@sideboard-ai/core 0.1.89 → 0.1.95

package/dist/{chunk-ZXYWWSHZ.js → chunk-R7BQBSDT.js}

@@ -20,8 +20,8 @@ import {
 } from "./chunk-3KETJKYA.js";
 
 // src/git/worktree.ts
-import { existsSync, readdirSync } from "fs";
-import { join } from "path";
+import { existsSync as existsSync2, readdirSync } from "fs";
+import { join as join2 } from "path";
 
 // src/git/team-meta.ts
 var SOCCER_TEAM_META = {
@@ -898,13 +898,96 @@ function formatMergePrError(raw) {
   return extractGhErrorDetail(trimmed) || trimmed;
 }
 
+// src/git/git-auth-mode.ts
+import { isAbsolute } from "path";
+
+// src/git/github-agent-auth.ts
+import { chmodSync, existsSync, mkdirSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+function githubAgentAuthDir() {
+  const override = process.env.SIDEBOARD_GIT_AUTH_DIR?.trim();
+  if (override) return override;
+  return join(homedir(), ".sideboard-git-auth");
+}
+function githubCredentialStorePath() {
+  return join(githubAgentAuthDir(), "git-credentials");
+}
+function githubGhConfigDir() {
+  return join(githubAgentAuthDir(), "gh");
+}
+function writePrivateFile(file, body) {
+  mkdirSync(dirname(file), { recursive: true, mode: 448 });
+  try {
+    chmodSync(dirname(file), 448);
+  } catch {
+  }
+  writeFileSync(file, body, { encoding: "utf8", mode: 384 });
+  try {
+    chmodSync(file, 384);
+  } catch {
+  }
+}
+function gitCredentialStoreContents(token) {
+  return `https://x-access-token:${encodeURIComponent(token)}@github.com
+`;
+}
+function ghHostsYml(token, user = "x-access-token") {
+  const u = user.replace(/[^A-Za-z0-9._-]/g, "") || "x-access-token";
+  return [
+    "github.com:",
+    "    git_protocol: https",
+    `    user: ${u}`,
+    `    oauth_token: ${token}`,
+    "    users:",
+    `        ${u}:`,
+    `            oauth_token: ${token}`,
+    ""
+  ].join("\n");
+}
+function materializeGithubAgentAuth(token, user) {
+  const trimmed = token.trim();
+  if (!trimmed) return;
+  const root = githubAgentAuthDir();
+  mkdirSync(root, { recursive: true, mode: 448 });
+  try {
+    chmodSync(root, 448);
+  } catch {
+  }
+  writePrivateFile(githubCredentialStorePath(), gitCredentialStoreContents(trimmed));
+  const ghDir = githubGhConfigDir();
+  mkdirSync(ghDir, { recursive: true, mode: 448 });
+  writePrivateFile(join(ghDir, "hosts.yml"), ghHostsYml(trimmed, user));
+  writePrivateFile(join(ghDir, "config.yml"), "git_protocol: https\nprompt: disabled\n");
+}
+function githubAgentAuthReady() {
+  return existsSync(githubCredentialStorePath()) && existsSync(join(githubGhConfigDir(), "hosts.yml"));
+}
+function githubCredentialHelperGitConfig() {
+  const file = githubCredentialStorePath();
+  return [
+    { key: "credential.helper", value: "" },
+    { key: "credential.helper", value: `store --file=${file}` }
+  ];
+}
+function githubGhConfigEnv() {
+  return {
+    GH_CONFIG_DIR: githubGhConfigDir(),
+    GH_PROMPT_DISABLED: "1"
+  };
+}
+
 // src/git/git-auth-mode.ts
 var HTTPS_REWRITE = [
   { key: "url.https://github.com/.insteadOf", value: "git@github.com:" },
-  { key: "url.https://github.com/.insteadOf", value: "ssh://git@github.com/" },
-  // Empty helper disables ~/.gitconfig osxkeychain so GUI agents cannot pop
-  // "git-credential-osxkeychain wants to use the keychain".
-  { key: "credential.helper", value: "" }
+  { key: "url.https://github.com/.insteadOf", value: "ssh://git@github.com/" }
+];
+var TOKEN_TTL_MS = 12 * 60 * 60 * 1e3;
+var tokenMemo = null;
+var GITHUB_CHILD_TOKEN_KEYS = [
+  "GH_TOKEN",
+  "GITHUB_TOKEN",
+  "GH_ENTERPRISE_TOKEN"
 ];
 function nonInteractiveGitProcessEnv() {
   return {
@@ -929,42 +1012,43 @@ function appendIndexedGitConfig(existing, entries) {
   return out;
 }
 function githubAgentGitEnv(existing) {
-  return appendIndexedGitConfig(existing, HTTPS_REWRITE);
-}
-function githubHttpsBearerEnv(existing, token) {
-  const rewrite = githubAgentGitEnv(existing);
-  const header = appendIndexedGitConfig(
-    { ...existing, ...rewrite },
-    [
-      {
-        key: "http.https://github.com/.extraHeader",
-        value: `AUTHORIZATION: bearer ${token}`
-      }
-    ]
-  );
-  return { ...rewrite, ...header };
+  const helpers = githubAgentAuthReady() ? githubCredentialHelperGitConfig() : [{ key: "credential.helper", value: "" }];
+  return appendIndexedGitConfig(existing, [...HTTPS_REWRITE, ...helpers]);
 }
 function applyGithubGitAuthEnv(existing, opts) {
   const out = { ...nonInteractiveGitProcessEnv() };
+  const token = opts.token?.trim() || existing?.GH_TOKEN?.trim() || "" || "";
+  if (token) materializeGithubAgentAuth(token);
+  Object.assign(out, githubGhConfigEnv());
   if (opts.mode === "ssh") return out;
-  const existingToken = existing?.GH_TOKEN?.trim() || "";
-  const provided = existingToken ? "" : opts.token?.trim() || "";
-  const token = existingToken || provided;
-  Object.assign(
-    out,
-    token ? githubHttpsBearerEnv(existing, token) : githubAgentGitEnv(existing)
-  );
-  if (provided) out.GH_TOKEN = provided;
+  Object.assign(out, githubAgentGitEnv(existing));
   return out;
 }
+function scrubGithubTokensFromChildEnv(env) {
+  for (const key of GITHUB_CHILD_TOKEN_KEYS) {
+    delete env[key];
+  }
+}
+function mergeAgentGitAuthEnv(env, gitEnv) {
+  Object.assign(env, gitEnv);
+  scrubGithubTokensFromChildEnv(env);
+}
 async function resolveGithubAgentToken(mode, cwd) {
-  if (mode === "ssh") return null;
-  if (mode === "token") return getGithubPat();
-  try {
-    return await resolveGhAuthToken(cwd);
-  } catch {
-    return null;
+  if (tokenMemo && tokenMemo.mode === mode && Date.now() - tokenMemo.at < TOKEN_TTL_MS) {
+    return tokenMemo.value;
   }
+  let value = null;
+  if (mode === "token") {
+    value = getGithubPat();
+  } else {
+    try {
+      value = await resolveGhAuthToken(cwd);
+    } catch {
+      value = null;
+    }
+  }
+  tokenMemo = { mode, value, at: Date.now() };
+  return value;
 }
 async function resolveAgentGitAuthEnv(existing, opts) {
   let mode = "auto";
@@ -986,7 +1070,40 @@ async function resolveAgentGitAuthEnv(existing, opts) {
   }
   return applyGithubGitAuthEnv(existing, { mode, token });
 }
-function codexUnattendedGitConfigArgs(sandbox) {
+async function warmGithubAgentAuth(opts) {
+  if (!opts?.force && githubAgentAuthReady()) return;
+  await resolveAgentGitAuthEnv(void 0, opts);
+}
+function normalizeWritableRoot(raw) {
+  const trimmed = raw.trim().replace(/\/+$/, "");
+  return trimmed && isAbsolute(trimmed) ? trimmed : null;
+}
+async function resolveCodexGitWritableRoots(cwd) {
+  const roots = /* @__PURE__ */ new Set();
+  const authDir = normalizeWritableRoot(githubAgentAuthDir());
+  if (authDir) roots.add(authDir);
+  try {
+    const [gitDir, commonDir] = await Promise.all([
+      git(["rev-parse", "--absolute-git-dir"], cwd, { reject: false, timeoutMs: 5e3 }),
+      git(["rev-parse", "--path-format=absolute", "--git-common-dir"], cwd, {
+        reject: false,
+        timeoutMs: 5e3
+      })
+    ]);
+    const gitDirPath = gitDir.exitCode === 0 ? normalizeWritableRoot(gitDir.stdout) : null;
+    const commonPath = commonDir.exitCode === 0 ? normalizeWritableRoot(commonDir.stdout) : null;
+    if (gitDirPath) roots.add(gitDirPath);
+    if (commonPath) roots.add(commonPath);
+  } catch {
+  }
+  return [...roots];
+}
+function codexSandboxWritableRootsArgs(roots) {
+  const abs = [...new Set(roots.map(normalizeWritableRoot).filter(Boolean))];
+  if (abs.length === 0) return [];
+  return ["-c", `sandbox_workspace_write.writable_roots=${JSON.stringify(abs)}`];
+}
+function codexUnattendedGitConfigArgs(sandbox, opts) {
   const args = [
     "-c",
     'shell_environment_policy.inherit="all"',
@@ -995,39 +1112,44 @@ function codexUnattendedGitConfigArgs(sandbox) {
   ];
   if (sandbox === "workspace-write") {
     args.push("-c", "sandbox_workspace_write.network_access=true");
+    args.push(...codexSandboxWritableRootsArgs(opts?.writableRoots ?? []));
   }
   return args;
 }
 function formatGitAuthModeDirective(mode) {
+  const shared = [
+    "- `git` and `gh` already authenticate in this process. Do not look for tokens in the environment, paste credentials into commands, or switch remotes to SSH.",
+    "- Do not set GitHub token environment variables, pass `--with-token`, or run `gh auth login` from this turn.",
+    "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below.",
+    "- If git/gh fail with auth errors, tell the user to run `gh auth login` on this Mac (or set a PAT in Account \u2192 GitHub). Do not wait for a Keychain dialog."
+  ];
   switch (mode) {
     case "gh":
       return [
         "Git authentication (Account \u2192 GitHub mode: gh CLI):",
         "- This process rewrites `git@github.com:` and `ssh://git@github.com/` to HTTPS.",
-        "- `GH_TOKEN` is injected from `gh auth token` (no macOS Keychain prompts). Do not switch remotes to SSH.",
-        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+        ...shared
       ].join("\n");
     case "ssh":
       return [
         "Git authentication (Account \u2192 GitHub mode: SSH):",
         "- Keep SSH remotes (`git@github.com:\u2026`). Do not rewrite them to HTTPS.",
         "- SSH is batch-mode: it will not prompt for a Keychain password. If push fails with `Permission denied (publickey)`, tell the user to unlock ssh-agent or switch Account \u2192 GitHub to Auto / gh CLI \u2014 do not rewrite remotes yourself.",
-        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below (API still uses `gh`)."
+        "- `gh` already authenticates for PRs/API (no token in the environment). Do not set GitHub token environment variables or run `gh auth login` from this turn.",
+        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
       ].join("\n");
     case "token":
       return [
         "Git authentication (Account \u2192 GitHub mode: personal access token):",
         "- This process rewrites GitHub SSH remotes to HTTPS.",
-        "- `GH_TOKEN` is set in the environment. Use HTTPS git and `gh`; do not paste the token into commands or chat.",
-        "- Push with `git push -u origin HEAD`. Create/update PRs with `gh` as below."
+        ...shared
       ].join("\n");
     case "auto":
     default:
       return [
         "Git authentication (Account \u2192 GitHub mode: auto):",
-        "- This process rewrites GitHub SSH remotes to HTTPS and authenticates with `GH_TOKEN` from `gh` so git/ssh never prompt the macOS Keychain (required for unattended orchestrator turns).",
-        "- Do not switch remotes to SSH. Push with `git push -u origin HEAD`.",
-        "- If HTTPS auth fails, tell the user to run `gh auth login` on this Mac or set Account \u2192 GitHub to a PAT \u2014 do not wait for a Keychain dialog."
