@kendoo.agentdesk/agentdesk 0.17.4 → 0.17.5

package/CHANGELOG.md

@@ -8,6 +8,11 @@ All user-facing changes to AgentDesk. Each entry is tagged:
 
 Internal refactors, infrastructure changes, and architectural notes are not listed here.
 
+## [0.17.5] — 2026-04-18
+
+### Fixed
+- `[CLI]` `agentdesk init` now explicitly asks how you want to authenticate with GitHub instead of silently reusing whichever account the gh CLI was last logged in as. Three choices: use the existing gh CLI auth (showing which account it's currently on), paste a personal access token for a different account, or skip and configure later. When a per-project token is saved, the verify step uses it so gh picks the right identity.
+
 ## [0.17.4] — 2026-04-18
 
 ### Fixed

package/cli/init.mjs

@@ -9,6 +9,7 @@
 import { existsSync, readFileSync, writeFileSync } from "fs";
 import { join } from "path";
 import { createInterface } from "readline";
+import { execSync } from "child_process";
 import { detectProject } from "./detect.mjs";
 import { loadConfig, pushConfig } from "./config.mjs";
 import { getStoredApiKey } from "./login.mjs";
@@ -262,6 +263,47 @@ export async function runInit(cwd, opts = {}) {
     const r = answer.trim() || current;
     if (r) config.github = { repo: r };
     console.log("");
+
+    // Ask which identity to use for this project, regardless of whether
+    // `gh auth` is already set up globally. Without this prompt the wizard
+    // silently reuses whichever account the user last ran `gh auth login`
+    // with, which is surprising on a machine with multiple GitHub identities.
+    let ghLogin = null;
+    try {
+      const out = execSync("gh api user --jq .login", { stdio: ["ignore", "pipe", "ignore"], encoding: "utf-8" }).trim();
+      if (out) ghLogin = out;
+    } catch {}
+    const ghOptionLabel = ghLogin
+      ? `Use gh CLI — currently authenticated as @${ghLogin}`
+      : `Use gh CLI — you'll run 'gh auth login' after this wizard`;
+    const authChoice = await selectOption(rl, "GitHub authentication for this project:", [
+      { label: ghOptionLabel, value: "gh" },
+      { label: "Paste a personal access token (use a different account)", value: "pat" },
+      { label: "Skip — configure later in the dashboard", value: "skip" },
+    ]);
+    console.log("");
+
+    if (authChoice.value === "pat") {
+      if (!quick) {
+        console.log("  Create a token:");
+        console.log("    1. Open https://github.com/settings/tokens");
+        console.log("    2. Click \"Generate new token (classic)\"");
+        console.log("    3. Name: AgentDesk. Scope: repo. Click Generate.");
+        console.log("    4. Copy the token and paste below.");
+        console.log("");
+      }
+      while (true) {
+        const tokenInput = (await ask(rl, "  GitHub token: ")).trim();
+        if (!tokenInput) {
+          console.log("  Token is required. Press Ctrl+C to abort.");
+          continue;
+        }
+        saveEnvVar(cwd, "GITHUB_TOKEN", tokenInput);
+        console.log("  ✓ Saved to .env (as GITHUB_TOKEN). This overrides any global gh CLI auth for this project.");
+        console.log("");
+        break;
+      }
+    }
   }
 
   // --- Step 3: Verify tracker permissions (with re-prompt on failure) ---

package/cli/tracker-check.mjs

@@ -158,6 +158,11 @@ async function checkGitHub({ repo }, creds) {
   const errors = [];
   let identity = null;
 
+  // If a per-project GITHUB_TOKEN is configured, let gh use it via env —
+  // takes precedence over whichever account `gh auth` is logged into.
+  const env = { ...process.env };
+  if (creds?.GITHUB_TOKEN) env.GH_TOKEN = creds.GITHUB_TOKEN;
+
   // Check if gh CLI is available
   try {
     execSync("gh --version", { stdio: "pipe" });
@@ -167,19 +172,19 @@ async function checkGitHub({ repo }, creds) {
 
   // Check auth status and grab the authenticated login
   try {
-    execSync("gh auth status", { stdio: "pipe" });
+    execSync("gh auth status", { stdio: "pipe", env });
     try {
-      const who = execSync(`gh api user --jq '{login: .login, name: .name}'`, { stdio: "pipe", encoding: "utf-8" }).trim();
+      const who = execSync(`gh api user --jq '{login: .login, name: .name}'`, { stdio: "pipe", encoding: "utf-8", env }).trim();
       const j = JSON.parse(who);
       identity = { name: j.name || j.login, login: j.login };
     } catch {}
   } catch {
-    return { ok: false, errors: ["GitHub CLI is not authenticated — run 'gh auth login'"] };
+    return { ok: false, errors: ["GitHub CLI is not authenticated — run 'gh auth login', or paste a GITHUB_TOKEN"] };
   }
 
   // Check repo access and permissions
   try {
-    const result = execSync(`gh api repos/${repo} --jq ".permissions"`, { stdio: "pipe", encoding: "utf-8" });
+    const result = execSync(`gh api repos/${repo} --jq ".permissions"`, { stdio: "pipe", encoding: "utf-8", env });
     const perms = JSON.parse(result.trim());
 
     if (!perms.pull) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.17.4",
+  "version": "0.17.5",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {