@cerebral-work/lizard 0.1.0 → 0.1.1

package/lib/lizard-install.d.ts

@@ -23,6 +23,9 @@ export class InstallError extends Error {}
 export const REPO: string;
 export const USAGE: string;
 
+/** The environment minus a GITHUB_TOKEN or GH_TOKEN holding an `op://` reference. */
+export function withoutOpRefs(env: Record<string, string | undefined>): Record<string, string | undefined>;
+
 /** The release asset's Rust target triple for a Node platform and arch. */
 export function targetFor(platform: string, arch: string): string;
 

package/lib/lizard-install.mjs

@@ -55,11 +55,24 @@ export function targetFor(platform, arch) {
   throw new InstallError(`lizard has no build for ${platform}-${arch}.`);
 }
 
+// The environment minus a GITHUB_TOKEN or GH_TOKEN that holds a 1Password
+// reference rather than a token. Shells that source op refs export the literal
+// `op://...` placeholder, and gh sends whatever those variables hold as its
+// token, so it would fail instead of using the stored gh login.
+export function withoutOpRefs(env) {
+  const out = { ...env };
+  for (const k of ["GITHUB_TOKEN", "GH_TOKEN"]) {
+    if (out[k]?.startsWith("op://")) delete out[k];
+  }
+  return out;
+}
+
 // Resolves { status, stdout, stderr, error }. status is the exit code, or null
 // when the process never ran (error is then set) or was killed by a signal.
 function run(cmd, args) {
   return new Promise((done) => {
-    execFile(cmd, args, { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }, (err, stdout, stderr) => {
+    const options = { encoding: "utf8", maxBuffer: 64 * 1024 * 1024, env: withoutOpRefs(process.env) };
+    execFile(cmd, args, options, (err, stdout, stderr) => {
       if (err && typeof err.code !== "number") {
         done({ status: null, stdout, stderr, error: err });
       } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cerebral-work/lizard",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Installer for lizard, the estate onboarding and control TUI. Downloads the release binary with your own gh login and verifies its SHA-256.",
   "license": "MIT",
   "repository": {