vexi-cli 0.5.4 → 0.8.0

package/dist/endpoint.js

@@ -0,0 +1,174 @@
+/**
+ * URL-based provider identification and model discovery.
+ *
+ * The user pastes an endpoint URL (e.g. https://openrouter.ai/api/v1).
+ * identifyFromUrl() inspects the hostname and path to determine which
+ * provider it is and how to authenticate. discoverModels() then calls
+ * the /models endpoint to get the live model list.
+ */
+const OPERATION_SUFFIXES = [
+    '/chat/completions',
+    '/completions',
+    '/models',
+    '/messages',
+];
+/** Strip trailing slashes and known operation path suffixes so the user can
+ *  paste a full URL (e.g. .../chat/completions) and still get the API root. */
+function normalizeBase(rawUrl) {
+    let url = rawUrl.trim().replace(/\/+$/, '');
+    for (const suffix of OPERATION_SUFFIXES) {
+        if (url.endsWith(suffix)) {
+            url = url.slice(0, url.length - suffix.length);
+            break;
+        }
+    }
+    return url;
+}
+function isPrivateIp(host) {
+    return (host === 'localhost' ||
+        host === '127.0.0.1' ||
+        host.endsWith('.local') ||
+        /^192\.168\.\d{1,3}\.\d{1,3}$/.test(host) ||
+        /^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host));
+}
+/**
+ * Identify the provider from a raw endpoint URL.
+ * Returns a UrlIdentity describing the provider, normalized base URL,
+ * API shape, and where to discover models.
+ */
+export function identifyFromUrl(rawUrl) {
+    const baseUrl = normalizeBase(rawUrl);
+    let parsed;
+    try {
+        parsed = new URL(baseUrl);
+    }
+    catch {
+        throw new Error(`Invalid URL: ${rawUrl}`);
+    }
+    const host = parsed.hostname.toLowerCase();
+    const path = parsed.pathname;
+    // OpenRouter
+    if (host === 'openrouter.ai') {
+        return {
+            provider: 'openrouter',
+            displayName: 'OpenRouter',
+            baseUrl,
+            apiShape: 'openai',
+            modelsUrl: `${baseUrl}/models`,
+        };
+    }
+    // Z.ai
+    if (host.endsWith('z.ai')) {
+        const displayName = path.toLowerCase().includes('/coding/') ? 'Z.ai (Coding Plan)' : 'Z.ai';
+        return {
+            provider: 'zai',
+            displayName,
+            baseUrl,
+            apiShape: 'openai',
+            modelsUrl: `${baseUrl}/models`,
+        };
+    }
+    // Groq
+    if (host.endsWith('groq.com')) {
+        return {
+            provider: 'groq',
+            displayName: 'Groq',
+            baseUrl,
+            apiShape: 'openai',
+            modelsUrl: `${baseUrl}/models`,
+        };
+    }
+    // OpenAI
+    if (host === 'api.openai.com') {
+        return {
+            provider: 'openai',
+            displayName: 'OpenAI',
+            baseUrl,
+            apiShape: 'openai',
+            modelsUrl: `${baseUrl}/models`,
+        };
+    }
+    // Anthropic
+    if (host === 'api.anthropic.com') {
+        return {
+            provider: 'anthropic',
+            displayName: 'Anthropic',
+            baseUrl,
+            apiShape: 'anthropic',
+            modelsUrl: `${baseUrl}/models`,
+        };
+    }
+    // Google Gemini
+    if (host.endsWith('generativelanguage.googleapis.com')) {
+        return {
+            provider: 'gemini',
+            displayName: 'Google Gemini',
+            baseUrl,
+            apiShape: 'openai',
+            modelsUrl: `${baseUrl}/models`,
+        };
+    }
+    // Cloudflare Workers AI -- model is embedded in the path after /ai/run/
+    if (host.endsWith('api.cloudflare.com') && path.includes('/ai/run/')) {
+        const aiRunStart = path.indexOf('/ai/run/') + '/ai/run/'.length;
+        let modelFromPath = path.slice(aiRunStart);
+        if (modelFromPath.startsWith('@cf/')) {
+            modelFromPath = modelFromPath.slice('@cf/'.length);
+        }
+        // baseUrl is the account endpoint up to /ai/run (without the model)
+        const cfBase = `${parsed.protocol}//${parsed.host}${path.slice(0, aiRunStart - 1)}`;
+        return {
+            provider: 'cloudflare',
+            displayName: 'Cloudflare Workers AI',
+            baseUrl: cfBase,
+            apiShape: 'openai',
+            modelsUrl: null,
+            modelFromPath: modelFromPath || undefined,
+        };
+    }
+    // Local / private LAN servers (Ollama, LM Studio, vLLM, etc.)
