@skaile/workspaces 4.24.0 → 4.25.0

package/dist/{chunk-3SZLZ56M.js → chunk-EZOFQW3G.js}

@@ -1568,6 +1568,69 @@ async function commitIdentityArgs(cwd) {
 function gitCommitting(args, cwd, timeout = 3e4) {
   return commitIdentityArgs(cwd).then((identity) => git([...identity, ...args], cwd, timeout));
 }
+async function pullByMerge(branch, cwd, auth, timeout = 3e4) {
+  const pending = await unfinishedGitOperation(cwd);
+  if (pending !== null) {
+    throw new Error(
+      `the checkout has an unfinished merge or rebase (${pending}); nothing was pulled. Finish or abort it first`
+    );
+  }
+  await runRemoteGit(["fetch", "origin", branch], auth, {
+    cwd,
+    safeDir: cwd,
+    timeout,
+    env: cLocaleEnv()
+  });
+  try {
+    await gitCommitting(["merge", "--ff", "--no-edit", "FETCH_HEAD"], cwd, timeout);
+  } catch (err) {
+    const unmerged = await gitOrNull(["diff", "--name-only", "--diff-filter=U"], cwd) ?? "";
+    if (await gitOrNull(["rev-parse", "--quiet", "--verify", "MERGE_HEAD"], cwd) !== null) {
+      await gitOrNull(["merge", "--abort"], cwd);
+    }
+    const files = unmerged.split("\n").filter(Boolean);
+    if (files.length > 0) {
+      throw new Error(
+        `origin/${branch} and the local branch both have new commits that conflict in ${files.join(", ")}; the merge was aborted and the checkout is unchanged`
+      );
+    }
+    throw err;
+  }
+}
+var UNFINISHED_OPERATION_PATHS = [
+  "MERGE_HEAD",
+  "CHERRY_PICK_HEAD",
+  "REVERT_HEAD",
+  "rebase-merge",
+  "rebase-apply"
+];
+async function unfinishedGitOperation(cwd) {
+  const paths = await gitOrNull(
+    ["rev-parse", ...UNFINISHED_OPERATION_PATHS.flatMap((p) => ["--git-path", p])],
+    cwd
+  );
+  if (paths === null) return "the git dir could not be resolved";
+  const found = await Promise.all(
+    paths.split("\n").map(async (p) => {
+      try {
+        return await existsOrThrow(resolve(cwd, p)) ? "is present" : null;
+      } catch (err) {
+        return `could not be checked (${err.code ?? "deadline or error"})`;
+      }
+    })
+  );
+  const index = found.findIndex((state) => state !== null);
+  if (index >= 0) return `${UNFINISHED_OPERATION_PATHS[index]} ${found[index]}`;
+  const unmerged = await gitOrNull(["diff", "--name-only", "--diff-filter=U"], cwd);
+  if (unmerged) return `unmerged paths: ${unmerged.split("\n").join(", ")}`;
+  return null;
+}
+async function refuseUnfinishedOperation(cwd, log) {
+  const reason = await unfinishedGitOperation(cwd);
+  if (reason === null) return false;
+  log.warn("not committing: the checkout has an unfinished merge or rebase", { reason });
+  return true;
+}
 async function ensureSkaileExcluded(cwd, log) {
   try {
     const commonDir = await git(["rev-parse", "--git-common-dir"], cwd, 5e3);
@@ -1638,6 +1701,208 @@ async function runGit(args, options) {
 function git(args, cwd, timeout = 3e4) {
   return runGit([...gitPrefix(cwd), ...args], { cwd, timeout });
 }
+var TOKEN_USERNAME = "x-access-token";
+var NETWORK_GIT_ARGS = [
+  "-c",
+  "credential.helper=",
+  "-c",
+  "core.hooksPath=/dev/null",
+  "-c",
+  "core.askPass=",
+  "-c",
+  "core.fsmonitor=false",
+  "-c",
+  "core.alternateRefsCommand=",
+  "-c",
+  "push.gpgSign=false",
+  "-c",
+  "gc.auto=0",
+  "-c",
+  "maintenance.auto=false"
+];
+function plainRemoteUrl(auth) {
+  if (!auth.token || !auth.url.startsWith("https://")) return auth.url;
+  const u = new URL(auth.url);
+  u.username = "";
+  u.password = "";
+  return u.toString();
+}
+function networkGitEnv(auth, base = process.env) {
+  const env = { ...base, GIT_TERMINAL_PROMPT: "0", GIT_ASKPASS: "" };
+  if (!auth?.token || !auth.url.startsWith("https://")) return env;
+  const { protocol, host } = new URL(auth.url);
+  const basic = Buffer.from(`${TOKEN_USERNAME}:${auth.token}`).toString("base64");
+  const existing = Number.parseInt(base.GIT_CONFIG_COUNT ?? "", 10);
+  const index = Number.isInteger(existing) && existing > 0 ? existing : 0;
+  const scope = auth.repoScoped ? comparableRemoteUrl(auth.url) : `${protocol}//${host}/`;
+  env[`GIT_CONFIG_KEY_${index}`] = `http.${scope}.extraHeader`;
+  env[`GIT_CONFIG_VALUE_${index}`] = `Authorization: Basic ${basic}`;
+  env.GIT_CONFIG_COUNT = String(index + 1);
+  env.GIT_ALLOW_PROTOCOL = "https";
+  return env;
+}
+async function runRemoteGit(args, auth, options) {
+  const keys = subcommandOf(args) === "submodule" ? CHECKOUT_UNSAFE_KEY_RE : TLS_TRUST_KEY_RE;
+  const withheld = auth?.token ? await tlsTrustOverride(options, keys) : null;
+  if (withheld !== null) {
+    authLog.warn(
+      "not sending the git credential: the checkout's config changes TLS trust or names a filter",
+      {
+        key: withheld
+      }
+    );
+  }
+  const recursion = RECURSING_SUBCOMMANDS.has(subcommandOf(args)) ? NO_SUBMODULE_RECURSION : [];
+  return runGit([...gitPrefix(options.safeDir), ...NETWORK_GIT_ARGS, ...recursion, ...args], {
+    ...options.cwd === void 0 ? {} : { cwd: options.cwd },
+    timeout: options.timeout,
+    env: networkGitEnv(withheld === null ? auth : void 0, options.env)
+  });
+}
+var RECURSING_SUBCOMMANDS = /* @__PURE__ */ new Set(["fetch", "pull", "push", "submodule", "clone"]);
+var NO_SUBMODULE_RECURSION = [
+  "-c",
+  "submodule.recurse=false",
+  "-c",
+  "fetch.recurseSubmodules=false",
+  "-c",
+  "push.recurseSubmodules=no"
+];
+function subcommandOf(args) {
+  let i = 0;
+  while (args[i] === "-c") i += 2;
+  return args[i] ?? "";
+}
+var authLog = createLogger({ kind: "connector", subkind: "git" });
+var TLS_TRUST_KEY_RE = "^http\\.(.*\\.)?(sslverify|sslcainfo|sslcapath)$";
+var CHECKOUT_UNSAFE_KEY_RE = `(${TLS_TRUST_KEY_RE})|(^filter\\..*\\.(smudge|clean|process)$)|(^lfs\\.(customtransfer\\..*\\.path|standalonetransferagent)$)`;
+async function tlsTrustOverride(options, keyRe = TLS_TRUST_KEY_RE) {
+  try {
+    const own = await configMatch(
+      gitPrefix(options.safeDir),
+      options.cwd,
+      [...options.cwd === void 0 ? ["--global"] : [], "--show-scope"],
+      keyRe
+    );
+    const line = own.find(isUnsafeConfigLine);
+    if (line !== void 0) return line.split(/\s+/)[1] ?? "unknown";
+    if (options.cwd === void 0) return null;
+    for (const dir of await submoduleGitDirs(options.cwd)) {
+      const hits = await configMatch(
+        ["-c", "safe.directory=*", `--git-dir=${dir}`],
+        options.cwd,
+        ["--show-scope"],
+        keyRe
+      );
+      const hit = hits.find(isUnsafeConfigLine);
+      if (hit !== void 0) return `${hit.split(/\s+/)[1] ?? "unknown"} (${dir})`;
+    }
+    return null;
+  } catch {
+    return "unreadable config";
+  }
+}
+function isUnsafeConfigLine(line) {
+  return !/^(system|command)\s/.test(line);
+}
+async function configMatch(globalArgs, cwd, selector, keyRe) {
+  try {
+    const out = await runGit(
+      [...globalArgs, "config", ...selector, "--includes", "--get-regexp", keyRe],
+      { ...cwd === void 0 ? {} : { cwd }, timeout: 5e3 }
+    );
+    return out.split("\n").filter((l) => l !== "");
+  } catch (err) {
+    if (err.code === 1) return [];
+    throw err;
+  }
+}
+var MAX_SUBMODULE_GIT_DIRS = 256;
+var MAX_SUBMODULE_SCAN_ENTRIES = 4096;
+var MAX_SUBMODULE_DEPTH = 8;
+async function submoduleGitDirs(cwd) {
+  const found = /* @__PURE__ */ new Set();
+  let scanned = 0;
+  const add = (dir) => {
+    found.add(dir);
+    if (found.size > MAX_SUBMODULE_GIT_DIRS) throw new Error("too many submodule git dirs");
+  };
+  const walkModules = async (dir, depth) => {
+    if (depth > MAX_SUBMODULE_DEPTH) throw new Error("submodule git dirs nested too deep");
+    for (const name of await listDirOrEmpty(dir)) {
+      scanned += 1;
+      if (scanned > MAX_SUBMODULE_SCAN_ENTRIES) throw new Error("submodule scan too large");
+      const child = join(dir, name);
+      const st = await withFsDeadline(`stat ${child}`, () => stat(child));
+      if (!st.isDirectory()) continue;
+      if (await existsOrThrow(join(child, "HEAD"))) {
+        add(child);
+        await walkModules(join(child, "modules"), depth + 1);
+      } else {
+        await walkModules(child, depth + 1);
+      }
