@h-rig/runtime 0.0.6-alpha.1 → 0.0.6-alpha.11

package/dist/src/control-plane/agent-wrapper.js

@@ -2951,6 +2951,17 @@ async function readSourceAwareTaskStatus(projectRoot, taskId, options = {}) {
     return null;
   }
 }
+function updateGithubIssueTaskBySourceIssueId(sourceIssueId, taskId, update, options = {}) {
+  const parsed = sourceIssueId?.trim().match(/^([^/]+)\/([^#]+)#(\d+)$/);
+  if (!parsed || parsed[3] !== taskId) {
+    return false;
+  }
+  applyGithubIssueUpdate(options.ghBinary ?? "gh", options.spawn ?? spawnSync, parsed[3], {
+    sourceIssueId: sourceIssueId.trim(),
+    taskSource: { kind: "github-issues", owner: parsed[1], repo: parsed[2] }
+  }, update);
+  return true;
+}
 function updateSourceAwareTaskConfigTask(projectRoot, taskId, update, options = {}) {
   const configPath = options.configPath ?? resolve13(projectRoot, ".rig", "task-config.json");
   const rawEntry = readRawTaskEntry(configPath, taskId);
@@ -3306,8 +3317,8 @@ function ensureStatusLabel(bin, repo, spawnFn, label) {
   }
 }
 function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
 }
 function ghSpawnOptions() {
   return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
@@ -5710,20 +5721,23 @@ function hashProjectPath(workspaceDir) {
 }
 function resolveGithubCliBinaryPath() {
   const explicit = process.env.RIG_GH_BIN?.trim();
-  if (explicit && existsSync23(explicit)) {
+  if (explicit && existsSync23(explicit) && !isRuntimeGatewayGhPath(explicit)) {
     return explicit;
   }
-  const bunResolved = Bun.which("gh");
-  if (bunResolved && existsSync23(bunResolved)) {
-    return bunResolved;
-  }
-  for (const candidate of ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"]) {
+  for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"]) {
     if (existsSync23(candidate)) {
       return candidate;
     }
   }
+  const bunResolved = Bun.which("gh");
+  if (bunResolved && existsSync23(bunResolved) && !isRuntimeGatewayGhPath(bunResolved)) {
+    return bunResolved;
+  }
   return "";
 }
+function isRuntimeGatewayGhPath(candidate) {
+  return /\/\.rig\/bin\/gh$/.test(candidate.replace(/\\/g, "/"));
+}
 async function resolveGithubCliAuthToken(ghBinary = "") {
   const gh = ghBinary || resolveGithubCliBinaryPath();
   if (!gh) {
@@ -5824,6 +5838,8 @@ async function runtimeEnv(projectRoot, runtime) {
     XDG_CACHE_HOME: runtime.cacheDir,
     XDG_STATE_HOME: runtime.stateDir,
     RIG_AGENT_ID: runtime.id,
+    ...process.env.RIG_RUN_ID?.trim() ? { RIG_RUN_ID: process.env.RIG_RUN_ID.trim() } : {},
+    ...process.env.RIG_SERVER_RUN_ID?.trim() ? { RIG_SERVER_RUN_ID: process.env.RIG_SERVER_RUN_ID.trim() } : {},
     RIG_TASK_ID: runtime.taskId,
     RIG_TASK_RUNTIME_ID: runtime.id,
     RIG_TASK_WORKSPACE: runtime.workspaceDir,
@@ -5887,6 +5903,10 @@ async function runtimeEnv(projectRoot, runtime) {
       env[key] = value;
     }
   }
+  const rigGithubToken = process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  if (rigGithubToken && !env.GITHUB_TOKEN && !env.GH_TOKEN) {
+    env.GITHUB_TOKEN = rigGithubToken;
+  }
   const fallbackGithubToken = !env.GITHUB_TOKEN && !env.GH_TOKEN ? await resolveGithubCliAuthToken(hostGhBinary) : "";
   if (fallbackGithubToken) {
     env.GITHUB_TOKEN = fallbackGithubToken;
@@ -5897,6 +5917,13 @@ async function runtimeEnv(projectRoot, runtime) {
   if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
     env.GH_TOKEN = env.GITHUB_TOKEN;
   }
+  const gitHubToken = env.GITHUB_TOKEN || env.GH_TOKEN || rigGithubToken;
+  if (gitHubToken) {
+    env.RIG_GITHUB_TOKEN = gitHubToken;
+    env.GITHUB_TOKEN = env.GITHUB_TOKEN || gitHubToken;
+    env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
+    applyGitHubCredentialHelperEnv(env);
+  }
   if (!env.GREPTILE_GITHUB_TOKEN && env.GITHUB_TOKEN) {
     env.GREPTILE_GITHUB_TOKEN = env.GITHUB_TOKEN;
   }
@@ -5977,12 +6004,21 @@ async function materializeRuntimeCertBundle(runtime) {
   }
   return targetPath;
 }
+function applyGitHubCredentialHelperEnv(env) {
+  env.GIT_TERMINAL_PROMPT = "0";
+  env.GIT_CONFIG_COUNT = "2";
+  env.GIT_CONFIG_KEY_0 = "credential.helper";
+  env.GIT_CONFIG_VALUE_0 = "";
+  env.GIT_CONFIG_KEY_1 = "credential.helper";
+  env.GIT_CONFIG_VALUE_1 = '!f() { test "$1" = get || exit 0; token="${GITHUB_TOKEN:-${GH_TOKEN:-${RIG_GITHUB_TOKEN:-}}}"; test -n "$token" || exit 0; echo username=x-access-token; echo password="$token"; }; f';
+}
 function persistRuntimeSecrets(runtimeRoot, env) {
   const secretsPath = resolve25(runtimeRoot, "runtime-secrets.json");
   const persisted = {};
   for (const key of [
     "GITHUB_TOKEN",
     "GH_TOKEN",
+    "RIG_GITHUB_TOKEN",
     "GREPTILE_GITHUB_TOKEN",
     "GREPTILE_API_KEY",
     "AI_REVIEW_MODE",
@@ -8461,7 +8497,11 @@ async function ensureAgentRuntime(options) {
   mkdirSync18(runtime.binDir, { recursive: true });
   mkdirSync18(workspaceLayout.distDir, { recursive: true });
   prepareRuntimeWorkspace(options.projectRoot, workspaceDir);
-  await resetEphemeralTaskArtifacts(workspaceDir, options.taskId);
+  if (options.preserveTaskArtifacts) {
+    console.log(`[rig-agent] Preserving runtime task artifacts for resume of ${options.taskId}.`);
+  } else {
+    await resetEphemeralTaskArtifacts(workspaceDir, options.taskId);
+  }
   const ctx = {
     runtimeId: options.id,
     taskId: options.taskId,
@@ -9173,7 +9213,8 @@ async function runAgentWrapper(options = {}) {
       taskId,
       mode: "worktree",
       provider,
-      taskRecordReader: taskRecordReaderFromEnv(taskId)
+      taskRecordReader: taskRecordReaderFromEnv(taskId),
+      preserveTaskArtifacts: process.env.RIG_RUN_RESUME === "1" || process.env.RIG_RUNTIME_ARTIFACT_CLEANUP === "preserve"
     });
     emitWrapperEvent("runtime.provision.completed", {
       runtimeId: runtime.id,
@@ -9193,6 +9234,18 @@ async function runAgentWrapper(options = {}) {
     console.error(`[rig-agent] Failed to provision runtime: ${error}`);
     return 1;
   }
+  try {
+    await waitForDirtyBaselineReady(runtime, taskId);
+  } catch (error) {
+    emitWrapperEvent("runtime.baseline.failed", {
+      runtimeId: runtime.id,
+      taskId,
+      workspaceDir: runtime.workspaceDir,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    console.error(`[rig-agent] Failed to apply selected baseline before provider launch: ${error}`);
+    return 1;
+  }
   const providerArgs = buildProviderArgs(provider, runtime, argv);
   const providerCommand = [providerBinary(provider), ...providerArgs];
   emitWrapperEvent("provider.launch", {
@@ -9324,12 +9377,16 @@ function buildProviderArgs(provider, runtime, argv) {
   }
   if (provider === "pi") {
     const piArgs = [...argv];
+    const piProvider = cliOptionValue(piArgs, "--provider") || process.env.RIG_PI_PROVIDER?.trim() || "openai-codex";
     if (!hasCliOption(piArgs, "--provider")) {
-      piArgs.unshift(process.env.RIG_PI_PROVIDER?.trim() || "openai-codex");
+      piArgs.unshift(piProvider);
       piArgs.unshift("--provider");
     }
-    if (!hasCliOption(piArgs, "--model")) {
-      piArgs.unshift(process.env.RIG_PI_MODEL?.trim() || "gpt-5.5");
+    const model = cliOptionValue(piArgs, "--model") || process.env.RIG_PI_MODEL?.trim() || "gpt-5.5";
+    if (hasCliOption(piArgs, "--model")) {
+      rewriteCliOptionValue(piArgs, "--model", normalizePiModelForProvider(model, piProvider));
+    } else {
+      piArgs.unshift(normalizePiModelForProvider(model, piProvider));
       piArgs.unshift("--model");
     }
     return piArgs;
@@ -9397,6 +9454,38 @@ function resolveProvider() {
 function hasCliOption(argv, option) {
   return argv.some((arg) => arg === option || arg.startsWith(`${option}=`));
 }
+function cliOptionValue(argv, option) {
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === option) {
+      const next = argv[index + 1];
+      return next && !next.startsWith("--") ? next : undefined;
+    }
+    if (arg?.startsWith(`${option}=`)) {
+      return arg.slice(option.length + 1);
+    }
+  }
+  return;
+}
+function rewriteCliOptionValue(argv, option, value) {
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === option && argv[index + 1] && !argv[index + 1].startsWith("--")) {
+      argv[index + 1] = value;
+      return;
+    }
+    if (arg?.startsWith(`${option}=`)) {
+      argv[index] = `${option}=${value}`;
+      return;
+    }
+  }
+}
+function normalizePiModelForProvider(model, provider) {
+  if (provider === "openrouter" && model === "openai-codex/gpt-5.5") {
+    return "openai/gpt-5.5";
+  }
+  return model;
+}
 function providerBinary(provider) {
   if (provider === "codex") {
     return Bun.which("codex") || "codex";
@@ -9413,6 +9502,34 @@ function providerBinary(provider) {
 function emitWrapperEvent(type, payload) {
   console.log(`__RIG_WRAPPER_EVENT__${JSON.stringify({ type, payload, at: new Date().toISOString() })}`);
 }
+function sleep(ms) {
+  return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
+}
+async function waitForDirtyBaselineReady(runtime, taskId) {
+  const readyFile = process.env.RIG_DIRTY_BASELINE_READY_FILE?.trim();
+  if (process.env.RIG_BASELINE_MODE !== "dirty-snapshot" || !readyFile)
+    return;
+  const timeoutMs = Number.parseInt(process.env.RIG_DIRTY_BASELINE_TIMEOUT_MS ?? "30000", 10);
+  const deadline = Date.now() + (Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : 30000);
+  emitWrapperEvent("runtime.baseline.waiting", {
+    runtimeId: runtime.id,
+    taskId,
+    workspaceDir: runtime.workspaceDir,
+    readyFile
+  });
+  while (!existsSync33(readyFile)) {
+    if (Date.now() >= deadline) {
+      throw new Error(`Timed out waiting for dirty baseline ready file: ${readyFile}`);
+    }
+    await sleep(50);
+  }
+  emitWrapperEvent("runtime.baseline.completed", {
+    runtimeId: runtime.id,
+    taskId,
+    workspaceDir: runtime.workspaceDir,
+    readyFile
+  });
+}
 async function resolveTaskId(projectRoot, monorepoRoot) {
   if (process.env.RIG_TASK_ID) {
     return process.env.RIG_TASK_ID;
@@ -9488,7 +9605,9 @@ async function updateTaskSourceAfterRun(projectRoot, taskId, runtime) {
   } catch (error) {
     let fallbackUpdated = false;
     try {
-      fallbackUpdated = updateSourceAwareTaskConfigTask(projectRoot, taskId, { status: "closed", comment });
+      const sourceIssueId = loadRuntimeContextFromEnv()?.sourceTask?.sourceIssueId;
+      fallbackUpdated = updateGithubIssueTaskBySourceIssueId(sourceIssueId, taskId, { status: "closed", comment });
+      fallbackUpdated = updateSourceAwareTaskConfigTask(projectRoot, taskId, { status: "closed", comment }) || fallbackUpdated;
     } catch (fallbackError) {
       console.error(`[rig-agent] Source-aware compatibility update also failed for ${taskId}: ${fallbackError instanceof Error ? fallbackError.message : String(fallbackError)}`);
     }

package/dist/src/control-plane/harness-main.js

@@ -1203,8 +1203,8 @@ function githubStatusFor(issue) {
   return "open";
 }
 function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
 }
 function ghSpawnOptions() {
   return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
@@ -5989,12 +5989,12 @@ var TASK_ARTIFACT_STAGE_FALLBACK = new Set([
   "task-result.json",
   "validation-summary.json"
 ]);
-function resolveHostRigBinDir(root) {
-  return resolve24(root, ".rig", "bin");
-}
 function isRuntimeGatewayGitPath(candidate) {
   return /\/\.rig\/bin\/git$/.test(candidate.replace(/\\/g, "/"));
 }
+function isRuntimeGatewayGhPath(candidate) {
+  return /\/\.rig\/bin\/gh$/.test(candidate.replace(/\\/g, "/"));
+}
 function resolveOptionalMonorepoRoot(projectRoot) {
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
   if (runtimeWorkspace && existsSync21(resolve24(runtimeWorkspace, ".git"))) {
@@ -6029,6 +6029,9 @@ function resolveGitBinary(projectRoot) {
   }
   return "git";
 }
+function escapeRegExp2(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 function safeCurrentTaskId(projectRoot) {
   try {
     const taskId = currentTaskId(projectRoot);
@@ -6187,17 +6190,15 @@ function gitOpenPr(options) {
   const target = options.target || (taskId ? "monorepo" : "project");
   let repoRoot = options.projectRoot;
   let repoLabel = "project-rig";
-  let defaultBase = process.env.RIG_PR_BASE_PROJECT || "main";
+  const envBase = target === "monorepo" ? process.env.RIG_PR_BASE_MONOREPO?.trim() || "" : process.env.RIG_PR_BASE_PROJECT?.trim() || "";
   if (target === "monorepo") {
     repoRoot = resolveOptionalMonorepoRoot(options.projectRoot) || resolveMonorepoRoot2(options.projectRoot);
     repoLabel = "monorepo";
-    defaultBase = process.env.RIG_PR_BASE_MONOREPO || "main";
     if (taskId) {
       gitSyncBranch(options.projectRoot, taskId, "monorepo");
     }
   } else if (taskId) {
     gitSyncBranch(options.projectRoot, taskId, "project");
-    defaultBase = inferProjectBase(options.projectRoot, defaultBase);
   }
   if (!existsSync21(resolve24(repoRoot, ".git"))) {
     throw new Error(`Repository not available for open-pr target ${target}: ${repoRoot}`);
@@ -6206,9 +6207,9 @@ function gitOpenPr(options) {
   if (!branch || branch === "HEAD") {
     throw new Error(`Cannot open PR from detached HEAD in ${repoLabel}. Checkout a branch first.`);
   }
-  const base = options.base || defaultBase;
   const repoNameWithOwner = resolveRepoNameWithOwner(options.projectRoot, repoRoot);
   const networkRemote = resolveNetworkRemoteName(options.projectRoot, repoRoot, repoNameWithOwner);
+  const base = options.base || envBase || inferRepositoryDefaultBase(options.projectRoot, repoRoot, repoNameWithOwner, networkRemote, target === "project" ? inferProjectBase(options.projectRoot, "main") : "main");
   refreshRemoteBaseRef(options.projectRoot, repoRoot, base);
   let reviewer = (options.reviewer || "").trim();
   let reviewerSource = reviewer ? "flag" : undefined;
@@ -6244,6 +6245,7 @@ function gitOpenPr(options) {
     "",
     "## Task",
     `- beads: ${taskId || "n/a"}`,
+    ...defaultPrRunLines(taskId, repoNameWithOwner),
     "",
     "## Review",
     "- Completion verification will run validation, verifier review, and PR policy checks.",
@@ -6335,6 +6337,29 @@ function gitOpenPr(options) {
   }
   return result;
 }
+function defaultPrRunLines(taskId, repoNameWithOwner) {
+  const lines = [];
+  const runId = process.env.RIG_SERVER_RUN_ID?.trim();
+  if (runId) {
+    lines.push(`- Run: ${runId}`);
+  }
+  const closeout = defaultPrCloseoutLine(taskId, repoNameWithOwner);
+  if (closeout) {
+    lines.push(`- ${closeout}`);
+  }
+  return lines;
+}
+function defaultPrCloseoutLine(taskId, repoNameWithOwner) {
+  const sourceIssueId = loadRuntimeContextFromEnv()?.sourceTask?.sourceIssueId;
+  if (sourceIssueId) {
+    const match = sourceIssueId.match(/^([^#]+)#(\d+)$/);
+    if (match) {
+      const [, sourceRepo, issueNumber] = match;
+      return sourceRepo.toLowerCase() === repoNameWithOwner.toLowerCase() ? `Closes #${issueNumber}` : `Closes ${sourceRepo}#${issueNumber}`;
+    }
+  }
+  return /^\d+$/.test(taskId) ? `Closes #${taskId}` : "";
+}
 function readPrViewState(gh, repoRoot, repoNameWithOwner, prUrl) {
   const view = runCapture2(withGhRepo([
     gh,
@@ -6485,32 +6510,19 @@ function resolveGithubCliBinary(projectRoot) {
   if (explicit) {
     candidates.add(explicit);
   }
+  for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"]) {
+    candidates.add(candidate);
+  }
   const explicitPathEntries = (process.env.PATH || "").split(":").map((entry) => entry.trim()).filter(Boolean);
   for (const entry of explicitPathEntries) {
     candidates.add(resolve24(entry, "gh"));
   }
-  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim();
-  if (hostProjectRoot) {
-    candidates.add(resolve24(resolveHostRigBinDir(hostProjectRoot), "gh"));
-  }
-  candidates.add(resolve24(resolveHostRigBinDir(projectRoot), "gh"));
-  const runtimeContext = loadRuntimeContextFromEnv();
-  if (runtimeContext?.binDir) {
-    candidates.add(resolve24(runtimeContext.binDir, "gh"));
-  }
-  const runtimeHome = process.env.RIG_RUNTIME_HOME?.trim();
-  if (runtimeHome) {
-    candidates.add(resolve24(runtimeHome, "bin", "gh"));
-  }
-  for (const candidate of ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"]) {
-    candidates.add(candidate);
-  }
   const bunResolved = Bun.which("gh");
   if (bunResolved) {
     candidates.add(bunResolved);
   }
   for (const candidate of candidates) {
-    if (candidate && existsSync21(candidate)) {
+    if (candidate && existsSync21(candidate) && !isRuntimeGatewayGhPath(candidate)) {
       return candidate;
     }
   }
@@ -6659,6 +6671,32 @@ function withGhRepo(command, repoNameWithOwner) {
   }
   return [command[0], command[1], command[2], ...ghRepoArgs(repoNameWithOwner), ...command.slice(3)];
 }
+function inferRepositoryDefaultBase(projectRoot, repoRoot, repoNameWithOwner, remoteName, fallback) {
+  const remote = remoteName || "origin";
+  const symbolic = runCapture2(gitCmd(projectRoot, repoRoot, "symbolic-ref", "--short", `refs/remotes/${remote}/HEAD`), projectRoot);
+  if (symbolic.exitCode === 0) {
+    const ref = symbolic.stdout.trim().replace(new RegExp(`^${escapeRegExp2(remote)}/`), "");
+    if (ref && ref !== "HEAD") {
+      return ref;
+    }
+  }
+  const lsRemote = runCapture2(gitCmd(projectRoot, repoRoot, "ls-remote", "--symref", remote, "HEAD"), projectRoot);
+  if (lsRemote.exitCode === 0) {
+    const match = lsRemote.stdout.match(/^ref:\s+refs\/heads\/([^\t\r\n]+)\s+HEAD/m);
+    if (match?.[1]) {
+      return match[1];
+    }
+  }
+  const gh = resolveGithubCliBinary(projectRoot);
+  if (gh && repoNameWithOwner) {
+    const api = runCapture2(withGhRepo([gh, "repo", "view", "--json", "defaultBranchRef", "--jq", ".defaultBranchRef.name"], repoNameWithOwner), repoRoot);
+    const branch = api.exitCode === 0 ? api.stdout.trim() : "";
+    if (branch) {
+      return branch;
+    }
+  }
+  return fallback;
+}
 function inferProjectBase(projectRoot, fallback) {
   const containing = runCapture2(gitCmd(projectRoot, projectRoot, "branch", "-r", "--contains", "HEAD"), projectRoot);
   if (containing.exitCode !== 0) {
@@ -7040,6 +7078,10 @@ function runtimeGitEnv(projectRoot) {
     }
     env[key] = value;
   }
+  const rigGithubToken = process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  if (rigGithubToken && !env.GITHUB_TOKEN && !env.GH_TOKEN) {
+    env.GITHUB_TOKEN = rigGithubToken;
+  }
   if (!env.GITHUB_TOKEN && env.GH_TOKEN) {
     env.GITHUB_TOKEN = env.GH_TOKEN;
   }
@@ -7063,6 +7105,13 @@ function runtimeGitEnv(projectRoot) {
   if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
     env.GH_TOKEN = env.GITHUB_TOKEN;
   }
+  const gitHubToken = env.GITHUB_TOKEN || env.GH_TOKEN || env.RIG_GITHUB_TOKEN || rigGithubToken;
+  if (gitHubToken) {
+    env.RIG_GITHUB_TOKEN = gitHubToken;
+    env.GITHUB_TOKEN = env.GITHUB_TOKEN || gitHubToken;
+    env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
+    applyGitHubCredentialHelperEnv(env);
+  }
   if (runtimeKnownHosts && existsSync21(runtimeKnownHosts)) {
     const sshParts = [
       "ssh",
@@ -7079,6 +7128,14 @@ function runtimeGitEnv(projectRoot) {
   }
   return Object.keys(env).length > 0 ? env : undefined;
 }
+function applyGitHubCredentialHelperEnv(env) {
+  env.GIT_TERMINAL_PROMPT = "0";
+  env.GIT_CONFIG_COUNT = "2";
+  env.GIT_CONFIG_KEY_0 = "credential.helper";
+  env.GIT_CONFIG_VALUE_0 = "";
+  env.GIT_CONFIG_KEY_1 = "credential.helper";
+  env.GIT_CONFIG_VALUE_1 = '!f() { test "$1" = get || exit 0; token="${GITHUB_TOKEN:-${GH_TOKEN:-${RIG_GITHUB_TOKEN:-}}}"; test -n "$token" || exit 0; echo username=x-access-token; echo password="$token"; }; f';
+}
 function loadPersistedRuntimeSecrets(runtimeRoot) {
   if (!runtimeRoot) {
     return {};