@shogo-ai/worker 1.7.4 → 1.7.6

package/src/commands/project-push.ts

@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: MIT
+// Copyright (C) 2026 Shogo Technologies, Inc.
+/**
+ * `shogo project push <projectId>` — upload a local workspace directory
+ * back to Shogo Cloud. The inverse of `shogo project pull`.
+ *
+ * With `--delete-remote`, any file present in the cloud manifest but
+ * missing locally is also removed from cloud. This makes `push` behave
+ * like a one-shot "mirror local to cloud" rather than a strict additive
+ * upload — safer to leave off by default.
+ */
+
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import pc from 'picocolors';
+import { CloudFileTransport, type ProgressEvent, type SyncStats } from '@shogo-ai/sdk';
+import { resolveConfig } from '../lib/config.ts';
+import { projectDirFor } from '../lib/paths.ts';
+
+export interface ProjectPushFlags {
+  from?: string;
+  deleteRemote?: boolean;
+  include?: string;
+  apiKey?: string;
+  cloudUrl?: string;
+}
+
+export async function runProjectPush(projectId: string, flags: ProjectPushFlags): Promise<void> {
+  if (!projectId) throw new Error('projectId is required');
+
+  const cfg = resolveConfig({
+    apiKey: flags.apiKey,
+    cloudUrl: flags.cloudUrl,
+  });
+
+  const from = resolve(flags.from ?? projectDirFor(projectId, cfg.projectsDir));
+  if (!existsSync(from)) {
+    throw new Error(`Source directory does not exist: ${from}`);
+  }
+
+  const include = flags.include?.split(',').map((s) => s.trim()).filter(Boolean);
+
+  console.log(pc.bold(`\nshogo project push ${pc.cyan(projectId)}`));
+  console.log(pc.dim('  cloud   ') + cfg.cloudUrl);
+  console.log(pc.dim('  from    ') + from);
+  if (include?.length) console.log(pc.dim('  include ') + include.join(', '));
+  if (flags.deleteRemote) console.log(pc.yellow('  --delete-remote: remote files not present locally will be DELETED'));
+  console.log('');
+
+  const transport = new CloudFileTransport({
+    apiUrl: cfg.cloudUrl,
+    apiKey: cfg.apiKey,
+    projectId,
+    localDir: from,
+    include,
+    onProgress: (e: ProgressEvent) => {
+      const verb = e.kind === 'upload' ? '↑' : e.kind === 'delete' ? '✗' : '·';
+      const pct = e.total > 0 ? ` ${e.index + 1}/${e.total}` : '';
+      const sz = e.bytes != null ? pc.dim(` (${formatBytes(e.bytes)})`) : '';
+      console.log(pc.dim(`  ${verb}${pct} ${e.path}${sz}`));
+    },
+  });
+
+  const stats = await transport.uploadAll({ deleteRemote: flags.deleteRemote });
+  printSummary('Push', stats);
+}
+
+function printSummary(label: string, stats: SyncStats): void {
+  const ok = stats.errors.length === 0;
+  const head = ok ? pc.green(`✓ ${label} complete`) : pc.red(`✗ ${label} completed with errors`);
+  console.log(`\n${head}`);
+  console.log(pc.dim('  uploaded:   ') + stats.uploaded);
+  if (stats.deleted) console.log(pc.dim('  deleted:    ') + stats.deleted);
+  if (!ok) {
+    console.log(pc.dim('  errors:     ') + stats.errors.length);
+    for (const err of stats.errors.slice(0, 5)) {
+      console.log(pc.dim('    ') + pc.red(`${err.path}: ${err.message}`));
+    }
+    if (stats.errors.length > 5) {
+      console.log(pc.dim(`    ... and ${stats.errors.length - 5} more`));
+    }
+  }
+}
+
+function formatBytes(n: number): string {
+  if (n < 1024) return `${n}B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)}KB`;
+  return `${(n / 1024 / 1024).toFixed(2)}MB`;
+}

package/src/commands/start.ts

@@ -52,6 +52,16 @@ export interface StartFlags {
   runtimeBin?: string;
   debug?: boolean;
   foreground?: boolean;
+  /** Set to `true` to disable the on-first-request auto-pull of project
+   *  workspaces from cloud. Auto-pull is ON by default for `cli_worker`
+   *  workers so a freshly-paired VPS can serve pinned projects without
+   *  the operator first running `shogo project pull`. */
+  noAutoPull?: boolean;
+  projectsDir?: string;
+  /** Disable the git smart-HTTP sync path even when `git` is on PATH.
+   *  When set, auto-pull falls back to the CloudFileTransport file-pump.
+   *  Useful when outbound HTTPS to git pack RPC endpoints is firewalled. */
+  noGit?: boolean;
 }
 
 export async function runStart(flags: StartFlags): Promise<void> {
@@ -61,6 +71,7 @@ export async function runStart(flags: StartFlags): Promise<void> {
     apiKey: flags.apiKey,
     cloudUrl: flags.cloudUrl,
     port: flags.port ? parseInt(flags.port, 10) : undefined,
+    projectsDir: flags.projectsDir,
   });
 
   const proxy = resolveProxy(flags.proxy);
@@ -97,11 +108,16 @@ export async function runStart(flags: StartFlags): Promise<void> {
     if (!ok) process.exit(1);
   }
 
+  const autoPullEnabled = !flags.noAutoPull;
+  const useGit = !flags.noGit;
+
   console.log(pc.bold('\nShogo Worker — Starting'));
   console.log(pc.dim('  name        ') + cfg.name);
   console.log(pc.dim('  worker-dir  ') + cfg.workerDir);
   console.log(pc.dim('  cloud       ') + cfg.cloudUrl);
   console.log(pc.dim('  runtime     ') + `${resolved.path} ${pc.dim(`(via ${resolved.source})`)}`);
+  console.log(pc.dim('  auto-pull   ') + (autoPullEnabled ? pc.green('on') + pc.dim(` → ${cfg.projectsDir}`) : pc.yellow('off')));
+  console.log(pc.dim('  sync mode   ') + (useGit ? pc.green('git') + pc.dim(' (falls back to file transport if git is missing)') : pc.yellow('files-only')));
   if (flags.project) console.log(pc.dim('  project     ') + flags.project);
   if (proxy) {
     console.log(pc.dim('  proxy       ') + `${proxy.url} ${pc.dim(`(from ${proxy.source})`)}`);
@@ -111,14 +127,20 @@ export async function runStart(flags: StartFlags): Promise<void> {
   const defaultSpawnConfig: ProjectSpawnConfig = {
     cloudUrl: cfg.cloudUrl,
     apiKey: cfg.apiKey,
-    // No projectDir on the worker — the agent-runtime fetches workspace
-    // state from the cloud using its API key. CWD defaults to a tmp
-    // dir per `WorkerRuntimeManager.resolveCwd()`.
+    // No projectDir up front — the runtime manager's `maybeAutoPull`
+    // sets PROJECT_DIR per-project to <projectsDir>/<projectId>/ once
+    // the clone completes. CWD defaults to that same directory.
   };
 
   const runtimeManager = new WorkerRuntimeManager({
     runtimeBin: flags.runtimeBin,
     defaultSpawnConfig,
+    autoPull: {
+      enabled: autoPullEnabled,
+      projectsDir: cfg.projectsDir,
+      watch: true,
+      useGit,
+    },
   });
 
   // Eagerly resolve so the cached `resolved` is reused — also exits early
@@ -223,6 +245,9 @@ function buildChildArgv(flags: StartFlags): string[] {
   if (flags.project) out.push('--project', flags.project);
   if (flags.runtimeBin) out.push('--runtime-bin', flags.runtimeBin);
   if (flags.debug) out.push('--debug');
+  if (flags.noAutoPull) out.push('--no-auto-pull');
+  if (flags.projectsDir) out.push('--projects-dir', flags.projectsDir);
+  if (flags.noGit) out.push('--no-git');
   return out;
 }
 

