npm - @haystackeditor/cli - Versions diffs - 0.13.0 → 0.13.2 - Mend

@haystackeditor/cli 0.13.0 → 0.13.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (18) hide show

package/dist/commands/config.js +7 -5
package/dist/commands/dismiss.js +16 -10
package/dist/commands/login.d.ts +4 -5
package/dist/commands/login.js +95 -71
package/dist/commands/pr-status.js +8 -4
package/dist/commands/request-review.js +10 -8
package/dist/commands/setup.js +8 -4
package/dist/commands/submit.d.ts +1 -0
package/dist/commands/submit.js +123 -19
package/dist/commands/triage.js +12 -3
package/dist/index.js +22 -5
package/dist/utils/auth.d.ts +50 -0
package/dist/utils/auth.js +386 -0
package/dist/utils/git.d.ts +15 -2
package/dist/utils/git.js +72 -11
package/dist/utils/github-api.d.ts +36 -15
package/dist/utils/github-api.js +52 -44
package/package.json +1 -1

package/dist/commands/triage.js CHANGED Viewed

@@ -22,7 +22,7 @@
 import chalk from 'chalk';
 import { checkAnalysisReady, fetchRatingSynthesis, fetchAutoFixManifest } from '../utils/analysis-api.js';
 import { parseRemoteUrl } from '../utils/git.js';
-import { loadToken } from './login.js';
+import { loadToken } from '../utils/auth.js';
 import { loadPendingSubmit, updatePendingSubmit, clearPendingSubmit } from '../utils/pending-state.js';
 // ============================================================================
 // PR identifier parsing
@@ -248,9 +248,18 @@ export async function triageCommand(identifier, options) {
     const pr = resolvePR(identifier, options);
     if (!pr)
         return;
-    // Load GitHub token for private repo auth
-    const token = await loadToken() || undefined;
     const isQuiet = options.hook || options.json;
+    // Load GitHub token for private repo auth
+    let token;
+    try {
+        token = await loadToken({ owner: pr.owner, repo: pr.repo }) || undefined;
+    }
+    catch (err) {
+        if (!isQuiet) {
+            console.log(chalk.yellow(`\n⚠ Could not load Haystack credentials: ${err.message}`));
+            console.log(chalk.dim('  Continuing without GitHub auth. Private repos may require `haystack login`.\n'));
+        }
+    }
     if (!isQuiet) {
         console.log(chalk.dim(`\nFetching analysis for ${pr.owner}/${pr.repo}#${pr.prNumber}...`));
     }

package/dist/index.js CHANGED Viewed

@@ -22,7 +22,7 @@
 import { Command } from 'commander';
 import { statusCommand } from './commands/status.js';
 import { initCommand } from './commands/init.js';
-import { loginCommand, logoutCommand } from './commands/login.js';
+import { authListCommand, authUseCommand, loginCommand, logoutCommand, whoamiCommand, } from './commands/login.js';
 import { handleAgenticTool, handleAutoMerge, handleWaitForReviewers, isAutoMergeEnabled } from './commands/config.js';
 import { installSkills, listSkills } from './commands/skills.js';
 import { hooksInstall, hooksStatus, hooksUpdate } from './commands/hooks.js';
@@ -38,7 +38,7 @@ const program = new Command();
 program
     .name('haystack')
     .description('Haystack CLI — automated PR review, triage, and merge queue')
-    .version('0.13.0');
+    .version('0.13.2');
 program
     .command('init')
     .description('Create .haystack.json configuration')
@@ -78,15 +78,31 @@ program
     .action(statusCommand);
 program
     .command('login')
-    .description('Authenticate with GitHub')
+    .description('Add or refresh a saved GitHub account')
     .action(loginCommand);
 program
-    .command('logout')
-    .description('Remove stored credentials')
+    .command('logout [login]')
+    .description('Remove a saved GitHub account (defaults to the active account)')
     .action(logoutCommand);
+program
+    .command('whoami')
+    .description('Show the active Haystack GitHub account')
+    .action(whoamiCommand);
+const authProgram = program
+    .command('auth')
+    .description('Manage saved Haystack GitHub accounts');
+authProgram
+    .command('list')
+    .description('List saved Haystack GitHub accounts')
+    .action(authListCommand);
+authProgram
+    .command('use <login>')
+    .description('Set the active Haystack GitHub account')
+    .action(authUseCommand);
 program
     .command('submit')
     .description('Create a PR from current changes')
+    .option('--account <login>', 'Saved Haystack account login to use for GitHub API calls')
     .option('--title <title>', 'PR title (default: last commit message)')
     .option('--body <body>', 'PR body (default: commit messages since base)')
     .option('--body-file <path>', 'Read PR body from file (use "-" for stdin)')
@@ -164,6 +180,7 @@ Examples:
   haystack submit --draft              # Create as draft PR
   haystack submit --review             # ⚠ Blocks auto-merge, needs human approval
   haystack submit --review octocat     # ⚠ Blocks auto-merge, requests review from octocat
+  haystack submit --account octocat    # Use a specific saved Haystack account for this submit
   haystack submit --max-turns 12       # Raise triage turn cap to 12 per checker
   haystack submit --triage-timeout 300 # Raise triage wall-clock to 5 minutes
 `)

package/dist/utils/auth.d.ts ADDED Viewed

@@ -0,0 +1,50 @@
+export interface StoredAccount {
+    github_token: string;
+    created_at: string;
+}
+export interface CredentialsStore {
+    version: 2;
+    activeLogin: string | null;
+    accounts: Record<string, StoredAccount>;
+    repoDefaults: Record<string, string>;
+}
+export interface GitHubUser {
+    login: string;
+    id: number;
+}
+export type VerifyGitHubTokenResult = {
+    status: 'ok';
+    user: GitHubUser;
+} | {
+    status: 'invalid';
+} | {
+    status: 'error';
+    message: string;
+};
+export interface ResolveAuthOptions {
+    preferredLogin?: string;
+    owner?: string;
+    repo?: string;
+}
+export interface ResolvedAuthContext {
+    login: string;
+    token: string;
+    source: 'preferred' | 'repo-default' | 'active';
+}
+export interface AccountSummary {
+    login: string;
+    createdAt: string;
+    isActive: boolean;
+    repoDefaultCount: number;
+}
+export declare function verifyGitHubToken(token: string): Promise<VerifyGitHubTokenResult>;
+export declare function loadCredentialsStore(): Promise<CredentialsStore>;
+export declare function saveAuthenticatedToken(token: string): Promise<GitHubUser>;
+export declare function listStoredAccounts(): Promise<AccountSummary[]>;
+export declare function setActiveAccount(login: string): Promise<void>;
+export declare function removeAccount(login?: string): Promise<string | null>;
+export declare function getActiveLogin(): Promise<string | null>;
+export declare function getRepoDefaultAccount(owner: string, repo: string): Promise<string | null>;
+export declare function setRepoDefaultAccount(owner: string, repo: string, login: string): Promise<void>;
+export declare function resolveAuthContext(options?: ResolveAuthOptions): Promise<ResolvedAuthContext>;
+export declare function loadToken(options?: ResolveAuthOptions): Promise<string | null>;

