agentic-pi 0.1.0

package/dist/extensions/github/client.js

@@ -0,0 +1,358 @@
+/**
+ * Thin wrapper around Octokit that refreshes the token automatically.
+ *
+ * Ported 1:1 from mcp-github-app/src/github.js with TypeScript types.
+ * All method names, parameters, and behaviour match the original — the goal
+ * is bit-compatible JSON responses so the dashboard shim keeps working.
+ */
+import { Octokit } from "@octokit/rest";
+const MAX_RETRIES = 3;
+const BASE_DELAY_MS = 1000;
+const RETRYABLE_STATUSES = new Set([408, 429, 500, 502, 503, 504]);
+/**
+ * LLMs that see optional fields in a tool's JSON Schema sometimes emit
+ * zero / empty-string values for ones they didn't actually want to set.
+ * Strip those before spreading into an Octokit call so the API only sees
+ * fields the agent meant to pass.
+ */
+function omitFalsy(opts) {
+    const out = {};
+    for (const [k, v] of Object.entries(opts ?? {})) {
+        if (v === undefined || v === null || v === "" || v === 0)
+            continue;
+        if (Array.isArray(v) && v.length === 0)
+            continue;
+        out[k] = v;
+    }
+    return out;
+}
+export class GitHubClient {
+    auth;
+    _octokit = null;
+    _tokenUsed = null;
+    constructor(auth) {
+        this.auth = auth;
+    }
+    async octokit() {
+        const token = await this.auth.getToken();
+        if (token !== this._tokenUsed) {
+            this._octokit = new Octokit({ auth: token });
+            this._tokenUsed = token;
+        }
+        return this._octokit;
+    }
+    async withRetry(fn) {
+        let lastError;
+        for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+            try {
+                return await fn();
+            }
+            catch (err) {
+                lastError = err;
+                const e = err;
+                const status = e.status || e.response?.status;
+                if (status && status >= 400 && status < 500 && !RETRYABLE_STATUSES.has(status)) {
+                    throw err;
+                }
+                if (attempt === MAX_RETRIES)
+                    break;
+                let delayMs;
+                if (status === 429) {
+                    const retryAfter = e.response?.headers?.["retry-after"];
+                    delayMs = retryAfter ? parseInt(retryAfter, 10) * 1000 : BASE_DELAY_MS * Math.pow(2, attempt);
+                }
+                else {
+                    delayMs = BASE_DELAY_MS * Math.pow(2, attempt);
+                }
+                if (status === 401) {
+                    this._tokenUsed = null;
+                }
+                await new Promise((r) => setTimeout(r, delayMs));
+            }
+        }
+        throw lastError;
+    }
+    // ── Repositories ──────────────────────────────────────────────────
+    async getRepository(owner, repo) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.repos.get({ owner, repo });
+            return data;
+        });
+    }
+    async getFileContents(owner, repo, path, branch) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const params = { owner, repo, path };
+            if (branch)
+                params.ref = branch;
+            const { data } = await ok.repos.getContent(params);
+            if (typeof data === "object" && data !== null && "content" in data && typeof data.content === "string") {
+                data.decoded_content = Buffer.from(data.content, "base64").toString("utf8");
+            }
+            return data;
+        });
+    }
+    async createOrUpdateFile(owner, repo, path, content, message, branch, sha) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const params = {
+                owner, repo, path, message,
+                content: Buffer.from(content).toString("base64"),
+            };
+            if (branch)
+                params.branch = branch;
+            if (sha)
+                params.sha = sha;
+            const { data } = await ok.repos.createOrUpdateFileContents(params);
+            return data;
+        });
+    }
+    async pushFiles(owner, repo, branch, files, message) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            let ref;
+            try {
+                const { data } = await ok.git.getRef({ owner, repo, ref: `heads/${branch}` });
+                ref = data;
+            }
+            catch {
+                const { data: repoData } = await ok.repos.get({ owner, repo });
+                const { data: defaultRef } = await ok.git.getRef({
+                    owner, repo, ref: `heads/${repoData.default_branch}`,
+                });
+                const { data: newRef } = await ok.git.createRef({
+                    owner, repo,
+                    ref: `refs/heads/${branch}`,
+                    sha: defaultRef.object.sha,
+                });
+                ref = newRef;
+            }
+            const blobs = await Promise.all(files.map(async (f) => {
+                const { data } = await ok.git.createBlob({
+                    owner, repo, content: f.content, encoding: "utf-8",
+                });
+                return { path: f.path, sha: data.sha, mode: "100644", type: "blob" };
+            }));
+            const { data: tree } = await ok.git.createTree({
+                owner, repo, base_tree: ref.object.sha, tree: blobs,
+            });
+            const { data: commit } = await ok.git.createCommit({
+                owner, repo, message, tree: tree.sha, parents: [ref.object.sha],
+            });
+            const { data: updated } = await ok.git.updateRef({
+                owner, repo, ref: `heads/${branch}`, sha: commit.sha,
+            });
+            return { commit: commit.sha, branch, ref: updated };
+        });
+    }
+    async listBranches(owner, repo, page = 1, perPage = 30) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.repos.listBranches({ owner, repo, page, per_page: perPage });
+            return data;
+        });
+    }
+    async createBranch(owner, repo, branch, fromBranch) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data: ref } = await ok.git.getRef({ owner, repo, ref: `heads/${fromBranch}` });
+            const { data } = await ok.git.createRef({
+                owner, repo, ref: `refs/heads/${branch}`, sha: ref.object.sha,
+            });
+            return data;
+        });
+    }
+    // ── Issues ────────────────────────────────────────────────────────
+    async listIssues(owner, repo, opts = {}) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.issues.listForRepo({
+                owner, repo, state: "open", per_page: 30, ...omitFalsy(opts),
+            });
+            return data;
+        });
+    }
+    async getIssue(owner, repo, issue_number) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.issues.get({ owner, repo, issue_number });
+            return data;
+        });
+    }
+    async createIssue(owner, repo, title, body, opts = {}) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.issues.create({
+                owner, repo, title, body, ...omitFalsy(opts),
+            });
+            return data;
+        });
+    }
+    async updateIssue(owner, repo, issue_number, updates) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.issues.update({
+                owner, repo, issue_number, ...omitFalsy(updates),
+            });
+            return data;
+        });
+    }
+    async addIssueComment(owner, repo, issue_number, body) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.issues.createComment({ owner, repo, issue_number, body });
+            return data;
+        });
+    }
+    async listIssueComments(owner, repo, issue_number, opts = {}) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.issues.listComments({
+                owner, repo, issue_number, per_page: 30, ...omitFalsy(opts),
+            });
+            return data;
+        });
+    }
+    async addLabels(owner, repo, issue_number, labels) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.issues.addLabels({ owner, repo, issue_number, labels });
+            return data;
+        });
+    }
+    async removeLabel(owner, repo, issue_number, name) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.issues.removeLabel({ owner, repo, issue_number, name });
+            return data;
+        });
+    }
+    async listLabels(owner, repo) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.issues.listLabelsForRepo({ owner, repo, per_page: 100 });
+            return data;
+        });
+    }
+    async createLabel(owner, repo, name, color, description) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.issues.createLabel({ owner, repo, name, color, description });
+            return data;
+        });
+    }
+    // ── Pull Requests ─────────────────────────────────────────────────
+    async listPullRequests(owner, repo, opts = {}) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const cleaned = {};
+            for (const [k, v] of Object.entries(opts)) {
+                if (v === "" || v === undefined || v === null)
+                    continue;
+                cleaned[k] = v;
+            }
+            const { data } = await ok.pulls.list({
+                owner, repo, state: "open", per_page: 30, ...cleaned,
+            });
+            return data;
+        });
+    }
+    async getPullRequest(owner, repo, pull_number) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.pulls.get({ owner, repo, pull_number });
+            return data;
+        });
+    }
+    async createPullRequest(owner, repo, title, body, head, base) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.pulls.create({ owner, repo, title, body, head, base });
+            return data;
+        });
+    }
+    async listPullRequestFiles(owner, repo, pull_number) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.pulls.listFiles({ owner, repo, pull_number, per_page: 100 });
+            return data;
+        });
+    }
+    async listPullRequestReviews(owner, repo, pull_number) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.pulls.listReviews({ owner, repo, pull_number, per_page: 100 });
+            return data;
+        });
+    }
+    async listPullRequestReviewComments(owner, repo, pull_number) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.pulls.listReviewComments({ owner, repo, pull_number, per_page: 100 });
+            return data;
+        });
+    }
+    async getPullRequestDiff(owner, repo, pull_number) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.pulls.get({
+                owner, repo, pull_number,
+                mediaType: { format: "diff" },
