@kubbisec/ai-linux-x64 0.1.22 → 0.1.23

package/bundled/extensions/kubbisec-github-local.extension.js

@@ -3,468 +3,481 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { summarizeSubprocessFailure, toUserError } from "@aspm/shared/cli-user-error";
 import { Type } from "@earendil-works/pi-ai";
-import { buildAuthenticatedGitRemoteUrl, buildGitGhSubprocessEnv, resolveHostGitAuth, } from "@kubbisec/remediation";
+import {
+  buildAuthenticatedGitRemoteUrl,
+  buildGitGhSubprocessEnv,
+  resolveHostGitAuth,
+} from "@kubbisec/remediation";
 import { resolveExtendedWorkspace } from "../config/extended-context.js";
 import { resolvePathInWorkspace } from "./cli-local-shared.js";
+
 function resolveWorkspace() {
-    return resolveExtendedWorkspace();
+  return resolveExtendedWorkspace();
 }
 function resolveWorkspacePath() {
-    const candidates = [
-        process.env.KUBBISEC_LOCAL_WORKSPACE,
-        process.env.KUBBISEC_AI_WORKSPACE,
-    ].filter((value) => typeof value === "string" && value.trim().length > 0);
-    for (const candidate of candidates) {
-        const segments = candidate.split(/[\\/]+/).filter(Boolean);
-        if (segments.includes("..")) {
-            throw new Error("workspace path traversal is not allowed");
-        }
+  const candidates = [
+    process.env.KUBBISEC_LOCAL_WORKSPACE,
+    process.env.KUBBISEC_AI_WORKSPACE,
+  ].filter((value) => typeof value === "string" && value.trim().length > 0);
+  for (const candidate of candidates) {
+    const segments = candidate.split(/[\\/]+/).filter(Boolean);
+    if (segments.includes("..")) {
+      throw new Error("workspace path traversal is not allowed");
     }
-    return resolveWorkspace();
+  }
+  return resolveWorkspace();
 }
 function execCapture(bin, args, cwd, options) {
-    return new Promise((resolve) => {
-        const child = spawn(bin, args, {
-            cwd,
-            env: options?.env ?? {
-                ...process.env,
-                GIT_TERMINAL_PROMPT: "0",
-                GH_PROMPT_DISABLED: "1",
-            },
-            stdio: ["ignore", "pipe", "pipe"],
-        });
-        let stdout = "";
-        let stderr = "";
-        child.stdout?.on("data", (c) => {
-            stdout += String(c);
-        });
-        child.stderr?.on("data", (c) => {
-            stderr += String(c);
-        });
-        child.on("error", (err) => {
-            resolve({ code: 127, stdout: "", stderr: toUserError(err).detail });
-        });
-        child.on("close", (code) => resolve({ code: code ?? 1, stdout, stderr }));
+  return new Promise((resolve) => {
+    const child = spawn(bin, args, {
+      cwd,
+      env: options?.env ?? {
+        ...process.env,
+        GIT_TERMINAL_PROMPT: "0",
+        GH_PROMPT_DISABLED: "1",
+      },
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (c) => {
+      stdout += String(c);
     });
+    child.stderr?.on("data", (c) => {
+      stderr += String(c);
+    });
+    child.on("error", (err) => {
+      resolve({ code: 127, stdout: "", stderr: toUserError(err).detail });
+    });
+    child.on("close", (code) => resolve({ code: code ?? 1, stdout, stderr }));
+  });
 }
 function redactGithubSecrets(text) {
-    return text
-        .replace(/https:\/\/([^/\s:@]+):([^@\s]+)@/gi, (_match, user) => `https://${String(user)}:***@`)
-        .replace(/\b(gh[pousr]_[A-Za-z0-9_]+)\b/g, "***");
+  return text
+    .replace(/https:\/\/([^/\s:@]+):([^@\s]+)@/gi, (_match, user) => `https://${String(user)}:***@`)
+    .replace(/\b(gh[pousr]_[A-Za-z0-9_]+)\b/g, "***");
 }
 function formatGitSummary(bin, label, result) {
-    const stdout = redactGithubSecrets(result.stdout.trim());
-    const stderr = redactGithubSecrets(result.stderr.trim());
-    if (result.code === 0 && stdout) {
-        return `${label}:\n${stdout}`;
-    }
-    if (result.code === 0) {
-        return `${label}: (sem saída)`;
-    }
-    return summarizeSubprocessFailure({
-        bin,
-        code: result.code,
-        stderr,
-        stdout,
-    });
+  const stdout = redactGithubSecrets(result.stdout.trim());
+  const stderr = redactGithubSecrets(result.stderr.trim());
+  if (result.code === 0 && stdout) {
+    return `${label}:\n${stdout}`;
+  }
+  if (result.code === 0) {
+    return `${label}: (sem saída)`;
+  }
+  return summarizeSubprocessFailure({
+    bin,
+    code: result.code,
+    stderr,
+    stdout,
+  });
 }
 function resolvePlatformToken() {
-    const candidate = process.env.KUBBISEC_GIT_TOKEN?.trim() ||
-        process.env.GITHUB_TOKEN?.trim() ||
-        process.env.GH_TOKEN?.trim();
