@ricsam/r5d-worker 0.0.32 → 0.0.33

package/README.md

@@ -15,6 +15,8 @@ The worker uses the existing `r5dctl` config file and accepts `R5D_WORKER_TOKEN`
 
 Web shells and agent shell commands receive a server-issued `r5dctl` credential automatically. The credential is scoped to the signed-in user and revoked when the shell or command finishes, so commands such as `r5dctl auth status` do not require a separate login on the worker host.
 
+When the user has signed in with GitHub, web shells and agent commands also receive that OAuth credential through `GH_TOKEN`. GitHub CLI commands such as `gh pr`, `gh issue`, and `gh workflow` therefore use the signed-in user's permissions without a separate `gh auth login` on the worker host. Signing in again refreshes the granted OAuth scopes for subsequently started commands and shells.
+
 Visible branch checkouts are the user/agent workbench. Their `origin` remains the connected GitHub repository for manual Git work. r5d internal sync git metadata lives separately under `~/.r5d/sync`; when a worker connects, every idle registered branch is force-synchronized from that internal remote. The same destructive sync can be requested for a live worker from User Settings.
 
 Worker labels are mandatory and unique per user. Choose labels that describe host capabilities, such as `macos`, `linux`, `ios`, or `ec2-build`.

package/dist/cjs/main.cjs

@@ -32,6 +32,7 @@ __export(main_exports, {
   ensureVisibleGitCheckout: () => ensureVisibleGitCheckout,
   findRepositorySyncBlockers: () => findRepositorySyncBlockers,
   findWorkerFiles: () => findWorkerFiles,
+  githubCliEnv: () => githubCliEnv,
   grepWorkerFiles: () => grepWorkerFiles,
   isArtifactEnvPath: () => isArtifactEnvPath,
   listWorkerDirectory: () => listWorkerDirectory,
@@ -72,7 +73,7 @@ const activeProcesses = /* @__PURE__ */ new Map();
 const cancelledProcessRuns = /* @__PURE__ */ new Set();
 const activePtys = /* @__PURE__ */ new Map();
 let currentWorkerSocket = null;
-let containerRegistryCredential = null;
+let githubCredential = null;
 let visibleGitIdentity = null;
 function defaultConfigPath() {
   return import_node_path.default.join(import_node_os.default.homedir(), ".config", "r5d", "r5dctl", "config.json");
@@ -928,8 +929,8 @@ function writeRegistryAuthFile(filePath, credential) {
   const auths = existingAuths;
   auths[credential.registry] = {
     username: credential.username,
-    password: credential.password,
-    auth: Buffer.from(`${credential.username}:${credential.password}`).toString("base64")
+    password: credential.token,
+    auth: Buffer.from(`${credential.username}:${credential.token}`).toString("base64")
   };
   config.auths = auths;
   import_node_fs.default.mkdirSync(import_node_path.default.dirname(filePath), { recursive: true });
@@ -937,8 +938,8 @@ function writeRegistryAuthFile(filePath, credential) {
 `, { mode: 384 });
   import_node_fs.default.chmodSync(filePath, 384);
 }
-function configureContainerRegistryAuth(credential) {
-  containerRegistryCredential = credential;
+function configureGitHubAuth(credential) {
+  githubCredential = credential;
   if (!credential) {
     return;
   }
@@ -946,25 +947,41 @@ function configureContainerRegistryAuth(credential) {
