@getmonoceros/workbench 1.37.12 → 1.37.14

package/bundled-components/features/atlassian/component.yml

@@ -40,19 +40,31 @@ options:
     description: "Optional Bitbucket app password; only needed for twg's Bitbucket commands."
     surface: env
 feature:
-  version: 1.2.0
+  version: 1.2.1
   persistentHomePaths: [.config/acli, .rovodev, .config/twg, .agents]
   vscodeExtensions: [Atlassian.atlascode]
-  # Forge is keychain-free in a container: instead of `forge login` (which
-  # needs libsecret), Atlassian's documented path is the FORGE_EMAIL /
-  # FORGE_API_TOKEN env vars, read at command time. We hand them to the
-  # workspace runtime env from the shared account options, gated on the
-  # `forge` toggle. Sibling of a service's connectionEnv (ADR 0021).
+  # Forge and twg are both keychain-free in a container: instead of a
+  # `login` step (which needs libsecret, or a TTY for twg's OAuth),
+  # Atlassian's documented path is env vars read at command time. We hand
+  # them to the workspace runtime env from the shared account options,
+  # each gated on its own toggle. Sibling of a service's connectionEnv
+  # (ADR 0021).
+  #   - Forge reads FORGE_EMAIL / FORGE_API_TOKEN.
+  #   - twg reads TWG_USER / TWG_SITE / TWG_TOKEN (+ optional
+  #     TWG_BBC_TOKEN for Bitbucket). Recent twg makes `twg login`
+  #     OAuth-only and it aborts without a TTY, so these env vars are the
+  #     only non-interactive auth path; there is no login hook.
   workspaceEnv:
     - whenOption: forge
       vars:
         FORGE_EMAIL: '${email}'
         FORGE_API_TOKEN: '${apiToken}'
+    - whenOption: twg
+      vars:
+        TWG_USER: '${email}'
+        TWG_SITE: '${instance}'
+        TWG_TOKEN: '${apiToken}'
+        TWG_BBC_TOKEN: '${bitbucketToken}'
 briefing:
   - whenOption: rovodev
     text: 'Atlassian Rovo Dev — invoke via `acli rovodev`. Pre-authenticated against the Atlassian account configured in the feature options (shared with twg).'

package/bundled-components/features/atlassian/install.sh

@@ -95,8 +95,9 @@ if [ "${TWG}" = "true" ]; then
   #     runtime — we re-record it as node in the post-create hook
   #     below.)
   #   - With --skip-login / --skip-skills we keep the install
-  #     non-interactive. Login + skills happen later as the node user
-  #     so they persist into the bind-mounted home.
+  #     non-interactive. Auth is env-var based (see the workspaceEnv
+  #     note below, no login step); skills install later as the node
+  #     user so they persist into the bind-mounted home.
   #
   # Heredoc (not `yes ... |`) deliberately: a long-lived `yes` left
   # writing into a closed pipe after the install script exits gets
@@ -128,49 +129,34 @@ TWG_INSTALL_INPUT
     exit 1
   }
 
+  # twg authenticates purely from the TWG_USER / TWG_SITE / TWG_TOKEN
+  # (+ optional TWG_BBC_TOKEN) env vars that the workbench injects into
+  # the workspace runtime env from the shared account options
+  # (feature.workspaceEnv, gated on the `twg` toggle): the same
+  # keychain-free path as Forge. There is deliberately no login step.
+  # Recent twg makes `twg login` OAuth-only, and it aborts without a TTY,
+  # which is unavailable during `monoceros apply`'s postCreate. So the
+  # post-create hook's only job is to (re-)install twg's agent skills as
+  # the node user, which needs no credentials, so it runs whenever twg is
+  # installed regardless of whether creds are set.
   HOOK="${POST_CREATE_DIR}/atlassian-twg.sh"
-  if [ -n "${INSTANCE}" ] && [ -n "${EMAIL}" ] && [ -n "${APITOKEN}" ]; then
-    cat >"${HOOK}" <<EOF
+  cat >"${HOOK}" <<EOF
 #!/usr/bin/env bash
 # Auto-generated by the Monoceros atlassian feature (twg).
-# Runs every container start. Always re-runs auth login so that
-# rotating the apiToken / bitbucketToken in the container yml
-# propagates through on the next \`monoceros apply\` without
-# needing to delete the previous credentials file by hand. twg's
-# login is a single API call; the cost is negligible compared to
-# the container build.
+# Runs every container start. twg auth comes from the TWG_* env vars
+# injected via feature.workspaceEnv; there is no login step here (recent
+# twg's \`twg login\` is OAuth-only and needs a TTY). This hook only
+# (re-)installs twg's agent skills as the node user.
 set -euo pipefail
-mkdir -p "\${HOME}/.config/twg"
-echo "[atlassian/twg] configuring twg non-interactively for ${EMAIL} @ ${INSTANCE}"
-# Notes on the non-interactive login dance:
-#   - We don't try to re-record consent here as the node user. twg's
-#     \`consent\` subcommand demands a TTY; the install-time consent
-#     (recorded as root during the feature build) appears to be
-#     enough for \`twg login\` itself.
-#   - \`twg login --force\` reads Atlassian creds from TWG_USER /
-#     TWG_SITE / TWG_TOKEN. If TWG_BBC_TOKEN is set, twg uses that
-#     directly and skips the Bitbucket prompt. If empty, twg prompts
-#     interactively — we feed two blank lines via heredoc so the
-#     "Enter = skip" branch fires and we don't hang. Future twg
-#     versions adding another optional prompt are also covered by
-#     the second blank line.
-TWG_USER='${EMAIL}' \\
-TWG_SITE='${INSTANCE}' \\
-TWG_TOKEN='${APITOKEN}' \\
-TWG_BBC_TOKEN='${BITBUCKETTOKEN}' \\
-  twg login --force <<'TWG_LOGIN_INPUT'
-
-
-TWG_LOGIN_INPUT
 
 # (Re-)install twg's agent skills. Canonical install lands in
 # /home/node/.agents/skills/twg (persisted via the feature's
 # persistentHomePaths); .agents/skills-native agents (codex, cursor,
 # gemini, copilot, …) read it directly. Agents with their own skills
-# dir (claude → .claude/skills, opencode → .opencode/skills) need an
+# dir (claude -> .claude/skills, opencode -> .opencode/skills) need an
 # explicit --agent flag, so we detect which AI CLIs are present in this
 # container and pass the matching flags. This keeps the atlassian
-# feature decoupled from the container's feature list — it reacts to
+# feature decoupled from the container's feature list: it reacts to
 # whatever is actually installed. Idempotent: re-running just refreshes
 # the wrappers.
 echo "[atlassian/twg] (re-)installing twg skills"
@@ -183,11 +169,10 @@ if command -v opencode >/dev/null 2>&1; then
 fi
 twg skills install --global --yes "\${TWG_SKILL_AGENTS[@]}"
 EOF
-    chmod 0755 "${HOOK}"
-    echo "[atlassian/twg] post-create login hook installed"
-  else
-    rm -f "${HOOK}"
-    echo "[atlassian/twg] missing instance/email/apiToken — login is manual (\`twg login\` once in the container)"
+  chmod 0755 "${HOOK}"
+  echo "[atlassian/twg] post-create skills hook installed; auth via TWG_* workspace env"
+  if [ -z "${INSTANCE}" ] || [ -z "${EMAIL}" ] || [ -z "${APITOKEN}" ]; then
+    echo "[atlassian/twg] instance/email/apiToken not all set; set them in the container yml so TWG_USER/TWG_SITE/TWG_TOKEN reach the shell (otherwise run \`twg login\` once in the container)"
   fi
 fi
 

package/dist/bin.js

@@ -8369,7 +8369,8 @@ Fix the value in the env file (or the yml).`
     (repo) => !repo.gitUser
   );
   const hasResolvedContainerGitUser = containerGitOverride !== void 0;
-  const hasDefaultGitUser = globalConfig?.defaults?.git?.user !== void 0;
+  const defaultGitUser = globalConfig?.defaults?.git?.user;
+  const hasDefaultGitUser = defaultGitUser?.name !== void 0 || defaultGitUser?.email !== void 0;
   const idLogger = {
     info: logger.info,
     warn: logger.warn ?? logger.info
@@ -8973,7 +8974,7 @@ var CLI_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    CLI_VERSION = true ? "1.37.12" : "dev";
+    CLI_VERSION = true ? "1.37.14" : "dev";
   }
 });