runwork 0.10.1 → 0.10.3

package/dist/health/checks.js

@@ -7,6 +7,7 @@ import { getCredentials } from '../auth/store.js';
 import { ApiClient } from '../api/client.js';
 import { detectAgents, getAdapterBySlug } from '../agents/detect.js';
 import { httpFetch } from '../utils/http.js';
+import { probeGit, parseGitVersion } from '../git/preflight.js';
 // First-party distribution endpoints. Defaults match the plan, can be
 // overridden via RUNWORK_DOWNLOAD_BASE_URL for staging or debugging.
 const BASE_URL = process.env.RUNWORK_DOWNLOAD_BASE_URL || 'https://runwork.ai';
@@ -50,26 +51,39 @@ export function buildContext() {
 }
 // ── 1. System dependencies ───────────────────────────────────────────
 export async function checkSystemDeps() {
-    try {
-        const output = execFileSync('git', ['--version'], { stdio: 'pipe' }).toString().trim();
-        const match = output.match(/(\d+\.\d+(?:\.\d+)?)/);
-        const version = match ? match[1] : 'unknown';
-        if (match) {
-            const [major, minor] = version.split('.').map(Number);
-            if (major < 2 || (major === 2 && minor < 20)) {
-                return { name: 'system-deps', status: 'warn', message: `git ${version} (old -- consider upgrading)` };
-            }
-        }
-        return { name: 'system-deps', status: 'pass', message: `git ${version}` };
-    }
-    catch {
+    // Delegate to probeGit() so doctor agrees with the preflight gate used by
+    // `runwork clone`/`init`/`dev`. probeGit also has Windows fallback paths
+    // (`where.exe`, canonical install dirs) that the previous bare execFileSync
+    // missed when Bun's standalone-binary spawn lookup failed despite git
+    // being installed.
+    const probe = probeGit();
+    if (!probe.installed) {
+        const detail = probe.error?.message ? ` (${probe.error.message})` : '';
         return {
             name: 'system-deps',
             status: 'fail',
-            message: 'git not found in PATH',
+            message: `git not found in PATH${detail}`,
             fix: 'Install git: https://git-scm.com/downloads',
         };
     }
+    const version = parseGitVersion(probe.version) ?? 'unknown';
+    // Show how we found it on Windows fallback paths so the user can see
+    // whether their PATH is wired up or we needed a rescue.
+    const sourceSuffix = probe.source === 'where' ? ` (resolved via where.exe at ${probe.path})`
+        : probe.source === 'registry' ? ` (resolved via Git for Windows registry at ${probe.path})`
+            : probe.source === 'canonical' ? ` (resolved via canonical install path ${probe.path})`
+                : '';
+    if (version !== 'unknown') {
+        const [major, minor] = version.split('.').map(Number);
+        if (major < 2 || (major === 2 && minor < 20)) {
+            return {
+                name: 'system-deps',
+                status: 'warn',
+                message: `git ${version} (old -- consider upgrading)${sourceSuffix}`,
+            };
+        }
+    }
+    return { name: 'system-deps', status: 'pass', message: `git ${version}${sourceSuffix}` };
 }
 // ── 2. CLI version ───────────────────────────────────────────────────
 export async function checkCliVersion() {
@@ -224,6 +238,108 @@ export async function checkAuthAndNetwork(ctx) {
         };
     }
 }
+// ── 4a. Git credential helper registration ──────────────────────────
+/**
+ * Verify that git's credential helper for the runwork origin is registered
+ * and that the binary it points at exists on disk. Catches the very common
+ * "logged in with an older CLI before configureGitCredentials shipped"
+ * state, where the user has credentials but git falls back to the system
+ * credential manager (Git Credential Manager popup on Windows, etc.) when
+ * trying to clone or push -- producing confusing UX with no obvious fix.
+ *
+ * The check is scoped to the *user's* logged-in baseUrl when available, so
+ * it doesn't false-fail on staging deployments that point at a different
+ * origin.
+ */
+export async function checkGitCredentialHelper(ctx) {
+    if (!ctx.credentials) {
+        return {
+            name: 'git-credential-helper',
+            status: 'skip',
+            message: 'skipped (not logged in)',
+        };
+    }
+    // Make sure git itself is callable before we try to read its config --
+    // probeGit() prepends the resolved git directory to PATH for us when it
+    // resolves via fallback, so this also smooths the way for the
+    // execFileSync('git', ...) call below.
+    const git = probeGit();
+    if (!git.installed) {
+        return {
+            name: 'git-credential-helper',
+            status: 'skip',
+            message: 'skipped (git not installed)',
+        };
+    }
+    let origin;
+    try {
+        origin = new URL(ctx.credentials.baseUrl).origin;
+    }
+    catch {
+        return {
+            name: 'git-credential-helper',
+            status: 'fail',
+            message: `cannot parse baseUrl from credentials: ${ctx.credentials.baseUrl}`,
+            fix: 'runwork login',
+        };
+    }
+    // `--get-regexp` returns 1 (and prints nothing) when no entry matches,
+    // so a non-zero exit is a normal "not registered" signal -- not an error.
+    let helperConfig;
+    try {
+        const buf = execFileSync('git', ['config', '--global', '--get-regexp', 'credential\\..*runwork.*\\.helper'], { stdio: ['ignore', 'pipe', 'ignore'] });
+        helperConfig = buf.toString('utf-8');
+    }
+    catch {
+        return {
+            name: 'git-credential-helper',
+            status: 'fail',
+            message: `no credential helper registered for ${origin}`,
+            fix: 'runwork login',
+        };
+    }
+    // Each line is `credential.<scope>.helper <value>`. We want a line whose
+    // <scope> matches the user's actual baseUrl origin (not e.g. a stale
+    // staging origin from a previous login).
+    const lines = helperConfig.split(/\r?\n/).map(l => l.trim()).filter(Boolean);
+    const escapedOrigin = origin.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const scopedRegex = new RegExp(`^credential\\.${escapedOrigin}\\.helper\\s+(.+)$`);
+    const matchedLine = lines.find(line => scopedRegex.test(line));
+    if (!matchedLine) {
+        return {
+            name: 'git-credential-helper',
+            status: 'fail',
+            message: `no credential helper registered for ${origin} (found ${lines.length} other runwork helper entries)`,
+            fix: 'runwork login',
+        };
+    }
+    const value = scopedRegex.exec(matchedLine)?.[1] ?? '';
+    // Helper values starting with `!` are shell commands. Common shapes:
+    //   `!runwork git-credential-helper`                 (PATH-relative)
+    //   `!"/abs/path/to/runwork" git-credential-helper`  (post-Pass-2 hardening, POSIX)
+    //   `!"C:/.../runwork.exe" git-credential-helper`    (post-Pass-2 hardening, Windows)
+    // We only validate "absolute path" entries by existsSync() because that's
+    // the unambiguous case. PATH-relative entries we trust git+bash to resolve
+    // at invocation time (no good way to simulate that without running it).
+    const absoluteHelperRegex = /^!"?(\/|[A-Za-z]:[\\/])/;
+    if (absoluteHelperRegex.test(value)) {
+        const pathMatch = value.match(/^!"([^"]+)"|^!(\S+)/);
+        const helperPath = pathMatch?.[1] ?? pathMatch?.[2] ?? '';
+        if (helperPath && !existsSync(helperPath)) {
+            return {
+                name: 'git-credential-helper',
+                status: 'fail',
+                message: `helper registered but binary not found at ${helperPath}`,
+                fix: 'runwork login (re-registers with the current binary path)',
+            };
+        }
+    }
+    return {
+        name: 'git-credential-helper',
+        status: 'pass',
+        message: `registered for ${origin}`,
+    };
+}
 // ── 5. Project config ────────────────────────────────────────────────
 export async function checkProjectConfig(ctx) {
     const configPath = join(ctx.cwd, '.runwork.json');

package/dist/health/runner.js

@@ -1,4 +1,4 @@
-import { buildContext, checkSystemDeps, checkCliVersion, checkCliArtifactReachable, checkCliInstallLocation, checkAuthAndNetwork, checkProjectConfig, checkAppExists, checkGitRemote, checkAgentSetup, } from './checks.js';
+import { buildContext, checkSystemDeps, checkCliVersion, checkCliArtifactReachable, checkCliInstallLocation, checkAuthAndNetwork, checkGitCredentialHelper, checkProjectConfig, checkAppExists, checkGitRemote, checkAgentSetup, } from './checks.js';
 export async function runAllChecks() {
     const ctx = buildContext();
     const checks = [];
@@ -14,6 +14,10 @@ export async function runAllChecks() {
     const { auth, network } = await checkAuthAndNetwork(ctx);
     checks.push(auth);
     checks.push(network);
+    // 4a. Git credential helper -- catches "logged in but git auth not wired
+    //     up" state that surfaces on Windows as a Git Credential Manager
+    //     popup mid-clone with no obvious cause.
+    checks.push(await checkGitCredentialHelper(ctx));
     // 5. Project config
     checks.push(await checkProjectConfig(ctx));
     // 6. App exists

package/dist/ui/__tests__/keyboard.test.js

@@ -27,4 +27,8 @@ describe('parseKeypress', () => {
     it('detects "i" for info', () => {
         expect(parseKeypress(Buffer.from('i'))).toBe('i');
     });
+    it('detects "s" for stop (used by `runwork dev attach`)', () => {
+        expect(parseKeypress(Buffer.from('s'))).toBe('s');
+        expect(parseKeypress(Buffer.from('S'))).toBe('s');
+    });
 });

package/dist/ui/keyboard.d.ts

@@ -1,4 +1,4 @@
-export type KeyAction = 'o' | 'p' | 'a' | 'e' | 'r' | 'i' | 'quit' | null;
+export type KeyAction = 'o' | 'p' | 'a' | 'e' | 'r' | 'i' | 's' | 'quit' | null;
 /** Parse a raw stdin buffer into a named action. */
 export declare function parseKeypress(data: Buffer): KeyAction;
 export interface KeyboardListener {

package/dist/ui/keyboard.js

@@ -12,6 +12,10 @@ export function parseKeypress(data) {
             case 'e': return 'e';
             case 'r': return 'r';
             case 'i': return 'i';
+            // 's' is consumed by `runwork dev attach` to stop the attached
+            // session. Other commands ignore it. We parse it centrally so the
+            // raw keypress doesn't leak through as a `null` action.
+            case 's': return 's';
             case 'q': return 'quit';
             default: return null;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runwork",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "description": "CLI for Runwork: develop, preview, and deploy Runwork apps from your local machine.",
   "license": "UNLICENSED",
   "author": "Runwork <info@runwork.ai> (https://www.runwork.ai)",