@shogo-ai/worker 1.0.10

package/src/lib/cloud-login.ts

@@ -0,0 +1,320 @@
+// SPDX-License-Identifier: MIT
+// Copyright (C) 2026 Shogo Technologies, Inc.
+/**
+ * CLI cloud-login — pure poll-based device flow.
+ *
+ * The CLI asks the cloud to mint a one-time pending-state, opens the
+ * bridge page in the user's browser, then polls the cloud until the
+ * bridge page approves the request — at which point the cloud returns
+ * the minted device-tagged API key exactly once and discards the
+ * state. The Shogo desktop app uses the exact same handshake (driven
+ * from `apps/desktop/src/main.ts → runCloudSignIn`); the only thing
+ * that differs is the `client=cli` URL hint we send so the bridge
+ * page renders the right copy.
+ *
+ * Sequence:
+ *   1. CLI → POST /api/cli/login/start (with device metadata)
+ *      cloud stores pending state, replies { state, userCode, authUrl,
+ *      expiresInMs, pollIntervalMs }.
+ *   2. CLI prints the URL + userCode and opens it in the browser.
+ *   3. User signs in at <cloudUrl>/auth/cli-link?state=... and clicks
+ *      "Approve". The bridge page POSTs /api/cli/login/approve which
+ *      mints the key on the cloud and pins it to `state`.
+ *   4. CLI polls GET /api/cli/login/poll?state=... at pollIntervalMs:
+ *        pending  → keep polling
+ *        approved → returns { key, email, workspace, deviceId } once,
+ *                   then the state is deleted.
+ *        denied   → user clicked "Cancel" on the bridge page.
+ *        expired  → 5-minute TTL elapsed.
+ *
+ * Notes:
+ *   - The userCode (last 6 hex of state, uppercased) is shown in both
+ *     the CLI and the browser so the user can confirm the device they
+ *     are approving matches the terminal they typed `shogo login` in.
+ *   - No localhost listener, no protocol handler, no deep links —
+ *     works behind firewalls / over SSH / from a remote tmux session.
+ */
+import { spawn } from 'node:child_process';
+import { hostname, platform as osPlatform, arch } from 'node:os';
+import pc from 'picocolors';
+import { workerUserAgent } from './user-agent.ts';
+
+export interface CloudLoginResult {
+  /** The minted shogo_sk_ key. */
+  key: string;
+  /** User email reported by cloud. */
+  email: string | null;
+  /** Workspace name the key was minted for. */
+  workspace: string | null;
+  /** Stable device id we sent up; cloud echoes it back. */
+  deviceId: string;
+}
+
+export interface CloudLoginOptions {
+  cloudUrl: string;
+  /** "cli" | "desktop" — hint sent to the cloud and echoed on the
+   * bridge page so the UI can label the approval flow correctly.
+   * Default: "cli". */
+  client?: 'cli' | 'desktop';
+  /** Override the device label shown in the dashboard. Defaults to hostname. */
+  deviceName?: string;
+  /** Override the platform string shown in the dashboard
+   * (e.g. "darwin-arm64"). Defaults to `${os.platform()}-${os.arch()}`. */
+  devicePlatform?: string;
+  /** Stable id for this machine. Caller should persist this so re-logins
+   * dedupe to the same device row. */
+  deviceId: string;
+  /** App version label sent to cloud. */
+  appVersion?: string;
+  /** Optional pre-select for the bridge picker. */
+  workspaceId?: string;
+  /** Cap on total wait — defaults to whatever the cloud says (usually 5min). */
+  timeoutMs?: number;
+  /** Browser-open behaviour. Three modes:
+   *   - undefined / true: spawn the platform default opener (open /
+   *     xdg-open / cmd start). Suitable for the CLI.
+   *   - false: never open the browser; caller surfaces the URL.
+   *   - function: custom opener (e.g. Electron's `shell.openExternal`).
+   *     Errors thrown from the function are swallowed so flaky openers
+   *     don't kill the flow — the URL is still printed via `log`. */
+  openBrowser?: boolean | ((url: string) => void | Promise<void>);
+  /** Custom logger — defaults to console.log. */
+  log?: (line: string) => void;
+  /** Override poll interval in ms. Defaults to whatever the cloud returns. */
+  pollIntervalMs?: number;
+  /** Install process-level SIGINT/SIGTERM handlers that abort the poll
+   * loop. Default: true (right for the CLI). Set false when embedding
+   * inside a long-lived host process (e.g. Electron main) where the
+   * caller already manages signal lifecycle and an unrelated Ctrl+C
+   * shouldn't unwind the host. */
+  installSignalHandlers?: boolean;
+  /** Test seam: replace the real fetch. */
+  fetchImpl?: typeof fetch;
+  /** Test seam: an AbortSignal to stop polling early. */
+  abortSignal?: AbortSignal;
+}
+
+export class CloudLoginError extends Error {
+  constructor(
+    message: string,
+    public readonly kind: 'timeout' | 'denied' | 'cancelled' | 'expired' | 'transport',
+  ) {
+    super(message);
+    this.name = 'CloudLoginError';
+  }
+}
+
+interface StartResponse {
+  ok: boolean;
+  error?: string;
+  state: string;
+  userCode: string;
+  authUrl: string;
+  expiresInMs: number;
+  pollIntervalMs: number;
+}
+
+interface PollResponse {
+  ok: boolean;
+  status: 'pending' | 'approved' | 'denied' | 'expired';
+  key?: string;
+  email?: string | null;
+  workspace?: string | null;
+  deviceId?: string;
+  error?: string;
+}
+
+export async function runCloudLogin(opts: CloudLoginOptions): Promise<CloudLoginResult> {
+  const cloudUrl = opts.cloudUrl.replace(/\/$/, '');
+  const client = opts.client ?? 'cli';
+  const deviceName = opts.deviceName ?? hostname();
+  const devicePlatform = opts.devicePlatform ?? `${osPlatform()}-${arch()}`;
+  const appVersion = opts.appVersion ?? readWorkerVersion();
+  const log = opts.log ?? ((line: string) => console.log(line));
+  const fetchImpl = opts.fetchImpl ?? fetch;
+
+  // 1. Start
+  const startRes = await fetchImpl(`${cloudUrl}/api/cli/login/start`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', 'user-agent': workerUserAgent() },
+    body: JSON.stringify({
+      deviceId: opts.deviceId,
+      deviceName,
+      devicePlatform,
+      deviceAppVersion: appVersion,
+      workspaceId: opts.workspaceId,
+      client,
+    }),
+    signal: AbortSignal.timeout(10_000),
+  }).catch((err) => {
+    throw new CloudLoginError(
+      `Cannot reach Shogo Cloud at ${cloudUrl}: ${err?.message ?? err}`,
+      'transport',
+    );
+  });
+  if (!startRes.ok) {
+    const text = await startRes.text().catch(() => '');
+    throw new CloudLoginError(
+      `Cloud rejected /api/cli/login/start (HTTP ${startRes.status}): ${text || 'no body'}`,
+      'transport',
+    );
+  }
+  const start = (await startRes.json().catch(() => ({} as any))) as StartResponse;
+  if (!start?.ok || !start.state || !start.authUrl) {
+    throw new CloudLoginError(
+      `Cloud returned a malformed start response: ${start?.error ?? JSON.stringify(start)}`,
+      'transport',
+    );
+  }
+
+  const pollIntervalMs = clampPollInterval(opts.pollIntervalMs ?? start.pollIntervalMs);
+  const timeoutMs = opts.timeoutMs ?? start.expiresInMs;
+  const deadline = Date.now() + timeoutMs;
+
+  // 2. Print + open browser
+  log('');
+  log(pc.bold('Sign in to Shogo Cloud'));
+  log(pc.dim('  cloud:     ') + cloudUrl);
+  log(pc.dim('  device:    ') + `${deviceName} (${devicePlatform})`);
+  log(pc.dim('  user code: ') + pc.cyan(start.userCode));
+  log('');
+  log('  Open this URL in your browser to approve:');
+  log('  ' + pc.cyan(start.authUrl));
+  log('');
+
+  if (opts.openBrowser !== false) {
+    if (typeof opts.openBrowser === 'function') {
+      // Caller-supplied opener (e.g. Electron `shell.openExternal`). We
+      // intentionally swallow errors here so a flaky opener doesn't
+      // kill the flow — the URL is already in `log` for copy/paste.
+      try {
+        await opts.openBrowser(start.authUrl);
+      } catch { /* user can copy/paste */ }
+    } else {
+      openInBrowser(start.authUrl).catch(() => { /* user can copy/paste */ });
+    }
+  }
+
+  log(pc.dim('Waiting for approval...'));
+
+  // 3. Poll loop
+  const installSignals = opts.installSignalHandlers ?? true;
+  const sigHandler = () => {
+    // We can't actually throw out of a signal handler — Node won't
+    // propagate it up the stack. Setting the abort signal is the right
+    // way to unwind the poll loop.
+    abortLocal.abort();
+  };
+  // Internal abort controller composes the caller's signal with our
+  // own signal-handler-driven cancellation, so the poll loop only
+  // needs to watch one signal.
+  const abortLocal = new AbortController();
+  if (opts.abortSignal) {
+    if (opts.abortSignal.aborted) abortLocal.abort();
+    else opts.abortSignal.addEventListener('abort', () => abortLocal.abort(), { once: true });
+  }
+  if (installSignals) {
+    process.once('SIGINT', sigHandler);
+    process.once('SIGTERM', sigHandler);
+  }
+
+  try {
+    while (true) {
+      if (abortLocal.signal.aborted) {
+        throw new CloudLoginError('Aborted by caller.', 'cancelled');
+      }
+      if (Date.now() >= deadline) {
+        throw new CloudLoginError(
+          `Timed out after ${Math.round(timeoutMs / 1000)}s waiting for approval.`,
+          'timeout',
+        );
+      }
+
+      const pollRes = await fetchImpl(
+        `${cloudUrl}/api/cli/login/poll?state=${encodeURIComponent(start.state)}`,
+        {
+          method: 'GET',
+          headers: { accept: 'application/json', 'user-agent': workerUserAgent() },
+          signal: AbortSignal.timeout(10_000),
+        },
+      ).catch((err) => {
+        // Soft network errors during polling shouldn't kill the flow —
+        // user might have a flaky connection. Log and back off.
+        log(pc.dim(`  (poll error: ${err?.message ?? err} — retrying)`));
+        return null;
+      });
+
+      if (pollRes && pollRes.ok) {
+        const data = (await pollRes.json().catch(() => ({} as any))) as PollResponse;
+        if (data?.status === 'approved' && data.key) {
+          return {
+            key: data.key,
+            email: data.email ?? null,
+            workspace: data.workspace ?? null,
+            deviceId: data.deviceId ?? opts.deviceId,
+          };
+        }
+        if (data?.status === 'denied') {
+          throw new CloudLoginError('Sign-in was denied in the browser.', 'denied');
+        }
+        if (data?.status === 'expired') {
+          throw new CloudLoginError('Sign-in request expired before it was approved.', 'expired');
+        }
+        // status === 'pending' (or unknown) → keep polling
+      }
+
+      await sleep(pollIntervalMs, abortLocal.signal);
+    }
+  } finally {
+    if (installSignals) {
+      process.removeListener('SIGINT', sigHandler);
+      process.removeListener('SIGTERM', sigHandler);
+    }
+  }
+}
+
+function clampPollInterval(ms: number): number {
+  if (!Number.isFinite(ms) || ms <= 0) return 2000;
+  return Math.min(Math.max(ms, 1000), 10_000);
+}
+
+function sleep(ms: number, signal?: AbortSignal): Promise<void> {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) return reject(new CloudLoginError('Aborted by caller.', 'cancelled'));
+    const t = setTimeout(() => {
+      signal?.removeEventListener('abort', onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(t);
+      reject(new CloudLoginError('Aborted by caller.', 'cancelled'));
+    };
+    signal?.addEventListener('abort', onAbort, { once: true });
+  });
+}
+
+// The build-time injected worker version (`shogo-cli/<version>`) is resolved
+// by the shared `workerUserAgent()` helper — see `./user-agent.ts` for the
+// bundler `--define` mechanism and the standalone-library fallback. It is used
+// here as the `deviceAppVersion` reported to the cloud during device login.
+function readWorkerVersion(): string {
+  return workerUserAgent();
+}
+
+function openInBrowser(url: string): Promise<void> {
+  return new Promise((resolve) => {
+    const cmd =
+      process.platform === 'darwin' ? 'open'
+      : process.platform === 'win32' ? 'cmd'
+      : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '""', url] : [url];
+    try {
+      const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+      child.on('error', () => resolve());
+      child.unref();
+      resolve();
+    } catch {
+      resolve();
+    }
+  });
+}

package/src/lib/cloud-sync-watcher.ts

@@ -0,0 +1,322 @@
+// SPDX-License-Identifier: MIT
+// Copyright (C) 2026 Shogo Technologies, Inc.
+/**
+ * Node-only filesystem watcher that pushes local edits back to Shogo
+ * Cloud via {@link CloudFileTransport}. Used by:
+ *   - `shogo project pull --watch`        (foreground sync)
+ *   - `WorkerRuntimeManager` auto-pull    (background sync alongside an
+ *                                          actively running agent-runtime)
+ *
+ * Design notes:
+ *   - Uses `node:fs.watch` recursively when available (Linux >= 20.x via
+ *     `recursive: true`, macOS, Windows) — no `chokidar` dep.
+ *   - Debounces a window of changes into a single batch upload to amortize
+ *     presign round trips. Default 1.5s.
+ *   - Skips EXCLUDED_DIRS the same way the transport does.
+ *   - Best-effort: errors are logged but never crash the watcher; the
+ *     caller's UI surfaces them.
+ */
+
+import { watch, type FSWatcher, statSync } from 'node:fs';
+import { relative, sep, posix } from 'node:path';
+import type { CloudFileTransport } from '@shogo-ai/sdk/cloud-file-transport';
+// commitAndPush is dynamically imported so this file does NOT eagerly
+// pull in git-cloner.ts at module-load. git-cloner.ts captures
+// `node:child_process` via `const execFileAsync = promisify(execFile)`
+// at load time; if cloud-sync-watcher.ts (and its tests) trigger that
+// load before git-cloner.test.ts's `mock.module('node:child_process', ...)`
+// hoist runs, the mock no longer applies to the cached `execFileAsync`.
+// Lazy resolution keeps git-cloner.ts unloaded until either a tests-
+// supplied `opts.commitAndPush` short-circuits the default, or the
+// real `flushGit` call path explicitly opts in.
+
+const DEBOUNCE_MS = 1500;
+const EXCLUDED_DIRS = new Set(['node_modules', '.git', 'dist', 'build', '.vite', '.cache']);
+/** Paths under these directories are gitignored — always route them
+ *  through the file transport even when the watcher is in 'git' mode. */
+const ALWAYS_FILE_TRANSPORT_PREFIXES = ['.shogo/'];
+
+export type WatcherSyncMode = 'git' | 'files';
+
+export interface WatcherGitOptions {
+  /** Cloud API URL. Forwarded to `commitAndPush`. */
+  apiUrl: string;
+  /** Bearer API key. */
+  apiKey: string;
+  /** Project ID. */
+  projectId: string;
+  /** Branch to push to. Default `HEAD` (current). */
+  branch?: string;
+  /** Optional author identity for the auto-commits. */
+  authorEmail?: string;
+  authorName?: string;
+}
+
+/** Signature of `commitAndPush` from `./git-cloner`. Extracted so tests
+ *  can inject a fake without resorting to module-level mocking (which
+ *  leaks across files in bun:test). */
+export type CommitAndPushFn = (opts: {
+  apiUrl: string;
+  apiKey: string;
+  projectId: string;
+  localDir: string;
+  message: string;
+  branch?: string;
+  authorEmail?: string;
+  authorName?: string;
+  logger?: Pick<Console, 'log' | 'warn' | 'error'>;
+}) => Promise<{ committed: boolean; commitSha?: string }>;
+
+export interface CloudSyncWatcherOptions {
+  /** Local directory to watch. */
+  rootDir: string;
+  /** Transport used to push uploads. Always required — `.shogo/` writes
+   *  flow through here even in git mode. */
+  transport: CloudFileTransport;
+  /** Optional debounce window in ms. Default 1500. */
+  debounceMs?: number;
+  /** Logger. Defaults to console. */
+  logger?: Pick<Console, 'log' | 'warn' | 'error'>;
+  /** Called whenever a batch flushes. Useful for progress UIs / metrics. */
+  onFlush?: (event: { uploaded: string[]; errors: number; committed?: boolean; commitSha?: string }) => void;
+  /**
+   * Sync strategy. Defaults to `'files'` to keep existing callers
+   * (manual `shogo project pull --watch`) working unchanged.
+   *
+   * In `'git'` mode the flush stages all tracked changes and pushes
+   * one commit to the cloud; `.shogo/` writes still PUT through the
+   * file transport because they're gitignored.
+   */
+  mode?: WatcherSyncMode;
+  /** Git options. Required when `mode: 'git'`. */
+  git?: WatcherGitOptions;
+  /** Override for the `commitAndPush` implementation. Tests inject a fake;
+   *  production callers leave this unset and get the real one. */
+  commitAndPush?: CommitAndPushFn;
+}
+
+/** Convert an absolute or platform-native path to a forward-slash relative path. */
+function toPosixRel(rootDir: string, abs: string): string {
+  const rel = relative(rootDir, abs);
+  if (!rel) return '';
+  return rel.split(sep).join(posix.sep);
+}
+
+function isExcluded(relPath: string): boolean {
+  if (!relPath) return true;
+  return relPath.split('/').some((part) => EXCLUDED_DIRS.has(part));
+}
+
+export class CloudSyncWatcher {
+  private readonly rootDir: string;
+  private readonly transport: CloudFileTransport;
+  private readonly debounceMs: number;
+  private readonly logger: Pick<Console, 'log' | 'warn' | 'error'>;
+  private readonly onFlush?: CloudSyncWatcherOptions['onFlush'];
+  private readonly mode: WatcherSyncMode;
+  private readonly git?: WatcherGitOptions;
+  private readonly commitAndPush: CommitAndPushFn;
+
+  private watcher: FSWatcher | null = null;
+  private pending = new Set<string>();
+  private timer: ReturnType<typeof setTimeout> | null = null;
+  private flushing = false;
+  private stopped = false;
+
+  constructor(opts: CloudSyncWatcherOptions) {
+    this.rootDir = opts.rootDir;
+    this.transport = opts.transport;
+    this.debounceMs = opts.debounceMs ?? DEBOUNCE_MS;
+    this.logger = opts.logger ?? console;
+    this.onFlush = opts.onFlush;
+    this.mode = opts.mode ?? 'files';
+    if (this.mode === 'git' && !opts.git) {
+      throw new Error('CloudSyncWatcher: mode: "git" requires the `git` option block');
+    }
+    this.git = opts.git;
+    this.commitAndPush = opts.commitAndPush ?? (async (args) => {
+      const mod = await import('./git-cloner.ts');
+      return mod.commitAndPush(args);
+    });
+  }
+
+  /**
+   * Begin watching. Throws if the directory can't be watched (e.g. it
+   * doesn't exist). Callers should wrap in try/catch.
+   */
+  start(): void {
+    if (this.watcher) return;
+    if (this.stopped) throw new Error('CloudSyncWatcher: already stopped, build a fresh instance');
+
+    // Some platforms / Node versions don't support `recursive: true`. Fall
+    // back to a non-recursive watch on the root + per-discovered-subdir
+    // watches in that case. For Linux >= 20 / macOS / Windows, the
+    // recursive variant is much cheaper and we use it by default.
+    try {
+      this.watcher = watch(this.rootDir, { recursive: true }, (eventType, filename) => {
+        if (!filename) return;
+        this.handleEvent(String(filename));
+      });
+    } catch (err: any) {
+      this.logger.warn(`[CloudSyncWatcher] recursive watch failed (${err?.message ?? err}); falling back to root-only watch.`);
+      this.watcher = watch(this.rootDir, (eventType, filename) => {
+        if (!filename) return;
+        this.handleEvent(String(filename));
+      });
+    }
+  }
+
+  /** Stop watching and flush any pending uploads. */
+  async stop(): Promise<void> {
+    if (this.stopped) return;
+    this.stopped = true;
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    if (this.watcher) {
+      try {
+        this.watcher.close();
+      } catch {
+        /* already closed */
+      }
+      this.watcher = null;
+    }
+    // Final flush so we don't lose the last edits made before SIGINT.
+    if (this.pending.size > 0) {
+      await this.flush();
+    }
+  }
+
+  private handleEvent(filenameLike: string): void {
+    if (this.stopped) return;
+    const rel = filenameLike.split(sep).join(posix.sep);
+    if (isExcluded(rel)) return;
+    // Ignore directory events — we only push file content. A directory rename
+    // shows up later as individual file events when their content is touched.
+    try {
+      const abs = `${this.rootDir}/${rel}`;
+      const stat = statSync(abs);
+      if (stat.isDirectory()) return;
+    } catch {
+      // File was deleted between the event firing and the stat — emit a
+      // delete intent. We track these as `null` markers in `pending` but
+      // since the transport doesn't have a "push pending deletes" mode
+      // we just drop them; the next `--delete-remote` push will clean
+      // them up. Documented behavior.
+      return;
+    }
+    this.pending.add(rel);
+    this.scheduleFlush();
+  }
+
+  private scheduleFlush(): void {
+    if (this.timer) return;
+    this.timer = setTimeout(() => {
+      this.timer = null;
+      void this.flush();
+    }, this.debounceMs);
+  }
+
+  private async flush(): Promise<void> {
+    if (this.flushing) {
+      // Re-schedule so we don't drop edits that arrived during the upload.
+      this.scheduleFlush();
+      return;
+    }
+    if (this.pending.size === 0) return;
+    this.flushing = true;
+    const batch = Array.from(this.pending);
+    this.pending.clear();
+    try {
+      if (this.mode === 'git') {
+        await this.flushGit(batch);
+      } else {
+        await this.flushFiles(batch);
+      }
+    } catch (err: any) {
+      this.logger.error(`[CloudSyncWatcher] flush failed: ${err?.message ?? err}`);
+      // Re-queue so we'll retry on the next tick.
+      for (const p of batch) this.pending.add(p);
+      this.scheduleFlush();
+    } finally {
+      this.flushing = false;
+    }
+  }
+
+  /**
+   * Pure file-transport flush. Used in `mode: 'files'` and as the
+   * always-on path for `.shogo/` writes when `mode: 'git'`.
+   */
+  private async flushFiles(batch: string[]): Promise<void> {
+    if (batch.length === 0) return;
+    const stats = await this.transport.uploadFiles(batch);
+    this.onFlush?.({ uploaded: batch, errors: stats.errors.length });
+    if (stats.errors.length > 0) {
+      for (const err of stats.errors) {
+        this.logger.warn(`[CloudSyncWatcher] upload ${err.path}: ${err.message}`);
+      }
+    }
+  }
+
+  /**
+   * Git-mode flush: route gitignored `.shogo/` writes through the file
+   * transport, then `git add -A && git commit && git push` everything
+   * else in one batch. This keeps the desktop checkpoint timeline in
+   * sync with what the worker's runtime is producing without having
+   * to push individual file PUTs per edit.
+   */
+  private async flushGit(batch: string[]): Promise<void> {
+    if (!this.git) throw new Error('CloudSyncWatcher: missing git options');
+    const fileTransportBatch: string[] = [];
+    const gitBatch: string[] = [];
+    for (const p of batch) {
+      if (ALWAYS_FILE_TRANSPORT_PREFIXES.some((prefix) => p === prefix.slice(0, -1) || p.startsWith(prefix))) {
+        fileTransportBatch.push(p);
+      } else {
+        gitBatch.push(p);
+      }
+    }
+
+    // Push .shogo/ first so the runtime's DB snapshot lands before
+    // any commit references that point at row IDs in it.
+    if (fileTransportBatch.length > 0) {
+      const stats = await this.transport.uploadFiles(fileTransportBatch);
+      if (stats.errors.length > 0) {
+        for (const err of stats.errors) {
+          this.logger.warn(`[CloudSyncWatcher] upload ${err.path}: ${err.message}`);
+        }
+      }
+    }
+
+    let committed = false;
+    let commitSha: string | undefined;
+    if (gitBatch.length > 0) {
+      const message = `auto: ${new Date().toISOString()}`;
+      try {
+        const res = await this.commitAndPush({
+          apiUrl: this.git.apiUrl,
+          apiKey: this.git.apiKey,
+          projectId: this.git.projectId,
+          localDir: this.rootDir,
+          message,
+          branch: this.git.branch,
+          authorEmail: this.git.authorEmail,
+          authorName: this.git.authorName,
+          logger: this.logger,
+        });
+        committed = res.committed;
+        commitSha = res.commitSha;
+      } catch (err: any) {
+        // commit/push failures bubble up so the caller's retry logic
+        // (flush() catch) re-queues the batch.
+        throw err;
+      }
+    }
+
+    this.onFlush?.({ uploaded: batch, errors: 0, committed, commitSha });
+  }
+}
+
+// Re-export for tests
+export { toPosixRel as _toPosixRel, isExcluded as _isExcluded };