@vibesdotdev/forge 0.0.0-stage → 1.0.0-rc.4

package/dist/cli/lib/git-credential-setup.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Explicitly wire git.vibes.dev credential.helper for users who select Smart
+ * HTTPS clone/fetch/push.
+ *
+ * Fresh clones and scratch checkouts often lack the helper that the source
+ * workstations already carry in global config. Without it, git falls through to
+ * a TTY password prompt (ENOTTY: "could not read Password … Device not configured")
+ * even when the remote uses the vibes-write@ write-intent URL and the helper
+ * itself works standalone. This module owns the pure detection + config args +
+ * fail-loud remedy so setup is one command, not tribal knowledge.
+ */
+export declare const GIT_VIBES_HOST = "git.vibes.dev";
+export declare const GIT_VIBES_HELPER_KEY = "credential.https://git.vibes.dev.helper";
+export declare const GIT_VIBES_USE_HTTP_PATH_KEY = "credential.https://git.vibes.dev.useHttpPath";
+/**
+ * Git's push-only rewrite to the reserved `vibes-write@` intent URL. SPEC lists
+ * `vibes-write@` push intent as retired, yet it still ships by coordinator
+ * ruling (2026-10-03): kept, and listed for Drew rather than removed.
+ */
+export declare const GIT_VIBES_PUSH_INSTEAD_OF_KEY = "url.https://vibes-write@git.vibes.dev/.pushInsteadOf";
+/**
+ * Non-secret runtime identity that Git must preserve when it launches the
+ * credential helper outside the shell/session that installed it.
+ */
+export interface GitCredentialHelperIdentity {
+    VIBES_HOME: string;
+    VIBES_PROFILE?: string;
+    VIBES_PROFILE_NAME?: string;
+    VIBES_CLI_MODE?: string;
+    VIBES_LOCAL_DEV?: string;
+}
+/** POSIX-shell quote one inert argv or environment value. */
+export declare function shellQuote(value: string): string;
+/**
+ * Build Git's `!` helper from the runtime-declared executable argv.
+ *
+ * Persisting a bare `vibes` command loses the active source/compiled entrypoint
+ * and silently changes VIBES_HOME/profile when Git later invokes the helper.
+ * The declaration is already the runtime's constitutional self-spawn contract,
+ * so project that exact argv plus an allowlist of non-secret identity selectors.
+ */
+export declare function buildGitCredentialHelperValue(selfSpawnArgv: readonly string[], identity: GitCredentialHelperIdentity): string;
+/**
+ * Invoked by git as `!…` using the runtime's declared self-spawn argv.
+ *
+ * A shell function rather than a bare command because git runs the WHOLE
+ * credential chain on every authenticated operation — measured twice per push,
+ * before send-pack starts — and `store`/`erase` are no-ops by contract (the
+ * helper mints an ephemeral token; there is nothing to persist or forget). Only
+ * `get` needs the binary, so the other two return from `/bin/sh` without
+ * spawning a ~93 MB executable whose startup floor is ~0.43s even on its
+ * pre-boot fast path. Same shape the ephemeral push helper already uses in
+ * forge.push.command.impl.ts.
+ *
+ * The read loop drains git's credential block (terminated by a blank line, or
+ * EOF) so git never blocks writing to a helper that is about to exit.
+ */
+export type GitCredentialConfigScope = 'global' | 'local';
+export interface GitCredentialHelperStatus {
+    /** True when the effective post-reset chain contains a Vibes helper. */
+    configured: boolean;
+    /** True only when the runtime's exact executable argv + identity are installed. */
+    identityCurrent: boolean;
+    /** True when useHttpPath is enabled specifically for git.vibes.dev. */
+    useHttpPath: boolean;
+    /** Matching helper lines from `git config --get-regexp`. */
+    helperLines: string[];
+    /** Helpers Git will actually try after applying empty-value chain resets. */
+    effectiveHelperLines: string[];
+    /** Native Git push-only rewrite that requests a write-scoped credential. */
+    pushInsteadOf: boolean;
+}
+/**
+ * Fail-loud remedy when git prompted for a password instead of invoking the helper.
+ * Never silent: every path that detects the gap must surface this string.
+ */
+export declare function missingCredentialHelperRemedy(): string;
+/**
+ * Parse `git config --get-regexp '^credential\\.'` (or broader credential dump)
+ * and decide whether the vibes helper is wired for git.vibes.dev.
+ */
+export declare function inspectGitCredentialConfig(configDump: string, expectedHelperValue?: string): GitCredentialHelperStatus;
+/**
+ * `git config` argv segments (without the `git` binary) for an explicit install.
+ * Scope `global` mutates ~/.gitconfig; `local` requires a repo cwd.
+ */
+export declare function gitConfigArgsForCredentialHelper(scope: GitCredentialConfigScope, helperValue: string): Array<string[]>;
+/**
+ * Optional push-intent remote URL: fetch stays credential-free; push uses
+ * vibes-write@ (retired per SPEC, still shipping; listed for Drew).
+ */
+export declare function writeIntentPushUrlFromCloneUrl(cloneUrl: string): string;
+//# sourceMappingURL=git-credential-setup.d.ts.map