+            });
+            return data;
+        });
+    }
+    async createPullRequestReview(owner, repo, pull_number, body, event, comments = []) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const params = { owner, repo, pull_number, body, event: event };
+            if (comments.length)
+                params.comments = comments;
+            const { data } = await ok.pulls.createReview(params);
+            return data;
+        });
+    }
+    async mergePullRequest(owner, repo, pull_number, opts = {}) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.pulls.merge({
+                owner, repo, pull_number, ...opts,
+            });
+            return data;
+        });
+    }
+    // ── Commits ───────────────────────────────────────────────────────
+    async listCommits(owner, repo, opts = {}) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.repos.listCommits({
+                owner, repo, per_page: 30, ...opts,
+            });
+            return data;
+        });
+    }
+    // ── Search ────────────────────────────────────────────────────────
+    async searchRepositories(query, page = 1, perPage = 30) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.search.repos({ q: query, page, per_page: perPage });
+            return data;
+        });
+    }
+    async searchIssues(query, page = 1, perPage = 30) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.search.issuesAndPullRequests({ q: query, page, per_page: perPage });
+            return data;
+        });
+    }
+    async searchCode(query, page = 1, perPage = 30) {
+        return this.withRetry(async () => {
+            const ok = await this.octokit();
+            const { data } = await ok.search.code({ q: query, page, per_page: perPage });
+            return data;
+        });
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/extensions/github/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/extensions/github/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAGxC,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAOnE;;;;;GAKG;AACH,SAAS,SAAS,CAAoC,IAAmB;IACvE,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACnE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChD,GAA+B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,YAAY;IAIM;IAHrB,QAAQ,GAAmB,IAAI,CAAC;IAChC,UAAU,GAAkB,IAAI,CAAC;IAEzC,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,OAAO;QACX,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzC,IAAI,KAAK,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7C,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,QAAS,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,SAAS,CAAI,EAAoB;QAC7C,IAAI,SAAkB,CAAC;QACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YACxD,IAAI,CAAC;gBACH,OAAO,MAAM,EAAE,EAAE,CAAC;YACpB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,CAAC;gBAChB,MAAM,CAAC,GAAG,GAAqB,CAAC;gBAChC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAC9C,IAAI,MAAM,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/E,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,IAAI,OAAO,KAAK,WAAW;oBAAE,MAAM;gBACnC,IAAI,OAAe,CAAC;gBACpB,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;oBACnB,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;oBACxD,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBAChG,CAAC;qBAAM,CAAC;oBACN,OAAO,GAAG,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBACjD,CAAC;gBACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;oBACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBACzB,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QACD,MAAM,SAAS,CAAC;IAClB,CAAC;IAED,qEAAqE;IAErE,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,IAAY;QAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,IAAY,EAAE,IAAY,EAAE,MAAe;QAC9E,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,MAAM,GAAgE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAClG,IAAI,MAAM;gBAAE,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,SAAS,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACtG,IAAqC,CAAC,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,KAAa,EAAE,IAAY,EAAE,IAAY,EAAE,OAAe,EAAE,OAAe,EAC3E,MAAe,EAAE,GAAY;QAE7B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,MAAM,GAA8D;gBACxE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO;gBAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACjD,CAAC;YACF,IAAI,MAAM;gBAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YACnC,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;YAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CACb,KAAa,EAAE,IAAY,EAAE,MAAc,EAC3C,KAA+C,EAAE,OAAe;QAEhE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,IAAI,GAAG,CAAC;YACR,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC9E,GAAG,GAAG,IAAI,CAAC;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/D,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;oBAC/C,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,QAAQ,CAAC,cAAc,EAAE;iBACrD,CAAC,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;oBAC9C,KAAK,EAAE,IAAI;oBACX,GAAG,EAAE,cAAc,MAAM,EAAE;oBAC3B,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG;iBAC3B,CAAC,CAAC;gBACH,GAAG,GAAG,MAAM,CAAC;YACf,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;gBACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC;oBACvC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO;iBACnD,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,QAAiB,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC;YACzF,CAAC,CAAC,CACH,CAAC;YACF,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC;gBAC7C,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK;aACpD,CAAC,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC;gBACjD,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;aAChE,CAAC,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;gBAC/C,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG;aACrD,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,IAAY,EAAE,IAAI,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE;QACpE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACvF,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,IAAY,EAAE,MAAc,EAAE,UAAkB;QAChF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,UAAU,EAAE,EAAE,CAAC,CAAC;YACvF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;gBACtC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG;aAC9D,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IAErE,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,IAAY,EAAE,OAAgC,EAAE;QAC9E,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;gBAC3C,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC;aACd,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,IAAY,EAAE,YAAoB;QAC9D,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,IAAY,EAAE,KAAa,EAAE,IAAwB,EAAE,OAAgC,EAAE;QACxH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;gBACtC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC;aACH,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,IAAY,EAAE,YAAoB,EAAE,OAAgC;QACnG,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;gBACtC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC;aACP,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,IAAY,EAAE,YAAoB,EAAE,IAAY;QACnF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,IAAY,EAAE,YAAoB,EAAE,OAAgC,EAAE;QAC3G,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;gBAC5C,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC;aACZ,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,IAAY,EAAE,YAAoB,EAAE,MAAgB;QACjF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;YAClF,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,IAAY,EAAE,YAAoB,EAAE,IAAY;QAC/E,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,IAAY;QAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YACnF,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,IAAY,EAAE,IAAY,EAAE,KAAa,EAAE,WAAoB;QAC9F,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACxF,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IAErE,KAAK,CAAC,gBAAgB,CAAC,KAAa,EAAE,IAAY,EAAE,OAAgC,EAAE;QACpF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,OAAO,GAA4B,EAAE,CAAC;YAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;oBAAE,SAAS;gBACxD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;gBACnC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,OAAO;aACd,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,IAAY,EAAE,WAAmB;QACnE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,IAAY,EAAE,KAAa,EAAE,IAAwB,EAAE,IAAY,EAAE,IAAY;QACtH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjF,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAAa,EAAE,IAAY,EAAE,WAAmB;QACzE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YACvF,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,IAAY,EAAE,WAAmB;QAC3E,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YACzF,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,6BAA6B,CAAC,KAAa,EAAE,IAAY,EAAE,WAAmB;QAClF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YAChG,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,IAAY,EAAE,WAAmB;QACvE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;gBAClC,KAAK,EAAE,IAAI,EAAE,WAAW;gBACxB,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;aAC9B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,KAAa,EAAE,IAAY,EAAE,WAAmB,EAAE,IAAY,EAAE,KAAa,EAC7E,WAAoF,EAAE;QAEtF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,MAAM,GAAgD,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,KAAkD,EAAE,CAAC;YAC1J,IAAI,QAAQ,CAAC,MAAM;gBAAG,MAAyC,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACpF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAa,EAAE,IAAY,EAAE,WAAmB,EAAE,OAAgC,EAAE;QACzG,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;gBACpC,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI;aACM,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IAErE,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,IAAY,EAAE,OAAgC,EAAE;QAC/E,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;gBAC1C,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,IAAI;aACW,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IAErE,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,IAAI,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE;QAC5D,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,IAAI,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE;QACtD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9F,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,IAAI,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE;QACpD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/extensions/github/credentials.d.ts

@@ -0,0 +1,24 @@
+/**
+ * git credential-store credentials file management.
+ *
+ * Ported from mcp-github-app/src/index.js. Same shape, same guards.
+ * The credentials file is shared with the sandbox entrypoint and any agent
+ * git clone — we just rewrite the file with a fresh token when called.
+ */
+/**
+ * Conservative shape check on a GitHub installation token. The credentials
+ * file contains `https://x-access-token:${token}@github.com`, so any `@`,
+ * `:`, `/`, or newline in the token would break URL parsing or inject extra
+ * entries. Real tokens are alphanumeric (plus `_-`); this catches any future
+ * format change before we write a malformed file.
+ */
+export declare function assertSafeToken(token: unknown): asserts token is string;
+/**
+ * Resolve the credentials-file path. Mirrors lastlight's LASTLIGHT_GIT_CREDENTIALS
+ * convention but accepts an explicit override too.
+ */
+export declare function credentialsFilePath(envVar?: string): string;
+/**
+ * Write the credentials file. Mode 600, single line, no shell anywhere.
+ */
+export declare function writeCredentialsFile(token: string): string;

package/dist/extensions/github/credentials.js

@@ -0,0 +1,44 @@
+/**
+ * git credential-store credentials file management.
+ *
+ * Ported from mcp-github-app/src/index.js. Same shape, same guards.
+ * The credentials file is shared with the sandbox entrypoint and any agent
+ * git clone — we just rewrite the file with a fresh token when called.
+ */
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+/**
+ * Conservative shape check on a GitHub installation token. The credentials
+ * file contains `https://x-access-token:${token}@github.com`, so any `@`,
+ * `:`, `/`, or newline in the token would break URL parsing or inject extra
+ * entries. Real tokens are alphanumeric (plus `_-`); this catches any future
+ * format change before we write a malformed file.
+ */
+export function assertSafeToken(token) {
+    if (typeof token !== "string" || !/^[A-Za-z0-9_-]+$/.test(token)) {
+        throw new Error("Refusing to embed a token containing characters outside [A-Za-z0-9_-] into git credentials file");
+    }
+}
+/**
+ * Resolve the credentials-file path. Mirrors lastlight's LASTLIGHT_GIT_CREDENTIALS
+ * convention but accepts an explicit override too.
+ */
+export function credentialsFilePath(envVar = "LASTLIGHT_GIT_CREDENTIALS") {
+    const raw = (process.env[envVar] || "").trim() ||
+        join(process.env.HOME || "/tmp", ".lastlight-git-credentials");
+    if (/\s/.test(raw)) {
+        throw new Error(`${envVar} contains whitespace; git's helper-arg parsing would break: ${raw}`);
+    }
+    return raw;
+}
+/**
+ * Write the credentials file. Mode 600, single line, no shell anywhere.
+ */
+export function writeCredentialsFile(token) {
+    assertSafeToken(token);
+    const credPath = credentialsFilePath();
+    mkdirSync(dirname(credPath), { recursive: true, mode: 0o700 });
+    writeFileSync(credPath, `https://x-access-token:${token}@github.com\n`, { mode: 0o600 });
+    return credPath;
+}
+//# sourceMappingURL=credentials.js.map

package/dist/extensions/github/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/extensions/github/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,iGAAiG,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAM,GAAG,2BAA2B;IACtE,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,4BAA4B,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,+DAA+D,GAAG,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,eAAe,CAAC,KAAK,CAAC,CAAC;IACvB,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,aAAa,CAAC,QAAQ,EAAE,0BAA0B,KAAK,eAAe,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/extensions/github/index.d.ts

@@ -0,0 +1,46 @@
+/**
+ * GitHub extension entry point.
+ *
+ * Composes auth + tools + profile gating into something the runner can hand
+ * to `createAgentSession({ customTools, tools })`.
+ *
+ * Safe by default: if `--profile` is not set OR the necessary GITHUB_ env
+ * vars are missing, this returns an empty tool set and the runner continues
+ * without GitHub support. The caller can inspect `status` / `reason` to
+ * decide whether to surface a warning.
+ */
+import type { ToolDefinition } from "@earendil-works/pi-coding-agent";
+import { type AuthFailureReason } from "./auth.js";
+import { type GitAccessProfile } from "./profiles.js";
+export { isGitAccessProfile, type GitAccessProfile } from "./profiles.js";
+/** Why the extension didn't load tools. */
+export type GitHubExtensionSkipReason = "no-profile" | AuthFailureReason;
+export interface GitHubExtensionResult {
+    /** Tools to pass into `createAgentSession({ customTools })`. */
+    customTools: ToolDefinition<any>[];
+    /** Tool names registered (subset of the profile's allowlist). */
+    toolNames: string[];
+    /** Whether the extension is active. */
+    status: "configured" | "skipped";
+    /** Set when `status === "skipped"`. */
+    reason?: GitHubExtensionSkipReason;
+    /** Human-readable extra detail for warnings / logs. */
+    message?: string;
+    /** Always echoed back so the consumer knows what they asked for. */
+    profile?: GitAccessProfile;
+}
+/**
+ * Build the GitHub extension for a given profile.
+ *
+ * - No profile → status:"skipped", reason:"no-profile" (silent, expected).
+ * - Profile set but no GITHUB_* env vars → status:"skipped", reason:"no-credentials".
+ * - PEM file missing or partial creds → status:"skipped" with a specific reason
+ *   and a message the caller should surface (these are misconfigurations,
+ *   not opt-outs).
+ */
+export declare function loadGitHubExtension(profileName?: string): GitHubExtensionResult;
+/**
+ * True if the skip is a misconfiguration the user almost certainly wants to
+ * know about (vs. a benign "didn't pass --profile" case).
+ */
+export declare function isMisconfigurationSkip(result: GitHubExtensionResult): boolean;

package/dist/extensions/github/index.js

@@ -0,0 +1,67 @@
+/**
+ * GitHub extension entry point.
+ *
+ * Composes auth + tools + profile gating into something the runner can hand
+ * to `createAgentSession({ customTools, tools })`.
+ *
+ * Safe by default: if `--profile` is not set OR the necessary GITHUB_ env
+ * vars are missing, this returns an empty tool set and the runner continues
+ * without GitHub support. The caller can inspect `status` / `reason` to
+ * decide whether to surface a warning.
+ */
+import { buildAuthFromEnv } from "./auth.js";
+import { buildGitHubTools } from "./tools.js";
+import { PROFILE_TOOLS, isGitAccessProfile, } from "./profiles.js";
+export { isGitAccessProfile } from "./profiles.js";
+/**
+ * Build the GitHub extension for a given profile.
+ *
+ * - No profile → status:"skipped", reason:"no-profile" (silent, expected).
+ * - Profile set but no GITHUB_* env vars → status:"skipped", reason:"no-credentials".
+ * - PEM file missing or partial creds → status:"skipped" with a specific reason
+ *   and a message the caller should surface (these are misconfigurations,
+ *   not opt-outs).
+ */
+export function loadGitHubExtension(profileName) {
+    if (!profileName) {
+        return {
+            customTools: [],
+            toolNames: [],
+            status: "skipped",
+            reason: "no-profile",
+        };
+    }
+    if (!isGitAccessProfile(profileName)) {
+        throw new Error(`Unknown GitHub profile '${profileName}'. Expected one of: ${Object.keys(PROFILE_TOOLS).join(", ")}`);
+    }
+    const { auth, reason, message } = buildAuthFromEnv();
+    if (!auth) {
+        return {
+            customTools: [],
+            toolNames: [],
+            status: "skipped",
+            reason,
+            message,
+            profile: profileName,
+        };
+    }
+    const allowed = new Set(PROFILE_TOOLS[profileName]);
+    const allTools = buildGitHubTools(auth);
+    const profileTools = allTools.filter((t) => allowed.has(t.name));
+    return {
+        customTools: profileTools,
+        toolNames: profileTools.map((t) => t.name),
+        status: "configured",
+        profile: profileName,
+    };
+}
+/**
+ * True if the skip is a misconfiguration the user almost certainly wants to
+ * know about (vs. a benign "didn't pass --profile" case).
+ */
+export function isMisconfigurationSkip(result) {
+    if (result.status !== "skipped")
+        return false;
+    return result.reason === "pem-unreadable" || result.reason === "invalid-config";
+}
+//# sourceMappingURL=index.js.map

package/dist/extensions/github/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/extensions/github/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,gBAAgB,EAA0B,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,kBAAkB,GAEnB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,kBAAkB,EAAyB,MAAM,eAAe,CAAC;AAuB1E;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAoB;IACtD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,EAAE;YACb,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,YAAY;SACrB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,2BAA2B,WAAW,uBAAuB,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrG,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,gBAAgB,EAAE,CAAC;IACrD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,EAAE;YACb,MAAM,EAAE,SAAS;YACjB,MAAM;YACN,OAAO;YACP,OAAO,EAAE,WAAW;SACrB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjE,OAAO;QACL,WAAW,EAAE,YAAY;QACzB,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1C,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,WAAW;KACrB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA6B;IAClE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,MAAM,CAAC,MAAM,KAAK,gBAAgB,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,CAAC;AAClF,CAAC"}

package/dist/extensions/github/profiles.d.ts

@@ -0,0 +1,17 @@
+/**
+ * GitHub tool profiles — registration-time gate.
+ *
+ * Maps the 4 lastlight profile names to the set of Pi tool names allowed
+ * in that profile. Tools NOT in the active profile are never registered, so
+ * the LLM cannot call them. Combined with the token-scope downscoping
+ * lastlight does on the host side, this gives defense-in-depth.
+ *
+ * Mirrors lastlight's `GITHUB_PERMISSION_PROFILES` token scopes:
+ *   read         → contents:r, issues:r, pull_requests:r, metadata:r
+ *   issues-write → ditto + issues:w
+ *   review-write → ditto + pull_requests:w
+ *   repo-write   → ditto + contents:w
+ */
+export type GitAccessProfile = "read" | "issues-write" | "review-write" | "repo-write";
+export declare const PROFILE_TOOLS: Record<GitAccessProfile, readonly string[]>;
+export declare function isGitAccessProfile(s: string): s is GitAccessProfile;