@cursor/july 0.1.68 → 0.1.74

package/dist/internal/shallow-clone.d.ts

@@ -1,5 +1,5 @@
 /**
- * Shallow GitHub PR checkout for SDK agents that review a PR's code.
+ * Shallow SCM PR checkout for SDK agents that review a PR's code.
  *
  * Mirrors Bugbot's `shallow_fetch` prefetch strategy
  * (`backend/crates/napi_bugbot/src/temp_clone.rs`): instead of cloning the
@@ -10,11 +10,19 @@
  * clone because its tools stream objects on demand; SDK agents read a real
  * working tree, so we materialize the head checkout instead.
  *
- * Auth also mirrors Bugbot's provider model (`IGitProvider.getAccessToken`
- * → token handed straight to git): the clone takes one explicit repo-scoped
- * bearer token. The default source is the serve host's Cursor-account
- * GitHub lease — the same backend `GithubAccessService` mint Bugbot uses —
- * which `CursorGithubCredentialProvider` installs as `GH_TOKEN` for child
+ * SCM support follows Bugbot's provider seam (`IGitProvider.getCloneTarget`
+ * / the Rust `clone_url` dispatch): everything provider-specific — remote
+ * URL shape, git credential username convention, PR head ref layout — lives
+ * in one {@link ScmCloneTarget} produced by {@link resolveScmCloneTarget}.
+ * Supporting another SCM (GitLab, Bitbucket, …) means adding a resolver
+ * case and a default credential source; the fetch/verify/checkout machinery
+ * is provider-agnostic.
+ *
+ * Auth also mirrors Bugbot (`IGitProvider.getAccessToken` → token handed
+ * straight to git): the clone takes one explicit repo-scoped bearer token.
+ * For GitHub the default source is the serve host's Cursor-account lease —
+ * the same backend `GithubAccessService` mint Bugbot uses — which
+ * `CursorGithubCredentialProvider` installs as `GH_TOKEN` for child
  * processes. Where Bugbot embeds the token in the clone URL, this module
  * serves it through an inline credential helper that reads a child-process
  * env var, so the token never lands in argv or in `.git/config` inside a
@@ -24,34 +32,90 @@
  * the security reviewer's `prepare_review` stage). Consumed via relative
  * source imports, following `tenant-mcp/run-mcp-registry.ts`.
  */
-export type ShallowPrCheckout = {
-    /** Directory containing the PR head working tree (detached at headSha). */
-    checkoutDir: string;
-    headSha: string;
-    /** True when the merge-base commit was also fetched (enables local diffs). */
-    baseFetched: boolean;
-    /** How the head commit was obtained. */
-    headSource: "sha_fetch" | "pr_ref_fetch";
+/** SCMs with shallow-clone support. */
+export type ScmProvider = "github";
+/**
+ * Everything git needs to clone one SCM's PR head. Provider-specific
+ * conventions live here and nowhere else.
+ */
+export type ScmCloneTarget = {
+    provider: ScmProvider;
+    /** `owner/name` — used for logs and error messages. */
+    repo: string;
+    prNumber: number;
+    /** HTTPS remote to fetch from. */
+    remoteUrl: string;
+    /** Username paired with the bearer token for git-over-HTTPS basic auth. */
+    credentialUsername: string;
+    /**
+     * Server-advertised PR head ref (e.g. GitHub `refs/pull/<n>/head`,
+     * GitLab `refs/merge-requests/<n>/head`) — the fallback when the pinned
+     * SHA cannot be fetched directly.
+     */
+    prHeadRef: string;
 };
-/** Repo-scoped bearer for git-over-HTTPS (installation token or PAT). */
+/**
+ * Resolve a PR URL to its clone target, or `undefined` when the SCM has no
+ * shallow-clone support (callers then review on their fallback checkout —
+ * e.g. Origin PRs, where the host checkout already is the reviewed repo).
+ */
+export declare function resolveScmCloneTarget(prUrl: string): ScmCloneTarget | undefined;
+/** Repo-scoped bearer for git-over-HTTPS. */
 export type ShallowCloneAuth = {
     token: string;
 };
 /**
- * Default clone credential: the serve host's Cursor-account GitHub lease.
+ * Default GitHub clone credential: the serve host's Cursor-account lease.
  * `CursorGithubCredentialProvider` mints it repo-scoped from the backend and
  * keeps `GH_TOKEN` refreshed for child processes; `GITHUB_TOKEN` covers
  * local/CI runs that export the conventional variable instead.
  */
 export declare function serveHostGithubAuth(env?: NodeJS.ProcessEnv): ShallowCloneAuth | undefined;
+export type CommitRangeDiff = {
+    status: "ok";
+    diff: string;
+} | {
+    status: "unavailable";
+    reason: string;
+};
 /**
- * Create a fresh shallow checkout of a GitHub PR head at `checkoutDir`.
+ * Diff two commits inside an existing shallow PR checkout, fetching either
+ * end on demand when the shallow history does not already contain it.
+ *
+ * Lives here because it needs the same authenticated git the clone uses —
+ * a `--depth=1` checkout usually lacks the older commit, so reading a range
+ * means another credentialed fetch. Never throws: every failure becomes an
+ * `unavailable` reason the caller can act on or surface.
+ */
+export declare function tryDiffCommitRange(args: {
+    /** Existing checkout to run git in (see {@link createShallowPrCheckout}). */
+    checkoutDir: string;
+    /** The checkout's clone target; supplies the remote's ref + auth conventions. */
+    target: ScmCloneTarget;
+    from: string;
+    to: string;
+    /** Restrict the diff to one path when set. */
+    file?: string | undefined;
+    /** Fetch credential; defaults to the target provider's credential source. */
+    auth?: ShallowCloneAuth | undefined;
+}): Promise<CommitRangeDiff>;
+export type ShallowPrCheckout = {
+    /** Directory containing the PR head working tree (detached at headSha). */
+    checkoutDir: string;
+    headSha: string;
+    /** True when the merge-base commit was also fetched (enables local diffs). */
+    baseFetched: boolean;
+    /** How the head commit was obtained. */
+    headSource: "sha_fetch" | "pr_ref_fetch";
+};
+/**
+ * Create a fresh shallow checkout of a PR head at `checkoutDir`.
  *
  * Fetch order (both single depth-1 round-trips):
  * 1. Fetch `headSha` (and `baseSha` when known) directly — GitHub advertises
  *    `allow-reachable-sha1-in-want`, and this pins the exact reviewed commit
  *    the way Bugbot's `shallow_fetch` does.
- * 2. Fall back to `refs/pull/<n>/head`, verifying it still resolves to
+ * 2. Fall back to the target's PR head ref, verifying it still resolves to
  *    `headSha` so the working tree cannot silently drift from the pinned
  *    patch in the review bundle.
  *
@@ -59,35 +123,26 @@ export declare function serveHostGithubAuth(env?: NodeJS.ProcessEnv): ShallowClo
  * patch text in their prompt); a missing head checkout throws.
  */
 export declare function createShallowPrCheckout(args: {
-    /** `owner/name`. */
-    repo: string;
-    prNumber?: number | undefined;
+    target: ScmCloneTarget;
     headSha: string;
     /** Merge-base SHA; fetched too so `git diff baseSha headSha` works locally. */
     baseSha?: string | undefined;
     checkoutDir: string;
-    /** Clone credential; required for GitHub remotes, unused for file fixtures. */
+    /** Clone credential; required for HTTPS remotes, unused for file fixtures. */
     auth?: ShallowCloneAuth | undefined;
-    /** Test seam: clone from this URL instead of `https://github.com/<repo>.git`. */
-    remoteUrl?: string | undefined;
 }): Promise<ShallowPrCheckout>;
-/** True for `https://github.com/<owner>/<repo>/pull/<n>` URLs. */
-export declare function isGithubPrUrl(prUrl: string): boolean;
 export type TryShallowPrCheckoutOptions = {
-    /** PR URL; only GitHub PR URLs are cloned (others skip). */
+    /** PR URL; resolved to a clone target (unsupported SCMs skip). */
     prUrl: string;
-    /** `owner/name`. */
-    repo: string;
-    prNumber?: number | undefined;
     /** Pinned head SHA; skipped (undefined result) when unknown. */
     headSha?: string | undefined;
     /** Merge-base SHA; fetched too so `git diff baseSha headSha` works locally. */
     baseSha?: string | undefined;
     checkoutDir: string;
-    /** Clone credential; defaults to {@link serveHostGithubAuth}. */
+    /** Clone credential; defaults to the target provider's credential source. */
     auth?: ShallowCloneAuth | undefined;
-    /** Test seam: clone from this URL instead of `https://github.com/<repo>.git`. */
-    remoteUrl?: string | undefined;
+    /** Test seam: clone this target instead of resolving `prUrl`. */
+    target?: ScmCloneTarget | undefined;
 };
 export type TryShallowPrCheckoutResult = {
     /** Set when the shallow checkout succeeded. */
@@ -104,12 +159,12 @@ export type TryShallowPrCheckoutResult = {
  * reviewed repo instead of the host's own checkout.
  *
  * Returns no checkout — leaving the caller on its fallback working
- * directory — when the PR is not on GitHub (e.g. Origin PRs, where the host
- * checkout is the reviewed repo), when no head SHA is pinned, when no clone
- * credential is available, or when the clone fails; `fallbackReason` says
- * which. Failures are logged, never thrown: agents still have the pinned
- * patch in their prompts, so a missing checkout degrades quality rather
- * than the run.
+ * directory — when the PR's SCM has no clone support (e.g. Origin PRs,
+ * where the host checkout is the reviewed repo), when no head SHA is
+ * pinned, when no clone credential is available, or when the clone fails;
+ * `fallbackReason` says which. Failures are logged, never thrown: agents
+ * still have the pinned patch in their prompts, so a missing checkout
+ * degrades quality rather than the run.
  */
 export declare function tryCreateShallowPrCheckout(options: TryShallowPrCheckoutOptions): Promise<TryShallowPrCheckoutResult>;
 //# sourceMappingURL=shallow-clone.d.ts.map

package/dist/internal/shallow-clone.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shallow-clone.d.ts","sourceRoot":"","sources":["../../src/internal/shallow-clone.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,WAAW,EAAE,OAAO,CAAC;IACrB,wCAAwC;IACxC,UAAU,EAAE,WAAW,GAAG,cAAc,CAAC;CAC1C,CAAC;AAEF,yEAAyE;AACzE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,gBAAgB,GAAG,SAAS,CAG9B;AA0GD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACpC,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgH7B;AAED,kEAAkE;AAClE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAapD;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,IAAI,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACpC,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CA2CrC"}
+{"version":3,"file":"shallow-clone.d.ts","sourceRoot":"","sources":["../../src/internal/shallow-clone.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,uCAAuC;AACvC,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC;AAEnC;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,WAAW,CAAC;IACtB,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,GACZ,cAAc,GAAG,SAAS,CA0B5B;AAED,6CAA6C;AAC7C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,gBAAgB,GAAG,SAAS,CAG9B;AAyBD,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9C;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,MAAM,EAAE,cAAc,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACrC,GAAG,OAAO,CAAC,eAAe,CAAC,CAiD3B;AA0CD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,WAAW,EAAE,OAAO,CAAC;IACrB,wCAAwC;IACxC,UAAU,EAAE,WAAW,GAAG,cAAc,CAAC;CAC1C,CAAC;AAqHF;;;;;;;;;;;;;GAaG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,IAAI,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACrC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuG7B;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACpC,iEAAiE;IACjE,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CA+CrC"}

package/dist/internal/shallow-clone.js

@@ -12,7 +12,38 @@ import { mkdirSync, rmSync } from "node:fs";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
 /**
- * Default clone credential: the serve host's Cursor-account GitHub lease.
+ * Resolve a PR URL to its clone target, or `undefined` when the SCM has no
+ * shallow-clone support (callers then review on their fallback checkout —
+ * e.g. Origin PRs, where the host checkout already is the reviewed repo).
+ */
+export function resolveScmCloneTarget(prUrl) {
+    let url;
+    try {
+        url = new URL(prUrl);
+    }
+    catch (_a) {
+        return undefined;
+    }
+    const parts = url.pathname.split("/").filter(Boolean);
+    if (url.hostname === "github.com" &&
+        parts.length >= 4 &&
+        parts[2] === "pull" &&
+        Number.isInteger(Number(parts[3]))) {
+        const repo = `${parts[0]}/${parts[1]}`;
+        const prNumber = Number(parts[3]);
+        return {
+            provider: "github",
+            repo,
+            prNumber,
+            remoteUrl: `https://github.com/${repo}.git`,
+            credentialUsername: "x-access-token",
+            prHeadRef: `refs/pull/${prNumber}/head`,
+        };
+    }
+    return undefined;
+}
+/**
+ * Default GitHub clone credential: the serve host's Cursor-account lease.
  * `CursorGithubCredentialProvider` mints it repo-scoped from the backend and
  * keeps `GH_TOKEN` refreshed for child processes; `GITHUB_TOKEN` covers
  * local/CI runs that export the conventional variable instead.
@@ -22,6 +53,107 @@ export function serveHostGithubAuth(env = process.env) {
     const token = ((_b = (_a = env.GH_TOKEN) !== null && _a !== void 0 ? _a : env.GITHUB_TOKEN) !== null && _b !== void 0 ? _b : "").trim();
     return token === "" ? undefined : { token };
 }
+/** Pair the provider's git-over-HTTPS username with the bearer token. */
+function cloneCredential(target, auth) {
+    return auth === undefined
+        ? undefined
+        : { username: target.credentialUsername, token: auth.token };
+}
+/** Default clone credential source per provider. */
+function defaultCloneAuth(target) {
+    switch (target.provider) {
+        case "github":
+            return serveHostGithubAuth();
+    }
+}
+/** Cap on diff text handed to a model; beyond this it is truncated. */
+const DIFF_MAX_CHARS = 80000;
+/**
+ * Diff two commits inside an existing shallow PR checkout, fetching either
+ * end on demand when the shallow history does not already contain it.
+ *
+ * Lives here because it needs the same authenticated git the clone uses —
+ * a `--depth=1` checkout usually lacks the older commit, so reading a range
+ * means another credentialed fetch. Never throws: every failure becomes an
+ * `unavailable` reason the caller can act on or surface.
+ */
+export function tryDiffCommitRange(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (!isFullCommitSha(args.from) || !isFullCommitSha(args.to)) {
+            return {
+                status: "unavailable",
+                reason: "Could not compute a reliable diff because a commit SHA was not a full 40-character SHA.",
+            };
+        }
+        const credential = cloneCredential(args.target, (_a = args.auth) !== null && _a !== void 0 ? _a : defaultCloneAuth(args.target));
+        for (const sha of [args.from, args.to]) {
+            if (!(yield ensureCommitFetched(args.checkoutDir, sha, args.target, credential))) {
+                return {
+                    status: "unavailable",
+                    reason: "Could not compute a reliable diff because a commit was unavailable in the checkout.",
+                };
+            }
+        }
+        try {
+            const diff = yield git(args.checkoutDir, [
+                "diff",
+                "--no-ext-diff",
+                "--unified=80",
+                `${args.from}..${args.to}`,
+                ...(args.file === undefined ? [] : ["--", args.file]),
+            ]);
+            return {
+                status: "ok",
+                diff: diff.length <= DIFF_MAX_CHARS
+                    ? diff
+                    : `${diff.slice(0, DIFF_MAX_CHARS)}\n\n[diff truncated at ${DIFF_MAX_CHARS} characters]`,
+            };
+        }
+        catch (_b) {
+            return {
+                status: "unavailable",
+                reason: "Could not compute a reliable diff because git diff failed.",
+            };
+        }
+    });
+}
+function isFullCommitSha(value) {
+    return /^[0-9a-f]{40}$/i.test(value);
+}
+/** Present already, or fetchable by SHA, or reachable from the PR head ref. */
+function ensureCommitFetched(checkoutDir, sha, target, credential) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if ((yield revParse(checkoutDir, sha)) !== undefined) {
+            return true;
+        }
+        const attempts = [
+            [...FETCH_ARGS, sha],
+            // Deeper history on the PR head ref: the older end of an inter-run range
+            // is usually an ancestor of the tip rather than the tip itself.
