dsh-config-manager 0.2.1 → 0.2.3

package/src/client/sync/sync-locales.ts

@@ -20,8 +20,8 @@ export const zh = {
   'config.tokenMissing': '未配置令牌：可拉取公开仓库，无法推送',
   'config.tokenPlaceholder': 'ghp_…（可选）',
   // 配置保存（自动保存 + 显式保存按钮）
-  'config.save': '保存配置',
-  'config.saveHint': '表单改动会自动保存（密码/token 安全写入 DSH credentials，不会写入同步文件或日志）；也可点击按钮立即保存。',
+  'config.save': '立即保存',
+  'config.saveHint': '表单改动会自动保存：密码/token 安全写入 DSH credentials，不会写入同步文件或日志。',
   // 通道选择器
   'channel.title': '同步通道',
   'channel.git': 'Git 私有仓库',
@@ -31,7 +31,7 @@ export const zh = {
   'channel.perChannelHint': '每条通道（Git / WebDAV / 对象存储 / Gist）的自动同步、同步模式、加密与远端快照各自独立配置。',
   // 通道入口卡（弹窗驱动：点按钮 → 弹窗内配置通道）
   'channel.open': '配置…',
-  'channel.openHint': '远程同步通过「同步通道」进行：Git 私有仓库或 WebDAV 服务器。点击按钮在弹窗中配置或修改。',
+  'channel.openHint': '远程同步通过「同步通道」进行：Git 私有仓库或 WebDAV 服务器。',
   // 断开通道配置（用户实测要求：配置过就必须能删掉，否则打不通的通道会永久占位）
   'channel.expand': '展开通道详情',
   'channel.collapse': '收起通道详情',
@@ -125,9 +125,11 @@ export const zh = {
   'push.title': '推送结果',
   'sections.title': '同步分区',
   'warnings.title': '分区告警',
-  // 一键同步（方案 A：拉取 → 逐项确认 → apply-items）
-  'syncflow.title': '一键同步',
-  'syncflow.button': '一键同步',
+  // 从远端合并到本机（方案 A：拉取 → 逐项确认 → apply-items）
+  // 名字必须写明方向（issue 121）：这条链路只下行、绝不上传 —— 叫「同步」会被读成双向。
+  'syncflow.title': '从远端合并到本机',
+  'syncflow.button': '从远端合并到本机',
+  // 方向说明（ⓘ，挂在动作行）：只下行 + 双向该去哪儿；常驻成行会与按钮名重复（DESIGN.md §7）
   // 方案 A：有基线且三方合并全部 skip = 远端与本机一致，不必同步
   'syncflow.upToDate': '已是最新，无需同步',
   'syncflow.syncing': '正在同步…',
@@ -177,7 +179,7 @@ export const zh = {
   'syncflow.remoteEmptyGuide': '远端还没有任何快照：这是首次同步，先点「推送到远端」把本机配置推上去（推送会创建第一个快照），之后才能拉取。',
   // 同步模式（默认快速导出 / 高级自定义导出）
   'mode.title': '同步分区',
-  'mode.hint': '点按钮在弹窗里勾选要同步的分区：勾选集合就是同步范围（默认已勾选推荐分区，可随时改）。',
+  'mode.hint': '同步范围 = 勾选的分区集合（默认已勾选推荐分区，可随时改）。',
   'mode.selectedCount': '已勾选 {n} 个',
   'mode.sectionsHint': '默认可同步的是可移植分区；平台相关分区（MCP 服务器）与设备相关分区（插件文件、凭据状态、历史会话）只有你在这里主动勾选才参与同步。',
   'mode.atLeastOne': '请至少勾选一个同步分区',
@@ -216,7 +218,7 @@ export const zh = {
   'mode.includeSecretsHint': '把真实凭据值（~/.dsh/.credentials.yaml）写入加密快照，可在另一台机器上随同步一并写回本机凭据；勾选时自动选中加密，密钥绝不进入未加密快照。',
   'mode.encryptAutosyncNotice': '加密快照仅通过手动推送/拉取使用；自动同步无密码，遇到加密快照会跳过并在历史中提示。',
   'mode.decryptPassword': '解密密码（加密快照拉取/同步用，可选）',
-  'mode.decryptPasswordHint': '输入后保存在本机凭据库，下次拉取自动使用；只有拉取的快照确实加密时才会用到 —— 未加密的备份不会使用密码。删除请点「删除已保存密码」。',
+  'mode.decryptPasswordHint': '输入后保存在本机凭据库，下次拉取自动使用；只有拉取的快照确实加密时才会用到 —— 未加密的备份不会使用密码。',
   'mode.decryptPasswordSaved': '已保存到本机',
   'mode.decryptPasswordPlaceholder': '已保存（留空即沿用）',
   'mode.clearSavedPassword': '删除已保存密码',
@@ -257,7 +259,7 @@ export const zh = {
   // 同步历史（含自动同步记录）
   'history.title': '同步历史',
   'history.empty': '尚无同步历史',
-  'history.emptyHint': '完成首次 push / 一键同步 / 自动同步后，这里会显示记录。',
+  'history.emptyHint': '完成首次推送 / 从远端合并 / 自动同步后，这里会显示记录。',
   'history.colTime': '时间',
   'history.colDetail': '详情',
   'history.kindAutosync': '自动同步',
@@ -304,7 +306,7 @@ export const zh = {
   'toast.pushPreviewFailed': '推送预览失败',
   'toast.pushFailed': '推送失败',
   'toast.pushDone': '推送完成',
-  'toast.syncStartFailed': '一键同步失败',
+  'toast.syncStartFailed': '从远端合并失败',
   'toast.autosyncUpdateFailed': '自动同步设置更新失败',
   'toast.autosyncUpdated': '自动同步设置已更新',
   'toast.snapshotsLoadFailed': '读取远端快照失败',
@@ -474,8 +476,8 @@ export const en: Record<keyof typeof zh, string> = {
   'config.tokenMissing': 'No token: public repos can be pulled, but pushing will fail',
   'config.tokenPlaceholder': 'ghp_… (optional)',
   // Config save (auto-save + explicit save button)
-  'config.save': 'Save config',
-  'config.saveHint': 'Form changes are saved automatically (password/token written securely into DSH credentials, never into sync files or logs); you can also save explicitly with the button.',
+  'config.save': 'Save now',
+  'config.saveHint': 'Form changes are saved automatically: password/token goes securely into DSH credentials, never into sync files or logs.',
   'channel.title': 'Sync Channel',
   'channel.git': 'Git private repo',
   'channel.webdav': 'WebDAV server',
@@ -484,7 +486,7 @@ export const en: Record<keyof typeof zh, string> = {
   'channel.perChannelHint': 'Auto sync, sync mode, encryption and remote snapshots are configured independently for each channel (Git / WebDAV / object storage / Gist).',
   // Channel entry card (dialog-driven: click the button → configure the channel in the dialog)
   'channel.open': 'Configure…',
-  'channel.openHint': 'Remote sync runs through a sync channel: a private Git repository or a WebDAV server. Click the button to configure or change it in the dialog.',
+  'channel.openHint': 'Remote sync runs through a sync channel: a private Git repository or a WebDAV server.',
   // Disconnect channel config (user report: once configured there was no way out)
   'channel.expand': 'Expand channel details',
   'channel.collapse': 'Collapse channel details',
@@ -573,8 +575,8 @@ export const en: Record<keyof typeof zh, string> = {
   'push.title': 'Push Result',
   'sections.title': 'Synced Sections',
   'warnings.title': 'Section Warnings',
-  'syncflow.title': 'One-Click Sync',
-  'syncflow.button': 'One-click sync',
+  'syncflow.title': 'Merge from remote',
+  'syncflow.button': 'Merge from remote',
   // Plan A: with a baseline, an all-skip three-way merge means local and remote already match
   'syncflow.upToDate': 'Already up to date; nothing to sync',
   'syncflow.syncing': 'Syncing…',
@@ -623,7 +625,7 @@ export const en: Record<keyof typeof zh, string> = {
   'syncflow.remoteEmptyGuide': 'No remote snapshots yet: this is the first sync — click "Push to remote" to upload your local config (that push creates the first snapshot); pulling only works afterwards.',
   // Sync mode (default quick export / advanced custom export)
   'mode.title': 'Sync Sections',
-  'mode.hint': 'Click the button to tick the sections to sync: the ticked set is the sync scope (recommended sections are ticked by default and can be changed any time).',
+  'mode.hint': 'Sync scope = the ticked set of sections (recommended sections are ticked by default and can be changed any time).',
   'mode.selectedCount': '{n} selected',
   'mode.sectionsHint': 'Portable sections sync by default; platform-dependent sections (MCP servers) and device-specific sections (plugin files, credentials status, sessions) only participate when you explicitly tick them here.',
   'mode.atLeastOne': 'Select at least one section to sync',
@@ -662,7 +664,7 @@ export const en: Record<keyof typeof zh, string> = {
   'mode.includeSecretsHint': 'Write real credential values (~/.dsh/.credentials.yaml) into the encrypted snapshot so another machine can restore them with the sync; checking this auto-selects encryption, and secrets never enter a plaintext snapshot.',
   'mode.encryptAutosyncNotice': 'Encrypted snapshots are only produced/consumed by manual push/pull; auto sync has no password, so it skips encrypted snapshots and reports them in history.',
   'mode.decryptPassword': 'Decryption password (for encrypted snapshot pull/sync, optional)',
-  'mode.decryptPasswordHint': 'Once entered it is saved in the local credential store and reused automatically; it is only ever used when the pulled snapshot is actually encrypted — plaintext backups never use the password. Use "Delete saved password" to remove it.',
+  'mode.decryptPasswordHint': 'Once entered it is saved in the local credential store and reused automatically; it is only ever used when the pulled snapshot is actually encrypted — plaintext backups never use the password.',
   'mode.decryptPasswordSaved': 'Saved locally',
   'mode.decryptPasswordPlaceholder': 'Saved (leave empty to reuse)',
   'mode.clearSavedPassword': 'Delete saved password',
@@ -701,7 +703,7 @@ export const en: Record<keyof typeof zh, string> = {
   'autosync.lastMessage': 'Last message',
   'history.title': 'Sync History',
   'history.empty': 'No sync history yet',
-  'history.emptyHint': 'Records appear here after your first push / one-click sync / auto sync.',
+  'history.emptyHint': 'Records appear here after your first push / merge from remote / auto sync.',
   'history.colTime': 'Time',
   'history.colDetail': 'Detail',
   'history.kindAutosync': 'Auto Sync',
@@ -745,7 +747,7 @@ export const en: Record<keyof typeof zh, string> = {
   'toast.pushPreviewFailed': 'Failed to build push preview',
   'toast.pushFailed': 'Push failed',
   'toast.pushDone': 'Push completed',
-  'toast.syncStartFailed': 'One-click sync failed',
+  'toast.syncStartFailed': 'Merge from remote failed',
   'toast.autosyncUpdateFailed': 'Failed to update auto-sync settings',
   'toast.autosyncUpdated': 'Auto-sync settings updated',
   'toast.snapshotsLoadFailed': 'Failed to load remote snapshots',

package/src/core/messages-core.ts

@@ -67,7 +67,7 @@ export const zh = {
 
   // ---------- run-registry ----------
   'core.run.autosyncBusy': '自动同步已在进行中',
-  'core.run.syncApplyBusy': '一键同步已在进行中',
+  'core.run.syncApplyBusy': '正在从远端合并',
   'core.run.backupScheduleBusy': '定时备份已在进行中',
   'core.run.restoreBusy': '快照恢复已在进行中（请等待当前恢复完成）',
   'core.run.recoveryBusy': '恢复/回滚已在进行中（请等待当前恢复完成）',
@@ -381,7 +381,7 @@ export const en: Record<keyof typeof zh, string> = {
 
   // ---------- run-registry ----------
   'core.run.autosyncBusy': 'Automatic sync is already in progress',
-  'core.run.syncApplyBusy': 'One-click sync is already in progress',
+  'core.run.syncApplyBusy': 'Merge from remote is already in progress',
   'core.run.backupScheduleBusy': 'Scheduled backup is already in progress',
   'core.run.restoreBusy': 'Snapshot restore is already in progress (wait for the current restore to finish)',
   'core.run.recoveryBusy': 'Recovery/rollback is already in progress (wait for the current recovery to finish)',

package/src/core/messages.ts

@@ -439,6 +439,9 @@ export const zh = {
   // 推送认证（真机：公开仓库拉取可匿名成功、推送必失败，git 原文只说「Invalid username or token」）
   'sync.git.pushTokenRequired': '推送需要访问令牌：远端是 http(s) 仓库，但本机没有可用的令牌（拉取公开仓库可以匿名完成，推送必须认证）。请在「同步 → 通道配置」里登录 GitHub 或填入访问令牌后重试。',
   'sync.git.pushAuthFailed': '推送认证失败：{err}。请确认令牌有效且对该仓库有写权限（账号密码推送已被远端禁用）；拉取成功不代表令牌可用 —— 公开仓库匿名即可拉取。可在「同步 → 通道配置」里重新登录或更换令牌。',
+  // issue #120：credential helper 必须经 shell 执行，Android 上 git 的 shell 路径不存在（askpass 又要 exec
+  // 权限，Android 10+ 禁执行应用目录文件）→ 已改用 HTTP 认证头重试；仍失败只能点名平台原因，别引向「令牌坏了」。
+  'sync.git.credentialHelperBlocked': 'git 在本机无法执行 credential helper（它需要 shell，而当前平台不允许从应用目录执行脚本/二进制），改用 HTTP 认证头重试也没成功。请确认 git 版本不低于 2.31（环境变量注入配置需要），或把仓库地址换成 ssh。原始错误：{err}',
   'sync.git.repoUrlInvalid': '无法解析 repoUrl（http(s) 仓库必须为合法 URL）: {url}',
   'sync.git.invalidSnapshotId': '非法快照 id: {id}（仅允许字母数字开头，字符限 . _ -）',
   'sync.webdav.baseUrlRequired': 'baseUrl 必须是非空字符串',
@@ -940,6 +943,7 @@ export const en: Record<keyof typeof zh, string> = {
   'sync.git.cmdFailed': 'git {args} failed (exit {code}): {err}',
   'sync.git.pushTokenRequired': 'Push requires an access token, but none is available on this machine (public repositories can be fetched anonymously; pushing always needs authentication). Sign in to GitHub or paste an access token under Sync → Channel configuration, then retry.',
   'sync.git.pushAuthFailed': 'Push authentication failed: {err}. Check that the token is valid and has write access to this repository (password authentication is disabled by the remote); a successful pull does not prove the token works — public repositories can be fetched anonymously. Sign in again or replace the token under Sync → Channel configuration.',
+  'sync.git.credentialHelperBlocked': 'git cannot run the credential helper on this machine (it needs a shell, and this platform does not allow executing scripts/binaries from the app directory), and retrying with an HTTP authorization header did not work either. Make sure git is 2.31 or newer (injecting config through environment variables needs it) or switch the repository address to ssh. Original error: {err}',
   'sync.git.repoUrlInvalid': 'Cannot parse repoUrl (http(s) repositories must be valid URLs): {url}',
   'sync.git.invalidSnapshotId': 'Invalid snapshot id: {id} (must start with an alphanumeric; only . _ - allowed)',
   'sync.webdav.baseUrlRequired': 'baseUrl must be a non-empty string',

package/src/index.ts

@@ -180,7 +180,7 @@ export const name = 'config-manager'
 export const inject = ['settings', 'credentials']
 
 /** Plugin version, kept in sync with package.json ("version"). */
-export const PLUGIN_VERSION = '0.2.1'
+export const PLUGIN_VERSION = '0.2.3'
 
 /** Plugin own package name — excluded from its own exported plugins list. */
 const PLUGIN_NAME = 'dsh-config-manager'

package/src/market/git-file-writer.test.ts

@@ -19,7 +19,7 @@ const TEST_TOKEN = 'gho_abcdefghijklmnopqrstuvwxyz123456';
 interface ExecCall {
   cmd: string;
   args: string[];
-  opts: { cwd?: string; timeoutMs?: number };
+  opts: { cwd?: string; timeoutMs?: number; env?: Record<string, string> };
 }
 
 /** 记录 exec 调用并按命令返回脚本化结果的 mock */
@@ -286,4 +286,78 @@ test('git-file-writer: 工作副本非空且非 git 仓库 → 拒绝', async (t
     GitFileWriterError,
   );
   assert.ok(!calls.some((c) => c.args[0] === 'clone'), '非空非仓库目录不得 clone');
-});
+});
+
+// issue #120：Android 上 credential helper 走 `sh -c`，helper 无法执行 ⇒ 换 env 注入认证头重试。
+test('git-file-writer: credential helper 无法执行 → 用 env 注入认证头重试 push 成功', async (t) => {
+  const workDir = await tempWorkDir(t);
+  const { exec, calls } = installExec((call) => {
+    if (gitCommandOf(call) === 'diff') return { stdout: '', stderr: '', code: 1 }; // 有变化 → commit + push
+    if (gitCommandOf(call) === 'push' && call.opts.env === undefined) {
+      return {
+        stdout: '',
+        stderr: "fatal: cannot exec 'git credential-store --file=/data/user/0/x/cache/tmp/dsh-git-cred-1/credential get': No such file or directory",
+        code: 128,
+      };
+    }
+    return { stdout: '', stderr: '', code: 0 };
+  });
+  const writer = createGitFileWriter({ credentials: { getToken: async () => TEST_TOKEN }, exec });
+
+  const result = await writer.writeFiles({
+    repoUrl: 'https://github.com/xiaojun/dsh-configs',
+    workDir,
+    entries: [{ path: 'a.txt', content: '1' }],
+    commitMessage: 'publish',
+  });
+
+  assert.equal(result.pushed, true);
+  const pushes = calls.filter((c) => gitCommandOf(c) === 'push');
+  assert.equal(pushes.length, 2, 'helper 失败后必须重试一次');
+  const retry = pushes[1]!;
+  assert.ok(!retry.args.some((a) => a.startsWith('credential.helper=store')), '重试不得再走 helper');
+  assert.equal(retry.opts.env?.['GIT_CONFIG_COUNT'], '2');
+  assert.equal(retry.opts.env?.['GIT_CONFIG_KEY_0'], 'credential.helper');
+  assert.equal(retry.opts.env?.['GIT_CONFIG_VALUE_0'], '');
+  assert.equal(retry.opts.env?.['GIT_CONFIG_KEY_1'], 'http.https://github.com/.extraheader');
+  assert.equal(
+    retry.opts.env?.['GIT_CONFIG_VALUE_1'],
+    'AUTHORIZATION: basic ' + Buffer.from('oauth2:' + TEST_TOKEN).toString('base64'),
+  );
+  assert.ok(!retry.args.join(' ').includes(TEST_TOKEN), 'token 不得进 argv');
+});
+
+test('git-file-writer: clone 遇 helper 无法执行 → 清掉半成品目录后重试', async (t) => {
+  const workDir = await tempWorkDir(t);
+  let cloneAttempts = 0;
+  const { exec } = installExec((call) => {
+    if (gitCommandOf(call) === 'clone') {
+      cloneAttempts += 1;
+      if (cloneAttempts === 1) {
+        return { stdout: '', stderr: "fatal: cannot exec 'git credential-store get': No such file or directory", code: 128 };
+      }
+    }
+    if (gitCommandOf(call) === 'diff') return { stdout: '', stderr: '', code: 0 };
+    return { stdout: '', stderr: '', code: 0 };
+  });
+  // 第一次 clone 前造一个半成品目录：真实 git 失败会留下 .git 残骸，重试前必须清空
+  const scriptedExec: GitExecFn = async (cmd, args, opts) => {
+    if (args.includes('clone') && cloneAttempts === 0) {
+      await fs.mkdir(path.join(workDir, '.git', 'partial'), { recursive: true });
+    }
+    return exec(cmd, args, opts);
+  };
+
+  const writer = createGitFileWriter({ credentials: { getToken: async () => TEST_TOKEN }, exec: scriptedExec });
+  const result = await writer.writeFiles({
+    repoUrl: 'https://github.com/xiaojun/dsh-configs',
+    workDir,
+    entries: [{ path: 'a.txt', content: '1' }],
+    commitMessage: 'noop',
+  });
+
+  assert.equal(cloneAttempts, 2, 'clone 失败后必须重试一次');
+  assert.equal(result.pushed, false);
+  // 第一轮留下的 .git 残骸必须被清掉，目录里只剩本轮写入的文件
+  assert.deepEqual(await fs.readdir(workDir), ['a.txt']);
+});

