@testchimp/cli 0.1.63 → 0.1.65

package/dist/chimphands/refreshGitAuth.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Remint a short-lived GitHub App installation token and apply it for git/gh.
+ * Never prints the token. Safe for ChimpHands agents and GHA runners.
+ */
+export type RefreshGitAuthResult = {
+    ok: true;
+    repositoryFullName: string;
+    expiresAtMillis: number;
+};
+/**
+ * Mint a ~1h GitHub App installation token and apply it for subsequent git/gh
+ * in this process (and this GHA job when GITHUB_ENV is set).
+ *
+ * Does **not** print the token. Applies via:
+ * - process.env GH_TOKEN / GITHUB_TOKEN
+ * - $GITHUB_ENV when present (GitHub Actions)
+ * - origin remote URL rewrite (https github.com) when possible
+ * - `gh auth login --with-token` + `gh auth setup-git` when `gh` exists
+ */
+export declare function refreshGitAuth(): Promise<RefreshGitAuthResult>;
+/** True when stderr/stdout looks like expired / rejected GitHub credentials. */
+export declare function looksLikeGitAuthFailure(text: string): boolean;

package/dist/chimphands/refreshGitAuth.js

@@ -0,0 +1,139 @@
+/**
+ * Remint a short-lived GitHub App installation token and apply it for git/gh.
+ * Never prints the token. Safe for ChimpHands agents and GHA runners.
+ */
+import { spawn } from "node:child_process";
+import { appendFileSync } from "node:fs";
+import { getBackendUrl, requireApiKey } from "../core/client.js";
+function run(cmd, args, env) {
+    return new Promise((resolve) => {
+        const child = spawn(cmd, args, {
+            stdio: ["ignore", "pipe", "pipe"],
+            env: env ? { ...process.env, ...env } : process.env,
+        });
+        let out = "";
+        let err = "";
+        child.stdout.on("data", (d) => {
+            out += d.toString();
+        });
+        child.stderr.on("data", (d) => {
+            err += d.toString();
+        });
+        child.on("close", (code) => resolve({ code: code ?? 1, out, err }));
+        child.on("error", (e) => resolve({ code: 1, out: "", err: e instanceof Error ? e.message : String(e) }));
+    });
+}
+function pipeTokenToGh(token) {
+    return new Promise((resolve) => {
+        const child = spawn("gh", ["auth", "login", "--with-token"], {
+            stdio: ["pipe", "ignore", "pipe"],
+            env: process.env,
+        });
+        let err = "";
+        child.stderr.on("data", (d) => {
+            err += d.toString();
+        });
+        child.on("close", (code) => resolve({ code: code ?? 1, err }));
+        child.on("error", (e) => resolve({ code: 1, err: e instanceof Error ? e.message : String(e) }));
+        child.stdin.write(token);
+        child.stdin.end();
+    });
+}
+function injectTokenIntoGithubHttpsUrl(remoteUrl, token) {
+    // https://github.com/owner/repo.git or https://x-access-token:OLD@github.com/owner/repo.git
+    const m = remoteUrl.match(/^https:\/\/(?:[^@]+@)?github\.com\/([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?\s*$/i);
+    if (!m)
+        return null;
+    const owner = m[1];
+    const repo = m[2].replace(/\.git$/i, "");
+    return `https://x-access-token:${token}@github.com/${owner}/${repo}.git`;
+}
+async function mintGithubWriteToken() {
+    const apiKey = requireApiKey();
+    const backend = getBackendUrl();
+    const res = await fetch(`${backend}/api/chimphands/github_write_token`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            "TestChimp-Api-Key": apiKey,
+        },
+        body: "{}",
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        throw new Error(`github_write_token failed HTTP ${res.status}: ${text}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error("github_write_token returned non-JSON");
+    }
+    const token = (parsed.token || "").trim();
+    if (!token) {
+        throw new Error("github_write_token returned empty token");
+    }
+    const repositoryFullName = (parsed.repositoryFullName ||
+        parsed.repository_full_name ||
+        "").trim();
+    const expiresAtMillis = Number(parsed.expiresAtMillis ?? parsed.expires_at_millis) ||
+        Date.now() + 60 * 60 * 1000;
+    return { token, repositoryFullName, expiresAtMillis };
+}
+/**
+ * Mint a ~1h GitHub App installation token and apply it for subsequent git/gh
+ * in this process (and this GHA job when GITHUB_ENV is set).
+ *
+ * Does **not** print the token. Applies via:
+ * - process.env GH_TOKEN / GITHUB_TOKEN
+ * - $GITHUB_ENV when present (GitHub Actions)
+ * - origin remote URL rewrite (https github.com) when possible
+ * - `gh auth login --with-token` + `gh auth setup-git` when `gh` exists
+ */
+export async function refreshGitAuth() {
+    const { token, repositoryFullName, expiresAtMillis } = await mintGithubWriteToken();
+    process.env.GH_TOKEN = token;
+    process.env.GITHUB_TOKEN = token;
+    const githubEnvPath = process.env.GITHUB_ENV?.trim();
+    if (githubEnvPath) {
+        try {
+            appendFileSync(githubEnvPath, `GH_TOKEN=${token}\nGITHUB_TOKEN=${token}\n`, "utf8");
+        }
+        catch (e) {
+            console.error(`ChimpHands refresh-git-auth: could not write GITHUB_ENV: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    const remote = await run("git", ["remote", "get-url", "origin"]);
+    if (remote.code === 0) {
+        const current = remote.out.trim();
+        const next = injectTokenIntoGithubHttpsUrl(current, token);
+        if (next) {
+            const set = await run("git", ["remote", "set-url", "origin", next]);
+            if (set.code !== 0) {
+                console.error(`ChimpHands refresh-git-auth: git remote set-url failed: ${set.err || set.out}`);
+            }
+        }
+    }
+    const ghLogin = await pipeTokenToGh(token);
+    if (ghLogin.code !== 0) {
+        // setup-git alone still helps when login is already present / unavailable
+        console.error(`ChimpHands refresh-git-auth: gh auth login skipped/failed: ${ghLogin.err || "non-zero"}`);
+    }
+    const setup = await run("gh", ["auth", "setup-git"], {
+        GH_TOKEN: token,
+        GITHUB_TOKEN: token,
+    });
+    if (setup.code !== 0) {
+        console.error(`ChimpHands refresh-git-auth: gh auth setup-git: ${setup.err || setup.out}`);
+    }
+    console.error(`ChimpHands refresh-git-auth: reminted GitHub App installation token` +
+        (repositoryFullName ? ` for ${repositoryFullName}` : "") +
+        ` (expires ~${new Date(expiresAtMillis).toISOString()})`);
+    return { ok: true, repositoryFullName, expiresAtMillis };
+}
+/** True when stderr/stdout looks like expired / rejected GitHub credentials. */
+export function looksLikeGitAuthFailure(text) {
+    const t = text.toLowerCase();
+    return (/authentication failed|could not read username|invalid username or password|bad credentials|401\b|403\b|permission.*denied|remote:.*denied|write access not granted|repository not found/.test(t) || /gh:\s*to get started|gh auth login|HTTP\s*401|HTTP\s*403/.test(t));
+}

package/dist/chimphands/run.js

@@ -67,7 +67,7 @@ const CHIMPHANDS_AGENT_PROMPT = `You are ChimpHands, TestChimp's coding agent. Y
 - This conversation uses ONE working branch and ONE pull request. Reuse them for all follow-up work in this chat.
 - If bootstrap lists a working branch, checkout that branch and push additional commits there — update the same PR.
 - Only create a NEW branch/PR when (a) no working branch exists yet for this conversation, or (b) the prior PR was merged/closed (verify with \`gh pr view\`).
-- Commit and push on the session working branch after meaningful edit batches. The host also commits any dirty worktree before idle teardown — keep the branch pushed so the UI can show diffs from GitHub.
+- Commit and push on the session working branch after meaningful edit batches. When \`CHIMPHANDS_UI_ATTACHED\` is \`false\` (no browser watching live), **commit and push before ending every turn** so the user can review async via PR / Files changed. The host also commits any remaining dirty worktree after each turn and before idle teardown.
 - Branch names MUST start with \`testchimp-\` or \`chimphands-\`.
 - When creating a NEW working branch: create it, then IMMEDIATELY publish it with
   \`git push -u origin <branch>\` BEFORE calling report-branch. Users open the branch URL in the UI —
@@ -75,6 +75,7 @@ const CHIMPHANDS_AGENT_PROMPT = `You are ChimpHands, TestChimp's coding agent. Y
 - After the branch is on the remote (and after opening a PR), IMMEDIATELY run:
   \`testchimp chimphands report-branch --branch <name> [--pr-url <url>]\`
 - Tell the user which branch you are on and include the PR URL when available.
+- **GitHub auth expiry (self-fix):** Job-start App installation tokens expire after ~1 hour. On \`git push\` / \`gh\` auth failures (401/403 / Authentication failed / write access not granted), run \`testchimp chimphands refresh-git-auth\` then retry — **never** ask the user to paste or reconnect a GitHub token in chat. See skill \`references/chimphands-faq.md\`.
 
 ## TestChimp workflows (/testchimp …)
 - Load and follow the \`testchimp\` skill under \`.agents/skills/testchimp/SKILL.md\`.
@@ -124,17 +125,26 @@ function apiHeaders(apiKey) {
         "TestChimp-Api-Key": apiKey,
     };
 }
+const POST_JSON_TIMEOUT_MS = 30_000;
 async function postJson(backend, apiKey, path, body) {
-    const res = await fetch(`${backend}${path}`, {
-        method: "POST",
-        headers: apiHeaders(apiKey),
-        body: JSON.stringify(body ?? {}),
-    });
-    const text = await res.text();
-    if (!res.ok) {
-        throw new Error(`ChimpHands API ${res.status} ${path}: ${text}`);
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), POST_JSON_TIMEOUT_MS);
+    try {
+        const res = await fetch(`${backend}${path}`, {
+            method: "POST",
+            headers: apiHeaders(apiKey),
+            body: JSON.stringify(body ?? {}),
+            signal: ac.signal,
+        });
+        const text = await res.text();
+        if (!res.ok) {
+            throw new Error(`ChimpHands API ${res.status} ${path}: ${text}`);
+        }
+        return text;
+    }
+    finally {
+        clearTimeout(timer);
     }
-    return text;
 }
 /** Serializes agent event posts so streaming chunks fan out in order. */
 class AgentEventPoster {
@@ -319,12 +329,29 @@ function mapToolExecutionStatus(status) {
         return TOOL_STATUS_ERROR;
     return undefined;
 }
+/** First observed start time per OpenCode tool part — progress updates must not reset the UI countdown. */
+const toolStartedAtByPartId = new Map();
 function toolExecutionFromOpencodePart(part) {
     const status = mapToolExecutionStatus(part.state?.status);
     if (!status)
         return undefined;
-    const startedAtMillis = normalizeEpochMillis(part.state?.time?.start) ??
-        (status === TOOL_STATUS_RUNNING ? Date.now() : undefined);
+    const partKey = String(part.id || part.messageID || "").trim();
+    const fromOpencode = normalizeEpochMillis(part.state?.time?.start);
+    const cached = partKey ? toolStartedAtByPartId.get(partKey) : undefined;
+    const isActive = status === TOOL_STATUS_PENDING || status === TOOL_STATUS_RUNNING;
+    let startedAtMillis = cached ?? fromOpencode;
+    if (startedAtMillis == null && isActive) {
+        startedAtMillis = Date.now();
+    }
+    if (partKey) {
+        if (isActive && startedAtMillis != null) {
+            toolStartedAtByPartId.set(partKey, startedAtMillis);
+        }
+        else if (status === TOOL_STATUS_COMPLETED ||
+            status === TOOL_STATUS_ERROR) {
+            toolStartedAtByPartId.delete(partKey);
+        }
+    }
     const endedAtMillis = normalizeEpochMillis(part.state?.time?.end);
     const toolName = String(part.state?.title || part.tool || "").trim() || undefined;
     const timeoutMillis = coerceTimeoutMillis(part.state?.input);
@@ -926,8 +953,8 @@ function detectWorkingBranchFromToolOutput(output) {
     const prMatch = text.match(/https:\/\/github\.com\/[^\s)\]]+\/pull\/\d+/);
     // Only auto-detect after a successful push to origin — local checkout -b alone would
     // report a branch URL that 404s until the remote ref exists.
