@themoltnet/pi-extension 0.24.0 → 0.24.1

package/dist/index.js

@@ -8824,8 +8824,7 @@ async function resumeVm(config) {
 			signal: config.signal
 		});
 		if (creds.gitconfig) {
-			const vmSigningKey = `${vmSshDir}/id_ed25519`;
-			const vmGitconfig = creds.gitconfig.replace(/signingKey\s*=\s*.+/g, `signingKey = ${vmSigningKey}`);
+			const vmGitconfig = rewriteGitconfigPaths(creds.gitconfig, vmSshDir, vmAgentDir);
 			await vm.fs.writeFile(`${vmAgentDir}/gitconfig`, vmGitconfig, {
 				mode: 420,
 				signal: config.signal
@@ -8848,17 +8847,6 @@ async function resumeVm(config) {
 			signal: config.signal
 		});
 		await vm.exec("chown -R agent:agent /home/agent/.pi /home/agent/.moltnet", { signal: config.signal });
-		const gitCredHelperPath = `${vmSshDir}/git-credential-moltnet`;
-		const credHelperScript = `#!/bin/sh
-echo "username=x-access-token"
-echo "password=$(moltnet github token --credentials ${vmSshDir}/moltnet.json)"
-`;
-		await vm.fs.writeFile(gitCredHelperPath, credHelperScript, {
-			mode: 493,
-			signal: config.signal
-		});
-		await vmRun(vm, "git credential helper", `git config --global credential.helper ${gitCredHelperPath} && \
-       git config --global url."https://github.com/".insteadOf "git@github.com:"`, config.signal);
 		return {
 			vm,
 			credentials: creds,
@@ -8877,6 +8865,30 @@ echo "password=$(moltnet github token --credentials ${vmSshDir}/moltnet.json)"
 	}
 }
 /**
+* Rewrite host-absolute paths inside an agent gitconfig to VM-local
+* equivalents before injecting it into the guest.
+*
+* Two rewrites:
+*   - `signingKey = <host path>`  → `<vmSshDir>/id_ed25519`
+*   - `... credential-helper --credentials <host moltnet.json>`
+*                                 → `<vmAgentDir>/moltnet.json`
+*
+* The credential-helper line is generated host-side by `moltnet github setup`
+* with a host-absolute `--credentials` path; inside the guest that path is
+* invalid, so it must point at the VM-side moltnet.json. The `insteadOf`
+* rewrite rule and every other line are workspace-independent and pass through
+* unchanged. A gitconfig without a credential helper is rewritten only for
+* `signingKey`.
+*
+* This is the single source of truth for git push auth in the guest: the
+* injected gitconfig carries the tokenless mint-on-demand helper, so the VM
+* no longer hand-rolls a credential-helper script or runs an imperative
+* `git config --global ... insteadOf` against the guest $HOME.
+*/
+function rewriteGitconfigPaths(gitconfig, vmSshDir, vmAgentDir) {
+	return gitconfig.replace(/signingKey\s*=\s*.+/g, `signingKey = ${vmSshDir}/id_ed25519`).replace(/(moltnet github credential-helper --credentials )\S+/g, `$1${vmAgentDir}/moltnet.json`);
+}
+/**
 * Rewrite host-absolute paths inside moltnet.json to VM-local equivalents.
 *
 * Fields rewritten:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-extension",
-  "version": "0.24.0",
+  "version": "0.24.1",
   "type": "module",
   "description": "MoltNet pi extension — sandboxed tool execution in Gondolin VMs with MoltNet identity and persistent memory",
   "keywords": [