dsh-github-app 0.0.0-stage → 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mike Lysikov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,150 @@
-# Temporary Holding Version
+# dsh-github-app
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+`dsh-github-app` connects the DSH agent to GitHub through a **GitHub App** instead of a personal access token or an interactive `gh auth login`.
+
+You create a GitHub App once, install it on your account or organization, and give the plugin three things: the App ID, the installation ID, and the App's private key.
+The plugin exchanges that key for a short-lived **installation access token**, signs `gh` in with it, configures git's credential helper, and exports the token to the environment of the agent's child processes. 
+The private key is encrypted on disk with a passphrase that is never stored anywhere.
+
+Why a GitHub App:
+
+- The token lives for about one hour and is limited to the repositories and permissions you granted to the installation.
+- Access is revoked by uninstalling or suspending the App, or by deleting the private key in GitHub — no password or PAT to hunt down.
+- No browser OAuth flow is needed inside the harness: the agent gets a token by itself.
+
+## How it works
+
+```
+DSH Settings → GitHub                Plugin host                         GitHub
+─────────────────────                ───────────                         ──────
+App ID + Installation ID  ─────────▶  sign a JWT with the App key  ───▶  POST /app/installations/{id}/access_tokens
+Passphrase + private key  ─────────▶  encrypt key at rest                       │
+                                                                          ◀──────┘  installation token (~1 h)
+                                     gh auth login --with-token
+                                     gh auth setup-git
+                                     GH_TOKEN / GITHUB_TOKEN → agent env
+```
+
+The decrypted key exists only for the duration of a Connect call. The installation token is stored by `gh` in its own credential store and exported to the agent's environment; it is never sent back to the browser.
+
+## What the settings section looks like
+
+```
+Settings → GitHub
+
+CLI status        [ Ready ]                                  GitHub 2.62.0
+                                                             Git 2.43.0
+App ID            [ 123456                                  ]
+Installation ID   [ 12345678                                ]
+Git user name     [ Your Name                               ]
+Git user email    [ you@example.com                         ]
+Key passphrase    [ ••••••••                                ]
+Private key (.pem)[ Choose file ]  Key uploaded and encrypted (app.pem)
+Connection        [ Connected ]  59:42                       [ Disconnect ]
+```
+
+Badges:
+
+- **CLI status**: `Install required` when `gh` or `git` is missing, `Ready` otherwise. The button installs both when needed.
+- **Connection**: `Pending setup` before a key is uploaded, `Disconnected` when a key exists but the login is not active, `Connected` when `gh` has a working account.
+- The `59:42` next to the connection is the remaining lifetime of the installation token. It turns yellow under five minutes and red at zero.
+
+## Setup
+
+### 1. Create a GitHub App
+
+Open **GitHub → Settings → Developer settings → GitHub Apps → New GitHub App** (for an organization: **Organization settings → Developer settings → GitHub Apps**). GitHub's direct link is <https://github.com/settings/apps/new>.
+
+- **Webhook**: uncheck *Active* — the plugin does not receive webhooks.
+- **Repository permissions**: set **Contents: Read and write** if the agent should clone and push. **Metadata: Read-only** is granted automatically. Add *Issues*, *Pull requests*, *Actions* and other permissions only if the agent should use the matching `gh` commands; the App cannot do more than you grant here.
+- **Where can this GitHub App be installed**: choose the narrowest option that fits your case.
+- Click **Create GitHub App**.
+
+### 2. Find the App ID
+
+The App's settings page shows **App ID** near the top. It is a number such as `123456`. Do not use the *Client ID* — it is a different value.
+
+### 3. Install the App and get the Installation ID
+
+- On the App page click **Install App** and choose the account or organization, then the repositories it may access.
+- After installing, the browser lands on `https://github.com/settings/installations/<installation-id>` (for an organization: `https://github.com/organizations/<org>/settings/installations/<installation-id>`). The number at the end is the **Installation ID**, for example `12345678`.
+- You can return to this page later via **Settings → Applications → Configure**.
+
+### 4. Generate the private key
+
+On the App settings page open **Private keys** and click **Generate a private key**. A file named like `your-app.2026-01-02.private-key.pem` is downloaded. GitHub does not let you download that key again, so keep it somewhere safe; if it is lost, generate a new one. Deleting the key in GitHub immediately stops tokens issued with it.
+
+### 5. Fill in the plugin
+
+Open **Settings → GitHub** in DSH and fill in the fields:
+
+| Field | What to enter | Where it comes from |
+| --- | --- | --- |
+| **App ID** | The numeric App ID | App settings page, *App ID* |
+| **Installation ID** | The numeric installation ID | URL of the installation page, `/installations/<id>` |
+| **Git user name** | Author name for commits | Your choice; written to `git config --global user.name` |
+| **Git user email** | Author email for commits | Your choice; written to `git config --global user.email` |
+| **Key passphrase** | Any passphrase of 8+ characters | Invented by you. It encrypts the key at rest and is **not stored** |
+| **Private key (.pem)** | The file from step 4 | GitHub App → *Private keys* |
+
+Text fields are saved automatically a moment after you stop typing, and only the field you changed is written. Git identity is applied to the global git config only when it actually changes; clearing a field removes that global setting.
+
+Then:
+
+1. If **CLI status** says `Install required`, click **Install missing components**. On Linux the package manager usually needs root; if the host lacks those privileges the manager's error is shown and you can install `gh`/`git` manually. On Debian/Ubuntu `gh` is not in the default repositories and the plugin shows a link to GitHub's installation instructions.
+2. Enter the passphrase and upload the `.pem` file. The key is encrypted and written to disk; the original file is not needed afterwards.
+3. Click **Connect**.
+
+### What happens on Connect
+
+1. The plugin decrypts the key with your passphrase and signs a short-lived JWT as the GitHub App.
+2. It asks GitHub for an installation access token.
+3. It runs `gh auth login --with-token` and `gh auth setup-git`, so both `gh` and `git` can use the token.
+4. It exports `GH_TOKEN` and `GITHUB_TOKEN` into the plugin host's environment, which the agent's child processes inherit.
+5. It reads the token expiry from GitHub and starts the countdown.
+
+If any step after the login fails, the plugin logs `gh` out again instead of leaving a half-connected state. A wrong passphrase or a corrupted key file is reported without touching the stored key.
+
+## Everyday use
+
+- **The token expires after about one hour.** GitHub App installation tokens are not refreshable, so when the countdown reaches zero the connection becomes unavailable and you click **Connect** again with the passphrase.
+- **Disconnect** runs `gh auth logout --hostname github.com`, removes `GH_TOKEN`/`GITHUB_TOKEN` from the host environment, and clears the recorded lifetime. Note that this logs out the active `github.com` account in gh's shared credential store, which may be a personal account if you changed accounts outside DSH.
+- **The passphrase is required for upload and for every Connect.** It is not stored, not sent anywhere except the plugin's own host, and cannot be recovered. If it is lost, upload the key again with a new passphrase.
+- **`gh` and `git` are shared tools.** The plugin drives their global settings (`gh` credential store, `git config --global`), so changes are visible outside DSH. Disconnecting or uninstalling does not remove the git identity.
+
+## Security
+
+- The private key is encrypted at rest with scrypt + AES-256-GCM (unique salt and IV, authenticated payload) in a `0600` file under `$DSH_HOME/dsh-github-app/`.
+- The passphrase is never persisted and never returned to the browser. The decrypted key exists in memory only during a Connect call.
+- Every request to the plugin API is checked by the DSH connection service: a live browser session or API credential is required even for loopback requests, so a spoofed `Host` header cannot bypass it. Only a profile without the connection service (headless) falls back to accepting loopback requests directly.
+- The installation token is never exposed to the browser. It is written to `gh`'s credential store and exported to the host environment for the agent; any process started by the agent can read it for as long as it is valid.
+- Revoke access at any time by uninstalling the App, deleting its private key in GitHub, or clicking **Disconnect** in DSH.
