User config file layered under repo config, user-scoped identities; split the CLI into modules; fix clone remote persistence fce44ae9ad29

//! Shared presentation helpers.

use anyhow::Result;

use oxy_core::hash::ChangeHash;

use oxy_core::objects::Change;

use oxy_core::repo::{Repo, SignatureStatus};

pub fn short_id(c: &Change) -> String {

    c.change_id.short(8)

}

/// `n head` / `n heads`.

pub fn plural(n: usize, word: &str) -> String {

    format!("{n} {word}{}", if n == 1 { "" } else { "s" })

}

/// Milliseconds since the Unix epoch as `YYYY-MM-DD HH:MM:SSZ`.

pub fn when(ms: u64) -> String {

    let secs = (ms / 1000) as i64;

    let days = secs.div_euclid(86_400);

    let rem = secs.rem_euclid(86_400);

    // Civil-from-days (Howard Hinnant), UTC.

    let z = days + 719_468;

    let era = z.div_euclid(146_097);

    let doe = z - era * 146_097;

    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;

    let y = yoe + era * 400;

    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);

    let mp = (5 * doy + 2) / 153;

    let d = doy - (153 * mp + 2) / 5 + 1;

    let m = if mp < 10 { mp + 3 } else { mp - 9 };

    let y = if m <= 2 { y + 1 } else { y };

    format!("{y:04}-{m:02}-{d:02} {:02}:{:02}:{:02}Z", rem / 3600, (rem % 3600) / 60, rem % 60)

}

/// One line describing how a change is authenticated.

pub fn signature_line(repo: &Repo, h: &ChangeHash) -> Result<String> {

    Ok(match repo.authenticate_change(h)? {

        SignatureStatus::Unsigned => "unsigned".to_string(),

        SignatureStatus::Valid { key, name, email, sealed } => {

            format!("{} by {name} <{email}> key {}", if sealed { "sealed" } else { "signed" }, key.short(12))

        }

        SignatureStatus::Invalid(why) => format!("INVALID signature: {why}"),

    })

}

pub fn deps_line(c: &Change) -> String {

    c.deps.iter().map(|d| format!("#{}", d.short(12))).collect::<Vec<_>>().join(" ")

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn dates() {

        assert_eq!(when(0), "1970-01-01 00:00:00Z");

        assert_eq!(when(1_700_000_000_000), "2023-11-14 22:13:20Z");

        assert_eq!(plural(1, "head"), "1 head");

        assert_eq!(plural(2, "head"), "2 heads");

    }

}

//! Identity, verification, and configuration commands.

use super::format::{short_id, signature_line, when};

use super::open;

use anyhow::Result;

use oxy_core::hash::ChangeHash;

use oxy_core::repo::{self, IdentityScope};

pub fn create(name: Option<String>, email: Option<String>, local: bool) -> Result<i32> {

    let mut repo = open()?;

    let name = name.unwrap_or_else(|| repo.config.author_name.clone());

    let email = email.unwrap_or_else(|| repo.config.author_email.clone());

    let scope = if local { IdentityScope::Repo } else { IdentityScope::User };

    let (key, _) = repo.create_identity(&name, &email, scope)?;

    println!("Created identity {name} <{email}>");

    println!("KeyId: {key}");

    println!("Secret key stored under {}", repo::default_keys_dir().display());

    match scope {

        IdentityScope::User => println!("Recorded as your default author in {}", repo.user_config_path().display()),

        IdentityScope::Repo => println!("Recorded in this repository's .oxy/config only"),

    }

    if !repo.config.sign_changes {

        println!("Changes will carry this author; run `oxy config --user core.sign change` to sign each commit.");

    }

    Ok(0)

}

pub fn show() -> Result<i32> {

    let repo = open()?;

    let Some(key) = repo.config.author_key else {

        println!("No identity configured; run `oxy identity create`.");

        return Ok(0);

    };

    let id = repo.identity(&key)?;

    println!("{} <{}>", id.name, id.email);

    println!("KeyId:   {key}");

    println!("Created: {}", when(id.created));

    println!("Secret:  {}", if repo.secret_key()?.is_some() { "available" } else { "NOT FOUND in key directory" });

    println!("Signing: {}", if repo.config.sign_changes { "every change (core.sign = change)" } else { "at push via seals (core.sign = seal)" });

    Ok(0)

}

pub fn verify(change: Option<&str>) -> Result<i32> {

    let repo = open()?;

    let hashes: Vec<ChangeHash> = match change {

        Some(c) => vec![repo.resolve_change(c)?],

        None => repo.log()?.into_iter().filter(|e| !e.is_working_copy).map(|e| e.hash).collect(),

    };

    let mut bad = 0;

    for h in hashes {

        let c = repo.store().get_change(&h)?;

        let line = signature_line(&repo, &h)?;

        if line.starts_with("INVALID") {

            bad += 1;

        }

        println!("{} #{}  {line}", short_id(&c), h.short(12));

    }

    Ok(if bad > 0 { 1 } else { 0 })

}

pub fn config(key: &str, value: &str, user: bool) -> Result<i32> {

    if user {

        let path = repo::default_user_config();

        repo::Config::set_user(&path, key, value)?;

        println!("{key} = {value} (in {})", path.display());

    } else {

        let mut repo = open()?;

        repo.config.set(key, value)?;

        repo.save_config()?;

        println!("{key} = {value} (in this repository)");

    }

    Ok(0)

}

//! Command-line definitions and dispatch.

mod format;

mod identity;

mod sync;

mod workspace;

use anyhow::{Context, Result};

use clap::{Parser, Subcommand};

use oxy_core::repo::Repo;

use std::path::PathBuf;

#[derive(Parser)]

#[command(name = "oxy", version, about = "Oxygen: breathing fresh air into version control")]

struct Cli {

    #[command(subcommand)]

    cmd: Cmd,

}

#[derive(Subcommand)]

enum Cmd {

    /// Create a repository in PATH (default: current directory)

    Init { path: Option<PathBuf> },

    /// Clone a repository from a local path or an http(s) URL

    Clone { url: String, dest: Option<PathBuf> },

    /// Show the working copy: changed paths and conflicts

    Status,

    /// Record the working copy as a change on the current bookmark

    Commit {

        #[arg(short, long)]

        message: String,

        /// Extra explicit dependencies (ChangeId prefix, #hash prefix)

        #[arg(long = "depends-on")]

        depends_on: Vec<String>,

    },

    /// List changes reachable from the bookmark and the working copy

    Log,

    /// Show what the working copy changes against its base

    Diff,

    /// Show one change (ChangeId prefix, #hash prefix, or @)

    Show { change: String },

    /// Move the working copy to the state formed by CHANGE... (default: the bookmark heads)

    Checkout {

        changes: Vec<String>,

        /// Throw away uncommitted working-copy changes

        #[arg(long)]

        discard: bool,

    },

    /// Report which conflicts of the working copy's base are resolved by the current files

    Resolve,

    /// Undo the last operation

    Undo,

    /// List operations

    #[command(name = "op")]

    Op {

        #[command(subcommand)]

        cmd: OpCmd,

    },

    /// Manage remotes

    Remote {

        #[command(subcommand)]

        cmd: RemoteCmd,

    },

    /// Fetch every bookmark of a remote into its tracking references

    Fetch { remote: Option<String> },

    /// Fetch, then union the remote bookmark into the local one (no merge change)

    Pull { remote: Option<String> },

    /// Push the current bookmark to a remote

    Push {

        remote: Option<String>,

        /// Allow dropping heads the remote has

        #[arg(long)]

        force: bool,

    },

    /// Serve repositories under ROOT over HTTP (spec §16); TLS is terminated in front

    Serve {

        /// Directory with one repository per subdirectory

        #[arg(long, default_value = ".")]

        root: PathBuf,

        #[arg(long, default_value = "127.0.0.1:8890")]

        bind: String,

        /// Bearer token allowed to push (repeatable); none means open

        #[arg(long = "token")]

        tokens: Vec<String>,

    },

    /// Manage the signing identity

    Identity {

        #[command(subcommand)]

        cmd: IdentityCmd,

    },

    /// Verify the signatures on a change (default: every change in the log)

    Verify { change: Option<String> },

    /// Set a configuration key (author.*, core.sign, workspace.bookmark, remote.<name>.url|token)

    Config {

        key: String,

        value: String,

        /// Write to the user file (~/.config/oxy/config.toml) instead of this repository

        #[arg(long)]

        user: bool,

    },

}

#[derive(Subcommand)]

enum OpCmd {

    Log,

}

#[derive(Subcommand)]

enum RemoteCmd {

    Add { name: String, url: String },

    Remove { name: String },

    List,

}

#[derive(Subcommand)]

enum IdentityCmd {

    /// Generate a composite Ed25519 + ML-DSA-65 key pair and make it your author identity

    Create {

        #[arg(long)]

        name: Option<String>,

        #[arg(long)]

        email: Option<String>,

        /// Record the author in this repository only, not in the user config

        #[arg(long)]

        local: bool,

    },

    /// Show the configured identity

    Show,

}

/// Open the repository containing the current directory.

fn open() -> Result<Repo> {

    Repo::open(&std::env::current_dir()?).context("opening repository")

}

/// Parse arguments and run; returns the process exit code.

pub fn run() -> Result<i32> {

    let cli = Cli::parse();

    match cli.cmd {

        Cmd::Init { path } => workspace::init(path),

        Cmd::Status => workspace::status(),

        Cmd::Commit { message, depends_on } => workspace::commit(&message, &depends_on),

        Cmd::Log => workspace::log(),

        Cmd::Diff => workspace::diff(),

        Cmd::Show { change } => workspace::show(&change),

        Cmd::Checkout { changes, discard } => workspace::checkout(&changes, discard),

        Cmd::Resolve => workspace::resolve(),

        Cmd::Undo => workspace::undo(),

        Cmd::Op { cmd: OpCmd::Log } => workspace::op_log(),

        Cmd::Clone { url, dest } => sync::clone(&url, dest),

        Cmd::Remote { cmd } => match cmd {

            RemoteCmd::Add { name, url } => sync::remote_add(&name, &url),

            RemoteCmd::Remove { name } => sync::remote_remove(&name),

            RemoteCmd::List => sync::remote_list(),

        },

        Cmd::Fetch { remote } => sync::fetch(remote.as_deref()),

        Cmd::Pull { remote } => sync::pull(remote.as_deref()),

        Cmd::Push { remote, force } => sync::push(remote.as_deref(), force),

        Cmd::Serve { root, bind, tokens } => sync::serve(root, &bind, tokens),

        Cmd::Identity { cmd } => match cmd {

            IdentityCmd::Create { name, email, local } => identity::create(name, email, local),

            IdentityCmd::Show => identity::show(),

        },

        Cmd::Verify { change } => identity::verify(change.as_deref()),

        Cmd::Config { key, value, user } => identity::config(&key, &value, user),

    }

}

//! Commands that talk to remotes, and the reference server.

use super::format::plural;

use super::open;

use anyhow::{Context, Result};

use oxy_core::repo::Repo;

use std::path::PathBuf;

pub fn clone(url: &str, dest: Option<PathBuf>) -> Result<i32> {

    let dest = dest.unwrap_or_else(|| {

        let base = url.trim_end_matches('/').rsplit('/').next().unwrap_or("repo");

        PathBuf::from(base)

    });

    let repo = Repo::clone(url, &dest)?;

    let heads = repo.bookmark_heads()?;

    println!("Cloned into {} ({url} on {}: {})", repo.root().display(), repo.config.bookmark, plural(heads.len(), "head"));

    Ok(0)

}

pub fn remote_add(name: &str, url: &str) -> Result<i32> {

    let mut repo = open()?;

    repo.config.set(&format!("remote.{name}.url"), url)?;

    repo.save_config()?;

    println!("Added remote {name} = {url}");

    Ok(0)

}

pub fn remote_remove(name: &str) -> Result<i32> {

    let mut repo = open()?;

    repo.config.set(&format!("remote.{name}.url"), "")?;

    repo.save_config()?;

    println!("Removed remote {name}");

    Ok(0)

}

pub fn remote_list() -> Result<i32> {

    let repo = open()?;

    let view = repo.view()?;

    for (name, url) in &repo.config.remotes {

        println!("{name}\t{url}");

        if let Some(bms) = view.remotes.get(name) {

            for (bm, st) in bms {

                let heads = repo.store().get_state(st).map(|s| s.heads.len()).unwrap_or(0);

                println!("    {bm}: {}", plural(heads, "head"));

            }

        }

    }

    Ok(0)

}

fn remote_name(remote: Option<&str>) -> String {

    remote.unwrap_or("origin").to_string()

}

pub fn fetch(remote: Option<&str>) -> Result<i32> {

    let repo = open()?;

    let remote = remote_name(remote);

    for (name, heads, n) in repo.fetch(&remote)? {

        println!("{remote}/{name}: {}, {}", plural(heads.len(), "head"), plural(n, "new change"));

    }

    Ok(0)

}

pub fn pull(remote: Option<&str>) -> Result<i32> {

    let repo = open()?;

    let remote = remote_name(remote);

    let r = repo.pull(&remote)?;

    if !r.changed {

        println!("Already up to date.");

        return Ok(0);

    }

    println!(

        "{} now has {}{}",

        repo.config.bookmark,

        plural(r.heads.len(), "head"),

        if r.checked_out { "; working copy updated" } else { "; run `oxy checkout` to update the working copy" }

    );

    let snap = repo.snapshot("oxy pull")?;

    if snap.base_snapshot.is_conflicted() {

        println!("The result has conflicts; see oxy status.");

    }

    Ok(0)

}

pub fn push(remote: Option<&str>, force: bool) -> Result<i32> {

    let repo = open()?;

    let remote = remote_name(remote);

    let mut code = 0;

    for r in repo.push(&remote, force)? {

        if r.ok {

            println!("{remote}/{}: {}", r.name, if r.reason.is_empty() { "updated" } else { r.reason.as_str() });

        } else {

            println!("{remote}/{}: rejected: {}", r.name, r.reason);

            code = 1;

        }

    }

    Ok(code)

}

pub fn serve(root: PathBuf, bind: &str, tokens: Vec<String>) -> Result<i32> {

    let listener = std::net::TcpListener::bind(bind).with_context(|| format!("binding {bind}"))?;

    let root = root.canonicalize()?;

    println!(

        "Serving repositories under {} on http://{bind}/<repo>/oxy/v1/ ({})",

        root.display(),

        if tokens.is_empty() { "open: no push tokens configured" } else { "push requires a token" }

    );

    oxy_server::run_blocking(listener, oxy_server::ServerConfig { root, tokens })?;

    Ok(0)

}

//! Commands that act on the local repository and working copy.

use super::format::{deps_line, plural, short_id, signature_line, when};

use super::open;

use anyhow::Result;

use oxy_core::repo::{render_change, ChangeStatus, Repo};

use std::path::PathBuf;

pub fn init(path: Option<PathBuf>) -> Result<i32> {

    let path = path.unwrap_or(std::env::current_dir()?);

    let repo = Repo::init(&path)?;

    println!("Initialized oxy repository in {}", repo.root().display());

    println!("Bookmark: {}   Author: {} <{}>", repo.config.bookmark, repo.config.author_name, repo.config.author_email);

    Ok(0)

}

fn status_tag(s: ChangeStatus) -> &'static str {

    match s {

        ChangeStatus::Added => "A",

        ChangeStatus::Modified => "M",

        ChangeStatus::Removed => "D",

        ChangeStatus::ModeChanged => "X",

        ChangeStatus::ConflictEdited => "C!",

        ChangeStatus::Resolved => "R",

    }

}

pub fn status() -> Result<i32> {

    let repo = open()?;

    let snap = repo.snapshot("oxy status")?;

    let heads = repo.bookmark_heads()?;

    println!("Working copy: {} on {} ({})", snap.wc.change_id.short(8), repo.config.bookmark, plural(heads.len(), "head"));

    if snap.statuses.is_empty() {

        println!("The working copy is clean.");

    }

    for s in &snap.statuses {

        println!("{:2} {}", status_tag(s.status), s.path);

    }

    if !snap.base_snapshot.is_conflicted() {

        return Ok(0);

    }

    println!("\nConflicts in the base state (edit the marked files, or the .oxy-conflict-N candidates, then commit):");

    for c in &snap.base_snapshot.tree.conflicts {

        println!("  tree: {c:?}");

    }

    for (p, f) in &snap.base_snapshot.files {

        if f.is_conflicted() {

            let state = match snap.statuses.iter().find(|s| s.path == *p).map(|s| s.status) {

                Some(ChangeStatus::Resolved) => "resolved in working copy",

                Some(ChangeStatus::ConflictEdited) => "markers remain",

                _ => "unresolved",

            };

            println!("  {p}  ({state})");

        }

    }

    Ok(2)

}

pub fn commit(message: &str, depends_on: &[String]) -> Result<i32> {

    let repo = open()?;

    let mut deps = Vec::new();

    for d in depends_on {

        deps.push(repo.resolve_change(d)?);

    }

    let h = repo.commit(message, &deps)?;

    let c = repo.store().get_change(&h)?;

    println!("Committed {} #{}: {}", short_id(&c), h.short(12), message.lines().next().unwrap_or(""));

    Ok(0)

}

pub fn log() -> Result<i32> {

    let repo = open()?;

    repo.snapshot("oxy log")?;

    for e in repo.log()? {

        let c = &e.change;

        let mut flags = Vec::new();

        if e.is_working_copy {

            flags.push("working copy");

        }

        if e.is_head {

            flags.push("head");

        }

        let flags = if flags.is_empty() { String::new() } else { format!(" ({})", flags.join(", ")) };

        println!("{} #{}{}", short_id(c), e.hash.short(12), flags);

        println!("    {}", when(c.hlc.wall_ms));

        if !c.deps.is_empty() {

            println!("    deps: {}", deps_line(c));

        }

        let msg = if c.message.is_empty() { "(no description)" } else { &c.message };

        for line in msg.lines() {

            println!("    {line}");

        }

        println!();

    }

    Ok(0)

}

pub fn diff() -> Result<i32> {

    let repo = open()?;

    let snap = repo.snapshot("oxy diff")?;

    print!("{}", render_change(&snap.wc, &snap.base, &snap.base_snapshot));

    Ok(0)

}

pub fn show(change: &str) -> Result<i32> {

    let repo = open()?;

    repo.snapshot("oxy show")?;

    let h = repo.resolve_change(change)?;

    let c = repo.store().get_change(&h)?;

    println!("change {} #{}", short_id(&c), h);

    println!("kind:   {:?}", c.kind);

    println!("date:   {}", when(c.hlc.wall_ms));

    println!("deps:   {}", deps_line(&c));

    println!("sig:    {}", signature_line(&repo, &h)?);

    println!("\n{}\n", if c.message.is_empty() { "(no description)" } else { &c.message });

    print!("{}", repo.describe_change(&h)?);

    Ok(0)

}

pub fn checkout(changes: &[String], discard: bool) -> Result<i32> {

    let repo = open()?;

    let heads = if changes.is_empty() {

        repo.bookmark_heads()?

    } else {

        changes.iter().map(|c| repo.resolve_change(c)).collect::<Result<Vec<_>, _>>()?

    };

    let spec = if changes.is_empty() { repo.config.bookmark.clone() } else { changes.join(" ") };

    let r = repo.checkout(&heads, discard, &format!("oxy checkout {spec}"))?;

    println!("Working copy now on {spec}: {} written, {} removed", plural(r.written, "file"), r.removed);

    if r.conflicted {

        println!("This state has conflicts; see oxy status.");

    }

    Ok(0)

}

pub fn resolve() -> Result<i32> {

    let repo = open()?;

    let snap = repo.snapshot("oxy resolve")?;

    if !snap.base_snapshot.is_conflicted() {

        println!("The working copy's base has no conflicts.");

        return Ok(0);

    }

    let mut remaining = 0;

    for (p, f) in &snap.base_snapshot.files {

        if !f.is_conflicted() {

            continue;

        }

        match snap.statuses.iter().find(|s| s.path == *p).map(|s| s.status) {

            Some(ChangeStatus::Resolved) => println!("resolved   {p}"),

            Some(ChangeStatus::ConflictEdited) => {

                remaining += 1;

                println!("markers    {p}");

            }

            _ => {

                remaining += 1;

                println!("unresolved {p}");

            }

        }

    }

    for c in &snap.base_snapshot.tree.conflicts {

        remaining += 1;

        println!("tree       {c:?}");

    }

    if remaining == 0 {

        println!("All conflicts are resolved; `oxy commit` will record the resolution.");

        Ok(0)

    } else {

        Ok(2)

    }

}

pub fn undo() -> Result<i32> {

    let repo = open()?;

    let op = repo.undo()?;

    println!("Undid the last operation; now at: {}", op.command);

    Ok(0)

}

pub fn op_log() -> Result<i32> {

    let repo = open()?;

    for (i, (r, op)) in repo.op_log()?.into_iter().enumerate() {

        println!("{}{} {}  {}", if i == 0 { "@ " } else { "  " }, r.short(12), when(op.hlc.wall_ms), op.command);

    }

    Ok(0)

}

/// Effective settings: defaults, then the user file (`~/.config/oxy/config.toml`,

/// spec §19), then the repository file (`.oxy/config`). Both files are

/// `key = "value"` lines. `save` writes only the repository layer.

    /// Keys set in the repository file (or via `set`), written by `save`.

    repo_layer: BTreeMap<String, String>,

            repo_layer: BTreeMap::new(),

    /// Set a key in the repository layer, as `oxy config` does.

        self.apply(key, value)?;

        if value.is_empty() {

            self.repo_layer.remove(key);

        } else {

            self.repo_layer.insert(key.to_string(), value.to_string());

        }

        Ok(())

    }

    /// Set a key in the user file without touching any repository.

    pub fn set_user(user_path: &Path, key: &str, value: &str) -> Result<()> {

        Config::default_for_user().apply(key, value)?;

        let mut entries = read_config_file(user_path)?;

        if value.is_empty() {

            entries.remove(key);

        } else {

            entries.insert(key.to_string(), value.to_string());

        }

        if let Some(parent) = user_path.parent() {

            fs::create_dir_all(parent)?;

        }

        write_config_file(user_path, &entries)

    }

    /// Apply a key to the effective values.

    fn apply(&mut self, key: &str, value: &str) -> Result<()> {

    /// Defaults, then the user file if it exists, then the repository file.

    fn load(user_path: Option<&Path>, repo_path: &Path) -> Result<Config> {

        if let Some(u) = user_path {

            for (k, v) in read_config_file(u)? {

                let _ = c.apply(&k, &v);

        for (k, v) in read_config_file(repo_path)? {

            if c.apply(&k, &v).is_ok() {

                c.repo_layer.insert(k, v);

            }

        }

        write_config_file(path, &self.repo_layer)

    }

    /// Keys explicitly set for this repository.

    pub fn repo_layer(&self) -> &BTreeMap<String, String> {

        &self.repo_layer

    }

}

/// Read `key = "value"` lines; a missing file is empty.

pub fn read_config_file(path: &Path) -> Result<BTreeMap<String, String>> {

    let text = match fs::read_to_string(path) {

        Ok(t) => t,

        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(BTreeMap::new()),

        Err(e) => return Err(e.into()),

    };

    let mut out = BTreeMap::new();

    for line in text.lines() {

        let line = line.trim();

        if line.is_empty() || line.starts_with('#') {

            continue;

        let Some((k, v)) = line.split_once('=') else { continue };

        out.insert(k.trim().to_string(), v.trim().trim_matches('"').to_string());

    Ok(out)

}

fn write_config_file(path: &Path, entries: &BTreeMap<String, String>) -> Result<()> {

    let text: String = entries.iter().map(|(k, v)| format!("{k} = \"{v}\"\n")).collect();

    write_atomic(path, text.as_bytes())

}

impl Config {

    user_config: PathBuf,

/// The user's oxy directory: `$OXY_HOME`, else `$XDG_CONFIG_HOME/oxy`, else

/// `~/.config/oxy`. It holds `config.toml` (spec §19) and `keys/`.

pub fn default_home() -> PathBuf {

        return PathBuf::from(h);

        return PathBuf::from(x).join("oxy");

    PathBuf::from(home).join(".config").join("oxy")

}

pub fn default_keys_dir() -> PathBuf {

    default_home().join("keys")

}

pub fn default_user_config() -> PathBuf {

    default_home().join("config.toml")

}

/// Where `create_identity` records the author.

#[derive(Clone, Copy, Debug, PartialEq, Eq)]

pub enum IdentityScope {

    /// The user file: every repository of this user signs with it.

    User,

    /// This repository only.

    Repo,

        let config = Config::load(Some(&default_user_config()), &oxy.join("config"))?;

        let repo = Repo { root, oxy, store, workspace, keys_dir: default_keys_dir(), user_config: default_user_config(), config };

                let config = Config::load(Some(&default_user_config()), &oxy.join("config"))?;

                let repo = Repo { root: d.to_path_buf(), oxy, store, workspace, keys_dir: default_keys_dir(), user_config: default_user_config(), config };

    /// Use a different user directory for keys and the user config file

    /// (tests, or `$OXY_HOME`). Reloads the effective configuration.

    pub fn with_home(mut self, dir: impl Into<PathBuf>) -> Repo {

        let dir = dir.into();

        self.keys_dir = dir.join("keys");

        self.user_config = dir.join("config.toml");

        if let Ok(c) = Config::load(Some(&self.user_config), &self.oxy.join("config")) {

            self.config = c;

        }

    pub fn user_config_path(&self) -> &Path {

        &self.user_config

    }

    /// Set a key in the user file and refresh the effective configuration.

    pub fn set_user_config(&mut self, key: &str, value: &str) -> Result<()> {

        Config::set_user(&self.user_config, key, value)?;

        self.config = Config::load(Some(&self.user_config), &self.oxy.join("config"))?;

        Ok(())

    }

    /// secret in the key directory, and record the author at `scope`.

    pub fn create_identity(&mut self, name: &str, email: &str, scope: IdentityScope) -> Result<(KeyId, Identity)> {

        write_atomic(&self.keys_dir.join(format!("{}.identity", key.to_hex())), &id.encode())?;

        match scope {

            IdentityScope::Repo => {

                self.config.set("author.name", name)?;

                self.config.set("author.email", email)?;

                self.config.set("author.key", &key.to_hex())?;

                self.save_config()?;

            }

            IdentityScope::User => {

                Config::set_user(&self.user_config, "author.name", name)?;

                Config::set_user(&self.user_config, "author.email", email)?;

                Config::set_user(&self.user_config, "author.key", &key.to_hex())?;

                self.config = Config::load(Some(&self.user_config), &self.oxy.join("config"))?;

            }

        }

    /// The identity object is kept beside the secret so a repository that has

    /// never seen it (a fresh clone) can store it when it first signs.

                if !self.store.has(&key) {

                    let id_path = self.keys_dir.join(format!("{}.identity", key.to_hex()));

                    if let Ok(bytes) = fs::read(&id_path) {

                        let id = Identity::decode(&bytes)?;

                        if id.hash() == key {

                            self.store.put_identity(&id)?;

                        }

                    }

                }

        repo.config.set("remote.origin.url", url)?;

        let mut repo = Repo::init(root).unwrap().with_home(root.join("home"));

        let (key, id) = repo.create_identity("Ada", "[email protected]", IdentityScope::Repo).unwrap();

        let reopened = Repo::open(root).unwrap().with_home(root.join("home"));

        let no_keys = Repo::open(root).unwrap().with_home(root.join("nowhere"));

        let mut a = Repo::clone(&origin_url, &root.join("a")).unwrap().with_home(root.join("home-a"));

        let (key_a, _) = a.create_identity("Ada", "[email protected]", IdentityScope::Repo).unwrap();

        let mut a = Repo::clone(&url, &root.join("a")).unwrap().with_home(root.join("home"));

        let (key, _) = a.create_identity("Ada", "a@b", IdentityScope::Repo).unwrap();

    fn user_config_supplies_defaults_and_clones_sign() {

        let dir = tempfile::tempdir().unwrap();

        let root = dir.path();

        let home = root.join("home");

        let origin = Repo::init(&root.join("origin")).unwrap();

        let url = root.join("origin").to_string_lossy().to_string();

        // Identity at user scope: the repository file stays free of author keys.

        let mut a = Repo::init(&root.join("a")).unwrap().with_home(&home);

        let (key, _) = a.create_identity("Ada", "[email protected]", IdentityScope::User).unwrap();

        assert!(!a.config.repo_layer().contains_key("author.key"));

        assert_eq!(a.config.author_key, Some(key));

        assert!(home.join("config.toml").exists());

        a.set_user_config("core.sign", "change").unwrap();

        assert!(a.config.sign_changes);

        // Repository settings override user settings and are the only ones saved.

        a.config.set("core.sign", "seal").unwrap();

        a.save_config().unwrap();

        let again = Repo::open(&root.join("a")).unwrap().with_home(&home);

        assert!(!again.config.sign_changes);

        assert_eq!(again.config.author_key, Some(key));

        assert_eq!(read_config_file(&root.join("a/.oxy/config")).unwrap().get("core.sign").map(String::as_str), Some("seal"));

        // A fresh clone made by this user signs with the user-level identity,

        // even though the clone's store has never seen the identity object.

        let b = Repo::clone(&url, &root.join("b")).unwrap().with_home(&home);

        assert!(b.config.sign_changes);

        write(&root.join("b"), "f.txt", b"f\n");

        let h = b.commit("signed from a clone", &[]).unwrap();

        assert!(matches!(b.verify_change(&h).unwrap(), SignatureStatus::Valid { key: k, .. } if k == key));

        assert!(b.push("origin", false).unwrap()[0].ok);

        assert!(matches!(origin.verify_change(&h).unwrap(), SignatureStatus::Valid { .. }));

    }

    #[test]

    let mut a = Repo::clone(&url, &root.join("a")).unwrap().with_home(root.join("home"));

    let (key, _) = a.create_identity("Ada", "[email protected]", oxy_core::repo::IdentityScope::Repo).unwrap();

| **Status** | Draft 0.5b |

| `~/.config/oxy/config.toml` | User settings, the same keys as `.oxy/config`: `author.name`, `author.email`, `author.key`, `core.sign`, and `remote.<name>.token`. Overridden by `$OXY_HOME/config.toml` when `$OXY_HOME` is set. |

Settings resolve in order: the repository file overrides the user file, which overrides environment variables (`OXY_AUTHOR_NAME`, `OXY_AUTHOR_EMAIL`, `OXY_TOKEN`) and built-in defaults. `oxy config` writes the repository file; `oxy config --user` writes the user file. Secret keys live beside the user file in `keys/`, one `<KeyId>.secret` and one `<KeyId>.identity` per key, so any repository the user works in can store the identity object when it first signs.

*Changelog.* Draft 0.5b (2026-09-26): §19 defines the user configuration file's keys, the precedence of repository over user over environment, and the key directory layout.

Draft 0.5a (2026-09-26): §15.1 allows a reference server behind TLS termination and requires authenticated pushes when credentials exist; §16.3 defines the CBOR message encodings (push validation moves to §16.4).

//!

//! Command definitions and dispatch live in `cli`; each command group has

//! its own module there.

mod cli;

    match cli::run() {