@testchimp/cli 0.1.64 → 0.1.66

package/dist/chimphands/refreshGitAuth.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Remint a short-lived GitHub App installation token and apply it for git/gh.
+ * Never prints the token. Safe for ChimpHands agents and GHA runners.
+ */
+export type RefreshGitAuthResult = {
+    ok: true;
+    repositoryFullName: string;
+    expiresAtMillis: number;
+};
+/**
+ * Mint a ~1h GitHub App installation token and apply it for subsequent git/gh
+ * in this process (and this GHA job when GITHUB_ENV is set).
+ *
+ * Does **not** print the token. Applies via:
+ * - process.env GH_TOKEN / GITHUB_TOKEN
+ * - $GITHUB_ENV when present (GitHub Actions)
+ * - origin remote URL rewrite (https github.com) when possible
+ * - `gh auth login --with-token` + `gh auth setup-git` when `gh` exists
+ */
+export declare function refreshGitAuth(): Promise<RefreshGitAuthResult>;
+/** True when stderr/stdout looks like expired / rejected GitHub credentials. */
+export declare function looksLikeGitAuthFailure(text: string): boolean;

package/dist/chimphands/refreshGitAuth.js

@@ -0,0 +1,139 @@
+/**
+ * Remint a short-lived GitHub App installation token and apply it for git/gh.
+ * Never prints the token. Safe for ChimpHands agents and GHA runners.
+ */
+import { spawn } from "node:child_process";
+import { appendFileSync } from "node:fs";
+import { getBackendUrl, requireApiKey } from "../core/client.js";
+function run(cmd, args, env) {
+    return new Promise((resolve) => {
+        const child = spawn(cmd, args, {
+            stdio: ["ignore", "pipe", "pipe"],
+            env: env ? { ...process.env, ...env } : process.env,
+        });
+        let out = "";
+        let err = "";
+        child.stdout.on("data", (d) => {
+            out += d.toString();
+        });
+        child.stderr.on("data", (d) => {
+            err += d.toString();
+        });
+        child.on("close", (code) => resolve({ code: code ?? 1, out, err }));
+        child.on("error", (e) => resolve({ code: 1, out: "", err: e instanceof Error ? e.message : String(e) }));
+    });
+}
+function pipeTokenToGh(token) {
+    return new Promise((resolve) => {
+        const child = spawn("gh", ["auth", "login", "--with-token"], {
+            stdio: ["pipe", "ignore", "pipe"],
+            env: process.env,
+        });
+        let err = "";
+        child.stderr.on("data", (d) => {
+            err += d.toString();
+        });
+        child.on("close", (code) => resolve({ code: code ?? 1, err }));
+        child.on("error", (e) => resolve({ code: 1, err: e instanceof Error ? e.message : String(e) }));
+        child.stdin.write(token);
+        child.stdin.end();
+    });
+}
+function injectTokenIntoGithubHttpsUrl(remoteUrl, token) {
+    // https://github.com/owner/repo.git or https://x-access-token:OLD@github.com/owner/repo.git
+    const m = remoteUrl.match(/^https:\/\/(?:[^@]+@)?github\.com\/([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?\s*$/i);
+    if (!m)
+        return null;
+    const owner = m[1];
+    const repo = m[2].replace(/\.git$/i, "");
+    return `https://x-access-token:${token}@github.com/${owner}/${repo}.git`;
+}
+async function mintGithubWriteToken() {
+    const apiKey = requireApiKey();
+    const backend = getBackendUrl();
+    const res = await fetch(`${backend}/api/chimphands/github_write_token`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            "TestChimp-Api-Key": apiKey,
+        },
+        body: "{}",
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        throw new Error(`github_write_token failed HTTP ${res.status}: ${text}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error("github_write_token returned non-JSON");
+    }
+    const token = (parsed.token || "").trim();
+    if (!token) {
+        throw new Error("github_write_token returned empty token");
+    }
+    const repositoryFullName = (parsed.repositoryFullName ||
+        parsed.repository_full_name ||
+        "").trim();
+    const expiresAtMillis = Number(parsed.expiresAtMillis ?? parsed.expires_at_millis) ||
+        Date.now() + 60 * 60 * 1000;
+    return { token, repositoryFullName, expiresAtMillis };
+}
+/**
+ * Mint a ~1h GitHub App installation token and apply it for subsequent git/gh
+ * in this process (and this GHA job when GITHUB_ENV is set).
+ *
+ * Does **not** print the token. Applies via:
+ * - process.env GH_TOKEN / GITHUB_TOKEN
+ * - $GITHUB_ENV when present (GitHub Actions)
+ * - origin remote URL rewrite (https github.com) when possible
+ * - `gh auth login --with-token` + `gh auth setup-git` when `gh` exists
+ */
+export async function refreshGitAuth() {
+    const { token, repositoryFullName, expiresAtMillis } = await mintGithubWriteToken();
+    process.env.GH_TOKEN = token;
+    process.env.GITHUB_TOKEN = token;
+    const githubEnvPath = process.env.GITHUB_ENV?.trim();
+    if (githubEnvPath) {
+        try {
+            appendFileSync(githubEnvPath, `GH_TOKEN=${token}\nGITHUB_TOKEN=${token}\n`, "utf8");
+        }
+        catch (e) {
+            console.error(`ChimpHands refresh-git-auth: could not write GITHUB_ENV: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    const remote = await run("git", ["remote", "get-url", "origin"]);
+    if (remote.code === 0) {
+        const current = remote.out.trim();
+        const next = injectTokenIntoGithubHttpsUrl(current, token);
+        if (next) {
+            const set = await run("git", ["remote", "set-url", "origin", next]);
+            if (set.code !== 0) {
+                console.error(`ChimpHands refresh-git-auth: git remote set-url failed: ${set.err || set.out}`);
+            }
+        }
+    }
+    const ghLogin = await pipeTokenToGh(token);
+    if (ghLogin.code !== 0) {
+        // setup-git alone still helps when login is already present / unavailable
+        console.error(`ChimpHands refresh-git-auth: gh auth login skipped/failed: ${ghLogin.err || "non-zero"}`);
+    }
+    const setup = await run("gh", ["auth", "setup-git"], {
+        GH_TOKEN: token,
+        GITHUB_TOKEN: token,
+    });
+    if (setup.code !== 0) {
+        console.error(`ChimpHands refresh-git-auth: gh auth setup-git: ${setup.err || setup.out}`);
+    }
+    console.error(`ChimpHands refresh-git-auth: reminted GitHub App installation token` +
+        (repositoryFullName ? ` for ${repositoryFullName}` : "") +
+        ` (expires ~${new Date(expiresAtMillis).toISOString()})`);
+    return { ok: true, repositoryFullName, expiresAtMillis };
+}
+/** True when stderr/stdout looks like expired / rejected GitHub credentials. */
+export function looksLikeGitAuthFailure(text) {
+    const t = text.toLowerCase();
+    return (/authentication failed|could not read username|invalid username or password|bad credentials|401\b|403\b|permission.*denied|remote:.*denied|write access not granted|repository not found/.test(t) || /gh:\s*to get started|gh auth login|HTTP\s*401|HTTP\s*403/.test(t));
+}

package/dist/chimphands/run.js

@@ -75,6 +75,7 @@ const CHIMPHANDS_AGENT_PROMPT = `You are ChimpHands, TestChimp's coding agent. Y
 - After the branch is on the remote (and after opening a PR), IMMEDIATELY run:
   \`testchimp chimphands report-branch --branch <name> [--pr-url <url>]\`
 - Tell the user which branch you are on and include the PR URL when available.
+- **GitHub auth expiry (self-fix):** Job-start App installation tokens expire after ~1 hour. On \`git push\` / \`gh\` auth failures (401/403 / Authentication failed / write access not granted), run \`testchimp chimphands refresh-git-auth\` then retry — **never** ask the user to paste or reconnect a GitHub token in chat. See skill \`references/chimphands-faq.md\`.
 
 ## TestChimp workflows (/testchimp …)
 - Load and follow the \`testchimp\` skill under \`.agents/skills/testchimp/SKILL.md\`.
@@ -124,17 +125,26 @@ function apiHeaders(apiKey) {
         "TestChimp-Api-Key": apiKey,
     };
 }
+const POST_JSON_TIMEOUT_MS = 30_000;
 async function postJson(backend, apiKey, path, body) {
-    const res = await fetch(`${backend}${path}`, {
-        method: "POST",
-        headers: apiHeaders(apiKey),
-        body: JSON.stringify(body ?? {}),
-    });
-    const text = await res.text();
-    if (!res.ok) {
-        throw new Error(`ChimpHands API ${res.status} ${path}: ${text}`);
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), POST_JSON_TIMEOUT_MS);
+    try {
+        const res = await fetch(`${backend}${path}`, {
+            method: "POST",
+            headers: apiHeaders(apiKey),
+            body: JSON.stringify(body ?? {}),
+            signal: ac.signal,
+        });
+        const text = await res.text();
+        if (!res.ok) {
+            throw new Error(`ChimpHands API ${res.status} ${path}: ${text}`);
+        }
+        return text;
+    }
+    finally {
+        clearTimeout(timer);
     }
-    return text;
 }
 /** Serializes agent event posts so streaming chunks fan out in order. */
 class AgentEventPoster {
@@ -319,12 +329,29 @@ function mapToolExecutionStatus(status) {
         return TOOL_STATUS_ERROR;
     return undefined;
 }
+/** First observed start time per OpenCode tool part — progress updates must not reset the UI countdown. */
+const toolStartedAtByPartId = new Map();
 function toolExecutionFromOpencodePart(part) {
     const status = mapToolExecutionStatus(part.state?.status);
     if (!status)
         return undefined;
-    const startedAtMillis = normalizeEpochMillis(part.state?.time?.start) ??
-        (status === TOOL_STATUS_RUNNING ? Date.now() : undefined);
+    const partKey = String(part.id || part.messageID || "").trim();
+    const fromOpencode = normalizeEpochMillis(part.state?.time?.start);
+    const cached = partKey ? toolStartedAtByPartId.get(partKey) : undefined;
+    const isActive = status === TOOL_STATUS_PENDING || status === TOOL_STATUS_RUNNING;
+    let startedAtMillis = cached ?? fromOpencode;
+    if (startedAtMillis == null && isActive) {
+        startedAtMillis = Date.now();
+    }
+    if (partKey) {
+        if (isActive && startedAtMillis != null) {
+            toolStartedAtByPartId.set(partKey, startedAtMillis);
+        }
+        else if (status === TOOL_STATUS_COMPLETED ||
+            status === TOOL_STATUS_ERROR) {
+            toolStartedAtByPartId.delete(partKey);
+        }
+    }
     const endedAtMillis = normalizeEpochMillis(part.state?.time?.end);
     const toolName = String(part.state?.title || part.tool || "").trim() || undefined;
     const timeoutMillis = coerceTimeoutMillis(part.state?.input);
@@ -926,8 +953,8 @@ function detectWorkingBranchFromToolOutput(output) {
     const prMatch = text.match(/https:\/\/github\.com\/[^\s)\]]+\/pull\/\d+/);
     // Only auto-detect after a successful push to origin — local checkout -b alone would
     // report a branch URL that 404s until the remote ref exists.
-    const pushMatch = text.match(/push\s+(?:--set-upstream\s+|-u\s+)?origin\s+((?:testchimp-|chimphands-)[^\s'"]+)/i);
-    const branch = pushMatch?.[1]?.replace(/[`'"]/g, "");
+    const pushMatch = text.match(/push\s+(?:--set-upstream\s+|-u\s+)?origin\s+((?:testchimp-|chimphands-)[^\s'"\[\]]+)/i);
+    const branch = pushMatch?.[1]?.replace(/[`'"\[\]]/g, "");
     return {
         branch,
         pullRequestUrl: prMatch?.[0],
@@ -1449,6 +1476,7 @@ function connectInboundStream(backend, apiKey, sessionId, handlers) {
     let stopped = false;
     let reconnectTimer = null;
     let reconnectDelayMs = 1000;
+    let activeReq = null;
     const scheduleReconnect = () => {
         if (stopped || !handlers.shouldRun())
             return;
@@ -1463,6 +1491,15 @@ function connectInboundStream(backend, apiKey, sessionId, handlers) {
     const connect = () => {
         if (stopped || !handlers.shouldRun())
             return;
+        if (activeReq) {
+            try {
+                activeReq.destroy();
+            }
+            catch {
+                /* ignore */
+            }
+            activeReq = null;
+        }
         const req = lib.request({
             hostname: url.hostname,
             port: url.port || (url.protocol === "https:" ? 443 : 80),
@@ -1541,16 +1578,36 @@ function connectInboundStream(backend, apiKey, sessionId, handlers) {
                     }
                 }
             });
-            res.on("end", () => scheduleReconnect());
+            res.on("end", () => {
+                if (activeReq === req)
+                    activeReq = null;
+                scheduleReconnect();
+            });
+        });
+        activeReq = req;
+        req.on("error", () => {
+            if (activeReq === req)
+                activeReq = null;
+            scheduleReconnect();
         });
-        req.on("error", () => scheduleReconnect());
         req.end();
     };
     connect();
     return () => {
         stopped = true;
-        if (reconnectTimer)
+        if (reconnectTimer) {
             clearTimeout(reconnectTimer);
+            reconnectTimer = null;
+        }
+        if (activeReq) {
+            try {
+                activeReq.destroy();
+            }
+            catch {
+                /* ignore */
+            }
+            activeReq = null;
+        }
     };
 }
 export async function runChimphands(opts) {
@@ -1716,14 +1773,52 @@ export async function runChimphands(opts) {
     let lastUserActivity = Date.now();
     let exitCode;
     let cancelTurnRequested = false;
+    /** True when cancel was triggered by a mid-turn user message (steer), not Stop. */
+    let steerAbortRequested = false;
     let activeOpencodeChild = null;
     let agentTurnInProgress = false;
+    /** Wakes waitForNextPrompt when idle is signaled (SSE) or a user message arrives. */
+    let wakeWaitForPrompt = null;
+    const wakePromptWaiter = () => {
+        const wake = wakeWaitForPrompt;
+        wakeWaitForPrompt = null;
+        wake?.();
+    };
     const turnControl = {
         getCancelRequested: () => cancelTurnRequested,
         onActiveChild: (child) => {
             activeOpencodeChild = child;
         },
     };
+    /** Abort in-flight OpenCode turn (session HTTP abort + kill `opencode run` child). */
+    const abortActiveTurn = (reason) => {
+        cancelTurnRequested = true;
+        if (reason === "steer") {
+            steerAbortRequested = true;
+        }
+        const sessionToAbort = opencodeSessionId?.trim();
+        if (attachUrl && sessionToAbort) {
+            void abortOpencodeSession(attachUrl, sessionToAbort);
+        }
+        const ch = activeOpencodeChild;
+        if (ch && !ch.killed) {
+            try {
+                ch.kill("SIGTERM");
+                setTimeout(() => {
+                    try {
+                        if (!ch.killed)
+                            ch.kill("SIGKILL");
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                }, 2000);
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    };
     const enqueueUserMessage = (msg) => {
         const id = msg.id?.trim();
         if (id) {
@@ -1739,6 +1834,13 @@ export async function runChimphands(opts) {
         idle = false;
         const preview = content.length > 120 ? `${content.slice(0, 117)}...` : content;
         console.error(`ChimpHands queued user message (turnActive=${agentTurnInProgress}, depth=${queue.length}): ${JSON.stringify(preview)}`);
+        // OpenCode has no mid-turn inject: abort the active turn so the queued
+        // message is consumed immediately as the next prompt (course-correct).
+        if (agentTurnInProgress && !cancelTurnRequested) {
+            console.error(`ChimpHands steering: aborting active turn so queued user message reaches OpenCode`);
+            abortActiveTurn("steer");
+        }
+        wakePromptWaiter();
     };
     const pollPendingUserMessages = async () => {
         try {
@@ -1781,15 +1883,18 @@ export async function runChimphands(opts) {
         }
         postEvent(role, content, opts);
     };
-    const complete = (status, errorMessage) => {
+    const complete = async (status, errorMessage) => {
         const body = { sessionId, status };
         if (errorMessage)
             body.errorMessage = String(errorMessage).slice(0, 4000);
         if (githubRunId)
             body.githubRunId = githubRunId;
-        void postJson(backend, apiKey, "/api/chimphands/complete_session", body).catch((err) => {
+        try {
+            await postJson(backend, apiKey, "/api/chimphands/complete_session", body);
+        }
+        catch (err) {
             console.error(`ChimpHands complete_session failed: ${err instanceof Error ? err.message : String(err)}`);
-        });
+        }
     };
     const childEnv = {
         ...process.env,
@@ -1801,34 +1906,14 @@ export async function runChimphands(opts) {
         childEnv.TESTCHIMP_USER_ID = userId;
     const handleCancelTurn = () => {
         console.error(`ChimpHands cancel_turn received for session ${sessionId}`);
-        cancelTurnRequested = true;
-        const sessionToAbort = opencodeSessionId?.trim();
-        if (attachUrl && sessionToAbort) {
-            void abortOpencodeSession(attachUrl, sessionToAbort);
-        }
-        const ch = activeOpencodeChild;
-        if (ch && !ch.killed) {
-            try {
-                ch.kill("SIGTERM");
-                setTimeout(() => {
-                    try {
-                        if (!ch.killed)
-                            ch.kill("SIGKILL");
-                    }
-                    catch {
-                        /* ignore */
-                    }
-                }, 2000);
-            }
-            catch {
-                /* ignore */
-            }
-        }
+        steerAbortRequested = false;
+        abortActiveTurn("cancel");
     };
     const stopInbound = connectInboundStream(backend, apiKey, sessionId, {
         onUserMessage: enqueueUserMessage,
         onIdle: () => {
             idle = true;
+            wakePromptWaiter();
         },
         onCancelTurn: handleCancelTurn,
         onUserFileEdit: handleUserFileEdit,
@@ -1856,6 +1941,7 @@ export async function runChimphands(opts) {
             stopLiveSse();
             stopLiveSse = null;
         }
+        wakePromptWaiter();
         await commitAndPushDirtyWorktree("chimphands: commit before session idle/shutdown");
         await poster.flush();
         if (runtimeId) {
@@ -1887,30 +1973,48 @@ export async function runChimphands(opts) {
         }
         const waitForNextPrompt = () => new Promise((resolve) => {
             let lastPollAt = 0;
+            let settled = false;
+            const finish = (value) => {
+                if (settled)
+                    return;
+                settled = true;
+                wakeWaitForPrompt = null;
+                resolve(value);
+            };
+            wakeWaitForPrompt = () => {
+                if (settled)
+                    return;
+                if (queue.length) {
+                    finish(normalizeUserMessage(queue.shift()));
+                    return;
+                }
+                if (idle || Date.now() - lastUserActivity >= idleMs) {
+                    finish(null);
+                }
+            };
             const tick = () => {
+                if (settled)
+                    return;
                 if (queue.length) {
-                    resolve(normalizeUserMessage(queue.shift()));
+                    finish(normalizeUserMessage(queue.shift()));
                     return;
                 }
                 const now = Date.now();
+                if (idle || now - lastUserActivity >= idleMs) {
+                    finish(null);
+                    return;
+                }
+                // Never gate the idle clock on consume_pending — a hung poll used to
+                // block waitForNextPrompt forever and keep the Actions job alive.
                 if (now - lastPollAt >= 1500) {
                     lastPollAt = now;
                     void pollPendingUserMessages().then(() => {
-                        if (queue.length) {
-                            resolve(normalizeUserMessage(queue.shift()));
-                            return;
-                        }
-                        if (idle || now - lastUserActivity >= idleMs) {
-                            resolve(null);
+                        if (settled)
                             return;
+                        if (queue.length) {
+                            finish(normalizeUserMessage(queue.shift()));
                         }
-                        setTimeout(tick, 500);
                     });
-                    return;
-                }
-                if (idle || now - lastUserActivity >= idleMs) {
-                    resolve(null);
-                    return;
                 }
                 setTimeout(tick, 500);
             };
@@ -1918,11 +2022,21 @@ export async function runChimphands(opts) {
         });
         while (prompt) {
             cancelTurnRequested = false;
+            const wasSteered = steerAbortRequested;
+            steerAbortRequested = false;
             agentTurnInProgress = true;
             let useOpencodeSessionId = opencodeSessionId;
             let isNewOpencodeSession = !useOpencodeSessionId;
-            let effectivePrompt = wrapPromptWithContext(conversationSummary, prompt, isNewOpencodeSession, workingBranch, pullRequestUrl);
-            const turnPostEvent = (role, content, opts) => postEventForTurn(prompt, effectivePrompt, role, content, opts);
+            const promptForOpencode = wasSteered
+                ? [
+                    "The previous agent turn was interrupted because the user sent a new message.",
+                    "Stop any long-running watch/poll that no longer applies. Course-correct using this guidance:",
+                    "",
+                    prompt,
+                ].join("\n")
+                : prompt;
+            let effectivePrompt = wrapPromptWithContext(conversationSummary, promptForOpencode, isNewOpencodeSession, workingBranch, pullRequestUrl);
+            const turnPostEvent = (role, content, opts) => postEventForTurn(promptForOpencode, effectivePrompt, role, content, opts);
             // Visible in chat (not filtered as routine). OpenCode may not emit text until a
             // part completes — without this the UI looks empty while the turn is running.
             postEvent(ROLE_STATUS, "Agent is working…", { status: STATUS_RUNNING });
@@ -2005,32 +2119,37 @@ export async function runChimphands(opts) {
                     const detail = reportErr instanceof Error ? reportErr.message : String(reportErr);
                     console.error(`ChimpHands failed to report OpenCode error to backend: ${detail}`);
                     postEvent(ROLE_STATUS, errMsg, { status: STATUS_FAILED });
-                    complete(STATUS_FAILED, errMsg);
+                    await complete(STATUS_FAILED, errMsg);
                 }
                 exitCode = result.code || 1;
                 break;
             }
-            if (result.cancelled) {
+            if (result.cancelled && (steerAbortRequested || queue.length > 0)) {
+                // Mid-turn user message aborted this turn — run the queued prompt next.
+                postEvent(ROLE_STATUS, "Incorporating your message…", { status: STATUS_RUNNING });
+            }
+            else if (result.cancelled) {
                 postEvent(ROLE_STATUS, "Turn stopped", { status: STATUS_WAITING_USER });
             }
             else {
                 postEvent(ROLE_STATUS, "Waiting for user input", { status: STATUS_WAITING_USER });
             }
+            await poster.flush();
             lastUserActivity = Date.now();
             idle = false;
             prompt = (await waitForNextPrompt()) || "";
         }
         if (exitCode == null) {
             console.error("ChimpHands session idle — no user input before timeout; completing.");
-            complete(STATUS_IDLE);
+            await complete(STATUS_IDLE);
         }
     }
     finally {
         await shutdownRuntime();
     }
-    if (exitCode != null) {
-        process.exit(exitCode);
-    }
+    // Always exit: tunnel WS / inbound SSE / heartbeat timers otherwise keep the
+    // Actions step alive after a successful idle teardown.
+    process.exit(exitCode ?? 0);
 }
 function startRuntimeHeartbeat(backend, apiKey, runtimeId, onUiAttached) {
     let stopped = false;
@@ -2120,10 +2239,29 @@ async function commitAndPushDirtyWorktree(message) {
             console.error(`ChimpHands git commit: ${commit.err || commit.out}`);
             return;
         }
-        const push = await run(["push", "-u", "origin", "HEAD"]);
+        let push = await run(["push", "-u", "origin", "HEAD"]);
         if (push.code !== 0) {
+            const detail = `${push.err || ""}\n${push.out || ""}`;
             console.error(`ChimpHands git push failed: ${push.err || push.out}`);
-            return;
+            try {
+                const { looksLikeGitAuthFailure, refreshGitAuth } = await import("./refreshGitAuth.js");
+                if (looksLikeGitAuthFailure(detail)) {
+                    console.error("ChimpHands reminting GitHub write token after push auth failure…");
+                    await refreshGitAuth();
+                    push = await run(["push", "-u", "origin", "HEAD"]);
+                    if (push.code !== 0) {
+                        console.error(`ChimpHands git push failed after refresh: ${push.err || push.out}`);
+                        return;
+                    }
+                }
+                else {
+                    return;
+                }
+            }
+            catch (refreshErr) {
+                console.error(`ChimpHands refresh-git-auth after push failure: ${refreshErr instanceof Error ? refreshErr.message : String(refreshErr)}`);
+                return;
+            }
         }
         console.error(`ChimpHands committed and pushed dirty worktree on ${current} before shutdown`);
     }

package/dist/cli/program.js

@@ -1584,6 +1584,21 @@ export function buildCliProgram() {
             process.exit(1);
         }
     });
+    chimphands
+        .command("refresh-git-auth")
+        .description("Remint a short-lived GitHub App installation token and apply it for git/gh (never prints the token)")
+        .action(async () => {
+        const { refreshGitAuth } = await import("../chimphands/refreshGitAuth.js");
+        try {
+            const result = await refreshGitAuth();
+            console.log(JSON.stringify(result));
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            console.error(`[testchimp chimphands refresh-git-auth] ${msg}`);
+            process.exit(1);
+        }
+    });
     chimphands
         .command("run")
         .description("Bootstrap session, configure OpenCode, and run the interactive bridge")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@testchimp/cli",
-  "version": "0.1.64",
+  "version": "0.1.66",
   "description": "TestChimp CLI and MCP server — coverage, plans, EaaS, TrueCoverage, API operations (calls /api/mcp/*)",
   "type": "module",
   "main": "dist/bin/testchimp.js",