runwork 0.15.1 → 0.16.0

package/dist/git/auto-commit.js

@@ -1,293 +0,0 @@
-import { execFileSync } from '../utils/subprocess.js';
-import { readFileSync } from 'fs';
-import { watch } from 'chokidar';
-import { join, relative } from 'path';
-import { dim, cyan, yellow } from '../ui/colors.js';
-import { buildIgnoreSets, defaultIgnoreSets, isPathIgnored, isRelPathIgnored } from '../utils/ignore-matcher.js';
-let watcher = null;
-let fastSyncTimer = null;
-let gitTimer = null;
-let gitPushing = false;
-let gitPendingAfterPush = false;
-let activeCallbacks;
-// Files awaiting fast sync: path -> 'changed' | 'deleted'
-const pendingFastSync = new Map();
-// Track files the user actually touched during this session (for git)
-const changedFiles = new Set();
-// Binary extensions to skip in fast sync (git handles them fine)
-const BINARY_EXTENSIONS = new Set([
-    '.png', '.jpg', '.jpeg', '.gif', '.ico', '.webp', '.avif', '.svg',
-    '.woff', '.woff2', '.ttf', '.eot', '.otf',
-    '.mp3', '.mp4', '.webm', '.ogg', '.wav',
-    '.zip', '.tar', '.gz', '.br',
-    '.pdf', '.wasm',
-]);
-const STATIC_IGNORE_SETS = defaultIgnoreSets();
-/**
- * Basename-level ignore predicate using the static defaults only.
- * Exposed for unit testing of the static defaults; the runtime watcher uses
- * a richer matcher built from `.gitignore` (see watchAndAutoCommit).
- */
-export function isIgnored(filePath) {
-    return isPathIgnored(filePath, STATIC_IGNORE_SETS);
-}
-export async function watchAndAutoCommit(directory, client, appId, callbacks) {
-    activeCallbacks = callbacks;
-    // Build a project-scoped ignore matcher that includes simple patterns from
-    // the project's .gitignore in addition to the static defaults. Without
-    // this the watcher tries to descend into large gitignored caches such as
-    // `.bun-cache/` or `dist/` and bogs the CLI down on startup.
-    const ignoreSets = buildIgnoreSets(directory);
-    watcher = watch(directory, {
-        ignored: (p) => isPathIgnored(p, ignoreSets),
-        persistent: true,
-        ignoreInitial: true,
-        awaitWriteFinish: {
-            stabilityThreshold: 300,
-            pollInterval: 100,
-        },
-    });
-    const onFileChange = (filePath) => {
-        const rel = relative(directory, filePath);
-        if (changedFiles.size === 0) {
-            console.log(`  ${dim('Changed:')} ${cyan(rel)}`);
-        }
-        else {
-            console.log(`  ${dim('Changed:')} ${cyan(rel)} ${dim(`(+${changedFiles.size} pending)`)}`);
-        }
-        changedFiles.add(rel);
-        pendingFastSync.set(rel, 'changed');
-        activeCallbacks?.onFileChange?.(rel, changedFiles.size);
-        scheduleFastSync(directory, client, appId);
-        scheduleGitCommit();
-    };
-    const onFileUnlink = (filePath) => {
-        const rel = relative(directory, filePath);
-        console.log(`  ${dim('Deleted:')} ${cyan(rel)}`);
-        changedFiles.add(rel);
-        pendingFastSync.set(rel, 'deleted');
-        scheduleFastSync(directory, client, appId);
-        scheduleGitCommit();
-    };
-    watcher.on('add', onFileChange);
-    watcher.on('change', onFileChange);
-    watcher.on('unlink', onFileUnlink);
-}
-// ========================================
-// FAST SYNC PATH (200ms debounce)
-// ========================================
-function scheduleFastSync(directory, client, appId) {
-    if (fastSyncTimer)
-        clearTimeout(fastSyncTimer);
-    fastSyncTimer = setTimeout(() => {
-        executeFastSync(directory, client, appId);
-    }, 200);
-}
-async function executeFastSync(directory, client, appId) {
-    if (pendingFastSync.size === 0)
-        return;
-    // Snapshot and clear
-    const snapshot = new Map(pendingFastSync);
-    pendingFastSync.clear();
-    const files = [];
-    const deletedFiles = [];