+    if (isPrivateIp(host)) {
+        return {
+            provider: 'local',
+            displayName: 'Local (OpenAI-compatible)',
+            baseUrl,
+            apiShape: 'openai',
+            modelsUrl: `${baseUrl}/models`,
+        };
+    }
+    // Unknown / custom endpoint -- assume OpenAI-compatible
+    return {
+        provider: 'custom',
+        displayName: `Custom (${host})`,
+        baseUrl,
+        apiShape: 'openai',
+        modelsUrl: `${baseUrl}/models`,
+    };
+}
+/**
+ * Discover the available models for a given endpoint.
+ *
+ * If the URL embeds the model (Cloudflare), returns that model directly.
+ * If modelsUrl is null, returns an empty array.
+ * Otherwise calls GET /models and maps the response to a list of id strings.
+ *
+ * Accepts an optional fetchFn for testability (defaults to globalThis.fetch).
+ */
+export async function discoverModels(identity, apiKey, fetchFn = globalThis.fetch) {
+    if (identity.modelFromPath) {
+        return [identity.modelFromPath];
+    }
+    if (!identity.modelsUrl) {
+        return [];
+    }
+    const headers = identity.apiShape === 'anthropic'
+        ? { 'x-api-key': apiKey, 'anthropic-version': '2023-06-01' }
+        : { Authorization: `Bearer ${apiKey}` };
+    const res = await fetchFn(identity.modelsUrl, { headers });
+    if (!res.ok) {
+        throw new Error(`Provider identified as "${identity.displayName}" but GET /models returned HTTP ${res.status}. ` +
+            `Enter the model ID manually.`);
+    }
+    const json = (await res.json());
+    return (json.data ?? []).map((m) => m.id).filter(Boolean);
+}

package/dist/endpoint.test.js

@@ -0,0 +1,146 @@
+import { describe, it, expect, vi } from 'vitest';
+import { identifyFromUrl, discoverModels } from './endpoint.js';
+// ── identifyFromUrl ──────────────────────────────────────────────────────────
+describe('identifyFromUrl', () => {
+    it('identifies OpenRouter', () => {
+        const id = identifyFromUrl('https://openrouter.ai/api/v1');
+        expect(id.provider).toBe('openrouter');
+        expect(id.displayName).toBe('OpenRouter');
+        expect(id.baseUrl).toBe('https://openrouter.ai/api/v1');
+        expect(id.apiShape).toBe('openai');
+        expect(id.modelsUrl).toBe('https://openrouter.ai/api/v1/models');
+    });
+    it('strips /chat/completions suffix', () => {
+        const id = identifyFromUrl('https://openrouter.ai/api/v1/chat/completions');
+        expect(id.baseUrl).toBe('https://openrouter.ai/api/v1');
+    });
+    it('strips trailing slash', () => {
+        const id = identifyFromUrl('https://openrouter.ai/api/v1/');
+        expect(id.baseUrl).toBe('https://openrouter.ai/api/v1');
+    });
+    it('identifies Z.ai coding plan', () => {
+        const id = identifyFromUrl('https://api.z.ai/coding/v1');
+        expect(id.provider).toBe('zai');
+        expect(id.displayName).toBe('Z.ai (Coding Plan)');
+        expect(id.apiShape).toBe('openai');
+    });
+    it('identifies Z.ai generic', () => {
+        const id = identifyFromUrl('https://api.z.ai/v1');
+        expect(id.provider).toBe('zai');
+        expect(id.displayName).toBe('Z.ai');
+    });
+    it('identifies Anthropic', () => {
+        const id = identifyFromUrl('https://api.anthropic.com/v1');
+        expect(id.provider).toBe('anthropic');
+        expect(id.apiShape).toBe('anthropic');
+        expect(id.modelsUrl).toBe('https://api.anthropic.com/v1/models');
+    });
+    it('identifies OpenAI', () => {
+        const id = identifyFromUrl('https://api.openai.com/v1');
+        expect(id.provider).toBe('openai');
+        expect(id.apiShape).toBe('openai');
+    });
+    it('identifies Groq', () => {
+        const id = identifyFromUrl('https://api.groq.com/openai/v1');
+        expect(id.provider).toBe('groq');
+        expect(id.displayName).toBe('Groq');
+    });
+    it('identifies localhost as local', () => {
+        const id = identifyFromUrl('http://localhost:11434/v1');
+        expect(id.provider).toBe('local');
+        expect(id.displayName).toBe('Local (OpenAI-compatible)');
+        expect(id.modelsUrl).toBe('http://localhost:11434/v1/models');
+    });
+    it('identifies 192.168.x.x as local', () => {
+        const id = identifyFromUrl('http://192.168.1.100:8080/v1');
+        expect(id.provider).toBe('local');
+    });
+    it('identifies Cloudflare and extracts model from path', () => {
+        const id = identifyFromUrl('https://api.cloudflare.com/client/v4/accounts/abc123/ai/run/@cf/meta/llama-3.1-8b');
+        expect(id.provider).toBe('cloudflare');
+        expect(id.displayName).toBe('Cloudflare Workers AI');
+        expect(id.modelsUrl).toBeNull();
+        expect(id.modelFromPath).toBe('meta/llama-3.1-8b');
+    });
+    it('classifies unknown public host as custom', () => {
+        const id = identifyFromUrl('https://my-proxy.example.com/v1');
+        expect(id.provider).toBe('custom');
+        expect(id.displayName).toContain('my-proxy.example.com');
+        expect(id.apiShape).toBe('openai');
+    });
+    it('throws on invalid URL', () => {
+        expect(() => identifyFromUrl('not-a-url')).toThrow('Invalid URL');
+    });
+});
+// ── discoverModels ────────────────────────────────────────────────────────────
+describe('discoverModels', () => {
+    it('returns modelFromPath directly without fetching', async () => {
+        const identity = {
+            provider: 'cloudflare',
+            displayName: 'Cloudflare Workers AI',
+            baseUrl: 'https://api.cloudflare.com/client/v4/accounts/abc/ai/run',
+            apiShape: 'openai',
+            modelsUrl: null,
+            modelFromPath: 'meta/llama-3.1-8b',
+        };
+        const fetchFn = vi.fn();
+        const models = await discoverModels(identity, 'key', fetchFn);
+        expect(models).toEqual(['meta/llama-3.1-8b']);
+        expect(fetchFn).not.toHaveBeenCalled();
+    });
+    it('returns empty array when modelsUrl is null and no modelFromPath', async () => {
+        const identity = {
+            provider: 'custom',
+            displayName: 'Custom',
+            baseUrl: 'https://example.com',
+            apiShape: 'openai',
+            modelsUrl: null,
+        };
+        const models = await discoverModels(identity, 'key', vi.fn());
+        expect(models).toEqual([]);
+    });
+    it('fetches /models and maps response data to ids', async () => {
+        const identity = {
+            provider: 'openrouter',
+            displayName: 'OpenRouter',
+            baseUrl: 'https://openrouter.ai/api/v1',
+            apiShape: 'openai',
+            modelsUrl: 'https://openrouter.ai/api/v1/models',
+        };
+        const mockFetch = vi.fn().mockResolvedValue({
+            ok: true,
+            json: async () => ({ data: [{ id: 'openai/gpt-4o' }, { id: 'anthropic/claude-3.5-sonnet' }] }),
+        });
+        const models = await discoverModels(identity, 'sk-test', mockFetch);
+        expect(models).toEqual(['openai/gpt-4o', 'anthropic/claude-3.5-sonnet']);
+        expect(mockFetch).toHaveBeenCalledWith('https://openrouter.ai/api/v1/models', expect.objectContaining({ headers: expect.objectContaining({ Authorization: 'Bearer sk-test' }) }));
+    });
+    it('uses x-api-key header for Anthropic shape', async () => {
+        const identity = {
+            provider: 'anthropic',
+            displayName: 'Anthropic',
+            baseUrl: 'https://api.anthropic.com/v1',
+            apiShape: 'anthropic',
+            modelsUrl: 'https://api.anthropic.com/v1/models',
+        };
+        const mockFetch = vi.fn().mockResolvedValue({
+            ok: true,
+            json: async () => ({ data: [{ id: 'claude-3-5-sonnet-20241022' }] }),
+        });
+        await discoverModels(identity, 'sk-ant-test', mockFetch);
+        expect(mockFetch).toHaveBeenCalledWith(expect.any(String), expect.objectContaining({
+            headers: expect.objectContaining({ 'x-api-key': 'sk-ant-test' }),
+        }));
+    });
+    it('throws when /models returns non-OK status', async () => {
+        const identity = {
+            provider: 'groq',
+            displayName: 'Groq',
+            baseUrl: 'https://api.groq.com/openai/v1',
+            apiShape: 'openai',
+            modelsUrl: 'https://api.groq.com/openai/v1/models',
+        };
+        const mockFetch = vi.fn().mockResolvedValue({ ok: false, status: 401 });
+        await expect(discoverModels(identity, 'bad-key', mockFetch)).rejects.toThrow('HTTP 401');
+    });
+});

package/dist/git/index.js

@@ -0,0 +1,142 @@
+/**
+ * Git push workflow for the /push slash command.
