@treeseed/sdk 0.6.7 → 0.6.9

package/dist/operations/providers/default.js

@@ -55,6 +55,10 @@ import { repoRoot } from "../../operations/services/workspace-save.js";
 import { run } from "../../operations/services/workspace-tools.js";
 import { resolveTreeseedWorkflowState } from "../../workflow-state.js";
 import { TreeseedWorkflowError, TreeseedWorkflowSdk } from "../../workflow.js";
+import {
+  formatTreeseedDependencyReport,
+  installTreeseedDependencies
+} from "../../managed-dependencies.js";
 function operationResult(metadata, payload, options = {}) {
   return {
     operation: metadata.id,
@@ -64,7 +68,8 @@ function operationResult(metadata, payload, options = {}) {
     nextSteps: options.nextSteps,
     exitCode: options.exitCode ?? (options.ok === false ? 1 : 0),
     stdout: options.stdout,
-    stderr: options.stderr
+    stderr: options.stderr,
+    report: options.report
   };
 }
 function failureResult(metadata, message, options = {}) {
@@ -325,6 +330,29 @@ class DoctorOperation extends BaseOperation {
     });
   }
 }
+class InstallOperation extends BaseOperation {
+  async execute(input, context) {
+    const result = await installTreeseedDependencies({
+      tenantRoot: context.cwd,
+      force: input.force === true,
+      env: context.env,
+      write: context.outputFormat === "json" ? void 0 : context.write
+    });
+    const stdout = [formatTreeseedDependencyReport(result)];
+    return operationResult(this.metadata, result, {
+      ok: result.ok,
+      exitCode: result.ok ? 0 : 1,
+      stdout,
+      report: {
+        ok: result.ok,
+        toolsHome: result.toolsHome,
+        ghConfigDir: result.ghConfigDir,
+        npmInstalls: result.npmInstalls,
+        tools: result.reports
+      }
+    });
+  }
+}
 class AuthLoginOperation extends BaseOperation {
   async execute(input, context) {
     const tenantRoot = context.cwd;
@@ -580,6 +608,7 @@ class DefaultTreeseedOperationsProvider {
       new TemplateOperation("template"),
       new SyncTemplateOperation("sync"),
       new DoctorOperation("doctor"),
+      new InstallOperation("install"),
       new AuthLoginOperation("auth:login"),
       new AuthLogoutOperation("auth:logout"),
       new AuthWhoAmIOperation("auth:whoami"),

package/dist/operations/services/commit-message-provider.d.ts

@@ -0,0 +1,33 @@
+export declare const DEFAULT_COMMIT_AI_MODEL = "@cf/google/gemma-4-26b-a4b-it";
+export type CommitMessageProviderMode = 'auto' | 'cloudflare' | 'fallback' | 'generated';
+export type CommitMessageContext = {
+    repoName: string;
+    repoPath: string;
+    branch: string;
+    kind: 'package' | 'project';
+    branchMode: 'package-release-main' | 'package-dev-save' | 'project-save';
+    changedFiles: string;
+    diff: string;
+    plannedVersion: string | null;
+    plannedTag: string | null;
+    userMessage?: string;
+};
+export type CommitMessageResult = {
+    message: string;
+    provider: 'cloudflare-workers-ai' | 'fallback';
+    fallbackUsed: boolean;
+    error: string | null;
+};
+export type CommitMessageProvider = {
+    generate(context: CommitMessageContext): Promise<string> | string;
+};
+type CommitMessageOptions = {
+    mode?: CommitMessageProviderMode;
+    provider?: CommitMessageProvider;
+    env?: NodeJS.ProcessEnv;
+    fetchImpl?: typeof fetch;
+};
+export declare function formatCommitMessage(type: string, scope: string, summary: string, bullets: string[]): string;
+export declare function generateFallbackCommitMessage(context: CommitMessageContext): string;
+export declare function generateRepositoryCommitMessage(context: CommitMessageContext, options?: CommitMessageOptions): Promise<CommitMessageResult>;
+export {};

package/dist/operations/services/commit-message-provider.js

@@ -0,0 +1,319 @@
+const DEFAULT_COMMIT_AI_MODEL = "@cf/google/gemma-4-26b-a4b-it";
+const allowedTypes = /* @__PURE__ */ new Set(["feat", "fix", "refactor", "test", "docs", "build", "ci", "chore"]);
+const danglingSubjectEndings = /* @__PURE__ */ new Set([
+  "a",
+  "an",
+  "add",
+  "and",
+  "as",
+  "at",
+  "allow",
+  "by",
+  "bump",
+  "change",
+  "for",
+  "from",
+  "implement",
+  "in",
+  "into",
+  "of",
+  "on",
+  "or",
+  "remove",
+  "set",
+  "support",
+  "sync",
+  "to",
+  "update",
+  "with"
+]);
+const defaultTimeoutMs = 3e4;
+const defaultMaxDiffChars = 12e3;
+function envValue(env, key) {
+  const value = env[key];
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function parseNumber(value, fallback) {
+  if (!value) return fallback;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function stripControlCharacters(value) {
+  return value.replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/gu, "");
+}
+function normalizeWhitespace(value) {
+  return stripControlCharacters(value).replace(/\s+/gu, " ").trim();
+}
+function changedPaths(changedFiles) {
+  return changedFiles.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean).map((line) => line.replace(/^([MADRCU?!]{1,2})\s+/u, "").trim()).filter(Boolean);
+}
+function conventionalParts(message) {
+  const value = String(message ?? "").trim();
+  const match = value.match(/^([a-z]+)(?:\(([a-z0-9-]+)\))?:\s*(.+)$/iu);
+  if (!match) return null;
+  const type = match[1].toLowerCase();
+  return {
+    type: allowedTypes.has(type) ? type : "chore",
+    scope: match[2]?.toLowerCase() ?? null,
+    summary: normalizeWhitespace(match[3])
+  };
+}
+function inferType(context) {
+  const conventional = conventionalParts(context.userMessage);
+  if (conventional) return conventional.type;
+  const paths = changedPaths(context.changedFiles);
+  if (paths.length > 0 && paths.every((path) => /(^|\/)(test|tests|__tests__)\/|\.test\.|\.spec\./u.test(path))) return "test";
+  if (paths.some((path) => path.startsWith(".github/") || path.includes("/workflows/"))) return "ci";
+  if (paths.some((path) => /(^|\/)(package|package-lock)\.json$/u.test(path) || path.includes("build") || path.includes("scripts/"))) return "build";
+  if (paths.some((path) => /\.(md|mdx|txt)$/u.test(path) || path.startsWith("docs/"))) return "docs";
+  if (context.diff.includes("fix") || context.diff.includes("bug") || context.diff.includes("fail")) return "fix";
+  if (context.diff.includes("refactor") || context.diff.includes("rename")) return "refactor";
+  return context.kind === "package" && context.branchMode === "package-release-main" ? "chore" : "feat";
+}
+function inferScope(context) {
+  const conventional = conventionalParts(context.userMessage);
+  if (conventional?.scope) return conventional.scope;
+  const counts = /* @__PURE__ */ new Map();
+  for (const path of changedPaths(context.changedFiles)) {
+    const scope = path.startsWith(".github/") ? "ci" : path.includes("workflow") || path.includes("repository-save-orchestrator") ? "workflow" : path.includes("package-reference") || path.includes("publish") || path.includes("release") ? "release" : path.includes("save") ? "save" : path.includes("cli/") || path.startsWith("src/cli") || path.includes("operations-registry") ? "cli" : path.includes("config") || path.endsWith(".yaml") || path.endsWith(".yml") ? "config" : path.includes("test") || path.includes("__tests__") ? "tests" : path.endsWith(".md") || path.endsWith(".mdx") ? "docs" : path.includes("package.json") || path.includes("package-lock.json") || path.includes("build") ? "build" : context.branchMode === "package-dev-save" ? "save" : "workflow";
+    counts.set(scope, (counts.get(scope) ?? 0) + 1);
+  }
+  return [...counts.entries()].sort((left, right) => right[1] - left[1] || left[0].localeCompare(right[0]))[0]?.[0] ?? (context.branchMode === "package-release-main" ? "release" : "save");
+}
+function summaryFromHint(message) {
+  const conventional = conventionalParts(message);
+  const hint = conventional?.summary ?? normalizeWhitespace(String(message ?? ""));
+  if (!hint) return null;
+  return hint.replace(/^(added|adds)\b/iu, "add").replace(/^(updated|updates)\b/iu, "update").replace(/^(fixed|fixes)\b/iu, "fix").replace(/^(prevented|prevents)\b/iu, "prevent").replace(/^(allowed|allows)\b/iu, "allow").replace(/^(implemented|implements)\b/iu, "implement");
+}
+function lastSummaryWord(summary) {
+  return normalizeWhitespace(summary).split(/\s+/u).at(-1)?.toLowerCase().replace(/[^a-z0-9-]/gu, "") ?? "";
+}
+function repairSummaryEnding(summary, fallback = "record changes") {
+  const words = normalizeWhitespace(summary).replace(/[.。]+$/u, "").split(/\s+/u).filter(Boolean);
+  while (words.length > 2 && danglingSubjectEndings.has(lastSummaryWord(words.join(" ")))) {
+    words.pop();
+  }
+  const repaired = words.join(" ").trim();
+  if (!repaired || danglingSubjectEndings.has(lastSummaryWord(repaired))) {
+    return fallback;
+  }
+  return repaired;
+}
+function fallbackSummary(context, type, scope) {
+  const hint = summaryFromHint(context.userMessage);
+  if (hint) return repairSummaryEnding(hint);
+  if (context.branchMode === "package-release-main") return "prepare stable release";
+  if (scope === "cli") return "allow save without message";
+  if (scope === "release" || scope === "ci") return "guard dev tags from publish";
+  if (scope === "workflow" || scope === "save") return "generate save commit messages";
+  if (type === "test") return "cover save workflow behavior";
+  if (type === "docs") return "update workflow guidance";
+  if (type === "build") return "update package build metadata";
+  return "record workflow changes";
+}
+function truncateSubject(type, scope, summary) {
+  const prefix = `${type}(${scope}): `;
+  const cleanSummary = repairSummaryEnding(summary);
+  const maxSummaryLength = Math.max(10, 50 - prefix.length);
+  if (cleanSummary.length <= maxSummaryLength) return `${prefix}${cleanSummary}`;
+  const sliced = cleanSummary.slice(0, maxSummaryLength).replace(/\s+\S*$/u, "").trim();
+  const repaired = repairSummaryEnding(sliced || cleanSummary.slice(0, maxSummaryLength).trim());
+  return `${prefix}${repaired}`;
+}
+function wrapText(value, width = 72) {
+  const words = normalizeWhitespace(value).split(/\s+/u).filter(Boolean);
+  const lines = [];
+  let line = "";
+  for (const word of words) {
+    if (!line) {
+      line = word;
+    } else if (`${line} ${word}`.length <= width) {
+      line = `${line} ${word}`;
+    } else {
+      lines.push(line);
+      line = word;
+    }
+  }
+  if (line) lines.push(line);
+  return lines;
+}
+function formatBullet(text) {
+  const lines = wrapText(text, 70);
+  return lines.map((line, index) => `${index === 0 ? "-" : " "} ${line}`).join("\n");
+}
+function formatCommitMessage(type, scope, summary, bullets) {
+  const normalizedType = allowedTypes.has(type) ? type : "chore";
+  const normalizedScope = scope.toLowerCase().replace(/[^a-z0-9-]+/gu, "-").replace(/^-+|-+$/gu, "") || "workflow";
+  const subject = truncateSubject(normalizedType, normalizedScope, summary);
+  const body = bullets.map((bullet) => normalizeWhitespace(bullet)).filter(Boolean).slice(0, 3).map(formatBullet).join("\n");
+  return `${subject}
+
+${body}`;
+}
+function generateFallbackCommitMessage(context) {
+  const type = inferType(context);
+  const scope = inferScope(context);
+  const summary = fallbackSummary(context, type, scope);
+  const bullets = [
+    context.userMessage?.trim() ? `Uses the provided save hint to describe why the ${scope} checkpoint is necessary.` : `Records the current ${scope} changes in the standard save workflow.`,
+    context.branchMode === "package-dev-save" ? "Keeps development package state on Git tags without publishing stable NPM releases." : context.branchMode === "package-release-main" ? "Prepares stable package metadata for the main branch release path." : "Preserves the project branch state for the parent workflow.",
+    "Keeps the message deterministic when AI generation is unavailable."
+  ];
+  return formatCommitMessage(type, scope, summary, bullets);
+}
+function assertCommitTemplate(message) {
+  const normalized = stripControlCharacters(message).replace(/^```(?:text)?\s*/iu, "").replace(/```\s*$/u, "").trim();
+  const [subject = "", ...rest] = normalized.split(/\r?\n/u);
+  if (!/^(feat|fix|refactor|test|docs|build|ci|chore)\([a-z0-9-]+\): .+/u.test(subject.trim())) {
+    throw new Error("AI commit message did not use the required subject template.");
+  }
+  const summary = subject.replace(/^[a-z]+\([^)]+\):\s*/u, "").trim();
+  if (danglingSubjectEndings.has(lastSummaryWord(summary))) {
+    throw new Error("AI commit message subject appears truncated.");
+  }
+  const bullets = rest.map((line) => line.trim()).filter((line) => line.startsWith("- "));
+  if (bullets.length === 0) {
+    throw new Error("AI commit message did not include body bullets.");
+  }
+  return formatCommitMessage(
+    subject.split("(")[0],
+    subject.match(/\(([^)]+)\)/u)?.[1] ?? "workflow",
+    subject.replace(/^[a-z]+\([^)]+\):\s*/u, ""),
+    bullets.map((line) => line.replace(/^-\s*/u, ""))
+  );
+}
+function cloudflareEndpoint(accountId, model, gatewayId) {
+  const normalizedModel = model.replace(/^\/+/u, "");
+  if (gatewayId) {
+    return `https://gateway.ai.cloudflare.com/v1/${encodeURIComponent(accountId)}/${encodeURIComponent(gatewayId)}/workers-ai/${normalizedModel}`;
+  }
+  return `https://api.cloudflare.com/client/v4/accounts/${encodeURIComponent(accountId)}/ai/run/${normalizedModel}`;
+}
+function cloudflarePrompt(context, maxDiffChars) {
+  return {
+    system: [
+      "Generate exactly one Git commit message.",
+      "Use this template:",
+      "type(scope): short imperative summary",
+      "",
+      "- Explain why this change is necessary.",
+      "- Mention any side effects or constraints.",
+      "- Use 72 character wrap.",
+      "",
+      "Use only these types: feat, fix, refactor, test, docs, build, ci, chore.",
+      "Infer scope from the changed area, not from the repository name.",
+      "Do not include repository name or package version in save messages.",
+      "Return only the commit message."
+    ].join("\n"),
+    user: [
+      `Branch: ${context.branch}`,
+      `Mode: ${context.branchMode}`,
+      `Kind: ${context.kind}`,
+      context.userMessage ? `User hint: ${context.userMessage}` : "User hint: none",
+      context.plannedTag ? `Planned tag: ${context.plannedTag}` : null,
+      "Changed files:",
+      context.changedFiles || "(none)",
+      "Diff:",
+      context.diff.slice(0, maxDiffChars) || "(none)"
+    ].filter((line) => line !== null).join("\n")
+  };
+}
+function extractCloudflareText(payload) {
+  const record = payload && typeof payload === "object" ? payload : {};
+  const result = record.result && typeof record.result === "object" ? record.result : record;
+  for (const key of ["response", "text", "output"]) {
+    if (typeof result[key] === "string") return result[key];
+  }
+  const choices = result.choices;
+  if (Array.isArray(choices)) {
+    const first = choices[0];
+    const message = first?.message;
+    if (typeof message?.content === "string") return message.content;
+    if (typeof first?.text === "string") return first.text;
+  }
+  return null;
+}
+async function generateCloudflareCommitMessage(context, env, fetchImpl) {
+  const token = envValue(env, "CLOUDFLARE_API_TOKEN");
+  const accountId = envValue(env, "CLOUDFLARE_ACCOUNT_ID");
+  const model = envValue(env, "TREESEED_COMMIT_AI_MODEL") ?? DEFAULT_COMMIT_AI_MODEL;
+  if (!token || !accountId) {
+    throw new Error("Cloudflare commit AI requires CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID.");
+  }
+  const timeoutMs = parseNumber(envValue(env, "TREESEED_COMMIT_AI_TIMEOUT_MS"), defaultTimeoutMs);
+  const maxDiffChars = parseNumber(envValue(env, "TREESEED_COMMIT_AI_MAX_DIFF_CHARS"), defaultMaxDiffChars);
+  const prompt = cloudflarePrompt(context, maxDiffChars);
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetchImpl(cloudflareEndpoint(accountId, model, envValue(env, "TREESEED_COMMIT_AI_GATEWAY_ID")), {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        messages: [
+          { role: "system", content: prompt.system },
+          { role: "user", content: prompt.user }
+        ]
+      }),
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      throw new Error(`Cloudflare commit AI failed with HTTP ${response.status}.`);
+    }
+    const text = extractCloudflareText(await response.json());
+    if (!text) {
+      throw new Error("Cloudflare commit AI returned an empty response.");
+    }
+    return assertCommitTemplate(text);
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function generateRepositoryCommitMessage(context, options = {}) {
+  const env = options.env ?? process.env;
+  const mode = options.mode ?? envValue(env, "TREESEED_COMMIT_MESSAGE_PROVIDER") ?? "auto";
+  const fallback = () => generateFallbackCommitMessage(context);
+  if (mode === "fallback") {
+    return { message: fallback(), provider: "fallback", fallbackUsed: false, error: null };
+  }
+  if (mode === "generated" && options.provider) {
+    try {
+      return {
+        message: assertCommitTemplate(await Promise.resolve(options.provider.generate(context))),
+        provider: "cloudflare-workers-ai",
+        fallbackUsed: false,
+        error: null
+      };
+    } catch (error) {
+      return { message: fallback(), provider: "fallback", fallbackUsed: true, error: error instanceof Error ? error.message : String(error) };
+    }
+  }
+  const hasCloudflareConfig = Boolean(envValue(env, "CLOUDFLARE_API_TOKEN") && envValue(env, "CLOUDFLARE_ACCOUNT_ID"));
+  if ((mode === "auto" || mode === "generated") && !hasCloudflareConfig) {
+    return { message: fallback(), provider: "fallback", fallbackUsed: false, error: null };
+  }
+  try {
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    if (typeof fetchImpl !== "function") {
+      throw new Error("Global fetch is unavailable for Cloudflare commit AI.");
+    }
+    return {
+      message: await generateCloudflareCommitMessage(context, env, fetchImpl),
+      provider: "cloudflare-workers-ai",
+      fallbackUsed: false,
+      error: null
+    };
+  } catch (error) {
+    return { message: fallback(), provider: "fallback", fallbackUsed: true, error: error instanceof Error ? error.message : String(error) };
+  }
+}
+export {
+  DEFAULT_COMMIT_AI_MODEL,
+  formatCommitMessage,
+  generateFallbackCommitMessage,
+  generateRepositoryCommitMessage
+};

package/dist/operations/services/config-runtime.js

@@ -47,6 +47,11 @@ import {
 } from "./github-api.js";
 import { loadCliDeployConfig, packageScriptPath, resolveWranglerBin, withProcessCwd } from "./runtime-tools.js";
 import { PRODUCTION_BRANCH, STAGING_BRANCH } from "./git-workflow.js";
+import {
+  createTreeseedManagedToolEnv,
+  resolveTreeseedToolBinary,
+  resolveTreeseedToolCommand
+} from "../../managed-dependencies.js";
 import {
   assertTreeseedKeyAgentResponse,
   getTreeseedKeyAgentPaths,
@@ -1406,9 +1411,14 @@ function collectTreeseedConfigSeedValues(tenantRoot, scope, env = process.env) {
   }
   return filterEnvironmentValuesByRegistry({
     ...machineValues,
-    ...Object.fromEntries(Object.entries(env).map(([key, value]) => [key, value ?? void 0]))
+    ...nonEmptyEnvironmentValues(env)
   }, registry, scope);
 }
+function nonEmptyEnvironmentValues(env = process.env) {
+  return Object.fromEntries(
+    Object.entries(env).filter(([, value]) => typeof value === "string" && value.length > 0)
+  );
+}
 function collectTreeseedConfigSeedValueSources(tenantRoot, scope, env = process.env) {
   warnDeprecatedTreeseedLocalEnvFiles(tenantRoot);
   const registry = collectTreeseedEnvironmentContext(tenantRoot);
@@ -1453,7 +1463,8 @@ function resolveTreeseedLaunchEnvironment({
     }
   }
   const registry = collectTreeseedEnvironmentContext(tenantRoot);
-  const seedValues = scope === "local" ? { ...baseEnv, ...machineValues } : { ...machineValues, ...baseEnv };
+  const baseValues = nonEmptyEnvironmentValues(baseEnv);
+  const seedValues = scope === "local" ? { ...baseValues, ...machineValues } : { ...machineValues, ...baseValues };
   const suggestedValues = getTreeseedEnvironmentSuggestedValues({
     scope,
     purpose: "deploy",
@@ -1465,7 +1476,7 @@ function resolveTreeseedLaunchEnvironment({
   const nonSecretSuggestedValues = Object.fromEntries(
     registry.entries.filter((entry) => entry.sensitivity !== "secret" && typeof suggestedValues[entry.id] === "string" && suggestedValues[entry.id].length > 0).map((entry) => [entry.id, suggestedValues[entry.id]])
   );
-  const scopedValues = scope === "local" ? { ...nonSecretSuggestedValues, ...baseEnv, ...machineValues } : { ...nonSecretSuggestedValues, ...machineValues, ...baseEnv };
+  const scopedValues = scope === "local" ? { ...nonSecretSuggestedValues, ...baseValues, ...machineValues } : { ...nonSecretSuggestedValues, ...machineValues, ...baseValues };
   return {
     ...scopedValues,
     ...overrides
@@ -1541,18 +1552,17 @@ function runGh(args, { cwd, dryRun = false, input, env } = {}) {
   if (dryRun) {
     return { status: 0, stdout: "", stderr: "" };
   }
-  const result = spawnSync("gh", args, {
+  const gh = resolveTreeseedToolBinary("gh", { env });
+  if (!gh) {
+    throw new Error("GitHub CLI `gh` is not installed.");
+  }
+  const result = spawnSync(gh, args, {
     cwd,
     stdio: input !== void 0 ? ["pipe", "pipe", "pipe"] : ["ignore", "pipe", "pipe"],
     encoding: "utf8",
     input,
     timeout: 15e3,
-    env: {
-      ...process.env,
-      ...env ?? {},
-      GH_PROMPT_DISABLED: "1",
-      GH_NO_UPDATE_NOTIFIER: "1"
-    }
+    env: createTreeseedManagedToolEnv({ ...process.env, ...env ?? {} })
   });
   if (result.error?.code === "ETIMEDOUT") {
     throw new Error(`gh ${args.join(" ")} timed out`);
@@ -1566,7 +1576,11 @@ function runRailway(args, { cwd, dryRun = false, input } = {}) {
   if (dryRun) {
     return { status: 0, stdout: "", stderr: "" };
   }
-  const result = spawnSync("railway", args, {
+  const railway = resolveTreeseedToolCommand("railway");
+  if (!railway) {
+    throw new Error("Railway CLI is unavailable.");
+  }
+  const result = spawnSync(railway.command, [...railway.argsPrefix, ...args], {
     cwd,
     stdio: input !== void 0 ? ["pipe", "pipe", "pipe"] : ["ignore", "pipe", "pipe"],
     encoding: "utf8",
@@ -1578,6 +1592,9 @@ function runRailway(args, { cwd, dryRun = false, input } = {}) {
   return result;
 }
 function commandAvailable(command) {
+  if (command === "gh" || command === "wrangler" || command === "railway" || command === "copilot") {
+    return Boolean(resolveTreeseedToolBinary(command));
+  }
   const result = spawnSync("bash", ["-lc", `command -v ${command}`], {
     stdio: "pipe",
     encoding: "utf8"
@@ -1612,8 +1629,10 @@ function toolStatus(name, available, detail, extra = {}) {
   };
 }
 function ensureTreeseedActVerificationTooling({ tenantRoot = process.cwd(), installIfMissing = true, env = process.env, write } = {}) {
-  const githubCli = !commandAvailable("gh") ? toolStatus("githubCli", false, "GitHub CLI `gh` is not installed.") : (() => {
-    const check = checkCommand("gh", ["--version"], { cwd: tenantRoot, env });
+  const managedEnv = createTreeseedManagedToolEnv(env);
+  const ghBinary = resolveTreeseedToolBinary("gh", { env: managedEnv });
+  const githubCli = !ghBinary ? toolStatus("githubCli", false, "GitHub CLI `gh` is not installed.") : (() => {
+    const check = checkCommand(ghBinary, ["--version"], { cwd: tenantRoot, env: managedEnv });
     return toolStatus("githubCli", check.ok, check.ok ? check.stdout.split("\n")[0] ?? "GitHub CLI detected." : check.detail || "GitHub CLI check failed.");
   })();
   let ghActExtension = toolStatus("ghActExtension", false, "GitHub CLI extension `gh-act` is not installed.", {
@@ -1636,23 +1655,24 @@ function ensureTreeseedActVerificationTooling({ tenantRoot = process.cwd(), inst
       );
     }
   })();
-  const railwayCheck = checkCommand("railway", ["--version"], { cwd: tenantRoot, env });
+  const railwayCommand = resolveTreeseedToolCommand("railway", { env });
+  const railwayCheck = railwayCommand ? checkCommand(railwayCommand.command, [...railwayCommand.argsPrefix, "--version"], { cwd: tenantRoot, env }) : { ok: false, stdout: "", detail: "Railway CLI is unavailable." };
   const railwayCli = toolStatus(
     "railwayCli",
     railwayCheck.ok,
     railwayCheck.ok ? railwayCheck.stdout.split("\n")[0] ?? "Railway CLI detected." : railwayCheck.detail || "Railway CLI is unavailable."
   );
-  if (githubCli.available) {
-    const check = checkCommand("gh", ["act", "--version"], { cwd: tenantRoot, env });
+  if (githubCli.available && ghBinary) {
+    const check = checkCommand(ghBinary, ["act", "--version"], { cwd: tenantRoot, env: managedEnv });
     if (check.ok) {
       ghActExtension = toolStatus("ghActExtension", true, check.stdout.split("\n")[0] ?? "gh-act is installed.", {
         attemptedInstall: false,
         installedDuringConfig: false
       });
-    } else if (installIfMissing) {
+    } else if (installIfMissing && commandAvailable("docker")) {
       write?.("Installing GitHub CLI extension `gh-act`...");
-      const install = checkCommand("gh", ["extension", "install", "https://github.com/nektos/gh-act"], { cwd: tenantRoot, env });
-      const postInstall = checkCommand("gh", ["act", "--version"], { cwd: tenantRoot, env });
+      const install = checkCommand(ghBinary, ["extension", "install", "https://github.com/nektos/gh-act"], { cwd: tenantRoot, env: managedEnv });
+      const postInstall = checkCommand(ghBinary, ["act", "--version"], { cwd: tenantRoot, env: managedEnv });
       ghActExtension = toolStatus(
         "ghActExtension",
         postInstall.ok,
@@ -1663,6 +1683,11 @@ function ensureTreeseedActVerificationTooling({ tenantRoot = process.cwd(), inst
           installStatus: install.status
         }
       );
+    } else if (installIfMissing) {
+      ghActExtension = toolStatus("ghActExtension", false, "Docker is not on PATH, so gh-act installation was skipped.", {
+        attemptedInstall: false,
+        installedDuringConfig: false
+      });
     } else {
       ghActExtension = toolStatus("ghActExtension", false, check.detail || "GitHub CLI extension `gh-act` is not installed.", {
         attemptedInstall: false,
@@ -1721,17 +1746,18 @@ function checkGitHubConnection({ tenantRoot, env }) {
   if (!env.GH_TOKEN) {
     return providerConnectionResult("github", false, "GH_TOKEN is not configured.", { skipped: true });
   }
-  if (!commandAvailable("gh")) {
+  const gh = resolveTreeseedToolBinary("gh", { env });
+  if (!gh) {
     return providerConnectionResult("github", false, "GitHub CLI `gh` is not installed.");
   }
   const repository = maybeResolveGitHubRepositorySlug(tenantRoot);
   const args = repository ? ["repo", "view", repository, "--json", "nameWithOwner", "--jq", ".nameWithOwner"] : ["api", "user", "--jq", ".login"];
   for (let attempt = 0; attempt < 3; attempt += 1) {
-    const result = spawnSync("gh", args, {
+    const result = spawnSync(gh, args, {
       cwd: tenantRoot,
       stdio: "pipe",
       encoding: "utf8",
-      env: { ...process.env, ...env },
+      env: createTreeseedManagedToolEnv({ ...process.env, ...env }),
       timeout: CLI_CHECK_TIMEOUT_MS
     });
     if (result.status === 0) {
@@ -1800,7 +1826,8 @@ async function checkRailwayConnection({ tenantRoot, env }) {
   const checkPromise = (async () => {
     for (let attempt = 0; attempt < 3; attempt += 1) {
       try {
-        const whoami = checkCommand("railway", ["whoami"], { cwd: tenantRoot, env });
+        const railwayCommand = resolveTreeseedToolCommand("railway", { env });
+        const whoami = railwayCommand ? checkCommand(railwayCommand.command, [...railwayCommand.argsPrefix, "whoami"], { cwd: tenantRoot, env }) : { ok: false, stdout: "", detail: "Railway CLI is unavailable." };
         if (!whoami.ok) {
           if (/rate.?limit|too many requests|429/iu.test(whoami.detail || "")) {
             return providerConnectionResult(

package/dist/operations/services/git-remote-policy.d.ts

@@ -0,0 +1,9 @@
+export type GitRemoteWriteMode = 'ssh-pushurl' | 'off';
+export declare function sshPushUrlForRemote(remoteUrl: string | null | undefined): string | null;
+export declare function configuredPushUrl(repoDir: string, remoteName?: string): string | null;
+export declare function remoteWriteUrl(repoDir: string, remoteName?: string): string | null;
+export declare function ensureSshPushUrlForOrigin(repoDir: string, remoteUrl: string | null | undefined, mode?: GitRemoteWriteMode): {
+    changed: boolean;
+    pushUrl: string | null;
+    reason: string;
+};

package/dist/operations/services/git-remote-policy.js

@@ -0,0 +1,55 @@
+import { run } from "./workspace-tools.js";
+function normalizeRemote(remoteUrl) {
+  return String(remoteUrl ?? "").trim();
+}
+function sshPushUrlForRemote(remoteUrl) {
+  const remote = normalizeRemote(remoteUrl).replace(/^git\+/u, "");
+  if (!remote || remote.startsWith("/") || remote.startsWith("./") || remote.startsWith("../")) {
+    return null;
+  }
+  if (/^(?:file|ssh):\/\//u.test(remote) || /^git@[^:]+:.+/u.test(remote)) {
+    return null;
+  }
+  const httpsMatch = remote.match(/^https:\/\/([^/]+)\/(.+?)(?:\.git)?$/u);
+  if (!httpsMatch) {
+    return null;
+  }
+  return `git@${httpsMatch[1]}:${httpsMatch[2]}.git`;
+}
+function configuredPushUrl(repoDir, remoteName = "origin") {
+  try {
+    return run("git", ["config", "--get", `remote.${remoteName}.pushurl`], { cwd: repoDir, capture: true }).trim() || null;
+  } catch {
+    return null;
+  }
+}
+function remoteWriteUrl(repoDir, remoteName = "origin") {
+  const pushUrl = configuredPushUrl(repoDir, remoteName);
+  if (pushUrl) return pushUrl;
+  try {
+    return run("git", ["remote", "get-url", remoteName], { cwd: repoDir, capture: true }).trim() || null;
+  } catch {
+    return null;
+  }
+}
+function ensureSshPushUrlForOrigin(repoDir, remoteUrl, mode = "ssh-pushurl") {
+  if (mode === "off") {
+    return { changed: false, pushUrl: configuredPushUrl(repoDir), reason: "disabled" };
+  }
+  const nextPushUrl = sshPushUrlForRemote(remoteUrl);
+  if (!nextPushUrl) {
+    return { changed: false, pushUrl: configuredPushUrl(repoDir), reason: "not-https" };
+  }
+  const currentPushUrl = configuredPushUrl(repoDir);
+  if (currentPushUrl === nextPushUrl) {
+    return { changed: false, pushUrl: currentPushUrl, reason: "already-configured" };
+  }
+  run("git", ["remote", "set-url", "--push", "origin", nextPushUrl], { cwd: repoDir });
+  return { changed: true, pushUrl: nextPushUrl, reason: currentPushUrl ? "updated" : "configured" };
+}
+export {
+  configuredPushUrl,
+  ensureSshPushUrlForOrigin,
+  remoteWriteUrl,
+  sshPushUrlForRemote
+};