+    }
+  };
+  const walkWorktree = async (worktree, depth) => {
+    if (depth > MAX_SUBMODULE_DEPTH) throw new Error("submodules nested too deep");
+    const gitmodules = join(worktree, ".gitmodules");
+    if (!await existsOrThrow(gitmodules)) return;
+    let listed = "";
+    try {
+      listed = await runGit(
+        ["config", "--file", gitmodules, "--get-regexp", "^submodule\\..*\\.path$"],
+        { cwd: worktree, timeout: 5e3 }
+      );
+    } catch (err) {
+      if (err.code !== 1) throw err;
+    }
+    for (const line of listed.split("\n").filter((l) => l !== "")) {
+      const path = line.slice(line.indexOf(" ") + 1);
+      const subWorktree = resolve(worktree, path);
+      const dotGit = join(subWorktree, ".git");
+      let st;
+      try {
+        st = await withFsDeadline(`stat ${dotGit}`, () => stat(dotGit));
+      } catch (err) {
+        if (err.code === "ENOENT") continue;
+        throw err;
+      }
+      if (st.isDirectory()) {
+        add(dotGit);
+      } else {
+        const content = await withFsDeadline(`read ${dotGit}`, () => readFile(dotGit, "utf-8"));
+        const m = /^gitdir:\s*(.+?)\s*$/m.exec(content);
+        if (!m?.[1]) throw new Error(`unrecognised gitfile ${dotGit}`);
+        add(resolve(dirname(dotGit), m[1]));
+      }
+      await walkWorktree(subWorktree, depth + 1);
+    }
+  };
+  const commonDir = resolve(cwd, await git(["rev-parse", "--git-common-dir"], cwd, 5e3));
+  await walkModules(join(commonDir, "modules"), 0);
+  await walkWorktree(cwd, 0);
+  return [...found];
+}
+async function listDirOrEmpty(dir) {
+  try {
+    return await withFsDeadline(`readdir ${dir}`, () => readdir(dir));
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+}
+async function existsOrThrow(path) {
+  try {
+    await withFsDeadline(`stat ${path}`, () => stat(path));
+    return true;
+  } catch (err) {
+    if (err.code === "ENOENT") return false;
+    throw err;
+  }
+}
+function gitRemote(args, cwd, auth, timeout = 3e4) {
+  return runRemoteGit(args, auth, { cwd, safeDir: cwd, timeout });
+}
 function pathExists(path) {
   return tryWithFsDeadline(`stat ${path}`, () => stat(path).then(() => true), false);
 }
@@ -1682,16 +1947,27 @@ function gitLocalCheckout(args, cwd) {
     throw typeof err?.code === "number" ? withConnectErrorKind(err, "repo-state") : err;
   });
 }
-async function syncSubmodules(cwd, log) {
+async function syncSubmodules(cwd, log, auth) {
   if (!await pathExists(join(cwd, ".gitmodules"))) return;
   try {
-    await git(["submodule", "update", "--init", "--recursive"], cwd, 12e4);
+    await gitRemote(
+      ["submodule", "update", "--init", "--recursive", "--checkout"],
+      cwd,
+      auth,
+      12e4
+    );
   } catch (err) {
     log.warn("git submodule update failed \u2014 checkout may be incomplete", {
       error: redactCredentials(err instanceof Error ? err.message : String(err))
     });
   }
 }
+async function checkoutSubmodulesOffline(cwd) {
+  if (!await pathExists(join(cwd, ".gitmodules"))) return [];
+  await gitOrNull(["submodule", "update", "--recursive", "--checkout", "--no-fetch"], cwd);
+  const status = await gitOrNull(["submodule", "status", "--recursive"], cwd) ?? "";
+  return status.split("\n").map((l) => /^[+-][0-9a-f]+ (.+?)(?: \([^)]*\))?$/.exec(l)?.[1]).filter((p) => p !== void 0);
+}
 function isValidGitRefOrSha(ref) {
   if (ref.length === 0 || ref.length > 255) return false;
   if (/[\s\\~^:?*[\x00-\x1f\x7f`$;&|'"<>()]/.test(ref)) return false;
@@ -1736,6 +2012,40 @@ async function resolveUpstreamRef(cwd, branch) {
   const ref = `refs/remotes/${remote}/${name}`;
   return await gitOrNull(["rev-parse", "--verify", "--quiet", ref], cwd) !== null ? ref : null;
 }
+async function assertOriginIsMount(s, cwd, op) {
+  const expected = comparableRemoteUrl(s.url);
+  for (const args of [
+    ["remote", "get-url", "origin"],
+    ["remote", "get-url", "--push", "origin"]
+  ]) {
+    const actual = await gitOrNull(args, cwd);
+    if (actual === null || comparableRemoteUrl(actual) !== expected) {
+      throw new Error(
+        `git ${op}: origin${args.includes("--push") ? " (push)" : ""} resolves to ${actual === null ? "nothing" : redactCredentials(actual)}, not this mount's remote ${expected}. Remove the pushurl / insteadOf / url override from the git config first.`
+      );
+    }
+  }
+}
+function comparableRemoteUrl(url) {
+  if (!url.startsWith("https://")) return url;
+  try {
+    const u = new URL(url);
+    return `${u.protocol}//${u.host}${u.pathname}`;
+  } catch {
+    return url;
+  }
+}
+function repoScopedAuth(s) {
+  return {
+    get url() {
+      return s.url;
+    },
+    get token() {
+      return s.token;
+    },
+    repoScoped: true
+  };
+}
 function trackingRefspec(branch) {
   return `+refs/heads/${branch}:refs/remotes/origin/${branch}`;
 }
@@ -1762,51 +2072,15 @@ async function dropTrackingRefspec(branch, cwd) {
 async function isAncestor(ancestor, descendant, cwd) {
   return await gitOrNull(["merge-base", "--is-ancestor", ancestor, descendant], cwd) !== null;
 }
-async function integrateOriginBaseBranch(branch, cwd) {
+async function integrateOriginBaseBranch(branch, cwd, auth) {
   if (await gitOrNull(["symbolic-ref", "-q", "HEAD"], cwd) !== `refs/heads/${branch}`) return;
-  if (await hasUnfinishedOperation(cwd)) return;
+  if (await unfinishedGitOperation(cwd) !== null) return;
   try {
-    await runGit([...gitPrefix(cwd), "fetch", "origin", branch], {
-      cwd,
-      timeout: 6e4,
-      env: cLocaleEnv()
-    });
+    await pullByMerge(branch, cwd, auth, 6e4);
   } catch (err) {
     if (/couldn't find remote ref/.test(err instanceof Error ? err.message : String(err))) return;
     throw err;
   }
-  if (await isAncestor("FETCH_HEAD", "HEAD", cwd)) return;
-  try {
-    await gitCommitting(["merge", "--ff", "--no-edit", "FETCH_HEAD"], cwd, 6e4);
-  } catch (err) {
-    const unmerged = await gitOrNull(["diff", "--name-only", "--diff-filter=U"], cwd) ?? "";
-    if (await gitOrNull(["rev-parse", "--quiet", "--verify", "MERGE_HEAD"], cwd) !== null) {
-      await gitOrNull(["merge", "--abort"], cwd);
-    }
-    const files = unmerged.split("\n").filter(Boolean);
-    if (files.length > 0) {
-      throw new Error(
-        `origin/${branch} and the local branch both have new commits that conflict in ${files.join(", ")}; the merge was aborted and nothing was pushed`
-      );
-    }
-    throw err;
-  }
-}
-async function hasUnfinishedOperation(cwd) {
-  for (const ref of ["MERGE_HEAD", "CHERRY_PICK_HEAD", "REVERT_HEAD"]) {
-    if (await gitOrNull(["rev-parse", "--quiet", "--verify", ref], cwd) !== null) return true;
-  }
-  for (const dir of ["rebase-merge", "rebase-apply"]) {
-    const path = await gitOrNull(["rev-parse", "--git-path", dir], cwd);
-    if (path === null) continue;
-    const found = await tryWithFsDeadline(
-      `stat ${dir}`,
-      () => stat(resolve(cwd, path)).then(() => true),
-      false
-    );
-    if (found) return true;
-  }
-  return false;
 }
 async function originTrackingRef(branch, cwd) {
   const ref = `refs/remotes/origin/${branch}`;
@@ -1852,11 +2126,34 @@ async function isDirEmpty(dir) {
   const entries = await tryWithFsDeadline(`readdir ${dir}`, () => readdir(dir), []);
   return entries.length === 0;
 }
-async function commitAll(cwd, message) {
+async function commitAll(cwd, message, log) {
+  if (await refuseUnfinishedOperation(cwd, log)) return null;
   if (!await hasChanges(cwd)) return null;
-  await git(["add", "-A"], cwd);
+  await stageAll(cwd, log);
+  if (await gitOrNull(["diff", "--cached", "--quiet"], cwd) !== null) return null;
   return gitCommitting(["commit", "-m", message], cwd);
 }
+async function stageAll(cwd, log) {
+  await git(["add", "-A"], cwd);
+  const raw = await gitOrNull(["diff", "--cached", "--raw", "--no-abbrev", "--no-renames", "-z"], cwd) ?? "";
+  const fields = raw.split("\0");
+  for (let i = 0; i + 1 < fields.length; i += 2) {
+    const m = /^:160000 160000 ([0-9a-f]+) ([0-9a-f]+) M$/.exec(fields[i] ?? "");
+    const path = fields[i + 1];
+    if (m === null || !path) continue;
+    const pinned = m[1];
+    const staged = m[2];
+    const dir = join(cwd, path);
+    const known = await gitOrNull(["cat-file", "-e", `${pinned}^{commit}`], dir) !== null;
+    if (!known || await isAncestor(staged, pinned, dir)) {
+      await gitOrNull(["reset", "-q", "--", path], cwd);
+      log.info("left a submodule pin out of the commit", {
+        path,
+        reason: known ? "would move the pin backwards" : "pinned commit is not local"
+      });
+    }
+  }
+}
 var TokenMediatorError = class extends Error {
   /** Every mediator refusal is fixed where the credential lives, whatever its code. */
   skaileConnectErrorKind = "credential";
@@ -1886,6 +2183,27 @@ var GitConnector = class extends AbstractConnector {
         accessLevel: "read",
         args: [],
         examples: ["sync_status"]
+      },
+      {
+        name: "push",
+        description: "Push this mount's branch (the session branch on a branching mount) to origin, authenticated by the mount. Pushes commits only: commit with the git CLI first. Never forces; a push origin refuses comes back as status 'rejected' (run 'pull', then push again). The checkout must be on the mount's branch.",
+        accessLevel: "write",
+        args: [],
+        examples: ["push"]
+      },
+      {
+        name: "pull",
+        description: "Fetch origin and merge origin's copy of this mount's branch into it (a merge, never a rebase). On a conflict the merge is aborted, the checkout is left as it was, and the conflicting files are listed (status 'conflict'); the fetched commits stay at origin/<branch> for a local `git merge`. Local changes that the merge would overwrite, or a merge or rebase already in progress, give status 'blocked'.",
+        accessLevel: "read",
+        args: [],
+        examples: ["pull"]
+      },
+      {
+        name: "fetch",
+        description: "Fetch origin, authenticated by the mount, updating origin/<branch> refs only. The working tree is not touched.",
+        accessLevel: "read",
+        args: [],
+        examples: ["fetch"]
       }
     ];
   }
@@ -1899,10 +2217,163 @@ var GitConnector = class extends AbstractConnector {
         const state = handle.state;
         return JSON.stringify(await readGitSyncStatus(cwd, state.branch));
       }
+      case "push":
+      case "pull":
+      case "fetch":
+        return JSON.stringify(await this.agentRemoteOp(handle, operation));
       default:
         throw new Error(`GitConnector has no operation: ${operation}`);
     }
   }
+  /**
+   * Run `fn` after every earlier job on this mount has settled. Network git and
+   * index-writing git on one checkout must not overlap: two of them contend for
+   * `.git/index.lock`, and a push racing a pull can push a half-merged branch.
+   * Not re-entrant — a job must never wait on the lock it runs under.
+   */
+  withMountLock(s, fn) {
+    const run = (s.mountLock ?? Promise.resolve()).then(fn);
+    s.mountLock = run.then(
+      () => void 0,
+      () => void 0
+    );
+    return run;
+  }
+  /**
+   * The agent's network git: the driver runs it with the mount's credential, so
+   * an agent on a mount without `exposeAccessToken` can push and pull without
+   * ever holding the token. Acts only on the mount's own branch, never forces.
+   */
+  async agentRemoteOp(handle, op) {
+    const cwd = handle.mountPath;
+    if (!cwd || handle.status !== "connected") {
+      throw new Error(`git ${op}: the mount is not connected (${handle.status})`);
+    }
+    const s = handle.state;
+    if (s.fleetManaged) {
+      throw new Error(`git ${op}: the host syncs this mount; there is nothing to run here`);
+    }
+    if (op === "push" && handle.access === "read-only") {
+      throw new Error("git push: this mount is read-only");
+    }
+    return this.withMountLock(s, async () => {
+      if (s.disposed) throw new Error(`git ${op}: the mount is disconnected`);
+      await assertOriginIsMount(s, cwd, op);
+      if (op !== "fetch") {
+        const head = await gitOrNull(["symbolic-ref", "--quiet", "--short", "HEAD"], cwd);
+        if (head !== s.activeBranch) {
+          throw new Error(
+            `git ${op}: the checkout is on ${head === null ? "a detached HEAD" : `"${head}"`}, but this mount pushes and pulls only "${s.activeBranch}". Check it out first.`
+          );
+        }
+      }
+      let outcome;
+      try {
+        outcome = op === "push" ? await this.agentPush(s, cwd) : op === "pull" ? await this.agentPull(s, cwd) : await this.agentFetch(s, cwd);
+      } catch (err) {
+        throw new Error(
+          `git ${op} failed: ${redactCredentials(err instanceof Error ? err.message : String(err))}`
+        );
+      }
+      this.log.info("agent git op", { op, branch: s.activeBranch, status: outcome.status });
+      return {
+        op,
+        branch: s.activeBranch,
+        ...outcome,
+        sync: await readGitSyncStatus(cwd, s.branch)
+      };
+    });
+  }
+  /** Fetch origin's base branch and, on a branching mount, the session branch. */
+  async fetchActiveBranch(s, cwd) {
+    const auth = repoScopedAuth(s);
+    await this.fetchOrigin(s, cwd, auth);
+    if (s.activeBranch === s.branch) return;
+    if (await this.trackSessionBranch(s.activeBranch, cwd, auth) === "failed") {
+      throw new Error(`could not fetch origin/${s.activeBranch}`);
+    }
+  }
+  async agentFetch(s, cwd) {
+    await this.fetchActiveBranch(s, cwd);
+    return { status: "fetched" };
+  }
+  async agentPush(s, cwd) {
+    const b = s.activeBranch;
+    const args = ["push", "origin", `refs/heads/${b}:refs/heads/${b}`];
+    try {
+      await runRemoteGit(args, repoScopedAuth(s), {
+        cwd,
+        safeDir: cwd,
+        timeout: 6e4,
+        env: cLocaleEnv()
+      });
+    } catch (err) {
+      const message = redactCredentials(err instanceof Error ? err.message : String(err));
+      if (/\[rejected\]|non-fast-forward|fetch first/.test(message)) {
+        return {
+          status: "rejected",
+          message: `origin has commits on "${b}" that this checkout lacks, so the push was refused (no force). Run the "pull" op, then push again.`
+        };
+      }
+      const remote = /\[remote rejected\][^\n]*/.exec(message)?.[0];
+      if (remote !== void 0) {
+        return { status: "rejected", message: `origin refused the push: ${remote.trim()}` };
+      }
+      throw err;
+    }
+    if (b === s.branch) {
+      await gitOrNull(["update-ref", `refs/remotes/origin/${b}`, `refs/heads/${b}`], cwd);
+    } else {
+      await setSessionUpstream(b, cwd);
+      await this.recordPushedSessionBranch(b, cwd);
+    }
+    return { status: "pushed" };
+  }
+  async agentPull(s, cwd) {
+    const b = s.activeBranch;
+    await this.fetchActiveBranch(s, cwd);
+    const pending = await unfinishedGitOperation(cwd);
+    if (pending !== null) {
+      return {
+        status: "blocked",
+        message: `the checkout has an unfinished merge or rebase (${pending}), so nothing was merged. Finish it (resolve, \`git add\`, \`git commit\`) or abort it, then pull again.`
+      };
+    }
+    const upstream = await originTrackingRef(b, cwd);
+    if (upstream === null) {
+      return {
+        status: "no-upstream",
+        message: `origin has no branch "${b}" yet; nothing to pull. "push" publishes it.`
+      };
+    }
+    if (await isAncestor(upstream, "HEAD", cwd)) return { status: "up-to-date" };
+    try {
+      await gitCommitting(["merge", "--ff", "--no-edit", upstream], cwd, 6e4);
+    } catch (err) {
+      const unmerged = await gitOrNull(["diff", "--name-only", "--diff-filter=U"], cwd);
+      const conflicts = (unmerged ?? "").split("\n").filter(Boolean);
+      if (await gitOrNull(["rev-parse", "--quiet", "--verify", "MERGE_HEAD"], cwd) !== null) {
+        await git(["merge", "--abort"], cwd);
+      }
+      if (conflicts.length > 0) {
+        return {
+          status: "conflict",
+          conflicts,
+          message: `merging origin/${b} conflicts, so the merge was aborted and the checkout is as it was. The fetched commits are at origin/${b}: run \`git merge origin/${b}\`, resolve, commit, then "push".`
