@neverquits/nq 0.1.1 → 0.1.3

package/bin/nq.mjs

@@ -102,6 +102,15 @@ async function main() {
     return
   }
 
+  // Invoked by git as a credential helper from inside a workspace clone.
+  // See cli/lib/commands/credential-helper.mjs for the details.
+  if (command === 'credential-helper') {
+    const action = args[1] ?? 'get'
+    const { credentialHelper } = await import('../lib/commands/credential-helper.mjs')
+    await credentialHelper(action)
+    return
+  }
+
   console.error(`  Unknown command: ${command}`)
   console.error('  Run "nq help" for usage.')
   process.exit(1)

package/lib/commands/credential-helper.mjs

@@ -0,0 +1,73 @@
+// Git credential helper. Configured per-repo by `nq pull` so that every
+// `git push` / `git fetch` to github.com transparently mints a fresh
+// installation token via the nq API.
+//
+// Git invokes us with one of {get, store, erase} and pipes a set of
+// key=value lines on stdin (host, protocol, etc.). We only respond to
+// `get`; the others are no-ops since we don't persist anything.
+
+import { execSync } from 'node:child_process'
+import { apiFetch } from '../api.mjs'
+
+export async function credentialHelper(action) {
+  if (action !== 'get') {
+    // store/erase: nothing to do. Drain stdin to keep git happy.
+    await readStdin()
+    return
+  }
+
+  const input = await readStdin()
+  const fields = parseFields(input)
+  if (fields.host !== 'github.com') return
+
+  // The helper is configured per-repo by `nq pull`, which stashes the
+  // identifiers in `.git/config` under the `nq.` namespace.
+  const orgId = readGitConfig('nq.orgId')
+  const agentKey = readGitConfig('nq.agentKey')
+  if (!orgId || !agentKey) {
+    process.stderr.write(
+      '  nq credential-helper: missing nq.orgId / nq.agentKey in .git/config. Re-run `nq pull`.\n',
+    )
+    return
+  }
+
+  const res = await apiFetch('/api/workspace/install-token', {
+    method: 'POST',
+    body: JSON.stringify({ orgId, agentKey }),
+  })
+  if (!res.ok) {
+    process.stderr.write(
+      `  nq credential-helper: install-token request failed (${res.status}).\n`,
+    )
+    return
+  }
+  const { token, username } = await res.json()
+  process.stdout.write(`username=${username ?? 'x-access-token'}\n`)
+  process.stdout.write(`password=${token}\n`)
+}
+
+function parseFields(text) {
+  const out = {}
+  for (const line of text.split('\n')) {
+    const idx = line.indexOf('=')
+    if (idx > 0) out[line.slice(0, idx)] = line.slice(idx + 1)
+  }
+  return out
+}
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let buf = ''
+    process.stdin.setEncoding('utf8')
+    process.stdin.on('data', (chunk) => (buf += chunk))
+    process.stdin.on('end', () => resolve(buf))
+  })
+}
+
+function readGitConfig(key) {
+  try {
+    return execSync(`git config --local ${key}`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+  } catch {
+    return null
+  }
+}

package/lib/commands/pull.mjs

@@ -1,9 +1,13 @@
 import { execSync } from 'node:child_process'
-import { existsSync, writeFileSync, mkdirSync } from 'node:fs'
-import { join, resolve } from 'node:path'
+import { existsSync, writeFileSync } from 'node:fs'
+import { join, resolve, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
 import { apiFetch, getToken } from '../api.mjs'
 import { getApiUrl } from '../config.mjs'
 
+const NQ_BIN = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', 'bin', 'nq.mjs')
+const NODE_BIN = process.execPath
+
 export async function pull(agentKey, options) {
   const orgId = options.org
   if (!orgId) {
@@ -18,27 +22,28 @@ export async function pull(agentKey, options) {
   console.log()
   console.log(`  Pulling workspace: ${orgId}/${agentKey}`)
 
-  // 1. Check if workspace repo exists
-  const res = await apiFetch(`/api/workspace/repos?orgId=${orgId}&agentKey=${agentKey}`)
-
-  if (!res.ok) {
-    console.error(`  Failed to fetch workspace info: ${res.status}`)
+  // Ask the backend for a fresh installation token + the repo identifier.
+  // The token is short-lived; we bake it into the clone URL once and then
+  // configure a credential helper so future pushes/pulls mint a new one.
+  const tokenRes = await apiFetch('/api/workspace/install-token', {
+    method: 'POST',
+    body: JSON.stringify({ orgId, agentKey }),
+  })
+  if (tokenRes.status === 404) {
+    console.error('  No workspace repo found. Has onboarding been completed for this org?')
     process.exit(1)
   }
-
-  const repo = await res.json()
-
-  if (!repo?.repoName) {
-    console.error('  No workspace repo found. Has onboarding been completed for this org?')
+  if (!tokenRes.ok) {
+    console.error(`  Failed to mint install token: ${tokenRes.status}`)
     process.exit(1)
   }
+  const { token, username, githubOrg, repoName } = await tokenRes.json()
 
-  // 2. Clone or pull
   const gitDir = join(dest, '.git')
-  const org = repo.githubOrg ?? process.env.GITHUB_WORKSPACES_ORG
 
   if (existsSync(gitDir)) {
     console.log('  Pulling latest changes...')
+    refreshRemote(dest, username, token, githubOrg, repoName)
     try {
       execSync('git pull --ff-only', { cwd: dest, stdio: 'inherit', timeout: 30_000 })
     } catch {
@@ -46,20 +51,24 @@ export async function pull(agentKey, options) {
       process.exit(1)
     }
   } else {
-    console.log(`  Cloning ${org}/${repo.repoName}...`)
+    console.log(`  Cloning ${githubOrg}/${repoName}...`)
+    const cloneUrl = buildAuthedUrl(username, token, githubOrg, repoName)
     try {
-      execSync(`git clone https://github.com/${org}/${repo.repoName}.git ${dest}`, {
+      execSync(`git clone ${shArg(cloneUrl)} ${shArg(dest)}`, {
         stdio: 'inherit',
         timeout: 60_000,
       })
     } catch {
-      console.error('  Clone failed. Make sure you have git access to the repo.')
-      console.error(`  Try: gh auth login && gh repo clone ${org}/${repo.repoName}`)
+      console.error('  Clone failed.')
       process.exit(1)
     }
+    // Strip the embedded token from the recorded remote so it's not
+    // sitting in plaintext in .git/config indefinitely. We'll rewrite
+    // it with a fresh token on the next pull/push via the helper.
+    setRemote(dest, `https://github.com/${githubOrg}/${repoName}.git`)
+    configureCredentialHelper(dest, orgId, agentKey)
   }
 
-  // 3. Write .mcp.json if we have a session
   if (sessionId) {
     writeMcpJson(dest, orgId, agentKey, sessionId)
     console.log('  Wrote .mcp.json')
@@ -70,6 +79,7 @@ export async function pull(agentKey, options) {
 
   console.log()
   console.log(`  Done. Workspace at: ${dest}`)
+  console.log('  You can `git push` from here at any time — no GitHub login needed.')
   console.log()
 
   if (sessionId) {
@@ -78,6 +88,46 @@ export async function pull(agentKey, options) {
   }
 }
 
+function buildAuthedUrl(username, token, githubOrg, repoName) {
+  const user = encodeURIComponent(username ?? 'x-access-token')
+  const pass = encodeURIComponent(token)
+  return `https://${user}:${pass}@github.com/${githubOrg}/${repoName}.git`
+}
+
+function refreshRemote(dest, username, token, githubOrg, repoName) {
+  const url = buildAuthedUrl(username, token, githubOrg, repoName)
+  execSync(`git remote set-url origin ${shArg(url)}`, { cwd: dest, stdio: 'ignore' })
+}
+
+function setRemote(dest, url) {
+  execSync(`git remote set-url origin ${shArg(url)}`, { cwd: dest, stdio: 'ignore' })
+}
+
+function configureCredentialHelper(dest, orgId, agentKey) {
+  // The helper is invoked by git during a github.com auth challenge.
+  // We point at the *absolute* path of this nq install (node binary +
+  // bin/nq.mjs) so the helper works regardless of whether `nq` is on
+  // the user's PATH — e.g. when they invoked us via `npx`.
+  const helperCmd = `${shArg(NODE_BIN)} ${shArg(NQ_BIN)} credential-helper`
+  const cmds = [
+    ['nq.orgId', orgId],
+    ['nq.agentKey', agentKey],
+    // Per-host helper, applied only inside this repo via --local config.
+    // The '!' prefix tells git to run it as a shell command.
+    ['credential.https://github.com.helper', `!${helperCmd}`],
+  ]
+  for (const [k, v] of cmds) {
+    execSync(`git config --local ${shArg(k)} ${shArg(v)}`, {
+      cwd: dest,
+      stdio: 'ignore',
+    })
+  }
+}
+
+function shArg(s) {
+  return `'${String(s).replace(/'/g, `'\\''`)}'`
+}
+
 function writeMcpJson(dest, orgId, agentKey, sessionId) {
   const apiUrl = getApiUrl()
   const token = getToken()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neverquits/nq",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "NeverQuits CLI — workspace setup for AI agent operators",
   "type": "module",
   "bin": {