@haystackeditor/cli 0.13.1 → 0.13.3

package/dist/commands/submit.js

@@ -362,8 +362,12 @@ export async function submitCommand(options) {
     // Step 4: Push to remote
     // -------------------------------------------------------------------------
     console.log(chalk.dim('\nPushing to origin...'));
+    if (!githubToken) {
+        console.error(chalk.red('\nInternal error: no Haystack account token resolved before push.\n'));
+        process.exit(1);
+    }
     try {
-        pushBranch('origin', currentBranch);
+        pushBranch('origin', currentBranch, { token: githubToken });
         console.log(chalk.green('✓ Branch pushed'));
     }
     catch (err) {

package/dist/index.js

@@ -38,7 +38,7 @@ const program = new Command();
 program
     .name('haystack')
     .description('Haystack CLI — automated PR review, triage, and merge queue')
-    .version('0.13.1');
+    .version('0.13.3');
 program
     .command('init')
     .description('Create .haystack.json configuration')

package/dist/utils/git.d.ts

@@ -52,10 +52,22 @@ export declare function remoteBranchExists(remoteName: string, branchName: strin
  * Checkout an existing branch
  */
 export declare function checkoutBranch(branchName: string): void;
+export interface PushAuth {
+    token: string;
+}
 /**
- * Push current branch to remote with upstream tracking
+ * Push current branch to remote with upstream tracking.
+ *
+ * When `auth` is provided, the push is authenticated with the given GitHub
+ * token via GIT_ASKPASS against an explicit HTTPS URL, independent of the
+ * user's ambient git credential helper and independent of whatever
+ * `remote.<name>.url` / `pushurl` they have configured. Remote-tracking
+ * refs are then seeded locally so upstream tracking (`-u`-style) works on
+ * first push. `.git/config` is never touched.
+ *
+ * Without `auth`, falls back to `git push -u <remote>` using ambient creds.
  */
-export declare function pushBranch(remoteName: string, branchName: string): void;
+export declare function pushBranch(remoteName: string, branchName: string, auth?: PushAuth): void;
 /**
  * Parse remote URL to extract owner and repo
  * Supports both SSH and HTTPS URLs

package/dist/utils/git.js

@@ -4,6 +4,9 @@
  * Provides functions for git operations: branch management, push, remote parsing.
  */
 import { execSync } from 'child_process';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
 // Re-export findGitRoot from hooks for consistency
 export { findGitRoot } from './hooks.js';
 // ============================================================================
@@ -159,13 +162,23 @@ export function checkoutBranch(branchName) {
         throw new Error(`Failed to checkout branch: ${message}`);
     }
 }
-// ============================================================================
-// Push operations
-// ============================================================================
 /**
- * Push current branch to remote with upstream tracking
+ * Push current branch to remote with upstream tracking.
+ *
+ * When `auth` is provided, the push is authenticated with the given GitHub
+ * token via GIT_ASKPASS against an explicit HTTPS URL, independent of the
+ * user's ambient git credential helper and independent of whatever
+ * `remote.<name>.url` / `pushurl` they have configured. Remote-tracking
+ * refs are then seeded locally so upstream tracking (`-u`-style) works on
+ * first push. `.git/config` is never touched.
+ *
+ * Without `auth`, falls back to `git push -u <remote>` using ambient creds.
  */
-export function pushBranch(remoteName, branchName) {
+export function pushBranch(remoteName, branchName, auth) {
+    if (auth) {
+        pushBranchWithToken(remoteName, branchName, auth.token);
+        return;
+    }
     try {
         execSync(`git push -u ${remoteName} "${branchName}"`, {
             encoding: 'utf-8',
@@ -173,15 +186,73 @@ export function pushBranch(remoteName, branchName) {
         });
     }
     catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        if (message.includes('permission denied') || message.includes('403')) {
-            throw new Error('Permission denied. Check your GitHub credentials.');
+        throw translatePushError(err);
+    }
+}
+function pushBranchWithToken(remoteName, branchName, token) {
+    // Derive owner/repo from the remote itself so the push URL always matches
+    // the tracking ref we'll seed below. No way for caller and remote identity
+    // to silently disagree.
+    const { owner, repo } = parseRemoteUrl(remoteName);
+    const pushUrl = `https://github.com/${owner}/${repo}.git`;
+    const repoSlug = `${owner}/${repo}`;
+    const askpassPath = path.join(os.tmpdir(), `haystack-askpass-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.sh`);
+    // Script reads token from env at call time — keeps it out of the script contents and argv.
+    const script = `#!/bin/sh\ncase "$1" in\n  Username*) printf '%s' "x-access-token" ;;\n  *) printf '%s' "$HAYSTACK_GIT_TOKEN" ;;\nesac\n`;
+    fs.writeFileSync(askpassPath, script, { mode: 0o700 });
+    const authedEnv = {
+        ...process.env,
+        GIT_ASKPASS: askpassPath,
+        GIT_TERMINAL_PROMPT: '0',
+        HAYSTACK_GIT_TOKEN: token,
+    };
+    try {
+        // Push to an explicit HTTPS URL with GIT_ASKPASS, bypassing ambient
+        // credential helpers entirely. Using a raw URL (not the named remote)
+        // means the user's configured url/pushurl/credential-helper settings
+        // are untouched — sidesteps precedence and multi-value edge cases
+        // around `remote.<name>.url` vs `remote.<name>.pushurl`.
+        execSync(`git -c credential.helper= push "${pushUrl}" "HEAD:refs/heads/${branchName}"`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], env: authedEnv });
+        // Pushing to a raw URL doesn't update refs/remotes/<name>/<branch>. Seed
+        // it from the server's authoritative state with a targeted fetch — this
+        // reflects any server-side rewrite or hook side effects, not a fabricated
+        // pre-push SHA. Then set upstream tracking to the named remote.
+        try {
+            execSync(`git -c credential.helper= fetch "${pushUrl}" "refs/heads/${branchName}:refs/remotes/${remoteName}/${branchName}"`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], env: authedEnv });
+            execSync(`git branch --set-upstream-to=${remoteName}/${branchName} "${branchName}"`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
         }
-        if (message.includes('remote rejected')) {
-            throw new Error('Remote rejected the push. The branch may be protected.');
+        catch (err) {
+            // Non-fatal: push succeeded; upstream tracking is a convenience.
+            const message = err instanceof Error ? err.message : String(err);
+            console.warn(`Warning: failed to set upstream tracking for ${branchName}: ${message}`);
         }
-        throw new Error(`Failed to push: ${message}`);
     }
+    catch (err) {
+        throw translatePushError(err, repoSlug);
+    }
+    finally {
+        try {
+            fs.unlinkSync(askpassPath);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            // Best-effort cleanup; log so we can spot leaking askpass scripts in /tmp.
+            console.warn(`Warning: failed to remove temp askpass script ${askpassPath}: ${message}`);
+        }
+    }
+}
+function translatePushError(err, repoSlug) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (message.includes('permission denied') || message.includes('403')) {
+        if (repoSlug) {
+            return new Error(`Permission denied pushing to ${repoSlug}. The Haystack account token lacks write access to this repo — run \`haystack auth list\` and pick an account that's a collaborator.`);
+        }
+        return new Error('Permission denied. Check your GitHub credentials.');
+    }
+    if (message.includes('remote rejected')) {
+        return new Error('Remote rejected the push. The branch may be protected.');
+    }
+    return new Error(`Failed to push: ${message}`);
 }
 // ============================================================================
 // Remote operations

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.13.1",
+  "version": "0.13.3",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {