@haystackeditor/cli 0.13.0 → 0.13.2

package/dist/commands/config.js

@@ -8,7 +8,7 @@ import chalk from 'chalk';
 import { readFileSync, writeFileSync } from 'fs';
 import { resolve } from 'path';
 import { execSync } from 'child_process';
-import { loadToken } from './login.js';
+import { resolveAuthContext } from '../utils/auth.js';
 import { AI_REVIEWER_SOURCES, AI_REVIEWER_DISPLAY_NAMES, AI_REVIEWER_BOT_USERNAMES } from '../types.js';
 const API_BASE = 'https://haystackeditor.com/api/preferences';
 const AGENTIC_TOOL_LABELS = {
@@ -64,12 +64,14 @@ function setPreference(key, value) {
 // API helpers (user-level preferences)
 // ============================================================================
 async function requireAuth() {
-    const token = await loadToken();
-    if (!token) {
-        console.error(chalk.red('\nNot logged in. Run `haystack login` first.\n'));
+    try {
+        const authContext = await resolveAuthContext();
+        return authContext.token;
+    }
+    catch (err) {
+        console.error(chalk.red(`\n${err.message}\n`));
         process.exit(1);
     }
-    return token;
 }
 async function apiRequest(method, token, body) {
     return fetch(API_BASE, {

package/dist/commands/dismiss.js

@@ -13,7 +13,7 @@
  *   https://github.com/owner/repo/pull/123 # GitHub URL
  */
 import chalk from 'chalk';
-import { loadToken } from './login.js';
+import { resolveAuthContext } from '../utils/auth.js';
 import { parseRemoteUrl } from '../utils/git.js';
 // ============================================================================
 // PR identifier parsing (shared with triage — duplicated to avoid circular deps)
@@ -125,9 +125,12 @@ async function runOverride(identifier, type, commandName) {
         process.exit(1);
     }
     // Require auth
-    const token = await loadToken();
-    if (!token) {
-        console.error(chalk.red('\nNot logged in. Run `haystack login` first.\n'));
+    let authContext;
+    try {
+        authContext = await resolveAuthContext({ owner: pr.owner, repo: pr.repo });
+    }
+    catch (err) {
+        console.error(chalk.red(`\n${err.message}\n`));
         process.exit(1);
     }
     const prLabel = `${pr.owner}/${pr.repo}#${pr.prNumber}`;
@@ -139,7 +142,7 @@ async function runOverride(identifier, type, commandName) {
     // Get PR HEAD SHA
     let headSha;
     try {
-        headSha = await getPRHeadSha(pr.owner, pr.repo, pr.prNumber, token);
+        headSha = await getPRHeadSha(pr.owner, pr.repo, pr.prNumber, authContext.token);
     }
     catch (err) {
         console.error(chalk.red(`\n${err.message}\n`));
@@ -147,7 +150,7 @@ async function runOverride(identifier, type, commandName) {
     }
     // Post the override
     try {
-        await postUserOverride(repoFullName, pr.prNumber, headSha, type, token);
+        await postUserOverride(repoFullName, pr.prNumber, headSha, type, authContext.token);
     }
     catch (err) {
         console.error(chalk.red(`\n${err.message}\n`));
@@ -182,16 +185,19 @@ export async function undismissCommand(identifier) {
         console.error(chalk.red(`\n${err.message}\n`));
         process.exit(1);
     }
-    const token = await loadToken();
-    if (!token) {
-        console.error(chalk.red('\nNot logged in. Run `haystack login` first.\n'));
+    let authContext;
+    try {
+        authContext = await resolveAuthContext({ owner: pr.owner, repo: pr.repo });
+    }
+    catch (err) {
+        console.error(chalk.red(`\n${err.message}\n`));
         process.exit(1);
     }
     const prLabel = `${pr.owner}/${pr.repo}#${pr.prNumber}`;
     const repoFullName = `${pr.owner}/${pr.repo}`;
     console.log(chalk.dim(`\nClearing overrides for ${prLabel}...`));
     try {
-        await deleteUserOverrides(repoFullName, pr.prNumber, token);
+        await deleteUserOverrides(repoFullName, pr.prNumber, authContext.token);
     }
     catch (err) {
         console.error(chalk.red(`\n${err.message}\n`));

package/dist/commands/login.d.ts

@@ -1,9 +1,8 @@
 /**
  * Login command - GitHub OAuth device flow
  */
-/**
- * Load token from disk
- */
-export declare function loadToken(): Promise<string | null>;
 export declare function loginCommand(): Promise<void>;
-export declare function logoutCommand(): Promise<void>;
+export declare function logoutCommand(login?: string): Promise<void>;
+export declare function whoamiCommand(): Promise<void>;
+export declare function authListCommand(): Promise<void>;
+export declare function authUseCommand(login: string): Promise<void>;

package/dist/commands/login.js

@@ -2,12 +2,12 @@
  * Login command - GitHub OAuth device flow
  */
 import chalk from 'chalk';
-import * as fs from 'fs/promises';
 import * as path from 'path';
 import * as os from 'os';
+import { getActiveLogin, getRepoDefaultAccount, listStoredAccounts, removeAccount, saveAuthenticatedToken, setActiveAccount, } from '../utils/auth.js';
+import { parseRemoteUrl } from '../utils/git.js';
 const GITHUB_CLIENT_ID = 'Ov23liW3JE38D3gZWa85'; // Haystack GitHub OAuth App
 const CONFIG_DIR = path.join(os.homedir(), '.haystack');
-const TOKEN_FILE = path.join(CONFIG_DIR, 'credentials.json');
 /**
  * Start device flow and get user code
  */
@@ -68,66 +68,15 @@ async function pollForToken(deviceCode, interval) {
         throw new Error(`OAuth error: ${data.error}`);
     }
 }
-/**
- * Save token to disk
- */
-async function saveToken(token) {
-    await fs.mkdir(CONFIG_DIR, { recursive: true });
-    const credentials = {
-        github_token: token,
-        created_at: new Date().toISOString(),
-    };
-    await fs.writeFile(TOKEN_FILE, JSON.stringify(credentials, null, 2), {
-        mode: 0o600, // Owner read/write only
-    });
-}
-/**
- * Load token from disk
- */
-export async function loadToken() {
-    try {
-        const content = await fs.readFile(TOKEN_FILE, 'utf-8');
-        const credentials = JSON.parse(content);
-        return credentials.github_token;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Verify token is valid by calling GitHub API
- */
-async function verifyToken(token) {
-    try {
-        const response = await fetch('https://api.github.com/user', {
-            headers: {
-                'Authorization': `Bearer ${token}`,
-                'User-Agent': 'Haystack-CLI',
-            },
-        });
-        if (!response.ok) {
-            return null;
-        }
-        return response.json();
-    }
-    catch {
-        return null;
-    }
-}
 export async function loginCommand() {
-    console.log(chalk.bold('\nHaystack Login\n'));
-    // Check if already logged in
-    const existingToken = await loadToken();
-    if (existingToken) {
-        const user = await verifyToken(existingToken);
-        if (user) {
-            console.log(chalk.green(`Already logged in as ${chalk.bold(user.login)}`));
-            console.log(chalk.dim('Run `haystack logout` to sign out.\n'));
-            return;
-        }
-    }
-    console.log('Authenticating with GitHub...\n');
     try {
+        console.log(chalk.bold('\nHaystack Login\n'));
+        const activeLogin = await getActiveLogin();
+        if (activeLogin) {
+            console.log(chalk.dim(`Current active account: ${chalk.bold(activeLogin)}`));
+            console.log(chalk.dim('This login will add or refresh a saved account and make it active.\n'));
+        }
+        console.log('Authenticating with GitHub...\n');
         // Start device flow
         const deviceFlow = await startDeviceFlow();
         console.log(chalk.yellow('Open this URL in your browser:\n'));
@@ -138,25 +87,100 @@ export async function loginCommand() {
         // Poll for token
         const token = await pollForToken(deviceFlow.device_code, deviceFlow.interval);
         // Verify and save
-        const user = await verifyToken(token);
-        if (!user) {
-            throw new Error('Failed to verify token');