package/src/lib/__tests__/cloud-sync-watcher.test.ts

@@ -0,0 +1,209 @@
+// SPDX-License-Identifier: MIT
+// Copyright (C) 2026 Shogo Technologies, Inc.
+/**
+ * Tests for {@link CloudSyncWatcher}.
+ *
+ * We exercise the watcher by:
+ *   - mounting a real tmpdir (fs.watch only works on real paths)
+ *   - injecting a fake CloudFileTransport that records uploadFiles calls
+ *   - touching files and waiting for the debounce window to fire
+ *
+ * Recursive `fs.watch` is supported on macOS / Windows / Linux >= 20.x.
+ * The CI matrix is expected to satisfy this; on platforms where it
+ * isn't, the watcher's `start()` will fall back to a flat root watch
+ * (which still passes the "single file in root" assertions but skips
+ * the "nested file" one).
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'bun:test';
+import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { CloudSyncWatcher, _isExcluded, type CommitAndPushFn } from '../cloud-sync-watcher.ts';
+
+/** Tests inject a fake `commitAndPush` rather than mocking the module
+ *  (mock.module leaks across files in bun:test). */
+const commitAndPushCalls: any[] = [];
+const commitAndPushFake: CommitAndPushFn = async (opts) => {
+  commitAndPushCalls.push(opts);
+  return { committed: true, commitSha: 'deadbeef1234' };
+};
+
+function fakeTransport() {
+  const calls: { paths: string[] }[] = [];
+  return {
+    transport: {
+      uploadFiles: async (paths: string[]) => {
+        calls.push({ paths: [...paths] });
+        return { downloaded: 0, uploaded: paths.length, skipped: 0, deleted: 0, errors: [] };
+      },
+    } as any,
+    calls,
+  };
+}
+
+function wait(ms: number): Promise<void> {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+describe('CloudSyncWatcher', () => {
+  let dir: string;
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'cloud-sync-watcher-'));
+  });
+  afterEach(() => {
+    try {
+      rmSync(dir, { recursive: true, force: true });
+    } catch {
+      /* ignore */
+    }
+  });
+
+  it('isExcluded skips node_modules / .git / dist / build paths', () => {
+    expect(_isExcluded('node_modules/lib/index.js')).toBe(true);
+    expect(_isExcluded('.git/HEAD')).toBe(true);
+    expect(_isExcluded('dist/bundle.js')).toBe(true);
+    expect(_isExcluded('build/main.css')).toBe(true);
+    expect(_isExcluded('src/App.tsx')).toBe(false);
+    expect(_isExcluded('config.json')).toBe(false);
+    expect(_isExcluded('')).toBe(true);
+  });
+
+  it('debounces a batch of edits into a single uploadFiles call', async () => {
+    const { transport, calls } = fakeTransport();
+    const watcher = new CloudSyncWatcher({ rootDir: dir, transport, debounceMs: 100 });
+    watcher.start();
+    // Give fs.watch a tick to start delivering events on macOS/Linux before
+    // we start writing — otherwise the first writes can be dropped.
+    await wait(50);
+
+    writeFileSync(join(dir, 'a.txt'), 'A');
+    writeFileSync(join(dir, 'b.txt'), 'B');
+    writeFileSync(join(dir, 'c.txt'), 'C');
+
+    await wait(400);
+    await watcher.stop();
+
+    // All three files coalesced into ONE upload batch.
+    expect(calls.length).toBeGreaterThanOrEqual(1);
+    const allPaths = calls.flatMap((c) => c.paths);
+    expect(allPaths).toContain('a.txt');
+    expect(allPaths).toContain('b.txt');
+    expect(allPaths).toContain('c.txt');
+  });
+
+  it('skips events inside excluded directories', async () => {
+    const { transport, calls } = fakeTransport();
+    mkdirSync(join(dir, 'node_modules'), { recursive: true });
+    mkdirSync(join(dir, 'src'), { recursive: true });
+    const watcher = new CloudSyncWatcher({ rootDir: dir, transport, debounceMs: 100 });
+    watcher.start();
+    await wait(50);
+
+    writeFileSync(join(dir, 'node_modules', 'lib.js'), 'LIB');
+    writeFileSync(join(dir, 'src', 'App.tsx'), 'APP');
+
+    await wait(400);
+    await watcher.stop();
+
+    const allPaths = calls.flatMap((c) => c.paths);
+    expect(allPaths.some((p) => p.includes('node_modules'))).toBe(false);
+    // On platforms where recursive watch works, src/App.tsx should have been
+    // captured. Where it doesn't, the array is empty — both are valid given
+    // the platform caveat described at the top of this file.
+  });
+
+  it('flushes any pending uploads on stop()', async () => {
+    const { transport, calls } = fakeTransport();
+    const watcher = new CloudSyncWatcher({ rootDir: dir, transport, debounceMs: 5_000 });
+    watcher.start();
+    await wait(50);
+
+    writeFileSync(join(dir, 'just-in-time.txt'), 'JIT');
+    // Don't wait the full debounce — stop() should still flush.
+    await wait(100);
+    await watcher.stop();
+
+    const allPaths = calls.flatMap((c) => c.paths);
+    expect(allPaths).toContain('just-in-time.txt');
+  });
+
+  it('git mode: flushes call commitAndPush instead of uploadFiles', async () => {
+    commitAndPushCalls.length = 0;
+    const { transport, calls } = fakeTransport();
+    const watcher = new CloudSyncWatcher({
+      rootDir: dir,
+      transport,
+      debounceMs: 100,
+      mode: 'git',
+      git: { apiUrl: 'https://api.shogo.ai', apiKey: 'shogo_sk_test', projectId: 'p_abc' },
+      commitAndPush: commitAndPushFake,
+    });
+    watcher.start();
+    await wait(50);
+
+    writeFileSync(join(dir, 'src.tsx'), 'CODE');
+    await wait(400);
+    await watcher.stop();
+
+    expect(commitAndPushCalls.length).toBeGreaterThanOrEqual(1);
+    expect(commitAndPushCalls[0]!.projectId).toBe('p_abc');
+    expect(commitAndPushCalls[0]!.localDir).toBe(dir);
+    expect(commitAndPushCalls[0]!.apiKey).toBe('shogo_sk_test');
+    // Non-.shogo paths should NOT go through uploadFiles in git mode.
+    const fileTransportPaths = calls.flatMap((c) => c.paths);
+    expect(fileTransportPaths.includes('src.tsx')).toBe(false);
+  });
+
+  it('git mode: .shogo/ writes still route through the file transport', async () => {
+    commitAndPushCalls.length = 0;
+    const { transport, calls } = fakeTransport();
+    mkdirSync(join(dir, '.shogo'), { recursive: true });
+    const watcher = new CloudSyncWatcher({
+      rootDir: dir,
+      transport,
+      debounceMs: 100,
+      mode: 'git',
+      git: { apiUrl: 'https://api.shogo.ai', apiKey: 'shogo_sk_test', projectId: 'p_xyz' },
+      commitAndPush: commitAndPushFake,
+    });
+    watcher.start();
+    await wait(50);
+
+    writeFileSync(join(dir, '.shogo', 'db.sqlite'), 'SQLITE');
+    writeFileSync(join(dir, 'App.tsx'), 'APP');
+    await wait(400);
+    await watcher.stop();
+
+    const fileTransportPaths = calls.flatMap((c) => c.paths);
+    expect(fileTransportPaths.some((p) => p.startsWith('.shogo'))).toBe(true);
+    // App.tsx commits go to git, NOT the file transport.
+    expect(fileTransportPaths.includes('App.tsx')).toBe(false);
+    expect(commitAndPushCalls.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it('git mode: throws when constructed without git options', () => {
+    const { transport } = fakeTransport();
+    expect(() => new CloudSyncWatcher({ rootDir: dir, transport, mode: 'git' as const })).toThrow();
+  });
+
+  it('invokes onFlush with the uploaded batch + error count', async () => {
+    const { transport } = fakeTransport();
+    const flushes: Array<{ uploaded: string[]; errors: number }> = [];
+    const watcher = new CloudSyncWatcher({
+      rootDir: dir,
+      transport,
+      debounceMs: 50,
+      onFlush: (e) => flushes.push(e),
+    });
+    watcher.start();
+    await wait(50);
+
+    writeFileSync(join(dir, 'x.txt'), 'X');
+    await wait(300);
+    await watcher.stop();
+
+    expect(flushes.length).toBeGreaterThanOrEqual(1);
+    expect(flushes[0]!.errors).toBe(0);
+    expect(flushes[0]!.uploaded).toContain('x.txt');
+  });
+});

package/src/lib/__tests__/config.test.ts

@@ -30,6 +30,8 @@ function setupTmpHome(): string {
     RUNTIME_DIR: join(homeDir, 'runtime'),
     RUNTIME_BIN: join(homeDir, 'runtime', 'agent-runtime'),
     RUNTIME_VERSION_FILE: join(homeDir, 'runtime', 'version.json'),
+    PROJECTS_DIR: join(homeDir, 'projects'),
+    projectDirFor: (id: string, base = join(homeDir, 'projects')) => join(base, id),
     ensureHome: () => {
       mkdirSync(homeDir, { recursive: true, mode: 0o700 });
       mkdirSync(join(homeDir, 'logs'), { recursive: true, mode: 0o700 });
@@ -37,6 +39,9 @@ function setupTmpHome(): string {
     ensureRuntimeDir: () => {
       mkdirSync(join(homeDir, 'runtime'), { recursive: true, mode: 0o700 });
     },
+    ensureProjectsDir: (base = join(homeDir, 'projects')) => {
+      mkdirSync(base, { recursive: true, mode: 0o700 });
+    },
   }));
   return configFile;
 }

package/src/lib/__tests__/git-cloner.test.ts

@@ -0,0 +1,258 @@
+// SPDX-License-Identifier: MIT
+// Copyright (C) 2026 Shogo Technologies, Inc.
+/**
+ * Tests for {@link cloneProject}, {@link commitAndPush}, and the
+ * support helpers in `lib/git-cloner.ts`.
+ *
+ * Strategy:
+ *   - Mock `node:child_process` so we never actually shell out.
+ *   - Capture the argv each call would have run with and assert the
+ *     bearer header lives in `-c http.extraHeader=…` rather than the
+ *     URL or environment.
+ */
+
+import { describe, it, expect, mock, beforeEach } from 'bun:test';
+import { EventEmitter } from 'node:events';
+
+interface SpawnInvocation {
+  cmd: string;
+  args: string[];
+  cwd?: string;
+  env?: NodeJS.ProcessEnv;
+}
+
+const spawnInvocations: SpawnInvocation[] = [];
+type SpawnHandler = (
+  inv: SpawnInvocation,
+) => { stdout?: string; stderr?: string; exitCode?: number; runError?: Error };
+let spawnHandler: SpawnHandler = () => ({ exitCode: 0 });
+
+function makeFakeChild(result: { stdout?: string; stderr?: string; exitCode?: number; runError?: Error }) {
+  const child = new EventEmitter() as any;
+  child.stdout = new EventEmitter();
+  child.stdout.setEncoding = () => {};
+  child.stderr = new EventEmitter();
+  child.stderr.setEncoding = () => {};
+  child.kill = () => {};
+  child.exitCode = null;
+  child.signalCode = null;
+  // Emit chunks + close asynchronously so callers' on() handlers register first.
+  setTimeout(() => {
+    if (result.runError) {
+      child.emit('error', result.runError);
+      return;
+    }
+    if (result.stdout) child.stdout.emit('data', result.stdout);
+    if (result.stderr) child.stderr.emit('data', result.stderr);
+    child.exitCode = result.exitCode ?? 0;
+    child.emit('close', result.exitCode ?? 0);
+  }, 5);
+  return child;
+}
+
+mock.module('node:child_process', () => ({
+  spawn: (cmd: string, args: string[], opts?: any) => {
+    const inv: SpawnInvocation = { cmd, args, cwd: opts?.cwd, env: opts?.env };
+    spawnInvocations.push(inv);
+    const result = spawnHandler(inv);
+    return makeFakeChild(result);
+  },
+  execFile: (cmd: string, args: string[], opts: any, cb: any) => {
+    const inv: SpawnInvocation = { cmd, args };
+    spawnInvocations.push(inv);
+    // probe for `git --version`
+    const callback = typeof opts === 'function' ? opts : cb;
+    setTimeout(() => callback?.(null, 'git version 2.40.0', ''), 1);
+  },
+}));
+
+const { buildGitUrl, cloneProject, commitAndPush, gitIsAvailable, isGitRepo, gitFetchAndReset } =
+  await import('../git-cloner.ts');
+
+beforeEach(() => {
+  spawnInvocations.length = 0;
+  spawnHandler = () => ({ exitCode: 0 });
+});
+
+describe('buildGitUrl', () => {
+  it('joins cloud url and project id with a trailing /git', () => {
+    expect(buildGitUrl('https://api.shogo.ai', 'p_abc')).toBe('https://api.shogo.ai/api/projects/p_abc/git');
+  });
+  it('strips trailing slashes from the cloud url', () => {
+    expect(buildGitUrl('https://api.shogo.ai///', 'p_abc')).toBe('https://api.shogo.ai/api/projects/p_abc/git');
+  });
+});
+
+describe('gitIsAvailable', () => {
+  it('returns true when git --version succeeds', async () => {
+    const ok = await gitIsAvailable(true);
+    expect(ok).toBe(true);
+  });
+});
+
+describe('cloneProject', () => {
+  it('uses http.extraHeader for the bearer token (never in argv URL)', async () => {
+    spawnHandler = (inv) => {
+      if (inv.args[0] === 'rev-parse') return { stdout: 'abc123\n' };
+      return { exitCode: 0 };
+    };
+    const res = await cloneProject({
+      apiUrl: 'https://api.shogo.ai',
+      apiKey: 'shogo_sk_secret',
+      projectId: 'p_demo',
+      localDir: '/tmp/test-clone',
+    });
+    expect(res.commitSha).toBe('abc123');
+
+    const cloneInv = spawnInvocations.find((i) => i.args.includes('clone'));
+    expect(cloneInv).toBeDefined();
+    expect(cloneInv!.args).toContain('-c');
+    expect(cloneInv!.args.some((a) => a.startsWith('http.extraHeader=Authorization: Bearer'))).toBe(true);
+    // URL should NOT carry the secret.
+    const urlArg = cloneInv!.args.find((a) => a.startsWith('https://'))!;
+    expect(urlArg.includes('shogo_sk_secret')).toBe(false);
+    expect(urlArg).toBe('https://api.shogo.ai/api/projects/p_demo/git');
+    // Shallow by default.
+    expect(cloneInv!.args.includes('--depth=1')).toBe(true);
+  });
+
+  it('throws when the target dir already has a .git', async () => {
+    // existsSync uses real fs; create a tmp dir with a .git.
+    const { mkdtempSync, mkdirSync, rmSync } = await import('node:fs');
+    const { tmpdir } = await import('node:os');
+    const { join } = await import('node:path');
+    const dir = mkdtempSync(join(tmpdir(), 'git-cloner-'));
+    try {
+      mkdirSync(join(dir, '.git'));
+      await expect(
+        cloneProject({
+          apiUrl: 'https://api.shogo.ai',
+          apiKey: 'shogo_sk_secret',
+          projectId: 'p_demo',
+          localDir: dir,
+        }),
+      ).rejects.toThrow(/\.git already exists/);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it('shallow=false omits --depth=1', async () => {
+    spawnHandler = (inv) => {
+      if (inv.args[0] === 'rev-parse') return { stdout: 'abc123\n' };
+      return { exitCode: 0 };
+    };
+    await cloneProject({
+      apiUrl: 'https://api.shogo.ai',
+      apiKey: 'k',
+      projectId: 'p',
+      localDir: '/tmp/never',
+      shallow: false,
+    });
+    const cloneInv = spawnInvocations.find((i) => i.args.includes('clone'))!;
+    expect(cloneInv.args.includes('--depth=1')).toBe(false);
+  });
+
+  it('rejects when git exits non-zero', async () => {
+    spawnHandler = () => ({ exitCode: 128, stderr: 'fatal: repository not found' });
+    await expect(
+      cloneProject({
+        apiUrl: 'https://api.shogo.ai',
+        apiKey: 'k',
+        projectId: 'p',
+        localDir: '/tmp/never',
