[mike@mwxm4]

Every y/n prompt after the first in a session answered itself with its
default and left the keypress queued for the next command line.

MIN and TIME are not part of the canonical/non-canonical switch: they
live in their own slots of the control-character array and survive
`stty icanon`. drainTTY left them at "min 0 time 0" — return whatever is
buffered, do not wait — and the restore named only icanon and echo, so
the next read returned zero bytes without ever waiting for a key.

Set MIN and TIME explicitly on the way in, and restore the terminal from
the state captured with `stty -g` instead of naming the flags we changed;
mgsh now hands the terminal back exactly as it found it, where before
"min 0" outlived mgsh itself and broke the next program's single-key
reads too.

getkey also reports whether it got a key at all. When it did not, the
answer is no whatever the default says: a question nobody saw must not
be taken as consent. All five call sites default to no, so the bug never
destroyed anything — it only made agreeing impossible.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -8,4 +8,5 @@
 .TemporaryItems
 .Trashes
 mgsh
+bin/
 .mgshrc

README.md

@@ -9,7 +9,9 @@ directory. Go port of the original Perl `mgsh` (`mgsh.perl`).
 - [Build](#build) · [Usage](#usage) · [Commands](#commands) · [Aliases](#aliases)
 - [Overview](#overview) · [Credential check](#credential-check)
 - [Public mirror (`pushremote`)](#public-mirror-pushremote) ·
+  [Deleting a mirror (`deleteremote`)](#deleting-a-mirror-deleteremote) ·
   [Releases](#releases)
+- [Updating itself](#updating-itself)
 - [Configuration](#configuration) · [Settings reference](#settings-reference) ·
   [Per-project configuration](#per-project-configuration)
 - [Git server layout](#git-server-layout)
@@ -17,14 +19,36 @@ directory. Go port of the original Perl `mgsh` (`mgsh.perl`).
 ## Build
 
 ```sh
-./build.sh          # builds ./mgsh and bumps the patch version by 0.0.1
+./build.sh                        # all platforms into ./bin, bumps the patch version
+PLATFORMS="linux/amd64" ./build.sh  # just one
 go build -o mgsh .                # plain build, keeps the default version
 ```
 
-`build.sh` reads `version.txt`, increments the patch component, injects it via
+`build.sh` cross-compiles for `darwin/arm64`, `darwin/amd64`, `linux/amd64` and
-`-ldflags -X main.VERSION`, and writes it back — so `version.txt` always holds
+`linux/arm64` into `./bin`:
-the version of the binary just built. Dependencies are fetched via Go modules
+
-(`go.mod` / `go.sum`) on first build.
+```
+bin/mgsh                 -> mgsh-darwin-arm64   (this machine)
+bin/mgsh-darwin-amd64
+bin/mgsh-darwin-arm64
+bin/mgsh-linux-amd64
+bin/mgsh-linux-arm64
+```
+
+`bin/mgsh` is a symlink to the build for the host, so there is one stable path
+to "the binary for this machine". `bin/` is git-ignored. Windows is deliberately
+absent: mgsh shells out to `stty` and `/bin/sh`, so it would compile there and
+then not work.
+
+Everything is built with `CGO_ENABLED=0`, which makes the cross builds need no
+toolchain per target and the binaries static; `os/user` resolves the current
+user without cgo on both darwin and linux.
+
+It reads `version.txt`, increments the patch component, injects it via
+`-ldflags -X main.VERSION` into **all** platforms of that run, and writes it
+back — so `version.txt` always holds the version of the binaries just built, and
+they all carry the same one. Dependencies are fetched via Go modules (`go.mod` /
+`go.sum`) on first build.
 
 Run the tests with `go test ./...`.
 
@@ -40,11 +64,11 @@ stand in. Outside `base` no project is selected. `mgsh <project>` starts the
 interactive shell with that project preselected.
 
 The commands available directly from the shell are `clone`, `init`, `log`,
-`push`, `pushremote`, `release`, `list`, `tag`, `archive`, `show`,
+`push`, `pushremote`, `deleteremote`, `release`, `list`, `tag`, `archive`,
-`pull`, `fetch`, `status`, `diff`, `overview`, `config`, `count`, `login` and
+`show`, `pull`, `fetch`, `status`, `diff`, `overview`, `config`, `count`,
-`cloneall`; every other command is interactive-only.
+`login` and `cloneall`; every other command is interactive-only.
 
-The interactive prompt is colored (Catppuccin Mocha) and shows the active
+The interactive prompt is colored (Catppuccin-flavored) and shows the active
 project, its git branch and a `*` dirty marker:
 
 ```
@@ -108,6 +132,7 @@ Run `help` for the full list. Highlights:
 | `cd [project]`            | change project (no argument: back to the base) |
 | `push [comment]`          | commit everything and push to the server       |
 | `pushremote [desc]`       | mirror the repo to a public server (gitea/github/gitlab) |
+| `deleteremote <@name\|host>` | delete the repo on that public server (asks first) |
 | `pull` / `fetch`          | pull / fetch from the server                   |
 | `status [-a]` / `diff`    | short git status (`-a`: overview of all projects) |
 | `overview`                | inventory of all projects, local and on the server |
@@ -124,6 +149,7 @@ Run `help` for the full list. Highlights:
 | `unalias <name>`          | remove a command alias                         |
 | `config [-k]`             | show the effective configuration and its sources |
 | `rescan`                  | reload the config, refresh the cached repo list |
+| `update [-c]`             | update mgsh to the newest release (`-c`: only look) |
 | `!<command>`              | run `<command>` in the shell                   |
 
 Commands that touch a repository (`push`, `pull`, `log`, `diff`, `tag`, `dist`,
@@ -299,6 +325,7 @@ remote.gitlab.url        = https://gitlab.example.com
 remote.gitlab.key        = <personal-access-token>
 remote.gitlab.type       = gitlab
 remote.gitlab.visibility = public
+remote.gitlab.active     = false     # only used when named (default true)
 
 # remotes                = gitea, gitlab   # optional: restrict and order the set
 # mirror                 = true            # `push` also mirrors via pushremote
@@ -311,10 +338,29 @@ name those versions used.
 
 | command                | pushes to                                     |
 |------------------------|-----------------------------------------------|
-| `pushremote`           | every configured target, in order              |
+| `pushremote`           | every **active** target, in order              |
-| `pushremote @gitea`    | only `gitea`                                   |
+| `pushremote @gitea`    | only `gitea`, active or not                    |
 | `pushremote @gitea @gitlab` | those two                                 |
-| `pushremote a fix`     | every target, description "a fix"              |
+| `pushremote a fix`     | every active target, description "a fix"       |
+
+#### Active and inactive targets
+
+`remote.<name>.active = false` takes a target out of the default set: it is
+skipped by a bare `pushremote`, by `release` without a `@name`, and by the
+automatic mirror of `mirror = true`. Naming it uses it exactly as before —
+`pushremote @gitea`, `release @gitea v1.2`, or by host, `pushremote @git.example.com`.
+
+That is the difference to the alternatives: removing the block loses the token,
+and leaving the target in `remotes = …` keeps it on the automatic path. An
+inactive target stays configured, keeps its credentials, is listed by `config`
+(a shade dimmer, marked `inactive`) and completes with Tab — it just no longer
+goes along by default. Useful for a server that is behind a VPN, rate-limited,
+or only occasionally interesting.
+
+Unset means active, so a configuration written before this flag existed keeps
+mirroring where it always did. When *every* configured target is inactive, a
+bare `pushremote` says so and names one instead of claiming nothing is
+configured.
 
 Each target owns a git remote of the same name in the repository, so
 `git push gitlab` keeps working outside mgsh. A
@@ -336,6 +382,52 @@ existing file is readable by others. The provider is auto-detected from the url
 with `remote.<name>.type`. Set `mirror = true` to have every `push` mirror
 automatically.
 
+### Deleting a mirror (`deleteremote`)
+
+`deleteremote` is the counterpart: it deletes the active project's repository on
+a public server, through the same API and with the same token.
+
+```
+deleteremote <@name|host> [...]
+```
+
+```
+< src/myproject > deleteremote git.example.com
+remote gitea https://git.example.com (as mike)
+this deletes https://git.example.com/mike/myproject.git with its issues,
+releases and history, and cannot be undone
+delete mike/myproject on gitea? y/N ? y
+deleted mike/myproject on gitea
+removed git remote gitea
+```
+
+A target can be named either way: `@gitea` (its configured name) or
+`git.example.com` (the host of its url) select the same server, and the `@` is
+optional here. Both spellings work for `pushremote` and `release` too.
+`active = false` changes nothing for this command — it always needs the server
+named anyway.
+
+The guard rails, because nothing on the other end can be undone from here:
+
+- **the server must be named.** Unlike `pushremote`, a bare `deleteremote` does
+  *not* mean "every configured target" — it lists them and stops.
+- the repository is looked up first, so a typo is reported as "nothing to
+  delete" instead of becoming a request nobody meant to send.
+- each deletion is confirmed on its own, naming owner/repo and server, and the
+  default answer is **no**.
+- the **local clone is never touched**. Only the git remote of that name is
+  dropped, and only while it still points at the repository that was deleted.
+
+Only the mirror is affected — the repository on the internal ssh git server, and
+everything `list`/`archive` deal with, stays where it is.
+
+Deletion needs more from the token than pushing does: the `delete_repo` scope on
+GitHub, `write:repository` on Gitea, and the `api` scope plus the Owner role on
+GitLab. When it is missing the server answers 403, and mgsh names the scope
+rather than passing the bare status on. GitLab may only *schedule* the deletion
+(HTTP 202): depending on the plan the project stays visible until its retention
+period is over.
+
 ### Releases
 
 `release` turns a commit into a published release on the mirror servers, in one
@@ -351,7 +443,7 @@ release [@name ...] <tag> [notes]
 remote hub released https://github.com/mike/mgsh.git
 ```
 
-Without `@name` it releases to every configured mirror target, exactly like
+Without `@name` it releases to every active mirror target, exactly like
 `pushremote`. Everything after the tag becomes the release notes *and* the tag's
 annotation.
 
@@ -370,11 +462,103 @@ on different servers. `release` also refuses when the repository is not on the
 mirror yet and tells you to run `pushremote` first, rather than creating it as a
 side effect.
 
-**No binary assets.** The three providers handle uploads in three incompatible
+#### Binaries and assets
-ways — Gitea attaches them to the release, GitHub uses a separate upload host,
+
-and GitLab does not host them at all but expects a link into its package
+If the project has a `./bin` or `./assets` directory, every file in it is
-registry. mgsh publishes source releases with notes; if you need binaries,
+attached to the release — nothing to configure, and nothing happens for a
-upload them with the provider's own tooling.
+project that has neither:
+
+```
+< src/mgsh > release v4.1.0
+attaching 5 assets, 38M from ./bin and ./assets
+remote gitea released https://git.example.com/mike/mgsh.git
+  uploading logo.png                     2.0K
+  uploading mgsh-darwin-amd64            9.8M
+  uploading mgsh-darwin-arm64            9.2M
+  uploading mgsh-linux-amd64             9.7M
+  uploading mgsh-linux-arm64             8.9M
+```
+
+Only regular files directly in those directories are taken: subdirectories are
+not descended into, and symlinks are skipped — `bin/mgsh` points at one of its
+own siblings, and uploading the same binary twice under two names helps nobody.
+A name present in both directories is used from `bin` and reported for
+`assets`, since one asset name can only mean one file.
+
+Re-releasing the same tag replaces same-named assets instead of failing or
+piling up duplicates, because rebuilding and publishing again is the normal
+reason to do it. A file that fails to upload does not stop the rest.
+
+This is where the providers stop resembling each other, and mgsh papers over it:
+
+| | how the bytes get there |
+|---|---|
+| Gitea | multipart `POST` to `…/releases/<id>/assets?name=<name>` |
+| GitHub | raw `POST` to the separate upload host named by the release's `upload_url` |
+| GitLab | a release stores links, not files: the file goes into the project's generic **package registry** and the release gets a `package` link pointing at it |
+
+The GitLab route needs the package registry enabled on the project — it is on by
+default, but a self-hosted instance can turn it off.
+
+## Updating itself
+
+```
+update -c        # only look
+update           # fetch and replace
+```
+
+and from outside the shell, `mgsh update` / `mgsh --update` — the dashed
+spelling is the one that also works before mgsh is configured, where every
+other command exits with "not configured".
+
+mgsh fetches the newest release from
+[git.micw.org/mike/mgsh](https://git.micw.org/mike/mgsh) — the URL sits fixed in
+the program, there is nothing to configure. What it needs is one release per
+version, whose tag is the bare number (`4.1.0`), with the files from `./bin` as
+its assets; the one looked for is the one matching `GOOS`/`GOARCH` of this
+machine. That is exactly what `./build.sh` produces and `release` publishes, so
+`./build.sh && release 4.1.0` is the whole publishing side.
+
+What gets replaced is the running file itself. If the `mgsh` that was called is
+a symlink — say `~/bin/mgsh` pointing at `~/src/mgsh/bin/mgsh-darwin-arm64` —
+the target behind it is renewed, not the link. Before the swap, what was freshly
+fetched is called once with `--version`; if it does not report the expected
+number, everything stays as it was. The swap itself is a `rename` within the
+same directory, hence atomic: either the old file or the new one, never half of
+one. If the binary lies somewhere you may not write to (`/usr/local/bin`),
+`update` says so and does nothing — then `sudo`.
+
+### Once a day, by itself
+
+Without being asked, mgsh looks once a day and says so on stderr — at the start
+of an interactive session, and after the output of a one-shot command:
+
+```
+mgsh 4.1.0 is available, run 'mgsh --update'
+```
+
+The run in the foreground never touches the network for this. It only reads a
+note — `~/Library/Caches/mgsh/update.json`, on Linux `~/.cache/mgsh/update.json`
+— and when that one is older than a day, it starts `mgsh --update-refresh` on
+the side: the same binary once more, detached, without output, only to ask.
+Nobody waits for its answer; it will be in the note at the next call. mgsh
+thereby stays exactly as fast as before, even when the server happens to be
+silent.
+
+The timestamp moves on *before* the asking. Two simultaneous runs therefore
+start one query, not two, and a server that does not answer is asked again
+tomorrow rather than on every call. If the note cannot be written, the question
+is dropped entirely — otherwise a write-protected cache directory would mean one
+process per call.
+
+Asking and speaking happen only when stderr hangs on a terminal. In a pipe, in a
+script and under cron there is quiet, and `MGSH_NO_UPDATE_CHECK=1` turns it off
+altogether.
+
+`selfupdate.go` is a copy from [dx](https://git.micw.org/mike/dx) and hangs on
+nothing in the rest of mgsh: standard library only, every name it brings starts
+with `selfUpdate` or `update`, and the block at the top of the file is all there
+is to adjust when it moves on to the next program.
 
 ## Configuration
 
@@ -437,6 +621,7 @@ setting.
 | `remote.<name>.key` | project | API token for that target |
 | `remote.<name>.type` | project | `gitea`\|`github`\|`gitlab`; auto-detected from the url when unset |
 | `remote.<name>.visibility` | project | `private` (default) or `public` for repositories `pushremote` creates |
+| `remote.<name>.active` | project | `false` keeps the target out of the default set; it is then only used when named (`pushremote @<name>`). Default `true` |
 | `remotes` | project | comma- or space-separated list restricting and ordering the mirror targets |
 | `mirror` | project | truthy (`1`/`true`/`yes`/`on`) → every `push` also mirrors |
 | `secretscan` | project | `off` disables the credential check `push` runs before committing (on by default; only an explicit `off` disables it) |

alias.go

@@ -44,10 +44,10 @@ var builtinCmds = map[string]bool{
 	"": true, "quit": true, "exit": true, "help": true, "rescan": true,
 	"dist": true, "list": true, "show": true, "log": true, "status": true,
 	"diff": true, "pull": true, "fetch": true, "push": true, "edit": true,
-	"pushremote": true, "overview": true, "archive": true, "init": true,
+	"pushremote": true, "deleteremote": true, "overview": true, "archive": true, "init": true,
 	"login": true, "cd": true, "checkout": true, "clone": true, "cloneall": true,
 	"count": true, "tag": true, "alias": true,
-	"unalias": true, "config": true, "release": true,
+	"unalias": true, "config": true, "release": true, "update": true,
 }
 
 func isBuiltin(name string) bool { return builtinCmds[name] }
@@ -241,7 +241,7 @@ func handleUnalias(name string) {
 
 func listAliases() {
 	if len(aliases) == 0 {
-		fmt.Println(col(cGray, "no aliases defined"))
+		fmt.Println(col(cDark, "no aliases defined"))
 		return
 	}
 	for _, n := range aliasNames() {
@@ -251,7 +251,7 @@ func listAliases() {
 
 // formatAlias renders `name = 'body'` with color.
 func formatAlias(name, body string) string {
-	return col(cGreen, name) + col(cGray, " = ") + col(cYellow, "'"+body+"'")
+	return col(cGreen, name) + col(cDark, " = ") + col(cYellow, "'"+body+"'")
 }
 
 // expandAlias substitutes positional parameters in an alias body. With no

assets.go

@@ -0,0 +1,323 @@
+package main
+
+// assets.go — attaching files to a release.
+//
+// `release` uploads everything in the project's ./bin and ./assets when those
+// directories exist. This is where the three providers stop resembling each
+// other, so each gets its own path:
+//
+//	Gitea   multipart POST to .../releases/<id>/assets?name=<name>
+//	GitHub  raw POST to the upload host named by the release object's upload_url
+//	GitLab  no asset hosting on a release at all: the file goes into the generic
+//	        package registry, and the release gets a link pointing at it
+//
+// Re-releasing the same tag replaces same-named assets rather than failing or
+// piling up duplicates, because rebuilding and publishing again is the normal
+// reason to do it.
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"mime"
+	"mime/multipart"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+)
+
+// assetDirs are the project directories whose files a release carries.
+var assetDirs = []string{"bin", "assets"}
+
+// releaseAsset is one file to attach to a release.
+type releaseAsset struct {
+	name string
+	path string
+	size int64
+}
+
+// collectAssets gathers the files to attach: every regular file directly in
+// the project's ./bin and ./assets. Subdirectories are not descended into, and
+// symlinks are skipped — bin/mgsh points at one of its own siblings, and
+// uploading the same binary twice under two names helps nobody.
+func collectAssets(dir string) (assets []releaseAsset, skipped []string) {
+	seen := map[string]bool{}
+	for _, sub := range assetDirs {
+		path := filepath.Join(dir, sub)
+		entries, err := os.ReadDir(path)
+		if err != nil {
+			continue // the directory simply is not there
+		}
+		for _, e := range entries {
+			if e.IsDir() || e.Type()&os.ModeSymlink != 0 {
+				continue
+			}
+			fi, err := e.Info()
+			if err != nil || !fi.Mode().IsRegular() {
+				continue
+			}
+			if seen[e.Name()] {
+				// bin/x and assets/x would fight over one asset name
+				skipped = append(skipped, filepath.Join(sub, e.Name()))
+				continue
+			}
+			seen[e.Name()] = true
+			assets = append(assets, releaseAsset{
+				name: e.Name(),
+				path: filepath.Join(path, e.Name()),
+				size: fi.Size(),
+			})
+		}
+	}
+	sort.Slice(assets, func(i, j int) bool { return assets[i].name < assets[j].name })
+	return assets, skipped
+}
+
+// contentType guesses a type from the file name, falling back to the one for
+// "some bytes" — which is what a compiled binary is.
+func contentType(name string) string {
+	if t := mime.TypeByExtension(filepath.Ext(name)); t != "" {
+		return t
+	}
+	return "application/octet-stream"
+}
+
+// doUpload sends a request with a raw body of a known size. The JSON helper
+// cannot express these: an asset upload is bytes, not an object, and the
+// providers insist on a Content-Length rather than a chunked body.
+func (r *remoteAPI) doUpload(method, endpoint, ctype string, body io.Reader, size int64) (int, []byte, error) {
+	req, err := http.NewRequest(method, endpoint, body)
+	if err != nil {
+		return 0, nil, err
+	}
+	req.ContentLength = size
+	req.Header.Set("Content-Type", ctype)
+	hk, hv := r.authHeader()
+	req.Header.Set(hk, hv)
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := r.http.Do(req)
+	if err != nil {
+		return 0, nil, err
+	}
+	defer resp.Body.Close()
+	data, _ := io.ReadAll(resp.Body)
+	return resp.StatusCode, data, nil
+}
+
+// uploadAssets attaches every file to the release, reporting each one as it
+// goes: these are megabytes over a network, and silence for a minute looks like
+// a hang. A file that fails does not stop the rest.
+func (r *remoteAPI) uploadAssets(owner, repo string, ref releaseRef, assets []releaseAsset) error {
+	failed := 0
+	for _, a := range assets {
+		fmt.Printf("  %s %s %s\n", col(cDark, "uploading"),
+			col(cGreen, padRight(a.name, 28)), col(cDark, humanSize(a.size)))
+		if err := r.uploadAsset(owner, repo, ref, a); err != nil {
+			errorln("  " + a.name + ": " + err.Error())
+			failed++
+		}
+	}
+	if failed > 0 {
+		return fmt.Errorf("%d of %d assets failed", failed, len(assets))
+	}
+	return nil
+}
+
+// uploadAsset attaches one file, replacing an asset of the same name that is
+// already on the release.
+func (r *remoteAPI) uploadAsset(owner, repo string, ref releaseRef, a releaseAsset) error {
+	if err := r.removeAsset(owner, repo, ref, a.name); err != nil {
+		return err
+	}
+	switch r.kind {
+	case kindGitLab:
+		return r.uploadAssetGitLab(owner, repo, ref, a)
+	case kindGitHub:
+		return r.uploadAssetGitHub(ref, a)
+	default:
+		return r.uploadAssetGitea(owner, repo, ref, a)
+	}
+}
+
+// uploadAssetGitea posts the file as a multipart form, streamed from disk
+// rather than buffered: these are whole binaries.
+func (r *remoteAPI) uploadAssetGitea(owner, repo string, ref releaseRef, a releaseAsset) error {
+	f, err := os.Open(a.path)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	pr, pw := io.Pipe()
+	mw := multipart.NewWriter(pw)
+	go func() {
+		part, err := mw.CreateFormFile("attachment", a.name)
+		if err == nil {
+			_, err = io.Copy(part, f)
+		}
+		if err != nil {
+			pw.CloseWithError(err)
+			return
+		}
+		pw.CloseWithError(mw.Close())
+	}()
+
+	ep := r.releasePath(owner, repo) + "/" + ref.id + "/assets?name=" + url.QueryEscape(a.name)
+	// the multipart length is not known up front, so this one is chunked
+	code, data, err := r.doUpload("POST", ep, mw.FormDataContentType(), pr, -1)
+	if err != nil {
+		return err
+	}
+	if code != 200 && code != 201 {
+		return fmt.Errorf("HTTP %d: %s", code, firstLine(data))
+	}
+	return nil
+}
+
+// uploadAssetGitHub posts the raw bytes to the host the release object named.
+func (r *remoteAPI) uploadAssetGitHub(ref releaseRef, a releaseAsset) error {
+	if ref.uploadURL == "" {
+		return fmt.Errorf("the release carries no upload_url")
+	}
+	f, err := os.Open(a.path)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	ep := ref.uploadURL + "?name=" + url.QueryEscape(a.name)
+	code, data, err := r.doUpload("POST", ep, contentType(a.name), f, a.size)
+	if err != nil {
+		return err
+	}
+	if code != 200 && code != 201 {
+		return fmt.Errorf("HTTP %d: %s", code, firstLine(data))
+	}
+	return nil
+}
+
+// uploadAssetGitLab puts the file into the project's generic package registry
+// and links the release to it, since a GitLab release stores links, not files.
+func (r *remoteAPI) uploadAssetGitLab(owner, repo string, ref releaseRef, a releaseAsset) error {
+	f, err := os.Open(a.path)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	pkg := r.packagePath(owner, repo, ref.tag, a.name)
+	code, data, err := r.doUpload("PUT", pkg, contentType(a.name), f, a.size)
+	if err != nil {
+		return err
+	}
+	if code != 200 && code != 201 {
+		return fmt.Errorf("package upload failed (HTTP %d): %s", code, firstLine(data))
+	}
+
+	code, data, err = r.do("POST", r.releaseByTagPath(owner, repo, ref.tag)+"/assets/links",
+		map[string]any{"name": a.name, "url": pkg, "link_type": "package"})
+	if err != nil {
+		return err
+	}
+	if code != 200 && code != 201 {
+		return fmt.Errorf("linking the package failed (HTTP %d): %s", code, firstLine(data))
+	}
+	return nil
+}
+
+// packagePath is where a release asset lives in GitLab's generic registry: one
+// package named after the repository, one version per tag.
+func (r *remoteAPI) packagePath(owner, repo, tag, name string) string {
+	return r.repoPath(owner, repo) + "/packages/generic/" +
+		url.PathEscape(repo) + "/" + url.PathEscape(tag) + "/" + url.PathEscape(name)
+}
+
+// removeAsset deletes an asset of the given name from the release when one is
+// there, so re-releasing a tag after a rebuild replaces the files instead of
+// failing or leaving two of each.
+func (r *remoteAPI) removeAsset(owner, repo string, ref releaseRef, name string) error {
+	listEP, delEP := r.assetEndpoints(owner, repo, ref)
+	code, data, err := r.do("GET", listEP, nil)
+	if err != nil {
+		return err
+	}
+	if code == 404 {
+		return nil // nothing uploaded yet
+	}
+	if code != 200 {
+		return fmt.Errorf("listing assets failed (HTTP %d): %s", code, firstLine(data))
+	}
+
+	for _, id := range assetIDsNamed(data, name) {
+		if code, data, err := r.do("DELETE", delEP+"/"+id, nil); err != nil {
+			return err
+		} else if code != 200 && code != 202 && code != 204 {
+			return fmt.Errorf("deleting the previous %s failed (HTTP %d): %s", name, code, firstLine(data))
+		}
+	}
+	return nil
+}
+
+// assetEndpoints returns where a release's assets are listed and deleted.
+// GitHub deletes an asset through the repository rather than the release.
+func (r *remoteAPI) assetEndpoints(owner, repo string, ref releaseRef) (list, del string) {
+	switch r.kind {
+	case kindGitLab:
+		base := r.releaseByTagPath(owner, repo, ref.tag) + "/assets/links"
+		return base, base
+	case kindGitHub:
+		return r.releasePath(owner, repo) + "/" + ref.id + "/assets",
+			r.releasePath(owner, repo) + "/assets"
+	default: // Gitea
+		base := r.releasePath(owner, repo) + "/" + ref.id + "/assets"
+		return base, base
+	}
+}
+
+// assetIDsNamed picks the ids of the listed assets called name. All three
+// providers answer with an array of objects carrying "id" and "name".
+func assetIDsNamed(data []byte, name string) []string {
+	var list []struct {
+		ID   json.Number `json:"id"`
+		Name string      `json:"name"`
+	}
+	if err := json.Unmarshal(data, &list); err != nil {
+		return nil
+	}
+	var ids []string
+	for _, a := range list {
+		if a.Name == name && a.ID.String() != "" {
+			ids = append(ids, a.ID.String())
+		}
+	}
+	return ids
+}
+
+// assetSummary describes what will be uploaded, for the line `release` prints
+// before it starts.
+func assetSummary(assets []releaseAsset) string {
+	var total int64
+	for _, a := range assets {
+		total += a.size
+	}
+	unit := "assets"
+	if len(assets) == 1 {
+		unit = "asset"
+	}
+	return strconv.Itoa(len(assets)) + " " + unit + ", " + humanSize(total)
+}
+
+// assetDirList names the directories that were actually found, for the same line.
+func assetDirList(dir string) []string {
+	var found []string
+	for _, sub := range assetDirs {
+		if isDir(filepath.Join(dir, sub)) {
+			found = append(found, "./"+sub)
+		}
+	}
+	return found
+}

assets_test.go

@@ -0,0 +1,284 @@
+package main
+
+// assets_test.go — attaching files to a release.
+//
+// The three providers upload assets in three unrelated ways, and the difference
+// is invisible until a real server rejects the request. The recording stand-in
+// lets each one be pinned down: where the bytes go, how they are wrapped, and
+// what else has to happen around them.
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// assetTree builds a project with ./bin and ./assets and returns its path.
+func assetTree(t *testing.T, files map[string]string) string {
+	t.Helper()
+	dir := t.TempDir()
+	for rel, content := range files {
+		p := filepath.Join(dir, rel)
+		if err := os.MkdirAll(filepath.Dir(p), 0755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(p, []byte(content), 0755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return dir
+}
+
+func TestCollectAssets(t *testing.T) {
+	dir := assetTree(t, map[string]string{
+		"bin/mgsh-linux-amd64":  "ELF...",
+		"bin/mgsh-darwin-arm64": "MACH...",
+		"assets/logo.png":       "PNG",
+		"assets/notes.txt":      "text",
+		"bin/sub/nested":        "not descended into",
+		"src/main.go":           "not an asset directory",
+	})
+	// bin/mgsh is a symlink to one of its siblings, as build.sh leaves it
+	if err := os.Symlink("mgsh-linux-amd64", filepath.Join(dir, "bin", "mgsh")); err != nil {
+		t.Fatal(err)
+	}
+
+	assets, skipped := collectAssets(dir)
+	var names []string
+	for _, a := range assets {
+		names = append(names, a.name)
+	}
+	want := "logo.png,mgsh-darwin-arm64,mgsh-linux-amd64,notes.txt"
+	if strings.Join(names, ",") != want {
+		t.Errorf("collected %v, want %s", names, want)
+	}
+	if len(skipped) != 0 {
+		t.Errorf("skipped = %v, want none", skipped)
+	}
+	for _, a := range assets {
+		if a.size == 0 {
+			t.Errorf("%s has no size", a.name)
+		}
+		if _, err := os.Stat(a.path); err != nil {
+			t.Errorf("%s: %v", a.name, err)
+		}
+	}
+
+	// a project with neither directory contributes nothing at all
+	if got, _ := collectAssets(t.TempDir()); len(got) != 0 {
+		t.Errorf("a project without bin/ or assets/ produced %v", got)
+	}
+}
+
+// TestCollectAssetsNameCollision: one asset name can only mean one file, so the
+// second directory's copy is reported rather than silently overwriting.
+func TestCollectAssetsNameCollision(t *testing.T) {
+	dir := assetTree(t, map[string]string{
+		"bin/tool":    "the binary",
+		"assets/tool": "something else with the same name",
+	})
+	assets, skipped := collectAssets(dir)
+	if len(assets) != 1 || assets[0].name != "tool" ||
+		!strings.HasSuffix(assets[0].path, "bin/tool") {
+		t.Errorf("assets = %+v, want only bin/tool", assets)
+	}
+	if len(skipped) != 1 || !strings.Contains(skipped[0], "tool") {
+		t.Errorf("skipped = %v, want the assets/ copy", skipped)
+	}
+}
+
+// TestUploadAssetGitea: a multipart POST under the field name Gitea expects,
+// with the asset name in the query.
+func TestUploadAssetGitea(t *testing.T) {
+	dir := assetTree(t, map[string]string{"bin/mgsh-linux-amd64": "binary-bytes-here"})
+	assets, _ := collectAssets(dir)
+
+	f := newFakeProvider(t)
+	f.route("GET /api/v1/repos/mike/mgsh/releases/7/assets", 200, `[]`)
+	f.route("POST /api/v1/repos/mike/mgsh/releases/7/assets", 201, `{"id":1}`)
+
+	api := newRemoteAPI(f.URL, "tok", "gitea")
+	ref := releaseRef{tag: "v1.0", id: "7"}
+	if err := api.uploadAsset("mike", "mgsh", ref, assets[0]); err != nil {
+		t.Fatalf("uploadAsset: %v (requests %v)", err, f.paths())
+	}
+
+	req := f.find("POST /api/v1/repos/mike/mgsh/releases/7/assets")
+	if req == nil {
+		t.Fatalf("no upload, requests: %v", f.paths())
+	}
+	if !strings.Contains(req.query, "name=mgsh-linux-amd64") {
+		t.Errorf("query = %q, want the asset name", req.query)
+	}
+	if !strings.HasPrefix(req.ctype, "multipart/form-data") {
+		t.Errorf("content type = %q, want multipart", req.ctype)
+	}
+	body := string(req.raw)
+	if !strings.Contains(body, `name="attachment"`) {
+		t.Errorf("form field is not 'attachment': %q", body)
+	}
+	if !strings.Contains(body, "binary-bytes-here") {
+		t.Errorf("the file contents did not make it: %q", body)
+	}
+}
+
+// TestUploadAssetGitHub: the bytes go raw to the host the release object named,
+// not to the API host.
+func TestUploadAssetGitHub(t *testing.T) {
+	dir := assetTree(t, map[string]string{"bin/tool": "raw-bytes"})
+	assets, _ := collectAssets(dir)
+
+	f := newFakeProvider(t)
+	f.route("GET /api/v3/repos/mike/mgsh/releases/7/assets", 200, `[]`)
+	f.route("POST /uploads/repos/mike/mgsh/releases/7/assets", 201, `{"id":1}`)
+
+	api := newRemoteAPI(f.URL, "tok", "github")
+	// the template suffix from the release object has to be stripped
+	ref := api.parseReleaseRef("v1.0", []byte(`{"id":7,"upload_url":"`+
+		f.URL+`/uploads/repos/mike/mgsh/releases/7/assets{?name,label}"}`))
+	if ref.id != "7" || strings.Contains(ref.uploadURL, "{") {
+		t.Fatalf("release ref = %+v, want id 7 and a bare upload url", ref)
+	}
+
+	if err := api.uploadAsset("mike", "mgsh", ref, assets[0]); err != nil {
+		t.Fatalf("uploadAsset: %v (requests %v)", err, f.paths())
+	}
+	req := f.find("POST /uploads/repos/mike/mgsh/releases/7/assets")
+	if req == nil {
+		t.Fatalf("no upload to the upload host, requests: %v", f.paths())
+	}
+	if string(req.raw) != "raw-bytes" {
+		t.Errorf("body = %q, want the file verbatim", req.raw)
+	}
+	if !strings.Contains(req.query, "name=tool") {
+		t.Errorf("query = %q, want the asset name", req.query)
+	}
+}
+
+// TestUploadAssetGitHubWithoutUploadURL: without one there is nowhere to put
+// the bytes, and that has to be said rather than guessed at.
+func TestUploadAssetGitHubWithoutUploadURL(t *testing.T) {
+	dir := assetTree(t, map[string]string{"bin/tool": "x"})
+	assets, _ := collectAssets(dir)
+	f := newFakeProvider(t)
+	f.route("GET /api/v3/repos/mike/mgsh/releases/7/assets", 200, `[]`)
+
+	api := newRemoteAPI(f.URL, "tok", "github")
+	err := api.uploadAsset("mike", "mgsh", releaseRef{tag: "v1", id: "7"}, assets[0])
+	if err == nil || !strings.Contains(err.Error(), "upload_url") {
+		t.Errorf("error = %v, want it to name the missing upload_url", err)
+	}
+}
+
+// TestUploadAssetGitLab: a GitLab release stores links, not files, so the file
+// goes into the generic package registry first and the release then points at
+// it.
+func TestUploadAssetGitLab(t *testing.T) {
+	dir := assetTree(t, map[string]string{"bin/tool": "package-bytes"})
+	assets, _ := collectAssets(dir)
+
+	const pkg = "/api/v4/projects/mike%2Fmgsh/packages/generic/mgsh/v1.0/tool"
+	const links = "/api/v4/projects/mike%2Fmgsh/releases/v1.0/assets/links"
+	f := newFakeProvider(t)
+	f.route("GET "+links, 200, `[]`)
+	f.route("PUT "+pkg, 201, `{"message":"201 Created"}`)
+	f.route("POST "+links, 201, `{"id":1}`)
+
+	api := newRemoteAPI(f.URL, "tok", "gitlab")
+	if err := api.uploadAsset("mike", "mgsh", releaseRef{tag: "v1.0", id: "v1.0"}, assets[0]); err != nil {
+		t.Fatalf("uploadAsset: %v (requests %v)", err, f.paths())
+	}
+
+	up := f.find("PUT " + pkg)
+	if up == nil {
+		t.Fatalf("no package upload, requests: %v", f.paths())
+	}
+	if string(up.raw) != "package-bytes" {
+		t.Errorf("package body = %q, want the file verbatim", up.raw)
+	}
+	link := f.find("POST " + links)
+	if link == nil {
+		t.Fatalf("the release was not linked to the package, requests: %v", f.paths())
+	}
+	if link.body["name"] != "tool" || link.body["link_type"] != "package" {
+		t.Errorf("link body = %v", link.body)
+	}
+	if u, _ := link.body["url"].(string); !strings.HasSuffix(u, pkg) {
+		t.Errorf("link url = %q, want it to point at the package", u)
+	}
+}
+
+// TestUploadAssetReplacesPrevious: re-releasing after a rebuild has to replace
+// the old file, not fail on it or leave two of each.
+func TestUploadAssetReplacesPrevious(t *testing.T) {
+	dir := assetTree(t, map[string]string{"bin/tool": "v2"})
+	assets, _ := collectAssets(dir)
+
+	f := newFakeProvider(t)
+	f.route("GET /api/v1/repos/mike/mgsh/releases/7/assets", 200,
+		`[{"id":41,"name":"other"},{"id":42,"name":"tool"}]`)
+	f.route("DELETE /api/v1/repos/mike/mgsh/releases/7/assets/42", 204, ``)
+	f.route("POST /api/v1/repos/mike/mgsh/releases/7/assets", 201, `{"id":43}`)
+
+	api := newRemoteAPI(f.URL, "tok", "gitea")
+	if err := api.uploadAsset("mike", "mgsh", releaseRef{tag: "v1", id: "7"}, assets[0]); err != nil {
+		t.Fatalf("uploadAsset: %v (requests %v)", err, f.paths())
+	}
+	if f.find("DELETE /api/v1/repos/mike/mgsh/releases/7/assets/42") == nil {
+		t.Errorf("the previous asset was not removed: %v", f.paths())
+	}
+	// only the one with the matching name
+	if f.find("DELETE /api/v1/repos/mike/mgsh/releases/7/assets/41") != nil {
+		t.Errorf("an unrelated asset was deleted: %v", f.paths())
+	}
+	if f.find("POST /api/v1/repos/mike/mgsh/releases/7/assets") == nil {
+		t.Errorf("the replacement was not uploaded: %v", f.paths())
+	}
+}
+
+// TestUploadAssetsReportsFailures: one bad file must not stop the others, and
+// the caller has to hear about it.
+func TestUploadAssetsReportsFailures(t *testing.T) {
+	dir := assetTree(t, map[string]string{"bin/good": "ok", "bin/bad": "boom"})
+	assets, _ := collectAssets(dir)
+
+	f := newFakeProvider(t)
+	f.route("GET /api/v1/repos/mike/mgsh/releases/7/assets", 200, `[]`)
+	// the fake answers 404 for anything unrouted, so the POST fails
+	api := newRemoteAPI(f.URL, "tok", "gitea")
+
+	out := captureStdout(t, func() {
+		if err := api.uploadAssets("mike", "mgsh", releaseRef{tag: "v1", id: "7"}, assets); err == nil {
+			t.Error("failed uploads were not reported")
+		}
+	})
+	// both were attempted, and each was announced before it started
+	for _, name := range []string{"good", "bad"} {
+		if !strings.Contains(out, name) {
+			t.Errorf("%s was not attempted or not announced:\n%s", name, out)
+		}
+	}
+}
+
+func TestAssetSummaryAndDirList(t *testing.T) {
+	dir := assetTree(t, map[string]string{
+		"bin/a":       strings.Repeat("x", 1024),
+		"assets/b":    strings.Repeat("y", 512),
+		"src/main.go": "not counted",
+	})
+	assets, _ := collectAssets(dir)
+	if got := assetSummary(assets); got != "2 assets, 1.5K" {
+		t.Errorf("assetSummary = %q, want \"2 assets, 1.5K\"", got)
+	}
+	if got := strings.Join(assetDirList(dir), ","); got != "./bin,./assets" {
+		t.Errorf("assetDirList = %q", got)
+	}
+	// singular reads properly, and a project without the directories lists none
+	if got := assetSummary(assets[:1]); !strings.HasPrefix(got, "1 asset,") {
+		t.Errorf("assetSummary(one) = %q", got)
+	}
+	if got := assetDirList(t.TempDir()); len(got) != 0 {
+		t.Errorf("assetDirList of a bare project = %v", got)
+	}
+}

build.sh

@@ -1,12 +1,22 @@
 #!/bin/sh
-# Build mgsh, auto-incrementing the patch version by 0.0.1 on every build.
+# Build mgsh for the usual platforms into ./bin, auto-incrementing the patch
+# version by 0.0.1 on every build.
 #
 # version.txt holds the currently built version. Each run increments the patch
-# component, then builds with that version injected via -ldflags, and writes it
+# component, then builds every platform with that one version injected via
-# back. So version.txt always reflects the version of the binary just built.
+# -ldflags, and writes it back. So version.txt always reflects the version of
+# the binaries just built, and all of them carry the same one.
+#
+# Override the platform list to build just one:
+#   PLATFORMS="linux/amd64" ./build.sh
+#
+# Windows is deliberately absent: mgsh shells out to stty and /bin/sh, so it
+# would compile there and then not work.
 set -e
 cd "$(dirname "$0")"
 
+PLATFORMS=${PLATFORMS:-"darwin/arm64 darwin/amd64 linux/amd64 linux/arm64"}
+
 V=$(cat version.txt 2>/dev/null || echo 4.0.0)
 
 # split MAJOR.MINOR.PATCH and increment PATCH (no carry: 4.0.9 -> 4.0.10)
@@ -17,7 +27,34 @@ PATCH=${REST#*.}
 PATCH=$((PATCH + 1))
 NV="$MAJOR.$MINOR.$PATCH"
 
-go build -ldflags "-X main.VERSION=$NV" -o mgsh .
+# earlier versions built ./mgsh in the repo root; drop it so nothing keeps
+# running a stale binary from a path that is no longer written
+if [ -f mgsh ]; then
+	rm -f mgsh
+	echo "removed stale ./mgsh (the build now writes ./bin)"
+fi
+
+mkdir -p bin
+HOST="$(go env GOOS)/$(go env GOARCH)"
+
+for p in $PLATFORMS; do
+	os=${p%/*}
+	arch=${p#*/}
+	out="bin/mgsh-$os-$arch"
+
+	# CGO_ENABLED=0 throughout: it makes the cross builds work without a
+	# toolchain per target and the binaries static, and os/user still resolves
+	# the current user without cgo on both darwin and linux.
+	CGO_ENABLED=0 GOOS="$os" GOARCH="$arch" \
+		go build -ldflags "-X main.VERSION=$NV" -o "$out" .
+
+	if [ "$p" = "$HOST" ]; then
+		ln -sf "mgsh-$os-$arch" bin/mgsh # the one for this machine
+		echo "  $out  ->  bin/mgsh"
+	else
+		echo "  $out"
+	fi
+done
 
 echo "$NV" > version.txt
 echo "built mgsh v$NV"

colors.go

@@ -7,21 +7,24 @@ import (
 	"unicode/utf8"
 )
 
-// Colors for the prompt, banner and output, using the Catppuccin Mocha palette
+// Colors for the prompt, banner and output, as 24-bit truecolor escapes: the
-// as 24-bit truecolor escapes
+// Catppuccin Mocha accents with a warm white and three greys of its own.
-// (https://terminalcolors.com/themes/catppuccin/mocha/).
 const (
 	cReset = "\033[0m"
 	cBold  = "\033[1m"
 	cDim   = "\033[2m"
 
-	cGreen  = "\033[38;2;166;227;161m" // Green    #a6e3a1
+	cYellow = "\033[38;2;249;226;175m" // #f9e2af
-	cYellow = "\033[38;2;249;226;175m" // Yellow   #f9e2af
+	cOrange = "\033[38;2;250;179;135m" // #fab387
-	cRed    = "\033[38;2;243;139;168m" // Red      #f38ba8
+	cRed    = "\033[38;2;243;139;168m" // #f38ba8
-	cCyan   = "\033[38;2;148;226;213m" // Teal     #94e2d5
+	cGreen  = "\033[38;2;148;226;213m" // #94e2d5
-	cPurple = "\033[38;2;203;166;247m" // Mauve    #cba6f7
+	cBlue   = "\033[38;2;180;190;254m" // #b4befe
-	cWhite  = "\033[38;2;205;214;244m" // Text     #cdd6f4
+	cPink   = "\033[38;2;245;178;247m" // #f5b2f7
-	cGray   = "\033[38;2;108;112;134m" // Overlay0 #6c7086
+	cViolet = "\033[38;2;203;166;247m" // #cba6f7
+	cWhite  = "\033[38;2;240;240;234m" // #f0f0ea
+	cGrey   = "\033[38;2;170;170;187m" // #aaaabb
+	cDark   = "\033[38;2;119;119;136m" // #777788
+	cDarker = "\033[38;2;68;68;85m"    // #444455
 )
 
 // col wraps s in color c, but only when color output is enabled.
@@ -66,7 +69,7 @@ func formatRepoList(entries []lsEntry, withSize bool) string {
 	for _, e := range entries {
 		fmt.Fprintf(&b, "  %s  %s", col(cGreen, padRight(e.name, width)), col(cYellow, e.date))
 		if withSize {
-			fmt.Fprintf(&b, "  %s", col(cGray, fmt.Sprintf("%7s", humanSize(e.size))))
+			fmt.Fprintf(&b, "  %s", col(cDark, fmt.Sprintf("%7s", humanSize(e.size))))
 		}
 		b.WriteByte('\n')
 	}

commands.go

@@ -20,7 +20,10 @@ var (
 	// literally named "git".
 	lsEntryRe = regexp.MustCompile(`^\S+\s+\d+\s+\S+\s+\S+\s+(\d+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(.*)$`)
 	gitDirRe  = regexp.MustCompile(`^(.*)\.git$`)
-	sanRe     = regexp.MustCompile(`[,;:\\/='"|?><-]+`)
+	// '!' is in here for the server's sake: csh expands history even inside
+	// single quotes, so a comment like "fix!now" would reach it as something
+	// else entirely (see remoteRejected).
+	sanRe = regexp.MustCompile(`[!,;:\\/='"|?><-]+`)
 	wsRe  = regexp.MustCompile(`\s+`)
 )
 
@@ -58,7 +61,13 @@ func parseDuSizes(lines []string) map[string]int64 {
 		if err != nil {
 			continue
 		}
-		out[strings.TrimPrefix(strings.TrimSpace(m[2]), "./")] = kb * 1024
+		// du echoes the path it was given, and find gives it an absolute one:
+		// key on the last element, which is what the listing calls the entry
+		name := strings.TrimSpace(m[2])
+		if i := strings.LastIndexByte(name, '/'); i >= 0 {
+			name = name[i+1:]
+		}
+		out[name] = kb * 1024
 	}
 	return out
 }
@@ -191,11 +200,20 @@ func runCommandDepth(line string, depth int) bool {
 	case "config": // show the effective configuration and where it came from
 		if opt["k"] {
 			fmt.Println(strings.Join(configKeys(), "\n"))
-			fmt.Println("remote.<name>.url|key|type|visibility")
+			fmt.Println("remote.<name>.url|key|type|visibility|active")
 			break
 		}
 		showConfig()
 
+	case "update": // replace this binary with the newest release (-c: only look)
+		run := selfUpdate.install
+		if opt["c"] {
+			run = selfUpdate.check
+		}
+		if err := run(os.Stdout); err != nil {
+			errorln("update: " + err.Error())
+		}
+
 	case "rescan": // reload the configuration and the cached server repo list
 		reloadConfig()
 		rescanServer()
@@ -242,14 +260,22 @@ func runCommandDepth(line string, depth int) bool {
 			one, many = "archive", "archives"
 		}
 		pat := strings.ToLower(word(words, 1))
-		remote := "/bin/ls -ltr " + shq(path)
+		remote := "/bin/ls -ltr " + shq(serverPath(path))
 		if !opt["a"] {
 			// archives are files and carry a real size; repositories are
 			// directories, whose listed size is the inode's, so ask du in the
 			// same round trip. Nothing shell-specific here on purpose: the
 			// login shell may be csh, where "2>/dev/null" is not a redirection
 			// but an argument followed by one.
-			remote += "; echo " + shq(listMarker) + "; du -sk *.git"
+			//
+			// The pattern goes to find, quoted, and never to the shell. A glob
+			// that matches nothing is a fatal error in a non-interactive zsh —
+			// "no matches found: *.git" — which aborts the command and turned an
+			// empty server into "could not list". sh would have handed the
+			// literal "*.git" to du instead, which is not much better.
+			remote += "; echo " + shq(listMarker) +
+				"; find " + shq(serverPath(path)) + " -maxdepth 1 -name " +
+				shq("*"+suffix) + " -exec du -sk {} +"
 		}
 		lines, err := sshOut(remote)
 		lsLines, duLines := splitAtMarker(lines, listMarker)
@@ -275,14 +301,20 @@ func runCommandDepth(line string, depth int) bool {
 		// complain when nothing usable came back at all.
 		if len(entries) == 0 {
 			if err != nil {
-				errorln("could not list " + many + " on the git server")
+				what := "could not list " + many + " on the git server"
+				if opt["a"] {
+					// by far the likeliest reason, and one the wording used to
+					// hide behind something that sounded like a dead connection
+					what += " — is there an 'archive' directory in " + cfg.GitPath + "?"
+				}
+				errorln(what)
 				break
 			}
 			what := "no " + many + " on the git server"
 			if pat != "" {
 				what = "no " + many + " matching '" + word(words, 1) + "'"
 			}
-			fmt.Println(col(cGray, what))
+			fmt.Println(col(cDark, what))
 			break
 		}
 		// no size column when the server gave no usable sizes, rather than a
@@ -296,7 +328,7 @@ func runCommandDepth(line string, depth int) bool {
 		if total > 0 {
 			summary += " · " + humanSize(total)
 		}
-		fmt.Println(col(cGray, summary))
+		fmt.Println(col(cDark, summary))
 
 	case "show": // show a repository's log directly on the server
 		prj := PRJ
@@ -316,8 +348,8 @@ func runCommandDepth(line string, depth int) bool {
 			errorln("repository not found")
 			break
 		}
-		logLines, _ := sshOut("cd " + shq(cfg.GitPath+"/"+prj+".git") +
+		logLines, _ := sshOut("git --git-dir=" + shq(serverPath(prj+".git")) +
-			" && git log --reverse --format='%h  %ct  %s'")
+			" log --reverse --format='%h  %ct  %s'")
 		repolog(logLines)
 
 	case "log":
@@ -383,14 +415,17 @@ func runCommandDepth(line string, depth int) bool {
 		if !gitOK(DIR, "push") {
 			break
 		}
-		sshOK("touch " + shq(cfg.GitPath+"/"+PRJ+".git"))
+		sshOK("touch " + shq(serverPath(PRJ+".git")))
-		if targets, _ := cfg.mirrorTargets(); truthy(cfg.Mirror) && len(targets) > 0 {
+		if targets, _ := cfg.mirrorTargets(); truthy(cfg.Mirror) && len(activeRemotes(targets)) > 0 {
-			handlePushRemote("") // auto-mirror to every configured server
+			handlePushRemote("") // auto-mirror to every active server
 		}
 
 	case "pushremote": // mirror the repo to a public git server via its API
 		handlePushRemote(strings.Join(fields[1:], " "))
 
+	case "deleteremote": // delete the repo on a public git server via its API
+		handleDeleteRemote(strings.Join(fields[1:], " "))
+
 	case "release": // tag a commit and publish it as a release on the mirrors
 		handleRelease(strings.Join(fields[1:], " "))
 
@@ -430,13 +465,17 @@ func runCommandDepth(line string, depth int) bool {
 		if comment != "" {
 			name = PRJ + "_" + z + "_" + comment
 		}
-		if !sshOK("cp -r " + shq(PRJ+".git") + " " + shq("archive/"+name+".git")) {
+		// the archive directory is mgsh's own convention, so make it rather than
+		// fail on a server where nobody has created it yet
+		if !sshOK("mkdir -p " + shq(serverPath("archive")) +
+			" && cp -r " + shq(serverPath(PRJ+".git")) + " " + shq(serverPath("archive/"+name+".git"))) {
 			break
 		}
-		if !sshOK("cd archive && tar cvzf " + shq(name+".git.tar.gz") + " " + shq(name+".git")) {
+		if !sshOK("tar cvzf " + shq(serverPath("archive/"+name+".git.tar.gz")) +
+			" -C " + shq(serverPath("archive")) + " " + shq(name+".git")) {
 			break
 		}
-		sshOK("rm -rf " + shq("archive/"+name+".git"))
+		sshOK("rm -rf " + shq(serverPath("archive/"+name+".git")))
 
 	case "init": // create a new repository from the current directory
 		if !requireProject() {
@@ -456,11 +495,13 @@ func runCommandDepth(line string, depth int) bool {
 		if exists && !yesno("overwrite existing repository "+PRJ+" on the server?", false) {
 			break
 		}
-		remote := shq(cfg.GitPath + "/" + PRJ + ".git")
+		remote := shq(serverPath(PRJ + ".git"))
 		if !sshOK("rm -rf " + remote) {
 			break
 		}
-		if !sshOK("mkdir " + remote + " && cd " + remote + " && git --bare init") {
+		// `git init --bare <path>` makes the directory itself: one command, and
+		// none of it depends on a `cd` having worked
+		if !sshOK("git init --bare " + remote) {
 			break
 		}
 		gi := DIR + "/.gitignore"
@@ -543,13 +584,14 @@ func runCommandDepth(line string, depth int) bool {
 				break
 			}
 		} else {
-			if !sshOK("cd archive && tar xvzf " + shq(prj+".git.tar.gz")) {
+			if !sshOK("tar xvzf " + shq(serverPath("archive/"+prj+".git.tar.gz")) +
+				" -C " + shq(serverPath("archive"))) {
 				break
 			}
 			if !gitOK(BASE, "clone", URL+"/archive/"+prj+".git") {
 				break
 			}
-			sshOK("rm -rf " + shq("archive/"+prj+".git"))
+			sshOK("rm -rf " + shq(serverPath("archive/"+prj+".git")))
 		}
 		if isDir(BASE + "/" + prj) {
 			PRJ = prj
@@ -560,7 +602,7 @@ func runCommandDepth(line string, depth int) bool {
 		if opt["a"] {
 			path = "./archive"
 		}
-		lines, err := sshOut("/bin/ls " + shq(path))
+		lines, err := sshOut("/bin/ls " + shq(serverPath(path)))
 		if err != nil {
 			errorln("could not list repositories on the git server")
 			break
@@ -610,7 +652,7 @@ func runCommandDepth(line string, depth int) bool {
 
 	default: // unknown command — no longer forwarded to the shell
 		fmt.Println(col(cRed, "unknown command: "+words[0]) +
-			col(cGray, "  (prefix with '!' to run a shell command)"))
+			col(cDark, "  (prefix with '!' to run a shell command)"))
 	}
 
 	return true
@@ -671,9 +713,9 @@ func formatLog(lines []string, now time.Time) string {
 			n++
 		}
 
-		fmt.Fprintf(&full, "%s  %s  %s\n", col(cPurple, hash), col(cYellow, z), subj)
+		fmt.Fprintf(&full, "%s  %s  %s\n", col(cViolet, hash), col(cYellow, z), subj)
-		fmt.Fprintf(&short, "%s  %s  %s\n", col(cPurple, hash), col(cYellow, zs), subj)
+		fmt.Fprintf(&short, "%s  %s  %s\n", col(cViolet, hash), col(cYellow, zs), subj)
-		fmt.Fprintf(&tiny, "%s  %s  %s\n", col(cPurple, hash), col(cYellow, zss), subj)
+		fmt.Fprintf(&tiny, "%s  %s  %s\n", col(cViolet, hash), col(cYellow, zss), subj)
 	}
 
 	switch {
@@ -773,6 +815,7 @@ var helpItems = []struct{ cmd, desc string }{
 	{"init", "make new repository from current directory"},
 	{"push [comment]", "push changes to git server"},
 	{"pushremote [@name] [desc]", "mirror repo to the public server(s) (gitea/github/gitlab)"},
+	{"deleteremote <@name|host>", "delete the repo on that public server (asks first)"},
 	{"release <tag> [notes]", "tag and publish a release on the public server(s)"},
 	{"pull", "pull changes from git server"},
 	{"fetch", "fetch changes from git server"},
@@ -798,6 +841,7 @@ var helpItems = []struct{ cmd, desc string }{
 	{"unalias <name>", "remove an alias"},
 	{"config [-k]", "show effective configuration (-k: list all setting names)"},
 	{"rescan", "reload config and refresh cached server repository list"},
+	{"update [-c]", "update mgsh to the newest release (-c: only look)"},
 	{"!<command>", "run <command> in the shell"},
 	{"quit", "exit mgsh"},
 }

completion.go

@@ -61,6 +61,7 @@ func builtinCompleter() *readline.PrefixCompleter {
 		readline.PcItem("list", readline.PcItem("-a")),
 		readline.PcItem("push"),
 		readline.PcItem("pushremote", readline.PcItemDynamic(dynRemoteNames)),
+		readline.PcItem("deleteremote", readline.PcItemDynamic(dynRemoteNames)),
 		readline.PcItem("release", readline.PcItemDynamic(dynRemoteNames)),
 		readline.PcItem("pull"),
 		readline.PcItem("fetch"),
@@ -84,6 +85,7 @@ func builtinCompleter() *readline.PrefixCompleter {
 		readline.PcItem("unalias", readline.PcItemDynamic(dynAliasNames)),
 		readline.PcItem("config", readline.PcItem("-k")),
 		readline.PcItem("rescan"),
+		readline.PcItem("update", readline.PcItem("-c")),
 		readline.PcItem("help"),
 		readline.PcItem("quit"),
 		readline.PcItem("exit"),
@@ -125,7 +127,7 @@ func fetchServerRepos() {
 	}
 	// a missing ./archive is a permanent, unremarkable state: still cache
 	var archives []string
-	if lines, err := sshOut("/bin/ls archive"); err == nil {
+	if lines, err := sshOut("/bin/ls " + shq(serverPath("archive"))); err == nil {
 		for _, ln := range lines {
 			t := strings.TrimSpace(ln)
 			if strings.HasSuffix(t, ".git.tar.gz") {

config.go

@@ -48,8 +48,18 @@ type RemoteTarget struct {
 	Key    string
 	Type   string // "gitea"|"github"|"gitlab" (auto-detected when empty)
 	Vis    string // "private" (default) | "public"
+	Active string // falsy -> taken along only when named (default: on)
 }
 
+// isActive reports whether the target takes part in a command that was given no
+// target of its own — `pushremote`, `release`, an auto-mirroring `push`. An
+// inactive one is not disabled, it is merely off the automatic path: naming it
+// (`pushremote @gitea`) uses it as it always did.
+//
+// Unset means active. The setting exists to take a server *out* of the default
+// set, so a configuration written before it existed must keep behaving.
+func (t RemoteTarget) isActive() bool { return !falsy(t.Active) }
+
 // legacyRemoteName is the target the pre-4.1 flat remoteurl/remotekey settings
 // are migrated to. It matches the git remote those versions created, so a
 // converted configuration keeps pushing to the same place.
@@ -188,9 +198,9 @@ func migrateRemoteKeys(path, data string) {
 		errorln("could not update " + path + ": " + err.Error())
 		return
 	}
-	fmt.Println(col(cGray, path+": mirror settings renamed to the remote.<name>.* form"))
+	fmt.Println(col(cDark, path+": mirror settings renamed to the remote.<name>.* form"))
 	for _, r := range renamed {
-		fmt.Println(col(cGray, "  "+r))
+		fmt.Println(col(cDark, "  "+r))
 	}
 }
 
@@ -441,7 +451,7 @@ func foldLegacyRemoteKeys(m map[string]string) map[string]string {
 }
 
 // remoteFieldRe matches a named mirror target setting: remote.<name>.<field>.
-var remoteFieldRe = regexp.MustCompile(`^remote\.([a-z0-9_.-]+)\.(url|key|type|visibility)$`)
+var remoteFieldRe = regexp.MustCompile(`^remote\.([a-z0-9_.-]+)\.(url|key|type|visibility|active)$`)
 
 // applyRemoteTargets merges `remote.<name>.<field>` settings into c.Remotes.
 // An already known target is updated field by field, so a project .mgshrc can
@@ -472,6 +482,8 @@ func applyRemoteTargets(c *Config, m map[string]string) {
 			t.Type = v
 		case "visibility":
 			t.Vis = v
+		case "active":
+			t.Active = v
 		}
 	}
 }
@@ -510,7 +522,7 @@ func applyEnv(c *Config) {
 }
 
 // remoteFields are the settings a mirror target is made of.
-var remoteFields = []string{"url", "key", "type", "visibility"}
+var remoteFields = []string{"url", "key", "type", "visibility", "active"}
 
 // applyRemoteEnv reads MGSH_REMOTE_<NAME>_<FIELD>, the environment spelling of
 // a remote.<name>.<field> setting — MGSH_REMOTE_GITLAB_KEY for
@@ -552,6 +564,8 @@ func applyRemoteEnv(c *Config) {
 			t.Type = value
 		case "visibility":
 			t.Vis = value
+		case "active":
+			t.Active = value
 		}
 	}
 }

deleteremote.go

@@ -0,0 +1,184 @@
+package main
+
+// deleteremote.go — the `deleteremote` command: remove the active project's
+// repository from a public mirror server via that server's REST API.
+//
+// This is the only mgsh command that destroys something on a server it does not
+// own, and nothing here can undo it. Four things keep it in check:
+//
+//   - the server has to be named. `pushremote` without one means "every
+//     configured target", which is convenient there and catastrophic here.
+//   - the repository is looked up first, so a typo comes back as "not on that
+//     server" instead of as a DELETE nobody meant to send.
+//   - every deletion is confirmed on its own, spelling out owner/repo and the
+//     server it lives on, and the default answer is no.
+//   - the local clone is never touched. Only the git remote `pushremote`
+//     created is dropped, and only while it still points at what was deleted.
+
+import (
+	"fmt"
+	"strings"
+)
+
+// deleteRepo removes owner/repo from the server.
+//
+// The providers disagree on what success looks like: Gitea and GitHub answer
+// 204, GitLab 202 — there the deletion is merely scheduled, and depending on
+// the plan the project stays visible until its retention period is over.
+func (r *remoteAPI) deleteRepo(owner, repo string) error {
+	code, data, err := r.do("DELETE", r.repoPath(owner, repo), nil)
+	if err != nil {
+		return err
+	}
+	switch code {
+	case 200, 202, 204:
+		return nil
+	case 403:
+		// the common failure by far: the token can push and create, but was
+		// never given the separate permission a deletion needs
+		return fmt.Errorf("not allowed to delete %s/%s — the token needs %s (HTTP 403): %s",
+			owner, repo, r.deletePermission(), firstLine(data))
+	default:
+		return fmt.Errorf("deleting repository failed (HTTP %d): %s", code, firstLine(data))
+	}
+}
+
+// deletePermission names what a provider wants from a token before it will
+// delete a repository, because a bare "403" sends people to the wrong setting.
+func (r *remoteAPI) deletePermission() string {
+	switch r.kind {
+	case kindGitHub:
+		return "the 'delete_repo' scope"
+	case kindGitLab:
+		return "the 'api' scope and the Owner role"
+	default: // Gitea
+		return "the 'write:repository' scope"
+	}
+}
+
+// parseRemoteSelectors splits `deleteremote <name|host> ...` into the targets
+// it names. The '@' that `pushremote` requires is accepted but optional here:
+// the command takes nothing but selectors, so there is no description a bare
+// word could be mistaken for.
+func parseRemoteSelectors(args string) []string {
+	var out []string
+	for _, f := range strings.Fields(args) {
+		if s := strings.TrimPrefix(f, "@"); s != "" {
+			out = append(out, s)
+		}
+	}
+	return out
+}
+
+// handleDeleteRemote implements `deleteremote <@name|host> ...`: it deletes the
+// active project's repository on each named mirror server.
+func handleDeleteRemote(args string) {
+	if !requireProject() {
+		return
+	}
+	targets, incomplete := cfg.mirrorTargets()
+	for _, n := range incomplete {
+		errorln("remote " + n + ": url or key missing — skipped")
+	}
+	if len(targets) == 0 {
+		errorln("deleteremote needs a 'remote.<name>.url' and 'remote.<name>.key' in " + configFile())
+		return
+	}
+
+	// no selector is never "all of them" — that is the whole point of the
+	// command taking one
+	sels := parseRemoteSelectors(args)
+	if len(sels) == 0 {
+		errorln("deleteremote needs the server to delete from: " + remoteChoices(targets))
+		return
+	}
+
+	targets = pickRemotes(targets, sels)
+	if len(targets) == 0 {
+		return // pickRemotes already named the selectors it did not recognise
+	}
+
+	repo := PRJ // like pushremote: the project names the repository
+	done := 0
+	for _, t := range targets {
+		if deleteOnRemote(t, repo) {
+			done++
+		}
+	}
+	if len(targets) > 1 {
+		fmt.Printf("%s %d/%d repositories deleted\n", col(cDark, "deleteremote:"), done, len(targets))
+	}
+}
+
+// remoteChoices lists the configured targets the way they may be selected, for
+// the message a `deleteremote` without a target earns.
+func remoteChoices(targets []RemoteTarget) string {
+	out := make([]string, 0, len(targets))
+	for _, t := range targets {
+		if h := remoteHost(t.URL); h != "" && !strings.EqualFold(h, t.Name) {
+			out = append(out, "@"+t.Name+" ("+h+")")
+			continue
+		}
+		out = append(out, "@"+t.Name)
+	}
+	return strings.Join(out, ", ")
+}
+
+// deleteOnRemote deletes repo on one target, after asking. It reports whether
+// something was actually deleted — a repository that is not there, and a
+// question answered with no, are not failures, and neither stops the remaining
+// targets.
+func deleteOnRemote(t RemoteTarget, repo string) bool {
+	api := newRemoteAPI(t.URL, t.Key, t.Type)
+
+	owner, err := api.authUser()
+	if err != nil {
+		errorln(t.Name + ": " + err.Error())
+		return false
+	}
+	fmt.Printf("%s %s %s (as %s)\n",
+		col(cDark, "remote"), col(cYellow, t.Name), col(cBlue, api.url), col(cGreen, owner))
+
+	exists, err := api.repoExists(owner, repo)
+	if err != nil {
+		errorln(t.Name + ": " + err.Error())
+		return false
+	}
+	if !exists {
+		fmt.Println(col(cDark, "no repository "+owner+"/"+repo+" there — nothing to delete"))
+		return false
+	}
+
+	fmt.Println(col(cOrange, "this deletes "+api.repoWebURL(owner, repo)+
+		" with its issues, releases and history, and cannot be undone"))
+	if !yesno("delete "+owner+"/"+repo+" on "+t.Name+"?", false) {
+		fmt.Println(col(cDark, "kept"))
+		return false
+	}
+
+	if err := api.deleteRepo(owner, repo); err != nil {
+		errorln(t.Name + ": " + err.Error())
+		return false
+	}
+	fmt.Println(col(cRed, "deleted ") + col(cWhite, owner+"/"+repo) + col(cDark, " on "+t.Name))
+
+	dropGitRemote(t.Name, api.repoWebURL(owner, repo))
+	return true
+}
+
+// dropGitRemote removes the local git remote named name, but only while it
+// still points at web — the repository just deleted. A remote the user has
+// since re-aimed somewhere else is theirs, not ours, and a `git push` failing
+// against a repository that no longer exists is worse than no remote at all.
+func dropGitRemote(name, web string) {
+	if !isDir(DIR + "/.git") {
+		return
+	}
+	url, err := gitCapture(DIR, "remote", "get-url", name)
+	if err != nil || strings.TrimSpace(url) != web {
+		return
+	}
+	if gitOK(DIR, "remote", "remove", name) {
+		fmt.Println(col(cDark, "removed git remote "+name))
+	}
+}

deleteremote_test.go

@@ -0,0 +1,266 @@
+package main
+
+// deleteremote_test.go — the command that deletes a repository on a server mgsh
+// does not own.
+//
+// Nothing it does can be undone from here, so the tests are less about the happy
+// path than about the ways it must refuse: no target named, an unknown target, a
+// question answered with no, a repository that is not there. Each of those has
+// to leave the server untouched, which is asserted on the requests the fake
+// provider received — the DELETE either went out or it did not.
+
+import (
+	"strings"
+	"testing"
+)
+
+// mirrorServer is a fake Gitea holding one repository owned by "mike".
+func mirrorServer(t *testing.T, project string) *fakeProvider {
+	t.Helper()
+	f := newFakeProvider(t)
+	f.route("GET /api/v1/user", 200, `{"login":"mike"}`)
+	f.route("GET /api/v1/repos/mike/"+project, 200, `{}`)
+	f.route("DELETE /api/v1/repos/mike/"+project, 204, "")
+	return f
+}
+
+// mirrorProject points the globals at a project with f as its single mirror
+// target, and answers every y/n question with answer. It returns the project
+// directory and the recorded questions.
+func mirrorProject(t *testing.T, f *fakeProvider, name string, answer bool) (string, *[]string) {
+	t.Helper()
+	dir := useProject(t, name)
+	cfg.Remotes = []RemoteTarget{{Name: "gitea", URL: f.URL, Key: "tok", Type: "gitea"}}
+	return dir, fakeAnswers(t, answer)
+}
+
+// deleted reports whether the DELETE for project actually went to the server.
+func deleted(f *fakeProvider, project string) bool {
+	return f.find("DELETE /api/v1/repos/mike/"+project) != nil
+}
+
+// TestDeleteRepoPerProvider pins the request each provider expects. GitLab
+// answers 202 — the deletion is only scheduled — which still counts as success.
+func TestDeleteRepoPerProvider(t *testing.T) {
+	for _, c := range []struct {
+		typ, path string
+		code      int
+	}{
+		{"gitea", "/api/v1/repos/mike/mgsh", 204},
+		{"github", "/api/v3/repos/mike/mgsh", 204},
+		{"gitlab", "/api/v4/projects/mike%2Fmgsh", 202},
+	} {
+		f := newFakeProvider(t)
+		f.route("DELETE "+c.path, c.code, "")
+
+		if err := newRemoteAPI(f.URL, "tok", c.typ).deleteRepo("mike", "mgsh"); err != nil {
+			t.Fatalf("%s: deleteRepo: %v (requests: %v)", c.typ, err, f.paths())
+		}
+		if f.find("DELETE "+c.path) == nil {
+			t.Errorf("%s: expected DELETE %s, got %v", c.typ, c.path, f.paths())
+		}
+	}
+}
+
+// TestDeleteRepoNamesTheMissingPermission: deleting needs more of a token than
+// pushing does, so a 403 here is the likeliest failure of all. Passing the bare
+// status on would send people to the wrong setting.
+func TestDeleteRepoNamesTheMissingPermission(t *testing.T) {
+	f := newFakeProvider(t)
+	f.route("DELETE /api/v3/repos/mike/mgsh", 403, `{"message":"Must have admin rights"}`)
+
+	err := newRemoteAPI(f.URL, "tok", "github").deleteRepo("mike", "mgsh")
+	if err == nil || !strings.Contains(err.Error(), "delete_repo") {
+		t.Errorf("403 error = %v, want it to name the delete_repo scope", err)
+	}
+}
+
+// TestDeleteRepoTreatsUnroutedAsFailure: anything the server did not accept must
+// surface as an error, or a repository that is still there looks deleted.
+func TestDeleteRepoReportsFailure(t *testing.T) {
+	f := newFakeProvider(t) // everything 404s
+	if err := newRemoteAPI(f.URL, "tok", "gitea").deleteRepo("mike", "mgsh"); err == nil {
+		t.Error("deleteRepo accepted a 404 as success")
+	}
+}
+
+// TestDeleteRemoteNeedsATarget is the one that matters most: `pushremote` with
+// no @name means "every configured server", and inheriting that here would wipe
+// the project off all of them at once.
+func TestDeleteRemoteNeedsATarget(t *testing.T) {
+	f := mirrorServer(t, "notes")
+	_, asked := mirrorProject(t, f, "notes", true) // even a standing "yes"
+
+	out := captureStdout(t, func() { runCommand("deleteremote") })
+
+	if len(f.got) != 0 {
+		t.Fatalf("deleteremote talked to the server without being told where: %v", f.paths())
+	}
+	if len(*asked) != 0 {
+		t.Errorf("asked %q although no target was named", *asked)
+	}
+	if !strings.Contains(out, "@gitea") {
+		t.Errorf("output does not say which targets exist: %q", out)
+	}
+}
+
+// TestDeleteRemoteRejectsUnknownTarget: a mistyped server name must not fall
+// back to some other target.
+func TestDeleteRemoteRejectsUnknownTarget(t *testing.T) {
+	f := mirrorServer(t, "notes")
+	_, asked := mirrorProject(t, f, "notes", true)
+
+	out := captureStdout(t, func() { runCommand("deleteremote @gitae") })
+
+	if len(f.got) != 0 {
+		t.Fatalf("an unknown target still reached a server: %v", f.paths())
+	}
+	if len(*asked) != 0 {
+		t.Errorf("asked %q for an unknown target", *asked)
+	}
+	if !strings.Contains(out, "gitae") {
+		t.Errorf("unknown target not reported: %q", out)
+	}
+}
+
+// TestDeleteRemoteKeepsRepoWhenDeclined: the question is the last guard, so a
+// "no" has to stop the DELETE, not just the message about it.
+func TestDeleteRemoteKeepsRepoWhenDeclined(t *testing.T) {
+	f := mirrorServer(t, "notes")
+	_, asked := mirrorProject(t, f, "notes", false)
+
+	captureStdout(t, func() { runCommand("deleteremote @gitea") })
+
+	if len(*asked) != 1 {
+		t.Fatalf("questions asked = %q, want exactly one", *asked)
+	}
+	if !strings.Contains((*asked)[0], "mike/notes") {
+		t.Errorf("question %q does not name the repository being deleted", (*asked)[0])
+	}
+	if deleted(f, "notes") {
+		t.Fatalf("deleted the repository after the user declined: %v", f.paths())
+	}
+}
+
+// TestDeleteRemoteWithoutRepositoryAsksNothing: a project that was never
+// mirrored (or a typo in the project name) is a no-op, not a question.
+func TestDeleteRemoteWithoutRepositoryAsksNothing(t *testing.T) {
+	f := newFakeProvider(t)
+	f.route("GET /api/v1/user", 200, `{"login":"mike"}`) // the repo lookup 404s
+	_, asked := mirrorProject(t, f, "notes", true)
+
+	out := captureStdout(t, func() { runCommand("deleteremote @gitea") })
+
+	if len(*asked) != 0 {
+		t.Errorf("asked %q about a repository that is not there", *asked)
+	}
+	if deleted(f, "notes") {
+		t.Error("sent a DELETE for a repository the server does not have")
+	}
+	if !strings.Contains(out, "nothing to delete") {
+		t.Errorf("output = %q, want it to say there is nothing to delete", out)
+	}
+}
+
+// TestDeleteRemoteByHostAndGitRemoteCleanup covers the whole accepted path: the
+// server picked by its host rather than its configured name, the DELETE sent,
+// and the now-dangling git remote dropped — while an unrelated remote stays.
+func TestDeleteRemoteByHostAndGitRemoteCleanup(t *testing.T) {
+	f := mirrorServer(t, "notes")
+	dir, asked := mirrorProject(t, f, "notes", true)
+
+	mustGit(t, dir, "init", "-q")
+	mustGit(t, dir, "remote", "add", "gitea", f.URL+"/mike/notes.git")
+	mustGit(t, dir, "remote", "add", "origin", "git@git.example:notes.git")
+
+	captureStdout(t, func() { runCommand("deleteremote " + remoteHost(f.URL)) })
+
+	if len(*asked) != 1 {
+		t.Fatalf("questions asked = %q, want exactly one", *asked)
+	}
+	if !deleted(f, "notes") {
+		t.Fatalf("no DELETE sent, requests: %v", f.paths())
+	}
+	remotes, err := gitCapture(dir, "remote")
+	if err != nil {
+		t.Fatal(err)
+	}
+	names := splitLines(strings.TrimSpace(remotes))
+	for _, n := range names {
+		if n == "gitea" {
+			t.Errorf("git remote gitea survived the deletion: %q", names)
+		}
+	}
+	if len(names) != 1 || names[0] != "origin" {
+		t.Errorf("git remotes = %q, want origin left alone", names)
+	}
+}
+
+// TestDeleteRemoteKeepsARepointedGitRemote: the local remote is only dropped
+// while it still points at what was deleted. One the user has since aimed
+// somewhere else is theirs.
+func TestDeleteRemoteKeepsARepointedGitRemote(t *testing.T) {
+	f := mirrorServer(t, "notes")
+	dir, _ := mirrorProject(t, f, "notes", true)
+
+	mustGit(t, dir, "init", "-q")
+	mustGit(t, dir, "remote", "add", "gitea", "https://elsewhere.example/mike/notes.git")
+
+	captureStdout(t, func() { runCommand("deleteremote @gitea") })
+
+	if !deleted(f, "notes") {
+		t.Fatalf("no DELETE sent, requests: %v", f.paths())
+	}
+	url, err := gitCapture(dir, "remote", "get-url", "gitea")
+	if err != nil {
+		t.Fatalf("git remote gitea was removed although it pointed elsewhere: %v", err)
+	}
+	if strings.TrimSpace(url) != "https://elsewhere.example/mike/notes.git" {
+		t.Errorf("git remote url = %q, want it untouched", strings.TrimSpace(url))
+	}
+}
+
+// TestRemoteMatches: a target answers to its configured name and to the host of
+// its url, in any case and with or without the '@'.
+func TestRemoteMatches(t *testing.T) {
+	tgt := RemoteTarget{Name: "gitea", URL: "https://git.example.com:3000/root"}
+	for _, c := range []struct {
+		sel  string
+		want bool
+	}{
+		{"gitea", true},
+		{"GITEA", true},
+		{"@gitea", true},
+		{"git.example.com", true},
+		{"https://git.example.com/mike/x", true},
+		{"git@git.example.com:mike/x.git", true},
+		{"example.com", false}, // a suffix is not the host
+		{"other", false},
+		{"@", false},
+		{"", false},
+	} {
+		if got := remoteMatches(tgt, c.sel); got != c.want {
+			t.Errorf("remoteMatches(%q) = %v, want %v", c.sel, got, c.want)
+		}
+	}
+}
+
+// TestParseRemoteSelectors: everything on the line selects a server, '@' or not
+// — the command takes nothing else that a bare word could be confused with.
+func TestParseRemoteSelectors(t *testing.T) {
+	for _, c := range []struct {
+		in   string
+		want []string
+	}{
+		{"", nil},
+		{"@gitea", []string{"gitea"}},
+		{"git.example.com", []string{"git.example.com"}},
+		{"@gitea git.example.com", []string{"gitea", "git.example.com"}},
+		{"@", nil},
+	} {
+		got := parseRemoteSelectors(c.in)
+		if strings.Join(got, ",") != strings.Join(c.want, ",") {
+			t.Errorf("parseRemoteSelectors(%q) = %v, want %v", c.in, got, c.want)
+		}
+	}
+}

git.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"errors"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -127,8 +128,30 @@ var sshExec = func(remote string, capture bool) ([]byte, error) {
 	return out, err
 }
 
+// errRemoteBang is what a command carrying a '!' comes back with, so a caller
+// sees a failure rather than a command that quietly did something else.
+var errRemoteBang = errors.New("remote command contains '!'")
+
+// remoteRejected reports whether a command must not be sent at all, and says
+// why. '!' is the one character shq cannot protect: csh expands history *before*
+// it looks at quotes, and it does so non-interactively too — `echo 'fix!now'`
+// answers "Event not found" on the tcsh server. No spelling survives both csh
+// and sh, so the only safe move is not to send one. This is the place every
+// remote command passes.
+func remoteRejected(remote string) bool {
+	if !strings.ContainsRune(remote, '!') {
+		return false
+	}
+	errorln("not sending a command with '!' in it — the server's login shell " +
+		"would expand it instead of passing it on: " + remote)
+	return true
+}
+
 // ssh runs a single remote command over ssh with inherited stdio.
 func ssh(remote string) error {
+	if remoteRejected(remote) {
+		return errRemoteBang
+	}
 	_, err := sshExec(remote, false)
 	return err
 }
@@ -144,6 +167,9 @@ func sshOK(remote string) bool {
 
 // sshOut runs a remote command and returns its stdout split into lines.
 func sshOut(remote string) ([]string, error) {
+	if remoteRejected(remote) {
+		return nil, errRemoteBang
+	}
 	out, err := sshExec(remote, true)
 	lines := strings.Split(string(out), "\n")
 	for len(lines) > 0 && lines[len(lines)-1] == "" {
@@ -152,10 +178,27 @@ func sshOut(remote string) ([]string, error) {
 	return lines, err
 }
 
+// serverPath anchors a path on the git server at the configured gitpath.
+//
+// Every remote command has to name its target outright, because the login
+// directory of the git user is not necessarily the directory holding the bare
+// repositories. With `gituser = git` and `gitpath = /home/git` the two are the
+// same place and a bare "." worked by luck; with `gituser = root` and
+// `gitpath = /root/mgsh` it lists the home directory, where there is nothing to
+// find.
+func serverPath(rel string) string {
+	base := strings.TrimRight(cfg.GitPath, "/")
+	rel = strings.TrimPrefix(strings.TrimSpace(rel), "./")
+	if rel == "" || rel == "." {
+		return base
+	}
+	return base + "/" + rel
+}
+
 // serverRepoNames lists the bare repositories on the git server, without the
 // ".git" suffix.
 func serverRepoNames() ([]string, error) {
-	lines, err := sshOut("/bin/ls .")
+	lines, err := sshOut("/bin/ls " + shq(serverPath(".")))
 	if err != nil {
 		return nil, err
 	}
@@ -169,10 +212,11 @@ func serverRepoNames() ([]string, error) {
 }
 
 // serverEntryExists reports whether entry is present in the remote directory
-// path (relative to the git user's home). The error is returned rather than
+// path (relative to gitpath, which serverPath resolves). The error is returned
-// folded into the bool so a failed lookup is never mistaken for "not there".
+// rather than folded into the bool so a failed lookup is never mistaken for
+// "not there".
 func serverEntryExists(path, entry string) (bool, error) {
-	lines, err := sshOut("/bin/ls " + shq(path))
+	lines, err := sshOut("/bin/ls " + shq(serverPath(path)))
 	if err != nil {
 		return false, err
 	}

input.go

@@ -1,5 +1,11 @@
 package main
 
+// input.go — the y/n prompts that guard the destructive commands.
+//
+// These questions are the only thing standing between `init` and a wiped
+// server repository, so the terminal handling here has to be exactly right: a
+// question that cannot be answered is worse than no question at all.
+
 import (
 	"fmt"
 	"os"
@@ -13,50 +19,86 @@ import (
 // variable because it guards the destructive operations: tests replace it to
 // drive those paths without a terminal, and to assert that the question was
 // asked at all.
+//
+// When the keypress cannot be read at all the answer is no, whatever the
+// default says — a question nobody saw must never be taken as consent.
 var yesno = func(prompt string, def bool) bool {
 	suffix := " y/N ? "
 	if def {
 		suffix = " Y/n ? "
 	}
-	ans := strings.ToLower(strings.TrimSpace(getkey(prompt + suffix)))
+	key, ok := getkey(prompt + suffix)
+	if !ok {
+		errorln("could not read an answer from the terminal — assuming no")
+		return false
+	}
+	ans := strings.ToLower(strings.TrimSpace(key))
 	if ans == "" {
 		return def
 	}
 	return ans == "y"
 }
 
-// getkey reads a single keypress from the terminal without echo. It reads a
+// keyModeArgs put the terminal into single-key input: one keypress is delivered
-// single byte directly from stdin; readline is not reading at this point (we
+// as it is typed, and it is not echoed.
-// are inside command execution), so there is no reader to desync with.
+//
+// MIN and TIME are set explicitly, and that is not decoration. They are not
+// part of the canonical/non-canonical switch — they live in their own slots of
+// the control-character array and survive `stty icanon`. drainTTY leaves them
+// at "min 0 time 0" ("return what is buffered, do not wait"), so without this
+// the *second* question of a session read zero bytes, answered itself with its
+// default, and left the keypress queued for the next prompt line.
+var keyModeArgs = []string{"-icanon", "-echo", "min", "1", "time", "0"}
+
+// getkey reads a single keypress from the terminal without echo, and reports
+// whether it got one. It reads a single byte directly from stdin; readline only
+// reads while it is inside Readline(), and we are inside command execution
+// here, so there is no reader to desync with.
 //
 // Anything else already typed on the same line is discarded: answering "yes"
 // to a y/n prompt must not leave "es\n" queued for the next readline call,
 // where it would come back as a bogus command.
-func getkey(prompt string) string {
+func getkey(prompt string) (string, bool) {
 	fmt.Print(prompt)
-	tty := readline.IsTerminal(int(os.Stdin.Fd()))
+
-	if tty {
+	restore := func() {}
-		stty("-icanon", "-echo")
+	if stdinIsTTY() {
+		restore = singleKeyMode()
 	}
 	var buf [1]byte
 	n, err := os.Stdin.Read(buf[:])
-	if tty {
+	restore()
-		drainTTY()
+
-		stty("icanon", "echo")
+	if err != nil || n == 0 {
-	}
+		fmt.Println()
-	key := ""
+		return "", false
-	if err == nil && n > 0 {
-		key = strings.Trim(string(buf[:n]), "\r\n\t")
 	}
+	key := strings.Trim(string(buf[:n]), "\r\n\t")
 	fmt.Println(key)
-	return key
+	return key, true
+}
+
+// singleKeyMode switches the terminal to single-key input and returns the
+// function that puts it back. The previous settings are restored verbatim from
+// `stty -g` rather than by naming the flags we changed: naming them is how the
+// MIN/TIME above were left behind in the first place, and mgsh should hand the
+// terminal back exactly as it found it.
+func singleKeyMode() func() {
+	saved, err := sttyRun("-g")
+	saved = strings.TrimSpace(saved)
+	sttyRun(keyModeArgs...)
+
+	if err != nil || saved == "" {
+		return func() { drainTTY(); sttyRun("icanon", "echo") } // best effort
+	}
+	return func() { drainTTY(); sttyRun(strings.Fields(saved)...) }
 }
 
 // drainTTY discards input already queued on the terminal. `min 0 time 0` makes
 // a read return whatever is buffered without waiting, so this cannot block when
-// nothing is pending.
+// nothing is pending. Its caller restores the terminal afterwards.
 func drainTTY() {
-	stty("-icanon", "-echo", "min", "0", "time", "0")
+	sttyRun("-icanon", "-echo", "min", "0", "time", "0")
 	buf := make([]byte, 256)
 	for {
 		n, err := os.Stdin.Read(buf)
@@ -66,10 +108,16 @@ func drainTTY() {
 	}
 }
 
-func stty(args ...string) {
+// stdinIsTTY reports whether keypresses come from a terminal. A variable so the
+// tests can exercise the terminal path without one.
+var stdinIsTTY = func() bool { return readline.IsTerminal(int(os.Stdin.Fd())) }
+
+// sttyRun runs stty on the terminal and returns its output. Errors are silent:
+// every caller has a fallback, and a stray "stty: ..." line in the middle of a
+// half-printed question helps nobody.
+var sttyRun = func(args ...string) (string, error) {
 	c := exec.Command("stty", args...)
 	c.Stdin = os.Stdin
-	c.Stdout = os.Stdout
+	out, err := c.Output()
-	c.Stderr = os.Stderr
+	return string(out), err
-	c.Run()
 }

input_test.go

@@ -0,0 +1,226 @@
+package main
+
+// input_test.go — the y/n prompt is the last thing between `init` and a wiped
+// server repository, so the terminal handling around it is pinned here.
+
+import (
+	"os"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+// fakeTTY stands in for the terminal driver. It models the one detail that made
+// the skipped-question bug possible: MIN and TIME are not part of the
+// canonical/non-canonical switch, so they survive `stty icanon` and carry over
+// into the next prompt.
+type fakeTTY struct {
+	mu    sync.Mutex
+	state map[string]string
+	calls [][]string
+	ready chan struct{} // signalled once single-key mode is in effect
+}
+
+func newFakeTTY() *fakeTTY {
+	return &fakeTTY{
+		state: map[string]string{"icanon": "on", "echo": "on", "min": "1", "time": "0"},
+		ready: make(chan struct{}, 4),
+	}
+}
+
+func (f *fakeTTY) run(args ...string) (string, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.calls = append(f.calls, args)
+
+	switch {
+	case len(args) == 1 && args[0] == "-g":
+		return f.serializeLocked(), nil
+	case len(args) == 1 && strings.HasPrefix(args[0], "saved:"):
+		for _, kv := range strings.Split(strings.TrimPrefix(args[0], "saved:"), ",") {
+			if k, v, ok := strings.Cut(kv, "="); ok {
+				f.state[k] = v
+			}
+		}
+		return "", nil
+	}
+	for i := 0; i < len(args); i++ {
+		switch a := args[i]; a {
+		case "min", "time":
+			if i+1 < len(args) {
+				f.state[a] = args[i+1]
+				i++
+			}
+		default:
+			f.state[strings.TrimPrefix(a, "-")] = boolWord(!strings.HasPrefix(a, "-"))
+		}
+	}
+	if strings.Join(args, " ") == strings.Join(keyModeArgs, " ") {
+		f.ready <- struct{}{} // single-key mode is set; the read comes next
+	}
+	return "", nil
+}
+
+func boolWord(on bool) string {
+	if on {
+		return "on"
+	}
+	return "off"
+}
+
+// serializeLocked renders the settings as one token, the way `stty -g` does.
+func (f *fakeTTY) serializeLocked() string {
+	return "saved:icanon=" + f.state["icanon"] + ",echo=" + f.state["echo"] +
+		",min=" + f.state["min"] + ",time=" + f.state["time"]
+}
+
+func (f *fakeTTY) get(k string) string {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.state[k]
+}
+
+func (f *fakeTTY) snapshot() string {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.serializeLocked()
+}
+
+// installFakeTTY points getkey at the fake terminal for the duration of a test.
+func installFakeTTY(t *testing.T) *fakeTTY {
+	t.Helper()
+	f := newFakeTTY()
+	oldRun, oldIsTTY, oldStdin := sttyRun, stdinIsTTY, os.Stdin
+	sttyRun = f.run
+	stdinIsTTY = func() bool { return true }
+	t.Cleanup(func() {
+		sttyRun, stdinIsTTY, os.Stdin = oldRun, oldIsTTY, oldStdin
+	})
+	return f
+}
+
+// askOnce runs one getkey against the fake terminal, answering with keys once
+// the terminal is actually in single-key mode. It reports the MIN in effect at
+// the moment of the read — the value the old code got wrong.
+func askOnce(t *testing.T, f *fakeTTY, keys string) (key string, ok bool, minAtRead string) {
+	t.Helper()
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+	os.Stdin = r
+
+	done := make(chan struct{})
+	go func() {
+		key, ok = getkey("question? ")
+		close(done)
+	}()
+
+	select {
+	case <-f.ready:
+	case <-time.After(5 * time.Second):
+		t.Fatal("the terminal was never put into single-key mode")
+	}
+	minAtRead = f.get("min")
+	w.WriteString(keys)
+	w.Close() // so the drain that follows the keypress sees EOF instead of blocking
+	<-done
+	r.Close()
+	return key, ok, minAtRead
+}
+
+// TestEveryQuestionWaitsForAnAnswer is the regression test for the bug where the
+// second y/n question of a session was skipped: drainTTY left the terminal at
+// "min 0" ("return what is buffered, do not wait"), the restore only named
+// icanon and echo, and so the next read returned zero bytes and answered the
+// question with its default.
+func TestEveryQuestionWaitsForAnAnswer(t *testing.T) {
+	f := installFakeTTY(t)
+
+	for i, want := range []string{"y", "n", "y"} {
+		key, ok, minAtRead := askOnce(t, f, want)
+		if !ok || key != want {
+			t.Fatalf("question %d: got (%q, %v), want (%q, true)", i+1, key, ok, want)
+		}
+		if minAtRead != "1" {
+			t.Errorf("question %d read the terminal at min=%s, want min=1 — "+
+				"min 0 returns without waiting and answers the question by itself",
+				i+1, minAtRead)
+		}
+	}
+}
+
+// TestPromptHandsTheTerminalBackUnchanged: mgsh must not leave the terminal in
+// a mode it chose. The old restore named only icanon and echo and left "min 0"
+// behind, which outlived mgsh itself and broke the next program's single-key
+// reads too.
+func TestPromptHandsTheTerminalBackUnchanged(t *testing.T) {
+	f := installFakeTTY(t)
+	initial := f.snapshot()
+
+	if _, ok, _ := askOnce(t, f, "y"); !ok {
+		t.Fatal("getkey did not read the key")
+	}
+	if got := f.snapshot(); got != initial {
+		t.Errorf("terminal left as %s, want it back at %s", got, initial)
+	}
+}
+
+// TestPromptRestoresFromTheSavedState pins *how* the terminal is restored: from
+// the state captured with `stty -g`, not by naming the flags we changed.
+func TestPromptRestoresFromTheSavedState(t *testing.T) {
+	f := installFakeTTY(t)
+	if _, ok, _ := askOnce(t, f, "y"); !ok {
+		t.Fatal("getkey did not read the key")
+	}
+
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if len(f.calls) == 0 {
+		t.Fatal("stty was never called")
+	}
+	if first := f.calls[0]; len(first) != 1 || first[0] != "-g" {
+		t.Errorf("first stty call was %v, want [-g]: the state has to be captured "+
+			"before it is changed", first)
+	}
+	last := f.calls[len(f.calls)-1]
+	if len(last) != 1 || !strings.HasPrefix(last[0], "saved:") {
+		t.Errorf("last stty call was %v, want the saved state played back", last)
+	}
+}
+
+// TestSingleKeyModeSetsMinExplicitly: MIN and TIME are inherited, so they have
+// to be named on the way in. Without that, a terminal left at "min 0" by an
+// earlier program (or an earlier mgsh) skips the question.
+func TestSingleKeyModeSetsMinExplicitly(t *testing.T) {
+	args := strings.Join(keyModeArgs, " ")
+	for _, want := range []string{"-icanon", "-echo", "min 1", "time 0"} {
+		if !strings.Contains(args, want) {
+			t.Errorf("single-key mode is %q, missing %q", args, want)
+		}
+	}
+}
+
+// TestQuestionSkippedByAPoisonedTerminalIsNotAYes: even if the terminal is
+// already in the broken state when mgsh starts, the answer must not be the
+// default — nobody saw the question, so nobody agreed to anything.
+func TestQuestionSkippedByAPoisonedTerminalIsNotAYes(t *testing.T) {
+	oldRun, oldIsTTY, oldStdin := sttyRun, stdinIsTTY, os.Stdin
+	defer func() { sttyRun, stdinIsTTY, os.Stdin = oldRun, oldIsTTY, oldStdin }()
+
+	sttyRun = func(args ...string) (string, error) { return "", nil }
+	stdinIsTTY = func() bool { return true }
+
+	r, w, _ := os.Pipe()
+	w.Close() // a terminal that returns nothing at all
+	os.Stdin = r
+	defer r.Close()
+
+	if key, ok := getkey("question? "); ok {
+		t.Fatalf("getkey reported a key %q from a terminal that gave none", key)
+	}
+	if yesno("destroy everything?", true) {
+		t.Error("an unanswerable question was taken as yes")
+	}
+}

main.go

@@ -45,6 +45,13 @@ var (
 )
 
 func main() {
+	// Answered before setup(), which exits when nothing is configured yet: an
+	// update has to work on a machine that has never run mgsh, and `--version`
+	// is what the freshly downloaded binary is probed with, right there.
+	if updateFlags() {
+		return
+	}
+
 	setup()
 	useColor = readline.IsTerminal(int(os.Stdout.Fd()))
 
@@ -68,12 +75,52 @@ func main() {
 		}
 		updateDirState()
 		runCommand(cmdline)
+		updateNote() // after the output: a footer, not a headline
 		return
 	}
 
+	updateNote() // before the prompt: a session starts here, not when it ends
 	runInteractive()
 }
 
+// updateFlags answers the self-update options and reports whether it did. They
+// are deliberately spelled with dashes and kept out of parseArgs: `mgsh update`
+// is the command for everyday use, and these are what works when there is no
+// configuration to read yet.
+func updateFlags() bool {
+	if len(os.Args) < 2 {
+		return false
+	}
+	switch os.Args[1] {
+	case "--version":
+		fmt.Printf("mgsh %s\n", VERSION)
+	case "--update":
+		if err := selfUpdate.install(os.Stdout); err != nil {
+			fmt.Fprintf(os.Stderr, "mgsh: %v\n", err)
+			os.Exit(1)
+		}
+	case "--check-update":
+		if err := selfUpdate.check(os.Stdout); err != nil {
+			fmt.Fprintf(os.Stderr, "mgsh: %v\n", err)
+			os.Exit(1)
+		}
+	case updateRefreshFlag: // the background run, not in the help
+		selfUpdate.refresh()
+	default:
+		return false
+	}
+	return true
+}
+
+// updateNote prints the once-a-day hint, when there is one. It costs nothing:
+// the line comes from the note in the cache directory, and the asking behind it
+// happens in the background, at most once a day.
+func updateNote() {
+	if hint := selfUpdate.daily(); hint != "" {
+		fmt.Fprintln(os.Stderr, col(cDark, hint))
+	}
+}
+
 // runInteractive drives the colored, history- and completion-enabled REPL.
 func runInteractive() {
 	home, _ := os.UserHomeDir()
@@ -145,9 +192,10 @@ func parseArgs() (int, string, bool) {
 	}
 	cls := map[string]int{
 		"clone": 2, "init": 2, "log": 2,
-		"push": 1, "pushremote": 1, "list": 1, "tag": 1, "archive": 1, "show": 1,
+		"push": 1, "pushremote": 1, "deleteremote": 1, "list": 1, "tag": 1, "archive": 1, "show": 1,
 		"pull": 1, "fetch": 1, "status": 1, "diff": 1, "overview": 1,
 		"config": 1, "count": 1, "login": 1, "cloneall": 1, "release": 1,
+		"update": 1,
 	}
 	if c, ok := cls[a0]; ok {
 		return c, strings.Join(os.Args[1:], " "), false

mgsh_test.go

@@ -109,7 +109,7 @@ func TestFormatRepoList(t *testing.T) {
 	colored := formatRepoList(entries, false)
 	useColor = false
 	strip := func(s string) string {
-		for _, c := range []string{cReset, cGreen, cYellow, cGray} {
+		for _, c := range []string{cReset, cGreen, cYellow, cDark} {
 			s = strings.ReplaceAll(s, c, "")
 		}
 		return s
@@ -499,6 +499,77 @@ remotes          = hub, public
 	}
 }
 