-        }
-        await saveToken(token);
+        const user = await saveAuthenticatedToken(token);
         console.log(chalk.green(`\nLogged in as ${chalk.bold(user.login)}`));
-        console.log(chalk.dim('Credentials saved to ~/.haystack/credentials.json\n'));
+        console.log(chalk.dim(`Credentials saved to ${path.join(CONFIG_DIR, 'credentials.json')}\n`));
     }
     catch (error) {
         console.error(chalk.red(`\nLogin failed: ${error.message}\n`));
         process.exit(1);
     }
 }
-export async function logoutCommand() {
+export async function logoutCommand(login) {
     try {
-        await fs.unlink(TOKEN_FILE);
-        console.log(chalk.green('\nLogged out successfully.\n'));
+        const removedLogin = await removeAccount(login);
+        if (!removedLogin) {
+            console.log(chalk.yellow('\nNot logged in.\n'));
+            return;
+        }
+        console.log(chalk.green(`\nRemoved saved account ${chalk.bold(removedLogin)}.`));
+        const nextActive = await getActiveLogin();
+        if (nextActive) {
+            console.log(chalk.dim(`Active account is now ${chalk.bold(nextActive)}.\n`));
+        }
+        else {
+            console.log(chalk.dim('No saved Haystack accounts remain.\n'));
+        }
     }
-    catch {
-        console.log(chalk.yellow('\nNot logged in.\n'));
+    catch (error) {
+        console.error(chalk.red(`\n${error.message}\n`));
+        process.exit(1);
+    }
+}
+export async function whoamiCommand() {
+    try {
+        const accounts = await listStoredAccounts();
+        if (accounts.length === 0) {
+            console.log(chalk.yellow('\nNot logged in.\n'));
+            return;
+        }
+        const active = accounts.find((account) => account.isActive);
+        if (!active) {
+            console.log(chalk.yellow('\nNo active Haystack account is configured.\n'));
+            return;
+        }
+        console.log(chalk.bold('\nHaystack Account\n'));
+        console.log(`  ${chalk.dim('Active:')} ${chalk.bold(active.login)}`);
+        console.log(`  ${chalk.dim('Saved:')}  ${accounts.length} account(s)`);
+        let remote = null;
+        try {
+            remote = parseRemoteUrl('origin');
+        }
+        catch {
+            remote = null;
+        }
+        if (remote) {
+            const repoDefault = await getRepoDefaultAccount(remote.owner, remote.repo);
+            if (repoDefault) {
+                console.log(`  ${chalk.dim('Repo:')}   ${remote.owner}/${remote.repo} -> ${repoDefault}`);
+            }
+        }
+        console.log('');
+    }
+    catch (error) {
+        console.error(chalk.red(`\n${error.message}\n`));
+        process.exit(1);
+    }
+}
+export async function authListCommand() {
+    try {
+        const accounts = await listStoredAccounts();
+        if (accounts.length === 0) {
+            console.log(chalk.yellow('\nNo saved Haystack accounts.\n'));
+            return;
+        }
+        console.log(chalk.bold('\nSaved Haystack Accounts\n'));
+        for (const account of accounts) {
+            const marker = account.isActive ? chalk.green('✓') : ' ';
+            const repoDefaultNote = account.repoDefaultCount > 0
+                ? chalk.dim(` (${account.repoDefaultCount} repo default${account.repoDefaultCount === 1 ? '' : 's'})`)
+                : '';
+            console.log(`  ${marker} ${chalk.bold(account.login)}${repoDefaultNote}`);
+        }
+        console.log('');
+    }
+    catch (error) {
+        console.error(chalk.red(`\n${error.message}\n`));
+        process.exit(1);
+    }
+}
+export async function authUseCommand(login) {
+    try {
+        await setActiveAccount(login);
+        console.log(chalk.green(`\nActive Haystack account set to ${chalk.bold(login)}.\n`));
+    }
+    catch (error) {
+        console.error(chalk.red(`\n${error.message}\n`));
+        process.exit(1);
     }
 }

package/dist/commands/pr-status.js

@@ -11,7 +11,7 @@
  *   https://github.com/owner/repo/pull/123 # GitHub URL
  */
 import chalk from 'chalk';
-import { loadToken } from './login.js';
+import { resolveAuthContext } from '../utils/auth.js';
 import { parseRemoteUrl } from '../utils/git.js';
 // ============================================================================
 // PR identifier parsing
@@ -120,11 +120,15 @@ export async function prStatusCommand(identifier, options) {
         console.error(chalk.red(`\n${err.message}\n`));
         process.exit(1);
     }
-    const token = await loadToken();
-    if (!token) {
-        console.error(chalk.red('\nNot logged in. Run `haystack login` first.\n'));
+    let authContext;
+    try {
+        authContext = await resolveAuthContext({ owner: pr.owner, repo: pr.repo });
+    }
+    catch (err) {
+        console.error(chalk.red(`\n${err.message}\n`));
         process.exit(1);
     }
+    const token = authContext.token;
     const prLabel = `${pr.owner}/${pr.repo}#${pr.prNumber}`;
     if (!options.json) {
         console.log(chalk.dim(`\nFetching status for ${prLabel}...\n`));

package/dist/commands/request-review.js

@@ -13,7 +13,7 @@
  *   https://github.com/owner/repo/pull/123 # GitHub URL
  */
 import chalk from 'chalk';
-import { loadToken } from './login.js';
+import { resolveAuthContext } from '../utils/auth.js';
 import { parseRemoteUrl } from '../utils/git.js';
 import { ensureHaystackLabels, addLabelsToIssue, requestReviewers, } from '../utils/github-api.js';
 // ============================================================================
@@ -59,18 +59,20 @@ export async function requestReviewCommand(identifier, reviewer) {
         console.error(chalk.red(`\n${err.message}\n`));
         process.exit(1);
     }
-    // Require auth
-    const token = await loadToken();
-    if (!token) {
-        console.error(chalk.red('\nNot logged in. Run `haystack login` first.\n'));
+    let authContext;
+    try {
+        authContext = await resolveAuthContext({ owner: pr.owner, repo: pr.repo });
+    }
+    catch (err) {
+        console.error(chalk.red(`\n${err.message}\n`));
         process.exit(1);
     }
     const prLabel = `${pr.owner}/${pr.repo}#${pr.prNumber}`;
     console.log(chalk.dim(`\nRequesting review for ${prLabel}...`));
     // Ensure the label exists in the repo, then add it to the PR
     try {
-        await ensureHaystackLabels(pr.owner, pr.repo, ['haystack:needs-review']);
-        await addLabelsToIssue(pr.owner, pr.repo, pr.prNumber, ['haystack:needs-review']);
+        await ensureHaystackLabels(pr.owner, pr.repo, ['haystack:needs-review'], authContext.token);
+        await addLabelsToIssue(pr.owner, pr.repo, pr.prNumber, ['haystack:needs-review'], authContext.token);
     }
     catch (err) {
         console.error(chalk.red(`\nFailed to add label: ${err.message}\n`));
@@ -79,7 +81,7 @@ export async function requestReviewCommand(identifier, reviewer) {
     // Request specific reviewer if provided
     if (reviewer) {
         try {
-            await requestReviewers(pr.owner, pr.repo, pr.prNumber, [reviewer]);
+            await requestReviewers(pr.owner, pr.repo, pr.prNumber, [reviewer], authContext.token);
             console.log(chalk.green(`\n  Review requested from ${reviewer} on ${prLabel}`));
         }
         catch (err) {

package/dist/commands/setup.js

@@ -16,7 +16,7 @@ import inquirer from 'inquirer';
 import { execFileSync, execSync } from 'child_process';
 import { mkdirSync } from 'fs';
 import { basename, join } from 'path';
-import { loadToken } from './login.js';
+import { resolveAuthContext } from '../utils/auth.js';
 import { hooksInstall } from './hooks.js';
 import { findGitRoot } from '../utils/hooks.js';
 import { trackError, trackSetupEvent } from '../utils/telemetry.js';
@@ -473,11 +473,15 @@ async function stepConfirm(selectedRepos, rules, signals, policies, token) {
 export async function setupCommand() {
     console.log(chalk.cyan('\n  Haystack Setup Wizard\n'));
     // Step 0: Check login
-    const token = await loadToken();
-    if (!token) {
-        console.log(chalk.yellow('  Not logged in. Run `haystack login` first.\n'));
+    let authContext;
+    try {
+        authContext = await resolveAuthContext();
+    }
+    catch (err) {
+        console.log(chalk.yellow(`  ${err.message}\n`));
         process.exit(1);
     }
+    const token = authContext.token;
     // Verify token
     const userResponse = await fetch(`${GITHUB_API}/user`, {
         headers: {

package/dist/commands/submit.d.ts

@@ -10,6 +10,7 @@
  *   - --force: skip triage checks
  */
 export interface SubmitOptions {
+    account?: string;
     title?: string;
     body?: string;
     bodyFile?: string;

package/dist/commands/submit.js

@@ -12,12 +12,13 @@
 import chalk from 'chalk';
 import fs from 'fs';
 import { findGitRoot, getCurrentBranch, getDefaultBranch, hasUncommittedChanges, parseRemoteUrl, pushBranch, getLastCommitMessage, getCommitMessagesSinceBase, } from '../utils/git.js';
-import { createPullRequest, findExistingPR, requireGitHubAuth, requestReviewers, } from '../utils/github-api.js';
+import { createPullRequest, findExistingPR, getRepositoryAccess, requestReviewers, } from '../utils/github-api.js';
 import { runTriage } from '../triage/runner.js';
 import { loadConfig } from '../utils/config.js';
 import { checkAnalysisReady, fetchAnalysisResults } from '../utils/analysis-api.js';
 import { savePendingSubmit, updatePendingSubmit } from '../utils/pending-state.js';
 import { ensureHaystackLabels, addLabelsToIssue, } from '../utils/github-api.js';
+import { listStoredAccounts, resolveAuthContext, setRepoDefaultAccount, } from '../utils/auth.js';
 // ============================================================================
 // Helpers
 // ============================================================================
@@ -28,6 +29,87 @@ function buildPRBody(commitMessages) {
 ---
 *Created via [Haystack CLI](https://haystackeditor.com)*`;
 }
+function canCreateSameRepoPullRequest(permissions) {
+    return permissions?.admin === true
+        || permissions?.maintain === true
+        || permissions?.push === true;
+}
+function buildSubmitPermissionMessage(activeLogin, owner, repo, detail) {
+    const repoName = `${owner}/${repo}`;
+    const lines = [
+        `Haystack is authenticated as ${activeLogin}, but that account cannot create a same-repo pull request in ${repoName}.`,
+        'Use `haystack submit --account <login>` or `haystack auth use <login>` to select a different saved account.',
+    ];
+    if (detail) {
+        lines.push(detail);
+    }
+    lines.push(`If the correct account is not saved yet, run \`haystack login\` with a GitHub account that has collaborator access to ${repoName}, then retry \`haystack submit\`.`);
+    return lines.join('\n');
+}
+function formatSubmitPermissionError(error, activeLogin, owner, repo) {
+    const message = error instanceof Error ? error.message : String(error);
+    const lowerMessage = message.toLowerCase();
+    const shouldWrap = lowerMessage.includes('must be a collaborator')
+        || lowerMessage.includes('permission denied')
+        || message.startsWith('Not found: getting repository access');
+    if (!shouldWrap) {
+        return message;
+    }
+    return buildSubmitPermissionMessage(activeLogin, owner, repo, `GitHub said: ${message}`);
+}
+async function checkSubmitAccess(owner, repo, authContext) {
+    try {
+        const repoAccess = await getRepositoryAccess(owner, repo, authContext.token);
+        return { repoAccess };
+    }
+    catch (error) {
+        return { error };
+    }
+}
+function ambiguousAccountMessage(owner, repo, logins) {
+    return [
+        `Multiple saved Haystack accounts can create a same-repo pull request in ${owner}/${repo}: ${logins.join(', ')}.`,
+        'Re-run `haystack submit --account <login>` or `haystack auth use <login>` to choose one.',
+    ].join('\n');
+}
+async function resolveSubmitAuthContext(owner, repo, preferredLogin) {
+    const primaryContext = await resolveAuthContext({ preferredLogin, owner, repo });
+    const primaryResult = await checkSubmitAccess(owner, repo, primaryContext);
+    if (primaryResult.repoAccess && canCreateSameRepoPullRequest(primaryResult.repoAccess.permissions)) {
+        return {
+            authContext: primaryContext,
+            repoAccess: primaryResult.repoAccess,
+            autoSelected: false,
+        };
+    }
+    if (!preferredLogin) {
+        const alternatives = [];
+        const accounts = await listStoredAccounts();
+        for (const account of accounts) {
+            if (account.login === primaryContext.login)
+                continue;
+            const candidateContext = await resolveAuthContext({ preferredLogin: account.login });
+            const candidateResult = await checkSubmitAccess(owner, repo, candidateContext);
+            if (candidateResult.repoAccess && canCreateSameRepoPullRequest(candidateResult.repoAccess.permissions)) {
+                alternatives.push({
+                    authContext: candidateContext,
+                    repoAccess: candidateResult.repoAccess,
+                    autoSelected: true,
+                });
+            }
+        }
+        if (alternatives.length === 1) {
+            return alternatives[0];
+        }
+        if (alternatives.length > 1) {
+            throw new Error(ambiguousAccountMessage(owner, repo, alternatives.map((candidate) => candidate.authContext.login)));
+        }
+    }
+    if (primaryResult.error) {
+        throw new Error(formatSubmitPermissionError(primaryResult.error, primaryContext.login, owner, repo));
+    }
+    throw new Error(buildSubmitPermissionMessage(primaryContext.login, owner, repo, 'The selected Haystack account does not have the collaborator access required for same-repo PR creation.'));
+}
 // ============================================================================
 // Triage output
 // ============================================================================
@@ -182,21 +264,34 @@ export async function submitCommand(options) {
         console.error(chalk.red('\nNot a git repository.\n'));
         process.exit(1);
     }
-    // Check authentication
-    let githubToken;
+    // Get remote info
+    let remoteInfo;
     try {
-        githubToken = await requireGitHubAuth();
-        console.log(chalk.green('✓ Authenticated'));
+        remoteInfo = parseRemoteUrl('origin');
+        console.log(chalk.green(`✓ Repository: ${remoteInfo.owner}/${remoteInfo.repo}`));
     }
     catch (err) {
         console.error(chalk.red(`\n${err.message}\n`));
         process.exit(1);
     }
-    // Get remote info
-    let remoteInfo;
+    let githubToken;
+    let activeGitHubLogin;
+    let autoSelectedAccount = false;
     try {
-        remoteInfo = parseRemoteUrl('origin');
-        console.log(chalk.green(`✓ Repository: ${remoteInfo.owner}/${remoteInfo.repo}`));
+        const authResolution = await resolveSubmitAuthContext(remoteInfo.owner, remoteInfo.repo, options.account);
+        githubToken = authResolution.authContext.token;
+        activeGitHubLogin = authResolution.authContext.login;
+        autoSelectedAccount = authResolution.autoSelected;
+        try {
+            await setRepoDefaultAccount(remoteInfo.owner, remoteInfo.repo, activeGitHubLogin);
+        }
+        catch (err) {
+            console.log(chalk.yellow(`⚠ Could not save ${activeGitHubLogin} as the default Haystack account for ${remoteInfo.owner}/${remoteInfo.repo}: ${err.message}`));
+        }
+        console.log(chalk.green(`✓ Authenticated as ${activeGitHubLogin}`));
+        if (autoSelectedAccount) {
+            console.log(chalk.dim(`  Auto-selected saved account ${activeGitHubLogin} for ${remoteInfo.owner}/${remoteInfo.repo}`));
+        }
     }
     catch (err) {
         console.error(chalk.red(`\n${err.message}\n`));
@@ -267,8 +362,16 @@ export async function submitCommand(options) {
     // Step 4: Push to remote
     // -------------------------------------------------------------------------
     console.log(chalk.dim('\nPushing to origin...'));
+    if (!githubToken) {
+        console.error(chalk.red('\nInternal error: no Haystack account token resolved before push.\n'));
+        process.exit(1);
+    }
     try {
-        pushBranch('origin', currentBranch);
+        pushBranch('origin', currentBranch, {
+            token: githubToken,
+            owner: remoteInfo.owner,
+            repo: remoteInfo.repo,
+        });
         console.log(chalk.green('✓ Branch pushed'));
     }
     catch (err) {
@@ -280,7 +383,7 @@ export async function submitCommand(options) {
     // -------------------------------------------------------------------------
     console.log(chalk.dim('\nCreating pull request...'));
     // Check if PR already exists
-    const existingPR = await findExistingPR(remoteInfo.owner, remoteInfo.repo, currentBranch);
+    const existingPR = await findExistingPR(remoteInfo.owner, remoteInfo.repo, currentBranch, githubToken);
     let prNumber;
     let prUrl;
     if (existingPR) {
@@ -316,13 +419,14 @@ export async function submitCommand(options) {
                 base: baseBranch,
                 body: prBody,
                 draft: options.draft,
+                token: githubToken,
             });
             prNumber = pr.number;
             prUrl = pr.html_url;
             console.log(chalk.green(`✓ Pull request created: #${prNumber}`));
         }
         catch (err) {
-            console.error(chalk.red(`\n${err.message}\n`));
+            console.error(chalk.red(`\n${formatSubmitPermissionError(err, activeGitHubLogin, remoteInfo.owner, remoteInfo.repo)}\n`));
             process.exit(1);
         }
     }
@@ -331,8 +435,8 @@ export async function submitCommand(options) {
     // -------------------------------------------------------------------------
     if (options.autoMerge) {
         try {
-            await ensureHaystackLabels(remoteInfo.owner, remoteInfo.repo, ['haystack:auto-merge']);
-            await addLabelsToIssue(remoteInfo.owner, remoteInfo.repo, prNumber, ['haystack:auto-merge']);
+            await ensureHaystackLabels(remoteInfo.owner, remoteInfo.repo, ['haystack:auto-merge'], githubToken);
+            await addLabelsToIssue(remoteInfo.owner, remoteInfo.repo, prNumber, ['haystack:auto-merge'], githubToken);
             console.log(chalk.green('✓ Auto-merge enabled for this PR'));
         }
         catch (err) {
@@ -344,8 +448,8 @@ export async function submitCommand(options) {
     // -------------------------------------------------------------------------
     if (options.autoFix) {
         try {
-            await ensureHaystackLabels(remoteInfo.owner, remoteInfo.repo, ['haystack:auto-fix']);
-            await addLabelsToIssue(remoteInfo.owner, remoteInfo.repo, prNumber, ['haystack:auto-fix']);
+            await ensureHaystackLabels(remoteInfo.owner, remoteInfo.repo, ['haystack:auto-fix'], githubToken);
+            await addLabelsToIssue(remoteInfo.owner, remoteInfo.repo, prNumber, ['haystack:auto-fix'], githubToken);
             console.log(chalk.green('✓ Auto-fix (alpha) enabled for this PR'));
         }
         catch (err) {
@@ -357,11 +461,11 @@ export async function submitCommand(options) {
     // -------------------------------------------------------------------------
     if (options.review) {
         try {
-            await ensureHaystackLabels(remoteInfo.owner, remoteInfo.repo, ['haystack:needs-review']);
-            await addLabelsToIssue(remoteInfo.owner, remoteInfo.repo, prNumber, ['haystack:needs-review']);
+            await ensureHaystackLabels(remoteInfo.owner, remoteInfo.repo, ['haystack:needs-review'], githubToken);
+            await addLabelsToIssue(remoteInfo.owner, remoteInfo.repo, prNumber, ['haystack:needs-review'], githubToken);
             if (typeof options.review === 'string') {
                 // Specific reviewer requested
-                await requestReviewers(remoteInfo.owner, remoteInfo.repo, prNumber, [options.review]);
+                await requestReviewers(remoteInfo.owner, remoteInfo.repo, prNumber, [options.review], githubToken);
                 console.log(chalk.green(`✓ Review requested from ${options.review}`));
             }
             else {