMAIL: author.email,
-        GIT_COMMITTER_NAME: author.name,
+    await spawnGit(['-C', opts.localDir, 'commit', '-F', '-'], {
+        stdin: opts.commitMessage,
+        env: {
+            GIT_AUTHOR_EMAIL: author.email,
+            GIT_AUTHOR_NAME: author.name,
+            GIT_COMMITTER_EMAIL: author.email,
+            GIT_COMMITTER_NAME: author.name,
+        },
     });
-    const { stdout: sha } = await execFile('git', ['-C', opts.localDir, 'rev-parse', 'HEAD']);
+    const { stdout: sha } = await runGit(['-C', opts.localDir, 'rev-parse', 'HEAD']);
     return {
         action,
         commitSha: sha.trim(),

package/dist/push/bare-path-diff.js

@@ -24,13 +24,11 @@
  *     `copyDirMirror` in `commands/push.ts`, which mirrors every non-dotfile
  *     into the real push clone.
  */
-import { execFile as execFileCb } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
-import * as util from 'node:util';
-const execFile = util.promisify(execFileCb);
+import { runGit } from '../util/git-ops.js';
 /**
  * Clone `remoteUrl` into an OS tmp dir, then diff the working tree of `localDir`
  * against the scratch clone's working tree. Returns `FileDelta[]` plus the
@@ -42,7 +40,7 @@ export async function computeBarePathDiff(localDir, remoteUrl) {
         // --depth 1 would miss information needed for later identity checks, but
         // for the diff we only need the tip — shallow is fine and a lot faster on
         // workspaces with 2 years of history.
-        await execFile('git', ['clone', '--branch', 'main', '--depth', '1', remoteUrl, scratchDir]);
+        await runGit(['clone', '--branch', 'main', '--depth', '1', remoteUrl, scratchDir]);
     }
     catch (error) {
         // Clean up before re-throwing so we never leak a scratch dir on failure.

package/dist/push/config-push-client.js

@@ -15,9 +15,11 @@
  * `QUONFIG_API_KEY` is set in the environment); see `getValidAccessToken`.
  */
 import { getApiUrl } from '../util/domain-urls.js';
-import { getValidAccessToken } from '../util/get-valid-token.js';
+import { getValidAccessToken, resolveDefaultOrgId } from '../util/get-valid-token.js';
 export const callConfigsPush = async (input) => {
-    const accessToken = await getValidAccessToken();
+    // TODO(qfg-kr7.5): thread workosOrgId through from the resolved workspace address.
+    const orgId = await resolveDefaultOrgId();
+    const accessToken = await getValidAccessToken(orgId);
     const apiUrl = getApiUrl();
     const res = await fetch(`${apiUrl}/api/v1/configs/push`, {
         method: 'POST',

package/dist/push/run-push.js

@@ -19,7 +19,8 @@
  * confirmation — that prompt is the destructive-change brake.
  */
 import * as fs from 'node:fs';
-import { readWorkspaceSlug, writeWorkspaceSlug } from '../util/quonfig-json.js';
+import { commitPinFixIfPinOnly } from '../util/git-ops.js';
+import { readWorkspaceSlug, tryParseWorkspacePin, writeWorkspaceSlug } from '../util/quonfig-json.js';
 import { checkIdentity } from './identity-check.js';
 import { confirmTypedSlug, confirmYesNo } from './confirm.js';
 import { summarizeDiff } from './diff-summary.js';
@@ -69,7 +70,10 @@ export async function runPush(input, deps) {
     // Guard 1 pre-work: read repo pin + current origin BEFORE we mint a write
     // token. The identity check happens after minting (so we can cross-reference
     // the backend's canonical identity) but we want the pin/origin up front.
-    const repoPinSlug = await readWorkspaceSlug(input.dir);
+    // The pin is `<org>/<ws>`; identity-check still operates on the workspace
+    // component until backend responses carry the org slug too (qfg-kr7 epic).
+    const repoPin = await readWorkspaceSlug(input.dir);
+    const repoPinSlug = repoPin?.workspaceSlug;
     const hasGit = await deps.gitOps.isGitRepo(input.dir);
     const remoteOriginUrl = hasGit ? await deps.gitOps.getRemoteOriginUrl(input.dir) : undefined;
     // Mint the write token. The backend accepts a slug OR a UUID for workspaceId
@@ -124,6 +128,23 @@ export async function runPush(input, deps) {
         await deps.gitOps.setRemoteOrigin(input.dir, backend.repoUrl);
         log('Fetching from remote...');
         await deps.gitOps.fetch(input.dir);
+        // Migration cleanup (qfg-0fn): older `qfg pull` runs wrote the
+        // workspace pin to the working tree without committing. The next
+        // diff would miss it. Sweep up that legacy state IF the only dirty
+        // change to quonfig.json is the matching workspace pin — never
+        // silently commit other uncommitted edits the user has in flight.
+        try {
+            const pinFix = await commitPinFixIfPinOnly(input.dir, 'quonfig.json', backend.workspaceSlug);
+            if (pinFix.kind === 'committed') {
+                log(`Committed workspace pin "${pinFix.slug}" to quonfig.json (legacy backfill from prior qfg pull).`);
+            }
+            else if (pinFix.kind === 'skipped') {
+                log(`Note: quonfig.json has uncommitted changes (${pinFix.reason}). They will not be included in this push.`);
+            }
+        }
+        catch {
+            /* non-fatal */
+        }
     }
     const deltas = await deps.gitOps.diffHeadVsOrigin(input.dir);
     const totalFilesInRemote = await deps.gitOps.countFilesInRemote(input.dir);
@@ -179,12 +200,20 @@ export async function runPush(input, deps) {
         throw new PushFatalError(`Push rejected by server: ${result.message}`, 'BAD_REQUEST');
     }
     if (unpinned && !input.noPinWrite) {
-        try {
-            await writeWorkspaceSlug(input.dir, backend.workspaceSlug);
-            log(`Wrote workspace = "${backend.workspaceSlug}" into quonfig.json`);
-        }
-        catch {
-            /* non-fatal; pin is advisory */
+        // Backend `workspaceSlug` is just the workspace component today; until
+        // it returns the slash form, we can only write the pin when the
+        // response is already in `<org>/<ws>` form. Otherwise skip — the pin
+        // is advisory and will be backfilled by a later `qfg pull` once the
+        // backend learns the new shape (qfg-kr7 epic).
+        const backendPin = tryParseWorkspacePin(backend.workspaceSlug);
+        if (backendPin) {
+            try {
+                await writeWorkspaceSlug(input.dir, backendPin);
+                log(`Wrote workspace = "${backendPin.orgSlug}/${backendPin.workspaceSlug}" into quonfig.json`);
+            }
+            catch {
+                /* non-fatal; pin is advisory */
+            }
         }
     }
     return { kind: 'pushed', dispatchedAs, commitSha: result.commitSha };

