agor-live 0.22.0 → 0.23.1

package/dist/core/git/index.js

@@ -1,1305 +1,2 @@
 // src/git/index.ts
-import { existsSync } from "fs";
-import { mkdir, readFile, stat, writeFile } from "fs/promises";
-import { basename, dirname, isAbsolute, join, resolve } from "path";
-import { simpleGit } from "simple-git";
-
-// src/config/config-manager.ts
-import { readFileSync, statSync } from "fs";
-import fs from "fs/promises";
-import os from "os";
-import path from "path";
-import yaml from "js-yaml";
-
-// src/config/analytics-defaults.ts
-function getDefaultAnalyticsConfig() {
-  return {
-    enabled: false,
-    client: {
-      app: "agor-daemon",
-      version: "dev",
-      debug: false
-    },
-    filters: {
-      exclude_events: []
-    },
-    plugins: [
-      {
-        type: "stdout",
-        enabled: false,
-        options: {
-          pretty: false
-        }
-      },
-      {
-        type: "http_batch",
-        enabled: false,
-        options: {
-          url: null,
-          flush_interval_ms: 1e3,
-          max_batch_size: 50,
-          timeout_ms: 3e3,
-          headers: {}
-        }
-      },
-      {
-        type: "module",
-        enabled: false,
-        options: {
-          module_path: null,
-          export_name: "createAnalyticsPlugin",
-          plugin_options: {}
-        }
-      }
-    ]
-  };
-}
-
-// src/config/constants.ts
-var DAEMON = {
-  /**
-   * Default daemon port
-   */
-  DEFAULT_PORT: 3030,
-  /**
-   * Default daemon host
-   */
-  DEFAULT_HOST: "localhost"
-};
-var MCP_TOKEN = {
-  /**
-   * Default lifetime for internal MCP session tokens in milliseconds.
-   * Keep short to bound the blast radius of a leaked token — there is no
-   * revocation mechanism; `exp` is the only backstop.
-   */
-  DEFAULT_EXPIRATION_MS: 24 * 60 * 60 * 1e3
-  // 24 hours
-};
-
-// src/config/executor-heartbeat.ts
-var EXECUTOR_HEARTBEAT_DEFAULT_INTERVAL_MS = 1e4;
-var EXECUTOR_HEARTBEAT_MIN_STALE_AFTER_MS = 3e4;
-var EXECUTOR_HEARTBEAT_DEFAULT_CALLBACK_TIMEOUT_MS = 3e3;
-function positiveIntegerOrDefault(value, fallback) {
-  return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
-}
-function resolveExecutorHeartbeatConfig(execution) {
-  const raw = execution?.executor_heartbeat;
-  const intervalMs = positiveIntegerOrDefault(
-    raw?.interval_ms,
-    EXECUTOR_HEARTBEAT_DEFAULT_INTERVAL_MS
-  );
-  const staleAfterMs = positiveIntegerOrDefault(
-    raw?.stale_after_ms,
-    Math.max(3 * intervalMs, EXECUTOR_HEARTBEAT_MIN_STALE_AFTER_MS)
-  );
-  const timeoutMs = positiveIntegerOrDefault(
-    raw?.callback?.timeout_ms,
-    EXECUTOR_HEARTBEAT_DEFAULT_CALLBACK_TIMEOUT_MS
-  );
-  return {
-    // Default enabled: the heartbeat is a lightweight task-row timestamp patch,
-    // and callback execution remains opt-in via command_template.
-    enabled: raw?.enabled ?? true,
-    interval_ms: intervalMs,
-    stale_after_ms: staleAfterMs,
-    callback: {
-      command_template: raw?.callback?.command_template ?? null,
-      timeout_ms: timeoutMs
-    }
-  };
-}
-
-// src/config/config-manager.ts
-var NO_FILE = -1;
-var NO_FILE_KEY = { mtimeMs: NO_FILE, size: 0 };
-var cachedEntry = null;
-function cacheKeyMatches(a, b) {
-  return a.mtimeMs === b.mtimeMs && a.size === b.size;
-}
-function statCacheKey(configPath) {
-  try {
-    const stat2 = statSync(configPath);
-    return { mtimeMs: stat2.mtimeMs, size: stat2.size };
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      return NO_FILE_KEY;
-    }
-    return null;
-  }
-}
-function readCachedConfig(configPath) {
-  if (cachedEntry === null || cachedEntry.path !== configPath) {
-    return null;
-  }
-  const currentKey = statCacheKey(configPath);
-  if (currentKey === null || !cacheKeyMatches(currentKey, cachedEntry.key)) {
-    return null;
-  }
-  return structuredClone(cachedEntry.config);
-}
-function writeCachedConfig(configPath, config, key) {
-  cachedEntry = { path: configPath, config: structuredClone(config), key };
-}
-function parseAndValidateConfig(content) {
-  const parsed = yaml.load(content);
-  const finalConfig = parsed || {};
-  validateConfig(finalConfig);
-  return finalConfig;
-}
-function getAgorHome() {
-  return path.join(os.homedir(), ".agor");
-}
-function getConfigPath() {
-  return path.join(getAgorHome(), "config.yaml");
-}
-function validateConfig(config) {
-  const mode = config.execution?.unix_user_mode;
-  if (mode === "opportunistic") {
-    throw new Error(
-      `Config error: 'opportunistic' unix_user_mode has been deprecated.
-Please update your config to use one of:
-  - 'insulated': Filesystem isolation via Unix groups (recommended)
-  - 'strict': Full process impersonation required
-
-To update: agor config set execution.unix_user_mode insulated`
-    );
-  }
-  const managedEnvExecutionMode = config.execution?.managed_envs_execution_mode;
-  if (managedEnvExecutionMode !== void 0 && managedEnvExecutionMode !== "hybrid" && managedEnvExecutionMode !== "webhook-only") {
-    throw new Error(
-      `Config error: execution.managed_envs_execution_mode must be one of: hybrid, webhook-only`
-    );
-  }
-  validateOptionalHttpUrl(
-    config.external_launch,
-    "login_redirect_url",
-    "external_launch.login_redirect_url"
-  );
-}
-function validateOptionalHttpUrl(container, key, configPath) {
-  if (!container || container[key] === void 0) return;
-  const raw = container[key];
-  if (typeof raw !== "string") {
-    throw new Error(`Config error: ${configPath} must be an HTTP(S) URL string`);
-  }
-  container[key] = validateHttpUrlString(raw, configPath);
-}
-function validateHttpUrlString(url, label, options = {}) {
-  const trimmed = options.stripTrailingSlash ? url.trim().replace(/\/$/, "") : url.trim();
-  if (!trimmed.startsWith("http://") && !trimmed.startsWith("https://")) {
-    throw new Error(`Invalid ${label}: "${url}". Must start with http:// or https://`);
-  }
-  let parsed;
-  try {
-    parsed = new URL(trimmed);
-  } catch {
-    throw new Error(`Invalid ${label} format: "${url}". Must be a valid HTTP(S) URL.`);
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error(`Invalid ${label}: "${url}". Must use http:// or https://`);
-  }
-  return trimmed;
-}
-function getDefaultConfig() {
-  return {
-    defaults: {
-      board: "main",
-      agent: "claude-code"
-    },
-    display: {
-      tableStyle: "unicode",
-      colorOutput: true
-    },
-    daemon: {
-      port: DAEMON.DEFAULT_PORT,
-      host: DAEMON.DEFAULT_HOST,
-      mcpEnabled: true
-      // Default: Enable built-in MCP server
-    },
-    ui: {
-      port: 5173,
-      host: "localhost"
-    },
-    execution: {
-      session_token_expiration_ms: 864e5,
-      // 24 hours
-      session_token_max_uses: 1,
-      // Single-use tokens
-      mcp_token_expiration_ms: MCP_TOKEN.DEFAULT_EXPIRATION_MS,
-      sync_unix_passwords: true,
-      // Default: sync passwords to Unix
-      executor_heartbeat: resolveExecutorHeartbeatConfig()
-    },
-    analytics: getDefaultAnalyticsConfig()
-  };
-}
-function expandHomePath(input) {
-  if (!input) {
-    return input;
-  }
-  if (input.startsWith("~/")) {
-    return path.join(os.homedir(), input.slice(2));
-  }
-  return input;
-}
-function loadConfigSync() {
-  const configPath = getConfigPath();
-  const cached = readCachedConfig(configPath);
-  if (cached !== null) {
-    return cached;
-  }
-  let beforeKey;
-  let content;
-  let afterKey;
-  try {
-    beforeKey = statCacheKey(configPath);
-    if (beforeKey?.mtimeMs === NO_FILE) {
-      const defaults = getDefaultConfig();
-      writeCachedConfig(configPath, defaults, NO_FILE_KEY);
-      return defaults;
-    }
-    content = readFileSync(configPath, "utf-8");
-    afterKey = statCacheKey(configPath);
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      const defaults = getDefaultConfig();
-      writeCachedConfig(configPath, defaults, NO_FILE_KEY);
-      return defaults;
-    }
-    throw new Error(
-      `Failed to load config: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-  let finalConfig;
-  try {
-    finalConfig = parseAndValidateConfig(content);
-  } catch (error) {
-    throw new Error(
-      `Failed to load config: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-  if (beforeKey !== null && afterKey !== null && cacheKeyMatches(beforeKey, afterKey)) {
-    writeCachedConfig(configPath, finalConfig, beforeKey);
-  }
-  return finalConfig;
-}
-function getDataHome() {
-  if (process.env.AGOR_DATA_HOME) {
-    return expandHomePath(process.env.AGOR_DATA_HOME);
-  }
-  try {
-    const config = loadConfigSync();
-    if (config.paths?.data_home) {
-      return expandHomePath(config.paths.data_home);
-    }
-  } catch {
-  }
-  return getAgorHome();
-}
-function getReposDir() {
-  return path.join(getDataHome(), "repos");
-}
-function getBranchesDir() {
-  return path.join(getDataHome(), "worktrees");
-}
-function getBranchPath(repoSlug, branchName) {
-  return path.join(getBranchesDir(), repoSlug, branchName);
-}
-
-// src/unix/run-as-user.ts
-import { execSync as execSync2 } from "child_process";
-
-// src/unix/user-manager.ts
-import { execSync } from "child_process";
-
-// src/lib/ids.ts
-import { randomBytes } from "crypto";
-import { v7 as uuidv7 } from "uuid";
-
-// src/unix/run-as-user.ts
-function escapeShellArg(arg) {
-  return `'${arg.replace(/'/g, "'\\''")}'`;
-}
-
-// src/utils/url.ts
-function redactUrlUserinfo(input) {
-  return input.replace(
-    /([A-Za-z][A-Za-z0-9+.-]*:\/\/)([^/?#\s]*@)([^/?#\s]+)/g,
-    (_match, prefix, _userinfo, host) => `${prefix}<redacted>@${host}`
-  );
-}
-function httpUrlHasUserinfo(rawUrl) {
-  if (!/^https?:\/\//i.test(rawUrl)) return false;
-  try {
-    const parsed = new URL(rawUrl);
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
-    return parsed.username.length > 0 || parsed.password.length > 0;
-  } catch {
-    return /^https?:\/\/[^/?#\s]*@[^/?#\s]+/i.test(rawUrl);
-  }
-}
-function stripHttpUrlUserinfo(rawUrl) {
