dsh-git-branch-manage 1.1.0 → 1.2.0

package/lib/local-import.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Import the machine's OWN credentials into the managed store (decision 0038).
+ *
+ * The store itself only knows the lines of `~/.git-credentials`. Everything
+ * the user already signed in through — Windows Credential Manager, macOS
+ * keychain, `gh auth git-credential` — lives outside that file and cannot be
+ * enumerated. What CAN be enumerated is the set of hosts git is configured to
+ * talk to (`[credential "https://host"]` sections in the user's gitconfig), so
+ * the import probes each of those with `git credential fill` and copies the
+ * secret the helper is willing to hand over. A host that answers nothing is
+ * reported as failed and left alone: importing never clears, only adds.
+ */
+import { type CredentialStore } from './credentials.js';
+/** One host the import copied out of the machine's own helper. */
+export interface ImportedCredential {
+    host: string;
+    username: string;
+    method: 'token' | 'password';
+}
+/** One host whose helper refused (or could not be asked) — the store is untouched. */
+export interface LocalImportFailure {
+    host: string;
+    error: string;
+}
+/** Outcome of one import run. */
+export interface LocalImportReport {
+    imported: ImportedCredential[];
+    skipped: string[];
+    failed: LocalImportFailure[];
+}
+/** One finished git invocation (local import never throws on a non-zero exit). */
+export interface LocalGitResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+/** Runs one git command with `input` on stdin; tests substitute a fake. */
+export type LocalGit = (args: readonly string[], input: string, env: NodeJS.ProcessEnv, timeoutMs: number) => Promise<LocalGitResult>;
+/** Seams for the import: the environment, the git runner, the per-host timeout. */
+export interface LocalImportDeps {
+    env?: NodeJS.ProcessEnv;
+    runGit?: LocalGit;
+    timeoutMs?: number;
+}
+/** The production git runner: spawn, feed stdin, collect both streams, kill on
+ * the deadline. `GIT_TERMINAL_PROMPT=0` / `GCM_INTERACTIVE=never` are applied
+ * by the caller, so a missing credential fails instead of opening a dialog. */
+export declare const runGitLocal: LocalGit;
+/**
+ * Hosts git is configured to ask for credentials: the URL-scoped
+ * `[credential "https://host"]` sections of the user's gitconfig, plus any
+ * that the global `credential.<url>.helper` keys spell out. Read-only.
+ * @param deps - environment and git seams.
+ */
+export declare function localCredentialHosts(deps?: LocalImportDeps): Promise<string[]>;
+/**
+ * Copy every host the machine already answers for into the managed store.
+ *
+ * Candidates come from the caller (`hosts`) or from the user's gitconfig. A
+ * host already managed is skipped (the panel is the source of truth for it),
+ * a host whose helper answers nothing is reported and left untouched, and the
+ * store is written once at the end — a partial import is still a valid import.
+ *
+ * @param store - the managed credential store.
+ * @param deps - environment and git seams.
+ * @param hosts - explicit candidates; omitted, the gitconfig's hosts are used.
+ */
+export declare function importLocalCredentials(store: CredentialStore, deps?: LocalImportDeps, hosts?: readonly string[]): Promise<LocalImportReport>;

package/lib/local-import.js

@@ -0,0 +1,151 @@
+/**
+ * Import the machine's OWN credentials into the managed store (decision 0038).
+ *
+ * The store itself only knows the lines of `~/.git-credentials`. Everything
+ * the user already signed in through — Windows Credential Manager, macOS
+ * keychain, `gh auth git-credential` — lives outside that file and cannot be
+ * enumerated. What CAN be enumerated is the set of hosts git is configured to
+ * talk to (`[credential "https://host"]` sections in the user's gitconfig), so
+ * the import probes each of those with `git credential fill` and copies the
+ * secret the helper is willing to hand over. A host that answers nothing is
+ * reported as failed and left alone: importing never clears, only adds.
+ */
+import { spawn } from 'node:child_process';
+import { TOKEN_USERNAME, normalizeCredentialHost, upsertCredential } from './credentials.js';
+/** A helper may take a while (keychain prompts, network providers); 20s is
+ * long enough for a cold GCM start and short enough not to hang a modal. */
+const DEFAULT_TIMEOUT_MS = 20_000;
+/** The production git runner: spawn, feed stdin, collect both streams, kill on
+ * the deadline. `GIT_TERMINAL_PROMPT=0` / `GCM_INTERACTIVE=never` are applied
+ * by the caller, so a missing credential fails instead of opening a dialog. */
+export const runGitLocal = (args, input, env, timeoutMs) => new Promise(resolve => {
+    const child = spawn('git', [...args], { env, windowsHide: true });
+    let stdout = '';
+    let stderr = '';
+    let settled = false;
+    const finish = (result) => {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(timer);
+        resolve(result);
+    };
+    const timer = setTimeout(() => {
+        child.kill();
+        finish({ code: -1, stdout, stderr: stderr === '' ? 'git timed out' : stderr });
+    }, timeoutMs);
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (chunk) => { stdout += chunk; });
+    child.stderr.on('data', (chunk) => { stderr += chunk; });
+    child.on('error', error => finish({ code: -1, stdout, stderr: error.message }));
+    child.on('close', code => finish({ code: code ?? -1, stdout, stderr }));
+    child.stdin.on('error', () => { });
+    child.stdin.end(input);
+});
+/** The local channel: fail fast instead of prompting, and drop any half
+ * injected `GIT_CONFIG_COUNT` channel (decision 0036) that would make every
+ * git command fail to parse. */
+function localEnv(env) {
+    const next = { ...env, GIT_TERMINAL_PROMPT: '0', GCM_INTERACTIVE: 'never' };
+    for (const key of Object.keys(next)) {
+        if (key === 'GIT_CONFIG_COUNT' || key.startsWith('GIT_CONFIG_KEY_') || key.startsWith('GIT_CONFIG_VALUE_'))
+            delete next[key];
+    }
+    return next;
+}
+/** First non-empty line of a helper's complaint, for the panel. */
+function firstLine(text) {
+    const line = text.split(/\r?\n/).map(part => part.trim()).find(part => part !== '');
+    return line ?? '';
+}
+/**
+ * Hosts git is configured to ask for credentials: the URL-scoped
+ * `[credential "https://host"]` sections of the user's gitconfig, plus any
+ * that the global `credential.<url>.helper` keys spell out. Read-only.
+ * @param deps - environment and git seams.
+ */
+export async function localCredentialHosts(deps = {}) {
+    const run = deps.runGit ?? runGitLocal;
+    const result = await run(['config', '--get-regexp', '^credential\\.https?://'], '', localEnv(deps.env ?? process.env), deps.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    // `git config --get-regexp` exits 1 when nothing matches: that is "no
+    // candidates", never an error worth surfacing.
+    if (result.code !== 0)
+        return [];
+    const hosts = [];
+    for (const line of result.stdout.split(/\r?\n/)) {
+        const match = /^credential\.https?:\/\/(\S+?)\.[A-Za-z0-9_-]+(?:\s|$)/i.exec(line);
+        if (match === null)
+            continue;
+        const host = normalizeCredentialHost(match[1] ?? '');
+        if (host !== undefined && !hosts.includes(host))
+            hosts.push(host);
+    }
+    return hosts;
+}
+/** Ask the machine's own helper for one host's credential. */
+async function probe(host, deps) {
+    const run = deps.runGit ?? runGitLocal;
+    const result = await run(['credential', 'fill'], `protocol=https\nhost=${host}\n\n`, localEnv(deps.env ?? process.env), deps.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    if (result.code !== 0) {
+        return { error: firstLine(result.stderr) === '' ? `git exited ${String(result.code)}` : firstLine(result.stderr) };
+    }
+    const field = (name) => result.stdout.split(/\r?\n/)
+        .find(line => line.startsWith(`${name}=`))
+        ?.slice(name.length + 1) ?? '';
+    const secret = field('password');
+    if (secret === '')
+        return { error: 'the credential helper returned no secret' };
+    return { username: field('username').trim(), secret };
+}
+/**
+ * Copy every host the machine already answers for into the managed store.
+ *
+ * Candidates come from the caller (`hosts`) or from the user's gitconfig. A
+ * host already managed is skipped (the panel is the source of truth for it),
+ * a host whose helper answers nothing is reported and left untouched, and the
+ * store is written once at the end — a partial import is still a valid import.
+ *
+ * @param store - the managed credential store.
+ * @param deps - environment and git seams.
+ * @param hosts - explicit candidates; omitted, the gitconfig's hosts are used.
+ */
+export async function importLocalCredentials(store, deps = {}, hosts) {
+    const report = { imported: [], skipped: [], failed: [] };
+    const entries = await store.load();
+    const managed = new Set(entries.map(entry => entry.host));
+    const candidates = [];
+    const seen = new Set();
+    for (const value of hosts ?? await localCredentialHosts(deps)) {
+        const host = normalizeCredentialHost(value);
+        if (host === undefined || seen.has(host))
+            continue;
+        seen.add(host);
+        if (managed.has(host)) {
+            report.skipped.push(host);
+            continue;
+        }
+        candidates.push(host);
+    }
+    let next = entries;
+    for (const host of candidates) {
+        const probed = await probe(host, deps);
+        if ('error' in probed) {
+            report.failed.push({ host, error: probed.error });
+            continue;
+        }
+        const token = probed.username === '' || probed.username === TOKEN_USERNAME;
+        const entry = {
+            host,
+            username: token ? '' : probed.username,
+            secret: probed.secret,
+            method: token ? 'token' : 'password',
+            updatedAt: Date.now(),
+        };
+        next = upsertCredential(next, entry);
+        report.imported.push({ host, username: token ? TOKEN_USERNAME : probed.username, method: token ? 'token' : 'password' });
+    }
+    if (report.imported.length > 0)
+        await store.save(next);
+    return report;
+}

package/lib/network-tool.d.ts

@@ -1,14 +1,11 @@
 /**
  * The model-facing `git_network` tool (host half).
  *
- * The credentials panel stores one token per remote host and makes it work on
- * two channels: the panel's own fetch / pull / push routes (`-c
- * http.<url>.extraHeader=…`, see `authConfigArgs`) and the environment bridge
- * the host installs for the shells it spawns (`shell-bridge.ts`). This tool is
- * the third, explicit one: it runs ONE git network command with the same
- * `authConfigArgs` the routes use, so a session reliably pushes as the account
- * the user configured and the secret never enters the conversation — including
- * on a host that predates the bridge.
+ * The credentials panel manages the machine's own `~/.git-credentials`
+ * (decision 0037), scoped per host through a generated include that
+ * `~/.gitconfig` pulls in. Because that is git's standard `credential-store`
+ * channel, this tool needs no injection of its own: it runs ONE git network
+ * command and git resolves the host exactly as it would in a plain shell.
  *
  * It is deliberately narrower than a shell wrapper: a fixed subcommand
  * allow-list (fetch / pull / push / ls-remote), no force/delete refspecs, no

package/lib/network-tool.js

@@ -1,14 +1,11 @@
 /**
  * The model-facing `git_network` tool (host half).
  *
- * The credentials panel stores one token per remote host and makes it work on
- * two channels: the panel's own fetch / pull / push routes (`-c
- * http.<url>.extraHeader=…`, see `authConfigArgs`) and the environment bridge
- * the host installs for the shells it spawns (`shell-bridge.ts`). This tool is
- * the third, explicit one: it runs ONE git network command with the same
- * `authConfigArgs` the routes use, so a session reliably pushes as the account
- * the user configured and the secret never enters the conversation — including
- * on a host that predates the bridge.
+ * The credentials panel manages the machine's own `~/.git-credentials`
+ * (decision 0037), scoped per host through a generated include that
+ * `~/.gitconfig` pulls in. Because that is git's standard `credential-store`
+ * channel, this tool needs no injection of its own: it runs ONE git network
+ * command and git resolves the host exactly as it would in a plain shell.
  *
  * It is deliberately narrower than a shell wrapper: a fixed subcommand
  * allow-list (fetch / pull / push / ls-remote), no force/delete refspecs, no
@@ -20,7 +17,7 @@
  * @module dsh-git-branch/network-tool
  */
 import { isAbsolute } from 'node:path';
-import { authConfigArgs, basicUsername, createCredentialStore, credentialFilePath, } from './credentials.js';
+import { basicUsername, createLocalCredentialStore, } from './credentials.js';
 import { childProcessExec, NETWORK_TIMEOUT_MS } from './git.js';
 /** Model-facing tool name. */
 export const GIT_NETWORK_TOOL_NAME = 'git_network';
@@ -162,19 +159,15 @@ export function renderGitNetwork(value) {
  * @returns a definition ready for `ctx.tools.register`.
  */
 export function gitNetworkTool(deps) {
-    const storeOf = () => deps.credentialsService?.store ?? deps.store ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
+    const storeOf = () => deps.credentialsService?.store ?? deps.store ?? createLocalCredentialStore(deps.home(), deps.envHome());
     const exec = deps.exec ?? childProcessExec;
     return {
         name: GIT_NETWORK_TOOL_NAME,
         description: 'Run ONE git network command (fetch, pull, push or ls-remote) inside a repository with the '
-            + 'plugin\'s stored Git credentials injected, so the command authenticates as the account configured in the '
+            + 'Git credentials managed for the remote host, so the command authenticates as the account configured in the '
             + 'Git credential panel instead of whatever the machine\'s git credential helper happens to hold. Prefer it for '
-            + 'every push/fetch/pull: the credential is injected explicitly and redacted from the output, while a plain '
-            + 'shell `git push` only reaches these credentials through the environment bridge the plugin host installs '
-            + 'for the shells it spawns. That bridge is absent in an older host or in a terminal started outside it; there '
-            + 'git clears the machine helper chain too, so an unconfigured host fails fast with a "terminal prompts '
-            + 'disabled" error instead of opening a credential dialog nobody can answer. Pass the git '
-            + 'arguments subcommand-first, for example ["push"], ["fetch", "--all", "--prune"] or '
+            + 'every push/fetch/pull: output is redacted from the tool result. Pass the git arguments subcommand-first, '
+            + 'for example ["push"], ["fetch", "--all", "--prune"] or '
             + '["push", "origin", "main"]. Force/delete refspecs, --force/--delete/--mirror/--prune and '
             + '--upload-pack/--receive-pack style options are rejected by design. The secret itself never appears in the '
             + 'result: only exit status, redacted stdout/stderr and the hosts that were authenticated.',
@@ -226,7 +219,10 @@ export function gitNetworkTool(deps) {
                 credentialsError = error instanceof Error ? error.message : String(error);
             }
             const hosts = [...new Set(entries.map(entry => entry.host))].sort();
-            const result = await exec('git', [...authConfigArgs(entries), ...request.args], {
+            // No credential argv: git authenticates through the URL-scoped
+            // `helper = store` include that 0037 installs into `~/.gitconfig`, so
+            // the same token serves this command and a plain shell `git push`.
+            const result = await exec('git', request.args, {
                 cwd: request.repoPath,
                 timeoutMs: NETWORK_TIMEOUT_MS,
             });

package/lib/routes.d.ts

@@ -5,8 +5,9 @@
 import { type CopyFilesSeams } from './copy-files.js';
 import { type CredentialStore } from './credentials.js';
 import type { CredentialService } from './credential-service.js';
+import { type LocalImportReport } from './local-import.js';
 import { type DirExists, type ExcludeSeams, type Exec } from './git.js';
-import type { AiCommitMessageResult, ChangesResult, CommitFilesResult, CommitResult, CreateBranchResult, CreateTagResult, CreateWorktreeResult, CredentialOAuthPollResult, CredentialOAuthStartResult, CredentialsResult, EnsureDirectoryResult, FetchResult, GroupWorkspacesResult, InspectWorktreeResult, LogResult, PathExistsResult, PurgeDirectoryResult, PushTagResult, RemoveWorktreeResult, RemotesResult, RepoStatus, RouteError, StageResult, SwitchResult, UpdateResult, WorktreesAllResult } from './wire.js';
+import type { AiCommitMessageResult, ChangesResult, CommitFilesResult, CommitResult, CreateBranchResult, CreateTagResult, CreateWorktreeResult, CredentialOAuthPollResult, CredentialOAuthStartResult, CredentialImportResult, CredentialsResult, EnsureDirectoryResult, FetchResult, GroupWorkspacesResult, InspectWorktreeResult, LogResult, PathExistsResult, PurgeDirectoryResult, PushTagResult, RemoveWorktreeResult, RemotesResult, RepoStatus, RouteError, StageResult, SwitchResult, UpdateResult, WorktreesAllResult } from './wire.js';
 /** Everything the handlers need from the host half. */
 export interface RouteDeps {
     exec: Exec;
@@ -51,6 +52,10 @@ export interface RouteDeps {
     /** Re-derive the shell credential bridge after the store changed (absent =
      * a host that does not provide the bridge; tests omit it). */
     refreshShellBridge?: () => Promise<void>;
+    /** Machine-credential import seam (decision 0038): probes the helpers the
+     * user's own gitconfig points git at, for the hosts it names. Tests
+     * substitute; absent = the real `git credential fill` probe. */
+    importLocalCredentials?: (store: CredentialStore, hosts?: readonly string[]) => Promise<LocalImportReport>;
 }
 /** Real fs-backed one-level directory listing (names only). Plain FILES are
  * filtered out — the storage root can carry strays (a legacy settings.json
@@ -63,7 +68,7 @@ export declare function fsMkdirRecursive(path: string): Promise<void>;
 /** One route outcome: HTTP status plus the JSON body. */
 export interface RouteOutcome {
     status: number;
-    body: RepoStatus | CreateWorktreeResult | SwitchResult | CreateBranchResult | FetchResult | UpdateResult | GroupWorkspacesResult | InspectWorktreeResult | RemoveWorktreeResult | PathExistsResult | EnsureDirectoryResult | WorktreesAllResult | PurgeDirectoryResult | ChangesResult | StageResult | CommitResult | LogResult | CommitFilesResult | CreateTagResult | PushTagResult | AiCommitMessageResult | CredentialsResult | CredentialOAuthStartResult | CredentialOAuthPollResult | RemotesResult | RouteError;
+    body: RepoStatus | CreateWorktreeResult | SwitchResult | CreateBranchResult | FetchResult | UpdateResult | GroupWorkspacesResult | InspectWorktreeResult | RemoveWorktreeResult | PathExistsResult | EnsureDirectoryResult | WorktreesAllResult | PurgeDirectoryResult | ChangesResult | StageResult | CommitResult | LogResult | CommitFilesResult | CreateTagResult | PushTagResult | AiCommitMessageResult | CredentialsResult | CredentialOAuthStartResult | CredentialOAuthPollResult | CredentialImportResult | RemotesResult | RouteError;
 }
 /**
  * POST /group — git belonging facts for a batch of workspace directories.
@@ -387,6 +392,18 @@ export declare function handleCredentialsSave(deps: RouteDeps, body: unknown): P
  * @param body - parsed request body: `{ host }`.
  */
 export declare function handleCredentialsDelete(deps: RouteDeps, body: unknown): Promise<RouteOutcome>;
+/**
+ * POST /credentials-import — copy what the machine's own credential helpers
+ * already answer for into the managed store, so a machine signed in through
+ * gh/GCM/Keychain stops needing a second sign-in here (decision 0038).
+ *
+ * The candidates are the URL-scoped hosts of the user's gitconfig; a host the
+ * panel already manages is skipped (the panel wins), and a host whose helper
+ * answers nothing is reported per host instead of failing the whole request.
+ * @param deps - host dependencies.
+ * @param body - parsed request body: absent, `{}` or `{ hosts?: string[] }`.
+ */
+export declare function handleCredentialsImport(deps: RouteDeps, body: unknown): Promise<RouteOutcome>;
 /**
  * POST /credentials-oauth-start — start a browser sign-in for ONE host
  * (GitHub device flow). The answer carries a one-time user code and the

package/lib/routes.js

@@ -5,7 +5,8 @@
 import { basename, dirname, join, resolve } from 'node:path';
 import { mkdir, readdir, rm, stat } from 'node:fs/promises';
 import { runPostCreateCopy } from './copy-files.js';
-import { authConfigArgs, credentialFilePath, createCredentialStore, credentialHostIssue, credentialSecretIssue, credentialUsernameIssue, maskSecret, normalizeCredentialHost, removeCredential, sortCredentials, upsertCredential } from './credentials.js';
+import { credentialHostIssue, credentialSecretIssue, credentialUsernameIssue, createLocalCredentialStore, maskSecret, normalizeCredentialHost, removeCredential, sortCredentials, upsertCredential } from './credentials.js';
+import { importLocalCredentials as runLocalImport } from './local-import.js';
 import { appendWorktreeExclude, fsExcludeSeams, GitError, addRemote, addWorktree, addWorktreeCutout, collectAiDiff, commitFiles, commitIndex, createBranch, createTag, cutoutBranchName, deleteBranch, fetchAll, fsDirExists, inspectWorktree, isAbsoluteDir, isStageablePath, listRemotes, listTagNames, logHistory, probeRepo, probeWorkspaceGit, pushTag, removeRemote, removeWorktree, renameBranch, resolveBranch, resolvePushRemote, pushBranch, setRemoteUrl, stagePaths, switchBranch, updateBranch, workingChanges } from './git.js';
 import { ACCEL_DEFAULT_URL, accelerateUrlError, isAbsoluteConfigPath, normalizeAccelerateUrl, remoteNameIssue, remoteUrlIssue, sanitizeBranchDir } from './normalize.js';
 import { deviceFlowClientId, isDeviceFlowHost, pollDeviceFlow, startDeviceFlow } from './oauth.js';
@@ -53,28 +54,20 @@ function accelPrefix(deps) {
     const url = deps.sectionCnAccelerateUrl?.() ?? ACCEL_DEFAULT_URL;
     return accelerateUrlError(url) === undefined ? normalizeAccelerateUrl(url) : undefined;
 }
-/** The global credential store: the service's shared instance (decision 0034),
- * else the wired store, else the fs-backed file at the resolved dsh home
- * (`<dshHome>/git-credentials.json`). */
+/** The global credential store: the service's shared instance (decision 0037),
+ * else the wired store, else the local `~/.git-credentials`-backed store. */
 function credentialStore(deps) {
-    return deps.credentialsService?.store ?? deps.credentialsStore ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
+    return deps.credentialsService?.store ?? deps.credentialsStore ?? createLocalCredentialStore(deps.home(), deps.envHome());
 }
 /**
- * `-c http.<url>.extraHeader` pairs for every stored credential, ready to
- * prepend to a git network command. A broken credential FILE must never break
- * git itself: an unreadable store degrades to "no credentials" (the network
- * command then runs unauthenticated, as it always did) — the credentials
- * route is where the file problem surfaces.
+ * Credential argv for one network command. Empty by design since 0037: the
+ * token reaches git through the URL-scoped `helper = store` include that
+ * `~/.gitconfig` carries, so there is nothing to inject. The seam stays so
+ * every call site keeps one place to change if a command ever needs an
+ * explicit override again.
  */
-async function authArgsFor(deps) {
-    if (deps.credentialsService !== undefined)
-        return deps.credentialsService.authConfigArgs();
-    try {
-        return authConfigArgs(await credentialStore(deps).load());
-    }
-    catch {
-        return [];
-    }
+async function authArgsFor(_deps) {
+    return [];
 }
 /**
  * Re-derive the shell credential bridge after a credential changed, so a
@@ -1419,6 +1412,56 @@ export async function handleCredentialsDelete(deps, body) {
         return storeFailure(error);
     }
 }
+/**
+ * POST /credentials-import — copy what the machine's own credential helpers
+ * already answer for into the managed store, so a machine signed in through
+ * gh/GCM/Keychain stops needing a second sign-in here (decision 0038).
+ *
+ * The candidates are the URL-scoped hosts of the user's gitconfig; a host the
+ * panel already manages is skipped (the panel wins), and a host whose helper
+ * answers nothing is reported per host instead of failing the whole request.
+ * @param deps - host dependencies.
+ * @param body - parsed request body: absent, `{}` or `{ hosts?: string[] }`.
+ */
+export async function handleCredentialsImport(deps, body) {
+    const record = body ?? {};
+    if (typeof record !== 'object' || record === null || Array.isArray(record)) {
+        return fail(400, 'request body must be a JSON object');
+    }
+    const fields = record;
+    for (const key of Object.keys(fields)) {
+        if (key !== 'hosts')
+            return fail(400, `unknown body key "${key}"`);
+    }
+    const rawHosts = fields.hosts;
+    let hosts;
+    if (rawHosts !== undefined) {
+        if (!Array.isArray(rawHosts) || rawHosts.some(value => typeof value !== 'string')) {
+            return fail(400, '"hosts" must be an array of remote hosts');
+        }
+        hosts = rawHosts.map(value => value.trim()).filter(value => value !== '');
+        if (hosts.length === 0)
+            return fail(400, '"hosts" must not be empty');
+    }
+    try {
+        const store = credentialStore(deps);
+        const importNow = deps.importLocalCredentials ?? ((target, wanted) => runLocalImport(target, {}, wanted));
+        const report = await importNow(store, hosts);
+        if (report.imported.length > 0)
+            await refreshBridge(deps);
+        const entries = await store.load();
+        const result = {
+            credentials: sortCredentials(entries).map(credentialView),
+            imported: report.imported,
+            skipped: report.skipped,
+            failed: report.failed,
+        };
+        return { status: 200, body: result };
+    }
+    catch (error) {
+        return storeFailure(error);
+    }
+}
 /** The HTTP seam: the wired fake in tests, global fetch in production. */
 function fetchFor(deps) {
     return deps.fetchImpl ?? globalThis.fetch;