-    return candidate || null;
+  const candidate =
+    process.env.KUBBISEC_GIT_TOKEN?.trim() ||
+    process.env.GITHUB_TOKEN?.trim() ||
+    process.env.GH_TOKEN?.trim();
+  return candidate || null;
 }
 function buildTextResult(text) {
-    return { content: [{ type: "text", text }] };
+  return { content: [{ type: "text", text }] };
 }
 function buildErrorResult(error) {
-    return buildTextResult(toUserError(error, "Falha ao executar github local").detail);
+  return buildTextResult(toUserError(error, "Falha ao executar github local").detail);
 }
 function isGitWorkspace(cwd) {
-    return fs.existsSync(path.join(cwd, ".git"));
+  return fs.existsSync(path.join(cwd, ".git"));
 }
 async function resolveRemoteUrl(cwd) {
-    if (!isGitWorkspace(cwd))
-        return null;
-    const remoteUrlResult = await execCapture("git", ["remote", "get-url", "origin"], cwd);
-    if (remoteUrlResult.code !== 0)
-        return null;
-    return remoteUrlResult.stdout.trim() || null;
+  if (!isGitWorkspace(cwd)) return null;
+  const remoteUrlResult = await execCapture("git", ["remote", "get-url", "origin"], cwd);
+  if (remoteUrlResult.code !== 0) return null;
+  return remoteUrlResult.stdout.trim() || null;
 }
 async function resolveWorkspaceAuth(cwd) {
-    const remoteUrl = await resolveRemoteUrl(cwd);
-    const platformToken = resolvePlatformToken();
-    const auth = await resolveHostGitAuth({
-        cwd,
-        remoteUrl,
-        platformToken,
-    });
-    const env = buildGitGhSubprocessEnv(auth, process.env);
-    return { auth, env, remoteUrl, platformToken };
+  const remoteUrl = await resolveRemoteUrl(cwd);
+  const platformToken = resolvePlatformToken();
+  const auth = await resolveHostGitAuth({
+    cwd,
+    remoteUrl,
+    platformToken,
+  });
+  const env = buildGitGhSubprocessEnv(auth, process.env);
+  return { auth, env, remoteUrl, platformToken };
 }
 function requireGitWorkspace(cwd) {
-    if (isGitWorkspace(cwd)) {
-        return { ok: true };
-    }
-    return {
-        ok: false,
-        result: buildTextResult("git: no .git in workspace (clone via kubsec_github_repository + remediation flow)"),
-    };
+  if (isGitWorkspace(cwd)) {
+    return { ok: true };
+  }
+  return {
+    ok: false,
+    result: buildTextResult(
+      "git: no .git in workspace (clone via kubsec_github_repository + remediation flow)",
+    ),
+  };
 }
 async function runAuthenticatedCommand(bin, args, cwd) {
-    const { env } = await resolveWorkspaceAuth(cwd);
-    return execCapture(bin, args, cwd, { env });
+  const { env } = await resolveWorkspaceAuth(cwd);
+  return execCapture(bin, args, cwd, { env });
 }
 function isGitAuthFailure(stderr, stdout) {
-    const detail = `${stderr}\n${stdout}`.toLowerCase();
-    return (detail.includes("invalid credentials") ||
-        detail.includes("authentication failed") ||
-        detail.includes("403") ||
-        detail.includes("401") ||
-        detail.includes("unauthorized"));
+  const detail = `${stderr}\n${stdout}`.toLowerCase();
+  return (
+    detail.includes("invalid credentials") ||
+    detail.includes("authentication failed") ||
+    detail.includes("403") ||
+    detail.includes("401") ||
+    detail.includes("unauthorized")
+  );
 }
 function buildRetryAuth(platformToken) {
-    return {
-        source: "platform-token",
-        mode: "embedded-token",
-        token: platformToken,
-        detail: "retry after native auth failure",
-    };
+  return {
+    source: "platform-token",
+    mode: "embedded-token",
+    token: platformToken,
+    detail: "retry after native auth failure",
+  };
 }
 async function prepareRemoteForAuth(cwd, remoteUrl, auth) {
-    const env = buildGitGhSubprocessEnv(auth, process.env);
-    if (!remoteUrl) {
-        return env;
-    }
-    const nextRemoteUrl = auth.mode === "embedded-token"
-        ? buildAuthenticatedGitRemoteUrl(remoteUrl, auth.token)
-        : remoteUrl;
-    const setUrl = await execCapture("git", ["remote", "set-url", "origin", nextRemoteUrl], cwd, {
-        env,
-    });
-    if (setUrl.code !== 0) {
-        throw new Error(formatGitSummary("git", "git remote set-url", setUrl));
-    }
+  const env = buildGitGhSubprocessEnv(auth, process.env);
+  if (!remoteUrl) {
     return env;
+  }
+  const nextRemoteUrl =
+    auth.mode === "embedded-token"
+      ? buildAuthenticatedGitRemoteUrl(remoteUrl, auth.token)
+      : remoteUrl;
+  const setUrl = await execCapture("git", ["remote", "set-url", "origin", nextRemoteUrl], cwd, {
+    env,
+  });
+  if (setUrl.code !== 0) {
