laneyard 0.6.0 → 0.7.0

package/dist/src/cli/adopt.js

@@ -29,15 +29,16 @@ export async function runAdoption(options) {
         process.stdout.write("\n" + dim("Fastfile not analysed — no Ruby with Prism available. Nothing else changes.\n"));
         return { applied: 0 };
     }
-    // A literal pointing at nothing is dropped rather than reported: there is no
-    // file to lift into the vault, and patching to a variable nothing supplies
-    // would trade one broken build for another.
-    // Resolved once, here, so the prompt, the vault write and the git check all
-    // speak about the same file rather than each resolving the path again.
+    // A literal path is looked up on disk so its bytes can go in the vault; one
+    // pointing at nothing is dropped, since patching to a variable nothing supplies
+    // would trade one broken build for another. An `env` value names no file — it
+    // is already a variable, only its *name* changes — so it is kept without a
+    // lookup, a rewrite with nothing to store. Resolved once, here, so the prompt,
+    // the vault write and the git check all speak about the same file.
     const found = new Map();
     const proposals = [];
     for (const proposal of proposalsFor(literals)) {
-        if (proposal.tier === "file") {
+        if (proposal.tier === "file" && proposal.literal.kind === "literal") {
             const hit = await readCredential(cwd, fastlaneDir, proposal);
             if (hit === null)
                 continue;
@@ -51,7 +52,20 @@ export async function runAdoption(options) {
     const accepted = [];
     for (const proposal of proposals) {
         process.stdout.write(describe(fastlaneDir, proposal) + "\n");
-        if (!(await asker.confirm(`  Store it here and use ${bold(proposal.varName)}?`, proposal.checked))) {
+        // A rewrite-only proposal stores nothing — it renames a variable your lane
+        // already reads — so the question is not "store it here".
+        const rewriteOnly = proposal.tier === "file" && !found.has(proposal);
+        // Plural when more than one argument changes — the mapping is on screen
+        // above, so the question counts them rather than repeating three long names.
+        const all = proposal.rewrites.length;
+        const question = rewriteOnly
+            ? all > 1
+                ? `  Rewrite all ${all} to the names the block exports?`
+                : `  Rewrite it to ${bold(proposal.varName)}?`
+            : all > 1
+                ? `  Store it here and rewrite all ${all}?`
+                : `  Store it here and use ${bold(proposal.varName)}?`;
+        if (!(await asker.confirm(question, proposal.checked))) {
             continue;
         }
         accepted.push(proposal.tier === "secret" ? await named(asker, proposal) : proposal);
@@ -117,19 +131,31 @@ function describe(fastlaneDir, proposal) {
     // or a password, and setup's output is pasted into bug reports and kept in CI
     // transcripts — printing it there would be this feature leaking the very
     // thing it exists to put away. The file and line above say where to look.
-    const shown = proposal.tier === "file"
-        ? `"${literal.value}"`
-        : proposal.tier === "inline"
-            ? dim("(a key, inline in the file)")
-            : dim("(a literal value, masked)");
-    const why = proposal.tier === "inline"
-        ? "This key is in your repository in cleartext."
+    const shown = (r) => r.literal.kind === "env"
+        ? `ENV["${r.literal.value}"]`
         : proposal.tier === "file"
-            ? "That path does not survive the clone: Laneyard builds from your remote."
-            : "A literal secret in a build file is a secret in your history.";
+            ? `"${r.literal.value}"`
+            : proposal.tier === "inline"
+                ? dim("(a key, inline in the file)")
+                : dim("(a literal value, masked)");
+    const many = proposal.rewrites.length > 1;
+    const why = literal.kind === "env"
+        ? `Renamed to the variable${many ? "s" : ""} Laneyard's signing block exports.`
+        : proposal.tier === "inline"
+            ? "This key is in your repository in cleartext."
+            : proposal.tier === "file"
+                ? "That path does not survive the clone: Laneyard builds from your remote."
+                : "A literal secret in a build file is a secret in your history.";
+    // Every argument that changes, not just the one the proposal is anchored on:
+    // an `apple_asc` block rewrites its key file *and* both identifiers, and
+    // naming one of the three made the other two look like they were not touched.
+    const width = Math.max(...proposal.rewrites.map((r) => r.arg.length));
+    const lines = proposal.rewrites
+        .map((r) => `    ${`${r.arg}:`.padEnd(width + 2)} ${shown(r)} → ${bold(r.varName)}\n`)
+        .join("");
     return ("\n" +
-        `  ${bold(`${fastlaneDir}/Fastfile:${literal.line}`)}   ${literal.action}(${literal.arg}:)\n` +
-        `                        → ${shown}\n` +
+        `  ${bold(`${fastlaneDir}/Fastfile:${literal.line}`)}   ${literal.action}\n` +
+        lines +
         dim(`  ${why}\n`));
 }
 /**
@@ -152,6 +178,7 @@ async function named(asker, proposal) {
         ...proposal,
         varName,
         edits: [{ ...proposal.edits[0], replacement: `ENV.fetch("${varName}")` }],
+        rewrites: [{ ...proposal.rewrites[0], varName }],
     };
 }
 /** Lifts one accepted proposal into the vault. */
@@ -160,6 +187,11 @@ async function store(vault, slug, asker, proposal, found) {
         await vault.set(slug, proposal.varName, proposal.literal.value, true);
         return;
     }
+    // A rewrite-only proposal — a `file` arg that was already a variable — lifts
+    // nothing: there is no file on disk, and the block it points at is the user's
+    // to upload. The report tells them so; here there is simply nothing to store.
+    if (proposal.tier === "file" && found === undefined)
+        return;
     const bytes = proposal.tier === "inline" ? Buffer.from(proposal.literal.value, "utf8") : found.bytes;
     // The original name is kept: some tools read meaning from it, and
     // `materialise.ts` already relies on `AuthKey_<KEY ID>.p8` surviving intact.
@@ -177,8 +209,15 @@ async function store(vault, slug, asker, proposal, found) {
 }
 /** What is left for the user to do, including the part Laneyard will not do. */
 async function report(cwd, fastlaneDir, accepted, found) {
+    // A rewrite-only proposal — an arg that was already a variable — stored
+    // nothing; counting it as stored would claim a credential is in the vault when
+    // it is the user's still to upload.
+    const stored = accepted.filter((p) => p.tier !== "file" || found.has(p));
+    const normalised = accepted.filter((p) => p.tier === "file" && !found.has(p));
     process.stdout.write("\n" +
-        ok(`Stored ${accepted.length} credential${accepted.length > 1 ? "s" : ""} in this machine's vault.\n`) +
+        (stored.length > 0
+            ? ok(`Stored ${stored.length} credential${stored.length > 1 ? "s" : ""} in this machine's vault.\n`)
+            : "") +
         ok(`Patched ${fastlaneDir}/Fastfile.\n`) +
         "\n" +
         // Said plainly because it is the trap `addProjectToConfig` already
@@ -186,6 +225,16 @@ async function report(cwd, fastlaneDir, accepted, found) {
         // the working copy reaches a run until it is pushed.
         warn("Commit and push it, or your runs still read the old file.\n") +
         dim("  git diff -- " + join(fastlaneDir, "Fastfile") + "\n"));
+    // The rewrites now read names a signing block exports. Nothing was stored for
+    // them, so the block is what makes them real — and the old variables the lane
+    // used to read are free to go.
+    if (normalised.length > 0) {
+        const names = [...new Set(normalised.map((p) => p.varName))].sort();
+        process.stdout.write("\n" +
+            warn(`Supply ${names.join(", ")} from a signing block.\n`) +
+            dim("  Upload the .p8 or service account there; the block exports these names,\n") +
+            dim("  and the variables you set as secrets for them can go.\n"));
+    }
     // Said, never done. Removing a file from someone's repository is not
     // setup's to decide, and `git rm --cached` does not take it out of the
     // history anyway — so the honest thing is to name it.

package/dist/src/cli/remove.js

@@ -13,14 +13,18 @@ import { LogStore } from "../logs/store.js";
 import { Vault } from "../secrets/vault.js";
 import { readLine } from "./home.js";
 import { bad, bold, dim, field, heading, ok, warn } from "./style.js";
-export const REMOVE_USAGE = `laneyard remove [--dry-run]
+export const REMOVE_USAGE = `laneyard remove [<slug>] [--dry-run]
 
-Run from your app's directory — the one that holds laneyard.yml. Removes
-everything Laneyard holds for that project: its block in config.yml, its clone,
-its artifacts, its run history and logs, and its own secrets and signing blocks
-in the vault. It also removes the repository's laneyard.yml, which you then
-commit. It does not touch the git remote, the credential originals, or the
-global secrets and signing blocks other projects share.
+Run from the directory that holds laneyard.yml — the repository root for most
+projects, the app's own folder in a monorepo — and the project is the one that
+file names. Give a slug instead when there is no such file.
+
+Removes everything Laneyard holds for that project: its block in config.yml, its
+clone, its artifacts, its run history and logs, and its own secrets and signing
+blocks in the vault. It also removes that laneyard.yml, which you then commit —
+one naming another project is left alone. It does not touch the git remote, the
+credential originals, or the global secrets and signing blocks other projects
+share.
 
   laneyard remove --dry-run   show what would go and stop
 
@@ -65,7 +69,7 @@ function renderInventory(slug, name, home, counts, clonePath, ymlPath) {
         field("secrets", plural(counts.secrets, "project secret")) + "\n" +
         field("signing", plural(counts.signingBlocks, "project signing block")) + "\n" +
         // The one thing removed outside `home`: the repository's own file.
-        field("laneyard.yml", ymlPath) + "\n" +
+        (ymlPath === null ? "" : field("laneyard.yml", ymlPath) + "\n") +
         heading("what will not be touched") +
         dim("  the git remote — the repository is yours, on your host and your disk.\n") +
         dim("  the credential originals — Laneyard removes only its own encrypted copy;\n") +
@@ -73,43 +77,56 @@ function renderInventory(slug, name, home, counts, clonePath, ymlPath) {
         dim("  global secrets and global signing blocks — shared by every project.\n"));
 }
 /**
- * Entry point for `laneyard remove`, run from the app's own directory.
+ * Entry point for `laneyard remove`, run from wherever the project's
+ * `laneyard.yml` sits — the repository root unless the app is one folder of a
+ * monorepo.
+ *
+ * The project is the one whose `laneyard.yml` sits in `cwd`, so the command names
+ * what the directory already is. A slug given outright overrides that, and is the
+ * only way to reach a project whose file was never written, lost its slug, or
+ * whose repository is no longer on this machine.
  *
- * The project is the one whose `laneyard.yml` sits in `cwd`; the slug is read
- * from that file rather than given as an argument, so the command names what the
- * directory already is. It reads the inventory first, prints what will and will
- * not go, and only then asks for the slug typed back — the same gate the web
- * route uses, for the same reason: the run history it deletes is the one thing
- * here nothing can rebuild.
+ * It reads the inventory first, prints what will and will not go, and only then
+ * asks for the slug typed back — the same gate the web route uses, for the same
+ * reason: the run history it deletes is the one thing here nothing can rebuild.
  */
 export async function runRemoveCommand(home, cwd, args, io) {
     let dryRun = false;
+    let given = null;
     for (const arg of args) {
         if (arg === "--dry-run" || arg === "-n")
             dryRun = true;
-        else {
+        else if (arg.startsWith("-")) {
             io.err(`Unknown option: ${arg}\n\n${REMOVE_USAGE}`);
             return 1;
         }
+        else if (given === null)
+            given = arg;
+        else {
+            io.err(`One project at a time. Give a single slug.\n\n${REMOVE_USAGE}`);
+            return 1;
+        }
     }
-    // The project is the one whose `laneyard.yml` is here — the file setup wrote
-    // and the slug it recorded in it. Run from anywhere else and there is nothing
-    // to name, which is the whole point: a project is removed from where it lives.
+    // The project is normally the one whose `laneyard.yml` is here — the file setup
+    // wrote, and the slug it recorded in it.
     const ymlPath = join(cwd, "laneyard.yml");
-    if (!existsSync(ymlPath)) {
-        io.err("\n" +
-            bad("No laneyard.yml here.") +
-            " Run `laneyard remove` from your app's directory — the one that holds it.\n");
-        return 1;
-    }
-    const repo = await loadRepoConfig(ymlPath);
-    const slug = repo.ok ? repo.config.slug : undefined;
+    const inFile = existsSync(ymlPath)
+        ? await loadRepoConfig(ymlPath).then((r) => (r.ok ? r.config.slug : undefined))
+        : undefined;
+    // A slug given outright is the way out when there is no such file: one that
+    // was never written, lost its slug, or whose repository is not on this machine
+    // any more. Without it those projects could only be removed from the web.
+    const slug = given ?? inFile;
     if (slug === undefined || slug === "") {
         io.err("\n" +
-            bad("This laneyard.yml has no slug.") +
-            " Run `laneyard setup` again to record which project it is.\n");
+            bad(existsSync(ymlPath) ? "This laneyard.yml has no slug." : "No laneyard.yml here.") +
+            " Run `laneyard remove` from the directory that holds it — usually the repository" +
+            " root — or name the project: `laneyard remove <slug>`.\n");
         return 1;
     }
+    // Removed only when it is this project's file. Given a slug explicitly, a
+    // `laneyard.yml` naming a different project is somebody else's and stays.
+    const ownYml = inFile !== undefined && inFile === slug ? ymlPath : null;
     const configPath = join(home, "config.yml");
     const config = new ConfigStore(configPath);
     const loaded = await config.load();
@@ -136,7 +153,7 @@ export async function runRemoveCommand(home, cwd, args, io) {
             " Wait for it to finish, or cancel it, then remove the project. Nothing was removed.\n");
         return 1;
     }
-    io.out(renderInventory(slug, entry.name, home, counts, clonePath, ymlPath));
+    io.out(renderInventory(slug, entry.name, home, counts, clonePath, ownYml));
     if (dryRun) {
         io.out("\n" +
             dim("Nothing was removed. Run `laneyard remove` without --dry-run to remove it.") +
@@ -172,7 +189,8 @@ export async function runRemoveCommand(home, cwd, args, io) {
         // The machine data went first, so a file removed here is one whose project
         // is already gone — never the other way round. `force` because the removal
         // must still report success if the file was deleted by hand meanwhile.
-        await rm(ymlPath, { force: true }).catch(() => { });
+        if (ownYml !== null)
+            await rm(ownYml, { force: true }).catch(() => { });
         io.out(heading("removed") +
             ok(`"${slug}": ${plural(result.runs, "run")}, ${plural(result.secrets, "secret")}, ` +
                 `${plural(result.signingBlocks, "signing block")}.\n`) +
@@ -180,7 +198,7 @@ export async function runRemoveCommand(home, cwd, args, io) {
                 ? dim(`  ${result.clonePath} is gone.\n`)
                 : dim("  There was no clone to remove.\n")) +
             dim(`  The block is out of ${configPath}.\n`) +
-            dim(`  ${ymlPath} is gone.\n`) +
+            (ownYml === null ? "" : dim(`  ${ownYml} is gone.\n`)) +
             "\n" +
             // The file is committed, so deleting the working copy is not the end of
             // it — the same trap adoption's report names about a patched Fastfile.

package/dist/src/cli/setup.js

@@ -151,16 +151,6 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
                 dim("  Continuing updates its entry, keeping anything you added by hand.\n") +
                 dim("  Give it another name to keep both.\n"));
         }
-        // The repository file lives in the app's own directory, so a monorepo of N
-        // apps carries N of them — one beside each app's fastlane folder. `appRoot`
-        // is the fastlane dir's parent; for a plain app whose fastlane sits at the
-        // root it is `.`, and the file lands at the repository root as it always did.
-        const appRoot = appRootOf(d.fastlaneDir);
-        const repoConfigPath = join(repoRoot(cwd, d.subPath), appRoot, LANEYARD_YML);
-        if (await fileExists(repoConfigPath)) {
-            process.stdout.write("\n" + warn(`${LANEYARD_YML} already exists in the repository.\n`) +
-                dim("  Its values win over anything written here; it will be left alone.\n"));
-        }
         // A machine with no account gets its first admin here. Asked rather than
         // assumed: the name is typed into a login form every day afterwards, and
         // `admin` is a poor thing to call a person once there are two of them.
@@ -187,7 +177,24 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
         }
         const gitUrl = await asker.ask("repository", d.gitUrl);
         const branch = await asker.ask("default branch", d.defaultBranch, dim("A run uses this branch unless you pick another one when you start it."));
-        const fastlaneDir = await asker.ask("fastlane directory", d.fastlaneDir, dim("Relative to the repository root, because that is what Laneyard clones."));
+        // Asked as it is written from where the command ran: from `app/`, the folder
+        // is `fastlane`, not `app/fastlane`. The repository-root-relative form is
+        // what the clone has and what `config.yml` stores, but prefixing it is
+        // Laneyard's job — asking someone to type a path they are standing inside
+        // reads like a mistake, and is the one people correct wrongly.
+        const fastlaneDir = fromRepoRoot(d.subPath, await asker.ask("fastlane directory", fromHere(d.subPath, d.fastlaneDir), dim("Relative to this directory.")));
+        // Computed from the answer, never from the detection: correcting the folder
+        // moves the app root with it, and with it where `laneyard.yml` is written and
+        // which prefix its paths drop. Read before the prompt, a correction was
+        // silently ignored and the file landed beside the wrong app.
+        const appRoot = appRootOf(fastlaneDir);
+        const repoConfigPath = join(repoRoot(cwd, d.subPath), appRoot, LANEYARD_YML);
+        const repoConfigExists = await fileExists(repoConfigPath);
+        if (repoConfigExists) {
+            process.stdout.write("\n" + warn(`${LANEYARD_YML} already exists in the repository.\n`) +
+                dim("  Its values win over anything written here and are left alone.\n") +
+                dim("  Only a missing `slug:` is added, so this project can be removed later.\n"));
+        }
         // A fastlane folder that is on disk but not in git will not survive the
         // clone Laneyard builds from — the case that started this: a stray
         // `app copie/` macOS made, detected here and absent from the remote.
@@ -209,10 +216,14 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
         // prompt is a miserable way to start, the detected ones are nearly always
         // right, and the file is there to be edited when they are not.
         const globs = d.artifactGlobs;
-        if (!(await asker.confirm(`\n${bold(`Set up "${slug}"`)}?`, true))) {
-            process.stdout.write(dim("Nothing written.") + "\n");
-            return 0;
-        }
+        // No final "and write those?" here, on purpose. It was a rubber stamp: by
+        // this line every value has been proposed and accepted one at a time, so the
+        // answer was always yes — and a question nobody ever says no to teaches
+        // people to press Return without reading the ones that matter. Nothing here
+        // destroys anything either: the project block is additive and `laneyard
+        // remove` undoes it, an existing `laneyard.yml` keeps its values, and the
+        // report below says exactly what was written and where. Ctrl-C still works
+        // at every prompt above.
         // The account first, so the server block is written before the project list
         // it sits above. `null` when this machine already has one, and then nothing
         // is written and nothing is printed.
@@ -271,7 +282,6 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
             // checklist cannot end up disagreeing about the same repository.
             ...(d.platforms.length > 0 ? { platforms: d.platforms } : {}),
         });
-        const port = await configuredPort(configPath);
         process.stdout.write(heading(`Project "${slug}" is set up`) +
             field("repository", `${gitUrl} (${branch})`) + "\n" +
             field("fastlane", fastlaneDir) + "\n" +
@@ -282,9 +292,12 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
             // one line of the file just written.
             field("platforms", d.platforms.join(", ") || dim("none detected")) + "\n" +
             "\n" +
-            (wroteRepoConfig
+            (wroteRepoConfig === "written"
                 ? ok(`Wrote ${bold(LANEYARD_YML)} — ${bold("commit it")} so your team builds the same way.\n`)
-                : warn(`Left the existing ${LANEYARD_YML} alone.\n`)) +
+                : wroteRepoConfig === "slug-added"
+                    ? ok(`Added ${bold(`slug: ${slug}`)} to the existing ${LANEYARD_YML}, and left the rest ` +
+                        `alone — ${bold("commit it")}.\n`)
+                    : warn(`Left the existing ${LANEYARD_YML} alone.\n`)) +
             ok(`Registered in ${configPath}\n`) +
             // Last thing before the invitation to start the server, because it is
             // the one line here that cannot be read again anywhere: the file holds
@@ -298,11 +311,14 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
                     "\n" +
                     warn("Write the password down — it is not shown again, and it is not stored.\n") +
                     dim("  Add a colleague later with `laneyard user add <name> --role builder`.\n")) +
-            heading("Start Laneyard") +
+            // An instruction, not a status. `Start Laneyard` over a command and a URL
+            // read as "started, and here is the address" — the URL especially, which
+            // nothing was serving yet. The verb says who does it, and the address is
+            // the server's to print once it is listening.
+            heading("The server is not running yet — start it with") +
             `  ${bold("laneyard")}\n` +
-            `  ${dim(`http://localhost:${port}`)}\n` +
             "\n" +
-            dim("Already running? The configuration is watched — it appears on its own.\n"));
+            dim("Already running? The configuration is watched — this project appears on its own.\n"));
         // The second act. After the success message, never before it: declining
         // everything here must leave exactly the project the lines above just
         // announced. See `cli/adopt.ts`.
@@ -332,17 +348,6 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
         asker.close();
     }
 }
-/**
- * The port the server will actually listen on.
- *
- * Read back from the file rather than assumed: telling someone to open a port
- * their configuration does not use is the kind of small wrongness that makes a
- * tool feel unreliable on first contact.
- */
-async function configuredPort(configPath) {
-    const res = await loadServerConfig(configPath);
-    return res.ok ? res.config.server.port : 7890;
-}
 /** The repository file, named once so the message and the write cannot disagree. */
 const LANEYARD_YML = "laneyard.yml";
 /** What the first account is called when nobody says otherwise. */
@@ -401,14 +406,30 @@ async function existingProject(configPath, slug) {
  * values win anyway.
  */
 async function writeRepoConfigIfAbsent(path, settings) {
-    if (await fileExists(path))
-        return false;
-    const doc = new Document(settings);
-    doc.commentBefore =
-        " How this project builds. Committed, so everyone builds it the same way.\n" +
-            " Values here win over the project's block in the server's config.yml.";
-    await writeFile(path, doc.toString(), "utf8");
-    return true;
+    const existing = await readFile(path, "utf8").catch(() => null);
+    if (existing === null) {
+        const doc = new Document(settings);
+        doc.commentBefore =
+            " How this project builds. Committed, so everyone builds it the same way.\n" +
+                " Values here win over the project's block in the server's config.yml.";
+        await writeFile(path, doc.toString(), "utf8");
+        return "written";
+    }
+    // The one edit an existing file gets: the slug, and only when it has none.
+    //
+    // A file written before slugs existed has no way to gain one otherwise, and
+    // `laneyard remove` refuses a slug-less file while telling you to run setup
+    // again — which left it untouched. That was a project nothing could remove.
+    //
+    // Through the YAML document, like `addProjectToConfig`: the comments, the key
+    // order and every value the file carried come back out unchanged. An existing
+    // slug is never touched, whatever it says.
+    const doc = parseDocument(existing);
+    if (doc.getIn(["slug"]) !== undefined)
+        return "left";
+    doc.setIn(["slug"], settings.slug);
+    await writeFile(path, serialize(doc), "utf8");
+    return "slug-added";
 }
 /**
  * A repo-root-relative path read as relative to the app directory.
@@ -425,6 +446,30 @@ function appRelative(appRoot, p) {
     const prefix = `${appRoot}/`;
     return p.startsWith(prefix) ? p.slice(prefix.length) : p;
 }
+/**
+ * A repository-root-relative path as it is written from where setup ran.
+ *
+ * `app/fastlane` is `fastlane` when standing in `app/`. A path outside that
+ * directory has no shorter form and is shown as it is.
+ */
+function fromHere(subPath, repoRelative) {
+    if (subPath === "")
+        return repoRelative;
+    const prefix = `${subPath}/`;
+    return repoRelative.startsWith(prefix) ? repoRelative.slice(prefix.length) : repoRelative;
+}
+/**
+ * The inverse: back to repository-root-relative, which is the shape of the clone.
+ *
+ * Tolerant of an answer that already carries the prefix — someone who types
+ * `app/fastlane` from `app/` means the same folder, and double-prefixing it into
+ * `app/app/fastlane` would be a worse answer than the one they gave.
+ */
+function fromRepoRoot(subPath, here) {
+    if (subPath === "" || here === "")
+        return here;
+    return here === subPath || here.startsWith(`${subPath}/`) ? here : `${subPath}/${here}`;
+}
 /** `git@github.com:you/thing.git` reads better as `you/thing` in a sentence. */
 function repositoryLabel(url) {
     return url.replace(/^.*[:/]([^/:]+\/[^/]+?)(\.git)?$/, "$1");

package/dist/src/fastfile/adoption.js

@@ -50,23 +50,39 @@ export function proposalsFor(literals) {
         const file = FILE_ARGS.find((r) => r.action.test(literal.action) && r.arg === literal.arg);
         if (file) {
             const name = defaultVarNames(file.kind)["path"];
+            const main = rewriteTo(literal, name);
             const identifiers = file.kind === "apple_asc" ? appleIdentifierRewrites(appleIdentifiers) : EMPTY;
+            const edits = [...(main ? [main] : []), ...identifiers.edits];
+            const rewrites = [
+                ...(main ? [{ arg: literal.arg, literal, varName: name }] : []),
+                ...identifiers.rewrites,
+            ];
+            // Every edit was a no-op — the value already reads its Laneyard name, and
+            // so did each identifier. Nothing to propose.
+            if (edits.length === 0)
+                continue;
             out.push({
                 tier: "file",
                 kind: file.kind,
                 varName: name,
-                // The explicit literal wins over the Key ID read from the filename.
-                suggestedFields: { ...suggestedFields(file.kind, literal.value), ...identifiers.fields },
+                // The filename gives a Key ID only for a literal path; an env name is not
+                // one. The explicit literal identifier wins over the filename either way.
+                suggestedFields: {
+                    ...(literal.kind === "literal" ? suggestedFields(file.kind, literal.value) : {}),
+                    ...identifiers.fields,
+                },
                 literal,
-                edits: [
-                    { start: literal.valueStart, length: literal.valueLength, replacement: `ENV.fetch("${name}")` },
-                    ...identifiers.edits,
-                ],
+                edits,
+                rewrites,
                 checked: true,
             });
             continue;
         }
-        const inline = INLINE_ARGS.find((r) => r.action.test(literal.action) && r.arg === literal.arg);
+        // Inline contents and a literal secret are, by definition, literals: an
+        // `ENV[...]` here is a variable, handled by the file pass above or left alone.
+        const inline = literal.kind === "literal"
+            ? INLINE_ARGS.find((r) => r.action.test(literal.action) && r.arg === literal.arg)
+            : undefined;
         if (inline) {
             const name = defaultVarNames(inline.kind)["path"];
             const identifiers = inline.kind === "apple_asc" ? appleIdentifierRewrites(appleIdentifiers) : EMPTY;
@@ -85,11 +101,12 @@ export function proposalsFor(literals) {
                     },
                     ...identifiers.edits,
                 ],
+                rewrites: [{ arg: inline.becomes, literal, varName: name }, ...identifiers.rewrites],
                 checked: true,
             });
             continue;
         }
-        if (SECRET_ARG.test(literal.arg)) {
+        if (literal.kind === "literal" && SECRET_ARG.test(literal.arg)) {
             const name = `${literal.action}_${literal.arg}`.toUpperCase();
             out.push({
                 tier: "secret",
@@ -97,6 +114,7 @@ export function proposalsFor(literals) {
                 literal,
                 suggestedFields: {},
                 edits: [{ start: literal.valueStart, length: literal.valueLength, replacement: `ENV.fetch("${name}")` }],
+                rewrites: [{ arg: literal.arg, literal, varName: name }],
                 // Unticked on purpose. This is the one tier where a false positive is
                 // likely — a non-secret URL, a placeholder — and a patch applied by
                 // default to a value that was not a secret is a silent regression in
@@ -108,7 +126,11 @@ export function proposalsFor(literals) {
     return out;
 }
 /** Neither an edit nor a field: an `apple_asc` block that names no identifier. */
-const EMPTY = { edits: [], fields: {} };
+const EMPTY = {
+    edits: [],
+    fields: {},
+    rewrites: [],
+};
 /**
  * The rewrites and pre-filled fields for the identifiers written beside an
  * App Store Connect key file.
@@ -122,16 +144,37 @@ const EMPTY = { edits: [], fields: {} };
 function appleIdentifierRewrites(identifiers) {
     const defaults = defaultVarNames("apple_asc");
     const edits = [];
+    const rewrites = [];
     const fields = {};
     for (const id of identifiers) {
-        edits.push({
-            start: id.valueStart,
-            length: id.valueLength,
-            replacement: `ENV.fetch("${defaults[id.arg]}")`,
-        });
-        fields[id.arg] = id.value;
+        const name = defaults[id.arg];
+        const edit = rewriteTo(id, name);
+        if (edit) {
+            edits.push(edit);
+            rewrites.push({ arg: id.arg, literal: id, varName: name });
+        }
+        // Only a literal is the identifier's value; an env name is the *variable* it
+        // was read from, not the id itself, so it pre-fills nothing.
+        if (id.kind === "literal")
+            fields[id.arg] = id.value;
     }
-    return { edits, fields };
+    return { edits, fields, rewrites };
+}
+/**
+ * The edit that makes one argument read `varName`, or null when it already does.
+ *
+ * A literal is always rewritten — a path or a value is never the variable name.
+ * An `ENV[...]` already reading that exact name is left alone: the point is to
+ * reach Laneyard's name, and it is already there.
+ */
+function rewriteTo(literal, varName) {
+    if (literal.kind === "env" && literal.value === varName)
+        return null;
+    return {
+        start: literal.valueStart,
+        length: literal.valueLength,
+        replacement: `ENV.fetch("${varName}")`,
+    };
 }
 /** What the credential's filename gives away, so the prompt starts filled in. */
 function suggestedFields(kind, path) {

package/dist/src/git/workspace.js

@@ -199,6 +199,34 @@ export class Workspace {
         onProgress?.(`Cloning ${this.redact(this.gitUrl)}…`);
         await this.git(["clone", this.gitUrl, this.path], process.cwd());
     }
+    /**
+     * Commits this workspace holds that `origin/<branch>` does not.
+     *
+     * The one thing `prepare` would destroy without saying so: it moves the local
+     * branch onto origin's, and a commit only this clone had becomes reachable
+     * from the reflog and nowhere a person looks. That is not hypothetical — the
+     * Fastfile tab commits and pushes as two separate acts on purpose, so a
+     * workspace sitting one commit ahead is a state the product produces itself.
+     *
+     * Counted rather than listed: the caller refuses on any number above zero, and
+     * a list would invite showing it, which is a screen nobody asked for.
+     *
+     * Zero when the branch does not exist on the remote yet, and zero when
+     * anything about the question cannot be answered — a workspace that has never
+     * been fetched has no `origin/<branch>` to compare against, and refusing a
+     * refresh because the comparison failed would break the one case the refresh
+     * exists for.
+     */
+    async unpushedCount(branch) {
+        try {
+            const out = await this.git(["rev-list", "--count", `origin/${branch}..HEAD`]);
+            const n = Number(out.trim());
+            return Number.isInteger(n) ? n : 0;
+        }
+        catch {
+            return 0;
+        }
+    }
     /**
      * Brings the workspace to the requested branch, up to date.
      * Clones on the first call, just fetches afterwards.