package/dist/utils/auth.js ADDED Viewed

@@ -0,0 +1,386 @@
+import * as fs from 'fs/promises';
+import * as os from 'os';
+import * as path from 'path';
+const CONFIG_DIR = path.join(os.homedir(), '.haystack');
+const TOKEN_FILE = path.join(CONFIG_DIR, 'credentials.json');
+const TOKEN_FILE_DISPLAY = '~/.haystack/credentials.json';
+const GITHUB_LOGIN_PATTERN = /^[A-Za-z\d](?:[A-Za-z\d]|-(?=[A-Za-z\d])){0,38}$/;
+function emptyStore() {
+    return {
+        version: 2,
+        activeLogin: null,
+        accounts: {},
+        repoDefaults: {},
+    };
+}
+function isLegacyCredentials(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    const keys = Object.keys(candidate);
+    return keys.length === 2
+        && keys.includes('github_token')
+        && keys.includes('created_at')
+        && typeof candidate.github_token === 'string'
+        && typeof candidate.created_at === 'string';
+}
+function hasAmbiguousLegacyCredentialsShape(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    const hasLegacyFields = 'github_token' in candidate || 'created_at' in candidate;
+    const hasV2Fields = 'version' in candidate
+        || 'accounts' in candidate
+        || 'activeLogin' in candidate
+        || 'repoDefaults' in candidate;
+    return hasLegacyFields && hasV2Fields;
+}
+function isStoredCredentialsShape(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    return 'version' in candidate
+        || 'accounts' in candidate
+        || 'activeLogin' in candidate
+        || 'repoDefaults' in candidate;
+}
+function normalizeGitHubLogin(value) {
+    if (typeof value !== 'string')
+        return null;
+    const normalized = value.trim();
+    if (!normalized || !GITHUB_LOGIN_PATTERN.test(normalized)) {
+        return null;
+    }
+    return normalized;
+}
+function findStoredLogin(accounts, login) {
+    const normalized = normalizeGitHubLogin(login);
+    if (!normalized)
+        return null;
+    const lookupKey = normalized.toLowerCase();
+    for (const storedLogin of Object.keys(accounts)) {
+        if (storedLogin.toLowerCase() === lookupKey) {
+            return storedLogin;
+        }
+    }
+    return null;
+}
+async function readGitHubErrorMessage(response) {
+    const body = await response.text().catch(() => '');
+    if (!body)
+        return '';
+    try {
+        const parsed = JSON.parse(body);
+        return typeof parsed.message === 'string' ? parsed.message : body;
+    }
+    catch {
+        return body;
+    }
+}
+function isInvalidTokenForbidden(response, message) {
+    const ssoHeader = response.headers.get('x-github-sso');
+    if (ssoHeader && !ssoHeader.startsWith('partial-results')) {
+        return true;
+    }
+    const normalizedMessage = message.toLowerCase();
+    return normalizedMessage.includes('resource protected by organization saml enforcement')
+        || normalizedMessage.includes('single sign-on')
+        || normalizedMessage.includes('must grant your oauth token access')
+        || normalizedMessage.includes('resource not accessible by personal access token');
+}
+function normalizeStore(value) {
+    if (!value || typeof value !== 'object') {
+        return emptyStore();
+    }
+    const raw = value;
+    const accounts = {};
+    if (raw.accounts && typeof raw.accounts === 'object') {
+        for (const [login, account] of Object.entries(raw.accounts)) {
+            const normalizedLogin = normalizeGitHubLogin(login);
+            if (normalizedLogin &&
+                !findStoredLogin(accounts, normalizedLogin) &&
+                account &&
+                typeof account === 'object' &&
+                typeof account.github_token === 'string' &&
+                typeof account.created_at === 'string') {
+                accounts[normalizedLogin] = {
+                    github_token: account.github_token,
+                    created_at: account.created_at,
+                };
+            }
+        }
+    }
+    const accountLogins = Object.keys(accounts);
+    const activeLogin = findStoredLogin(accounts, raw.activeLogin) ?? accountLogins[0] ?? null;
+    const repoDefaults = {};
+    if (raw.repoDefaults && typeof raw.repoDefaults === 'object') {
+        for (const [repoFullName, login] of Object.entries(raw.repoDefaults)) {
+            const storedLogin = findStoredLogin(accounts, login);
+            if (storedLogin) {
+                repoDefaults[repoFullName] = storedLogin;
+            }
+        }
+    }
+    return {
+        version: 2,
+        activeLogin,
+        accounts,
+        repoDefaults,
+    };
+}
+async function ensureConfigDir() {
+    await fs.mkdir(CONFIG_DIR, { recursive: true });
+}
+async function saveStore(store) {
+    const normalized = normalizeStore(store);
+    if (Object.keys(normalized.accounts).length === 0) {
+        await fs.rm(TOKEN_FILE, { force: true });
+        return;
+    }
+    await ensureConfigDir();
+    await fs.writeFile(TOKEN_FILE, JSON.stringify(normalized, null, 2), {
+        mode: 0o600,
+    });
+    await fs.chmod(TOKEN_FILE, 0o600);
+}
+export async function verifyGitHubToken(token) {
+    try {
+        const response = await fetch('https://api.github.com/user', {
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'User-Agent': 'Haystack-CLI',
+            },
+        });
+        if (response.status === 401) {
+            return { status: 'invalid' };
+        }
+        if (!response.ok) {
+            const rateLimitRemaining = response.headers.get('x-ratelimit-remaining');
+            if (response.status === 403 && rateLimitRemaining === '0') {
+                return {
+                    status: 'error',
+                    message: 'GitHub API rate limit exceeded while verifying credentials.',
+                };
+            }
+            const message = await readGitHubErrorMessage(response);
+            if (response.status === 403 && isInvalidTokenForbidden(response, message)) {
+                return { status: 'invalid' };
+            }
+            return {
+                status: 'error',
+                message: message
+                    ? `GitHub API returned ${response.status} while verifying credentials: ${message}`
+                    : `GitHub API returned ${response.status} while verifying credentials.`,
+            };
+        }
+        return {
+            status: 'ok',
+            user: await response.json(),
+        };
+    }
+    catch (error) {
+        return {
+            status: 'error',
+            message: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+async function migrateLegacyCredentials(legacy) {
+    const verification = await verifyGitHubToken(legacy.github_token);
+    if (verification.status === 'invalid') {
+        const store = emptyStore();
+        await saveStore(store);
+        return store;
+    }
+    if (verification.status === 'error') {
+        throw new Error(`Could not migrate legacy credentials from ${TOKEN_FILE_DISPLAY}: ${verification.message}`);
+    }
+    const user = verification.user;
+    const store = {
+        version: 2,
+        activeLogin: user.login,
+        accounts: {
+            [user.login]: {
+                github_token: legacy.github_token,
+                created_at: legacy.created_at,
+            },
+        },
+        repoDefaults: {},
+    };
+    await saveStore(store);
+    return store;
+}
+export async function loadCredentialsStore() {
+    let content;
+    try {
+        content = await fs.readFile(TOKEN_FILE, 'utf-8');
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT') {
+            return emptyStore();
+        }
+        throw new Error(`Failed to read ${TOKEN_FILE_DISPLAY}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch (error) {
+        throw new Error(`Failed to parse ${TOKEN_FILE_DISPLAY}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (isLegacyCredentials(parsed)) {
+        return migrateLegacyCredentials(parsed);
+    }
+    if (hasAmbiguousLegacyCredentialsShape(parsed)) {
+        throw new Error(`Failed to parse ${TOKEN_FILE_DISPLAY}: unsupported mixed legacy/v2 credentials format.`);
+    }
+    if (!isStoredCredentialsShape(parsed)) {
+        throw new Error(`Failed to parse ${TOKEN_FILE_DISPLAY}: unsupported credentials format.`);
+    }
+    if (parsed.version !== undefined && parsed.version !== 2) {
+        throw new Error(`Failed to parse ${TOKEN_FILE_DISPLAY}: unsupported credentials version ${String(parsed.version)}.`);
+    }
+    return normalizeStore(parsed);
+}
+function repoKey(owner, repo) {
+    if (!owner || !repo)
+        return null;
+    return `${owner}/${repo}`;
+}
+export async function saveAuthenticatedToken(token) {
+    const verification = await verifyGitHubToken(token);
+    if (verification.status === 'invalid') {
+        throw new Error('GitHub token expired or invalid. Run `haystack login` again.');
+    }
+    if (verification.status === 'error') {
+        throw new Error(`Failed to verify token: ${verification.message}`);
+    }
+    const user = verification.user;
+    const store = await loadCredentialsStore();
+    store.accounts[user.login] = {
+        github_token: token,
+        created_at: new Date().toISOString(),
+    };
+    store.activeLogin = user.login;
+    await saveStore(store);
+    return user;
+}
+export async function listStoredAccounts() {
+    const store = await loadCredentialsStore();
+    const repoDefaultCounts = new Map();
+    for (const login of Object.values(store.repoDefaults)) {
+        repoDefaultCounts.set(login, (repoDefaultCounts.get(login) ?? 0) + 1);
+    }
+    return Object.entries(store.accounts)
+        .map(([login, account]) => ({
+        login,
+        createdAt: account.created_at,
+        isActive: store.activeLogin === login,
+        repoDefaultCount: repoDefaultCounts.get(login) ?? 0,
+    }))
+        .sort((a, b) => {
+        if (a.isActive !== b.isActive)
+            return a.isActive ? -1 : 1;
+        return a.login.localeCompare(b.login);
+    });
+}
+export async function setActiveAccount(login) {
+    const store = await loadCredentialsStore();
+    const storedLogin = findStoredLogin(store.accounts, login);
+    if (!storedLogin) {
+        throw new Error(`No saved Haystack account for ${login}.`);
+    }
+    store.activeLogin = storedLogin;
+    await saveStore(store);
+}
+export async function removeAccount(login) {
+    const store = await loadCredentialsStore();
+    const targetLogin = login ? findStoredLogin(store.accounts, login) : store.activeLogin;
+    if (login && !targetLogin) {
+        throw new Error(`No saved Haystack account for ${login}.`);
+    }
+    if (!targetLogin || !store.accounts[targetLogin]) {
+        return null;
+    }
+    delete store.accounts[targetLogin];
+    for (const [repoFullName, mappedLogin] of Object.entries(store.repoDefaults)) {
+        if (mappedLogin === targetLogin) {
+            delete store.repoDefaults[repoFullName];
+        }
+    }
+    if (store.activeLogin === targetLogin) {
+        store.activeLogin = Object.keys(store.accounts)[0] ?? null;
+    }
+    await saveStore(store);
+    return targetLogin;
+}
+export async function getActiveLogin() {
+    const store = await loadCredentialsStore();
+    return store.activeLogin;
+}
+export async function getRepoDefaultAccount(owner, repo) {
+    const store = await loadCredentialsStore();
+    const key = repoKey(owner, repo);
+    if (!key)
+        return null;
+    return store.repoDefaults[key] ?? null;
+}
+export async function setRepoDefaultAccount(owner, repo, login) {
+    const store = await loadCredentialsStore();
+    const storedLogin = findStoredLogin(store.accounts, login);
+    if (!storedLogin) {
+        throw new Error(`No saved Haystack account for ${login}.`);
+    }
+    const key = repoKey(owner, repo);
+    if (!key)
+        return;
+    store.repoDefaults[key] = storedLogin;
+    await saveStore(store);
+}
+export async function resolveAuthContext(options = {}) {
+    const store = await loadCredentialsStore();
+    const { preferredLogin, owner, repo } = options;
+    if (preferredLogin) {
+        const storedLogin = findStoredLogin(store.accounts, preferredLogin);
+        if (!storedLogin) {
+            throw new Error(`No saved Haystack account for ${preferredLogin}. Run \`haystack login\` to add it or \`haystack auth list\` to inspect saved accounts.`);
+        }
+        const account = store.accounts[storedLogin];
+        return {
+            login: storedLogin,
+            token: account.github_token,
+            source: 'preferred',
+        };
+    }
+    const repoFullName = repoKey(owner, repo);
+    if (repoFullName) {
+        const repoLogin = store.repoDefaults[repoFullName];
+        if (repoLogin && store.accounts[repoLogin]) {
+            return {
+                login: repoLogin,
+                token: store.accounts[repoLogin].github_token,
+                source: 'repo-default',
+            };
+        }
+    }
+    if (store.activeLogin && store.accounts[store.activeLogin]) {
+        return {
+            login: store.activeLogin,
+            token: store.accounts[store.activeLogin].github_token,
+            source: 'active',
+        };
+    }
+    throw new Error('Not logged in. Run `haystack login` first.');
+}
+export async function loadToken(options = {}) {
+    try {
+        const context = await resolveAuthContext(options);
+        return context.token;
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith('Not logged in.')) {
+            return null;
+        }
+        throw error;
+    }
+}

