@bensandee/tooling 0.72.2 → 0.72.3

package/dist/bin.mjs

@@ -4961,7 +4961,7 @@ function buildManagedDevDeps(ctx) {
 	const devDeps = { ...rootDevDeps(ctx.config) };
 	if (!isMonorepo) Object.assign(devDeps, perPackageDevDeps(ctx.config));
 	if (ctx.config.stack !== "none" || ctx.config.ci === "forgejo") devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.14.0";
-	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.72.2";
+	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.72.3";
 	if (ctx.config.useEslintPlugin && ctx.config.stack !== "none") devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.13.2";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "3.0.1",
@@ -8663,7 +8663,7 @@ function reportFailures(failed, command) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.72.2 repo:sync\` on ${timestamp}_\n`);
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.72.3 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
 		const items = changed.map((r) => {
@@ -12725,7 +12725,7 @@ async function runPrUpsert(executor, options) {
 		timeoutMs: 6e4,
 		signal
 	})).stdout.trim() !== "") log$1.warn("Working tree has uncommitted changes -- they will not be part of this PR.");
-	const resolved = resolveConnection(cwd);
+	const resolved = options.connection;
 	const derived = derivePrContent({
 		branch,
 		subjects,
@@ -12736,7 +12736,7 @@ async function runPrUpsert(executor, options) {
 		wipPrefix: resolved.type === "forgejo"
 	});
 	debug(options, `pr:${mode} ${branch} (diff base ${localBase}, ${resolved.type})`);
-	const conn = resolved.type === "forgejo" ? withInjectedToken(resolved.conn, options.token) : null;
+	const conn = resolved.type === "forgejo" ? resolved.conn : null;
 	const open = conn !== null ? await findOpenPrEntry(executor, conn, branch, signal) : await findOpenGitHubPr(executor, cwd, branch, signal);
 	const existing = open?.number ?? null;
 	assertModeAllows(mode, existing, branch);
@@ -13012,18 +13012,6 @@ async function readGitHubPrContent(executor, cwd, prNumber, signal = null) {
 		body: parsed.data.body ?? ""
 	};
 }
-/**
-* Apply an injected forge token to a resolved connection. `resolveConnection` reads only the
-* ambient RELEASE_TOKEN/FORGEJO_TOKEN, so a caller acting under a different identity (the agent's
-* bot) passes its token here to author the PR object as that identity -- matching the branch push,
-* which `buildGitAuthEnv` already authenticates with the same token. No token = ambient, unchanged.
-*/
-function withInjectedToken(conn, token) {
-	return token === void 0 ? conn : {
-		...conn,
-		token
-	};
-}
 async function pushBranch(executor, cwd, branch, env, forceWithLease = false) {
 	const pushArgs = forceWithLease ? [
 		"push",
@@ -13289,6 +13277,7 @@ const prCreateCommand = defineCommand({
 		const body = readBodySource(args.body ?? void 0, args["body-file"] ?? void 0);
 		const result = await runPrUpsert(createRealExecutor$1(), {
 			cwd: process.cwd(),
+			connection: resolveConnection(process.cwd()),
 			mode: args.upsert === true ? "upsert" : "create",
 			title: args.title ?? void 0,
 			body,
@@ -13367,6 +13356,7 @@ const prUpdateCommand = defineCommand({
 		const rewrites = args.title !== void 0 || body !== void 0;
 		const result = await runPrUpsert(createRealExecutor$1(), {
 			cwd: process.cwd(),
+			connection: resolveConnection(process.cwd()),
 			mode: "update",
 			title: args.title ?? void 0,
 			body,
@@ -14255,12 +14245,13 @@ function requireForgejoTransport(executor, cwd, target, refusal) {
 * uses this to detect a `github.com` target and fail before any request.
 *
 * `injectedToken` overrides the ambient `RELEASE_TOKEN`/`FORGEJO_TOKEN` for the Forgejo
-* transport, mirroring `resolveGitCoordinates`'s `injectedToken ?? resolveForgeToken(...)`
-* precedence so a run's forge writes and its git pushes resolve the same identity. The agent
-* passes its bot token here so a run's comments post as the bot even though the operator's
-* personal token is in the shared shell -- without it, git pushed as the bot while comments
-* posted as the operator (the split seen on PR #368). Forgejo-only: the GitHub branch uses
-* `gh`'s own auth and ignores it, which is fine because the agent is Forgejo-only.
+* transport. The env fallback exists for the CLI commands alone -- they are entrypoints, where
+* resolving from the environment is the contract -- and the agent must never reach it: its
+* container deliberately carries no ambient forge token, and in a dev shell the fallback would
+* silently post comments as the operator while git pushed as the bot (the split seen on
+* PR #368). The agent's call sites all pass `AgentRunOptions.token`, which is required, so
+* that guarantee is compile-checked rather than remembered. Forgejo-only: the GitHub branch
+* uses `gh`'s own auth and ignores it, which is fine because the agent is Forgejo-only.
 */
 function resolveIssueTransport(executor, cwd, target, injectedToken, signal = null) {
 	if (target !== void 0) {
@@ -24907,7 +24898,7 @@ setForgejoLogger(log$1);
 * `local <sha>[-dirty]` otherwise -- so an artifact built from the working tree
 * can't pass itself off as the published release whose version it carries.
 */
-const displayVersion = "0.72.2";
+const displayVersion = "0.72.3";
 /**
 * Wait until a stream's internally-buffered data has been flushed to the OS.
 *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bensandee/tooling",
-  "version": "0.72.2",
+  "version": "0.72.3",
   "description": "CLI tool to bootstrap and maintain standardized TypeScript project tooling",
   "license": "MIT",
   "repository": {