@uniqbit/mate-core 0.18.0 → 0.18.1-canary.1

package/package.json

@@ -1,8 +1,13 @@
 {
   "name": "@uniqbit/mate-core",
-  "version": "0.18.0",
+  "version": "0.18.1-canary.1",
   "description": "Core framework and plugin APIs for Mate.",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/uniqbit-ag/mate-cli.git",
+    "directory": "packages/mate-core"
+  },
   "files": [
     "src/",
     "wrappers/",

package/src/cli/commands/artifact/finish/git.ts

@@ -2,6 +2,8 @@ import fs from "node:fs";
 import { spawnSync } from "node:child_process";
 import path from "node:path";
 
+import { runPreferringSsh, type GitResult } from "../../../../runtime/companion-git";
+
 export interface RebaseResult {
   ok: boolean;
   conflictedPaths: string[];
@@ -46,7 +48,7 @@ export interface GitOps {
 
 function gitRun(
   companionPath: string,
-  args: string[],
+  args: readonly string[],
 ): { status: number; out: string; err: string } {
   const {
     GIT_DIR: _gitDir,
@@ -112,7 +114,13 @@ export function defaultGitOps(
   workingRepoPath = process.env.MATE_REPO_PATH,
 ): GitOps {
   assertSafeCompanionRoot(companionPath, workingRepoPath);
-  const exec = (args: string[]) => gitRun(companionPath, args);
+  const exec = (args: readonly string[]) => gitRun(companionPath, args);
+  const toResult = (res: ReturnType<typeof exec>): GitResult => ({
+    status: res.status,
+    stdout: res.out,
+    stderr: res.err,
+  });
+  const execNetwork = (args: string[]) => runPreferringSsh(exec, args, toResult);
   const execOrThrow = (args: string[]) => {
     const res = exec(args);
     if (res.status !== 0) {
@@ -185,7 +193,8 @@ export function defaultGitOps(
       return exec(["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"]).status === 0;
     },
     async fetch() {
-      execOrThrow(["fetch"]);
+      const res = execNetwork(["fetch"]);
+      if (res.status !== 0) throw new Error(`git fetch failed: ${res.err || res.out}`);
     },
     async rebaseOntoUpstream() {
       const res = exec(["rebase", "--autostash", "@{u}"]);
@@ -205,7 +214,7 @@ export function defaultGitOps(
       execOrThrow(["tag", "-a", name, "-m", message]);
     },
     async push() {
-      const res = exec(["push", "--follow-tags"]);
+      const res = execNetwork(["push", "--follow-tags"]);
       return { ok: res.status === 0, error: res.err || res.out };
     },
   };

package/src/cli/commands/companion/link.ts

@@ -19,6 +19,7 @@ import { runSetupFlowAtPath } from "../setup";
 import { runInstallCommand } from "../install";
 import type { CompanionSource, LinkedRepository } from "../../../lib/orchestrator/types";
 import { invalidateInstallState } from "../../../lib/install";
+import { toSshUrl } from "../../../runtime/companion-git";
 
 interface CompanionLinkCommandDeps {
   selectCompanionLinkInputs?: (
@@ -61,23 +62,6 @@ export async function runCompanionLinkCommand(argv: string[]): Promise<void> {
   return companionLinkCommandDeps.runCompanionLinkCommandWithDeps(argv);
 }
 
-function toSshUrl(url: string): string | null {
-  try {
-    const parsed = new URL(url.trim());
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
-    if (!parsed.hostname || parsed.pathname === "/") return null;
-
-    const repositoryPath = parsed.pathname.replace(/^\/+/, "");
-    if (!repositoryPath) return null;
-
-    // Keep the usual scp-style form when no SSH port is specified.
-    if (!parsed.port) return `git@${parsed.hostname}:${repositoryPath}`;
-    return `ssh://git@${parsed.hostname}:${parsed.port}/${repositoryPath}`;
-  } catch {
-    return null;
-  }
-}
-
 function exitWithError(message: string): never {
   process.stderr.write(`${message}\n`);
   process.exit(1);

package/src/lib/orchestrator/companion-git-sync.ts

@@ -10,7 +10,10 @@ import {
   gitEnvironment,
   isAuthenticationFailure,
   outputLines,
+  REMOTE_URLS_QUERY,
   resolveUpstreamTargetWith,
+  shouldRetryWithoutSsh,
+  sshRewriteArgs,
   type GitResult,
 } from "../../runtime/companion-git";
 import { recordCompanionSync } from "../../runtime/companion-git-state";
@@ -172,11 +175,7 @@ export class CompanionGitSync {
     }
     const dirty = outputLines(before.stdout).length > 0;
 
-    const fetch = await this.command(
-      companionPath,
-      ["fetch", target.remote, target.branch],
-      interactiveGit ? "interactive" : undefined,
-    );
+    const fetch = await this.fetch(companionPath, target, interactiveGit);
     if (fetch.status !== 0) {
       const authenticationFailure = isAuthenticationFailure(fetch);
       const recovery = interactiveGit
@@ -248,6 +247,25 @@ export class CompanionGitSync {
     };
   }
 
+  /**
+   * SSH attempt stays captured: a failure there is expected noise, and SSH
+   * still prompts for passphrases or host keys on the terminal itself.
+   */
+  private async fetch(
+    companionPath: string,
+    target: SyncTarget,
+    interactiveGit: boolean,
+  ): Promise<GitCommandResult> {
+    const args = ["fetch", target.remote, target.branch];
+    const remotes = await this.command(companionPath, REMOTE_URLS_QUERY);
+    const rewrite = remotes.status === 0 ? sshRewriteArgs(remotes.stdout) : [];
+    if (rewrite.length > 0) {
+      const overSsh = await this.command(companionPath, [...rewrite, ...args]);
+      if (!shouldRetryWithoutSsh(overSsh)) return overSsh;
+    }
+    return this.command(companionPath, args, interactiveGit ? "interactive" : undefined);
+  }
+
   private async mergeAndRestore(
     companionPath: string,
     target: SyncTarget,

package/src/lib/orchestrator/companion-hub.ts

@@ -17,6 +17,7 @@ import {
 import { hydrateDynamicPlugins } from "../../tools/setup/dynamic-plugins/hydrate";
 import { applySetupCompatibilities } from "../../tools/setup";
 import { findRepoLocalRegistryFile } from "./repo-local-registry";
+import { runPreferringSsh, toSshUrl } from "../../runtime/companion-git";
 
 export interface GitCommandResult {
   status: number | null;
@@ -217,10 +218,15 @@ export async function materializeHubMember(
   await fs.mkdir(path.dirname(destination), { recursive: true });
   try {
     if (source.kind === "git") {
-      const args = ["clone"];
-      if (source.ref) args.push("--branch", source.ref);
-      args.push(source.url!, destination);
-      gitOutputOrThrow(git(hubPath, args), `Cloning ${source.url}`);
+      const branch = source.ref ? ["--branch", source.ref] : [];
+      const cloneFrom = (url: string) => git(hubPath, ["clone", ...branch, url, destination]);
+      const sshUrl = toSshUrl(source.url!);
+      let clone = sshUrl ? cloneFrom(sshUrl) : undefined;
+      if (!clone || clone.status !== 0) {
+        if (clone) await fs.rm(destination, { recursive: true, force: true });
+        clone = cloneFrom(source.url!);
+      }
+      gitOutputOrThrow(clone, `Cloning ${source.url}`);
     } else {
       await copyWithoutGit(source.path!, destination);
     }
@@ -288,7 +294,11 @@ async function syncHubMember(
     return { id: member.id, status: "dirty", message: "local changes must be resolved first" };
   }
 
-  const fetch = git(memberPath, ["fetch", "origin"]);
+  const fetch = runPreferringSsh(
+    (args) => git(memberPath, [...args]),
+    ["fetch", "origin"],
+    (result) => ({ ...result, status: result.status ?? 1 }),
+  );
   if (fetch.status !== 0) {
     return { id: member.id, status: "failed", message: fetch.stderr || "fetch failed" };
   }

package/src/runtime/companion-git.ts

@@ -61,6 +61,72 @@ export function isAuthenticationFailure(result: GitResult): boolean {
   ].some((marker) => output.includes(marker));
 }
 
+/** `git@host:path` (`ssh://` when a port is given) for an HTTP(S) Git URL; `null` otherwise. */
+export function toSshUrl(url: string): string | null {
+  try {
+    const parsed = new URL(url.trim());
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+    if (!parsed.hostname || parsed.pathname === "/") return null;
+
+    const repositoryPath = parsed.pathname.replace(/^\/+/, "");
+    if (!repositoryPath) return null;
+
+    if (!parsed.port) return `git@${parsed.hostname}:${repositoryPath}`;
+    return `ssh://git@${parsed.hostname}:${parsed.port}/${repositoryPath}`;
+  } catch {
+    return null;
+  }
+}
+
+/** Lists every configured remote URL, one `remote.<name>.<key> <url>` per line. */
+export const REMOTE_URLS_QUERY: readonly string[] = [
+  "config",
+  "--get-regexp",
+  String.raw`^remote\..+\.(url|pushurl)$`,
+];
+
+/**
+ * `-c url.<ssh>.insteadOf=<https>` per HTTP(S) remote in `REMOTE_URLS_QUERY`
+ * output, so one invocation reaches every remote over SSH without rewriting
+ * the stored configuration. Empty when no remote is HTTP(S).
+ */
+export function sshRewriteArgs(remoteUrlsOutput: string): string[] {
+  const urls = new Set(
+    outputLines(remoteUrlsOutput).flatMap((line) => {
+      const url = line.slice(line.indexOf(" ") + 1).trim();
+      return url ? [url] : [];
+    }),
+  );
+  return [...urls].flatMap((url) => {
+    const ssh = toSshUrl(url);
+    return ssh ? ["-c", `url.${ssh}.insteadOf=${url}`] : [];
+  });
+}
+
+/** A remote rejection is a verdict the configured URL would repeat; anything else may be SSH-only. */
+export function shouldRetryWithoutSsh(result: GitResult): boolean {
+  if (result.status === 0) return false;
+  return !/\[(?:remote )?rejected\]/.test(`${result.stderr}\n${result.stdout}`);
+}
+
+/**
+ * Runs a network command over SSH first when a remote is HTTP(S), then as
+ * configured. `run` is the caller's own Git driver.
+ */
+export function runPreferringSsh<R extends { status: number | null }>(
+  run: (args: readonly string[]) => R,
+  args: readonly string[],
+  toResult: (result: R) => GitResult,
+): R {
+  const remotes = toResult(run(REMOTE_URLS_QUERY));
+  const rewrite = remotes.status === 0 ? sshRewriteArgs(remotes.stdout) : [];
+  if (rewrite.length > 0) {
+    const overSsh = run([...rewrite, ...args]);
+    if (!shouldRetryWithoutSsh(toResult(overSsh))) return overSsh;
+  }
+  return run(args);
+}
+
 /**
  * Inherited `GIT_*` overrides would point Git at the session's own repository
  * rather than the companion, so they are stripped from every invocation.

package/src/runtime/companion-sync.ts

@@ -30,6 +30,7 @@ import {
   outputLines,
   resolveUpstreamTargetSync,
   runGitSync,
+  runPreferringSsh,
   type CompanionForkState,
 } from "./companion-git";
 import { hasLaunchEnvironment } from "./env";
@@ -130,10 +131,10 @@ export function syncCompanionUnattended(
     );
   }
 
-  const fetch = runGitSync(
-    companionPath,
+  const fetch = runPreferringSsh(
+    (args) => runGitSync(companionPath, args, remaining()),
     ["fetch", "--no-progress", target.remote, target.branch],
-    remaining(),
+    (result) => result,
   );
   if (fetch.status !== 0) {
     if (isAuthenticationFailure(fetch)) {