gitgrip 2.0.0a11__tar.gz → 2.0.0a12__tar.gz

{gitgrip-2.0.0a11 → gitgrip-2.0.0a12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitgrip
-Version: 2.0.0a11
+Version: 2.0.0a12
 Summary: Workspace layer for multi-repo work: workspaces, isolated lanes, and one grouped review per slice
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{gitgrip-2.0.0a11 → gitgrip-2.0.0a12}/gitgrip.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitgrip
-Version: 2.0.0a11
+Version: 2.0.0a12
 Summary: Workspace layer for multi-repo work: workspaces, isolated lanes, and one grouped review per slice
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{gitgrip-2.0.0a11 → gitgrip-2.0.0a12}/gitgrip.egg-info/SOURCES.txt

@@ -259,6 +259,7 @@ tests/test_member_working_root_checkout_materialize.py
 tests/test_merge_credential_remotes.py
 tests/test_merge_evidence.py
 tests/test_merge_parent_verification.py
+tests/test_migrate_gr1_member_origin.py
 tests/test_migrate_gr1_one_root.py
 tests/test_migration.py
 tests/test_migration_overlay_compatibility.py
@@ -294,6 +295,7 @@ tests/test_overlay_tier_b_repo_state.py
 tests/test_overlay_tier_b_staging_discipline.py
 tests/test_overlay_trust_model.py
 tests/test_overlay_workspace_spec.py
+tests/test_pin_rewind_shallow_path_quoted.py
 tests/test_platform_adapter_changelog.py
 tests/test_platform_adapter_plugins.py
 tests/test_pr_adapter_v2_target.py
@@ -306,6 +308,7 @@ tests/test_pr_merge_missing_target.py
 tests/test_pr_merge_partial_failure.py
 tests/test_pr_review_subject.py
 tests/test_pr_view.py
+tests/test_printed_command_values_quoted.py
 tests/test_project_file_materialization.py
 tests/test_project_review_range_reconstruction.py
 tests/test_project_review_three_repo.py
@@ -364,6 +367,7 @@ tests/test_review_merge_platform.py
 tests/test_review_merge_receipt.py
 tests/test_review_merge_set_alone.py
 tests/test_review_merge_set_required.py
+tests/test_review_merge_tracking_command_quoted.py
 tests/test_review_merge_updates_tracking_ref.py
 tests/test_review_named_refusals.py
 tests/test_review_open_lane.py
@@ -421,6 +425,7 @@ tests/test_snapshot_id_prefix_resolution.py
 tests/test_spec_apply_event_outcomes.py
 tests/test_spec_declaration_ref_pin.py
 tests/test_spec_show_native_root.py
+tests/test_spec_sourced_git_lines_quoted.py
 tests/test_sprint21_sync_platform.py
 tests/test_staging_cleanup.py
 tests/test_store_break_attempts.py

gitgrip-2.0.0a12/gr2/python_cli/_build.json

@@ -0,0 +1 @@
+{"commit": "8c58df6", "release": true}

{gitgrip-2.0.0a11 → gitgrip-2.0.0a12}/gr2/python_cli/app.py

@@ -1678,7 +1678,7 @@ def workspace_init(
             lines.append("no origin: materialize refuses these repos until a url is set:")
             for repo in without_url:
                 lines.append(
-                    f"- {repo['name']}: git -C {workspace_root / repo['path']} "
+                    f"- {repo['name']}: git -C {next_steps._shown(workspace_root / repo['path'])} "
                     "remote add origin <url>"
                 )
         typer.echo("\n".join(lines))
@@ -2087,7 +2087,7 @@ def _lane_member_branch_in(workspace_root: Path, repo_top: Path) -> tuple[str, s
         if key is not None:
             # A native workspace lane materializes every member of the selected workspace commit, which can
             # differ from this lane's repos once the store grows: name no --repos there, so lane create takes them all.
-            repos = "" if grip._is_native_workspace(workspace_root) else f" --repos {key}"
+            repos = "" if grip._is_native_workspace(workspace_root) else f" --repos {next_steps._shown(key)}"
             return unit, lane_name, key, str(branch_map.get(key) or lane_name), repos
     return None
 
@@ -2128,9 +2128,9 @@ def _refuse_branching_a_lane_member(target: Path, name: str) -> None:
     if name == lane_branch:
         return
     typer.echo(
-        f"Error: {key} is a repo of lane {unit}/{lane_name}, whose branch for it is '{lane_branch}'; "
+        f"Error: {key} is a repo of lane {next_steps._shown(f'{unit}/{lane_name}')}, whose branch for it is '{lane_branch}'; "
         f"'{name}' was not created or switched to. The lane records its branch and fork base, so work on "
-        f"another branch belongs in a new lane: gr2 lane create <workspace> {unit} <lane>{repos} "
+        f"another branch belongs in a new lane: gr2 lane create <workspace> {next_steps._shown(unit)} <lane>{repos} "
         f"--branch {name}",
         err=True,
     )
@@ -2788,12 +2788,12 @@ def repo_status(
         if state == "changed":
             hook_lines.append(
                 f"hooks changed since grant {getattr(target, 'name', target.path.name)} "
-                f"(sha {hooks_sha(target.path)[:12]}) — re-bind: gr2 hooks trust {getattr(target, 'name', target.path.name)}"
+                f"(sha {hooks_sha(target.path)[:12]}) — re-bind: gr2 hooks trust {next_steps._shown(getattr(target, 'name', target.path.name))}"
             )
         else:
             hook_lines.append(
                 f"hooks unbound {getattr(target, 'name', target.path.name)} "
-                f"(sha {hooks_sha(target.path)[:12]}) — bind: gr2 hooks trust {getattr(target, 'name', target.path.name)}"
+                f"(sha {hooks_sha(target.path)[:12]}) — bind: gr2 hooks trust {next_steps._shown(getattr(target, 'name', target.path.name))}"
             )
 
     if json_output:
@@ -2967,9 +2967,9 @@ def hooks_status(
         if row["state"] == "bound":
             typer.echo(f"hooks bound {row['member']} (sha {row['hooks_sha']}, granted {row['granted_at']})")
         elif row["state"] == "changed":
-            typer.echo(f"hooks changed since grant {row['member']} (now sha {row['hooks_sha']}) — re-bind: gr2 hooks trust {row['member']}")
+            typer.echo(f"hooks changed since grant {row['member']} (now sha {row['hooks_sha']}) — re-bind: gr2 hooks trust {next_steps._shown(row['member'])}")
         else:
-            typer.echo(f"hooks unbound {row['member']} (sha {row['hooks_sha']}) — bind: gr2 hooks trust {row['member']}")
+            typer.echo(f"hooks unbound {row['member']} (sha {row['hooks_sha']}) — bind: gr2 hooks trust {next_steps._shown(row['member'])}")
 
 
 @hooks_app.command("show")
@@ -4219,7 +4219,7 @@ def review_read_pr(
     typer.echo(f"base {opened.base}")
     if opened.stat:
         typer.echo(opened.stat)
-    typer.echo(f"Read the full diff: git -C {opened.path} diff {opened.base}...{opened.head}")
+    typer.echo(f"Read the full diff: git -C {next_steps._shown(opened.path)} diff {next_steps._shown(f'{opened.base}...{opened.head}')}")
 
 
 class _ReviewSelectRefused(typer.BadParameter):

