@haystackeditor/cli 0.13.1 → 0.13.2

package/dist/commands/submit.js

@@ -362,8 +362,16 @@ export async function submitCommand(options) {
     // Step 4: Push to remote
     // -------------------------------------------------------------------------
     console.log(chalk.dim('\nPushing to origin...'));
+    if (!githubToken) {
+        console.error(chalk.red('\nInternal error: no Haystack account token resolved before push.\n'));
+        process.exit(1);
+    }
     try {
-        pushBranch('origin', currentBranch);
+        pushBranch('origin', currentBranch, {
+            token: githubToken,
+            owner: remoteInfo.owner,
+            repo: remoteInfo.repo,
+        });
         console.log(chalk.green('✓ Branch pushed'));
     }
     catch (err) {

package/dist/index.js

@@ -38,7 +38,7 @@ const program = new Command();
 program
     .name('haystack')
     .description('Haystack CLI — automated PR review, triage, and merge queue')
-    .version('0.13.1');
+    .version('0.13.2');
 program
     .command('init')
     .description('Create .haystack.json configuration')

package/dist/utils/git.d.ts

@@ -52,10 +52,23 @@ export declare function remoteBranchExists(remoteName: string, branchName: strin
  * Checkout an existing branch
  */
 export declare function checkoutBranch(branchName: string): void;
+export interface PushAuth {
+    token: string;
+    owner: string;
+    repo: string;
+}
 /**
- * Push current branch to remote with upstream tracking
+ * Push current branch to remote with upstream tracking.
+ *
+ * When `auth` is provided, the push is authenticated with the given GitHub
+ * token via GIT_ASKPASS against `https://github.com/{owner}/{repo}.git` —
+ * independent of the user's ambient git credential helper. Upstream tracking
+ * is then set against the original `remoteName` so the token URL never lands
+ * in `.git/config`.
+ *
+ * Without `auth`, falls back to `git push -u <remote>` using ambient creds.
  */
-export declare function pushBranch(remoteName: string, branchName: string): void;
+export declare function pushBranch(remoteName: string, branchName: string, auth?: PushAuth): void;
 /**
  * Parse remote URL to extract owner and repo
  * Supports both SSH and HTTPS URLs

package/dist/utils/git.js

@@ -4,6 +4,9 @@
  * Provides functions for git operations: branch management, push, remote parsing.
  */
 import { execSync } from 'child_process';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
 // Re-export findGitRoot from hooks for consistency
 export { findGitRoot } from './hooks.js';
 // ============================================================================
@@ -159,13 +162,22 @@ export function checkoutBranch(branchName) {
         throw new Error(`Failed to checkout branch: ${message}`);
     }
 }
-// ============================================================================
-// Push operations
-// ============================================================================
 /**
- * Push current branch to remote with upstream tracking
+ * Push current branch to remote with upstream tracking.
+ *
+ * When `auth` is provided, the push is authenticated with the given GitHub
+ * token via GIT_ASKPASS against `https://github.com/{owner}/{repo}.git` —
+ * independent of the user's ambient git credential helper. Upstream tracking
+ * is then set against the original `remoteName` so the token URL never lands
+ * in `.git/config`.
+ *
+ * Without `auth`, falls back to `git push -u <remote>` using ambient creds.
  */
-export function pushBranch(remoteName, branchName) {
+export function pushBranch(remoteName, branchName, auth) {
+    if (auth) {
+        pushBranchWithToken(remoteName, branchName, auth);
+        return;
+    }
     try {
         execSync(`git push -u ${remoteName} "${branchName}"`, {
             encoding: 'utf-8',
@@ -173,15 +185,64 @@ export function pushBranch(remoteName, branchName) {
         });
     }
     catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        if (message.includes('permission denied') || message.includes('403')) {
-            throw new Error('Permission denied. Check your GitHub credentials.');
+        throw translatePushError(err);
+    }
+}
+function pushBranchWithToken(remoteName, branchName, auth) {
+    const askpassPath = path.join(os.tmpdir(), `haystack-askpass-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.sh`);
+    // Script reads token from env at call time — keeps it out of the script contents and argv.
+    const script = `#!/bin/sh\ncase "$1" in\n  Username*) printf '%s' "x-access-token" ;;\n  *) printf '%s' "$HAYSTACK_GIT_TOKEN" ;;\nesac\n`;
+    fs.writeFileSync(askpassPath, script, { mode: 0o700 });
+    try {
+        const pushUrl = `https://github.com/${auth.owner}/${auth.repo}.git`;
+        execSync(`git push "${pushUrl}" "HEAD:refs/heads/${branchName}"`, {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+            env: {
+                ...process.env,
+                GIT_ASKPASS: askpassPath,
+                GIT_TERMINAL_PROMPT: '0',
+                HAYSTACK_GIT_TOKEN: auth.token,
+            },
+        });
+        try {
+            execSync(`git branch --set-upstream-to=${remoteName}/${branchName} "${branchName}"`, {
+                encoding: 'utf-8',
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+        }
+        catch (err) {
+            // Non-fatal: push succeeded; upstream tracking is a convenience.
+            const message = err instanceof Error ? err.message : String(err);
+            console.warn(`Warning: failed to set upstream tracking for ${branchName}: ${message}`);
+        }
+    }
+    catch (err) {
+        throw translatePushError(err, auth);
+    }
+    finally {
+        try {
+            fs.unlinkSync(askpassPath);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            // Best-effort cleanup; log so we can spot leaking askpass scripts in /tmp.
+            console.warn(`Warning: failed to remove temp askpass script ${askpassPath}: ${message}`);
         }
-        if (message.includes('remote rejected')) {
-            throw new Error('Remote rejected the push. The branch may be protected.');
+    }
+}
+function translatePushError(err, auth) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (message.includes('permission denied') || message.includes('403')) {
+        if (auth) {
+            return new Error(`Permission denied pushing to ${auth.owner}/${auth.repo}. The Haystack account token lacks write access to this repo — run \`haystack auth list\` and pick an account that's a collaborator.`);
         }
-        throw new Error(`Failed to push: ${message}`);
+        return new Error('Permission denied. Check your GitHub credentials.');
+    }
+    if (message.includes('remote rejected')) {
+        return new Error('Remote rejected the push. The branch may be protected.');
     }
+    return new Error(`Failed to push: ${message}`);
 }
 // ============================================================================
 // Remote operations

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {