fix: update_ssh_monitor fetch+reset after kalinamall force-push

Release 1.2.5-SAC; prefer kalinamall remote; ff-only or hard reset.

Co-authored-by: Cursor <cursoragent@cursor.com>

sac-client.sh

@@ -1,5 +1,5 @@
 # SAC client for ssh-monitor (source from ssh-monitor)
-# SAC client release: 1.2.4-SAC — ingest HTTP 201/409/202
+# SAC client release: 1.2.5-SAC — ingest HTTP 201/409/202
 # shellcheck shell=bash
 
 sac_normalize_mode() {

ssh-monitor

@@ -7,7 +7,7 @@ IFS=$'\n\t'
 # ============================================
 
 CONFIG_FILE="/etc/ssh-monitor.conf"
-SSH_MONITOR_VERSION="1.2.4-SAC"
+SSH_MONITOR_VERSION="1.2.5-SAC"
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 if [ -f "$SCRIPT_DIR/sac-client.sh" ]; then

update_ssh_monitor.sh

@@ -229,6 +229,69 @@ get_git_short_rev() {
     git -C "$repo_dir" rev-parse --short HEAD 2>/dev/null || printf 'unknown'
 }
 
+# Remote kalinamall или origin с URL git.kalinamall.ru (не GitHub).
+resolve_git_remote_name() {
+    local repo="$1" name url
+    if git -C "$repo" remote get-url kalinamall &>/dev/null; then
+        printf '%s' kalinamall
+        return 0
+    fi
+    while read -r name; do
+        [ -n "$name" ] || continue
+        url=$(git -C "$repo" remote get-url "$name" 2>/dev/null || true)
+        case "$url" in
+            *git.kalinamall.ru*) printf '%s' "$name"; return 0 ;;
+        esac
+    done < <(git -C "$repo" remote 2>/dev/null)
+    if git -C "$repo" remote get-url origin &>/dev/null; then
+        printf '%s' origin
+        return 0
+    fi
+    git -C "$repo" remote add kalinamall "$REPO_URL" >> "$LOG_FILE" 2>&1 \
+        || git -C "$repo" remote set-url kalinamall "$REPO_URL" >> "$LOG_FILE" 2>&1
+    printf '%s' kalinamall
+}
+
+# fetch + ff-only pull; при расхождении истории (force-push) — reset --hard.
+sync_git_repository() {
+    local repo="$1" branch="${2:-main}"
+    local remote upstream git_before git_after
+
+    remote="$(resolve_git_remote_name "$repo")"
+    upstream="${remote}/${branch}"
+
+    if [ -f "$repo/.git/MERGE_HEAD" ]; then
+        log_action "git: незавершённый merge — abort"
+        git -C "$repo" merge --abort >> "$LOG_FILE" 2>&1 || true
+    fi
+
+    git_before="$(get_git_short_rev "$repo")"
+    log_action "git: fetch --prune $remote $branch (было $git_before) → $REPO_URL"
+    if ! git -C "$repo" fetch --prune "$remote" "$branch" >> "$LOG_FILE" 2>&1; then
+        SUMMARY_GIT="fetch FAILED ($git_before)"
+        log_action "ERROR: git fetch failed (см. $LOG_FILE)"
+        return 1
+    fi
+
+    if git -C "$repo" pull --ff-only "$remote" "$branch" >> "$LOG_FILE" 2>&1; then
+        git_after="$(get_git_short_rev "$repo")"
+        SUMMARY_GIT="pull ok, $git_before → $git_after"
+        log_action "git: fast-forward OK ($git_before → $git_after)"
+        return 0
+    fi
+
+    log_action "WARN: fast-forward невозможен (часто после force-push) — reset --hard $upstream"
+    if ! git -C "$repo" reset --hard "$upstream" >> "$LOG_FILE" 2>&1; then
+        SUMMARY_GIT="reset FAILED ($git_before)"
+        log_action "ERROR: git reset --hard $upstream failed (см. $LOG_FILE)"
+        return 1
+    fi
+    git_after="$(get_git_short_rev "$repo")"
+    SUMMARY_GIT="reset ok, $git_before → $git_after"
+    log_action "git reset --hard: $git_before → $git_after"
+    return 0
+}
+
 read_ssh_monitor_version() {
     local f="$1"
     local line
@@ -764,18 +827,11 @@ update_script() {
 
     debug_step "Проверяем наличие репозитория и обновляем/клонируем"
     if [ -d "$SCRIPT_NAME" ]; then
-        git_before="$(get_git_short_rev "$git_repo")"
+        if sync_git_repository "$git_repo" main; then
-        log_action "git: pull origin main (было commit $git_before) → $REPO_URL"
+            pull_ok=1
-        debug_step "Выполняем git pull origin main"
-        if git -C "$SCRIPT_NAME" pull origin main >> "$LOG_FILE" 2>&1; then
-            git_after="$(get_git_short_rev "$git_repo")"
-            SUMMARY_GIT="pull ok, $git_before → $git_after"
-            log_action "git pull: успех (commit $git_before → $git_after)"
         else
             pull_ok=0
-            git_after="$(get_git_short_rev "$git_repo")"
+            log_action "WARNING: git sync не удался — remote в клоне может быть устаревшим"
-            SUMMARY_GIT="pull FAILED, используется локальный клон ($git_after)"
-            log_action "WARNING: git pull не удался — продолжаем со старым клоном (commit $git_after). См. хвост $LOG_FILE"
         fi
     else
         log_action "git: clone $REPO_URL → $UPDATE_DIR/$SCRIPT_NAME"