bmad-stella 2.0.0 → 2.0.1

package/bmad-core/utils/github-mcp-auth.js

@@ -1,81 +0,0 @@
-'use strict';
-
-/**
- * github-mcp-auth.js — dynamic auth header provider for the GitHub MCP server.
- *
- * Claude Code runs this as a server's `headersHelper` on every connection. It must
- * print a JSON object of header name→value pairs to stdout and nothing else
- * (Claude parses stdout as JSON). The GitHub remote MCP server authenticates with a
- * Personal Access Token sent as `Authorization: Bearer <token>`.
- *
- * The token is read from (in order):
- *   1. process.env.GITHUB_PERSONAL_ACCESS_TOKEN   (if exported in the environment)
- *   2. GITHUB_PERSONAL_ACCESS_TOKEN in <projectRoot>/.env   (git-ignored, mode 0600)
- *
- * <projectRoot> is resolved from this file's location: the helper is installed at
- * <projectRoot>/.bmad-core/utils/github-mcp-auth.js, so the root is two levels up.
- *
- * On success: writes {"Authorization":"Bearer <token>"} to stdout, exits 0.
- * On failure: writes a diagnostic to stderr, exits 1 (Claude marks the connection
- * as needing authentication rather than sending an empty header).
- */
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-const TOKEN_KEY = 'GITHUB_PERSONAL_ACCESS_TOKEN';
-
-/** Read a single key from a .env file without pulling in a dotenv dependency. */
-function readEnvFileValue(envPath, key) {
-  let contents;
-  try {
-    contents = fs.readFileSync(envPath, 'utf8');
-  } catch {
-    return null; // file missing/unreadable — caller handles
-  }
-  for (const rawLine of contents.split(/\r?\n/)) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith('#')) continue;
-    const eq = line.indexOf('=');
-    if (eq === -1) continue;
-    if (line.slice(0, eq).trim() !== key) continue;
-    let value = line.slice(eq + 1).trim();
-    if (
-      (value.startsWith('"') && value.endsWith('"')) ||
-      (value.startsWith("'") && value.endsWith("'"))
-    ) {
-      value = value.slice(1, -1);
-    }
-    return value;
-  }
-  return null;
-}
-
-function resolveToken() {
-  const fromEnv = process.env[TOKEN_KEY];
-  if (fromEnv && fromEnv.trim()) return { token: fromEnv.trim(), source: 'environment' };
-
-  // <root>/.bmad-core/utils/github-mcp-auth.js → <root>
-  const projectRoot = path.resolve(__dirname, '..', '..');
-  // Tokens live in <root>/bmad-docs/.bmad-tokens/.env (kept in sync with the installer).
-  const envPath = path.join(projectRoot, 'bmad-docs', '.bmad-tokens', '.env');
-  const fromFile = readEnvFileValue(envPath, TOKEN_KEY);
-  if (fromFile && fromFile.trim()) return { token: fromFile.trim(), source: envPath };
-
-  return { token: null, source: envPath };
-}
-
-function main() {
-  const { token, source } = resolveToken();
-  if (!token) {
-    process.stderr.write(
-      `github-mcp-auth: ${TOKEN_KEY} not found in the environment or ${source}.\n` +
-        `Add it to .env or run the BMad-Stella installer to (re)configure the GitHub MCP server.\n`,
-    );
-    process.exit(1);
-  }
-  // ONLY the JSON object goes to stdout.
-  process.stdout.write(JSON.stringify({ Authorization: `Bearer ${token}` }));
-}
-
-main();

package/docs/github-pat-guide.md

@@ -1,65 +0,0 @@
-# Create a GitHub Token for BMad (GitHub MCP)
-
-The GitHub MCP server (used by the PR-reviewer) authenticates with a **fine-grained Personal Access Token**. This guide walks you through creating one.
-
-**⏱️ ~2 minutes. The token is read-only — it cannot change your code.**
-
----
-
-## 1. Open the token page
-
-1. Go to → **https://github.com/settings/personal-access-tokens**
-2. Click **Fine-grained tokens**
-3. Click **Generate new token**
-
-_(full path: GitHub → your avatar → **Settings** → **Developer settings** → **Personal access tokens** → **Fine-grained tokens** → **Generate new token**)_
-
-## 2. Name + expiry
-
-- **Token name:** `<your preferred name>` (e.g. `bmad-github-mcp`)
-- **Expiration:** 90 days (pick what you like)
-
-## 3. Resource owner
-
-Pick whoever **owns the repo** you'll review:
-
-- If the repo is under **your personal account**, select **yourself**.
-- If the repo is under an **organization** you have access to, select that **organization**.
-
-## 4. Repository access
-
-Choose **"Only select repositories"** → pick the repo(s) you'll do PR reviews in.
-
-## 5. Permissions → Repository permissions (the important part)
-
-Set exactly these two to **Read-only**:
-
-| Permission        | Set to    |
-| ----------------- | --------- |
-| **Contents**      | Read-only |
-| **Pull requests** | Read-only |
-
-_("Metadata: Read" turns on by itself — leave it. Everything else: "No access".)_
-
-> ⚠️ **Don't skip Contents: Read.** Without it, PR review fails with a **403** when fetching the diff (metadata works, the diff doesn't).
-
-## 6. Generate + copy
-
-Click **Generate token** → **copy it now** (GitHub shows it only once). It starts with `github_pat_…`.
-
-## 7. Give it to BMad
-
-- **During install:** paste it when the installer asks for the **GitHub Personal Access Token**.
-- **Already installed, or changing the token later:** open `bmad-docs/.bmad-tokens/.env` in your project and paste your token there:
-
-  ```
-  GITHUB_PERSONAL_ACCESS_TOKEN=github_pat_xxxxxxxx
-  ```
-
-## ✅ Done
-
-In Claude Code: `/mcp` → GitHub should show **connected**.
-
----
-
-**Security note:** the token is stored in a git-ignored file (`bmad-docs/.bmad-tokens/.env`) and is read-only — it can't push, merge, or modify anything. Rotate it by editing that file.