@sweny-ai/core 0.1.176 → 0.1.177

package/dist/skills/git-push.js

@@ -7,26 +7,165 @@
  * the sweny process, with the github skill's token (`GITHUB_TOKEN`), right
  * before it opens the PR. The agent never holds the token.
  *
- * Guard rails: only a local branch that exists, only to `origin` when it is
- * the PR's own repo, never force, never the base branch or the remote's
- * default branch. The token goes to git through command-scope config in the
- * child env (`GIT_CONFIG_*`), never argv, as an `http.<server>/.extraheader`
- * that first resets any persisted one (so the job token is never sent twice).
+ * The checkout is agent-written, so nothing in it may run, or steer the push,
+ * while the token is in play. The push therefore never runs in the checkout:
+ *
+ * 1. Read-only git in the checkout, with no token in its env, resolves the
+ *    head commit, checks that every fetch and push URL of `origin` is the PR's
+ *    repo on the GitHub server, and finds the object store.
+ * 2. A private temporary bare repo borrows those objects (`alternates`, data
+ *    only) and gets one ref, the head commit.
+ * 3. git pushes from that repo, with no system or global config, an empty
+ *    hooks dir, `--no-verify` and no credential helper, to an explicit URL
+ *    built from the PR's repo (`<server>/<owner>/<repo>.git`) with an explicit
+ *    refspec. No agent-written config, hook, push URL or `insteadOf` is read.
+ *    The token goes to git as command-scope config in the child env, never
+ *    argv, and only on this one invocation.
+ *
+ * The git binary, its PATH, the proxy and CA settings and the server URL come
+ * from the environment captured at process startup (startup-env.ts), never
+ * from a value the workspace `.env` introduced, and git is run by an absolute
+ * path that lies outside the workspace, the temp dir and any directory this
+ * user can write (see {@link resolveTrustedGit}).
+ *
+ * The private repo lives in the temp dir, which this user (and so the agent)
+ * can write. A process the agent left running could edit its config between
+ * `init` and `push` (an `insteadOf`, a proxy, `sslVerify=false`). Two layers:
+ * the push carries command-scope config for its exact URL (proxy from the
+ * trusted env or none, `sslVerify=true`, CA only from the trusted env), which
+ * beats repo-local config of the same URL; and the repo's config, alternates,
+ * top-level entries and hooks dir are fingerprinted after setup and compared
+ * right before the push, which is refused on any change. git has no switch to
+ * skip `$GIT_DIR/config`, so a byte check is the idiomatic guard. Residual
+ * risk: a change landing in the milliseconds between that check and git's own
+ * config read. The harnesses stop the agent's process (Codex its whole process
+ * group) when a node ends, but a deliberately detached process (`setsid`)
+ * escapes any group kill; only the sandbox's own process boundary ends it.
+ *
+ * Guard rails: only a local branch that exists, only when origin is the PR's
+ * own repo, never the base branch or the repo's default branch (from the
+ * GitHub API, not the checkout's `origin/HEAD`). The head must be new on the
+ * remote, or an unprotected branch with an open PR into the base (checked by
+ * the caller through the API); the push leases on the sha that check saw and
+ * only fast-forwards.
  * A push that fails is logged and the PR is still requested: the agent may
  * already have pushed (persisted credentials, an `agent_env` grant).
  */
 import { execFile } from "node:child_process";
-import { setBranchPusher } from "./github.js";
-const defaultGit = (args, opts) => new Promise((resolve) => {
-    execFile("git", args, { cwd: opts.cwd, env: opts.env, timeout: 120_000 }, (err, stdout, stderr) => {
-        const code = err
-            ? typeof err.code === "number"
-                ? err.code
-                : 1
-            : 0;
-        resolve({ code, stdout: String(stdout ?? ""), stderr: String(stderr ?? "") });
+import { accessSync, constants as fsConstants, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { devNull } from "node:os";
+import * as path from "node:path";
+import { startupEnv, startupTmpdir, trustedEnvValue } from "../startup-env.js";
+/** True when `child` is `dir` or inside it. */
+function inside(dir, child) {
+    const rel = path.relative(dir, child);
+    return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+}
+function real(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return path.resolve(p);
+    }
+}
+/** True when this user can write `dir` or any directory above it. */
+function writableChain(dir) {
+    for (let d = path.resolve(dir);; d = path.dirname(d)) {
+        try {
+            accessSync(d, fsConstants.W_OK);
+            return true;
+        }
+        catch {
+            // Not writable: check the parent.
