gent-cli 8.0.0 → 9.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gent-cli",
-  "version": "8.0.0",
+  "version": "9.1.0",
   "description": "A modern, Git-like version control CLI with cloud sync, AI-powered superpowers (ask/review/docs/changelog), and zero-friction setup (gent setup/doctor/config).",
   "main": "src/index.js",
   "bin": {

package/src/commands/branch.js

@@ -148,6 +148,8 @@ async function syncBranchCreate(name, commitSha, gentPath) {
         // Non-fatal: branch created locally even if remote sync fails
         if (error.response?.status === 400) {
             console.log(chalk.gray(`  ⚠ Remote sync skipped (branch may already exist remotely)`));
+        } else if (error.response?.status === 403) {
+            console.log(chalk.yellow(`  ⚠ Remote sync skipped — no write access to this repository`));
         }
     }
 }
@@ -173,6 +175,8 @@ async function syncBranchDelete(name, gentPath) {
     } catch (error) {
         if (error.response?.status === 400) {
             console.log(chalk.gray(`  ⚠ Cannot delete default branch on remote`));
+        } else if (error.response?.status === 403) {
+            console.log(chalk.yellow(`  ⚠ Remote delete skipped — no write access to this repository`));
         } else if (error.response?.status === 404) {
             // Branch didn't exist remotely, that's fine
         }

package/src/commands/clone.js

@@ -11,15 +11,12 @@
  *   gent clone <url>                   → Clone into folder named after repo
  *   gent clone <url> <directory>       → Clone into specific directory
  *
- * ALGORITHM (client-side, no /clone/ endpoint):
+ * ALGORITHM:
  *   1. Parse URL to get owner_id + repo_name
- *   2. GET repo details → name, description, default_branch
- *   3. GET branches list → all branch names + SHAs
- *   4. GET commits list → all commits
- *   5. For each commit, fetch tree + blobs
- *   6. Create .gent/ directory structure
- *   7. Store all objects locally
- *   8. Checkout HEAD (restore working tree from latest commit)
+ *   2. GET /clone/ → full snapshot (commits, base64 objects, branches, tags)
+ *   3. Create .gent/ structure + store objects locally
+ *   4. Write commits.json / config / HEAD / staging
+ *   5. Checkout the default branch's tree
  *
  * ============================================================================
  */
@@ -32,7 +29,7 @@ const { ensureDir, writeJSON, pathExists } = require('../utils/fileSystem');
 const { GENT_DIR, CONFIG_FILE, STAGING_FILE, COMMITS_FILE, API_ENDPOINTS, buildRepoUrl, parseRemoteUrl } = require('../utils/constants');
 const apiClient = require('../utils/api-client');
 const authStorage = require('../utils/auth-storage');
-const { storeBlob, readBlob, decodeRemoteBlobContent } = require('../utils/hash-engine');
+const { storeBlob, readBlob } = require('../utils/hash-engine');
 
 /**
  * Clone remote repository
@@ -65,14 +62,14 @@ async function clone(url, directory, options) {
             return;
         }
 
-        // 1. Get repo details
-        spinner.text = 'Fetching repository info...';
-        const repoDetail = await apiClient.get(
-            buildRepoUrl(API_ENDPOINTS.REPO_DETAIL, repoInfo)
+        // Fetch the full repository snapshot in one call.
+        spinner.text = 'Fetching repository...';
+        const payload = await apiClient.get(
+            buildRepoUrl(API_ENDPOINTS.REPO_CLONE, repoInfo)
         );
 
-        const repoName = repoDetail.name || repoInfo.repo_name;
-        const defaultBranch = repoDetail.default_branch || 'main';
+        const repoName = payload.name || repoInfo.repo_name;
+        const defaultBranch = payload.currentBranch || 'main';
         const targetDir = directory || repoName;
         const targetPath = path.resolve(process.cwd(), targetDir);
 
@@ -84,39 +81,6 @@ async function clone(url, directory, options) {
             }
         }
 
-        // 2. Get branches
-        spinner.text = 'Fetching branches...';
-        let remoteBranches = [];
-        try {
-            remoteBranches = await apiClient.get(
-                buildRepoUrl(API_ENDPOINTS.REPO_BRANCHES, repoInfo)
-            );
-        } catch {
-            // No branches yet
-        }
-
-        // 3. Get all commits
-        spinner.text = 'Fetching commits...';
-        let remoteCommits = [];
-        try {
-            remoteCommits = await apiClient.get(
-                buildRepoUrl(API_ENDPOINTS.REPO_COMMITS, repoInfo)
-            );
-        } catch {
-            // No commits yet
-        }
-
-        // 4. Get tags
-        spinner.text = 'Fetching tags...';
-        let remoteTags = [];
-        try {
-            remoteTags = await apiClient.get(
-                buildRepoUrl(API_ENDPOINTS.REPO_TAGS, repoInfo)
-            );
-        } catch {
-            // No tags
-        }
-
         // Create directory structure
         spinner.text = 'Setting up repository...';
         const gentPath = path.join(targetPath, GENT_DIR);
@@ -125,100 +89,33 @@ async function clone(url, directory, options) {
         await ensureDir(path.join(gentPath, 'refs', 'heads'));
         await ensureDir(path.join(gentPath, 'refs', 'tags'));
 
-        // 5. For each commit, fetch tree and blobs
-        const localCommits = [];
+        // Store blob objects (base64) into the local object store.
+        spinner.text = 'Storing objects...';
         let objectCount = 0;
-
-        for (let i = 0; i < remoteCommits.length; i++) {
-            const commit = remoteCommits[i];
-            spinner.text = `Fetching objects (${i + 1}/${remoteCommits.length})...`;
-
-            let treeEntries = [];
-            if (commit.tree_sha) {
-                try {
-                    const tree = await apiClient.get(
-                        buildRepoUrl(API_ENDPOINTS.REPO_TREE_DETAIL, { ...repoInfo, sha: commit.tree_sha })
-                    );
-                    treeEntries = tree.entries || [];
-                } catch {
-                    // Tree not available
-                }
-            }
-
-            // Fetch and store blobs
-            for (const entry of treeEntries) {
-                if (entry.type === 'blob' && entry.sha) {
-                    try {
-                        const blob = await apiClient.get(
-                            buildRepoUrl(API_ENDPOINTS.REPO_BLOB_DETAIL, { ...repoInfo, sha: entry.sha })
-                        );
-                        if (blob.content) {
-                            const buf = decodeRemoteBlobContent(blob.content, entry.sha);
-                            await storeBlob(gentPath, buf);
-                            objectCount++;
-                        }
-                    } catch {
-                        // Blob fetch failed
-                    }
-                }
-            }
-
-            // Convert to local commit format
-            localCommits.push({
-                hash: commit.sha,
-                message: commit.message,
-                author: { name: commit.author_name, email: commit.author_email },
-                timestamp: commit.committed_at,
-                parent: commit.parent_shas && commit.parent_shas[0] || null,
-                mergeParent: commit.parent_shas && commit.parent_shas[1] || null,
-                treeHash: commit.tree_sha,
-                tree: treeEntries.map(e => ({
-                    mode: e.mode || '100644',
-                    name: e.name,
-                    hash: e.sha,
-                    type: e.type || 'blob'
-                })),
-                files: treeEntries.map(e => ({ path: e.name, hash: e.sha })),
-                stats: {}
-            });
+        for (const obj of payload.objects || []) {
+            if (obj.type !== 'blob' || typeof obj.data !== 'string') continue;
+            await storeBlob(gentPath, Buffer.from(obj.data, 'base64'));
+            objectCount++;
         }
 
-        // Build branches map
-        const branches = {};
-        for (const b of remoteBranches) {
-            branches[b.name] = b.commit_sha;
-        }
-        if (!branches[defaultBranch]) {
-            branches[defaultBranch] = null;
-        }
-
-        // Build tags map
-        const tagsMap = {};
-        for (const t of remoteTags) {
-            tagsMap[t.name] = {
-                hash: t.commit_sha,
-                message: t.message || '',
-                annotated: t.annotated || false,
-                tagger: { name: t.tagger_name || '', email: t.tagger_email || '' },
-                timestamp: t.created_at
-            };
-        }
+        const localCommits = payload.commits || [];
+        const branches = payload.branches || {};
+        if (!(defaultBranch in branches)) branches[defaultBranch] = null;
 
         // Write commits.json
-        const repoData = {
+        await writeJSON(path.join(gentPath, COMMITS_FILE), {
             commits: localCommits,
             branches,
             currentBranch: defaultBranch,
-            tags: tagsMap
-        };
-        await writeJSON(path.join(gentPath, COMMITS_FILE), repoData);
+            tags: payload.tags || {}
+        });
 
         // Write config with remote
         const config = {
             user: { name: '', email: '' },
             repository: {
                 name: repoName,
-                description: repoDetail.description || '',
+                description: payload.description || '',
                 created: new Date().toISOString()
             },
             remotes: {
@@ -256,12 +153,15 @@ async function clone(url, directory, options) {
                 spinner.text = 'Checking out files...';
                 let fileCount = 0;
                 for (const entry of tree) {
+                    if (entry.type && entry.type !== 'blob') continue;
+                    const relPath = entry.name || entry.path;
+                    if (!relPath || !entry.hash) continue;
                     try {
                         // Write the raw Buffer — not a UTF-8 string. Decoding a
                         // binary blob (PNG, PDF, etc.) as UTF-8 would replace
                         // non-utf-8 bytes with U+FFFD, silently corrupting it.
                         const buf = await readBlob(gentPath, entry.hash);
-                        const fullPath = path.join(targetPath, entry.name || entry.path);
+                        const fullPath = path.join(targetPath, relPath);
                         await fs.mkdir(path.dirname(fullPath), { recursive: true });
                         await fs.writeFile(fullPath, buf);
                         fileCount++;
@@ -285,6 +185,8 @@ async function clone(url, directory, options) {
             console.error(chalk.red('Repository not found'));
         } else if (error.response?.status === 401) {
             console.error(chalk.red('Authentication failed — run "gent login"'));
+        } else if (error.response?.status === 403) {
+            console.error(chalk.red('Access denied — you do not have permission to clone this repository'));
         } else if (error.response?.data) {
             console.error(chalk.red(JSON.stringify(error.response.data)));
         } else {

package/src/commands/commit.js

@@ -89,6 +89,9 @@ async function commit(options) {
             }
         }
 
+        // ponytail: accounts with no name set fall back to email as identity
+        if (!authorName && authorEmail) authorName = authorEmail;
+
         if (!authorName || !authorEmail) {
             spinner.stop();
             console.error(chalk.red('Author identity unknown'));

package/src/commands/explain.js

@@ -91,9 +91,10 @@ async function explain(ref, options = {}) {
             );
             void stagedTree;
         } else {
-            const targetHash = ref
-                ? (commits.find(c => c.hash === ref || c.hash.startsWith(ref)) || {}).hash
-                : repository.branches[repository.currentBranch];
+            const headHash = repository.branches[repository.currentBranch];
+            const targetHash = (!ref || ref === 'HEAD')
+                ? headHash
+                : (commits.find(c => c.hash === ref || c.hash.startsWith(ref)) || {}).hash;
             const commit = targetHash ? commitMap.get(targetHash) : null;
             if (!commit) {
                 console.log(chalk.yellow(ref ? `Commit '${ref}' not found` : 'No commits yet'));

package/src/commands/log.js

@@ -16,8 +16,7 @@
  *   Reads commits.json, filters by branch HEAD → parent chain, displays
  *   in reverse chronological order.
  *
- * BACKEND EXPECTATIONS:
- *   GET /api/repos/:id/commits/?branch=main&limit=10
+ * BACKEND: none — fully local. Reads commits.json; makes no HTTP request.
  *
  * ============================================================================
  */

package/src/commands/members.js

@@ -0,0 +1,134 @@
+/**
+ * Members Command - Manage repository collaborators (owner-only for add/remove).
+ *
+ * USAGE:
+ *   gent members                     → list owner + members with roles
+ *   gent members add <email>         → add a collaborator (default role: write)
+ *   gent members add <email> --role read
+ *   gent members remove <email>      → remove a collaborator
+ *
+ * BACKEND:
+ *   GET    /api/repos/:owner_id/:repo_name/members/                → [{ user_id, email, role, created_at }]
+ *   POST   /api/repos/:owner_id/:repo_name/members/  { email, role: 'write'|'read' }
+ *   DELETE /api/repos/:owner_id/:repo_name/members/:user_id/
+ */
+
+const chalk = require('chalk');
+const ora = require('ora');
+const path = require('path');
+const { readJSON, getGentPath } = require('../utils/fileSystem');
+const { CONFIG_FILE, API_ENDPOINTS, buildRepoUrl, parseRemoteUrl } = require('../utils/constants');
+const apiClient = require('../utils/api-client');
+const authStorage = require('../utils/auth-storage');
+
+const VALID_ROLES = ['write', 'read'];
+
+/**
+ * Resolve the origin remote's { owner_id, repo_name } for the current repo.
+ */
+async function resolveRepoInfo() {
+    const gentPath = await getGentPath();
+    const config = await readJSON(path.join(gentPath, CONFIG_FILE));
+    const remoteConfig = config.remotes && config.remotes.origin;
+    if (!remoteConfig) {
+        throw new Error("No 'origin' remote. Use \"gent remote add origin <url>\" first.");
+    }
+    const repoInfo = parseRemoteUrl(remoteConfig.url);
+    if (!repoInfo) {
+        throw new Error('Invalid origin remote URL. Expected /api/repos/{owner_id}/{repo_name}');
+    }
+    return repoInfo;
+}
+
+async function members(action, target, options = {}) {
+    try {
+        if (!(await authStorage.isAuthenticated())) {
+            console.error(chalk.red('Not authenticated'));
+            console.log(chalk.yellow('Run "gent login" first'));
+            return;
+        }
+
+        const repoInfo = await resolveRepoInfo();
+
+        if (!action || action === 'list') {
+            await listMembers(repoInfo);
+        } else if (action === 'add') {
+            await addMember(repoInfo, target, options);
+        } else if (action === 'remove' || action === 'rm') {
+            await removeMember(repoInfo, target);
+        } else {
+            console.error(chalk.red(`Unknown action '${action}'`));
+            console.log(chalk.yellow('Usage: gent members [list | add <email> | remove <email>]'));
+        }
+    } catch (error) {
+        handleError(error);
+    }
+}
+
+async function listMembers(repoInfo) {
+    const spinner = ora('Fetching members...').start();
+    const data = await apiClient.get(buildRepoUrl(API_ENDPOINTS.REPO_MEMBERS, repoInfo));
+    spinner.stop();
+
+    console.log(chalk.bold.cyan('\nRepository members:\n'));
+    for (const m of data || []) {
+        const role = m.role === 'owner'
+            ? chalk.magenta('owner')
+            : m.role === 'write' ? chalk.green('write') : chalk.gray('read');
+        console.log(`  ${chalk.white.bold(m.email)}  [${role}]  ${chalk.gray(`#${m.user_id}`)}`);
+    }
+    console.log();
+}
+
+async function addMember(repoInfo, email, options) {
+    if (!email) {
+        console.error(chalk.red('Usage: gent members add <email> [--role write|read]'));
+        return;
+    }
+    const role = (options.role || 'write').toLowerCase();
+    if (!VALID_ROLES.includes(role)) {
+        console.error(chalk.red(`Invalid role '${role}'. Use one of: ${VALID_ROLES.join(', ')}`));
+        return;
+    }
+
+    const spinner = ora(`Adding ${email} as ${role}...`).start();
+    await apiClient.post(buildRepoUrl(API_ENDPOINTS.REPO_MEMBERS, repoInfo), { email, role });
+    spinner.succeed(chalk.green(`Added ${email} (${role})`));
+}
+
+async function removeMember(repoInfo, email) {
+    if (!email) {
+        console.error(chalk.red('Usage: gent members remove <email>'));
+        return;
+    }
+
+    const spinner = ora(`Removing ${email}...`).start();
+    // The remove endpoint keys on user_id, so resolve it from the member list.
+    const list = await apiClient.get(buildRepoUrl(API_ENDPOINTS.REPO_MEMBERS, repoInfo));
+    const member = (list || []).find(m => m.email === email && m.role !== 'owner');
+    if (!member) {
+        spinner.fail(chalk.red(`${email} is not a member of this repository`));
+        return;
+    }
+
+    await apiClient.delete(
+        buildRepoUrl(API_ENDPOINTS.REPO_MEMBER_DETAIL, { ...repoInfo, user_id: member.user_id })
+    );
+    spinner.succeed(chalk.green(`Removed ${email}`));
+}
+
+function handleError(error) {
+    if (error.response?.status === 401) {
+        console.error(chalk.red('Authentication failed — run "gent login"'));
+    } else if (error.response?.status === 403) {
+        console.error(chalk.red(error.response.data?.error || 'Only the repository owner can manage members'));
+    } else if (error.response?.data) {
+        const d = error.response.data;
+        console.error(chalk.red(d.error || (typeof d === 'object' ? JSON.stringify(d) : d)));
+    } else {
+        console.error(chalk.red('Error:'), error.message);
+    }
+    process.exit(1);
+}
+
+module.exports = members;

package/src/commands/password.js

@@ -0,0 +1,134 @@
+/**
+ * Password Command - Change or reset your account password.
+ *
+ * USAGE:
+ *   gent password change             → change password (prompts current + new)
+ *   gent password reset [email]      → email yourself a reset link
+ *   gent password reset-confirm      → finish a reset with uid + token from the email
+ *
+ * BACKEND:
+ *   POST /api/auth/password/change/          { current_password, new_password, new_password_confirm }
+ *   POST /api/auth/password/reset/           { email }
+ *   POST /api/auth/password/reset/confirm/   { uid, token, new_password, new_password_confirm }
+ *
+ * Note: changing/resetting the password blacklists all refresh tokens, so
+ * `change` re-logs you in with the new password to keep the session alive.
+ */
+
+const chalk = require('chalk');
+const inquirer = require('inquirer');
+const ora = require('ora');
+const { API_ENDPOINTS } = require('../utils/constants');
+const apiClient = require('../utils/api-client');
+const authStorage = require('../utils/auth-storage');
+const authService = require('../services/auth-service');
+
+async function password(action, options = {}) {
+    try {
+        const act = action || 'change';
+        if (act === 'change') {
+            await changePassword();
+        } else if (act === 'reset') {
+            await requestReset(options);
+        } else if (act === 'reset-confirm') {
+            await confirmReset();
+        } else {
+            console.error(chalk.red(`Unknown action '${action}'`));
+            console.log(chalk.yellow('Usage: gent password [change | reset [email] | reset-confirm]'));
+        }
+    } catch (error) {
+        handleError(error);
+    }
+}
+
+async function changePassword() {
+    if (!(await authStorage.isAuthenticated())) {
+        console.error(chalk.red('Not authenticated'));
+        console.log(chalk.yellow('Run "gent login" first'));
+        return;
+    }
+    const user = await authStorage.getUser();
+
+    const answers = await inquirer.prompt([
+        { type: 'password', name: 'current', message: 'Current password:', mask: '*' },
+        {
+            type: 'password', name: 'next', message: 'New password:', mask: '*',
+            validate: (v) => v.length >= 8 || 'Password must be at least 8 characters long'
+        },
+        {
+            type: 'password', name: 'confirm', message: 'Confirm new password:', mask: '*',
+            validate: (v, a) => v === a.next || 'Passwords do not match'
+        },
+    ]);
+
+    const spinner = ora('Changing password...').start();
+    await apiClient.post(API_ENDPOINTS.PASSWORD_CHANGE, {
+        current_password: answers.current,
+        new_password: answers.next,
+        new_password_confirm: answers.confirm,
+    });
+
+    // The backend blacklisted our refresh token; re-login to refresh the session.
+    try {
+        if (user?.email) await authService.login(user.email, answers.next);
+        spinner.succeed(chalk.green('Password changed'));
+    } catch {
+        await authStorage.clearAuth();
+        spinner.succeed(chalk.green('Password changed'));
+        console.log(chalk.yellow('Please run "gent login" again with your new password.'));
+    }
+}
+
+async function requestReset(options) {
+    let email = options.email;
+    if (!email) {
+        ({ email } = await inquirer.prompt([{ type: 'input', name: 'email', message: 'Account email:' }]));
+    }
+
+    const spinner = ora('Requesting password reset...').start();
+    const res = await apiClient.post(API_ENDPOINTS.PASSWORD_RESET, { email });
+    spinner.succeed(chalk.green(res.message || 'If that account exists, a reset link has been sent.'));
+    console.log(chalk.gray('Open the link in your email, then run "gent password reset-confirm".'));
+}
+
+async function confirmReset() {
+    const a = await inquirer.prompt([
+        { type: 'input', name: 'uid', message: 'uid (from reset link):' },
+        { type: 'input', name: 'token', message: 'token (from reset link):' },
+        {
+            type: 'password', name: 'next', message: 'New password:', mask: '*',
+            validate: (v) => v.length >= 8 || 'Password must be at least 8 characters long'
+        },
+        {
+            type: 'password', name: 'confirm', message: 'Confirm new password:', mask: '*',
+            validate: (v, ans) => v === ans.next || 'Passwords do not match'
+        },
+    ]);
+
+    const spinner = ora('Resetting password...').start();
+    const res = await apiClient.post(API_ENDPOINTS.PASSWORD_RESET_CONFIRM, {
+        uid: a.uid,
+        token: a.token,
+        new_password: a.next,
+        new_password_confirm: a.confirm,
+    });
+    spinner.succeed(chalk.green(res.message || 'Password reset successfully'));
+    console.log(chalk.gray('Run "gent login" with your new password.'));
+}
+
+function handleError(error) {
+    const data = error.response?.data;
+    if (error.response?.status === 401 && data?.current_password) {
+        console.error(chalk.red('Current password is incorrect'));
+    } else if (data) {
+        // DRF returns { field: [messages] } or { error/detail: message }.
+        const msg = data.error || data.detail
+            || (typeof data === 'object' ? Object.values(data).flat().join(', ') : data);
+        console.error(chalk.red(msg || 'Request failed'));
+    } else {
+        console.error(chalk.red('Error:'), error.message);
+    }
+    process.exit(1);
+}
+
+module.exports = password;

package/src/commands/pull.js

@@ -11,13 +11,10 @@
  *   gent pull                          → Pull from origin/current-branch
  *   gent pull <remote> <branch>        → Pull specific remote/branch
  *
- * ALGORITHM (client-side, no /pull/ endpoint):
- *   1. GET .../branches/{branch}/ → get remote branch head SHA
- *   2. GET .../commits/ → list all remote commits
- *   3. Diff local vs remote commits, find new ones
- *   4. For each new commit, fetch tree + blobs via individual endpoints
- *   5. Store objects locally
- *   6. If diverged: run 3-way merge. If fast-forward: advance pointer
+ * ALGORITHM:
+ *   1. GET .../pull/?branch=&since= → { commits, objects (base64), head } in one call
+ *   2. Store objects locally, add new commits to the local store
+ *   3. If diverged: run 3-way merge. If fast-forward: advance the pointer
  *
  * ============================================================================
  */
@@ -30,7 +27,7 @@ const { getGentPath, readJSON, writeJSON } = require('../utils/fileSystem');
 const { COMMITS_FILE, CONFIG_FILE, API_ENDPOINTS, buildRepoUrl, parseRemoteUrl } = require('../utils/constants');
 const apiClient = require('../utils/api-client');
 const authStorage = require('../utils/auth-storage');
-const { storeBlob, objectExists, readBlob, readBlobAsString, decodeRemoteBlobContent } = require('../utils/hash-engine');
+const { storeBlob, readBlob } = require('../utils/hash-engine');
 const { findMergeBase, mergeTreeEntries } = require('../utils/merge-engine');
 const { generateCommitHash } = require('../utils/helpers');
 
@@ -73,104 +70,48 @@ async function pull(remoteName, branchName, options) {
         const branch = branchName || repository.currentBranch;
         const localHead = repository.branches[branch] || null;
 
-        // 1. Get remote branch info to find remote HEAD
-        spinner.text = `Fetching branch info for ${branch}...`;
-        let remoteHead;
+        // 1. Fetch commits + objects for this branch in a single call. `since`
+        //    lets the server send only what we don't have on a fast-forward.
+        spinner.text = `Fetching updates for ${branch}...`;
+        let pullData;
         try {
-            const branchInfo = await apiClient.get(
-                buildRepoUrl(API_ENDPOINTS.REPO_BRANCH_DETAIL, { ...repoInfo, branch_name: branch })
-            );
-            remoteHead = branchInfo.commit_sha;
+            const pullUrl = buildRepoUrl(API_ENDPOINTS.REPO_PULL, repoInfo);
+            const query = localHead
+                ? `?branch=${encodeURIComponent(branch)}&since=${encodeURIComponent(localHead)}`
+                : `?branch=${encodeURIComponent(branch)}`;
+            pullData = await apiClient.get(pullUrl + query);
         } catch (error) {
             if (error.response?.status === 404) {
                 spinner.succeed(chalk.green('Remote branch not found — nothing to pull'));
                 return;
             }
+            if (error.response?.status === 403) {
+                spinner.fail(chalk.red('Access denied — you are not a member of this private repository'));
+                return;
+            }
             throw error;
         }
 
-        if (!remoteHead || remoteHead === localHead) {
-            spinner.succeed(chalk.green('Already up-to-date'));
-            return;
-        }
-
-        // 2. Fetch all remote commits
-        spinner.text = `Fetching commits...`;
-        const remoteCommits = await apiClient.get(
-            buildRepoUrl(API_ENDPOINTS.REPO_COMMITS, repoInfo)
-        );
-
-        // 3. Find commits we don't have locally
-        const localCommitSet = new Set((repository.commits || []).map(c => c.hash || c.sha));
-        const newRemoteCommits = remoteCommits.filter(c => !localCommitSet.has(c.sha));
+        const remoteHead = pullData.head;
+        config.remoteRefs = config.remoteRefs || {};
 
-        if (newRemoteCommits.length === 0) {
-            // We have all commits but pointer is different — update ref
-            config.remoteRefs = config.remoteRefs || {};
-            config.remoteRefs[`${remote}/${branch}`] = remoteHead;
+        if (!remoteHead || remoteHead === localHead) {
+            if (remoteHead) config.remoteRefs[`${remote}/${branch}`] = remoteHead;
             await writeJSON(path.join(gentPath, CONFIG_FILE), config);
             spinner.succeed(chalk.green('Already up-to-date'));
             return;
         }
 
-        // 4. For each new commit, fetch tree and blobs
-        spinner.text = `Fetching ${newRemoteCommits.length} new commit(s) + objects...`;
-
-        const fetchedCommits = [];
-        for (const commit of newRemoteCommits) {
-            // Fetch tree for this commit
-            let treeEntries = [];
-            if (commit.tree_sha) {
-                try {
-                    const tree = await apiClient.get(
-                        buildRepoUrl(API_ENDPOINTS.REPO_TREE_DETAIL, { ...repoInfo, sha: commit.tree_sha })
-                    );
-                    treeEntries = tree.entries || [];
-                } catch {
-                    // Tree may not be available
-                }
-            }
-
-            // Fetch and store blobs
-            for (const entry of treeEntries) {
-                if (entry.type === 'blob' && entry.sha) {
-                    if (!(await objectExists(gentPath, entry.sha))) {
-                        try {
-                            const blob = await apiClient.get(
-                                buildRepoUrl(API_ENDPOINTS.REPO_BLOB_DETAIL, { ...repoInfo, sha: entry.sha })
-                            );
-                            if (blob.content) {
-                                const buf = decodeRemoteBlobContent(blob.content, entry.sha);
-                                await storeBlob(gentPath, buf);
-                            }
-                        } catch {
-                            // Blob fetch failed, continue
-                        }
-                    }
-                }
-            }
-
-            // Convert remote commit format to local format
-            fetchedCommits.push({
-                hash: commit.sha,
-                message: commit.message,
-                author: { name: commit.author_name, email: commit.author_email },
-                timestamp: commit.committed_at,
-                parent: commit.parent_shas && commit.parent_shas[0] || null,
-                mergeParent: commit.parent_shas && commit.parent_shas[1] || null,
-                treeHash: commit.tree_sha,
-                tree: treeEntries.map(e => ({
-                    mode: e.mode || '100644',
-                    name: e.name,
-                    hash: e.sha,
-                    type: e.type || 'blob'
-                })),
-                files: treeEntries.map(e => ({ path: e.name, hash: e.sha })),
-                stats: {}
-            });
+        // 2. Store blob objects (base64) into the local object store.
+        spinner.text = 'Storing objects...';
+        for (const obj of pullData.objects || []) {
+            if (obj.type !== 'blob' || typeof obj.data !== 'string') continue;
+            await storeBlob(gentPath, Buffer.from(obj.data, 'base64'));
         }
 
-        // 5. Add new commits to local store (dedup)
+        // 3. Add new remote commits to the local store (dedup by hash). The
+        //    server returns them in the CLI's native commit shape already.
+        const fetchedCommits = pullData.commits || [];
         let newCount = 0;
         const commitSet = new Set((repository.commits || []).map(c => c.hash));
         for (const commit of fetchedCommits) {
@@ -182,9 +123,7 @@ async function pull(remoteName, branchName, options) {
             }
         }
 
-        // 6. Merge strategy
-        config.remoteRefs = config.remoteRefs || {};
-
+        // 4. Merge strategy
         if (!localHead || isAncestor(repository.commits, localHead, remoteHead)) {
             // Fast-forward
             const previousTree = localHead ? getCommitTree(repository.commits, localHead) : [];
@@ -224,7 +163,7 @@ async function pull(remoteName, branchName, options) {
             const mergeCommit = {
                 hash: generateCommitHash(),
                 message: `Merge remote-tracking branch '${remote}/${branch}'`,
-                author: (repository.commits.find(c => c.hash === localHead) || {}).author || { name: 'Unknown', email: '' },
+                author: (repository.commits.find(c => c.hash === localHead) || {}).author || { name: 'Unknown', email: (await authStorage.getUser())?.email || '' },
                 timestamp: new Date().toISOString(),
                 parent: localHead,
                 mergeParent: remoteHead,
@@ -259,6 +198,8 @@ async function pull(remoteName, branchName, options) {
         spinner.fail(chalk.red('Pull failed'));
         if (error.response?.status === 401) {
             console.error(chalk.red('Authentication failed — run "gent login"'));
+        } else if (error.response?.status === 403) {
+            console.error(chalk.red('Access denied — you are not a member of this private repository'));
         } else if (error.response?.data) {
             console.error(chalk.red(JSON.stringify(error.response.data)));
         } else {

package/src/commands/push.js

@@ -95,9 +95,15 @@ async function push(remoteName, branchName, options) {
 
         // Determine which commits to push (since last pushed ref)
         config.remoteRefs = config.remoteRefs || {};
-        const lastPushed = config.remoteRefs[`${remote}/${branch}`] || null;
+        // Everything reachable from any already-pushed ref of this remote is the
+        // boundary — a merge can pull in commits from a branch that was never
+        // pushed, so we can't bound by this branch's ref alone.
+        const remoteHave = Object.entries(config.remoteRefs)
+            .filter(([name]) => name.startsWith(`${remote}/`))
+            .map(([, sha]) => sha)
+            .filter(Boolean);
         const commits = repository.commits || [];
-        const commitsToPush = getCommitsSince(commits, localHead, lastPushed);
+        const commitsToPush = getCommitsSince(commits, localHead, remoteHave);
 
         if (commitsToPush.length === 0) {
             spinner.succeed(chalk.green('Everything up-to-date'));
@@ -178,17 +184,39 @@ async function push(remoteName, branchName, options) {
             }
         }
 
-        // Build commits for the pack
+        // Build commits for the pack. author_email must satisfy the backend's
+        // EmailField(required=True); fall back to the logged-in user's email so
+        // merge/legacy commits with a blank email don't 400 the whole push.
+        const fallbackEmail = (await authStorage.getUser())?.email || '';
         const packCommits = commitsToPush.map(c => ({
             sha: c.hash,
             message: c.message,
             tree_sha: c.treeHash || '',
             parent_shas: [c.parent, c.mergeParent].filter(Boolean),
-            author_name: typeof c.author === 'object' ? (c.author.name || 'Unknown') : (c.author || 'Unknown'),
-            author_email: typeof c.author === 'object' ? (c.author.email || '') : '',
+            author_name: (typeof c.author === 'object' ? c.author.name : c.author) || 'Unknown',
+            author_email: (typeof c.author === 'object' ? c.author.email : '') || fallbackEmail,
             committed_at: c.timestamp || new Date().toISOString()
         }));
 
+        // Only send tags whose target commit will exist on the remote after this
+        // push (in this pack, or reachable from an already-pushed remote ref).
+        // The backend validates every tag's commit and atomically 400s the whole
+        // push for any tag pointing at a commit it doesn't have.
+        const pushableShas = new Set(commitsToPush.map(c => c.hash));
+        const commitByHash = new Map(commits.map(c => [c.hash, c]));
+        for (const [refName, refHead] of Object.entries(config.remoteRefs || {})) {
+            if (!refName.startsWith(`${remote}/`)) continue;
+            let cur = refHead;
+            while (cur && !pushableShas.has(cur)) {
+                pushableShas.add(cur);
+                cur = commitByHash.get(cur)?.parent || null;
+            }
+        }
+        const tagsToPush = {};
+        for (const [name, tag] of Object.entries(repository.tags || {})) {
+            if (tag && tag.hash && pushableShas.has(tag.hash)) tagsToPush[name] = tag;
+        }
+
         // Build push payload matching PushPackRequest schema
         const payload = {
             pack: {
@@ -200,7 +228,7 @@ async function push(remoteName, branchName, options) {
                 name: branch,
                 commit_sha: localHead
             }],
-            tags: repository.tags || {}
+            tags: tagsToPush
         };
 
         // Send to backend
@@ -224,7 +252,7 @@ async function push(remoteName, branchName, options) {
         } else if (error.response?.status === 401) {
             console.error(chalk.red('Authentication failed — run "gent login"'));
         } else if (error.response?.status === 403) {
-            console.error(chalk.red('Permission denied — only repo owner can push'));
+            console.error(chalk.red(error.response.data?.error || error.response.data?.detail || 'Permission denied — you need write access to this repository'));
         } else if (error.response?.data) {
             console.error(chalk.red(JSON.stringify(error.response.data, null, 2)));
         } else {
@@ -235,25 +263,44 @@ async function push(remoteName, branchName, options) {
 }
 
 /**
- * Get commits from tip back to (but excluding) stopHash.
+ * Get commits reachable from tip (following BOTH parents, so merges are
+ * covered) that the remote doesn't already have. Post-order → parents precede
+ * children in the returned array.
  * @param {Array} allCommits
  * @param {String} tipHash
- * @param {String|null} stopHash
+ * @param {String[]} remoteHave - shas the remote already has (its ref tips)
  * @returns {Array}
  */
-function getCommitsSince(allCommits, tipHash, stopHash) {
+function getCommitsSince(allCommits, tipHash, remoteHave) {
     const commitMap = new Map(allCommits.map(c => [c.hash, c]));
-    const result = [];
-    let current = tipHash;
 
-    while (current && current !== stopHash) {
-        const commit = commitMap.get(current);
-        if (!commit) break;
-        result.push(commit);
-        current = commit.parent;
+    // Boundary = every commit reachable from a remote ref via both parents.
+    const have = new Set();
+    const stack = [...(remoteHave || [])].filter(Boolean);
+    while (stack.length) {
+        const sha = stack.pop();
+        if (!sha || have.has(sha)) continue;
+        const c = commitMap.get(sha);
+        if (!c) continue; // not local → treat as already-remote boundary
+        have.add(sha);
+        if (c.parent) stack.push(c.parent);
+        if (c.mergeParent) stack.push(c.mergeParent);
     }
 
-    return result.reverse(); // oldest first
+    const result = [];
+    const visited = new Set();
+    const visit = (sha) => {
+        if (!sha || visited.has(sha) || have.has(sha)) return;
+        const c = commitMap.get(sha);
+        if (!c) return;
+        visited.add(sha);
+        visit(c.parent);
+        visit(c.mergeParent);
+        result.push(c); // after both parents → oldest first
+    };
+    visit(tipHash);
+
+    return result;
 }
 
 module.exports = push;

package/src/commands/search.js

@@ -41,7 +41,7 @@ async function search(query, options = {}) {
         const filtered = repos.filter(r => {
             if (options.mine && myId && r.owner_id !== myId) return false;
             if (!q) return true;
-            const haystack = [r.name, r.description, r.owner_name, r.owner_email]
+            const haystack = [r.name, r.description, r.owner_email]
                 .filter(Boolean).join(' ').toLowerCase();
             return haystack.includes(q);
         });

package/src/commands/show.js

@@ -16,8 +16,9 @@
  *   Retrieves commit from commits.json, reads blob content from object store,
  *   computes diff against parent commit's tree, and displays unified diff.
  *
- * BACKEND EXPECTATIONS:
- *   GET /api/repos/:id/commits/:hash/ — returns commit object with tree
+ * BACKEND: none — fully local. Reads commits.json + the local object store.
+ *   (Remote commit_detail returns { sha, tree_sha, parent_shas[], author_name,
+ *    author_email, committed_at, message } — tree_sha is a bare string, no embedded tree.)
  *
  * ============================================================================
  */

package/src/commands/tag.js

@@ -18,9 +18,9 @@
  *   Annotated tag = includes tagger info, message, timestamp.
  *
  * BACKEND EXPECTATIONS:
- *   POST /api/repos/:id/tags/ { name, hash, message, annotated }
- *   GET  /api/repos/:id/tags/
- *   DELETE /api/repos/:id/tags/:name/
+ *   POST   /api/repos/:owner_id/:repo_name/tags/create/ { name, commit_sha, message, annotated, tagger_name, tagger_email }
+ *   DELETE /api/repos/:owner_id/:repo_name/tags/:name/
+ *   (tag list is local-only — the CLI never GETs /tags/)
  *
  * ============================================================================
  */
@@ -181,8 +181,15 @@ async function syncTagCreate(name, tagObj, taggerName, taggerEmail, gentPath) {
         await apiClient.post(url, payload);
         console.log(chalk.gray(`  ↑ Synced to remote`));
     } catch (error) {
+        // Duplicates now upsert (200) on the backend, so a 400 is a real failure
+        // — most often the tagged commit hasn't been pushed yet.
         if (error.response?.status === 400) {
-            console.log(chalk.gray(`  ⚠ Remote sync skipped (tag may already exist remotely)`));
+            const data = error.response.data;
+            const msg = (data && data.error) || (typeof data === 'object' ? JSON.stringify(data) : data) || 'Bad request';
+            console.log(chalk.yellow(`  ⚠ Remote sync failed: ${msg}`));
+            console.log(chalk.gray(`    (has the tagged commit been pushed to the remote?)`));
+        } else if (error.response?.status === 403) {
+            console.log(chalk.yellow(`  ⚠ Remote sync failed: ${error.response.data?.error || 'no write access to repository'}`));
         }
     }
 }
@@ -208,6 +215,8 @@ async function syncTagDelete(name, gentPath) {
     } catch (error) {
         if (error.response?.status === 404) {
             // Tag didn't exist remotely
+        } else if (error.response?.status === 403) {
+            console.log(chalk.yellow(`  ⚠ Remote delete failed: ${error.response.data?.error || 'no write access to repository'}`));
         }
     }
 }

package/src/index.js

@@ -14,8 +14,8 @@
  *   Branching:   branch, checkout, merge, resolve, stash
  *   Safety:      undo, redo
  *   Insight:     summary, ask, review, docs, changelog
- *   Remote:      remote, repos, push, pull, search, web, share
- *   Auth:        register, login, logout, whoami
+ *   Remote:      remote, repos, members, push, pull, search, web, share
+ *   Auth:        register, login, logout, whoami, password
  *   AI:          ai (status|test|models)
  *   Templates:   template (list|use)
  *
@@ -50,6 +50,7 @@ const remoteCommand = require('./commands/remote');
 const pushCommand = require('./commands/push');
 const pullCommand = require('./commands/pull');
 const reposCommand = require('./commands/repos');
+const membersCommand = require('./commands/members');
 const undoCommand = require('./commands/undo');
 const resolveCommand = require('./commands/resolve');
 const summaryCommand = require('./commands/summary');
@@ -60,6 +61,7 @@ const registerCommand = require('./commands/register');
 const loginCommand = require('./commands/login');
 const logoutCommand = require('./commands/logout');
 const whoamiCommand = require('./commands/whoami');
+const passwordCommand = require('./commands/password');
 
 // Import new gent-platform commands
 const configCommand = require('./commands/config');
@@ -241,6 +243,12 @@ program
     .option('--default-branch <name>', 'Default branch name (with --create)')
     .action(reposCommand);
 
+program
+    .command('members [action] [email]')
+    .description('Manage repo collaborators (list | add <email> | remove <email>)')
+    .option('--role <role>', 'Role when adding a member: write or read', 'write')
+    .action(membersCommand);
+
 program
     .command('push [remote] [branch]')
     .description('Push local commits to remote')
@@ -358,6 +366,12 @@ program
     .description('Display current user information')
     .action(whoamiCommand);
 
+program
+    .command('password [action]')
+    .description('Change or reset your password (change | reset [email] | reset-confirm)')
+    .option('-e, --email <email>', 'Account email (for reset)')
+    .action(passwordCommand);
+
 // Help command
 program
     .command('help [command]')

package/src/services/auth-service.js

@@ -138,10 +138,9 @@ async function refreshToken() {
             refresh: refreshToken
         });
 
-        const { access } = response;
-
-        // Update only access token
-        await authStorage.updateAccessToken(access);
+        // Backend rotates refresh tokens, so persist the new one too.
+        const { access, refresh } = response;
+        await authStorage.updateTokens(access, refresh);
 
         return access;
     } catch (error) {

package/src/utils/api-client.js

@@ -116,10 +116,11 @@ apiClient.interceptors.response.use(
                     { refresh: refreshToken }
                 );
 
-                const { access } = response.data;
-
-                // Update stored access token
-                await authStorage.updateAccessToken(access);
+                // Backend rotates refresh tokens (ROTATE_REFRESH_TOKENS +
+                // BLACKLIST_AFTER_ROTATION); persist the new refresh or the
+                // next silent refresh sends a blacklisted token and 401s.
+                const { access, refresh } = response.data;
+                await authStorage.updateTokens(access, refresh);
 
                 // Update authorization header
                 originalRequest.headers.Authorization = `Bearer ${access}`;

package/src/utils/auth-storage.js

@@ -136,10 +136,13 @@ async function clearAuth() {
 }
 
 /**
- * Update only the access token (used after refresh)
+ * Update stored tokens after a refresh. The backend rotates refresh tokens
+ * (ROTATE_REFRESH_TOKENS + BLACKLIST_AFTER_ROTATION), so the new refresh token
+ * MUST be persisted or the next refresh sends a blacklisted token and 401s.
  * @param {string} newAccessToken - New access token
+ * @param {string} [newRefreshToken] - New (rotated) refresh token, if returned
  */
-async function updateAccessToken(newAccessToken) {
+async function updateTokens(newAccessToken, newRefreshToken) {
     const authData = await readAuthData();
 
     if (!authData) {
@@ -147,6 +150,9 @@ async function updateAccessToken(newAccessToken) {
     }
 
     authData.accessToken = newAccessToken;
+    if (newRefreshToken) {
+        authData.refreshToken = newRefreshToken;
+    }
     authData.timestamp = new Date().toISOString();
 
     const authFilePath = getAuthFilePath();
@@ -158,6 +164,11 @@ async function updateAccessToken(newAccessToken) {
     await fs.writeFile(authFilePath, JSON.stringify({ data: encryptedData }), 'utf8');
 }
 
+// Back-compat alias: same as updateTokens with no rotated refresh.
+async function updateAccessToken(newAccessToken) {
+    return updateTokens(newAccessToken);
+}
+
 module.exports = {
     saveTokens,
     getAccessToken,
@@ -165,5 +176,6 @@ module.exports = {
     getUser,
     isAuthenticated,
     clearAuth,
-    updateAccessToken
+    updateAccessToken,
+    updateTokens
 };

package/src/utils/constants.js

@@ -23,6 +23,9 @@ module.exports = {
         LOGOUT: '/api/auth/logout/',
         REFRESH: '/api/auth/token/refresh/',
         PROFILE: '/api/auth/profile/',
+        PASSWORD_CHANGE: '/api/auth/password/change/',
+        PASSWORD_RESET: '/api/auth/password/reset/',
+        PASSWORD_RESET_CONFIRM: '/api/auth/password/reset/confirm/',
 
         // Repository management
         REPOS: '/api/repos/',
@@ -30,9 +33,13 @@ module.exports = {
         // Template: /api/repos/{owner_id}/{repo_name}/
         REPO_DETAIL: '/api/repos/{owner_id}/{repo_name}/',
         REPO_DELETE: '/api/repos/{owner_id}/{repo_name}/delete/',
+        REPO_MEMBERS: '/api/repos/{owner_id}/{repo_name}/members/',
+        REPO_MEMBER_DETAIL: '/api/repos/{owner_id}/{repo_name}/members/{user_id}/',
 
-        // Push
+        // Push / Pull / Clone
         REPO_PUSH: '/api/repos/{owner_id}/{repo_name}/push/',
+        REPO_PULL: '/api/repos/{owner_id}/{repo_name}/pull/',
+        REPO_CLONE: '/api/repos/{owner_id}/{repo_name}/clone/',
 
         // Branches
         REPO_BRANCHES: '/api/repos/{owner_id}/{repo_name}/branches/',