evo-cli 0.11.3__tar.gz → 0.12.1__tar.gz

{evo_cli-0.11.3 → evo_cli-0.12.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.11.3
+Version: 0.12.1
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli
@@ -16,6 +16,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cryptography>=41.0
 Requires-Dist: paramiko>=2.7.0
+Requires-Dist: PyYAML>=6.0
 Requires-Dist: rich>=13.0
 Requires-Dist: rich-click>=1.8
 Provides-Extra: test
@@ -112,3 +113,56 @@ Options:
 - `-y, --yes` - Skip the confirmation prompt
 - `-f, --force` - Apply the fix even if the version is not in the affected range
 - `--unpin` - Undo the fix: re-enable the auto-updater and install the latest build
+
+#### Credentials
+
+`evo` owns the omelet credential store. The source of truth is a folder of one JSON file per service
+(`~/.omelet.d/credentials/`), which compiles into a flat `~/.omelet.json` that older consumers read
+directly.
+
+```bash
+evo cred doctor                       # health + expiry of every credential, exit 1 if any expired
+evo cred get openai_api_key           # print one value by dotted path, nothing else on stdout
+evo cred add openai_api_key           # prompt with no echo, write the folder file, recompile
+evo cred refresh --all                # refresh Google OAuth access tokens
+evo cred compile                      # rebuild ~/.omelet.json from the folder
+evo cred sync push                    # push the folder to a private GitHub repo via gh
+```
+
+Read a value into the environment without it reaching your shell history:
+
+```bash
+eval "$(evo cred get --export OPENAI_API_KEY openai_api_key)"
+```
+
+Configuration is env-driven, with no personal defaults baked in:
+
+- `OMELET_DIR` - store root (default `~/.omelet.d`; the folder is `$OMELET_DIR/credentials`)
+- `OMELET_CONFIG` - compiled flat file (default `~/.omelet.json`)
+- `OMELET_SYNC_REPO` - required for `sync`; a **private** GitHub repo as `owner/repo`
+- `OMELET_SYNC_DIR` - folder name inside the sync repo (default `credentials`)
+- `RCLONE_DRIVE_CLIENT_ID` / `RCLONE_DRIVE_CLIENT_SECRET` - OAuth client for the rclone refresh
+
+`evo cred sync push` refuses to push to a repo whose visibility is not `PRIVATE`. Never echo a value
+into a shared terminal or a log; `doctor` and `list` only ever print a masked preview.
+
+#### Harness Repositories
+
+Fast-forward every available repository declared in a harness manifest:
+
+```bash
+evo harness pull
+```
+
+Run the command from a harness directory or any registered member repository. Use `--harness PATH`
+when a repository belongs to multiple harnesses or the harness is not registered.
+
+```bash
+evo harness pull --harness ~/github/my-project-harness
+evo harness pull --repo backend --repo frontend
+evo harness pull --dry-run
+```
+
+The command reads `harness.yaml` and its optional `harness.local.yaml` overlay. Repositories marked
+`present: false` are skipped. Repositories with uncommitted changes are not modified, and every pull
+uses `git pull --ff-only` so the command never creates merge commits.

{evo_cli-0.11.3 → evo_cli-0.12.1}/README.md

@@ -85,3 +85,56 @@ Options:
 - `-y, --yes` - Skip the confirmation prompt
 - `-f, --force` - Apply the fix even if the version is not in the affected range
 - `--unpin` - Undo the fix: re-enable the auto-updater and install the latest build
+
+#### Credentials
+
+`evo` owns the omelet credential store. The source of truth is a folder of one JSON file per service
+(`~/.omelet.d/credentials/`), which compiles into a flat `~/.omelet.json` that older consumers read
+directly.
+
+```bash
+evo cred doctor                       # health + expiry of every credential, exit 1 if any expired
+evo cred get openai_api_key           # print one value by dotted path, nothing else on stdout
+evo cred add openai_api_key           # prompt with no echo, write the folder file, recompile
+evo cred refresh --all                # refresh Google OAuth access tokens
+evo cred compile                      # rebuild ~/.omelet.json from the folder
+evo cred sync push                    # push the folder to a private GitHub repo via gh
+```
+
+Read a value into the environment without it reaching your shell history:
+
+```bash
+eval "$(evo cred get --export OPENAI_API_KEY openai_api_key)"
+```
+
+Configuration is env-driven, with no personal defaults baked in:
+
+- `OMELET_DIR` - store root (default `~/.omelet.d`; the folder is `$OMELET_DIR/credentials`)
+- `OMELET_CONFIG` - compiled flat file (default `~/.omelet.json`)
+- `OMELET_SYNC_REPO` - required for `sync`; a **private** GitHub repo as `owner/repo`
+- `OMELET_SYNC_DIR` - folder name inside the sync repo (default `credentials`)
+- `RCLONE_DRIVE_CLIENT_ID` / `RCLONE_DRIVE_CLIENT_SECRET` - OAuth client for the rclone refresh
+
+`evo cred sync push` refuses to push to a repo whose visibility is not `PRIVATE`. Never echo a value
+into a shared terminal or a log; `doctor` and `list` only ever print a masked preview.
+
+#### Harness Repositories
+
+Fast-forward every available repository declared in a harness manifest:
+
+```bash
+evo harness pull
+```
+
+Run the command from a harness directory or any registered member repository. Use `--harness PATH`
+when a repository belongs to multiple harnesses or the harness is not registered.
+
+```bash
+evo harness pull --harness ~/github/my-project-harness
+evo harness pull --repo backend --repo frontend
+evo harness pull --dry-run
+```
+
+The command reads `harness.yaml` and its optional `harness.local.yaml` overlay. Repositories marked
+`present: false` are skipped. Repositories with uncommitted changes are not modified, and every pull
+uses `git pull --ff-only` so the command never creates merge commits.

evo_cli-0.12.1/evo_cli/VERSION

@@ -0,0 +1 @@
+0.12.1

{evo_cli-0.11.3 → evo_cli-0.12.1}/evo_cli/cli.py

@@ -3,10 +3,12 @@ import rich_click as click
 from evo_cli import __version__
 from evo_cli.commands.claude_code import setup_claude
 from evo_cli.commands.cloudflare import cfssh
+from evo_cli.commands.cred import cred_group
 from evo_cli.commands.download import download
 from evo_cli.commands.fix_claude import f_claude
 from evo_cli.commands.gdrive import gdrive
 from evo_cli.commands.gh import setup_gh
+from evo_cli.commands.harness import harness_group
 from evo_cli.commands.hwid import hwid
 from evo_cli.commands.hwid_reset import hwid_reset
 from evo_cli.commands.localproxy import localproxy
@@ -18,6 +20,7 @@ from evo_cli.commands.plantuml import plantuml
 from evo_cli.commands.site2s import site2s
 from evo_cli.commands.ssh import setupssh
 from evo_cli.commands.sysmon import sysmon
+from evo_cli.commands.update import update
 from evo_cli.commands.wifi import wifi
 
 
@@ -55,9 +58,11 @@ setup_group.add_command(setupssh)
 
 cli.add_command(setup_group)
 cli.add_command(cfssh)
+cli.add_command(cred_group)
 cli.add_command(download)
 cli.add_command(f_claude)
 cli.add_command(gdrive)
+cli.add_command(harness_group)
 cli.add_command(hwid)
 cli.add_command(hwid_reset)
 cli.add_command(site2s)
@@ -66,6 +71,7 @@ cli.add_command(mcp_group)
 cli.add_command(netcheck)
 cli.add_command(plantuml)
 cli.add_command(sysmon)
+cli.add_command(update)
 cli.add_command(wifi)
 
 

evo_cli-0.12.1/evo_cli/commands/cred.py

@@ -0,0 +1,279 @@
+import getpass
+import json
+import os
+import sys
+
+import rich_click as click
+from rich.table import Table
+
+from evo_cli.console import console, info, success, warning
+from evo_cli.credentials import doctor as doctor_module
+from evo_cli.credentials import google_oauth, migrate, sync
+from evo_cli.credentials.registry import config_path, credentials_dir
+from evo_cli.credentials.store import (
+    CredentialError,
+    compile_flat,
+    get_value,
+    read_flat,
+    relative_to_store,
+    require_folder,
+    set_value,
+)
+
+HEALTH_STYLE = {
+    "ok": "green",
+    "expiring": "yellow",
+    "EXPIRED": "bold red",
+    "deprecated": "dim",
+}
+
+
+def _guard(func, *args, **kwargs):
+    try:
+        return func(*args, **kwargs)
+    except CredentialError as exc:
+        raise click.ClickException(str(exc)) from exc
+    except ValueError as exc:
+        raise click.ClickException(str(exc)) from exc
+
+
+def _render(rows):
+    table = Table(show_header=True, header_style="accent", box=None, pad_edge=False)
+    for column in ("FILE", "SERVICE", "TYPE", "HEALTH", "SECRET", "EXPIRY"):
+        table.add_column(column, overflow="fold")
+    for row in rows:
+        table.add_row(
+            row["file"],
+            row["service"],
+            row["type"],
+            f"[{HEALTH_STYLE.get(row['health'], 'white')}]{row['health']}[/]",
+            row["secret"],
+            row["expiry"],
+        )
+    console.print(table)
+
+
+@click.group("cred", help="Read, refresh, and sync the omelet credential store.")
+def cred_group():
+    pass
+
+
+@cred_group.command("get", help="Print one credential by dotted key path.")
+@click.argument("key_path")
+@click.option("--export", "export_var", metavar="VAR", help="Print a shell export statement instead of the raw value.")
+def get(key_path, export_var):
+    value = _guard(get_value, key_path)
+
+    if isinstance(value, (dict, list)):
+        sys.stdout.write(json.dumps(value, ensure_ascii=False) + "\n")
+        return
+
+    text = str(value)
+    if export_var:
+        escaped = text.replace("'", "'\\''")
+        sys.stdout.write(f"export {export_var}='{escaped}'\n")
+        return
+
+    sys.stdout.write(text)
+    if sys.stdout.isatty():
+        sys.stdout.write("\n")
+
+
+@cred_group.command("list", help="List every credential in the store with its health.")
+def list_credentials():
+    _guard(require_folder)
+    rows = _guard(doctor_module.scan)
+    _render(rows)
+    console.print(f"\n{len(rows)} entries in {credentials_dir()}")
+
+
+@cred_group.command("doctor", help="Report health and expiry; exit 1 if anything is expired.")
+def doctor():
+    _guard(require_folder)
+    rows = _guard(doctor_module.scan)
+    _render(rows)
+    expired = [row for row in rows if row["health"] == "EXPIRED"]
+    console.print(f"\n{len(rows)} entries in {credentials_dir()}")
+    if expired:
+        warning(f"{len(expired)} EXPIRED - run: evo cred refresh --all")
+        raise click.exceptions.Exit(1)
+    success("all credentials healthy")
+
+
+@cred_group.command("compile", help="Rebuild the flat config from the credentials folder.")
+@click.option("--include-legacy", is_flag=True, help="Also merge entries marked deprecated.")
+def compile_command(include_legacy):
+    count, skipped, target = _guard(compile_flat, include_legacy=include_legacy)
+    message = f"compiled {count} entries -> {target}"
+    if skipped:
+        message += f" (skipped {len(skipped)} deprecated: {', '.join(skipped)})"
+    success(message)
+
+
+@cred_group.command("add", help="Add or update a credential, then recompile the flat config.")
+@click.argument("key_path")
+@click.option("--from-stdin", is_flag=True, help="Read the value from stdin.")
+@click.option("--from-env", metavar="VAR", help="Read the value from an environment variable.")
+@click.option("--value", "inline_value", help="Inline value. Avoid: leaks to shell history.")
+@click.option("--json", "parse_json", is_flag=True, help="Parse the value as JSON (bool/number/object/array).")
+def add(key_path, from_stdin, from_env, inline_value, parse_json):
+    sources = [bool(from_stdin), bool(from_env), inline_value is not None]
+    if sum(sources) > 1:
+        raise click.UsageError("Use only one of --from-stdin, --from-env, --value.")
+
+    if from_stdin:
+        value = sys.stdin.read().rstrip("\n")
+    elif from_env:
+        if from_env not in os.environ:
+            raise click.ClickException(f"env var {from_env} not set")
+        value = os.environ[from_env]
+    elif inline_value is not None:
+        value = inline_value
+    else:
+        value = getpass.getpass(f"value for {key_path} (no echo): ")
+        if not value:
+            raise click.ClickException("empty value, aborting")
+
+    if parse_json:
+        try:
+            value = json.loads(value)
+        except json.JSONDecodeError as exc:
+            raise click.ClickException(f"--json: failed to parse value: {exc}") from exc
+
+    path, existed = _guard(set_value, key_path, value)
+    count, _, target = _guard(compile_flat)
+    verb = "updated" if existed else "added"
+    success(f"{verb} {key_path} in {relative_to_store(path)}, recompiled {target} ({count} entries)")
+
+
+@cred_group.command("refresh", help="Refresh Google OAuth access tokens and recompile.")
+@click.option("--all", "refresh_all", is_flag=True, help="Refresh every refreshable OAuth entry.")
+@click.option(
+    "--service",
+    type=click.Choice(sorted(google_oauth.SERVICE_ALIASES)),
+    help="Refresh a single service.",
+)
+@click.option("--dry-run", is_flag=True, help="Show what would be refreshed without calling Google.")
+def refresh(refresh_all, service, dry_run):
+    if refresh_all == bool(service):
+        raise click.UsageError("Pass exactly one of --all or --service.")
+
+    _guard(require_folder)
+    target = "*" if refresh_all else google_oauth.SERVICE_ALIASES[service]
+    entries = _guard(google_oauth.select_entries, target)
+    if not entries:
+        raise click.ClickException("no matching refreshable oauth entries")
+
+    failures = 0
+    refreshed = 0
+    for path, entry in entries:
+        name = entry.get("id", path.name)
+        creds, err = google_oauth.resolve_creds(entry)
+        if err:
+            warning(f"{name}: skip ({err})")
+            failures += 1
+            continue
+
+        if dry_run:
+            info(
+                f"{name}: would POST {google_oauth.TOKEN_URL} "
+                f"refresh_token={creds['refresh_token'][:10]}... client_id={creds['client_id'][:12]}..."
+            )
+            continue
+
+        try:
+            expiry = google_oauth.refresh_entry(path, entry, creds)
+        except Exception as exc:
+            warning(f"{name}: {google_oauth.describe_error(exc)}")
+            failures += 1
+            continue
+
+        refreshed += 1
+        success(f"{name}: refreshed, valid until {expiry}")
+
+    if refreshed:
+        count, _, target_path = _guard(compile_flat)
+        info(f"recompiled {target_path} ({count} entries)")
+
+    if failures:
+        raise click.exceptions.Exit(1)
+
+
+@cred_group.command("migrate", help="Split a flat omelet.json into the per-service credentials folder.")
+@click.option("--source", "source", type=click.Path(), help="Flat file to migrate. Defaults to the compiled config.")
+@click.option("--dry-run", is_flag=True, help="Show the plan, write nothing.")
+@click.option("--merge", is_flag=True, help="Migrate into an existing folder, adding only keys not already present.")
+@click.option("--strict", is_flag=True, help="Abort on keys not mapped in the registry instead of routing to misc/.")
+@click.option("--force", is_flag=True, help="Overwrite an existing non-empty folder.")
+def migrate_command(source, dry_run, merge, strict, force):
+    result = _guard(migrate.plan, source or config_path(), strict=strict, merge=merge)
+
+    console.print(f"source: {result['source_path']} ({result['source_keys']} top-level keys)")
+    console.print(f"target: {credentials_dir()}{'  [MERGE]' if merge else ''}\n")
+
+    for item in result["actions"]:
+        flags = " [unmapped->misc]" if item["misc"] else ""
+        if item["entry"].get("status") == "deprecated":
+            flags += " [DEPRECATED]"
+        if item["entry"].get("expiry"):
+            flags += f" expiry={item['entry']['expiry']}"
+        console.print(f"  {item['action']:6s} {item['rel']:40s} <- {', '.join(item['keys'])}{flags}")
+
+    if result["unmapped"]:
+        warning(f"{len(result['unmapped'])} unmapped key(s) routed to misc/: {', '.join(result['unmapped'])}")
+
+    if dry_run:
+        info(f"dry-run: would write {len(result['actions'])} file(s)")
+        return
+
+    if not result["actions"]:
+        info("nothing to do (folder already up to date)")
+        return
+
+    if migrate.folder_has_files() and not (merge or force):
+        raise click.ClickException(
+            f"refusing: {credentials_dir()} already has files.\n"
+            "Use --merge (add missing keys) or --force (overwrite), or point OMELET_DIR elsewhere."
+        )
+
+    backup = _guard(migrate.apply, result)
+    info(f"backed up source -> {backup}")
+    success(f"wrote {len(result['actions'])} file(s) to {credentials_dir()}")
+
+    count, _, target_path = _guard(compile_flat)
+    success(f"compiled {count} entries -> {target_path}")
+
+
+@cred_group.group("sync", help="Sync the credentials folder with a private GitHub repo.")
+def sync_group():
+    pass
+
+
+@sync_group.command("push", help="Push the local credentials folder to the sync repo.")
+def sync_push():
+    host = _guard(sync.push)
+    if host is None:
+        info("no changes to push")
+        return
+    success(f"pushed {sync.dir_in_repo()}/ to {sync.sync_repo()} (from {host})")
+
+
+@sync_group.command("pull", help="Pull the credentials folder from the sync repo, then recompile.")
+def sync_pull():
+    backup = _guard(sync.pull)
+    if backup:
+        info(f"backed up existing folder -> {backup}")
+    success(f"pulled {sync.sync_repo()}:{sync.dir_in_repo()}/ -> {credentials_dir()}")
+    count, _, target_path = _guard(compile_flat)
+    success(f"compiled {count} entries -> {target_path}")
+
+
+@cred_group.command("path", help="Print the store locations this machine resolves to.")
+def show_path():
+    console.print(f"folder: {credentials_dir()}")
+    console.print(f"flat:   {config_path()}")
+    try:
+        keys = [key for key in read_flat() if not key.startswith("_")]
+    except CredentialError:
+        keys = []
+    console.print(f"keys:   {len(keys)}")

evo_cli-0.12.1/evo_cli/commands/harness.py

@@ -0,0 +1,213 @@
+import json
+import os
+import shutil
+import subprocess
+from pathlib import Path
+
+import rich_click as click
+import yaml
+
+
+def _read_yaml(path, required=True):
+    if not path.is_file():
+        if required:
+            raise click.ClickException(f"Harness manifest not found: {path}")
+        return {}
+    try:
+        data = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
+    except (OSError, yaml.YAMLError) as exc:
+        raise click.ClickException(f"Cannot read {path}: {exc}") from exc
+    if not isinstance(data, dict):
+        raise click.ClickException(f"Expected a YAML mapping in {path}")
+    return data
+
+
+def _resolve_path(value, base):
+    path = Path(os.path.expandvars(str(value))).expanduser()
+    return (path if path.is_absolute() else base / path).resolve()
+
+
+def _load_repos(manifest_path):
+    manifest = _read_yaml(manifest_path)
+    local = _read_yaml(manifest_path.with_name("harness.local.yaml"), required=False)
+    root = manifest_path.parent.resolve()
+    workspace_value = (
+        os.environ.get("EVO_HARNESS_WORKSPACE") or local.get("workspace") or manifest.get("workspace") or root.parent
+    )
+    workspace = _resolve_path(workspace_value, root)
+    entries = manifest.get("repos", [])
+    if not isinstance(entries, list):
+        raise click.ClickException(f"Expected 'repos' to be a list in {manifest_path}")
+    present_overrides = local.get("present", {}) or {}
+    if not isinstance(present_overrides, dict):
+        raise click.ClickException(
+            f"Expected 'present' to be a mapping in {manifest_path.with_name('harness.local.yaml')}"
+        )
+
+    repos = []
+    names = set()
+    for index, entry in enumerate(entries):
+        if not isinstance(entry, dict):
+            raise click.ClickException(f"Expected repos[{index}] to be a mapping in {manifest_path}")
+        name = str(entry.get("name", "")).strip()
+        if not name:
+            raise click.ClickException(f"Expected repos[{index}].name in {manifest_path}")
+        if name in names:
+            raise click.ClickException(f"Duplicate repo name '{name}' in {manifest_path}")
+        names.add(name)
+        fallback = workspace / name
+        declared = _resolve_path(entry["path"], workspace) if entry.get("path") else None
+        path = declared if declared and declared.exists() else fallback.resolve()
+        present = present_overrides.get(name, entry.get("present", True))
+        repos.append({"name": name, "path": path, "present": bool(present)})
+    return manifest, repos
+
+
+def _contains(parent, child):
+    try:
+        child.relative_to(parent)
+        return True
+    except ValueError:
+        return False
+
+
+def _as_manifest(value):
+    path = _resolve_path(value, Path.cwd())
+    return path / "harness.yaml" if path.is_dir() else path
+
+
+def _find_manifest(value=None):
+    configured = value or os.environ.get("EVO_HARNESS")
+    if configured:
+        manifest_path = _as_manifest(configured)
+        if not manifest_path.is_file():
+            raise click.ClickException(f"Harness manifest not found: {manifest_path}")
+        return manifest_path
+
+    cwd = Path.cwd().resolve()
+    for base in (cwd, *cwd.parents):
+        candidate = base / "harness.yaml"
+        if candidate.is_file():
+            return candidate
+
+    registry_path = _resolve_path(
+        os.environ.get("EVO_HARNESS_REGISTRY", Path.home() / ".claude" / "harness" / "registry.json"),
+        Path.cwd(),
+    )
+    matches = []
+    if registry_path.is_file():
+        try:
+            registry = json.loads(registry_path.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError) as exc:
+            raise click.ClickException(f"Cannot read {registry_path}: {exc}") from exc
+        for cluster in registry.get("clusters", []):
+            if not isinstance(cluster, dict) or not cluster.get("root"):
+                continue
+            candidate = _as_manifest(cluster["root"])
+            if not candidate.is_file():
+                continue
+            try:
+                _, repos = _load_repos(candidate)
+            except click.ClickException:
+                continue
+            root = candidate.parent.resolve()
+            if _contains(root, cwd) or any(_contains(repo["path"], cwd) for repo in repos):
+                matches.append(candidate)
+
+    matches = list(dict.fromkeys(matches))
+    if len(matches) == 1:
+        return matches[0]
+    if len(matches) > 1:
+        choices = ", ".join(str(path.parent) for path in matches)
+        raise click.ClickException(f"Current directory belongs to multiple harnesses: {choices}. Use --harness PATH.")
+    raise click.ClickException("Cannot find harness.yaml. Run inside a harness repo or use --harness PATH.")
+
+
+def _git(path, *args):
+    return subprocess.run(
+        ["git", "-C", str(path), *args],
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+        check=False,
+    )
+
+
+@click.group("harness", help="Manage repositories declared by a harness manifest.")
+def harness_group():
+    pass
+
+
+@harness_group.command("pull", help="Fast-forward all available repositories in a harness.")
+@click.option(
+    "--harness",
+    "harness_path",
+    type=click.Path(path_type=Path),
+    help="Harness directory or harness.yaml path. Defaults to auto-discovery.",
+)
+@click.option("--repo", "repos", multiple=True, help="Pull only this repo name. Repeat for multiple repos.")
+@click.option("--prune/--no-prune", default=True, show_default=True, help="Prune deleted remote refs while pulling.")
+@click.option("--dry-run", is_flag=True, help="Show repositories that would be pulled.")
+def pull(harness_path, repos, prune, dry_run):
+    if shutil.which("git") is None:
+        raise click.ClickException("git is not installed or is not on PATH")
+
+    manifest_path = _find_manifest(harness_path)
+    manifest, entries = _load_repos(manifest_path)
+    available = {entry["name"] for entry in entries}
+    unknown = sorted(set(repos) - available)
+    if unknown:
+        raise click.ClickException(f"Unknown repo name(s): {', '.join(unknown)}")
+    selected = [entry for entry in entries if not repos or entry["name"] in repos]
+
+    click.echo(f"Harness: {manifest.get('name') or manifest_path.parent.name}")
+    click.echo(f"Manifest: {manifest_path}")
+    results = []
+    incomplete = 0
+
+    for entry in selected:
+        name = entry["name"]
+        path = entry["path"]
+        if not entry["present"]:
+            results.append((name, "skipped (present: false)"))
+            continue
+        if not path.is_dir():
+            results.append((name, f"failed (missing: {path})"))
+            incomplete += 1
+            continue
+
+        status = _git(path, "status", "--porcelain")
+        if status.returncode != 0:
+            detail = (status.stderr or status.stdout).strip().splitlines()
+            results.append((name, f"failed ({detail[-1] if detail else 'not a git repository'})"))
+            incomplete += 1
+            continue
+        if status.stdout.strip():
+            results.append((name, "skipped (uncommitted changes)"))
+            incomplete += 1
+            continue
+        if dry_run:
+            results.append((name, "would pull"))
+            continue
+
+        args = ["pull", "--ff-only"]
+        if prune:
+            args.append("--prune")
+        update = _git(path, *args)
+        if update.returncode != 0:
+            detail = (update.stderr or update.stdout).strip().splitlines()
+            results.append((name, f"failed ({detail[-1] if detail else 'git pull failed'})"))
+            incomplete += 1
+            continue
+        head = _git(path, "log", "-1", "--oneline")
+        results.append((name, head.stdout.strip() or "updated"))
+
+    click.echo()
+    click.secho("Summary", bold=True)
+    width = max((len(name) for name, _ in results), default=0)
+    for name, status in results:
+        color = "red" if status.startswith("failed") else "yellow" if status.startswith("skipped") else "green"
+        click.secho(f"  {name:<{width}}  {status}", fg=color)
+    if incomplete:
+        raise click.exceptions.Exit(1)