package/dist/utils/git.d.ts CHANGED Viewed

@@ -52,10 +52,23 @@ export declare function remoteBranchExists(remoteName: string, branchName: strin
  * Checkout an existing branch
  */
 export declare function checkoutBranch(branchName: string): void;
+export interface PushAuth {
+    token: string;
+    owner: string;
+    repo: string;
+}
 /**
- * Push current branch to remote with upstream tracking
+ * Push current branch to remote with upstream tracking.
+ *
+ * When `auth` is provided, the push is authenticated with the given GitHub
+ * token via GIT_ASKPASS against `https://github.com/{owner}/{repo}.git` —
+ * independent of the user's ambient git credential helper. Upstream tracking
+ * is then set against the original `remoteName` so the token URL never lands
+ * in `.git/config`.
+ *
+ * Without `auth`, falls back to `git push -u <remote>` using ambient creds.
  */
-export declare function pushBranch(remoteName: string, branchName: string): void;
+export declare function pushBranch(remoteName: string, branchName: string, auth?: PushAuth): void;
 /**
  * Parse remote URL to extract owner and repo
  * Supports both SSH and HTTPS URLs

package/dist/utils/git.js CHANGED Viewed

@@ -4,6 +4,9 @@
  * Provides functions for git operations: branch management, push, remote parsing.
  */
 import { execSync } from 'child_process';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
 // Re-export findGitRoot from hooks for consistency
 export { findGitRoot } from './hooks.js';
 // ============================================================================
@@ -159,13 +162,22 @@ export function checkoutBranch(branchName) {
         throw new Error(`Failed to checkout branch: ${message}`);
     }
 }
-// ============================================================================
-// Push operations
-// ============================================================================
 /**
- * Push current branch to remote with upstream tracking
+ * Push current branch to remote with upstream tracking.
+ *
+ * When `auth` is provided, the push is authenticated with the given GitHub
+ * token via GIT_ASKPASS against `https://github.com/{owner}/{repo}.git` —
+ * independent of the user's ambient git credential helper. Upstream tracking
+ * is then set against the original `remoteName` so the token URL never lands
+ * in `.git/config`.
+ *
+ * Without `auth`, falls back to `git push -u <remote>` using ambient creds.
  */
-export function pushBranch(remoteName, branchName) {
+export function pushBranch(remoteName, branchName, auth) {
+    if (auth) {
+        pushBranchWithToken(remoteName, branchName, auth);
+        return;
+    }
     try {
         execSync(`git push -u ${remoteName} "${branchName}"`, {
             encoding: 'utf-8',
@@ -173,15 +185,64 @@ export function pushBranch(remoteName, branchName) {
         });
     }
     catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        if (message.includes('permission denied') || message.includes('403')) {
-            throw new Error('Permission denied. Check your GitHub credentials.');
+        throw translatePushError(err);
+    }
+}
+function pushBranchWithToken(remoteName, branchName, auth) {
+    const askpassPath = path.join(os.tmpdir(), `haystack-askpass-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.sh`);
+    // Script reads token from env at call time — keeps it out of the script contents and argv.
+    const script = `#!/bin/sh\ncase "$1" in\n  Username*) printf '%s' "x-access-token" ;;\n  *) printf '%s' "$HAYSTACK_GIT_TOKEN" ;;\nesac\n`;
+    fs.writeFileSync(askpassPath, script, { mode: 0o700 });
+    try {
+        const pushUrl = `https://github.com/${auth.owner}/${auth.repo}.git`;
+        execSync(`git push "${pushUrl}" "HEAD:refs/heads/${branchName}"`, {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+            env: {
+                ...process.env,
+                GIT_ASKPASS: askpassPath,
+                GIT_TERMINAL_PROMPT: '0',
+                HAYSTACK_GIT_TOKEN: auth.token,
+            },
+        });
+        try {
+            execSync(`git branch --set-upstream-to=${remoteName}/${branchName} "${branchName}"`, {
+                encoding: 'utf-8',
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+        }
+        catch (err) {
+            // Non-fatal: push succeeded; upstream tracking is a convenience.
+            const message = err instanceof Error ? err.message : String(err);
+            console.warn(`Warning: failed to set upstream tracking for ${branchName}: ${message}`);
+        }
+    }
+    catch (err) {
+        throw translatePushError(err, auth);
+    }
+    finally {
+        try {
+            fs.unlinkSync(askpassPath);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            // Best-effort cleanup; log so we can spot leaking askpass scripts in /tmp.
+            console.warn(`Warning: failed to remove temp askpass script ${askpassPath}: ${message}`);
         }
-        if (message.includes('remote rejected')) {
-            throw new Error('Remote rejected the push. The branch may be protected.');
+    }
+}
+function translatePushError(err, auth) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (message.includes('permission denied') || message.includes('403')) {
+        if (auth) {
+            return new Error(`Permission denied pushing to ${auth.owner}/${auth.repo}. The Haystack account token lacks write access to this repo — run \`haystack auth list\` and pick an account that's a collaborator.`);
         }
-        throw new Error(`Failed to push: ${message}`);
+        return new Error('Permission denied. Check your GitHub credentials.');
+    }
+    if (message.includes('remote rejected')) {
+        return new Error('Remote rejected the push. The branch may be protected.');
     }
+    return new Error(`Failed to push: ${message}`);
 }
 // ============================================================================
 // Remote operations