+
+## Files
+
+The plugin keeps its data in `$DSH_HOME/dsh-github-app/` (`$DSH_HOME` defaults to `~/.dsh`):
+
+| File | Contents |
+| --- | --- |
+| `github.json` | App ID, installation ID, git identity, key file name, token timestamps (mode `0600`) |
+| `github-app.pem.enc` | The encrypted GitHub App private key (mode `0600`) |
+
+## Uninstall
+
+Removing the bundle deletes the plugin-owned `$DSH_HOME/dsh-github-app/` directory — settings and the encrypted key — about 15 seconds after the profile stops listing the package in `dependencies` and `dsh.profile.bundles`. DSH has no uninstall hook, so the running host watches its own profile and performs the cleanup; disabling the plugin, an HMR reload, or a host restart keeps the data because the profile still declares the package.
+
+- Removing the package while no DSH host is running (`dsh plugin remove` from a shell) leaves the watcher without a process to run in; delete `$DSH_HOME/dsh-github-app/` manually.
+- A DSH update is a removal followed by an installation, so the cleanup also runs on update. Reinstall within the 15-second window, or back up the directory first, to keep the current settings.
+- Uninstalling does **not** log `gh` out. Click **Disconnect** first if you want to drop the token immediately.
+- The `gh` token store and the git identity are shared user settings and are left untouched.
+
+## Troubleshooting
+
+| Symptom | Likely cause |
+| --- | --- |
+| `Install required` does not go away | `gh`/`git` are not on `PATH` for the DSH host; install them manually and restart the host. |
+| `Cannot decrypt private key` | Wrong passphrase, or the key file was replaced/corrupted. Upload the `.pem` again. |
+| `GitHub API 401` | The App ID and the private key belong to different Apps, or the key was deleted in GitHub. |
+| `GitHub API 404` | Wrong installation ID, or the App is not installed on that account/repository. |
+| `GitHub API 403` / `gh` commands fail with 403 | The App lacks the permission for that operation (for example *Contents: Read and write* for pushing). |
+| Connected, but pushes fail | `gh auth setup-git` did not configure the credential helper; run Connect again and check `git config --global --get credential.https://github.com.helper`. |

package/_virtual/_rollup-plugin-process-env.mjs

@@ -0,0 +1,6 @@
+(function() {
+	const env = { "INNETJS_CSS": ".gh-section{color:var(--dsw-alias-label-primary);display:flex;flex-direction:column;font-size:14px;line-height:22px;width:100%}.gh-row{align-items:center;border-bottom:.5px solid var(--dsw-alias-border-l2);display:flex;gap:8px;padding:16px 0}.gh-row:last-of-type{border-bottom:none}.gh-text{flex:1;flex-direction:column;gap:4px;padding-right:48px}.gh-text,.gh-titleRow{display:flex;min-width:0}.gh-titleRow{align-items:center;flex-wrap:wrap;gap:8px}.gh-title{color:var(--dsw-alias-label-primary);font-size:14px;font-weight:400;line-height:22px}.gh-badge{align-items:center;border:.5px solid transparent;border-radius:999px;display:inline-flex;flex:none;font-size:11px;font-weight:500;gap:5px;line-height:17px;padding:1px 8px;white-space:nowrap}.gh-badge-missing{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary)}.gh-badge-missing,.gh-badge-pending{background:var(--dsw-alias-bg-module-platform)}.gh-badge-pending{border-color:var(--dsw-alias-label-caption);color:var(--dsw-alias-label-secondary)}.gh-badge-connected{background:var(--dsw-alias-bg-module-platform);border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary)}.gh-dot{background:currentColor;border-radius:50%;flex:none;height:6px;width:6px}.gh-desc{color:var(--dsw-alias-label-tertiary);font-size:12px;font-weight:400;line-height:18px;white-space:pre-line}.gh-desc code{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:11px}.gh-control{align-items:center;display:flex;flex:none;gap:8px;min-width:0}.gh-timer{box-sizing:border-box;color:var(--dsw-alias-label-primary);display:inline-block;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:14px;font-variant-numeric:tabular-nums;line-height:22px;min-width:72px;text-align:right}.gh-timer-soon{color:var(--dsw-alias-state-warn-primary)}.gh-timer-expired{color:var(--dsw-alias-state-error-primary)}.gh-input{background:var(--dsw-alias-bg-module-platform);border:none;border-radius:var(--dsw-radius-md);box-sizing:border-box;color:var(--dsw-alias-label-primary);font:inherit;font-size:14px;height:36px;line-height:22px;max-width:320px;padding:0 14px}.gh-input:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}.gh-input:disabled{cursor:default;opacity:.5}.gh-input:focus-visible{outline:var(--dsw-focus-ring-width,2px) solid var(--dsw-focus-ring-color,var(--dsw-alias-state-business-primary));outline-offset:2px}.gh-button{align-items:center;border:none;border-radius:var(--dsw-radius-md);box-sizing:border-box;cursor:pointer;display:inline-flex;font:inherit;font-size:14px;gap:6px;height:36px;justify-content:center;line-height:22px;padding:0 14px;white-space:nowrap}.gh-button:disabled{cursor:default;opacity:.4}.gh-button:focus-visible{outline:var(--dsw-focus-ring-width,2px) solid var(--dsw-focus-ring-color,var(--dsw-alias-state-business-primary));outline-offset:2px}.gh-primary{background:var(--dsw-alias-button-primary-fill);color:var(--dsw-alias-label-primary-foreground);font-weight:500}.gh-primary:hover:not(:disabled){background:var(--dsw-alias-button-primary-hover)}.gh-secondary{background:transparent;border:.5px solid var(--dsw-alias-border-l3);color:var(--dsw-alias-label-primary)}.gh-secondary:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}.gh-fileInput{color:var(--dsw-alias-label-secondary);font-size:12px}.gh-fileInput::file-selector-button{align-items:center;background:transparent;border:.5px solid var(--dsw-alias-border-l3);border-radius:var(--dsw-radius-md);box-sizing:border-box;color:var(--dsw-alias-label-primary);cursor:pointer;display:inline-flex;font:inherit;font-size:12px;height:28px;justify-content:center;line-height:18px;margin-right:8px;padding:0 10px;white-space:nowrap}.gh-fileInput::file-selector-button:hover{background:var(--dsw-alias-interactive-bg-hover)}.gh-fileInput:disabled::file-selector-button{cursor:default;opacity:.4}.gh-notice{border-radius:var(--dsw-radius-md);font-size:12px;line-height:18px;margin:0;padding:8px 12px}.gh-notice-success{color:var(--dsw-alias-state-success-primary)}.gh-notice-error,.gh-notice-success{background:var(--dsw-alias-bg-module-platform)}.gh-notice-error{color:var(--dsw-alias-state-error-primary)}.gh-loading{border-bottom:.5px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:18px;padding:16px 0}@media (max-width:640px){.gh-row{flex-wrap:wrap}.gh-text{flex-basis:100%;padding-right:0}.gh-control{align-items:stretch;width:100%}.gh-input{max-width:none;width:100%}}" };
+	if (typeof process === "undefined") globalThis.process = { env };
+	else if (process.env) Object.assign(process.env, env);
+	else process.env = env;
+})();

package/api.d.ts

@@ -0,0 +1,5 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+export type ApiHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+export declare function createApiHandler(ctx: unknown, { trustedHosts }: {
+    trustedHosts: string[];
+}): ApiHandler;

package/api.mjs

@@ -0,0 +1,258 @@
+import { writeSecretFile } from "./atomicFile.mjs";
+import { MAX_BODY_BYTES, TOKEN_TTL_SECONDS } from "./constants.mjs";
+import { PAYLOAD_TOO_LARGE, isLoopbackRequest, isTrustedApiRequest, readJsonBody, writeJson } from "./fence.mjs";
+import { passphraseError } from "./passphrase.mjs";
+import { encryptPrivateKey } from "./keyCrypto.mjs";
+import { parseTimestamp } from "./time.mjs";
+import { encryptedKeyPath, keyFileExists, readSettings, writeSettings } from "./settings.mjs";
+import { connect, disconnect, getAuthStatus, getGhInfo, getGitIdentity, getGitInfo, installGh, installGit, setGitIdentity } from "./github.mjs";
+import { isInsideDshHome, removeSecretFile } from "./secureFile.mjs";
+import { errorMessage } from "./utils/errorMessage.mjs";
+// src/api.ts
+/**
+* Resolve the connection service for browser-session verification.
+*
+* @param ctx plugin context.
+* @returns the service, or undefined when this profile has none.
+*/
+function resolveConnection(ctx) {
+	if (ctx === null || typeof ctx !== "object") return void 0;
+	const candidate = ctx;
+	let direct;
+	try {
+		direct = candidate.connection;
+	} catch {}
+	if (direct && typeof direct.requestRejection === "function") return direct;
+	if (typeof candidate.get === "function") try {
+		const service = candidate.get("connection");
+		if (service && typeof service.requestRejection === "function") return service;
+	} catch {}
+}
+/**
+* Require a live DSH browser session (or API credential) for a request.
+*
+* @param ctx plugin context.
+* @param req incoming request.
+* @returns undefined when admitted, otherwise the HTTP status to return.
+*/
+function sessionRejection(ctx, req) {
+	const connection = resolveConnection(ctx);
+	if (!connection || typeof connection.requestRejection !== "function") return 403;
+	let rejection;
+	try {
+		rejection = connection.requestRejection(req);
+	} catch {
+		return 403;
+	}
+	if (rejection === void 0) return void 0;
+	return rejection === 401 ? 401 : 403;
+}
+function ok(res, value) {
+	writeJson(res, 200, {
+		ok: true,
+		value
+	});
+}
+function fail(res, status, message) {
+	writeJson(res, status, {
+		ok: false,
+		error: { message }
+	});
+}
+const PEM_MARKER = /PRIVATE KEY-----/;
+/**
+* Validate browser-supplied key material, encrypt it and store it at the
+* fixed encrypted-key path.
+*
+* @param pem PEM text.
+* @param passphrase user passphrase; never persisted.
+* @returns the stored path, or an HTTP status and message for the failure.
+*/
+async function storeEncryptedKey(pem, passphrase) {
+	const invalid = passphraseError(passphrase);
+	if (invalid !== null) return {
+		ok: false,
+		status: 400,
+		message: invalid
+	};
+	if (!PEM_MARKER.test(pem)) return {
+		ok: false,
+		status: 400,
+		message: "Invalid private key format"
+	};
+	try {
+		const envelope = await encryptPrivateKey(pem, passphrase);
+		const keyPath = encryptedKeyPath();
+		writeSecretFile(keyPath, envelope);
+		return {
+			ok: true,
+			keyPath
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			status: 500,
+			message: errorMessage(error, "Cannot store encrypted private key")
+		};
+	}
+}
+async function statusPayload() {
+	const settings = readSettings();
+	const gh = await getGhInfo();
+	const git = await getGitInfo();
+	let auth = {
+		loggedIn: false,
+		gitConfigured: false
+	};
+	if (gh.installed) auth = await getAuthStatus();
+	const gitIdentity = git.installed ? await getGitIdentity() : {
+		name: "",
+		email: ""
+	};
+	return {
+		gh,
+		git,
+		config: {
+			appId: settings.appId,
+			installationId: settings.installationId,
+			gitUserName: settings.gitUserName,
+			gitUserEmail: settings.gitUserEmail,
+			keyFileName: settings.keyFileName,
+			hasKey: keyFileExists(settings)
+		},
+		auth,
+		token: {
+			issuedAt: parseTimestamp(settings.tokenIssuedAt),
+			expiresAt: parseTimestamp(settings.tokenExpiresAt),
+			ttlSeconds: TOKEN_TTL_SECONDS,
+			active: auth.loggedIn
+		},
+		gitIdentity
+	};
+}
+function createApiHandler(ctx, { trustedHosts }) {
+	return async (req, res) => {
+		if (!isTrustedApiRequest(req, trustedHosts)) {
+			fail(res, 403, "Untrusted request");
+			return;
+		}
+		if (resolveConnection(ctx) !== void 0 || !isLoopbackRequest(req)) {
+			const rejection = sessionRejection(ctx, req);
+			if (rejection !== void 0) {
+				fail(res, rejection, rejection === 401 ? "Authentication required: open the DSH Web UI from its printed URL." : "Untrusted request");
+				return;
+			}
+		}
+		if ((req.method || "GET").toUpperCase() !== "POST") {
+			fail(res, 405, "Method not allowed");
+			return;
+		}
+		const body = await readJsonBody(req, MAX_BODY_BYTES);
+		if (body === PAYLOAD_TOO_LARGE) {
+			fail(res, 413, "Payload too large");
+			return;
+		}
+		const payload = body !== null && typeof body === "object" ? body : {};
+		const action = payload.action;
+		if (typeof action !== "string" || action.trim() === "") {
+			fail(res, 400, "Missing action");
+			return;
+		}
+		try {
+			switch (action) {
+				case "status":
+					ok(res, await statusPayload());
+					break;
+				case "installGh":
+					ok(res, {
+						install: await installGh(),
+						status: await statusPayload()
+					});
+					break;
+				case "installGit":
+					ok(res, {
+						install: await installGit(),
+						status: await statusPayload()
+					});
+					break;
+				case "saveConfig": {
+					const patch = {};
+					if (typeof payload.appId === "string") patch.appId = payload.appId;
+					if (typeof payload.installationId === "string") patch.installationId = payload.installationId;
+					if (typeof payload.gitUserName === "string") patch.gitUserName = payload.gitUserName;
+					if (typeof payload.gitUserEmail === "string") patch.gitUserEmail = payload.gitUserEmail;
+					let uploadedName = null;
+					if (typeof payload.pemBase64 === "string" && payload.pemBase64.trim() !== "") {
+						const pemBuffer = Buffer.from(payload.pemBase64, "base64");
+						let pemText = pemBuffer.toString("utf8");
+						const stored = await storeEncryptedKey(pemText, payload.passphrase).finally(() => {
+							pemText = "";
+							pemBuffer.fill(0);
+						});
+						if (!stored.ok) {
+							fail(res, stored.status, stored.message);
+							return;
+						}
+						patch.keyPath = stored.keyPath;
+						uploadedName = typeof payload.pemFileName === "string" ? payload.pemFileName.trim() : "";
+					}
+					const latest = readSettings();
+					if (uploadedName !== null) patch.keyFileName = uploadedName || latest.keyFileName || "github-app.pem.enc";
+					const replacedKeyPath = patch.keyPath && latest.keyPath && latest.keyPath !== patch.keyPath && isInsideDshHome(latest.keyPath) ? latest.keyPath : null;
+					const next = writeSettings({
+						...latest,
+						...patch
+					});
+					if (replacedKeyPath !== null) removeSecretFile(replacedKeyPath);
+					if (next.gitUserName !== latest.gitUserName || next.gitUserEmail !== latest.gitUserEmail) await setGitIdentity(next.gitUserName, next.gitUserEmail);
+					ok(res, {
+						settings: next,
+						status: await statusPayload()
+					});
+					break;
+				}
+				case "clearConfig": {
+					await disconnect();
+					const current = readSettings();
+					removeSecretFile(current.keyPath);
+					removeSecretFile(encryptedKeyPath());
+					writeSettings({
+						appId: "",
+						installationId: "",
+						keyPath: null,
+						keyFileName: null
+					});
+					ok(res, await statusPayload());
+					break;
+				}
+				case "connect": {
+					const settings = readSettings();
+					ok(res, {
+						connect: await connect(settings, payload.passphrase),
+						status: await statusPayload()
+					});
+					break;
+				}
+				case "disconnect": {
+					const result = await disconnect();
+					if (!result.ok) {
+						fail(res, 500, result.error || "Disconnect failed");
+						return;
+					}
+					ok(res, await statusPayload());
+					break;
+				}
+				case "test":
+					ok(res, {
+						auth: await getAuthStatus(),
+						status: await statusPayload()
+					});
+					break;
+				default: fail(res, 400, `Unknown action: ${action}`);
+			}
+		} catch (error) {
+			fail(res, 500, errorMessage(error, "Internal error"));
+		}
+	};
+}
+export { createApiHandler };

package/atomicFile.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Atomic private-file writes shared by settings and key storage.
+ *
+ * Files are written to a sibling temp file, fsynced, renamed into place and
+ * tightened to 0600, so a crash never leaves a half-written secret and an
+ * existing destination cannot keep looser permissions.
+ */
+/**
+ * Write a secret file atomically with mode 0600.
+ *
+ * @param file destination path.
+ * @param content file contents.
+ */
+export declare function writeSecretFile(file: string, content: string): void;

package/atomicFile.mjs

@@ -0,0 +1,53 @@
+import { dirname } from "node:path";
+import { randomBytes } from "node:crypto";
+import { chmodSync, closeSync, fsyncSync, mkdirSync, openSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+// src/atomicFile.ts
+/**
+* Atomic private-file writes shared by settings and key storage.
+*
+* Files are written to a sibling temp file, fsynced, renamed into place and
+* tightened to 0600, so a crash never leaves a half-written secret and an
+* existing destination cannot keep looser permissions.
+*/
+/**
+* Write a secret file atomically with mode 0600.
+*
+* @param file destination path.
+* @param content file contents.
+*/
+function writeSecretFile(file, content) {
+	const directory = dirname(file);
+	mkdirSync(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const temp = `${file}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+	let handle;
+	try {
+		handle = openSync(temp, "w", 384);
+		writeFileSync(handle, content, "utf8");
+		fsyncSync(handle);
+		closeSync(handle);
+		handle = void 0;
+	} catch (error) {
+		if (handle !== void 0) try {
+			closeSync(handle);
+		} catch {}
+		try {
+			unlinkSync(temp);
+		} catch {}
+		throw error;
+	}
+	try {
+		renameSync(temp, file);
+	} catch (error) {
+		try {
+			unlinkSync(temp);
+		} catch {}
+		throw error;
+	}
+	try {
+		chmodSync(file, 384);
+	} catch {}
+}
+export { writeSecretFile };

package/client/client.js

@@ -0,0 +1,3 @@
+(function(){let e={INNETJS_CSS:`.gh-section{color:var(--dsw-alias-label-primary);display:flex;flex-direction:column;font-size:14px;line-height:22px;width:100%}.gh-row{align-items:center;border-bottom:.5px solid var(--dsw-alias-border-l2);display:flex;gap:8px;padding:16px 0}.gh-row:last-of-type{border-bottom:none}.gh-text{flex:1;flex-direction:column;gap:4px;padding-right:48px}.gh-text,.gh-titleRow{display:flex;min-width:0}.gh-titleRow{align-items:center;flex-wrap:wrap;gap:8px}.gh-title{color:var(--dsw-alias-label-primary);font-size:14px;font-weight:400;line-height:22px}.gh-badge{align-items:center;border:.5px solid transparent;border-radius:999px;display:inline-flex;flex:none;font-size:11px;font-weight:500;gap:5px;line-height:17px;padding:1px 8px;white-space:nowrap}.gh-badge-missing{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary)}.gh-badge-missing,.gh-badge-pending{background:var(--dsw-alias-bg-module-platform)}.gh-badge-pending{border-color:var(--dsw-alias-label-caption);color:var(--dsw-alias-label-secondary)}.gh-badge-connected{background:var(--dsw-alias-bg-module-platform);border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary)}.gh-dot{background:currentColor;border-radius:50%;flex:none;height:6px;width:6px}.gh-desc{color:var(--dsw-alias-label-tertiary);font-size:12px;font-weight:400;line-height:18px;white-space:pre-line}.gh-desc