@haystackeditor/cli 0.12.3 → 0.13.1

package/dist/utils/auth.js

@@ -0,0 +1,386 @@
+import * as fs from 'fs/promises';
+import * as os from 'os';
+import * as path from 'path';
+const CONFIG_DIR = path.join(os.homedir(), '.haystack');
+const TOKEN_FILE = path.join(CONFIG_DIR, 'credentials.json');
+const TOKEN_FILE_DISPLAY = '~/.haystack/credentials.json';
+const GITHUB_LOGIN_PATTERN = /^[A-Za-z\d](?:[A-Za-z\d]|-(?=[A-Za-z\d])){0,38}$/;
+function emptyStore() {
+    return {
+        version: 2,
+        activeLogin: null,
+        accounts: {},
+        repoDefaults: {},
+    };
+}
+function isLegacyCredentials(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    const keys = Object.keys(candidate);
+    return keys.length === 2
+        && keys.includes('github_token')
+        && keys.includes('created_at')
+        && typeof candidate.github_token === 'string'
+        && typeof candidate.created_at === 'string';
+}
+function hasAmbiguousLegacyCredentialsShape(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    const hasLegacyFields = 'github_token' in candidate || 'created_at' in candidate;
+    const hasV2Fields = 'version' in candidate
+        || 'accounts' in candidate
+        || 'activeLogin' in candidate
+        || 'repoDefaults' in candidate;
+    return hasLegacyFields && hasV2Fields;
+}
+function isStoredCredentialsShape(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    return 'version' in candidate
+        || 'accounts' in candidate
+        || 'activeLogin' in candidate
+        || 'repoDefaults' in candidate;
+}
+function normalizeGitHubLogin(value) {
+    if (typeof value !== 'string')
+        return null;
+    const normalized = value.trim();
+    if (!normalized || !GITHUB_LOGIN_PATTERN.test(normalized)) {
+        return null;
+    }
+    return normalized;
+}
+function findStoredLogin(accounts, login) {
+    const normalized = normalizeGitHubLogin(login);
+    if (!normalized)
+        return null;
+    const lookupKey = normalized.toLowerCase();
+    for (const storedLogin of Object.keys(accounts)) {
+        if (storedLogin.toLowerCase() === lookupKey) {
+            return storedLogin;
+        }
+    }
+    return null;
+}
+async function readGitHubErrorMessage(response) {
+    const body = await response.text().catch(() => '');
+    if (!body)
+        return '';
+    try {
+        const parsed = JSON.parse(body);
+        return typeof parsed.message === 'string' ? parsed.message : body;
+    }
+    catch {
+        return body;
+    }
+}
+function isInvalidTokenForbidden(response, message) {
+    const ssoHeader = response.headers.get('x-github-sso');
+    if (ssoHeader && !ssoHeader.startsWith('partial-results')) {
+        return true;
+    }
+    const normalizedMessage = message.toLowerCase();
+    return normalizedMessage.includes('resource protected by organization saml enforcement')
+        || normalizedMessage.includes('single sign-on')
+        || normalizedMessage.includes('must grant your oauth token access')
+        || normalizedMessage.includes('resource not accessible by personal access token');
+}
+function normalizeStore(value) {
+    if (!value || typeof value !== 'object') {
+        return emptyStore();
+    }
+    const raw = value;
+    const accounts = {};
+    if (raw.accounts && typeof raw.accounts === 'object') {
+        for (const [login, account] of Object.entries(raw.accounts)) {
+            const normalizedLogin = normalizeGitHubLogin(login);
+            if (normalizedLogin &&
+                !findStoredLogin(accounts, normalizedLogin) &&
+                account &&
+                typeof account === 'object' &&
+                typeof account.github_token === 'string' &&
+                typeof account.created_at === 'string') {
+                accounts[normalizedLogin] = {
+                    github_token: account.github_token,
+                    created_at: account.created_at,
+                };
+            }
+        }
+    }
+    const accountLogins = Object.keys(accounts);
+    const activeLogin = findStoredLogin(accounts, raw.activeLogin) ?? accountLogins[0] ?? null;
+    const repoDefaults = {};
+    if (raw.repoDefaults && typeof raw.repoDefaults === 'object') {
+        for (const [repoFullName, login] of Object.entries(raw.repoDefaults)) {
+            const storedLogin = findStoredLogin(accounts, login);
+            if (storedLogin) {
+                repoDefaults[repoFullName] = storedLogin;
+            }
+        }
+    }
+    return {
+        version: 2,
+        activeLogin,
+        accounts,
+        repoDefaults,
+    };
+}
+async function ensureConfigDir() {
+    await fs.mkdir(CONFIG_DIR, { recursive: true });
+}
+async function saveStore(store) {
+    const normalized = normalizeStore(store);
+    if (Object.keys(normalized.accounts).length === 0) {
+        await fs.rm(TOKEN_FILE, { force: true });
+        return;
+    }
+    await ensureConfigDir();
+    await fs.writeFile(TOKEN_FILE, JSON.stringify(normalized, null, 2), {
+        mode: 0o600,
+    });
+    await fs.chmod(TOKEN_FILE, 0o600);
+}
+export async function verifyGitHubToken(token) {
+    try {
+        const response = await fetch('https://api.github.com/user', {
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'User-Agent': 'Haystack-CLI',
+            },
+        });
+        if (response.status === 401) {
+            return { status: 'invalid' };
+        }
+        if (!response.ok) {
+            const rateLimitRemaining = response.headers.get('x-ratelimit-remaining');
+            if (response.status === 403 && rateLimitRemaining === '0') {
+                return {
+                    status: 'error',
+                    message: 'GitHub API rate limit exceeded while verifying credentials.',
+                };
+            }
+            const message = await readGitHubErrorMessage(response);
+            if (response.status === 403 && isInvalidTokenForbidden(response, message)) {
+                return { status: 'invalid' };
+            }
+            return {
+                status: 'error',
+                message: message
+                    ? `GitHub API returned ${response.status} while verifying credentials: ${message}`
+                    : `GitHub API returned ${response.status} while verifying credentials.`,
+            };
+        }
+        return {
+            status: 'ok',
+            user: await response.json(),
+        };
+    }
+    catch (error) {
+        return {
+            status: 'error',
+            message: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+async function migrateLegacyCredentials(legacy) {
+    const verification = await verifyGitHubToken(legacy.github_token);
+    if (verification.status === 'invalid') {
+        const store = emptyStore();
+        await saveStore(store);
+        return store;
+    }
+    if (verification.status === 'error') {
+        throw new Error(`Could not migrate legacy credentials from ${TOKEN_FILE_DISPLAY}: ${verification.message}`);
+    }
+    const user = verification.user;
+    const store = {
+        version: 2,
+        activeLogin: user.login,
+        accounts: {
+            [user.login]: {
+                github_token: legacy.github_token,
+                created_at: legacy.created_at,
+            },
+        },
+        repoDefaults: {},
+    };
+    await saveStore(store);
+    return store;
+}
+export async function loadCredentialsStore() {
+    let content;
+    try {
+        content = await fs.readFile(TOKEN_FILE, 'utf-8');
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT') {
+            return emptyStore();
+        }
+        throw new Error(`Failed to read ${TOKEN_FILE_DISPLAY}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch (error) {
+        throw new Error(`Failed to parse ${TOKEN_FILE_DISPLAY}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (isLegacyCredentials(parsed)) {
+        return migrateLegacyCredentials(parsed);
+    }
+    if (hasAmbiguousLegacyCredentialsShape(parsed)) {
+        throw new Error(`Failed to parse ${TOKEN_FILE_DISPLAY}: unsupported mixed legacy/v2 credentials format.`);
+    }
+    if (!isStoredCredentialsShape(parsed)) {
+        throw new Error(`Failed to parse ${TOKEN_FILE_DISPLAY}: unsupported credentials format.`);
+    }
+    if (parsed.version !== undefined && parsed.version !== 2) {
+        throw new Error(`Failed to parse ${TOKEN_FILE_DISPLAY}: unsupported credentials version ${String(parsed.version)}.`);
+    }
+    return normalizeStore(parsed);
+}
+function repoKey(owner, repo) {
+    if (!owner || !repo)
+        return null;
+    return `${owner}/${repo}`;
+}
+export async function saveAuthenticatedToken(token) {
+    const verification = await verifyGitHubToken(token);
+    if (verification.status === 'invalid') {
+        throw new Error('GitHub token expired or invalid. Run `haystack login` again.');
+    }
+    if (verification.status === 'error') {
+        throw new Error(`Failed to verify token: ${verification.message}`);
+    }
+    const user = verification.user;
+    const store = await loadCredentialsStore();
+    store.accounts[user.login] = {
+        github_token: token,
+        created_at: new Date().toISOString(),
+    };
+    store.activeLogin = user.login;
+    await saveStore(store);
+    return user;
+}
+export async function listStoredAccounts() {
+    const store = await loadCredentialsStore();
+    const repoDefaultCounts = new Map();
+    for (const login of Object.values(store.repoDefaults)) {
+        repoDefaultCounts.set(login, (repoDefaultCounts.get(login) ?? 0) + 1);
+    }
+    return Object.entries(store.accounts)
+        .map(([login, account]) => ({
+        login,
+        createdAt: account.created_at,
+        isActive: store.activeLogin === login,
+        repoDefaultCount: repoDefaultCounts.get(login) ?? 0,
+    }))
+        .sort((a, b) => {
+        if (a.isActive !== b.isActive)
+            return a.isActive ? -1 : 1;
+        return a.login.localeCompare(b.login);
+    });
+}
+export async function setActiveAccount(login) {
+    const store = await loadCredentialsStore();
+    const storedLogin = findStoredLogin(store.accounts, login);
+    if (!storedLogin) {
+        throw new Error(`No saved Haystack account for ${login}.`);
+    }
+    store.activeLogin = storedLogin;
+    await saveStore(store);
+}
+export async function removeAccount(login) {
+    const store = await loadCredentialsStore();
+    const targetLogin = login ? findStoredLogin(store.accounts, login) : store.activeLogin;
+    if (login && !targetLogin) {
+        throw new Error(`No saved Haystack account for ${login}.`);
+    }
+    if (!targetLogin || !store.accounts[targetLogin]) {
+        return null;
+    }
+    delete store.accounts[targetLogin];
+    for (const [repoFullName, mappedLogin] of Object.entries(store.repoDefaults)) {
+        if (mappedLogin === targetLogin) {
+            delete store.repoDefaults[repoFullName];
+        }
+    }
+    if (store.activeLogin === targetLogin) {
+        store.activeLogin = Object.keys(store.accounts)[0] ?? null;
+    }
+    await saveStore(store);
+    return targetLogin;
+}
+export async function getActiveLogin() {
+    const store = await loadCredentialsStore();
+    return store.activeLogin;
+}
+export async function getRepoDefaultAccount(owner, repo) {
+    const store = await loadCredentialsStore();
+    const key = repoKey(owner, repo);
+    if (!key)
+        return null;
+    return store.repoDefaults[key] ?? null;
+}
+export async function setRepoDefaultAccount(owner, repo, login) {
+    const store = await loadCredentialsStore();
+    const storedLogin = findStoredLogin(store.accounts, login);
+    if (!storedLogin) {
+        throw new Error(`No saved Haystack account for ${login}.`);
+    }
+    const key = repoKey(owner, repo);
+    if (!key)
+        return;
+    store.repoDefaults[key] = storedLogin;
+    await saveStore(store);
+}
+export async function resolveAuthContext(options = {}) {
+    const store = await loadCredentialsStore();
+    const { preferredLogin, owner, repo } = options;
+    if (preferredLogin) {
+        const storedLogin = findStoredLogin(store.accounts, preferredLogin);
+        if (!storedLogin) {
+            throw new Error(`No saved Haystack account for ${preferredLogin}. Run \`haystack login\` to add it or \`haystack auth list\` to inspect saved accounts.`);
+        }
+        const account = store.accounts[storedLogin];
+        return {
+            login: storedLogin,
+            token: account.github_token,
+            source: 'preferred',
+        };
+    }
+    const repoFullName = repoKey(owner, repo);
+    if (repoFullName) {
+        const repoLogin = store.repoDefaults[repoFullName];
+        if (repoLogin && store.accounts[repoLogin]) {
+            return {
+                login: repoLogin,
+                token: store.accounts[repoLogin].github_token,
+                source: 'repo-default',
+            };
+        }
+    }
+    if (store.activeLogin && store.accounts[store.activeLogin]) {
+        return {
+            login: store.activeLogin,
+            token: store.accounts[store.activeLogin].github_token,
+            source: 'active',
+        };
+    }
+    throw new Error('Not logged in. Run `haystack login` first.');
+}
+export async function loadToken(options = {}) {
+    try {
+        const context = await resolveAuthContext(options);
+        return context.token;
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith('Not logged in.')) {
+            return null;
+        }
+        throw error;
+    }
+}

package/dist/utils/github-api.d.ts

@@ -11,6 +11,7 @@ export interface CreatePROptions {
     base: string;
     body?: string;
     draft?: boolean;
+    token?: string;
 }
 export interface PRResponse {
     number: number;
@@ -29,11 +30,33 @@ export interface LabelInfo {
     color: string;
     description?: string;
 }
+export interface GitHubUser {
+    login: string;
+    id: number;
+}
+export interface RepositoryPermissions {
+    admin?: boolean;
+    maintain?: boolean;
+    push?: boolean;
+    triage?: boolean;
+    pull?: boolean;
+}
+export interface RepositoryAccess {
+    full_name: string;
+    owner: {
+        login: string;
+    };
+    permissions?: RepositoryPermissions;
+}
 export declare const HAYSTACK_LABELS: Record<string, LabelInfo>;
 /**
- * Get stored GitHub token, throw if not authenticated
+ * Get a GitHub token, throw if not authenticated
  */
-export declare function requireGitHubAuth(): Promise<string>;
+export declare function requireGitHubAuth(options?: {
+    preferredLogin?: string;
+    owner?: string;
+    repo?: string;
+}): Promise<string>;
 /**
  * Create a pull request
  */
@@ -41,43 +64,41 @@ export declare function createPullRequest(options: CreatePROptions): Promise<PRR
 /**
  * Check if a PR already exists for a branch
  */
-export declare function findExistingPR(owner: string, repo: string, head: string): Promise<PRResponse | null>;
+export declare function findExistingPR(owner: string, repo: string, head: string, token?: string): Promise<PRResponse | null>;
 /**
  * Add labels to an issue/PR
  */
-export declare function addLabelsToIssue(owner: string, repo: string, issueNumber: number, labels: string[]): Promise<void>;
+export declare function addLabelsToIssue(owner: string, repo: string, issueNumber: number, labels: string[], token?: string): Promise<void>;
 /**
  * Get all labels from an issue/PR
  */
-export declare function getLabelsFromIssue(owner: string, repo: string, issueNumber: number): Promise<string[]>;
+export declare function getLabelsFromIssue(owner: string, repo: string, issueNumber: number, token?: string): Promise<string[]>;
 /**
  * Remove a label from an issue/PR
  */
-export declare function removeLabelFromIssue(owner: string, repo: string, issueNumber: number, labelName: string): Promise<void>;
+export declare function removeLabelFromIssue(owner: string, repo: string, issueNumber: number, labelName: string, token?: string): Promise<void>;
 /**
  * Check if a label exists in the repo
  */
-export declare function labelExists(owner: string, repo: string, labelName: string): Promise<boolean>;
+export declare function labelExists(owner: string, repo: string, labelName: string, token?: string): Promise<boolean>;
 /**
  * Create a label in the repo
  */
-export declare function createLabel(owner: string, repo: string, label: LabelInfo): Promise<void>;
+export declare function createLabel(owner: string, repo: string, label: LabelInfo, token?: string): Promise<void>;
 /**
  * Ensure all required Haystack labels exist in the repo
  */
-export declare function ensureHaystackLabels(owner: string, repo: string, labelNames: string[]): Promise<void>;
+export declare function ensureHaystackLabels(owner: string, repo: string, labelNames: string[], token?: string): Promise<void>;
 /**
  * Request reviewers on a pull request
  */
-export declare function requestReviewers(owner: string, repo: string, prNumber: number, reviewers: string[]): Promise<void>;
+export declare function requestReviewers(owner: string, repo: string, prNumber: number, reviewers: string[], token?: string): Promise<void>;
 /**
  * Get the authenticated user's info
  */
-export declare function getCurrentUser(): Promise<{
-    login: string;
-    id: number;
-}>;
+export declare function getCurrentUser(token?: string): Promise<GitHubUser>;
+export declare function getRepositoryAccess(owner: string, repo: string, token?: string): Promise<RepositoryAccess>;
 /**
  * Check if user has push access to a repo
  */
-export declare function hasPushAccess(owner: string, repo: string): Promise<boolean>;
+export declare function hasPushAccess(owner: string, repo: string, token?: string): Promise<boolean>;

package/dist/utils/github-api.js

@@ -3,7 +3,7 @@
  *
  * Provides functions for creating PRs, managing labels, etc.
  */
-import { loadToken } from '../commands/login.js';
+import { resolveAuthContext } from './auth.js';
 const GITHUB_API_BASE = 'https://api.github.com';
 // Label definitions for Haystack workflow
 export const HAYSTACK_LABELS = {
@@ -27,14 +27,14 @@ export const HAYSTACK_LABELS = {
 // Authentication
 // ============================================================================
 /**
- * Get stored GitHub token, throw if not authenticated
+ * Get a GitHub token, throw if not authenticated
  */
-export async function requireGitHubAuth() {
-    const token = await loadToken();
-    if (!token) {
-        throw new Error('Not logged in. Run `haystack login` first.');
-    }
-    return token;
+export async function requireGitHubAuth(options) {
+    const context = await resolveAuthContext(options);
+    return context.token;
+}
+async function resolveToken(token, options) {
+    return token ?? requireGitHubAuth(options);
 }
 // ============================================================================
 // API helpers
@@ -88,7 +88,10 @@ async function handleApiError(response, context) {
  * Create a pull request
  */
 export async function createPullRequest(options) {
-    const token = await requireGitHubAuth();
+    const token = await resolveToken(options.token, {
+        owner: options.owner,
+        repo: options.repo,
+    });
     const response = await githubApiRequest('POST', `/repos/${options.owner}/${options.repo}/pulls`, token, {
         title: options.title,
         head: options.head,
@@ -139,11 +142,11 @@ async function findMergedPRForBranch(owner, repo, head, token) {
 /**
  * Check if a PR already exists for a branch
  */
-export async function findExistingPR(owner, repo, head) {
-    const token = await requireGitHubAuth();
+export async function findExistingPR(owner, repo, head, token) {
+    const authToken = await resolveToken(token, { owner, repo });
     // head format should be "owner:branch" for cross-repo or just "branch" for same-repo
     const headParam = head.includes(':') ? head : `${owner}:${head}`;
-    const response = await githubApiRequest('GET', `/repos/${owner}/${repo}/pulls?head=${encodeURIComponent(headParam)}&state=open`, token);
+    const response = await githubApiRequest('GET', `/repos/${owner}/${repo}/pulls?head=${encodeURIComponent(headParam)}&state=open`, authToken);
     if (!response.ok) {
         if (response.status === 404)
             return null;
@@ -158,9 +161,9 @@ export async function findExistingPR(owner, repo, head) {
 /**
  * Add labels to an issue/PR
  */
-export async function addLabelsToIssue(owner, repo, issueNumber, labels) {
-    const token = await requireGitHubAuth();
-    const response = await githubApiRequest('POST', `/repos/${owner}/${repo}/issues/${issueNumber}/labels`, token, { labels });
+export async function addLabelsToIssue(owner, repo, issueNumber, labels, token) {
+    const authToken = await resolveToken(token, { owner, repo });
+    const response = await githubApiRequest('POST', `/repos/${owner}/${repo}/issues/${issueNumber}/labels`, authToken, { labels });
     if (!response.ok) {
         await handleApiError(response, `adding labels to PR #${issueNumber}`);
     }
@@ -168,9 +171,9 @@ export async function addLabelsToIssue(owner, repo, issueNumber, labels) {
 /**
  * Get all labels from an issue/PR
  */
-export async function getLabelsFromIssue(owner, repo, issueNumber) {
-    const token = await requireGitHubAuth();
-    const response = await githubApiRequest('GET', `/repos/${owner}/${repo}/issues/${issueNumber}/labels`, token);
+export async function getLabelsFromIssue(owner, repo, issueNumber, token) {
+    const authToken = await resolveToken(token, { owner, repo });
+    const response = await githubApiRequest('GET', `/repos/${owner}/${repo}/issues/${issueNumber}/labels`, authToken);
     if (!response.ok) {
         await handleApiError(response, `getting labels from PR #${issueNumber}`);
     }
@@ -180,9 +183,9 @@ export async function getLabelsFromIssue(owner, repo, issueNumber) {
 /**
  * Remove a label from an issue/PR
  */
-export async function removeLabelFromIssue(owner, repo, issueNumber, labelName) {
-    const token = await requireGitHubAuth();
-    const response = await githubApiRequest('DELETE', `/repos/${owner}/${repo}/issues/${issueNumber}/labels/${encodeURIComponent(labelName)}`, token);
+export async function removeLabelFromIssue(owner, repo, issueNumber, labelName, token) {
+    const authToken = await resolveToken(token, { owner, repo });
+    const response = await githubApiRequest('DELETE', `/repos/${owner}/${repo}/issues/${issueNumber}/labels/${encodeURIComponent(labelName)}`, authToken);
     // 404 is fine - label wasn't on the issue
     if (!response.ok && response.status !== 404) {
         await handleApiError(response, `removing label '${labelName}' from PR #${issueNumber}`);
@@ -191,17 +194,17 @@ export async function removeLabelFromIssue(owner, repo, issueNumber, labelName)
 /**
  * Check if a label exists in the repo
  */
-export async function labelExists(owner, repo, labelName) {
-    const token = await requireGitHubAuth();
-    const response = await githubApiRequest('GET', `/repos/${owner}/${repo}/labels/${encodeURIComponent(labelName)}`, token);
+export async function labelExists(owner, repo, labelName, token) {
+    const authToken = await resolveToken(token, { owner, repo });
+    const response = await githubApiRequest('GET', `/repos/${owner}/${repo}/labels/${encodeURIComponent(labelName)}`, authToken);
     return response.ok;
 }
 /**
  * Create a label in the repo
  */
-export async function createLabel(owner, repo, label) {
-    const token = await requireGitHubAuth();
-    const response = await githubApiRequest('POST', `/repos/${owner}/${repo}/labels`, token, {
+export async function createLabel(owner, repo, label, token) {
+    const authToken = await resolveToken(token, { owner, repo });
+    const response = await githubApiRequest('POST', `/repos/${owner}/${repo}/labels`, authToken, {
         name: label.name,
         color: label.color,
         description: label.description,
@@ -214,14 +217,14 @@ export async function createLabel(owner, repo, label) {
 /**
  * Ensure all required Haystack labels exist in the repo
  */
-export async function ensureHaystackLabels(owner, repo, labelNames) {
+export async function ensureHaystackLabels(owner, repo, labelNames, token) {
     for (const name of labelNames) {
         const labelInfo = HAYSTACK_LABELS[name];
         if (!labelInfo)
             continue;
-        const exists = await labelExists(owner, repo, name);
+        const exists = await labelExists(owner, repo, name, token);
         if (!exists) {
-            await createLabel(owner, repo, labelInfo);
+            await createLabel(owner, repo, labelInfo, token);
         }
     }
 }
@@ -231,9 +234,9 @@ export async function ensureHaystackLabels(owner, repo, labelNames) {
 /**
  * Request reviewers on a pull request
  */
-export async function requestReviewers(owner, repo, prNumber, reviewers) {
-    const token = await requireGitHubAuth();
-    const response = await githubApiRequest('POST', `/repos/${owner}/${repo}/pulls/${prNumber}/requested_reviewers`, token, { reviewers });
+export async function requestReviewers(owner, repo, prNumber, reviewers, token) {
+    const authToken = await resolveToken(token, { owner, repo });
+    const response = await githubApiRequest('POST', `/repos/${owner}/${repo}/pulls/${prNumber}/requested_reviewers`, authToken, { reviewers });
     if (!response.ok) {
         await handleApiError(response, `requesting reviewers on PR #${prNumber}`);
     }
@@ -244,23 +247,28 @@ export async function requestReviewers(owner, repo, prNumber, reviewers) {
 /**
  * Get the authenticated user's info
  */
-export async function getCurrentUser() {
-    const token = await requireGitHubAuth();
-    const response = await githubApiRequest('GET', '/user', token);
+export async function getCurrentUser(token) {
+    const authToken = await resolveToken(token);
+    const response = await githubApiRequest('GET', '/user', authToken);
     if (!response.ok) {
         await handleApiError(response, 'getting current user');
     }
     return response.json();
 }
+export async function getRepositoryAccess(owner, repo, token) {
+    const authToken = await resolveToken(token, { owner, repo });
+    const response = await githubApiRequest('GET', `/repos/${owner}/${repo}`, authToken);
+    if (!response.ok) {
+        await handleApiError(response, `getting repository access for ${owner}/${repo}`);
+    }
+    return response.json();
+}
 /**
  * Check if user has push access to a repo
  */
-export async function hasPushAccess(owner, repo) {
-    const token = await requireGitHubAuth();
-    const response = await githubApiRequest('GET', `/repos/${owner}/${repo}`, token);
-    if (!response.ok) {
-        return false;
-    }
-    const data = await response.json();
-    return data.permissions?.push === true;
+export async function hasPushAccess(owner, repo, token) {
+    const data = await getRepositoryAccess(owner, repo, token);
+    return data.permissions?.admin === true
+        || data.permissions?.maintain === true
+        || data.permissions?.push === true;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.12.3",
+  "version": "0.13.1",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {