@episoda/cli 0.2.158 → 0.2.160

package/dist/index.js

@@ -1653,10 +1653,6 @@ var require_git_executor = __commonJS({
             };
           } catch {
           }
-          try {
-            await this.runGitCommand(["fetch", "--all", "--prune"], cwd, options);
-          } catch {
-          }
           const args = ["worktree", "add"];
           if (command.detach) {
             args.push("--detach", command.path);
@@ -3203,13 +3199,14 @@ async function getDevServerStatus() {
 }
 
 // src/commands/daemon.ts
-var import_child_process4 = require("child_process");
+var import_child_process5 = require("child_process");
 var path6 = __toESM(require("path"));
 var fs5 = __toESM(require("fs"));
 
 // src/daemon/worktree-manager.ts
 var fs2 = __toESM(require("fs"));
 var path3 = __toESM(require("path"));
+var import_child_process2 = require("child_process");
 var import_core3 = __toESM(require_dist());
 function validateModuleUid(moduleUid) {
   if (!moduleUid || typeof moduleUid !== "string" || !moduleUid.trim()) {
@@ -3226,6 +3223,38 @@ function validateModuleUid(moduleUid) {
   }
   return true;
 }
+function isValidDefaultBranchName(name) {
+  if (!name || typeof name !== "string") return false;
+  const trimmed = name.trim();
+  if (trimmed !== name) return false;
+  if (name.length > 255) return false;
+  if (name.startsWith("-")) return false;
+  if (name.startsWith("/")) return false;
+  if (name.endsWith("/")) return false;
+  if (name.endsWith(".")) return false;
+  if (name.endsWith(".lock")) return false;
+  if (name.includes("..")) return false;
+  if (name.includes("@{")) return false;
+  if (name.includes("//")) return false;
+  if (name.includes("\\")) return false;
+  if (/[ ~^:?*\[\]\s]/.test(name)) return false;
+  if (!/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(name)) return false;
+  return true;
+}
+function runGit(args, cwd, timeoutMs) {
+  const res = (0, import_child_process2.spawnSync)("git", args, {
+    cwd,
+    encoding: "utf-8",
+    timeout: timeoutMs,
+    windowsHide: true,
+    shell: false
+  });
+  return {
+    success: res.status === 0,
+    stdout: (res.stdout || "").toString(),
+    stderr: (res.stderr || "").toString()
+  };
+}
 var WorktreeManager = class _WorktreeManager {
   constructor(projectRoot) {
     // ============================================================
@@ -3283,22 +3312,24 @@ var WorktreeManager = class _WorktreeManager {
    */
   async ensureFetchRefspecConfigured() {
     try {
-      const { execSync: execSync10 } = require("child_process");
       let fetchRefspec = null;
       try {
-        fetchRefspec = execSync10("git config --get remote.origin.fetch", {
-          cwd: this.bareRepoPath,
-          encoding: "utf-8",
-          timeout: 5e3
-        }).trim();
+        const res = runGit(["config", "--get", "remote.origin.fetch"], this.bareRepoPath, 5e3);
+        if (res.success) {
+          fetchRefspec = res.stdout.trim();
+        }
       } catch {
       }
       if (!fetchRefspec) {
         console.log("[WorktreeManager] EP1014: Configuring missing fetch refspec for bare repo");
-        execSync10('git config remote.origin.fetch "+refs/heads/*:refs/remotes/origin/*"', {
-          cwd: this.bareRepoPath,
-          timeout: 5e3
-        });
+        const setRes = runGit(
+          ["config", "remote.origin.fetch", "+refs/heads/*:refs/remotes/origin/*"],
+          this.bareRepoPath,
+          5e3
+        );
+        if (!setRes.success) {
+          throw new Error(setRes.stderr || "Failed to configure fetch refspec");
+        }
         console.log("[WorktreeManager] EP1014: Fetch refspec configured successfully");
       }
     } catch (error) {
@@ -3331,11 +3362,44 @@ var WorktreeManager = class _WorktreeManager {
     manager.writeConfig(config);
     return manager;
   }
+  /**
+   * EP1373: Resolve the default branch name using a 3-level fallback:
+   * 1. Explicit defaultBranch parameter (from project GitHub config)
+   * 2. Git-derived: refs/remotes/origin/HEAD symbolic-ref target
+   * 3. Final fallback: 'main' (with warning)
+   */
+  async resolveDefaultBranch(explicitDefault) {
+    if (explicitDefault) {
+      if (isValidDefaultBranchName(explicitDefault)) {
+        return explicitDefault;
+      }
+      console.warn(`[WorktreeManager] EP1373: Invalid defaultBranch provided ("${explicitDefault}"), ignoring`);
+    }
+    try {
+      const res = runGit(["symbolic-ref", "refs/remotes/origin/HEAD"], this.bareRepoPath, 5e3);
+      if (!res.success) {
+        throw new Error(res.stderr || "symbolic-ref failed");
+      }
+      const symref = res.stdout.trim();
+      const match = symref.match(/^refs\/remotes\/origin\/(.+)$/);
+      if (match && match[1]) {
+        const derived = match[1];
+        if (isValidDefaultBranchName(derived)) {
+          return derived;
+        }
+        console.warn(`[WorktreeManager] EP1373: Derived default branch from origin/HEAD is invalid ("${derived}"), ignoring`);
+      }
+    } catch {
+    }
+    console.warn('[WorktreeManager] EP1373: Could not resolve default branch, falling back to "main"');
+    return "main";
+  }
   /**
    * Create a worktree for a module
    * The entire operation is locked to prevent race conditions
+   * EP1373: Added defaultBranch parameter for explicit default branch resolution
    */
-  async createWorktree(moduleUid, branchName, createBranch = false) {
+  async createWorktree(moduleUid, branchName, createBranch = false, defaultBranch, correlationId) {
     if (!validateModuleUid(moduleUid)) {
       return {
         success: false,
@@ -3401,25 +3465,63 @@ var WorktreeManager = class _WorktreeManager {
           console.warn("[WorktreeManager] EP1265: Failed to prune worktrees (continuing):", pruneResult.output);
         }
       }
-      const fetchResult = await this.gitExecutor.execute({
-        action: "fetch",
-        remote: "origin",
-        branch: "+refs/heads/main:refs/remotes/origin/main"
-      }, { cwd: this.bareRepoPath });
-      if (!fetchResult.success && createBranch) {
-        console.error("[worktree-manager] Failed to fetch from origin:", fetchResult.output);
-        return {
-          success: false,
-          error: "Failed to fetch latest refs from origin. Cannot create worktree with stale refs."
-        };
+      const resolvedDefault = await this.resolveDefaultBranch(defaultBranch);
+      let shouldCreateBranch = createBranch;
+      let startPoint;
+      if (createBranch) {
+        const managerFetchStartMs = Date.now();
+        const fetchResult = await this.gitExecutor.execute({
+          action: "fetch",
+          remote: "origin",
+          branch: `+refs/heads/${resolvedDefault}:refs/remotes/origin/${resolvedDefault}`
+        }, { cwd: this.bareRepoPath });
+        console.log(`[WorktreeManager] EP1373: manager_fetch phase=manager_fetch durationMs=${Date.now() - managerFetchStartMs} moduleUid=${moduleUid} correlationId=${correlationId || "none"} defaultBranch=${resolvedDefault} success=${fetchResult.success}`);
+        if (!fetchResult.success) {
+          console.error("[worktree-manager] Failed to fetch from origin:", fetchResult.output);
+          return {
+            success: false,
+            error: "Failed to fetch latest refs from origin. Cannot create worktree with stale refs."
+          };
+        }
+        startPoint = `origin/${resolvedDefault}`;
+      } else {
+        const existingBranchFetchStartMs = Date.now();
+        const branchFetchResult = await this.gitExecutor.execute({
+          action: "fetch",
+          remote: "origin",
+          branch: `+refs/heads/${branchName}:refs/remotes/origin/${branchName}`
+        }, { cwd: this.bareRepoPath });
+        console.log(`[WorktreeManager] EP1373: existing_branch_fetch phase=existing_branch_fetch durationMs=${Date.now() - existingBranchFetchStartMs} moduleUid=${moduleUid} correlationId=${correlationId || "none"} branch=${branchName} success=${branchFetchResult.success}`);
+        const localBranchExists = runGit(
+          ["show-ref", "--verify", `refs/heads/${branchName}`],
+          this.bareRepoPath,
+          5e3
+        ).success;
+        const remoteBranchExists = runGit(
+          ["show-ref", "--verify", `refs/remotes/origin/${branchName}`],
+          this.bareRepoPath,
+          5e3
+        ).success;
+        if (!localBranchExists && remoteBranchExists) {
+          shouldCreateBranch = true;
+          startPoint = `origin/${branchName}`;
+          console.log(`[WorktreeManager] EP1373: remote_only_branch phase=remote_only_branch moduleUid=${moduleUid} correlationId=${correlationId || "none"} branch=${branchName}`);
+        } else if (!localBranchExists && !remoteBranchExists) {
+          return {
+            success: false,
+            error: `Branch "${branchName}" not found locally or on origin`
+          };
+        }
       }
+      const gitWorktreeAddStartMs = Date.now();
       const result = await this.gitExecutor.execute({
         action: "worktree_add",
         path: worktreePath,
         branch: branchName,
-        create: createBranch,
-        startPoint: createBranch ? "origin/main" : void 0
+        create: shouldCreateBranch,
+        startPoint
       }, { cwd: this.bareRepoPath });
+      console.log(`[WorktreeManager] EP1373: git_worktree_add phase=git_worktree_add durationMs=${Date.now() - gitWorktreeAddStartMs} moduleUid=${moduleUid} correlationId=${correlationId || "none"} success=${result.success}`);
       if (!result.success) {
         return {
           success: false,
@@ -3915,8 +4017,8 @@ var WorktreeManager = class _WorktreeManager {
     console.log(`[WorktreeManager] EP959:   Timeout: ${TIMEOUT_MINUTES} minutes`);
     console.log(`[WorktreeManager] EP959:   Script: ${scriptPreview}`);
     try {
-      const { execSync: execSync10 } = require("child_process");
-      execSync10(script, {
+      const { execSync: execSync11 } = require("child_process");
+      execSync11(script, {
         cwd: worktree.worktreePath,
         stdio: "inherit",
         timeout: TIMEOUT_MINUTES * 60 * 1e3,
@@ -3950,8 +4052,8 @@ var WorktreeManager = class _WorktreeManager {
     console.log(`[WorktreeManager] EP959:   Timeout: ${TIMEOUT_MINUTES} minutes`);
     console.log(`[WorktreeManager] EP959:   Script: ${scriptPreview}`);
     try {
-      const { execSync: execSync10 } = require("child_process");
-      execSync10(script, {
+      const { execSync: execSync11 } = require("child_process");
+      execSync11(script, {
         cwd: worktree.worktreePath,
         stdio: "inherit",
         timeout: TIMEOUT_MINUTES * 60 * 1e3,
@@ -4090,7 +4192,7 @@ async function syncProjectPath(config, projectId, path18) {
 // src/utils/bootstrap.ts
 var fs3 = __toESM(require("fs"));
 var path4 = __toESM(require("path"));
-var import_child_process2 = require("child_process");
+var import_child_process3 = require("child_process");
 async function extractBootstrapScripts(bareRepoPath, projectPath) {
   const scriptsDir = path4.join(projectPath, ".episoda", "scripts");
   const scriptPath = path4.join(scriptsDir, "api-helper.sh");
@@ -4106,7 +4208,7 @@ async function extractBootstrapScripts(bareRepoPath, projectPath) {
   ];
   for (const srcPath of scriptPaths) {
     try {
-      const scriptContent = (0, import_child_process2.execSync)(
+      const scriptContent = (0, import_child_process3.execSync)(
         `git --git-dir="${bareRepoPath}" show main:${srcPath}`,
         { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
       );
@@ -4124,7 +4226,7 @@ async function extractBootstrapScripts(bareRepoPath, projectPath) {
 var fs4 = __toESM(require("fs"));
 var os = __toESM(require("os"));
 var path5 = __toESM(require("path"));
-var import_child_process3 = require("child_process");
+var import_child_process4 = require("child_process");
 var PROTOCOL_SCHEME = "episoda";
 var APP_NAME = "Episoda";
 function parseProtocolUrl(rawUrl) {
@@ -4151,11 +4253,11 @@ function getLinuxDesktopPath() {
 function resolveBinaryFromPath(name) {
   try {
     if (process.platform === "win32") {
-      const output2 = (0, import_child_process3.execSync)(`where ${name}`, { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+      const output2 = (0, import_child_process4.execSync)(`where ${name}`, { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
       const first = output2.split(/\r?\n/)[0];
       return first || null;
     }
-    const output = (0, import_child_process3.execSync)(`command -v ${name}`, { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+    const output = (0, import_child_process4.execSync)(`command -v ${name}`, { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
     return output || null;
   } catch {
     return null;
@@ -4264,7 +4366,7 @@ exit 0
       fs4.writeFileSync(handlerPath, handlerScript, { mode: 493 });
       fs4.writeFileSync(infoPlistPath, infoPlist);
       const lsregister = "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";
-      (0, import_child_process3.execSync)(`"${lsregister}" -f "${appPath}"`);
+      (0, import_child_process4.execSync)(`"${lsregister}" -f "${appPath}"`);
       return { success: true, message: "Protocol handler registered for macOS." };
     }
     if (process.platform === "linux") {
@@ -4286,7 +4388,7 @@ Terminal=false
 MimeType=x-scheme-handler/${PROTOCOL_SCHEME};
 `;
       fs4.writeFileSync(desktopPath, desktopEntry);
-      (0, import_child_process3.execSync)(`xdg-mime default ${path5.basename(desktopPath)} x-scheme-handler/${PROTOCOL_SCHEME}`);
+      (0, import_child_process4.execSync)(`xdg-mime default ${path5.basename(desktopPath)} x-scheme-handler/${PROTOCOL_SCHEME}`);
       return { success: true, message: "Protocol handler registered for Linux." };
     }
     if (process.platform === "win32") {
@@ -4301,9 +4403,9 @@ shell.Run cmd, 0, False
 `;
       fs4.writeFileSync(vbsPath, vbsScript);
       const handlerCommand = `wscript.exe "${vbsPath}" "%1"`;
-      (0, import_child_process3.execSync)(`reg add HKCU\\Software\\Classes\\${PROTOCOL_SCHEME} /ve /d "URL:Episoda Protocol" /f`);
-      (0, import_child_process3.execSync)(`reg add HKCU\\Software\\Classes\\${PROTOCOL_SCHEME} /v "URL Protocol" /d "" /f`);
-      (0, import_child_process3.execSync)(`reg add HKCU\\Software\\Classes\\${PROTOCOL_SCHEME}\\shell\\open\\command /ve /d "${handlerCommand}" /f`);
+      (0, import_child_process4.execSync)(`reg add HKCU\\Software\\Classes\\${PROTOCOL_SCHEME} /ve /d "URL:Episoda Protocol" /f`);
+      (0, import_child_process4.execSync)(`reg add HKCU\\Software\\Classes\\${PROTOCOL_SCHEME} /v "URL Protocol" /d "" /f`);
+      (0, import_child_process4.execSync)(`reg add HKCU\\Software\\Classes\\${PROTOCOL_SCHEME}\\shell\\open\\command /ve /d "${handlerCommand}" /f`);
       fs4.writeFileSync(marker, JSON.stringify({ registeredAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
       return { success: true, message: "Protocol handler registered for Windows." };
     }
@@ -4355,7 +4457,7 @@ async function maybeRegisterProtocolHandler() {
 }
 function findGitRoot(startDir) {
   try {
-    const result = (0, import_child_process4.execSync)("git rev-parse --show-toplevel", {
+    const result = (0, import_child_process5.execSync)("git rev-parse --show-toplevel", {
       cwd: startDir,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
@@ -4559,14 +4661,14 @@ Received ${signal}. Daemon continues running in background.`);
 var os2 = __toESM(require("os"));
 var fs7 = __toESM(require("fs"));
 var path8 = __toESM(require("path"));
-var import_child_process6 = require("child_process");
+var import_child_process7 = require("child_process");
 var import_core6 = __toESM(require_dist());
 
 // src/daemon/machine-id.ts
 var fs6 = __toESM(require("fs"));
 var path7 = __toESM(require("path"));
 var crypto2 = __toESM(require("crypto"));
-var import_child_process5 = require("child_process");
+var import_child_process6 = require("child_process");
 var import_core5 = __toESM(require_dist());
 function isValidUUID(str) {
   const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -4609,7 +4711,7 @@ async function getMachineId() {
 function getHardwareUUID() {
   try {
     if (process.platform === "darwin") {
-      const output = (0, import_child_process5.execSync)(
+      const output = (0, import_child_process6.execSync)(
         `ioreg -d2 -c IOPlatformExpertDevice | awk -F\\" '/IOPlatformUUID/{print $(NF-1)}'`,
         { encoding: "utf-8", timeout: 5e3 }
       ).trim();
@@ -4630,7 +4732,7 @@ function getHardwareUUID() {
         }
       }
     } else if (process.platform === "win32") {
-      const output = (0, import_child_process5.execSync)("wmic csproduct get uuid", {
+      const output = (0, import_child_process6.execSync)("wmic csproduct get uuid", {
         encoding: "utf-8",
         timeout: 5e3
       });
@@ -5069,7 +5171,7 @@ async function monitorAuthorization(apiUrl, deviceCode, expiresIn) {
       resolve5(false);
     }, expiresIn * 1e3);
     const url = `${apiUrl}/api/oauth/authorize-stream?device_code=${deviceCode}`;
-    const curlProcess = (0, import_child_process6.spawn)("curl", ["-N", url]);
+    const curlProcess = (0, import_child_process7.spawn)("curl", ["-N", url]);
     let buffer = "";
     curlProcess.stdout.on("data", (chunk) => {
       buffer += chunk.toString();
@@ -5173,7 +5275,7 @@ function openBrowser(url) {
       break;
   }
   try {
-    (0, import_child_process6.spawn)(command, args, {
+    (0, import_child_process7.spawn)(command, args, {
       detached: true,
       stdio: "ignore"
     }).unref();
@@ -5194,7 +5296,7 @@ async function installGitCredentialHelper(apiUrl) {
     } catch {
     }
     try {
-      const allHelpers = (0, import_child_process6.execSync)("git config --global --get-all credential.helper", {
+      const allHelpers = (0, import_child_process7.execSync)("git config --global --get-all credential.helper", {
         encoding: "utf8",
         stdio: ["pipe", "pipe", "pipe"]
       }).trim().split("\n");
@@ -5203,7 +5305,7 @@ async function installGitCredentialHelper(apiUrl) {
       }
     } catch {
     }
-    (0, import_child_process6.execSync)(`git config --global --add credential.helper "${helperPath}"`, {
+    (0, import_child_process7.execSync)(`git config --global --add credential.helper "${helperPath}"`, {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -5247,7 +5349,7 @@ ${exportLine}
 var os3 = __toESM(require("os"));
 var fs8 = __toESM(require("fs"));
 var path9 = __toESM(require("path"));
-var import_child_process7 = require("child_process");
+var import_child_process8 = require("child_process");
 var import_core7 = __toESM(require_dist());
 async function connectCommand(options) {
   const { code } = options;
@@ -5327,7 +5429,7 @@ async function installGitCredentialHelper2(apiUrl) {
     const scriptContent = generateCredentialHelperScript(apiUrl);
     fs8.writeFileSync(helperPath, scriptContent, { mode: 493 });
     try {
-      const allHelpers = (0, import_child_process7.execSync)("git config --global --get-all credential.helper", {
+      const allHelpers = (0, import_child_process8.execSync)("git config --global --get-all credential.helper", {
         encoding: "utf8",
         stdio: ["pipe", "pipe", "pipe"]
       }).trim().split("\n");
@@ -5336,7 +5438,7 @@ async function installGitCredentialHelper2(apiUrl) {
       }
     } catch {
     }
-    (0, import_child_process7.execSync)(`git config --global --add credential.helper "${helperPath}"`, {
+    (0, import_child_process8.execSync)(`git config --global --add credential.helper "${helperPath}"`, {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -5377,16 +5479,17 @@ ${exportLine}
 }
 
 // src/commands/status.ts
+var import_child_process10 = require("child_process");
 var import_core8 = __toESM(require_dist());
 
 // src/utils/update-checker.ts
-var import_child_process8 = require("child_process");
+var import_child_process9 = require("child_process");
 var semver = __toESM(require("semver"));
 var PACKAGE_NAME = "@episoda/cli";
 var NPM_REGISTRY = "https://registry.npmjs.org";
 function isFileLinkedInstall() {
   try {
-    const output = (0, import_child_process8.execSync)(`npm list -g ${PACKAGE_NAME} --json`, {
+    const output = (0, import_child_process9.execSync)(`npm list -g ${PACKAGE_NAME} --json`, {
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 1e4
     }).toString();
@@ -5430,7 +5533,7 @@ async function checkForUpdates(currentVersion) {
 }
 function performSyncUpdate(targetVersion) {
   try {
-    (0, import_child_process8.execSync)(`npm install -g ${PACKAGE_NAME}@${targetVersion}`, {
+    (0, import_child_process9.execSync)(`npm install -g ${PACKAGE_NAME}@${targetVersion}`, {
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 12e4
       // 2 minute timeout
@@ -5445,12 +5548,12 @@ function performSyncUpdate(targetVersion) {
 }
 async function restartDaemon() {
   try {
-    (0, import_child_process8.execSync)("episoda stop", {
+    (0, import_child_process9.execSync)("episoda stop", {
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 1e4
     });
     await new Promise((resolve5) => setTimeout(resolve5, 1e3));
-    const child = (0, import_child_process8.spawn)("episoda", ["dev"], {
+    const child = (0, import_child_process9.spawn)("episoda", ["dev"], {
       detached: true,
       stdio: "ignore",
       shell: true
@@ -5506,7 +5609,7 @@ async function updateAndRestartDaemon(targetVersion) {
 }
 function getInstalledVersion() {
   try {
-    const output = (0, import_child_process8.execSync)(`npm list -g ${PACKAGE_NAME} --json`, {
+    const output = (0, import_child_process9.execSync)(`npm list -g ${PACKAGE_NAME} --json`, {
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 1e4
     }).toString();
@@ -5517,6 +5620,22 @@ function getInstalledVersion() {
   }
 }
 
+// src/utils/github-token.ts
+var INVALID_GITHUB_TOKEN_LITERALS = /* @__PURE__ */ new Set([
+  "${GITHUB_PERSONAL_ACCESS_TOKEN}",
+  "undefined",
+  "null",
+  '""',
+  "''"
+]);
+function sanitizeGithubToken(token) {
+  if (token === void 0) return "";
+  const trimmed = token.trim();
+  if (!trimmed) return "";
+  if (INVALID_GITHUB_TOKEN_LITERALS.has(trimmed)) return "";
+  return trimmed;
+}
+
 // src/commands/status.ts
 async function statusCommand(options = {}) {
   status.info("Checking CLI status...");
@@ -5648,12 +5767,25 @@ async function statusCommand(options = {}) {
   }
   status.info("");
   status.info("MCP Configuration:");
-  if (process.env.GITHUB_PERSONAL_ACCESS_TOKEN) {
+  const envGithubToken = sanitizeGithubToken(process.env.GITHUB_PERSONAL_ACCESS_TOKEN);
+  if (envGithubToken) {
     status.success("  \u2713 GitHub MCP token available (GITHUB_PERSONAL_ACCESS_TOKEN is set)");
   } else {
-    status.warning("  \u26A0 GitHub MCP token missing (GITHUB_PERSONAL_ACCESS_TOKEN not set)");
-    status.info('  GitHub MCP tools will fail with "Requires authentication".');
-    status.info("  Fix: export GITHUB_PERSONAL_ACCESS_TOKEN=$(gh auth token)");
+    let ghAuthAvailable = false;
+    try {
+      const ghToken = (0, import_child_process10.execSync)("gh auth token", { encoding: "utf8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
+      ghAuthAvailable = ghToken.length > 0;
+    } catch {
+    }
+    if (ghAuthAvailable) {
+      status.success("  \u2713 GitHub MCP token available (via gh auth)");
+      status.info('  The portable launcher (scripts/github-mcp-server.sh) will use "gh auth token" automatically.');
+    } else {
+      status.warning("  \u26A0 GitHub MCP token missing");
+      status.info('  GitHub MCP tools will fail with "Requires authentication".');
+      status.info("  Fix: gh auth login    # Authenticate GitHub CLI (recommended)");
+      status.info("  Alt: export GITHUB_PERSONAL_ACCESS_TOKEN=ghp_...");
+    }
   }
   if (options.verify) {
     status.info("");
@@ -6524,7 +6656,7 @@ async function listWorktrees(options) {
 }
 
 // src/commands/update.ts
-var import_child_process9 = require("child_process");
+var import_child_process11 = require("child_process");
 var import_core14 = __toESM(require_dist());
 async function isDaemonRunning2() {
   try {
@@ -6536,7 +6668,7 @@ async function isDaemonRunning2() {
 }
 function stopDaemon2() {
   try {
-    (0, import_child_process9.execSync)("episoda stop", { stdio: "pipe" });
+    (0, import_child_process11.execSync)("episoda stop", { stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -6544,7 +6676,7 @@ function stopDaemon2() {
 }
 function startDaemon2() {
   try {
-    const child = (0, import_child_process9.spawn)("episoda", ["dev"], {
+    const child = (0, import_child_process11.spawn)("episoda", ["dev"], {
       detached: true,
       stdio: "ignore",
       shell: process.platform === "win32"
@@ -6557,7 +6689,7 @@ function startDaemon2() {
 }
 function performUpdate(targetVersion) {
   try {
-    (0, import_child_process9.execSync)(`npm install -g ${PACKAGE_NAME}@${targetVersion}`, {
+    (0, import_child_process11.execSync)(`npm install -g ${PACKAGE_NAME}@${targetVersion}`, {
       stdio: "pipe",
       timeout: 12e4
       // 2 minute timeout
@@ -6685,7 +6817,7 @@ async function setupCommand(options = {}) {
 }
 
 // src/commands/run.ts
-var import_child_process10 = require("child_process");
+var import_child_process12 = require("child_process");
 var import_core15 = __toESM(require_dist());
 
 // src/utils/env-cache.ts
@@ -6843,7 +6975,7 @@ async function runCommand(args, options = {}) {
     status.info(`Running: ${command} ${commandArgs.join(" ")}`);
     status.info("");
   }
-  const child = (0, import_child_process10.spawn)(command, commandArgs, {
+  const child = (0, import_child_process12.spawn)(command, commandArgs, {
     stdio: "inherit",
     env: mergedEnv,
     shell: process.platform === "win32"
@@ -6894,7 +7026,7 @@ function signalToNumber(signal) {
 }
 
 // src/commands/shell.ts
-var import_child_process11 = require("child_process");
+var import_child_process13 = require("child_process");
 var import_core16 = __toESM(require_dist());
 async function shellCommand(shell, options = {}) {
   const config = await (0, import_core16.loadConfig)();
@@ -6938,7 +7070,7 @@ async function shellCommand(shell, options = {}) {
     // Set a marker so users know they're in an episoda shell
     EPISODA_SHELL: "1"
   };
-  const child = (0, import_child_process11.spawn)(targetShell, [], {
+  const child = (0, import_child_process13.spawn)(targetShell, [], {
     stdio: "inherit",
     env: mergedEnv
   });
@@ -7211,19 +7343,19 @@ async function promptForValue(key) {
 }
 
 // src/commands/migrations.ts
-var import_child_process12 = require("child_process");
+var import_child_process14 = require("child_process");
 var import_util = require("util");
 var import_path = __toESM(require("path"));
-var exec = (0, import_util.promisify)(import_child_process12.exec);
+var exec = (0, import_util.promisify)(import_child_process14.exec);
 function getDefaultMigrationDir() {
   return process.env.EPISODA_MIGRATION_DIR || "supabase/migrations";
 }
-async function runGit(command, cwd) {
+async function runGit2(command, cwd) {
   const { stdout } = await exec(command, { cwd, maxBuffer: 1024 * 1024 * 10 });
   return stdout.trim();
 }
 async function getRepoRoot() {
-  return runGit("git rev-parse --show-toplevel", process.cwd());
+  return runGit2("git rev-parse --show-toplevel", process.cwd());
 }
 function parseBaseRef(baseRef) {
   const parts = baseRef.split("/");
@@ -7261,17 +7393,17 @@ async function getMigrationConflicts(options) {
   if (options.fetch) {
     const { remote, ref } = parseBaseRef(options.baseRef);
     if (remote && ref) {
-      await runGit(`git fetch ${remote} ${ref}`, repoRoot);
+      await runGit2(`git fetch ${remote} ${ref}`, repoRoot);
     } else if (ref) {
-      await runGit(`git fetch origin ${ref}`, repoRoot);
+      await runGit2(`git fetch origin ${ref}`, repoRoot);
     }
   }
-  const mainFilesOutput = await runGit(
+  const mainFilesOutput = await runGit2(
     `git ls-tree -r --name-only ${options.baseRef} ${options.migrationDir}`,
     repoRoot
   );
   const mainFiles = mainFilesOutput.split("\n").filter(Boolean);
-  const diffOutput = await runGit(
+  const diffOutput = await runGit2(
     `git diff --name-status ${options.baseRef}...HEAD -- ${options.migrationDir}`,
     repoRoot
   );
@@ -7409,15 +7541,15 @@ async function migrationsFixCommand(options) {
     return;
   }
   for (const entry of renamePlan) {
-    await runGit(`git mv "${entry.from}" "${entry.to}"`, repoRoot);
+    await runGit2(`git mv "${entry.from}" "${entry.to}"`, repoRoot);
   }
   if (options.commit || options.push) {
     const message = options.message || "Fix migration ordering conflicts";
-    await runGit("git add --all", repoRoot);
-    await runGit(`git commit -m "${message}"`, repoRoot);
+    await runGit2("git add --all", repoRoot);
+    await runGit2(`git commit -m "${message}"`, repoRoot);
   }
   if (options.push) {
-    await runGit("git push", repoRoot);
+    await runGit2("git push", repoRoot);
   }
   status.success("Migration conflicts fixed.");
 }