package/dist/cli/lib/git-credential-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-credential-setup.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/git-credential-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAC9C,eAAO,MAAM,oBAAoB,4CAAgD,CAAC;AAClF,eAAO,MAAM,2BAA2B,iDAAqD,CAAC;AAC9F;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,yDAA6D,CAAC;AAExG;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAUD,6DAA6D;AAC7D,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC5C,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,QAAQ,EAAE,2BAA2B,GACnC,MAAM,CAmBR;AAED;;;;;;;;;;;;;;GAcG;AAEH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE1D,MAAM,WAAW,yBAAyB;IACzC,wEAAwE;IACxE,UAAU,EAAE,OAAO,CAAC;IACpB,mFAAmF;IACnF,eAAe,EAAE,OAAO,CAAC;IACzB,uEAAuE;IACvE,WAAW,EAAE,OAAO,CAAC;IACrB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,6EAA6E;IAC7E,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,4EAA4E;IAC5E,aAAa,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,IAAI,MAAM,CAYtD;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACzC,UAAU,EAAE,MAAM,EAClB,mBAAmB,CAAC,EAAE,MAAM,GAC1B,yBAAyB,CAoE3B;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAC/C,KAAK,EAAE,wBAAwB,EAC/B,WAAW,EAAE,MAAM,GACjB,KAAK,CAAC,MAAM,EAAE,CAAC,CAsBjB;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiBvE"}

package/dist/cli/lib/git-credential-setup.js

@@ -0,0 +1,185 @@
+/**
+ * Explicitly wire git.vibes.dev credential.helper for users who select Smart
+ * HTTPS clone/fetch/push.
+ *
+ * Fresh clones and scratch checkouts often lack the helper that the source
+ * workstations already carry in global config. Without it, git falls through to
+ * a TTY password prompt (ENOTTY: "could not read Password … Device not configured")
+ * even when the remote uses the vibes-write@ write-intent URL and the helper
+ * itself works standalone. This module owns the pure detection + config args +
+ * fail-loud remedy so setup is one command, not tribal knowledge.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+export const GIT_VIBES_HOST = 'git.vibes.dev';
+export const GIT_VIBES_HELPER_KEY = `credential.https://${GIT_VIBES_HOST}.helper`;
+export const GIT_VIBES_USE_HTTP_PATH_KEY = `credential.https://${GIT_VIBES_HOST}.useHttpPath`;
+/**
+ * Git's push-only rewrite to the reserved `vibes-write@` intent URL. SPEC lists
+ * `vibes-write@` push intent as retired, yet it still ships by coordinator
+ * ruling (2026-10-03): kept, and listed for Drew rather than removed.
+ */
+export const GIT_VIBES_PUSH_INSTEAD_OF_KEY = `url.https://vibes-write@${GIT_VIBES_HOST}/.pushInsteadOf`;
+const GIT_HELPER_IDENTITY_KEYS = [
+    'VIBES_HOME',
+    'VIBES_PROFILE',
+    'VIBES_PROFILE_NAME',
+    'VIBES_CLI_MODE',
+    'VIBES_LOCAL_DEV'
+];
+/** POSIX-shell quote one inert argv or environment value. */
+export function shellQuote(value) {
+    return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+/**
+ * Build Git's `!` helper from the runtime-declared executable argv.
+ *
+ * Persisting a bare `vibes` command loses the active source/compiled entrypoint
+ * and silently changes VIBES_HOME/profile when Git later invokes the helper.
+ * The declaration is already the runtime's constitutional self-spawn contract,
+ * so project that exact argv plus an allowlist of non-secret identity selectors.
+ */
+export function buildGitCredentialHelperValue(selfSpawnArgv, identity) {
+    if (selfSpawnArgv.length === 0 || selfSpawnArgv.some((arg) => arg.length === 0)) {
+        throw new CapabilityError('Forge Git setup requires a declared non-empty Vibes self-spawn argv', 'INVALID_INPUT', {
+            reason: 'git-helper-argv-invalid',
+            retryable: false
+        });
+    }
+    if (!identity.VIBES_HOME.trim()) {
+        throw new CapabilityError('Forge Git setup requires the canonical VIBES_HOME', 'INVALID_INPUT', {
+            reason: 'git-helper-home-invalid',
+            retryable: false
+        });
+    }
+    const environment = GIT_HELPER_IDENTITY_KEYS.flatMap((key) => {
+        const value = identity[key];
+        return value ? [shellQuote(`${key}=${value}`)] : [];
+    });
+    const command = [...environment, ...selfSpawnArgv.map(shellQuote)].join(' ');
+    return `!f() { if [ "$1" != get ]; then while IFS= read -r l; do [ -z "$l" ] && break; done; exit 0; fi; exec env ${command} forge credential-helper get; }; f`;
+}
+/**
+ * Fail-loud remedy when git prompted for a password instead of invoking the helper.
+ * Never silent: every path that detects the gap must surface this string.
+ */
+export function missingCredentialHelperRemedy() {
+    return ('[forge] git.vibes.dev native HTTPS integration is NOT configured in this checkout.\n' +
+        '  Symptom: git prompts for Password / "could not read Password for … Device not configured"\n' +
+        '  even when remote uses https://vibes-write@git.vibes.dev/… and\n' +
+        '  `vibes forge credential-helper get` works standalone.\n' +
+        '  Enable the credential helper explicitly for the current checkout:\n' +
+        '    vibes forge setup-git --https --local\n' +
+        '  Or opt into global HTTPS behavior:\n' +
+        '    vibes forge setup-git --https\n' +
+        '  Then re-run: git config --get-regexp credential');
+}
+/**
+ * Parse `git config --get-regexp '^credential\\.'` (or broader credential dump)
+ * and decide whether the vibes helper is wired for git.vibes.dev.
+ */
+export function inspectGitCredentialConfig(configDump, expectedHelperValue) {
+    const lines = configDump
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+    const orderedHelperLines = lines.filter((line) => {
+        const lower = line.toLowerCase();
+        return lower.includes('credential.') && lower.includes('helper');
+    });
+    const helperLines = [...new Set(orderedHelperLines)];
+    const effectiveHelperLines = [];
+    const effectiveHelperValues = [];
+    for (const line of orderedHelperLines) {
+        const lower = line.toLowerCase();
+        const keyEnd = line.search(/[\s=]/);
+        const key = (keyEnd < 0 ? lower : lower.slice(0, keyEnd)).trim();
+        const targetsHost = key === GIT_VIBES_HELPER_KEY ||
+            // Bare `credential.helper` applies to every host, including git.vibes.dev.
+            key === 'credential.helper';
+        if (!targetsHost)
+            continue;
+        const value = keyEnd < 0 ? '' : line.slice(keyEnd + 1).trim();
+        // Git defines an empty helper value as a reset of every helper accumulated
+        // from lower-precedence config. Detection must model that same chain or a
+        // stale global Vibes entry can make a broken local reset look configured.
+        if (!value) {
+            effectiveHelperLines.length = 0;
+            effectiveHelperValues.length = 0;
+            continue;
+        }
+        effectiveHelperLines.push(line);
+        effectiveHelperValues.push(value);
+    }
+    const vibesHelper = effectiveHelperLines.some((line) => {
+        const lower = line.toLowerCase();
+        return lower.includes('vibes') && lower.includes('credential-helper');
+    });
+    const useHttpPath = lines.some((line) => {
+        const lower = line.toLowerCase();
+        const keyEnd = line.search(/[\s=]/);
+        const key = (keyEnd < 0 ? lower : lower.slice(0, keyEnd)).trim();
+        if (key !== GIT_VIBES_USE_HTTP_PATH_KEY.toLowerCase())
+            return false;
+        // value true / yes / 1
+        return /\s(true|yes|1)\s*$/i.test(line) || /usehttppath\s*=\s*(true|yes|1)/i.test(line);
+    });
+    const pushInsteadOf = lines.some((line) => {
+        const normalized = line.toLowerCase().replace(/\s*=\s*/g, ' ');
+        return (normalized.startsWith(`${GIT_VIBES_PUSH_INSTEAD_OF_KEY.toLowerCase()} `) &&
+            normalized.endsWith(`https://${GIT_VIBES_HOST}/`));
+    });
+    return {
+        configured: vibesHelper,
+        identityCurrent: expectedHelperValue !== undefined &&
+            expectedHelperValue.length > 0 &&
+            effectiveHelperValues.includes(expectedHelperValue),
+        useHttpPath,
+        helperLines,
+        effectiveHelperLines,
+        pushInsteadOf
+    };
+}
+/**
+ * `git config` argv segments (without the `git` binary) for an explicit install.
+ * Scope `global` mutates ~/.gitconfig; `local` requires a repo cwd.
+ */
+export function gitConfigArgsForCredentialHelper(scope, helperValue) {
+    if (!helperValue.trim()) {
+        throw new CapabilityError('Forge Git setup requires a non-empty credential helper command', 'INVALID_INPUT', {
+            reason: 'git-helper-command-empty',
+            retryable: false
+        });
+    }
+    const scopeFlag = scope === 'global' ? '--global' : '--local';
+    return [
+        [scopeFlag, GIT_VIBES_USE_HTTP_PATH_KEY, 'true'],
+        // An empty helper resets every lower-precedence helper accumulated from
+        // system/global config (notably duplicate osxkeychain + legacy Vibes
+        // entries). The one canonical Vibes helper follows it. Git intentionally
+        // treats credential.helper as a multi-valued chain, so a plain `set`
+        // cannot provide this invariant.
+        [scopeFlag, '--add', GIT_VIBES_HELPER_KEY, ''],
+        [scopeFlag, '--add', GIT_VIBES_HELPER_KEY, helperValue],
+        // Git's native push-only URL rewrite leaves clone/fetch on the read path
+        // while ordinary `git push` supplies the reserved username that requests
+        // a short-lived repo:write credential. No per-repository pushurl ritual.
+        [scopeFlag, GIT_VIBES_PUSH_INSTEAD_OF_KEY, `https://${GIT_VIBES_HOST}/`]
+    ];
+}
+/**
+ * Optional push-intent remote URL: fetch stays credential-free; push uses
+ * vibes-write@ (retired per SPEC, still shipping; listed for Drew).
+ */
+export function writeIntentPushUrlFromCloneUrl(cloneUrl) {
+    const url = URL.canParse(cloneUrl) ? new URL(cloneUrl) : null;
+    if (!url ||
+        url.protocol !== 'https:' ||
+        url.hostname !== GIT_VIBES_HOST ||
+        url.username ||
+        url.password) {
+        throw new CapabilityError(`write-intent push URL requires a credential-free https://${GIT_VIBES_HOST} clone URL`, 'INVALID_INPUT', { reason: 'write-intent-url-invalid', retryable: false });
+    }
+    url.username = 'vibes-write';
+    return url.toString();
+}
+//# sourceMappingURL=git-credential-setup.js.map

