@brainervirus/workit-core 8.0.1 → 8.1.1

package/src/forge/resolve.ts

@@ -2,7 +2,8 @@
 // §2.0 Identity).
 //
 // - The push remote host decides GitHub vs GitLab. A workspace provider that
-//   disagrees is `blocked`, never silently overridden.
+//   disagrees is `blocked` for the forge verbs, never silently overridden;
+//   `git push` (checkPushIdentity) only needs git, so it pushes with a note.
 // - PRs/MRs live in the base repository: an `upstream` remote on the same
 //   forge, else the push repo's fork parent, else the push repo itself.
 // - Every API call carries the workspace's credential explicitly, so the
@@ -23,9 +24,10 @@ import {
   type ForgeHosts,
   type SshConfig,
 } from "../git/rev";
-import { FORGE_TIMEOUTS, systemRunner, type ForgeRunner } from "./exec";
+import { FORGE_TIMEOUTS, isNetworkError, systemRunner, type ForgeRunner } from "./exec";
 import { createGitHubForge } from "./github";
 import { createGitLabForge } from "./gitlab";
+import { redactText } from "./redact";
 import { failure, success, type Forge, type ForgeResult, type Identity } from "./types";
 
 export type CredentialSource = "workspace_token_file" | "gh_account_token" | "cli_login";
@@ -62,51 +64,103 @@ export type ResolveOptions = {
   now?: () => number;
   /** ssh_config for Host aliases (default: the user's ~/.ssh/config). */
   sshConfig?: string | SshConfig;
+  /** Absolute deadline (`now()` clock) for every call, resolution included; null = none. */
+  deadline?: number | null;
 };
 
-const configuredHosts = (): ForgeHosts => {
-  const vcs = readVcsConfig();
-  if (vcs.status !== "valid") return {};
-  const host = (kind: "github" | "gitlab"): string[] => {
-    const value = (vcs.config[kind] as { host?: unknown } | undefined)?.host;
-    return typeof value === "string" && value.trim() ? [value.trim()] : [];
+// Per-process memo of credential lookups and /user answers (a long-lived MCP
+// server re-asks after the TTL). Scoped by runner, so an injected test runner
+// never sees another's answers, and keyed by the gh/glab config location, so
+// another GH_CONFIG_DIR never reuses them; only successes are kept.
+const MEMO_TTL_MS = 5 * 60_000;
+const SYSTEM_SCOPE = {};
+const memoScopes = new WeakMap<object, Map<string, { at: number; value: unknown }>>();
+
+type MemoScope = { owner: object; key: string };
+
+const memoScope = (runner: ForgeRunner | undefined, env: NodeJS.ProcessEnv): MemoScope => ({
+  owner: runner ?? SYSTEM_SCOPE,
+  key: [env.GH_CONFIG_DIR, env.GLAB_CONFIG_DIR, env.XDG_CONFIG_HOME, env.HOME]
+    .map((value) => value ?? "")
+    .join("|"),
+});
+
+function memo<T>(
+  scope: MemoScope,
+  key: string,
+  compute: () => { keep: boolean; value: T },
+  now = Date.now,
+): T {
+  let entries = memoScopes.get(scope.owner);
+  if (!entries) memoScopes.set(scope.owner, (entries = new Map()));
+  const full = `${scope.key} ${key}`;
+  const hit = entries.get(full);
+  if (hit && now() - hit.at < MEMO_TTL_MS) return hit.value as T;
+  const { keep, value } = compute();
+  if (keep) entries.set(full, { at: now(), value });
+  return value;
+}
+
+/** A runner whose calls are clamped to `limits.deadline`, carrying `token`. */
+function clampedRunner(
+  base: ForgeRunner,
+  limits: { deadline: number | null },
+  now: () => number,
+  token?: string,
+): ForgeRunner {
+  return (bin, args, callOptions) => {
+    let timeoutMs = callOptions.timeoutMs;
+    if (limits.deadline !== null) {
+      const remaining = limits.deadline - now();
+      if (remaining <= 0)
+        return {
+          status: null,
+          stdout: "",
+          stderr: "",
+          timedOut: true,
+          missing: false,
+          timeoutMs: 0,
+        };
+      timeoutMs = Math.min(timeoutMs, remaining);
+    }
+    const run = base(bin, args, { ...callOptions, timeoutMs, ...(token ? { token } : {}) });
+    return run.timedOut && run.timeoutMs === undefined ? { ...run, timeoutMs } : run;
+  };
+}
+
+/**
+ * `forge.identity` answered once per explicit credential per TTL (push, then
+ * pr create, …). The CLI's own login (`cli_login`) is never memoized: a
+ * `glab auth login` / `gh auth switch` must show on the next call.
+ */
+const memoizedIdentity = (forge: Forge, scope: MemoScope, credential: Credential): Forge => {
+  if (credential.credential === "cli_login") return forge;
+  const identity = (expected: string | null) => forge.identity(expected);
+  return {
+    ...forge,
+    identity: (expected: string | null) =>
+      memo(
+        scope,
+        `identity ${forge.kind} ${forge.apiHost} ${credential.credential} ${credential.token ?? ""} ${expected ?? ""}`,
+        () => {
+          const value = identity(expected);
+          return { keep: value.ok, value };
+        },
+      ),
   };
-  return { github: host("github"), gitlab: host("gitlab") };
 };
 