+            [
+                "fetch",
+                "--depth=200",
+                "--no-tags",
+                "--quiet",
+                "origin",
+                target.prHeadRef,
+            ],
+        ];
+        for (const attempt of attempts) {
+            try {
+                yield git(checkoutDir, attempt, credential);
+                if ((yield revParse(checkoutDir, sha)) !== undefined) {
+                    return true;
+                }
+            }
+            catch (_a) {
+                // Try the next strategy; the caller fails closed if none work.
+            }
+        }
+        return false;
+    });
+}
 function logShallowClone(message, fields = {}) {
     const suffix = Object.entries(fields)
         .filter(([, value]) => value !== undefined)
@@ -55,12 +187,12 @@ function gitError(args, error) {
     return new Error(`git ${args.join(" ")} failed — ${detail}`);
 }
 /**
- * The one credential helper git may use: serve the caller-provided token
- * from the child process env at request time. The shell reads
- * `$SHALLOW_CLONE_GIT_TOKEN` when git asks, keeping the token out of argv.
+ * The one credential helper git may use: serve the caller-provided
+ * credential from the child process env at request time. The shell reads
+ * the values when git asks, keeping the token out of argv.
  */
-const TOKEN_CREDENTIAL_HELPER = '!f() { test "$1" = get && printf "username=x-access-token\\npassword=$SHALLOW_CLONE_GIT_TOKEN\\n"; }; f';
-function git(cwd, args, auth) {
+const CREDENTIAL_HELPER = '!f() { test "$1" = get && printf "username=$SHALLOW_CLONE_GIT_USERNAME\\npassword=$SHALLOW_CLONE_GIT_TOKEN\\n"; }; f';
+function git(cwd, args, credential) {
     return __awaiter(this, void 0, void 0, function* () {
         // Async on purpose: fetches/checkouts of large repos take minutes, and the
         // serve host runs the clone in-process. A synchronous git call blocks the
@@ -68,9 +200,9 @@ function git(cwd, args, auth) {
         // long enough for the platform's probe budget to replace the engine.
         try {
             const { stdout } = yield execFileAsync("git", [
-                ...(auth === undefined
+                ...(credential === undefined
                     ? []
-                    : ["-c", `credential.helper=${TOKEN_CREDENTIAL_HELPER}`]),
+                    : ["-c", `credential.helper=${CREDENTIAL_HELPER}`]),
                 ...args,
             ], {
                 cwd,
@@ -82,9 +214,12 @@ function git(cwd, args, auth) {
                     // .com/.insteadOf` entries scoped to a *different* repo, as cloud
                     // VMs bake in) cannot hijack auth away from the explicit token,
                     // and no ambient credential helpers run against PR-author input.
-                    GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_SYSTEM: "/dev/null", GIT_TERMINAL_PROMPT: "0" }), (auth === undefined
+                    GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_SYSTEM: "/dev/null", GIT_TERMINAL_PROMPT: "0" }), (credential === undefined
                     ? {}
-                    : { SHALLOW_CLONE_GIT_TOKEN: auth.token })),
+                    : {
+                        SHALLOW_CLONE_GIT_USERNAME: credential.username,
+                        SHALLOW_CLONE_GIT_TOKEN: credential.token,
+                    })),
             });
             return stdout;
         }
@@ -105,14 +240,16 @@ function revParse(cwd, rev) {
     });
 }
 const FETCH_ARGS = ["fetch", "--depth=1", "--no-tags", "--quiet", "origin"];
+/** Local tracking ref the PR head ref is fetched into. */
+const LOCAL_PR_HEAD_REF = "refs/remotes/origin/shallow-clone-pr-head";
 /**
- * Create a fresh shallow checkout of a GitHub PR head at `checkoutDir`.
+ * Create a fresh shallow checkout of a PR head at `checkoutDir`.
  *
  * Fetch order (both single depth-1 round-trips):
  * 1. Fetch `headSha` (and `baseSha` when known) directly — GitHub advertises
  *    `allow-reachable-sha1-in-want`, and this pins the exact reviewed commit
  *    the way Bugbot's `shallow_fetch` does.
- * 2. Fall back to `refs/pull/<n>/head`, verifying it still resolves to
+ * 2. Fall back to the target's PR head ref, verifying it still resolves to
  *    `headSha` so the working tree cannot silently drift from the pinned
  *    patch in the review bundle.
  *
@@ -121,23 +258,19 @@ const FETCH_ARGS = ["fetch", "--depth=1", "--no-tags", "--quiet", "origin"];
  */
 export function createShallowPrCheckout(args) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        const { repo, prNumber, headSha, baseSha, checkoutDir, auth } = args;
+        const { target, headSha, baseSha, checkoutDir, auth } = args;
+        const { repo, prNumber } = target;
+        const credential = cloneCredential(target, auth);
         const startedAt = Date.now();
         logShallowClone("cloning PR head", { repo, prNumber, headSha, baseSha });
         rmSync(checkoutDir, { recursive: true, force: true });
         mkdirSync(checkoutDir, { recursive: true });
         yield git(checkoutDir, ["init", "--quiet"]);
-        yield git(checkoutDir, [
-            "remote",
-            "add",
-            "origin",
-            (_a = args.remoteUrl) !== null && _a !== void 0 ? _a : `https://github.com/${repo}.git`,
-        ]);
+        yield git(checkoutDir, ["remote", "add", "origin", target.remoteUrl]);
         const shaFetch = () => __awaiter(this, void 0, void 0, function* () {
             const extraBase = baseSha === undefined || baseSha === headSha ? [] : [baseSha];
             try {
-                yield git(checkoutDir, [...FETCH_ARGS, headSha, ...extraBase], auth);
+                yield git(checkoutDir, [...FETCH_ARGS, headSha, ...extraBase], credential);
             }
             catch (error) {
                 if (extraBase.length === 0) {
@@ -151,29 +284,24 @@ export function createShallowPrCheckout(args) {
                     baseSha,
                     error: errorSummary(error),
                 });
-                yield git(checkoutDir, [...FETCH_ARGS, headSha], auth);
+                yield git(checkoutDir, [...FETCH_ARGS, headSha], credential);
             }
         });
         let headSource;
-        let shaFetchError;
         try {
             yield shaFetch();
             headSource = "sha_fetch";
         }
         catch (error) {
-            shaFetchError = errorSummary(error);
-            if (prNumber === undefined) {
-                throw new Error(`Shallow SHA fetch failed for ${repo}@${headSha} and no PR number is available for a ref fallback: ${shaFetchError}`);
-            }
+            const shaFetchError = errorSummary(error);
             logShallowClone("sha fetch failed; falling back to PR head ref", {
                 repo,
                 prNumber,
                 headSha,
                 error: shaFetchError,
             });
-            const prRef = `refs/pull/${prNumber}/head`;
-            yield git(checkoutDir, [...FETCH_ARGS, `+${prRef}:refs/remotes/origin/pr/${prNumber}/head`], auth);
-            const fetchedSha = yield revParse(checkoutDir, `refs/remotes/origin/pr/${prNumber}/head`);
+            yield git(checkoutDir, [...FETCH_ARGS, `+${target.prHeadRef}:${LOCAL_PR_HEAD_REF}`], credential);
+            const fetchedSha = yield revParse(checkoutDir, LOCAL_PR_HEAD_REF);
             if (fetchedSha !== headSha) {
                 throw new Error(`Shallow PR ref fetch for ${repo}#${prNumber} resolved to ${fetchedSha !== null && fetchedSha !== void 0 ? fetchedSha : "nothing"}, expected pinned head ${headSha} (sha fetch error: ${shaFetchError})`);
             }
@@ -194,7 +322,7 @@ export function createShallowPrCheckout(args) {
             // Best-effort: local diffs are nice-to-have, the pinned patch in the
             // prompt is the authoritative delta either way.
