burhan-mop 0.1.6 → 0.1.7

package/.MOP/PROTOCOL.md

@@ -31,7 +31,8 @@ Use this order:
 7. Coding/adventure language.
 8. GitHub project link. Required for `team`, optional for `solo`.
 9. GitHub username.
-10. Git commit email. Use a GitHub-verified email or GitHub noreply email.
+10. Git commit email. Default to `github-noreply` so MOP derives the active
+    GitHub account email as `ID+USERNAME@users.noreply.github.com`.
 11. If `team`, ask join mode: `open`, `owner-approved`, or `invite`.
 12. Ask auto deploy: `Nak aktifkan auto deploy sekarang? Pilih provider:
     GitHub, Docker, Vercel.` If the user says later/no, answer with the defer
@@ -40,7 +41,7 @@ Use this order:
 After confirmation, run:
 
 ```bash
-node .MOP/scripts/mop-core.mjs setup --project-name "<name>" --name "<display>" --codename <codename> --password "<password>" --mode <solo|team> --conversation-language "<lang>" --coding-language "<lang>" --git-email "<github-verified-email>" [--git-name "<display>"] [--github-username "<github-login>"] [--github-url "<url>"] [--join-mode <mode>]
+node .MOP/scripts/mop-core.mjs setup --project-name "<name>" --name "<display>" --codename <codename> --password "<password>" --mode <solo|team> --conversation-language "<lang>" --coding-language "<lang>" --git-email github-noreply [--git-name "<display>"] [--github-username "<github-login>"] [--github-url "<url>"] [--join-mode <mode>]
 ```
 
 ## Agent Naming Ceremony
@@ -431,10 +432,13 @@ In team mode, an agent name is the identity.
 Autosycn is always available and should be used after meaningful state or file
 changes. It is intentionally identity-safe.
 
-Before first push for a member, configure the real Git identity:
+Before first push for a member, configure the real GitHub identity. Default to
+GitHub noreply so commits attach to the active user account without exposing
+private email:
 
 ```bash
-node .MOP/scripts/mop-core.mjs member git-identity --actor <codename> --name "<display name>" --email "<github-verified-email>" --github-username "<github-login>"
+gh auth login
+node .MOP/scripts/mop-core.mjs member git-identity --actor <codename> --name "<display name>" --email github-noreply --github-username "<github-login>"
 ```
 
 Then run:
@@ -455,6 +459,13 @@ Autosycn must:
 - Commit with `GIT_AUTHOR_NAME`, `GIT_AUTHOR_EMAIL`, `GIT_COMMITTER_NAME`, and
   `GIT_COMMITTER_EMAIL` set from member state.
 - Set local `git config user.name` and `user.email` before commit/merge.
+- For member commits, derive `user.email` from the active GitHub CLI account as
+  `ID+USERNAME@users.noreply.github.com` when
+  `autosync.githubIdentity.useNoreplyForMemberCommits` is enabled.
+- Refuse to commit or push if `gh api user` is authenticated as a different
+  GitHub username than the active member's configured `githubUsername`.
+- Use the member GitHub identity for setup, preflight, memory, and work branch
+  commits. Use `BURHAN-MOP` only for merge guardian commits.
 - In team mode, `main` is the trunk and each user works on `dev/<codename>`.
 - Push to `dev/<codename>` in team mode and `main` in solo mode.
 - After a team push, BURHAN-MOP reviews `dev/<codename>` and merges it into
@@ -469,10 +480,11 @@ Autosycn must:
 - If `githubUsername` is configured, refuse to push unless `gh api user`
   verifies the same account.
 
-Important: GitHub commit attribution comes from commit email. GitHub push actor
-comes from the credential or SSH key used by `git push`; no script can fake that.
-If GitHub shows the AI/bot as pusher, fix `gh auth login`, Git Credential
-Manager, or the SSH key account.
+Important: GitHub commit attribution comes from commit email. MOP uses the
+active GitHub account noreply email for member commits by default. GitHub push
+actor comes from the credential or SSH key used by `git push`; no script can
+fake that. If GitHub shows the wrong pusher, fix `gh auth login`, Git
+Credential Manager, or the SSH key account.
 
 ## Default Skill: auto-deploy
 

package/.MOP/STATE.json

@@ -399,7 +399,18 @@
       }
     },
     "requireUserGitEmail": true,
-    "verifyGhUserWhenConfigured": true
+    "verifyGhUserWhenConfigured": true,
+    "githubIdentity": {
+      "requireMatchedGhUser": true,
+      "useNoreplyForMemberCommits": true,
+      "noreplyFormat": "id-plus-login",
+      "rules": [
+        "Member commits must use the active member GitHub account, not an AI or guardian identity.",
+        "When gh is authenticated, derive member commit email as ID+USERNAME@users.noreply.github.com.",
+        "Refuse autosycn if the active gh account does not match the member githubUsername.",
+        "BURHAN-MOP identity is reserved for merge guardian commits only."
+      ]
+    }
   },
   "members": {},
   "installedSkills": [

package/.MOP/scripts/mop-autosycn.mjs

@@ -247,22 +247,59 @@ function getMember(state, actor) {
   return member;
 }
 
+function githubIdentityPolicy(state) {
+  return state.autosync?.githubIdentity || {
+    requireMatchedGhUser: true,
+    useNoreplyForMemberCommits: true,
+    noreplyFormat: 'id-plus-login'
+  };
+}
+
+function currentGhUser() {
+  const result = runOptional('gh', ['api', 'user', '--jq', '{login:.login,id:.id,email:.email}']);
+  if (!result.ok) return null;
+  try {
+    return JSON.parse(result.stdout || '{}');
+  } catch {
+    return null;
+  }
+}
+
+function githubNoreplyEmail(user) {
+  if (!user?.login || !user?.id) return '';
+  return `${user.id}+${user.login}@users.noreply.github.com`;
+}
+
 function identityFor(state, actor) {
   const member = getMember(state, actor);
   const identity = member.gitIdentity || {};
+  const policy = githubIdentityPolicy(state);
+  const gh = currentGhUser();
   const name = identity.name || member.displayName || actor;
-  const email = identity.email || member.github?.noreplyEmail || '';
+  const githubUsername = identity.githubUsername || member.github?.username || gh?.login || '';
+  if (gh?.login && githubUsername && policy.requireMatchedGhUser !== false && gh.login.toLowerCase() !== githubUsername.toLowerCase()) {
+    throw new Error(`GitHub CLI authenticated as ${gh.login}, expected ${githubUsername}. Refusing to commit or push as the wrong user.`);
+  }
+  let email = identity.email || member.github?.noreplyEmail || '';
+  if (policy.useNoreplyForMemberCommits !== false) {
+    email = githubNoreplyEmail(gh);
+    if (!email) {
+      throw new Error('GitHub noreply identity is required for member commits. Run gh auth login as the real user, or set autosync.githubIdentity.useNoreplyForMemberCommits=false.');
+    }
+  }
   if (!email && state.autosync?.requireUserGitEmail !== false) {
     throw new Error([
       `Missing git email for ${actor}.`,
-      'Set a GitHub-verified email or noreply email first:',
-      `node .MOP/scripts/mop-core.mjs member git-identity --actor ${actor} --name "${name}" --email "<github-verified-email>" [--github-username "<username>"]`
+      'Set a GitHub-verified email or let MOP derive GitHub noreply from gh:',
+      `node .MOP/scripts/mop-core.mjs member git-identity --actor ${actor} --name "${name}" --email github-noreply [--github-username "<username>"]`
     ].join(' '));
   }
   return {
     name,
     email,
-    githubUsername: identity.githubUsername || member.github?.username || ''
+    githubUsername,
+    githubUserId: gh?.login?.toLowerCase() === githubUsername.toLowerCase() ? gh.id : identity.githubUserId,
+    emailSource: policy.useNoreplyForMemberCommits !== false ? 'github-noreply' : (identity.emailSource || 'manual')
   };
 }
 
@@ -335,15 +372,16 @@ function configureRemote(url, replaceRemote = false) {
 }
 
 function verifyGhUser(identity, state) {
-  if (!identity.githubUsername || state.autosync?.verifyGhUserWhenConfigured === false) return 'skipped';
-  const gh = runOptional('gh', ['api', 'user', '--jq', '.login']);
-  if (!gh.ok) {
+  const policy = githubIdentityPolicy(state);
+  if (state.autosync?.verifyGhUserWhenConfigured === false && policy.requireMatchedGhUser === false) return 'skipped';
+  const gh = currentGhUser();
+  if (!gh?.login) {
     throw new Error('GitHub username is configured, but gh could not verify the active account. Run gh auth login as the real user or set autosync.verifyGhUserWhenConfigured=false for SSH-only workflows.');
   }
-  if (gh.stdout.toLowerCase() !== identity.githubUsername.toLowerCase()) {
-    throw new Error(`GitHub CLI authenticated as ${gh.stdout}, expected ${identity.githubUsername}. Refusing to push as the wrong account.`);
+  if (identity.githubUsername && gh.login.toLowerCase() !== identity.githubUsername.toLowerCase()) {
+    throw new Error(`GitHub CLI authenticated as ${gh.login}, expected ${identity.githubUsername}. Refusing to push as the wrong account.`);
   }
-  return `verified:${gh.stdout}`;
+  return `verified:${gh.login}:${githubNoreplyEmail(gh) || 'email-unavailable'}`;
 }
 