-  if (!/^https?:\/\//i.test(rawUrl)) return rawUrl;
-  try {
-    const parsed = new URL(rawUrl);
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return rawUrl;
-    if (parsed.username || parsed.password) {
-      parsed.username = "";
-      parsed.password = "";
-      return parsed.toString();
-    }
-    return rawUrl;
-  } catch {
-    return rawUrl.replace(/^(https?:\/\/)([^/?#\s]*@)([^/?#\s]+)/i, "$1$3");
-  }
-}
-
-// src/git/index.ts
-async function validateGitRef(ref) {
-  await validateNamespacedGitRef(ref, "heads", "Invalid git ref");
-}
-async function validateNamespacedGitRef(ref, namespace, errorPrefix) {
-  if (typeof ref !== "string") {
-    throw new Error(`${errorPrefix}: expected string, got ${typeof ref}`);
-  }
-  if (ref.length === 0) {
-    throw new Error(`${errorPrefix}: empty string`);
-  }
-  if (ref.startsWith("-")) {
-    throw new Error(
-      `${errorPrefix}: refs starting with '-' are rejected to prevent option injection`
-    );
-  }
-  if (/[\s\0]/.test(ref)) {
-    throw new Error(`${errorPrefix}: contains whitespace, newline, or NUL byte`);
-  }
-  const { git } = createGit();
-  try {
-    await git.raw(["check-ref-format", `refs/${namespace}/${ref}`]);
-  } catch {
-    throw new Error(`${errorPrefix}: rejected by git check-ref-format: ${ref}`);
-  }
-}
-var cachedGitBinary;
-function getGitBinary() {
-  if (cachedGitBinary !== void 0) return cachedGitBinary;
-  const commonPaths = [
-    "/opt/homebrew/bin/git",
-    // Homebrew on Apple Silicon
-    "/usr/local/bin/git",
-    // Homebrew on Intel
-    "/usr/bin/git"
-    // System git (Docker and Linux)
-  ];
-  for (const path2 of commonPaths) {
-    if (existsSync(path2)) {
-      cachedGitBinary = path2;
-      return path2;
-    }
-  }
-  cachedGitBinary = "git";
-  return cachedGitBinary;
-}
-function isLikelyGitToken(token) {
-  return /^[A-Za-z0-9_-]{20,255}$/.test(token);
-}
-function buildWorktreeAddArgs(params) {
-  const { branchPath, ref, createBranch: createBranch2, sourceBranch, refType, fetchSucceeded } = params;
-  const optionArgs = [];
-  const positionalArgs = [branchPath];
-  if (createBranch2) {
-    optionArgs.push("-b", ref);
-    if (sourceBranch) {
-      if (refType === "tag") {
-        positionalArgs.push(sourceBranch);
-      } else {
-        const baseRef = fetchSucceeded ? `origin/${sourceBranch}` : sourceBranch;
-        positionalArgs.push(baseRef);
-      }
-    }
-  } else {
-    positionalArgs.push(ref);
-  }
-  return ["worktree", "add", ...optionArgs, "--", ...positionalArgs];
-}
-var DEFAULT_AUTH_HEADER_HOST = "github.com";
-function parseHostFromGitUrl(url) {
-  if (typeof url !== "string" || url.length === 0) return void 0;
-  if (/^(?:https?|ssh):\/\//.test(url)) {
-    try {
-      return new URL(url).hostname || void 0;
-    } catch {
-      return void 0;
-    }
-  }
-  return url.match(/^(?:[^@\s:]+@)?([^/:\s]+):(?!\/)/)?.[1];
-}
-function gitUrlHasUserinfo(rawUrl) {
-  return httpUrlHasUserinfo(rawUrl);
-}
-function redactGitUrlCredentials(rawUrl) {
-  if (!/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(rawUrl)) return rawUrl;
-  return redactUrlUserinfo(rawUrl);
-}
-function stripGitUrlCredentials(rawUrl) {
-  return stripHttpUrlUserinfo(rawUrl);
-}
-function parseGitdirPointer(raw) {
-  const match = raw.match(/^gitdir:\s*(.+?)\s*$/m);
-  return match?.[1];
-}
-async function findGitConfigPaths(repoPath) {
-  const dotGit = join(repoPath, ".git");
-  const paths = /* @__PURE__ */ new Set();
-  let dotGitStat;
-  try {
-    dotGitStat = await stat(dotGit);
-  } catch {
-    return [];
-  }
-  if (dotGitStat.isDirectory()) {
-    paths.add(join(dotGit, "config"));
-  } else if (dotGitStat.isFile()) {
-    const pointer = parseGitdirPointer(await readFile(dotGit, "utf8"));
-    if (pointer) {
-      const gitDir = isAbsolute(pointer) ? pointer : resolve(repoPath, pointer);
-      paths.add(join(gitDir, "config"));
-      paths.add(join(gitDir, "config.worktree"));
-      try {
-        const commonDirRaw = (await readFile(join(gitDir, "commondir"), "utf8")).trim();
-        if (commonDirRaw) {
-          const commonDir = isAbsolute(commonDirRaw) ? commonDirRaw : resolve(gitDir, commonDirRaw);
-          paths.add(join(commonDir, "config"));
-        }
-      } catch {
-      }
-    }
-  }
-  const existing = [];
-  for (const candidate of paths) {
-    try {
-      const candidateStat = await stat(candidate);
-      if (candidateStat.isFile()) existing.push(candidate);
-    } catch {
-    }
-  }
-  return existing;
-}
-function parseRemoteSection(line) {
-  const match = line.match(/^\s*\[remote\s+"((?:\\.|[^"])*)"\]\s*(?:[#;].*)?$/);
-  return match?.[1]?.replace(/\\"/g, '"');
-}
-function scrubGitConfigText(configPath, text, writeChanges) {
-  const lines = text.split("\n");
-  const findings = [];
-  let currentRemote;
-  let changed = false;
-  const nextLines = lines.map((line) => {
-    const remote = parseRemoteSection(line);
-    if (remote !== void 0) {
-      currentRemote = remote;
-      return line;
-    }
-    if (/^\s*\[/.test(line)) {
-      currentRemote = void 0;
-      return line;
-    }
-    if (!currentRemote) return line;
-    const match = line.match(/^(\s*)(url|pushurl)(\s*=\s*)(.*?)(\r?)$/i);
-    if (!match) return line;
-    const [, indent, rawKey, sep, rawValue, cr] = match;
-    const value = rawValue.trim();
-    if (!gitUrlHasUserinfo(value)) return line;
-    const key = rawKey.toLowerCase();
-    const sanitizedUrl = stripGitUrlCredentials(value);
-    findings.push({
-      configPath,
-      remote: currentRemote,
-      key,
-      redactedUrl: redactGitUrlCredentials(value),
-      sanitizedUrl
-    });
-    changed = true;
-    return writeChanges ? `${indent}${rawKey}${sep}${sanitizedUrl}${cr}` : line;
-  });
-  return { text: nextLines.join("\n"), findings, changed };
-}
-async function scanGitConfigRemoteCredentials(repoPath) {
-  const configPaths = await findGitConfigPaths(repoPath);
-  const findings = [];
-  for (const configPath of configPaths) {
-    const text = await readFile(configPath, "utf8");
-    findings.push(...scrubGitConfigText(configPath, text, false).findings);
-  }
-  return { repoPath, configPaths, findings };
-}
-async function scrubGitConfigRemoteCredentials(repoPath) {
-  const configPaths = await findGitConfigPaths(repoPath);
-  const findings = [];
-  let changed = false;
-  for (const configPath of configPaths) {
-    const text = await readFile(configPath, "utf8");
-    const result = scrubGitConfigText(configPath, text, true);
-    findings.push(...result.findings);
-    if (result.changed) {
-      await writeFile(configPath, result.text, "utf8");
-      changed = true;
-    }
-  }
-  return { repoPath, configPaths, findings, changed };
-}
-async function resolveAuthHost(repoPath) {
-  try {
-    const origin = await getRemoteUrl(repoPath, "origin");
-    if (origin) {
-      const host = parseHostFromGitUrl(origin);
-      if (host) return host;
-    }
-  } catch {
-  }
-  console.warn(
-    `\u{1F511} Could not derive auth host from origin in ${repoPath}; falling back to ${DEFAULT_AUTH_HEADER_HOST}. If this repo lives on GitHub Enterprise or a self-hosted forge, the auth header will be ineffective.`
-  );
-  return DEFAULT_AUTH_HEADER_HOST;
-}
-function buildGitConfigEnv(entries) {
-  if (entries.length === 0) return {};
-  const out = {
-    GIT_CONFIG_COUNT: String(entries.length)
-  };
-  for (let i = 0; i < entries.length; i++) {
-    const [key, value] = entries[i];
-    out[`GIT_CONFIG_KEY_${i}`] = key;
-    out[`GIT_CONFIG_VALUE_${i}`] = value;
-  }
-  return out;
-}
-function buildGitConfigParameters(pairs) {
-  return pairs.map((p) => p.trim()).filter((p) => p.length > 0).map((p) => escapeShellArg(p)).join(" ");
-}
-function buildAuthHeaderEnv(token, host = DEFAULT_AUTH_HEADER_HOST) {
-  if (!token) return [];
-  if (!isLikelyGitToken(token)) {
-    console.warn(
-      "\u{1F511} Skipping http.extraheader: token does not match expected shape. Tokens must match /^[A-Za-z0-9_-]{20,255}$/. Re-save the token to enable the auth header."
-    );
-    return [];
-  }
-  const credential = Buffer.from(`x-access-token:${token}`, "utf8").toString("base64");
-  const key = `http.https://${host}/.extraheader`;
-  return [[key, `Authorization: Basic ${credential}`]];
-}
-function categorizeGitError(stderr) {
-  const s = stderr.toLowerCase();
-  if (s.includes("authentication failed") || s.includes("could not read username") || s.includes("could not read password") || s.includes("terminal prompts disabled") || s.includes("fatal: authentication") || s.includes("http basic") || s.includes("403 forbidden") || s.includes("permission denied (publickey)")) {
-    return "auth_failed";
-  }
-  if (s.includes("repository not found") || s.includes("not found") || s.includes("does not exist") || s.includes("404")) {
-    return "not_found";
-  }
-  if (s.includes("could not resolve host") || s.includes("connection refused") || s.includes("connection timed out") || s.includes("operation timed out") || s.includes("network is unreachable") || s.includes("network error")) {
-    return "network";
-  }
-  return "unknown";
-}
-function redactGitEnv(env) {
-  const out = {};
-  for (const [key, raw] of Object.entries(env)) {
-    if (raw === void 0) continue;
-    const isConfigValue = /^GIT_CONFIG_VALUE_\d+$/.test(key);
-    const looksLikeAuth = /authorization:/i.test(raw);
-    out[key] = isConfigValue && looksLikeAuth ? "<redacted>" : raw;
-  }
-  return out;
-}
-function createGit(baseDir, env, authHost) {
-  const gitBinary = getGitBinary();
-  const config = [];
-  const rawToken = env?.GITHUB_TOKEN ?? env?.GH_TOKEN;
-  const authConfigEntries = buildAuthHeaderEnv(rawToken, authHost ?? DEFAULT_AUTH_HEADER_HOST);
-  let spawnEnv;
-  if (env || authConfigEntries.length > 0) {
-    spawnEnv = {
-      ...process.env,
-      ...env ?? {},
-      // Inheritance kill (GLOBAL only): ignore the daemon user's
-      // ~/.gitconfig. /etc/gitconfig is intentionally NOT killed — it is
-      // admin-policy territory (CA bundles, proxies). See block comment.
-      GIT_CONFIG_GLOBAL: "/dev/null",
-      // Fail fast instead of blocking on an interactive credential prompt
-      // (which would hang the daemon).
-      GIT_TERMINAL_PROMPT: "0",
-      // Inject http.extraheader (and any future server-constructed config)
-      // via the env-var protocol so it never lands on argv.
-      ...buildGitConfigEnv(authConfigEntries)
-    };
-  }
-  const git = simpleGit({
-    baseDir,
-    binary: gitBinary,
-    config,
-    unsafe: {
-      // simple-git's scanner blocks spawning when these env vars / config keys
-      // are present. We own the daemon env (in strict mode it's the user's own
-      // env) and inject GIT_CONFIG_* ourselves — opting in here mirrors what a
-      // direct `git` invocation on the same machine does.
