@saeed42/worktree-worker 1.4.0 → 1.5.0

package/dist/main.js

@@ -466,6 +466,48 @@ var GitService = class {
     const result = await this.exec(["remote", "get-url", remote], cwd);
     return result.code === 0 ? result.stdout.trim() : null;
   }
+  /**
+   * Configure git credential helper with token (temporary, for operations like worktree add)
+   * SECURITY: Token is stored in /tmp and should be cleared after operation
+   */
+  async configureCredentials(githubToken) {
+    const log = logger.child({ service: "git", operation: "configureCredentials" });
+    log.debug("Configuring git credentials");
+    await this.exec(["config", "--global", "credential.helper", "store --file=/tmp/.git-credentials"]);
+    await this.exec(["config", "--global", "core.askPass", ""]);
+    const { writeFile: writeFile2 } = await import("fs/promises");
+    const credLine = `https://x-access-token:${githubToken}@github.com
+`;
+    await writeFile2("/tmp/.git-credentials", credLine, { mode: 384 });
+    log.debug("Git credentials configured");
+  }
+  /**
+   * Clear git credentials (call after operations complete)
+   */
+  async clearCredentials() {
+    const log = logger.child({ service: "git", operation: "clearCredentials" });
+    log.debug("Clearing git credentials");
+    const { unlink: unlink2 } = await import("fs/promises");
+    try {
+      await unlink2("/tmp/.git-credentials");
+    } catch {
+    }
+    await this.exec(["config", "--global", "--unset", "credential.helper"]).catch(() => {
+    });
+    log.debug("Git credentials cleared");
+  }
+  /**
+   * Run an operation with temporary credentials
+   * SECURITY: Credentials are cleared after operation completes (success or failure)
+   */
+  async withCredentials(githubToken, operation) {
+    await this.configureCredentials(githubToken);
+    try {
+      return await operation();
+    } finally {
+      await this.clearCredentials();
+    }
+  }
 };
 var gitService = new GitService();
 
@@ -1016,13 +1058,24 @@ var WorktreeService = class {
     await gitService.pruneWorktrees(baseRepoDir);
     const localBranchExists = await gitService.branchExists(branchName, baseRepoDir);
     const remoteBranchExists = await gitService.branchExists(`origin/${branchName}`, baseRepoDir);
+    const createWorktreeWithCreds = async (operation) => {
+      if (options.githubToken) {
+        await gitService.withCredentials(options.githubToken, operation);
+      } else {
+        await operation();
+      }
+    };
     if (localBranchExists) {
       log.info("Creating worktree from existing local branch", { branchName });
-      await gitService.execOrThrow(["worktree", "add", worktreePath, branchName], baseRepoDir);
+      await createWorktreeWithCreds(async () => {
+        await gitService.execOrThrow(["worktree", "add", worktreePath, branchName], baseRepoDir);
+      });
     } else if (remoteBranchExists) {
       log.info("Creating worktree from remote branch", { branchName });
-      await gitService.exec(["fetch", "origin", `${branchName}:${branchName}`], baseRepoDir);
-      await gitService.execOrThrow(["worktree", "add", worktreePath, branchName], baseRepoDir);
+      await createWorktreeWithCreds(async () => {
+        await gitService.exec(["fetch", "origin", `${branchName}:${branchName}`], baseRepoDir);
+        await gitService.execOrThrow(["worktree", "add", worktreePath, branchName], baseRepoDir);
+      });
     } else {
       let baseRef = `origin/${baseBranch}`;
       const baseBranchExistsOnRemote = await gitService.branchExists(baseRef, baseRepoDir);
@@ -1058,7 +1111,9 @@ var WorktreeService = class {
         }
       }
       log.info("Creating worktree with new branch from base", { baseRef, branchName });
-      await gitService.addWorktreeWithNewBranch(worktreePath, branchName, baseRef, baseRepoDir);
+      await createWorktreeWithCreds(async () => {
+        await gitService.addWorktreeWithNewBranch(worktreePath, branchName, baseRef, baseRepoDir);
+      });
     }
     await gitService.exec(["config", "--local", "user.name", "origin-agent[bot]"], worktreePath).catch(() => {
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saeed42/worktree-worker",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Git worktree management service for AI agent trials",
   "type": "module",
   "main": "dist/main.js",