@mrciphersmith/keryx 0.2.101 → 0.2.105

package/dist/cli.js

@@ -1089,6 +1089,8 @@ var init_providers = __esm(() => {
       label: "GitHub Copilot",
       baseUrl: "https://api.githubcopilot.com",
       envKey: "GITHUB_COPILOT_TOKEN",
+      chatPath: "/chat/completions",
+      modelsPath: "/models",
       models: ["gpt-4o", "gpt-4.1", "gpt-4o-mini"],
       note: "Copilot \xB7 device login"
     }
@@ -10264,6 +10266,28 @@ var init_templates3 = __esm(() => {
   init_default_tasks();
 });
 
+// src/lib/git-env.ts
+function withoutGitDiscoveryOverrides(env) {
+  const clean = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (value !== undefined && !GIT_DISCOVERY_OVERRIDE_VARS.includes(key)) {
+      clean[key] = value;
+    }
+  }
+  return clean;
+}
+var GIT_DISCOVERY_OVERRIDE_VARS;
+var init_git_env = __esm(() => {
+  GIT_DISCOVERY_OVERRIDE_VARS = [
+    "GIT_DIR",
+    "GIT_WORK_TREE",
+    "GIT_INDEX_FILE",
+    "GIT_OBJECT_DIRECTORY",
+    "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+    "GIT_COMMON_DIR"
+  ];
+});
+
 // src/metrics/provenance.ts
 async function collectGitProvenance(cwd) {
   const [commit, branch, worktree] = await Promise.all([
@@ -11674,7 +11698,12 @@ function pathExistsSync(filePath) {
   return existsSync11(filePath);
 }
 async function runCommand(command, cwd) {
-  const proc = Bun.spawn(command, { cwd, stdout: "pipe", stderr: "pipe" });
+  const proc = Bun.spawn(command, {
+    cwd,
+    env: withoutGitDiscoveryOverrides(process.env),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(proc.stdout).text(),
     new Response(proc.stderr).text(),
@@ -11837,6 +11866,7 @@ function normalizePath3(file) {
 var IGNORED_DIRS, TEST_FILE_RE2, SOURCE_FILE_RE, CONFIG_FILE_RE, CI_FILE_RE, INSTRUCTION_FILE_RE, IMPORT_RE, DEFAULT_TESTING_CONFIG, BASE_STRATEGIES, BUN_LOCKFILES;
 var init_service2 = __esm(() => {
   init_fs();
+  init_git_env();
   init_lifecycle();
   init_guard2();
   init_capability();
@@ -27377,9 +27407,6 @@ var init_slate_terminal_state = __esm(() => {
 });
 
 // src/commands/agent.ts
-function isDurableToolCall(name, risk) {
-  return risk !== "read" || DURABLE_READ_TOOL_NAMES.has(name);
-}
 function resolveAgentMaxRounds(env = process.env) {
   const raw = env[ENV_AGENT_MAX_ROUNDS];
   if (raw === undefined || raw.trim().length === 0) {
@@ -27995,7 +28022,8 @@ async function runAgentTurnCore(io, deps, history, userLine, options = {}) {
         return {};
       }
       const risk = toolByName.get(call.name)?.definition.risk;
-      if (isDurableToolCall(call.name, risk) && (untrustedContentSeen || batchContainsUntrustedWeb)) {
+      const isPureReadTool = risk === "read" && !DURABLE_READ_TOOL_NAMES.has(call.name);
+      if (!isPureReadTool && (untrustedContentSeen || batchContainsUntrustedWeb)) {
         const result = {
           output: "tool blocked: external web content cannot authorize further tool calls in this turn",
           isError: true
@@ -41137,6 +41165,24 @@ var init_device_code = __esm(() => {
 });
 
 // src/lib/oauth/copilot.ts
+function copilotApiBaseFromExchange(raw) {
+  if (typeof raw !== "string" || raw.length === 0) {
+    return;
+  }
+  try {
+    const url = new URL(raw);
+    if (url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0) {
+      return;
+    }
+    const host = url.hostname;
+    if (host !== "api.githubcopilot.com" && !host.endsWith(".githubcopilot.com")) {
+      return;
+    }
+    return `https://${host}${url.port.length > 0 ? `:${url.port}` : ""}`;
+  } catch {
+    return;
+  }
+}
 function expiresInSecondsFrom(rec, now) {
   if (typeof rec.expires_at === "string") {
     const expires = Date.parse(rec.expires_at);
@@ -41197,7 +41243,12 @@ async function exchangeGithubTokenForCopilot(githubToken, http) {
     throw new DeviceCodeError("failed", "GitHub Copilot token exchange returned no token");
   }
   const expiresInSeconds = expiresInSecondsFrom(rec, Date.now());
-  return { accessToken: rec.token, ...expiresInSeconds !== undefined ? { expiresInSeconds } : {} };
+  const apiBaseUrl = copilotApiBaseFromExchange(rec.endpoints?.api);
+  return {
+    accessToken: rec.token,
+    ...expiresInSeconds !== undefined ? { expiresInSeconds } : {},
+    ...apiBaseUrl !== undefined ? { apiBaseUrl } : {}
+  };
 }
 var COPILOT_TOKEN_URL = "https://api.github.com/copilot_internal/v2/token";
 var init_copilot = __esm(() => {
@@ -41321,6 +41372,9 @@ async function loginRfc8628(input) {
   }, http);
   if (endpoints.afterToken === "github-copilot") {
     const copilot = await exchangeGithubTokenForCopilot(tokens.accessToken, http);
+    if (copilot.apiBaseUrl !== undefined) {
+      saveProviderBaseUrl("github-copilot", copilot.apiBaseUrl, input.dir);
+    }
     return {
       accessToken: copilot.accessToken,
       refreshToken: tokens.accessToken,
@@ -41370,6 +41424,9 @@ async function refreshProviderGrant(provider, http, dir) {
   const endpoints = provider === "github-copilot" ? GITHUB_COPILOT_DEVICE : XAI_GROK_DEVICE;
   if (provider === "github-copilot") {
     const copilot = await exchangeGithubTokenForCopilot(grant.refresh, http);
+    if (copilot.apiBaseUrl !== undefined) {
+      saveProviderBaseUrl("github-copilot", copilot.apiBaseUrl, dir);
+    }
     const next = grantFromTokens("device-code", {
       accessToken: copilot.accessToken,
       refreshToken: grant.refresh,
@@ -41424,6 +41481,7 @@ function logoutProvider(provider, dir) {
 }
 var SESSION_REFRESHED_GRANTS;
 var init_login = __esm(() => {
+  init_shell_config();
   init_catalog();
   init_copilot();
   init_device_code();
@@ -45289,6 +45347,7 @@ init_templates3();
 init_service2();
 
 // src/testing/templates.ts
+init_git_env();
 function renderTestingConfig(input) {
   return `${JSON.stringify({
     schemaVersion: 1,
@@ -45481,6 +45540,11 @@ function renderTestingPrePushHook() {
     return 0
   fi
 
+  # Git exports GIT_DIR to hooks. Inherited by the suite, it redirects every
+  # fixture repo a test creates onto this checkout, so a fixture's
+  # 'git config user.name' rewrites the identity of the repo being pushed.
+  unset ${GIT_DISCOVERY_OVERRIDE_VARS.join(" ")}
+
   if command -v keryx >/dev/null 2>&1; then
     keryx test run --changed --strict
     return $?
@@ -48228,7 +48292,7 @@ import path47 from "path";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.101",
+  version: "0.2.105",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -79525,23 +79589,10 @@ function builtinReadOnlyTools(root) {
 