   writeRegistryAuthFile(containersAuthPath(), credential);
   if (credential.missingScopes.length > 0) {
     process.stderr.write(
-      `[r5d-worker] GitHub token is missing GHCR scope(s): ${credential.missingScopes.join(", ")}. Sign in with GitHub again if GHCR push/pull fails.
+      `[r5d-worker] GitHub token is missing scope(s): ${credential.missingScopes.join(", ")}. Sign in with GitHub again if gh or GHCR access fails.
 `
     );
   } else {
-    process.stdout.write(`[r5d-worker] configured GHCR auth for ${credential.username}
+    process.stdout.write(`[r5d-worker] configured GitHub CLI and GHCR auth for ${credential.username}
 `);
   }
 }
 function containerRegistryEnv() {
-  if (!containerRegistryCredential) {
+  if (!githubCredential) {
     return {};
   }
   return {
-    R5D_GHCR_REGISTRY: containerRegistryCredential.registry,
-    R5D_GHCR_NAMESPACE: containerRegistryCredential.username,
+    R5D_GHCR_REGISTRY: githubCredential.registry,
+    R5D_GHCR_NAMESPACE: githubCredential.username,
     R5D_GHCR_AUTH_FILE: containersAuthPath(),
     REGISTRY_AUTH_FILE: containersAuthPath(),
-    GHCR_REGISTRY: containerRegistryCredential.registry,
-    GHCR_NAMESPACE: containerRegistryCredential.username
+    GHCR_REGISTRY: githubCredential.registry,
+    GHCR_NAMESPACE: githubCredential.username
+  };
+}
+function githubCliEnv(token) {
+  if (!token) {
+    return {};
+  }
+  return {
+    GH_TOKEN: token,
+    GH_HOST: "github.com",
+    GH_PROMPT_DISABLED: "1"
+  };
+}
+function githubProcessEnv() {
+  return {
+    ...containerRegistryEnv(),
+    ...githubCliEnv(githubCredential?.token)
   };
 }
 function checkoutVisibleBranch(input) {
@@ -1910,7 +1927,7 @@ async function executeCommand(input) {
       detached: true,
       env: {
         ...process.env,
-        ...containerRegistryEnv(),
+        ...githubProcessEnv(),
         ...input.message.env ?? {},
         ...internalGitProcessEnv(workspace, input.message.env),
         ...artifactProcessEnv,
@@ -2015,7 +2032,7 @@ async function executeStreamingCommand(input) {
       detached: true,
       env: {
         ...process.env,
-        ...containerRegistryEnv(),
+        ...githubProcessEnv(),
         ...input.message.env ?? {},
         ...internalGitProcessEnv(workspace, input.message.env),
         ...artifactProcessEnv,
@@ -2346,7 +2363,7 @@ async function openPty(input) {
         cwd: branchPath.branchPath,
         env: {
           ...process.env,
-          ...containerRegistryEnv(),
+          ...githubProcessEnv(),
           ...input.message.env ?? {},
           ...planProcessEnv,
           R5D_PROJECT_ID: input.projectId,
@@ -2530,7 +2547,7 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "project_manifest") {
-        configureContainerRegistryAuth(message.githubContainerRegistry);
+        configureGitHubAuth(message.githubCredential);
         visibleGitIdentity = message.gitIdentity;
         manifestByProjectId.clear();
         for (const project of message.projects) {
@@ -2920,6 +2937,7 @@ if (isCliEntrypoint()) {
   ensureVisibleGitCheckout,
   findRepositorySyncBlockers,
   findWorkerFiles,
+  githubCliEnv,
   grepWorkerFiles,
   isArtifactEnvPath,
   listWorkerDirectory,

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.32",
+  "version": "0.0.33",
   "type": "commonjs"
 }

package/dist/mjs/main.mjs

@@ -23,7 +23,7 @@ const activeProcesses = /* @__PURE__ */ new Map();
 const cancelledProcessRuns = /* @__PURE__ */ new Set();
 const activePtys = /* @__PURE__ */ new Map();
 let currentWorkerSocket = null;
-let containerRegistryCredential = null;
+let githubCredential = null;
 let visibleGitIdentity = null;
 function defaultConfigPath() {
   return path.join(os.homedir(), ".config", "r5d", "r5dctl", "config.json");
@@ -879,8 +879,8 @@ function writeRegistryAuthFile(filePath, credential) {
   const auths = existingAuths;
   auths[credential.registry] = {
     username: credential.username,
-    password: credential.password,
-    auth: Buffer.from(`${credential.username}:${credential.password}`).toString("base64")
+    password: credential.token,
+    auth: Buffer.from(`${credential.username}:${credential.token}`).toString("base64")
   };
   config.auths = auths;
   fs.mkdirSync(path.dirname(filePath), { recursive: true });
@@ -888,8 +888,8 @@ function writeRegistryAuthFile(filePath, credential) {
 `, { mode: 384 });
   fs.chmodSync(filePath, 384);
 }
-function configureContainerRegistryAuth(credential) {
-  containerRegistryCredential = credential;
+function configureGitHubAuth(credential) {
+  githubCredential = credential;
   if (!credential) {
     return;
   }
@@ -897,25 +897,41 @@ function configureContainerRegistryAuth(credential) {
   writeRegistryAuthFile(containersAuthPath(), credential);
   if (credential.missingScopes.length > 0) {
     process.stderr.write(
-      `[r5d-worker] GitHub token is missing GHCR scope(s): ${credential.missingScopes.join(", ")}. Sign in with GitHub again if GHCR push/pull fails.
+      `[r5d-worker] GitHub token is missing scope(s): ${credential.missingScopes.join(", ")}. Sign in with GitHub again if gh or GHCR access fails.
 `
     );
   } else {
-    process.stdout.write(`[r5d-worker] configured GHCR auth for ${credential.username}
+    process.stdout.write(`[r5d-worker] configured GitHub CLI and GHCR auth for ${credential.username}
 `);
   }
 }
 function containerRegistryEnv() {
-  if (!containerRegistryCredential) {
+  if (!githubCredential) {
     return {};
   }
   return {
-    R5D_GHCR_REGISTRY: containerRegistryCredential.registry,
-    R5D_GHCR_NAMESPACE: containerRegistryCredential.username,
+    R5D_GHCR_REGISTRY: githubCredential.registry,
+    R5D_GHCR_NAMESPACE: githubCredential.username,
     R5D_GHCR_AUTH_FILE: containersAuthPath(),
     REGISTRY_AUTH_FILE: containersAuthPath(),
-    GHCR_REGISTRY: containerRegistryCredential.registry,
-    GHCR_NAMESPACE: containerRegistryCredential.username
+    GHCR_REGISTRY: githubCredential.registry,
+    GHCR_NAMESPACE: githubCredential.username
+  };
+}
+function githubCliEnv(token) {
+  if (!token) {
+    return {};
+  }
+  return {
+    GH_TOKEN: token,
+    GH_HOST: "github.com",
+    GH_PROMPT_DISABLED: "1"
+  };
+}
+function githubProcessEnv() {
+  return {
+    ...containerRegistryEnv(),
+    ...githubCliEnv(githubCredential?.token)
   };
 }
 function checkoutVisibleBranch(input) {
@@ -1861,7 +1877,7 @@ async function executeCommand(input) {
       detached: true,
       env: {
         ...process.env,
-        ...containerRegistryEnv(),
+        ...githubProcessEnv(),
         ...input.message.env ?? {},
         ...internalGitProcessEnv(workspace, input.message.env),
         ...artifactProcessEnv,
@@ -1966,7 +1982,7 @@ async function executeStreamingCommand(input) {
       detached: true,
       env: {
         ...process.env,
-        ...containerRegistryEnv(),
+        ...githubProcessEnv(),
         ...input.message.env ?? {},
         ...internalGitProcessEnv(workspace, input.message.env),
         ...artifactProcessEnv,
@@ -2297,7 +2313,7 @@ async function openPty(input) {
         cwd: branchPath.branchPath,
         env: {
           ...process.env,
-          ...containerRegistryEnv(),
+          ...githubProcessEnv(),
           ...input.message.env ?? {},
           ...planProcessEnv,
           R5D_PROJECT_ID: input.projectId,
@@ -2481,7 +2497,7 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "project_manifest") {
-        configureContainerRegistryAuth(message.githubContainerRegistry);
+        configureGitHubAuth(message.githubCredential);
         visibleGitIdentity = message.gitIdentity;
         manifestByProjectId.clear();
         for (const project of message.projects) {
@@ -2870,6 +2886,7 @@ export {
   ensureVisibleGitCheckout,
   findRepositorySyncBlockers,
   findWorkerFiles,
+  githubCliEnv,
   grepWorkerFiles,
   isArtifactEnvPath,
   listWorkerDirectory,

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.32",
+  "version": "0.0.33",
   "type": "module"
 }

package/dist/types/main.d.ts

@@ -119,6 +119,7 @@ export declare function resolveWorkerFilePath(branchPath: string, inputPath: str
 export declare function resolveProjectFilePath(branchPath: string, inputPath: string): Extract<ResolvedWorkerFilePath, {
     scope: "project";
 }>;
+export declare function githubCliEnv(token: string | null | undefined): Record<string, string>;
 export declare function ensureVisibleGitCheckout(input: {
     projectRoot: string;
     branchName: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.32",
+  "version": "0.0.33",
   "type": "module",
   "main": "./dist/cjs/main.cjs",
   "module": "./dist/mjs/main.mjs",