@mastra/github-signals 0.5.0-alpha.0 → 0.5.0

package/dist/github-app-owner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-app-owner.d.ts","sourceRoot":"","sources":["../src/github-app-owner.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,cAAc,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAqBnG,qBAAa,sBAAsB;;IAIjC,YAAY,QAAQ,GAAE,2BAA6C,EAElE;IAEK,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CA2BzG;CAWF"}
+{"version":3,"file":"github-app-owner.d.ts","sourceRoot":"","sources":["../src/github-app-owner.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,cAAc,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAyBnG,qBAAa,sBAAsB;;IAIjC,YAAY,QAAQ,GAAE,2BAA6C,EAElE;IAEK,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CA2BzG;CAWF"}

package/dist/github-auth-env.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Resolve a GitHub credential from the global `gh` CLI and return an environment
+ * that presents it to a child process.
+ *
+ * gitcrawl takes the first non-empty value of the environment variable named by
+ * `[github].token_env` (default `GITHUB_TOKEN`) and only discovers it is invalid
+ * when GitHub rejects it, so a stale exported token fails `sync` outright even
+ * when `gh` can still mint a working credential. Injecting a credential here
+ * makes gitcrawl's own env lookup win, so the stale value is never consulted.
+ *
+ * `gh auth token` is asked with the token variables removed: `gh` answers with
+ * `GH_TOKEN`/`GITHUB_TOKEN` verbatim when either is set, which would hand back
+ * the very credential being replaced.
+ *
+ * Returns `undefined` when no credential can be resolved, so callers leave the
+ * inherited environment untouched rather than stripping a working token.
+ */
+export declare function resolveGithubAuthEnv(): Promise<NodeJS.ProcessEnv | undefined>;
+//# sourceMappingURL=github-auth-env.d.ts.map

package/dist/github-auth-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-auth-env.d.ts","sourceRoot":"","sources":["../src/github-auth-env.ts"],"names":[],"mappings":"AA0BA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC,CAqBnF"}

package/dist/index.cjs

@@ -30,6 +30,54 @@ let _mastra_core_signals = require("@mastra/core/signals");
 let _mastra_core_tools = require("@mastra/core/tools");
 let zod = require("zod");
 zod = __toESM(zod, 1);
+//#region src/github-auth-env.ts
+let execFileAsync$2;
+/** Environment variables both gitcrawl and the `gh` CLI treat as a GitHub credential. */
+const GITHUB_TOKEN_ENV_VARS = ["GH_TOKEN", "GITHUB_TOKEN"];
+/** Remove every casing of the token variables: Windows treats environment names case-insensitively. */
+function withoutGithubTokens(env) {
+	const scrubbed = { ...env };
+	for (const name of Object.keys(scrubbed)) if (GITHUB_TOKEN_ENV_VARS.some((tokenEnv) => tokenEnv.toLowerCase() === name.toLowerCase())) delete scrubbed[name];
+	return scrubbed;
+}
+/**
+* Resolve a GitHub credential from the global `gh` CLI and return an environment
+* that presents it to a child process.
+*
+* gitcrawl takes the first non-empty value of the environment variable named by
+* `[github].token_env` (default `GITHUB_TOKEN`) and only discovers it is invalid
+* when GitHub rejects it, so a stale exported token fails `sync` outright even
+* when `gh` can still mint a working credential. Injecting a credential here
+* makes gitcrawl's own env lookup win, so the stale value is never consulted.
+*
+* `gh auth token` is asked with the token variables removed: `gh` answers with
+* `GH_TOKEN`/`GITHUB_TOKEN` verbatim when either is set, which would hand back
+* the very credential being replaced.
+*
+* Returns `undefined` when no credential can be resolved, so callers leave the
+* inherited environment untouched rather than stripping a working token.
+*/
+async function resolveGithubAuthEnv() {
+	const scrubbed = withoutGithubTokens(process.env);
+	if (!execFileAsync$2) {
+		const { execFile } = await import("child_process");
+		execFileAsync$2 = (0, util.promisify)(execFile);
+	}
+	let token;
+	try {
+		const { stdout } = await execFileAsync$2("gh", ["auth", "token"], { env: scrubbed });
+		token = stdout.trim();
+	} catch {
+		return;
+	}
+	if (!token) return void 0;
+	return {
+		...process.env,
+		GH_TOKEN: token,
+		GITHUB_TOKEN: token
+	};
+}
+//#endregion
 //#region src/github-app-owner.ts
 const OWNER_CACHE_TTL_MS = 1440 * 60 * 1e3;
 let execFileAsync$1;
@@ -38,7 +86,7 @@ const defaultRunGhApi = async (args) => {
 		const { execFile } = await import("child_process");
 		execFileAsync$1 = (0, util.promisify)(execFile);
 	}
-	return execFileAsync$1("gh", args);
+	return execFileAsync$1("gh", args, { env: await resolveGithubAuthEnv() });
 };
 var GithubAppOwnerResolver = class {
 	#cache = /* @__PURE__ */ new Map();
@@ -660,7 +708,8 @@ var GitcrawlSyncClient = class {
 			const { stdout, stderr } = await execFileAsync(this.#command, args, {
 				cwd: input.cwd,
 				signal: input.abortSignal,
-				maxBuffer: 10 * 1024 * 1024
+				maxBuffer: 10 * 1024 * 1024,
+				env: await resolveGithubAuthEnv()
 			});
 			return {
 				ok: true,
@@ -1554,7 +1603,7 @@ var GithubSignals = class extends _mastra_core_signals.SignalProvider {
 					`repos/${owner}/${repo}/collaborators/${user}/permission`,
 					"--jq",
 					".permission"
-				]);
+				], { env: await resolveGithubAuthEnv() });
 				const raw = stdout.trim();
 				permission = [
 					"admin",