-const createForge = (derived: DerivedForge, repo: string, runner: ForgeRunner): Forge =>
-  derived.kind === "github"
-    ? createGitHubForge({ apiHost: derived.apiHost, repo, runner })
-    : createGitLabForge({ apiHost: derived.apiHost, repo, runner });
+type Credential = { token: string | undefined; credential: CredentialSource };
 
-export function resolveForge(
-  cwd: string,
-  options: ResolveOptions = {},
-): ForgeResult<ResolvedForge> {
-  let workspace: ReturnType<typeof resolveRuntimeWorkspaceVcs>;
-  try {
-    workspace = resolveRuntimeWorkspaceVcs(cwd);
-  } catch (error) {
-    return failure(
-      "blocked",
-      error instanceof Error ? error.message : String(error),
-      "fix ~/.config/workit/workspaces.json (workit init → Workspaces)",
-    );
-  }
-  const hosts = configuredHosts();
-  const pushed = pushForge(cwd, { branch: options.branch, hosts, sshConfig: options.sshConfig });
-  if (!pushed.ok) return failure(pushed.code, pushed.error, pushed.unblock);
-  const conflict = forgeConflict(pushed.forge, workspace?.vcs?.provider);
-  if (conflict) return failure("blocked", conflict.error, conflict.unblock);
-  const derived = pushed.forge;
+/** The credential every API call carries (see the header). */
+function resolveCredential(
+  workspace: ReturnType<typeof resolveRuntimeWorkspaceVcs>,
+  derived: DerivedForge,
+  run: ForgeRunner,
+  scope: MemoScope,
+): ForgeResult<Credential> {
   const { kind, apiHost } = derived;
-  const base = options.runner ?? systemRunner(kind, apiHost, options.env ?? process.env);
-  const now = options.now ?? Date.now;
   const expectedAccount = workspace?.vcs?.account ?? null;
-
-  // The credential for every call.
-  let token: string | undefined;
-  let credential: CredentialSource = "cli_login";
   const tokenFile = (workspace?.vcs as { tokenFile?: unknown } | undefined)?.tokenFile;
   if (typeof tokenFile === "string" && tokenFile.trim()) {
     // A stored token goes only to the host it is for: the public forge (also
@@ -127,6 +181,7 @@ export function resolveForge(
         `token_host_unverified: push host ${derived.host} only looks like ${kind}; workspace ${workspace?.name ?? "?"} vcs.tokenFile is not sent to it`,
         `if ${apiHost} is your ${kind} server, set ${kind}.host in ~/.config/workit/vcs.json (or vcs.host for the workspace); otherwise fix the push remote`,
       );
+    let token = "";
     try {
       token = fs.readFileSync(tokenFile.trim(), "utf8").trim();
     } catch {
@@ -142,42 +197,108 @@ export function resolveForge(
         `workspace ${workspace?.name ?? "?"} vcs.tokenFile is empty`,
         "fix vcs.tokenFile in ~/.config/workit/workspaces.json",
       );
-    credential = "workspace_token_file";
-  } else if (expectedAccount && kind === "github") {
-    const issued = base("gh", ["auth", "token", "--hostname", apiHost, "--user", expectedAccount], {
+    return success({ token, credential: "workspace_token_file" });
+  }
+  // glab keeps one login per host, so a GitLab account is checked, not selected.
+  if (!expectedAccount || kind !== "github")
+    return success({ token: undefined, credential: "cli_login" });
+  return memo(scope, `token ${apiHost} ${expectedAccount}`, () => {
+    const issued = run("gh", ["auth", "token", "--hostname", apiHost, "--user", expectedAccount], {
       timeoutMs: FORGE_TIMEOUTS.api,
     });
-    if (issued.missing)
-      return failure(
-        "unavailable",
-        "gh is not installed",
-        "install the GitHub CLI (https://cli.github.com) and run: gh auth login",
-      );
-    token = issued.status === 0 ? issued.stdout.trim() : "";
-    if (!token)
-      return failure(
-        "blocked",
-        `identity_unavailable: gh has no login for ${expectedAccount} on ${apiHost} (workspace ${workspace?.name ?? "?"})`,
-        `gh auth login --hostname ${apiHost}  # sign in as ${expectedAccount}; workit passes that account's token per call and never switches the active account`,
-      );
-    credential = "gh_account_token";
-  }
+    const value = authTokenResult(issued, apiHost, expectedAccount, workspace?.name ?? "?");
+    return { keep: value.ok, value };
+  });
+}
 
-  const limits: { deadline: number | null } = { deadline: null };
-  const runner: ForgeRunner = (bin, args, callOptions) => {
-    let timeoutMs = callOptions.timeoutMs;
-    if (limits.deadline !== null) {
-      const remaining = limits.deadline - now();
-      if (remaining <= 0)
-        return { status: null, stdout: "", stderr: "", timedOut: true, missing: false };
-      timeoutMs = Math.min(timeoutMs, remaining);
-    }
-    return base(bin, args, { ...callOptions, timeoutMs, ...(token ? { token } : {}) });
+/**
+ * `gh auth token --user`: a timeout or a transport error is `unavailable`
+ * (exit 5, retry); only gh saying it has no such login is identity_unavailable.
+ */
+function authTokenResult(
+  issued: ReturnType<ForgeRunner>,
+  apiHost: string,
+  account: string,
+  workspace: string,
+): ForgeResult<Credential> {
+  if (issued.missing)
+    return failure(
+      "unavailable",
+      "gh is not installed",
+      "install the GitHub CLI (https://cli.github.com) and run: gh auth login",
+    );
+  if (issued.timedOut)
+    return failure(
+      "unavailable",
+      `gh auth token ${issued.timeoutMs === 0 ? "not attempted: the time budget ran out" : `timed out after ${issued.timeoutMs ?? FORGE_TIMEOUTS.api} ms`} (looking up the ${account} login on ${apiHost})`,
+      "gh auth status  # check gh and the network, then retry",
+    );
+  const token = issued.status === 0 ? issued.stdout.trim() : "";
+  if (token) return success({ token, credential: "gh_account_token" });
+  const stderr = redactText(issued.stderr).trim();
+  const first = stderr.split(/\r?\n/u).find((line) => line.trim()) ?? "";
+  if (issued.status !== 0 && first && !/no oauth token|not logged in|no account/iu.test(stderr))
+    return failure(
+      "unavailable",
+      `gh auth token failed${isNetworkError(stderr) ? " (network)" : ""}: ${first.slice(0, 200)}`,
+      "gh auth status  # check gh and the network, then retry",
+    );
+  return failure(
+    "blocked",
+    `identity_unavailable: gh has no login for ${account} on ${apiHost} (workspace ${workspace})`,
+    `gh auth login --hostname ${apiHost}  # sign in as ${account}; workit passes that account's token per call and never switches the active account`,
+  );
+}
+
+const configuredHosts = (): ForgeHosts => {
+  const vcs = readVcsConfig();
+  if (vcs.status !== "valid") return {};
+  const host = (kind: "github" | "gitlab"): string[] => {
+    const value = (vcs.config[kind] as { host?: unknown } | undefined)?.host;
+    return typeof value === "string" && value.trim() ? [value.trim()] : [];
   };
+  return { github: host("github"), gitlab: host("gitlab") };
+};
+
+const createForge = (derived: DerivedForge, repo: string, runner: ForgeRunner): Forge =>
+  derived.kind === "github"
+    ? createGitHubForge({ apiHost: derived.apiHost, repo, runner })
+    : createGitLabForge({ apiHost: derived.apiHost, repo, runner });
+
+export function resolveForge(
+  cwd: string,
+  options: ResolveOptions = {},
+): ForgeResult<ResolvedForge> {
+  let workspace: ReturnType<typeof resolveRuntimeWorkspaceVcs>;
+  try {
+    workspace = resolveRuntimeWorkspaceVcs(cwd);
+  } catch (error) {
+    return failure(
+      "blocked",
+      error instanceof Error ? error.message : String(error),
+      "fix ~/.config/workit/workspaces.json (workit init → Workspaces)",
+    );
+  }
+  const hosts = configuredHosts();
+  const pushed = pushForge(cwd, { branch: options.branch, hosts, sshConfig: options.sshConfig });
+  if (!pushed.ok) return failure(pushed.code, pushed.error, pushed.unblock);
+  const conflict = forgeConflict(pushed.forge, workspace?.vcs?.provider);
+  if (conflict) return failure("blocked", conflict.error, conflict.unblock);
+  const derived = pushed.forge;
+  const { kind, apiHost } = derived;
+  const base = options.runner ?? systemRunner(kind, apiHost, options.env ?? process.env);
+  const scope = memoScope(options.runner, options.env ?? process.env);
+  const now = options.now ?? Date.now;
+  const expectedAccount = workspace?.vcs?.account ?? null;
+  // The deadline covers resolution too, so a verb's --timeout bounds it all.
+  const limits: { deadline: number | null } = { deadline: options.deadline ?? null };
+  const credential = resolveCredential(workspace, derived, clampedRunner(base, limits, now), scope);
+  if (!credential.ok) return credential;
+  const runner = clampedRunner(base, limits, now, credential.data.token);
 
   // Base repository: an `upstream` remote on the same forge, else the fork parent.
   const headRepo = derived.repo;
-  const probe = createForge(derived, headRepo, runner);
+  const probe = memoizedIdentity(createForge(derived, headRepo, runner), scope, credential.data);
   const info = probe.repoInfo(headRepo);
   if (!info.ok && info.code !== "not_found") return info;
   const headProjectId = info.ok ? info.data.id : null;
@@ -201,13 +322,16 @@ export function resolveForge(
       : (remotes.find((name) => repoOfRemote(name) === baseRepo) ?? pushed.remote);
 
   return success({
-    forge: baseRepo === headRepo ? probe : createForge(derived, baseRepo, runner),
+    forge:
+      baseRepo === headRepo
+        ? probe
+        : memoizedIdentity(createForge(derived, baseRepo, runner), scope, credential.data),
     remote: pushed.remote,
     url: pushed.url,
     derived,
     workspace: workspace?.name ?? null,
     expectedAccount,
-    credential,
+    credential: credential.data.credential,
     headRepo,
     headProjectId,
     fork: baseRepo !== headRepo,
@@ -225,16 +349,142 @@ export function checkIdentity(resolved: ResolvedForge): ForgeResult<Identity> {
   const { forge, expectedAccount } = resolved;
   const identity = forge.identity(expectedAccount);
   if (!identity.ok) return identity;
-  if (identity.data.matches === false) {
-    const bin = forge.kind === "github" ? "gh" : "glab";
-    const where = `workspace ${resolved.workspace ?? "?"}`;
+  if (identity.data.matches === false)
+    return mismatch(resolved, identity.data.login ?? "?", resolved.workspace);
+  return identity;
+}
+
+const mismatch = <T>(
+  resolved: Pick<ResolvedForge, "forge" | "credential" | "expectedAccount">,
+  login: string,
+  workspace: string | null,
+): ForgeResult<T> => {
+  const { forge, expectedAccount } = resolved;
+  const bin = forge.kind === "github" ? "gh" : "glab";
+  const where = `workspace ${workspace ?? "?"}`;
+  const fileFix = `put a token for ${expectedAccount} in the ${where} vcs.tokenFile`;
+  return failure(
+    "blocked",
+    `identity_mismatch: the ${resolved.credential === "workspace_token_file" ? "vcs.tokenFile token" : `${bin} login`} is ${login} but ${where} expects ${expectedAccount}`,
+    resolved.credential === "workspace_token_file"
+      ? fileFix
+      : forge.kind === "github"
+        ? `gh auth login --hostname ${forge.apiHost}  # sign in as ${expectedAccount}`
+        : // glab keeps one login per host; switching it would change every repo.
+          `${fileFix} (glab keeps one login per host, so workit never switches it)`,
+  );
+};
+
+/** The forge could not answer at all, as opposed to answering against the account. */
+const unreachable = (result: { code: string; error: string }): boolean =>
+  result.code === "unavailable" && !/ is not authenticated for /u.test(result.error);
+
+/** Total budget for the identity check before a push (B1). */
+export const PUSH_IDENTITY_BUDGET_MS = 5_000;
+
+export type PushIdentity = {
+  /**
+   * verified: the forge says the credential is the workspace account.
+   * no_account: the workspace names no vcs.account, so there is nothing to check.
+   * skipped: the check could not run (forge down, slow, unknown, misconfigured);
+   * git pushes anyway and `reason` says why.
+   */
+  status: "verified" | "no_account" | "skipped";
+  forge: "github" | "gitlab" | null;
+  account: string | null;
+  login: string | null;
+  reason?: string;
+  unblock?: string;
+};
+
+/**
+ * The best-effort identity check before `git push`: git decides the transport,
+ * so a forge that cannot answer (missing, slow, offline, unknown, another
+ * provider) pushes with `status: "skipped"` and the reason (S10, B1). Positive
+ * evidence still blocks: another account, no gh login for the workspace
+ * account, a broken token file or a rejected credential. All calls share one
+ * `budgetMs`; explicit credentials are memoized.
+ */
+export function checkPushIdentity(
+  cwd: string,
+  options: Omit<ResolveOptions, "deadline"> & { budgetMs?: number } = {},
+): ForgeResult<PushIdentity> {
+  let workspace: ReturnType<typeof resolveRuntimeWorkspaceVcs>;
+  try {
+    workspace = resolveRuntimeWorkspaceVcs(cwd);
+  } catch (error) {
     return failure(
       "blocked",
-      `identity_mismatch: the ${resolved.credential === "workspace_token_file" ? "vcs.tokenFile token" : `${bin} login`} is ${identity.data.login} but ${where} expects ${expectedAccount}`,
-      resolved.credential === "workspace_token_file"
-        ? `put a token for ${expectedAccount} in the ${where} vcs.tokenFile`
-        : `${bin} auth login --hostname ${forge.apiHost}  # sign in as ${expectedAccount}`,
+      error instanceof Error ? error.message : String(error),
+      "fix ~/.config/workit/workspaces.json (workit init → Workspaces)",
     );
   }
-  return identity;
+  const account = workspace?.vcs?.account ?? null;
+  const skipped = (forge: PushIdentity["forge"], reason: string, unblock?: string) =>
+    success<PushIdentity>({
+      status: "skipped",
+      forge,
+      account,
+      login: null,
+      reason,
+      ...(unblock ? { unblock } : {}),
+    });
+  const pushed = pushForge(cwd, {
+    branch: options.branch,
+    hosts: configuredHosts(),
+    sshConfig: options.sshConfig,
+  });
+  if (!pushed.ok) {
+    const host = /^unsupported_forge: .*?"([^"]+)"/u.exec(pushed.error)?.[1];
+    const what = /could not resolve ssh alias/u.test(pushed.error)
+      ? `could not resolve ssh alias ${host} to GitHub or GitLab`
+      : pushed.error.startsWith("unsupported_forge: ssh host")
+        ? `ssh host ${host} is not a GitHub/GitLab host or an alias workit can resolve`
+        : `${host} is not a GitHub or GitLab host workit knows`;
+    return skipped(
+      null,
+      host
+        ? `unsupported_forge: ${what}; account checks skipped, pushed with git only (no PR or CI verbs)`
+        : pushed.error,
+      pushed.unblock,
+    );
+  }
+  const derived = pushed.forge;
+  const conflict = forgeConflict(derived, workspace?.vcs?.provider);
+  if (conflict) return skipped(derived.kind, conflict.error, conflict.unblock);
+  if (!account) return success({ status: "no_account", forge: derived.kind, account, login: null });
+
+  const base =
+    options.runner ?? systemRunner(derived.kind, derived.apiHost, options.env ?? process.env);
+  const scope = memoScope(options.runner, options.env ?? process.env);
+  const now = options.now ?? Date.now;
+  const limits = { deadline: now() + (options.budgetMs ?? PUSH_IDENTITY_BUDGET_MS) };
+  const credential = resolveCredential(workspace, derived, clampedRunner(base, limits, now), scope);
+  // A forge that cannot answer (missing CLI, timeout, transport) is skipped;
+  // local evidence against the account (no gh login for it, a broken
+  // vcs.tokenFile, a rejected credential) still blocks: over HTTPS git would
+  // push with whatever account gh's credential helper has active.
+  if (!credential.ok)
+    return unreachable(credential)
+      ? skipped(derived.kind, credential.error, credential.unblock)
+      : credential;
+  const forge = memoizedIdentity(
+    createForge(derived, derived.repo, clampedRunner(base, limits, now, credential.data.token)),
+    scope,
+    credential.data,
+  );
+  const identity = forge.identity(account);
+  if (!identity.ok)
+    return unreachable(identity)
+      ? skipped(derived.kind, identity.error, identity.unblock)
+      : identity;
+  if (identity.data.matches === false)
+    return mismatch(
+      { forge, credential: credential.data.credential, expectedAccount: account },
+      identity.data.login ?? "?",
+      workspace?.name ?? null,
+    );
+  if (identity.data.matches === null)
+    return skipped(derived.kind, identity.data.note ?? "the credential cannot read /user");
+  return success({ status: "verified", forge: derived.kind, account, login: identity.data.login });
 }