 // src/harness/tool/builtin/apply-patch-tool.ts
 init_patch_risk();
+init_git_env();
 var MAX_OUTPUT_BYTES = 20000;
-var GIT_DISCOVERY_OVERRIDE_VARS = [
-  "GIT_DIR",
-  "GIT_WORK_TREE",
-  "GIT_INDEX_FILE",
-  "GIT_OBJECT_DIRECTORY",
-  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
-  "GIT_COMMON_DIR"
-];
 function gitDiscoveryCleanEnv() {
-  const env = {};
-  for (const [key, value] of Object.entries(process.env)) {
-    if (value !== undefined && !GIT_DISCOVERY_OVERRIDE_VARS.includes(key)) {
-      env[key] = value;
-    }
-  }
-  return env;
+  return withoutGitDiscoveryOverrides(process.env);
 }
 async function spawnGitApply(args, patch, cwd) {
   try {
@@ -95021,7 +95072,7 @@ function pickAuthMethodStep(otui, r, providerLabel, methods) {
     });
   });
 }
-function runDeviceLoginInTui(otui, r, provider) {
+function runDeviceLoginInTui(otui, r, provider, dir) {
   return new Promise((resolve) => {
     const box = overlayBox(otui, r, "device-login");
     r.root.add(box);
@@ -95049,6 +95100,7 @@ function runDeviceLoginInTui(otui, r, provider) {
       provider,
       fetch: (input, init) => globalThis.fetch(input, init),
       signal: controller.signal,
+      ...dir !== undefined ? { dir } : {},
       onChallenge: (challenge) => {
         status.content = otui.t`${otui.bold(challenge.userCode)}\n${otui.dim(challenge.verificationUri)}\n${otui.dim("Open that URL on any device and enter the code. Waiting for authorization\u2026")}`;
         openVerificationUrl(challenge.verificationUriComplete ?? challenge.verificationUri);
@@ -95165,12 +95217,14 @@ function selectProviderModelInTui(otui, r, detected, options = {}) {
           }
           continue;
         }
-        let selectedBaseUrl = options.onlyConnected || prov.baseUrl === undefined ? prov.baseUrl : await promptBaseUrlStep(otui, r, prov.label ?? prov.name, prov.baseUrl);
-        if (!options.onlyConnected && prov.baseUrl !== undefined && selectedBaseUrl === undefined) {
+        const lockDiscoveredHost = prov.name === "github-copilot";
+        let selectedBaseUrl = options.onlyConnected || prov.baseUrl === undefined || lockDiscoveredHost ? prov.baseUrl : await promptBaseUrlStep(otui, r, prov.label ?? prov.name, prov.baseUrl);
+        if (!options.onlyConnected && !lockDiscoveredHost && prov.baseUrl !== undefined && selectedBaseUrl === undefined) {
           continue;
         }
-        if (!options.onlyConnected && selectedBaseUrl !== undefined)
+        if (!options.onlyConnected && !lockDiscoveredHost && selectedBaseUrl !== undefined) {
           saveProviderBaseUrl(prov.name, selectedBaseUrl, options.configDir);
+        }
         let selectedProvider = selectedBaseUrl === undefined ? prov : { ...prov, baseUrl: selectedBaseUrl };
         const envKey = prov.envKey;
         const label = prov.label ?? prov.name;
@@ -95198,7 +95252,15 @@ function selectProviderModelInTui(otui, r, detected, options = {}) {
             }
           }
           if (method === "device-code") {
-            return await runDeviceLoginInTui(otui, r, prov.name) ? "ok" : "back";
+            if (!await runDeviceLoginInTui(otui, r, prov.name, options.configDir)) {
+              return "back";
+            }
+            const saved = loadShellConfig(options.configDir).baseUrls?.[prov.name];
+            if (typeof saved === "string" && saved.length > 0) {
+              selectedBaseUrl = saved;
+              selectedProvider = { ...prov, baseUrl: saved };
+            }
+            return "ok";
           }
           const kr = await promptApiKeyStep(otui, r, {
             label,

package/dist/core.js

@@ -16331,6 +16331,25 @@ import { existsSync as existsSync7 } from "fs";
 import { mkdir as mkdir21, readFile as readFile29, readdir as readdir10, writeFile as writeFile17 } from "fs/promises";
 import path58 from "path";
 
+// src/lib/git-env.ts
+var GIT_DISCOVERY_OVERRIDE_VARS = [
+  "GIT_DIR",
+  "GIT_WORK_TREE",
+  "GIT_INDEX_FILE",
+  "GIT_OBJECT_DIRECTORY",
+  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+  "GIT_COMMON_DIR"
+];
+function withoutGitDiscoveryOverrides(env) {
+  const clean = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (value !== undefined && !GIT_DISCOVERY_OVERRIDE_VARS.includes(key)) {
+      clean[key] = value;
+    }
+  }
+  return clean;
+}
+
 // src/metrics/lifecycle.ts
 init_fs();
 init_guard();
@@ -17244,7 +17263,12 @@ function pathExistsSync(filePath) {
   return existsSync7(filePath);
 }
 async function runCommand2(command, cwd) {
-  const proc = Bun.spawn(command, { cwd, stdout: "pipe", stderr: "pipe" });
+  const proc = Bun.spawn(command, {
+    cwd,
+    env: withoutGitDiscoveryOverrides(process.env),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(proc.stdout).text(),
     new Response(proc.stderr).text(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.2.101",
+  "version": "0.2.105",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {