@workit-dev/core 0.0.1 → 1.0.0

package/src/forge/reruns.ts

@@ -0,0 +1,132 @@
+// The rerun-once record (design §2.1 `ci rerun`): one row per check rerun on
+// a given head (of a PR, or of a branch such as a red main), so a second rerun
+// of the same check on the same head needs `--force`. Rows use the ledger row shape (`type: "ci.rerun"`) so S13 can
+// fold this file into `ledger.jsonl`.
+//
+// It lives in the git common dir (`<common>/workit/ci-reruns.jsonl`, design
+// §0 #5) so every worktree of the repository shares it and `git clean` does
+// not drop it. Append-only; unreadable lines are skipped.
+import fs from "node:fs";
+import path from "node:path";
+import { gitCommonDir } from "../git/rev";
+
+export type RerunRow = {
+  v: 1;
+  at: string;
+  type: "ci.rerun";
+  forge: string;
+  repo: string;
+  /** The PR whose checks were rerun; null for a branch rerun (`--ref`). */
+  pr: number | null;
+  /** The branch whose latest run was rerun; null for a PR rerun. Absent on older rows. */
+  branch?: string | null;
+  head: string;
+  /** The workflow run / pipeline the check belongs to. Absent on older rows. */
+  runId?: number | null;
+  check: string;
+  reason: string;
+  forced: boolean;
+};
+
+export function rerunLogPath(cwd: string): string | null {
+  const common = gitCommonDir(cwd);
+  return common ? path.join(common, "workit", "ci-reruns.jsonl") : null;
+}
+
+const isRow = (value: unknown): value is RerunRow => {
+  const row = value as Partial<RerunRow> | null;
+  return (
+    !!row &&
+    row.type === "ci.rerun" &&
+    (typeof row.pr === "number" || typeof row.branch === "string") &&
+    typeof row.head === "string" &&
+    typeof row.check === "string" &&
+    typeof row.repo === "string"
+  );
+};
+
+/**
+ * How often each check was rerun on commit `head` in `repo`, whether through
+ * its PR or its branch: one commit's checks are one allowance.
+ */
+export function rerunCounts(cwd: string, key: { repo: string; head: string }): Map<string, number> {
+  const counts = new Map<string, number>();
+  const file = rerunLogPath(cwd);
+  if (!file) return counts;
+  let text: string;
+  try {
+    text = fs.readFileSync(file, "utf8");
+  } catch {
+    return counts;
+  }
+  for (const raw of text.split("\n")) {
+    if (!raw.trim()) continue;
+    let row: unknown;
+    try {
+      row = JSON.parse(raw);
+    } catch {
+      continue;
+    }
+    if (isRow(row) && row.repo === key.repo && row.head === key.head)
+      counts.set(row.check, (counts.get(row.check) ?? 0) + 1);
+  }
+  return counts;
+}
+
+/** Append rows (one write, O_APPEND). Returns false when the file cannot be written. */
+export function recordReruns(cwd: string, rows: readonly RerunRow[]): boolean {
+  if (rows.length === 0) return true;
+  const file = rerunLogPath(cwd);
+  if (!file) return false;
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.appendFileSync(file, rows.map((row) => `${JSON.stringify(row)}\n`).join(""));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+const LOCK_WAIT_MS = 2_000;
+const LOCK_STALE_MS = 60_000;
+
+const pause = (ms: number): void => {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+};
+
+/**
+ * Run `fn` holding `<common>/workit/ci-reruns.lock` (atomic create). Two
+ * concurrent `ci rerun`s therefore cannot both pass the once-per-head check.
+ * A lock older than a minute is from a dead process and is taken over.
+ * Null when the lock stays held past the wait (the caller reports busy).
