Git on blog.rymcg.tech

Git extensions in Babashka

ryan-blog@rymcg.tech (EnigmaCurry) — Tue, 02 Jun 2026 00:00:00 -0600

In a previous post, I introduced git_extensions.sh – a monolithic bash script providing custom git subcommands (git vendor, git deploy, git deploy-key, git remote-proto). It worked fine. It also weighed in at 1,590 lines of bash, with global variables named things like VENDOR_SSH_PORT and URL parsing done through cascading regex in BASH_REMATCH. The kind of code where adding a feature means holding your breath and hoping set -eo pipefail catches whatever you break.

So I ported it to Babashka.

Why Babashka?

Babashka is a fast-starting Clojure scripting runtime. It ships as a single static binary, starts in under 50ms, and gives you a real language with real data structures instead of a stringly-typed minefield.

The pitch for porting a bash script to Babashka:

Maps instead of globals. URL parsing returns {:host "github.com" :path "user/repo"} instead of setting REMOTE_PROTO_HOST and praying nobody clobbers it.
Explicit parameters instead of cd. The bash version relies on cd "$dest" to set the working directory for subsequent git commands. The Babashka version passes :dir explicitly to every process call. No spooky action at a distance.
Actual testable functions. Each function takes arguments and returns values. No subshell surprises, no nameref tricks (local -n), no quoting emergencies.
63% less code. 580 lines of Clojure vs 1,590 lines of bash, with identical functionality and CLI interface.

The tradeoff is a runtime dependency – you need bb on your PATH. But if you’re already using Nix (and if you’re reading this blog, you probably are), that’s a non-issue.

What changed

Nothing, from the user’s perspective. The CLI is identical:

git vendor enigmacurry/sway-home
git deploy git@github.com:user/repo.git
git deploy-key list
git remote-proto ssh --port 2222

Same flags, same output, same symlink dispatch trick. The script detects its invoked name and dispatches accordingly, with a fallback to first-argument dispatch:

# Via symlink (git finds git-vendor in PATH):
git vendor org/repo

# Direct invocation:
bb git_extensions.bb vendor org/repo

How the port went

Most of the translation was mechanical. Bash patterns have direct Clojure equivalents:

Bash	Babashka
`[[ "$url" =~ ^git@([^:]+):(.+)$ ]]`	`(re-matches #"git@([^:]+):(.+)" url)`
`REPO_URL="${BASH_REMATCH[1]}"`	`(let [[_ host path] (re-matches ...)])`
`local -n _host=$2`	Just return a map
`check_deps git ssh-keygen`	`(check-deps "git" "ssh-keygen")`
`git remote get-url origin`	`(git-out dir "remote" "get-url" "origin")`
`awk '...' "$config_file" > "$tmp_file"`	Line processing with `loop`/`recur`

The SSH config manipulation (adding/removing Host blocks) was the most interesting part. The bash version uses awk with state tracking. The Clojure version does the same thing with a loop that tracks a skip flag – structurally identical, but without awk’s implicit line iteration.

The one genuinely tricky part was symlink detection. Babashka resolves *file* to the actual script, not the symlink. The solution tries two strategies: on Linux it reads /proc/self/cmdline (the null-separated argv), and on macOS/BSD it falls back to ps -p <pid> -o args=. Both scan the process command line for an argv entry starting with git-.

Installation

If you use my sway-home config with home-manager, it’s already wired up – the symlinks now point to git_extensions.bb.

For manual installation, you’ll need Babashka installed, then:

## Download the script and make it executable:
curl -Lo ~/.local/bin/git_extensions.bb \
  https://raw.githubusercontent.com/EnigmaCurry/blog.rymcg.tech/master/src/git/git_extensions.bb
chmod +x ~/.local/bin/git_extensions.bb

## Create symlinks for each extension:
ln -s git_extensions.bb ~/.local/bin/git-vendor
ln -s git_extensions.bb ~/.local/bin/git-deploy
ln -s git_extensions.bb ~/.local/bin/git-deploy-key
ln -s git_extensions.bb ~/.local/bin/git-remote-proto

The bash version still works and isn’t going anywhere. Use whichever you prefer.

The script

Download the script from this direct link

#!/usr/bin/env bb

;;; ============================================================
;;; Git Extensions Framework
;;; ============================================================
;;;
;;; A multi-command git extension framework.
;;; Create symlinks like `git-deploy` pointing to this script.
;;; The script detects the command from the symlink name.
;;;
;;; Supported extensions:
;;;   - vendor: Clone repositories to ~/git/vendor/{org}/{repo}
;;;   - deploy: Clone repositories using deploy key authentication
;;;   - deploy-key: Manage deploy keys (list, show, remove)
;;;   - remote-proto: Convert remote URL protocol (https, git, ssh)
;;;
;;; ============================================================

(ns git-extensions
  (:require [babashka.fs :as fs]
            [babashka.process :as proc]
            [clojure.string :as str]
            [clojure.java.io :as io]))

(def original-args *command-line-args*)
(def home (System/getProperty "user.home"))

;;; ============================================================
;;; Common Utilities
;;; ============================================================

(defn stderr [& args]
  (binding [*out* *err*]
    (apply println args)))

(defn error [& args]
  (apply stderr "Error:" args))

(defn fault [& [msg]]
  (when msg (error msg))
  (stderr "Exiting.")
  (System/exit 1))

(defn check-deps [& deps]
  (let [missing (remove #(fs/which %) deps)]
    (when (seq missing)
      (fault (str "Missing dependencies: " (str/join " " missing))))))

(defn ask-yes-no
  "Prompt for yes/no confirmation. Returns true for yes."
  ([prompt] (ask-yes-no prompt nil))
  ([prompt default]
   (loop []
     (let [suffix (case default "y" " [Y/n] " "n" " [y/N] " " [y/n] ")]
       (print (str prompt suffix))
       (flush)
       (let [reply (str/lower-case (str/trim (or (read-line) "")))
             reply (if (str/blank? reply) (or default "") reply)]
         (case reply
           ("y" "yes") true
           ("n" "no") false
           (do (println "Please answer yes or no.") (recur))))))))

(defn ask-input
  "Prompt for text input with optional default."
  ([prompt] (ask-input prompt nil))
  ([prompt default]
   (if default
     (do (print (str prompt " [" default "] ")) (flush)
         (let [reply (str/trim (or (read-line) ""))]
           (if (str/blank? reply) default reply)))
     (do (print (str prompt " ")) (flush)
         (str/trim (or (read-line) ""))))))

;;; Git helpers — all take an explicit directory

(defn git-out
  "Run git in dir, return trimmed stdout or nil on failure."
  [dir & args]
  (let [r (apply proc/shell {:dir dir :out :string :err :string :continue true} "git" args)]
    (when (zero? (:exit r))
      (str/trim (:out r)))))

(defn git-ok?
  "Run git in dir, return true if exit 0."
  [dir & args]
  (zero? (:exit (apply proc/shell {:dir dir :out :string :err :string :continue true} "git" args))))

(defn git!
  "Run git in dir with output to terminal, exit on failure."
  [dir & args]
  (let [r (apply proc/shell {:dir dir :continue true} "git" args)]
    (when-not (zero? (:exit r))
      (fault (str "git " (str/join " " args) " failed")))
    r))

;;; ============================================================
;;; URL Parsing (shared)
;;; ============================================================

(defn parse-remote-url
  "Parse a git remote URL. Returns {:host :path} or nil."
  [url]
  (let [url (str/replace url #"\.git$" "")]
    (or (when-let [[_ host path] (re-matches #"git@([^:]+):(.+)" url)]
          {:host host :path path})
        (when-let [[_ _ host path] (re-matches #"ssh://([^@]+@)?([^/]+)/(.+)" url)]
          {:host host :path path})
        (when-let [[_ host path] (re-matches #"https?://([^/]+)/(.+)" url)]
          {:host host :path path}))))

;;; ============================================================
;;; Deploy Extension
;;; ============================================================

(defn deploy-parse-repo-spec
  "Parse 'url#branch' → {:url :branch}."
  [spec]
  (if-let [[_ url branch] (re-matches #"(.+)#([^#]+)" spec)]
    {:url url :branch branch}
    {:url spec :branch nil}))

(defn deploy-default-destination
  "Derive ~/git/vendor/{org}/{repo} from URL."
  [url]
  (if-let [{:keys [path]} (parse-remote-url url)]
    (let [path (str/replace path #"^/" "")
          parts (str/split path #"/")
          org (str/lower-case (first parts))
          repo (last parts)]
      (str home "/git/vendor/" org "/" repo))
    ;; Fallback: just repo name
    (-> url (str/replace #"\.git$" "") (str/split #"/") last)))

(defn deploy-normalize-url
  "Normalize URL to SSH format (git@host:path.git)."
  [url]
  (let [url (str/replace url #"\.git$" "")]
    (cond
      (re-matches #"https?://([^/]+)/(.+)" url)
      (let [[_ host path] (re-matches #"https?://([^/]+)/(.+)" url)]
        (str "git@" host ":" path ".git"))

      (str/starts-with? url "git@")
      (str url ".git")

      (str/starts-with? url "ssh://")
      (let [rest (-> url (str/replace #"^ssh://" "") (str/replace #"^[^@]+@" ""))]
        (if-let [[_ host _ _ path] (re-matches #"([^:/]+)(:([0-9]+))?/(.+)" rest)]
          (str "git@" host ":" path ".git")
          (str url ".git")))

      :else (str url ".git"))))

(defn deploy-alias-url?
  "Check if URL uses a deploy key alias (git@deploy-...)."
  [url]
  (boolean (re-find #"^git@deploy-" url)))

(defn deploy-extract-alias
  "Extract alias from git@alias:path URL."
  [url]
  (second (re-matches #"git@([^:]+):.*" url)))

(defn deploy-convert-remote-url
  "Convert a remote URL to use the deploy key alias."
  [url alias]
  (if-let [{:keys [path]} (parse-remote-url url)]
    (str "git@" alias ":" path ".git")
    (fault (str "Cannot parse remote URL: " url))))

;;; --- SSH Config Management ---

(def ssh-config-file (str home "/.ssh/config"))

(defn ssh-keys-dir []
  (let [dir (str home "/.ssh/deploy-keys")]
    (fs/create-dirs dir)
    (fs/set-posix-file-permissions dir "rwx------")
    dir))

(defn deploy-generate-alias [host path]
  (-> (str "deploy--" host "--" path)
      (str/replace #"/" "-")
      (str/replace #"-{2,}" "-")))

(defn deploy-key-file-path [alias]
  (str (ssh-keys-dir) "/" alias))

(defn deploy-host-alias-exists? [alias]
  (and (fs/exists? ssh-config-file)
       (some #(= (str/trim %) (str "Host " alias))
             (str/split-lines (slurp ssh-config-file)))))

(defn- remove-host-block
  "Remove a Host block from SSH config content."
  [content alias]
  (let [lines (str/split-lines content)]
    (->> (loop [[line & more] lines skip false result []]
           (if (nil? line)
             result
             (if (re-matches #"Host .+" line)
               (if (= (str/trim line) (str "Host " alias))
                 (recur more true result)
                 (recur more false (conj result line)))
               (if skip
                 (recur more skip result)
                 (recur more false (conj result line))))))
         (str/join "\n"))))

(defn deploy-add-host-alias [alias real-host key-file & [port]]
  (fs/create-dirs (fs/parent ssh-config-file))
  (let [existing (if (fs/exists? ssh-config-file) (slurp ssh-config-file) "")
        separator (cond
                    (str/blank? existing) ""
                    (not (str/ends-with? existing "\n")) "\n\n"
                    :else "\n")
        entry (str separator
                   "Host " alias "\n"
                   "    HostName " real-host "\n"
                   (when port (str "    Port " port "\n"))
                   "    User git\n"
                   "    IdentityFile " key-file "\n"
                   "    IdentitiesOnly yes\n")]
    (spit ssh-config-file entry :append true)
    (fs/set-posix-file-permissions ssh-config-file "rw-------")
    (stderr (str "## Added SSH host alias '" alias "'"))))

(defn deploy-remove-host-alias [alias]
  (when (fs/exists? ssh-config-file)
    (spit ssh-config-file (remove-host-block (slurp ssh-config-file) alias))
    (fs/set-posix-file-permissions ssh-config-file "rw-------")))

(defn deploy-update-host-alias [alias real-host key-file & [port]]
  (deploy-remove-host-alias alias)
  (deploy-add-host-alias alias real-host key-file port))

(defn deploy-generate-key [key-file comment]
  (proc/shell {:out :string :err :string}
              "ssh-keygen" "-t" "ed25519" "-f" key-file "-N" "" "-C" comment)
  (fs/set-posix-file-permissions key-file "rw-------")
  (fs/set-posix-file-permissions (str key-file ".pub") "rw-r--r--")
  (stderr (str "## Generated new deploy key: " key-file)))

;;; --- Deploy Key Setup ---

(defn deploy-setup-key
  "Setup deploy key for a remote in a given repo dir.
   Returns {:alias :key-file :created?}."
  [dir remote-name repo-port]
  (let [remote-url (or (git-out dir "remote" "get-url" remote-name)
                       (fault (str "Remote '" remote-name "' not found")))]
    (if (deploy-alias-url? remote-url)
      ;; Already configured
      (let [alias (deploy-extract-alias remote-url)]
        (stderr (str "## Already configured with deploy key: " alias))
        {:alias alias :key-file (deploy-key-file-path alias) :created? false})
      ;; Parse and setup
      (let [{:keys [host path]} (or (parse-remote-url remote-url)
                                    (fault (str "Cannot parse remote URL: " remote-url)))
            _ (stderr (str "## Host: " host))
            _ (stderr (str "## Path: " path))
            alias (deploy-generate-alias host path)
            key-file (deploy-key-file-path alias)
            _ (stderr (str "## SSH alias: " alias))
            _ (stderr (str "## Key file: " key-file))
            created? (if (fs/exists? key-file)
                       (do (stderr "## Deploy key already exists") false)
                       (let [hostname (or (System/getenv "HOSTNAME") "localhost")]
                         (deploy-generate-key key-file
                           (str "deploy-key@" hostname " " host ":" path))
                         true))]
        (if (deploy-host-alias-exists? alias)
          (stderr "## SSH host alias already configured")
          (deploy-add-host-alias alias host key-file repo-port))
        ;; Update remote URL
        (let [new-url (deploy-convert-remote-url remote-url alias)]
          (when (not= remote-url new-url)
            (git! dir "remote" "set-url" remote-name new-url)
            (stderr "## Updated remote URL to use deploy key")))
        {:alias alias :key-file key-file :created? created?}))))

;;; --- Deploy Repository Setup ---

(defn deploy-init-repo [dest url remote-name]
  (if (fs/directory? dest)
    (if (fs/directory? (str dest "/.git"))
      (do (stderr (str "## Directory already contains a git repository: " dest))
          (stderr "## Updating configuration..."))
      (fault (str "Directory exists but is not a git repository: " dest)))
    (do (fs/create-dirs dest)
        (stderr (str "## Created directory: " dest))))
  (when-not (fs/directory? (str dest "/.git"))
    (git! dest "init" "--quiet")
    (stderr "## Initialized empty git repository")
    (git! dest "symbolic-ref" "HEAD" "refs/heads/__deploy_pending__"))
  (if (git-out dest "remote" "get-url" remote-name)
    (do (git! dest "remote" "set-url" remote-name url)
        (stderr (str "## Updated remote '" remote-name "': " url)))
    (do (git! dest "remote" "add" remote-name url)
        (stderr (str "## Added remote '" remote-name "': " url))))
  (git! dest "config" "checkout.defaultRemote" remote-name))

(defn deploy-test-key [dir remote-name & [timeout-secs]]
  (let [t (str (or timeout-secs 10))]
    (zero? (:exit (proc/shell {:dir dir :out :string :err :string :continue true}
                              "timeout" t "git" "ls-remote" "--heads" remote-name)))))

(defn deploy-get-default-branch [dir remote-name]
  (let [result (git-out dir "ls-remote" "--symref" remote-name "HEAD")]
    (or (when result
          (some #(second (re-matches #"ref:\s+refs/heads/(\S+)\s+HEAD" %))
                (str/split-lines result)))
        ;; Fallback: check common names
        (let [branches (->> (str/split-lines (or (git-out dir "ls-remote" "--heads" remote-name) ""))
                            (keep #(second (re-matches #".*refs/heads/(.+)" %))))]
          (or (some #{"main"} branches)
              (some #{"master"} branches)
              (some #{"develop"} branches)
              (first branches))))))

(defn deploy-show-key-instructions [key-file]
  (println)
  (println "========================================")
  (println "DEPLOY KEY NOT YET AUTHORIZED")
  (println "========================================")
  (println)
  (println "Add this public key as a deploy key on your git server:")
  (println)
  (print (slurp (str key-file ".pub")))
  (println)
  (println "========================================")
  (println)
  (println "For GitHub: Settings \u2192 Deploy keys \u2192 Add deploy key")
  (println "For GitLab: Settings \u2192 Repository \u2192 Deploy keys")
  (println "For Forgejo/Gitea: Settings \u2192 Deploy Keys \u2192 Add Deploy Key")
  (println))

;;; --- Deploy Help ---

(def deploy-help-text
  "## git deploy - Clone a repository using a deploy key

Usage: git deploy <repo-url[#branch]> [destination] [options]
       git deploy <path> [options]

Arguments:
    repo-url        Repository URL (supports #branch suffix)
    destination     Local directory (default: ~/git/vendor/{ORG}/{REPO})
    path            Path to existing git repo (converts remote to deploy key)

Options:
    --remote <name>    Remote name (default: origin)
    --branch <name>    Branch to clone (overrides #branch in URL)
    -h, --help         Show this help message

Description:
    Clones a repository using a dedicated deploy key for authentication,
    or converts an existing repository's remote to use a deploy key.

    When given a URL:
    - Creates a new clone using a deploy key for authentication

    When given a path to an existing git repository:
    - Offers to convert the existing remote to use a deploy key
    - If no remote exists, prompts for a URL
    - If already configured, tests the deploy key

    If the deploy key is already authorized:
    - Discovers the default branch automatically (if not specified)
    - Fetches and checks out the repository
    - Exits successfully (code 0)

    If the deploy key is NOT yet authorized:
    - Creates the deploy key and shows the public key
    - Prints instructions to add it to your git server
    - Exits with error code 1 (re-run after adding the key)

URL Formats:
    git@github.com:user/repo.git
    git@github.com:user/repo.git#main
    https://github.com/user/repo
    https://github.com/user/repo#develop
    ssh://git@host:port/user/repo.git

Examples:
    git deploy git@github.com:user/repo.git
    git deploy git@github.com:user/repo.git#develop
    git deploy git@github.com:user/repo.git ~/projects/myrepo
    git deploy /path/to/existing/repo
    git deploy .

Workflow:
    1. Run 'git deploy <url>' or 'git deploy <path>'
    2. If key not yet authorized, add the printed key to your git server
    3. Re-run the command - repository will be cloned/configured")

;;; --- Deploy: Parse CLI args ---

(defn deploy-parse-args [args]
  (loop [[arg & more] args
         opts {:repo-spec nil :destination nil :remote "origin" :branch-override nil}]
    (if (nil? arg)
      opts
      (case arg
        "--remote" (recur (rest more) (assoc opts :remote (first more)))
        "--branch" (recur (rest more) (assoc opts :branch-override (first more)))
        ("-h" "--help") (do (println deploy-help-text) (System/exit 0))
        (if (str/starts-with? arg "-")
          (do (error "Unknown option:" arg) (println deploy-help-text) (System/exit 1))
          (cond
            (nil? (:repo-spec opts)) (recur more (assoc opts :repo-spec arg))
            (nil? (:destination opts)) (recur more (assoc opts :destination arg))
            :else (do (error "Too many arguments")
                      (println deploy-help-text)
                      (System/exit 1))))))))

;;; --- Deploy: Clone success handler ---

(defn deploy-clone-success [dir remote branch]
  (let [branch (or branch
                   (do (stderr "## Discovering default branch...")
                       (let [b (deploy-get-default-branch dir remote)]
                         (when b (stderr (str "## Default branch: " b)))
                         b)))]
    (if (str/blank? branch)
      (do (stderr)
          (stderr "========================================")
          (stderr "## Repository is empty (no branches on remote)")
          (stderr (str "## Location: " dir))
          (stderr "========================================"))
      (do (stderr (str "## Fetching from " remote "..."))
          (git! dir "fetch" remote)
          (stderr (str "## Checking out branch '" branch "'..."))
          (git! dir "checkout" branch)
          (proc/shell {:dir dir :continue true}
                      "git" "branch" (str "--set-upstream-to=" remote "/" branch) branch)
          (stderr)
          (stderr "========================================")
          (stderr "## Repository cloned successfully!")
          (stderr (str "## Location: " dir))
          (stderr (str "## Branch: " branch))
          (stderr "========================================")))))

;;; --- Deploy: Key failure handler ---

(defn deploy-key-failure [key-file dest convert-mode?]
  (when (and key-file (fs/exists? (str key-file ".pub")))
    (deploy-show-key-instructions key-file))
  (stderr)
  (stderr (str "## Repository prepared at: " dest))
  (stderr "## After adding the deploy key, run this command again:")
  (if convert-mode?
    (stderr "##   git deploy")
    (stderr (str "##   git deploy " (str/join " " original-args))))
  (stderr)
  (System/exit 1))

;;; --- Deploy Main ---

(defn deploy-main [args]
  (check-deps "git" "ssh-keygen")
  (let [{:keys [repo-spec destination remote branch-override]} (deploy-parse-args args)]
    (when (str/blank? repo-spec)
      (println deploy-help-text)
      (System/exit 0))

    ;; Validate: must be a directory or a URL
    (let [is-dir (fs/directory? repo-spec)
          is-url (boolean (re-find #"^(git@|ssh://|https?://)" (or repo-spec "")))]
      (when (and (not is-dir) (not is-url))
        (fault (str "Invalid argument: '" repo-spec "' is not a directory or a valid URL")))

      (if is-dir
        ;; ---- Convert mode ----
        (let [target-dir (str (fs/absolutize repo-spec))]
          (when-not (git-ok? target-dir "rev-parse" "--git-dir")
            (fault (str "Directory is not a git repository: " target-dir)))
          (let [existing-url (git-out target-dir "remote" "get-url" remote)
                already-configured (and existing-url (deploy-alias-url? existing-url))
                repo-spec (cond
                            (nil? existing-url)
                            (do (println)
                                (println (str "Repository has no '" remote "' remote configured."))
                                (println)
                                (let [url (ask-input "Enter repository URL:")]
                                  (when (str/blank? url) (fault "No URL provided"))
                                  url))

                            already-configured existing-url

                            :else
                            (do (println)
                                (println (str "Found existing remote '" remote "':"))
                                (println (str "  " existing-url))
                                (println)
                                (if (ask-yes-no "Convert this remote to use a deploy key?" "y")
                                  existing-url
                                  (do (println "Aborted.") (System/exit 0)))))
                {:keys [url branch]} (deploy-parse-repo-spec repo-spec)
                branch (or branch-override branch)
                repo-port (when-not already-configured
                            (second (re-find #"^ssh://(?:[^@]+@)?[^:/]+:([0-9]+)/" url)))
                url (if already-configured url (deploy-normalize-url url))]

            (stderr)
            (stderr (str "## Repository URL: " url))
            (stderr (str "## Destination: " target-dir))
            (when branch (stderr (str "## Branch: " branch)))
            (stderr)

            (let [key-info (if already-configured
                             (let [alias (deploy-extract-alias url)]
                               (stderr (str "## Deploy key already configured: " alias))
                               {:key-file (deploy-key-file-path alias)})
                             (do (deploy-init-repo target-dir url remote)
                                 (stderr)
                                 (stderr "## Setting up deploy key...")
                                 (deploy-setup-key target-dir remote repo-port)))]
              (stderr)
              (stderr "## Testing deploy key...")
              (if (deploy-test-key target-dir remote)
                (do (stderr "## Deploy key is working!")
                    (stderr)
                    (stderr "========================================")
                    (stderr (if already-configured
                              "## Deploy key is working!"
                              "## Remote converted to deploy key successfully!"))
                    (stderr (str "## Location: " target-dir))
                    (stderr "========================================"))
                (deploy-key-failure (:key-file key-info) target-dir true)))))

        ;; ---- Clone mode ----
        (let [{:keys [url branch]} (deploy-parse-repo-spec repo-spec)
              branch (or branch-override branch)
              repo-port (second (re-find #"^ssh://(?:[^@]+@)?[^:/]+:([0-9]+)/" url))
              url (deploy-normalize-url url)
              dest (or destination (deploy-default-destination url))
              dest (if (str/starts-with? dest "/") dest
                       (str (System/getProperty "user.dir") "/" dest))]

          (stderr)
          (stderr (str "## Repository URL: " url))
          (stderr (str "## Destination: " dest))
          (when branch (stderr (str "## Branch: " branch)))
          (stderr)

          (deploy-init-repo dest url remote)
          (stderr)
          (stderr "## Setting up deploy key...")
          (let [key-info (deploy-setup-key dest remote repo-port)]
            (stderr)
            (stderr "## Testing deploy key...")
            (if (deploy-test-key dest remote)
              (do (stderr "## Deploy key is working!")
                  (deploy-clone-success dest remote branch))
              (deploy-key-failure (:key-file key-info) dest false))))))))

;;; ============================================================
;;; Deploy-Key Extension
;;; ============================================================

(defn deploy-key-list []
  (let [keys-dir (str home "/.ssh/deploy-keys")]
    (if-not (fs/directory? keys-dir)
      (println "No deploy keys found.")
      (let [key-files (->> (fs/list-dir keys-dir)
                           (map str)
                           (remove #(str/ends-with? % ".pub"))
                           (filter #(fs/regular-file? %))
                           sort)]
        (if (empty? key-files)
          (println "No deploy keys found.")
          (do (println "Deploy keys:")
              (println)
              (doseq [key-file key-files]
                (let [alias (fs/file-name key-file)
                      pub-file (str key-file ".pub")
                      config-content (when (fs/exists? ssh-config-file)
                                       (slurp ssh-config-file))
                      in-config (and config-content
                                     (some #(= (str/trim %) (str "Host " alias))
                                           (str/split-lines config-content)))
                      hostname (when in-config
                                 ;; Extract HostName from the block
                                 (let [lines (str/split-lines config-content)]
                                   (loop [[line & more] lines found false]
                                     (when line
                                       (if (re-matches #"Host .+" line)
                                         (recur more (= (str/trim line) (str "Host " alias)))
                                         (if (and found (re-find #"HostName" line))
                                           (str/trim (second (str/split (str/trim line) #"\s+" 2)))
                                           (recur more found)))))))]
                  (println (str "  " alias))
                  (when hostname (println (str "    Host: " hostname)))
                  (println (str "    Key:  " key-file))
                  (println (str "    SSH config: " (if in-config "yes" "no")))
                  (when (fs/exists? pub-file)
                    (let [result (proc/shell {:out :string :err :string :continue true}
                                            "ssh-keygen" "-lf" pub-file)]
                      (when (zero? (:exit result))
                        (let [fingerprint (second (str/split (str/trim (:out result)) #"\s+"))]
                          (when fingerprint
                            (println (str "    Fingerprint: " fingerprint)))))))
                  (println)))))))))

(defn deploy-key-show [alias]
  (when (str/blank? alias)
    (error "Missing alias argument")
    (System/exit 1))
  (let [pub-file (str home "/.ssh/deploy-keys/" alias ".pub")]
    (when-not (fs/exists? pub-file)
      (fault (str "Deploy key not found: " alias)))
    (println (str "Public key for " alias ":"))
    (println)
    (print (slurp pub-file))
    (println)))

(defn deploy-key-remove [alias]
  (when (str/blank? alias)
    (error "Missing alias argument")
    (System/exit 1))
  (let [keys-dir (str home "/.ssh/deploy-keys")
        key-file (str keys-dir "/" alias)
        pub-file (str key-file ".pub")]
    (let [found (atom false)]
      ;; Remove from SSH config
      (when (and (fs/exists? ssh-config-file)
                 (some #(= (str/trim %) (str "Host " alias))
                       (str/split-lines (slurp ssh-config-file))))
        (spit ssh-config-file (remove-host-block (slurp ssh-config-file) alias))
        (fs/set-posix-file-permissions ssh-config-file "rw-------")
        (println (str "Removed SSH config entry: " alias))
        (reset! found true))
      ;; Remove key files
      (when (fs/exists? key-file)
        (fs/delete key-file)
        (println (str "Removed private key: " key-file))
        (reset! found true))
      (when (fs/exists? pub-file)
        (fs/delete pub-file)
        (println (str "Removed public key: " pub-file))
        (reset! found true))
      (when-not @found
        (fault (str "Deploy key not found: " alias)))
      (println)
      (println (str "Deploy key '" alias "' removed successfully."))
      (println)
      (println "Note: If any repositories are using this key, you'll need to")
      (println "update their remote URLs or create a new deploy key."))))

(def deploy-key-help-text
  "## git deploy-key - Manage deploy keys

Usage: git deploy-key <command> [args]

Commands:
    list              List all deploy keys
    show <alias>      Show the public key for an alias
    remove <alias>    Remove a deploy key and its SSH config entry

Options:
    -h, --help        Show this help message

Examples:
    git deploy-key list
    git deploy-key show deploy--github.com--user-repo
    git deploy-key remove deploy--github.com--user-repo

Files:
    Keys:   ~/.ssh/deploy-keys/
    Config: ~/.ssh/config")

(defn deploy-key-main [args]
  (let [[subcommand & rest-args] args]
    (case subcommand
      ("list" "ls") (deploy-key-list)
      ("show" "cat") (deploy-key-show (first rest-args))
      ("remove" "rm" "delete") (deploy-key-remove (first rest-args))
      ("-h" "--help" "help" nil) (do (println deploy-key-help-text) (System/exit 0))
      (do (error "Unknown command:" subcommand)
          (println deploy-key-help-text)
          (System/exit 1)))))

;;; ============================================================
;;; Vendor Extension
;;; ============================================================

(def vendor-default-domain "github.com")

(defn vendor-parse-ref
  "Parse a git repository reference into {:domain :org :repo :ssh? :ssh-port}."
  [input]
  (let [input (str/replace input #"/$" "")]
    (or
     ;; https://domain/org/repo
     (when-let [[_ domain org repo] (re-matches #"https?://([^/]+)/([^/]+)/([^/]+)/?" input)]
       {:domain domain :org org :repo repo :ssh? false})

     ;; ssh://[git@]domain[:port]/org/repo
     (when-let [[_ _ domain _ port org repo]
                (re-matches #"ssh://(git@)?([^/:]+)(:([0-9]+))?/([^/]+)/(.+)" input)]
       {:domain domain :org org :repo repo :ssh? true :ssh-port port})

     ;; git@domain:org/repo
     (when-let [[_ domain org repo] (re-matches #"git@([^:]+):([^/]+)/(.+)" input)]
       {:domain domain :org org :repo repo :ssh? true})

     ;; domain/org/repo (three parts, first has dots)
     (when-let [[_ domain org repo]
                (re-matches #"([a-zA-Z0-9.-]+\.[a-zA-Z]+)/([^/]+)/([^/]+)" input)]
       {:domain domain :org org :repo repo :ssh? false})

     ;; org/repo (two parts, default domain)
     (when-let [[_ org repo] (re-matches #"([^/]+)/([^/]+)" input)]
       {:domain vendor-default-domain :org org :repo repo :ssh? false}))))

(defn vendor-normalize [{:keys [repo org] :as parsed}]
  (-> parsed
      (assoc :repo (str/replace repo #"\.git$" ""))
      (assoc :org (str/lower-case org))))

(defn vendor-build-url [{:keys [domain org repo ssh? ssh-port]}]
  (if ssh?
    (if ssh-port
      (str "ssh://git@" domain ":" ssh-port "/" org "/" repo ".git")
      (str "git@" domain ":" org "/" repo ".git"))
    (str "https://" domain "/" org "/" repo)))

(def vendor-help-text
  "## git vendor - Clone repositories to ~/git/vendor/{org}/{repo}

Usage: git vendor <repository>

Arguments:
    repository      Repository reference in any supported format

Supported Formats:
    org/repo                          Uses github.com by default
    github.com/org/repo               Domain with path
    https://github.com/org/repo       HTTPS URL
    git@github.com:org/repo.git       SSH URL
    ssh://git@host:port/org/repo      SSH URL with custom port

Options:
    -h, --help      Show this help message

Description:
    Clones a repository to ~/git/vendor/{org}/{repo}.
    The org name is lowercased for consistent directory structure.

    If the repository already exists, reports the location and exits.

Examples:
    git vendor enigmacurry/sway-home
    git vendor github.com/enigmacurry/sway-home
    git vendor https://github.com/EnigmaCurry/sway-home.git
    git vendor git@github.com:EnigmaCurry/sway-home.git
    git vendor ssh://git@github.com:22/EnigmaCurry/sway-home.git")

(defn vendor-main [args]
  (check-deps "git")
  (let [repo-ref (loop [[arg & more] args ref nil]
                   (if (nil? arg)
                     ref
                     (case arg
                       ("-h" "--help") (do (println vendor-help-text) (System/exit 0))
                       (if (str/starts-with? arg "-")
                         (do (error "Unknown option:" arg)
                             (println vendor-help-text) (System/exit 1))
                         (if (nil? ref)
                           (recur more arg)
                           (do (error "Too many arguments")
                               (println vendor-help-text) (System/exit 1)))))))]
    (when (str/blank? repo-ref)
      (println vendor-help-text)
      (System/exit 0))
    (let [parsed (vendor-parse-ref repo-ref)]
      (when-not parsed
        (error "Invalid repository format:" repo-ref)
        (println)
        (println "Supported formats:")
        (println "  org/repo")
        (println "  github.com/org/repo")
        (println "  https://github.com/org/repo")
        (println "  git@github.com:org/repo.git")
        (println "  ssh://git@host:port/org/repo")
        (System/exit 1))
      (let [{:keys [org repo] :as parsed} (vendor-normalize parsed)
            clone-url (vendor-build-url parsed)
            vendor-dir (str home "/git/vendor")
            target-dir (str vendor-dir "/" org "/" repo)]
        (if (fs/directory? target-dir)
          (do (println (str "Repository already exists: " target-dir))
              (System/exit 0))
          (do (fs/create-dirs (str vendor-dir "/" org))
              (println (str "Cloning " clone-url))
              (println (str "     to " target-dir))
              (println)
              (if (zero? (:exit (proc/shell {:continue true} "git" "clone" clone-url target-dir)))
                (do (println)
                    (println (str "Repository cloned: " target-dir)))
                (fault "Clone failed"))))))))

;;; ============================================================
;;; Remote-Proto Extension
;;; ============================================================

(defn remote-proto-parse-url
  "Parse a git remote URL into {:host :org :repo :port}."
  [url]
  (let [url (str/replace url #"\.git$" "")]
    (or (when-let [[_ host org repo] (re-matches #"https?://([^/]+)/([^/]+)/([^/]+)/?" url)]
          {:host host :org org :repo repo})
        (when-let [[_ _ host _ port org repo]
                   (re-matches #"ssh://(git@)?([^/:]+)(:([0-9]+))?/([^/]+)/([^/]+)/?" url)]
          {:host host :org org :repo repo :port port})
        (when-let [[_ host org repo] (re-matches #"git@([^:]+):([^/]+)/([^/]+)" url)]
          {:host host :org org :repo repo}))))

(defn remote-proto-build-url [{:keys [host org repo port]} protocol]
  (case protocol
    ("http" "https") (str "https://" host "/" org "/" repo ".git")
    "git"            (str "git@" host ":" org "/" repo ".git")
    "ssh"            (if port
                       (str "ssh://git@" host ":" port "/" org "/" repo ".git")
                       (str "ssh://git@" host "/" org "/" repo ".git"))))

(def remote-proto-help-text
  "## git remote-proto - Convert remote URL protocol

Usage: git remote-proto <protocol> [options]

Arguments:
    protocol        Target protocol: http, https, git, or ssh

Protocols:
    http, https     https://{host}/{org}/{repo}.git
    git             git@{host}:{org}/{repo}.git
    ssh             ssh://git@{host}[:port]/{org}/{repo}.git

Options:
    --remote <name>    Remote name (default: origin)
    --port <port>      SSH port (only used with ssh protocol)
    -h, --help         Show this help message

Description:
    Converts the remote URL to use a different protocol while
    preserving the host, organization, and repository.

Examples:
    git remote-proto git
    git remote-proto https
    git remote-proto ssh --port 2222
    git remote-proto ssh --remote upstream")

(defn remote-proto-main [args]
  (check-deps "git")
  (let [parsed (loop [[arg & more] args
                      opts {:protocol nil :remote "origin" :port nil}]
                 (if (nil? arg)
                   opts
                   (case arg
                     "--remote" (recur (rest more) (assoc opts :remote (first more)))
                     "--port" (recur (rest more) (assoc opts :port (first more)))
                     ("-h" "--help") (do (println remote-proto-help-text) (System/exit 0))
                     (if (str/starts-with? arg "-")
                       (do (error "Unknown option:" arg)
                           (println remote-proto-help-text) (System/exit 1))
                       (if (nil? (:protocol opts))
                         (recur more (assoc opts :protocol arg))
                         (do (error "Too many arguments")
                             (println remote-proto-help-text) (System/exit 1)))))))
        {:keys [protocol remote port]} parsed]

    (when (str/blank? protocol)
      (println remote-proto-help-text)
      (System/exit 0))

    (when-not (#{"http" "https" "git" "ssh"} protocol)
      (fault (str "Invalid protocol: " protocol " (must be http, https, git, or ssh)")))

    (when (and port (not= protocol "ssh"))
      (stderr "Warning: --port is only used with ssh protocol, ignoring"))

    (let [cwd (System/getProperty "user.dir")]
      (when-not (git-ok? cwd "rev-parse" "--git-dir")
        (fault "Not a git repository"))

      (let [current-url (or (git-out cwd "remote" "get-url" remote)
                            (fault (str "Remote '" remote "' not found")))]
        (println (str "Current: " current-url))

        (let [parsed (or (remote-proto-parse-url current-url)
                         (fault (str "Cannot parse remote URL: " current-url)))
              parsed (if (and (= protocol "ssh") port)
                       (assoc parsed :port port)
                       parsed)
              new-url (remote-proto-build-url parsed protocol)]

          (if (= current-url new-url)
            (println (str "Already using " protocol " protocol"))
            (do (git! cwd "remote" "set-url" remote new-url)
                (println (str "Updated: " new-url)))))))))

;;; ============================================================
;;; Main Dispatcher
;;; ============================================================

(def main-help-text
  "## Git Extensions Framework

Usage: git <extension> [args...]
   or: git-<extension> [args...]

Available extensions:
    vendor        Clone repositories to ~/git/vendor/{org}/{repo}
    deploy        Clone repositories using deploy key authentication
    deploy-key    Manage deploy keys (list, show, remove)
    remote-proto  Convert remote URL protocol (https, git, ssh)

Run 'git <extension> --help' for extension-specific help.

Setup:
    Create symlinks in your PATH:
        ln -s /path/to/git_extensions.bb ~/.local/bin/git-vendor
        ln -s /path/to/git_extensions.bb ~/.local/bin/git-deploy
        ln -s /path/to/git_extensions.bb ~/.local/bin/git-deploy-key
        ln -s /path/to/git_extensions.bb ~/.local/bin/git-remote-proto

    Then use as:
        git vendor org/repo
        git deploy <repo-url>
        git deploy-key list
        git remote-proto ssh")

(defn- find-git-cmd
  "Scan a sequence of argv strings for one starting with 'git-'.
   Returns the extension name (e.g. 'deploy') or nil."
  [parts]
  (some (fn [part]
          (let [base (str (fs/file-name part))]
            (when (str/starts-with? base "git-")
              (subs base 4))))
        parts))

(defn- detect-from-procfs
  "Linux: read /proc/self/cmdline (null-separated argv)."
  []
  (let [bytes (java.nio.file.Files/readAllBytes
               (java.nio.file.Paths/get "/proc/self/cmdline" (into-array String [])))
        parts (loop [i 0 start 0 result []]
                (if (>= i (alength bytes))
                  (if (> i start)
                    (conj result (String. bytes (int start) (int (- i start))))
                    result)
                  (if (zero? (aget bytes i))
                    (recur (inc i) (inc i)
                           (if (> i start)
                             (conj result (String. bytes (int start) (int (- i start))))
                             result))
                    (recur (inc i) start result))))]
    (find-git-cmd parts)))

(defn- detect-from-ps
  "macOS/BSD: use ps to read the command line for the current process."
  []
  (let [pid (.pid (java.lang.ProcessHandle/current))
        result (proc/shell {:out :string :err :string :continue true}
                           "ps" "-p" (str pid) "-o" "args=")
        parts (when (zero? (:exit result))
                (str/split (str/trim (:out result)) #"\s+"))]
    (find-git-cmd parts)))

(defn detect-extension-cmd
  "Detect the extension command from the invoked symlink name.
   Tries /proc/self/cmdline (Linux), then ps (macOS/BSD)."
  []
  (or (try (detect-from-procfs) (catch Exception _ nil))
      (try (detect-from-ps) (catch Exception _ nil))))

(let [symlink-cmd (detect-extension-cmd)
      ;; If invoked via symlink (git-deploy), use that command and all CLI args
      ;; If invoked directly (bb git_extensions.bb deploy ...), first arg is the command
      extension-cmd (or symlink-cmd (first *command-line-args*))
      args (if symlink-cmd
             (vec *command-line-args*)
             (vec (rest *command-line-args*)))]
  (case extension-cmd
    "vendor"       (vendor-main args)
    "deploy"       (deploy-main args)
    "deploy-key"   (deploy-key-main args)
    "remote-proto" (remote-proto-main args)
    ("-h" "--help" "help" nil) (do (println main-help-text) (System/exit 0))
    (do (error "Unknown extension:" extension-cmd)
        (println main-help-text)
        (System/exit 1))))

Extensions to git

ryan-blog@rymcg.tech (EnigmaCurry) — Sat, 31 Jan 2026 00:00:00 -0600

Note: This post documents an older version of this idea written in Bash script form. A newer version has been ported to Babashka.

Git is already a mass of arcane incantations and eldritch commands. So naturally, we’re going to bolt more onto it. Why? Because typing the same 47-character SSH URL for the hundredth time is a rite of passage nobody asked for.

This post introduces a script that adds several custom git subcommands, turning your terminal into an even more dangerous weapon of mass productivity.

How git extensions work

Here’s a dirty little secret: git will run any executable named git-<something> that’s in your PATH as if it were a built-in subcommand. Drop a script called git-hierarchicaldiffvisualization somewhere in your path, and suddenly git hierarchicaldiffvisualization is a real command that your coworkers will hate you for.

We exploit this “feature” by creating a single script (git_extensions.sh) and symlinking it multiple times with different names:

ln -s /path/to/git_extensions.sh ~/.local/bin/git-vendor
ln -s /path/to/git_extensions.sh ~/.local/bin/git-deploy
ln -s /path/to/git_extensions.sh ~/.local/bin/git-deploy-key
ln -s /path/to/git_extensions.sh ~/.local/bin/git-remote-proto

The script detects which name it was invoked as and dispatches to the appropriate handler. A monolithic git extension toolkit.

git vendor

Tired of your ~/Downloads folder looking like a git graveyard? git vendor clones repositories to a consistent location: ~/git/vendor/{org}/{repo}.

The killer feature is flexible input parsing. All of these work:

git vendor enigmacurry/sway-home
git vendor github.com/torvalds/linux
git vendor https://github.com/EnigmaCurry/blog.rymcg.tech.git
git vendor git@github.com:EnigmaCurry/sway-home.git
git vendor ssh://git@forgejo.example.com:2222/EnigmaCurry/emacs.git

The org name gets lowercased for filesystem consistency, because we’re civilized people who don’t want EnigmaCurry/ and enigmacurry/ fighting for dominance.

If the repository already exists, it just tells you where it is and exits-no redundant clones, no drama.

git deploy

Sometimes you need to clone a repository on a server using a deploy key-a dedicated SSH key that grants access to a single repo. This is common for CI/CD pipelines, automated deployments, or any situation where you don’t want your personal keys floating around.

git deploy automates the tedious dance:

git deploy git@github.com:EnigmaCurry/secret-project.git

On first run, it:

Generates an ed25519 SSH key in ~/.ssh/deploy-keys/
Adds an SSH host alias to ~/.ssh/config
Shows you the public key to add to your git server
Exits with an error (because the key isn’t authorized yet)

After you add the key to GitHub/GitLab/Forgejo, run the same command again. This time it succeeds and clones the repository.

You can also convert an existing repository to use a deploy key:

cd /path/to/existing/repo
git deploy .

The default clone destination follows the same pattern as git vendor: ~/git/vendor/{org}/{repo}.

git deploy-key

Manage your deploy keys without spelunking through ~/.ssh/:

# List all deploy keys
git deploy-key list

# Show a key's public key (for re-adding to git servers)
git deploy-key show deploy--github.com--enigmacurry-project

# Remove a deploy key and its SSH config entry
git deploy-key remove deploy--github.com--enigmacurry-project

git remote-proto

Switch your remote URL between protocols without manually editing anything:

# You cloned with HTTPS like a normal person
git remote -v
# origin  https://github.com/enigmacurry/kick-ascii (fetch)

# But now you want SSH
git remote-proto git

# Current: https://github.com/enigmacurry/kick-ascii
# Updated: git@github.com:enigmacurry/kick-ascii.git

Supported protocols:

Protocol	URL Format
`http` / `https`	`https://{host}/{org}/{repo}.git`
`git`	`git@{host}:{org}/{repo}.git`
`ssh`	`ssh://git@{host}/{org}/{repo}.git`

For SSH with a custom port:

git remote-proto ssh --port 2222
# Updated: ssh://git@github.com:2222/enigmacurry/kick-ascii.git

Installation

It is already installed if you use my sway-home config. But assuming you don’t, here’s how to install it by hand:

## Download the script and make it executable:
curl -Lo ~/.local/bin/git_extensions.sh \
  https://raw.githubusercontent.com/EnigmaCurry/blog.rymcg.tech/master/src/git/git_extensions.sh
chmod +x ~/.local/bin/git_extensions.sh

## Create symlinks for each extension:
ln -s git_extensions.sh ~/.local/bin/git-vendor
ln -s git_extensions.sh ~/.local/bin/git-deploy
ln -s git_extensions.sh ~/.local/bin/git-deploy-key
ln -s git_extensions.sh ~/.local/bin/git-remote-proto

Verify: git vendor --help

Now go forth and clone responsibly.

The script

Download the script from this direct link

#!/bin/bash

######################################################
#              Git Extensions Framework              #
######################################################
#
# A multi-command git extension framework.
# Create symlinks like `git-deploy` pointing to this script.
# The script detects the command from the symlink name.
#
# Supported extensions:
#   - vendor: Clone repositories to ~/git/vendor/{org}/{repo}
#   - deploy: Clone repositories using deploy key authentication
#   - deploy-key: Manage deploy keys (list, show, remove)
#   - remote-proto: Convert remote URL protocol (https, git, ssh)
#
######################################################

set -eo pipefail

ORIGINAL_ARGS="${@}"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SCRIPT_NAME="$(basename "$0")"

# Extract command from script name (git-deploy -> deploy)
if [[ "$SCRIPT_NAME" == git-* ]]; then
    EXTENSION_CMD="${SCRIPT_NAME#git-}"
elif [[ "$SCRIPT_NAME" == "git_extensions.sh" ]]; then
    # Called directly - first argument is the command
    EXTENSION_CMD="${1:-}"
    shift 2>/dev/null || true
else
    EXTENSION_CMD="$SCRIPT_NAME"
fi

#-----------------------------------------------------------
# Common Utilities
#-----------------------------------------------------------

stderr(){ echo "$@" >/dev/stderr; }
error(){ stderr "Error: $@"; }
fault(){ test -n "$1" && error "$1"; stderr "Exiting."; exit 1; }

check_var() {
    local help_func="${1:-__help}"
    shift
    local missing=()
    for varname in "$@"; do
        if [[ -z "${!varname}" ]]; then
            missing+=("$varname")
        fi
    done
    if [[ ${#missing[@]} -gt 0 ]]; then
        echo ""
        $help_func
        echo ""
        echo "## Error: Missing:"
        for var in "${missing[@]}"; do
            echo "   - $var"
        done
        echo ""
        exit 1
    fi
}

check_deps(){
    local missing=""
    for dep in "$@"; do
        if ! command -v "$dep" >/dev/null 2>&1; then
            missing="${missing} ${dep}"
        fi
    done
    if [[ -n "$missing" ]]; then fault "Missing dependencies:${missing}"; fi
}

# Prompt for yes/no confirmation
# Returns 0 for yes, 1 for no
ask_yes_no() {
    local prompt="$1"
    local default="${2:-}"
    local reply

    while true; do
        if [[ "$default" == "y" ]]; then
            read -r -p "${prompt} [Y/n] " reply
            reply="${reply:-y}"
        elif [[ "$default" == "n" ]]; then
            read -r -p "${prompt} [y/N] " reply
            reply="${reply:-n}"
        else
            read -r -p "${prompt} [y/n] " reply
        fi

        case "${reply,,}" in
            y|yes) return 0 ;;
            n|no) return 1 ;;
            *) echo "Please answer yes or no." ;;
        esac
    done
}

# Prompt for text input
ask_input() {
    local prompt="$1"
    local default="${2:-}"
    local reply

    if [[ -n "$default" ]]; then
        read -r -p "${prompt} [${default}] " reply
        echo "${reply:-$default}"
    else
        read -r -p "${prompt} " reply
        echo "$reply"
    fi
}

#===========================================================
#                    DEPLOY EXTENSION
#===========================================================
# Clone repositories using deploy key authentication

#-----------------------------------------------------------
# URL Parsing
#-----------------------------------------------------------

# Parse repository URL with optional branch
# Format: url[#branch]
# Returns: Sets REPO_URL and REPO_BRANCH variables
__deploy_parse_repo_spec() {
    local spec="$1"

    if [[ "$spec" =~ ^(.+)#([^#]+)$ ]]; then
        REPO_URL="${BASH_REMATCH[1]}"
        REPO_BRANCH="${BASH_REMATCH[2]}"
    else
        REPO_URL="$spec"
        REPO_BRANCH=""
    fi
}

# Parse a git remote URL and extract host and path components
__deploy_parse_remote_url() {
    local url="$1"
    local -n _host=$2
    local -n _path=$3

    # Remove trailing .git if present
    url="${url%.git}"

    if [[ "$url" =~ ^git@([^:]+):(.+)$ ]]; then
        # git@host:user/repo format
        _host="${BASH_REMATCH[1]}"
        _path="${BASH_REMATCH[2]}"
    elif [[ "$url" =~ ^ssh://([^@]+@)?([^/]+)/(.+)$ ]]; then
        # ssh://[user@]host/path format
        _host="${BASH_REMATCH[2]}"
        _path="${BASH_REMATCH[3]}"
    elif [[ "$url" =~ ^https?://([^/]+)/(.+)$ ]]; then
        # https://host/path format
        _host="${BASH_REMATCH[1]}"
        _path="${BASH_REMATCH[2]}"
    else
        return 1
    fi
}

# Derive default destination path from URL: ~/git/vendor/{ORG}/{REPO}
__deploy_default_destination() {
    local url="$1"
    local host path

    if ! __deploy_parse_remote_url "$url" host path; then
        # Fallback to just repo name in current dir
        echo "$(__deploy_repo_name_from_url "$url")"
        return
    fi

    # path is typically "org/repo" or just "repo"
    # Remove any leading slashes
    path="${path#/}"

    # Extract org and repo from path
    local org repo
    if [[ "$path" == */* ]]; then
        org="${path%%/*}"
        repo="${path#*/}"
        # Handle nested paths (e.g., gitlab subgroups) - just use last component as repo
        repo="${repo##*/}"
    else
        org="unknown"
        repo="$path"
    fi

    # Normalize: lowercase the org name for consistent directory structure
    org="${org,,}"

    echo "${HOME}/git/vendor/${org}/${repo}"
}

# Extract repository name from URL for default destination
__deploy_repo_name_from_url() {
    local url="$1"
    local name

    # Remove trailing .git
    url="${url%.git}"

    # Extract last path component
    name="${url##*/}"

    # Handle ssh format (git@host:user/repo)
    if [[ "$name" == *:* ]]; then
        name="${name##*:}"
        name="${name##*/}"
    fi

    echo "$name"
}

# Normalize URL to SSH format for consistency
__deploy_normalize_url() {
    local url="$1"

    # Remove trailing .git if present, we'll add it back
    url="${url%.git}"

    # Convert HTTPS to SSH format
    if [[ "$url" =~ ^https?://([^/]+)/(.+)$ ]]; then
        local host="${BASH_REMATCH[1]}"
        local path="${BASH_REMATCH[2]}"
        echo "git@${host}:${path}.git"
    elif [[ "$url" =~ ^git@ ]]; then
        # Already SSH format
        echo "${url}.git"
    elif [[ "$url" =~ ^ssh:// ]]; then
        # ssh://[user@]host[:port]/path format, convert to git@ format
        local rest="${url#ssh://}"
        rest="${rest#*@}"  # Remove user@ if present
        # Extract host, optional port, and path (port is stripped here, handled via SSH config)
        if [[ "$rest" =~ ^([^:/]+)(:([0-9]+))?/(.+)$ ]]; then
            echo "git@${BASH_REMATCH[1]}:${BASH_REMATCH[4]}.git"
        else
            echo "${url}.git"
        fi
    else
        # Unknown format, return as-is with .git
        echo "${url}.git"
    fi
}

# Check if URL is already using a deploy key alias
__deploy_is_alias_url() {
    local url="$1"
    if [[ "$url" =~ ^git@deploy-[^:]+: ]]; then
        return 0
    fi
    return 1
}

# Extract the existing alias from a deploy-key URL
__deploy_extract_alias_from_url() {
    local url="$1"
    if [[ "$url" =~ ^git@([^:]+): ]]; then
        echo "${BASH_REMATCH[1]}"
    fi
}

# Convert a remote URL to use the deploy key alias
__deploy_convert_remote_url() {
    local url="$1"
    local alias="$2"
    local host path

    if ! __deploy_parse_remote_url "$url" host path; then
        fault "Cannot parse remote URL: $url"
    fi

    # Return in git@alias:path format
    echo "git@${alias}:${path}.git"
}

#-----------------------------------------------------------
# SSH Key Management
#-----------------------------------------------------------

__deploy_ssh_config_file() {
    echo "${HOME}/.ssh/config"
}

__deploy_ssh_keys_dir() {
    local dir="${HOME}/.ssh/deploy-keys"
    mkdir -p "$dir"
    chmod 700 "$dir"
    echo "$dir"
}

# Generate SSH host alias name from repo
__deploy_generate_alias() {
    local host="$1"
    local path="$2"
    echo "deploy--${host}--${path}" | tr '/' '-' | tr -s '-'
}

# Get key file path for an alias
__deploy_key_file_path() {
    local alias="$1"
    local keys_dir
    keys_dir=$(__deploy_ssh_keys_dir)
    echo "${keys_dir}/${alias}"
}

# Check if SSH host alias exists in config
__deploy_host_alias_exists() {
    local alias="$1"
    local config_file
    config_file=$(__deploy_ssh_config_file)

    if [[ -f "$config_file" ]]; then
        grep -q "^Host ${alias}$" "$config_file" 2>/dev/null
    else
        return 1
    fi
}

# Add SSH host alias to config
__deploy_add_host_alias() {
    local alias="$1"
    local real_host="$2"
    local key_file="$3"
    local port="${4:-}"
    local config_file
    config_file=$(__deploy_ssh_config_file)

    mkdir -p "$(dirname "$config_file")"

    # Add newline if file exists and doesn't end with one
    if [[ -f "$config_file" ]] && [[ -s "$config_file" ]]; then
        if [[ $(tail -c1 "$config_file" | wc -l) -eq 0 ]]; then
            echo "" >> "$config_file"
        fi
        echo "" >> "$config_file"
    fi

    {
        echo "Host ${alias}"
        echo "    HostName ${real_host}"
        [[ -n "$port" ]] && echo "    Port ${port}"
        echo "    User git"
        echo "    IdentityFile ${key_file}"
        echo "    IdentitiesOnly yes"
    } >> "$config_file"

    chmod 600 "$config_file"
    stderr "## Added SSH host alias '${alias}'"
}

# Remove SSH host alias from config
__deploy_remove_host_alias() {
    local alias="$1"
    local config_file
    config_file=$(__deploy_ssh_config_file)

    if [[ ! -f "$config_file" ]]; then
        return 0
    fi

    local tmp_file
    tmp_file=$(mktemp)
    awk -v alias="$alias" '
        BEGIN { skip=0 }
        /^Host / {
            if ($2 == alias) {
                skip=1
                next
            } else {
                skip=0
            }
        }
        !skip { print }
    ' "$config_file" > "$tmp_file"

    mv "$tmp_file" "$config_file"
    chmod 600 "$config_file"
}

# Update SSH host alias in config
__deploy_update_host_alias() {
    local alias="$1"
    local real_host="$2"
    local key_file="$3"
    local port="${4:-}"

    __deploy_remove_host_alias "$alias"
    __deploy_add_host_alias "$alias" "$real_host" "$key_file" "$port"
}

# Generate a new deploy key
__deploy_generate_key() {
    local key_file="$1"
    local comment="$2"

    ssh-keygen -t ed25519 -f "$key_file" -N "" -C "$comment" >/dev/null 2>&1
    chmod 600 "$key_file"
    chmod 644 "${key_file}.pub"
    stderr "## Generated new deploy key: ${key_file}"
}

#-----------------------------------------------------------
# Deploy Key Setup
#-----------------------------------------------------------

# Setup deploy key for a remote - returns the alias name
# Sets KEY_FILE and KEY_CREATED variables
__deploy_setup_key() {
    local remote_name="${1:-origin}"

    local remote_url
    remote_url=$(git remote get-url "$remote_name" 2>/dev/null) || fault "Remote '${remote_name}' not found"

    # Check if already using a deploy key alias
    if __deploy_is_alias_url "$remote_url"; then
        local existing_alias
        existing_alias=$(__deploy_extract_alias_from_url "$remote_url")
        KEY_FILE=$(__deploy_key_file_path "$existing_alias")
        KEY_CREATED=false

        stderr "## Already configured with deploy key: ${existing_alias}"
        echo "$existing_alias"
        return 0
    fi

    # Parse the remote URL
    local host path
    if ! __deploy_parse_remote_url "$remote_url" host path; then
        fault "Cannot parse remote URL: ${remote_url}"
    fi

    stderr "## Host: ${host}"
    stderr "## Path: ${path}"

    # Generate alias and key file path
    local alias
    alias=$(__deploy_generate_alias "$host" "$path")
    KEY_FILE=$(__deploy_key_file_path "$alias")

    stderr "## SSH alias: ${alias}"
    stderr "## Key file: ${KEY_FILE}"

    KEY_CREATED=false

    # Check if key already exists
    if [[ -f "$KEY_FILE" ]]; then
        stderr "## Deploy key already exists"
    else
        __deploy_generate_key "$KEY_FILE" "deploy-key@${HOSTNAME:-localhost} ${host}:${path}"
        KEY_CREATED=true
    fi

    # Setup or update SSH host alias
    if __deploy_host_alias_exists "$alias"; then
        stderr "## SSH host alias already configured"
    else
        __deploy_add_host_alias "$alias" "$host" "$KEY_FILE" "$REPO_PORT"
    fi

    # Update the git remote to use the alias
    local new_url
    new_url=$(__deploy_convert_remote_url "$remote_url" "$alias")

    if [[ "$remote_url" != "$new_url" ]]; then
        git remote set-url "$remote_name" "$new_url"
        stderr "## Updated remote URL to use deploy key"
    fi

    echo "$alias"
}

#-----------------------------------------------------------
# Repository Setup
#-----------------------------------------------------------

# Initialize the repository and configure remote
__deploy_init_repo() {
    local dest="$1"
    local url="$2"
    local remote_name="${3:-origin}"

    # Create destination directory
    if [[ -d "$dest" ]]; then
        if [[ -d "${dest}/.git" ]]; then
            stderr "## Directory already contains a git repository: ${dest}"
            stderr "## Updating configuration..."
        else
            fault "Directory exists but is not a git repository: ${dest}"
        fi
    else
        mkdir -p "$dest"
        stderr "## Created directory: ${dest}"
    fi

    cd "$dest"

    # Initialize if not already a git repo
    if [[ ! -d ".git" ]]; then
        git init --quiet
        stderr "## Initialized empty git repository"

        # Point HEAD to a placeholder branch
        git symbolic-ref HEAD refs/heads/__deploy_pending__
    fi

    # Configure remote
    if git remote get-url "$remote_name" >/dev/null 2>&1; then
        git remote set-url "$remote_name" "$url"
        stderr "## Updated remote '${remote_name}': ${url}"
    else
        git remote add "$remote_name" "$url"
        stderr "## Added remote '${remote_name}': ${url}"
    fi

    # Set default remote for convenience
    git config checkout.defaultRemote "$remote_name"
}

# Test if the deploy key works by trying to access the remote
__deploy_test_key() {
    local remote_name="$1"
    local timeout_secs="${2:-10}"

    if timeout "$timeout_secs" git ls-remote --heads "$remote_name" >/dev/null 2>&1; then
        return 0
    fi
    return 1
}

# Get the default branch from the remote
__deploy_get_default_branch() {
    local remote_name="$1"

    local default_ref
    default_ref=$(git ls-remote --symref "$remote_name" HEAD 2>/dev/null | grep "^ref:" | awk '{print $2}' | sed 's|refs/heads/||')

    if [[ -n "$default_ref" ]]; then
        echo "$default_ref"
        return 0
    fi

    # Fallback: check common branch names
    local branches
    branches=$(git ls-remote --heads "$remote_name" 2>/dev/null | awk '{print $2}' | sed 's|refs/heads/||')

    for try_branch in main master develop; do
        if echo "$branches" | grep -q "^${try_branch}$"; then
            echo "$try_branch"
            return 0
        fi
    done

    echo "$branches" | head -1
}

# Show the public key and instructions
__deploy_show_key_instructions() {
    local key_file="$1"

    echo ""
    echo "========================================"
    echo "DEPLOY KEY NOT YET AUTHORIZED"
    echo "========================================"
    echo ""
    echo "Add this public key as a deploy key on your git server:"
    echo ""
    cat "${key_file}.pub"
    echo ""
    echo "========================================"
    echo ""
    echo "For GitHub: Settings → Deploy keys → Add deploy key"
    echo "For GitLab: Settings → Repository → Deploy keys"
    echo "For Forgejo/Gitea: Settings → Deploy Keys → Add Deploy Key"
    echo ""
}

#-----------------------------------------------------------
# Deploy Help
#-----------------------------------------------------------

__deploy_help() {
    cat <<EOF
## git deploy - Clone a repository using a deploy key

Usage: git deploy <repo-url[#branch]> [destination] [options]
       git deploy <path> [options]

Arguments:
    repo-url        Repository URL (supports #branch suffix)
    destination     Local directory (default: ~/git/vendor/{ORG}/{REPO})
    path            Path to existing git repo (converts remote to deploy key)

Options:
    --remote <name>    Remote name (default: origin)
    --branch <name>    Branch to clone (overrides #branch in URL)
    -h, --help         Show this help message

Description:
    Clones a repository using a dedicated deploy key for authentication,
    or converts an existing repository's remote to use a deploy key.

    When given a URL:
    - Creates a new clone using a deploy key for authentication

    When given a path to an existing git repository:
    - Offers to convert the existing remote to use a deploy key
    - If no remote exists, prompts for a URL
    - If already configured, tests the deploy key

    If the deploy key is already authorized:
    - Discovers the default branch automatically (if not specified)
    - Fetches and checks out the repository
    - Exits successfully (code 0)

    If the deploy key is NOT yet authorized:
    - Creates the deploy key and shows the public key
    - Prints instructions to add it to your git server
    - Exits with error code 1 (re-run after adding the key)

URL Formats:
    git@github.com:user/repo.git
    git@github.com:user/repo.git#main
    https://github.com/user/repo
    https://github.com/user/repo#develop
    ssh://git@host:port/user/repo.git

Examples:
    # Clone using remote's default branch
    git deploy git@github.com:user/repo.git

    # Clone specific branch
    git deploy git@github.com:user/repo.git#develop

    # Clone to specific directory
    git deploy git@github.com:user/repo.git ~/projects/myrepo

    # Convert existing repo's remote to use deploy key
    git deploy /path/to/existing/repo
    git deploy .

Workflow:
    1. Run 'git deploy <url>' or 'git deploy <path>'
    2. If key not yet authorized, add the printed key to your git server
    3. Re-run the command - repository will be cloned/configured
EOF
}

#-----------------------------------------------------------
# Deploy Main
#-----------------------------------------------------------

__deploy_main() {
    check_deps git ssh-keygen

    local repo_spec=""
    local destination=""
    local remote_name="origin"
    local branch_override=""
    local convert_mode=false
    local already_configured=false

    while [[ $# -gt 0 ]]; do
        case "$1" in
            --remote)
                remote_name="$2"
                shift 2
                ;;
            --branch)
                branch_override="$2"
                shift 2
                ;;
            -h|--help)
                __deploy_help
                exit 0
                ;;
            -*)
                error "Unknown option: $1"
                __deploy_help
                exit 1
                ;;
            *)
                if [[ -z "$repo_spec" ]]; then
                    repo_spec="$1"
                elif [[ -z "$destination" ]]; then
                    destination="$1"
                else
                    error "Too many arguments"
                    __deploy_help
                    exit 1
                fi
                shift
                ;;
        esac
    done

    # No argument provided - show help
    if [[ -z "$repo_spec" ]]; then
        __deploy_help
        exit 0
    fi

    # Check if repo_spec is an existing directory (convert mode)
    if [[ -d "$repo_spec" ]]; then
        :  # Fall through to directory handling below
    elif [[ "$repo_spec" =~ ^(git@|ssh://|https?://) ]]; then
        :  # Looks like a URL, fall through to clone logic
    else
        fault "Invalid argument: '${repo_spec}' is not a directory or a valid URL"
    fi

    if [[ -d "$repo_spec" ]]; then
        local target_dir
        target_dir=$(cd "$repo_spec" && pwd)

        # Check if it's a git repository
        if ! git -C "$target_dir" rev-parse --git-dir >/dev/null 2>&1; then
            fault "Directory is not a git repository: ${target_dir}"
        fi

        local existing_url
        existing_url=$(git -C "$target_dir" remote get-url "$remote_name" 2>/dev/null) || existing_url=""

        if [[ -z "$existing_url" ]]; then
            # No remote configured - prompt for URL
            echo ""
            echo "Repository has no '${remote_name}' remote configured."
            echo ""

            repo_spec=$(ask_input "Enter repository URL:")
            if [[ -z "$repo_spec" ]]; then
                fault "No URL provided"
            fi
        elif __deploy_is_alias_url "$existing_url"; then
            # Already using deploy key
            repo_spec="$existing_url"
            already_configured=true
        else
            # Has remote, confirm conversion
            echo ""
            echo "Found existing remote '${remote_name}':"
            echo "  ${existing_url}"
            echo ""

            if ask_yes_no "Convert this remote to use a deploy key?" "y"; then
                repo_spec="$existing_url"
            else
                echo "Aborted."
                exit 0
            fi
        fi

        convert_mode=true
        destination="$target_dir"
    fi

    # Parse repo spec
    __deploy_parse_repo_spec "$repo_spec"

    # Apply branch override if specified
    if [[ -n "$branch_override" ]]; then
        REPO_BRANCH="$branch_override"
    fi

    # Skip normalization if already configured (URL is already in deploy-key format)
    REPO_PORT=""
    if [[ "$already_configured" != "true" ]]; then
        # Extract port from ssh:// URLs before normalization (which runs in a subshell)
        if [[ "$REPO_URL" =~ ^ssh://([^@]+@)?([^:/]+):([0-9]+)/ ]]; then
            REPO_PORT="${BASH_REMATCH[3]}"
        fi
        # Normalize URL to SSH format
        REPO_URL=$(__deploy_normalize_url "$REPO_URL")
    fi

    # Derive destination from URL if not specified: ~/git/vendor/{ORG}/{REPO}
    if [[ -z "$destination" ]]; then
        destination=$(__deploy_default_destination "$REPO_URL")
    elif [[ "$destination" != /* ]]; then
        # Convert relative path to absolute
        destination="$(pwd)/${destination}"
    fi

    stderr ""
    stderr "## Repository URL: ${REPO_URL}"
    stderr "## Destination: ${destination}"
    [[ -n "$REPO_BRANCH" ]] && stderr "## Branch: ${REPO_BRANCH}"
    stderr ""

    if [[ "$already_configured" == "true" ]]; then
        # Already configured - just need to get the key file path for potential error messages
        local existing_alias
        existing_alias=$(__deploy_extract_alias_from_url "$REPO_URL")
        KEY_FILE=$(__deploy_key_file_path "$existing_alias")
        stderr "## Deploy key already configured: ${existing_alias}"
    else
        # Initialize the repository (or update existing)
        __deploy_init_repo "$destination" "$REPO_URL" "$remote_name"

        # Setup deploy key
        stderr ""
        stderr "## Setting up deploy key..."
        KEY_FILE=""
        KEY_CREATED=false
        __deploy_setup_key "$remote_name" >/dev/null
    fi

    # Test deploy key
    stderr ""
    stderr "## Testing deploy key..."

    if __deploy_test_key "$remote_name"; then
        stderr "## Deploy key is working!"

        if [[ "$convert_mode" == "true" ]]; then
            # Converting existing repo - don't fetch/checkout, just confirm
            stderr ""
            stderr "========================================"
            if [[ "$already_configured" == "true" ]]; then
                stderr "## Deploy key is working!"
            else
                stderr "## Remote converted to deploy key successfully!"
            fi
            stderr "## Location: ${destination}"
            stderr "========================================"
        else
            # Cloning new repo - fetch and checkout
            # If no branch specified, discover the default branch
            if [[ -z "$REPO_BRANCH" ]]; then
                stderr "## Discovering default branch..."
                REPO_BRANCH=$(__deploy_get_default_branch "$remote_name")
                if [[ -n "$REPO_BRANCH" ]]; then
                    stderr "## Default branch: ${REPO_BRANCH}"
                fi
            fi

            if [[ -z "$REPO_BRANCH" ]]; then
                # Remote has no branches (empty repo)
                stderr ""
                stderr "========================================"
                stderr "## Repository is empty (no branches on remote)"
                stderr "## Location: ${destination}"
                stderr "========================================"
            else
                # Fetch from remote
                stderr "## Fetching from ${remote_name}..."
                git fetch "$remote_name"

                # Checkout the branch
                stderr "## Checking out branch '${REPO_BRANCH}'..."
                git checkout "$REPO_BRANCH"

                # Ensure tracking is configured
                git branch --set-upstream-to="${remote_name}/${REPO_BRANCH}" "$REPO_BRANCH" 2>/dev/null || true

                stderr ""
                stderr "========================================"
                stderr "## Repository cloned successfully!"
                stderr "## Location: ${destination}"
                stderr "## Branch: ${REPO_BRANCH}"
                stderr "========================================"
            fi
        fi
    else
        # Key not working - show instructions and exit with error
        if [[ -n "$KEY_FILE" ]] && [[ -f "${KEY_FILE}.pub" ]]; then
            __deploy_show_key_instructions "$KEY_FILE"
        else
            stderr ""
            stderr "## Deploy key not working and key file not found."
        fi

        stderr ""
        stderr "## Repository prepared at: ${destination}"
        stderr "## After adding the deploy key, run this command again:"
        if [[ "$convert_mode" == "true" ]]; then
            stderr "##   git deploy"
        else
            stderr "##   git deploy ${ORIGINAL_ARGS}"
        fi
        stderr ""

        exit 1
    fi
}

#===========================================================
#                  DEPLOY-KEY EXTENSION
#===========================================================
# Manage deploy keys: list, show, remove

#-----------------------------------------------------------
# Deploy-Key List
#-----------------------------------------------------------

__deploy_key_list() {
    local keys_dir="${HOME}/.ssh/deploy-keys"
    local config_file="${HOME}/.ssh/config"

    if [[ ! -d "$keys_dir" ]]; then
        echo "No deploy keys found."
        return 0
    fi

    local keys=()
    while IFS= read -r -d '' key_file; do
        local alias
        alias=$(basename "$key_file")
        # Skip .pub files
        [[ "$alias" == *.pub ]] && continue
        keys+=("$alias")
    done < <(find "$keys_dir" -maxdepth 1 -type f -print0 2>/dev/null)

    if [[ ${#keys[@]} -eq 0 ]]; then
        echo "No deploy keys found."
        return 0
    fi

    echo "Deploy keys:"
    echo ""

    for alias in "${keys[@]}"; do
        local key_file="${keys_dir}/${alias}"
        local pub_file="${key_file}.pub"
        local in_config="no"
        local hostname=""

        # Check if alias exists in ssh config
        if [[ -f "$config_file" ]] && grep -q "^Host ${alias}$" "$config_file" 2>/dev/null; then
            in_config="yes"
            # Extract HostName from config
            hostname=$(awk -v alias="$alias" '
                BEGIN { found=0 }
                /^Host / { found = ($2 == alias) }
                found && /HostName/ { print $2; exit }
            ' "$config_file")
        fi

        echo "  ${alias}"
        [[ -n "$hostname" ]] && echo "    Host: ${hostname}"
        echo "    Key:  ${key_file}"
        echo "    SSH config: ${in_config}"

        if [[ -f "$pub_file" ]]; then
            local fingerprint
            fingerprint=$(ssh-keygen -lf "$pub_file" 2>/dev/null | awk '{print $2}')
            [[ -n "$fingerprint" ]] && echo "    Fingerprint: ${fingerprint}"
        fi

        echo ""
    done
}

#-----------------------------------------------------------
# Deploy-Key Show
#-----------------------------------------------------------

__deploy_key_show() {
    local alias="$1"
    local keys_dir="${HOME}/.ssh/deploy-keys"
    local key_file="${keys_dir}/${alias}"
    local pub_file="${key_file}.pub"

    if [[ -z "$alias" ]]; then
        error "Missing alias argument"
        __deploy_key_help
        exit 1
    fi

    if [[ ! -f "$pub_file" ]]; then
        fault "Deploy key not found: ${alias}"
    fi

    echo "Public key for ${alias}:"
    echo ""
    cat "$pub_file"
    echo ""
}

#-----------------------------------------------------------
# Deploy-Key Remove
#-----------------------------------------------------------

__deploy_key_remove() {
    local alias="$1"
    local keys_dir="${HOME}/.ssh/deploy-keys"
    local config_file="${HOME}/.ssh/config"
    local key_file="${keys_dir}/${alias}"
    local pub_file="${key_file}.pub"

    if [[ -z "$alias" ]]; then
        error "Missing alias argument"
        __deploy_key_help
        exit 1
    fi

    local found=false

    # Remove from SSH config
    if [[ -f "$config_file" ]] && grep -q "^Host ${alias}$" "$config_file" 2>/dev/null; then
        local tmp_file
        tmp_file=$(mktemp)
        awk -v alias="$alias" '
            BEGIN { skip=0 }
            /^Host / {
                if ($2 == alias) {
                    skip=1
                    next
                } else {
                    skip=0
                }
            }
            !skip { print }
        ' "$config_file" > "$tmp_file"

        mv "$tmp_file" "$config_file"
        chmod 600 "$config_file"
        echo "Removed SSH config entry: ${alias}"
        found=true
    fi

    # Remove key files
    if [[ -f "$key_file" ]]; then
        rm -f "$key_file"
        echo "Removed private key: ${key_file}"
        found=true
    fi

    if [[ -f "$pub_file" ]]; then
        rm -f "$pub_file"
        echo "Removed public key: ${pub_file}"
        found=true
    fi

    if [[ "$found" == "false" ]]; then
        fault "Deploy key not found: ${alias}"
    fi

    echo ""
    echo "Deploy key '${alias}' removed successfully."
    echo ""
    echo "Note: If any repositories are using this key, you'll need to"
    echo "update their remote URLs or create a new deploy key."
}

#-----------------------------------------------------------
# Deploy-Key Help
#-----------------------------------------------------------

__deploy_key_help() {
    cat <<EOF
## git deploy-key - Manage deploy keys

Usage: git deploy-key <command> [args]

Commands:
    list              List all deploy keys
    show <alias>      Show the public key for an alias
    remove <alias>    Remove a deploy key and its SSH config entry

Options:
    -h, --help        Show this help message

Examples:
    # List all deploy keys
    git deploy-key list

    # Show a specific key's public key (for adding to git server)
    git deploy-key show deploy--github.com--user-repo

    # Remove a deploy key
    git deploy-key remove deploy--github.com--user-repo

Files:
    Keys:   ~/.ssh/deploy-keys/
    Config: ~/.ssh/config
EOF
}

#-----------------------------------------------------------
# Deploy-Key Main
#-----------------------------------------------------------

__deploy_key_main() {
    local subcommand="${1:-}"
    shift 2>/dev/null || true

    case "$subcommand" in
        list|ls)
            __deploy_key_list
            ;;
        show|cat)
            __deploy_key_show "$@"
            ;;
        remove|rm|delete)
            __deploy_key_remove "$@"
            ;;
        -h|--help|help|"")
            __deploy_key_help
            exit 0
            ;;
        *)
            error "Unknown command: $subcommand"
            __deploy_key_help
            exit 1
            ;;
    esac
}

#===========================================================
#                    VENDOR EXTENSION
#===========================================================
# Clone repositories to ~/git/vendor/{org}/{repo} with flexible URL parsing

# Default domain when not specified
VENDOR_DEFAULT_DOMAIN="github.com"

#-----------------------------------------------------------
# Vendor URL Parsing
#-----------------------------------------------------------

# Parse a git repository reference into components
# Sets: VENDOR_DOMAIN, VENDOR_ORG, VENDOR_REPO, VENDOR_USE_SSH, VENDOR_SSH_PORT
__vendor_parse_ref() {
    local input="$1"

    # Reset state
    VENDOR_DOMAIN=""
    VENDOR_ORG=""
    VENDOR_REPO=""
    VENDOR_USE_SSH=false
    VENDOR_SSH_PORT=""

    # Remove trailing slashes
    input="${input%/}"

    # https://domain/org/repo or https://domain/org/repo.git
    if [[ "$input" =~ ^https?://([^/]+)/([^/]+)/([^/]+)/?$ ]]; then
        VENDOR_DOMAIN="${BASH_REMATCH[1]}"
        VENDOR_ORG="${BASH_REMATCH[2]}"
        VENDOR_REPO="${BASH_REMATCH[3]}"

    # ssh://[git@]domain[:port]/org/repo
    elif [[ "$input" =~ ^ssh://(git@)?([^/:]+)(:([0-9]+))?/([^/]+)/(.+)$ ]]; then
        VENDOR_DOMAIN="${BASH_REMATCH[2]}"
        VENDOR_SSH_PORT="${BASH_REMATCH[4]}"
        VENDOR_ORG="${BASH_REMATCH[5]}"
        VENDOR_REPO="${BASH_REMATCH[6]}"
        VENDOR_USE_SSH=true

    # git@domain:org/repo.git or git@domain:org/repo
    elif [[ "$input" =~ ^git@([^:]+):([^/]+)/(.+)$ ]]; then
        VENDOR_DOMAIN="${BASH_REMATCH[1]}"
        VENDOR_ORG="${BASH_REMATCH[2]}"
        VENDOR_REPO="${BASH_REMATCH[3]}"
        VENDOR_USE_SSH=true

    # domain/org/repo (three path components with dots in first)
    elif [[ "$input" =~ ^([a-zA-Z0-9.-]+\.[a-zA-Z]+)/([^/]+)/([^/]+)$ ]]; then
        VENDOR_DOMAIN="${BASH_REMATCH[1]}"
        VENDOR_ORG="${BASH_REMATCH[2]}"
        VENDOR_REPO="${BASH_REMATCH[3]}"

    # org/repo (two components, assume default domain)
    elif [[ "$input" =~ ^([^/]+)/([^/]+)$ ]]; then
        VENDOR_DOMAIN="$VENDOR_DEFAULT_DOMAIN"
        VENDOR_ORG="${BASH_REMATCH[1]}"
        VENDOR_REPO="${BASH_REMATCH[2]}"

    else
        return 1
    fi

    # Normalize: remove .git suffix from repo name
    VENDOR_REPO="${VENDOR_REPO%.git}"

    # Normalize: lowercase the org name for consistent directory structure
    VENDOR_ORG="${VENDOR_ORG,,}"

    return 0
}

# Build the clone URL from parsed components
__vendor_build_url() {
    if [[ "$VENDOR_USE_SSH" == true ]]; then
        if [[ -n "$VENDOR_SSH_PORT" ]]; then
            echo "ssh://git@${VENDOR_DOMAIN}:${VENDOR_SSH_PORT}/${VENDOR_ORG}/${VENDOR_REPO}.git"
        else
            echo "git@${VENDOR_DOMAIN}:${VENDOR_ORG}/${VENDOR_REPO}.git"
        fi
    else
        echo "https://${VENDOR_DOMAIN}/${VENDOR_ORG}/${VENDOR_REPO}"
    fi
}

#-----------------------------------------------------------
# Vendor Help
#-----------------------------------------------------------

__vendor_help() {
    cat <<EOF
## git vendor - Clone repositories to ~/git/vendor/{org}/{repo}

Usage: git vendor <repository>

Arguments:
    repository      Repository reference in any supported format

Supported Formats:
    org/repo                          Uses github.com by default
    github.com/org/repo               Domain with path
    https://github.com/org/repo       HTTPS URL
    git@github.com:org/repo.git       SSH URL
    ssh://git@host:port/org/repo      SSH URL with custom port

Options:
    -h, --help      Show this help message

Description:
    Clones a repository to ~/git/vendor/{org}/{repo}.
    The org name is lowercased for consistent directory structure.

    If the repository already exists, reports the location and exits.

Examples:
    git vendor enigmacurry/sway-home
    git vendor github.com/enigmacurry/sway-home
    git vendor https://github.com/EnigmaCurry/sway-home.git
    git vendor git@github.com:EnigmaCurry/sway-home.git
    git vendor ssh://git@github.com:22/EnigmaCurry/sway-home.git
EOF
}

#-----------------------------------------------------------
# Vendor Main
#-----------------------------------------------------------

__vendor_main() {
    check_deps git

    local repo_ref=""

    while [[ $# -gt 0 ]]; do
        case "$1" in
            -h|--help)
                __vendor_help
                exit 0
                ;;
            -*)
                error "Unknown option: $1"
                __vendor_help
                exit 1
                ;;
            *)
                if [[ -z "$repo_ref" ]]; then
                    repo_ref="$1"
                else
                    error "Too many arguments"
                    __vendor_help
                    exit 1
                fi
                shift
                ;;
        esac
    done

    if [[ -z "$repo_ref" ]]; then
        __vendor_help
        exit 0
    fi

    # Parse the repository reference
    if ! __vendor_parse_ref "$repo_ref"; then
        error "Invalid repository format: $repo_ref"
        echo ""
        echo "Supported formats:"
        echo "  org/repo"
        echo "  github.com/org/repo"
        echo "  https://github.com/org/repo"
        echo "  git@github.com:org/repo.git"
        echo "  ssh://git@host:port/org/repo"
        exit 1
    fi

    # Build the clone URL
    local clone_url
    clone_url=$(__vendor_build_url)

    # Define the target directory
    local vendor_dir="${HOME}/git/vendor"
    local target_dir="${vendor_dir}/${VENDOR_ORG}/${VENDOR_REPO}"

    # Check if already cloned
    if [[ -d "$target_dir" ]]; then
        echo "Repository already exists: ${target_dir}"
        exit 0
    fi

    # Ensure the parent directory exists
    mkdir -p "${vendor_dir}/${VENDOR_ORG}"

    # Clone the repository
    echo "Cloning ${clone_url}"
    echo "     to ${target_dir}"
    echo ""

    if git clone "$clone_url" "$target_dir"; then
        echo ""
        echo "Repository cloned: ${target_dir}"
    else
        fault "Clone failed"
    fi
}

#===========================================================
#                  REMOTE-PROTO EXTENSION
#===========================================================
# Convert git remote URLs between protocols (https, git, ssh)

#-----------------------------------------------------------
# Remote-Proto URL Parsing
#-----------------------------------------------------------

# Parse a git remote URL into components
# Sets: REMOTE_PROTO_HOST, REMOTE_PROTO_ORG, REMOTE_PROTO_REPO, REMOTE_PROTO_PORT
__remote_proto_parse_url() {
    local url="$1"

    # Reset state
    REMOTE_PROTO_HOST=""
    REMOTE_PROTO_ORG=""
    REMOTE_PROTO_REPO=""
    REMOTE_PROTO_PORT=""

    # Remove trailing .git if present (we'll add it back as needed)
    url="${url%.git}"

    # https://host/org/repo
    if [[ "$url" =~ ^https?://([^/]+)/([^/]+)/([^/]+)/?$ ]]; then
        REMOTE_PROTO_HOST="${BASH_REMATCH[1]}"
        REMOTE_PROTO_ORG="${BASH_REMATCH[2]}"
        REMOTE_PROTO_REPO="${BASH_REMATCH[3]}"

    # ssh://[git@]host[:port]/org/repo
    elif [[ "$url" =~ ^ssh://(git@)?([^/:]+)(:([0-9]+))?/([^/]+)/([^/]+)/?$ ]]; then
        REMOTE_PROTO_HOST="${BASH_REMATCH[2]}"
        REMOTE_PROTO_PORT="${BASH_REMATCH[4]}"
        REMOTE_PROTO_ORG="${BASH_REMATCH[5]}"
        REMOTE_PROTO_REPO="${BASH_REMATCH[6]}"

    # git@host:org/repo
    elif [[ "$url" =~ ^git@([^:]+):([^/]+)/([^/]+)$ ]]; then
        REMOTE_PROTO_HOST="${BASH_REMATCH[1]}"
        REMOTE_PROTO_ORG="${BASH_REMATCH[2]}"
        REMOTE_PROTO_REPO="${BASH_REMATCH[3]}"

    else
        return 1
    fi

    return 0
}

# Build URL in the specified protocol
__remote_proto_build_url() {
    local protocol="$1"

    case "$protocol" in
        http|https)
            echo "https://${REMOTE_PROTO_HOST}/${REMOTE_PROTO_ORG}/${REMOTE_PROTO_REPO}.git"
            ;;
        git)
            echo "git@${REMOTE_PROTO_HOST}:${REMOTE_PROTO_ORG}/${REMOTE_PROTO_REPO}.git"
            ;;
        ssh)
            if [[ -n "$REMOTE_PROTO_PORT" ]]; then
                echo "ssh://git@${REMOTE_PROTO_HOST}:${REMOTE_PROTO_PORT}/${REMOTE_PROTO_ORG}/${REMOTE_PROTO_REPO}.git"
            else
                echo "ssh://git@${REMOTE_PROTO_HOST}/${REMOTE_PROTO_ORG}/${REMOTE_PROTO_REPO}.git"
            fi
            ;;
        *)
            return 1
            ;;
    esac
}

#-----------------------------------------------------------
# Remote-Proto Help
#-----------------------------------------------------------

__remote_proto_help() {
    cat <<EOF
## git remote-proto - Convert remote URL protocol

Usage: git remote-proto <protocol> [options]

Arguments:
    protocol        Target protocol: http, https, git, or ssh

Protocols:
    http, https     https://{host}/{org}/{repo}.git
    git             git@{host}:{org}/{repo}.git
    ssh             ssh://git@{host}[:port]/{org}/{repo}.git

Options:
    --remote <name>    Remote name (default: origin)
    --port <port>      SSH port (only used with ssh protocol)
    -h, --help         Show this help message

Description:
    Converts the remote URL to use a different protocol while
    preserving the host, organization, and repository.

Examples:
    # Convert origin to SSH (git@) format
    git remote-proto git

    # Convert origin to HTTPS format
    git remote-proto https

    # Convert to ssh:// format with custom port
    git remote-proto ssh --port 2222

    # Convert a specific remote
    git remote-proto ssh --remote upstream
EOF
}

#-----------------------------------------------------------
# Remote-Proto Main
#-----------------------------------------------------------

__remote_proto_main() {
    check_deps git

    local protocol=""
    local remote_name="origin"
    local port_override=""

    while [[ $# -gt 0 ]]; do
        case "$1" in
            --remote)
                remote_name="$2"
                shift 2
                ;;
            --port)
                port_override="$2"
                shift 2
                ;;
            -h|--help)
                __remote_proto_help
                exit 0
                ;;
            -*)
                error "Unknown option: $1"
                __remote_proto_help
                exit 1
                ;;
            *)
                if [[ -z "$protocol" ]]; then
                    protocol="$1"
                else
                    error "Too many arguments"
                    __remote_proto_help
                    exit 1
                fi
                shift
                ;;
        esac
    done

    if [[ -z "$protocol" ]]; then
        __remote_proto_help
        exit 0
    fi

    # Validate protocol
    case "$protocol" in
        http|https|git|ssh)
            ;;
        *)
            fault "Invalid protocol: $protocol (must be http, https, git, or ssh)"
            ;;
    esac

    # Warn if --port used with non-ssh protocol
    if [[ -n "$port_override" && "$protocol" != "ssh" ]]; then
        stderr "Warning: --port is only used with ssh protocol, ignoring"
    fi

    # Check we're in a git repo
    if ! git rev-parse --git-dir >/dev/null 2>&1; then
        fault "Not a git repository"
    fi

    # Get current remote URL
    local current_url
    current_url=$(git remote get-url "$remote_name" 2>/dev/null) || fault "Remote '${remote_name}' not found"

    echo "Current: ${current_url}"

    # Parse the URL
    if ! __remote_proto_parse_url "$current_url"; then
        fault "Cannot parse remote URL: ${current_url}"
    fi

    # Apply port override for ssh protocol
    if [[ "$protocol" == "ssh" && -n "$port_override" ]]; then
        REMOTE_PROTO_PORT="$port_override"
    fi

    # Build new URL
    local new_url
    new_url=$(__remote_proto_build_url "$protocol") || fault "Failed to build URL for protocol: ${protocol}"

    # Check if already using this protocol
    if [[ "$current_url" == "$new_url" ]]; then
        echo "Already using ${protocol} protocol"
        exit 0
    fi

    # Update the remote
    git remote set-url "$remote_name" "$new_url"
    echo "Updated: ${new_url}"
}

#===========================================================
#                    MAIN DISPATCHER
#===========================================================

__main_help() {
    cat <<EOF
## Git Extensions Framework

Usage: git <extension> [args...]
   or: git-<extension> [args...]

Available extensions:
    vendor        Clone repositories to ~/git/vendor/{org}/{repo}
    deploy        Clone repositories using deploy key authentication
    deploy-key    Manage deploy keys (list, show, remove)
    remote-proto  Convert remote URL protocol (https, git, ssh)

Run 'git <extension> --help' for extension-specific help.

Setup:
    Create symlinks in your PATH:
        ln -s /path/to/git_extensions.sh ~/.local/bin/git-vendor
        ln -s /path/to/git_extensions.sh ~/.local/bin/git-deploy
        ln -s /path/to/git_extensions.sh ~/.local/bin/git-deploy-key
        ln -s /path/to/git_extensions.sh ~/.local/bin/git-remote-proto

    Then use as:
        git vendor org/repo
        git deploy <repo-url>
        git deploy-key list
        git remote-proto ssh
EOF
}

# Dispatch to the appropriate extension
case "$EXTENSION_CMD" in
    vendor)
        __vendor_main "$@"
        ;;
    deploy)
        __deploy_main "$@"
        ;;
    deploy-key)
        __deploy_key_main "$@"
        ;;
    remote-proto)
        __remote_proto_main "$@"
        ;;
    -h|--help|help|"")
        __main_help
        exit 0
        ;;
    *)
        error "Unknown extension: $EXTENSION_CMD"
        __main_help
        exit 1
        ;;
esac

Git on blog.rymcg.tech

Git extensions in Babashka

Why Babashka?

What changed

How the port went

Installation

The script

Extensions to git

How git extensions work

git vendor

git deploy

git deploy-key

git remote-proto

Installation

See Also

The script