@tablation/crew 0.127.8 → 0.127.10

package/dist/cli.js

@@ -11509,7 +11509,7 @@ var SandboxRunner = class {
           rmSync14(tmp, { recursive: true, force: true });
         }
       }
-      const withStubs = `PATH=${shQuote2(SANDBOX_STUB_DIR)}:"$PATH"; export PATH; `;
+      const withStubs = `${sandboxEnvExports()}PATH=${shQuote2(SANDBOX_STUB_DIR)}:"$PATH"; export PATH; `;
       const command2 = viaUpload ? ["sh", "-c", `${withStubs}exec ${[harness, ...plan.args].map(shQuote2).join(" ")} < ${SANDBOX_PROMPT_PATH}`] : ["sh", "-c", `${withStubs}exec "$@"`, "sh", harness, ...plan.args];
       const child = spawn3(cfg.bin, ["sandbox", "exec", "-n", name, "--no-login-shell", "--workdir", cfg.workDir, "--", ...command2], {
         env: process.env,
@@ -12837,8 +12837,10 @@ m=${VOLUME_ROOT}/"$1"; url="$2"
 export GIT_TERMINAL_PROMPT=0
 git config --global --add safe.directory '*'
 if [ -n "$CREW_FORGE_TOKEN" ]; then
-  H="Authorization: Basic $(printf '%s:%s' "$CREW_FORGE_USER" "$CREW_FORGE_TOKEN" | base64 | tr -d '\\n')"
-  git() { command git -c "http.extraHeader=$H" "$@"; }
+  # An inline credential helper, not http.extraHeader: GitHub answers a preemptive Basic header
+  # with 401 and git then prompts (CREW-2965). The helper body is single-quoted so the shell passes
+  # it literally and git's own shell expands the env when it runs the helper: no token in argv.
+  git() { command git -c credential.helper= -c 'credential.helper=!f() { echo username=\${CREW_FORGE_USER:-x-access-token}; echo password=$CREW_FORGE_TOKEN; }; f' "$@"; }
 fi
 if [ -d "$m" ]; then
   git -C "$m" fetch --prune --atomic --quiet origin
@@ -13376,6 +13378,14 @@ var CREW_ENV = {
   // A run cannot reach the download host, so an in-run update attempt is only noise.
   DISABLE_AUTOUPDATER: "1"
 };
+function sandboxEnvExports() {
+  const vars = {
+    ...CREW_ENV,
+    [SERENA_LANGUAGE_SERVERS_ENV]: `${SERENA_IMAGE_HOME}/language_servers`,
+    UV_PYTHON_INSTALL_DIR: `${CREW_PREFIX}/uv/python`
+  };
+  return Object.entries(vars).map(([k, v]) => `${k}=${v}; export ${k}; `).join("");
+}
 function claudeInstallCommand() {
   const cases = Object.entries(SANDBOX_CLAUDE_SHA256).map(([arch, { platform: platform2, sha256: sha2562 }]) => `${arch}) p=${platform2}; sum=${sha2562};;`).join(" ");
   return [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.127.8",
+  "version": "0.127.10",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",