feat(lanes): git login from the dashboard, merge and conflict resolution (#45)

Part A — a fetch/pull/push against a remote that needs a login no longer
dies on "terminal prompts disabled": the server answers 409 EGITAUTH with
the host, the git bar asks for a username + password/access token and
resends the same action. AgentHub keeps its OWN credential store
(<CLAUDE_HOME>/agenthub-git-credentials/, 0700/0600), one login per host,
shared by every user of the install, managed from Settings -> Git
credentials. A login is only sent to one of the repo's own remote hosts,
saved only after git accepted it, never returned by any route, and reaches
git through an exclusive credential helper (never argv).

Part B — merge a branch (or the diverged upstream) from the git bar; a
merge that stops on conflicts lists them in the Changes panel with Keep
mine / Take theirs / Mark resolved, then Complete merge or Abort merge
(confirm gate). Clean tree, repo-root lane and an existing ref only;
pull/switch/hunk actions are blocked mid-merge; staging a conflicted file
with markers left is refused. Rebase/reset/stash stay out.

client/src/components/lanes/LaneGitBar.tsx

@@ -1,7 +1,9 @@
 /**
  * @file The lane's git action row: ahead/behind against the upstream, and the
  * writes `POST /api/lanes/:id/git/:action` offers that are not per-file —
- * fetch, pull, push, switch branch, and create/delete a branch. Committing is
+ * fetch, pull, push, switch branch, create/delete a branch, and start a merge
+ * (the picked branch, or the upstream once diverged; resolving it is the
+ * Changes panel's job). Committing is
  * NOT here: it is the Changes panel's staged-only commit box, beside the
  * per-file stage/unstage/discard it commits — one way to commit, and it only
  * ever takes what the user staged.
@@ -12,17 +14,32 @@
  * Nothing here decides what an action may do; the server does (pull is always
  * --ff-only, switch refuses a dirty tree), and this only reports what it said.
  * Failures print git's own text, because "! [rejected] non-fast-forward" tells
- * the user more than any sentence this file could write.
+ * the user more than any sentence this file could write. The one exception
+ * is `EGITAUTH` (issue #45): the dashboard's git has no terminal to prompt
+ * in, so a remote wanting a login opens a form here and the SAME action is
+ * resent with the typed credential — the token is never rendered back.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
 import { useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
-import { ArrowDown, ArrowUp, GitBranch, Plus, RefreshCw, Trash2, Upload } from "lucide-react";
-import { api } from "../../lib/api";
+import {
+  ArrowDown,
+  ArrowUp,
+  GitBranch,
+  GitMerge,
+  Plus,
+  RefreshCw,
+  Trash2,
+  Upload,
+} from "lucide-react";
+import { api, type GitAuthNeeded } from "../../lib/api";
 import type { LaneGitFacts, LaneWorktree } from "../../lib/types";
 
-type Action = "fetch" | "pull" | "push" | "switch" | "branch-create" | "branch-delete";
+type Action = "fetch" | "pull" | "push" | "switch" | "branch-create" | "branch-delete" | "merge";
+type RunBody = Parameters<typeof api.lanes.gitAction>[2];
+
+const LOCAL_HOST = /^(localhost|127\.|\[::1\])/;
 
 function Btn({
   label,
@@ -85,6 +102,11 @@ export function LaneGitBar({
   const [worktrees, setWorktrees] = useState<LaneWorktree[]>([]);
   const [picked, setPicked] = useState("");
   const [newBranch, setNewBranch] = useState("");
+  // Set when git needed a login for `action`; the form resends that action.
+  const [login, setLogin] = useState<{ action: Action; auth: GitAuthNeeded } | null>(null);
+  const [username, setUsername] = useState("");
+  const [password, setPassword] = useState("");
+  const [remember, setRemember] = useState(true);
   // The Changes panel is not keyed by lane, so this bar outlives a lane switch.
   // All of the state above describes ONE lane — a branch picked for lane A,
   // applied after switching, would move B's HEAD — so it is reset during
@@ -102,6 +124,8 @@ export function LaneGitBar({
     setWorktrees([]);
     setPicked("");
     setNewBranch("");
+    setLogin(null);
+    setPassword("");
     inFlight.current = false;
   }
   const laneNow = useRef(laneId);
@@ -109,18 +133,25 @@ export function LaneGitBar({
 
   if (!git.available) return null;
   const dirty = git.dirty + git.untracked;
+  const merging = !!git.merging;
 
-  const run = async (action: Action, body?: { branch?: string }) => {
+  const run = async (action: Action, body?: RunBody) => {
     if (inFlight.current) return;
     inFlight.current = true;
     const lane = laneId;
     setBusy(action);
     setError(null);
     try {
-      await api.lanes.gitAction(lane, action, body || {});
+      const res = await api.lanes.gitAction(lane, action, body || {});
       // Landed after a lane switch: every write below belongs to the lane
       // no longer shown.
       if (laneNow.current !== lane) return;
+      // A merge that stopped on conflicts still succeeded in starting; the
+      // Changes panel below lists the files to resolve.
+      if (res?.conflicts?.length)
+        setError(t("gitBar.mergeConflicts", { count: res.conflicts.length }));
+      setLogin(null);
+      setPassword("");
       // The branch list this bar is showing is stale the moment a branch is
       // created, deleted or switched to, so it is re-read rather than patched.
       if (action === "switch" || action.startsWith("branch-")) {
@@ -136,7 +167,12 @@ export function LaneGitBar({
       // rejection text verbatim — hence the <pre> below rather than a line.
       // ENOREMOTE is the one refusal with no git text to show: the server's
       // sentence is English and says less than a translated one.
-      if (laneNow.current === lane)
+      const auth = (err as { code?: string; auth?: GitAuthNeeded })?.auth;
+      if (laneNow.current === lane && (err as { code?: string })?.code === "EGITAUTH" && auth) {
+        setLogin({ action, auth });
+        setUsername((u) => u || auth.username || "");
+        setPassword("");
+      } else if (laneNow.current === lane)
         setError(
           (err as { code?: string })?.code === "ENOREMOTE"
             ? t("gitBar.errNoRemote")
@@ -170,6 +206,11 @@ export function LaneGitBar({
     await refreshBranches();
   };
 
+  const merge = (branch: string) => {
+    if (!window.confirm(t("gitBar.mergeConfirm", { branch, current: git.branch }))) return;
+    void run("merge", { branch });
+  };
+
   const heldBy = new Map(
     worktrees.filter((w) => w.branch).map((w) => [w.branch as string, w.path])
   );
@@ -211,6 +252,18 @@ export function LaneGitBar({
           )
         )}
 
+        {/* Diverged: a --ff-only pull can only refuse, so offer the merge. */}
+        {git.upstream && (git.ahead ?? 0) > 0 && (git.behind ?? 0) > 0 && !merging && (
+          <Btn
+            label={t("gitBar.mergeUpstream", { upstream: git.upstream })}
+            icon={<GitMerge className="h-3 w-3" />}
+            busy={busy === "merge"}
+            disabled={!!busy || dirty > 0}
+            title={dirty > 0 ? t("gitBar.switchDirty") : t("gitBar.mergeUpstreamHint")}
+            onClick={() => merge(git.upstream as string)}
+          />
+        )}
+
         <div className="ml-auto flex shrink-0 items-center">
           <Btn
             compact
@@ -226,8 +279,8 @@ export function LaneGitBar({
             label={t("gitBar.pull")}
             icon={<ArrowDown className="h-3.5 w-3.5" />}
             busy={busy === "pull"}
-            disabled={!git.hasRemote || !!busy}
-            title={t("gitBar.pullHint")}
+            disabled={!git.hasRemote || !!busy || merging}
+            title={merging ? t("gitBar.merging") : t("gitBar.pullHint")}
             onClick={() => run("pull")}
           />
           <Btn
@@ -243,10 +296,16 @@ export function LaneGitBar({
             compact
             label={t("gitBar.switch")}
             icon={<GitBranch className="h-3.5 w-3.5" />}
-            disabled={!!busy}
+            disabled={!!busy || merging}
             // A dirty tree is refused server-side; saying so before the click
             // beats a red box after it.
-            title={dirty > 0 ? t("gitBar.switchDirty") : t("gitBar.switchHint")}
+            title={
+              merging
+                ? t("gitBar.merging")
+                : dirty > 0
+                  ? t("gitBar.switchDirty")
+                  : t("gitBar.switchHint")
+            }
             onClick={openSwitch}
           />
         </div>
@@ -281,6 +340,14 @@ export function LaneGitBar({
             title={dirty > 0 ? t("gitBar.switchDirty") : t("gitBar.switchHint")}
             onClick={() => void run("switch", { branch: picked })}
           />
+          <Btn
+            label={t("gitBar.merge")}
+            icon={<GitMerge className="h-3 w-3" />}
+            busy={busy === "merge"}
+            disabled={!picked || picked === git.branch || dirty > 0 || !!busy}
+            title={dirty > 0 ? t("gitBar.switchDirty") : t("gitBar.mergeHint")}
+            onClick={() => merge(picked)}
+          />
           {onNewLane && (
             <Btn
               label={t("gitBar.newLane")}
@@ -339,6 +406,77 @@ export function LaneGitBar({
         </div>
       )}
 
+      {login && (
+        <form
+          data-testid="lane-git-login"
+          className="space-y-1.5 rounded border border-border-light bg-surface-1 p-2 text-[11px]"
+          onSubmit={(e) => {
+            e.preventDefault();
+            const { protocol, host } = login.auth;
+            void run(login.action, {
+              credentials: { protocol, host, username: username.trim(), password, remember },
+            });
+          }}
+        >
+          <p className="font-medium text-fg-primary">
+            {t("gitBar.loginTitle", { host: login.auth.host })}
+          </p>
+          {login.auth.rejected && (
+            <p role="alert" className="text-status-danger">
+              {t("gitBar.loginRejected")}
+            </p>
+          )}
+          <div className="flex gap-1.5">
+            <input
+              aria-label={t("gitBar.loginUser")}
+              placeholder={t("gitBar.loginUser")}
+              autoComplete="username"
+              value={username}
+              onChange={(e) => setUsername(e.target.value)}
+              className="min-w-0 flex-1 rounded border border-border-light bg-surface-0 px-2 py-0.5 text-fg-primary placeholder:text-fg-muted focus:border-accent focus:outline-none"
+            />
+            <input
+              type="password"
+              aria-label={t("gitBar.loginPassword")}
+              placeholder={t("gitBar.loginPassword")}
+              autoComplete="current-password"
+              value={password}
+              onChange={(e) => setPassword(e.target.value)}
+              className="min-w-0 flex-1 rounded border border-border-light bg-surface-0 px-2 py-0.5 text-fg-primary placeholder:text-fg-muted focus:border-accent focus:outline-none"
+            />
+          </div>
+          <label className="flex items-center gap-1.5 text-fg-secondary">
+            <input
+              type="checkbox"
+              checked={remember}
+              onChange={(e) => setRemember(e.target.checked)}
+            />
+            {t("gitBar.loginRemember")}
+          </label>
+          <p className="text-[10px] text-fg-muted">{t("gitBar.loginTokenHint")}</p>
+          {/* The token crosses the network in the clear on a plain-http LAN address. */}
+          {location.protocol === "http:" && !LOCAL_HOST.test(location.hostname) && (
+            <p className="text-[10px] text-status-warning">{t("gitBar.loginInsecure")}</p>
+          )}
+          <div className="flex gap-1.5">
+            <button
+              type="submit"
+              disabled={!username.trim() || !password || !!busy}
+              className="rounded border border-accent/40 bg-accent/15 px-2 py-0.5 text-accent hover:bg-accent/25 disabled:cursor-not-allowed disabled:opacity-40"
+            >
+              {t("gitBar.loginSubmit")}
+            </button>
+            <Btn
+              label={t("gitBar.loginCancel")}
+              onClick={() => {
+                setLogin(null);
+                setPassword("");
+              }}
+            />
+          </div>
+        </form>
+      )}
+
       {error && (
         <pre
           role="alert"