runwork 0.10.1 → 0.10.3

package/dist/git/credentials.js

@@ -1,16 +1,37 @@
 import { execFileSync } from 'child_process';
 import { getCredentials } from '../auth/store.js';
+/**
+ * Build the value we hand to `git config credential.<origin>.helper`.
+ *
+ * Git invokes credential helpers via its bash shell (Git Bash on Windows,
+ * /bin/sh elsewhere). A leading `!` tells git to treat the value as a raw
+ * shell command. We embed the absolute path of the *currently running*
+ * runwork binary so the helper invocation never depends on PATH at the
+ * moment git happens to call it -- which used to be a real failure mode
+ * on Windows when runwork.exe sits in `~/.runwork/bin` and that directory
+ * isn't picked up by git's bash subshell.
+ *
+ * The path is wrapped in quotes (handles spaces in install paths) and on
+ * Windows we normalise backslashes to forward slashes -- bash on Windows
+ * accepts both, but forward slashes avoid escaping issues in the .gitconfig
+ * file itself.
+ */
+export function buildHelperValue(execPath) {
+    const normalised = execPath.replace(/\\/g, '/');
+    return `!"${normalised}" git-credential-helper`;
+}
 /**
  * Configure git to use the runwork credential helper for our remote.
  * Called by `runwork login` and `runwork init`.
  */
 export async function configureGitCredentials(remoteUrl) {
     const origin = new URL(remoteUrl).origin;
+    const helperValue = buildHelperValue(process.execPath);
     try {
         execFileSync('git', [
             'config', '--global',
             `credential.${origin}.helper`,
-            '!runwork git-credential-helper',
+            helperValue,
         ], { stdio: 'pipe' });
     }
     catch (err) {

package/dist/git/preflight.d.ts

@@ -1,25 +1,54 @@
+export type GitSource = 'PATH' | 'where' | 'registry' | 'canonical';
 export interface GitProbe {
     installed: boolean;
     /** Trimmed `git --version` output when detected; undefined otherwise. */
     version?: string;
+    /** Resolved binary path; 'git' when bare PATH lookup worked, absolute when discovered via fallback. */
+    path?: string;
+    /** How we resolved the binary -- useful for `runwork doctor --verbose` diagnostics. */
+    source?: GitSource;
     /** Underlying error for diagnostics (most often ENOENT on a missing git binary). */
     error?: NodeJS.ErrnoException;
 }
 /**
- * Probe whether `git` is callable from this process. We use `execFileSync`
- * (not `which`/`where.exe`) so the check follows the exact PATH lookup any
- * subsequent git invocation will use -- that way we never report "found"
- * when the real call would fail with ENOENT, and vice versa.
+ * Probe whether `git` is callable from this process.
+ *
+ * Strategy:
+ *   1. Try a bare `git --version` -- the common path on macOS, Linux, and
+ *      most Windows installs.
+ *   2. On Windows, fall back to `where.exe git` (uses the same PATH +
+ *      PATHEXT rules cmd.exe applies, which are more permissive than
+ *      Bun's spawn lookup in standalone-compiled binaries).
+ *   3. On Windows, finally probe canonical install paths under
+ *      %ProgramFiles%, %ProgramFiles(x86)%, %LOCALAPPDATA%\Programs.
+ *
+ * When step 2 or 3 succeeds, we prepend the resolved directory to
+ * process.env.PATH so the ~50 other call sites that do
+ * `execFileSync('git', ...)` automatically benefit, without rewriting
+ * each one. Result is cached for the lifetime of the process.
  */
 export declare function probeGit(): GitProbe;
+/**
+ * Reset the cached probe result. Exposed for tests and for `runwork doctor`
+ * when it wants to re-check after a guided install.
+ */
+export declare function resetGitProbeCache(): void;
+/**
+ * Extract a short numeric version (e.g. "2.43.0") from a `git --version`
+ * output line. Returns null if no number could be parsed.
+ */
+export declare function parseGitVersion(versionLine: string | undefined): string | null;
 /**
  * Build a beginner-friendly message explaining how to recover from a missing
  * git binary. Includes a Windows-specific hint because the most common
  * scenario there is "winget install Git.Git just succeeded but this shell's
  * PATH was cached at launch" -- restarting the shell fixes it without a
  * second install attempt.
+ *
+ * If a probe error is supplied, the underlying message is appended so users
+ * can see *why* detection failed (ENOENT vs EACCES vs something else).
  */
-export declare function buildMissingGitMessage(commandName: string): string;
+export declare function buildMissingGitMessage(commandName: string, probe?: GitProbe): string;
 /**
  * Convenience wrapper for command entry points: probe git, and if it's
  * missing, print the beginner-friendly message and exit with code 1.

package/dist/git/preflight.js

@@ -1,18 +1,235 @@
 import { execFileSync } from 'child_process';
+import { existsSync } from 'fs';
+import { win32 as winPath } from 'path';
+import { homedir } from 'os';
+const VERSION_REGEX = /(\d+\.\d+(?:\.\d+)?)/;
+function tryRun(bin) {
+    try {
+        const out = execFileSync(bin, ['--version'], { stdio: ['ignore', 'pipe', 'pipe'] });
+        return { ok: true, version: out.toString('utf-8').trim() };
+    }
+    catch (err) {
+        return { ok: false, error: err };
+    }
+}
+function whereGit() {
+    if (process.platform !== 'win32')
+        return null;
+    try {
+        // No `encoding: 'utf-8'` on purpose: keep the return as a Buffer to
+        // match tryRun()'s shape. We toString() ourselves so test mocks can
+        // return Buffers uniformly.
+        const buf = execFileSync('where.exe', ['git'], {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            windowsHide: true,
+        });
+        const out = buf.toString('utf-8');
+        // `where.exe git` may print multiple matches (cmd shim, exe shim).
+        // Prefer git.exe -- the bare shim is a .cmd that's harder to invoke
+        // reliably from spawn() and that mismatch is exactly what we're trying
+        // to work around.
+        const lines = out.split(/\r?\n/).map(line => line.trim()).filter(Boolean);
+        const exe = lines.find(line => /\.exe$/i.test(line));
+        if (exe && existsSync(exe))
+            return exe;
+        const fallback = lines.find(line => existsSync(line));
+        return fallback ?? null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
- * Probe whether `git` is callable from this process. We use `execFileSync`
- * (not `which`/`where.exe`) so the check follows the exact PATH lookup any
- * subsequent git invocation will use -- that way we never report "found"
- * when the real call would fail with ENOENT, and vice versa.
+ * Query Git for Windows' registry keys for an InstallPath.
+ *
+ * The official Git for Windows installer always writes
+ * `HKLM\SOFTWARE\GitForWindows\InstallPath` (system installs) or
+ * `HKCU\Software\GitForWindows\InstallPath` (per-user installs). When that
+ * value points at e.g. `C:\Program Files\Git`, the binary lives at
+ * `<value>\cmd\git.exe`. Portable / non-installer Gits (MinGit, Scoop,
+ * GitHub Desktop's bundled git) won't appear here -- they're covered by
+ * canonicalGitCandidates().
+ */
+function registryGit() {
+    if (process.platform !== 'win32')
+        return null;
+    const queries = [
+        ['HKLM\\SOFTWARE\\GitForWindows', '/v', 'InstallPath'],
+        ['HKCU\\Software\\GitForWindows', '/v', 'InstallPath'],
+    ];
+    for (const args of queries) {
+        try {
+            const buf = execFileSync('reg.exe', ['query', ...args], {
+                stdio: ['ignore', 'pipe', 'pipe'],
+                windowsHide: true,
+            });
+            const out = buf.toString('utf-8');
+            // Output shape:
+            //   HKEY_LOCAL_MACHINE\SOFTWARE\GitForWindows
+            //       InstallPath    REG_SZ    C:\Program Files\Git
+            const match = out.match(/InstallPath\s+REG_SZ\s+(.+)/i);
+            if (!match)
+                continue;
+            const installRoot = match[1].trim();
+            const gitExe = winPath.join(installRoot, 'cmd', 'git.exe');
+            if (existsSync(gitExe))
+                return gitExe;
+        }
+        catch {
+            // reg.exe missing or key not present -- next query.
+        }
+    }
+    return null;
+}
+function canonicalGitCandidates() {
+    if (process.platform !== 'win32')
+        return [];
+    const paths = [];
+    const push = (...parts) => {
+        if (parts.every((part) => typeof part === 'string' && part.length > 0)) {
+            // Use winPath.join (not the bare `join` from 'path') because the path
+            // module's separator is locked at module-load time. On macOS test
+            // hosts running these tests with process.platform spoofed to 'win32',
+            // bare join would mix '\' and '/' separators and miss real Windows
+            // file system paths.
+            paths.push(winPath.join(...parts));
+        }
+    };
+    const home = homedir();
+    // Standard installer locations. `Git\cmd\git.exe` is the public entry
+    // point (a small shim that sets up PATH internally then runs the real
+    // git from `Git\mingw64\bin`). Bun's spawn copes with .exe just fine,
+    // so the shim works as long as we call it by absolute path.
+    push(process.env.ProgramFiles, 'Git', 'cmd', 'git.exe');
+    push(process.env['ProgramFiles(x86)'], 'Git', 'cmd', 'git.exe');
+    push(process.env.LOCALAPPDATA, 'Programs', 'Git', 'cmd', 'git.exe');
+    // Portable / per-user installs that don't register in HKLM:
+    //   - ~/.runwork/tools/mingit, ~/.runwork/tools/git -- our own namespace.
+    //     Other tools (e.g. Codex CLI) have been observed dropping a portable
+    //     MinGit there; if anything lives in our directory we should respect
+    //     it, even when we didn't put it there ourselves.
+    //   - Scoop -- ~/scoop/apps/git/current/cmd/git.exe.
+    //   - GitHub Desktop's bundled git lives under a versioned path that's
+    //     awkward to enumerate without a glob; skipped intentionally.
+    if (home) {
+        push(home, '.runwork', 'tools', 'mingit', 'cmd', 'git.exe');
+        push(home, '.runwork', 'tools', 'git', 'cmd', 'git.exe');
+        push(home, '.runwork', 'tools', 'PortableGit', 'cmd', 'git.exe');
+        push(home, 'scoop', 'apps', 'git', 'current', 'cmd', 'git.exe');
+    }
+    // Hard-coded defaults in case the env vars are missing (e.g. bizarre
+    // sandbox where %ProgramFiles% isn't propagated).
+    paths.push('C:\\Program Files\\Git\\cmd\\git.exe');
+    paths.push('C:\\Program Files (x86)\\Git\\cmd\\git.exe');
+    // De-dup while preserving order.
+    return [...new Set(paths)];
+}
+function prependToPath(dir) {
+    // Hard-coded ';' instead of `path.delimiter`: this helper is only called
+    // from the Windows-only fallback branch of probeGit(), but the path
+    // module's `delimiter` is determined by the *real* host OS at module
+    // load time -- so unit tests that flip `process.platform` to 'win32' on
+    // a macOS host would otherwise see ':' and fail to detect a duplicate
+    // entry. PATH on Windows always uses ';'.
+    const PATH_DELIM = ';';
+    const current = process.env.PATH ?? '';
+    const parts = current.split(PATH_DELIM);
+    if (parts.includes(dir))
+        return;
+    process.env.PATH = `${dir}${PATH_DELIM}${current}`;
+    // Windows historically reads `Path` (any case). Node normalizes via
+    // process.env, but the Bun-on-Windows path lookup we're working around
+    // here has surprised us before, so make the casing redundant.
+    if (process.env.Path !== undefined) {
+        process.env.Path = process.env.PATH;
+    }
+}
+let cachedProbe;
+/**
+ * Probe whether `git` is callable from this process.
+ *
+ * Strategy:
+ *   1. Try a bare `git --version` -- the common path on macOS, Linux, and
+ *      most Windows installs.
+ *   2. On Windows, fall back to `where.exe git` (uses the same PATH +
+ *      PATHEXT rules cmd.exe applies, which are more permissive than
+ *      Bun's spawn lookup in standalone-compiled binaries).
+ *   3. On Windows, finally probe canonical install paths under
+ *      %ProgramFiles%, %ProgramFiles(x86)%, %LOCALAPPDATA%\Programs.
+ *
+ * When step 2 or 3 succeeds, we prepend the resolved directory to
+ * process.env.PATH so the ~50 other call sites that do
+ * `execFileSync('git', ...)` automatically benefit, without rewriting
+ * each one. Result is cached for the lifetime of the process.
  */
 export function probeGit() {
-    try {
-        const out = execFileSync('git', ['--version'], { stdio: ['ignore', 'pipe', 'pipe'] });
-        return { installed: true, version: out.toString('utf-8').trim() };
+    if (cachedProbe)
+        return cachedProbe;
+    // 1. Bare lookup.
+    const bare = tryRun('git');
+    if (bare.ok) {
+        cachedProbe = { installed: true, version: bare.version, path: 'git', source: 'PATH' };
+        return cachedProbe;
     }
-    catch (err) {
-        return { installed: false, error: err };
+    if (process.platform === 'win32') {
+        // 2. where.exe -- uses the same PATH+PATHEXT rules cmd.exe applies.
+        const whereResult = whereGit();
+        if (whereResult) {
+            const verify = tryRun(whereResult);
+            if (verify.ok) {
+                prependToPath(winPath.dirname(whereResult));
+                cachedProbe = { installed: true, version: verify.version, path: whereResult, source: 'where' };
+                return cachedProbe;
+            }
+        }
+        // 3. Registry -- the official Git for Windows installer always writes
+        //    HKLM\SOFTWARE\GitForWindows\InstallPath (or the HKCU equivalent
+        //    for per-user installs), so this catches "git is installed but
+        //    something has stripped both PATH and any chance of where.exe
+        //    finding it" cases (e.g. sandboxed agent shells).
+        const registryResult = registryGit();
+        if (registryResult) {
+            const verify = tryRun(registryResult);
+            if (verify.ok) {
+                prependToPath(winPath.dirname(registryResult));
+                cachedProbe = { installed: true, version: verify.version, path: registryResult, source: 'registry' };
+                return cachedProbe;
+            }
+        }
+        // 4. Canonical paths -- standard installer dirs plus our own
+        //    ~/.runwork/tools/{mingit,git,PortableGit} namespace and Scoop's
+        //    install location, for portable / non-installer Gits the registry
+        //    won't know about.
+        for (const candidate of canonicalGitCandidates()) {
+            if (!existsSync(candidate))
+                continue;
+            const verify = tryRun(candidate);
+            if (verify.ok) {
+                prependToPath(winPath.dirname(candidate));
+                cachedProbe = { installed: true, version: verify.version, path: candidate, source: 'canonical' };
+                return cachedProbe;
+            }
+        }
     }
+    cachedProbe = { installed: false, error: bare.error };
+    return cachedProbe;
+}
+/**
+ * Reset the cached probe result. Exposed for tests and for `runwork doctor`
+ * when it wants to re-check after a guided install.
+ */
+export function resetGitProbeCache() {
+    cachedProbe = undefined;
+}
+/**
+ * Extract a short numeric version (e.g. "2.43.0") from a `git --version`
+ * output line. Returns null if no number could be parsed.
+ */
+export function parseGitVersion(versionLine) {
+    if (!versionLine)
+        return null;
+    const match = versionLine.match(VERSION_REGEX);
+    return match ? match[1] : null;
 }
 /**
  * Build a beginner-friendly message explaining how to recover from a missing
@@ -20,8 +237,11 @@ export function probeGit() {
  * scenario there is "winget install Git.Git just succeeded but this shell's
  * PATH was cached at launch" -- restarting the shell fixes it without a
  * second install attempt.
+ *
+ * If a probe error is supplied, the underlying message is appended so users
+ * can see *why* detection failed (ENOENT vs EACCES vs something else).
  */
-export function buildMissingGitMessage(commandName) {
+export function buildMissingGitMessage(commandName, probe) {
     const lines = [
         `Git is required to run \`runwork ${commandName}\`, but it was not found on PATH.`,
         '',
@@ -34,6 +254,12 @@ export function buildMissingGitMessage(commandName) {
         lines.push('', 'If you just installed Git, this shell\'s PATH was cached when it opened', 'and does not yet include Git. Close this PowerShell / Command Prompt', 'window, open a fresh one, and re-run the command.');
     }
     lines.push('', 'Verify the install with: git --version');
+    if (probe?.error?.message) {
+        // Surface the underlying error for diagnostics so users (and we, in bug
+        // reports) can see whether this was ENOENT, EACCES, a sandbox PATH
+        // strip, etc. -- not just "not found".
+        lines.push('', `Underlying error: ${probe.error.message}`);
+    }
     return lines.join('\n');
 }
 /**
@@ -45,6 +271,6 @@ export function requireGit(commandName) {
     const probe = probeGit();
     if (probe.installed)
         return;
-    console.error(buildMissingGitMessage(commandName));
+    console.error(buildMissingGitMessage(commandName, probe));
     process.exit(1);
 }

package/dist/health/__tests__/checks.test.js

@@ -9,6 +9,7 @@ vi.mock('child_process', async (importOriginal) => {
 });
 import { existsSync } from 'fs';
 import { execFileSync } from 'child_process';
+import { resetGitProbeCache } from '../../git/preflight.js';
 const mockedExistsSync = vi.mocked(existsSync);
 const mockedExecFileSync = vi.mocked(execFileSync);
 beforeEach(() => {
@@ -17,6 +18,10 @@ beforeEach(() => {
     vi.spyOn(console, 'log').mockImplementation(() => { });
     vi.spyOn(console, 'error').mockImplementation(() => { });
     mockedExistsSync.mockReturnValue(true);
+    // checkSystemDeps now goes through probeGit() which caches the resolved
+    // git binary for the lifetime of the process. Reset between tests so each
+    // mock setup actually drives a fresh probe.
+    resetGitProbeCache();
 });
 afterEach(() => {
     vi.restoreAllMocks();
@@ -64,6 +69,135 @@ describe('checkSystemDeps', () => {
         expect(result.fix).toBeDefined();
     });
 });
+// ── 4a. Git credential helper ────────────────────────────────────────
+describe('checkGitCredentialHelper', () => {
+    function gitConfigOutput(line) {
+        return Buffer.from(`${line}\n`);
+    }
+    function gitConfigEmpty() {
+        // git config --get-regexp returns 1 with no output when nothing matches
+        const err = new Error('git config exited with code 1');
+        err.status = 1;
+        throw err;
+    }
+    it('skips when not logged in', async () => {
+        const { checkGitCredentialHelper } = await import('../checks.js');
+        const ctx = makeCtx({ credentials: null });
+        const result = await checkGitCredentialHelper(ctx);
+        expect(result.status).toBe('skip');
+        expect(result.message).toContain('not logged in');
+    });
+    it('skips when git is not installed', async () => {
+        const { checkGitCredentialHelper } = await import('../checks.js');
+        // First call (probeGit -> git --version) throws ENOENT-shaped error.
+        mockedExecFileSync.mockImplementation((file) => {
+            if (file === 'git') {
+                const err = new Error('spawn git ENOENT');
+                err.code = 'ENOENT';
+                throw err;
+            }
+            throw new Error('unreachable');
+        });
+        const ctx = makeCtx();
+        const result = await checkGitCredentialHelper(ctx);
+        expect(result.status).toBe('skip');
+        expect(result.message).toContain('git not installed');
+    });
+    it('passes when helper is registered for the credentials origin', async () => {
+        const { checkGitCredentialHelper } = await import('../checks.js');
+        mockedExecFileSync.mockImplementation(((file, args) => {
+            if (file === 'git' && args?.[0] === '--version')
+                return Buffer.from('git version 2.43.0');
+            if (file === 'git' && args?.includes('--get-regexp')) {
+                return gitConfigOutput('credential.https://runwork.ai.helper !runwork git-credential-helper');
+            }
+            throw new Error(`unexpected call: ${file} ${args?.join(' ')}`);
+        }));
+        const ctx = makeCtx();
+        const result = await checkGitCredentialHelper(ctx);
+        expect(result.status).toBe('pass');
+        expect(result.message).toContain('https://runwork.ai');
+    });
+    it('fails when no entry exists in git config', async () => {
+        const { checkGitCredentialHelper } = await import('../checks.js');
+        mockedExecFileSync.mockImplementation(((file, args) => {
+            if (file === 'git' && args?.[0] === '--version')
+                return Buffer.from('git version 2.43.0');
+            if (file === 'git' && args?.includes('--get-regexp'))
+                gitConfigEmpty();
+            throw new Error(`unexpected call: ${file} ${args?.join(' ')}`);
+        }));
+        const ctx = makeCtx();
+        const result = await checkGitCredentialHelper(ctx);
+        expect(result.status).toBe('fail');
+        expect(result.fix).toBe('runwork login');
+    });
+    it('fails when entries exist but none match the credentials origin', async () => {
+        const { checkGitCredentialHelper } = await import('../checks.js');
+        mockedExecFileSync.mockImplementation(((file, args) => {
+            if (file === 'git' && args?.[0] === '--version')
+                return Buffer.from('git version 2.43.0');
+            if (file === 'git' && args?.includes('--get-regexp')) {
+                // Stale entry from a previous staging URL.