+ *
+ * Design: fully injected — run, confirm, and provider are passed in so the
+ * module is testable without touching real git, the filesystem, or the network.
+ * All user-facing output goes through the injected log function.
+ * Every mutating git command is gated behind an explicit confirm call.
+ */
+/** Wrap a string in single quotes, escaping embedded single quotes. */
+function shellQuote(s) {
+    return "'" + s.replace(/'/g, "'\\''") + "'";
+}
+const AUTH_SIGNATURES = [
+    'could not read',
+    'authentication failed',
+    'permission denied',
+    'terminal prompts disabled',
+    'host key verification',
+    'batch mode',
+];
+function isAuthError(combined) {
+    const lower = combined.toLowerCase();
+    return AUTH_SIGNATURES.some((sig) => lower.includes(sig));
+}
+export async function gitPush(opts) {
+    const log = opts.log ?? ((l) => console.log(l));
+    const { cwd, run, confirm, provider } = opts;
+    // ── 1. Repo check ────────────────────────────────────────────────────────
+    const repoCheck = await run('git rev-parse --is-inside-work-tree', cwd);
+    if (repoCheck.code !== 0) {
+        log('Not a git repository. Initialize one with:');
+        log('  git init && git remote add origin <your-repo-url>');
+        return { ok: false, reason: 'not-a-repo' };
+    }
+    // ── 2. Remote check ──────────────────────────────────────────────────────
+    const remoteResult = await run('git remote', cwd);
+    if (!remoteResult.stdout.trim()) {
+        log('No git remote configured. Add one with:');
+        log('  git remote add origin <your-repo-url>');
+        return { ok: false, reason: 'no-remote' };
+    }
+    // ── 3. Resolve branch ────────────────────────────────────────────────────
+    const branch = opts.branch ?? (await run('git rev-parse --abbrev-ref HEAD', cwd)).stdout.trim();
+    if (!branch || branch === 'HEAD') {
+        log('Cannot determine current branch (detached HEAD?). Checkout a named branch first.');
+        return { ok: false, reason: 'aborted', detail: 'detached HEAD' };
+    }
+    // ── 4. Inspect working state ─────────────────────────────────────────────
+    const statusResult = await run('git status --porcelain', cwd);
+    // Preserve leading chars (XY status columns) — do NOT trim() the full output.
+    const statusLines = statusResult.stdout.split('\n').filter((l) => l.trim().length > 0);
+    const diffStat = (await run('git diff --stat HEAD', cwd)).stdout.trim();
+    if (diffStat)
+        log(diffStat);
+    // ── 5. Stage + commit (skipped when pushOnly) ─────────────────────────────
+    if (!opts.pushOnly) {
+        if (statusLines.length > 0) {
+            // Porcelain format: XY<space>filename — Y != ' ' means unstaged/untracked
+            const needsAdd = statusLines.some((l) => l.length >= 2 && l[1] !== ' ');
+            if (needsAdd) {
+                const addOk = await confirm('Stage all changes? (git add -A)');
+                if (!addOk)
+                    return { ok: false, reason: 'aborted' };
+                await run('git add -A', cwd);
+            }
+            // Draft or use the provided commit message
+            let commitMsg = opts.message ?? '';
+            if (!commitMsg) {
+                const stagedDiff = (await run('git diff --staged', cwd)).stdout;
+                const trimmedDiff = stagedDiff.slice(0, 6000);
+                const userContent = 'Write a single-line Conventional Commits message (type(scope): description) ' +
+                    'for the following diff. Reply with ONLY the commit message — no explanation, ' +
+                    'no markdown fences, no backticks.\n\n' +
+                    (trimmedDiff || '(no staged diff available)');
+                const messages = [
+                    { role: 'system', content: 'You draft git commit messages. Reply with only the message.' },
+                    { role: 'user', content: userContent },
+                ];
+                try {
+                    const raw = await provider.stream(messages, () => { });
+                    commitMsg = raw.replace(/`/g, '').split('\n')[0]?.trim() ?? '';
+                }
+                catch {
+                    // fall through to default below
+                }
+                if (!commitMsg)
+                    commitMsg = 'chore: update files';
+            }
+            log(`Proposed commit message: ${commitMsg}`);
+            const commitOk = await confirm(`Commit with: "${commitMsg}"?`);
+            if (!commitOk)
+                return { ok: false, reason: 'aborted' };
+            const commitResult = await run(`git commit -m ${shellQuote(commitMsg)}`, cwd);
+            if (commitResult.code !== 0) {
+                log(`Commit failed:\n${commitResult.stderr.trim()}`);
+                return { ok: false, reason: 'push-failed', detail: commitResult.stderr };
+            }
+        }
+        else {
+            // Nothing staged or unstaged — check for already-committed unpushed work
+            const logResult = await run('git log @{u}..HEAD --oneline', cwd);
+            if (logResult.code === 0 && !logResult.stdout.trim()) {
+                log('Nothing to commit and already up to date with remote.');
+                return { ok: false, reason: 'nothing-to-do' };
+            }
+            if (logResult.stdout.trim()) {
+                log(`Unpushed commits:\n${logResult.stdout.trim()}`);
+            }
+            // code !== 0 means no upstream yet — proceed, the push step will set -u
+        }
+    }
+    // ── 6. Auth pre-flight ───────────────────────────────────────────────────
+    const safeBranch = shellQuote(branch);
+    // Disable terminal prompts so git never hangs waiting for input.
+    // On Windows, Git for Windows respects GIT_TERMINAL_PROMPT via its own env.
+    const dryRunCmd = process.platform === 'win32'
+        ? `git -c core.askPass= push --dry-run origin ${safeBranch}`
+        : `GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND='ssh -o BatchMode=yes' git -c core.askPass= push --dry-run origin ${safeBranch}`;
+    const dryResult = await run(dryRunCmd, cwd);
+    if (dryResult.code !== 0 && isAuthError(dryResult.stderr + dryResult.stdout)) {
+        log('Authentication failed. Set up git credentials:');
+        log('  • SSH key: https://docs.github.com/authentication/connecting-to-github-with-ssh');
+        log('  • HTTPS token: personal access token or git credential helper.');
+        return { ok: false, reason: 'auth-failed', detail: dryResult.stderr };
+    }
+    // ── 7. Push ──────────────────────────────────────────────────────────────
+    const upstreamResult = await run(`git rev-parse --abbrev-ref --symbolic-full-name ${shellQuote(`${branch}@{upstream}`)}`, cwd);
+    const hasUpstream = upstreamResult.code === 0 && upstreamResult.stdout.trim().length > 0;
+    const pushCmd = hasUpstream
+        ? `git push origin ${safeBranch}`
+        : `git push -u origin ${safeBranch}`;
+    const pushOk = await confirm(`Run: ${pushCmd}?`);
+    if (!pushOk)
+        return { ok: false, reason: 'aborted' };
+    const pushResult = await run(pushCmd, cwd);
+    if (pushResult.code !== 0) {
+        log(`Push failed:\n${pushResult.stderr.trim()}`);
+        return { ok: false, reason: 'push-failed', detail: pushResult.stderr };
+    }
+    log(`Pushed ${branch} to origin.`);
+    return { ok: true };
+}

package/dist/git/index.test.js

@@ -0,0 +1,178 @@
+import { describe, it, expect } from 'vitest';
+import { gitPush } from './index.js';
+/** Build a mock `run` that returns canned results matched by command substring. */
+function makeRun(specs = []) {
+    const calls = [];
+    const run = async (cmd, _cwd) => {
+        calls.push(cmd);
+        for (const spec of specs) {
+            if (cmd.includes(spec.match))
+                return spec.out;
+        }
+        return { stdout: '', stderr: '', code: 0 };
+    };
+    return { run, calls };
+}
+/** Build a mock `confirm` that returns scripted booleans in sequence. */
+function makeConfirm(answers = []) {
+    const calls = [];
+    let i = 0;
+    const confirm = async (msg) => {
+        calls.push(msg);
+        return answers[i++] ?? true;
+    };
+    return { confirm, calls };
+}
+const MOCK_PROVIDER = {
+    id: 'openai',
+    model: 'gpt-4o',
+    stream: async () => 'feat: add new feature',
+};
+const OK = { stdout: '', stderr: '', code: 0 };
+/** Specs shared by all happy-path scenarios. */
+function happySpecs(branch = 'main', opts = {}) {
+    return [
+        { match: '--is-inside-work-tree', out: { stdout: 'true\n', stderr: '', code: 0 } },
+        { match: 'git remote', out: { stdout: 'origin\n', stderr: '', code: 0 } },
+        { match: '--abbrev-ref HEAD', out: { stdout: `${branch}\n`, stderr: '', code: 0 } },
+        { match: 'status --porcelain', out: OK },
+        { match: 'diff --stat HEAD', out: OK },
+        { match: 'push --dry-run', out: OK }, // must come before 'push origin'
+        {
+            match: '--symbolic-full-name',
+            out: opts.upstreamExists === false
+                ? { stdout: '', stderr: 'fatal: no upstream configured', code: 128 }
+                : { stdout: `origin/${branch}\n`, stderr: '', code: 0 },
+        },
+        { match: 'push origin', out: OK },
+        { match: 'push -u', out: OK },
+    ];
+}
+// ── Test cases ────────────────────────────────────────────────────────────────
+describe('gitPush', () => {
+    // 1. Not a git repo
+    it('returns not-a-repo and runs no mutating commands', async () => {
+        const { run, calls } = makeRun([
+            { match: '--is-inside-work-tree', out: { stdout: '', stderr: '', code: 128 } },
+        ]);
+        const { confirm } = makeConfirm();
+        const logs = [];
+        const result = await gitPush({
+            cwd: '/proj', run, confirm, provider: MOCK_PROVIDER,
+            log: (l) => logs.push(l),
+        });
+        expect(result).toEqual({ ok: false, reason: 'not-a-repo' });
+        expect(calls.some((c) => c.includes('git add'))).toBe(false);
+        expect(calls.some((c) => c.includes('git commit'))).toBe(false);
+        expect(calls.some((c) => c.includes('git push'))).toBe(false);
+        expect(logs.some((l) => l.includes('git init'))).toBe(true);
+    });
+    // 2. No remote configured
+    it('returns no-remote and nothing is pushed', async () => {
+        const { run, calls } = makeRun([
+            { match: '--is-inside-work-tree', out: { stdout: 'true\n', stderr: '', code: 0 } },
+            { match: 'git remote', out: { stdout: '', stderr: '', code: 0 } },
+        ]);
+        const { confirm } = makeConfirm();
+        const result = await gitPush({
+            cwd: '/proj', run, confirm, provider: MOCK_PROVIDER,
+        });
+        expect(result).toEqual({ ok: false, reason: 'no-remote' });
+        expect(calls.some((c) => c.includes('git push'))).toBe(false);
+    });
+    // 3. Auth pre-flight fails → real push is NEVER run
+    it('returns auth-failed when dry-run shows an auth-signature error', async () => {
+        const { run, calls } = makeRun([
+            { match: '--is-inside-work-tree', out: { stdout: 'true\n', stderr: '', code: 0 } },
+            { match: 'git remote', out: { stdout: 'origin\n', stderr: '', code: 0 } },
+            { match: '--abbrev-ref HEAD', out: { stdout: 'main\n', stderr: '', code: 0 } },
+            { match: 'status --porcelain', out: OK },
+            { match: 'diff --stat HEAD', out: OK },
+            // dry-run fails with auth-signature stderr
+            {
+                match: 'push --dry-run',
+                out: { stdout: '', stderr: 'could not read Username for remote: terminal prompts disabled', code: 1 },
+            },
+        ]);
+        const { confirm } = makeConfirm([true]); // any confirms before push would be true
+        const result = await gitPush({
+            cwd: '/proj', run, confirm, provider: MOCK_PROVIDER, pushOnly: true,
+        });
+        expect(result.ok).toBe(false);
+        expect(result.reason).toBe('auth-failed');
+        // The real (non-dry-run) push must NOT have been called
+        expect(calls.some((c) => c.includes('push') && !c.includes('--dry-run'))).toBe(false);
+    });
+    // 4. Happy path: unstaged changes, no message → add, AI-draft commit, push
+    it('stages, AI-drafts commit message, and pushes; returns ok: true', async () => {
+        const { run, calls } = makeRun([
+            { match: '--is-inside-work-tree', out: { stdout: 'true\n', stderr: '', code: 0 } },
+            { match: 'git remote', out: { stdout: 'origin\n', stderr: '', code: 0 } },
+            { match: '--abbrev-ref HEAD', out: { stdout: 'main\n', stderr: '', code: 0 } },
+            // ' M' → Y='M' → unstaged modification → needsAdd = true
+            { match: 'status --porcelain', out: { stdout: ' M src/foo.ts\n', stderr: '', code: 0 } },
+            { match: 'diff --stat HEAD', out: { stdout: '1 file changed, 2 insertions(+)\n', stderr: '', code: 0 } },
+            { match: 'add -A', out: OK },
+            { match: 'diff --staged', out: { stdout: '+added a line\n', stderr: '', code: 0 } },
+            { match: 'commit -m', out: OK },
+            { match: 'push --dry-run', out: OK },
+            { match: '--symbolic-full-name', out: { stdout: 'origin/main\n', stderr: '', code: 0 } },
+            { match: 'push origin', out: OK },
+        ]);
+        // all confirms: add, commit, push
+        const { confirm } = makeConfirm([true, true, true]);
+        const logs = [];
+        const result = await gitPush({
+            cwd: '/proj', run, confirm, provider: MOCK_PROVIDER,
+            log: (l) => logs.push(l),
+        });
+        expect(result).toEqual({ ok: true });
+        expect(calls.some((c) => c.includes('add -A'))).toBe(true);
+        expect(calls.some((c) => c.includes('commit -m'))).toBe(true);
+        // Real push (non-dry-run) was called
+        expect(calls.some((c) => c.includes('push origin') && !c.includes('--dry-run'))).toBe(true);
+        // AI-drafted message appears in the log
+        expect(logs.some((l) => l.includes('feat: add new feature'))).toBe(true);
+        // Final success message
+        expect(logs.some((l) => l.includes('Pushed main to origin'))).toBe(true);
+    });
+    // 5. pushOnly: true → no git add or git commit
+    it('pushOnly skips staging and committing, only pushes', async () => {
+        const { run, calls } = makeRun(happySpecs());
+        const { confirm } = makeConfirm([true]); // only the push confirm
+        const result = await gitPush({
+            cwd: '/proj', run, confirm, provider: MOCK_PROVIDER, pushOnly: true,
+        });
+        expect(result).toEqual({ ok: true });
+        expect(calls.some((c) => c.includes('add -A'))).toBe(false);
+        expect(calls.some((c) => c.includes('commit -m'))).toBe(false);
+        expect(calls.some((c) => c.includes('push origin') && !c.includes('--dry-run'))).toBe(true);
+    });
+    // 6. User declines push confirm → aborted, no real push runs
+    it('returns aborted when user declines the push confirm', async () => {
+        const { run, calls } = makeRun(happySpecs());
+        // pushOnly so there are no add/commit confirms; only one confirm: the push
+        const { confirm } = makeConfirm([false]);
+        const result = await gitPush({
+            cwd: '/proj', run, confirm, provider: MOCK_PROVIDER, pushOnly: true,
+        });
+        expect(result).toEqual({ ok: false, reason: 'aborted' });
+        // No real push was issued after the decline
+        expect(calls.some((c) => c.includes('push origin') && !c.includes('--dry-run'))).toBe(false);
+        expect(calls.some((c) => c.includes('push -u'))).toBe(false);
+    });
+    // 7. New branch with no upstream → git push -u origin <branch>
+    it('uses git push -u when no upstream is configured', async () => {
+        const branch = 'feature/new-thing';
+        const { run, calls } = makeRun(happySpecs(branch, { upstreamExists: false }));
+        const { confirm } = makeConfirm([true]);
+        const result = await gitPush({
+            cwd: '/proj', run, confirm, provider: MOCK_PROVIDER,
+            pushOnly: true, branch,
+        });
+        expect(result).toEqual({ ok: true });
+        // Must use -u form, not the plain push
+        expect(calls.some((c) => c.includes('push -u'))).toBe(true);
+        expect(calls.some((c) => c.includes('push origin') && !c.includes('push -u') && !c.includes('--dry-run'))).toBe(false);
+    });
+});