@rallycry/conveyor-agent 10.13.57 → 10.13.58

package/dist/{boot-37ZX7POR.js → boot-7OPX55AO.js}

@@ -9,14 +9,14 @@ import {
   readAgentVersion,
   redactToken,
   reportBootMilestone
-} from "./chunk-WVUQ5CH5.js";
+} from "./chunk-QZN6HVUY.js";
 import {
   workbenchPort
 } from "./chunk-4VUQ2NPF.js";
 import {
   startWorkbenchServer
-} from "./chunk-MS43QSHO.js";
-import "./chunk-PWYJZY3P.js";
+} from "./chunk-AXA55U4Z.js";
+import "./chunk-NAK6FY5U.js";
 import {
   DEFAULT_WORKBENCH_PORT
 } from "./chunk-JIGG755T.js";
@@ -1316,4 +1316,4 @@ export {
   runBoot,
   workbenchBootSteps
 };
-//# sourceMappingURL=boot-37ZX7POR.js.map
+//# sourceMappingURL=boot-7OPX55AO.js.map

package/dist/{chunk-MS43QSHO.js → chunk-AXA55U4Z.js}

@@ -1,7 +1,7 @@
 import {
   loadPtySpawn,
   terminateProcessGroup
-} from "./chunk-PWYJZY3P.js";
+} from "./chunk-NAK6FY5U.js";
 import {
   FrameReader,
   timingSafeTokenEqual,
@@ -296,4 +296,4 @@ async function runReaddir(socket, req) {
 export {
   startWorkbenchServer
 };
-//# sourceMappingURL=chunk-MS43QSHO.js.map
+//# sourceMappingURL=chunk-AXA55U4Z.js.map

package/dist/{chunk-VIEBOAJ7.js → chunk-HYP7BK2B.js}

@@ -7,7 +7,7 @@ import {
   readAgentVersion,
   registerBootMilestoneSocketFallback,
   reportBootMilestone
-} from "./chunk-WVUQ5CH5.js";
+} from "./chunk-QZN6HVUY.js";
 import {
   LoopLagMonitor,
   buildConveyorSocketOptions,
@@ -30,6 +30,7 @@ import {
   buildPromptBytes,
   buildSpawnArgs,
   cleanTerminalOutput,
+  ghHostsExternallyOwned,
   gitCredentialHelper,
   githubTokenFilePath,
   inheritedEnv,
@@ -53,7 +54,7 @@ import {
   transcriptSize,
   turnOptionsFrom,
   writeGitCredential
-} from "./chunk-PWYJZY3P.js";
+} from "./chunk-NAK6FY5U.js";
 
 // src/setup/bootstrap.ts
 var BOOTSTRAP_TIMEOUT_MS = 3e4;
@@ -1463,24 +1464,43 @@ async function isAuthError(cwd) {
     return errLooksLikeAuth(err);
   }
 }
+function credentialErrorText(err) {
+  const raw = err instanceof Error ? err.message : String(err);
+  return raw.replace(/\/\/[^@\s]+@/g, "//***@");
+}
 async function updateRemoteCredential(cwd, credential) {
+  const result = { ok: false, storeWritten: false, helperConfigured: false };
   try {
     const currentUrl = await git(cwd, ["remote", "get-url", "origin"]);
     const cloneUrl = credential.cloneUrl ?? currentUrl;
-    writeGitCredential(cwd, cloneUrl, credential);
-    if (currentUrl !== cloneUrl) {
-      await git(cwd, ["remote", "set-url", "origin", cloneUrl]);
+    const normalizedUrl = writeGitCredential(cwd, cloneUrl, credential);
+    result.storeWritten = true;
+    if (currentUrl !== normalizedUrl) {
+      await git(cwd, ["remote", "set-url", "origin", normalizedUrl]);
     }
     await git(cwd, ["config", "--local", "credential.helper", gitCredentialHelper(cwd)]);
-  } catch {
+    result.helperConfigured = true;
+    result.ok = true;
+  } catch (err) {
+    result.error = credentialErrorText(err);
   }
+  return result;
 }
 async function updateRemoteToken(cwd, token) {
   const username = process.env.CONVEYOR_GIT_USERNAME || "x-access-token";
   const cloneUrl = process.env.CONVEYOR_GIT_CLONE_URL || void 0;
-  await updateRemoteCredential(cwd, { username, secret: token, cloneUrl });
+  const credential = await updateRemoteCredential(cwd, { username, secret: token, cloneUrl });
   process.env.CONVEYOR_GIT_SECRET = token;
-  syncGithubTokenFiles(token);
+  const files = syncGithubTokenFiles(token);
+  return { credential, files };
+}
+async function verifyGitCredential(cwd) {
+  try {
+    await git(cwd, ["ls-remote", "--heads", "origin"], 3e4);
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: credentialErrorText(err) };
+  }
 }
 function wipRefForBranch(branch) {
   return `conveyor-wip/${branch}`;
@@ -11169,18 +11189,48 @@ function buildRefreshGithubTokenTool(connection, config) {
         const result = await connection.call("refreshGithubToken", {
           sessionId: connection.sessionId
         });
-        await updateRemoteToken(config.workspaceDir, result.token);
+        const written = await updateRemoteToken(config.workspaceDir, result.token);
         process.env.GITHUB_TOKEN = result.token;
         process.env.GH_TOKEN = result.token;
         const tokenFile = githubTokenFilePath();
+        const failures = [];
+        if (!written.credential.storeWritten) {
+          failures.push(
+            `- git credential store NOT written${written.credential.error ? `: ${written.credential.error}` : ""}`
+          );
+        } else if (!written.credential.helperConfigured) {
+          failures.push(
+            `- git credential helper NOT configured${written.credential.error ? `: ${written.credential.error}` : ""}`
+          );
+        }
+        if (!written.files.tokenFile) failures.push(`- token file ${tokenFile} NOT written`);
+        if (!written.files.ghHosts && !ghHostsExternallyOwned()) {
+          failures.push("- gh CLI config NOT written");
+        }
+        const probe = await verifyGitCredential(config.workspaceDir);
+        if (!probe.ok) {
+          failures.push(
+            `- git could not authenticate to origin: ${probe.error ?? "unknown error"}`
+          );
+        }
+        if (failures.length > 0) {
+          return textResult(
+            [
+              probe.ok ? "GitHub token refreshed, but some credential copies did not update." : "GitHub token refresh did NOT produce a working git credential.",
+              ...failures,
+              `A current token is available at ${tokenFile} when that file was written.`,
+              "Do not retry this tool more than once. Report the failing lines above to the team \u2014 the GitHub App install may be missing for this project, or the pod's credential directory may not be writable."
+            ].join("\n")
+          );
+        }
         return textResult(
           [
-            "GitHub token refreshed.",
-            "- git: the credential store is updated, so `git push` works now with no extra step.",
+            "GitHub token refreshed and verified against origin.",
+            "- git: the credential store and helper are updated, so `git push` works now with no extra step.",
             "- gh: the CLI config is updated, so `gh` works now with no extra step.",
             `- shell/scripts: read the current token from ${tokenFile}.`,
             `  For a command that needs it in the environment: GITHUB_TOKEN=$(cat ${tokenFile}) <command>`,
-            "Retry the failed command. If it still returns 401, the GitHub App install may be missing for this project \u2014 report that instead of retrying."
+            "Retry the failed command."
           ].join("\n")
         );
       } catch (error) {
@@ -16148,10 +16198,17 @@ var SessionRunner = class _SessionRunner {
       const res = await this.connection.call("refreshGithubToken", {
         sessionId: this.connection.sessionId
       });
-      await updateRemoteToken(this.config.workspaceDir, res.token);
+      const written = await updateRemoteToken(this.config.workspaceDir, res.token);
       process.env.GITHUB_TOKEN = res.token;
       process.env.GH_TOKEN = res.token;
-      process.stderr.write("[conveyor-agent] Proactively refreshed GitHub token\n");
+      if (written.credential.ok) {
+        process.stderr.write("[conveyor-agent] Proactively refreshed GitHub token\n");
+      } else {
+        process.stderr.write(
+          `[conveyor-agent] Warning: refreshed GitHub token but the git credential did not update: ${written.credential.error ?? "unknown error"}
+`
+        );
+      }
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       process.stderr.write(`[conveyor-agent] Warning: proactive token refresh failed: ${msg}
@@ -16365,4 +16422,4 @@ export {
   loadConveyorConfig,
   unshallowRepo
 };
-//# sourceMappingURL=chunk-VIEBOAJ7.js.map
+//# sourceMappingURL=chunk-HYP7BK2B.js.map