+        }
+        if (path.dirname(d) === d)
+            return false;
+    }
+}
+/**
+ * Whether `dir` may hold the git sweny runs with the token: absolute, outside
+ * the workspace and the temp dir, and not writable by this user at any level
+ * (the agent runs as this user). The writability check is skipped as root,
+ * where the agent could replace any binary anyway, and on Windows, where
+ * `access(W_OK)` only reads the read-only attribute: there the sandbox is the
+ * boundary.
+ */
+function trustedDir(dir, workspace) {
+    if (!dir || !path.isAbsolute(dir))
+        return false;
+    const r = real(dir);
+    const ws = real(workspace);
+    const tmp = real(startupTmpdir());
+    for (const d of [path.resolve(dir), r]) {
+        if (inside(ws, d) || inside(path.resolve(workspace), d) || inside(tmp, d))
+            return false;
+    }
+    const root = typeof process.getuid === "function" && process.getuid() === 0;
+    if (!root && process.platform !== "win32" && (writableChain(dir) || writableChain(r)))
+        return false;
+    return true;
+}
+/** The trusted entries of a PATH value, in order (see {@link trustedDir}). */
+export function trustedPathDirs(pathValue, workspace) {
+    const seen = new Set();
+    const out = [];
+    for (const d of (pathValue ?? "").split(path.delimiter)) {
+        if (seen.has(d) || !trustedDir(d, workspace))
+            continue;
+        seen.add(d);
+        out.push(d);
+    }
+    return out;
+}
+/**
+ * The absolute path of the first `git` on `pathValue` (the startup PATH) whose
+ * directory, and whose resolved file and its directory, pass
+ * {@link trustedDir}. Undefined when there is none: nothing is pushed.
+ */
+export function resolveTrustedGit(pathValue, workspace) {
+    const names = process.platform === "win32" ? ["git.exe"] : ["git"];
+    for (const dir of trustedPathDirs(pathValue, workspace)) {
+        for (const name of names) {
+            const candidate = path.join(dir, name);
+            try {
+                if (!statSync(candidate).isFile())
+                    continue;
+                accessSync(candidate, fsConstants.X_OK);
+            }
+            catch {
+                continue;
+            }
+            const file = real(candidate);
+            if (!trustedDir(path.dirname(file), workspace))
+                continue;
+            if (process.platform !== "win32" && !(typeof process.getuid === "function" && process.getuid() === 0)) {
+                try {
+                    accessSync(file, fsConstants.W_OK);
+                    continue; // A git binary this user can rewrite is not trusted.
+                }
+                catch {
+                    // Not writable: trusted.
+                }
+            }
+            return candidate;
+        }
+    }
+    return undefined;
+}
+/** A runner that executes the git at `gitPath` (absolute), never a PATH lookup. */
+export function gitAt(gitPath) {
+    return (args, opts) => new Promise((resolve) => {
+        execFile(gitPath, args, { cwd: opts.cwd, env: opts.env, timeout: 120_000 }, (err, stdout, stderr) => {
+            const code = err
+                ? typeof err.code === "number"
+                    ? err.code
+                    : 1
+                : 0;
+            resolve({ code, stdout: String(stdout ?? ""), stderr: String(stderr ?? "") });
+        });
     });
-});
+}
 /** `owner/repo` from a GitHub remote URL (https, ssh or scp form), lowercased, or undefined. */
 export function repoFromRemote(url) {
     const u = url.trim();
@@ -51,15 +190,18 @@ export function isSafeBranch(name) {
         !name.includes("..") &&
         !name.includes("//"));
 }
-/** The command-scope git config that authenticates one push to `server` with `token`. */
-export function pushAuthConfig(server, token, env) {
+/** `owner/repo` with plain name characters only. */
+export function isSafeRepo(repo) {
+    const parts = repo.split("/");
+    return (parts.length === 2 &&
+        parts.every((p) => /^[A-Za-z0-9._-]+$/.test(p) && p !== "." && p !== ".." && !p.startsWith("-")));
+}
+/** `env` plus command-scope config entries (GIT_CONFIG_COUNT/KEY/VALUE), appended after any already there. */
+function withCommandConfig(env, entries) {
     const out = { ...env };
     const base = Number.parseInt(out.GIT_CONFIG_COUNT ?? "0", 10);
     let n = Number.isFinite(base) && base > 0 ? base : 0;
-    const key = `http.${server.replace(/\/+$/, "")}/.extraheader`;
-    const basic = Buffer.from(`x-access-token:${token}`).toString("base64");
-    // An empty value resets the list, so a header the checkout persisted is not sent too.
-    for (const value of ["", `AUTHORIZATION: basic ${basic}`]) {
+    for (const [key, value] of entries) {
         out[`GIT_CONFIG_KEY_${n}`] = key;
         out[`GIT_CONFIG_VALUE_${n}`] = value;
         n++;
@@ -67,50 +209,257 @@ export function pushAuthConfig(server, token, env) {
     out.GIT_CONFIG_COUNT = String(n);
     return out;
 }
+/** The command-scope git config that authenticates one push to `server` with `token`. */
+export function pushAuthConfig(server, token, env) {
+    const key = `http.${server.replace(/\/+$/, "")}/.extraheader`;
+    const basic = Buffer.from(`x-access-token:${token}`).toString("base64");
+    // An empty value resets the list, so no other header is sent with it.
+    return withCommandConfig(env, [
+        [key, ""],
+        [key, `AUTHORIZATION: basic ${basic}`],
+    ]);
+}
+/**
+ * Command-scope transport config for the push to `destination`, keyed to that
+ * exact URL so it beats repo-local `http.*` and `http.<url>.*` entries: the
+ * proxy from the trusted env or none (an empty `http.proxy` disables proxying,
+ * env included), TLS verification on, and a CA bundle only from the trusted env.
+ */
+export function pushTransportConfig(destination, trusted) {
+    const k = (name) => `http.${destination}.${name}`;
+    const proxy = trusted.HTTPS_PROXY ?? trusted.https_proxy ?? trusted.ALL_PROXY ?? trusted.all_proxy ?? "";
+    const out = [
+        [k("proxy"), proxy],
+        [k("sslVerify"), "true"],
+    ];
+    if (trusted.GIT_SSL_CAINFO)
+        out.push([k("sslCAInfo"), trusted.GIT_SSL_CAINFO]);
+    if (trusted.GIT_SSL_CAPATH)
+        out.push([k("sslCAPath"), trusted.GIT_SSL_CAPATH]);
+    return out;
+}
+// What the operator's env may hand git: locale, home, temp dirs, proxies and
+// CA bundles, each through the startup snapshot (trustedEnvValue). PATH is set
+// by the caller from the trusted startup PATH. Every other GIT_* setting
+// (GIT_DIR, GIT_CONFIG_*, GIT_SSH*, GIT_ASKPASS, GIT_TRACE*, ...) is dropped.
+const KEPT_ENV = /^(HOME|USERPROFILE|TMPDIR|TEMP|TMP|LANG|LANGUAGE|LC_[A-Z_]+|SYSTEMROOT|SystemRoot|COMSPEC|ComSpec|PATHEXT|(HTTPS?|ALL|NO)_PROXY|(https?|all|no)_proxy|SSL_CERT_FILE|SSL_CERT_DIR|GIT_SSL_CAINFO|GIT_SSL_CAPATH)$/;
+/**
+ * The env every sweny-side git call runs with: the trusted PATH, no system or
+ * global config, no prompts, no inherited git settings, and no kept value the
+ * workspace `.env` introduced.
+ */
+export function hardenedGitEnv(env, trustedPath) {
+    const out = {};
+    const keys = new Set([...Object.keys(env === process.env ? startupEnv() : env), ...Object.keys(startupEnv())]);
+    for (const k of keys) {
+        if (!KEPT_ENV.test(k))
+            continue;
+        const v = trustedEnvValue(env, k);
+        if (v !== undefined)
+            out[k] = v;
+    }
+    if (trustedPath !== undefined)
+        out.PATH = trustedPath;
+    out.GIT_CONFIG_NOSYSTEM = "1";
+    out.GIT_CONFIG_GLOBAL = devNull;
+    out.GIT_TERMINAL_PROMPT = "0";
+    return out;
+}
+/**
+ * True when a fresh `git init --bare` config holds only repo-format keys
+ * (`[core]` format/fs flags, `[extensions]` object format and ref storage).
+ */
+export function isPlainRepoConfig(text) {
+    let section = "";
+    for (const raw of text.split("\n")) {
+        const line = raw.trim();
+        if (!line || line.startsWith("#") || line.startsWith(";"))
+            continue;
+        const head = /^\[([A-Za-z0-9.-]+)\]$/.exec(line);
+        if (head) {
+            section = head[1].toLowerCase();
+            if (section !== "core" && section !== "extensions")
+                return false;
+            continue;
+        }
+        const kv = /^([A-Za-z][A-Za-z0-9-]*)\s*=\s*[A-Za-z0-9._-]*$/.exec(line);
+        if (!kv)
+            return false;
+        const key = `${section}.${kv[1].toLowerCase()}`;
+        if (!PLAIN_REPO_KEYS.has(key))
+            return false;
+    }
+    return true;
+}
+const PLAIN_REPO_KEYS = new Set([
+    "core.repositoryformatversion",
+    "core.filemode",
+    "core.bare",
+    "core.ignorecase",
+    "core.precomposeunicode",
+    "core.symlinks",
+    "core.logallrefupdates",
+    "extensions.objectformat",
+    "extensions.refstorage",
+]);
+/** Command-line config (highest precedence) for every sweny-side git call. */
+function hardenedArgs(hooksDir) {
+    return [
+        "-c",
+        `core.hooksPath=${hooksDir}`,
+        "-c",
+        "core.fsmonitor=false",
+        "-c",
+        "core.sshCommand=",
+        "-c",
+        "credential.helper=",
+        "-c",
+        "core.askPass=",
+        "-c",
+        "protocol.ext.allow=never",
+    ];
+}
+/** A branch name without a leading `refs/heads/`, so `refs/heads/develop` and `develop` compare equal. */
+export function branchName(ref) {
+    return ref.trim().replace(/^refs\/heads\//, "");
+}
 /**
- * Push the PR's head branch to `origin` from the sweny process. Never throws.
+ * Push the PR's head branch from the sweny process. Never throws.
  */
 export async function pushHeadBranch(opts) {
-    const git = opts.git ?? defaultGit;
-    const cwd = opts.cwd ?? process.cwd();
-    const env = { ...(opts.env ?? process.env), GIT_TERMINAL_PROMPT: "0" };
-    const { head, base } = opts;
+    const { token } = opts;
+    const head = branchName(opts.head);
+    const base = branchName(opts.base);
+    const defaultBranch = opts.defaultBranch === undefined ? undefined : branchName(opts.defaultBranch);
+    if (!isSafeRepo(opts.repo))
+        return { pushed: false, attempted: false, reason: `repo "${opts.repo}" is not owner/repo` };
     if (!isSafeBranch(head))
         return { pushed: false, attempted: false, reason: `head "${head}" is not a plain branch name` };
     if (head === base)
         return { pushed: false, attempted: false, reason: "head is the base branch" };
+    if (!defaultBranch)
+        return { pushed: false, attempted: false, reason: "the repo's default branch is unknown" };
+    if (head === defaultBranch || head === "main" || head === "master") {
+        return { pushed: false, attempted: false, reason: `head ${head} is the default branch` };
+    }
+    const remoteSha = opts.remoteSha;
+    if (remoteSha === undefined || !/^([0-9a-f]{40}([0-9a-f]{24})?)?$/.test(remoteSha)) {
+        return { pushed: false, attempted: false, reason: `the remote state of ${head} is unknown` };
+    }
+    if (!token)
+        return { pushed: false, attempted: false, reason: "no GITHUB_TOKEN" };
+    const opEnv = opts.env ?? process.env;
+    const cwd = path.resolve(opts.cwd);
+    // git and its PATH come from the startup snapshot, never the run's env or the workspace.
+    const startupPath = startupEnv().PATH ?? startupEnv().Path;
+    const gitPath = opts.git ? undefined : resolveTrustedGit(startupPath, cwd);
+    if (!opts.git && !gitPath) {
+        return { pushed: false, attempted: false, reason: "no git outside the workspace and writable dirs" };
+    }
+    const git = opts.git ?? gitAt(gitPath);
+    let server;
+    try {
+        server = new URL((trustedEnvValue(opEnv, "GITHUB_SERVER_URL") || "https://github.com").replace(/\/+$/, ""));
+    }
+    catch {
+        return { pushed: false, attempted: false, reason: "GITHUB_SERVER_URL is not a URL" };
+    }
+    if (server.protocol !== "https:" || server.username || server.password || server.search || server.hash) {
+        return { pushed: false, attempted: false, reason: "GITHUB_SERVER_URL is not a plain https URL" };
+    }
+    const serverBase = `${server.origin}${server.pathname.replace(/\/+$/, "")}`;
+    const serverHost = server.hostname.toLowerCase();
+    const destination = `${serverBase}/${opts.repo}.git`;
+    const env = hardenedGitEnv(opEnv, trustedPathDirs(startupPath, cwd).join(path.delimiter));
+    let tmp;
     try {
-        const local = await git(["rev-parse", "--verify", "--quiet", `refs/heads/${head}^{commit}`], { cwd, env });
-        if (local.code !== 0)
+        tmp = mkdtempSync(path.join(startupTmpdir(), "sweny-push-"));
+        const hooks = path.join(tmp, "hooks");
+        mkdirSync(hooks, { mode: 0o700 });
+        const hard = hardenedArgs(hooks);
+        // Reads in the agent's checkout: no token in the env, nothing run from its config.
+        const read = (args) => git([...hard, "-c", "safe.directory=*", ...args], { cwd, env });
+        const local = await read(["rev-parse", "--verify", "--quiet", `refs/heads/${head}^{commit}`]);
+        const sha = local.stdout.trim();
+        if (local.code !== 0 || !/^[0-9a-f]{40}([0-9a-f]{24})?$/.test(sha)) {
             return { pushed: false, attempted: false, reason: `no local branch ${head}` };
-        const remote = await git(["remote", "get-url", "origin"], { cwd, env });
-        if (remote.code !== 0)
+        }
+        const fetchUrls = await read(["remote", "get-url", "--all", "origin"]);
+        const pushUrls = await read(["remote", "get-url", "--push", "--all", "origin"]);
+        if (fetchUrls.code !== 0 || pushUrls.code !== 0) {
             return { pushed: false, attempted: false, reason: "no origin remote" };
-        const parsed = repoFromRemote(remote.stdout);
-        if (!parsed || parsed.repo !== opts.repo.toLowerCase()) {
-            return { pushed: false, attempted: false, reason: `origin is not ${opts.repo}` };
         }
-        const originHead = await git(["symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD"], { cwd, env });
-        const defaultBranch = originHead.code === 0 ? originHead.stdout.trim().replace(/^origin\//, "") : undefined;
-        if (head === defaultBranch || head === "main" || head === "master") {
-            return { pushed: false, attempted: false, reason: `head ${head} is the default branch` };
+        const urls = `${fetchUrls.stdout}\n${pushUrls.stdout}`
+            .split("\n")
+            .map((u) => u.trim())
+            .filter(Boolean);
+        const wanted = opts.repo.toLowerCase();
+        const bad = urls.length === 0 ||
+            urls.some((u) => {
+                const p = repoFromRemote(u);
+                return !p || p.repo !== wanted || p.host !== serverHost;
+            });
+        if (bad)
+            return { pushed: false, attempted: false, reason: `origin is not ${opts.repo} on ${serverHost}` };
+        const objectsOut = await read(["rev-parse", "--git-path", "objects"]);
+        const shallowOut = await read(["rev-parse", "--git-path", "shallow"]);
+        if (objectsOut.code !== 0 || shallowOut.code !== 0) {
+            return { pushed: false, attempted: false, reason: "cannot locate the checkout's object store" };
         }
-        const server = (env.GITHUB_SERVER_URL || "https://github.com").replace(/\/+$/, "");
-        let serverHost;
-        try {
-            serverHost = new URL(server).host.toLowerCase();
+        const objects = path.resolve(cwd, objectsOut.stdout.trim());
+        const shallow = path.resolve(cwd, shallowOut.stdout.trim());
+        // A private bare repo that borrows the checkout's objects and holds one ref.
+        const repoDir = path.join(tmp, "push.git");
+        const own = (args, extraEnv) => git([...hard, `--git-dir=${repoDir}`, ...args], { cwd: tmp, env: { ...env, ...extraEnv } });
+        const init = await git([...hard, "init", "--quiet", "--bare", repoDir], { cwd: tmp, env });
+        if (init.code !== 0)
+            return { pushed: false, attempted: false, reason: "cannot create the push repo" };
+        // The config `init` wrote may only hold plain repo-format keys: no url, http, include or remote.
+        if (!isPlainRepoConfig(readFileSync(path.join(repoDir, "config"), "utf8"))) {
+            return { pushed: false, attempted: false, reason: "the private push repo changed before the push" };
         }
-        catch {
-            serverHost = "github.com";
+        writeFileSync(path.join(repoDir, "objects", "info", "alternates"), `${objects}\n`);
+        // A shallow checkout (actions/checkout's default): copy its boundary list. Only a
+        // plain, bounded file; a link or FIFO the agent planted is not read.
+        const shallowStat = lstatSync(shallow, { throwIfNoEntry: false });
+        if (shallowStat?.isFile() && shallowStat.size <= 1 << 20) {
+            writeFileSync(path.join(repoDir, "shallow"), readFileSync(shallow));
         }
-        const pushEnv = opts.token && parsed.https && parsed.host === serverHost ? pushAuthConfig(server, opts.token, env) : env;
-        const r = await git(["push", "--porcelain", "origin", `refs/heads/${head}:refs/heads/${head}`], {
-            cwd,
-            env: pushEnv,
-        });
+        // What the push reads from the private repo, fixed here and re-checked right before the token is used.
+        const fingerprint = () => JSON.stringify([
+            readdirSync(repoDir).sort(),
+            readFileSync(path.join(repoDir, "config"), "utf8"),
+            readFileSync(path.join(repoDir, "objects", "info", "alternates"), "utf8"),
+            readdirSync(hooks).sort(),
+        ]);
+        const staged = fingerprint();
+        const ref = await own(["update-ref", `refs/heads/${head}`, sha]);
+        if (ref.code !== 0)
+            return { pushed: false, attempted: false, reason: `cannot stage ${head} for the push` };
+        // An existing remote head (an open PR's branch) is only fast-forwarded:
+        // the lease below would otherwise let a diverged commit replace it.
+        if (remoteSha) {
+            const ff = await own(["merge-base", "--is-ancestor", remoteSha, sha]);
+            if (ff.code !== 0) {
+                return { pushed: false, attempted: false, reason: `${head} is not a fast-forward of the remote ${head}` };
+            }
+        }
+        const pushEnv = pushAuthConfig(serverBase, token, withCommandConfig({}, pushTransportConfig(destination, env)));
+        if (fingerprint() !== staged) {
+            return { pushed: false, attempted: false, reason: "the private push repo changed before the push" };
+        }
+        const r = await own([
+            "push",
+            "--no-verify",
+            "--porcelain",
+            // The remote head must still be what the API reported ("" = must not exist).
+            `--force-with-lease=refs/heads/${head}:${remoteSha}`,
+            destination,
+            `refs/heads/${head}:refs/heads/${head}`,
+        ], pushEnv);
         if (r.code !== 0) {
             const why = (r.stderr || r.stdout).trim().split("\n").at(-1) ?? "";
-            return { pushed: false, attempted: true, reason: `git push failed: ${redact(why, opts.token)}` };
+            return { pushed: false, attempted: true, reason: `git push failed: ${redact(why, token)}` };
         }
         return { pushed: true, attempted: true };
     }
@@ -118,9 +467,19 @@ export async function pushHeadBranch(opts) {
         return {
             pushed: false,
             attempted: false,
-            reason: redact(err instanceof Error ? err.message : String(err), opts.token),
+            reason: redact(err instanceof Error ? err.message : String(err), token),
         };
     }
+    finally {
+        if (tmp) {
+            try {
+                rmSync(tmp, { recursive: true, force: true });
+            }
+            catch {
+                // Best effort: a leftover temp dir holds no secret.
+            }
+        }
+    }
 }
 function redact(text, token) {
     if (!token)
@@ -128,5 +487,7 @@ function redact(text, token) {
     const basic = Buffer.from(`x-access-token:${token}`).toString("base64");
     return text.split(token).join("***").split(basic).join("***");
 }
-// The Node entry imports this module (executor.ts), which arms the push in `github_create_pr`.
-setBranchPusher(pushHeadBranch);
+/** A pusher bound to one run's checkout and env (handed to tools as `ToolContext.pushBranch`). */
+export function bindBranchPusher(cwd, env) {
+    return (o) => pushHeadBranch({ ...o, cwd, env });
+}

package/dist/skills/github.d.ts

@@ -4,24 +4,28 @@
  * Replaces: source-control/github.ts + issue-tracking/github-issues.ts
  * ~800 lines → ~120 lines
  */
-import type { Skill } from "../types.js";
+import type { Skill, ToolContext } from "../types.js";
+export type { BranchPusher } from "../types.js";
 /**
- * Pushes a PR's head branch from the sweny process (#473). The Node entry
- * registers it (skills/git-push.ts, imported by the executor); this module
- * stays browser-safe, and without a pusher `github_create_pr` only calls the API.
+ * The REST base: `ctx.githubApiUrl` (the operator's GITHUB_API_URL, for GHES)
+ * or https://api.github.com. Only a plain https URL: no credentials, query or
+ * fragment, since the token goes to it.
  */
-export type BranchPusher = (opts: {
-    repo: string;
-    head: string;
-    base: string;
-    token?: string;
-}) => Promise<{
-    pushed: boolean;
-    attempted: boolean;
-    reason?: string;
+export declare function githubApiBase(apiUrl: string | undefined): string;
+/**
+ * Whether sweny may push the PR's head branch, from the API (#498). The agent
+ * names head and base, so head could be an existing integration branch
+ * ("release") that is neither base nor default. A head that does not exist
+ * remotely is pushed with an empty lease (it must still not exist). One that
+ * exists is pushed only when it is unprotected and already has an open PR from
+ * this repo into `base`, leased on the sha the API returned. Any API failure
+ * means no push.
+ */
+export declare function headPushLease(repo: string, head: string, base: string, ctx: ToolContext): Promise<{
+    remoteSha: string;
+} | {
+    skip: string;
 }>;
-/** Register (or clear, with `undefined`) the sweny-side branch pusher. */
-export declare function setBranchPusher(fn: BranchPusher | undefined): void;
 /**
  * Encode an LLM-chosen repo file path for safe interpolation into a
  * GitHub API request path.