+// TestInactiveRemoteIsOnlyUsedWhenNamed: `active = false` takes a target off the
+// automatic path — not used when no name is given — while naming it, by name or
+// by host, still reaches it. It is not the same as removing the target, and not
+// the same as an unusable one: it stays in the configuration, listed and ready.
+func TestInactiveRemoteIsOnlyUsedWhenNamed(t *testing.T) {
+	rc := `
+remote.gitea.url    = https://git.example.com
+remote.gitea.key    = tok
+remote.gitea.active = false
+remote.hub.url      = https://github.com
+remote.hub.key      = tok2
+`
+	var c Config
+	applyConfig(&c, parseConfig(rc))
+
+	all, incomplete := c.mirrorTargets()
+	if len(all) != 2 || len(incomplete) != 0 {
+		t.Fatalf("mirrorTargets = %+v (incomplete %v), want both targets", all, incomplete)
+	}
+	if got := pickRemotes(all, nil); len(got) != 1 || got[0].Name != "hub" {
+		t.Errorf("selection without a name = %+v, want only the active hub", got)
+	}
+	for _, sel := range []string{"gitea", "@gitea", "git.example.com"} {
+		if got := pickRemotes(all, []string{sel}); len(got) != 1 || got[0].Name != "gitea" {
+			t.Errorf("pickRemotes(%q) = %+v, want the inactive gitea", sel, got)
+		}
+	}
+
+	// MGSH_REMOTE_<NAME>_ACTIVE is the environment spelling
+	t.Setenv("MGSH_REMOTE_HUB_ACTIVE", "false")
+	var c2 Config
+	applyConfig(&c2, parseConfig(rc))
+	applyEnv(&c2)
+	all2, _ := c2.mirrorTargets()
+	if got := pickRemotes(all2, nil); len(got) != 0 {
+		t.Errorf("MGSH_REMOTE_HUB_ACTIVE=false left %+v in the default set", got)
+	}
+}
+
+// TestRemoteActiveDefaultsToOn: the setting exists to take a server *out* of the
+// default set, so anything but a deliberate "off" — unset, "true", a typo — has
+// to leave it in. A configuration written before the flag existed must not
+// suddenly stop mirroring.
+func TestRemoteActiveDefaultsToOn(t *testing.T) {
+	for _, v := range []string{"", "true", "yes", "1", "on", "sometimes"} {
+		if !(RemoteTarget{Active: v}).isActive() {
+			t.Errorf("active = %q switched the target off", v)
+		}
+	}
+	for _, v := range []string{"false", "no", "0", "off", " FALSE "} {
+		if (RemoteTarget{Active: v}).isActive() {
+			t.Errorf("active = %q did not switch the target off", v)
+		}
+	}
+}
+
+// TestPushRemoteWithOnlyInactiveTargets: the message has to name the reason.
+// "needs a remote.<name>.url" would send the user looking for a setting that is
+// sitting right there in the file.
+func TestPushRemoteWithOnlyInactiveTargets(t *testing.T) {
+	dir := useProject(t, "notes")
+	mustGit(t, dir, "init", "-q")
+	cfg.Remotes = []RemoteTarget{{Name: "gitea", URL: "https://git.example.com", Key: "tok", Active: "false"}}
+
+	out := captureStdout(t, func() { runCommand("pushremote") })
+
+	if !strings.Contains(out, "inactive") || !strings.Contains(out, "@gitea") {
+		t.Errorf("output = %q, want it to report the inactive target and how to name it", out)
+	}
+}
+
 func TestParsePushRemoteArgs(t *testing.T) {
 	cases := []struct {
 		in    string

mgshrc.example

@@ -26,8 +26,13 @@ gitpath     = /home/git
 # and visibility. <name> is yours to pick and becomes the git remote created in
 # the repository, so `git push gitlab` keeps working outside mgsh.
 #
-# `pushremote` pushes to every configured server in the order given,
+# `pushremote` pushes to every active server in the order given,
-# `pushremote @gitlab` to a single one.
+# `pushremote @gitlab` to a single one (active or not).
+#
+# `deleteremote @gitlab` (or `deleteremote gitlab.example.com`) deletes the
+# project's repository there again, after asking. It always needs the server
+# named, and the token needs permission to delete: delete_repo on GitHub,
+# write:repository on Gitea, api + Owner on GitLab.
 #
 # remote.gitea.url         = https://git.example.com
 # remote.gitea.key         = <personal-access-token>
@@ -38,6 +43,8 @@ gitpath     = /home/git
 # remote.gitlab.key        = <personal-access-token>
 # remote.gitlab.type       = gitlab
 # remote.gitlab.visibility = public
+# remote.gitlab.active     = false     # default true; false = only used when
+#                                      # named, e.g. `pushremote @gitlab`
 #
 # remotes          = gitea, gitlab   # optional: restrict and order the set
 # mirror           = true            # `push` also mirrors via pushremote

overview.go

@@ -82,7 +82,7 @@ func overviewAll() {
 	})
 
 	if len(rows) == 0 {
-		fmt.Println(col(cGray, "nothing under "+BASE))
+		fmt.Println(col(cDark, "nothing under "+BASE))
 		return
 	}
 
@@ -109,9 +109,9 @@ func overviewAll() {
 	if initN > 0 {
 		summary += fmt.Sprintf(" · %d to init", initN)
 	}
-	fmt.Println(col(cGray, summary))
+	fmt.Println(col(cDark, summary))
 	if srv.err != nil {
-		fmt.Println(col(cGray, "  git server not reachable — local view only"))
+		fmt.Println(col(cDark, "  git server not reachable — local view only"))
 	}
 }
 
@@ -301,7 +301,7 @@ func syncColor(s projStatus) string {
 	case s.ahead > 0:
 		return cGreen
 	default:
-		return cGray
+		return cDark
 	}
 }
 
@@ -339,8 +339,8 @@ func formatProjStatus(s projStatus, w overviewWidths) string {
 		if !s.lastWhen.IsZero() {
 			age = shortAge(time.Since(s.lastWhen))
 		}
-		b.WriteString("  " + col(cGray, padRight(s.lastHost, w.host)))
+		b.WriteString("  " + col(cDark, padRight(s.lastHost, w.host)))
-		b.WriteString(" " + col(cGray, fmt.Sprintf("%4s", age)))
+		b.WriteString(" " + col(cDark, fmt.Sprintf("%4s", age)))
 	}
 	if w.hint {
 		hint := ""
@@ -350,7 +350,7 @@ func formatProjStatus(s projStatus, w overviewWidths) string {
 		b.WriteString("  " + col(cYellow, padRight(hint, hintWidth)))
 	}
 	if len(s.mirrors) > 0 {
-		b.WriteString(col(cGray, "  → "+strings.Join(s.mirrors, " ")))
+		b.WriteString(col(cDark, "  → "+strings.Join(s.mirrors, " ")))
 	}
 	return strings.TrimRight(b.String(), " ")
 }

prompt.go

@@ -45,21 +45,21 @@ func plainPrompt() string {
 
 func coloredPrompt() string {
 	var b strings.Builder
-	b.WriteString(cBold + cPurple + "< " + cReset)
+	b.WriteString(cBold + cViolet + "< " + cReset)
-	b.WriteString(cCyan + filepath.Base(BASE) + cReset)
+	b.WriteString(cBlue + filepath.Base(BASE) + cReset)
 	if PRJ != "" && isDir(BASE+"/"+PRJ) {
 		b.WriteString(cBold + cWhite + "/" + cReset + cBold + cGreen + PRJ + cReset)
 		if BPLSTATE != "" {
 			b.WriteString(cRed + BPLSTATE + cReset)
 		}
 		if BRANCH != "" {
-			b.WriteString(cGray + " (" + cReset + cCyan + BRANCH + cReset)
+			b.WriteString(cDark + " (" + cReset + cBlue + BRANCH + cReset)
 			if DIRTY {
 				b.WriteString(cRed + "*" + cReset)
 			}
-			b.WriteString(cGray + ")" + cReset)
+			b.WriteString(cDark + ")" + cReset)
 		}
 	}
-	b.WriteString(" " + cBold + cPurple + ">" + cReset + " ")
+	b.WriteString(" " + cBold + cViolet + ">" + cReset + " ")
 	return b.String()
 }

release.go

@@ -56,46 +56,68 @@ func (r *remoteAPI) releaseByTagPath(owner, repo, tag string) string {
 	return r.releasePath(owner, repo) + "/tags/" + url.PathEscape(tag)
 }
 
-// findRelease returns the provider's id for the release of tag and whether it
+// releaseRef identifies a release for the calls that follow creating it.
-// exists at all. GitLab addresses releases by tag, so there the tag is the id.
+type releaseRef struct {
-func (r *remoteAPI) findRelease(owner, repo, tag string) (id string, found bool, err error) {
+	tag string
-	code, data, err := r.do("GET", r.releaseByTagPath(owner, repo, tag), nil)
+	id  string // provider id; the tag itself on GitLab
-	if err != nil {
+	// GitHub uploads assets to a different host than its API, and names it in
-		return "", false, err
+	// the release object as an RFC 6570 template
+	uploadURL string
 }
-	switch code {
+
-	case 404:
+// parseReleaseRef reads the identifying fields out of a release object.
-		return "", false, nil
+func (r *remoteAPI) parseReleaseRef(tag string, data []byte) releaseRef {
-	case 200:
+	ref := releaseRef{tag: tag, id: tag}
 	if r.kind == kindGitLab {
-			return tag, true, nil
+		return ref // GitLab addresses a release by its tag throughout
 	}
 	var res struct {
 		ID        int64  `json:"id"`
+		UploadURL string `json:"upload_url"`
 	}
 	json.Unmarshal(data, &res)
-		return strconv.FormatInt(res.ID, 10), true, nil
+	ref.id = strconv.FormatInt(res.ID, 10)
+	// ".../assets{?name,label}" -> ".../assets"
+	if i := strings.IndexByte(res.UploadURL, '{'); i >= 0 {
+		ref.uploadURL = res.UploadURL[:i]
+	} else {
+		ref.uploadURL = res.UploadURL
+	}
+	return ref
+}
+
+// findRelease returns the release of tag and whether it exists at all.
+func (r *remoteAPI) findRelease(owner, repo, tag string) (ref releaseRef, found bool, err error) {
+	code, data, err := r.do("GET", r.releaseByTagPath(owner, repo, tag), nil)
+	if err != nil {
+		return releaseRef{}, false, err
+	}
+	switch code {
+	case 404:
+		return releaseRef{}, false, nil
+	case 200:
+		return r.parseReleaseRef(tag, data), true, nil
 	default:
-		return "", false, fmt.Errorf("checking release failed (HTTP %d): %s", code, firstLine(data))
+		return releaseRef{}, false, fmt.Errorf("checking release failed (HTTP %d): %s", code, firstLine(data))
 	}
 }
 
 // createRelease publishes a new release for an already pushed tag.
-func (r *remoteAPI) createRelease(owner, repo string, rel release) error {
+func (r *remoteAPI) createRelease(owner, repo string, rel release) (releaseRef, error) {
 	code, data, err := r.do("POST", r.releasePath(owner, repo), r.releaseBody(rel, true))
 	if err != nil {
-		return err
+		return releaseRef{}, err
 	}
 	if code != 200 && code != 201 {
-		return fmt.Errorf("creating release failed (HTTP %d): %s", code, firstLine(data))
+		return releaseRef{}, fmt.Errorf("creating release failed (HTTP %d): %s", code, firstLine(data))
 	}
-	return nil
+	return r.parseReleaseRef(rel.Tag, data), nil
 }
 
 // updateRelease rewrites the name and notes of an existing release. Gitea and
 // GitHub patch it by numeric id, GitLab puts it by tag.
-func (r *remoteAPI) updateRelease(owner, repo, id string, rel release) error {
+func (r *remoteAPI) updateRelease(owner, repo string, ref releaseRef, rel release) error {
-	method, ep := "PATCH", r.releasePath(owner, repo)+"/"+id
+	method, ep := "PATCH", r.releasePath(owner, repo)+"/"+ref.id
 	if r.kind == kindGitLab {
 		method, ep = "PUT", r.releaseByTagPath(owner, repo, rel.Tag)
 	}
@@ -147,15 +169,13 @@ func handleRelease(args string) {
 		return
 	}
 
-	targets, incomplete := cfg.mirrorTargets()
+	configured, incomplete := cfg.mirrorTargets()
 	for _, n := range incomplete {
 		errorln("remote " + n + ": url or key missing — skipped")
 	}
-	targets = pickRemotes(targets, names)
+	targets := pickRemotes(configured, names)
 	if len(targets) == 0 {
-		if len(names) == 0 { // an unknown @name already reported itself
+		reportNoTargets("release", configured, names)
-			errorln("release needs a mirror target — see 'config'")
-		}
 		return
 	}
 
@@ -164,14 +184,25 @@ func handleRelease(args string) {
 		body = releaseNotes(DIR, tag)
 	}
 
+	// ./bin and ./assets ride along when they are there; nothing to configure,
+	// and nothing happens for a project that has neither
+	assets, skipped := collectAssets(DIR)
+	for _, s := range skipped {
+		errorln("skipping " + s + ": another directory already contributes that name")
+	}
+	if len(assets) > 0 {
+		fmt.Printf("%s %s %s\n", col(cDark, "attaching"), col(cYellow, assetSummary(assets)),
+			col(cDark, "from "+strings.Join(assetDirList(DIR), " and ")))
+	}
+
 	done := 0
 	for _, t := range targets {
-		if publishRelease(t, PRJ, tag, body) {
+		if publishRelease(t, PRJ, tag, body, assets) {
 			done++
 		}
 	}
 	if len(targets) > 1 {
-		fmt.Printf("%s %d/%d remotes released\n", col(cGray, "release:"), done, len(targets))
+		fmt.Printf("%s %d/%d remotes released\n", col(cDark, "release:"), done, len(targets))
 	}
 }
 
@@ -223,7 +254,7 @@ func releaseNotes(dir, tag string) string {
 // publishRelease pushes the tag to one mirror target and turns it into a
 // release there. It returns success, so one unreachable server does not stop
 // the remaining ones.
-func publishRelease(t RemoteTarget, repo, tag, body string) bool {
+func publishRelease(t RemoteTarget, repo, tag, body string, assets []releaseAsset) bool {
 	api := newRemoteAPI(t.URL, t.Key, t.Type)
 
 	owner, err := api.authUser()
@@ -248,17 +279,17 @@ func publishRelease(t RemoteTarget, repo, tag, body string) bool {
 	}
 
 	rel := release{Tag: tag, Name: tag, Body: body, Prerelease: preReleaseRe.MatchString(tag)}
-	id, found, err := api.findRelease(owner, repo, tag)
+	ref, found, err := api.findRelease(owner, repo, tag)
 	if err != nil {
 		errorln(t.Name + ": " + err.Error())
 		return false
 	}
 	if found {
-		if err := api.updateRelease(owner, repo, id, rel); err != nil {
+		if err := api.updateRelease(owner, repo, ref, rel); err != nil {
 			errorln(t.Name + ": " + err.Error())
 			return false
 		}
-	} else if err := api.createRelease(owner, repo, rel); err != nil {
+	} else if ref, err = api.createRelease(owner, repo, rel); err != nil {
 		errorln(t.Name + ": " + err.Error())
 		return false
 	}
@@ -270,7 +301,14 @@ func publishRelease(t RemoteTarget, repo, tag, body string) bool {
 	if rel.Prerelease {
 		what += " (pre-release)"
 	}
-	fmt.Printf("%s %s %s %s\n", col(cGray, "remote"), col(cYellow, t.Name),
+	fmt.Printf("%s %s %s %s\n", col(cDark, "remote"), col(cYellow, t.Name),
-		col(cGreen, what), col(cCyan, api.repoWebURL(owner, repo)))
+		col(cGreen, what), col(cBlue, api.repoWebURL(owner, repo)))
+
+	if len(assets) > 0 {
+		if err := api.uploadAssets(owner, repo, ref, assets); err != nil {
+			errorln(t.Name + ": " + err.Error())
+			return false
+		}
+	}
 	return true
 }

release_test.go

@@ -9,6 +9,7 @@ package main
 
 import (
 	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -20,6 +21,8 @@ import (
 // recordedReq is one request the fake provider received.
 type recordedReq struct {
 	method, path, query string
+	ctype               string
+	raw                 []byte // the body as sent, for the asset uploads
 	body                map[string]any
 }
 
@@ -42,11 +45,12 @@ func newFakeProvider(t *testing.T) *fakeProvider {
 		body string
 	}{}}
 	f.Server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		rec := recordedReq{method: r.Method, path: r.URL.EscapedPath(), query: r.URL.RawQuery}
+		rec := recordedReq{method: r.Method, path: r.URL.EscapedPath(), query: r.URL.RawQuery,
+			ctype: r.Header.Get("Content-Type")}
 		if r.Body != nil {
-			var m map[string]any
+			raw, _ := io.ReadAll(r.Body)
-			json.NewDecoder(r.Body).Decode(&m)
+			rec.raw = raw
-			rec.body = m
+			json.Unmarshal(raw, &rec.body)
 		}
 		f.got = append(f.got, rec)
 
@@ -106,7 +110,7 @@ func TestCreateReleasePerProvider(t *testing.T) {
 		f.route("POST "+c.wantPath, 201, `{"id":7}`)
 
 		api := newRemoteAPI(f.URL, "tok", c.typ)
-		if err := api.createRelease("mike", "mgsh", rel); err != nil {
+		if _, err := api.createRelease("mike", "mgsh", rel); err != nil {
 			t.Fatalf("%s: createRelease: %v (requests: %v)", c.typ, err, f.paths())
 		}
 
@@ -145,11 +149,11 @@ func TestFindReleaseAndUpdate(t *testing.T) {
 		f.route(c.wantMethod+" "+c.wantUpdate, 200, `{}`)
 
 		api := newRemoteAPI(f.URL, "tok", c.typ)
-		id, found, err := api.findRelease("mike", "mgsh", "v1.2")
+		ref, found, err := api.findRelease("mike", "mgsh", "v1.2")
 		if err != nil || !found {
-			t.Fatalf("%s: findRelease = %q,%v,%v", c.typ, id, found, err)
+			t.Fatalf("%s: findRelease = %+v,%v,%v", c.typ, ref, found, err)
 		}
-		if err := api.updateRelease("mike", "mgsh", id, release{Tag: "v1.2", Name: "v1.2", Body: "new"}); err != nil {
+		if err := api.updateRelease("mike", "mgsh", ref, release{Tag: "v1.2", Name: "v1.2", Body: "new"}); err != nil {
 			t.Fatalf("%s: updateRelease: %v (requests: %v)", c.typ, err, f.paths())
 		}
 		req := f.find(c.wantMethod + " " + c.wantUpdate)
@@ -168,9 +172,9 @@ func TestFindReleaseAndUpdate(t *testing.T) {
 func TestFindReleaseMissing(t *testing.T) {
 	f := newFakeProvider(t) // everything 404s
 	api := newRemoteAPI(f.URL, "tok", "gitea")
-	id, found, err := api.findRelease("mike", "mgsh", "v9")
+	ref, found, err := api.findRelease("mike", "mgsh", "v9")
-	if err != nil || found || id != "" {
+	if err != nil || found || ref.id != "" {
-		t.Fatalf("findRelease on empty server = %q,%v,%v", id, found, err)
+		t.Fatalf("findRelease on empty server = %+v,%v,%v", ref, found, err)
 	}
 }
 

remote.go

@@ -238,18 +238,64 @@ func parsePushRemoteArgs(args string) (names []string, description string) {
 	return names, strings.Join(fields[i:], " ")
 }
 
+// remoteHost reduces a configured url — or whatever a user typed in its place —
+// to its bare host: scheme, credentials, port and path removed.
+func remoteHost(s string) string {
+	s = strings.TrimSpace(s)
+	if i := strings.Index(s, "://"); i >= 0 {
+		s = s[i+3:]
+	}
+	if i := strings.IndexByte(s, '@'); i >= 0 { // user[:pass]@host
+		s = s[i+1:]
+	}
+	if i := strings.IndexAny(s, "/:"); i >= 0 {
+		s = s[:i]
+	}
+	return s
+}
+
+// remoteMatches reports whether sel picks target t. A target answers both to its
+// configured name and to the host of its url: the name is what the config calls
+// the server, the host is what the user sees in the browser, and `@gitea` should
+// not be the only way to say `git.example.com`.
+func remoteMatches(t RemoteTarget, sel string) bool {
+	sel = strings.TrimPrefix(strings.TrimSpace(sel), "@")
+	if sel == "" {
+		return false
+	}
+	if strings.EqualFold(t.Name, sel) {
+		return true
+	}
+	h := remoteHost(t.URL)
+	return h != "" && strings.EqualFold(h, remoteHost(sel))
+}
+
+// activeRemotes keeps the targets that take part when a command was given no
+// target of its own (see RemoteTarget.isActive).
+func activeRemotes(all []RemoteTarget) []RemoteTarget {
+	out := make([]RemoteTarget, 0, len(all))
+	for _, t := range all {
+		if t.isActive() {
+			out = append(out, t)
+		}
+	}
+	return out
+}
+
 // pickRemotes narrows all to the explicitly requested names, complaining about
-// any that are not configured. With no names given, all targets are used.
+// any that are not configured. With no names given the active targets are used
+// — `active = false` takes a server off that automatic path, and naming it is
+// what puts it back on.
 func pickRemotes(all []RemoteTarget, names []string) []RemoteTarget {
 	if len(names) == 0 {
-		return all
+		return activeRemotes(all)
 	}
 	var out []RemoteTarget
 	seen := map[string]bool{}
 	for _, n := range names {
 		found := false
 		for _, t := range all {
-			if !strings.EqualFold(t.Name, n) {
+			if !remoteMatches(t, n) {
 				continue
 			}
 			if !seen[t.Name] { // `@hub @hub` must not push twice
@@ -266,8 +312,24 @@ func pickRemotes(all []RemoteTarget, names []string) []RemoteTarget {
 	return out
 }
 
+// reportNoTargets explains an empty selection. There are three ways to end up
+// with nothing to push to, and they need different answers: nothing configured
+// at all, everything configured switched to `active = false`, or a name nobody
+// recognised — which pickRemotes has already complained about by itself.
+func reportNoTargets(cmd string, configured []RemoteTarget, names []string) {
+	switch {
+	case len(names) > 0:
+		return
+	case len(configured) > 0:
+		errorln("every configured remote is inactive — name one, e.g. '" +
+			cmd + " @" + configured[0].Name + "'")
+	default:
+		errorln(cmd + " needs a 'remote.<name>.url' and 'remote.<name>.key' in " + configFile())
+	}
+}
+
 // handlePushRemote implements `pushremote [@name ...] [description]`. Without
-// a @name it mirrors to every configured target; the description, if given, is
+// a @name it mirrors to every active target; the description, if given, is
 // set on the repository when it is created.
 func handlePushRemote(args string) {
 	if !requireRepo() {
@@ -275,15 +337,13 @@ func handlePushRemote(args string) {
 	}
 	names, description := parsePushRemoteArgs(args)
 
-	targets, incomplete := cfg.mirrorTargets()
+	configured, incomplete := cfg.mirrorTargets()
 	for _, n := range incomplete {
 		errorln("remote " + n + ": url or key missing — skipped")
 	}
-	targets = pickRemotes(targets, names)
+	targets := pickRemotes(configured, names)
 	if len(targets) == 0 {
-		if len(names) == 0 { // an unknown @name already reported itself
+		reportNoTargets("pushremote", configured, names)
-			errorln("pushremote needs a 'remote.<name>.url' and 'remote.<name>.key' in " + configFile())
-		}
 		return
 	}
 
@@ -296,7 +356,7 @@ func handlePushRemote(args string) {
 		}
 	}
 	if len(targets) > 1 {
-		fmt.Printf("%s %d/%d remotes updated\n", col(cGray, "pushremote:"), done, len(targets))
+		fmt.Printf("%s %d/%d remotes updated\n", col(cDark, "pushremote:"), done, len(targets))
 	}
 }
 
@@ -313,7 +373,7 @@ func pushToRemote(t RemoteTarget, repo, description string) bool {
 		return false
 	}
 	fmt.Printf("%s %s %s (as %s)\n",
-		col(cGray, "remote"), col(cYellow, t.Name), col(cCyan, api.url), col(cGreen, owner))
+		col(cDark, "remote"), col(cYellow, t.Name), col(cBlue, api.url), col(cGreen, owner))
 
 	exists, err := api.repoExists(owner, repo)
 	if err != nil {
@@ -343,7 +403,7 @@ func pushToRemote(t RemoteTarget, repo, description string) bool {
 		return false
 	}
 	gitPushHeader(DIR, t.Name, header, "--tags")
-	fmt.Println(col(cGreen, "pushed to ") + col(cCyan, web))
+	fmt.Println(col(cGreen, "pushed to ") + col(cBlue, web))
 	return true
 }
 

remotecmd_test.go

@@ -101,7 +101,7 @@ func TestInitKeepsServerRepoWhenDeclined(t *testing.T) {
 	if c := findCmd(*sent, "rm -rf"); c != "" {
 		t.Fatalf("init destroyed the server repository after the user declined: %q", c)
 	}
-	if c := findCmd(*sent, "git --bare init"); c != "" {
+	if c := findCmd(*sent, "git init --bare"); c != "" {
 		t.Fatalf("init re-created the repository after the user declined: %q", c)
 	}
 }
@@ -147,7 +147,7 @@ func TestInitOnFreshProjectCreatesRepo(t *testing.T) {
 	if findCmd(*sent, "rm -rf "+shq("/home/git/notes.git")) == "" {
 		t.Errorf("init did not clear the target path, sent: %q", *sent)
 	}
-	if c := findCmd(*sent, "git --bare init"); !strings.Contains(c, shq("/home/git/notes.git")) {
+	if c := findCmd(*sent, "git init --bare"); !strings.Contains(c, shq("/home/git/notes.git")) {
 		t.Errorf("init did not create the bare repository at the configured path: %q", c)
 	}
 }
@@ -224,25 +224,110 @@ func TestArchiveNamesAndQuotesSnapshot(t *testing.T) {
 	}
 	cp, tar, rm := (*sent)[1], (*sent)[2], (*sent)[3]
 
-	// name is <project>_<stamp>_<sanitised comment>
+	// name is <project>_<stamp>_<sanitised comment>, and every path is spelled
+	// out from gitpath — the login directory is not necessarily the same place
 	stamp := archiveStamp()
 	name := "notes_" + stamp + "_before_rewrite"
-	if !strings.HasPrefix(cp, "cp -r "+shq("notes.git")+" ") {
+	// the archive directory is made first: on a server where nobody created it,
+	// the copy used to fail with a raw cp error
+	if !strings.HasPrefix(cp, "mkdir -p "+shq("/home/git/archive")+" && cp -r "+shq("/home/git/notes.git")+" ") {
 		t.Errorf("cp command = %q", cp)
 	}
-	if !strings.Contains(cp, shq("archive/"+name+".git")) {
+	if !strings.Contains(cp, shq("/home/git/archive/"+name+".git")) {
 		t.Errorf("cp target = %q, want it to contain %q", cp, name)
 	}
-	// `cd archive && tar`, not `cd archive;tar`: a failed cd must not let tar
+	// `tar -C <dir>`, not `cd <dir> && tar`: on the tcsh server `cd` is aliased
-	// run in the login directory
+	// to `cd !*;echo $cwd`, which turns the guard into `cd X; echo && tar` —
-	if !strings.HasPrefix(tar, "cd archive && tar ") || !strings.Contains(tar, shq(name+".git.tar.gz")) {
+	// tar then runs in the login directory even when the cd failed, and the
+	// whole command still reports success
+	if !strings.HasPrefix(tar, "tar cvzf "+shq("/home/git/archive/"+name+".git.tar.gz")+" -C "+shq("/home/git/archive")+" ") ||
+		!strings.Contains(tar, shq(name+".git")) {
 		t.Errorf("tar command = %q", tar)
 	}
-	if rm != "rm -rf "+shq("archive/"+name+".git") {
+	if rm != "rm -rf "+shq("/home/git/archive/"+name+".git") {
 		t.Errorf("cleanup command = %q", rm)
 	}
 }
 
+// TestServerCommandsAreAnchoredAtGitPath: mgsh used to address the server
+// through the login directory, which only worked because `gituser = git` and
+// `gitpath = /home/git` happen to be the same place. With `gituser = root` and
+// `gitpath = /root/mgsh` every command went to /root instead — `list` came back
+// empty and `archive` had nothing to copy.
+func TestServerCommandsAreAnchoredAtGitPath(t *testing.T) {
+	useProject(t, "notes")
+	cfg.GitPath = "/root/mgsh" // the repositories are NOT in the login directory
+	sent := fakeServer(t, func(cmd string) (string, error) {
+		if strings.HasPrefix(cmd, "/bin/ls") {
+			return "notes.git\n", nil
+		}
+		return "", nil
+	})
+
+	captureStdout(t, func() {
+		runCommand("list")
+		runCommand("list -a")
+		runCommand("show notes")
+		runCommand("archive")
+	})
+
+	if len(*sent) == 0 {
+		t.Fatal("no remote commands recorded")
+	}
+	for _, c := range *sent {
+		if !strings.Contains(c, "/root/mgsh") {
+			t.Errorf("remote command not anchored at gitpath: %q", c)
+		}
+		// No `cd` either. On the tcsh server it is aliased to `cd !*;echo $cwd`,
+		// which splits `cd X && Y` into `cd X; echo $cwd && Y`: Y runs even when
+		// the cd failed, and the command still exits 0. Every tool mgsh uses can
+		// be told its directory instead — tar -C, git --git-dir, find <path>.
+		if strings.HasPrefix(c, "cd ") || strings.Contains(c, " cd ") {
+			t.Errorf("remote command relies on cd: %q", c)
+		}
+	}
+}
+
+// TestRemoteCommandsRefuseExclamationMark: '!' is the one character shq cannot
+// protect. csh expands history before it looks at quotes, and does so
+// non-interactively too, so `cp -r '/home/git/wei!rd.git' …` arrives as
+// something else. Such a command must not be sent at all.
+func TestRemoteCommandsRefuseExclamationMark(t *testing.T) {
+	useProject(t, "wei!rd")
+	sent := fakeServer(t, func(cmd string) (string, error) {
+		if strings.HasPrefix(cmd, "/bin/ls") {
+			return "wei!rd.git\n", nil // the repository is there, so both proceed
+		}
+		return "", nil
+	})
+
+	out := captureStdout(t, func() {
+		runCommand("show wei!rd")
+		runCommand("archive")
+	})
+
+	for _, c := range *sent {
+		if strings.Contains(c, "!") {
+			t.Errorf("sent a command containing '!': %q", c)
+		}
+	}
+	if c := findCmd(*sent, "--git-dir"); c != "" {
+		t.Errorf("show sent %q despite the '!' in the name", c)
+	}
+	if c := findCmd(*sent, "cp -r"); c != "" {
+		t.Errorf("archive sent %q despite the '!' in the name", c)
+	}
+	if !strings.Contains(out, "not sending") {
+		t.Errorf("output = %q, want the refusal to say what it did not do", out)
+	}
+
+	// the other way in is an archive comment, which is why sanitizeComment
+	// drops the character before it ever becomes part of a name
+	if got := sanitizeComment("fix!now"); strings.ContainsRune(got, '!') {
+		t.Errorf("sanitizeComment(%q) = %q, want the '!' gone", "fix!now", got)
+	}
+}
+
 // TestCloneRefusesUnknownRepository: `clone` must not start a git clone for a
 // repository the server does not list.
 func TestCloneRefusesUnknownRepository(t *testing.T) {
@@ -389,5 +474,15 @@ func TestListSendsNoShellSpecificSyntax(t *testing.T) {
 		if strings.Contains(c, "2>") || strings.Contains(c, "&>") {
 			t.Errorf("remote command uses sh-only redirection: %q", c)
 		}
+		// A glob is expanded by that same login shell, and a non-interactive
+		// zsh that finds nothing to match does not pass the pattern on like sh
+		// does — it fails the command outright ("no matches found: *.git"),
+		// which is how an empty server came to be reported as unreachable.
+		for _, idx := range indexesOf(c, "*") {
+			if idx == 0 || c[idx-1] != '\'' {
+				t.Errorf("unquoted glob in remote command: %q", c)
+				break
+			}
+		}
 	}
 }

secrets.go

@@ -191,9 +191,9 @@ func secretsApproved(dir string) bool {
 			where += ":" + strconv.Itoa(h.lineNo)
 		}
 		fmt.Printf("  %s  %s\n    %s\n",
-			col(cYellow, where), col(cGray, h.kind), col(cRed, ellipsis(strings.TrimSpace(h.text), 100)))
+			col(cYellow, where), col(cDark, h.kind), col(cRed, ellipsis(strings.TrimSpace(h.text), 100)))
 	}
-	fmt.Println(col(cGray, "  (set 'secretscan = off' to skip this check)"))
+	fmt.Println(col(cDark, "  (set 'secretscan = off' to skip this check)"))
 	return yesno("push anyway?", false)
 }
 

