feat(lanes): git login from the dashboard, merge and conflict resolution (#45)

Part A — a fetch/pull/push against a remote that needs a login no longer
dies on "terminal prompts disabled": the server answers 409 EGITAUTH with
the host, the git bar asks for a username + password/access token and
resends the same action. AgentHub keeps its OWN credential store
(<CLAUDE_HOME>/agenthub-git-credentials/, 0700/0600), one login per host,
shared by every user of the install, managed from Settings -> Git
credentials. A login is only sent to one of the repo's own remote hosts,
saved only after git accepted it, never returned by any route, and reaches
git through an exclusive credential helper (never argv).

Part B — merge a branch (or the diverged upstream) from the git bar; a
merge that stops on conflicts lists them in the Changes panel with Keep
mine / Take theirs / Mark resolved, then Complete merge or Abort merge
(confirm gate). Clean tree, repo-root lane and an existing ref only;
pull/switch/hunk actions are blocked mid-merge; staging a conflicted file
with markers left is refused. Rebase/reset/stash stay out.

client/src/components/lanes/__tests__/LaneChangesPanel.test.tsx

@@ -1245,3 +1245,82 @@ describe("LaneChangesPanel", () => {
     expect(screen.getByRole("button", { name: "Expand all folders" })).toBeEnabled();
   });
 });
+
+describe("a merge in progress (issue #45)", () => {
+  const merging = (conflicts: number) => ({
+    available: true as const,
+    branch: "main",
+    head: "abc1234",
+    subject: "main",
+    dirty: 1,
+    untracked: 0,
+    files: [],
+    hasRemote: false,
+    upstream: null,
+    ahead: null,
+    behind: null,
+    merging: true,
+    conflicts,
+  });
+  const conflicted = changes({
+    files: [
+      {
+        path: "a.txt",
+        status: "UU",
+        untracked: false,
+        staged: true,
+        unstaged: true,
+        conflicted: true,
+        added: 3,
+        deleted: 0,
+        binary: false,
+      },
+      {
+        path: "b.txt",
+        status: "A ",
+        untracked: false,
+        staged: true,
+        added: 1,
+        deleted: 0,
+        binary: false,
+      },
+    ],
+  });
+
+  it("lists conflicts on their own, resolves one side, and blocks the commit until none are left", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValue(merging(1));
+    vi.mocked(api.lanes.changes).mockResolvedValue(conflicted);
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={3} />);
+
+    const group = await screen.findByTestId("lane-changes-conflicts");
+    expect(within(group).getByText("a.txt")).toBeInTheDocument();
+    // Not offered as an ordinary stage: that would mark it resolved blind.
+    expect(screen.getAllByText("a.txt")).toHaveLength(1);
+    expect(screen.getByRole("button", { name: "Complete merge" })).toBeDisabled();
+
+    await user.click(within(group).getByRole("button", { name: "Take theirs" }));
+    await waitFor(() =>
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "resolve", {
+        path: "a.txt",
+        side: "theirs",
+      })
+    );
+  });
+
+  it("completes the merge once nothing is conflicted, and aborts only on a second click", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValue(merging(0));
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={3} />);
+
+    await user.click(await screen.findByRole("button", { name: "Complete merge" }));
+    await waitFor(() => expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "merge-commit", {}));
+
+    await user.click(screen.getByRole("button", { name: "Abort merge" }));
+    expect(api.lanes.gitAction).not.toHaveBeenCalledWith(3, "merge-abort", expect.anything());
+    await user.click(screen.getByRole("button", { name: "Click again to abort the merge" }));
+    await waitFor(() =>
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "merge-abort", { confirm: true })
+    );
+  });
+});

client/src/components/lanes/__tests__/LaneGitBar.test.tsx

@@ -255,3 +255,91 @@ describe("LaneGitBar", () => {
     );
   });
 });
+
+describe("git login (issue #45)", () => {
+  const authErr = (rejected = false) =>
+    Object.assign(new Error("git.smartgift.io.vn needs a username and password or access token"), {
+      code: "EGITAUTH",
+      auth: { protocol: "https", host: "git.smartgift.io.vn", username: "vi", rejected },
+    });
+
+  it("asks for a login when git needs one, then resends the same action with it", async () => {
+    vi.mocked(api.lanes.gitAction).mockRejectedValueOnce(authErr());
+    const user = userEvent.setup();
+    const onChanged = vi.fn();
+    render(<LaneGitBar laneId={3} git={facts()} onChanged={onChanged} />);
+
+    await user.click(screen.getByRole("button", { name: /Push/ }));
+    const form = await screen.findByTestId("lane-git-login");
+    expect(form).toHaveTextContent("git.smartgift.io.vn");
+    expect(screen.getByLabelText("Username")).toHaveValue("vi");
+    expect(screen.getByLabelText(/Remember for everyone/)).toBeChecked();
+    await user.type(screen.getByLabelText("Password or access token"), "s3cret");
+    await user.click(screen.getByRole("button", { name: "Log in and retry" }));
+
+    await waitFor(() =>
+      expect(api.lanes.gitAction).toHaveBeenLastCalledWith(3, "push", {
+        credentials: {
+          protocol: "https",
+          host: "git.smartgift.io.vn",
+          username: "vi",
+          password: "s3cret",
+          remember: true,
+        },
+      })
+    );
+    await waitFor(() => expect(screen.queryByTestId("lane-git-login")).toBeNull());
+    expect(onChanged).toHaveBeenCalled();
+    expect(document.body.textContent).not.toContain("s3cret");
+  });
+
+  it("says the login was wrong when the host rejected it, and keeps the form", async () => {
+    vi.mocked(api.lanes.gitAction)
+      .mockRejectedValueOnce(authErr())
+      .mockRejectedValueOnce(authErr(true));
+    const user = userEvent.setup();
+    render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: /Fetch/ }));
+    await user.type(await screen.findByLabelText("Password or access token"), "bad");
+    await user.click(screen.getByRole("button", { name: "Log in and retry" }));
+    expect(await screen.findByTestId("lane-git-login")).toHaveTextContent(/rejected/i);
+    expect(screen.getByLabelText("Password or access token")).toHaveValue("");
+  });
+});
+
+describe("merge (issue #45)", () => {
+  it("merges the picked branch into the current one after a confirm", async () => {
+    const confirm = vi.spyOn(window, "confirm").mockReturnValue(true);
+    const user = userEvent.setup();
+    render(<LaneGitBar laneId={3} git={facts({ dirty: 0, untracked: 0 })} onChanged={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: /Branch/ }));
+    await user.selectOptions(await screen.findByLabelText("Switch branch…"), "development");
+    await user.click(screen.getByRole("button", { name: "Merge into current" }));
+    await waitFor(() =>
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "merge", { branch: "development" })
+    );
+    confirm.mockRestore();
+  });
+
+  it("offers to merge the upstream when the branch has diverged", async () => {
+    vi.spyOn(window, "confirm").mockReturnValue(true);
+    const user = userEvent.setup();
+    render(<LaneGitBar laneId={3} git={facts({ dirty: 0, untracked: 0 })} onChanged={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: "Merge origin/feat/thing" }));
+    await waitFor(() =>
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "merge", { branch: "origin/feat/thing" })
+    );
+  });
+
+  it("disables pull and switch while a merge is in progress", () => {
+    render(
+      <LaneGitBar
+        laneId={3}
+        git={{ ...facts(), merging: true, conflicts: 1 } as LaneGitFacts}
+        onChanged={vi.fn()}
+      />
+    );
+    expect(screen.getByRole("button", { name: /Pull/ })).toBeDisabled();
+    expect(screen.getByRole("button", { name: /Branch/ })).toBeDisabled();
+  });
+});