+    throw new Error(formatGitSummary("git", "git remote set-url", setUrl));
+  }
+  return env;
 }
 function normalizeCloneRemote(params) {
-    const remoteUrl = typeof params.remoteUrl === "string" ? params.remoteUrl.trim() : "";
-    if (remoteUrl) {
-        return remoteUrl;
-    }
-    const repo = typeof params.repo === "string" ? params.repo.trim().replace(/^\/+|\/+$/g, "") : "";
-    if (!repo) {
-        return null;
-    }
-    return `https://github.com/${repo.endsWith(".git") ? repo : `${repo}.git`}`;
+  const remoteUrl = typeof params.remoteUrl === "string" ? params.remoteUrl.trim() : "";
+  if (remoteUrl) {
+    return remoteUrl;
+  }
+  const repo = typeof params.repo === "string" ? params.repo.trim().replace(/^\/+|\/+$/g, "") : "";
+  if (!repo) {
+    return null;
+  }
+  return `https://github.com/${repo.endsWith(".git") ? repo : `${repo}.git`}`;
 }
 function inferCloneDirectory(params, remoteUrl) {
-    const explicit = typeof params.directory === "string" ? params.directory.trim() : "";
-    if (explicit) {
-        return explicit;
-    }
-    const repo = typeof params.repo === "string" ? params.repo.trim() : "";
-    if (repo) {
-        return (repo
-            .split("/")
-            .filter(Boolean)
-            .pop()
-            ?.replace(/\.git$/i, "") || "repo");
-    }
-    const normalized = remoteUrl.replace(/[\\/]+$/, "");
-    const basename = normalized
-        .split(/[/:]/)
+  const explicit = typeof params.directory === "string" ? params.directory.trim() : "";
+  if (explicit) {
+    return explicit;
+  }
+  const repo = typeof params.repo === "string" ? params.repo.trim() : "";
+  if (repo) {
+    return (
+      repo
+        .split("/")
+        .filter(Boolean)
         .pop()
-        ?.replace(/\.git$/i, "");
-    return basename || "repo";
+        ?.replace(/\.git$/i, "") || "repo"
+    );
+  }
+  const normalized = remoteUrl.replace(/[\\/]+$/, "");
+  const basename = normalized
+    .split(/[/:]/)
+    .pop()
+    ?.replace(/\.git$/i, "");
+  return basename || "repo";
 }
 async function sanitizeClonedRemote(cwd, remoteUrl, auth) {
-    if (auth.mode !== "embedded-token") {
-        return;
-    }
-    const sanitizedEnv = buildGitGhSubprocessEnv(auth, process.env);
-    const sanitized = await execCapture("git", ["remote", "set-url", "origin", remoteUrl], cwd, {
-        env: sanitizedEnv,
-    });
-    if (sanitized.code !== 0) {
-        throw new Error(formatGitSummary("git", "git remote set-url", sanitized));
-    }
+  if (auth.mode !== "embedded-token") {
+    return;
+  }
+  const sanitizedEnv = buildGitGhSubprocessEnv(auth, process.env);
+  const sanitized = await execCapture("git", ["remote", "set-url", "origin", remoteUrl], cwd, {
+    env: sanitizedEnv,
+  });
+  if (sanitized.code !== 0) {
+    throw new Error(formatGitSummary("git", "git remote set-url", sanitized));
+  }
 }
 async function resolveCurrentBranch(cwd) {
-    const branch = await execCapture("git", ["branch", "--show-current"], cwd);
-    const branchName = branch.stdout.trim();
-    return branch.code === 0 && branchName ? branchName : null;
+  const branch = await execCapture("git", ["branch", "--show-current"], cwd);
+  const branchName = branch.stdout.trim();
+  return branch.code === 0 && branchName ? branchName : null;
 }
 export default function kubbisecGithubLocal(api) {
-    api.registerTool({
-        name: "github_local_status",
-        label: "GitHub local status",
-        description: "Reports host GitHub auth and git remote details for this machine.",
-        parameters: Type.Object({}),
-        async execute() {
-            try {
-                const cwd = resolveWorkspacePath();
-                const parts = [`workspace: ${cwd}`];
-                const hasGit = isGitWorkspace(cwd);
-                const remoteUrl = await resolveRemoteUrl(cwd);
-                const auth = await resolveHostGitAuth({
-                    cwd,
-                    remoteUrl,
-                    platformToken: resolvePlatformToken(),
-                });
-                parts.push(`auth source: ${auth.source}`);
-                parts.push(`auth detail: ${auth.detail}`);
-                if (hasGit) {
-                    const remote = await execCapture("git", ["remote", "-v"], cwd);
-                    const branch = await execCapture("git", ["branch", "--show-current"], cwd);
-                    parts.push(formatGitSummary("git", "git remote", remote));
-                    const branchName = branch.stdout.trim();
-                    parts.push(`git branch: ${branchName || (branch.code === 0 ? "(detached)" : "indisponível")}`);
-                }
-                else {
-                    parts.push("git: no .git in workspace (clone via kubsec_github_repository + remediation flow)");
-                }
-                return buildTextResult(parts.join("\n\n"));
-            }
-            catch (error) {
-                return buildErrorResult(error);
-            }
-        },
-    });
-    api.registerTool({
-        name: "github_local_repo_summary",
-        label: "GitHub local repo summary",
-        description: "Lists top-level files and recent git log in the workspace.",
-        parameters: Type.Object({}),
-        async execute() {
-            try {
-                const cwd = resolveWorkspacePath();
-                const entries = fs.existsSync(cwd)
-                    ? fs
-                        .readdirSync(cwd, { withFileTypes: true })
-                        .slice(0, 40)
-                        .map((e) => (e.isDirectory() ? `${e.name}/` : e.name))
-                    : [];
-                let logOut = "";
-                if (isGitWorkspace(cwd)) {
-                    const log = await execCapture("git", ["log", "-5", "--oneline"], cwd);
-                    if (log.code === 0 && log.stdout.trim()) {
-                        logOut = redactGithubSecrets(log.stdout.trim());
-                    }
-                    else if (log.code !== 0) {
-                        logOut = summarizeSubprocessFailure({
-                            bin: "git",
-                            code: log.code,
-                            stderr: redactGithubSecrets(log.stderr),
-                            stdout: redactGithubSecrets(log.stdout),
-                        });
-                    }
-                }
-                const text = [
-                    `workspace: ${cwd}`,
-                    `entries: ${entries.join(", ") || "(empty)"}`,
-                    logOut ? `recent commits:\n${logOut}` : "no git history",
-                ].join("\n\n");
-                return buildTextResult(text);
-            }
-            catch (error) {
-                return buildErrorResult(error);
-            }
-        },
-    });
-    api.registerTool({
-        name: "github_local_clone",
-        label: "GitHub local clone",
-        description: "Clones a repository into a workspace-safe local directory.",
-        parameters: Type.Object({
-            remoteUrl: Type.Optional(Type.String({ description: "Full Git remote URL." })),
-            repo: Type.Optional(Type.String({ description: "GitHub repo in owner/name format." })),
-            directory: Type.Optional(Type.String({ description: "Optional target directory inside the workspace." })),
-            branch: Type.Optional(Type.String({ description: "Optional branch to clone." })),
-        }),
-        async execute(_toolCallId, params) {
-            try {
-                const cwd = resolveWorkspacePath();
-                const remoteUrl = normalizeCloneRemote(params);
-                if (!remoteUrl) {
-                    return buildTextResult("remoteUrl or repo is required");
-                }
-                const targetDir = resolvePathInWorkspace(inferCloneDirectory(params, remoteUrl), cwd);
-                if (path.resolve(targetDir) === path.resolve(cwd)) {
-                    return buildTextResult("clone target must be a child path inside the workspace");
-                }
-                const branch = typeof params.branch === "string" ? params.branch.trim() : "";
-                const platformToken = resolvePlatformToken();
-                let auth = await resolveHostGitAuth({
-                    cwd,
-                    remoteUrl,
-                    platformToken,
-                });
-                const buildCloneArgs = (currentAuth) => {
-                    const cloneRemoteUrl = currentAuth.mode === "embedded-token"
-                        ? buildAuthenticatedGitRemoteUrl(remoteUrl, currentAuth.token)
-                        : remoteUrl;
-                    const args = ["clone"];
-                    if (branch) {
-                        args.push("--branch", branch);
-                    }
-                    args.push(cloneRemoteUrl, targetDir);
-                    return { args, cloneRemoteUrl };
-                };
-                const runClone = async (currentAuth) => {
-                    const { args, cloneRemoteUrl } = buildCloneArgs(currentAuth);
-                    const env = buildGitGhSubprocessEnv(currentAuth, process.env);
-                    const result = await execCapture("git", args, cwd, { env });
-                    return { result, cloneRemoteUrl };
-                };
-                let clone = await runClone(auth);
-                if (clone.result.code !== 0 &&
-                    auth.mode === "native" &&
-                    platformToken &&
-                    isGitAuthFailure(clone.result.stderr, clone.result.stdout)) {
-                    fs.rmSync(targetDir, { recursive: true, force: true });
-                    auth = buildRetryAuth(platformToken);
-                    clone = await runClone(auth);
-                }
-                if (clone.result.code === 0) {
-                    await sanitizeClonedRemote(targetDir, remoteUrl, auth);
-                }
-                const relativeTarget = path.relative(cwd, targetDir) || ".";
-                return buildTextResult(`${formatGitSummary("git", "git clone", clone.result)}\n\ntarget: ${relativeTarget}`);
-            }
-            catch (error) {
-                return buildErrorResult(error);
-            }
-        },
-    });
-    api.registerTool({
-        name: "github_local_fetch",
-        label: "GitHub local fetch",
-        description: "Runs `git fetch` in the workspace using host or fallback auth.",
-        parameters: Type.Object({}),
-        async execute() {
-            try {
-                const cwd = resolveWorkspacePath();
-                const gitWorkspace = requireGitWorkspace(cwd);
-                if (!gitWorkspace.ok)
-                    return gitWorkspace.result;
-                const result = await runAuthenticatedCommand("git", ["fetch"], cwd);
-                return buildTextResult(formatGitSummary("git", "git fetch", result));
-            }
-            catch (error) {
-                return buildErrorResult(error);
-            }
-        },
-    });
-    api.registerTool({
-        name: "github_local_commit",
-        label: "GitHub local commit",
-        description: "Stages all changes and creates a git commit in the workspace.",
-        parameters: Type.Object({
-            message: Type.String({ description: "Commit message passed to `git commit -m`." }),
-        }),
-        async execute(_toolCallId, params) {
-            try {
-                const message = String(params.message ?? "").trim();
-                if (!message) {
-                    return buildTextResult("commit message is required");
-                }
-                const cwd = resolveWorkspacePath();
-                const gitWorkspace = requireGitWorkspace(cwd);
-                if (!gitWorkspace.ok)
-                    return gitWorkspace.result;
-                const { env } = await resolveWorkspaceAuth(cwd);
-                const addResult = await execCapture("git", ["add", "-A"], cwd, { env });
-                if (addResult.code !== 0) {
-                    return buildTextResult(formatGitSummary("git", "git add", addResult));
-                }
-                const commitResult = await execCapture("git", ["commit", "-m", message], cwd, { env });
-                return buildTextResult(formatGitSummary("git", "git commit", commitResult));
-            }
-            catch (error) {
-                return buildErrorResult(error);
-            }
-        },
-    });
-    api.registerTool({
-        name: "github_local_push",
-        label: "GitHub local push",
-        description: "Pushes the current branch to origin using host or fallback auth.",
-        parameters: Type.Object({}),
-        async execute() {
-            try {
-                const cwd = resolveWorkspacePath();
-                const gitWorkspace = requireGitWorkspace(cwd);
-                if (!gitWorkspace.ok)
-                    return gitWorkspace.result;
-                const branch = await resolveCurrentBranch(cwd);
-                const args = branch ? ["push", "-u", "origin", branch] : ["push"];
-                const { auth, remoteUrl, platformToken } = await resolveWorkspaceAuth(cwd);
-                const runPush = async (currentAuth) => {
-                    const env = await prepareRemoteForAuth(cwd, remoteUrl, currentAuth);
-                    return execCapture("git", args, cwd, { env });
-                };
-                let result = await runPush(auth);
-                if (result.code !== 0 &&
-                    auth.mode === "native" &&
-                    platformToken &&
-                    isGitAuthFailure(result.stderr, result.stdout)) {
-                    result = await runPush(buildRetryAuth(platformToken));
-                }
-                return buildTextResult(formatGitSummary("git", "git push", result));
-            }
-            catch (error) {
-                return buildErrorResult(error);
-            }
-        },
-    });
-    api.registerTool({
-        name: "github_local_pr_create",
-        label: "GitHub local PR create",
-        description: "Creates a pull request with `gh pr create` from the current branch.",
-        parameters: Type.Object({
-            title: Type.String({ description: "Pull request title." }),
-            body: Type.String({ description: "Pull request body." }),
-            base: Type.Optional(Type.String({ description: "Optional base branch name." })),
-        }),
-        async execute(_toolCallId, params) {
-            try {
-                const title = String(params.title ?? "").trim();
-                const body = String(params.body ?? "").trim();
-                const base = typeof params.base === "string" ? params.base.trim() : "";
-                if (!title) {
-                    return buildTextResult("pull request title is required");
-                }
-                if (!body) {
-                    return buildTextResult("pull request body is required");
-                }
-                const cwd = resolveWorkspacePath();
-                const gitWorkspace = requireGitWorkspace(cwd);
-                if (!gitWorkspace.ok)
-                    return gitWorkspace.result;
-                const branch = await resolveCurrentBranch(cwd);
-                const args = ["pr", "create", "--title", title, "--body", body];
-                if (base) {
-                    args.push("--base", base);
-                }
-                if (branch) {
-                    args.push("--head", branch);
-                }
-                const { auth, env, platformToken } = await resolveWorkspaceAuth(cwd);
-                let result = await execCapture("gh", args, cwd, { env });
-                if (result.code !== 0 &&
-                    auth.mode === "native" &&
-                    platformToken &&
-                    isGitAuthFailure(result.stderr, result.stdout)) {
-                    const retryEnv = buildGitGhSubprocessEnv(buildRetryAuth(platformToken), process.env);
-                    result = await execCapture("gh", args, cwd, { env: retryEnv });
-                }
-                return buildTextResult(formatGitSummary("gh", "gh pr create", result));
-            }
-            catch (error) {
-                return buildErrorResult(error);
-            }
-        },
-    });
+  api.registerTool({
+    name: "github_local_status",
+    label: "GitHub local status",
+    description: "Reports host GitHub auth and git remote details for this machine.",
+    parameters: Type.Object({}),
+    async execute() {
+      try {
+        const cwd = resolveWorkspacePath();
+        const parts = [`workspace: ${cwd}`];
+        const hasGit = isGitWorkspace(cwd);
+        const remoteUrl = await resolveRemoteUrl(cwd);
+        const auth = await resolveHostGitAuth({
+          cwd,
+          remoteUrl,
+          platformToken: resolvePlatformToken(),
+        });
+        parts.push(`auth source: ${auth.source}`);
+        parts.push(`auth detail: ${auth.detail}`);
+        if (hasGit) {
+          const remote = await execCapture("git", ["remote", "-v"], cwd);
+          const branch = await execCapture("git", ["branch", "--show-current"], cwd);
+          parts.push(formatGitSummary("git", "git remote", remote));
+          const branchName = branch.stdout.trim();
+          parts.push(
+            `git branch: ${branchName || (branch.code === 0 ? "(detached)" : "indisponível")}`,
+          );
+        } else {
+          parts.push(
+            "git: no .git in workspace (clone via kubsec_github_repository + remediation flow)",
+          );
+        }
+        return buildTextResult(parts.join("\n\n"));
+      } catch (error) {
+        return buildErrorResult(error);
+      }
+    },
+  });
+  api.registerTool({
+    name: "github_local_repo_summary",
+    label: "GitHub local repo summary",
+    description: "Lists top-level files and recent git log in the workspace.",
+    parameters: Type.Object({}),
+    async execute() {
+      try {
+        const cwd = resolveWorkspacePath();
+        const entries = fs.existsSync(cwd)
+          ? fs
+              .readdirSync(cwd, { withFileTypes: true })
+              .slice(0, 40)
+              .map((e) => (e.isDirectory() ? `${e.name}/` : e.name))
+          : [];
+        let logOut = "";