+ */
+export function withRerunLock<T>(cwd: string, fn: () => T): T | null {
+  const file = rerunLogPath(cwd);
+  if (!file) return fn();
+  const lock = `${file.slice(0, -".jsonl".length)}.lock`;
+  fs.mkdirSync(path.dirname(lock), { recursive: true });
+  const until = Date.now() + LOCK_WAIT_MS;
+  for (;;) {
+    try {
+      fs.closeSync(fs.openSync(lock, "wx"));
+      break;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+      try {
+        if (Date.now() - fs.statSync(lock).mtimeMs > LOCK_STALE_MS) {
+          fs.rmSync(lock, { force: true });
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (Date.now() >= until) return null;
+      pause(50);
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    fs.rmSync(lock, { force: true });
+  }
+}

package/src/forge/resolve.ts

@@ -0,0 +1,509 @@
+// Which forge, which repositories, and which credential (D16, design §0 #6,
+// §2.0 Identity).
+//
+// - The push remote host decides GitHub vs GitLab. A workspace provider that
+//   disagrees is `blocked` for the forge verbs, never silently overridden;
+//   `git push` (checkPushIdentity) only needs git, so it pushes with a note.
+// - PRs/MRs live in the base repository: an `upstream` remote on the same
+//   forge, else the push repo's fork parent, else the push repo itself.
+// - Every API call carries the workspace's credential explicitly, so the
+//   machine-wide active gh/glab account is never switched or relied on:
+//   the workspace `vcs.tokenFile`, else (GitHub) `gh auth token --user
+//   <vcs.account>`, else the CLI's default login. The token is never printed.
+// Config is read, never written.
+import fs from "node:fs";
+import { configFilePath } from "../core/config";
+import { readVcsConfig } from "../core/vcs-config";
+import { resolveRuntimeWorkspaceVcs } from "../core/workspaces";
+import {
+  deriveForge,
+  forgeConflict,
+  pushForge,
+  pushUrl,
+  remoteNames,
+  type DerivedForge,
+  type ForgeHosts,
+  type SshConfig,
+} from "../git/rev";
+import { FORGE_TIMEOUTS, isNetworkError, systemRunner, type ForgeRunner } from "./exec";
+import { createGitHubForge } from "./github";
+import { createGitLabForge } from "./gitlab";
+import { redactText } from "./redact";
+import { failure, success, type Forge, type ForgeResult, type Identity } from "./types";
+
+export type CredentialSource = "workspace_token_file" | "gh_account_token" | "cli_login";
+
+export type ResolvedForge = {
+  /** Bound to the base repository (where the PR/MR lives). */
+  forge: Forge;
+  /** Push remote name. */
+  remote: string;
+  /** Redacted push URL. */
+  url: string;
+  derived: DerivedForge;
+  workspace: string | null;
+  /** The workspace `vcs.account`, when configured. */
+  expectedAccount: string | null;
+  credential: CredentialSource;
+  /** The push (head) repository; differs from forge.repo for a fork. */
+  headRepo: string;
+  /** GitLab project id of the push repository (MR source project). */
+  headProjectId: number | null;
+  fork: boolean;
+  /** Remote to fetch base commits from (the base repo's remote when one exists). */
+  baseRemote: string;
+  /** Absolute deadline (ms, `now()` clock) every API call is clamped to; null = none. */
+  limits: { deadline: number | null };
+  /** The workspace credential's runner, clamped to `limits` (another repo on the same host). */
+  runner: ForgeRunner;
+};
+
+export type ResolveOptions = {
+  branch?: string | null;
+  env?: NodeJS.ProcessEnv;
+  /** Replaces the real gh/glab (tests replay recorded API fixtures). */
+  runner?: ForgeRunner;
+  /** Clock for the deadline (tests use a virtual one). */
+  now?: () => number;
+  /** ssh_config for Host aliases (default: the user's ~/.ssh/config). */
+  sshConfig?: string | SshConfig;
+  /** Absolute deadline (`now()` clock) for every call, resolution included; null = none. */
+  deadline?: number | null;
+};
+
+// Per-process memo of credential lookups and /user answers (a long-lived MCP
+// server re-asks after the TTL). Scoped by runner, so an injected test runner
+// never sees another's answers, and keyed by the gh/glab config location, so
+// another GH_CONFIG_DIR never reuses them; only successes are kept.
+const MEMO_TTL_MS = 5 * 60_000;
+const SYSTEM_SCOPE = {};
+const memoScopes = new WeakMap<object, Map<string, { at: number; value: unknown }>>();
+
+type MemoScope = { owner: object; key: string };
+
+const memoScope = (runner: ForgeRunner | undefined, env: NodeJS.ProcessEnv): MemoScope => ({
+  owner: runner ?? SYSTEM_SCOPE,
+  key: [env.GH_CONFIG_DIR, env.GLAB_CONFIG_DIR, env.XDG_CONFIG_HOME, env.HOME]
+    .map((value) => value ?? "")
+    .join("|"),
+});
+
+function memo<T>(
+  scope: MemoScope,
+  key: string,
+  compute: () => { keep: boolean; value: T },
+  now = Date.now,
+): T {
+  let entries = memoScopes.get(scope.owner);
+  if (!entries) memoScopes.set(scope.owner, (entries = new Map()));
+  const full = `${scope.key} ${key}`;
+  const hit = entries.get(full);
+  if (hit && now() - hit.at < MEMO_TTL_MS) return hit.value as T;
+  const { keep, value } = compute();
+  if (keep) entries.set(full, { at: now(), value });
+  return value;
+}
+
+/** A runner whose calls are clamped to `limits.deadline`, carrying `token`. */
+function clampedRunner(
+  base: ForgeRunner,
+  limits: { deadline: number | null },
+  now: () => number,
+  token?: string,
+): ForgeRunner {
+  return (bin, args, callOptions) => {
+    let timeoutMs = callOptions.timeoutMs;
+    if (limits.deadline !== null) {
+      const remaining = limits.deadline - now();
+      if (remaining <= 0)
+        return {
+          status: null,
+          stdout: "",
+          stderr: "",
+          timedOut: true,
+          missing: false,
+          timeoutMs: 0,
+        };
+      timeoutMs = Math.min(timeoutMs, remaining);
+    }
+    const run = base(bin, args, { ...callOptions, timeoutMs, ...(token ? { token } : {}) });
+    return run.timedOut && run.timeoutMs === undefined ? { ...run, timeoutMs } : run;
+  };
+}
+
+/**
+ * `forge.identity` answered once per explicit credential per TTL (push, then
+ * pr create, …). The CLI's own login (`cli_login`) is never memoized: a
+ * `glab auth login` / `gh auth switch` must show on the next call.
+ */
+const memoizedIdentity = (forge: Forge, scope: MemoScope, credential: Credential): Forge => {
+  if (credential.credential === "cli_login") return forge;
+  const identity = (expected: string | null) => forge.identity(expected);
+  return {
+    ...forge,
+    identity: (expected: string | null) =>
+      memo(
+        scope,
+        `identity ${forge.kind} ${forge.apiHost} ${credential.credential} ${credential.token ?? ""} ${expected ?? ""}`,
+        () => {
+          const value = identity(expected);
+          return { keep: value.ok, value };
+        },
+      ),
+  };
+};
+
+type Credential = { token: string | undefined; credential: CredentialSource };
+
+/** The credential every API call carries (see the header). */
+function resolveCredential(
+  workspace: ReturnType<typeof resolveRuntimeWorkspaceVcs>,
+  derived: DerivedForge,
+  run: ForgeRunner,
+  scope: MemoScope,
+): ForgeResult<Credential> {
+  const { kind, apiHost } = derived;
+  const expectedAccount = workspace?.vcs?.account ?? null;
+  const tokenFile = (workspace?.vcs as { tokenFile?: unknown } | undefined)?.tokenFile;
+  if (typeof tokenFile === "string" && tokenFile.trim()) {
+    // A stored token goes only to the host it is for: the public forge (also
+    // reached through an ~/.ssh/config alias) or a host configured
+    // explicitly (vcs.json github.host/gitlab.host, workspace vcs.host).
+    // A host merely *named* like a forge (github.evil.com) never gets it.
+    const workspaceHost = (workspace?.vcs as { host?: unknown } | undefined)?.host;
+    const explicit =
+      typeof workspaceHost === "string" &&
+      workspaceHost
+        .trim()
+        .toLowerCase()
+        .replace(/^https?:\/\//u, "")
+        .replace(/\/.*$/u, "") === apiHost;
+    if (derived.via === "host_name" && !explicit)
+      return failure(
+        "blocked",
+        `token_host_unverified: push host ${derived.host} only looks like ${kind}; workspace ${workspace?.name ?? "?"} vcs.tokenFile is not sent to it`,
+        `if ${apiHost} is your ${kind} server, set ${kind}.host in ${configFilePath("vcs.json")} (or vcs.host for the workspace); otherwise fix the push remote`,
+      );
+    // Like youtrack.token: a token other users can read is refused (N14).
+    if (process.platform !== "win32") {
+      let mode = 0;
+      try {
+        mode = fs.statSync(tokenFile.trim()).mode;
+      } catch {
+        // unreadable: reported below
+      }
+      if ((mode & 0o077) !== 0)
+        return failure(
+          "blocked",
+          `workspace ${workspace?.name ?? "?"} vcs.tokenFile is readable by group or other (mode ${(mode & 0o777).toString(8).padStart(4, "0")})`,
+          `chmod 600 ${tokenFile.trim()}`,
+        );
+    }
+    let token = "";
+    try {
+      token = fs.readFileSync(tokenFile.trim(), "utf8").trim();
+    } catch {
+      return failure(
+        "blocked",
+        `workspace ${workspace?.name ?? "?"} vcs.tokenFile cannot be read`,
+        `fix vcs.tokenFile in ${configFilePath("workspaces.json")}`,
+      );
+    }
+    if (!token)
+      return failure(
+        "blocked",
+        `workspace ${workspace?.name ?? "?"} vcs.tokenFile is empty`,
+        `fix vcs.tokenFile in ${configFilePath("workspaces.json")}`,
+      );
+    return success({ token, credential: "workspace_token_file" });
+  }
+  // glab keeps one login per host, so a GitLab account is checked, not selected.
+  if (!expectedAccount || kind !== "github")
+    return success({ token: undefined, credential: "cli_login" });
+  return memo(scope, `token ${apiHost} ${expectedAccount}`, () => {
+    const issued = run("gh", ["auth", "token", "--hostname", apiHost, "--user", expectedAccount], {
+      timeoutMs: FORGE_TIMEOUTS.api,
+    });
+    const value = authTokenResult(issued, apiHost, expectedAccount, workspace?.name ?? "?");
+    return { keep: value.ok, value };
+  });
+}
+
+/**
+ * `gh auth token --user`: a timeout or a transport error is `unavailable`
+ * (exit 5, retry); only gh saying it has no such login is identity_unavailable.
+ */
+function authTokenResult(
+  issued: ReturnType<ForgeRunner>,
+  apiHost: string,
+  account: string,
+  workspace: string,
+): ForgeResult<Credential> {
+  if (issued.missing)
+    return failure(
+      "unavailable",
+      "gh is not installed",
+      "install the GitHub CLI (https://cli.github.com) and run: gh auth login",
+    );
+  if (issued.timedOut)
+    return failure(
+      "unavailable",
+      `gh auth token ${issued.timeoutMs === 0 ? "not attempted: the time budget ran out" : `timed out after ${issued.timeoutMs ?? FORGE_TIMEOUTS.api} ms`} (looking up the ${account} login on ${apiHost})`,
+      "gh auth status  # check gh and the network, then retry",
+    );
+  const token = issued.status === 0 ? issued.stdout.trim() : "";
+  if (token) return success({ token, credential: "gh_account_token" });
+  const stderr = redactText(issued.stderr).trim();
+  const first = stderr.split(/\r?\n/u).find((line) => line.trim()) ?? "";
+  if (issued.status !== 0 && first && !/no oauth token|not logged in|no account/iu.test(stderr))
+    return failure(
+      "unavailable",
+      `gh auth token failed${isNetworkError(stderr) ? " (network)" : ""}: ${first.slice(0, 200)}`,
+      "gh auth status  # check gh and the network, then retry",
+    );
+  return failure(
+    "blocked",
+    `identity_unavailable: gh has no login for ${account} on ${apiHost} (workspace ${workspace})`,
+    `gh auth login --hostname ${apiHost}  # sign in as ${account}; workit passes that account's token per call and never switches the active account`,
+  );
+}
+
+const configuredHosts = (): ForgeHosts => {
+  const vcs = readVcsConfig();
+  if (vcs.status !== "valid") return {};
+  const host = (kind: "github" | "gitlab"): string[] => {
+    const value = (vcs.config[kind] as { host?: unknown } | undefined)?.host;
+    return typeof value === "string" && value.trim() ? [value.trim()] : [];
+  };
+  return { github: host("github"), gitlab: host("gitlab") };
+};
+
+const createForge = (derived: DerivedForge, repo: string, runner: ForgeRunner): Forge =>
+  derived.kind === "github"
+    ? createGitHubForge({ apiHost: derived.apiHost, repo, runner })
+    : createGitLabForge({ apiHost: derived.apiHost, repo, runner });
+
+export function resolveForge(
+  cwd: string,
+  options: ResolveOptions = {},
+): ForgeResult<ResolvedForge> {
+  let workspace: ReturnType<typeof resolveRuntimeWorkspaceVcs>;
+  try {
+    workspace = resolveRuntimeWorkspaceVcs(cwd);
+  } catch (error) {
+    return failure(
+      "blocked",
+      error instanceof Error ? error.message : String(error),
+      `fix ${configFilePath("workspaces.json")} (workit init → Workspaces)`,
+    );
+  }
+  const hosts = configuredHosts();
+  const pushed = pushForge(cwd, { branch: options.branch, hosts, sshConfig: options.sshConfig });
+  if (!pushed.ok) return failure(pushed.code, pushed.error, pushed.unblock);
+  const conflict = forgeConflict(pushed.forge, workspace?.vcs?.provider);
+  if (conflict) return failure("blocked", conflict.error, conflict.unblock);
+  const derived = pushed.forge;
+  const { kind, apiHost } = derived;
+  const base = options.runner ?? systemRunner(kind, apiHost, options.env ?? process.env);
+  const scope = memoScope(options.runner, options.env ?? process.env);
+  const now = options.now ?? Date.now;
+  const expectedAccount = workspace?.vcs?.account ?? null;
+  // The deadline covers resolution too, so a verb's --timeout bounds it all.
+  const limits: { deadline: number | null } = { deadline: options.deadline ?? null };
+  const credential = resolveCredential(workspace, derived, clampedRunner(base, limits, now), scope);
+  if (!credential.ok) return credential;
+  const runner = clampedRunner(base, limits, now, credential.data.token);
+
+  // Base repository: an `upstream` remote on the same forge, else the fork parent.
+  const headRepo = derived.repo;
+  const probe = memoizedIdentity(createForge(derived, headRepo, runner), scope, credential.data);
+  const info = probe.repoInfo(headRepo);
+  if (!info.ok && info.code !== "not_found") return info;
+  const headProjectId = info.ok ? info.data.id : null;
+  const remotes = remoteNames(cwd);
+  const repoOfRemote = (name: string): string | null => {
+    const url = pushUrl(cwd, name);
+    const other = url ? deriveForge(url, { hosts, sshConfig: options.sshConfig }) : null;
+    return other && other.kind === kind && other.apiHost === apiHost ? other.repo : null;
+  };
+  const upstream =
+    pushed.remote !== "upstream" && remotes.includes("upstream") ? repoOfRemote("upstream") : null;
+  const baseRepo =
+    upstream && upstream !== headRepo
+      ? upstream
+      : info.ok && info.data.parent
+        ? info.data.parent
+        : headRepo;
+  const baseRemote =
+    baseRepo === headRepo
+      ? pushed.remote
+      : (remotes.find((name) => repoOfRemote(name) === baseRepo) ?? pushed.remote);
+
+  return success({
+    forge:
+      baseRepo === headRepo
+        ? probe
+        : memoizedIdentity(createForge(derived, baseRepo, runner), scope, credential.data),
+    remote: pushed.remote,
+    url: pushed.url,
+    derived,
+    workspace: workspace?.name ?? null,
+    expectedAccount,
+    credential: credential.data.credential,
+    headRepo,
+    headProjectId,
+    fork: baseRepo !== headRepo,
+    baseRemote,
+    limits,
+    runner,
+  });
+}
+
+/**
+ * The credential in use must belong to the workspace account. A mismatch is
+ * `blocked` with the fix (never a global account switch); no configured
+ * account passes; a credential that cannot read /user passes with a note.
+ */
+export function checkIdentity(resolved: ResolvedForge): ForgeResult<Identity> {
+  const { forge, expectedAccount } = resolved;
+  const identity = forge.identity(expectedAccount);
+  if (!identity.ok) return identity;
+  if (identity.data.matches === false)
+    return mismatch(resolved, identity.data.login ?? "?", resolved.workspace);
+  return identity;
+}
+
+const mismatch = <T>(
+  resolved: Pick<ResolvedForge, "forge" | "credential" | "expectedAccount">,
+  login: string,
+  workspace: string | null,
+): ForgeResult<T> => {
+  const { forge, expectedAccount } = resolved;
+  const bin = forge.kind === "github" ? "gh" : "glab";
+  const where = `workspace ${workspace ?? "?"}`;
+  const fileFix = `put a token for ${expectedAccount} in the ${where} vcs.tokenFile`;
+  return failure(
+    "blocked",
+    `identity_mismatch: the ${resolved.credential === "workspace_token_file" ? "vcs.tokenFile token" : `${bin} login`} is ${login} but ${where} expects ${expectedAccount}`,
+    resolved.credential === "workspace_token_file"
+      ? fileFix
+      : forge.kind === "github"
+        ? `gh auth login --hostname ${forge.apiHost}  # sign in as ${expectedAccount}`
+        : // glab keeps one login per host; switching it would change every repo.
+          `${fileFix} (glab keeps one login per host, so workit never switches it)`,
+  );
+};
+
+/** The forge could not answer at all, as opposed to answering against the account. */
+const unreachable = (result: { code: string; error: string }): boolean =>
+  result.code === "unavailable" && !/ is not authenticated for /u.test(result.error);
+
+/** Total budget for the identity check before a push (B1). */
+export const PUSH_IDENTITY_BUDGET_MS = 5_000;
+
+export type PushIdentity = {
+  /**
+   * verified: the forge says the credential is the workspace account.
+   * no_account: the workspace names no vcs.account, so there is nothing to check.
+   * skipped: the check could not run (forge down, slow, unknown, misconfigured);
+   * git pushes anyway and `reason` says why.
+   */
+  status: "verified" | "no_account" | "skipped";
+  forge: "github" | "gitlab" | null;
+  account: string | null;
+  login: string | null;
+  reason?: string;
+  unblock?: string;
+};
+
+/**
+ * The best-effort identity check before `git push`: git decides the transport,
+ * so a forge that cannot answer (missing, slow, offline, unknown, another
+ * provider) pushes with `status: "skipped"` and the reason (S10, B1). Positive
+ * evidence still blocks: another account, no gh login for the workspace
+ * account, a broken token file or a rejected credential. All calls share one
+ * `budgetMs`; explicit credentials are memoized.
+ */
+export function checkPushIdentity(
+  cwd: string,
+  options: Omit<ResolveOptions, "deadline"> & { budgetMs?: number } = {},
+): ForgeResult<PushIdentity> {
+  let workspace: ReturnType<typeof resolveRuntimeWorkspaceVcs>;
+  try {
+    workspace = resolveRuntimeWorkspaceVcs(cwd);
+  } catch (error) {
+    return failure(
+      "blocked",
+      error instanceof Error ? error.message : String(error),
+      `fix ${configFilePath("workspaces.json")} (workit init → Workspaces)`,
+    );
+  }
+  const account = workspace?.vcs?.account ?? null;
+  const skipped = (forge: PushIdentity["forge"], reason: string, unblock?: string) =>
+    success<PushIdentity>({
+      status: "skipped",
+      forge,
+      account,
+      login: null,
+      reason,
+      ...(unblock ? { unblock } : {}),
+    });
+  const pushed = pushForge(cwd, {
+    branch: options.branch,
+    hosts: configuredHosts(),
+    sshConfig: options.sshConfig,
+  });
+  if (!pushed.ok) {
+    const host = /^unsupported_forge: .*?"([^"]+)"/u.exec(pushed.error)?.[1];
+    const what = /could not resolve ssh alias/u.test(pushed.error)
+      ? `could not resolve ssh alias ${host} to GitHub or GitLab`
+      : pushed.error.startsWith("unsupported_forge: ssh host")
+        ? `ssh host ${host} is not a GitHub/GitLab host or an alias workit can resolve`
+        : `${host} is not a GitHub or GitLab host workit knows`;
+    return skipped(
+      null,
+      host
+        ? `unsupported_forge: ${what}; account checks skipped, pushed with git only (no PR or CI verbs)`
+        : pushed.error,
+      pushed.unblock,
+    );
+  }
+  const derived = pushed.forge;
+  const conflict = forgeConflict(derived, workspace?.vcs?.provider);
+  if (conflict) return skipped(derived.kind, conflict.error, conflict.unblock);
+  if (!account) return success({ status: "no_account", forge: derived.kind, account, login: null });
+
+  const base =
+    options.runner ?? systemRunner(derived.kind, derived.apiHost, options.env ?? process.env);
+  const scope = memoScope(options.runner, options.env ?? process.env);
+  const now = options.now ?? Date.now;
+  const limits = { deadline: now() + (options.budgetMs ?? PUSH_IDENTITY_BUDGET_MS) };
+  const credential = resolveCredential(workspace, derived, clampedRunner(base, limits, now), scope);
+  // A forge that cannot answer (missing CLI, timeout, transport) is skipped;
+  // local evidence against the account (no gh login for it, a broken
+  // vcs.tokenFile, a rejected credential) still blocks: over HTTPS git would
+  // push with whatever account gh's credential helper has active.
+  if (!credential.ok)
+    return unreachable(credential)
+      ? skipped(derived.kind, credential.error, credential.unblock)
+      : credential;
+  const forge = memoizedIdentity(
+    createForge(derived, derived.repo, clampedRunner(base, limits, now, credential.data.token)),
+    scope,
+    credential.data,
+  );
+  const identity = forge.identity(account);
+  if (!identity.ok)
+    return unreachable(identity)
+      ? skipped(derived.kind, identity.error, identity.unblock)
+      : identity;
+  if (identity.data.matches === false)
+    return mismatch(
+      { forge, credential: credential.data.credential, expectedAccount: account },
+      identity.data.login ?? "?",
+      workspace?.name ?? null,
+    );
+  if (identity.data.matches === null)
+    return skipped(derived.kind, identity.data.note ?? "the credential cannot read /user");
+  return success({ status: "verified", forge: derived.kind, account, login: identity.data.login });
+}