@quonfig/cli 0.4.0 → 0.6.0

package/dist/migrate/quonfig-target/ruleset.d.ts

@@ -91,6 +91,27 @@ export interface RulesetContext {
  * becomes a dotted path (`address.city`).
  */
 export declare function normalizeAttribute(contextKind: string | undefined, attribute: string): string;
+/**
+ * Join several regex patterns into one alternation `(?:a)|(?:b)` (qfg-ktkr.6).
+ * Each alternative is wrapped in a non-capturing group so anchors and inner
+ * `|` stay scoped to their own pattern. The join adds no quantified group, so
+ * it stays inside the v1 safety rule as long as every pattern is in v1 and
+ * the length and unbounded-quantifier caps hold; returns `null` otherwise
+ * (qfg-ktkr.2: the full checkRegexV1, not just the caps).
+ */
+export declare function joinRegexAlternation(patterns: string[]): null | string;
+/**
+ * Expand a provider rule's clauses into the OR-alternatives of clause lists
+ * that preserve LaunchDarkly semantics (qfg-ktkr.6). LD ORs a clause's values;
+ * Quonfig has no within-rule OR, so a multi-value `matches` clause whose
+ * patterns cannot be joined within the v1 caps is:
+ *  - negated (matches none): split into single-pattern negated clauses ANDed
+ *    in the same rule;
+ *  - positive (matches any): fanned out into one alternative per pattern.
+ * Alternatives serve the same value, so first-match-wins over them is the OR.
+ * Returns `null` (rule dropped + reported) past MAX_SPLIT_RULES alternatives.
+ */
+export declare function expandClauses(clauses: SourceClause[], ctx: RulesetContext): null | SourceClause[][];
 /**
  * Map one provider clause to a Quonfig criterion, or `null` when the clause's
  * operator has no v1 mapping (D3 — negated comparisons, applicationVersion…).
@@ -98,12 +119,39 @@ export declare function normalizeAttribute(contextKind: string | undefined, attr
  * partial AND would silently broaden targeting.
  */
 export declare function clauseToCriterion(clause: SourceClause, ctx: RulesetContext): QuonfigCriterion | null;
+/**
+ * Map one provider clause to the Quonfig criteria it ANDs into a rule, or
+ * `null` when the clause cannot be mapped (see `clauseToCriterion`).
+ *
+ * A negated property clause (`in`, `contains`, `startsWith`, `endsWith`,
+ * `matches` with `negate: true`) gets an `IS_PRESENT` guard on the same
+ * property ANDed in front of it (qfg-goi1.5.10, operator-semantics Q6b).
+ * LaunchDarkly never matches a context that lacks the clause attribute, negated
+ * or not; Quonfig's negated operators do match a missing attribute (Q6a, kept),
+ * so without the guard a migrated rule would broaden to every context missing
+ * the attribute. Negated `segmentMatch` (NOT_IN_SEG) has no property and is not
+ * guarded. This only shapes NEW migrations; already-migrated workspaces are
+ * never rewritten.
+ */
+export declare function clauseToCriteria(clause: SourceClause, ctx: RulesetContext): QuonfigCriterion[] | null;
 /**
  * Build a Quonfig rule from a provider rule's clauses (AND semantics) plus its
  * served value. Returns `null` when any clause cannot be mapped — the rule is
  * dropped wholesale and reported, rather than silently broadened.
  */
 export declare function buildRule(clauses: SourceClause[], value: QuonfigRuleValue, ctx: RulesetContext): QuonfigRule | null;
+/**
+ * AND a clause list into criteria, or `null` when any clause is unmappable.
+ * An IS_PRESENT guard already in the list is not repeated (a split negated
+ * multi-pattern clause guards its property once).
+ */
+export declare function clausesToCriteria(clauses: SourceClause[], ctx: RulesetContext): null | QuonfigCriterion[];
+/**
+ * Build the Quonfig rules for one provider rule: `buildRule` over each
+ * alternative from `expandClauses` (qfg-ktkr.6). Usually one rule; empty when
+ * the rule is dropped (and reported).
+ */
+export declare function buildRules(clauses: SourceClause[], value: QuonfigRuleValue, ctx: RulesetContext): QuonfigRule[];
 /**
  * Convert a provider rollout to a Quonfig `weighted_values`. The experiment
  * framing (`kind: "experiment"` + `seed`) is dropped + reported (plan §5.4),

package/dist/migrate/quonfig-target/ruleset.js

@@ -8,6 +8,7 @@
  * verbs do the LaunchDarkly collapse; a second provider with a different
  * topology composes them differently.
  */
+import { checkRegexV1 } from '../../verify/regex-dialect.js';
 import { resolveKey } from '../key-rewriter.js';
 import { mapLaunchDarklyOperator } from './operators.js';
 import { toQuonfigValue } from './values.js';
@@ -41,6 +42,57 @@ export function normalizeAttribute(contextKind, attribute) {
     const dotted = attribute.replace(/^\//, '').replaceAll('/', '.');
     return `${kind}.${dotted}`;
 }
+/** Upper bound on rules one LD rule may fan out into when patterns are split. */
+const MAX_SPLIT_RULES = 16;
+/**
+ * Join several regex patterns into one alternation `(?:a)|(?:b)` (qfg-ktkr.6).
+ * Each alternative is wrapped in a non-capturing group so anchors and inner
+ * `|` stay scoped to their own pattern. The join adds no quantified group, so
+ * it stays inside the v1 safety rule as long as every pattern is in v1 and
+ * the length and unbounded-quantifier caps hold; returns `null` otherwise
+ * (qfg-ktkr.2: the full checkRegexV1, not just the caps).
+ */
+export function joinRegexAlternation(patterns) {
+    const joined = patterns.map((p) => `(?:${p})`).join('|');
+    return checkRegexV1(joined) === null ? joined : null;
+}
+/** A multi-value `matches` clause whose patterns cannot be joined within v1. */
+function isUnjoinableMatches(clause) {
+    return clause.op === 'matches' && clause.values.length > 1 && joinRegexAlternation(clause.values.map(String)) === null;
+}
+/**
+ * Expand a provider rule's clauses into the OR-alternatives of clause lists
+ * that preserve LaunchDarkly semantics (qfg-ktkr.6). LD ORs a clause's values;
+ * Quonfig has no within-rule OR, so a multi-value `matches` clause whose
+ * patterns cannot be joined within the v1 caps is:
+ *  - negated (matches none): split into single-pattern negated clauses ANDed
+ *    in the same rule;
+ *  - positive (matches any): fanned out into one alternative per pattern.
+ * Alternatives serve the same value, so first-match-wins over them is the OR.
+ * Returns `null` (rule dropped + reported) past MAX_SPLIT_RULES alternatives.
+ */
+export function expandClauses(clauses, ctx) {
+    let alternatives = [[]];
+    for (const clause of clauses) {
+        if (!isUnjoinableMatches(clause)) {
+            for (const alt of alternatives)
+                alt.push(clause);
+            continue;
+        }
+        const singles = clause.values.map((v) => ({ ...clause, values: [v] }));
+        if (clause.negate) {
+            for (const alt of alternatives)
+                alt.push(...singles);
+            continue;
+        }
+        alternatives = alternatives.flatMap((alt) => singles.map((single) => [...alt, single]));
+        if (alternatives.length > MAX_SPLIT_RULES) {
+            ctx.report.add('skipped-rule', ctx.sourceKey, `rule dropped: its regex clauses expand to more than ${MAX_SPLIT_RULES} rules (patterns too long or too complex to join within Quonfig regex v1)`);
+            return null;
+        }
+    }
+    return alternatives;
+}
 /** Build a `valueToMatch` typed value for a non-presence, non-segment clause. */
 function valueToMatchFor(operator, clause, ctx) {
     if (STRING_LIST_OPERATORS.has(operator)) {
@@ -60,6 +112,11 @@ function valueToMatchFor(operator, clause, ctx) {
     }
     if (operator === 'PROP_MATCHES' || operator === 'PROP_DOES_NOT_MATCH') {
         if (clause.values.length > 1) {
+            // LD ORs the patterns (qfg-ktkr.6). `expandClauses` splits any set too
+            // big to join, so this only falls back for a direct caller.
+            const joined = joinRegexAlternation(clause.values.map(String));
+            if (joined !== null)
+                return { type: 'string', value: joined };
             ctx.report.add('skipped-rule', ctx.sourceKey, `regex clause listed ${clause.values.length} patterns; Quonfig PROP_MATCHES takes one — only the first kept`);
         }
         return { type: 'string', value: String(clause.values[0] ?? '') };
@@ -97,23 +154,92 @@ export function clauseToCriterion(clause, ctx) {
         ? { operator }
         : { operator, propertyName: normalizeAttribute(clause.contextKind, clause.attribute) };
     criterion.valueToMatch = valueToMatchFor(operator, clause, ctx);
+    // qfg-ktkr.2: a pattern outside Quonfig regex v1 would be refused by
+    // `qfg verify` and the Git hook, so drop the rule and report why instead of
+    // writing a file nobody can push.
+    if ((operator === 'PROP_MATCHES' || operator === 'PROP_DOES_NOT_MATCH') && criterion.valueToMatch) {
+        const pattern = String(criterion.valueToMatch.value);
+        const violation = checkRegexV1(pattern);
+        if (violation) {
+            ctx.report.add('skipped-rule', ctx.sourceKey, `regex clause on "${clause.attribute}" skipped: pattern "${pattern}" is outside Quonfig regex v1 (${violation.reason}). ${violation.hint}`);
+            return null;
+        }
+    }
     return criterion;
 }
+/**
+ * Map one provider clause to the Quonfig criteria it ANDs into a rule, or
+ * `null` when the clause cannot be mapped (see `clauseToCriterion`).
+ *
+ * A negated property clause (`in`, `contains`, `startsWith`, `endsWith`,
+ * `matches` with `negate: true`) gets an `IS_PRESENT` guard on the same
+ * property ANDed in front of it (qfg-goi1.5.10, operator-semantics Q6b).
+ * LaunchDarkly never matches a context that lacks the clause attribute, negated
+ * or not; Quonfig's negated operators do match a missing attribute (Q6a, kept),
+ * so without the guard a migrated rule would broaden to every context missing
+ * the attribute. Negated `segmentMatch` (NOT_IN_SEG) has no property and is not
+ * guarded. This only shapes NEW migrations; already-migrated workspaces are
+ * never rewritten.
+ */
+export function clauseToCriteria(clause, ctx) {
+    const criterion = clauseToCriterion(clause, ctx);
+    if (criterion === null)
+        return null;
+    if (clause.negate && criterion.propertyName !== undefined) {
+        return [{ operator: 'IS_PRESENT', propertyName: criterion.propertyName }, criterion];
+    }
+    return [criterion];
+}
 /**
  * Build a Quonfig rule from a provider rule's clauses (AND semantics) plus its
  * served value. Returns `null` when any clause cannot be mapped — the rule is
  * dropped wholesale and reported, rather than silently broadened.
  */
 export function buildRule(clauses, value, ctx) {
+    const criteria = clausesToCriteria(clauses, ctx);
+    if (criteria === null)
+        return null;
+    // A rule with no clauses matches everyone — represent that as ALWAYS_TRUE.
+    return { criteria: criteria.length > 0 ? criteria : [ALWAYS_TRUE], value };
+}
+/**
+ * AND a clause list into criteria, or `null` when any clause is unmappable.
+ * An IS_PRESENT guard already in the list is not repeated (a split negated
+ * multi-pattern clause guards its property once).
+ */
+export function clausesToCriteria(clauses, ctx) {
     const criteria = [];
     for (const clause of clauses) {
-        const criterion = clauseToCriterion(clause, ctx);
-        if (criterion === null)
+        const mapped = clauseToCriteria(clause, ctx);
+        if (mapped === null)
             return null;
-        criteria.push(criterion);
+        for (const c of mapped) {
+            const duplicateGuard = c.operator === 'IS_PRESENT' &&
+                criteria.some((e) => e.operator === 'IS_PRESENT' && e.propertyName === c.propertyName);
+            if (!duplicateGuard)
+                criteria.push(c);
+        }
     }
-    // A rule with no clauses matches everyone — represent that as ALWAYS_TRUE.
-    return { criteria: criteria.length > 0 ? criteria : [ALWAYS_TRUE], value };
+    return criteria;
+}
+/**
+ * Build the Quonfig rules for one provider rule: `buildRule` over each
+ * alternative from `expandClauses` (qfg-ktkr.6). Usually one rule; empty when
+ * the rule is dropped (and reported).
+ */
+export function buildRules(clauses, value, ctx) {
+    const alternatives = expandClauses(clauses, ctx);
+    if (alternatives === null)
+        return [];
+    const rules = [];
+    for (const alt of alternatives) {
+        const rule = buildRule(alt, value, ctx);
+        // An unmappable clause fails every alternative alike — report it once.
+        if (rule === null)
+            return [];
+        rules.push(rule);
+    }
+    return rules;
 }
 /** Resolve a variation index to its typed Quonfig value. */
 function variationValue(index, ctx) {
@@ -202,9 +328,7 @@ export function collapseEnvironment(env, ctx) {
     }
     for (const rule of env.rules ?? []) {
         const value = rule.rollout === undefined ? variationValue(rule.variation ?? 0, ctx) : rolloutToWeightedValues(rule.rollout, ctx);
-        const built = buildRule(rule.clauses, value, ctx);
-        if (built !== null)
-            rules.push(built);
+        rules.push(...buildRules(rule.clauses, value, ctx));
     }
     if (env.fallthrough) {
         rules.push({ criteria: [ALWAYS_TRUE], value: servedValue(env.fallthrough, ctx) });

package/dist/migrate/sources/flagsmith/translate.js

@@ -15,6 +15,7 @@
  * mutable state. Report accumulation flows through the `ConversionReport`
  * argument supplied by the caller (the `flagsmith.ts` source).
  */
+import { checkRegexV1 } from '../../../verify/regex-dialect.js';
 import { resolveKey } from '../../key-rewriter.js';
 import { inferValueType, toQuonfigValue } from '../../quonfig-target/values.js';
 import { normalizeImportedWeights } from '../../quonfig-target/weights.js';
@@ -270,6 +271,16 @@ export function mapCondition(condition) {
             };
         }
         case 'REGEX': {
+            // qfg-ktkr.2: a pattern outside Quonfig regex v1 would be refused by
+            // `qfg verify` and the Git hook; drop the rule with the reason instead.
+            const pattern = String(value ?? '');
+            const violation = checkRegexV1(pattern);
+            if (violation) {
+                return {
+                    drop: true,
+                    reason: `pattern "${pattern}" is outside Quonfig regex v1 (${violation.reason}). ${violation.hint}`,
+                };
+            }
             return {
                 criterion: {
                     operator: 'PROP_MATCHES',

package/dist/migrate/sources/launchdarkly/translate.js

@@ -9,7 +9,7 @@
  * plan §5.4.
  */
 import { resolveKey } from '../../key-rewriter.js';
-import { clauseToCriterion, collapseEnvironment, } from '../../quonfig-target/ruleset.js';
+import { clausesToCriteria, collapseEnvironment, expandClauses, } from '../../quonfig-target/ruleset.js';
 import { inferFlagValueType, toQuonfigValue } from '../../quonfig-target/values.js';
 const ALWAYS_TRUE = { operator: 'ALWAYS_TRUE' };
 /**
@@ -202,9 +202,7 @@ export function translateSegment(segment, report) {
             rules.push(keyListRule(ic.contextKind, ic.values, true));
     }
     for (const rule of segment.rules ?? []) {
-        const built = buildSegmentRule(rule, ctx);
-        if (built !== null)
-            rules.push(built);
+        rules.push(...buildSegmentRules(rule, ctx));
     }
     // Trailing catch-all: anyone not matched above is not in the segment.
     rules.push({ criteria: [ALWAYS_TRUE], value: { type: 'bool', value: false } });
@@ -225,21 +223,26 @@ export function translateSegment(segment, report) {
     return out;
 }
 /**
- * Build a Quonfig rule from a LaunchDarkly segment rule. A segment rule's
+ * Build the Quonfig rules for a LaunchDarkly segment rule. A segment rule's
  * clauses AND together and the rule means "in the segment". A rule-level
  * `weight` is a percentage of matching contexts — converted to a
- * `weighted_values` bool split (and reported as re-bucketing). Returns `null`
+ * `weighted_values` bool split (and reported as re-bucketing). Usually one
+ * rule; several when a multi-pattern `matches` is split (qfg-ktkr.6); empty
  * when a clause cannot be mapped (the whole rule is dropped — see `buildRule`).
  */
-function buildSegmentRule(rule, ctx) {
-    // Reuse the clause-mapping verb via a tiny inline AND loop so segment rules
-    // get the exact same operator handling (and whole-rule-drop) as flag rules.
-    const criteria = [];
-    for (const clause of rule.clauses) {
-        const criterion = clauseToCriterion(clause, ctx);
-        if (criterion === null)
-            return null;
-        criteria.push(criterion);
+function buildSegmentRules(rule, ctx) {
+    // Reuse the clause-mapping verbs so segment rules get the exact same operator
+    // handling (whole-rule-drop, multi-pattern `matches` expansion — qfg-ktkr.6)
+    // as flag rules. Each alternative is its own "in the segment" rule.
+    const alternatives = expandClauses(rule.clauses, ctx);
+    if (alternatives === null)
+        return [];
+    const criteriaSets = [];
+    for (const alt of alternatives) {
+        const criteria = clausesToCriteria(alt, ctx);
+        if (criteria === null)
+            return [];
+        criteriaSets.push(criteria);
     }
     const value = rule.weight === undefined
         ? { type: 'bool', value: true }
@@ -258,5 +261,5 @@ function buildSegmentRule(rule, ctx) {
     if (rule.weight !== undefined) {
         ctx.report.add('rebucketed-rollout', ctx.sourceKey, `segment rule has a ${rule.weight / 1000}% weight — converted to a weighted bool split; users will be re-bucketed`);
     }
-    return { criteria: criteria.length > 0 ? criteria : [ALWAYS_TRUE], value };
+    return criteriaSets.map((criteria) => ({ criteria: criteria.length > 0 ? criteria : [ALWAYS_TRUE], value }));
 }

package/dist/push/git-pack.d.ts

@@ -17,6 +17,8 @@
  * stand up real tmp-dir git repos rather than mocking the shell — the
  * pack format is too fiddly to fake convincingly.
  */
+/** `expectedSha` for a branch the server does not have yet. */
+export declare const ZERO_OID = "0000000000000000000000000000000000000000";
 /** Per §7 open Q #7 of the design plan: pack size cap of 25 MiB. */
 export declare const MAX_PACK_BYTES: number;
 /**
@@ -62,6 +64,16 @@ export interface BuildPackOptions {
  * from expectedSha" recipe. Buffers the entire output to memory so we
  * can enforce the §7 cap before shipping anything to the server.
  *
+ * For a brand-new branch `expectedSha` is {@link ZERO_OID}, which is not
+ * an object git can exclude (qfg-b1eo). Then the pack excludes everything
+ * reachable from the `origin/*` remote-tracking refs, i.e. what the server
+ * already has, and with no such refs it carries the full history:
+ *
+ *     printf '<newSha>\n^<origin ref sha>\n…' | git pack-objects --revs --stdout
+ *
+ * (pack-objects' stdin takes revs and `--not` only, not `--remotes`, so
+ * the refs are resolved with `git for-each-ref` first.)
+ *
  * Returns an empty `Uint8Array` when `expectedSha === newSha` — there
  * are no new commits, so `pack-objects` would either error on stdin
  * with no candidate revs or produce an empty pack. Skipping the spawn

package/dist/push/git-pack.js

@@ -19,6 +19,8 @@
  */
 import { spawn } from 'node:child_process';
 import { GIT_SAFE_ARGS, GIT_SAFE_ENV, runGit } from '../util/git-ops.js';
+/** `expectedSha` for a branch the server does not have yet. */
+export const ZERO_OID = '0000000000000000000000000000000000000000';
 /** Per §7 open Q #7 of the design plan: pack size cap of 25 MiB. */
 export const MAX_PACK_BYTES = 25 * 1024 * 1024;
 /**
@@ -69,6 +71,16 @@ export class PackTooLargeError extends Error {
  * from expectedSha" recipe. Buffers the entire output to memory so we
  * can enforce the §7 cap before shipping anything to the server.
  *
+ * For a brand-new branch `expectedSha` is {@link ZERO_OID}, which is not
+ * an object git can exclude (qfg-b1eo). Then the pack excludes everything
+ * reachable from the `origin/*` remote-tracking refs, i.e. what the server
+ * already has, and with no such refs it carries the full history:
+ *
+ *     printf '<newSha>\n^<origin ref sha>\n…' | git pack-objects --revs --stdout
+ *
+ * (pack-objects' stdin takes revs and `--not` only, not `--remotes`, so
+ * the refs are resolved with `git for-each-ref` first.)
+ *
  * Returns an empty `Uint8Array` when `expectedSha === newSha` — there
  * are no new commits, so `pack-objects` would either error on stdin
  * with no candidate revs or produce an empty pack. Skipping the spawn
@@ -79,6 +91,7 @@ export async function buildPack(dir, expectedSha, newSha, options = {}) {
         return new Uint8Array(0);
     }
     const limit = options.maxBytes ?? MAX_PACK_BYTES;
+    const excludes = expectedSha === ZERO_OID ? await originRefShas(dir) : [expectedSha];
     return new Promise((resolve, reject) => {
         const env = { ...process.env, ...GIT_SAFE_ENV };
         const args = [...GIT_SAFE_ARGS, '-C', dir, 'pack-objects', '--revs', '--stdout'];
@@ -120,8 +133,19 @@ export async function buildPack(dir, expectedSha, newSha, options = {}) {
             }
             resolve(new Uint8Array(out.buffer, out.byteOffset, out.byteLength));
         });
-        // Feed the rev-list spec on stdin: include newSha, exclude expectedSha.
-        // `--revs` tells pack-objects to read this as `git rev-list` would.
-        child.stdin.end(`${newSha}\n^${expectedSha}\n`);
+        // Feed the rev-list spec on stdin: include newSha, exclude expectedSha
+        // (or, for a new branch, the origin/* refs). `--revs` tells
+        // pack-objects to read this as `git rev-list` would.
+        child.stdin.end([newSha, ...excludes.map((sha) => `^${sha}`)].map((line) => `${line}\n`).join(''));
     });
 }
+/** Commit SHAs of the `origin/*` remote-tracking refs (deduped). */
+async function originRefShas(dir) {
+    const res = await runGit(['-C', dir, 'for-each-ref', '--format=%(objectname)', 'refs/remotes/origin']);
+    return [
+        ...new Set(res.stdout
+            .split('\n')
+            .map((l) => l.trim())
+            .filter((l) => l.length > 0)),
+    ];
+}

package/dist/push/run-push.d.ts

@@ -19,7 +19,8 @@
  * confirmation — that prompt is the destructive-change brake.
  */
 import { FileDelta } from './diff-summary.js';
-import type { CurrentBranchResult } from './git-pack.js';
+import { type CurrentBranchResult } from './git-pack.js';
+/** All-zeros object id, the git-protocol convention for "no such ref". */
 export interface GiteaTokenMintResult {
     expiresAt: string | null;
     repoUrl: string;

package/dist/push/run-push.js

@@ -24,8 +24,7 @@ import { readWorkspaceSlug, tryParseWorkspacePin, writeWorkspaceSlug } from '../
 import { checkIdentity } from './identity-check.js';
 import { confirmTypedSlug, confirmYesNo } from './confirm.js';
 import { summarizeDiff } from './diff-summary.js';
-/** All-zeros object id, the git-protocol convention for "no such ref". */
-const ZERO_OID = '0000000000000000000000000000000000000000';
+import { ZERO_OID } from './git-pack.js';
 export class PushFatalError extends Error {
     code;
     constructor(message, code = 'PUSH_FATAL') {

package/dist/ui/get-confirmation.d.ts

@@ -1,7 +1,16 @@
+import type { PromptContext } from './get-string.js';
 export declare const confirmFlag: {
     confirm: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
 };
-declare const getConfirmation: ({ flags, message, }: {
+/**
+ * Ask a yes/no question; Enter alone answers no.
+ *
+ * Uses @inquirer/prompts' `confirm`, which reads in raw mode. oclif's
+ * `ux.confirm` read a cooked line, so under a pty the terminal echoed a stray
+ * `^D` before the success line (qfg-r3a47).
+ */
+declare const getConfirmation: ({ context, flags, message, }: {
+    context?: PromptContext;
     flags: {
         confirm?: boolean;
         interactive?: boolean;

package/dist/ui/get-confirmation.js

@@ -1,12 +1,21 @@
-import { Flags, ux } from '@oclif/core';
+import { confirm } from '@inquirer/prompts';
+import { Flags } from '@oclif/core';
 import isInteractive from '../util/is-interactive.js';
 export const confirmFlag = { confirm: Flags.boolean({ description: 'confirm without prompt' }) };
-const getConfirmation = async ({ flags, message, }) => {
+/**
+ * Ask a yes/no question; Enter alone answers no.
+ *
+ * Uses @inquirer/prompts' `confirm`, which reads in raw mode. oclif's
+ * `ux.confirm` read a cooked line, so under a pty the terminal echoed a stray
+ * `^D` before the success line (qfg-r3a47).
+ */
+const getConfirmation = async ({ context, flags, message, }) => {
     if (flags.confirm)
         return true;
-    if (!isInteractive(flags)) {
+    // A caller-supplied context (tests) brings its own streams instead of the TTY.
+    if (!context && !isInteractive(flags)) {
         throw new Error('Cannot prompt for confirmation in a non-interactive context. Pass --confirm to skip the confirmation prompt.');
     }
-    return ux.confirm(message);
+    return confirm({ default: false, message }, context);
 };
 export default getConfirmation;

package/dist/ui/get-string.d.ts

@@ -1,5 +1,22 @@
-declare const getString: ({ allowBlank, message }: {
+/** Streams for the masked prompt; tests pass their own instead of the TTY. */
+export type PromptContext = {
+    input?: NodeJS.ReadableStream;
+    output?: NodeJS.WritableStream;
+};
+/**
+ * Prompt for a string.
+ *
+ * `mask: true` (secret values, qfg-38lp) never echoes what is typed: each
+ * character shows as `*`. It uses @inquirer/prompts' `password`, which reads
+ * through readline with a muted output stream. oclif's `ux.prompt({type:
+ * 'mask'})` was used before and was not safe: it wrote each typed character
+ * and only redrew `*` after Enter (so the plaintext stayed in scrollback and
+ * terminal logs), and it hung when a paste delivered "value\r" in one chunk.
+ */
+declare const getString: ({ allowBlank, context, mask, message, }: {
     allowBlank: boolean;
+    context?: PromptContext;
+    mask?: boolean;
     message: string;
 }) => Promise<string>;
 export default getString;

package/dist/ui/get-string.js

@@ -1,8 +1,23 @@
+import { password } from '@inquirer/prompts';
 import { ux } from '@oclif/core';
-const getString = async ({ allowBlank, message }) => {
-    const options = {
-        required: !allowBlank,
-    };
-    return ux.prompt(message, options);
+/**
+ * Prompt for a string.
+ *
+ * `mask: true` (secret values, qfg-38lp) never echoes what is typed: each
+ * character shows as `*`. It uses @inquirer/prompts' `password`, which reads
+ * through readline with a muted output stream. oclif's `ux.prompt({type:
+ * 'mask'})` was used before and was not safe: it wrote each typed character
+ * and only redrew `*` after Enter (so the plaintext stayed in scrollback and
+ * terminal logs), and it hung when a paste delivered "value\r" in one chunk.
+ */
+const getString = async ({ allowBlank, context, mask, message, }) => {
+    if (mask) {
+        return password({
+            mask: '*',
+            message,
+            validate: (value) => allowBlank || value.length > 0 || 'A value is required',
+        }, context);
+    }
+    return ux.prompt(message, { required: !allowBlank });
 };
 export default getString;