-    const pushMatch = text.match(/push\s+(?:--set-upstream\s+|-u\s+)?origin\s+((?:testchimp-|chimphands-)[^\s'"]+)/i);
-    const branch = pushMatch?.[1]?.replace(/[`'"]/g, "");
+    const pushMatch = text.match(/push\s+(?:--set-upstream\s+|-u\s+)?origin\s+((?:testchimp-|chimphands-)[^\s'"\[\]]+)/i);
+    const branch = pushMatch?.[1]?.replace(/[`'"\[\]]/g, "");
     return {
         branch,
         pullRequestUrl: prMatch?.[0],
@@ -939,10 +966,12 @@ function writeOpencodeConfig(backend, apiKey, boot) {
     const modelId = resolveOpencodeModelId(boot);
     const model = `${TESTCHIMP_PROVIDER_ID}/${modelId}`;
     const sessionId = bootStr(boot, "session_id", "sessionId");
+    const uiAttached = !!(boot.uiAttached ?? boot.ui_attached);
     const mcpEnv = {
         TESTCHIMP_API_KEY: apiKey,
         TESTCHIMP_BACKEND_URL: backend,
         TESTCHIMP_EXECUTION_SOURCE: "CLOUD_AGENT",
+        CHIMPHANDS_UI_ATTACHED: uiAttached ? "true" : "false",
     };
     const serviceUserId = bootStr(boot, "chimphands_service_account_user_id", "chimphandsServiceAccountUserId");
     if (serviceUserId) {
@@ -1447,6 +1476,7 @@ function connectInboundStream(backend, apiKey, sessionId, handlers) {
     let stopped = false;
     let reconnectTimer = null;
     let reconnectDelayMs = 1000;
+    let activeReq = null;
     const scheduleReconnect = () => {
         if (stopped || !handlers.shouldRun())
             return;
@@ -1461,6 +1491,15 @@ function connectInboundStream(backend, apiKey, sessionId, handlers) {
     const connect = () => {
         if (stopped || !handlers.shouldRun())
             return;
+        if (activeReq) {
+            try {
+                activeReq.destroy();
+            }
+            catch {
+                /* ignore */
+            }
+            activeReq = null;
+        }
         const req = lib.request({
             hostname: url.hostname,
             port: url.port || (url.protocol === "https:" ? 443 : 80),
@@ -1539,16 +1578,36 @@ function connectInboundStream(backend, apiKey, sessionId, handlers) {
                     }
                 }
             });
-            res.on("end", () => scheduleReconnect());
+            res.on("end", () => {
+                if (activeReq === req)
+                    activeReq = null;
+                scheduleReconnect();
+            });
+        });
+        activeReq = req;
+        req.on("error", () => {
+            if (activeReq === req)
+                activeReq = null;
+            scheduleReconnect();
         });
-        req.on("error", () => scheduleReconnect());
         req.end();
     };
     connect();
     return () => {
         stopped = true;
-        if (reconnectTimer)
+        if (reconnectTimer) {
             clearTimeout(reconnectTimer);
+            reconnectTimer = null;
+        }
+        if (activeReq) {
+            try {
+                activeReq.destroy();
+            }
+            catch {
+                /* ignore */
+            }
+            activeReq = null;
+        }
     };
 }
 export async function runChimphands(opts) {
@@ -1569,6 +1628,7 @@ export async function runChimphands(opts) {
     const githubRunId = (process.env.GITHUB_RUN_ID || "").trim();
     const poster = new AgentEventPoster(backend, apiKey, sessionId);
     poster.uiAttached = !!(boot.uiAttached ?? boot.ui_attached);
+    process.env.CHIMPHANDS_UI_ATTACHED = poster.uiAttached ? "true" : "false";
     let stopLiveSse = null;
     /** Do not open localhost OpenCode /event until serve has been (re)started with config. */
     let opencodeHttpReady = !attachUrl;
@@ -1597,6 +1657,7 @@ export async function runChimphands(opts) {
     };
     const syncLiveSse = (attached) => {
         pendingUiAttached = attached;
+        process.env.CHIMPHANDS_UI_ATTACHED = attached ? "true" : "false";
         if (!attachUrl) {
             poster.uiAttached = attached;
             return;
@@ -1714,6 +1775,13 @@ export async function runChimphands(opts) {
     let cancelTurnRequested = false;
     let activeOpencodeChild = null;
     let agentTurnInProgress = false;
+    /** Wakes waitForNextPrompt when idle is signaled (SSE) or a user message arrives. */
+    let wakeWaitForPrompt = null;
+    const wakePromptWaiter = () => {
+        const wake = wakeWaitForPrompt;
+        wakeWaitForPrompt = null;
+        wake?.();
+    };
     const turnControl = {
         getCancelRequested: () => cancelTurnRequested,
         onActiveChild: (child) => {
@@ -1733,6 +1801,7 @@ export async function runChimphands(opts) {
         queue.push(content);
         lastUserActivity = Date.now();
         idle = false;
+        wakePromptWaiter();
