fix(#131): SSH-default shortcodes with --protocol override

CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [Unreleased]
+
+### Changed
+
+- **Breaking:** Built-in shortcodes (`gh:`, `gl:`, `cb:`) now default to SSH
+  URLs instead of HTTPS. The `gh config get git_protocol` detection has been
+  removed — behavior is now consistent across all three vendors and independent
+  of the `gh` CLI.
+
+### Added
+
+- `--protocol <ssh|https>` flag on `diecut new` for per-invocation override of
+  shortcode protocol.
+- `DIECUT_GIT_PROTOCOL` environment variable for persistent shortcode protocol
+  preference.
+- Dry-run output now prints the resolved clone URL (or local path) before any
+  clone is attempted.
+
 ## [0.3.5](https://github.com/raiderrobert/diecut/compare/v0.3.4...v0.3.5) (2026-03-15)
 
 

Cargo.toml

@@ -39,6 +39,7 @@ indexmap = { version = "2.11.4", features = ["serde"] }
 [dev-dependencies]
 rstest = "0.23"
 criterion = "0.5"
+serial_test = "3"
 
 [[bench]]
 name = "benchmarks"

README.md

@@ -50,6 +50,12 @@ diecut list
 
 Example templates: [diecut-templates](https://github.com/raiderrobert/diecut-templates)
 
+### Protocol
+
+Built-in shortcodes resolve to SSH URLs by default (e.g., `gh:user/repo` →
+`git@github.com:user/repo.git`). To use HTTPS instead, pass `--protocol https`
+or set `DIECUT_GIT_PROTOCOL=https` in your shell environment.
+
 ## Documentation
 
 Full documentation: **[diecut.dev](https://diecut.dev/)**

docs/src/content/docs/reference/commands.md

@@ -25,6 +25,7 @@ diecut new <TEMPLATE> [OPTIONS]
 | `--no-hooks` | `false` | Skip running hooks |
 | `--dry-run` | `false` | Show what would be generated without writing files |
 | `-v, --verbose` | `false` | Show file contents (with `--dry-run`) or detailed output |
+| `--protocol <ssh\|https>` | `ssh` | Protocol for expanding built-in shortcodes (`gh:`, `gl:`, `cb:`) |
 
 ### Examples
 
@@ -51,6 +52,7 @@ diecut new ./my-template --dry-run --verbose
 - The `--data` flag can be repeated to set multiple variables.
 - When `--defaults` is set, any variable without a default value causes an error.
 - Subpaths let you point to a template inside a larger repo (e.g., `gh:user/templates/python-pkg`).
+- `DIECUT_GIT_PROTOCOL` sets the default shortcode protocol persistently (`ssh` or `https`). Overridden per-invocation by `--protocol`.
 
 ---
 

docs/src/content/docs/using-templates/index.mdx

@@ -17,6 +17,12 @@ diecut pulls templates from local paths or any Git host.
 
 Git templates are cached at `~/.cache/diecut/templates/`. Override with `DIECUT_CACHE_DIR`.
 
+## Protocol
+
+Built-in shortcodes (`gh:`, `gl:`, `cb:`) resolve to SSH URLs by default (e.g.,
+`gh:user/repo` → `git@github.com:user/repo.git`). To use HTTPS instead, pass
+`--protocol https` or set `DIECUT_GIT_PROTOCOL=https` in your shell environment.
+
 ## Multi-template repos (subpaths)
 
 A single repo can hold multiple templates in subdirectories. Add the subdirectory path after the repo:

src/cli.rs

@@ -1,4 +1,5 @@
 use clap::{Parser, Subcommand};
+use diecut::template::GitProtocol;
 
 #[derive(Parser)]
 #[command(
@@ -45,8 +46,56 @@ pub enum Commands {
         /// Show file contents (with --dry-run) or detailed output
         #[arg(short, long)]
         verbose: bool,
+
+        /// Protocol for expanding shortcodes (ssh or https).
+        /// Defaults to ssh. Override with DIECUT_GIT_PROTOCOL env var.
+        #[arg(long, value_enum)]
+        protocol: Option<GitProtocol>,
     },
 
     /// List cached templates
     List,
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use clap::Parser;
+    use diecut::template::GitProtocol;
+
+    #[test]
+    fn parses_new_without_protocol() {
+        let cli = Cli::parse_from(["diecut", "new", "gh:user/repo"]);
+        if let Commands::New { protocol, .. } = cli.command {
+            assert!(protocol.is_none());
+        } else {
+            panic!("expected New");
+        }
+    }
+
+    #[test]
+    fn parses_new_with_protocol_ssh() {
+        let cli = Cli::parse_from(["diecut", "new", "gh:user/repo", "--protocol", "ssh"]);
+        if let Commands::New { protocol, .. } = cli.command {
+            assert_eq!(protocol, Some(GitProtocol::Ssh));
+        } else {
+            panic!("expected New");
+        }
+    }
+
+    #[test]
+    fn parses_new_with_protocol_https() {
+        let cli = Cli::parse_from(["diecut", "new", "gh:user/repo", "--protocol", "https"]);
+        if let Commands::New { protocol, .. } = cli.command {
+            assert_eq!(protocol, Some(GitProtocol::Https));
+        } else {
+            panic!("expected New");
+        }
+    }
+
+    #[test]
+    fn rejects_invalid_protocol() {
+        let result = Cli::try_parse_from(["diecut", "new", "gh:user/repo", "--protocol", "ftp"]);
+        assert!(result.is_err());
+    }
+}

src/commands/new.rs

@@ -1,4 +1,7 @@
 use console::style;
+use diecut::template::{
+    format_resolved_source, resolve_git_protocol, resolve_source, GitProtocol, ResolveOptions,
+};
 use diecut::GenerateOptions;
 use miette::Result;
 
@@ -12,6 +15,7 @@ pub fn run(
     no_hooks: bool,
     dry_run: bool,
     verbose: bool,
+    protocol: Option<GitProtocol>,
 ) -> Result<()> {
     let data_pairs: Vec<(String, String)> = data
         .into_iter()
@@ -23,13 +27,28 @@ pub fn run(
         })
         .collect();
 
+    let resolved_protocol = resolve_git_protocol(protocol)?;
+
+    if dry_run {
+        // Resolve the source first so the URL is visible even if clone fails.
+        let source = resolve_source(
+            &template,
+            ResolveOptions {
+                protocol: resolved_protocol,
+                ..Default::default()
+            },
+        )?;
+        println!("{}", format_resolved_source(&source));
+    }
+
     let options = GenerateOptions {
         template,
         output,
         data: data_pairs,
         defaults,
         overwrite,
         no_hooks,
+        protocol: resolved_protocol,
     };
 
     if dry_run {

src/error.rs

@@ -78,6 +78,13 @@ pub enum DicecutError {
         source: tera::Error,
     },
 
+    #[error("Invalid git protocol value '{value}' in {config_key}")]
+    #[diagnostic(help("Expected 'ssh' or 'https'"))]
+    InvalidProtocol {
+        value: String,
+        config_key: &'static str,
+    },
+
     #[error("Invalid template abbreviation: {input}")]
     #[diagnostic(help("Supported abbreviations: gh:user/repo, gl:user/repo, cb:user/repo"))]
     InvalidAbbreviation { input: String },

src/lib.rs

@@ -18,7 +18,7 @@ use crate::answers::TemplateOrigin;
 use crate::error::{DicecutError, Result};
 use crate::prompt::{collect_variables, PromptOptions};
 use crate::render::{build_context, execute_plan, plan_render, GeneratedProject, GenerationPlan};
-use crate::template::{get_or_clone, resolve_source, TemplateSource};
+use crate::template::{get_or_clone, resolve_source, GitProtocol, ResolveOptions, TemplateSource};
 
 pub struct GenerateOptions {
     pub template: String,
@@ -27,6 +27,7 @@ pub struct GenerateOptions {
     pub defaults: bool,
     pub overwrite: bool,
     pub no_hooks: bool,
+    pub protocol: GitProtocol,
 }
 
 /// Everything needed to execute a generation that has been planned but not yet written.
@@ -44,7 +45,13 @@ pub struct FullGenerationPlan {
 /// This performs all preparation (template resolution, variable collection, pre-generate
 /// hooks, and rendering) but does **not** write any files to disk.
 pub fn plan_generation(options: GenerateOptions) -> Result<FullGenerationPlan> {
-    let source = resolve_source(&options.template)?;
+    let source = resolve_source(
+        &options.template,
+        ResolveOptions {
+            protocol: options.protocol,
+            ..Default::default()
+        },
+    )?;
     let (template_dir, origin) = match &source {
         TemplateSource::Local(path) => (path.clone(), TemplateOrigin::Local),
         TemplateSource::Git {
@@ -222,6 +229,7 @@ default = "my-project"
             defaults: false,
             overwrite: false,
             no_hooks: true,
+            protocol: GitProtocol::default(),
         };
 
         let plan = plan_generation(options).unwrap();
@@ -240,6 +248,7 @@ default = "my-project"
             defaults: true,
             overwrite: false,
             no_hooks: true,
+            protocol: GitProtocol::default(),
         };
 
         let result = plan_generation(options);
@@ -267,6 +276,7 @@ default = "my-project"
             defaults: true,
             overwrite,
             no_hooks: true,
+            protocol: GitProtocol::default(),
         };
 
         let result = plan_generation(options);
@@ -294,6 +304,7 @@ default = "my-project"
             defaults: false,
             overwrite: false,
             no_hooks: true,
+            protocol: GitProtocol::default(),
         };
 
         let plan = plan_generation(options).unwrap();
@@ -326,6 +337,7 @@ default = "my-project"
             defaults: false,
             overwrite: true,
             no_hooks: true,
+            protocol: GitProtocol::default(),
         };
 
         let plan = plan_generation(options).unwrap();
@@ -368,6 +380,7 @@ default = "test"
             defaults: true,
             overwrite: true,
             no_hooks: true,
+            protocol: GitProtocol::default(),
         };
 
         let plan = plan_generation(options).unwrap();
@@ -394,6 +407,7 @@ default = "test"
             defaults: false,
             overwrite: true,
             no_hooks: true,
+            protocol: GitProtocol::default(),
         };
 
         let result = generate(options).unwrap();

src/main.rs

@@ -15,8 +15,9 @@ fn main() -> miette::Result<()> {
             no_hooks,
             dry_run,
             verbose,
+            protocol,
         } => commands::new::run(
-            template, output, data, defaults, overwrite, no_hooks, dry_run, verbose,
+            template, output, data, defaults, overwrite, no_hooks, dry_run, verbose, protocol,
         ),
         Commands::List => commands::list::run(),
     }

src/template/mod.rs

@@ -4,4 +4,7 @@ pub mod source;
 
 pub use cache::{clear_cache, get_or_clone, list_cached, CacheMetadata, CachedTemplate};
 pub use clone::{clone_template, CloneResult};
-pub use source::{resolve_source, resolve_source_full, resolve_source_with_ref, TemplateSource};
+pub use source::{
+    format_resolved_source, resolve_git_protocol, resolve_source, GitProtocol, ResolveOptions,
+    TemplateSource,
+};