+        if (isGitWorkspace(cwd)) {
+          const log = await execCapture("git", ["log", "-5", "--oneline"], cwd);
+          if (log.code === 0 && log.stdout.trim()) {
+            logOut = redactGithubSecrets(log.stdout.trim());
+          } else if (log.code !== 0) {
+            logOut = summarizeSubprocessFailure({
+              bin: "git",
+              code: log.code,
+              stderr: redactGithubSecrets(log.stderr),
+              stdout: redactGithubSecrets(log.stdout),
+            });
+          }
+        }
+        const text = [
+          `workspace: ${cwd}`,
+          `entries: ${entries.join(", ") || "(empty)"}`,
+          logOut ? `recent commits:\n${logOut}` : "no git history",
+        ].join("\n\n");
+        return buildTextResult(text);
+      } catch (error) {
+        return buildErrorResult(error);
+      }
+    },
+  });
+  api.registerTool({
+    name: "github_local_clone",
+    label: "GitHub local clone",
+    description: "Clones a repository into a workspace-safe local directory.",
+    parameters: Type.Object({
+      remoteUrl: Type.Optional(Type.String({ description: "Full Git remote URL." })),
+      repo: Type.Optional(Type.String({ description: "GitHub repo in owner/name format." })),
+      directory: Type.Optional(
+        Type.String({ description: "Optional target directory inside the workspace." }),
+      ),
+      branch: Type.Optional(Type.String({ description: "Optional branch to clone." })),
+    }),
+    async execute(_toolCallId, params) {
+      try {
+        const cwd = resolveWorkspacePath();
+        const remoteUrl = normalizeCloneRemote(params);
+        if (!remoteUrl) {
+          return buildTextResult("remoteUrl or repo is required");
+        }
+        const targetDir = resolvePathInWorkspace(inferCloneDirectory(params, remoteUrl), cwd);
+        if (path.resolve(targetDir) === path.resolve(cwd)) {
+          return buildTextResult("clone target must be a child path inside the workspace");
+        }
+        const branch = typeof params.branch === "string" ? params.branch.trim() : "";
+        const platformToken = resolvePlatformToken();
+        let auth = await resolveHostGitAuth({
+          cwd,
+          remoteUrl,
+          platformToken,
+        });
+        const buildCloneArgs = (currentAuth) => {
+          const cloneRemoteUrl =
+            currentAuth.mode === "embedded-token"
+              ? buildAuthenticatedGitRemoteUrl(remoteUrl, currentAuth.token)
+              : remoteUrl;
+          const args = ["clone"];
+          if (branch) {
+            args.push("--branch", branch);
+          }
+          args.push(cloneRemoteUrl, targetDir);
+          return { args, cloneRemoteUrl };
+        };
+        const runClone = async (currentAuth) => {
+          const { args, cloneRemoteUrl } = buildCloneArgs(currentAuth);
+          const env = buildGitGhSubprocessEnv(currentAuth, process.env);
+          const result = await execCapture("git", args, cwd, { env });
+          return { result, cloneRemoteUrl };
+        };
+        let clone = await runClone(auth);
+        if (
+          clone.result.code !== 0 &&
+          auth.mode === "native" &&
+          platformToken &&
+          isGitAuthFailure(clone.result.stderr, clone.result.stdout)
+        ) {
+          fs.rmSync(targetDir, { recursive: true, force: true });
+          auth = buildRetryAuth(platformToken);
+          clone = await runClone(auth);
+        }
+        if (clone.result.code === 0) {
+          await sanitizeClonedRemote(targetDir, remoteUrl, auth);
+        }
+        const relativeTarget = path.relative(cwd, targetDir) || ".";
+        return buildTextResult(
+          `${formatGitSummary("git", "git clone", clone.result)}\n\ntarget: ${relativeTarget}`,
+        );
+      } catch (error) {
+        return buildErrorResult(error);
+      }
+    },
+  });
+  api.registerTool({
+    name: "github_local_fetch",
+    label: "GitHub local fetch",
+    description: "Runs `git fetch` in the workspace using host or fallback auth.",
+    parameters: Type.Object({}),
+    async execute() {
+      try {
+        const cwd = resolveWorkspacePath();
+        const gitWorkspace = requireGitWorkspace(cwd);
+        if (!gitWorkspace.ok) return gitWorkspace.result;
+        const result = await runAuthenticatedCommand("git", ["fetch"], cwd);
+        return buildTextResult(formatGitSummary("git", "git fetch", result));
+      } catch (error) {
+        return buildErrorResult(error);
+      }
+    },
+  });
+  api.registerTool({
+    name: "github_local_commit",