         const preview = content.length > 120 ? `${content.slice(0, 117)}...` : content;
         console.error(`ChimpHands queued user message (turnActive=${agentTurnInProgress}, depth=${queue.length}): ${JSON.stringify(preview)}`);
     };
@@ -1777,15 +1846,18 @@ export async function runChimphands(opts) {
         }
         postEvent(role, content, opts);
     };
-    const complete = (status, errorMessage) => {
+    const complete = async (status, errorMessage) => {
         const body = { sessionId, status };
         if (errorMessage)
             body.errorMessage = String(errorMessage).slice(0, 4000);
         if (githubRunId)
             body.githubRunId = githubRunId;
-        void postJson(backend, apiKey, "/api/chimphands/complete_session", body).catch((err) => {
+        try {
+            await postJson(backend, apiKey, "/api/chimphands/complete_session", body);
+        }
+        catch (err) {
             console.error(`ChimpHands complete_session failed: ${err instanceof Error ? err.message : String(err)}`);
-        });
+        }
     };
     const childEnv = {
         ...process.env,
@@ -1825,6 +1897,7 @@ export async function runChimphands(opts) {
         onUserMessage: enqueueUserMessage,
         onIdle: () => {
             idle = true;
+            wakePromptWaiter();
         },
         onCancelTurn: handleCancelTurn,
         onUserFileEdit: handleUserFileEdit,
@@ -1852,6 +1925,7 @@ export async function runChimphands(opts) {
             stopLiveSse();
             stopLiveSse = null;
         }
+        wakePromptWaiter();
         await commitAndPushDirtyWorktree("chimphands: commit before session idle/shutdown");
         await poster.flush();
         if (runtimeId) {
@@ -1883,30 +1957,48 @@ export async function runChimphands(opts) {
         }
         const waitForNextPrompt = () => new Promise((resolve) => {
             let lastPollAt = 0;
+            let settled = false;
+            const finish = (value) => {
+                if (settled)
+                    return;
+                settled = true;
+                wakeWaitForPrompt = null;
+                resolve(value);
+            };
+            wakeWaitForPrompt = () => {
+                if (settled)
+                    return;
+                if (queue.length) {
+                    finish(normalizeUserMessage(queue.shift()));
+                    return;
+                }
+                if (idle || Date.now() - lastUserActivity >= idleMs) {
+                    finish(null);
+                }
+            };
             const tick = () => {
+                if (settled)
+                    return;
                 if (queue.length) {
-                    resolve(normalizeUserMessage(queue.shift()));
+                    finish(normalizeUserMessage(queue.shift()));
                     return;
                 }
                 const now = Date.now();
+                if (idle || now - lastUserActivity >= idleMs) {
+                    finish(null);
+                    return;
+                }
+                // Never gate the idle clock on consume_pending — a hung poll used to
+                // block waitForNextPrompt forever and keep the Actions job alive.
                 if (now - lastPollAt >= 1500) {
                     lastPollAt = now;
                     void pollPendingUserMessages().then(() => {
-                        if (queue.length) {
-                            resolve(normalizeUserMessage(queue.shift()));
-                            return;
-                        }
-                        if (idle || now - lastUserActivity >= idleMs) {
-                            resolve(null);
+                        if (settled)
                             return;
+                        if (queue.length) {
+                            finish(normalizeUserMessage(queue.shift()));
                         }
-                        setTimeout(tick, 500);
                     });
-                    return;
-                }
-                if (idle || now - lastUserActivity >= idleMs) {
-                    resolve(null);
-                    return;
                 }
                 setTimeout(tick, 500);
             };
@@ -1977,6 +2069,11 @@ export async function runChimphands(opts) {
                     console.error(`ChimpHands turn-end reconcile failed: ${err instanceof Error ? err.message : String(err)}`);
                 }
             }
+            // Async / no UI: checkpoint dirty worktree after each turn so PR + Files changed
+            // are reviewable when the user opens the session later (live VCS tunnel may be idle).
+            if (!poster.uiAttached) {
+                await commitAndPushDirtyWorktree("chimphands: commit after turn (async / no UI attached)");
+            }
             if (result.code !== 0 && !result.cancelled) {
                 const errMsg = (result.err || "opencode failed").trim() || "opencode failed";
                 console.error(`ChimpHands OpenCode failed: ${errMsg}`);
@@ -1996,7 +2093,7 @@ export async function runChimphands(opts) {
                     const detail = reportErr instanceof Error ? reportErr.message : String(reportErr);
                     console.error(`ChimpHands failed to report OpenCode error to backend: ${detail}`);
                     postEvent(ROLE_STATUS, errMsg, { status: STATUS_FAILED });
-                    complete(STATUS_FAILED, errMsg);
+                    await complete(STATUS_FAILED, errMsg);
                 }
                 exitCode = result.code || 1;
                 break;
@@ -2007,21 +2104,22 @@ export async function runChimphands(opts) {
             else {
                 postEvent(ROLE_STATUS, "Waiting for user input", { status: STATUS_WAITING_USER });
             }
+            await poster.flush();
             lastUserActivity = Date.now();
             idle = false;
             prompt = (await waitForNextPrompt()) || "";
         }
         if (exitCode == null) {
             console.error("ChimpHands session idle — no user input before timeout; completing.");
-            complete(STATUS_IDLE);
+            await complete(STATUS_IDLE);
         }
     }
     finally {
         await shutdownRuntime();
     }
-    if (exitCode != null) {
-        process.exit(exitCode);
-    }
+    // Always exit: tunnel WS / inbound SSE / heartbeat timers otherwise keep the
+    // Actions step alive after a successful idle teardown.
+    process.exit(exitCode ?? 0);
 }
 function startRuntimeHeartbeat(backend, apiKey, runtimeId, onUiAttached) {
     let stopped = false;
@@ -2111,10 +2209,29 @@ async function commitAndPushDirtyWorktree(message) {
             console.error(`ChimpHands git commit: ${commit.err || commit.out}`);
             return;
         }
-        const push = await run(["push", "-u", "origin", "HEAD"]);
+        let push = await run(["push", "-u", "origin", "HEAD"]);
         if (push.code !== 0) {
+            const detail = `${push.err || ""}\n${push.out || ""}`;
             console.error(`ChimpHands git push failed: ${push.err || push.out}`);
-            return;
+            try {
+                const { looksLikeGitAuthFailure, refreshGitAuth } = await import("./refreshGitAuth.js");
+                if (looksLikeGitAuthFailure(detail)) {
+                    console.error("ChimpHands reminting GitHub write token after push auth failure…");
+                    await refreshGitAuth();
+                    push = await run(["push", "-u", "origin", "HEAD"]);
+                    if (push.code !== 0) {
+                        console.error(`ChimpHands git push failed after refresh: ${push.err || push.out}`);
+                        return;
+                    }
+                }
+                else {
+                    return;
+                }
+            }
+            catch (refreshErr) {
+                console.error(`ChimpHands refresh-git-auth after push failure: ${refreshErr instanceof Error ? refreshErr.message : String(refreshErr)}`);
+                return;
+            }
         }
         console.error(`ChimpHands committed and pushed dirty worktree on ${current} before shutdown`);
     }
@@ -2125,7 +2242,10 @@ async function commitAndPushDirtyWorktree(message) {
 function opencodeProxyNeedsDirectory(path) {
     const p = path.startsWith("/") ? path : `/${path}`;
     return (p.startsWith("/vcs") ||
+        p.startsWith("/api/vcs") ||
         p.startsWith("/file") ||
+        p.startsWith("/api/fs") ||
+        p.startsWith("/api/session") ||
         p.startsWith("/path") ||
         p.startsWith("/session") ||
         p.startsWith("/instance") ||

package/dist/cli/program.js

@@ -1584,6 +1584,21 @@ export function buildCliProgram() {
             process.exit(1);
         }
     });
+    chimphands
+        .command("refresh-git-auth")
+        .description("Remint a short-lived GitHub App installation token and apply it for git/gh (never prints the token)")
+        .action(async () => {
+        const { refreshGitAuth } = await import("../chimphands/refreshGitAuth.js");
+        try {
+            const result = await refreshGitAuth();
+            console.log(JSON.stringify(result));
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            console.error(`[testchimp chimphands refresh-git-auth] ${msg}`);
+            process.exit(1);
+        }
+    });
     chimphands
         .command("run")
         .description("Bootstrap session, configure OpenCode, and run the interactive bridge")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@testchimp/cli",
-  "version": "0.1.63",
+  "version": "0.1.65",
   "description": "TestChimp CLI and MCP server — coverage, plans, EaaS, TrueCoverage, API operations (calls /api/mcp/*)",
   "type": "module",
   "main": "dist/bin/testchimp.js",