@haystackeditor/cli 0.13.2 → 0.13.3

package/dist/commands/submit.js

@@ -367,11 +367,7 @@ export async function submitCommand(options) {
         process.exit(1);
     }
     try {
-        pushBranch('origin', currentBranch, {
-            token: githubToken,
-            owner: remoteInfo.owner,
-            repo: remoteInfo.repo,
-        });
+        pushBranch('origin', currentBranch, { token: githubToken });
         console.log(chalk.green('✓ Branch pushed'));
     }
     catch (err) {

package/dist/index.js

@@ -38,7 +38,7 @@ const program = new Command();
 program
     .name('haystack')
     .description('Haystack CLI — automated PR review, triage, and merge queue')
-    .version('0.13.2');
+    .version('0.13.3');
 program
     .command('init')
     .description('Create .haystack.json configuration')

package/dist/utils/git.d.ts

@@ -54,17 +54,16 @@ export declare function remoteBranchExists(remoteName: string, branchName: strin
 export declare function checkoutBranch(branchName: string): void;
 export interface PushAuth {
     token: string;
-    owner: string;
-    repo: string;
 }
 /**
  * Push current branch to remote with upstream tracking.
  *
  * When `auth` is provided, the push is authenticated with the given GitHub
- * token via GIT_ASKPASS against `https://github.com/{owner}/{repo}.git` —
- * independent of the user's ambient git credential helper. Upstream tracking
- * is then set against the original `remoteName` so the token URL never lands
- * in `.git/config`.
+ * token via GIT_ASKPASS against an explicit HTTPS URL, independent of the
+ * user's ambient git credential helper and independent of whatever
+ * `remote.<name>.url` / `pushurl` they have configured. Remote-tracking
+ * refs are then seeded locally so upstream tracking (`-u`-style) works on
+ * first push. `.git/config` is never touched.
  *
  * Without `auth`, falls back to `git push -u <remote>` using ambient creds.
  */

package/dist/utils/git.js

@@ -166,16 +166,17 @@ export function checkoutBranch(branchName) {
  * Push current branch to remote with upstream tracking.
  *
  * When `auth` is provided, the push is authenticated with the given GitHub
- * token via GIT_ASKPASS against `https://github.com/{owner}/{repo}.git` —
- * independent of the user's ambient git credential helper. Upstream tracking
- * is then set against the original `remoteName` so the token URL never lands
- * in `.git/config`.
+ * token via GIT_ASKPASS against an explicit HTTPS URL, independent of the
+ * user's ambient git credential helper and independent of whatever
+ * `remote.<name>.url` / `pushurl` they have configured. Remote-tracking
+ * refs are then seeded locally so upstream tracking (`-u`-style) works on
+ * first push. `.git/config` is never touched.
  *
  * Without `auth`, falls back to `git push -u <remote>` using ambient creds.
  */
 export function pushBranch(remoteName, branchName, auth) {
     if (auth) {
-        pushBranchWithToken(remoteName, branchName, auth);
+        pushBranchWithToken(remoteName, branchName, auth.token);
         return;
     }
     try {
@@ -188,28 +189,37 @@ export function pushBranch(remoteName, branchName, auth) {
         throw translatePushError(err);
     }
 }
-function pushBranchWithToken(remoteName, branchName, auth) {
+function pushBranchWithToken(remoteName, branchName, token) {
+    // Derive owner/repo from the remote itself so the push URL always matches
+    // the tracking ref we'll seed below. No way for caller and remote identity
+    // to silently disagree.
+    const { owner, repo } = parseRemoteUrl(remoteName);
+    const pushUrl = `https://github.com/${owner}/${repo}.git`;
+    const repoSlug = `${owner}/${repo}`;
     const askpassPath = path.join(os.tmpdir(), `haystack-askpass-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.sh`);
     // Script reads token from env at call time — keeps it out of the script contents and argv.
     const script = `#!/bin/sh\ncase "$1" in\n  Username*) printf '%s' "x-access-token" ;;\n  *) printf '%s' "$HAYSTACK_GIT_TOKEN" ;;\nesac\n`;
     fs.writeFileSync(askpassPath, script, { mode: 0o700 });
+    const authedEnv = {
+        ...process.env,
+        GIT_ASKPASS: askpassPath,
+        GIT_TERMINAL_PROMPT: '0',
+        HAYSTACK_GIT_TOKEN: token,
+    };
     try {
-        const pushUrl = `https://github.com/${auth.owner}/${auth.repo}.git`;
-        execSync(`git push "${pushUrl}" "HEAD:refs/heads/${branchName}"`, {
-            encoding: 'utf-8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-            env: {
-                ...process.env,
-                GIT_ASKPASS: askpassPath,
-                GIT_TERMINAL_PROMPT: '0',
-                HAYSTACK_GIT_TOKEN: auth.token,
-            },
-        });
+        // Push to an explicit HTTPS URL with GIT_ASKPASS, bypassing ambient
+        // credential helpers entirely. Using a raw URL (not the named remote)
+        // means the user's configured url/pushurl/credential-helper settings
+        // are untouched — sidesteps precedence and multi-value edge cases
+        // around `remote.<name>.url` vs `remote.<name>.pushurl`.
+        execSync(`git -c credential.helper= push "${pushUrl}" "HEAD:refs/heads/${branchName}"`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], env: authedEnv });
+        // Pushing to a raw URL doesn't update refs/remotes/<name>/<branch>. Seed
+        // it from the server's authoritative state with a targeted fetch — this
+        // reflects any server-side rewrite or hook side effects, not a fabricated
+        // pre-push SHA. Then set upstream tracking to the named remote.
         try {
-            execSync(`git branch --set-upstream-to=${remoteName}/${branchName} "${branchName}"`, {
-                encoding: 'utf-8',
-                stdio: ['pipe', 'pipe', 'pipe'],
-            });
+            execSync(`git -c credential.helper= fetch "${pushUrl}" "refs/heads/${branchName}:refs/remotes/${remoteName}/${branchName}"`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], env: authedEnv });
+            execSync(`git branch --set-upstream-to=${remoteName}/${branchName} "${branchName}"`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
         }
         catch (err) {
             // Non-fatal: push succeeded; upstream tracking is a convenience.
@@ -218,7 +228,7 @@ function pushBranchWithToken(remoteName, branchName, auth) {
         }
     }
     catch (err) {
-        throw translatePushError(err, auth);
+        throw translatePushError(err, repoSlug);
     }
     finally {
         try {
@@ -231,11 +241,11 @@ function pushBranchWithToken(remoteName, branchName, auth) {
         }
     }
 }
-function translatePushError(err, auth) {
+function translatePushError(err, repoSlug) {
     const message = err instanceof Error ? err.message : String(err);
     if (message.includes('permission denied') || message.includes('403')) {
-        if (auth) {
-            return new Error(`Permission denied pushing to ${auth.owner}/${auth.repo}. The Haystack account token lacks write access to this repo — run \`haystack auth list\` and pick an account that's a collaborator.`);
+        if (repoSlug) {
+            return new Error(`Permission denied pushing to ${repoSlug}. The Haystack account token lacks write access to this repo — run \`haystack auth list\` and pick an account that's a collaborator.`);
         }
         return new Error('Permission denied. Check your GitHub credentials.');
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {