@autohq/cli 0.1.89 → 0.1.91

package/dist/agent-bridge.js

@@ -4842,6 +4842,76 @@ var require_websocket_server = __commonJS({
   }
 });
 
+// src/commands/agent-bridge/git-credentials.ts
+import { once } from "events";
+import { chmod, mkdir, readFile, writeFile } from "fs/promises";
+import { createServer } from "http";
+import { homedir } from "os";
+import path from "path";
+var RELAY_PATH = "/git-credential";
+function defaultGitCredentialPortFilePath() {
+  return path.join(homedir(), ".auto", "agent-bridge", "git-credential.json");
+}
+async function startGitCredentialRelay(input) {
+  const fetchImpl = input.fetchImpl ?? fetch;
+  let target = { url: input.url, accessToken: input.accessToken };
+  const server = createServer((request, response) => {
+    if (request.method !== "POST" || request.url !== RELAY_PATH) {
+      response.writeHead(404).end();
+      return;
+    }
+    const chunks = [];
+    request.on("data", (chunk) => chunks.push(chunk));
+    request.on("end", () => {
+      void (async () => {
+        try {
+          const upstream = await fetchImpl(target.url, {
+            method: "POST",
+            headers: {
+              authorization: `Bearer ${target.accessToken}`,
+              "content-type": "application/json"
+            },
+            body: Buffer.concat(chunks).toString("utf8") || "{}"
+          });
+          const body = await upstream.text();
+          response.writeHead(upstream.status, {
+            "content-type": upstream.headers.get("content-type") ?? "application/json"
+          }).end(body);
+        } catch (error51) {
+          response.writeHead(502, { "content-type": "application/json" }).end(
+            JSON.stringify({
+              error: error51 instanceof Error ? error51.message : String(error51)
+            })
+          );
+        }
+      })();
+    });
+  });
+  server.listen(0, "127.0.0.1");
+  await once(server, "listening");
+  server.unref();
+  const address = server.address();
+  if (!address || typeof address !== "object") {
+    server.close();
+    throw new Error("git credential relay failed to bind a loopback port");
+  }
+  const portFilePath = input.portFilePath ?? defaultGitCredentialPortFilePath();
+  await mkdir(path.dirname(portFilePath), { recursive: true });
+  await writeFile(portFilePath, JSON.stringify({ port: address.port }), {
+    mode: 384
+  });
+  await chmod(portFilePath, 384);
+  return {
+    port: address.port,
+    update: (next) => {
+      target = { url: next.url, accessToken: next.accessToken };
+    },
+    close: () => new Promise((resolve) => {
+      server.close(() => resolve());
+    })
+  };
+}
+
 // ../../node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -5608,10 +5678,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path) {
-  if (!path)
+function getElementAtPath(obj, path2) {
+  if (!path2)
     return obj;
-  return path.reduce((acc, key) => acc?.[key], obj);
+  return path2.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -6020,11 +6090,11 @@ function explicitlyAborted(x2, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path, issues) {
+function prefixIssues(path2, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path);
+    iss.path.unshift(path2);
     return iss;
   });
 }
@@ -6171,16 +6241,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path = []) => {
+  const processError = (error52, path2 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path2, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
       } else {
-        const fullpath = [...path, ...issue2.path];
+        const fullpath = [...path2, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -6207,17 +6277,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path = []) => {
+  const processError = (error52, path2 = []) => {
     var _a3, _b2;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path2, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
       } else {
-        const fullpath = [...path, ...issue2.path];
+        const fullpath = [...path2, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -6249,8 +6319,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path) {
+  const path2 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path2) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -18942,13 +19012,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path = ref.slice(1).split("/").filter(Boolean);
-  if (path.length === 0) {
+  const path2 = ref.slice(1).split("/").filter(Boolean);
+  if (path2.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path[0] === defsKey) {
-    const key = path[1];
+  if (path2[0] === defsKey) {
+    const key = path2[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -19463,7 +19533,14 @@ var AgentBridgeClaudeConfigSchema = external_exports.object({
 var RuntimeBridgeBootstrapPlaintextSchema = external_exports.object({
   version: external_exports.literal(1),
   outputSeqStart: external_exports.number().int().nonnegative(),
-  claude: AgentBridgeClaudeConfigSchema
+  claude: AgentBridgeClaudeConfigSchema,
+  // Endpoint + run token for the git credential broker. Present only when
+  // the run has GitHub App git mounts; rides the encrypted bootstrap so the
+  // token lives in agent-bridge memory, never on disk.
+  gitCredentials: external_exports.object({
+    url: external_exports.string().trim().min(1),
+    accessToken: external_exports.string().trim().min(1)
+  }).strict().optional()
 }).strict();
 var RuntimeBridgeEncryptedBootstrapSchema = external_exports.object({
   version: external_exports.literal(1),
@@ -19615,6 +19692,8 @@ var AuthScopeSchema = external_exports.enum([
   "secrets:read",
   "secrets:write",
   "secrets:use",
+  "github:mcp",
+  "github:credentials",
   "projects:admin",
   "org:admin"
 ]);
@@ -20657,6 +20736,87 @@ var ConnectionRemoveResponseSchema = external_exports.object({
   message: external_exports.string().trim().min(1)
 });
 
+// ../../packages/schemas/src/github-credentials.ts
+var CreateRunGithubCredentialRequestSchema = external_exports.object({
+  host: external_exports.literal("github.com"),
+  path: external_exports.string().trim().min(1).optional()
+});
+var RunGithubCredentialResponseSchema = external_exports.object({
+  username: external_exports.literal("x-access-token"),
+  password: external_exports.string().min(1),
+  expiresAt: external_exports.string().datetime()
+});
+
+// ../../packages/schemas/src/github-mcp-catalog.ts
+var GITHUB_MCP_TOOL_NAMES = [
+  "actions_get",
+  "actions_list",
+  "actions_run_trigger",
+  "add_comment_to_pending_review",
+  "add_issue_comment",
+  "add_reply_to_pull_request_comment",
+  "create_branch",
+  "create_or_update_file",
+  "create_pull_request",
+  "create_repository",
+  "delete_file",
+  "fork_repository",
+  "get_commit",
+  "get_file_contents",
+  "get_job_logs",
+  "get_label",
+  "get_latest_release",
+  "get_release_by_tag",
+  "get_tag",
+  "issue_read",
+  "issue_write",
+  "list_branches",
+  "list_commits",
+  "list_issue_types",
+  "list_issues",
+  "list_pull_requests",
+  "list_releases",
+  "list_repository_collaborators",
+  "list_tags",
+  "merge_pull_request",
+  "pull_request_read",
+  "pull_request_review_write",
+  "push_files",
+  "search_code",
+  "search_commits",
+  "search_issues",
+  "search_pull_requests",
+  "search_repositories",
+  "sub_issue_write",
+  "update_pull_request",
+  "update_pull_request_branch"
+];
+var GITHUB_MCP_WRITE_TOOLS = [
+  "actions_run_trigger",
+  "add_comment_to_pending_review",
+  "add_issue_comment",
+  "add_reply_to_pull_request_comment",
+  "create_branch",
+  "create_or_update_file",
+  "create_pull_request",
+  "create_repository",
+  "delete_file",
+  "fork_repository",
+  "issue_write",
+  "merge_pull_request",
+  "pull_request_review_write",
+  "push_files",
+  "sub_issue_write",
+  "update_pull_request",
+  "update_pull_request_branch"
+];
+var githubMcpToolNameSet = new Set(
+  GITHUB_MCP_TOOL_NAMES
+);
+var githubMcpWriteToolSet = new Set(
+  GITHUB_MCP_WRITE_TOOLS
+);
+
 // ../../packages/schemas/src/secrets.ts
 var SECRET_ENCRYPTION_ALGORITHM = "AES-256-GCM";
 var SecretEnvNameSchema = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
@@ -20831,6 +20991,14 @@ var GITHUB_MOUNT_CAPABILITY_LEVELS = [
 var GithubMountCapabilityLevelSchema = external_exports.enum(
   GITHUB_MOUNT_CAPABILITY_LEVELS
 );
+var DEFAULT_GITHUB_MOUNT_CAPABILITIES = {
+  contents: "write",
+  pullRequests: "write",
+  issues: "write",
+  checks: "read",
+  actions: "read",
+  workflows: "none"
+};
 var GitMountAuthSchema = external_exports.discriminatedUnion("kind", [
   external_exports.object({
     kind: external_exports.literal("none")
@@ -20851,14 +21019,7 @@ var GitMountAuthSchema = external_exports.discriminatedUnion("kind", [
       checks: GithubMountCapabilityLevelSchema.default("read"),
       actions: GithubMountCapabilityLevelSchema.default("read"),
       workflows: GithubMountCapabilityLevelSchema.default("none")
-    }).default({
-      contents: "write",
-      pullRequests: "write",
-      issues: "write",
-      checks: "read",
-      actions: "read",
-      workflows: "none"
-    })
+    }).default({ ...DEFAULT_GITHUB_MOUNT_CAPABILITIES })
   })
 ]);
 var GitMountSchema = external_exports.object({
@@ -21009,6 +21170,11 @@ var LocalToolSchema = external_exports.discriminatedUnion(
     error: `Unsupported local tool implementation. Supported implementations: ${LOCAL_TOOL_IMPLEMENTATIONS.join(", ")}`
   }
 );
+var GithubToolSchema = external_exports.object({
+  kind: external_exports.literal("github"),
+  description: external_exports.string().trim().min(1).optional(),
+  tools: external_exports.array(external_exports.enum(GITHUB_MCP_TOOL_NAMES)).min(1).optional()
+});
 var ToolSpecSchema = external_exports.discriminatedUnion("kind", [
   RemoteMcpToolSchema,
   LocalToolSchema
@@ -21058,6 +21224,10 @@ var InlineSessionToolSchema = RemoteMcpToolSchema.extend({
       disabled: external_exports.boolean().optional()
     })
   )
+).or(
+  GithubToolSchema.extend({
+    disabled: external_exports.boolean().optional()
+  })
 );
 var SessionToolRefSchema = InlineSessionToolSchema.or(
   ReferencedSessionToolRefSchema
@@ -21173,17 +21343,17 @@ var TriggerFilterScalarSchema = external_exports.union([
   external_exports.boolean()
 ]);
 var TriggerFilterPathSchema = external_exports.string().refine(
-  (path) => {
-    if (path.length === 0 || path.trim() !== path) {
+  (path2) => {
+    if (path2.length === 0 || path2.trim() !== path2) {
       return false;
     }
-    if (path.startsWith("$.")) {
-      const segments = path.slice(2).split(".");
+    if (path2.startsWith("$.")) {
+      const segments = path2.slice(2).split(".");
       return segments.length > 0 && segments.every(
         (segment) => segment.length > 0 && segment.trim() === segment
       );
     }
-    return !path.includes(".");
+    return !path2.includes(".");
   },
   {
     message: "Trigger filter paths must be a single bare key or use $.path.segments"
@@ -21622,8 +21792,8 @@ function hasAutoAttributionsExists(trigger, expected) {
 function isChatMessageEvent(trigger) {
   return trigger.event.startsWith("chat.message.");
 }
-function hasFilterValue(trigger, path, expected) {
-  return trigger.where?.[path] === expected;
+function hasFilterValue(trigger, path2, expected) {
+  return trigger.where?.[path2] === expected;
 }
 
 // ../../packages/schemas/src/project-resources.ts
@@ -21842,7 +22012,7 @@ var SessionRunRecordSchema = external_exports.object({
       external_exports.object({
         source: external_exports.literal("inline"),
         alias: ToolAliasSchema,
-        spec: RemoteMcpToolSchema.or(LocalToolSchema)
+        spec: RemoteMcpToolSchema.or(LocalToolSchema).or(GithubToolSchema)
       }),
       external_exports.object({
         source: external_exports.literal("resource"),
@@ -22346,7 +22516,6 @@ var SessionRunDispatchCommandRecordSchema = external_exports.discriminatedUnion(
 var RuntimeRecordSchema = external_exports.object({
   id: RuntimeIdSchema2,
   sandboxId: external_exports.string().trim().min(1).nullable(),
-  gitAuthExpiresAt: external_exports.string().datetime().nullable(),
   createdAt: external_exports.string().datetime(),
   updatedAt: external_exports.string().datetime()
 });
@@ -23678,12 +23847,12 @@ function parse4(str) {
   uri.queryKey = queryKey(uri, uri["query"]);
   return uri;
 }
-function pathNames(obj, path) {
-  const regx = /\/{2,9}/g, names = path.replace(regx, "/").split("/");
-  if (path.slice(0, 1) == "/" || path.length === 0) {
+function pathNames(obj, path2) {
+  const regx = /\/{2,9}/g, names = path2.replace(regx, "/").split("/");
+  if (path2.slice(0, 1) == "/" || path2.length === 0) {
     names.splice(0, 1);
   }
-  if (path.slice(-1) == "/") {
+  if (path2.slice(-1) == "/") {
     names.splice(names.length - 1, 1);
   }
   return names;
@@ -24300,7 +24469,7 @@ var protocol2 = Socket.protocol;
 // ../../node_modules/socket.io-client/build/esm-debug/url.js
 var import_debug7 = __toESM(require_src(), 1);
 var debug7 = (0, import_debug7.default)("socket.io-client:url");
-function url2(uri, path = "", loc) {
+function url2(uri, path2 = "", loc) {
   let obj = uri;
   loc = loc || typeof location !== "undefined" && location;
   if (null == uri)
@@ -24334,7 +24503,7 @@ function url2(uri, path = "", loc) {
   obj.path = obj.path || "/";
   const ipv63 = obj.host.indexOf(":") !== -1;
   const host = ipv63 ? "[" + obj.host + "]" : obj.host;
-  obj.id = obj.protocol + "://" + host + ":" + obj.port + path;
+  obj.id = obj.protocol + "://" + host + ":" + obj.port + path2;
   obj.href = obj.protocol + "://" + host + (loc && loc.port === obj.port ? "" : ":" + obj.port);
   return obj;
 }
@@ -25965,8 +26134,8 @@ function lookup(uri, opts) {
   const parsed = url2(uri, opts.path || "/socket.io");
   const source = parsed.source;
   const id = parsed.id;
-  const path = parsed.path;
-  const sameNamespace = cache[id] && path in cache[id]["nsps"];
+  const path2 = parsed.path;
+  const sameNamespace = cache[id] && path2 in cache[id]["nsps"];
   const newConnection = opts.forceNew || opts["force new connection"] || false === opts.multiplex || sameNamespace;
   let io;
   if (newConnection) {
@@ -26034,6 +26203,7 @@ async function runAgentBridgeSocket(options) {
       RUNTIME_BRIDGE_BOOTSTRAP_EVENT,
       createRuntimeBridgeBootstrapListener({
         token: options.token,
+        onBootstrap: options.onBootstrap,
         createHandler: (bootstrap) => options.createHandler({
           emitOutput: (output) => emitOutputWithAck(socket, output),
           claude: bootstrap.claude,
@@ -26132,6 +26302,7 @@ function createRuntimeBridgeBootstrapListener(input) {
       input.writeOutput?.(
         `agent_bridge_bootstrap_decrypted duration_ms=${Date.now() - decryptStartedAt}`
       );
+      await input.onBootstrap?.(bootstrap);
       let handler = input.getHandler();
       if (!handler) {
         handler = input.createHandler(bootstrap);
@@ -46539,21 +46710,21 @@ import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as rea
 import { dirname } from "path";
 var AGENT_BRIDGE_RUNTIME_DIR = "/tmp/auto-bridge-runtime";
 var CLAUDE_SESSION_RESUME_PATH = `${AGENT_BRIDGE_RUNTIME_DIR}/claude-session-id`;
-function fileClaudeSessionResumeStore(path = CLAUDE_SESSION_RESUME_PATH) {
+function fileClaudeSessionResumeStore(path2 = CLAUDE_SESSION_RESUME_PATH) {
   return {
     read(runId) {
-      if (!existsSync2(path)) {
+      if (!existsSync2(path2)) {
         return null;
       }
-      const record2 = parseResumeRecord(readFileSync2(path, "utf8"));
+      const record2 = parseResumeRecord(readFileSync2(path2, "utf8"));
       if (!record2 || record2.runId !== runId) {
         return null;
       }
       return record2.sessionId;
     },
     write(record2) {
-      mkdirSync2(dirname(path), { recursive: true });
-      writeFileSync(path, `${JSON.stringify(record2)}
+      mkdirSync2(dirname(path2), { recursive: true });
+      writeFileSync(path2, `${JSON.stringify(record2)}
 `, "utf8");
     }
   };
@@ -46922,7 +47093,10 @@ function deliveryMessage(delivery) {
 // src/commands/agent-bridge/entrypoint.ts
 async function runAgentBridgeProcess(input) {
   const runAgentBridge = input.runAgentBridge ?? runAgentBridgeClaudeCode;
-  await runAgentBridge(agentBridgeOptionsFromEnv(input));
+  await runAgentBridge({
+    ...agentBridgeOptionsFromEnv(input),
+    onBootstrap: createGitCredentialRelayStarter(input.writeOutput)
+  });
 }
 function agentBridgeOptionsFromEnv(input) {
   return {
@@ -46931,6 +47105,37 @@ function agentBridgeOptionsFromEnv(input) {
     writeOutput: input.writeOutput
   };
 }
+function createGitCredentialRelayStarter(writeOutput) {
+  let relay;
+  let startup;
+  return async (bootstrap) => {
+    const gitCredentials = bootstrap.gitCredentials;
+    if (!gitCredentials) {
+      return;
+    }
+    if (relay) {
+      relay.update(gitCredentials);
+      return;
+    }
+    if (startup) {
+      const started = await startup;
+      started?.update(gitCredentials);
+      return;
+    }
+    startup = startGitCredentialRelay(gitCredentials).then((started) => {
+      relay = started;
+      writeOutput?.(`agent_bridge_git_credential_relay port=${started.port}`);
+      return started;
+    }).catch((error51) => {
+      startup = void 0;
+      writeOutput?.(
+        `agent_bridge_git_credential_relay_failed error=${error51 instanceof Error ? error51.message : String(error51)}`
+      );
+      return void 0;
+    });
+    await startup;
+  };
+}
 function requiredEnv(env, key) {
   const value2 = env[key]?.trim();
   if (!value2) {