-      allowUnsafeSshCommand: true,
-      allowUnsafeConfigPaths: true,
-      allowUnsafeConfigEnvCount: true,
-      allowUnsafeEditor: true,
-      allowUnsafeAskPass: true,
-      allowUnsafePager: true,
-      allowUnsafeGitProxy: true,
-      allowUnsafeTemplateDir: true,
-      allowUnsafeDiffExternal: true
-    }
-  });
-  if (spawnEnv) {
-    git.env(spawnEnv);
-  }
-  return { git };
-}
-function createGitForRemote(remoteUrl, env) {
-  return createGit(void 0, env, parseHostFromGitUrl(remoteUrl));
-}
-async function addSafeDirectoryBestEffort(path2, logPrefix) {
-  const prefix = logPrefix ? `${logPrefix} ` : "";
-  try {
-    const { git } = createGit(path2);
-    await git.addConfig("safe.directory", path2, true, "global");
-    console.log(`${prefix}\u2705 Added ${path2} to git safe.directory`);
-  } catch (error) {
-    console.warn(
-      `${prefix}\u26A0\uFE0F  Failed to add ${path2} to safe.directory:`,
-      error instanceof Error ? error.message : String(error)
-    );
-  }
-}
-function extractRepoName(url) {
-  const match = url.match(/\/([^/]+?)(?:\.git)?$/);
-  if (!match) {
-    throw new Error(`Could not extract repo name from URL: ${url}`);
-  }
-  return match[1];
-}
-async function cloneRepo(options) {
-  const cloneUrl = stripGitUrlCredentials(options.url);
-  if (cloneUrl !== options.url) {
-    console.warn(
-      `\u{1F512} Stripped credentials from clone URL before use: ${redactGitUrlCredentials(options.url)}`
-    );
-  }
-  const repoName = extractRepoName(cloneUrl);
-  const reposDir = getReposDir();
-  const targetPath = options.targetDir || join(reposDir, repoName);
-  await mkdir(dirname(targetPath), { recursive: true });
-  if (existsSync(targetPath)) {
-    const isValid = await isGitRepo(targetPath);
-    if (isValid) {
-      await scrubGitConfigRemoteCredentials(targetPath);
-      console.log(`Repository already exists at ${targetPath}, using existing clone`);
-      const existingGit = createGit(targetPath, options.env, parseHostFromGitUrl(cloneUrl)).git;
-      if (options.branch) {
-        const branches = await existingGit.branch();
-        if (branches.current !== options.branch) {
-          try {
-            await existingGit.fetch(["origin", options.branch]);
-          } catch (err) {
-            throw new Error(
-              `Existing clone at ${targetPath} is on branch '${branches.current}'; failed to fetch '${options.branch}' from origin: ${err instanceof Error ? err.message : String(err)}`
-            );
-          }
-          try {
-            await existingGit.checkout(options.branch);
-          } catch (err) {
-            throw new Error(
-              `Existing clone at ${targetPath} is on branch '${branches.current}'; failed to switch to pinned '${options.branch}': ${err instanceof Error ? err.message : String(err)}`
-            );
-          }
-        }
-        return {
-          path: targetPath,
-          repoName,
-          defaultBranch: options.branch
-        };
-      }
-      const defaultBranch2 = await getDefaultBranch(targetPath);
-      return {
-        path: targetPath,
-        repoName,
-        defaultBranch: defaultBranch2
-      };
-    } else {
-      throw new Error(
-        `Directory exists but is not a valid git repository: ${targetPath}
-Please delete this directory manually and try again.`
-      );
-    }
-  }
-  const { git } = createGitForRemote(cloneUrl, options.env);
-  if (options.onProgress) {
-    git.outputHandler((_command, _stdout, _stderr) => {
-    });
-  }
-  const cloneArgs = [];
-  if (options.bare) cloneArgs.push("--bare");
-  if (options.branch) cloneArgs.push("--branch", options.branch);
-  console.log(
-    `Cloning ${redactGitUrlCredentials(cloneUrl)} to ${targetPath}${options.branch ? ` (branch: ${options.branch})` : ""}...`
-  );
-  await git.clone(cloneUrl, targetPath, cloneArgs);
-  await scrubGitConfigRemoteCredentials(targetPath);
-  const defaultBranch = options.branch ?? await getDefaultBranch(targetPath);
-  return {
-    path: targetPath,
-    repoName,
-    defaultBranch
-  };
-}
-async function isValidGitRepo(path2) {
-  try {
-    const stats = await stat(path2);
-    if (!stats.isDirectory()) {
-      return false;
-    }
-    const { git } = createGit(path2);
-    await git.revparse(["--git-dir"]);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function isGitRepo(path2) {
-  return isValidGitRepo(path2);
-}
-async function getCurrentBranch(repoPath) {
-  const { git } = createGit(repoPath);
-  const status = await git.status();
-  return status.current || "";
-}
-async function getDefaultBranch(repoPath, remote = "origin") {
-  const { git } = createGit(repoPath);
-  try {
-    const result = await git.raw(["symbolic-ref", `refs/remotes/${remote}/HEAD`]);
-    const match = result.trim().match(/refs\/remotes\/[^/]+\/(.+)/);
-    if (match?.[1]) {
-      return match[1];
-    }
-  } catch {
-  }
-  try {
-    const branches = await git.branch();
-    return branches.current || "main";
-  } catch {
-    return "main";
-  }
-}
-async function getCurrentSha(repoPath) {
-  const { git } = createGit(repoPath);
-  const log = await git.log({ maxCount: 1 });
-  return log.latest?.hash || "";
-}
-async function isClean(repoPath) {
-  const { git } = createGit(repoPath);
-  const status = await git.status();
-  return status.isClean();
-}
-async function getRemoteUrl(repoPath, remote = "origin") {
-  try {
-    const { git } = createGit(repoPath);
-    const remotes = await git.getRemotes(true);
-    const remoteObj = remotes.find((r) => r.name === remote);
-    return remoteObj?.refs.fetch ? stripGitUrlCredentials(remoteObj.refs.fetch) : null;
-  } catch {
-    return null;
-  }
-}
-async function ensureGitRemoteUrl(repoPath, remoteName, expectedUrl, env) {
-  const { git } = createGit(repoPath, env);
-  const safeExpectedUrl = stripGitUrlCredentials(expectedUrl);
-  const configKey = `remote.${remoteName}.url`;
-  let currentUrls;
-  try {
-    const raw = await git.raw(["config", "--get-all", configKey]);
-    currentUrls = raw.split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
-  } catch {
-    return { changed: false, previousUrl: void 0 };
-  }
-  if (currentUrls.length === 0) {
-    return { changed: false, previousUrl: void 0 };
-  }
-  if (currentUrls.length === 1 && currentUrls[0] === safeExpectedUrl) {
-    return { changed: false, previousUrl: currentUrls[0] };
-  }
-  await git.raw(["config", "--replace-all", configKey, safeExpectedUrl]);
-  return { changed: true, previousUrl: currentUrls.join("\n") };
-}
-async function createBranch(repoPath, branchPath, ref, createBranch2 = false, pullLatest = true, sourceBranch, env, refType) {
-  console.log("\u{1F50D} createBranch called with:", {
-    repoPath,
-    branchPath,
-    ref,
-    createBranch: createBranch2,
-    pullLatest,
-    sourceBranch,
-    refType
-  });
-  if (!repoPath) {
-    throw new Error("repoPath is required but was null/undefined");
-  }
-  const scrubResult = await scrubGitConfigRemoteCredentials(repoPath);
-  if (scrubResult.findings.length > 0) {
-    console.warn(
-      `\u{1F512} Scrubbed ${scrubResult.findings.length} credential-bearing git remote URL(s) from ${scrubResult.configPaths.length} git config file(s) before creating a worktree branch.`
-    );
-  }
-  if (existsSync(branchPath)) {
-    throw new Error(
-      `Target directory '${branchPath}' already exists on disk. This usually means an archived or partially-cleaned branch still occupies this path. Please choose a different name or clean up the existing directory.`
-    );
-  }
-  await validateGitRef(ref);
-  if (sourceBranch !== void 0) {
-    await validateGitRef(sourceBranch);
-  }
-  const hasToken = !!(env?.GITHUB_TOKEN ?? env?.GH_TOKEN);
-  const authHost = hasToken ? await resolveAuthHost(repoPath) : void 0;
-  const { git } = createGit(repoPath, env, authHost);
-  let fetchSucceeded = false;
-  if (pullLatest) {
-    try {
-      const fetchArgs = refType === "tag" ? ["origin", "--tags"] : ["origin"];
-      await git.fetch(fetchArgs);
-      fetchSucceeded = true;
-      console.log("\u2705 Fetched latest from origin");
-      if (!createBranch2 && refType !== "tag") {
-        try {
-          const branches = await git.branch();
-          const localBranchExists = branches.all.includes(ref);
-          if (localBranchExists) {
-            const remoteBranches = await git.branch(["-r"]);
-            const remoteBranchExists = remoteBranches.all.includes(`origin/${ref}`);
-            if (remoteBranchExists) {
-              await git.raw(["branch", "-f", ref, `origin/${ref}`]);
-              console.log(`\u2705 Updated local ${ref} to match origin/${ref}`);
-            }
-          }
-        } catch (error) {
-          console.warn(
-            `\u26A0\uFE0F  Failed to update local ${ref} branch:`,
-            error instanceof Error ? error.message : String(error)
-          );
-        }
-      }
-    } catch (error) {
-      console.warn(
-        "\u26A0\uFE0F  Failed to fetch from origin (will use local refs):",
-        error instanceof Error ? error.message : String(error)
-      );
-    }
-  }
-  const worktreeAddArgs = buildWorktreeAddArgs({
-    branchPath,
-    ref,
-    createBranch: createBranch2,
-    sourceBranch,
-    refType,
-    fetchSucceeded
-  });
-  if (createBranch2 && sourceBranch && refType === "tag") {
-    console.log(`\u{1F4CC} Creating branch '${ref}' from tag '${sourceBranch}'`);
-  }
-  try {
-    await git.raw(worktreeAddArgs);
-  } catch (error) {
-    const errorMessage = error instanceof Error ? error.message : String(error);
-    if (createBranch2 && errorMessage.includes("already exists")) {
-      console.warn(
-        `\u26A0\uFE0F  Branch '${ref}' already exists. Checking if it's orphaned (stale from a deleted branch)...`
-      );
-      const worktrees = await listGitWorktrees(repoPath);
-      const branchInUse = worktrees.some((wt) => wt.ref === ref);
-      if (branchInUse) {
-        throw new Error(
-          `A branch named '${ref}' already exists and is in use by another branch. Please choose a different name.`
-        );
-      }
-      console.log(`\u{1F9F9} Deleting orphaned branch '${ref}' and retrying branch creation...`);
-      await git.raw(["branch", "-D", ref]);
-      await git.raw(worktreeAddArgs);
-      console.log(`\u2705 Successfully created branch after cleaning up stale branch '${ref}'`);
-    } else {
-      throw error;
-    }
-  }
-  await addSafeDirectoryBestEffort(branchPath);
-}
-async function assertRemoteRefVisibleForClone(options) {
-  const remoteUrl = stripGitUrlCredentials(options.remoteUrl);
-  const refType = options.refType ?? "branch";
-  const ref = options.ref;
-  if (!remoteUrl) {
-    throw new Error("remoteUrl is required");
-  }
-  if (refType === "branch") {
-    await validateGitRef(ref);
-  } else {
-    await validateNamespacedGitRef(ref, "tags", "Invalid git tag ref");
-  }
-  const { git } = createGitForRemote(remoteUrl, options.env);
-  const namespace = refType === "tag" ? "refs/tags" : "refs/heads";
-  let output;
-  try {
-    output = await git.listRemote([
-      refType === "tag" ? "--tags" : "--heads",
-      remoteUrl,
-      `${namespace}/${ref}`
-    ]);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(
-      `Cannot validate clone-mode ${refType} '${ref}' against remote ${redactGitUrlCredentials(remoteUrl)}: ${message}`
-    );
-  }
-  if (output.trim().length === 0) {
-    throw new Error(
-      `Clone mode cannot clone local-only or missing ${refType} '${ref}' because it is not visible on the remote ${redactGitUrlCredentials(remoteUrl)}. Push '${ref}' to origin, choose a remote ${refType}, or use storage_mode='worktree' if it is enabled.`
-    );
-  }
-}
-async function createBranchAsClone(options) {
-  const { targetPath, ref, newBranchName, depth, referencePath, env } = options;
-  const remoteUrl = stripGitUrlCredentials(options.remoteUrl);
-  const singleBranch = options.singleBranch ?? true;
-  if (!remoteUrl) {
-    throw new Error("remoteUrl is required");
-  }
-  if (remoteUrl !== options.remoteUrl) {
-    console.warn(