+        };
+      }
+      return {
+        status: "blocked",
+        message: `the merge did not start: ${redactCredentials(err instanceof Error ? err.message : String(err))}`
+      };
+    }
+    const stale = await checkoutSubmodulesOffline(cwd);
+    if (stale.length === 0) return { status: "merged" };
+    return {
+      status: "merged",
+      message: `submodules ${stale.join(", ")} were not updated: their new commits need a fetch, which happens at the next platform sync. Do not stage or commit them until then.`
+    };
+  }
   async connect(declaration, ctx) {
     const targetDir = ctx.mountTarget;
     if (!targetDir) {
@@ -1945,11 +2416,10 @@ var GitConnector = class extends AbstractConnector {
         targetDir,
         tokenMediator: initial.authRef?.kind === "backend" ? tokenMediator : void 0
       };
-      const authUrl = this.authUrl(state);
-      await this.prepareCheckout(targetDir, url, branch, authUrl, declaration.access, started);
+      await this.prepareCheckout(targetDir, url, branch, state, declaration.access, started);
       if (session.enabled && !session.isMain && session.slug) {
         if (declaration.mount?.exposeAccessToken !== true) {
-          await this.rebakeRemoteAuth(targetDir, state);
+          await this.reconcileRemoteUrl(targetDir, state);
         }
         await this.checkoutSessionBranch(state, session, targetDir);
       }
@@ -1969,7 +2439,7 @@ var GitConnector = class extends AbstractConnector {
         }
       }
       if (!state.managedGitconfig) {
-        await this.rebakeRemoteAuth(targetDir, state);
+        await this.reconcileRemoteUrl(targetDir, state);
         if (initial.token) {
           const providerKind = initial.authRef?.kind ?? "pat";
           const skipReason = providerKind !== "backend" ? "non-backend-credential" : !state.tokenMediator ? "no-token-mediator" : !initial.expiresAt ? "no-expiry" : null;
@@ -1989,13 +2459,17 @@ var GitConnector = class extends AbstractConnector {
         }
       }
       if (state.sessionBranchFetch === "failed") {
-        state.sessionBranchFetch = await this.trackSessionBranch(state.activeBranch, targetDir);
+        state.sessionBranchFetch = await this.trackSessionBranch(
+          state.activeBranch,
+          targetDir,
+          state
+        );
         if (state.sessionBranchFetch === "fetched") {
           if (state.sessionBranchCreated) {
-            await this.adoptOriginSessionBranch(state.activeBranch, targetDir);
+            await this.adoptOriginSessionBranch(state, state.activeBranch, targetDir);
           } else {
             await this.reconcileLocalSessionBranch(state, state.activeBranch, targetDir);
-            await syncSubmodules(targetDir, this.log);
+            await syncSubmodules(targetDir, this.log, state);
           }
         }
       }
@@ -2041,55 +2515,57 @@ var GitConnector = class extends AbstractConnector {
    *     reset, no clean. Existing files become uncommitted-on-init; the
    *     agent or `pushAfterCommit` reconciles with remote later.
    */
-  async prepareCheckout(targetDir, url, branch, authUrl, access, started) {
+  async prepareCheckout(targetDir, url, branch, auth, access, started) {
     try {
       if (await pathExists(join(targetDir, ".git"))) {
         await clearStaleIndexLock(targetDir, this.log);
         if (await this.isInitialisedCheckout(targetDir)) {
           this.log.info("found existing checkout \u2014 using as-is", { branch, targetDir });
         } else {
-          if (await this.countRemoteHeads(targetDir, authUrl) === 0) {
+          if (await this.countRemoteHeads(targetDir, auth) === 0) {
             this.log.info("empty .git against a ref-less remote \u2014 bootstrapping branch", {
               branch,
               access
             });
-            await this.bootstrapEmptyRemote(targetDir, branch, authUrl, access);
+            await this.bootstrapEmptyRemote(targetDir, branch, auth, access);
           } else {
             this.log.info("found empty .git \u2014 bootstrapping from origin", { branch });
-            await this.bootstrapFromOrigin(targetDir, branch, authUrl);
+            await this.bootstrapFromOrigin(targetDir, branch, auth);
           }
           this.log.info("bootstrap ok", { branch, durationMs: Date.now() - started });
         }
       } else {
         await withFsDeadline(`mkdir ${targetDir}`, () => mkdir(targetDir, { recursive: true }));
         if (await isDirEmpty(targetDir)) {
-          if (await this.countRemoteHeads(targetDir, authUrl) === 0) {
+          if (await this.countRemoteHeads(targetDir, auth) === 0) {
             this.log.info("remote has no refs \u2014 bootstrapping branch", { url, branch, access });
-            await this.bootstrapEmptyRemote(targetDir, branch, authUrl, access);
+            await this.bootstrapEmptyRemote(targetDir, branch, auth, access);
             this.log.info("empty-remote bootstrap ok", {
               branch,
               durationMs: Date.now() - started
             });
           } else {
             this.log.info("clone start", { url, branch });
-            await runGit(
+            await runRemoteGit(
               [
-                ...gitPrefix(targetDir),
                 "clone",
                 "--branch",
                 branch,
                 "--single-branch",
-                "--recurse-submodules",
-                authUrl,
+                "--no-checkout",
+                plainRemoteUrl(auth),
                 targetDir
               ],
-              { timeout: 12e4 }
+              auth,
+              { safeDir: targetDir, timeout: 12e4 }
             );
+            await git(["checkout", "-f", branch], targetDir, 12e4);
+            await syncSubmodules(targetDir, this.log, auth);
             this.log.info("clone ok", { branch, durationMs: Date.now() - started });
           }
         } else {
           this.log.warn("target non-empty without .git \u2014 initialising in place", { targetDir });
-          await this.initInPlace(targetDir, authUrl);
+          await this.initInPlace(targetDir, plainRemoteUrl(auth));
           this.log.info("init in place ok", { durationMs: Date.now() - started });
         }
       }
@@ -2113,7 +2589,7 @@ var GitConnector = class extends AbstractConnector {
         "config"
       );
     }
-    state.sessionBranchFetch = await this.trackSessionBranch(sessionBranch, targetDir);
+    state.sessionBranchFetch = await this.trackSessionBranch(sessionBranch, targetDir, state);
     let created = false;
     if (await localBranchExists(sessionBranch, targetDir)) {
       await gitLocalCheckout([sessionBranch], targetDir);
@@ -2130,20 +2606,20 @@ var GitConnector = class extends AbstractConnector {
       }
       if (originHasBranch) {
         await gitLocalCheckout(["-B", sessionBranch, `origin/${sessionBranch}`], targetDir);
-      } else if (!await this.branchFromRef(session, sessionBranch, targetDir)) {
+      } else if (!await this.branchFromRef(state, session, sessionBranch, targetDir)) {
         await gitLocalCheckout(["-b", sessionBranch], targetDir);
         created = true;
       } else {
         created = true;
       }
     }
-    await syncSubmodules(targetDir, this.log);
+    await syncSubmodules(targetDir, this.log, state);
     state.activeBranch = sessionBranch;
     state.sessionBranchCreated = created;
     this.log.info("session branch checked out", { sessionBranch });
     if (created && state.lifecycle.publishOnCreate) {
       try {
-        await git(["push", "-u", "origin", sessionBranch], targetDir, 6e4);
+        await gitRemote(["push", "-u", "origin", sessionBranch], targetDir, state, 6e4);
         await this.recordPushedSessionBranch(sessionBranch, targetDir);
         this.log.info("published new session branch", { sessionBranch });
       } catch (err) {
@@ -2165,11 +2641,12 @@ var GitConnector = class extends AbstractConnector {
    * every plain `git fetch origin` fail. Runs on every connect, so it also
    * repairs a checkout cloned before the refspec existed.
    */
-  async trackSessionBranch(sessionBranch, targetDir) {
+  async trackSessionBranch(sessionBranch, targetDir, auth) {
     let outcome;
     try {
-      await runGit([...gitPrefix(targetDir), "fetch", "origin", trackingRefspec(sessionBranch)], {
+      await runRemoteGit(["fetch", "origin", trackingRefspec(sessionBranch)], auth, {
         cwd: targetDir,
+        safeDir: targetDir,
         timeout: 6e4,
         env: cLocaleEnv()
       });
@@ -2204,10 +2681,10 @@ var GitConnector = class extends AbstractConnector {
    * checkout is refused (for example local changes in the way), the branch
    * stays as it is and the push later fails as non-fast-forward.
    */
-  async adoptOriginSessionBranch(sessionBranch, targetDir) {
+  async adoptOriginSessionBranch(state, sessionBranch, targetDir) {
     try {
       await gitLocalCheckout(["-B", sessionBranch, `origin/${sessionBranch}`], targetDir);
-      await syncSubmodules(targetDir, this.log);
+      await syncSubmodules(targetDir, this.log, state);
       this.log.info("session branch re-pointed at origin after auth retry", { sessionBranch });
     } catch (err) {
       this.log.warn("could not re-point session branch at origin", {
@@ -2266,6 +2743,7 @@ var GitConnector = class extends AbstractConnector {
   async integrateOriginSessionBranch(s, cwd, branch = s.activeBranch) {
     const originRef = await originTrackingRef(branch, cwd);
     if (originRef === null || await isAncestor(originRef, "HEAD", cwd)) return;
+    if (await this.skipOverUnfinishedOperation(cwd, "merge of origin session branch")) return;
     try {
       await gitCommitting(["merge", "--no-edit", originRef], cwd, 6e4);
       this.log.info("merged origin session branch", { branch });
@@ -2307,12 +2785,12 @@ var GitConnector = class extends AbstractConnector {
    */
   async pushActiveBranch(s, cwd) {
     if (s.activeBranch === s.branch) {
-      await integrateOriginBaseBranch(s.branch, cwd);
-      await git(["push", "origin", s.activeBranch], cwd, 6e4);
+      await integrateOriginBaseBranch(s.branch, cwd, s);
+      await gitRemote(["push", "origin", s.activeBranch], cwd, s, 6e4);
       return;
     }
     await this.integrateOriginSessionBranch(s, cwd);
-    await git(["push", "-u", "origin", s.activeBranch], cwd, 6e4);
+    await gitRemote(["push", "-u", "origin", s.activeBranch], cwd, s, 6e4);
     await this.recordPushedSessionBranch(s.activeBranch, cwd);
   }
   /**
@@ -2320,7 +2798,7 @@ var GitConnector = class extends AbstractConnector {
    * true when the branch was created from the anchor; false when no valid
    * `fromRef` was supplied or the fetch failed (caller falls back to base).
    */
-  async branchFromRef(session, sessionBranch, targetDir) {
+  async branchFromRef(auth, session, sessionBranch, targetDir) {
     if (!session.fromRef) return false;
     if (!isValidGitRefOrSha(session.fromRef)) {
       this.log.warn("fromRef rejected by refname validation, falling back to base branch", {
@@ -2330,7 +2808,7 @@ var GitConnector = class extends AbstractConnector {
       return false;
     }
     try {
-      await git(["fetch", "origin", session.fromRef], targetDir);
+      await gitRemote(["fetch", "origin", session.fromRef], targetDir, auth);
       await git(["checkout", "-b", sessionBranch, "FETCH_HEAD"], targetDir);
       this.log.info("session branch created from fromRef", {
         sessionBranch,
@@ -2462,16 +2940,18 @@ var GitConnector = class extends AbstractConnector {
       this.log.debug("sync skipped \u2014 fleet-managed");
       return { filesWritten: 0, filesDeleted: 0, bytesTransferred: 0 };
     }
-    this.log.debug("sync (pull) start", { branch: s.activeBranch });
-    try {
-      await gitCommitting(["pull", "origin", s.activeBranch], handle.mountPath, 6e4);
-      await syncSubmodules(handle.mountPath, this.log);
-      this.log.debug("sync ok");
-    } catch (err) {
-      this.log.error("sync failed", err, { branch: s.activeBranch });
-      throw err;
-    }
-    return { filesWritten: 0, filesDeleted: 0, bytesTransferred: 0 };
+    return this.withMountLock(s, async () => {
+      this.log.debug("sync (pull) start", { branch: s.activeBranch });
+      try {
+        await pullByMerge(s.activeBranch, handle.mountPath, s, 6e4);
+        await syncSubmodules(handle.mountPath, this.log, s);
+        this.log.debug("sync ok");
+      } catch (err) {
+        this.log.error("sync failed", err, { branch: s.activeBranch });
+        throw err;
+      }
+      return { filesWritten: 0, filesDeleted: 0, bytesTransferred: 0 };
+    });
   }
   // ── Watch ──────────────────────────────────────────────────────────────────
   watch(handle, callback, options) {
@@ -2516,19 +2996,21 @@ var GitConnector = class extends AbstractConnector {
     }
     const lc = s.lifecycle;
     if (!lc.commitOnHibernate) return;
-    const result = await commitAll(handle.mountPath, `skaile: hibernate snapshot`);
-    if (!result) return this.pushUnpushedOnHibernate(s, handle.mountPath);
-    const sha = await git(["rev-parse", "--short", "HEAD"], handle.mountPath);
-    if (lc.pushOnHibernate) {
-      try {
-        await this.pushActiveBranch(s, handle.mountPath);
-        this.log.info("push ok", { branch: s.activeBranch });
-      } catch (err) {
-        this.log.error("push failed", err, { branch: s.activeBranch });
-        throw err;
+    return this.withMountLock(s, async () => {
+      const result = await commitAll(handle.mountPath, `skaile: hibernate snapshot`, this.log);
+      if (!result) return this.pushUnpushedOnHibernate(s, handle.mountPath);
+      const sha = await git(["rev-parse", "--short", "HEAD"], handle.mountPath);
+      if (lc.pushOnHibernate) {
+        try {
+          await this.pushActiveBranch(s, handle.mountPath);
+          this.log.info("push ok", { branch: s.activeBranch });
+        } catch (err) {
+          this.log.error("push failed", err, { branch: s.activeBranch });
+          throw err;
+        }
       }
-    }
-    return `Committed ${sha} on ${s.activeBranch}${lc.pushOnHibernate ? " (pushed)" : ""}`;
+      return `Committed ${sha} on ${s.activeBranch}${lc.pushOnHibernate ? " (pushed)" : ""}`;
+    });
   }
   /**
    * Hibernate with nothing new to commit: push commits that are still only
@@ -2560,46 +3042,54 @@ var GitConnector = class extends AbstractConnector {
     }
     const lc = s.lifecycle;
     const details = [];
-    try {
-      const commitResult = await commitAll(handle.mountPath, `skaile: session close`);
-      if (commitResult) {
-        const sha = await git(["rev-parse", "--short", "HEAD"], handle.mountPath);
-        details.push(`Committed ${sha}`);
-      }
-      if (lc.pushOnClose || lc.mergeOnClose) {
-        await this.pushActiveBranch(s, handle.mountPath);
-        details.push(`Pushed ${s.activeBranch}`);
-      }
-      if (lc.mergeOnClose && s.activeBranch !== s.branch) {
-        await git(["checkout", s.branch], handle.mountPath);
-        await gitCommitting(["pull", "origin", s.branch], handle.mountPath, 6e4);
-        await syncSubmodules(handle.mountPath, this.log);
-        let merged = true;
-        try {
-          await gitCommitting(["merge", s.activeBranch], handle.mountPath);
-        } catch (err) {
-          this.log.warn("merge failed", {
-            branch: s.activeBranch,
-            error: redactCredentials(err instanceof Error ? err.message : String(err))
+    return this.withMountLock(s, async () => {
+      try {
+        const commitResult = await commitAll(handle.mountPath, `skaile: session close`, this.log);
+        if (commitResult) {
+          const sha = await git(["rev-parse", "--short", "HEAD"], handle.mountPath);
+          details.push(`Committed ${sha}`);
+        }
+        if (lc.pushOnClose || lc.mergeOnClose) {
+          await this.pushActiveBranch(s, handle.mountPath);
+          details.push(`Pushed ${s.activeBranch}`);
+        }
+        const closePending = lc.mergeOnClose && s.activeBranch !== s.branch ? await unfinishedGitOperation(handle.mountPath) : null;
+        if (closePending !== null) {
+          this.log.warn("merge on close skipped: the checkout has an unfinished merge or rebase", {
+            reason: closePending
           });
-          const resolved = await this.resolveConflictsOrAbort(s, handle.mountPath, "merge");
-          if (resolved) {
-            details.push("Resolved merge conflicts (created .conflict files)");
-          } else {
-            merged = false;
+          details.push(`Merge of ${s.activeBranch} into ${s.branch} skipped: ${closePending}`);
+        } else if (lc.mergeOnClose && s.activeBranch !== s.branch) {
+          await git(["checkout", s.branch], handle.mountPath);
+          await pullByMerge(s.branch, handle.mountPath, s, 6e4);
+          await syncSubmodules(handle.mountPath, this.log, s);
+          let merged = true;
+          try {
+            await gitCommitting(["merge", s.activeBranch], handle.mountPath);
+          } catch (err) {
+            this.log.warn("merge failed", {
+              branch: s.activeBranch,
+              error: redactCredentials(err instanceof Error ? err.message : String(err))
+            });
+            const resolved = await this.resolveConflictsOrAbort(s, handle.mountPath, "merge");
+            if (resolved) {
+              details.push("Resolved merge conflicts (created .conflict files)");
+            } else {
+              merged = false;
+            }
           }
+          if (lc.pushOnClose) {
+            await gitRemote(["push", "origin", s.branch], handle.mountPath, s, 6e4);
+          }
+          details.push(
+            merged ? `Merged ${s.activeBranch} into ${s.branch}` : `Merge of ${s.activeBranch} into ${s.branch} FAILED`
+          );
         }
-        if (lc.pushOnClose) {
-          await git(["push", "origin", s.branch], handle.mountPath, 6e4);
-        }
-        details.push(
-          merged ? `Merged ${s.activeBranch} into ${s.branch}` : `Merge of ${s.activeBranch} into ${s.branch} FAILED`
-        );
+        return details.join("; ") || void 0;
+      } finally {
+        await this.teardownManagedCredential(handle.id, s);
       }
-      return details.join("; ") || void 0;
-    } finally {
-      await this.teardownManagedCredential(handle.id, s);
-    }
+    });
   }
   // ── Private: managed gitconfig (Tier-2 credential exposure) ──────────────
   /**
@@ -2926,15 +3416,6 @@ var GitConnector = class extends AbstractConnector {
         token: result.token,
         credentialsPath: state.managedGitconfig.credentialsPath
       });
-    } else if (state.targetDir) {
-      const rebake = this.rebakeRemoteAuth(state.targetDir, state);
-      state.rebakeInFlight = rebake;
-      try {
-        await rebake;
-      } finally {
-        if (state.rebakeInFlight === rebake) state.rebakeInFlight = void 0;
-      }
-      if (state.tokenMediator !== mediator) return;
     }
     this.log.info("refresh", {
       event: "refresh",
@@ -2954,11 +3435,7 @@ var GitConnector = class extends AbstractConnector {
       state.refreshTimer = void 0;
     }
     state.tokenMediator = void 0;
-    if (state.rebakeInFlight) await state.rebakeInFlight;
-    if (!state.managedGitconfig) {
-      await this.stripRemoteAuth(state);
-      return;
-    }
+    if (!state.managedGitconfig) return;
     try {
       removeMountBlock({
         mountId: connectorId,
@@ -2991,7 +3468,7 @@ var GitConnector = class extends AbstractConnector {
    * The intent is to preserve whatever the agent last had on disk. We
    * therefore:
    *   - `git init` — creates `.git/`; does not modify any existing file.
-   *   - `git remote add origin <authUrl>` — wires up the remote so the
+   *   - `git remote add origin <remoteUrl>` — wires up the remote so the
    *     normal lifecycle hooks (`pushOnHibernate`, `pushAfterCommit`)
    *     have a target.
    *
@@ -3003,32 +3480,32 @@ var GitConnector = class extends AbstractConnector {
    *     user's last on-disk state. The agent or autocommit reconciles
    *     with the remote later.
    *
-   * Token persistence: the auth URL gets written into `.git/config`
-   * exactly like the `git clone <authUrl>` path does — token-rotation
-   * handling is external to this method (managed-gitconfig credential
-   * helper refresh in Tier-2 connectors).
+   * `remoteUrl` carries no credential; network commands authenticate per
+   * command (see `runRemoteGit`).
    */
-  async initInPlace(targetDir, authUrl) {
+  async initInPlace(targetDir, remoteUrl) {
     await git(["init"], targetDir, 1e4);
     try {
       await git(["remote", "remove", "origin"], targetDir, 5e3);
     } catch {
     }
-    await git(["remote", "add", "origin", authUrl], targetDir, 5e3);
+    await git(["remote", "add", "origin", remoteUrl], targetDir, 5e3);
   }
   /**
-   * Count `refs/heads/*` on `authUrl`, optionally narrowed to one `branch`.
+   * Count `refs/heads/*` on the remote, optionally narrowed to one `branch`.
    *
    * Returns `null` when the probe itself fails (network, auth, bad URL).
    * "Cannot tell" must never collapse into "no refs": the empty-remote
    * fallback WRITES to origin, and every caller therefore treats `null` as
    * "assume populated" and falls through to the path that fails loudly.
    */
-  async countRemoteHeads(targetDir, authUrl, branch) {
+  async countRemoteHeads(targetDir, auth, branch) {
+    const remoteUrl = plainRemoteUrl(auth);
     try {
-      const out = await runGit(
-        branch === void 0 ? [...gitPrefix(targetDir), "ls-remote", "--heads", authUrl] : [...gitPrefix(targetDir), "ls-remote", "--heads", authUrl, `refs/heads/${branch}`],
-        { timeout: 3e4 }
+      const out = await runRemoteGit(
+        branch === void 0 ? ["ls-remote", "--heads", remoteUrl] : ["ls-remote", "--heads", remoteUrl, `refs/heads/${branch}`],
+        auth,
+        { safeDir: targetDir, timeout: 3e4 }
       );
       return out.length === 0 ? 0 : out.split("\n").length;
     } catch (err) {
@@ -3062,8 +3539,8 @@ var GitConnector = class extends AbstractConnector {
    * come up with a usable checkout even when origin is unreachable — the
    * lifecycle hooks (`pushAfterCommit`, hibernate/close push) publish later.
    */
-  async bootstrapEmptyRemote(targetDir, branch, authUrl, access) {
-    await this.initInPlace(targetDir, authUrl);
+  async bootstrapEmptyRemote(targetDir, branch, auth, access) {
+    await this.initInPlace(targetDir, plainRemoteUrl(auth));
     await git(["symbolic-ref", "HEAD", `refs/heads/${branch}`], targetDir, 5e3);
     await git(
       [
@@ -3086,7 +3563,7 @@ var GitConnector = class extends AbstractConnector {
       return;
     }
     try {
-      await git(["push", "-u", "origin", branch], targetDir, 6e4);
+      await gitRemote(["push", "-u", "origin", branch], targetDir, auth, 6e4);
       this.log.info("empty remote initialised on origin", { branch });
       return;
     } catch (err) {
@@ -3095,11 +3572,11 @@ var GitConnector = class extends AbstractConnector {
         error: redactCredentials(err instanceof Error ? err.message : String(err))
       });
     }
-    const publishedElsewhere = await this.countRemoteHeads(targetDir, authUrl, branch);
+    const publishedElsewhere = await this.countRemoteHeads(targetDir, auth, branch);
     if (publishedElsewhere === null || publishedElsewhere === 0) return;
     try {
       this.log.info("origin gained the branch concurrently \u2014 adopting it", { branch });
-      await this.bootstrapFromOrigin(targetDir, branch, authUrl);
+      await this.bootstrapFromOrigin(targetDir, branch, auth);
     } catch (err) {
       this.log.warn("adopting the concurrently-created branch failed; keeping local branch", {
         branch,
@@ -3138,22 +3615,19 @@ var GitConnector = class extends AbstractConnector {
    * `reset --hard`. Files that do not conflict with the remote stay
    * exactly where they are.
    *
-   * Auth-URL handling matches `initInPlace`: a pre-existing `origin`
-   * remote is replaced with the authed URL so the fetch works even
-   * after token rotation. This persists the token in `.git/config`
-   * the same way `git clone <authUrl>` does — token-rotation handling
-   * is external to this connector method.
+   * A pre-existing `origin` is replaced with the declared URL, which also
+   * drops a token an older driver wrote into it.
