@ghl-ai/aw 0.1.39 → 0.1.40-beta.0

package/git.mjs

@@ -9,6 +9,49 @@ import { REGISTRY_BASE_BRANCH, REGISTRY_DIR, DOCS_SOURCE_DIR, RULES_SOURCE_DIR }
 
 const exec = promisify(execCb);
 
+/**
+ * Env vars applied to every git command that touches the network.
+ * GIT_TERMINAL_PROMPT=0 prevents git from hanging when it would otherwise
+ * prompt for credentials (e.g. HTTPS URL with SSH-only auth configured).
+ * Instead, git exits immediately with a non-zero code that we can catch.
+ */
+const GIT_NET_ENV = { ...process.env, GIT_TERMINAL_PROMPT: '0' };
+
+/**
+ * Convert an HTTPS GitHub URL to its SSH equivalent.
+ * e.g. https://github.com/Org/Repo.git → git@github.com:Org/Repo.git
+ */
+function toSshUrl(httpsUrl) {
+  const m = httpsUrl.match(/^https:\/\/github\.com\/(.+)$/);
+  return m ? `git@github.com:${m[1]}` : httpsUrl;
+}
+
+/**
+ * Detect whether the user's git is configured to prefer SSH for github.com.
+ * Checks: 1) git insteadOf config  2) gh CLI auth status
+ * Returns true if SSH is preferred.
+ */
+function prefersSsh() {
+  // Check git url."git@github.com:".insteadOf
+  try {
+    const out = execSync(
+      'git config --global --get-regexp "url\\.git@github\\.com.*\\.insteadOf"',
+      { stdio: 'pipe', encoding: 'utf8', env: GIT_NET_ENV },
+    ).trim();
+    if (out.includes('https://github.com')) return true;
+  } catch { /* not configured */ }
+
+  // Check gh auth — if protocol is ssh, prefer SSH
+  try {
+    const out = execSync('gh auth status 2>&1', {
+      stdio: 'pipe', encoding: 'utf8', env: GIT_NET_ENV, timeout: 5000,
+    });
+    if (/git protocol:\s*ssh/i.test(out)) return true;
+  } catch { /* gh not installed or not authed */ }
+
+  return false;
+}
+
 // ── Backward-compat: temp-dir sparse checkout (used by search.mjs) ────────────
 
 /**
@@ -18,12 +61,23 @@ const exec = promisify(execCb);
 export function sparseCheckout(repo, paths) {
   const tempDir = mkdtempSync(join(tmpdir(), 'aw-'));
 
-  const repoUrl = repo.startsWith('http') ? repo : `https://github.com/${repo}.git`;
-  try {
-    execSync(`git clone --filter=blob:none --no-checkout "${repoUrl}" "${tempDir}"`, {
-      stdio: 'pipe',
-    });
-  } catch (e) {
+  const httpsUrl = repo.startsWith('http') ? repo : `https://github.com/${repo}.git`;
+  const urls = prefersSsh() ? [toSshUrl(httpsUrl), httpsUrl] : [httpsUrl, toSshUrl(httpsUrl)];
+
+  let cloned = false;
+  for (const url of urls) {
+    try {
+      execSync(`git clone --filter=blob:none --no-checkout "${url}" "${tempDir}"`, {
+        stdio: 'pipe', env: GIT_NET_ENV,
+      });
+      cloned = true;
+      break;
+    } catch {
+      // Clean up partial clone so next attempt can use the same tempDir
+      try { rmSync(join(tempDir, '.git'), { recursive: true, force: true }); } catch {}
+    }
+  }
+  if (!cloned) {
     throw new Error(`Failed to clone ${repo}. Check your git credentials and repo access.`);
   }
 
@@ -47,10 +101,20 @@ export function sparseCheckout(repo, paths) {
 export async function sparseCheckoutAsync(repo, paths) {
   const tempDir = mkdtempSync(join(tmpdir(), 'aw-'));
 
-  const repoUrl = repo.startsWith('http') ? repo : `https://github.com/${repo}.git`;
-  try {
-    await exec(`git clone --filter=blob:none --no-checkout "${repoUrl}" "${tempDir}"`);
-  } catch (e) {
+  const httpsUrl = repo.startsWith('http') ? repo : `https://github.com/${repo}.git`;
+  const urls = prefersSsh() ? [toSshUrl(httpsUrl), httpsUrl] : [httpsUrl, toSshUrl(httpsUrl)];
+
+  let cloned = false;
+  for (const url of urls) {
+    try {
+      await exec(`git clone --filter=blob:none --no-checkout "${url}" "${tempDir}"`, { env: GIT_NET_ENV });
+      cloned = true;
+      break;
+    } catch {
+      try { rmSync(join(tempDir, '.git'), { recursive: true, force: true }); } catch {}
+    }
+  }
+  if (!cloned) {
     throw new Error(`Failed to clone ${repo}. Check your git credentials and repo access.`);
   }
 
@@ -106,7 +170,9 @@ export function isValidClone(awHome, repoUrl) {
   if (!existsSync(join(awHome, '.git'))) return false;
   try {
     const remote = execSync('git remote get-url origin', { cwd: awHome, stdio: 'pipe', encoding: 'utf8' }).trim();
-    return remote === repoUrl || remote === repoUrl.replace(/\.git$/, '') + '.git' || remote.replace(/\.git$/, '') === repoUrl.replace(/\.git$/, '');
+    // Normalize both sides to bare repo path for comparison (handles HTTPS ↔ SSH)
+    const normalize = (u) => u.replace(/\.git$/, '').replace(/^git@github\.com:/, 'https://github.com/');
+    return normalize(remote) === normalize(repoUrl);
   } catch {
     return false;
   }
@@ -123,10 +189,26 @@ export async function initPersistentClone(repoUrl, awHome, sparsePaths) {
     try { execSync(`rm -rf "${awHome}"`, { stdio: 'pipe' }); } catch {}
   }
 
-  try {
-    await exec(`git clone --filter=blob:none --no-checkout "${repoUrl}" "${awHome}"`);
-  } catch (e) {
-    throw new Error(`Failed to clone ${repoUrl}: ${e.message}`);
+  const urls = prefersSsh()
+    ? [toSshUrl(repoUrl), repoUrl]
+    : [repoUrl, toSshUrl(repoUrl)];
+
+  let cloned = false;
+  for (const url of urls) {
+    // Clean up any partial clone from a previous attempt
+    if (existsSync(awHome) && !isValidClone(awHome, url)) {
+      try { execSync(`rm -rf "${awHome}"`, { stdio: 'pipe' }); } catch {}
+    }
+    try {
+      await exec(`git clone --filter=blob:none --no-checkout "${url}" "${awHome}"`, { env: GIT_NET_ENV });
+      cloned = true;
+      break;
+    } catch {
+      // try next URL
+    }
+  }
+  if (!cloned) {
+    throw new Error(`Failed to clone ${repoUrl}. Check your git credentials and repo access (HTTPS and SSH both failed).`);
   }
 
   try {
@@ -286,7 +368,7 @@ export async function fetchAndMerge(awHome, { silent = true } = {}) {
 
   // ── 2. Fetch ──────────────────────────────────────────────────────────────
   try {
-    await exec(`git -C "${awHome}" fetch origin ${REGISTRY_BASE_BRANCH}`);
+    await exec(`git -C "${awHome}" fetch origin ${REGISTRY_BASE_BRANCH}`, { env: GIT_NET_ENV });
   } catch (e) {
     throw new Error(`Failed to fetch from origin: ${e.message}`);
   }
@@ -315,7 +397,7 @@ export async function fetchAndMerge(awHome, { silent = true } = {}) {
     // someone else pushed to the remote tracking branch since our last fetch.
     if (isPushBranch) {
       try {
-        await exec(`git -C "${awHome}" push --force-with-lease origin "${currentBranch}"`);
+        await exec(`git -C "${awHome}" push --force-with-lease origin "${currentBranch}"`, { env: GIT_NET_ENV });
       } catch { /* non-blocking — divergence will be resolved on next aw push */ }
     }
   } catch {
@@ -442,7 +524,7 @@ export function updatePushBranch(awHome, pushBranchName) {
   }
 
   try {
-    execSync(`git -C "${awHome}" push origin "${pushBranchName}" --force`, { stdio: 'pipe' });
+    execSync(`git -C "${awHome}" push origin "${pushBranchName}" --force`, { stdio: 'pipe', env: GIT_NET_ENV });
   } catch (e) {
     throw new Error(`Failed to push branch: ${e.message}`);
   }
@@ -485,7 +567,7 @@ export async function createPushBranch(awHome, branchName, files, commitMsg, pre
   }
 
   try {
-    await exec(`git -C "${awHome}" push -u origin "${branchName}"`);
+    await exec(`git -C "${awHome}" push -u origin "${branchName}"`, { env: GIT_NET_ENV });
   } catch (e) {
     throw new Error(`Failed to push branch: ${e.message}`);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ghl-ai/aw",
-  "version": "0.1.39",
+  "version": "0.1.40-beta.0",
   "description": "Agentic Workspace CLI — pull, push & manage agents, skills and commands from the registry",
   "type": "module",
   "bin": {