package/src/market/git-file-writer.ts

@@ -30,6 +30,7 @@ import { withWorkdirLock, WorkdirLockError } from '../utils/workdir-lock.ts';
 import { fastForwardFetchArgs, fastForwardMergeArgs, isMissingRemoteRefError, parseCurrentBranch } from '../utils/git-fast-forward.ts';
 import { marketMsg } from './messages-market.ts';
 import type { GitAuthor, GitCredentialProvider, GitExecFn, GitExecResult } from '../sync/git/git-transport.ts';
+import { clearDirContents, credentialHeaderEnv, isEmptyDir, isCredentialExecFailure } from '../sync/git/credential-auth.ts';
 
 const execFileAsync = promisify(execFile);
 
@@ -102,6 +103,8 @@ const defaultExec: GitExecFn = async (cmd, args, opts) => {
       maxBuffer: 16 * 1024 * 1024,
       windowsHide: true,
       encoding: 'utf8',
+      // issue #120：credential helper 走不了 shell 时改用 env 注入认证头重试（追加在继承的 process.env 上）
+      env: opts.env === undefined ? undefined : { ...process.env, ...opts.env },
     });
     return { stdout: String(stdout), stderr: String(stderr), code: 0 };
   } catch (err) {
@@ -231,7 +234,7 @@ export class GitFileWriterClient implements GitFileWriter {
     const pushArgs = branch !== ''
       ? ['push', '-u', 'origin', branch, ...(call.force === true ? ['--force-with-lease'] : [])]
       : ['push', '-u', 'origin', 'HEAD'];
-    const push = await this.runGit(pushArgs, { cwd: call.workDir, withCredential: true, token, mask });
+    const push = await this.runGit(pushArgs, { cwd: call.workDir, withCredential: true, token, mask, repoUrl: call.repoUrl });
     if (push.code !== 0) {
       throw new GitFileWriterError(mask(marketMsg('market.gitWriter.pushFailed', { stderr: push.stderr })));
     }
@@ -246,7 +249,10 @@ export class GitFileWriterClient implements GitFileWriter {
    */
   private async runGit(
     args: string[],
-    opts: { cwd?: string; withCredential?: boolean; allowNonZero?: boolean; token: string; mask: (text: string) => string },
+    opts: {
+      cwd?: string; withCredential?: boolean; allowNonZero?: boolean; token: string;
+      mask: (text: string) => string; repoUrl?: string;
+    },
   ): Promise<GitExecResult> {
     const cwd = opts.cwd ?? '';
     let extra: string[] = [];
@@ -256,8 +262,20 @@ export class GitFileWriterClient implements GitFileWriter {
       extra = cred.extraArgs;
       cleanup = cred.cleanup;
     }
+    // issue #120：只有「命令开跑前目录是空的」才敢在重试前清空 —— 绝不删用户文件。
+    const cloneTargetWasEmpty = args[0] === 'clone' ? await isEmptyDir(cwd) : false;
     try {
-      const result = await this.exec(this.gitBin, [...extra, ...args], { cwd, timeoutMs: this.timeoutMs });
+      let result = await this.exec(this.gitBin, [...extra, ...args], { cwd, timeoutMs: this.timeoutMs });
+      // issue #120：同 GitTransport —— credential helper 必须经 shell 执行，Android 上 git 的 shell 路径
+      // 不存在（askpass 又要 exec 权限）→ 改用 env 注入 HTTP 认证头重试一次（不需要 shell）。
+      if (result.code !== 0 && opts.withCredential === true && opts.token !== ''
+        && isCredentialExecFailure(result.stderr + ' ' + result.stdout)) {
+        const headerEnv = credentialHeaderEnv(opts.repoUrl ?? '', this.credentialUsername, opts.token);
+        if (Object.keys(headerEnv).length > 0 && (args[0] !== 'clone' || cloneTargetWasEmpty)) {
+          if (args[0] === 'clone') await clearDirContents(cwd);
+          result = await this.exec(this.gitBin, args, { cwd, timeoutMs: this.timeoutMs, env: headerEnv });
+        }
+      }
       if (result.code !== 0 && !opts.allowNonZero) {
         throw new GitFileWriterError(opts.mask(marketMsg('market.gitWriter.commandFailed', { args: args.join(' '), stderr: result.stderr })));
       }
@@ -309,7 +327,7 @@ export class GitFileWriterClient implements GitFileWriter {
       if (entries.length > 0) {
         throw new GitFileWriterError(marketMsg('market.gitWriter.workDirNotEmpty', { workDir }));
       }
-      const clone = await this.runGit(['clone', repoUrl, '.'], { cwd: workDir, withCredential: true, token, mask });
+      const clone = await this.runGit(['clone', repoUrl, '.'], { cwd: workDir, withCredential: true, token, mask, repoUrl });
       if (clone.code !== 0) {
         throw new GitFileWriterError(mask(marketMsg('market.gitWriter.cloneFailed', { stderr: clone.stderr })));
       }
@@ -331,7 +349,7 @@ export class GitFileWriterClient implements GitFileWriter {
     if (branch === '') return;
     // 不再用 git pull --ff-only：并发下 FETCH_HEAD 会被写成多行 for-merge、pull 自己 fatal；
     // 显式 refspec fetch + 显式远端跟踪分支 merge 完全不读 FETCH_HEAD（参数见 utils/git-fast-forward.ts）。
-    const fetched = await this.runGit(fastForwardFetchArgs(branch), { cwd: workDir, withCredential: true, allowNonZero: true, token, mask });
+    const fetched = await this.runGit(fastForwardFetchArgs(branch), { cwd: workDir, withCredential: true, allowNonZero: true, token, mask, repoUrl });
     if (fetched.code !== 0) {
       const combined = fetched.stderr + ' ' + fetched.stdout;
       // 无 upstream / 远端还没有这个分支 → 静默跳过（内容可能已是最新）

package/src/routes/messages.ts

@@ -41,13 +41,13 @@ export const zh = {
   'route.syncPreviewFailed': '同步预览失败',
   'route.syncSessionExpired': '同步会话不存在或已过期，请重新拉取预览',
   'route.syncConflictResolutionRequired': '冲突项 {id} 必须提供 resolution（useRemote/keepLocal/skip）',
-  'route.syncApplySummary': '一键同步应用：{count} 项{status}{ineffective}',
+  'route.syncApplySummary': '从远端合并：{count} 项{status}{ineffective}',
   'route.syncRollbackIncomplete': '（回滚未完成）',
   'route.syncRolledBack': '（已回滚）',
   'route.syncIneffectiveSuffix': '（{count} 项未生效）',
   'route.syncApplyPartial': '同步应用部分成功：有项未生效（见告警明细）',
   'route.syncApplyFailed': '同步应用未完全成功',
-  'route.syncRollbackSummary': '一键同步回滚（{id}）',
+  'route.syncRollbackSummary': '从远端合并回滚（{id}）',
   // ---------- 事故恢复 ----------
   'route.recoverySessionRepairRollback': '会话修复回滚',
   'route.recoverySessionRepairDropped': '会话修复（丢弃重放重复行 {count} 行）',
@@ -82,13 +82,13 @@ export const en: Record<keyof typeof zh, string> = {
   'route.syncPreviewFailed': 'Sync preview failed',
   'route.syncSessionExpired': 'The sync session does not exist or has expired; pull a fresh preview',
   'route.syncConflictResolutionRequired': 'Conflict item {id} must provide a resolution (useRemote/keepLocal/skip)',
-  'route.syncApplySummary': 'One-click sync apply: {count} item(s){status}{ineffective}',
+  'route.syncApplySummary': 'Merge from remote: {count} item(s){status}{ineffective}',
   'route.syncRollbackIncomplete': ' (rollback incomplete)',
   'route.syncRolledBack': ' (rolled back)',
   'route.syncIneffectiveSuffix': ' ({count} item(s) had no effect)',
   'route.syncApplyPartial': 'Sync apply partially succeeded: some items had no effect (see the warning details)',
   'route.syncApplyFailed': 'Sync apply did not fully succeed',
-  'route.syncRollbackSummary': 'One-click sync rollback ({id})',
+  'route.syncRollbackSummary': 'Merge from remote rollback ({id})',
   'route.recoverySessionRepairRollback': 'Session repair rollback',
   'route.recoverySessionRepairDropped': 'Session repair (dropped {count} replayed duplicate row(s))',
   'route.recoverySessionRepairRejected': 'Session repair was rejected: {reason}',

