@geteigen/cli 0.0.0-stage → 3.1.0

package/dist/cli/src/proc.d.ts

@@ -0,0 +1,31 @@
+import type { ChildProcess, SpawnOptions } from "child_process";
+/**
+ * Spawn an agent CLI (`cursor`, `claude`, `codex`). On Windows those are
+ * npm `.cmd` shims, which plain `spawn` can't launch without a shell —
+ * cross-spawn resolves the shim and escapes arguments safely.
+ */
+export declare function spawnCli(command: string, args: string[], options: SpawnOptions): ChildProcess;
+/** POSIX-safe single quotes so prompts / MCP JSON survive `zsh -lc`. */
+export declare function posixShellQuote(value: string): string;
+/**
+ * Spawn an agent CLI the way a terminal would. Finder/Dock Eigen has a
+ * different keychain context than Terminal; a login shell is how Claude
+ * Foundry / Codex subscription creds actually resolve.
+ */
+export declare function spawnUserCli(command: string, args: string[], options: SpawnOptions): ChildProcess;
+export interface ExecCliOptions {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    timeout?: number;
+    maxBuffer?: number;
+}
+/** execFile-style helper on top of spawnCli: resolves `{ stdout, stderr }`, rejects on non-zero exit. */
+export declare function execCli(command: string, args: string[], options?: ExecCliOptions): Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+/**
+ * Stop a CLI run. On Windows the child is the `.cmd` shim's cmd.exe, so kill
+ * the whole tree or the real agent keeps running.
+ */
+export declare function killCli(child: ChildProcess): void;

package/dist/cli/src/proc.js

@@ -0,0 +1,97 @@
+import crossSpawn from "cross-spawn";
+/**
+ * Spawn an agent CLI (`cursor`, `claude`, `codex`). On Windows those are
+ * npm `.cmd` shims, which plain `spawn` can't launch without a shell —
+ * cross-spawn resolves the shim and escapes arguments safely.
+ */
+export function spawnCli(command, args, options) {
+    return crossSpawn(command, args, options);
+}
+/** POSIX-safe single quotes so prompts / MCP JSON survive `zsh -lc`. */
+export function posixShellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * Spawn an agent CLI the way a terminal would. Finder/Dock Eigen has a
+ * different keychain context than Terminal; a login shell is how Claude
+ * Foundry / Codex subscription creds actually resolve.
+ */
+export function spawnUserCli(command, args, options) {
+    if (process.platform === "win32")
+        return spawnCli(command, args, options);
+    const shell = process.env.SHELL && process.env.SHELL.startsWith("/")
+        ? process.env.SHELL
+        : process.platform === "darwin"
+            ? "/bin/zsh"
+            : "/bin/sh";
+    const line = [command, ...args].map(posixShellQuote).join(" ");
+    return spawnCli(shell, ["-lc", line], options);
+}
+/** execFile-style helper on top of spawnCli: resolves `{ stdout, stderr }`, rejects on non-zero exit. */
+export function execCli(command, args, options = {}) {
+    const maxBuffer = options.maxBuffer ?? 1024 * 1024;
+    return new Promise((resolve, reject) => {
+        const child = spawnCli(command, args, {
+            cwd: options.cwd,
+            env: options.env,
+            stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
+        });
+        let stdout = "";
+        let stderr = "";
+        let settled = false;
+        const fail = (err) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            err.stdout = stdout;
+            err.stderr = stderr;
+            reject(err);
+        };
+        const timer = options.timeout
+            ? setTimeout(() => {
+                child.kill();
+                fail(new Error(`${command} timed out after ${options.timeout}ms`));
+            }, options.timeout)
+            : undefined;
+        child.stdout?.on("data", (chunk) => {
+            stdout += chunk.toString("utf8");
+            if (stdout.length > maxBuffer) {
+                child.kill();
+                fail(new Error(`${command} output exceeded maxBuffer`));
+            }
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderr += chunk.toString("utf8");
+        });
+        child.on("error", (err) => fail(err));
+        child.on("close", (code) => {
+            if (settled)
+                return;
+            if (code === 0) {
+                settled = true;
+                clearTimeout(timer);
+                resolve({ stdout, stderr });
+                return;
+            }
+            fail(Object.assign(new Error(`${command} exited with code ${code}`), {
+                code,
+            }));
+        });
+    });
+}
+/**
+ * Stop a CLI run. On Windows the child is the `.cmd` shim's cmd.exe, so kill
+ * the whole tree or the real agent keeps running.
+ */
+export function killCli(child) {
+    if (process.platform === "win32" && child.pid) {
+        crossSpawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+            stdio: "ignore",
+            windowsHide: true,
+        });
+        return;
+    }
+    child.kill("SIGTERM");
+}

package/dist/cli/src/service.d.ts

@@ -0,0 +1,17 @@
+export declare function logPath(): string;
+export declare function readDaemonPid(): number | null;
+/** Re-launch `eigen start <args>` detached, logging to worker.log. */
+export declare function startDaemon(startArgs: string[]): {
+    pid: number;
+    log: string;
+};
+export declare function stopDaemon(): boolean;
+export declare function installService(startArgs: string[]): string[];
+export declare function uninstallService(): string;
+export declare function serviceStatus(): {
+    installed: boolean;
+    running: boolean;
+    detail: string;
+};
+/** Follow the worker's logs (blocks until Ctrl-C). */
+export declare function followLogs(): void;

package/dist/cli/src/service.js

@@ -0,0 +1,255 @@
+import { spawn, spawnSync } from "child_process";
+import { existsSync, mkdirSync, openSync, readFileSync, realpathSync, rmSync, writeFileSync } from "fs";
+import { homedir, platform } from "os";
+import { dirname, join } from "path";
+import { getConfigDir } from "./config.js";
+/**
+ * Keep the worker running without a terminal: `eigen start --daemon` for a
+ * quick background run, `eigen service install` for a systemd / launchd
+ * service that restarts on crash and starts at boot.
+ */
+const UNIT = "eigen-worker";
+const LAUNCHD_LABEL = "space.geteigen.worker";
+export function logPath() {
+    return join(getConfigDir(), "worker.log");
+}
+function pidPath() {
+    return join(getConfigDir(), "worker.pid");
+}
+/** node + this CLI's entry script, as absolute paths. */
+function execArgs() {
+    const script = process.argv[1] || "";
+    let bin = script;
+    try {
+        bin = realpathSync(script);
+    }
+    catch {
+        // keep as is
+    }
+    return { node: process.execPath, bin };
+}
+function run(cmd, args) {
+    const res = spawnSync(cmd, args, { encoding: "utf8" });
+    return { ok: res.status === 0, out: `${res.stdout || ""}${res.stderr || ""}`.trim() };
+}
+// ── --daemon / stop ─────────────────────────────────────────────────────────
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function readDaemonPid() {
+    if (!existsSync(pidPath()))
+        return null;
+    const pid = Number(readFileSync(pidPath(), "utf8").trim());
+    return Number.isFinite(pid) && pid > 0 && pidAlive(pid) ? pid : null;
+}
+/** Re-launch `eigen start <args>` detached, logging to worker.log. */
+export function startDaemon(startArgs) {
+    const existing = readDaemonPid();
+    if (existing)
+        throw new Error(`The worker is already running in the background (pid ${existing}). Stop it with \`eigen stop\`.`);
+    const { node, bin } = execArgs();
+    const log = logPath();
+    mkdirSync(dirname(log), { recursive: true });
+    const fd = openSync(log, "a");
+    const child = spawn(node, [bin, "start", ...startArgs], {
+        detached: true,
+        stdio: ["ignore", fd, fd],
+        env: process.env,
+    });
+    child.unref();
+    if (!child.pid)
+        throw new Error("Couldn't start the worker in the background");
+    writeFileSync(pidPath(), String(child.pid));
+    return { pid: child.pid, log };
+}
+export function stopDaemon() {
+    const pid = readDaemonPid();
+    if (existsSync(pidPath()))
+        rmSync(pidPath());
+    if (!pid)
+        return false;
+    process.kill(pid, "SIGTERM");
+    return true;
+}
+// ── systemd / launchd ───────────────────────────────────────────────────────
+function isRoot() {
+    return typeof process.getuid === "function" && process.getuid() === 0;
+}
+/** Home of the account that ran `sudo` (so the service uses their config). */
+function sudoUserHome(user) {
+    const out = run("getent", ["passwd", user]);
+    const home = out.ok ? out.out.split(":")[5] : "";
+    return home || `/home/${user}`;
+}
+function systemdUnitPath() {
+    if (isRoot())
+        return { path: `/etc/systemd/system/${UNIT}.service`, system: true };
+    return { path: join(homedir(), ".config", "systemd", "user", `${UNIT}.service`), system: false };
+}
+function systemctl(system, args) {
+    return run("systemctl", system ? args : ["--user", ...args]);
+}
+function launchdPlistPath() {
+    return join(homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+}
+function xmlEscape(value) {
+    return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+export function installService(startArgs) {
+    const { node, bin } = execArgs();
+    const env = { PATH: process.env.PATH || "/usr/local/bin:/usr/bin:/bin" };
+    if (process.env.STEER_SERVER_URL)
+        env.STEER_SERVER_URL = process.env.STEER_SERVER_URL;
+    if (process.env.EIGEN_WORK_ROOT)
+        env.EIGEN_WORK_ROOT = process.env.EIGEN_WORK_ROOT;
+    const os = platform();
+    if (os === "linux") {
+        const { path, system } = systemdUnitPath();
+        const sudoUser = system ? process.env.SUDO_USER : undefined;
+        const home = sudoUser ? sudoUserHome(sudoUser) : homedir();
+        env.HOME = home;
+        const exec = [node, bin, "start", ...startArgs].map((p) => (/\s/.test(p) ? `"${p}"` : p)).join(" ");
+        const unit = [
+            "[Unit]",
+            "Description=Eigen agent worker",
+            "After=network-online.target",
+            "Wants=network-online.target",
+            "",
+            "[Service]",
+            "Type=simple",
+            sudoUser ? `User=${sudoUser}` : "",
+            `WorkingDirectory=${home}`,
+            `ExecStart=${exec}`,
+            ...Object.entries(env).map(([k, v]) => `Environment="${k}=${v}"`),
+            // Not on clean exit: a revoked machine exits 0 and must stay stopped.
+            "Restart=on-failure",
+            "RestartSec=5",
+            "",
+            "[Install]",
+            `WantedBy=${system ? "multi-user.target" : "default.target"}`,
+            "",
+        ]
+            .filter((line, i, all) => line !== "" || all[i - 1] !== "")
+            .join("\n");
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, unit);
+        systemctl(system, ["daemon-reload"]);
+        const enabled = systemctl(system, ["enable", "--now", UNIT]);
+        if (!enabled.ok)
+            throw new Error(enabled.out || "systemctl enable failed");
+        const notes = [`Installed ${path}`, `Logs: ${system ? `journalctl -u ${UNIT} -f` : `journalctl --user -u ${UNIT} -f`}`];
+        if (!system) {
+            const lingerUser = process.env.SUDO_USER || process.env.USER || "";
+            const linger = lingerUser
+                ? run("sudo", ["-n", "loginctl", "enable-linger", lingerUser])
+                : { ok: false, out: "" };
+            if (linger.ok) {
+                notes.push(`Linger enabled for ${lingerUser} (survives SSH logout).`);
+            }
+            else {
+                notes.push(`To keep it running after you log out: sudo loginctl enable-linger ${lingerUser || "$USER"}`);
+            }
+        }
+        return notes;
+    }
+    if (os === "darwin") {
+        const path = launchdPlistPath();
+        const log = logPath();
+        mkdirSync(dirname(log), { recursive: true });
+        const args = [node, bin, "start", ...startArgs].map((a) => `    <string>${xmlEscape(a)}</string>`).join("\n");
+        const envXml = Object.entries(env)
+            .map(([k, v]) => `    <key>${xmlEscape(k)}</key>\n    <string>${xmlEscape(v)}</string>`)
+            .join("\n");
+        const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${LAUNCHD_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+${args}
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+${envXml}
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
+  <key>StandardOutPath</key>
+  <string>${xmlEscape(log)}</string>
+  <key>StandardErrorPath</key>
+  <string>${xmlEscape(log)}</string>
+</dict>
+</plist>
+`;
+        mkdirSync(dirname(path), { recursive: true });
+        run("launchctl", ["unload", path]);
+        writeFileSync(path, plist);
+        const loaded = run("launchctl", ["load", "-w", path]);
+        if (!loaded.ok)
+            throw new Error(loaded.out || "launchctl load failed");
+        return [`Installed ${path}`, `Logs: ${log}`];
+    }
+    throw new Error("Automatic service install isn't supported on Windows yet. Run `eigen start` from Task Scheduler (At startup, \"Run whether user is logged on or not\"), or use the Docker image.");
+}
+export function uninstallService() {
+    const os = platform();
+    if (os === "linux") {
+        const { path, system } = systemdUnitPath();
+        systemctl(system, ["disable", "--now", UNIT]);
+        if (existsSync(path))
+            rmSync(path);
+        systemctl(system, ["daemon-reload"]);
+        return `Removed ${path}`;
+    }
+    if (os === "darwin") {
+        const path = launchdPlistPath();
+        run("launchctl", ["unload", "-w", path]);
+        if (existsSync(path))
+            rmSync(path);
+        return `Removed ${path}`;
+    }
+    throw new Error("No service to remove on this platform.");
+}
+export function serviceStatus() {
+    const os = platform();
+    if (os === "linux") {
+        const { path, system } = systemdUnitPath();
+        const active = systemctl(system, ["is-active", UNIT]);
+        return { installed: existsSync(path), running: active.out === "active", detail: active.out || "unknown" };
+    }
+    if (os === "darwin") {
+        const path = launchdPlistPath();
+        const listed = run("launchctl", ["list", LAUNCHD_LABEL]);
+        const pid = listed.out.match(/"PID"\s*=\s*(\d+)/)?.[1];
+        return { installed: existsSync(path), running: Boolean(pid), detail: pid ? `pid ${pid}` : "not running" };
+    }
+    return { installed: false, running: false, detail: "not supported on this platform" };
+}
+/** Follow the worker's logs (blocks until Ctrl-C). */
+export function followLogs() {
+    const os = platform();
+    if (os === "linux" && existsSync(systemdUnitPath().path)) {
+        const { system } = systemdUnitPath();
+        spawnSync("journalctl", system ? ["-u", UNIT, "-n", "100", "-f"] : ["--user", "-u", UNIT, "-n", "100", "-f"], {
+            stdio: "inherit",
+        });
+        return;
+    }
+    const log = logPath();
+    if (!existsSync(log))
+        throw new Error(`No log yet at ${log}`);
+    spawnSync("tail", ["-n", "100", "-f", log], { stdio: "inherit" });
+}

package/dist/cli/src/workRoots.d.ts

@@ -0,0 +1,30 @@
+import type { MachineDirListing } from "../../shared/machines.js";
+export declare function expandHome(path: string): string;
+export declare class WorkRoots {
+    private local;
+    private server;
+    constructor(localRoots: string[]);
+    setServerRoots(roots: string[]): void;
+    /** Allowed roots; empty means no limit. */
+    effective(): string[];
+    /** Where new checkouts go (created on demand). */
+    workRoot(): string;
+    isAllowed(path: string): boolean;
+    listDirs(path?: string): MachineDirListing;
+}
+export declare function prepareRepo(roots: WorkRoots, input: {
+    repoUrl: string;
+    ref: string;
+    dir: string;
+    branch?: string;
+    token?: string;
+}): Promise<string>;
+export declare function finalizeGit(roots: WorkRoots, input: {
+    repoPath: string;
+    branch: string;
+    message: string;
+    token?: string;
+}): Promise<{
+    pushed: boolean;
+    branch: string;
+}>;

package/dist/cli/src/workRoots.js

@@ -0,0 +1,228 @@
+import { existsSync, mkdirSync, readdirSync, realpathSync, statSync } from "fs";
+import { homedir } from "os";
+import { basename, dirname, isAbsolute, join, normalize, resolve, sep } from "path";
+import { execCli } from "./proc.js";
+import { gitCredentialsPath, rememberGithubToken } from "./gitAuthEnv.js";
+/**
+ * Folders this machine lets agents work in. Local roots come from
+ * `eigen start --root` / EIGEN_WORK_ROOT; server roots from Eigen → Machines.
+ * When either is set, runs, folder browsing, and git operations must stay
+ * inside their union. With none set, the whole home directory is browsable.
+ */
+const MAX_ENTRIES = 300;
+export function expandHome(path) {
+    const trimmed = path.trim();
+    if (trimmed === "~")
+        return homedir();
+    if (trimmed.startsWith("~/") || trimmed.startsWith("~\\"))
+        return join(homedir(), trimmed.slice(2));
+    return trimmed;
+}
+function canonical(path) {
+    const abs = resolve(expandHome(path));
+    try {
+        return realpathSync(abs);
+    }
+    catch {
+        return normalize(abs);
+    }
+}
+function within(child, root) {
+    if (child === root)
+        return true;
+    const prefix = root.endsWith(sep) ? root : root + sep;
+    return child.startsWith(prefix);
+}
+export class WorkRoots {
+    local;
+    server = [];
+    constructor(localRoots) {
+        this.local = [...new Set(localRoots.map((r) => r.trim()).filter(Boolean).map(canonical))];
+    }
+    setServerRoots(roots) {
+        this.server = [...new Set((roots || []).map((r) => r.trim()).filter(Boolean).map(canonical))];
+    }
+    /** Allowed roots; empty means no limit. */
+    effective() {
+        return [...new Set([...this.local, ...this.server])];
+    }
+    /** Where new checkouts go (created on demand). */
+    workRoot() {
+        const root = this.local[0] ?? this.server[0] ?? join(homedir(), "eigen-work");
+        mkdirSync(root, { recursive: true });
+        return root;
+    }
+    isAllowed(path) {
+        const roots = this.effective();
+        if (!roots.length)
+            return true;
+        const target = canonical(path);
+        return roots.some((root) => within(target, root));
+    }
+    listDirs(path) {
+        const roots = this.effective();
+        if (!path) {
+            const tops = roots.length ? roots : [homedir()];
+            return {
+                path: "",
+                parent: null,
+                roots,
+                entries: tops.filter((p) => existsSync(p)).map((p) => entryFor(p)),
+            };
+        }
+        const target = canonical(path);
+        if (!this.isAllowed(target))
+            throw new Error("That folder is outside this machine's allowed folders");
+        if (!statSync(target).isDirectory())
+            throw new Error("Not a folder");
+        const entries = [];
+        for (const dirent of readdirSync(target, { withFileTypes: true })) {
+            if (!dirent.isDirectory() || dirent.name.startsWith("."))
+                continue;
+            entries.push(entryFor(join(target, dirent.name)));
+            if (entries.length >= MAX_ENTRIES)
+                break;
+        }
+        entries.sort((a, b) => a.name.localeCompare(b.name));
+        const atRoot = roots.length ? roots.includes(target) : target === canonical(homedir());
+        const parentPath = dirname(target);
+        return {
+            path: target,
+            parent: atRoot || parentPath === target || !this.isAllowed(parentPath) ? null : parentPath,
+            roots,
+            entries,
+        };
+    }
+}
+function entryFor(path) {
+    return { name: basename(path) || path, path, isGitRepo: existsSync(join(path, ".git")) };
+}
+function git(cwd, args, timeout = 120_000) {
+    return execCli("git", args, { cwd, timeout, env: { ...process.env, GIT_TERMINAL_PROMPT: "0" } });
+}
+/** https://github.com/o/r → https://x-access-token:TOKEN@github.com/o/r.git */
+function authedUrl(repoUrl, token) {
+    const clean = repoUrl.replace(/\/+$/, "").replace(/\.git$/, "");
+    if (!token)
+        return `${clean}.git`;
+    return `${clean.replace(/^https:\/\//, `https://x-access-token:${encodeURIComponent(token)}@`)}.git`;
+}
+async function useStoredGithubCreds(cwd) {
+    const file = gitCredentialsPath();
+    await git(cwd, ["config", "--local", "--unset-all", "credential.helper"]).catch(() => undefined);
+    await git(cwd, ["config", "--local", "credential.helper", `store --file=${file}`]);
+}
+/** Don't leave the access token in origin — `git remote -v` prints it. */
+async function forgetRemoteToken(cwd) {
+    try {
+        const current = (await git(cwd, ["remote", "get-url", "origin"])).stdout.trim();
+        const plain = current.replace(/x-access-token:[^@]+@/, "");
+        if (plain !== current)
+            await git(cwd, ["remote", "set-url", "origin", plain]);
+    }
+    catch {
+        // no origin / not a repo
+    }
+}
+async function persistGithubAuth(cwd, token) {
+    if (!token || !existsSync(join(cwd, ".git")))
+        return;
+    rememberGithubToken(token);
+    await useStoredGithubCreds(cwd);
+    await forgetRemoteToken(cwd);
+}
+/** Strip credentials so errors never echo a token. */
+function scrub(message, token) {
+    let out = message.replace(/x-access-token:[^@\s]+@/g, "x-access-token:***@");
+    if (token)
+        out = out.split(token).join("***");
+    return out;
+}
+export async function prepareRepo(roots, input) {
+    const dir = input.dir.trim();
+    if (!dir || isAbsolute(dir) || dir.split(/[\\/]/).some((part) => part === ".." || part === "")) {
+        throw new Error("Invalid workspace folder");
+    }
+    const target = join(roots.workRoot(), dir);
+    if (!roots.isAllowed(dirname(target)) && roots.effective().length) {
+        throw new Error("The work folder is outside this machine's allowed folders");
+    }
+    try {
+        if (!input.repoUrl) {
+            // Scratch workspace (no repo): an empty git dir so agents have a cwd.
+            mkdirSync(target, { recursive: true });
+            if (!existsSync(join(target, ".git")))
+                await git(target, ["init", "-q"]);
+            return target;
+        }
+        const remote = authedUrl(input.repoUrl, input.token);
+        const ref = input.ref || "main";
+        if (existsSync(join(target, ".git"))) {
+            await git(target, ["remote", "set-url", "origin", remote]);
+            await git(target, ["fetch", "--depth", "50", "origin", ref], 300_000);
+        }
+        else {
+            mkdirSync(dirname(target), { recursive: true });
+            try {
+                await git(dirname(target), ["clone", "--depth", "50", "--branch", ref, remote, target], 300_000);
+            }
+            catch {
+                await git(dirname(target), ["clone", remote, target], 600_000);
+                await git(target, ["checkout", ref]);
+            }
+            await git(target, ["config", "user.name", "Eigen Agent"]);
+            await git(target, ["config", "user.email", "agent@users.noreply.github.com"]);
+        }
+        if (input.branch) {
+            await git(target, ["checkout", "-B", input.branch, `origin/${ref}`]).catch(() => git(target, ["checkout", "-B", input.branch]));
+        }
+        return target;
+    }
+    catch (err) {
+        throw new Error(scrub(err.stderr || err.message, input.token));
+    }
+    finally {
+        await persistGithubAuth(target, input.token);
+    }
+}
+export async function finalizeGit(roots, input) {
+    if (!roots.isAllowed(input.repoPath))
+        throw new Error("That folder is outside this machine's allowed folders");
+    const cwd = canonical(input.repoPath);
+    try {
+        await git(cwd, ["add", "-A"]);
+        const status = await git(cwd, ["status", "--porcelain"]);
+        let committed = false;
+        if (status.stdout.trim()) {
+            await git(cwd, [
+                "-c",
+                "user.name=Eigen Agent",
+                "-c",
+                "user.email=agent@users.noreply.github.com",
+                "commit",
+                "-q",
+                "-m",
+                input.message || "Changes from Eigen agent",
+            ]);
+            committed = true;
+        }
+        if (input.token) {
+            const current = (await git(cwd, ["remote", "get-url", "origin"])).stdout.trim();
+            const plain = current.replace(/x-access-token:[^@]+@/, "");
+            if (/^https:\/\/github\.com\//.test(plain)) {
+                await git(cwd, ["remote", "set-url", "origin", authedUrl(plain, input.token)]);
+            }
+        }
+        const ahead = await git(cwd, ["rev-list", "--count", `origin/${input.branch}..HEAD`]).catch(() => null);
+        if (!committed && ahead && ahead.stdout.trim() === "0")
+            return { pushed: false, branch: input.branch };
+        await git(cwd, ["push", "-u", "origin", `HEAD:refs/heads/${input.branch}`], 300_000);
+        return { pushed: true, branch: input.branch };
+    }
+    catch (err) {
+        throw new Error(scrub(err.stderr || err.message, input.token));
+    }
+    finally {
+        await persistGithubAuth(cwd, input.token);
+    }
+}

package/dist/cli/src/worker.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Connect with this machine's credential (`eigen connect`) when there is
+ * one, otherwise as the signed-in user (`eigen login`).
+ */
+export declare function startWorker(opts?: {
+    repo?: string;
+    roots?: string[];
+}): void;