-    for (const [filePath, action] of snapshot) {
-        if (action === 'deleted') {
-            deletedFiles.push(filePath);
-        }
-        else {
-            // Skip binary files in fast sync — git path handles them
-            const ext = filePath.lastIndexOf('.') >= 0 ? filePath.slice(filePath.lastIndexOf('.')) : '';
-            if (BINARY_EXTENSIONS.has(ext.toLowerCase()))
-                continue;
-            try {
-                const contents = readFileSync(join(directory, filePath), 'utf-8');
-                files.push({ filePath, fileContents: contents });
-            }
-            catch {
-                // File may have been deleted between detection and read
-            }
-        }
-    }
-    if (files.length === 0 && deletedFiles.length === 0)
-        return;
-    const total = files.length + deletedFiles.length;
-    try {
-        await client.syncFiles(appId, files, deletedFiles.length > 0 ? deletedFiles : undefined);
-        console.log(dim(`  Synced ${total} file(s) to preview.`));
-        activeCallbacks?.onFastSync?.(total);
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.warn(yellow(`  Fast sync failed (git will handle it): ${message}`));
-    }
-}
-// ========================================
-// GIT PATH (2s debounce)
-// ========================================
-/**
- * Stage and commit the current working tree in a single shot, staging exactly
- * what the dev watcher would: tracked modifications/deletions (`git add -u`)
- * plus untracked files that the CLI ignore matcher does NOT exclude.
- *
- * It deliberately does NOT use `git add -A`. A blanket add honors only
- * `.gitignore`, which in the runwork-app template excludes `.env.*` but not a
- * bare `.env` (vibe-apps write both `.dev.vars` and `.env` locally) — so
- * `git add -A` would commit and push local secrets. The CLI ignore matcher
- * (the same one the dev watcher uses) excludes `.env`, `.dev.vars`,
- * `.bun-cache`, `.runwork`, and `*.log`, keeping deploy's staging in parity
- * with dev.
- *
- * Used by `runwork deploy`, which must commit pending working-tree changes
- * even when no dev session ever ran.
- *
- * Returns the number of files committed (0 when nothing was staged).
- */
-export function commitWorkingTree(cwd, message) {
-    // Tracked modifications and deletions.
-    execFileSync('git', ['add', '-u'], { cwd, stdio: 'pipe' });
-    // Untracked files that git itself doesn't ignore (.gitignore), further
-    // filtered through the CLI ignore matcher to match the dev watcher exactly.
-    const ignoreSets = buildIgnoreSets(cwd);
-    const untracked = execFileSync('git', ['-c', 'core.quotePath=false', 'ls-files', '--others', '--exclude-standard'], { cwd, encoding: 'utf-8' }).trim();
-    if (untracked) {
-        const toAdd = untracked
-            .split('\n')
-            .filter(Boolean)
-            .filter((p) => !isRelPathIgnored(p, ignoreSets));
-        const BATCH_SIZE = 50;
-        for (let i = 0; i < toAdd.length; i += BATCH_SIZE) {
-            const batch = toAdd.slice(i, i + BATCH_SIZE);
-            if (batch.length === 0)
-                continue;
-            try {
-                execFileSync('git', ['add', '--', ...batch], { cwd, stdio: 'pipe' });
-            }
-            catch {
-                // A file may have vanished between listing and staging.
-            }
-        }
-    }
-    return commitStaged(cwd, message);
-}
-/**
- * Commit whatever is currently staged. Shared by the deploy one-shot path
- * (after `git add -A`) and the dev watcher path (after a selective add) so
- * the "is anything staged? then commit" logic lives in one place.
- *
- * Returns the number of files committed (0 when nothing was staged).
- */
-function commitStaged(cwd, message) {
-    // An empty staging area means there is nothing to commit.