-      `\u{1F512} Stripped credentials from clone-mode remote URL before use: ${redactGitUrlCredentials(options.remoteUrl)}`
-    );
-  }
-  if (!targetPath) {
-    throw new Error("targetPath is required");
-  }
-  await validateGitRef(ref);
-  if (newBranchName !== void 0) {
-    await validateGitRef(newBranchName);
-  }
-  if (depth !== void 0 && (!Number.isInteger(depth) || depth <= 0)) {
-    throw new Error(`Invalid clone depth: expected positive integer, got ${depth}`);
-  }
-  if (existsSync(targetPath)) {
-    throw new Error(
-      `Target directory '${targetPath}' already exists. Refusing to clone over existing contents \u2014 pick a different path or remove the directory first.`
-    );
-  }
-  let useReference = false;
-  if (referencePath) {
-    if (existsSync(referencePath)) {
-      useReference = true;
-    } else {
-      console.log(
-        `[createBranchAsClone] referencePath '${referencePath}' not present on this filesystem \u2014 falling back to a full clone without --reference.`
-      );
-    }
-  }
-  const { git } = createGitForRemote(remoteUrl, env);
-  const cloneArgs = ["--branch", ref];
-  if (singleBranch) cloneArgs.push("--single-branch");
-  if (depth !== void 0) cloneArgs.push("--depth", String(depth));
-  if (useReference && referencePath) cloneArgs.push("--reference", referencePath);
-  console.log(
-    `[createBranchAsClone] Cloning ${redactGitUrlCredentials(remoteUrl)} \u2192 ${targetPath} (ref=${ref}${newBranchName ? `, newBranch=${newBranchName}` : ""}, depth=${depth ?? "full"}, singleBranch=${singleBranch}, reference=${useReference ? referencePath : "none"})`
-  );
-  await git.clone(remoteUrl, targetPath, cloneArgs);
-  await scrubGitConfigRemoteCredentials(targetPath);
-  let finalRef = ref;
-  if (newBranchName) {
-    console.log(
-      `[createBranchAsClone] Creating local branch '${newBranchName}' off cloned '${ref}'`
-    );
-    const { git: cloneGit } = createGit(targetPath, env);
-    await cloneGit.checkoutLocalBranch(newBranchName);
-    finalRef = newBranchName;
-  }
-  await addSafeDirectoryBestEffort(targetPath, "[createBranchAsClone]");
-  return { path: targetPath, ref: finalRef };
-}
-async function restoreBranchFilesystem(repoPath, branchPath, ref, baseRef, env) {
-  await validateGitRef(ref);
-  await validateGitRef(baseRef);
-  const scrubResult = await scrubGitConfigRemoteCredentials(repoPath);
-  if (scrubResult.findings.length > 0) {
-    console.warn(
-      `[restoreBranch] Scrubbed ${scrubResult.findings.length} credential-bearing git remote URL(s) before restore.`
-    );
-  }
-  const hasToken = !!(env?.GITHUB_TOKEN ?? env?.GH_TOKEN);
-  const authHost = hasToken ? await resolveAuthHost(repoPath) : void 0;
-  const { git } = createGit(repoPath, env, authHost);
-  try {
-    await git.fetch(["origin"]);
-    console.log(`[restoreBranch] Fetched latest from origin`);
-  } catch (error) {
-    console.warn(
-      `[restoreBranch] Failed to fetch from origin (will use local refs):`,
-      error instanceof Error ? error.message : String(error)
-    );
-  }
-  let branchExistsOnRemote = false;
-  try {
-    const lsRemoteOutput = await git.listRemote(["--heads", "origin", ref]);
-    branchExistsOnRemote = lsRemoteOutput.trim().length > 0;
-  } catch {
-    try {
-      const branches = await git.branch(["-r"]);
-      branchExistsOnRemote = branches.all.includes(`origin/${ref}`);
-    } catch {
-    }
-  }
-  try {
-    if (branchExistsOnRemote) {
-      console.log(`[restoreBranch] Branch '${ref}' found on remote, checking out`);
-      await createBranch(repoPath, branchPath, ref, false, true, void 0, env);
-      return { success: true, strategy: "checkout" };
-    }
-    console.log(`[restoreBranch] Branch '${ref}' not on remote, creating from base '${baseRef}'`);
-    await createBranch(repoPath, branchPath, ref, true, true, baseRef, env);
-    return { success: true, strategy: "create" };
-  } catch (error) {
-    const msg = error instanceof Error ? error.message : String(error);
-    console.error(`[restoreBranch] Failed to restore branch: ${msg}`);
-    return {
-      success: false,
-      strategy: branchExistsOnRemote ? "checkout" : "create",
-      error: msg
-    };
-  }
-}
-async function listGitWorktrees(repoPath) {
-  const { git } = createGit(repoPath);
-  const output = await git.raw(["worktree", "list", "--porcelain"]);
-  const worktrees = [];
-  const lines = output.split("\n");
-  let current = {};
-  for (const line of lines) {
-    if (line.startsWith("worktree ")) {
-      current.path = line.substring(9);
-      current.name = basename(current.path);
-    } else if (line.startsWith("HEAD ")) {
-      current.sha = line.substring(5);
-    } else if (line.startsWith("branch ")) {
-      current.ref = line.substring(7).replace("refs/heads/", "");
-      current.detached = false;
-    } else if (line.startsWith("detached")) {
-      current.detached = true;
-    } else if (line === "") {
-      if (current.path && current.sha) {
-        worktrees.push(current);
-      }
-      current = {};
-    }
-  }
-  if (current.path && current.sha) {
-    worktrees.push(current);
-  }
-  return worktrees;
-}
-async function removeGitWorktree(repoPath, branchName) {
-  const { git } = createGit(repoPath);
-  await git.raw(["worktree", "remove", "--force", branchName]);
-}
-async function cleanBranch(branchPath, fixOwnership = true) {
-  const { git } = createGit(branchPath);
-  const dryRunResult = await git.clean("fdxn");
-  const filesRemoved = Array.isArray(dryRunResult.files) ? dryRunResult.files.length : 0;
-  if (fixOwnership) {
-    try {
-      const { execSync: execSync3 } = await import("child_process");
-      const { existsSync: existsSync2 } = await import("fs");
-      const os2 = await import("os");
-      if (!existsSync2(branchPath)) {
-        throw new Error(`Branch path does not exist: ${branchPath}`);
-      }
-      const currentUser = os2.userInfo().username;
-      try {
-        const escapedPath = branchPath.replace(/'/g, "'\\''");
-        execSync3(`sudo -n chown -R ${currentUser}: '${escapedPath}'`, {
-          stdio: "pipe",
-          encoding: "utf-8"
-        });
-        console.log(`[git.clean] Fixed ownership to ${currentUser} before clean`);
-      } catch (_chownError) {
-        console.warn(
-          "[git.clean] Could not fix ownership (sudo not configured), continuing anyway"
-        );
-      }
-    } catch (error) {
-      console.warn("[git.clean] Error fixing ownership, continuing with clean:", error);
-    }
-  }
-  try {
-    await git.clean("fdx");
-  } catch (error) {
-    const errorMessage = error instanceof Error ? error.message : String(error);
-    const isWarningsOnly = errorMessage.includes("warning:") && errorMessage.includes("failed to remove");
-    if (!isWarningsOnly) {
-      throw error;
-    }
-    console.warn(
-      "[git.clean] Completed with warnings (some files could not be removed):",
-      errorMessage
-    );
-  }
-  return { filesRemoved };
-}
-async function pruneGitWorktrees(repoPath) {
-  const { git } = createGit(repoPath);
-  await git.raw(["worktree", "prune"]);
-}
-async function hasRemoteBranch(repoPath, branchName, remote = "origin") {
-  const { git } = createGit(repoPath);
-  const branches = await git.branch(["-r"]);
-  return branches.all.includes(`${remote}/${branchName}`);
-}
-async function getRemoteBranches(repoPath, remote = "origin") {
-  const { git } = createGit(repoPath);
-  const branches = await git.branch(["-r"]);
-  return branches.all.filter((b) => b.startsWith(`${remote}/`)).map((b) => b.replace(`${remote}/`, ""));
-}
-async function getGitState(repoPath) {
-  try {
-    if (!await isGitRepo(repoPath)) {
-      console.warn(`[getGitState] Not a git repo: ${repoPath}`);
-      return "unknown";
-    }
-    const sha = await getCurrentSha(repoPath);
-    if (!sha) {
-      try {
-        const { git } = createGit(repoPath);
-        const headSha = await git.revparse(["HEAD"]);
-        if (headSha) {
-          const clean2 = await isClean(repoPath);
-          const trimmed = headSha.trim();
-          console.log(
-            `[getGitState] git.log() returned no SHA but rev-parse HEAD succeeded: ${trimmed.substring(0, 8)} (${repoPath})`
-          );
-          return clean2 ? trimmed : `${trimmed}-dirty`;
-        }
-      } catch (revParseError) {
-        console.warn(
-          `[getGitState] Both git.log() and rev-parse HEAD failed for ${repoPath}:`,
-          revParseError
-        );
-      }
-      console.warn(
-        `[getGitState] Could not determine SHA for ${repoPath} (git log returned empty)`
-      );
-      return "unknown";
-    }
-    const clean = await isClean(repoPath);
-    return clean ? sha : `${sha}-dirty`;
-  } catch (error) {
-    console.warn(`[getGitState] Failed for ${repoPath}:`, error);
-    return "unknown";
-  }
-}
-async function deleteRepoDirectory(repoPath) {
-  const { rm } = await import("fs/promises");
-  const { realpathSync, existsSync: existsSync2 } = await import("fs");
-  const { resolve: resolve2, relative } = await import("path");
-  const reposDir = getReposDir();
-  const resolvedReposDir = realpathSync(reposDir);
-  const resolvedRepoPath = existsSync2(repoPath) ? realpathSync(repoPath) : resolve2(realpathSync(resolve2(repoPath, "..")), resolve2(repoPath).split("/").pop());
-  const relativePath = relative(resolvedReposDir, resolvedRepoPath);
-  if (relativePath.startsWith("..") || resolve2(relativePath) === relativePath) {
-    throw new Error(
-      `Safety check failed: Repository path must be inside ${reposDir}. Got: ${repoPath}`
-    );
-  }
-  if (resolvedRepoPath === resolvedReposDir || relativePath === "") {
-    throw new Error("Cannot delete the repos directory itself");
-  }
-  await rm(resolvedRepoPath, { recursive: true, force: true });
-}
-async function deleteBranchDirectory(branchPath) {
-  const { rm } = await import("fs/promises");
-  const { realpathSync, existsSync: existsSync2 } = await import("fs");
-  const { resolve: resolve2, relative } = await import("path");
-  const branchesDir = getBranchesDir();
-  const resolvedBranchesDir = realpathSync(branchesDir);
-  const resolvedBranchPath = existsSync2(branchPath) ? realpathSync(branchPath) : resolve2(realpathSync(resolve2(branchPath, "..")), resolve2(branchPath).split("/").pop());
-  const relativePath = relative(resolvedBranchesDir, resolvedBranchPath);
-  if (relativePath.startsWith("..") || resolve2(relativePath) === relativePath) {
-    throw new Error(
-      `Safety check failed: Branch path must be inside ${branchesDir}. Got: ${branchPath}`
-    );
-  }
-  if (resolvedBranchPath === resolvedBranchesDir || relativePath === "") {
-    throw new Error("Cannot delete the branches directory itself");
-  }
-  await rm(resolvedBranchPath, { recursive: true, force: true });
-}
-async function deleteBranch(repoPath, branchName) {
-  await validateGitRef(branchName);
-  const { git } = createGit(repoPath);
-  try {
-    await git.raw(["branch", "-D", branchName]);
-    return true;
-  } catch (error) {
-    const msg = error instanceof Error ? error.message : String(error);
-    if (msg.includes("not found")) {
-      return false;
-    }
-    throw error;
-  }
-}
-export {
-  addSafeDirectoryBestEffort,
-  assertRemoteRefVisibleForClone,
-  buildAuthHeaderEnv,
-  buildGitConfigEnv,
-  buildGitConfigParameters,
-  buildWorktreeAddArgs,
-  categorizeGitError,
-  cleanBranch,
-  cloneRepo,
-  createBranch,
-  createBranchAsClone,
-  createGit,
-  createGitForRemote,
-  deleteBranch,
-  deleteBranchDirectory,
-  deleteRepoDirectory,
-  ensureGitRemoteUrl,
-  extractRepoName,
-  getBranchPath,
-  getBranchesDir,
-  getCurrentBranch,
-  getCurrentSha,
-  getDefaultBranch,
-  getGitState,
-  getRemoteBranches,
-  getRemoteUrl,
-  getReposDir,
-  gitUrlHasUserinfo,
-  hasRemoteBranch,
-  isClean,
-  isGitRepo,
-  isLikelyGitToken,
-  isValidGitRepo,
-  listGitWorktrees,
-  parseHostFromGitUrl,
-  pruneGitWorktrees,
-  redactGitEnv,
-  redactGitUrlCredentials,
-  removeGitWorktree,
-  restoreBranchFilesystem,
-  scanGitConfigRemoteCredentials,
-  scrubGitConfigRemoteCredentials,
-  simpleGit,
-  stripGitUrlCredentials,
-  validateGitRef
-};
+export * from "@agor/git";