dsh-git-branch-manage 1.1.0 → 1.3.0

package/lib/normalize.d.ts

@@ -75,8 +75,8 @@ export type AccelerateUrlIssue = 'empty' | 'invalid';
 export declare function accelerateUrlError(value: string): AccelerateUrlIssue | undefined;
 /**
  * Normalize an accepted accelerate URL: trim, and append the trailing `/`
- * the prefix concatenation requires (`https://gh-proxy.com/` + `o/r.git`
- * must stay one valid URL). Callers pass the result to `url.<base>.insteadOf`.
+ * the prefix concatenation requires (`https://gh-proxy.com/` + the complete
+ * `https://github.com/o/r.git` URL). accelArgs builds the Git rewrite base.
  * @param value - an accepted (non-empty, http(s), whitespace-free) URL.
  * @returns the prefix ending in `/`.
  */
@@ -105,3 +105,15 @@ export type RemoteUrlIssue = 'empty' | 'whitespace' | 'invalid';
  * @returns the issue kind, or undefined when acceptable.
  */
 export declare function remoteUrlIssue(url: string): RemoteUrlIssue | undefined;
+/** Schemes git's libcurl accepts for an HTTP(S) remote. */
+export declare const PROXY_SCHEMES: readonly string[];
+/**
+ * Why this proxy value cannot be used, or undefined when it can.
+ *
+ * Credentials are rejected on purpose: the value is stored in the plugin
+ * config and passed as one `-c` argument, so `user:pass@` would be readable
+ * in the settings UI and in any diagnostics (0043).
+ * @param value - candidate proxy URL.
+ * @returns the user-facing reason, or undefined.
+ */
+export declare function proxyUrlError(value: string): string | undefined;

package/lib/normalize.js

@@ -117,8 +117,8 @@ export function accelerateUrlError(value) {
 }
 /**
  * Normalize an accepted accelerate URL: trim, and append the trailing `/`
- * the prefix concatenation requires (`https://gh-proxy.com/` + `o/r.git`
- * must stay one valid URL). Callers pass the result to `url.<base>.insteadOf`.
+ * the prefix concatenation requires (`https://gh-proxy.com/` + the complete
+ * `https://github.com/o/r.git` URL). accelArgs builds the Git rewrite base.
  * @param value - an accepted (non-empty, http(s), whitespace-free) URL.
  * @returns the prefix ending in `/`.
  */
@@ -173,3 +173,39 @@ export function remoteUrlIssue(url) {
         return undefined;
     return 'invalid';
 }
+/** Schemes git's libcurl accepts for an HTTP(S) remote. */
+export const PROXY_SCHEMES = ['http', 'https', 'socks5', 'socks5h'];
+/**
+ * Why this proxy value cannot be used, or undefined when it can.
+ *
+ * Credentials are rejected on purpose: the value is stored in the plugin
+ * config and passed as one `-c` argument, so `user:pass@` would be readable
+ * in the settings UI and in any diagnostics (0043).
+ * @param value - candidate proxy URL.
+ * @returns the user-facing reason, or undefined.
+ */
+export function proxyUrlError(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return 'must be an absolute proxy URL such as http://127.0.0.1:7890';
+    }
+    if (!PROXY_SCHEMES.includes(url.protocol.replace(':', ''))) {
+        return `scheme must be one of ${PROXY_SCHEMES.join(', ')}`;
+    }
+    if (url.hostname === '')
+        return 'must name a proxy host';
+    if (url.port === '')
+        return 'must name a proxy port';
+    const port = Number(url.port);
+    if (!Number.isInteger(port) || port < 1 || port > 65_535)
+        return 'proxy port must be 1-65535';
+    if (url.username !== '' || url.password !== '')
+        return 'credentials in the proxy URL are not supported';
+    if ((url.pathname !== '' && url.pathname !== '/') || url.search !== '' || url.hash !== '') {
+        return 'must not carry a path, query, or fragment';
+    }
+    return undefined;
+}

package/lib/routes.d.ts

@@ -5,13 +5,22 @@
 import { type CopyFilesSeams } from './copy-files.js';
 import { type CredentialStore } from './credentials.js';
 import type { CredentialService } from './credential-service.js';
-import { type DirExists, type ExcludeSeams, type Exec } from './git.js';
-import type { AiCommitMessageResult, ChangesResult, CommitFilesResult, CommitResult, CreateBranchResult, CreateTagResult, CreateWorktreeResult, CredentialOAuthPollResult, CredentialOAuthStartResult, CredentialsResult, EnsureDirectoryResult, FetchResult, GroupWorkspacesResult, InspectWorktreeResult, LogResult, PathExistsResult, PurgeDirectoryResult, PushTagResult, RemoveWorktreeResult, RemotesResult, RepoStatus, RouteError, StageResult, SwitchResult, UpdateResult, WorktreesAllResult } from './wire.js';
+import { type LocalImportReport } from './local-import.js';
+import { type ChannelProvider, type DirExists, type ExcludeSeams, type Exec } from './git.js';
+import type { NetworkProbeResult, AiCommitMessageResult, ChangesResult, CommitFilesResult, CommitResult, CreateBranchResult, CreateTagResult, CreateWorktreeResult, CredentialOAuthPollResult, CredentialOAuthStartResult, CredentialImportResult, CredentialsResult, EnsureDirectoryResult, FetchResult, GroupWorkspacesResult, InspectWorktreeResult, LogResult, PathExistsResult, PurgeDirectoryResult, PushTagResult, RemoveWorktreeResult, RemotesResult, RepoStatus, RouteError, StageResult, SwitchResult, UpdateResult, WorktreesAllResult } from './wire.js';
 /** Everything the handlers need from the host half. */
 export interface RouteDeps {
     exec: Exec;
+    /** Fallback channels for a network command, in priority order: the
+     * explicit proxy first, then the IP-optimized channel (absent = direct only; tests leave
+     * it out so no real lookup, race, or proxy argv ever runs). */
+    networkChannels?: (exec: Exec, cwd: string, authArgs: readonly string[]) => readonly ChannelProvider[];
     /** The settings-resolved rootDir (absent/blank = the default location). */
     sectionRootDir: () => string | undefined;
+    /** Explicit proxy URL for the proxy channel; absent/blank = none. */
+    sectionNetworkProxy?: () => string | undefined;
+    /** The proxy Windows itself has enabled (read-only WinINET probe); absent = not looked up. */
+    sectionSystemProxy?: () => Promise<string | undefined>;
     /** Whether a worktree creation syncs the remotes first (absent = off). */
     sectionFetchBeforeCreate: () => boolean | undefined;
     /** Post-create configuration files to copy when .worktreeinclude is absent. */
@@ -51,6 +60,10 @@ export interface RouteDeps {
     /** Re-derive the shell credential bridge after the store changed (absent =
      * a host that does not provide the bridge; tests omit it). */
     refreshShellBridge?: () => Promise<void>;
+    /** Machine-credential import seam (decision 0038): probes the helpers the
+     * user's own gitconfig points git at, for the hosts it names. Tests
+     * substitute; absent = the real `git credential fill` probe. */
+    importLocalCredentials?: (store: CredentialStore, hosts?: readonly string[]) => Promise<LocalImportReport>;
 }
 /** Real fs-backed one-level directory listing (names only). Plain FILES are
  * filtered out — the storage root can carry strays (a legacy settings.json
@@ -63,7 +76,7 @@ export declare function fsMkdirRecursive(path: string): Promise<void>;
 /** One route outcome: HTTP status plus the JSON body. */
 export interface RouteOutcome {
     status: number;
-    body: RepoStatus | CreateWorktreeResult | SwitchResult | CreateBranchResult | FetchResult | UpdateResult | GroupWorkspacesResult | InspectWorktreeResult | RemoveWorktreeResult | PathExistsResult | EnsureDirectoryResult | WorktreesAllResult | PurgeDirectoryResult | ChangesResult | StageResult | CommitResult | LogResult | CommitFilesResult | CreateTagResult | PushTagResult | AiCommitMessageResult | CredentialsResult | CredentialOAuthStartResult | CredentialOAuthPollResult | RemotesResult | RouteError;
+    body: RepoStatus | CreateWorktreeResult | SwitchResult | CreateBranchResult | FetchResult | UpdateResult | GroupWorkspacesResult | InspectWorktreeResult | RemoveWorktreeResult | PathExistsResult | EnsureDirectoryResult | WorktreesAllResult | PurgeDirectoryResult | ChangesResult | StageResult | CommitResult | LogResult | CommitFilesResult | CreateTagResult | PushTagResult | AiCommitMessageResult | CredentialsResult | CredentialOAuthStartResult | CredentialOAuthPollResult | CredentialImportResult | RemotesResult | NetworkProbeResult | RouteError;
 }
 /**
  * POST /group — git belonging facts for a batch of workspace directories.
@@ -387,6 +400,18 @@ export declare function handleCredentialsSave(deps: RouteDeps, body: unknown): P
  * @param body - parsed request body: `{ host }`.
  */
 export declare function handleCredentialsDelete(deps: RouteDeps, body: unknown): Promise<RouteOutcome>;
+/**
+ * POST /credentials-import — copy what the machine's own credential helpers
+ * already answer for into the managed store, so a machine signed in through
+ * gh/GCM/Keychain stops needing a second sign-in here (decision 0038).
+ *
+ * The candidates are the URL-scoped hosts of the user's gitconfig; a host the
+ * panel already manages is skipped (the panel wins), and a host whose helper
+ * answers nothing is reported per host instead of failing the whole request.
+ * @param deps - host dependencies.
+ * @param body - parsed request body: absent, `{}` or `{ hosts?: string[] }`.
+ */
+export declare function handleCredentialsImport(deps: RouteDeps, body: unknown): Promise<RouteOutcome>;
 /**
  * POST /credentials-oauth-start — start a browser sign-in for ONE host
  * (GitHub device flow). The answer carries a one-time user code and the
@@ -423,3 +448,16 @@ export declare function handleRemotes(deps: RouteDeps, body: unknown): Promise<R
  * @param body - parsed request body: `{ repoPath, action, name, url? }`.
  */
 export declare function handleRemote(deps: RouteDeps, body: unknown): Promise<RouteOutcome>;
+/**
+ * Report which network channel can read the repository's endpoint right now.
+ *
+ * Diagnostics only: nothing here writes to git or to the config. Each
+ * channel gets its own budget (PROBE_TIMEOUT_MS), so a dead proxy costs one
+ * timeout and the answer still names the channels that work. The system
+ * proxy is reported when the plugin has none of its own — git ignores
+ * WinINET, so a value here is a suggestion the user must opt into (0043).
+ * @param deps - route dependencies (exec, channel providers, config readers).
+ * @param body - `{ repoPath }`.
+ * @returns one report per channel, in the order the write path would try them.
+ */
+export declare function handleNetworkProbe(deps: RouteDeps, body: unknown): Promise<RouteOutcome>;

package/lib/routes.js

@@ -5,8 +5,11 @@
 import { basename, dirname, join, resolve } from 'node:path';
 import { mkdir, readdir, rm, stat } from 'node:fs/promises';
 import { runPostCreateCopy } from './copy-files.js';
-import { authConfigArgs, credentialFilePath, createCredentialStore, credentialHostIssue, credentialSecretIssue, credentialUsernameIssue, maskSecret, normalizeCredentialHost, removeCredential, sortCredentials, upsertCredential } from './credentials.js';
-import { appendWorktreeExclude, fsExcludeSeams, GitError, addRemote, addWorktree, addWorktreeCutout, collectAiDiff, commitFiles, commitIndex, createBranch, createTag, cutoutBranchName, deleteBranch, fetchAll, fsDirExists, inspectWorktree, isAbsoluteDir, isStageablePath, listRemotes, listTagNames, logHistory, probeRepo, probeWorkspaceGit, pushTag, removeRemote, removeWorktree, renameBranch, resolveBranch, resolvePushRemote, pushBranch, setRemoteUrl, stagePaths, switchBranch, updateBranch, workingChanges } from './git.js';
+import { credentialHostIssue, credentialSecretIssue, credentialUsernameIssue, createLocalCredentialStore, maskSecret, normalizeCredentialHost, removeCredential, sortCredentials, upsertCredential } from './credentials.js';
+import { importLocalCredentials as runLocalImport } from './local-import.js';
+import { appendWorktreeExclude, fsExcludeSeams, GitError, addRemote, addWorktree, addWorktreeCutout, collectAiDiff, commitFiles, commitIndex, createBranch, createTag, cutoutBranchName, deleteBranch, fetchAll, fsDirExists, inspectWorktree, isAbsoluteDir, isStageablePath, listRemotes, listTagNames, logHistory, probeRepo, probeWorkspaceGit, pushTag, removeRemote, removeWorktree, renameBranch, resolveBranch, resolvePushRemote, resolvePushTarget, pushBranch, setRemoteUrl, stagePaths, switchBranch, updateBranch, workingChanges } from './git.js';
+import { classifyGitFailure, withHint } from './network.js';
+import { channelReport } from './network-probe.js';
 import { ACCEL_DEFAULT_URL, accelerateUrlError, isAbsoluteConfigPath, normalizeAccelerateUrl, remoteNameIssue, remoteUrlIssue, sanitizeBranchDir } from './normalize.js';
 import { deviceFlowClientId, isDeviceFlowHost, pollDeviceFlow, startDeviceFlow } from './oauth.js';
 import { resolveRootDir } from './settings.js';
@@ -53,28 +56,25 @@ function accelPrefix(deps) {
     const url = deps.sectionCnAccelerateUrl?.() ?? ACCEL_DEFAULT_URL;
     return accelerateUrlError(url) === undefined ? normalizeAccelerateUrl(url) : undefined;
 }
-/** The global credential store: the service's shared instance (decision 0034),
- * else the wired store, else the fs-backed file at the resolved dsh home
- * (`<dshHome>/git-credentials.json`). */
+/** The fallback chain for one command: the host's providers, or none at all. */
+function networkOptions(deps, cwd, authArgs) {
+    const channels = deps.networkChannels?.(deps.exec, cwd, authArgs) ?? [];
+    return channels.length === 0 ? {} : { fallbackChannels: channels };
+}
+/** The global credential store: the service's shared instance (decision 0037),
+ * else the wired store, else the local `~/.git-credentials`-backed store. */
 function credentialStore(deps) {
-    return deps.credentialsService?.store ?? deps.credentialsStore ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
+    return deps.credentialsService?.store ?? deps.credentialsStore ?? createLocalCredentialStore(deps.home(), deps.envHome());
 }
 /**
- * `-c http.<url>.extraHeader` pairs for every stored credential, ready to
- * prepend to a git network command. A broken credential FILE must never break
- * git itself: an unreadable store degrades to "no credentials" (the network
- * command then runs unauthenticated, as it always did) — the credentials
- * route is where the file problem surfaces.
+ * Credential argv for one network command. Empty by design since 0037: the
+ * token reaches git through the URL-scoped `helper = store` include that
+ * `~/.gitconfig` carries, so there is nothing to inject. The seam stays so
+ * every call site keeps one place to change if a command ever needs an
+ * explicit override again.
  */
-async function authArgsFor(deps) {
-    if (deps.credentialsService !== undefined)
-        return deps.credentialsService.authConfigArgs();
-    try {
-        return authConfigArgs(await credentialStore(deps).load());
-    }
-    catch {
-        return [];
-    }
+async function authArgsFor(_deps) {
+    return [];
 }
 /**
  * Re-derive the shell credential bridge after a credential changed, so a
@@ -320,6 +320,10 @@ export async function handlePurgeDirectory(deps, body) {
 }
 /** GitError to outcome: usage-shaped failures are 400, the rest 500. */
 function gitFailure(error) {
+    // Every git failure the routes surface passes through one classifier so
+    // the toast explains WHAT broke (host, credentials, divergence) instead of
+    // repeating git's raw text alone.
+    const failure = classifyGitFailure(error.stderr, { timedOut: error.timedOut });
     const usage = error.stderr.includes('usage:')
         || error.stderr.includes('fatal: invalid')
         // A user-typed branch name git refuses (`'bad..name' is not a valid
@@ -354,7 +358,7 @@ function gitFailure(error) {
         // (a stale sidebar row racing a terminal-side removal).
         || error.stderr.includes('cannot remove the main worktree')
         || error.stderr.includes('is not a registered worktree');
-    return fail(usage ? 400 : 500, error.message);
+    return fail(usage ? 400 : 500, withHint(error.message, failure));
 }
 /**
  * GET /status 鈥?repository facts for one directory.
@@ -469,7 +473,10 @@ export async function handleCreateWorktree(deps, body) {
             const resolved = await resolveBranch(deps.exec, facts.repoRoot, branch);
             if (resolved?.remote !== undefined) {
                 try {
-                    await fetchAll(deps.exec, facts.repoRoot, accelPrefix(deps), await authArgsFor(deps));
+                    {
+                        const authArgs = await authArgsFor(deps);
+                        await fetchAll(deps.exec, facts.repoRoot, accelPrefix(deps), authArgs, networkOptions(deps, facts.repoRoot, authArgs));
+                    }
                 }
                 catch (error) {
                     fetchWarning = error instanceof GitError ? error.stderr.trim() : error instanceof Error ? error.message : String(error);
@@ -704,7 +711,10 @@ export async function handleFetch(deps, body) {
         const facts = await probeRepo(deps.exec, repoPath, deps.dirExists);
         if (facts === undefined)
             return fail(400, `"${repoPath}" is not inside a git repository`);
-        await fetchAll(deps.exec, facts.repoRoot, accelPrefix(deps), await authArgsFor(deps));
+        {
+            const authArgs = await authArgsFor(deps);
+            await fetchAll(deps.exec, facts.repoRoot, accelPrefix(deps), authArgs, networkOptions(deps, facts.repoRoot, authArgs));
+        }
         const result = { remote: 'all' };
         return { status: 200, body: result };
     }
@@ -767,8 +777,9 @@ export async function handlePush(deps, body) {
             return fail(400, `"${repoPath}" is not inside a git repository`);
         // The session's OWN worktree, not the main checkout: in a linked-worktree
         // session "push current branch" means the branch that worktree holds.
-        const outcome = await pushBranch(deps.exec, facts.toplevel, await authArgsFor(deps));
-        const result = { branch: outcome.branch, pushed: outcome.pushed };
+        const authArgs = await authArgsFor(deps);
+        const outcome = await pushBranch(deps.exec, facts.toplevel, authArgs, networkOptions(deps, facts.toplevel, authArgs));
+        const result = { branch: outcome.branch, pushed: outcome.pushed, ...(outcome.note === undefined ? {} : { note: outcome.note }) };
         return { status: 200, body: result };
     }
     catch (error) {
@@ -1199,8 +1210,9 @@ export async function handlePushTag(deps, body) {
         const choice = await resolvePushRemote(deps.exec, facts.toplevel);
         if (!choice.ok)
             return fail(400, choice.message);
-        const result = await pushTag(deps.exec, facts.toplevel, name, choice.remote, await authArgsFor(deps));
-        const body = result;
+        const authArgs = await authArgsFor(deps);
+        const result = await pushTag(deps.exec, facts.toplevel, name, choice.remote, authArgs, networkOptions(deps, facts.toplevel, authArgs));
+        const body = { ...result, ...(result.note === undefined ? {} : { note: result.note }) };
         return { status: 200, body };
     }
     catch (error) {
@@ -1419,6 +1431,56 @@ export async function handleCredentialsDelete(deps, body) {
         return storeFailure(error);
     }
 }
+/**
+ * POST /credentials-import — copy what the machine's own credential helpers
+ * already answer for into the managed store, so a machine signed in through
+ * gh/GCM/Keychain stops needing a second sign-in here (decision 0038).
+ *
+ * The candidates are the URL-scoped hosts of the user's gitconfig; a host the
+ * panel already manages is skipped (the panel wins), and a host whose helper
+ * answers nothing is reported per host instead of failing the whole request.
+ * @param deps - host dependencies.
+ * @param body - parsed request body: absent, `{}` or `{ hosts?: string[] }`.
+ */
+export async function handleCredentialsImport(deps, body) {
+    const record = body ?? {};
+    if (typeof record !== 'object' || record === null || Array.isArray(record)) {
+        return fail(400, 'request body must be a JSON object');
+    }
+    const fields = record;
+    for (const key of Object.keys(fields)) {
+        if (key !== 'hosts')
+            return fail(400, `unknown body key "${key}"`);
+    }
+    const rawHosts = fields.hosts;
+    let hosts;
+    if (rawHosts !== undefined) {
+        if (!Array.isArray(rawHosts) || rawHosts.some(value => typeof value !== 'string')) {
+            return fail(400, '"hosts" must be an array of remote hosts');
+        }
+        hosts = rawHosts.map(value => value.trim()).filter(value => value !== '');
+        if (hosts.length === 0)
+            return fail(400, '"hosts" must not be empty');
+    }
+    try {
+        const store = credentialStore(deps);
+        const importNow = deps.importLocalCredentials ?? ((target, wanted) => runLocalImport(target, {}, wanted));
+        const report = await importNow(store, hosts);
+        if (report.imported.length > 0)
+            await refreshBridge(deps);
+        const entries = await store.load();
+        const result = {
+            credentials: sortCredentials(entries).map(credentialView),
+            imported: report.imported,
+            skipped: report.skipped,
+            failed: report.failed,
+        };
+        return { status: 200, body: result };
+    }
+    catch (error) {
+        return storeFailure(error);
+    }
+}
 /** The HTTP seam: the wired fake in tests, global fetch in production. */
 function fetchFor(deps) {
     return deps.fetchImpl ?? globalThis.fetch;
@@ -1628,3 +1690,73 @@ export async function handleRemote(deps, body) {
         return fail(500, error instanceof Error ? error.message : String(error));
     }
 }
+/**
+ * Report which network channel can read the repository's endpoint right now.
+ *
+ * Diagnostics only: nothing here writes to git or to the config. Each
+ * channel gets its own budget (PROBE_TIMEOUT_MS), so a dead proxy costs one
+ * timeout and the answer still names the channels that work. The system
+ * proxy is reported when the plugin has none of its own — git ignores
+ * WinINET, so a value here is a suggestion the user must opt into (0043).
+ * @param deps - route dependencies (exec, channel providers, config readers).
+ * @param body - `{ repoPath }`.
+ * @returns one report per channel, in the order the write path would try them.
+ */
+export async function handleNetworkProbe(deps, body) {
+    const parsed = readBody(body, ['repoPath']);
+    if (isOutcome(parsed))
+        return parsed;
+    const { repoPath } = parsed;
+    if (!isAbsoluteDir(repoPath))
+        return fail(400, '"repoPath" must be an absolute directory');
+    try {
+        const facts = await probeRepo(deps.exec, repoPath, deps.dirExists);
+        if (facts === undefined)
+            return fail(400, JSON.stringify(repoPath) + " is not inside a git repository");
+        const authArgs = await authArgsFor(deps);
+        const url = await probeEndpoint(deps.exec, facts.repoRoot, authArgs);
+        if (url === undefined)
+            return fail(400, '"repoPath" has no remote to probe');
+        const channels = [await channelReport(deps.exec, facts.repoRoot, 'direct', url, [], authArgs)];
+        for (const provider of deps.networkChannels?.(deps.exec, facts.repoRoot, authArgs) ?? []) {
+            const argv = await provider(url);
+            if (argv === undefined || argv.length === 0)
+                continue;
+            const channel = argv.some(item => item.startsWith('http.proxy=')) ? 'proxy' : 'ip';
+            if (channels.some(report => report.channel === channel))
+                continue;
+            channels.push(await channelReport(deps.exec, facts.repoRoot, channel, url, argv, authArgs));
+        }
+        const systemProxy = await deps.sectionSystemProxy?.();
+        const result = {
+            url,
+            channels,
+            ...(systemProxy === undefined || systemProxy === '' ? {} : { systemProxy }),
+        };
+        return { status: 200, body: result };
+    }
+    catch (error) {
+        if (error instanceof GitError)
+            return gitFailure(error);
+        throw error;
+    }
+}
+/**
+ * The endpoint a probe should read: the upstream's push URL when the branch
+ * tracks one, otherwise the push URL of `origin` (or the first remote).
+ * @param exec - executor seam.
+ * @param cwd - any directory inside the repository.
+ * @param authArgs - credential argv for the host.
+ * @returns the URL, or undefined when the repository has no remote at all.
+ */
+async function probeEndpoint(exec, cwd, authArgs) {
+    const target = await resolvePushTarget(exec, cwd, authArgs);
+    if (target?.url !== undefined && target.url !== '')
+        return target.url;
+    const remotes = await listRemotes(exec, cwd);
+    const chosen = remotes.find(remote => remote.name === 'origin') ?? remotes[0];
+    if (chosen === undefined)
+        return undefined;
+    const url = chosen.pushUrl !== '' ? chosen.pushUrl : chosen.fetchUrl;
+    return url === '' ? undefined : url;
+}

package/lib/shell-bridge.d.ts

@@ -1,143 +1,85 @@
 /**
- * Shell credential bridge (host half) — session gitconfig channel. The
- * credential panel stores one token per remote host, but 0029 could only
- * inject it into the panel's own routes and the `git_network` tool; a plain
- * `git push` run in a shell authenticated as whatever the machine's
- * credential helper held — often a different account — or hung on an
- * interactive prompt nobody could answer.
+ * Shell credential setup (host half) — decision 0037.
  *
- * 0032 closed that gap with `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_n`/
- * `GIT_CONFIG_VALUE_n` environment entries. That channel is dead on a DSH
- * host: the subprocess environment scrubber
- * (`@deepseek-ai/dsh-subprocess`, `SENSITIVE_ENV_PATTERN = /KEY|PASSWORD|SECRET|TOKEN/i`
- * plus every `DSH_*` name) strips the `GIT_CONFIG_KEY_*` names and keeps
- * `GIT_CONFIG_COUNT`/`VALUE_*`, so git starts with a half-parsed config and
- * dies with `fatal: unable to parse command-line config` — every git command
- * in the shell, not only the networked ones (0034).
+ * Before 0037 the panel's token only reached commands the plugin itself ran;
+ * a plain `git push` in a shell authenticated as whatever the machine's
+ * helper held (often a different account) or hung on a prompt nobody could
+ * answer. 0032/0034 tried to bridge that through the process environment
+ * (`GIT_CONFIG_COUNT`, then a generated `GIT_CONFIG_GLOBAL` session file) —
+ * both channels existed only in the host process's own environment, so a
+ * shell that received a different environment snapshot saw nothing.
  *
- * The replacement writes ONE generated gitconfig per host process and points
- * git at it with `GIT_CONFIG_GLOBAL` — a name the scrubber keeps. The file:
+ * 0037 stops fighting the environment and uses git's own mechanisms:
  *
- *  1. `[include]`s the user's own `~/.gitconfig` (read-only; 0021's "never
- *     write the user's git config files" stands) so identity, proxies and
- *     `http.sslBackend` keep working;
- *  2. resets the whole `credential.helper` list to empty, cutting the machine
- *     chain (`helper-selector` → GCM) and any helper the included user config
- *     carries (the local `gh` helper being the motivating case);
- *  3. per stored host, resets that URL scope and then installs the bundled
- *     helper (`helpers/git-credential-bridge.js`) as a `!`-shell command.
+ *  1. `<dsh-home>/git-credentials.include.gitconfig` is generated with one
+ *     URL-scoped section per managed host;
+ *  2. `~/.gitconfig` gains exactly one `[include] path = <that file>` line
+ *     (idempotent; see `ensureGitconfigInclude` in `credentials.ts`);
+ *  3. every git process — the plugin's own routes, `git_network`, and a
+ *     plain shell — reads that include and therefore resolves the host
+ *     through `credential-store`, i.e. `~/.git-credentials`.
  *
- * A host with no stored credential then fails at once ("terminal prompts
- * disabled") instead of reaching the machine chain, whose interactive GUI
- * dialog nobody in an agent shell can answer. `GIT_TERMINAL_PROMPT=0` and
- * `GCM_INTERACTIVE=never` ride along as the last line of defence.
+ * Nothing rides the process environment any more, which is why the module is
+ * now only a gitconfig-install + fail-fast switch manager. `GIT_TERMINAL_PROMPT=0`
+ * and `GCM_INTERACTIVE=never` stay: a host without a stored credential should
+ * fail at once instead of parking an agent shell on a GUI dialog.
  *
- * Environment contract (all names survive the scrubber — no KEY/PASSWORD/
- * SECRET/TOKEN substring, no `DSH_` prefix):
- *  - `GIT_CONFIG_GLOBAL` — the generated session config (0034).
- *  - `DGB_BRIDGE_HELPER` — credential file path for the helper script.
- *  - `GIT_TERMINAL_PROMPT` / `GCM_INTERACTIVE` — fail fast, never prompt.
- *
- * The file is re-derived whenever the credential store changes
- * (`src/routes.ts` calls the bridge after every save / delete / sign-in).
+ * `apply`/`dispose` still delete the retired 0032 channel's leftovers
+ * (`GIT_CONFIG_COUNT` with a broken `GIT_CONFIG_KEY_n` / `GIT_CONFIG_VALUE_n`
+ * set). The DSH subprocess scrubber strips the KEY names while the count and
+ * values survive, so a half-injected channel — left behind by an upgrade from
+ * 1.0.10 — makes git abort every command; see `legacyConfigNames` (0036).
  */
 import { type CredentialStore } from './credentials.js';
-/** Env var carrying the credential file path to the helper script. */
-export declare const BRIDGE_HELPER_ENV = "DGB_BRIDGE_HELPER";
-/** Env var carrying a debug log path to the helper script (unset by default). */
-export declare const BRIDGE_DEBUG_ENV = "DGB_BRIDGE_DEBUG";
-/** Env var pointing git at the generated session configuration file. */
-export declare const SESSION_GITCONFIG_ENV = "GIT_CONFIG_GLOBAL";
-/** Host-side seams the bridge reads through (tests substitute all of them). */
+/** Host-side seams the setup reads through (tests substitute all of them). */
 export interface ShellBridgeDeps {
     /** User home directory seam. */
     readonly home: () => string;
     /** `$DSH_HOME` seam (blank/undefined = unset). */
     readonly envHome: () => string | undefined;
-    /** Store seam; the fs-backed store at the resolved path when absent. */
+    /** Store seam; the fs-backed local store when absent. */
     readonly store?: CredentialStore;
     /** The environment object to mutate; `process.env` when absent. */
     readonly env?: Record<string, string | undefined>;
-    /** Absolute helper script path; the compiled sibling under `helpers/` when
-     * absent. */
-    readonly helperPath?: string;
-    /** Node executable that runs the helper; `process.execPath` when absent. */
-    readonly nodePath?: string;
-    /** Directory for the session config; the OS temp dir when absent. */
-    readonly configDir?: () => string;
-    /** Exact session config path (tests); `<configDir>/dsh-git-branch-<pid>.gitconfig` when absent. */
-    readonly configPath?: string;
-    /** User global config the session file includes; `<home>/.gitconfig` when absent. */
+    /** User global config the generated file is included from; `<home>/.gitconfig` when absent. */
     readonly userGitconfig?: string;
 }
-/** The bridge's operations: re-derive the environment, and undo it. */
+/** The setup's operations: re-derive the include, and undo it. */
 export interface ShellBridge {
-    /** Read the credential store and rewrite the injected environment.
-     * A store that cannot be read drops every URL-scoped helper (no host can be
-     * bridged), but keeps the global reset, so shell git still fails fast
-     * instead of opening an interactive credential dialog. */
+    /** The generated include file (diagnostics/tests). */
+    readonly configPath: () => string;
+    /** Read the credential store and rewrite the include + `~/.gitconfig`.
+     * A store that cannot be read writes an empty include (no host is
+     * scoped), while the fail-fast switches still go out. */
     readonly apply: () => Promise<void>;
-    /** Remove the injected environment and delete the session config file. */
+    /** Remove the fail-fast switches, the include line and the generated file. */
     readonly dispose: () => Promise<void>;
-    /** The session config path this bridge writes. */
-    readonly configPath: () => string;
 }
-/** One ordered environment assignment. */
-export type BridgeAssignment = readonly [key: string, value: string];
-/**
- * Quote one executable or path for git's `!` shell command. Backslashes are
- * normalized to forward slashes first: git runs `!` helpers through `sh`,
- * where `C:\\…` would be read as escape sequences.
- * @param value - an absolute path.
- */
-export declare function shellQuote(value: string): string;
-/**
- * The helper command git runs for one configured host: a `!`-prefixed shell
- * command, because git does not word-split a helper value by itself (a bare
- * `node "C:/…/bridge.js"` is looked up as the program `git-credential-node`).
- * @param nodePath - the node executable.
- * @param helperPath - the compiled helper script.
- */
-export declare function bridgeCommand(nodePath: string, helperPath: string): string;
+/** The retired 0032 channel's count variable. */
+export declare const LEGACY_COUNT_ENV = "GIT_CONFIG_COUNT";
 /**
- * Escape one value for a gitconfig line: a literal `"` becomes `\"`, which is
- * how a quoted path survives git's config parser and still reaches `sh`
- * intact. Without this the quotes are eaten and `sh` splits
- * `C:/Program Files/…` on the space.
- * @param value - the raw helper command.
- */
-export declare function gitconfigEscape(value: string): string;
-/**
- * The session gitconfig body for the given hosts: the user's own config
- * included (read-only), the whole machine helper list reset to empty, and per
- * host a URL-scoped reset followed by the bridge command. The empty value
- * before each command is what cuts the included `gh` helper (and any other
- * helper the user configures for that URL) out of that scope.
- * @param hosts - normalized hosts with a stored credential.
- * @param options - the node/helper pair and the user config to include.
- */
-export declare function sessionGitconfigBody(hosts: readonly string[], options: {
-    readonly nodePath: string;
-    readonly helperPath: string;
-    readonly userGitconfig?: string;
-}): string;
-/**
- * The environment assignments pointing git at the session config: the config
- * path itself, the credential file the helper reads, and the two fail-fast
- * switches. `hosts` live in the file now, not in the environment.
- * @param options - the session config path and the credential file.
+ * Environment names left over from the retired 0032 channel that would make
+ * git abort with `fatal: unable to parse command-line config`.
+ *
+ * The DSH subprocess scrubber deletes every `GIT_CONFIG_KEY_<n>` (the name
+ * contains `KEY`) while `GIT_CONFIG_COUNT` / `GIT_CONFIG_VALUE_<n>` survive, so
+ * the channel is injected half-way and git can no longer parse it. Those
+ * leftovers outlive the code that wrote them: upgrading the plugin from 1.0.10
+ * leaves them in the host process environment, where they break every `git`
+ * command in every derived shell until someone deletes them by hand.
+ *
+ * A count whose pairs are all present is valid git input (a caller may set the
+ * channel deliberately), so it is left untouched; only a broken channel — or a
+ * non-numeric count — is reported for removal.
+ * @param env - the environment to inspect.
  */
-export declare function shellBridgeEnv(options: {
-    readonly configPath: string;
-    readonly credentialFile: string;
-}): readonly BridgeAssignment[];
+export declare function legacyConfigNames(env: Record<string, string | undefined>): string[];
 /**
- * Build the bridge over one host process. Every {@link ShellBridge.apply}
- * rewrites the session config for the current store and re-points the
- * environment at it, so a deleted host loses its helper scope just like a
- * freshly added one gains it. A config file that cannot be written leaves
- * `GIT_CONFIG_GLOBAL` untouched (git then runs with the machine config —
- * unauthenticated at worst) while the fail-fast switches still go out.
+ * Build the setup over one host process. Every {@link ShellBridge.apply}
+ * rewrites the include for the current store, so a deleted host loses its
+ * helper scope just like a freshly added one gains it. A failing write never
+ * throws: the worst case is a stale include until the next credential save,
+ * and git keeps working with the machine's own configuration.
  * @param deps - host seams.
  */
 export declare function createShellBridge(deps: ShellBridgeDeps): ShellBridge;