    */
-  async bootstrapFromOrigin(targetDir, branch, authUrl) {
+  async bootstrapFromOrigin(targetDir, branch, auth) {
     try {
       await git(["remote", "remove", "origin"], targetDir, 5e3);
     } catch {
     }
-    await git(["remote", "add", "origin", authUrl], targetDir, 5e3);
-    await git(["fetch", "--depth=1", "origin", branch], targetDir, 12e4);
+    await git(["remote", "add", "origin", plainRemoteUrl(auth)], targetDir, 5e3);
+    await gitRemote(["fetch", "--depth=1", "origin", branch], targetDir, auth, 12e4);
     await this.preserveConflictingUntracked(targetDir, branch);
     await git(["checkout", "-B", branch, `origin/${branch}`], targetDir, 3e4);
-    await syncSubmodules(targetDir, this.log);
+    await syncSubmodules(targetDir, this.log, auth);
     try {
       await git(["branch", `--set-upstream-to=origin/${branch}`, branch], targetDir, 5e3);
     } catch {
@@ -3203,16 +3677,7 @@ var GitConnector = class extends AbstractConnector {
       }
     }
   }
-  // ── Private: auth URL ─────────────────────────────────────────────────────
-  authUrl(s) {
-    if (s.token && s.url.startsWith("https://")) {
-      const urlObj = new URL(s.url);
-      urlObj.username = "x-access-token";
-      urlObj.password = s.token;
-      return urlObj.toString();
-    }
-    return s.url;
-  }
+  // ── Private: origin URL ───────────────────────────────────────────────────
   /**
    * Align `origin` with the exact sanitized URL used by the Tier-2 helper.
    * Git does not normalize query/fragment data, path case, or `.git` aliases
@@ -3230,43 +3695,37 @@ var GitConnector = class extends AbstractConnector {
     return credentialScopeUrl;
   }
   /**
-   * Tier-1 only: rewrite `origin` so it carries the token freshly minted on
-   * this connect. The "use as-is" wake path leaves whatever token the first
-   * connect baked in — long-dead for short-lived (GitHub App) tokens. Without
-   * a Tier-2 helper this URL token is the sole credential, so it must be
-   * refreshed here. No-op for anonymous (no token) or non-https remotes.
-   */
-  async rebakeRemoteAuth(targetDir, state) {
-    if (!state.token || !state.url.startsWith("https://")) return;
-    try {
-      await git(["remote", "set-url", "origin", this.authUrl(state)], targetDir, 5e3);
-    } catch (err) {
-      this.log.warn("failed to refresh inline token on origin", {
-        error: err instanceof Error ? err.message : String(err)
-      });
-    }
-  }
-  /**
-   * Tier-1: remove the userinfo from `origin`, so the token baked by
-   * connect/refresh does not stay in `.git/config` after teardown. No-op when
-   * `origin` carries none, or nothing was baked (no token, non-https remote).
+   * Point `origin` at the declared URL, without a credential in it.
+   *
+   * Clones made before the driver authenticated per command hold
+   * `https://x-access-token:<token>@…` in `.git/config`, where the agent can
+   * read it; this is what removes it, on the first connect after an upgrade.
+   * With a token in hand `origin` is set to the declared URL, as the old
+   * re-bake did. Without one only a token-bearing origin is rewritten: a URL
+   * the user declared with their own userinfo is theirs to keep.
    */
-  async stripRemoteAuth(state) {
-    if (!state.token || !state.targetDir || !state.url.startsWith("https://")) return;
+  async reconcileRemoteUrl(targetDir, state) {
     try {
-      const current = await git(["remote", "get-url", "origin"], state.targetDir, 5e3);
-      const bare = new URL(current);
-      if (!bare.username && !bare.password) return;
-      bare.username = "";
-      bare.password = "";
-      await git(["remote", "set-url", "origin", bare.toString()], state.targetDir, 5e3);
-      this.log.info("teardown", {
-        event: "teardown",
-        tier: 1,
-        scope: redactCredentials(state.url)
-      });
+      const current = await gitOrNull(["remote", "get-url", "origin"], targetDir);
+      let wanted = null;
+      if (state.token && state.url.startsWith("https://")) {
+        wanted = plainRemoteUrl(state);
+      } else if (current?.startsWith("https://")) {
+        const u = new URL(current);
+        if (u.username === TOKEN_USERNAME) {
+          u.username = "";
+          u.password = "";
+          wanted = u.toString();
+        }
+      }
+      if (wanted === null || wanted === current) return;
+      await git(
+        current === null ? ["remote", "add", "origin", wanted] : ["remote", "set-url", "origin", wanted],
+        targetDir,
+        5e3
+      );
     } catch (err) {
-      this.log.warn("failed to strip inline token from origin", {
+      this.log.warn("failed to reconcile origin URL", {
         error: redactCredentials(err instanceof Error ? err.message : String(err))
       });
     }
@@ -3285,7 +3744,9 @@ var GitConnector = class extends AbstractConnector {
       }
       if (s.disposed) return;
       s.fetchInFlight = true;
-      void this.runPeriodicFetch(s, mountPath).catch((err) => {
+      void this.withMountLock(s, async () => {
+        if (!s.disposed) await this.runPeriodicFetch(s, mountPath);
+      }).catch((err) => {
         this.log.debug("periodic fetch failed", {
           error: redactCredentials(err instanceof Error ? err.message : String(err))
         });
@@ -3299,14 +3760,15 @@ var GitConnector = class extends AbstractConnector {
     await this.fetchOrigin(s, mountPath);
     if (s.disposed) return;
     if (s.sync.autoRebase && s.activeBranch !== s.branch) {
-      const onOrigin = await this.trackSessionBranch(s.activeBranch, mountPath);
+      const onOrigin = await this.trackSessionBranch(s.activeBranch, mountPath, s);
       if (s.disposed) return;
       if (onOrigin !== "absent") {
         await this.mergeBaseIntoSessionBranch(s, mountPath);
         if (s.disposed) return;
-        await syncSubmodules(mountPath, this.log);
+        await syncSubmodules(mountPath, this.log, s);
         return;
       }
+      if (await this.skipOverUnfinishedOperation(mountPath, "rebase onto base")) return;
       try {
         await gitCommitting(["rebase", `origin/${s.branch}`], mountPath, 6e4);
       } catch (err) {
@@ -3317,11 +3779,11 @@ var GitConnector = class extends AbstractConnector {
         await this.resolveConflictsOrAbort(s, mountPath, "rebase");
       }
       if (s.disposed) return;
-      await syncSubmodules(mountPath, this.log);
+      await syncSubmodules(mountPath, this.log, s);
     } else if (s.sync.autoPull) {
-      await gitCommitting(["pull", "origin", s.activeBranch], mountPath, 6e4);
+      await pullByMerge(s.activeBranch, mountPath, s, 6e4);
       if (s.disposed) return;
-      await syncSubmodules(mountPath, this.log);
+      await syncSubmodules(mountPath, this.log, s);
     }
   }
   /**
@@ -3331,11 +3793,12 @@ var GitConnector = class extends AbstractConnector {
    * refspec fails the whole fetch. Drop it and fetch again. The base branch
    * refspec is never dropped.
    */
-  async fetchOrigin(s, mountPath) {
+  async fetchOrigin(s, mountPath, auth = s) {
     for (let attempt = 0; ; attempt++) {
       try {
-        await runGit([...gitPrefix(mountPath), "fetch", "origin"], {
+        await runRemoteGit(["fetch", "origin"], auth, {
           cwd: mountPath,
+          safeDir: mountPath,
           timeout: 6e4,
           env: cLocaleEnv()
         });
@@ -3362,6 +3825,8 @@ var GitConnector = class extends AbstractConnector {
   async mergeBaseIntoSessionBranch(s, mountPath) {
     const baseRef = `origin/${s.branch}`;
     if (await isAncestor(baseRef, "HEAD", mountPath)) return;
+    if (await this.skipOverUnfinishedOperation(mountPath, "merge of base into session branch"))
+      return;
     try {
       await gitCommitting(["merge", "--no-edit", baseRef], mountPath, 6e4);
       this.log.info("merged base into published session branch", {
@@ -3378,6 +3843,17 @@ var GitConnector = class extends AbstractConnector {
     }
   }
   // ── Conflict resolution ──────────────────────────────────────────────────
+  /**
+   * True (and logged) when a merge or rebase is already open in the checkout,
+   * so a driver merge must not start: its failure path would abort or resolve
+   * the agent's own operation.
+   */
+  async skipOverUnfinishedOperation(cwd, what) {
+    const reason = await unfinishedGitOperation(cwd);
+    if (reason === null) return false;
+    this.log.warn(`${what} skipped: the checkout has an unfinished merge or rebase`, { reason });
+    return true;
+  }
   /**
    * Attempt to resolve merge/rebase conflicts by keeping "ours" and copying
    * "theirs" to a .conflict file. If resolution fails entirely, abort.