package/dist/ui/get-value.d.ts

@@ -4,8 +4,10 @@ interface Environment {
     id: string;
     name: string;
 }
-declare const getValue: ({ allowBlank, desiredValue, environment, flags, key, message, quonfig, }: {
+declare const getValue: ({ allowBlank, desiredValue, environment, flags, key, mask, message, quonfig, }: {
     allowBlank?: boolean;
+    /** mask the prompt input (secret values, qfg-38lp) */
+    mask?: boolean;
     desiredValue: string | undefined;
     environment?: Environment;
     flags: {

package/dist/ui/get-value.js

@@ -3,15 +3,15 @@ import { failure, noop, success } from '../result.js';
 import isInteractive from '../util/is-interactive.js';
 import validateValue from '../validations/value.js';
 import getString from './get-string.js';
-const getValue = async ({ allowBlank = true, desiredValue, environment, flags, key, message, quonfig, }) => {
+const getValue = async ({ allowBlank = true, desiredValue, environment, flags, key, mask, message, quonfig, }) => {
     if (desiredValue === undefined && !isInteractive(flags)) {
-        return failure(`No value provided for ${key ?? message}. Pass --value=<value> (or use --env-var) when running non-interactively.`);
+        return failure(`No value provided for ${key ?? message}. Pass --value=<value>, --value-stdin or --value-from-env=<VAR> (or use --env-var) when running non-interactively.`);
     }
     if (!key) {
         if (desiredValue !== undefined) {
             return success(desiredValue);
         }
-        const value = await promptForValue({ allowBlank, message });
+        const value = await promptForValue({ allowBlank, mask, message });
         if (value === undefined || value === null) {
             return noop();
         }
@@ -22,7 +22,7 @@ const getValue = async ({ allowBlank = true, desiredValue, environment, flags, k
     if (!config) {
         return failure(`Could not find config named ${key}`);
     }
-    const selectedValue = desiredValue ?? (await promptForValue({ allowBlank, config, currentDefault, message }));
+    const selectedValue = desiredValue ?? (await promptForValue({ allowBlank, config, currentDefault, mask, message }));
     if (selectedValue === undefined || selectedValue === null) {
         return noop();
     }
@@ -38,11 +38,11 @@ const valueToString = (v) => {
         return '';
     return String(v.value);
 };
-const promptForValue = async ({ allowBlank, config: _config, currentDefault, message, }) => {
+const promptForValue = async ({ allowBlank, config: _config, currentDefault, mask, message, }) => {
     // In the new quonfig format, allowable values aren't stored at the config level.
     // Just prompt for a string input.
-    if (!currentDefault) {
-        return getString({ allowBlank, message });
+    if (!currentDefault || mask) {
+        return getString({ allowBlank, mask, message });
     }
     const autoCompleteMessage = `The current default is \`${valueToString(currentDefault)}\`. Enter your new default.`;
     return getString({ allowBlank, message: autoCompleteMessage });

package/dist/util/clone-and-stack-push.js

@@ -1,8 +1,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { MIGRATOR_IDENTITY, runGit as runGitSafe, spawnGit } from './git-ops.js';
+import { MIGRATOR_IDENTITY, redactToken, runGit as runGitSafe, spawnGit } from './git-ops.js';
 export { MIGRATOR_IDENTITY } from './git-ops.js';
-const redactToken = (s) => s.replaceAll(/:([^\s/@]+)@/g, ':***@');
 export class PushConflictError extends Error {
     constructor(message) {
         super(message);
@@ -54,7 +53,13 @@ const getOriginUrl = async (dir) => {
         return null;
     }
 };
-const normalizeRemoteUrl = (url) => redactToken(url.replace(/\.git$/, '').trim());
+// Compare repos without credentials: the same repo with a different (or no)
+// username/token is still the same repo. ensureCloneOrReuse re-points origin
+// at the fresh remoteUrl after a match.
+const normalizeRemoteUrl = (url) => url
+    .trim()
+    .replace(/\.git$/, '')
+    .replace(/^(https?:\/\/)[^/@]*@/i, '$1');
 const ensureCloneOrReuse = async (remoteUrl, localDir, branch) => {
     if (fs.existsSync(localDir) && (await isGitRepo(localDir))) {
         const origin = await getOriginUrl(localDir);