             try {
-                yield git(checkoutDir, [...FETCH_ARGS, baseSha], auth);
+                yield git(checkoutDir, [...FETCH_ARGS, baseSha], credential);
                 baseFetched = (yield revParse(checkoutDir, baseSha)) !== undefined;
             }
             catch (error) {
@@ -218,71 +346,63 @@ export function createShallowPrCheckout(args) {
         return { checkoutDir, headSha, baseFetched, headSource };
     });
 }
-/** True for `https://github.com/<owner>/<repo>/pull/<n>` URLs. */
-export function isGithubPrUrl(prUrl) {
-    try {
-        const url = new URL(prUrl);
-        const parts = url.pathname.split("/").filter(Boolean);
-        return (url.hostname === "github.com" &&
-            parts.length >= 4 &&
-            parts[2] === "pull" &&
-            Number.isInteger(Number(parts[3])));
-    }
-    catch (_a) {
-        return false;
-    }
-}
 /**
  * Best-effort shallow PR checkout for hosts whose SDK agents should read the
  * reviewed repo instead of the host's own checkout.
  *
  * Returns no checkout — leaving the caller on its fallback working
- * directory — when the PR is not on GitHub (e.g. Origin PRs, where the host
- * checkout is the reviewed repo), when no head SHA is pinned, when no clone
- * credential is available, or when the clone fails; `fallbackReason` says
- * which. Failures are logged, never thrown: agents still have the pinned
- * patch in their prompts, so a missing checkout degrades quality rather
- * than the run.
+ * directory — when the PR's SCM has no clone support (e.g. Origin PRs,
+ * where the host checkout is the reviewed repo), when no head SHA is
+ * pinned, when no clone credential is available, or when the clone fails;
+ * `fallbackReason` says which. Failures are logged, never thrown: agents
+ * still have the pinned patch in their prompts, so a missing checkout
+ * degrades quality rather than the run.
  */
 export function tryCreateShallowPrCheckout(options) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        const { prUrl, repo, prNumber, headSha, baseSha, checkoutDir, remoteUrl } = options;
-        if (remoteUrl === undefined && !isGithubPrUrl(prUrl)) {
-            logShallowClone("skipped: not a GitHub PR URL", { prUrl });
-            return { fallbackReason: "skipped: not a GitHub PR URL" };
+        var _a, _b;
+        const { prUrl, headSha, baseSha, checkoutDir } = options;
+        const target = (_a = options.target) !== null && _a !== void 0 ? _a : resolveScmCloneTarget(prUrl);
+        if (target === undefined) {
+            logShallowClone("skipped: unsupported SCM for shallow clone", { prUrl });
+            return { fallbackReason: "skipped: unsupported SCM for shallow clone" };
         }
         if (headSha === undefined) {
-            logShallowClone("skipped: no pinned head SHA", { repo, prUrl });
+            logShallowClone("skipped: no pinned head SHA", {
+                repo: target.repo,
+                prUrl,
+            });
             return { fallbackReason: "skipped: no pinned head SHA" };
         }
-        const auth = (_a = options.auth) !== null && _a !== void 0 ? _a : serveHostGithubAuth();
-        if (remoteUrl === undefined && auth === undefined) {
-            // Fail fast instead of letting an unauthenticated fetch 404/hang: real
-            // GitHub clones need the serve host's lease (or an explicit token).
-            logShallowClone("skipped: no GitHub clone credential", { repo, prUrl });
+        const auth = (_b = options.auth) !== null && _b !== void 0 ? _b : defaultCloneAuth(target);
+        if (auth === undefined && target.remoteUrl.startsWith("https://")) {
+            // Fail fast instead of letting an unauthenticated fetch 404/hang: HTTPS
+            // clones need the provider's credential (or an explicit token).
+            logShallowClone("skipped: no clone credential", {
+                repo: target.repo,
+                provider: target.provider,
+                prUrl,
+            });
             return {
-                fallbackReason: "skipped: no GitHub clone credential (serve host GH_TOKEN lease not installed)",
+                fallbackReason: `skipped: no ${target.provider} clone credential (serve host token lease not installed)`,
             };
         }
         try {
             return {
                 checkout: yield createShallowPrCheckout({
-                    repo,
-                    prNumber,
+                    target,
                     headSha,
                     baseSha,
                     checkoutDir,
                     auth,
-                    remoteUrl,
                 }),
             };
         }
         catch (error) {
             const reason = errorSummary(error);
             logShallowClone("failed; caller falls back to host checkout", {
-                repo,
-                prNumber,
+                repo: target.repo,
+                prNumber: target.prNumber,
                 headSha,
                 error: reason,
             });

package/dist/internal/terminal-style.d.ts

@@ -17,6 +17,24 @@ export declare function makePalette(enabled: boolean): TerminalPalette;
 export declare function stdoutPalette(): TerminalPalette;
 /** Palette for human-facing stderr (login progress, warnings). */
 export declare function stderrPalette(): TerminalPalette;
+/** Visible column count, ignoring CSI color/style and OSC 8 hyperlinks. */
+export declare function visibleWidth(text: string): number;
+/** True when `text` already carries CSI styling or OSC 8 (do not wrap again). */
+export declare function hasAnsiStyling(text: string): boolean;
+/**
+ * Clickable terminal hyperlink (OSC 8). The URI is the click target; `label`
+ * is what the user sees. `visibleWidth` ignores the OSC wrapper.
+ */
+export declare function terminalHyperlink(url: string, label: string, enabled?: boolean): string;
+/**
+ * Unicode box around `lines`. `color` wraps the whole box (borders + body)
+ * so a warning panel can be yellow without per-line prefixes.
+ */
+export declare function formatTerminalBox(lines: readonly string[], options?: {
+    color?: (s: string) => string;
+    minWidth?: number;
+    padding?: number;
+}): string;
 /** Wipe the terminal before a `dev` Enter-to-restart cycle. */
 export declare function clearTerminal(stream?: NodeJS.WriteStream): void;
 //# sourceMappingURL=terminal-style.d.ts.map

package/dist/internal/terminal-style.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terminal-style.d.ts","sourceRoot":"","sources":["../../src/internal/terminal-style.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;CAC/B;AAcD,wBAAgB,eAAe,CAC7B,MAAM,GAAE,MAAM,CAAC,WAA4B,GAC1C,OAAO,CAET;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,eAAe,CAiB7D;AAED,oEAAoE;AACpE,wBAAgB,aAAa,IAAI,eAAe,CAE/C;AAED,kEAAkE;AAClE,wBAAgB,aAAa,IAAI,eAAe,CAE/C;AAED,+DAA+D;AAC/D,wBAAgB,aAAa,CAC3B,MAAM,GAAE,MAAM,CAAC,WAA4B,GAC1C,IAAI,CAMN"}
+{"version":3,"file":"terminal-style.d.ts","sourceRoot":"","sources":["../../src/internal/terminal-style.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;CAC/B;AAsBD,wBAAgB,eAAe,CAC7B,MAAM,GAAE,MAAM,CAAC,WAA4B,GAC1C,OAAO,CAET;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,eAAe,CAiB7D;AAED,oEAAoE;AACpE,wBAAgB,aAAa,IAAI,eAAe,CAE/C;AAED,kEAAkE;AAClE,wBAAgB,aAAa,IAAI,eAAe,CAE/C;AAED,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,OAA2B,GACnC,MAAM,CAKR;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,CAAC,EAAE;IACR,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,MAAM,CAoBR;AAED,+DAA+D;AAC/D,wBAAgB,aAAa,CAC3B,MAAM,GAAE,MAAM,CAAC,WAA4B,GAC1C,IAAI,CAMN"}