selfupdate.go

@@ -0,0 +1,484 @@
+// selfupdate.go — updating oneself from the releases of a Gitea instance.
+//
+// The file is meant to be copied: take it into another program, adjust the
+// configuration block below, hang `--update` and `--check-update` into the
+// options — done. It needs nothing but the standard library, and apart from
+// that block it brings no names that do not begin with "selfUpdate" or
+// "update".
+//
+// It assumes the layout build.sh produces: one release per version, whose tag
+// is the bare number (4.0.64, a leading "v" is allowed), holding one asset
+// "<name>-<goos>-<goarch>" each — that is, exactly the files from ./bin. Under
+// /api/v1/repos/<owner>/<repo>/releases/latest Gitea hands out the newest
+// release that is neither a draft nor a prerelease; GitHub speaks the same
+// route with different field names and is therefore not covered.
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// ------------------------------------------------------------ Configuration
+
+var selfUpdate = selfUpdater{
+	repo:     "https://git.micw.org/mike/mgsh",
+	asset:    "mgsh",
+	current:  VERSION, // from main.go, set by -ldflags
+	verify:   []string{"--version"},
+	every:    24 * time.Hour,
+	quietEnv: "MGSH_NO_UPDATE_CHECK",
+}
+
+type selfUpdater struct {
+	repo     string        // repo URL as in the browser: https://host/owner/repo
+	asset    string        // base name of the assets, "-<goos>-<goarch>" is added
+	current  string        // the running version
+	verify   []string      // trial run of the download; empty skips it
+	every    time.Duration // how often to look on its own; 0 turns that off
+	quietEnv string        // this environment variable set: keep quiet as well
+}
+
+// updateRefreshFlag is the option the program calls itself with, in the
+// background. It is deliberately absent from the help.
+const updateRefreshFlag = "--update-refresh"
+
+// ------------------------------------------------------------ Looking by itself
+
+// daily is the hook for the ordinary run of the program. It costs nothing: in
+// the foreground the network is never touched. What comes back is the line
+// pointing at a new version — or "", when there is nothing to say; what it
+// looks like is up to the caller. Should the note be older than `every`, daily
+// starts a background run on the side, whose answer the next call will find
+// waiting.
+func (u selfUpdater) daily() string {
+	if u.every <= 0 || os.Getenv(u.quietEnv) != "" || !updateOnTerminal() {
+		return ""
+	}
+	st := u.loadState() // no file: the zero value, hence due at once
+
+	if time.Since(st.Checked) >= u.every {
+		// The timestamp moves on before the asking, not after: otherwise two
+		// simultaneous runs start two queries, and a server that is not in the
+		// mood would get a new one on every call. If the note does not stay
+		// put, nothing is asked either — else an unwritable cache directory
+		// would mean one process per call.
+		st.Checked = time.Now()
+		if u.saveState(st) == nil {
+			u.spawnRefresh()
+		}
+	}
+
+	if st.Latest == "" || updateCompare(st.Latest, u.current) <= 0 {
+		return ""
+	}
+	return fmt.Sprintf("%s %s is available, run '%s --update'", u.asset, st.Latest, u.asset)
+}
+
+// refresh is the background run: ask, write it down, stay quiet. The writing
+// down is done by latest; if the query fails, the old state remains.
+func (u selfUpdater) refresh() {
+	_, _ = u.latest()
+}
+
+// spawnRefresh calls this program once more, only to ask, and does not wait.
+// Without a Wait the child is adopted by init when this process ends — it thus
+// outlives the call, and the call's output stays untouched by it.
+func (u selfUpdater) spawnRefresh() {
+	exe, err := os.Executable()
+	if err != nil {
+		return
+	}
+	cmd := exec.Command(exe, updateRefreshFlag)
+	cmd.Stdin, cmd.Stdout, cmd.Stderr = nil, nil, nil // everything to /dev/null
+	if cmd.Start() == nil {
+		cmd.Process.Release()
+	}
+}
+
+// The hint is meant for the person sitting there. Running in a pipe, in a
+// script or under cron, the program neither asks nor says anything.
+func updateOnTerminal() bool {
+	st, err := os.Stderr.Stat()
+	return err == nil && st.Mode()&os.ModeCharDevice != 0
+}
+
+// --------------------------------------------------------------------- Note
+
+// updateState is what is left between two calls: when the last question was
+// asked and what came of it.
+type updateState struct {
+	Checked time.Time `json:"checked"`
+	Latest  string    `json:"latest"`
+}
+
+// The note lives in the cache directory, not in the configuration: if it gets
+// lost, the only cost is asking once too early.
+func (u selfUpdater) statePath() (string, error) {
+	dir, err := os.UserCacheDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(dir, u.asset, "update.json"), nil
+}
+
+func (u selfUpdater) loadState() updateState {
+	var st updateState
+	path, err := u.statePath()
+	if err != nil {
+		return st
+	}
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return st
+	}
+	json.Unmarshal(b, &st) // a broken file counts as none
+	return st
+}
+
+func (u selfUpdater) saveState(st updateState) error {
+	path, err := u.statePath()
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		return err
+	}
+	b, err := json.Marshal(st)
+	if err != nil {
+		return err
+	}
+	// By way of a file alongside, so that a simultaneous run never comes upon
+	// half a JSON.
+	tmp := path + ".new"
+	if err := os.WriteFile(tmp, b, 0o644); err != nil {
+		return err
+	}
+	if err := os.Rename(tmp, path); err != nil {
+		os.Remove(tmp)
+		return err
+	}
+	return nil
+}
+
+// ------------------------------------------------------------------ The work
+
+// check only looks and touches nothing.
+func (u selfUpdater) check(w io.Writer) error {
+	rel, err := u.latest()
+	if err != nil {
+		return err
+	}
+	if updateCompare(rel.TagName, u.current) <= 0 {
+		fmt.Fprintf(w, "%s %s is up to date\n", u.asset, u.current)
+		return nil
+	}
+	fmt.Fprintf(w, "%s %s is available, running %s\n  %s\n  run '%s --update' to install it\n",
+		u.asset, rel.TagName, u.current, rel.HTMLURL, u.asset)
+	return nil
+}
+
+// install fetches the newest release and replaces the running file with it.
+func (u selfUpdater) install(w io.Writer) error {
+	rel, err := u.latest()
+	if err != nil {
+		return err
+	}
+	if updateCompare(rel.TagName, u.current) <= 0 {
+		fmt.Fprintf(w, "%s %s is up to date\n", u.asset, u.current)
+		return nil
+	}
+
+	want := fmt.Sprintf("%s-%s-%s", u.asset, runtime.GOOS, runtime.GOARCH)
+	var src *updateAsset
+	for i := range rel.Assets {
+		if rel.Assets[i].Name == want {
+			src = &rel.Assets[i]
+			break
+		}
+	}
+	if src == nil {
+		names := make([]string, len(rel.Assets))
+		for i, a := range rel.Assets {
+			names[i] = a.Name
+		}
+		return fmt.Errorf("release %s has no %q (only %s)", rel.TagName, want, strings.Join(names, ", "))
+	}
+
+	exe, err := os.Executable()
+	if err != nil {
+		return fmt.Errorf("cannot locate the running binary: %w", err)
+	}
+	// An installed mgsh is often a symlink into ./bin. What should be replaced
+	// is the file behind it, not the link.
+	if real, err := filepath.EvalSymlinks(exe); err == nil {
+		exe = real
+	}
+	mode := os.FileMode(0o755)
+	if st, err := os.Stat(exe); err == nil {
+		mode = st.Mode().Perm()
+	}
+
+	fmt.Fprintf(w, "downloading %s %s (%s)\n", want, rel.TagName, updateSize(src.Size))
+	tmp, err := u.download(src, exe, mode)
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tmp) // only bites when the renaming below falls through
+
+	if err := u.probe(tmp, rel.TagName); err != nil {
+		return err
+	}
+	if err := updateReplace(tmp, exe); err != nil {
+		return err
+	}
+
+	fmt.Fprintf(w, "%s %s → %s, at %s\n", u.asset, u.current, rel.TagName, exe)
+	return nil
+}
+
+func (u selfUpdater) download(a *updateAsset, exe string, mode os.FileMode) (string, error) {
+	// The new file comes into being next to the old one: same filesystem, so
+	// the renaming at the end is one atomic step and not half a copy. It also
+	// comes into being before the first byte — a missing write permission ought
+	// to show up before a few megabytes have gone down the wire.
+	dir := filepath.Dir(exe)
+	f, err := os.CreateTemp(dir, "."+filepath.Base(exe)+".new")
+	if err != nil {
+		var pe *os.PathError // the path is in the message already
+		if errors.As(err, &pe) {
+			err = pe.Err
+		}
+		return "", fmt.Errorf("cannot write to %s: %w", dir, err)
+	}
+	tmp := f.Name()
+
+	resp, err := updateGet(context.Background(), a.URL)
+	if err != nil {
+		f.Close()
+		os.Remove(tmp)
+		return "", err
+	}
+	defer resp.Body.Close()
+
+	n, err := io.Copy(f, resp.Body)
+	if cerr := f.Close(); err == nil {
+		err = cerr
+	}
+	if err == nil && a.Size > 0 && n != a.Size {
+		err = fmt.Errorf("got %d of %d bytes from %s", n, a.Size, a.URL)
+	}
+	if err == nil {
+		err = os.Chmod(tmp, mode)
+	}
+	if err != nil {
+		os.Remove(tmp)
+		return "", err
+	}
+	return tmp, nil
+}
+
+// probe calls the freshly fetched runner once. That catches a file that is
+// truncated, built for the wrong platform, or not executable in the first
+// place, before it replaces the running one.
+func (u selfUpdater) probe(path, tag string) error {
+	if len(u.verify) == 0 {
+		return nil
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	out, err := exec.CommandContext(ctx, path, u.verify...).CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("the downloaded binary does not run: %w", err)
+	}
+	if !strings.Contains(string(out), strings.TrimPrefix(tag, "v")) {
+		return fmt.Errorf("the downloaded binary reports %q, expected %s",
+			strings.TrimSpace(string(out)), tag)
+	}
+	return nil
+}
+
+// updateReplace swaps the running file for the new one.
+func updateReplace(tmp, exe string) error {
+	if err := os.Rename(tmp, exe); err == nil {
+		return nil
+	}
+	// Unix overwrites the file of a running program without complaint, Windows
+	// does not: there the old one has to be got out of the way first. Deleting
+	// it becomes possible when this process ends at the earliest — so the
+	// tidying up is allowed to fail.
+	old := exe + ".old"
+	os.Remove(old)
+	if err := os.Rename(exe, old); err != nil {
+		return fmt.Errorf("cannot replace %s: %w", exe, err)
+	}
+	if err := os.Rename(tmp, exe); err != nil {
+		os.Rename(old, exe) // back to how it was
+		return fmt.Errorf("cannot replace %s: %w", exe, err)
+	}
+	os.Remove(old)
+	return nil
+}
+
+// -------------------------------------------------------------------- Gitea
+
+type updateRelease struct {
+	TagName string        `json:"tag_name"`
+	HTMLURL string        `json:"html_url"`
+	Assets  []updateAsset `json:"assets"`
+}
+
+type updateAsset struct {
+	Name string `json:"name"`
+	Size int64  `json:"size"`
+	URL  string `json:"browser_download_url"`
+}
+
+func (u selfUpdater) latest() (updateRelease, error) {
+	base, err := u.apiBase()
+	if err != nil {
+		return updateRelease{}, err
+	}
+	// The question is a small one; if it hangs, it does not hang for long. The
+	// generous time limit of updateClient is meant for the download.
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	resp, err := updateGet(ctx, base+"/releases/latest")
+	if err != nil {
+		return updateRelease{}, err
+	}
+	defer resp.Body.Close()
+
+	var rel updateRelease
+	if err := json.NewDecoder(resp.Body).Decode(&rel); err != nil {
+		return updateRelease{}, fmt.Errorf("unexpected answer from %s: %w", base, err)
+	}
+	if rel.TagName == "" {
+		return updateRelease{}, fmt.Errorf("%s has no releases", u.repo)
+	}
+
+	// Every question that succeeds fills the note — no matter whether it came
+	// from --update, from --check-update or from the background run.
+	u.saveState(updateState{Checked: time.Now(), Latest: rel.TagName})
+	return rel, nil
+}
+
+// apiBase turns https://host/owner/repo into the API root of the repo.
+func (u selfUpdater) apiBase() (string, error) {
+	bad := fmt.Errorf("repo %q: expected https://host/owner/repo", u.repo)
+
+	ref, err := url.Parse(strings.TrimSuffix(strings.TrimSuffix(u.repo, "/"), ".git"))
+	if err != nil || ref.Host == "" {
+		return "", bad
+	}
+	parts := strings.Split(strings.Trim(ref.Path, "/"), "/")
+	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+		return "", bad
+	}
+	return fmt.Sprintf("%s://%s/api/v1/repos/%s/%s", ref.Scheme, ref.Host, parts[0], parts[1]), nil
+}
+
+// One time limit for all of it: the look costs a few hundred milliseconds, the
+// download a few megabytes — both may hang, but not forever.
+var updateClient = &http.Client{Timeout: 5 * time.Minute}
+
+func updateGet(ctx context.Context, target string) (*http.Response, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, target, nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("User-Agent", "selfupdate.go (+"+runtime.GOOS+"/"+runtime.GOARCH+")")
+
+	resp, err := updateClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode != http.StatusOK {
+		resp.Body.Close()
+		return nil, fmt.Errorf("GET %s: %s", target, resp.Status)
+	}
+	return resp, nil
+}
+
+// ------------------------------------------------------------------ Numbers
+
+// updateCompare compares two versions component by component, numerically, so
+// that 2.1.10 lands behind 2.1.9 and not in front of it. A leading "v" does not
+// count, missing places count as 0 (2.1 == 2.1.0), and a suffix on the number
+// makes the version older, not newer (2.1.6-rc1 < 2.1.6). The result is the one
+// of strings.Compare: -1, 0, 1.
+func updateCompare(a, b string) int {
+	as := strings.Split(strings.TrimPrefix(a, "v"), ".")
+	bs := strings.Split(strings.TrimPrefix(b, "v"), ".")
+
+	for i := 0; i < len(as) || i < len(bs); i++ {
+		x, y := "0", "0"
+		if i < len(as) {
+			x = as[i]
+		}
+		if i < len(bs) {
+			y = bs[i]
+		}
+		if c := updateComparePart(x, y); c != 0 {
+			return c
+		}
+	}
+	return 0
+}
+
+func updateComparePart(a, b string) int {
+	na, ra := updateSplitNum(a)
+	nb, rb := updateSplitNum(b)
+	switch {
+	case na != nb:
+		if na < nb {
+			return -1
+		}
+		return 1
+	case ra == rb:
+		return 0
+	case ra == "": // 2.1.6 is finished, 2.1.6-rc1 is not yet
+		return 1
+	case rb == "":
+		return -1
+	}
+	return strings.Compare(ra, rb)
+}
+
+// updateSplitNum separates "10-rc1" into 10 and "-rc1".
+func updateSplitNum(s string) (int, string) {
+	i := 0
+	for i < len(s) && s[i] >= '0' && s[i] <= '9' {
+		i++
+	}
+	n, _ := strconv.Atoi(s[:i])
+	return n, s[i:]
+}
+
+// updateSize is deliberately a small formatting of its own and not humanSize
+// from colors.go — the file is meant to stand on its own.
+func updateSize(b int64) string {
+	const k = 1024
+	switch {
+	case b > k*k:
+		return fmt.Sprintf("%.1f MB", float64(b)/k/k)
+	case b > k:
+		return fmt.Sprintf("%.1f KB", float64(b)/k)
+	default:
+		return fmt.Sprintf("%d B", b)
+	}
+}

selfupdate_test.go

@@ -0,0 +1,190 @@
+package main
+
+// selfupdate_test.go — the parts of selfupdate.go that can be checked without
+// replacing the running binary: the version arithmetic, the URL it derives, and
+// what it makes of a Gitea release.
+//
+// selfupdate.go itself is a file copied between programs and stays as it is;
+// the tests live here so the copy keeps working when it lands in the next one.
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// cacheInTemp points os.UserCacheDir at a temporary directory, so the note
+// selfupdate writes never touches the real one.
+func cacheInTemp(t *testing.T) {
+	t.Helper()
+	dir := t.TempDir()
+	t.Setenv("HOME", dir)                                 // darwin: ~/Library/Caches
+	t.Setenv("XDG_CACHE_HOME", filepath.Join(dir, "xdg")) // linux
+}
+
+// fakeGitea serves one /releases/latest answer, the way Gitea does.
+func fakeGitea(t *testing.T, body string) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/repos/mike/mgsh/releases/latest" {
+			http.NotFound(w, r)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.Write([]byte(body))
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func testUpdater(srv *httptest.Server, current string) selfUpdater {
+	return selfUpdater{
+		repo:     srv.URL + "/mike/mgsh",
+		asset:    "mgsh",
+		current:  current,
+		every:    0, // no background run from a test
+		quietEnv: "MGSH_NO_UPDATE_CHECK",
+	}
+}
+
+// TestUpdateCompare is the one piece of arithmetic in the file, and the reason
+// it exists: a plain string comparison puts 4.0.9 after 4.0.10 and would offer
+// an update backwards forever.
+func TestUpdateCompare(t *testing.T) {
+	for _, c := range []struct {
+		a, b string
+		want int
+	}{
+		{"4.0.10", "4.0.9", 1}, // numerically, not alphabetically
+		{"4.0.9", "4.0.10", -1},
+		{"4.0.64", "4.0.64", 0},
+		{"v4.1.0", "4.0.64", 1}, // a leading v does not count
+		{"4.1", "4.1.0", 0},     // missing places are zeroes
+		{"4.2", "4.1.9", 1},
+		{"4.0.64-rc1", "4.0.64", -1}, // a suffix is not yet the release
+		{"4.0.64", "4.0.64-rc1", 1},
+		{"4.0.64-rc2", "4.0.64-rc1", 1},
+		{"5.0.0", "4.99.99", 1},
+	} {
+		if got := updateCompare(c.a, c.b); got != c.want {
+			t.Errorf("updateCompare(%q, %q) = %d, want %d", c.a, c.b, got, c.want)
+		}
+	}
+}
+
+// TestUpdateAPIBase: the browser URL of the repo is all the file is configured
+// with, so everything depends on it becoming the right API root.
+func TestUpdateAPIBase(t *testing.T) {
+	for _, c := range []struct{ repo, want string }{
+		{"https://git.micw.org/mike/mgsh", "https://git.micw.org/api/v1/repos/mike/mgsh"},
+		{"https://git.micw.org/mike/mgsh/", "https://git.micw.org/api/v1/repos/mike/mgsh"},
+		{"https://git.micw.org/mike/mgsh.git", "https://git.micw.org/api/v1/repos/mike/mgsh"},
+		{"http://localhost:3000/mike/mgsh", "http://localhost:3000/api/v1/repos/mike/mgsh"},
+	} {
+		got, err := selfUpdater{repo: c.repo}.apiBase()
+		if err != nil || got != c.want {
+			t.Errorf("apiBase(%q) = %q, %v, want %q", c.repo, got, err, c.want)
+		}
+	}
+	// anything that is not host/owner/repo has to say so rather than build a
+	// URL that 404s later
+	for _, bad := range []string{"", "git.micw.org/mike/mgsh", "https://git.micw.org/mike", "https://git.micw.org/a/b/c"} {
+		if _, err := (selfUpdater{repo: bad}).apiBase(); err == nil {
+			t.Errorf("apiBase(%q) accepted a malformed repo URL", bad)
+		}
+	}
+}
+
+// TestSelfUpdateCheck covers both answers of `update -c`, and that a successful
+// look leaves the note behind that the daily hint later reads.
+func TestSelfUpdateCheck(t *testing.T) {
+	cacheInTemp(t)
+	srv := fakeGitea(t, `{"tag_name":"4.1.0","html_url":"https://git.micw.org/mike/mgsh/releases/tag/4.1.0",
+		"assets":[{"name":"mgsh-darwin-arm64","size":9,"browser_download_url":"x"}]}`)
+
+	var out strings.Builder
+	if err := testUpdater(srv, "4.0.64").check(&out); err != nil {
+		t.Fatalf("check: %v", err)
+	}
+	if !strings.Contains(out.String(), "4.1.0 is available") {
+		t.Errorf("check output = %q, want the new version offered", out.String())
+	}
+
+	out.Reset()
+	if err := testUpdater(srv, "4.1.0").check(&out); err != nil {
+		t.Fatalf("check: %v", err)
+	}
+	if !strings.Contains(out.String(), "up to date") {
+		t.Errorf("check output = %q, want 'up to date'", out.String())
+	}
+
+	// the same version must not be offered as an update to itself
+	out.Reset()
+	if err := testUpdater(srv, "4.2.0").check(&out); err != nil {
+		t.Fatalf("check: %v", err)
+	}
+	if strings.Contains(out.String(), "available") {
+		t.Errorf("a newer running version was offered an update: %q", out.String())
+	}
+
+	cache, err := os.UserCacheDir()
+	if err != nil {
+		t.Fatal(err)
+	}
+	note := filepath.Join(cache, "mgsh", "update.json")
+	b, err := os.ReadFile(note)
+	if err != nil {
+		t.Fatalf("no note written to %s: %v", note, err)
+	}
+	if !strings.Contains(string(b), `"latest":"4.1.0"`) {
+		t.Errorf("note = %s, want the looked-up version in it", b)
+	}
+}
+
+// TestSelfUpdateNoReleases: an empty repository must produce a plain message,
+// not a nil release that gets compared against the running version.
+func TestSelfUpdateNoReleases(t *testing.T) {
+	cacheInTemp(t)
+	srv := fakeGitea(t, `{}`)
+
+	err := testUpdater(srv, "4.0.64").check(&strings.Builder{})
+	if err == nil || !strings.Contains(err.Error(), "no releases") {
+		t.Errorf("check against a release-less repo = %v, want a 'no releases' error", err)
+	}
+}
+
+// TestSelfUpdateWithoutMatchingAsset: a release built for other platforms must
+// not be installed, and the message has to name what was looked for — that is
+// what tells you the release is incomplete rather than the machine unsupported.
+func TestSelfUpdateWithoutMatchingAsset(t *testing.T) {
+	cacheInTemp(t)
+	srv := fakeGitea(t, `{"tag_name":"4.1.0","assets":[{"name":"mgsh-plan9-mips","size":1,"browser_download_url":"x"}]}`)
+
+	err := testUpdater(srv, "4.0.64").install(&strings.Builder{})
+	if err == nil {
+		t.Fatal("install accepted a release without a binary for this platform")
+	}
+	if !strings.Contains(err.Error(), "mgsh-") || !strings.Contains(err.Error(), "mgsh-plan9-mips") {
+		t.Errorf("error = %v, want the wanted and the available asset names", err)
+	}
+}
+
+// TestUpdateDailyStaysQuiet: the automatic look is for the person sitting
+// there. Under MGSH_NO_UPDATE_CHECK, and with `every` at zero, it says nothing
+// and starts nothing.
+func TestUpdateDailyStaysQuiet(t *testing.T) {
+	cacheInTemp(t)
+	u := selfUpdater{asset: "mgsh", current: "4.0.0", every: 0, quietEnv: "MGSH_NO_UPDATE_CHECK"}
+	if hint := u.daily(); hint != "" {
+		t.Errorf("daily with every=0 = %q, want silence", hint)
+	}
+
+	t.Setenv("MGSH_NO_UPDATE_CHECK", "1")
+	u.every = 1
+	if hint := u.daily(); hint != "" {
+		t.Errorf("daily under MGSH_NO_UPDATE_CHECK = %q, want silence", hint)
+	}
+}

show_config.go

@@ -24,11 +24,11 @@ func showConfig() {
 		project = DIR + "/" + projectRC
 	}
 
-	fmt.Printf("%s %s\n", col(cGray, "global "), col(cCyan, global))
+	fmt.Printf("%s %s\n", col(cDark, "global "), col(cBlue, global))
 	if project != "" {
-		fmt.Printf("%s %s\n", col(cGray, "project"), col(cCyan, project))
+		fmt.Printf("%s %s\n", col(cDark, "project"), col(cBlue, project))
 	} else if PRJ != "" {
-		fmt.Printf("%s %s\n", col(cGray, "project"), col(cGray, "no "+projectRC+" in "+PRJ))
+		fmt.Printf("%s %s\n", col(cDark, "project"), col(cDark, "no "+projectRC+" in "+PRJ))
 	}
 	fmt.Println()
 
@@ -72,13 +72,13 @@ func showConfig() {
 	}
 
 	if k := sshKeyPath(); k != "" {
-		fmt.Printf("  %s%s\n", col(cGray, padRight("ssh identity", 14)), col(cGray, k))
+		fmt.Printf("  %s%s\n", col(cDark, padRight("ssh identity", 14)), col(cDark, k))
 	}
-	fmt.Printf("  %s%s\n", col(cGray, padRight("clone url", 14)), col(cGray, URL))
+	fmt.Printf("  %s%s\n", col(cDark, padRight("clone url", 14)), col(cDark, URL))
 	// the project's real origin: it can differ from what the current settings
 	// would produce, e.g. after moving the server or editing a project .mgshrc
 	if o := originURL(); o != "" {
-		fmt.Printf("  %s%s\n", col(cGray, padRight("origin", 14)), col(cGray, o))
+		fmt.Printf("  %s%s\n", col(cDark, padRight("origin", 14)), col(cDark, o))
 	}
 
 	showRemotes()
@@ -90,11 +90,11 @@ func showRemotes() {
 	targets, incomplete := cfg.mirrorTargets()
 	fmt.Println()
 	if len(targets) == 0 && len(incomplete) == 0 {
-		fmt.Println(col(cGray, "no pushremote targets configured"))
+		fmt.Println(col(cDark, "no pushremote targets configured"))
 		return
 	}
 
-	fmt.Println(col(cGray, "pushremote targets (in push order):"))
+	fmt.Println(col(cDark, "pushremote targets (in push order):"))
 	for _, t := range targets {
 		vis := "private"
 		if strings.EqualFold(strings.TrimSpace(t.Vis), "public") {
@@ -104,9 +104,15 @@ func showRemotes() {
 		if kind == "" {
 			kind = remoteKindName(detectRemoteKind(t.URL, "")) + " (detected)"
 		}
-		fmt.Printf("  %s%s  %s\n",
+		// an inactive target is still a target, just not an automatic one: it
-			col(cGreen, padRight("@"+t.Name, 14)), t.URL,
+		// steps back a shade instead of dropping out of the listing
-			col(cGray, kind+", "+vis+", key "+maskSecret(t.Key)))
+		name, state := col(cGreen, padRight("@"+t.Name, 14)), ""
+		if !t.isActive() {
+			name = col(cGrey, padRight("@"+t.Name, 14))
+			state = ", inactive (only when named)"
+		}
+		fmt.Printf("  %s%s  %s\n", name, t.URL,
+			col(cDark, kind+", "+vis+", key "+maskSecret(t.Key)+state))
 	}
 	for _, n := range incomplete {
 		fmt.Printf("  %s%s\n", col(cRed, padRight("@"+n, 14)), col(cRed, "incomplete: url or key missing"))

version.txt

@@ -1 +1 @@
-4.0.50
+4.0.69