-    const staged = execFileSync('git', ['-c', 'core.quotePath=false', 'diff', '--cached', '--name-only'], { cwd, encoding: 'utf-8' });
-    if (!staged.trim()) {
-        return { committed: false, fileCount: 0 };
-    }
-    const stagedFiles = staged.trim().split('\n').filter(Boolean);
-    execFileSync('git', ['commit', '-m', message], { cwd, stdio: 'pipe' });
-    return { committed: true, fileCount: stagedFiles.length };
-}
-function scheduleGitCommit() {
-    if (gitPushing) {
-        gitPendingAfterPush = true;
-        return;
-    }
-    if (gitTimer)
-        clearTimeout(gitTimer);
-    gitTimer = setTimeout(() => {
-        commitAndPush();
-    }, 2000);
-}
-function commitAndPush() {
-    try {
-        if (changedFiles.size === 0)
-            return;
-        gitPushing = true;
-        // Stage only files the user actually touched + already-tracked modified files
-        execFileSync('git', ['add', '-u'], { stdio: 'pipe' });
-        // Also stage specific files the user created/modified this session
-        const filesToAdd = Array.from(changedFiles);
-        changedFiles.clear();
-        if (filesToAdd.length > 0) {
-            const BATCH_SIZE = 50;
-            for (let i = 0; i < filesToAdd.length; i += BATCH_SIZE) {
-                const batch = filesToAdd.slice(i, i + BATCH_SIZE);
-                try {
-                    execFileSync('git', ['add', '--', ...batch], { stdio: 'pipe' });
-                }
-                catch {
-                    // Some files may have been deleted between detection and staging
-                }
-            }
-        }
-        // Commit whatever ended up staged (shared with the deploy path).
-        const timestamp = new Date().toISOString().replace('T', ' ').slice(0, 19);
-        const { committed, fileCount } = commitStaged(process.cwd(), `dev: updated ${timestamp}`);
-        if (!committed)
-            return;
-        // Pull --rebase to integrate any remote changes, then push
-        try {
-            execFileSync('git', ['pull', '--rebase', 'runwork', 'main'], { stdio: 'pipe' });
-        }
-        catch {
-            try {
-                execFileSync('git', ['rebase', '--abort'], { stdio: 'pipe' });
-            }
-            catch { /* no rebase in progress */ }
-            // Rebase fails when histories diverged (e.g. template update). Fall back to merge.
-            try {
-                execFileSync('git', ['merge', 'runwork/main', '--allow-unrelated-histories', '--no-edit'], { stdio: 'pipe' });
-            }
-            catch {
-                try {
-                    execFileSync('git', ['merge', '--abort'], { stdio: 'pipe' });
-                }
-                catch { /* no merge in progress */ }
-                console.warn(yellow('Auto-sync: could not reconcile with the remote (conflicting changes). Your work is committed locally and safe.'));
-                console.warn(dim('  Resolve it by running: git fetch runwork && git rebase runwork/main'));
-                console.warn(dim('  Fix any conflicts (git status), then restart `runwork dev` to resume auto-sync.'));
-                return;
-            }
-        }
-        // Push the current HEAD to the remote's `main` branch regardless of
-        // what the local branch is named. This way `git init` defaults of
-        // `master` (older Git) or any other custom branch name still sync
-        // cleanly to runwork's `main`. Without `HEAD:main`, `git push runwork
-        // main` fails with "src refspec main does not match any" when the
-        // local branch isn't called `main`.
-        try {
-            execFileSync('git', ['rev-parse', '--abbrev-ref', '@{u}'], { stdio: 'pipe' });
-            execFileSync('git', ['push', 'runwork', 'HEAD:main'], { stdio: 'pipe' });
-        }
-        catch {
-            execFileSync('git', ['push', '-u', 'runwork', 'HEAD:main'], { stdio: 'pipe' });
-        }
-        console.log(dim(`  Pushed ${fileCount} file(s) to git.`));
-        activeCallbacks?.onGitPush?.(fileCount);
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.warn(yellow(`Auto-sync failed: ${message}`));
-    }
-    finally {
-        gitPushing = false;
-        if (gitPendingAfterPush) {
-            gitPendingAfterPush = false;
-            scheduleGitCommit();
-        }
-    }
-}
-export async function stopAutoCommit() {
-    if (fastSyncTimer) {
-        clearTimeout(fastSyncTimer);
-        fastSyncTimer = null;
-    }
-    if (gitTimer) {
-        clearTimeout(gitTimer);
-        gitTimer = null;
-    }
-    if (watcher) {
-        await watcher.close();
-        watcher = null;
-    }
-}

package/dist/git/classify-sync-error.d.ts

@@ -1,21 +0,0 @@
-/**
- * Classify a git sync failure from the raw stderr that `syncWithRemote`
- * captures, so `runwork dev`/`deploy` can show an accurate cause and fix
- * instead of the old catch-all "the sandbox session expired or the network
- * connection was interrupted" (which pointed users away from the real
- * problem, e.g. a missing `runwork` remote -- see friction log #3).
- */
-export type SyncErrorReason = 'no-remote' | 'auth' | 'network' | 'conflict' | 'unknown';
-export interface SyncErrorDiagnosis {
-    reason: SyncErrorReason;
-    /** One-line summary suitable for an `error.message` field. */
-    message: string;
-    /** Plain explanation of the likely cause. */
-    diagnosis: string;
-    /** Actionable next steps, most-likely-fix first. */
-    suggestions: string[];
-}
-/** Map raw git stderr (or the stash-conflict sentinel) to a coarse reason. */
-export declare function classifySyncError(raw: string | undefined): SyncErrorReason;
-/** Build a full, user-facing diagnosis from the raw git stderr. */
-export declare function diagnoseSyncError(raw: string | undefined): SyncErrorDiagnosis;

package/dist/git/classify-sync-error.js

@@ -1,111 +0,0 @@
-/**
- * The sentinel `syncWithRemote` returns when a stash pop conflicts after an
- * otherwise-successful fetch/rebase. Routed through the classifier so the
- * diagnosis stays in one place.
- */
-const STASH_CONFLICT = 'stash-conflict';
-/** Map raw git stderr (or the stash-conflict sentinel) to a coarse reason. */
-export function classifySyncError(raw) {
-    if (!raw)
-        return 'unknown';
-    const s = raw.toLowerCase();
-    if (raw === STASH_CONFLICT)
-        return 'conflict';
-    // Missing/!misnamed remote. A plain `git clone` names the remote `origin`,
-    // so `git fetch runwork` fails with this before auth ever matters.
-    if (s.includes('does not appear to be a git repository') ||
-        s.includes("'runwork' does not appear") ||
-        s.includes('no such remote') ||
-        (s.includes('remote') && s.includes('not found'))) {
-        return 'no-remote';
-    }
-    // Authentication / authorization.
-    if (s.includes('authentication failed') ||
-        s.includes('could not read username') ||
-        s.includes('could not read password') ||
-        s.includes('terminal prompts disabled') ||
-        s.includes('permission denied') ||
-        s.includes('error: 403') ||
-        s.includes('error: 401') ||
-        s.includes('http basic: access denied') ||
-        s.includes('invalid username or password')) {
-        return 'auth';
-    }
-    // Network / connectivity.
-    if (s.includes('could not resolve host') ||
-        s.includes('failed to connect') ||
-        s.includes("couldn't connect to server") ||
-        s.includes('connection timed out') ||
-        s.includes('operation timed out') ||
-        s.includes('network is unreachable') ||
-        s.includes('temporary failure in name resolution')) {
-        return 'network';
-    }
-    // Merge/rebase conflicts.
-    if (s.includes('conflict') ||
-        s.includes('needs merge') ||
-        s.includes('automatic merge failed') ||
-        s.includes('patch failed')) {
-        return 'conflict';
-    }
-    return 'unknown';
-}
-/** Build a full, user-facing diagnosis from the raw git stderr. */
-export function diagnoseSyncError(raw) {
-    const reason = classifySyncError(raw);
-    switch (reason) {
-        case 'no-remote':
-            return {
-                reason,
-                message: "git remote 'runwork' is missing or misconfigured",
-                diagnosis: "The sync targets a remote named 'runwork', but it doesn't exist in this repository (a plain `git clone` names the remote 'origin').",
-                suggestions: [
-                    'Run `runwork doctor --fix` to add/repair the runwork remote',
-                    'Or add it manually: `git remote add runwork <app git URL>`',
-                ],
-            };
-        case 'auth':
-            return {
-                reason,
-                message: 'git could not authenticate to the runwork remote',
-                diagnosis: 'The runwork git credential helper is not registered (or the stored credentials were rejected), so git could not authenticate.',
-                suggestions: [
-                    'Run `runwork doctor --fix` to register the git credential helper',
-                    'If it persists, re-authenticate with `runwork login`',
-                ],
-            };
-        case 'network':
-            return {
-                reason,
-                message: 'network error while syncing with the runwork remote',
-                diagnosis: 'git could not reach the runwork host. This is usually a connectivity or DNS issue.',
-                suggestions: [
-                    'Check your network connection',
-                    'Confirm outbound access to runwork.ai, then run `runwork dev` again',
-                ],
-            };
-        case 'conflict':
-            return {
-                reason,
-                message: raw === STASH_CONFLICT
-                    ? 'merge conflicts after restoring local changes'
-                    : 'merge conflicts while syncing with the remote',
-                diagnosis: 'Local changes could not be automatically merged with the remote state; the conflict needs manual resolution.',
-                suggestions: [
-                    'Resolve the conflicts in the affected files (`git status` lists them)',
-                    'Run `git add` on resolved files, then `git commit`',
-                    'Run `runwork dev` again after resolving',
-                ],
-            };
-        default:
-            return {
-                reason,
-                message: raw || 'file sync failed',
-                diagnosis: 'Could not sync files to the sandbox.',
-                suggestions: [
-                    'Run `runwork doctor` to diagnose environment issues',
-                    'Run `runwork dev` again to start a fresh session',
-                ],
-            };
-    }
-}

package/dist/git/credentials.d.ts

@@ -1,75 +0,0 @@
-/**
- * Build the value we hand to `git config credential.<origin>.helper`.
- *
- * Git invokes credential helpers via its bash shell (Git Bash on Windows,
- * /bin/sh elsewhere). A leading `!` tells git to treat the value as a raw
- * shell command. We embed the absolute path of the *currently running*
- * runwork binary so the helper invocation never depends on PATH at the
- * moment git happens to call it -- which used to be a real failure mode
- * on Windows when runwork.exe sits in `~/.runwork/bin` and that directory
- * isn't picked up by git's bash subshell.
- *
- * The path is wrapped in quotes (handles spaces in install paths) and on
- * Windows we normalise backslashes to forward slashes -- bash on Windows
- * accepts both, but forward slashes avoid escaping issues in the .gitconfig
- * file itself.
- */
-export declare function buildHelperValue(execPath: string): string;
-/**
- * Configure git to use the runwork credential helper for our remote.
- * Called by `runwork login` and `runwork init`.
- */
-export declare function configureGitCredentials(remoteUrl: string): Promise<void>;
-/**
- * Result of looking up the git credential helper registered for a given
- * origin in the user's global git config. Shared by `runwork doctor`
- * (reporting) and the lazy-ensure path (clone/dev/deploy) so the detection
- * logic never drifts between the two.
- */
-export type CredentialHelperLookup = {
-    status: 'none';
-} | {
-    status: 'unscoped';
-    otherCount: number;
-} | {
-    status: 'registered';
-    value: string;
-};
-/**
- * Read the git credential helper (if any) registered for `origin` in the
- * global git config. Mirrors the scoped lookup `runwork doctor` performs: an
- * entry only counts when its scope matches the user's baseUrl origin, so a
- * stale staging origin from a previous login doesn't mask a missing entry.
- */
-export declare function lookupCredentialHelper(origin: string): CredentialHelperLookup;
-/**
- * Inspect the binary a credential-helper value points at. Only absolute-path
- * helper values (`!"/abs/path" git-credential-helper`) can be validated on
- * disk; PATH-relative entries are trusted to resolve at git-invocation time
- * (reported `ok` with a null path). Shared so the doctor check and the
- * lazy-ensure path agree on what "stale" means.
- */
-export declare function helperBinaryStatus(value: string): {
-    ok: boolean;
-    path: string | null;
-};
-/**
- * Idempotently make sure the runwork git credential helper is registered for
- * the given baseUrl's origin -- registering it when absent, or repairing it
- * when it points at a binary that no longer exists (e.g. after the CLI moved
- * on upgrade). This is the bridge that lets headless auth paths -- the
- * `get_cli_setup` MCP tool or a hand-written `~/.runwork/.credentials` --
- * work with git without a separate `runwork login`. Safe (and cheap) to call
- * before every git operation in clone/dev/deploy.
- */
-export declare function ensureGitCredentialHelper(baseUrl: string): Promise<void>;
-/**
- * Remove the git credential helper configuration for our remote.
- */
-export declare function removeGitCredentials(baseUrl: string): Promise<void>;
-/**
- * Git credential helper protocol handler.
- * Git calls: runwork git-credential-helper get
- * We read stdin for host/protocol, write username/password to stdout.
- */
-export declare function handleGitCredentialRequest(action: string): Promise<void>;

package/dist/git/credentials.js

@@ -1,164 +0,0 @@
-import { existsSync } from 'fs';
-import { execFileSync } from '../utils/subprocess.js';
-import { getCredentials } from '../auth/store.js';
-/**
- * Build the value we hand to `git config credential.<origin>.helper`.
- *
- * Git invokes credential helpers via its bash shell (Git Bash on Windows,
- * /bin/sh elsewhere). A leading `!` tells git to treat the value as a raw
- * shell command. We embed the absolute path of the *currently running*
- * runwork binary so the helper invocation never depends on PATH at the
- * moment git happens to call it -- which used to be a real failure mode
- * on Windows when runwork.exe sits in `~/.runwork/bin` and that directory
- * isn't picked up by git's bash subshell.
- *
- * The path is wrapped in quotes (handles spaces in install paths) and on
- * Windows we normalise backslashes to forward slashes -- bash on Windows
- * accepts both, but forward slashes avoid escaping issues in the .gitconfig
- * file itself.
- */
-export function buildHelperValue(execPath) {
-    const normalised = execPath.replace(/\\/g, '/');
-    return `!"${normalised}" git-credential-helper`;
-}
-/**
- * Configure git to use the runwork credential helper for our remote.
- * Called by `runwork login` and `runwork init`.
- */
-export async function configureGitCredentials(remoteUrl) {
-    const origin = new URL(remoteUrl).origin;
-    const helperValue = buildHelperValue(process.execPath);
-    try {
-        execFileSync('git', [
-            'config', '--global',
-            `credential.${origin}.helper`,
-            helperValue,
-        ], { stdio: 'pipe' });
-    }
-    catch (err) {
-        const code = err?.code;
-        if (code === 'ENOENT') {
-            console.warn('Note: git is not installed. Skipping git credential helper setup.');
-            console.warn('Install git before running `runwork init`, `clone`, `dev`, or `deploy`.');
-            return;
-        }
-        throw err;
-    }
-}
-/**
- * Read the git credential helper (if any) registered for `origin` in the
- * global git config. Mirrors the scoped lookup `runwork doctor` performs: an
- * entry only counts when its scope matches the user's baseUrl origin, so a
- * stale staging origin from a previous login doesn't mask a missing entry.
- */
-export function lookupCredentialHelper(origin) {
-    // `--get-regexp` exits 1 (printing nothing) when no entry matches, which
-    // surfaces here as a thrown error -- a normal "not registered" signal.
-    let helperConfig;
-    try {
-        const buf = execFileSync('git', ['config', '--global', '--get-regexp', 'credential\\..*runwork.*\\.helper'], { stdio: ['ignore', 'pipe', 'ignore'] });
-        helperConfig = buf.toString();
-    }
-    catch {
-        return { status: 'none' };
-    }
-    const lines = helperConfig.split(/\r?\n/).map(l => l.trim()).filter(Boolean);
-    const escapedOrigin = origin.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    const scopedRegex = new RegExp(`^credential\\.${escapedOrigin}\\.helper\\s+(.+)$`);
-    const matchedLine = lines.find(line => scopedRegex.test(line));
-    if (!matchedLine) {
-        return { status: 'unscoped', otherCount: lines.length };
-    }
-    return { status: 'registered', value: scopedRegex.exec(matchedLine)?.[1] ?? '' };
-}
-/**
- * Inspect the binary a credential-helper value points at. Only absolute-path
- * helper values (`!"/abs/path" git-credential-helper`) can be validated on
- * disk; PATH-relative entries are trusted to resolve at git-invocation time
- * (reported `ok` with a null path). Shared so the doctor check and the
- * lazy-ensure path agree on what "stale" means.
- */
-export function helperBinaryStatus(value) {
-    const absoluteHelperRegex = /^!"?(\/|[A-Za-z]:[\\/])/;
-    if (!absoluteHelperRegex.test(value))
-        return { ok: true, path: null };
-    const pathMatch = value.match(/^!"([^"]+)"|^!(\S+)/);
-    const helperPath = pathMatch?.[1] ?? pathMatch?.[2] ?? '';
-    if (!helperPath)
-        return { ok: true, path: null };
-    return { ok: existsSync(helperPath), path: helperPath };
-}
-/**
- * Idempotently make sure the runwork git credential helper is registered for
- * the given baseUrl's origin -- registering it when absent, or repairing it
- * when it points at a binary that no longer exists (e.g. after the CLI moved
- * on upgrade). This is the bridge that lets headless auth paths -- the
- * `get_cli_setup` MCP tool or a hand-written `~/.runwork/.credentials` --
- * work with git without a separate `runwork login`. Safe (and cheap) to call
- * before every git operation in clone/dev/deploy.
- */
-export async function ensureGitCredentialHelper(baseUrl) {
-    let origin;
-    try {
-        origin = new URL(baseUrl).origin;
-    }
-    catch {
-        return; // Unparseable baseUrl -- nothing actionable.
-    }
-    const lookup = lookupCredentialHelper(origin);
-    if (lookup.status === 'registered' && helperBinaryStatus(lookup.value).ok) {
-        return; // Already registered and valid -- no-op.
-    }
-    await configureGitCredentials(baseUrl);
-}
-/**
- * Remove the git credential helper configuration for our remote.
- */
-export async function removeGitCredentials(baseUrl) {
-    const origin = new URL(baseUrl).origin;
-    try {
-        execFileSync('git', [
-            'config', '--global', '--unset',
-            `credential.${origin}.helper`,
-        ], { stdio: 'pipe' });
-    }
-    catch {
-        // Ignore errors if the config key doesn't exist
-    }
-}
-/**
- * Git credential helper protocol handler.
- * Git calls: runwork git-credential-helper get
- * We read stdin for host/protocol, write username/password to stdout.
- */
-export async function handleGitCredentialRequest(action) {
-    if (action !== 'get') {
-        return; // Only 'get' needs handling. 'store' and 'erase' are no-ops.
-    }
-    const input = await readStdin();
-    const lines = input.trim().split('\n');
-    const params = {};
-    for (const line of lines) {
-        const [key, value] = line.split('=', 2);
-        if (key && value)
-            params[key] = value;
-    }
-    const creds = getCredentials();
-    if (!creds) {
-        process.exit(1);
-    }
-    process.stdout.write(`protocol=${params.protocol || 'https'}\n`);
-    process.stdout.write(`host=${params.host}\n`);
-    process.stdout.write(`username=runwork\n`);
-    process.stdout.write(`password=${creds.apiKey}\n`);
-}
-function readStdin() {
-    return new Promise((resolve) => {
-        let data = '';
-        process.stdin.setEncoding('utf8');
-        process.stdin.on('data', (chunk) => { data += chunk; });
-        process.stdin.on('end', () => resolve(data));
-        if (process.stdin.readableEnded)
-            resolve(data);
-    });
-}