@quonfig/cli 0.0.45 → 0.0.47

package/dist/push/config-push-client.js

@@ -59,6 +59,108 @@ export const callConfigsPush = async (input, orgSlug) => {
     }
     throw new Error(`configs.push failed (HTTP ${res.status}): ${message}`);
 };
+/**
+ * Pack-push wire client for `configs.gitPush` (qfg-7429.4). Mirrors
+ * `callConfigsPush` shape — same oRPC `{json: ...}` envelope, same
+ * status-to-tagged-union mapping. Two differences:
+ *
+ *   - The pack is base64-encoded so the JSON envelope stays text-safe;
+ *     the server-side handler (`git-push-handler.ts`) decodes it via
+ *     `Buffer.from(input.pack, 'base64')`.
+ *   - 403 denials carry `{commitSha, path, reason, requiredPermission}`
+ *     plus an optional `suggestedRecovery` block for the GitHub-fork
+ *     dead-end UX (see §6 of the design plan and qfg-7429.5 for the
+ *     polished renderer).
+ */
+export const callConfigsGitPush = async (input, orgSlug) => {
+    const accessToken = await getValidAccessTokenForOrgSlug(orgSlug);
+    const apiUrl = getApiUrl();
+    const wirePayload = {
+        workspaceId: input.workspaceId,
+        targetRef: input.targetRef,
+        expectedSha: input.expectedSha,
+        newSha: input.newSha,
+        pack: Buffer.from(input.pack).toString('base64'),
+        hasUpstreamRemote: input.hasUpstreamRemote,
+    };
+    const res = await fetch(`${apiUrl}/api/v1/configs/gitPush`, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ json: wirePayload }),
+    });
+    if (res.ok) {
+        const body = (await res.json());
+        const commitSha = body.json?.commitSha;
+        const ref = body.json?.ref;
+        if (!commitSha || !ref) {
+            throw new Error(`configs.gitPush returned 200 but missing commitSha/ref (body=${JSON.stringify(body)})`);
+        }
+        return { kind: 'success', commitSha, ref };
+    }
+    const text = await res.text().catch(() => '');
+    let parsed;
+    try {
+        const body = JSON.parse(text);
+        parsed = body.json ?? body;
+    }
+    catch {
+        /* keep parsed undefined */
+    }
+    const message = parsed?.message ?? text ?? `HTTP ${res.status}`;
+    if (res.status === 403) {
+        const denials = extractGitPushDenials(parsed?.data);
+        if (denials.length > 0) {
+            const suggestedRecovery = extractSuggestedRecovery(parsed?.data);
+            return suggestedRecovery ? { kind: 'denied', denials, suggestedRecovery } : { kind: 'denied', denials };
+        }
+    }
+    if (res.status === 409) {
+        return { kind: 'conflict', message };
+    }
+    if (res.status === 400) {
+        return { kind: 'bad-request', message };
+    }
+    throw new Error(`configs.gitPush failed (HTTP ${res.status}): ${message}`);
+};
+function extractGitPushDenials(data) {
+    // Narrowing helper: the gitPush handler's denial shape extends the
+    // bare-path denial with `commitSha`. Other fields parsed identically.
+    if (!data || typeof data !== 'object')
+        return [];
+    const denials = data.denials;
+    if (!Array.isArray(denials))
+        return [];
+    const out = [];
+    for (const raw of denials) {
+        if (!raw || typeof raw !== 'object')
+            continue;
+        const r = raw;
+        if (typeof r.commitSha !== 'string' || typeof r.path !== 'string' || typeof r.requiredPermission !== 'string')
+            continue;
+        out.push({
+            commitSha: r.commitSha,
+            path: r.path,
+            reason: typeof r.reason === 'string' ? r.reason : `Missing required permission: ${r.requiredPermission}`,
+            requiredPermission: r.requiredPermission,
+        });
+    }
+    return out;
+}
+function extractSuggestedRecovery(data) {
+    if (!data || typeof data !== 'object')
+        return undefined;
+    const sr = data.suggestedRecovery;
+    if (!sr || typeof sr !== 'object')
+        return undefined;
+    const r = sr;
+    if (r.kind !== 'revert-upstream' || typeof r.offendingCommitSha !== 'string' || typeof r.message !== 'string') {
+        return undefined;
+    }
+    return { kind: 'revert-upstream', offendingCommitSha: r.offendingCommitSha, message: r.message };
+}
 function extractDenials(data) {
     if (!data || typeof data !== 'object')
         return [];

package/dist/push/git-pack.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Pack-push primitives for the CLI clone-path flow (qfg-7429.4, §4.1
+ * of project/plans/qfg-git-commit-push-pull-improvements.md).
+ *
+ * The CLI ships actual git commit objects to app-quonfig instead of a
+ * file-delta list. This module owns the two preflight checks and the
+ * `git pack-objects` wrapper:
+ *
+ *   - `getCurrentBranch(dir)` — refuse detached HEAD and `master`
+ *     before any pack work happens. Returns the branch name to use as
+ *     the basename of `targetRef` on success.
+ *   - `buildPack(dir, expectedSha, newSha)` — produce the packfile of
+ *     `<expectedSha>..<newSha>` and return it as raw bytes. Capped at
+ *     25 MiB per §7 open Q #7; throws `PackTooLargeError` on overflow.
+ *
+ * Pure(ish): every git invocation goes through `runGit`/`spawn`. Tests
+ * stand up real tmp-dir git repos rather than mocking the shell — the
+ * pack format is too fiddly to fake convincingly.
+ */
+/** Per §7 open Q #7 of the design plan: pack size cap of 25 MiB. */
+export declare const MAX_PACK_BYTES: number;
+/**
+ * Result of `getCurrentBranch`. `branch` carries the name to forward
+ * into the server `targetRef`. `detached` and `master` carry the exact
+ * user-facing refusal message — callers throw it as-is.
+ */
+export type CurrentBranchResult = {
+    kind: 'branch';
+    name: string;
+} | {
+    kind: 'detached';
+    message: string;
+} | {
+    kind: 'master';
+    message: string;
+};
+/**
+ * Resolve HEAD via `git symbolic-ref HEAD`. Empty/failed resolution
+ * means detached HEAD (per §4.1 step 1). `master` is treated as a
+ * structural workspace error rather than a transient one — the
+ * workspace template uses `main`, and a `master` checkout is almost
+ * always a leftover from cloning a non-Quonfig template.
+ */
+export declare function getCurrentBranch(dir: string): Promise<CurrentBranchResult>;
+export declare class PackTooLargeError extends Error {
+    bytes: number;
+    limit: number;
+    constructor(bytes: number, limit: number);
+}
+export interface BuildPackOptions {
+    /** Override the size cap. Defaults to MAX_PACK_BYTES. */
+    maxBytes?: number;
+}
+/**
+ * Produce a packfile covering `<expectedSha>..<newSha>` — i.e. the new
+ * commit objects, their trees, and their blobs that are not already
+ * reachable from `expectedSha`. Internally:
+ *
+ *     printf '<newSha>\n^<expectedSha>\n' | git pack-objects --revs --stdout
+ *
+ * which is the canonical "pack everything reachable from newSha but not
+ * from expectedSha" recipe. Buffers the entire output to memory so we
+ * can enforce the §7 cap before shipping anything to the server.
+ *
+ * Returns an empty `Uint8Array` when `expectedSha === newSha` — there
+ * are no new commits, so `pack-objects` would either error on stdin
+ * with no candidate revs or produce an empty pack. Skipping the spawn
+ * keeps the no-op caller path simple.
+ */
+export declare function buildPack(dir: string, expectedSha: string, newSha: string, options?: BuildPackOptions): Promise<Uint8Array>;

package/dist/push/git-pack.js

@@ -0,0 +1,127 @@
+/**
+ * Pack-push primitives for the CLI clone-path flow (qfg-7429.4, §4.1
+ * of project/plans/qfg-git-commit-push-pull-improvements.md).
+ *
+ * The CLI ships actual git commit objects to app-quonfig instead of a
+ * file-delta list. This module owns the two preflight checks and the
+ * `git pack-objects` wrapper:
+ *
+ *   - `getCurrentBranch(dir)` — refuse detached HEAD and `master`
+ *     before any pack work happens. Returns the branch name to use as
+ *     the basename of `targetRef` on success.
+ *   - `buildPack(dir, expectedSha, newSha)` — produce the packfile of
+ *     `<expectedSha>..<newSha>` and return it as raw bytes. Capped at
+ *     25 MiB per §7 open Q #7; throws `PackTooLargeError` on overflow.
+ *
+ * Pure(ish): every git invocation goes through `runGit`/`spawn`. Tests
+ * stand up real tmp-dir git repos rather than mocking the shell — the
+ * pack format is too fiddly to fake convincingly.
+ */
+import { spawn } from 'node:child_process';
+import { GIT_SAFE_ARGS, GIT_SAFE_ENV, runGit } from '../util/git-ops.js';
+/** Per §7 open Q #7 of the design plan: pack size cap of 25 MiB. */
+export const MAX_PACK_BYTES = 25 * 1024 * 1024;
+/**
+ * Resolve HEAD via `git symbolic-ref HEAD`. Empty/failed resolution
+ * means detached HEAD (per §4.1 step 1). `master` is treated as a
+ * structural workspace error rather than a transient one — the
+ * workspace template uses `main`, and a `master` checkout is almost
+ * always a leftover from cloning a non-Quonfig template.
+ */
+export async function getCurrentBranch(dir) {
+    let stdout;
+    try {
+        const res = await runGit(['-C', dir, 'symbolic-ref', '--quiet', '--short', 'HEAD']);
+        stdout = res.stdout.trim();
+    }
+    catch {
+        return { kind: 'detached', message: 'qfg push requires a checked-out branch.' };
+    }
+    if (stdout.length === 0) {
+        return { kind: 'detached', message: 'qfg push requires a checked-out branch.' };
+    }
+    if (stdout === 'master') {
+        return {
+            kind: 'master',
+            message: 'Quonfig workspaces use `main`; rename with `git branch -m master main`.',
+        };
+    }
+    return { kind: 'branch', name: stdout };
+}
+export class PackTooLargeError extends Error {
+    bytes;
+    limit;
+    constructor(bytes, limit) {
+        super(`Pack exceeds ${limit} bytes (got ${bytes} bytes). Reduce the size of new commits or split them across multiple pushes.`);
+        this.name = 'PackTooLargeError';
+        this.bytes = bytes;
+        this.limit = limit;
+    }
+}
+/**
+ * Produce a packfile covering `<expectedSha>..<newSha>` — i.e. the new
+ * commit objects, their trees, and their blobs that are not already
+ * reachable from `expectedSha`. Internally:
+ *
+ *     printf '<newSha>\n^<expectedSha>\n' | git pack-objects --revs --stdout
+ *
+ * which is the canonical "pack everything reachable from newSha but not
+ * from expectedSha" recipe. Buffers the entire output to memory so we
+ * can enforce the §7 cap before shipping anything to the server.
+ *
+ * Returns an empty `Uint8Array` when `expectedSha === newSha` — there
+ * are no new commits, so `pack-objects` would either error on stdin
+ * with no candidate revs or produce an empty pack. Skipping the spawn
+ * keeps the no-op caller path simple.
+ */
+export async function buildPack(dir, expectedSha, newSha, options = {}) {
+    if (expectedSha === newSha) {
+        return new Uint8Array(0);
+    }
+    const limit = options.maxBytes ?? MAX_PACK_BYTES;
+    return new Promise((resolve, reject) => {
+        const env = { ...process.env, ...GIT_SAFE_ENV };
+        const args = [...GIT_SAFE_ARGS, '-C', dir, 'pack-objects', '--revs', '--stdout'];
+        const child = spawn('git', args, { env, stdio: ['pipe', 'pipe', 'pipe'] });
+        const chunks = [];
+        let totalBytes = 0;
+        let stderr = '';
+        let killedForOverflow = false;
+        child.stdout.on('data', (chunk) => {
+            totalBytes += chunk.byteLength;
+            if (totalBytes > limit) {
+                if (!killedForOverflow) {
+                    killedForOverflow = true;
+                    child.kill('SIGKILL');
+                }
+                return;
+            }
+            chunks.push(chunk);
+        });
+        child.stderr.on('data', (chunk) => {
+            stderr += chunk.toString();
+        });
+        child.on('error', (err) => reject(err));
+        child.on('close', (code, signal) => {
+            if (killedForOverflow) {
+                reject(new PackTooLargeError(totalBytes, limit));
+                return;
+            }
+            if (code !== 0) {
+                reject(new Error(`git pack-objects exited ${code ?? signal}: ${stderr}`));
+                return;
+            }
+            const out = Buffer.concat(chunks, totalBytes);
+            // Defensive: if git produced more than the limit but stayed under
+            // a chunk boundary that triggered our SIGKILL, double-check here.
+            if (out.byteLength > limit) {
+                reject(new PackTooLargeError(out.byteLength, limit));
+                return;
+            }
+            resolve(new Uint8Array(out.buffer, out.byteOffset, out.byteLength));
+        });
+        // Feed the rev-list spec on stdin: include newSha, exclude expectedSha.
+        // `--revs` tells pack-objects to read this as `git rev-list` would.
+        child.stdin.end(`${newSha}\n^${expectedSha}\n`);
+    });
+}

package/dist/push/identity-check.d.ts

@@ -8,18 +8,24 @@
  *
  *   A. Requested target   — slug or UUID the user asked for (--workspace or profile default)
  *   B. Repo pin           — `workspace` slug from `quonfig.json`, if present
- *   C. Remote origin      — `remote.origin.url` on the local git repo, if present
+ *   C. Remote URLs        — `git remote -v` URLs on the local repo, if any
  *
  * ...and the canonical `backend` identity (the workspace the gitea.token
  * response was minted for). This module cross-checks them and returns one of:
  *
  *   - ok                                    all defined signals agree
- *   - abort                                 any two defined signals disagree
+ *   - abort                                 any defined signal disagrees
  *   - requires-typed-slug-confirmation      the repo is unpinned and has no
- *                                           origin, so only the requested
+ *                                           remotes, so only the requested
  *                                           target supports our identity —
  *                                           we demand the user type the slug
  *
+ * Multi-remote support (qfg-glrd.3): customers often use GitHub for PR review
+ * (origin = github.com/their-org/configs) and a secondary remote for Quonfig.
+ * As long as ANY configured remote matches the backend's repo URL, the remote
+ * signal is `match`. Only when every configured remote points elsewhere do we
+ * abort — and the abort details list every remote that was considered.
+ *
  * The module is intentionally pure: no I/O, no prompting, no UI. The UI layer
  * (confirm prompts, diff summary) and the data-fetch layer (reading quonfig.json,
  * shelling out to git, calling gitea.token) live elsewhere.
@@ -31,8 +37,13 @@ export interface IdentityCheckInput {
         workspaceId: string;
         repoUrl: string;
     };
-    /** "C. Remote origin" — the origin URL on the local git repo, if present. */
-    remoteOriginUrl: string | undefined;
+    /**
+     * "C. Remote URLs" — every configured `git remote` URL on the local repo.
+     * Empty array means "no remotes configured" (either not a git repo, or a
+     * fresh repo with no remotes). Length ≥ 1 means at least one remote must
+     * match the backend's repo URL.
+     */
+    remoteUrls: string[];
     /** "B. Repo pin" — slug from `quonfig.json.workspace`, if present. */
     repoPinSlug: string | undefined;
     /** "A. Requested target" — what the user asked for. Slug or UUID. */
@@ -44,10 +55,20 @@ export type IdentityCheckOutcome = {
 } | {
     kind: 'abort';
     reason: string;
-    details: Record<string, string>;
+    details: Record<string, string | string[]>;
 } | {
     kind: 'requires-typed-slug-confirmation';
     canonicalSlug: string;
     reason: string;
 };
 export declare function checkIdentity(input: IdentityCheckInput): IdentityCheckOutcome;
+/**
+ * Walk a list of configured git remote URLs and return the first one that
+ * normalizes to the same repo as `backendRepoUrl`. Returns `undefined` if no
+ * configured remote matches.
+ *
+ * Useful for callers that have already resolved the backend and want to know
+ * *which* remote authenticated against it (e.g. `qfg pull` updating the URL
+ * to embed a fresh token).
+ */
+export declare function findQuonfigRemote(remotes: string[], backendRepoUrl: string): string | undefined;

package/dist/push/identity-check.js

@@ -8,18 +8,24 @@
  *
  *   A. Requested target   — slug or UUID the user asked for (--workspace or profile default)
  *   B. Repo pin           — `workspace` slug from `quonfig.json`, if present
- *   C. Remote origin      — `remote.origin.url` on the local git repo, if present
+ *   C. Remote URLs        — `git remote -v` URLs on the local repo, if any
  *
  * ...and the canonical `backend` identity (the workspace the gitea.token
  * response was minted for). This module cross-checks them and returns one of:
  *
  *   - ok                                    all defined signals agree
- *   - abort                                 any two defined signals disagree
+ *   - abort                                 any defined signal disagrees
  *   - requires-typed-slug-confirmation      the repo is unpinned and has no
- *                                           origin, so only the requested
+ *                                           remotes, so only the requested
  *                                           target supports our identity —
  *                                           we demand the user type the slug
  *
+ * Multi-remote support (qfg-glrd.3): customers often use GitHub for PR review
+ * (origin = github.com/their-org/configs) and a secondary remote for Quonfig.
+ * As long as ANY configured remote matches the backend's repo URL, the remote
+ * signal is `match`. Only when every configured remote points elsewhere do we
+ * abort — and the abort details list every remote that was considered.
+ *
  * The module is intentionally pure: no I/O, no prompting, no UI. The UI layer
  * (confirm prompts, diff summary) and the data-fetch layer (reading quonfig.json,
  * shelling out to git, calling gitea.token) live elsewhere.
@@ -63,12 +69,36 @@ const resolvePin = (pin, backend) => {
         return 'match';
     return 'mismatch';
 };
-const resolveOrigin = (origin, backend) => {
-    const a = normalizeRemoteUrl(origin);
-    const b = normalizeRemoteUrl(backend.repoUrl);
-    if (!a || !b)
+/**
+ * Resolve the remote signal: any single configured remote that normalizes to
+ * the backend's repo URL counts as a `match`. If we hit at least one such
+ * match, the overall resolution is `match` regardless of how many other
+ * remotes are configured. Otherwise, if every remote is either a clean
+ * mismatch or malformed, the resolution is `mismatch` — the user's git
+ * config doesn't agree with the workspace we're pushing to.
+ */
+const resolveRemotes = (remotes, backend) => {
+    const target = normalizeRemoteUrl(backend.repoUrl);
+    if (!target)
         return 'malformed';
-    return a === b ? 'match' : 'mismatch';
+    let sawMalformed = false;
+    for (const remote of remotes) {
+        const normalized = normalizeRemoteUrl(remote);
+        if (!normalized) {
+            sawMalformed = true;
+            continue;
+        }
+        if (normalized === target)
+            return 'match';
+    }
+    // No remote matched. If every remote was malformed and we never saw a
+    // resolvable mismatch, surface the malformed case so the abort message
+    // can speak about unreadable URLs specifically. Otherwise it's a plain
+    // mismatch — none of the configured remotes point at us.
+    if (sawMalformed && remotes.every((r) => normalizeRemoteUrl(r) === undefined)) {
+        return 'malformed';
+    }
+    return 'mismatch';
 };
 export function checkIdentity(input) {
     if (!input.requestedTarget || input.requestedTarget.length === 0) {
@@ -81,15 +111,18 @@ export function checkIdentity(input) {
     const backend = input.backend;
     const requested = resolveRequested(input.requestedTarget, backend);
     const pin = input.repoPinSlug === undefined ? undefined : resolvePin(input.repoPinSlug, backend);
-    const origin = input.remoteOriginUrl === undefined ? undefined : resolveOrigin(input.remoteOriginUrl, backend);
-    // Judgment call (flagged in tests): a malformed origin URL is a signal we
-    // cannot resolve. We treat it as `mismatch` rather than `missing` so the
-    // guard aborts — it is safer to refuse a push with an unreadable remote
-    // than to silently drop that signal and rely on the pin alone.
+    // Empty `remoteUrls` means "no remotes configured" — we have no signal to
+    // resolve, identical to the old `remoteOriginUrl === undefined` case.
+    const remote = input.remoteUrls.length === 0 ? undefined : resolveRemotes(input.remoteUrls, backend);
+    // Judgment call (flagged in tests): a malformed remote with no resolvable
+    // alternative is a signal we cannot resolve. We treat it as `mismatch`
+    // rather than `missing` so the guard aborts — it is safer to refuse a push
+    // with an unreadable remote than to silently drop that signal and rely on
+    // the pin alone.
     const signalLabels = {
         requested,
         pin,
-        origin,
+        remote,
     };
     // Collect which sources disagree with the backend (or are malformed).
     const disagreeing = [];
@@ -110,9 +143,11 @@ export function checkIdentity(input) {
         details.repoPinSlug = input.repoPinSlug;
         details.pinResolution = pin;
     }
-    if (input.remoteOriginUrl !== undefined) {
-        details.remoteOriginUrl = input.remoteOriginUrl;
-        details.originResolution = origin;
+    if (input.remoteUrls.length > 0) {
+        // Surface every remote URL that was considered. When multiple remotes
+        // disagree the user needs to see each one to figure out which to fix.
+        details.remoteUrls = input.remoteUrls;
+        details.remoteResolution = remote;
     }
     if (disagreeing.length > 0) {
         // Any single defined source pointing somewhere other than the backend is
@@ -124,12 +159,32 @@ export function checkIdentity(input) {
     }
     // No disagreement among defined sources. Are we in the "bare dir" case
     // where only the requested target speaks for identity?
-    if (input.repoPinSlug === undefined && input.remoteOriginUrl === undefined) {
+    if (input.repoPinSlug === undefined && input.remoteUrls.length === 0) {
         return {
             kind: 'requires-typed-slug-confirmation',
             canonicalSlug: backend.workspaceSlug,
-            reason: 'Local directory has no workspace pin and no git origin — cannot cross-check the requested target. Confirm by typing the workspace slug.',
+            reason: 'Local directory has no workspace pin and no git remotes — cannot cross-check the requested target. Confirm by typing the workspace slug.',
         };
     }
     return { kind: 'ok', canonicalSlug: backend.workspaceSlug };
 }
+/**
+ * Walk a list of configured git remote URLs and return the first one that
+ * normalizes to the same repo as `backendRepoUrl`. Returns `undefined` if no
+ * configured remote matches.
+ *
+ * Useful for callers that have already resolved the backend and want to know
+ * *which* remote authenticated against it (e.g. `qfg pull` updating the URL
+ * to embed a fresh token).
+ */
+export function findQuonfigRemote(remotes, backendRepoUrl) {
+    const target = normalizeRemoteUrl(backendRepoUrl);
+    if (!target)
+        return undefined;
+    for (const remote of remotes) {
+        const normalized = normalizeRemoteUrl(remote);
+        if (normalized === target)
+            return remote;
+    }
+    return undefined;
+}