@@ -3386,7 +3862,7 @@ var GitConnector = class extends AbstractConnector {
   async resolveConflictsOrAbort(s, mountPath, mode) {
     try {
       const conflicted = (await git(["diff", "--name-only", "--diff-filter=U"], mountPath)).split("\n").filter(Boolean);
-      if (conflicted.length === 0) return false;
+      if (conflicted.length === 0) throw new Error(`${mode} failed without conflicts`);
       for (const file of conflicted) {
         await this.resolveFileConflict(mountPath, file);
       }
@@ -3482,7 +3958,9 @@ var GitConnector = class extends AbstractConnector {
         return;
       }
       s.autoCommitInFlight = true;
-      void this.performAutoCommit(s, mountPath).catch((err) => {
+      void this.withMountLock(s, async () => {
+        if (!s.disposed) await this.performAutoCommit(s, mountPath);
+      }).catch((err) => {
         this.log.debug("auto-commit failed", {
           error: err instanceof Error ? err.message : String(err)
         });
@@ -3493,9 +3971,10 @@ var GitConnector = class extends AbstractConnector {
   }
   async performAutoCommit(s, mountPath) {
     try {
+      if (await refuseUnfinishedOperation(mountPath, this.log)) return;
       const message = await this.generateCommitMessage(mountPath);
       if (s.disposed) return;
-      const result = await commitAll(mountPath, message);
+      const result = await commitAll(mountPath, message, this.log);
       if (!result || s.disposed) return;
       if (s.lifecycle.pushAfterCommit) {
         try {
@@ -3508,7 +3987,7 @@ var GitConnector = class extends AbstractConnector {
   }
   async generateCommitMessage(mountPath) {
     try {
-      await git(["add", "-A"], mountPath);
+      await stageAll(mountPath, this.log);
       const stat5 = await git(["diff", "--cached", "--stat"], mountPath);
       const lines = stat5.split("\n").filter((l) => l.includes("|"));
       if (lines.length === 0) return "skaile: auto-save";
@@ -3523,7 +4002,13 @@ var GitConnector = class extends AbstractConnector {
 function createConnector5() {
   return new GitConnector();
 }
-var __test = { resolveGitConfig };
+var __test = {
+  resolveGitConfig,
+  networkGitEnv,
+  plainRemoteUrl,
+  runRemoteGit,
+  comparableRemoteUrl
+};
 
 // factory-assets/connectors/gmail/adapter.ts
 var GmailConnector = class extends AbstractConnector {
@@ -8264,6 +8749,20 @@ async function buildSdkConnectorTools(manager, options) {
     tools: withActivityLabelDefs(buildConnectorToolDefs(manager, options), options?.z ?? zStatic)
   });
 }
+var GIT_REMOTE_TOOLS = [
+  [
+    "push",
+    "Push a git mount's branch to origin with the mount's credential. Commit with the git CLI first; only commits are pushed. Never forces: a refused push returns status 'rejected' \u2014 run git_pull, then push again. Returns JSON {status, message, sync}."
+  ],
+  [
+    "pull",
+    "Fetch origin and merge it into a git mount's branch with the mount's credential (a merge, never a rebase). On a conflict the merge is aborted, the checkout is left as it was, and status 'conflict' lists the files; merge origin/<branch> locally to resolve. Submodules are not fetched: a moved submodule updates at the next platform sync, and the message names it. Returns JSON {status, message, conflicts?, sync}."
+  ],
+  [
+    "fetch",
+    "Fetch origin for a git mount with the mount's credential. Updates origin/<branch> refs only; the working tree is not touched. Returns JSON {status, sync}."
+  ]
+];
 function buildConnectorToolDefs(manager, options) {
   const shellAccess = options?.shellAccess ?? true;
   const z5 = options?.z ?? zStatic;
@@ -8412,6 +8911,31 @@ function buildConnectorToolDefs(manager, options) {
       }
     }
   });
+  if (manager.listGitConnectors().length > 0) {
+    for (const [op, what] of GIT_REMOTE_TOOLS) {
+      tools.push({
+        name: `git_${op}`,
+        description: what,
+        inputSchema: {
+          connector_id: z5.string().describe("ID of the git mount (see the Mounts table)")
+        },
+        handler: async ({ connector_id }) => {
+          try {
+            if (manager.get(connector_id).connector.name !== "git") {
+              throw new Error(`connector "${connector_id}" is not a git mount`);
+            }
+            const result = await manager.executeOp(connector_id, op, {});
+            return { content: [{ type: "text", text: result }] };
+          } catch (err) {
+            return {
+              content: [{ type: "text", text: `Error: ${err.message}` }],
+              isError: true
+            };
+          }
+        }
+      });
+    }
+  }
   if (!shellAccess) {
     tools.push({
       name: "connector_exec",
@@ -8656,13 +9180,13 @@ function appendGitAuthNotes(lines, manager, fsConnectors) {
     const hosts = [...new Set(tier2.map((m) => safeHost(m.source)))].filter(Boolean);
     lines.push("");
     lines.push(
-      `> **Git auth (CLI):** the git CLI is authenticated for the duration of this session for ${hosts.map((h) => `\`${h}\``).join(", ")}. Use \`git push\` / \`git pull\` directly.`
+      `> **Git auth (CLI):** the git CLI is authenticated for the duration of this session for ${hosts.map((h) => `\`${h}\``).join(", ")} (mounts ${idList(tier2)}). Use \`git push\` / \`git pull\` directly, or the \`git_push\` / \`git_pull\` / \`git_fetch\` tools.`
     );
   }
   if (tier1.length > 0) {
     lines.push("");
     lines.push(
-      '> **Git auth (mount-managed):** `git push` / `git pull` against mount remotes go through the workspace mount, not the agent. If a network git command fails with "could not read Username", do not retry \u2014 the credential is intentionally not exposed to the CLI. Use the workspace\'s autoPush / autoPull or ask the user to enable "Allow agent to use git CLI directly" on the mount.'
+      `> **Git auth (mount-managed):** on mounts ${idList(tier1)} the git CLI has no credential, so a network git command (\`git push\`, \`git pull\`, \`git fetch\`) fails with "could not read Username" \u2014 do not retry it. Commit with the git CLI as usual, then push and pull with the \`git_push\`, \`git_pull\` and \`git_fetch\` tools (\`connector_id\` = the mount id; where only \`connector_exec\` is offered, its \`push\` / \`pull\` / \`fetch\` operations), which run with the mount's credential. They act on the mount's own branch only and never force; a rejected push means \`git_pull\` first. \`git_pull\` does not fetch submodules; they update at the next platform sync. \`gh\` and pull requests are not available on these mounts: they need the user to enable "Allow agent to use git CLI directly" on the mount.`
     );
   }
 }
@@ -8711,6 +9235,9 @@ function buildToolSection(manager, toolConnectors, shellAccess) {
   }
   return lines.join("\n");
 }
+function idList(mounts) {
+  return mounts.map((m) => `\`${m.id}\``).join(", ");
+}
 function safeHost(source) {
   try {
     return new URL(source).host;
@@ -12043,5 +12570,5 @@ function describeFlowOperations() {
 }
 
 export { AbstractConnector, BUILTIN_CONNECTOR_CATALOG, BoxConnector, ClassifierSubpromptRunner, ConnectorManager, DeployConnector, DevServerConnector, FlowAdapter, GitConnector, GmailConnector, GoogleDriveConnector, LocalConnector, LogBuffer, MAX_REARM_MS, MIN_REFRESH_DELAY_MS, ManagedGitconfigCollisionError, MattermostConnector, MemoryConnector, MinIOConnector, NO_ACTIVE_FLOW_ERROR, PortPool, PostgresConnector, REFRESH_LEAD_MS, S3Connector, S3FetchStoppedError, S3PresignedRequestError, S3_PRESIGN_BATCH, SQLiteConnector, SessionInlineSubFlowRunner, SessionNodeExecutor, SessionSubpromptRunner, SharePointConnector, StaticServerConnector, TunnelConnector, WebDAVConnector, XStateConnector, XStateStoreConnector, __test, atomicReplaceCredential, buildConnectorPromptSection, buildConnectorToolDefs, buildFlowPromptEvent, buildFlowToolDefs, buildLazyFlowToolDefs, buildLazySdkFlowTools, buildSdkConnectorTools, buildSdkFlowTools, checkFleetMountLiveness, classifierQuestion, classifyConnectError, createConnector, createConnector10, createConnector11, createConnector12, createConnector13, createConnector14, createConnector15, createConnector16, createConnector17, createConnector18, createConnector19, createConnector2, createConnector20, createConnector3, createConnector4, createConnector5, createConnector6, createConnector7, createConnector8, createConnector9, createFsWatcher, createWorktree, defaultSpawn, describeFlowOperations, driveOrchestratorTurn, ensureDirMode, ensureFleetMounted, ensureRefreshAttemptStamp, findGitRoot, findMissingPackages, getConnector, installNpmPackages, isFleetManaged, isPackageResolvable, listConnectors, listWorktrees, parseListObjectsV2, presignScopePrefix, presignableKey, readGitSyncStatus, registerBuiltinConnectors, removeMountBlock, removeUnavailableMountBlock, renderCredentialHelperScript, tryGetConnector, worktreeRegistry, writeHelperScript, writeMountBlock, writeUnavailableMountBlock };
-//# sourceMappingURL=chunk-3SZLZ56M.js.map
-//# sourceMappingURL=chunk-3SZLZ56M.js.map
+//# sourceMappingURL=chunk-EZOFQW3G.js.map
+//# sourceMappingURL=chunk-EZOFQW3G.js.map