+                return gitConfigOutput('credential.https://runwork-staging.example.com.helper !runwork git-credential-helper');
+            }
+            throw new Error(`unexpected call: ${file} ${args?.join(' ')}`);
+        }));
+        const ctx = makeCtx({
+            credentials: { apiKey: 'k', email: 'u@e.com', baseUrl: 'https://runwork.ai' },
+        });
+        const result = await checkGitCredentialHelper(ctx);
+        expect(result.status).toBe('fail');
+        expect(result.message).toContain('1 other runwork helper');
+    });
+    it('fails when the registered absolute path no longer exists', async () => {
+        const { checkGitCredentialHelper } = await import('../checks.js');
+        mockedExecFileSync.mockImplementation(((file, args) => {
+            if (file === 'git' && args?.[0] === '--version')
+                return Buffer.from('git version 2.43.0');
+            if (file === 'git' && args?.includes('--get-regexp')) {
+                return gitConfigOutput('credential.https://runwork.ai.helper !"/old/path/runwork" git-credential-helper');
+            }
+            throw new Error(`unexpected call: ${file} ${args?.join(' ')}`);
+        }));
+        mockedExistsSync.mockImplementation((p) => p !== '/old/path/runwork');
+        const ctx = makeCtx();
+        const result = await checkGitCredentialHelper(ctx);
+        expect(result.status).toBe('fail');
+        expect(result.message).toContain('binary not found');
+        expect(result.fix).toContain('runwork login');
+    });
+    it('passes when the registered absolute path still exists', async () => {
+        const { checkGitCredentialHelper } = await import('../checks.js');
+        mockedExecFileSync.mockImplementation(((file, args) => {
+            if (file === 'git' && args?.[0] === '--version')
+                return Buffer.from('git version 2.43.0');
+            if (file === 'git' && args?.includes('--get-regexp')) {
+                return gitConfigOutput('credential.https://runwork.ai.helper !"/usr/local/bin/runwork" git-credential-helper');
+            }
+            throw new Error(`unexpected call: ${file} ${args?.join(' ')}`);
+        }));
+        mockedExistsSync.mockReturnValue(true);
+        const ctx = makeCtx();
+        const result = await checkGitCredentialHelper(ctx);
+        expect(result.status).toBe('pass');
+    });
+    it('passes a Windows-style absolute path that exists', async () => {
+        const { checkGitCredentialHelper } = await import('../checks.js');
+        mockedExecFileSync.mockImplementation(((file, args) => {
+            if (file === 'git' && args?.[0] === '--version')
+                return Buffer.from('git version 2.43.0');
+            if (file === 'git' && args?.includes('--get-regexp')) {
+                return gitConfigOutput('credential.https://runwork.ai.helper !"C:/Users/test/.runwork/bin/runwork.exe" git-credential-helper');
+            }
+            throw new Error(`unexpected call: ${file} ${args?.join(' ')}`);
+        }));
+        mockedExistsSync.mockReturnValue(true);
+        const ctx = makeCtx();
+        const result = await checkGitCredentialHelper(ctx);
+        expect(result.status).toBe('pass');
+    });
+});
 // ── 3 & 4. Auth + Network ───────────────────────────────────────────
 describe('checkAuthAndNetwork', () => {
     it('fails auth when no credentials', async () => {

package/dist/health/checks.d.ts

@@ -16,6 +16,19 @@ export declare function checkAuthAndNetwork(ctx: DoctorContext): Promise<{
     auth: CheckResult;
     network: CheckResult;
 }>;
+/**
+ * Verify that git's credential helper for the runwork origin is registered
+ * and that the binary it points at exists on disk. Catches the very common
+ * "logged in with an older CLI before configureGitCredentials shipped"
+ * state, where the user has credentials but git falls back to the system
+ * credential manager (Git Credential Manager popup on Windows, etc.) when
+ * trying to clone or push -- producing confusing UX with no obvious fix.
+ *
+ * The check is scoped to the *user's* logged-in baseUrl when available, so
+ * it doesn't false-fail on staging deployments that point at a different
+ * origin.
+ */
+export declare function checkGitCredentialHelper(ctx: DoctorContext): Promise<CheckResult>;
 export declare function checkProjectConfig(ctx: DoctorContext): Promise<CheckResult>;
 export declare function checkAppExists(ctx: DoctorContext): Promise<CheckResult>;
 export declare function checkGitRemote(ctx: DoctorContext): Promise<CheckResult>;