package/dist/util/clone-and-stack-push.js

@@ -1,23 +1,6 @@
-import { execFile as execFileCb, spawn } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import * as util from 'node:util';
-const execFile = util.promisify(execFileCb);
-const gitCommitFromStdin = (cwd, message, env) => new Promise((resolve, reject) => {
-    const child = spawn('git', ['-C', cwd, 'commit', '-F', '-'], { env });
-    let stderr = '';
-    child.stderr.on('data', (d) => {
-        stderr += d.toString();
-    });
-    child.on('error', reject);
-    child.on('close', (code) => {
-        if (code === 0)
-            resolve();
-        else
-            reject(new Error(`git commit exited ${code}: ${stderr}`));
-    });
-    child.stdin.end(message);
-});
+import { runGit as runGitSafe, spawnGit } from './git-ops.js';
 export const MIGRATOR_IDENTITY = {
     name: 'quonfig migrator',
     email: 'migrator@quonfig.com',
@@ -31,7 +14,7 @@ export class PushConflictError extends Error {
 }
 const runGit = async (cwd, args) => {
     try {
-        return await execFile('git', args, { cwd });
+        return await runGitSafe(args, { cwd });
     }
     catch (error) {
         const e = error;
@@ -46,7 +29,7 @@ const runGit = async (cwd, args) => {
 };
 const isGitRepo = async (dir) => {
     try {
-        await execFile('git', ['-C', dir, 'rev-parse', '--git-dir']);
+        await runGitSafe(['-C', dir, 'rev-parse', '--git-dir']);
         return true;
     }
     catch {
@@ -55,7 +38,7 @@ const isGitRepo = async (dir) => {
 };
 const getOriginUrl = async (dir) => {
     try {
-        const { stdout } = await execFile('git', ['-C', dir, 'remote', 'get-url', 'origin']);
+        const { stdout } = await runGitSafe(['-C', dir, 'remote', 'get-url', 'origin']);
         return stdout.trim() || null;
     }
     catch {
@@ -86,7 +69,7 @@ const ensureCloneOrReuse = async (remoteUrl, localDir, branch) => {
     return 'cloned';
 };
 const hasStagedChanges = async (dir) => {
-    const { stdout } = await execFile('git', ['-C', dir, 'status', '--porcelain']);
+    const { stdout } = await runGitSafe(['-C', dir, 'status', '--porcelain']);
     return stdout.trim().length > 0;
 };
 export const cloneAndStackPush = async (opts) => {
@@ -101,14 +84,16 @@ export const cloneAndStackPush = async (opts) => {
     if (!(await hasStagedChanges(opts.localDir))) {
         return { action, committed: false, commitSha: null };
     }
-    await gitCommitFromStdin(opts.localDir, opts.commitMessage, {
-        ...process.env,
-        GIT_AUTHOR_NAME: author.name,
-        GIT_AUTHOR_EMAIL: author.email,
-        GIT_COMMITTER_NAME: author.name,
-        GIT_COMMITTER_EMAIL: author.email,
+    await spawnGit(['-C', opts.localDir, 'commit', '-F', '-'], {
+        stdin: opts.commitMessage,
+        env: {
+            GIT_AUTHOR_NAME: author.name,
+            GIT_AUTHOR_EMAIL: author.email,
+            GIT_COMMITTER_NAME: author.name,
+            GIT_COMMITTER_EMAIL: author.email,
+        },
     });
-    const { stdout: sha } = await execFile('git', ['-C', opts.localDir, 'rev-parse', 'HEAD']);
+    const { stdout: sha } = await runGitSafe(['-C', opts.localDir, 'rev-parse', 'HEAD']);
     try {
         // Plain push — no force, no force-with-lease. If the remote has advanced, we fail
         // and surface a conflict; we do NOT clobber UI edits.