feat: add remote SSH git repository management

.github/workflows/auto-merge-release.yml

@@ -1,31 +1,62 @@
 name: Auto-merge release-please PR
 
 on:
-  pull_request:
+  # Triggers after the Release workflow completes on main.
+  # workflow_run always runs in the default-branch context, so it is never
+  # blocked by the "first-time contributor" approval gate.
+  workflow_run:
+    workflows: ["Release"]
+    types: [completed]
     branches: [main]
-    types: [opened, synchronize, reopened]
 
 permissions:
   contents: write
   pull-requests: write
 
 jobs:
   auto-merge:
-    # Only run on release-please PRs
-    if: github.actor == 'github-actions[bot]' && startsWith(github.head_ref, 'release-please--')
     runs-on: macos-26
+    # Only proceed when the Release workflow succeeded
+    if: github.event.workflow_run.conclusion == 'success'
     steps:
+      - name: Find open release-please PR
+        id: find-pr
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR_NUMBER=$(gh pr list \
+            --repo "${{ github.repository }}" \
+            --head "release-please--branches--main" \
+            --state open \
+            --json number \
+            --jq '.[0].number // empty')
+
+          if [[ -z "${PR_NUMBER}" ]]; then
+            echo "No open release-please PR found; nothing to do."
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "Found release-please PR #${PR_NUMBER}"
+            echo "found=true" >> "$GITHUB_OUTPUT"
+            echo "number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+          fi
+
       - uses: actions/checkout@v4
+        if: steps.find-pr.outputs.found == 'true'
+        with:
+          ref: release-please--branches--main
 
       - name: Build
+        if: steps.find-pr.outputs.found == 'true'
         run: swift build
 
       - name: Run tests
+        if: steps.find-pr.outputs.found == 'true'
         run: swift run GitKitChecks
 
       - name: Approve and auto-merge
+        if: steps.find-pr.outputs.found == 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh pr review "${{ github.event.pull_request.number }}" --approve
-          gh pr merge "${{ github.event.pull_request.number }}" --squash --auto
+          gh pr review "${{ steps.find-pr.outputs.number }}" --approve
+          gh pr merge "${{ steps.find-pr.outputs.number }}" --squash --auto

.github/workflows/release.yml

@@ -22,6 +22,7 @@ jobs:
         id: release
         with:
           release-type: simple
+          token: ${{ secrets.RELEASE_TOKEN }}
 
   build:
     needs: release-please

Sources/GitKit/CLIGitService.swift

@@ -9,10 +9,10 @@ private let recordSeparator = "\u{1e}" // between records
 /// `GitService` backed by the user's installed `git` binary.
 public struct CLIGitService: GitService {
     public let root: URL
-    private let runner: GitRunner
+    private let runner: any GitRunnerProtocol
 
-    /// Creates a service rooted at `directory`. Resolves to the repository top-level so
-    /// that all paths are reported relative to a stable root.
+    /// Creates a service rooted at a local `directory`. Resolves to the repository
+    /// top-level so that all paths are reported relative to a stable root.
     public init(directory: URL, executablePath: String? = nil) async throws {
         let probe = GitRunner(workingDirectory: directory, executablePath: executablePath)
         let result = try await probe.runRaw(["rev-parse", "--show-toplevel"])
@@ -24,6 +24,17 @@ public struct CLIGitService: GitService {
         self.runner = GitRunner(workingDirectory: self.root, executablePath: executablePath)
     }
 
+    /// Creates a service for a remote repository accessed over SSH.
+    public init(sshRunner: SSHGitRunner) async throws {
+        let result = try await sshRunner.runRaw(["rev-parse", "--show-toplevel"])
+        guard result.succeeded else {
+            throw GitError.notARepository(sshRunner.remotePath)
+        }
+        let top = result.stdoutString.trimmingCharacters(in: .whitespacesAndNewlines)
+        self.root = URL(fileURLWithPath: top)
+        self.runner = sshRunner
+    }
+
     /// Discovers the repository top-level for an arbitrary path, returning nil if none.
     public static func repositoryRoot(for directory: URL, executablePath: String? = nil) async -> URL? {
         let probe = GitRunner(workingDirectory: directory, executablePath: executablePath)

Sources/GitKit/GitRunner.swift

@@ -32,7 +32,7 @@ private final class CaptureBox: @unchecked Sendable {
 ///
 /// An actor enforces one mutating invocation at a time per repository, avoiding
 /// `index.lock` contention while still allowing concurrency across repositories.
-public actor GitRunner {
+public actor GitRunner: GitRunnerProtocol {
     /// Working directory for invocations. `nil` for repo-independent commands (e.g. clone, version).
     public let workingDirectory: URL?
     private let executableURL: URL

Sources/GitKit/GitRunnerProtocol.swift

@@ -0,0 +1,36 @@
+import Foundation
+
+/// Abstraction over local and SSH-based git command execution.
+///
+/// Both `GitRunner` (local) and `SSHGitRunner` (remote) conform to this protocol,
+/// allowing `CLIGitService` to execute git commands transparently against either.
+public protocol GitRunnerProtocol: Actor {
+    /// Working directory for the repository. For local runners this is a filesystem URL;
+    /// for SSH runners it\u{2019}s a synthetic URL representing the remote path.
+    var workingDirectory: URL? { get }
+
+    /// Runs `git <arguments>` and returns the result without throwing on non-zero exit.
+    func runRaw(_ arguments: [String]) async throws -> GitProcessResult
+
+    /// Runs `git <arguments>`, throwing on non-zero exit. Returns stdout as `Data`.
+    @discardableResult
+    func run(_ arguments: [String]) async throws -> Data
+
+    /// Runs `git <arguments>`, throwing on non-zero exit. Returns stdout as a string.
+    func runString(_ arguments: [String]) async throws -> String
+
+    /// Runs `git <arguments>`, streaming stderr progress lines to `onProgress`.
+    /// Throws on non-zero exit.
+    @discardableResult
+    func runStreaming(
+        _ arguments: [String],
+        onProgress: (@Sendable (String) -> Void)?
+    ) async throws -> GitProcessResult
+}
+
+public extension GitRunnerProtocol {
+    @discardableResult
+    func runStreaming(_ arguments: [String]) async throws -> GitProcessResult {
+        try await runStreaming(arguments, onProgress: nil)
+    }
+}

Sources/GitKit/Models/FileStatus.swift

@@ -57,8 +57,14 @@ public struct WorkingTreeStatus: Sendable {
     public let isDetached: Bool
     public let files: [FileStatus]
 
-    public var stagedFiles: [FileStatus] { files.filter(\.isStaged) }
-    public var unstagedFiles: [FileStatus] { files.filter { $0.hasUnstagedChanges || $0.isUntracked } }
+    /// Conflicted (unmerged) files. Surfaced separately so they don't masquerade as ordinary
+    /// staged/unstaged edits — an unmerged entry reports both an index and a worktree state.
+    public var conflictedFiles: [FileStatus] { files.filter(\.isConflicted) }
+    public var stagedFiles: [FileStatus] { files.filter { $0.isStaged && !$0.isConflicted } }
+    public var unstagedFiles: [FileStatus] {
+        files.filter { !$0.isConflicted && ($0.hasUnstagedChanges || $0.isUntracked) }
+    }
+    public var hasConflicts: Bool { files.contains(where: \.isConflicted) }
     public var hasChanges: Bool { !files.isEmpty }
 
     public init(

Sources/GitKit/RepositoryWatcher.swift

@@ -1,9 +1,15 @@
 import Foundation
 
+/// Common interface for local (FSEvents) and remote (SSH polling) repository watchers.
+public protocol RepositoryWatching: AnyObject, Sendable {
+    func start()
+    func stop()
+}
+
 /// Watches a repository's working tree (and its `.git` directory) with FSEvents, invoking
 /// `onChange` when anything changes on disk. Events are coalesced by FSEvents' latency
 /// window; callers should debounce further before doing expensive work.
-public final class RepositoryWatcher: @unchecked Sendable {
+public final class RepositoryWatcher: RepositoryWatching, @unchecked Sendable {
     private let path: String
     private let onChange: @Sendable () -> Void
     private let queue = DispatchQueue(label: "com.gitify.repository-watcher", qos: .utility)