 function runProjectCommand(command, env) {
@@ -677,6 +715,7 @@ function status() {
     workBranchPrefix: state.autosync?.workBranchPrefix || 'dev',
     autoMergeToMain: state.autosync?.autoMergeToMain !== false,
     mergeGuardian: guardianConfig(state),
+    githubIdentity: githubIdentityPolicy(state),
     preflightBeforeWork: state.autosync?.preflightBeforeWork !== false,
     requireUserGitEmail: state.autosync?.requireUserGitEmail !== false,
     initialized: state.initialized,
@@ -691,7 +730,8 @@ function status() {
         displayName: member.displayName,
         gitIdentityConfigured: Boolean(member.gitIdentity?.email || member.github?.noreplyEmail),
         gitName: member.gitIdentity?.name || member.displayName || key,
-        gitEmail: member.gitIdentity?.email || member.github?.noreplyEmail || ''
+        gitEmail: member.gitIdentity?.email || member.github?.noreplyEmail || '',
+        githubUsername: member.gitIdentity?.githubUsername || member.github?.username || ''
       }
     ]))
   }, null, 2));

package/.MOP/scripts/mop-core.mjs

@@ -3,6 +3,7 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, writeFile
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { randomBytes, scryptSync, timingSafeEqual } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
 
 const here = dirname(fileURLToPath(import.meta.url));
 const coreDir = resolve(here, '..');
@@ -71,6 +72,53 @@ function verifyPassword(password, salt, expectedHex) {
   return expected.length === actual.length && timingSafeEqual(actual, expected);
 }
 
+function currentGhUser() {
+  const result = spawnSync('gh', ['api', 'user', '--jq', '{login:.login,id:.id,email:.email}'], {
+    cwd: rootDir,
+    encoding: 'utf8'
+  });
+  if (result.status !== 0) return null;
+  try {
+    return JSON.parse(result.stdout || '{}');
+  } catch {
+    return null;
+  }
+}
+
+function githubNoreplyEmail(user) {
+  if (!user?.login || !user?.id) return '';
+  return `${user.id}+${user.login}@users.noreply.github.com`;
+}
+
+function resolveGitIdentityInput(state, actor, name, emailInput, githubUsernameInput) {
+  const policy = state.autosync?.githubIdentity || {};
+  const preferNoreply = policy.useNoreplyForMemberCommits !== false;
+  const gh = currentGhUser();
+  const githubUsername = githubUsernameInput || gh?.login || '';
+  if (gh?.login && githubUsername && policy.requireMatchedGhUser !== false && gh.login.toLowerCase() !== githubUsername.toLowerCase()) {
+    throw new Error(`GitHub CLI authenticated as ${gh.login}, expected ${githubUsername}. Run gh auth login as the real user.`);
+  }
+
+  let email = String(emailInput || '').trim();
+  const wantsNoreply = !email || ['auto', 'github', 'github-noreply', 'noreply'].includes(email.toLowerCase());
+  if (preferNoreply && wantsNoreply) {
+    email = githubNoreplyEmail(gh);
+    if (!email) {
+      throw new Error('Cannot derive GitHub noreply email. Run gh auth login or provide --git-email "<github-verified-email>".');
+    }
+  }
+  if (!email && state.autosync?.requireUserGitEmail !== false) {
+    throw new Error('Git email is required. Use --git-email github-noreply after gh auth login, or provide a GitHub-verified email.');
+  }
+  return {
+    name,
+    email,
+    githubUsername,
+    githubUserId: gh?.login?.toLowerCase() === githubUsername.toLowerCase() ? gh.id : undefined,
+    emailSource: wantsNoreply && email ? 'github-noreply' : 'manual'
+  };
+}
+
 function activeAgentFor(state, actor) {
   const activeId = state.activeAgents?.[actor];
   if (!activeId) return null;
@@ -502,7 +550,7 @@ function setup(args) {
   const codingLanguage = String(args['coding-language'] || 'English');
   const githubUrl = String(args['github-url'] || '');
   const gitName = String(args['git-name'] || displayName);
-  const gitEmail = String(args['git-email'] || '');
+  const gitEmail = String(args['git-email'] || 'github-noreply');
   const githubUsername = String(args['github-username'] || '');
   const joinMode = String(args['join-mode'] || 'owner-approved');
 
@@ -510,12 +558,10 @@ function setup(args) {
   if (password.length < 8) throw new Error('Password must be at least 8 characters.');
   if (!['solo', 'team'].includes(mode)) throw new Error('Mode must be solo or team.');
   if (mode === 'team' && !githubUrl) throw new Error('Team mode requires --github-url.');
-  if (state.autosync?.requireUserGitEmail !== false && !gitEmail) {
-    throw new Error('Git email is required so commits are attributed to the real user, not the AI tool.');
-  }
   if (!['open', 'owner-approved', 'invite'].includes(joinMode)) {
     throw new Error('Join mode must be open, owner-approved, or invite.');
   }
+  const gitIdentity = resolveGitIdentityInput(state, codename, gitName, gitEmail, githubUsername);
 
   const { passwordHash, passwordSalt } = hashPassword(password);
   state.initialized = true;
@@ -545,11 +591,7 @@ function setup(args) {
         conversation: conversationLanguage,
         coding: codingLanguage
       },
-      gitIdentity: {
-        name: gitName,
-        email: gitEmail,
-        githubUsername
-      },
+      gitIdentity,
       joinedAt: now()
     }
   };
@@ -822,12 +864,12 @@ function memberGitIdentity(args) {
   if (!member) throw new Error('Unknown actor.');
   const agent = requireActiveAgent(state, actor);
   const name = String(args.name || member.displayName || actor);
-  const email = requireArg(args, 'email');
+  const email = String(args.email || 'github-noreply');
   const githubUsername = String(args['github-username'] || member.gitIdentity?.githubUsername || '');
-  member.gitIdentity = { name, email, githubUsername };
+  member.gitIdentity = resolveGitIdentityInput(state, actor, name, email, githubUsername);
   appendLedger(state, actor, 'git-identity', `Updated git identity for ${actor}.`, agent);
   writeState(state);
-  console.log(`Git identity set for ${actor}: ${name} <${email}>${githubUsername ? ` github=${githubUsername}` : ''}`);
+  console.log(`Git identity set for ${actor}: ${member.gitIdentity.name} <${member.gitIdentity.email}>${member.gitIdentity.githubUsername ? ` github=${member.gitIdentity.githubUsername}` : ''}`);
 }
 
 function validate() {
@@ -843,6 +885,9 @@ function validate() {
   if (state.memoryPolicy && typeof state.memoryPolicy !== 'object') errors.push('memoryPolicy must be object');
   if (state.agentRouter && typeof state.agentRouter !== 'object') errors.push('agentRouter must be object');
   if (state.partyMode && typeof state.partyMode !== 'object') errors.push('partyMode must be object');
+  if (state.autosync?.githubIdentity && typeof state.autosync.githubIdentity !== 'object') {
+    errors.push('autosync.githubIdentity must be object');
+  }
   if (state.projectRootPolicy && typeof state.projectRootPolicy !== 'object') errors.push('projectRootPolicy must be object');
   if (state.projectRootPolicy?.rules && !Array.isArray(state.projectRootPolicy.rules)) {
     errors.push('projectRootPolicy.rules must be array');
@@ -985,9 +1030,9 @@ function main() {
   console.log(`Usage:
   node .MOP/scripts/mop-core.mjs status
   node .MOP/scripts/mop-core.mjs validate
-  node .MOP/scripts/mop-core.mjs setup --project-name NAME --name DISPLAY --codename CODE --password PASS --mode solo|team --conversation-language LANG --coding-language LANG --git-email EMAIL [--git-name NAME] [--github-username USER] [--github-url URL]
+  node .MOP/scripts/mop-core.mjs setup --project-name NAME --name DISPLAY --codename CODE --password PASS --mode solo|team --conversation-language LANG --coding-language LANG [--git-email github-noreply|EMAIL] [--git-name NAME] [--github-username USER] [--github-url URL]
   node .MOP/scripts/mop-core.mjs login --codename CODE --password PASS
-  node .MOP/scripts/mop-core.mjs member git-identity --actor CODE --name NAME --email EMAIL [--github-username USER]
+  node .MOP/scripts/mop-core.mjs member git-identity --actor CODE --name NAME [--email github-noreply|EMAIL] [--github-username USER]
   node .MOP/scripts/mop-core.mjs agent activate --actor CODE --role ROLE --title TITLE --name NAME
   node .MOP/scripts/mop-core.mjs agent use --actor CODE --name NAME
   node .MOP/scripts/mop-core.mjs agent current --actor CODE

package/.agents/AGENTS.md

@@ -34,6 +34,10 @@ Before doing anything, read `.MOP/STATE.json` and follow
 - For risky changes, run adversarial review before implementation or merge.
 - When a role agent first appears, ask the user to name it before using it as a
   personal agent.
+- Autosycn member commits must use the active member GitHub account. By default,
+  MOP derives `ID+USERNAME@users.noreply.github.com` from `gh api user` and
+  refuses mismatched GitHub accounts. `BURHAN-MOP` identity is reserved for
+  merge guardian commits only.
 
 ## Operating Rules
 

package/AGENTS.md

@@ -46,8 +46,8 @@ follow `.MOP/PROTOCOL.md`.
 
 For `/mop-setup`, ask in order: project name (default folder name), owner display
 name, owner codename, password, solo/team, conversation language, coding
-language, GitHub link, GitHub username, Git commit email, join mode if team,
-then whether to activate auto-deploy now or later.
+language, GitHub link, GitHub username, Git commit email (`github-noreply` by
+default), join mode if team, then whether to activate auto-deploy now or later.
 
 Agent role/template names are not personal AI names. When a role agent is first
 needed, ask the user to name it and save it with `mop-core.mjs agent activate`.
@@ -62,6 +62,9 @@ agent route instead of answering invisibly.
 Default skill: `autosycn`. After meaningful changes, use
 `.MOP/scripts/mop-autosycn.mjs`. It must commit and merge with the
 real member Git identity from state, never with the AI tool identity.
+Member commits must use the active member GitHub account; by default MOP derives
+`ID+USERNAME@users.noreply.github.com` from `gh api user` and refuses mismatched
+GitHub accounts. `BURHAN-MOP` identity is only for merge guardian commits.
 In team mode, run `preflight --actor <codename>` before starting work; work goes
 to `dev/<codename>`. Every small or large change is pushed there first, then
 BURHAN-MOP reviews and merges to `main` only when checks pass.

package/CLAUDE.md

@@ -47,6 +47,9 @@ agent route instead of answering invisibly.
 Default skill: `autosycn`. After meaningful changes, use
 `.MOP/scripts/mop-autosycn.mjs`. It must commit and merge with the
 real member Git identity from state, never with the AI tool identity.
+Member commits must use the active member GitHub account; by default MOP derives
+`ID+USERNAME@users.noreply.github.com` from `gh api user` and refuses mismatched
+GitHub accounts. `BURHAN-MOP` identity is only for merge guardian commits.
 In team mode, run `preflight --actor <codename>` before starting work; work goes
 to `dev/<codename>`. Every small or large change is pushed there first, then
 BURHAN-MOP reviews and merges to `main` only when checks pass.

package/GEMINI.md

@@ -16,6 +16,9 @@ rules are imported below.
   example: `agent: <agent-name> (<agent-role>) to <user>`.
 - Save a one-line memory after meaningful work with
   `mop-core.mjs memory add --actor <codename> --kind conversation --summary "<outcome>"`.
+- Autosycn member commits must use the active member GitHub account. MOP derives
+  `ID+USERNAME@users.noreply.github.com` from `gh api user` by default and
+  refuses mismatched GitHub accounts.
 - Treat the current workspace root as the project root; do not create a nested
   project wrapper folder for app work unless the user explicitly asks for it.
 - Use `.gemini/settings.json` for context filenames and MCP server setup.

package/README.bm.md

@@ -142,7 +142,7 @@ dan merge hanya bila workflow selamat.
 | --- | --- |
 | npm package | [`burhan-mop`](https://www.npmjs.com/package/burhan-mop) |
 | command latest | `npx burhan-mop install` |
-| GitHub release | [`v0.1.6`](https://github.com/BURHANDEV-ENTERPRISE/BURHAN-MOP/releases/tag/v0.1.6) |
+| GitHub release | [`v0.1.7`](https://github.com/BURHANDEV-ENTERPRISE/BURHAN-MOP/releases/tag/v0.1.7) |
 | Node | `>=20` |
 
 ## Links

package/README.md

@@ -141,7 +141,7 @@ and merges only when the workflow is safe.
 | --- | --- |
 | npm package | [`burhan-mop`](https://www.npmjs.com/package/burhan-mop) |
 | latest command | `npx burhan-mop install` |
-| GitHub release | [`v0.1.6`](https://github.com/BURHANDEV-ENTERPRISE/BURHAN-MOP/releases/tag/v0.1.6) |
+| GitHub release | [`v0.1.7`](https://github.com/BURHANDEV-ENTERPRISE/BURHAN-MOP/releases/tag/v0.1.7) |
 | Node | `>=20` |
 
 ## Links

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "burhan-mop",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "MOP portable agent memory core installer and CLI.",
   "type": "module",
   "author": "BURHANDEV ENTERPRISE",