+        "- This process rewrites GitHub SSH remotes to HTTPS so git/ssh never prompt the macOS Keychain (required for unattended orchestrator turns).",
+        ...shared
       ].join("\n");
   }
 }
@@ -1408,7 +1530,7 @@ async function originGhRepoEnv(cwd, opts) {
   await ensureGhPreferOrigin(cwd);
   const slug = await resolveGithubRepoSlug(cwd);
   const mode = opts?.mode ?? getGithubGitAuthMode();
-  const token = mode === "token" ? getGithubPat() : mode === "ssh" ? null : await resolveGhAuthToken(cwd);
+  const token = await resolveGithubAgentToken(mode, cwd);
   return {
     ...applyGithubGitAuthEnv(opts?.env, { mode, token }),
     ...slug ? { GH_REPO: slug } : {}
@@ -1548,13 +1670,78 @@ async function getPr(repoPath, number) {
   if (exitCode !== 0 || !stdout.trim()) return null;
   return JSON.parse(stdout);
 }
-function resolvePrSelector(thread) {
-  if (thread.prUrl?.trim()) return thread.prUrl.trim();
+function normalizeGitBranchName(ref) {
+  return ref.trim().replace(/^refs\/heads\//, "").replace(/^origin\//, "");
+}
+function isDefaultishSourceRef(ref) {
+  const n = normalizeGitBranchName(ref ?? "").toLowerCase();
+  return !n || n === "head" || n === "default" || n === "main" || n === "master" || n === "develop" || n === "trunk";
+}
+function resolvePrSelectors(thread) {
+  const out = [];
+  const push = (value) => {
+    const v = value?.trim();
+    if (!v || out.includes(v)) return;
+    out.push(v);
+  };
+  push(thread.prUrl);
   if (thread.sourceType === "pr" && thread.sourceRef?.trim()) {
-    return thread.sourceRef.replace(/^#/, "").trim();
+    push(thread.sourceRef.replace(/^#/, "").trim());
+  }
+  push(thread.branchName);
+  if (thread.sourceType === "branch") {
+    const source = normalizeGitBranchName(thread.sourceRef ?? "");
+    if (source && !isDefaultishSourceRef(source) && source !== thread.branchName?.trim()) {
+      push(source);
+    }
+  }
+  return out;
+}
+function resolvePrSelector(thread) {
+  return resolvePrSelectors(thread)[0] ?? null;
+}
+async function getPrForHeadBranch(repoPath, branch) {
+  const head = normalizeGitBranchName(branch);
+  if (!head || isDefaultishSourceRef(head)) return null;
+  const slug = await resolveGithubRepoSlug(repoPath);
+  const viewArgs = [
+    "pr",
+    "view",
+    head,
+    "--json",
+    "number,title,headRefName,url,isCrossRepository"
+  ];
+  if (slug) viewArgs.push("--repo", slug);
+  const viewed = await gh(viewArgs, repoPath, { reject: false });
+  if (viewed.exitCode === 0 && viewed.stdout.trim()) {
+    try {
+      return JSON.parse(viewed.stdout);
+    } catch {
+      return null;
+    }
+  }
+  const listHead = slug ? ghHeadRef(slug, head) : head;
+  const listArgs = [
+    "pr",
+    "list",
+    "--head",
+    listHead,
+    "--json",
+    "number,title,headRefName,url,isCrossRepository",
+    "--limit",
+    "1",
+    "--state",
+    "open"
+  ];
+  if (slug) listArgs.push("--repo", slug);
+  const listed = await gh(listArgs, repoPath, { reject: false });
+  if (listed.exitCode !== 0 || !listed.stdout.trim()) return null;
+  try {
+    const rows = JSON.parse(listed.stdout);
+    return rows[0] ?? null;
+  } catch {
+    return null;
   }
-  if (thread.branchName?.trim()) return thread.branchName.trim();
-  return null;
 }
 function normalizeGhTime(value) {
   if (typeof value !== "string" || !value.trim()) return null;
@@ -1880,7 +2067,7 @@ async function fetchPrHead(repoPath, number, localBranch) {
     const label = opts?.ghAuth ? `${remote} (gh auth)` : remote;
     const gitOpts = { reject: false };
     if (opts?.ghAuth) {
-      const token = await resolveGhAuthToken(repoPath);
+      const token = await resolveGithubAgentToken(getGithubGitAuthMode(), repoPath);
       if (!token) {
         errors.push(`${label}: gh auth token unavailable`);
         return false;
@@ -1931,7 +2118,7 @@ async function fetchPrHead(repoPath, number, localBranch) {
       const ensureOid = async (remote, opts) => {
         const gitOpts = { reject: false };
         if (opts?.ghAuth) {
-          const token = await resolveGhAuthToken(repoPath);
+          const token = await resolveGithubAgentToken(getGithubGitAuthMode(), repoPath);
           if (!token) return false;
           gitOpts.env = { GIT_TERMINAL_PROMPT: "0" };
           gitOpts.config = {
@@ -1999,8 +2186,8 @@ function isLocalPrFetchBranch(ref) {
 }
 async function createThreadWorktree(opts) {
   let branchName = `thread/${opts.slug}`;
-  const worktreePath = join(worktreesRoot(opts.repoPath), opts.slug);
-  if (existsSync(worktreePath)) {
+  const worktreePath = join2(worktreesRoot(opts.repoPath), opts.slug);
+  if (existsSync2(worktreePath)) {
     throw new Error(`Worktree already exists at ${worktreePath}`);
   }
   await ensureGhPreferOrigin(opts.repoPath);
@@ -2069,8 +2256,8 @@ ${add.stdout}`;
 async function createExistingBranchWorktree(opts) {
   const branchName = opts.branchName.trim();
   if (!branchName) throw new Error("branch name required");
-  const worktreePath = join(worktreesRoot(opts.repoPath), opts.slug);
-  if (existsSync(worktreePath)) {
+  const worktreePath = join2(worktreesRoot(opts.repoPath), opts.slug);
+  if (existsSync2(worktreePath)) {
     throw new Error(`Worktree already exists at ${worktreePath}`);
   }
   await ensureGhPreferOrigin(opts.repoPath);
@@ -2181,7 +2368,7 @@ async function pushBranch(worktreePath, branchName) {
   if (ssh.exitCode === 0) return;
   const sshErr = (ssh.stderr || ssh.stdout).trim();
   const slug = await resolveGithubRepoSlug(worktreePath);
-  const token = await resolveGhAuthToken(worktreePath);
+  const token = await resolveGithubAgentToken(getGithubGitAuthMode(), worktreePath);
   if (!slug || !token) {
     throw new Error(
       sshErr || `git push origin ${branchName} failed` + (!token ? " (no SSH agent and gh auth token unavailable \u2014 run: gh auth login)" : "")
@@ -2358,8 +2545,8 @@ function sameRepoPath(a, b) {
   return normalizeWorktreePath(a) === normalizeWorktreePath(b);
 }
 function listLocalThreadBranchSlugs(repoPath) {
-  const refsDir = join(repoPath, ".git", "refs", "heads", "thread");
-  if (!existsSync(refsDir)) return [];
+  const refsDir = join2(repoPath, ".git", "refs", "heads", "thread");
+  if (!existsSync2(refsDir)) return [];
   try {
     return readdirSync(refsDir).filter((name) => !name.startsWith(".")).map((name) => normalizeTakenSlug(name));
   } catch {
@@ -2369,7 +2556,7 @@ function listLocalThreadBranchSlugs(repoPath) {
 function collectTakenTeamSlugs(repoPath) {
   const taken = /* @__PURE__ */ new Set();
   const root = worktreesRoot(repoPath);
-  if (existsSync(root)) {
+  if (existsSync2(root)) {
     for (const entry of readdirSync(root, { withFileTypes: true })) {
       if (entry.isDirectory() && entry.name !== ".DS_Store") {
         taken.add(normalizeTakenSlug(entry.name));
@@ -2391,8 +2578,8 @@ function allocateTeamSlug(repoPath) {
   const taken = collectTakenTeamSlugs(repoPath);
   for (let attempt = 0; attempt < 32; attempt++) {
     const team = allocateTeamName(taken);
-    const path = join(worktreesRoot(repoPath), team.slug);
-    if (!existsSync(path)) return team;
+    const path = join2(worktreesRoot(repoPath), team.slug);
+    if (!existsSync2(path)) return team;
     taken.add(team.slug);
   }
   throw new Error("No available soccer team worktree directories left");
@@ -2413,7 +2600,10 @@ export {
   worktreeDisplayLabelForGroup,
   formatGhLandError,
   githubAgentGitEnv,
+  mergeAgentGitAuthEnv,
   resolveAgentGitAuthEnv,
+  warmGithubAgentAuth,
+  resolveCodexGitWritableRoots,
   codexUnattendedGitConfigArgs,
   formatGitAuthModeDirective,
   detectGhStack,
@@ -2433,7 +2623,10 @@ export {
   listBranches,
   listPrs,
   getPr,
+  isDefaultishSourceRef,
+  resolvePrSelectors,
   resolvePrSelector,
+  getPrForHeadBranch,
   detectLocalMergeConflicts,
   getPrChecks,
   getPrMeta,