+    label: "GitHub local commit",
+    description: "Stages all changes and creates a git commit in the workspace.",
+    parameters: Type.Object({
+      message: Type.String({ description: "Commit message passed to `git commit -m`." }),
+    }),
+    async execute(_toolCallId, params) {
+      try {
+        const message = String(params.message ?? "").trim();
+        if (!message) {
+          return buildTextResult("commit message is required");
+        }
+        const cwd = resolveWorkspacePath();
+        const gitWorkspace = requireGitWorkspace(cwd);
+        if (!gitWorkspace.ok) return gitWorkspace.result;
+        const { env } = await resolveWorkspaceAuth(cwd);
+        const addResult = await execCapture("git", ["add", "-A"], cwd, { env });
+        if (addResult.code !== 0) {
+          return buildTextResult(formatGitSummary("git", "git add", addResult));
+        }
+        const commitResult = await execCapture("git", ["commit", "-m", message], cwd, { env });
+        return buildTextResult(formatGitSummary("git", "git commit", commitResult));
+      } catch (error) {
+        return buildErrorResult(error);
+      }
+    },
+  });
+  api.registerTool({
+    name: "github_local_push",
+    label: "GitHub local push",
+    description: "Pushes the current branch to origin using host or fallback auth.",
+    parameters: Type.Object({}),
+    async execute() {
+      try {
+        const cwd = resolveWorkspacePath();
+        const gitWorkspace = requireGitWorkspace(cwd);
+        if (!gitWorkspace.ok) return gitWorkspace.result;
+        const branch = await resolveCurrentBranch(cwd);
+        const args = branch ? ["push", "-u", "origin", branch] : ["push"];
+        const { auth, remoteUrl, platformToken } = await resolveWorkspaceAuth(cwd);
+        const runPush = async (currentAuth) => {
+          const env = await prepareRemoteForAuth(cwd, remoteUrl, currentAuth);
+          return execCapture("git", args, cwd, { env });
+        };
+        let result = await runPush(auth);
+        if (
+          result.code !== 0 &&
+          auth.mode === "native" &&
+          platformToken &&
+          isGitAuthFailure(result.stderr, result.stdout)
+        ) {
+          result = await runPush(buildRetryAuth(platformToken));
+        }
+        return buildTextResult(formatGitSummary("git", "git push", result));
+      } catch (error) {
+        return buildErrorResult(error);
+      }
+    },
+  });
+  api.registerTool({
+    name: "github_local_pr_create",
+    label: "GitHub local PR create",
+    description: "Creates a pull request with `gh pr create` from the current branch.",
+    parameters: Type.Object({
+      title: Type.String({ description: "Pull request title." }),
+      body: Type.String({ description: "Pull request body." }),
+      base: Type.Optional(Type.String({ description: "Optional base branch name." })),
+    }),
+    async execute(_toolCallId, params) {
+      try {
+        const title = String(params.title ?? "").trim();
+        const body = String(params.body ?? "").trim();
+        const base = typeof params.base === "string" ? params.base.trim() : "";
+        if (!title) {
+          return buildTextResult("pull request title is required");
+        }
+        if (!body) {
+          return buildTextResult("pull request body is required");
+        }
+        const cwd = resolveWorkspacePath();
+        const gitWorkspace = requireGitWorkspace(cwd);
+        if (!gitWorkspace.ok) return gitWorkspace.result;
+        const branch = await resolveCurrentBranch(cwd);
+        const args = ["pr", "create", "--title", title, "--body", body];
+        if (base) {
+          args.push("--base", base);
+        }
+        if (branch) {
+          args.push("--head", branch);
+        }
+        const { auth, env, platformToken } = await resolveWorkspaceAuth(cwd);
+        let result = await execCapture("gh", args, cwd, { env });
+        if (
+          result.code !== 0 &&
+          auth.mode === "native" &&
+          platformToken &&
+          isGitAuthFailure(result.stderr, result.stdout)
+        ) {
+          const retryEnv = buildGitGhSubprocessEnv(buildRetryAuth(platformToken), process.env);
+          result = await execCapture("gh", args, cwd, { env: retryEnv });
+        }
+        return buildTextResult(formatGitSummary("gh", "gh pr create", result));
+      } catch (error) {
+        return buildErrorResult(error);
+      }
+    },
+  });
 }
-//# sourceMappingURL=kubbisec-github-local.extension.js.map
+//# sourceMappingURL=kubbisec-github-local.extension.js.map