{gitgrip-2.0.0a11 → gitgrip-2.0.0a12}/gr2/python_cli/approvals.py

@@ -16,6 +16,7 @@ from datetime import datetime, timezone
 from pathlib import Path
 
 from . import approval_schema, gitops, grip
+from .next_steps import _shown
 
 PREFIX = "refs/dev.synapt.grip/__approvals__/v1/"
 SCHEMA = approval_schema.PACKAGE
@@ -151,14 +152,14 @@ def review_open_lane(lane: Path) -> tuple[Path, str, dict[str, Path]] | None:
         raise ApprovalRefused(f"approval_lane_names_no_workspace: {lane} was opened by an older gr2 and does not name "
                               "the workspace it was opened from",
                               next_step=f"next: open the review again, then stamp the new lane: "
-                                        f"gr2 review open <your-workspace> gr:{marker['gr_commit']} --lane-dir <new-lane>, "
+                                        f"gr2 review open <your-workspace> {_shown('gr:' + str(marker['gr_commit']))} --lane-dir <new-lane>, "
                                         "then gr2 review stamp <new-lane>")
     if not Path(marker["workspace_root"]).is_absolute():
         raise ApprovalRefused(f"approval_lane_workspace_not_absolute: {lane} names the workspace "
                               f"{marker['workspace_root']!r}, which is not absolute and would resolve against the "
                               "current directory; review open writes it absolute, so this marker was edited by hand or written elsewhere",
                               next_step=f"next: open the review again, then stamp the new lane: "
-                                        f"gr2 review open <your-workspace> gr:{marker['gr_commit']} --lane-dir <new-lane>, "
+                                        f"gr2 review open <your-workspace> {_shown('gr:' + str(marker['gr_commit']))} --lane-dir <new-lane>, "
                                         "then gr2 review stamp <new-lane>")
     try:
         members = ({rows[0]["key"]: lane} if len(rows) == 1
@@ -190,11 +191,12 @@ def _context(workspace: Path, review_id: str, member_dirs: dict[str, Path] | Non
             repo = member_dirs.get(m["key"])
             if repo is None:
                 keys = [r["key"] for r in view["members"]]
+                from . import next_steps
                 raise ApprovalRefused(
                     f"approval_lane_partial: this lane holds {', '.join(sorted(member_dirs))}; the review has "
                     f"{', '.join(keys)}",
-                    next_step=f"next: open the whole review and stamp that lane: gr2 review open {workspace} "
-                              f"gr:{rid} --lane-dir <new-lane>, then gr2 review stamp <new-lane>")
+                    next_step=f"next: open the whole review and stamp that lane: gr2 review open {next_steps._shown(workspace)} "
+                              f"{next_steps._shown('gr:' + rid)} --lane-dir <new-lane>, then gr2 review stamp <new-lane>")
             if merge_gate._toplevel(repo) != repo.resolve():
                 raise ApprovalRefused(f"approval_member_repo_mismatch: {m['key']}")
             repo = repo.resolve()

{gitgrip-2.0.0a11 → gitgrip-2.0.0a12}/gr2/python_cli/clone_exec.py

@@ -48,7 +48,7 @@ import time
 import urllib.parse
 from pathlib import Path
 
-from . import gitops
+from . import gitops, next_steps
 from .spec_apply import (
     MaterializationPlanError,
     ValidatedPlan,
@@ -972,7 +972,7 @@ def _reuse_existing_lane(
         raise CloneExecutionError(
             f"existing lane at {dest} is on branch {actual_branch!r}, not the expected "
             f"{expected_branch!r}. Materialization never switches a lane's branch; move "
-            f"it back with `git -C {dest} checkout {expected_branch}` or remove the lane "
+            f"it back with `git -C {next_steps._shown(dest)} checkout {next_steps._shown(expected_branch)}` or remove the lane "
             "to re-materialize (grip#807 step 6)"
         )
     if expected_seed is not None and actual_head != expected_seed:

{gitgrip-2.0.0a11 → gitgrip-2.0.0a12}/gr2/python_cli/gitops.py

@@ -4,6 +4,8 @@ import os
 import subprocess
 from pathlib import Path
 
+from . import next_steps
+
 
 _SSH_GITHUB_PREFIX = "git@github.com:"
 _HTTPS_GITHUB_PREFIX = "https://github.com/"
@@ -588,7 +590,7 @@ def checkout_declared_pin(repo_root: Path, pin: str, *, member: str) -> None:
             raise SystemExit(
                 f"member '{member}' declares pin {pin}, the clone cannot reach that commit, and "
                 f"fetching it by sha from origin did not provide it. Try "
-                f"`git -C {repo_root} fetch --depth 1 origin -- {pin}` by hand to see why. This verb "
+                f"`git -C {next_steps._shown(repo_root)} fetch --depth 1 origin -- {next_steps._shown(pin)}` by hand to see why. This verb "
                 "will not leave the member on its default branch instead: that is a commit the "
                 "root never declared."
             )

{gitgrip-2.0.0a11 → gitgrip-2.0.0a12}/gr2/python_cli/grip_cli.py

@@ -591,13 +591,13 @@ def _register_submodules(root: Path, paths: list[str]) -> None:
         done = _store_git(root, "submodule", "init", "--", path, check=False)
         if done.returncode:
             typer.echo(f"{path}: not registered as a submodule ({_git_detail(done)}); plain `git submodule` verbs "
-                       f"need `git submodule init {path}` first", err=True)
+                       f"need `git submodule init -- {next_steps._shown(path)}` first", err=True)
             continue
         now = _registered_submodule_urls(root)
         new, registered = now - registered, now
         if new:
             typer.echo(f"{path}: registered as a submodule, so plain `git submodule` verbs act on it "
-                       f"(`git submodule deinit {path}` lasts until the next store commit)", err=True)
+                       f"(`git submodule deinit -- {next_steps._shown(path)}` lasts until the next store commit)", err=True)
 
 
 def _existing_sets(root: Path) -> list[dict]:
@@ -2013,7 +2013,7 @@ def _refuse_pin_rewind(
             # says nothing about direction there; materialize would be the wrong advice for a checkout ahead.
             raise PinRewindRefusal(
                 f"{name}: cannot tell whether HEAD {head[:12]} is behind the recorded pin {recorded[:12]}: this "
-                f"checkout is shallow and does not reach it; run `git fetch --unshallow` in {member['path']} and "
+                f"checkout is shallow and does not reach it; run `git fetch --unshallow` in {next_steps._shown(member['path'])} and "
                 f"commit again, or {allow} to record HEAD anyway",
                 3,
             )
@@ -3831,7 +3831,7 @@ def grip_materialize_cmd(
             if member["branch"] is None:
                 typer.echo(
                     f"{member['name']}: left detached at {member['pin'][:12]}: {member['detached']}; "
-                    f"to work on a branch: git -C {member['path']} switch -c <branch>",
+                    f"to work on a branch: git -C {next_steps._shown(member['path'])} switch -c <branch>",
                     err=True,
                 )
     # stderr in both modes, so neither stdout contract moves

{gitgrip-2.0.0a11 → gitgrip-2.0.0a12}/gr2/python_cli/hooks.py

@@ -9,6 +9,7 @@ import tomllib
 from pathlib import Path
 
 from .events import EventType, emit, emit_after_outcome
+from .next_steps import _shown
 from . import gitops
 
 
@@ -844,7 +845,7 @@ def _report_unbound(
             + ", ".join(ignored)
             + " — consent is a local record on the host, never inside the hooks table"
         )
-    print(f"bind: gr2 hooks trust {ctx.repo_name}")
+    print(f"bind: gr2 hooks trust {_shown(ctx.repo_name)}")
 
 
 def run_lifecycle_stage(

{gitgrip-2.0.0a11 → gitgrip-2.0.0a12}/gr2/python_cli/merge_gate.py

@@ -111,11 +111,15 @@ def _refresh_tracking(repo: Path, remote: str, into: str) -> dict | None:
     name = next((n for n in names if urls[n] and _url_key(urls[n], repo) == want), None)
     if name is None:
         target = "origin" if "origin" in names else names[0]
-        return {"command": f"git -C {repo} fetch --no-tags --refmap= {remote} +refs/heads/{into}:refs/remotes/{target}/{into}",
+        shown = next_steps._shown  # every value quoted whole: a refname may hold ';', so the line runs as printed
+        return {"command": f"git -C {shown(repo)} fetch --no-tags --refmap= -- {shown(remote)} "
+                           f"{shown(f'+refs/heads/{into}:refs/remotes/{target}/{into}')}",
                 "reason": f"no remote of this clone names {remote}"}
     spec = f"+refs/heads/{into}:refs/remotes/{name}/{into}"
     proc = gitops.run(repo, "fetch", "--no-tags", "-q", "--refmap=", name, spec, timeout=120)
-    return None if proc.returncode == 0 else {"command": f"git -C {repo} fetch --no-tags --refmap= {name} {spec}",
+    shown = next_steps._shown
+    return None if proc.returncode == 0 else {"command": f"git -C {shown(repo)} fetch --no-tags --refmap= -- {shown(name)} "
+                                                         f"{shown(spec)}",
                                               "reason": "the fetch failed"}
 
 
@@ -652,7 +656,8 @@ def review_merge(workspace: Path, review_id: str, *, into: str = "main", feature
         try:
             failed = _refresh_tracking(repo, m["remote"], into)
         except (RuntimeError, subprocess.SubprocessError, OSError) as exc:
-            failed = {"command": f"git -C {repo} fetch --no-tags <remote> +refs/heads/{into}:refs/remotes/<remote>/{into}",
+            spec = next_steps._shown(f"+refs/heads/{into}:refs/remotes/<remote>/{into}")
+            failed = {"command": f"git -C {next_steps._shown(repo)} fetch --no-tags <remote> {spec}",
                       "reason": f"the clone could not be read: {exc}"}
         if failed:
             tracking_stale.append({"member": m["key"], **failed})

{gitgrip-2.0.0a11 → gitgrip-2.0.0a12}/gr2/python_cli/migration.py

@@ -11,11 +11,12 @@ import tempfile
 import tomllib
 import contextlib
 from pathlib import Path, PurePosixPath, PureWindowsPath
+from urllib.parse import urlsplit, urlunsplit
 
 import yaml
 
 from . import grip
-from .gitops import git
+from .gitops import git, remote_origin_url
 from .workspace_guidance import GR1_ONLY_NEXT_STEP, init_unless_inside_workspace, workspace_init_command
 from gr2.prototypes import lane_workspace_prototype as lane_proto
 from gr2.prototypes import repo_maintenance_prototype as repo_proto
@@ -117,6 +118,7 @@ def migrate_gr1_workspace(
         "unit_count": len(compiled["units"]),
         "snapshots": snapshots,
         "not_migrated": list(compiled.get("not_migrated") or []),
+        "member_origins": list(compiled.get("member_origins") or []),
     }
     summary_path.write_text(json.dumps(summary, indent=2) + "\n")
 
@@ -794,6 +796,33 @@ def _rollback_bootstrap(
         shutil.rmtree(grip_dir)
 
 
+def _member_checkout_origin(workspace_root: Path, member_path: str) -> str | None:
+    """The origin url of the checkout at a member's path, when that path is a repository of its own.
+
+    A path with no `.git` of its own is not the member's checkout: inside a root that is itself a
+    repository, asking git there would answer with the ROOT's origin.
+    """
+    checkout = workspace_root / member_path
+    if not (checkout / ".git").exists():
+        return None
+    return remote_origin_url(checkout)
+
+
+_SSH_SCHEMES = frozenset({"ssh", "git+ssh", "ssh+git"})
+
+
+def _strip_url_userinfo(url: str) -> str:
+    """The url without its userinfo, except an SSH login (`ssh://git@host/...`), which names an account and
+    holds no secret. An scp-like `git@host:path` has no scheme and is returned as written."""
+    try:
+        parts = urlsplit(url)
+    except ValueError:
+        return url
+    if "@" not in parts.netloc or parts.scheme.lower() in _SSH_SCHEMES:
+        return url
+    return urlunsplit(parts._replace(netloc=parts.netloc.rpartition("@")[2]))
+
+
 def compile_gr1_to_workspace_spec(
     workspace_root: Path,
     manifest: dict[str, object],
@@ -806,6 +835,7 @@ def compile_gr1_to_workspace_spec(
         raise ValueError("canonical gripspace manifest repos must be a mapping")
     repos: list[dict[str, object]] = []
     writable_repo_names: list[str] = []
+    member_origins: list[dict[str, str]] = []
 
     for repo_name, repo_doc in repos_doc.items():
         safe_repo_name = _safe_workspace_component(repo_name, "repo name")
@@ -813,10 +843,30 @@ def compile_gr1_to_workspace_spec(
             raise ValueError(f"repository {safe_repo_name!r} must be a mapping")
         path = repo_doc.get("path", "")
         normalized_path = _safe_workspace_relative_path(path, f"repository {safe_repo_name!r} path")
+        manifest_url = str(repo_doc.get("url", "")).strip()
+        # The checkout at the member's path is what this desk actually fetches from; the manifest's url
+        # is what it said when the repo was added, and the two drift (a renamed repo, an SSH url, a fork).
+        checkout_url = _member_checkout_origin(workspace_root, normalized_path)
+        url = manifest_url
+        if checkout_url is not None:
+            # A credential never leaves the checkout's own git config: userinfo is stripped, and an origin that
+            # still carries one (a token in the query, a fragment) is not used and not printed.
+            checkout_url = _strip_url_userinfo(checkout_url)
+            if grip.url_has_credentials(checkout_url):
+                member_origins.append(
+                    {"repo": safe_repo_name, "manifest_url": manifest_url, "checkout_url": None,
+                     "refused": "credentials"}
+                )
+            else:
+                url = checkout_url
+                if checkout_url != manifest_url:
+                    member_origins.append(
+                        {"repo": safe_repo_name, "manifest_url": manifest_url, "checkout_url": checkout_url}
+                    )
         repo_item = {
             "name": safe_repo_name,
             "path": normalized_path,
-            "url": str(repo_doc.get("url", "")).strip(),
+            "url": url,
         }
         if "revision" in repo_doc:
             repo_item["default_branch"] = str(repo_doc.get("revision") or "").strip()
@@ -859,6 +909,7 @@ def compile_gr1_to_workspace_spec(
         "repos": repos,
         "units": units,
         "not_migrated": not_migrated,
+        "member_origins": member_origins,
         "workspace_constraints": {
             "migration_source": "gr1",
         },
@@ -1067,30 +1118,46 @@ def preserve_gr1_state(workspace_root: Path, migration_dir: Path) -> dict[str, s
     return snapshots
 
 
+def _toml_str(value: object) -> str:
+    """A TOML basic string holding exactly `value`: a quote, backslash, newline or other control character in a url
+    or name stays data. Only what TOML requires is escaped (the quote, the backslash, U+0000..U+001F and U+007F);
+    everything else is written literally, since TOML is UTF-8 and an escaped surrogate pair (what an ASCII-only
+    JSON string makes of a character above U+FFFF) is not a value TOML will load."""
+    out = []
+    for ch in str(value):
+        if ch in ('"', "\\"):
+            out.append("\\" + ch)
+        elif ord(ch) < 0x20 or ord(ch) == 0x7F:
+            out.append(f"\\u{ord(ch):04X}")
+        else:
+            out.append(ch)
+    return '"' + "".join(out) + '"'
+
+
 def render_workspace_spec(compiled: dict[str, object]) -> str:
     lines = [
-        f'workspace_name = "{compiled["workspace_name"]}"',
+        f'workspace_name = {_toml_str(compiled["workspace_name"])}',
         "",
     ]
     constraints = compiled.get("workspace_constraints") or {}
     if constraints:
         lines.append("[workspace_constraints]")
         for key, value in constraints.items():
-            lines.append(f'{key} = "{value}"')
+            lines.append(f'{key} = {_toml_str(value)}')
         lines.append("")
 
     for repo in compiled["repos"]:
         lines.extend(
             [
                 "[[repos]]",
-                f'name = "{repo["name"]}"',
-                f'path = "{repo["path"]}"',
-                f'url = "{repo["url"]}"',
+                f'name = {_toml_str(repo["name"])}',
+                f'path = {_toml_str(repo["path"])}',
+                f'url = {_toml_str(repo["url"])}',
             ]
         )
         default_branch = str(repo.get("default_branch", "")).strip()
         if default_branch:
-            lines.append(f'default_branch = "{default_branch}"')
+            lines.append(f'default_branch = {_toml_str(default_branch)}')
         if repo.get("reference", False):
             lines.append("reference = true")
         lines.append("")
@@ -1099,9 +1166,9 @@ def render_workspace_spec(compiled: dict[str, object]) -> str:
         lines.extend(
             [
                 "[[units]]",
-                f'name = "{unit["name"]}"',
-                f'path = "{unit["path"]}"',
-                "repos = [" + ", ".join(f'"{repo}"' for repo in unit["repos"]) + "]",
+                f'name = {_toml_str(unit["name"])}',
+                f'path = {_toml_str(unit["path"])}',
+                "repos = [" + ", ".join(_toml_str(repo) for repo in unit["repos"]) + "]",
             ]
         )
         lines.append("")
@@ -1147,6 +1214,25 @@ def render_migration(payload: dict[str, object]) -> str:
             f"{len(not_migrated)} unit(s) in the gr1 agents manifest are not in this workspace's spec,"
             " and nothing under them was read. A desk that is its own root migrates from that root."
         )
+    member_origins = payload.get("member_origins") or []
+    if member_origins:
+        lines.append("MEMBER ORIGIN")
+        for row in member_origins:
+            if row.get("refused") == "credentials":
+                lines.append(
+                    f"- {_printable(row['repo'])}: the checkout's origin carries credentials or cannot be parsed and"
+                    " was not used;"
+                    f" the spec keeps {_printable(row['manifest_url'])}. Remove the credential from the url and use a"
+                    " credential helper."
+                )
+                continue
+            lines.append(
+                f"- {_printable(row['repo'])}: {_printable(row['manifest_url'])} -> {_printable(row['checkout_url'])}"
+            )
+        lines.append(
+            f"{len(member_origins)} member(s) differ from the gr1 manifest; the spec records each checkout's own"
+            " origin (userinfo removed), which is what this desk fetches from."
+        )
     lines.append("SNAPSHOTS")
     lines.extend(f"- {name}\t{path}" for name, path in payload["snapshots"].items())
     return "\n".join(lines)

{gitgrip-2.0.0a11 → gitgrip-2.0.0a12}/gr2/python_cli/workspace_guidance.py

@@ -3,6 +3,7 @@
 from pathlib import Path
 
 from .layout import grip_dir
+from .next_steps import _shown
 
 GR1_ONLY_NEXT_STEP = (
     "This workspace is still in gr1 format. Run `gr2 workspace migrate-gr1 .` "
@@ -51,7 +52,7 @@ def missing_workspace_spec_message(workspace_root: Path) -> str:
 def workspace_init_command(target: object = "") -> str:
     """The one place a verb's advice spells the init command (a structural test holds every other text to it), so
     whether that advice suits the path is decided once, in `init_unless_inside_workspace`."""
-    return f"`gr2 workspace init {target}`" if str(target) else "`gr2 workspace init`"
+    return f"`gr2 workspace init {_shown(target)}`" if str(target) else "`gr2 workspace init`"
 
 
 def inside_workspace_sentence(path: Path, enclosing: Path) -> str:

{gitgrip-2.0.0a11 → gitgrip-2.0.0a12}/pyproject.toml

@@ -11,7 +11,7 @@ name = "gitgrip"
 # number and it is not derived from Cargo.toml. gr1 releases as crates.io/GitHub
 # `v1.x.y`; gr2 releases as PyPI `gr2/v2.x.y`. Runtime reads it via
 # importlib.metadata.version("gitgrip"), never a checked-in file.
-version = "2.0.0a11"
+version = "2.0.0a12"
 description = "Workspace layer for multi-repo work: workspaces, isolated lanes, and one grouped review per slice"
 readme = "README.md"
 requires-python = ">=3.11"

{gitgrip-2.0.0a11 → gitgrip-2.0.0a12}/tests/test_branch_in_lane.py

@@ -388,3 +388,54 @@ def test_an_unloadable_bound_lane_without_a_usable_worktree_does_not_hold_its_la
     made = _branch(repo, "other")
     assert made.exit_code == 0, made.output
     assert _git(repo, "branch", "--show-current") == "other"
+
+
+def test_the_lane_named_in_the_refusal_is_quoted_when_its_directories_hold_shell_text(tmp_path: Path) -> None:
+    # Rule: the unit and lane come from the lane doc's directory names, not from the person typing `gr2 branch`,
+    # so the printed lane create quotes them: shlex.split gives the unit as one argument, and the line run by a
+    # shell (gr2 stubbed) starts nothing the directory names hold.
+    from gr2.prototypes import lane_workspace_prototype as lanes
+    import subprocess
+
+    ws, _repos = _lane(tmp_path)
+    repo = _plain(ws / "solo-repo")
+    unit, lane = "u; touch MARKU", "l; touch MARKL"
+    path = lanes.lane_file(ws, unit, lane)
+    path.parent.mkdir(parents=True)
+    path.write_text(f'lane_kind = "bound"\nrepos = ["solo"]\nbound_worktree = "{repo}"\n')
+    moved = _branch(repo, "other")
+    assert moved.exit_code == 2, moved.output
+    assert f"lane {shlex.quote(f'{unit}/{lane}')}," in moved.output, moved.output
+    printed = moved.output.split("new lane: ", 1)[1].strip().replace("<workspace>", str(ws)).replace("<lane>", "next")
+    argv = shlex.split(printed)
+    assert argv[:6] == ["gr2", "lane", "create", str(ws), unit, "next"], printed
+    assert argv[-2:] == ["--branch", "other"], printed
+    ran = subprocess.run(["bash", "-c", "gr2() { :; }\n" + printed], cwd=tmp_path, capture_output=True, text=True)
+    assert ran.returncode == 0, ran.stderr
+    assert not (tmp_path / "MARKU").exists() and not (tmp_path / "MARKL").exists(), printed
+    assert list(tmp_path.glob("MARK*")) == [], printed
+
+
+def test_the_member_key_in_the_refusal_is_quoted_when_the_lane_record_holds_shell_text(tmp_path: Path) -> None:
+    # Rule: the `--repos` key comes from the lane record, not from the person typing `gr2 branch`, and a plain
+    # member key may hold ';' and a space (only separators, NUL and newline are refused), so the printed lane
+    # create quotes it: shlex.split gives the key as one argument, and the line run by a shell starts nothing.
+    from gr2.prototypes import lane_workspace_prototype as lanes
+    import subprocess
+
+    ws = tmp_path / "ws"  # a spec workspace (no native root), where the refusal names --repos
+    (ws / ".grip").mkdir(parents=True)
+    (ws / ".grip" / "workspace_spec.toml").write_text('schema_version = 1\nworkspace_name = "m"\n')
+    repo = _plain(ws / "solo-repo")
+    key = "s; touch MARKK #"
+    path = lanes.lane_file(ws, "u", "l")
+    path.parent.mkdir(parents=True)
+    path.write_text(f'lane_kind = "bound"\nrepos = ["{key}"]\nbound_worktree = "{repo}"\n')
+    moved = _branch(repo, "other")
+    assert moved.exit_code == 2, moved.output
+    printed = moved.output.split("new lane: ", 1)[1].strip().replace("<workspace>", str(ws)).replace("<lane>", "next")
+    argv = shlex.split(printed)
+    assert argv[6:] == ["--repos", key, "--branch", "other"], printed
+    ran = subprocess.run(["bash", "-c", "gr2() { :; }\n" + printed], cwd=tmp_path, capture_output=True, text=True)
+    assert ran.returncode == 0, ran.stderr
+    assert list(tmp_path.glob("MARK*")) == [], printed