feat: add repository git credential fixer

test/credential-fix.test.mjs

@@ -0,0 +1,49 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { execFileSync } from 'node:child_process'
+import { credentialHelperCmd, fixRepoConfig } from '../forge.mjs'
+
+function git(cwd, ...args) {
+  return execFileSync('git', ['-C', cwd, ...args], { encoding: 'utf8' }).trimEnd()
+}
+
+function tempRepo() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'git-forge-credentials-'))
+  const repo = path.join(root, 'repo')
+  fs.mkdirSync(repo)
+  execFileSync('git', ['init', '--quiet', repo])
+  return { root, repo }
+}
+
+test('forge_fix_credentials replaces local helpers and resolves nested paths', async () => {
+  const { root, repo } = tempRepo()
+  try {
+    git(repo, 'config', '--local', '--add', 'credential.helper', 'store')
+    git(repo, 'config', '--local', '--add', 'credential.helper', 'old-helper')
+    const nested = path.join(repo, 'nested')
+    fs.mkdirSync(nested)
+
+    const result = await fixRepoConfig(nested)
+    const expected = credentialHelperCmd()
+
+    assert.equal(result.path, repo)
+    assert.equal(result.fixed, true)
+    assert.deepEqual(result.previous, ['store', 'old-helper'])
+    assert.deepEqual(result.current, ['', expected])
+    assert.deepEqual(git(repo, 'config', '--local', '--get-all', 'credential.helper').split('\n'), ['', expected])
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true })
+  }
+})
+
+test('forge_fix_credentials rejects a non-repository path', async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'git-forge-not-repo-'))
+  try {
+    await assert.rejects(() => fixRepoConfig(root), /not a git repository/)
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true })
+  }
+})