package/dist/cli/lib/git-credential-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-credential-setup.js","sourceRoot":"","sources":["../../../src/cli/lib/git-credential-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,cAAc,SAAS,CAAC;AAClF,MAAM,CAAC,MAAM,2BAA2B,GAAG,sBAAsB,cAAc,cAAc,CAAC;AAC9F;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,2BAA2B,cAAc,iBAAiB,CAAC;AAcxG,MAAM,wBAAwB,GAAG;IAChC,YAAY;IACZ,eAAe;IACf,oBAAoB;IACpB,gBAAgB;IAChB,iBAAiB;CACiD,CAAC;AAEpE,6DAA6D;AAC7D,MAAM,UAAU,UAAU,CAAC,KAAa;IACvC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAC5C,aAAgC,EAChC,QAAqC;IAErC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,eAAe,CAAC,qEAAqE,EAAE,eAAe,EAAE;YACjH,MAAM,EAAE,yBAAyB;YACjC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,eAAe,CAAC,mDAAmD,EAAE,eAAe,EAAE;YAC/F,MAAM,EAAE,yBAAyB;YACjC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7E,OAAO,6GAA6G,OAAO,oCAAoC,CAAC;AACjK,CAAC;AAmCD;;;GAGG;AACH,MAAM,UAAU,6BAA6B;IAC5C,OAAO,CACN,sFAAsF;QACtF,+FAA+F;QAC/F,mEAAmE;QACnE,2DAA2D;QAC3D,uEAAuE;QACvE,6CAA6C;QAC7C,wCAAwC;QACxC,qCAAqC;QACrC,mDAAmD,CACnD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACzC,UAAkB,EAClB,mBAA4B;IAE5B,MAAM,KAAK,GAAG,UAAU;SACtB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEpC,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAErD,MAAM,oBAAoB,GAAa,EAAE,CAAC;IAC1C,MAAM,qBAAqB,GAAa,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,MAAM,WAAW,GAChB,GAAG,KAAK,oBAAoB;YAC5B,2EAA2E;YAC3E,GAAG,KAAK,mBAAmB,CAAC;QAC7B,IAAI,CAAC,WAAW;YAAE,SAAS;QAC3B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC;YAChC,qBAAqB,CAAC,MAAM,GAAG,CAAC,CAAC;YACjC,SAAS;QACV,CAAC;QACD,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,IAAI,GAAG,KAAK,2BAA2B,CAAC,WAAW,EAAE;YAAE,OAAO,KAAK,CAAC;QACpE,uBAAuB;QACvB,OAAO,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,CACN,UAAU,CAAC,UAAU,CAAC,GAAG,6BAA6B,CAAC,WAAW,EAAE,GAAG,CAAC;YACxE,UAAU,CAAC,QAAQ,CAAC,WAAW,cAAc,GAAG,CAAC,CACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;QACN,UAAU,EAAE,WAAW;QACvB,eAAe,EACd,mBAAmB,KAAK,SAAS;YACjC,mBAAmB,CAAC,MAAM,GAAG,CAAC;YAC9B,qBAAqB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACpD,WAAW;QACX,WAAW;QACX,oBAAoB;QACpB,aAAa;KACb,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC/C,KAA+B,EAC/B,WAAmB;IAEnB,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,eAAe,CAAC,gEAAgE,EAAE,eAAe,EAAE;YAC5G,MAAM,EAAE,0BAA0B;YAClC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,OAAO;QACN,CAAC,SAAS,EAAE,2BAA2B,EAAE,MAAM,CAAC;QAChD,wEAAwE;QACxE,qEAAqE;QACrE,yEAAyE;QACzE,qEAAqE;QACrE,iCAAiC;QACjC,CAAC,SAAS,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,CAAC;QAC9C,CAAC,SAAS,EAAE,OAAO,EAAE,oBAAoB,EAAE,WAAW,CAAC;QACvD,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,CAAC,SAAS,EAAE,6BAA6B,EAAE,WAAW,cAAc,GAAG,CAAC;KACxE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAAgB;IAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,IACC,CAAC,GAAG;QACJ,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,QAAQ,KAAK,cAAc;QAC/B,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ,EACX,CAAC;QACF,MAAM,IAAI,eAAe,CACxB,4DAA4D,cAAc,YAAY,EACtF,eAAe,EACf,EAAE,MAAM,EAAE,0BAA0B,EAAE,SAAS,EAAE,KAAK,EAAE,CACxD,CAAC;IACH,CAAC;IACD,GAAG,CAAC,QAAQ,GAAG,aAAa,CAAC;IAC7B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC"}

package/dist/cli/lib/git-credential-setup.node.d.ts

@@ -0,0 +1,26 @@
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import { type GitCredentialConfigScope } from './git-credential-setup.ts';
+export type GitExec = (args: string[], options?: {
+    cwd?: string;
+}) => Promise<{
+    code: number;
+    stdout: string;
+    stderr: string;
+}>;
+/**
+ * The git of the handed runtime: each call runs through its
+ * `runtime/execution` with the kernel's git child environment (the host base
+ * set plus git's own selectors), output captured.
+ */
+export declare function runtimeGitExec(runtime: VibesRuntime): GitExec;
+export declare function readCredentialConfigDump(gitExec: GitExec, cwd?: string): Promise<string>;
+/**
+ * The helper re-enters this Vibes executable through the host's
+ * `runtime/host-command` identity; identity keys come from the runtime's
+ * captured environment, never the live process env. The workspace is not
+ * projected: git runs the helper in the repository it operates on, and the
+ * helper's host binds that workspace itself (rc02-rc03 §2.4).
+ */
+export declare function resolveGitCredentialHelperValue(runtime: VibesRuntime): Promise<string>;
+export declare function applyCredentialHelperConfig(scope: GitCredentialConfigScope, gitExec: GitExec, cwd: string | undefined, helperValue: string): Promise<void>;
+//# sourceMappingURL=git-credential-setup.node.d.ts.map

package/dist/cli/lib/git-credential-setup.node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-credential-setup.node.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/git-credential-setup.node.ts"],"names":[],"mappings":"AACA,OAAO,EAA4D,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKlH,OAAO,EAMN,KAAK,wBAAwB,EAC7B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,OAAO,GAAG,CACrB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KACtB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE/D;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAY7D;AAED,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ9F;AAED;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAW5F;AAgBD,wBAAsB,2BAA2B,CAChD,KAAK,EAAE,wBAAwB,EAC/B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,WAAW,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAqBf"}

package/dist/cli/lib/git-credential-setup.node.js

@@ -0,0 +1,89 @@
+import { getPathRoots } from '@vibesdotdev/paths';
+import { CapabilityError, composeChildEnv, getRuntimeHostCommands } from '@vibesdotdev/kernel';
+import { getRuntimeExecution } from '@vibesdotdev/kernel/execution';
+import { gitChildInheritEnv } from '@vibesdotdev/git-operations/core';
+import { redactedCause } from "../../failures.js";
+import { buildGitCredentialHelperValue, GIT_VIBES_HELPER_KEY, GIT_VIBES_PUSH_INSTEAD_OF_KEY, gitConfigArgsForCredentialHelper } from "./git-credential-setup.js";
+/**
+ * The git of the handed runtime: each call runs through its
+ * `runtime/execution` with the kernel's git child environment (the host base
+ * set plus git's own selectors), output captured.
+ */
+export function runtimeGitExec(runtime) {
+    return async (args, options) => {
+        const env = composeChildEnv(runtime, { inheritEnv: gitChildInheritEnv(runtime.getEnvSnapshot()) });
+        const result = await (await getRuntimeExecution(runtime)).execute({
+            command: 'git',
+            args,
+            env,
+            envMode: 'replace',
+            cwd: options?.cwd
+        });
+        return { code: result.exitCode ?? 1, stdout: result.stdout, stderr: result.stderr };
+    };
+}
+export async function readCredentialConfigDump(gitExec, cwd) {
+    // One ordered dump is important: empty helper values reset every preceding
+    // helper, so concatenating host-specific and broad queries corrupts the
+    // effective-chain calculation.
+    const general = await gitExec(['config', '--get-regexp', String.raw `^(credential\.|url\.)`], {
+        cwd
+    });
+    return general.stdout;
+}
+/**
+ * The helper re-enters this Vibes executable through the host's
+ * `runtime/host-command` identity; identity keys come from the runtime's
+ * captured environment, never the live process env. The workspace is not
+ * projected: git runs the helper in the repository it operates on, and the
+ * helper's host binds that workspace itself (rc02-rc03 §2.4).
+ */
+export async function resolveGitCredentialHelperValue(runtime) {
+    const selfSpawnArgv = (await getRuntimeHostCommands(runtime)).selfSpawnArgv('Forge Git setup');
+    const env = runtime.getEnvSnapshot();
+    const identity = {
+        VIBES_HOME: getPathRoots(runtime).vibesHome
+    };
+    for (const key of ['VIBES_PROFILE', 'VIBES_PROFILE_NAME', 'VIBES_CLI_MODE', 'VIBES_LOCAL_DEV']) {
+        const value = env[key];
+        if (value)
+            identity[key] = value;
+    }
+    return buildGitCredentialHelperValue(selfSpawnArgv, identity);
+}
+/**
+ * A `git config` step that failed: a value-free message, the step and exit
+ * code, and git's own text only as the redacted cause.
+ */
+function gitConfigFailure(step, result) {
+    const output = result.stderr.trim() || result.stdout.trim();
+    return new CapabilityError(`git config ${step} failed.`, 'UNAVAILABLE', {
+        reason: 'git-config-failed',
+        retryable: false,
+        details: { step, exitCode: result.code },
+        cause: output ? redactedCause(output) : undefined
+    });
+}
+export async function applyCredentialHelperConfig(scope, gitExec, cwd, helperValue) {
+    const scopeFlag = scope === 'global' ? '--global' : '--local';
+    for (const key of [GIT_VIBES_HELPER_KEY, GIT_VIBES_PUSH_INSTEAD_OF_KEY]) {
+        // Remove every selected-scope value before installing one canonical
+        // projection. Exit 5 means the key was already absent.
+        const unset = await gitExec(['config', scopeFlag, '--unset-all', key], {
+            cwd: scope === 'local' ? cwd : undefined
+        });
+        if (unset.code !== 0 && unset.code !== 5) {
+            throw gitConfigFailure(`${scopeFlag} --unset-all`, unset);
+        }
+    }
+    for (const args of gitConfigArgsForCredentialHelper(scope, helperValue)) {
+        const result = await gitExec(['config', ...args], {
+            cwd: scope === 'local' ? cwd : undefined
+        });
+        if (result.code !== 0) {
+            // The helper value names this host's paths: the step names only the scope.
+            throw gitConfigFailure(scopeFlag, result);
+        }
+    }
+}
+//# sourceMappingURL=git-credential-setup.node.js.map

package/dist/cli/lib/git-credential-setup.node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-credential-setup.node.js","sourceRoot":"","sources":["../../../src/cli/lib/git-credential-setup.node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,sBAAsB,EAAqB,MAAM,qBAAqB,CAAC;AAClH,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EACN,6BAA6B,EAC7B,oBAAoB,EACpB,6BAA6B,EAC7B,gCAAgC,EAGhC,MAAM,2BAA2B,CAAC;AAOnC;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAqB;IACnD,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,kBAAkB,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YACjE,OAAO,EAAE,KAAK;YACd,IAAI;YACJ,GAAG;YACH,OAAO,EAAE,SAAS;YAClB,GAAG,EAAE,OAAO,EAAE,GAAG;SACjB,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACrF,CAAC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAgB,EAAE,GAAY;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,+BAA+B;IAC/B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,GAAG,CAAA,uBAAuB,CAAC,EAAE;QAC5F,GAAG;KACH,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,MAAM,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,OAAqB;IAC1E,MAAM,aAAa,GAAG,CAAC,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;IAC/F,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAgC;QAC7C,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,SAAS;KAC3C,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,iBAAiB,CAAU,EAAE,CAAC;QACzG,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,KAAK;YAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,6BAA6B,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAwD;IAC/F,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5D,OAAO,IAAI,eAAe,CAAC,cAAc,IAAI,UAAU,EAAE,aAAa,EAAE;QACvE,MAAM,EAAE,mBAAmB;QAC3B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE;QACxC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;KACjD,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,KAA+B,EAC/B,OAAgB,EAChB,GAAuB,EACvB,WAAmB;IAEnB,MAAM,SAAS,GAAG,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,KAAK,MAAM,GAAG,IAAI,CAAC,oBAAoB,EAAE,6BAA6B,CAAC,EAAE,CAAC;QACzE,oEAAoE;QACpE,uDAAuD;QACvD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE;YACtE,GAAG,EAAE,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;SACxC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,gBAAgB,CAAC,GAAG,SAAS,cAAc,EAAE,KAAK,CAAC,CAAC;QAC3D,CAAC;IACF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,gCAAgC,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE;YACjD,GAAG,EAAE,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;SACxC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACvB,2EAA2E;YAC3E,MAAM,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/cli/lib/output.d.ts

@@ -0,0 +1,48 @@
+import type { UIContext } from '@vibesdotdev/cli/providers';
+import type { CommandContext } from '@vibesdotdev/cli';
+/**
+ * Shared output helpers for forge-cli. Human-facing tables, JSON, and errors
+ * render through the `cli/ui` the CLI surface handed the command
+ * (`CommandContext.ui`), passed explicitly: there is no ambient or fallback UI.
+ *
+ * Byte-exact protocols are intentionally NOT routed through here: token reveal,
+ * git credential-helper exchange, and command-substitution clone URLs keep
+ * their explicit stdout contracts in their owning implementations.
+ */
+import type { ReadonlyJsonObject } from '@vibesdotdev/kernel/schemas/json';
+export declare function wantsJson(opts?: ReadonlyJsonObject): boolean;
+export declare function wantsQuiet(opts?: ReadonlyJsonObject): boolean;
+/**
+ * The UI the CLI surface handed this command. A host that bound no `cli/ui`
+ * fails the command closed instead of rendering somewhere else.
+ */
+export declare function commandUI(context: Pick<CommandContext, 'ui'>): UIContext;
+/** Render an object/array as pretty JSON to STDOUT. */
+export declare function printJson<Data>(ui: UIContext, value: Data): void;
+/** Render an unadorned human-facing line. */
+export declare function printLine(ui: UIContext, message?: string): void;
+/** Render semantic human-facing status. */
+export declare function printInfo(ui: UIContext, message: string): void;
+export declare function printSuccess(ui: UIContext, message: string): void;
+export declare function printWarning(ui: UIContext, message: string): void;
+export declare function printError(ui: UIContext, message: string): void;
+/** Use the shared interactive policy; non-interactive callers get the default. */
+export declare function confirmAction(ui: UIContext, message: string, defaultValue?: boolean): Promise<boolean>;
+/** A single table column: header + accessor + width. */
+export interface Column<T> {
+    header: string;
+    width: number;
+    value: (row: T) => string;
+}
+/**
+ * Project feature rows into the canonical CLI table renderer.
+ */
+export declare function renderTable<T>(ui: UIContext, rows: T[], columns: Column<T>[], emptyMessage: string): void;
+/** Preserve an exit that an inner Forge command already rendered. */
+export declare function rethrowCLIExitSignal<E>(error: E): void;
+/**
+ * Render an error to STDERR/JSON and request a drained non-zero exit.
+ * Never returns (`requestCLIExit` throws CLIExitSignal after setting exitCode).
+ */
+export declare function failWith<Details extends ReadonlyJsonObject = ReadonlyJsonObject>(ui: UIContext, message: string, opts?: ReadonlyJsonObject, details?: Details): never;
+//# sourceMappingURL=output.d.ts.map

package/dist/cli/lib/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/output.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAE3E,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAE5D;AAED,wBAAgB,UAAU,CAAC,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAE7D;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,SAAS,CAKxE;AAED,uDAAuD;AACvD,wBAAgB,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,GAAG,IAAI,CAEhE;AAED,6CAA6C;AAC7C,wBAAgB,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,SAAK,GAAG,IAAI,CAE3D;AAED,2CAA2C;AAC3C,wBAAgB,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAE9D;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAEjE;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAEjE;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAE/D;AAED,kFAAkF;AAClF,wBAAsB,aAAa,CAClC,EAAE,EAAE,SAAS,EACb,OAAO,EAAE,MAAM,EACf,YAAY,UAAQ,GAClB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,wDAAwD;AACxD,MAAM,WAAW,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAC5B,EAAE,EAAE,SAAS,EACb,IAAI,EAAE,CAAC,EAAE,EACT,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EACpB,YAAY,EAAE,MAAM,GAClB,IAAI,CAWN;AAED,qEAAqE;AACrE,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAGtD;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB,EAC/E,EAAE,EAAE,SAAS,EACb,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,OAAO,GACf,KAAK,CAOP"}

package/dist/cli/lib/output.js

@@ -0,0 +1,74 @@
+import { isCLIExitSignal, requestCLIExit } from '@vibesdotdev/cli/providers';
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+export function wantsJson(opts) {
+    return Boolean(opts && (opts.json === true || opts.format === 'json' || opts.output === 'json'));
+}
+export function wantsQuiet(opts) {
+    return Boolean(opts && opts.quiet === true);
+}
+/**
+ * The UI the CLI surface handed this command. A host that bound no `cli/ui`
+ * fails the command closed instead of rendering somewhere else.
+ */
+export function commandUI(context) {
+    if (context.ui)
+        return context.ui;
+    throw new CapabilityError('This CLI host handed the command no UI (cli/ui).', 'UNAVAILABLE', {
+        reason: 'cli-ui-unavailable'
+    });
+}
+/** Render an object/array as pretty JSON to STDOUT. */
+export function printJson(ui, value) {
+    ui.json(value);
+}
+/** Render an unadorned human-facing line. */
+export function printLine(ui, message = '') {
+    ui.log(message);
+}
+/** Render semantic human-facing status. */
+export function printInfo(ui, message) {
+    ui.info(message);
+}
+export function printSuccess(ui, message) {
+    ui.success(message);
+}
+export function printWarning(ui, message) {
+    ui.warn(message);
+}
+export function printError(ui, message) {
+    ui.error(message);
+}
+/** Use the shared interactive policy; non-interactive callers get the default. */
+export async function confirmAction(ui, message, defaultValue = false) {
+    return ui.confirm(message, defaultValue);
+}
+/**
+ * Project feature rows into the canonical CLI table renderer.
+ */
+export function renderTable(ui, rows, columns, emptyMessage) {
+    if (rows.length === 0) {
+        ui.info(emptyMessage);
+        return;
+    }
+    ui.table(rows.map((row) => Object.fromEntries(columns.map((column) => [column.header, column.value(row)]))), { columns: columns.map((column) => column.header) });
+}
+/** Preserve an exit that an inner Forge command already rendered. */
+export function rethrowCLIExitSignal(error) {
+    const parsed = CaughtFailureSchema.safeParse(error);
+    if (parsed.success && isCLIExitSignal(parsed.data))
+        throw error;
+}
+/**
+ * Render an error to STDERR/JSON and request a drained non-zero exit.
+ * Never returns (`requestCLIExit` throws CLIExitSignal after setting exitCode).
+ */
+export function failWith(ui, message, opts, details) {
+    if (opts && wantsJson(opts)) {
+        printJson(ui, details ? { error: message, ...details } : { error: message });
+    }
+    else {
+        ui.error(`Error: ${message}`);
+    }
+    requestCLIExit(1);
+}
+//# sourceMappingURL=output.js.map

package/dist/cli/lib/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../../src/cli/lib/output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAG7E,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAc3E,MAAM,UAAU,SAAS,CAAC,IAAyB;IAClD,OAAO,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAyB;IACnD,OAAO,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,OAAmC;IAC5D,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,EAAE,CAAC;IAClC,MAAM,IAAI,eAAe,CAAC,kDAAkD,EAAE,aAAa,EAAE;QAC5F,MAAM,EAAE,oBAAoB;KAC5B,CAAC,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,SAAS,CAAO,EAAa,EAAE,KAAW;IACzD,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChB,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,SAAS,CAAC,EAAa,EAAE,OAAO,GAAG,EAAE;IACpD,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACjB,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,SAAS,CAAC,EAAa,EAAE,OAAe;IACvD,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAa,EAAE,OAAe;IAC1D,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAa,EAAE,OAAe;IAC1D,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAa,EAAE,OAAe;IACxD,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,EAAa,EACb,OAAe,EACf,YAAY,GAAG,KAAK;IAEpB,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AAC1C,CAAC;AASD;;GAEG;AACH,MAAM,UAAU,WAAW,CAC1B,EAAa,EACb,IAAS,EACT,OAAoB,EACpB,YAAoB;IAEpB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtB,OAAO;IACR,CAAC;IACD,EAAE,CAAC,KAAK,CACP,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAChB,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC/E,EACD,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CACnD,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAAI,KAAQ;IAC/C,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,KAAK,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CACvB,EAAa,EACb,OAAe,EACf,IAAyB,EACzB,OAAiB;IAEjB,IAAI,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;SAAM,CAAC;QACP,EAAE,CAAC,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,cAAc,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC"}

package/dist/cli/lib/registry-client-config.d.ts

@@ -0,0 +1,34 @@
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+export declare const REGISTRY_TOKEN_ENV = "VIBES_REGISTRY_TOKEN";
+export declare const REGISTRY_SCOPE = "@vibesdotdev";
+export declare function registryAuthKey(origin: string): string;
+export declare function mergeUserNpmrc(existing: string, origin: string): string;
+export declare function mergeUserBunfig(existing: string, origin: string): string;
+export declare function formatRegistryEnvExport(token: string): string;
+/**
+ * The named registry token (`VIBES_REGISTRY_TOKEN`) from the host's declared
+ * secrets store, or `null` when it is not set. It is an install credential,
+ * never the caller's bearer. Any other resolution failure is thrown.
+ */
+export declare function resolveNamedRegistryToken(runtime: VibesRuntime): Promise<string | null>;
+/** True when `error` is the typed signed-out failure of `resolveCallerBearer`. */
+export declare function isNotSignedIn(error: unknown): boolean;
+/** Where the registry client projection writes, from the runtime's path roots. */
+export interface RegistryHomes {
+    /** The user home holding the package-manager client files (`.npmrc`, `.bunfig.toml`). */
+    readonly home: string;
+    /** The Vibes home holding the `registry.env` remint hook. */
+    readonly vibesHome: string;
+    /** The user home holding the shell profiles that source that hook. */
+    readonly userHome: string;
+}
+/**
+ * The registry projection's homes: the path roots' `userHome` and `vibesHome`
+ * (rc02-rc03 §3). Nothing reads `HOME`, `USERPROFILE` or `homedir()`.
+ */
+export declare function registryHomes(runtime: VibesRuntime): RegistryHomes;
+export declare function writeUserRegistryClientConfig(home: string, runtime: VibesRuntime): Promise<{
+    npmrc: string;
+    bunfig: string;
+}>;
+//# sourceMappingURL=registry-client-config.d.ts.map

package/dist/cli/lib/registry-client-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-client-config.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/registry-client-config.ts"],"names":[],"mappings":"AAYA,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzE,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AACzD,eAAO,MAAM,cAAc,iBAAiB,CAAC;AAE7C,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAgBvE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAcxE;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM7D;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAK7F;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAErD;AAED,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,aAAa,CAGlE;AAKD,wBAAsB,6BAA6B,CAClD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,YAAY,GACnB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAa5C"}