package/src/sync/git/credential-auth.ts

@@ -0,0 +1,84 @@
+import { readdir, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+
+/**
+ * issue #120：**不依赖 shell、不依赖可执行文件**的 git 认证兜底。
+ *
+ * 真机现场（Android，App 内嵌 `dsh web`）：git 二进制编译期把 GIT_SHELL_PATH 钉成
+ * Termux 的 `/data/data/com.termux/files/usr/bin/sh`，该路径在 App 沙箱里不存在，而 git 执行
+ * credential helper 的方式是把 helper 值拼成 `sh -c 'git <helper> ...'` —— **没有**「值里不含空格
+ * 就不经 shell」这种写法（本机 git trace 实测：`run_command: 'git credential-store get'` 之后紧接
+ * `start_command: '<git>/usr/bin/sh.exe' -c 'git credential-store get'`；裸 `credential.helper=store`
+ * 也一样）。于是 helper 恒定失败：
+ * `fatal: cannot exec 'git credential-store --file=... credential get': No such file or directory`
+ * → 无 tty 时退化成 `fatal: could not read Password for 'https://oauth2@github.com': terminal prompts disabled`。
+ *
+ * 换成 `core.askpass` 躲不开：askpass 是一个**要被 exec 的脚本**，而 Android 10 起 targetSdk ≥ 29
+ * 的应用不允许执行自己数据目录里的文件（SELinux untrusted_app_29+ 对 app_data_file 无 execute 权限）。
+ *
+ * 唯一不需要 exec 的通道是 git 自己从环境变量读配置（git ≥ 2.31 的 GIT_CONFIG_COUNT 协议）：
+ * 把 `http.<scope>.extraheader = AUTHORIZATION: basic <base64(user:token)>` 挂进 git 子进程的 env，
+ * 凭据既不进 argv、也不落临时文件、更不需要 sh —— token 只出现在 git 子进程的环境里
+ * （Android 上 /proc/<pid>/environ 也只有同 uid 可读，比临时凭据文件更窄）。
+ *
+ * 用法：helper 路线先跑；失败且命中 isCredentialExecFailure() 时换这份 env 重试一次。
+ */
+
+/**
+ * credential helper 无法被执行时的 git 原文特征：
+ * - `cannot exec ...: No such file or directory`：shell 或 helper 二进制不存在；
+ * - `could not read Password ...` / `terminal prompts disabled`：helper 没跑成，退化成读终端口令。
+ */
+const CREDENTIAL_EXEC_FAILURE_RE = /cannot exec|could not read Password|terminal prompts disabled/i;
+
+/** 这条 git 失败是不是「credential helper 根本没能执行」（→ 值得改用 HTTP 认证头重试）。 */
+export function isCredentialExecFailure(text: string): boolean {
+  return CREDENTIAL_EXEC_FAILURE_RE.test(text);
+}
+
+/** 目录是否为空（读不到 = 非空：拿不准时绝不删东西，见 runGit 的 clone 重试）。 */
+export async function isEmptyDir(dir: string): Promise<boolean> {
+  try {
+    return (await readdir(dir)).length === 0;
+  } catch {
+    return false;
+  }
+}
+
+/** 清空目录内容但保留目录本身（只用于「命令开跑前确认为空」的 clone 重试路径）。 */
+export async function clearDirContents(dir: string): Promise<void> {
+  const entries = await readdir(dir).catch(() => [] as string[]);
+  for (const entry of entries) {
+    await rm(join(dir, entry), { recursive: true, force: true });
+  }
+}
+
+/**
+ * 构造「用 HTTP 认证头代替 credential helper」的子进程环境变量。
+ *
+ * - 顺带把 `credential.helper` 置空：否则全局 `.gitconfig` 里配的 helper 仍会被调用并再次 cannot exec。
+ * - 明文 http 常被远端重定向到 https，而 git 是按**每条请求的 URL** 匹配配置的 → 两个前缀都挂一份。
+ * - 返回空对象 = 注入不了（repoUrl 不是合法 URL，或令牌为空），调用方保持原有失败路径。
+ */
+export function credentialHeaderEnv(repoUrl: string, username: string, token: string): Record<string, string> {
+  if (token === '') return {};
+  let origin: string;
+  try {
+    const u = new URL(repoUrl);
+    // 只取 scheme://host[:port]/ 作作用域：路径无关（同主机全部仓库都用这份令牌）
+    origin = `${u.protocol}//${u.host}/`;
+  } catch {
+    return {};
+  }
+  const scopes = [origin];
+  if (origin.startsWith('http://')) scopes.push(`https://${origin.slice('http://'.length)}`);
+  const authorization = `AUTHORIZATION: basic ${Buffer.from(`${username}:${token}`, 'utf8').toString('base64')}`;
+  const pairs: Array<[string, string]> = [['credential.helper', '']];
+  for (const scope of scopes) pairs.push([`http.${scope}.extraheader`, authorization]);
+  const env: Record<string, string> = { GIT_CONFIG_COUNT: String(pairs.length) };
+  pairs.forEach(([key, value], index) => {
+    env[`GIT_CONFIG_KEY_${String(index)}`] = key;
+    env[`GIT_CONFIG_VALUE_${String(index)}`] = value;
+  });
+  return env;
+}

package/src/sync/git/git-transport.test.ts

@@ -401,6 +401,102 @@ test('推送鉴权失败（GitHub 文案）→ 分类 auth + 可操作提示，
   );
 });
 
+test('issue #120：credential helper 无法执行（Android 没有可用 shell）→ 改用 env 注入认证头重试一次', async (t) => {
+  const dir = await makeGitWorkDir(t);
+  const calls: { args: string[]; env?: Record<string, string> }[] = [];
+  const exec: GitExecFn = async (_cmd, args, opts) => {
+    calls.push({ args, env: opts.env });
+    const joined = args.join(' ');
+    if (joined.includes('diff') && joined.includes('--quiet')) return { stdout: '', stderr: '', code: 1 };
+    if (joined.includes('push -u')) {
+      // 第一次：credential helper 走 shell，而本机没有可用的 sh（真机原文）
+      if (opts.env === undefined || opts.env['GIT_CONFIG_KEY_0'] === undefined) {
+        return {
+          stdout: '',
+          stderr: "fatal: cannot exec 'git credential-store --file=/data/user/0/x/cache/tmp/dsh-git-cred-1/credential get': No such file or directory",
+          code: 128,
+        };
+      }
+      return { stdout: '', stderr: '', code: 0 };
+    }
+    return { stdout: '', stderr: '', code: 0 };
+  };
+  const transport = new GitTransport(makeOptions({ workDir: dir, exec }));
+  await transport.upload(sampleSnapshot());
+  const pushes = calls.filter((c) => c.args.join(' ').includes('push -u'));
+  assert.equal(pushes.length, 2, 'helper 无法执行时必须重试一次');
+  const retry = pushes[1]!;
+  assert.ok(!retry.args.some((a) => a.startsWith('credential.helper=store')), '重试不得再注入 store helper');
+  const env = retry.env!;
+  assert.equal(env['GIT_CONFIG_COUNT'], '2', '一条清 helper、一条挂认证头');
+  assert.equal(env['GIT_CONFIG_KEY_0'], 'credential.helper');
+  assert.equal(env['GIT_CONFIG_VALUE_0'], '', '必须清掉全局 helper，否则它会被再次调用并再次 cannot exec');
+  assert.equal(env['GIT_CONFIG_KEY_1'], 'http.https://github.com/.extraheader');
+  assert.equal(
+    env['GIT_CONFIG_VALUE_1'],
+    'AUTHORIZATION: basic ' + Buffer.from('oauth2:' + TEST_TOKEN, 'utf8').toString('base64'),
+  );
+  for (const arg of retry.args) assert.ok(!arg.includes(TEST_TOKEN), '重试的 argv 不得含 token');
+});
+
+test('issue #120：认证头重试也失败 → 错误点名平台原因，不再把用户引向「令牌坏了」', async (t) => {
+  const dir = await makeGitWorkDir(t);
+  const calls: CallRecord[] = [];
+  const exec: GitExecFn = async (_cmd, args) => {
+    calls.push({ cmd: 'git', args });
+    const joined = args.join(' ');
+    if (joined.includes('diff') && joined.includes('--quiet')) return { stdout: '', stderr: '', code: 1 };
+    if (joined.includes('push -u')) {
+      return {
+        stdout: '',
+        stderr: "fatal: cannot exec 'git credential-store get': No such file or directory\n"
+          + 'fatal: could not read Password for ' + "'" + 'https://oauth2@github.com' + "'" + ': terminal prompts disabled',
+        code: 128,
+      };
+    }
+    return { stdout: '', stderr: '', code: 0 };
+  };
+  const transport = new GitTransport(makeOptions({ workDir: dir, exec }));
+  await assert.rejects(
+    transport.upload(sampleSnapshot()),
+    (err: unknown) => {
+      assert.ok(err instanceof GitTransportError);
+      assert.equal(err.kind, 'auth');
+      assert.match(err.message, /credential helper/, '必须点名 credential helper 执行不了');
+      assert.match(err.message, /2\.31/, '必须给出可验证的下限（env 注入配置需要 git ≥ 2.31）');
+      assert.ok(!/推送认证失败/.test(err.message), '不得把平台问题写成「令牌/权限」问题');
+      assert.ok(!err.message.includes(TEST_TOKEN), '错误消息不得泄漏 token');
+      return true;
+    },
+  );
+  assert.equal(calls.filter((c) => c.args.join(' ').includes('push -u')).length, 2, '只重试一次，不无限重试');
+});
+
+test('issue #120：clone 遇到 helper 无法执行 → 清掉半成品目录后用认证头重试成功', async (t) => {
+  const dir = await makeTempDir(t); // 空目录 → 走 clone 分支
+  let cloneAttempts = 0;
+  const exec: GitExecFn = async (_cmd, args, opts) => {
+    const joined = args.join(' ');
+    if (joined.includes('clone')) {
+      cloneAttempts += 1;
+      if (cloneAttempts === 1) {
+        // git 认证失败前已建出半成品（.git + 部分对象）
+        await fs.mkdir(path.join(dir, '.git'), { recursive: true });
+        await fs.writeFile(path.join(dir, '.git', 'partial'), 'half');
+        return { stdout: '', stderr: "fatal: cannot exec 'git credential-store get': No such file or directory", code: 128 };
+      }
+      assert.deepEqual(await fs.readdir(dir), [], '重试前必须清掉半成品，否则 clone 会因目录非空失败');
+      assert.ok(opts.env !== undefined, '重试必须走 env 注入认证头');
+      await fs.mkdir(path.join(dir, '.git'), { recursive: true });
+      return { stdout: '', stderr: '', code: 0 };
+    }
+    return { stdout: '', stderr: '', code: 0 };
+  };
+  const transport = new GitTransport(makeOptions({ workDir: dir, exec }));
+  await transport.list();
+  assert.equal(cloneAttempts, 2, '应恰好重试一次 clone');
+});
+
 test('checkIsPrivate：匿名可达 → false；匿名失败+认证可达 → true；都失败 → 抛错', async (t) => {
   // 匿名成功
   const c1: CallRecord[] = [];