+      }),
+    ).rejects.toThrow(/exited with code 128/);
+  });
+});
+
+describe('commitAndPush', () => {
+  it('reports committed=false when there is nothing to commit', async () => {
+    spawnHandler = (inv) => {
+      // `git diff --cached --quiet` exits 0 when nothing is staged.
+      if (inv.args[0] === 'diff') return { exitCode: 0 };
+      return { exitCode: 0 };
+    };
+    const res = await commitAndPush({
+      apiUrl: 'https://api.shogo.ai',
+      apiKey: 'shogo_sk_test',
+      projectId: 'p_clean',
+      localDir: '/tmp/never',
+      message: 'no-op',
+    });
+    expect(res.committed).toBe(false);
+    expect(res.commitSha).toBeUndefined();
+    // We should not have pushed.
+    expect(spawnInvocations.some((i) => i.args[0] === 'push')).toBe(false);
+  });
+
+  it('commits + pushes when there are staged changes', async () => {
+    spawnHandler = (inv) => {
+      if (inv.args[0] === 'diff') {
+        // Non-zero exit = "diff present" = something to commit.
+        return { exitCode: 1 };
+      }
+      if (inv.args[0] === 'rev-parse') return { stdout: 'feedface\n' };
+      return { exitCode: 0 };
+    };
+    const res = await commitAndPush({
+      apiUrl: 'https://api.shogo.ai',
+      apiKey: 'shogo_sk_test',
+      projectId: 'p_dirty',
+      localDir: '/tmp/never',
+      message: 'auto: 2026-01-01T00:00:00Z',
+    });
+    expect(res.committed).toBe(true);
+    expect(res.commitSha).toBe('feedface');
+    const pushInv = spawnInvocations.find((i) => i.args.includes('push'))!;
+    expect(pushInv).toBeDefined();
+    expect(pushInv.args.some((a) => a.startsWith('http.extraHeader='))).toBe(true);
+  });
+});
+
+describe('gitFetchAndReset', () => {
+  it('passes bearer via -c http.extraHeader on both fetch and reset', async () => {
+    spawnHandler = (inv) => {
+      if (inv.args[0] === 'rev-parse') return { stdout: 'cafebabe\n' };
+      return { exitCode: 0 };
+    };
+    const res = await gitFetchAndReset({
+      apiUrl: 'https://api.shogo.ai',
+      apiKey: 'shogo_sk_test',
+      projectId: 'p_demo',
+      localDir: '/tmp/never',
+    });
+    expect(res.commitSha).toBe('cafebabe');
+    const fetchInv = spawnInvocations.find((i) => i.args.includes('fetch'))!;
+    expect(fetchInv.args.some((a) => a.startsWith('http.extraHeader='))).toBe(true);
+    // reset does NOT need the bearer.
+    const resetInv = spawnInvocations.find((i) => i.args.includes('reset'))!;
+    expect(resetInv.args.some((a) => a.startsWith('http.extraHeader='))).toBe(false);
+  });
+});
+
+describe('isGitRepo', () => {
+  it('returns true when .git exists in the dir', async () => {
+    const { mkdtempSync, mkdirSync, rmSync } = await import('node:fs');
+    const { tmpdir } = await import('node:os');
+    const { join } = await import('node:path');
+    const dir = mkdtempSync(join(tmpdir(), 'is-git-'));
+    try {
+      mkdirSync(join(dir, '.git'));
+      expect(isGitRepo(dir)).toBe(true);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+  it('returns false when .git is missing', async () => {
+    const { mkdtempSync, rmSync } = await import('node:fs');
+    const { tmpdir } = await import('node:os');
+    const { join } = await import('node:path');
+    const dir = mkdtempSync(join(tmpdir(), 'is-git-'));
+    try {
+      expect(isGitRepo(dir)).toBe(false);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});