code{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:11px}.gh-control{align-items:center;display:flex;flex:none;gap:8px;min-width:0}.gh-timer{box-sizing:border-box;color:var(--dsw-alias-label-primary);display:inline-block;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:14px;font-variant-numeric:tabular-nums;line-height:22px;min-width:72px;text-align:right}.gh-timer-soon{color:var(--dsw-alias-state-warn-primary)}.gh-timer-expired{color:var(--dsw-alias-state-error-primary)}.gh-input{background:var(--dsw-alias-bg-module-platform);border:none;border-radius:var(--dsw-radius-md);box-sizing:border-box;color:var(--dsw-alias-label-primary);font:inherit;font-size:14px;height:36px;line-height:22px;max-width:320px;padding:0 14px}.gh-input:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}.gh-input:disabled{cursor:default;opacity:.5}.gh-input:focus-visible{outline:var(--dsw-focus-ring-width,2px) solid var(--dsw-focus-ring-color,var(--dsw-alias-state-business-primary));outline-offset:2px}.gh-button{align-items:center;border:none;border-radius:var(--dsw-radius-md);box-sizing:border-box;cursor:pointer;display:inline-flex;font:inherit;font-size:14px;gap:6px;height:36px;justify-content:center;line-height:22px;padding:0 14px;white-space:nowrap}.gh-button:disabled{cursor:default;opacity:.4}.gh-button:focus-visible{outline:var(--dsw-focus-ring-width,2px) solid var(--dsw-focus-ring-color,var(--dsw-alias-state-business-primary));outline-offset:2px}.gh-primary{background:var(--dsw-alias-button-primary-fill);color:var(--dsw-alias-label-primary-foreground);font-weight:500}.gh-primary:hover:not(:disabled){background:var(--dsw-alias-button-primary-hover)}.gh-secondary{background:transparent;border:.5px solid var(--dsw-alias-border-l3);color:var(--dsw-alias-label-primary)}.gh-secondary:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}.gh-fileInput{color:var(--dsw-alias-label-secondary);font-size:12px}.gh-fileInput::file-selector-button{align-items:center;background:transparent;border:.5px solid var(--dsw-alias-border-l3);border-radius:var(--dsw-radius-md);box-sizing:border-box;color:var(--dsw-alias-label-primary);cursor:pointer;display:inline-flex;font:inherit;font-size:12px;height:28px;justify-content:center;line-height:18px;margin-right:8px;padding:0 10px;white-space:nowrap}.gh-fileInput::file-selector-button:hover{background:var(--dsw-alias-interactive-bg-hover)}.gh-fileInput:disabled::file-selector-button{cursor:default;opacity:.4}.gh-notice{border-radius:var(--dsw-radius-md);font-size:12px;line-height:18px;margin:0;padding:8px 12px}.gh-notice-success{color:var(--dsw-alias-state-success-primary)}.gh-notice-error,.gh-notice-success{background:var(--dsw-alias-bg-module-platform)}.gh-notice-error{color:var(--dsw-alias-state-error-primary)}.gh-loading{border-bottom:.5px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:18px;padding:16px 0}@media (max-width:640px){.gh-row{flex-wrap:wrap}.gh-text{flex-basis:100%;padding-right:0}.gh-control{align-items:stretch;width:100%}.gh-input{max-width:none;width:100%}}`};typeof process>`u`?globalThis.process={env:e}:process.env?Object.assign(process.env,e):process.env=e})();function e(e){return typeof e!=`string`||e.trim()===``?`Passphrase is required.`:e.length<8?`Passphrase must be at least 8 characters.`:e.length>1024?`Passphrase must be at most 1024 characters.`:null}async function t(e,t){let n=Object.assign({action:e},t||{}),r=await fetch(`/github/api`,{method:`POST`,headers:{"content-type":`application/json`},credentials:`same-origin`,body:JSON.stringify(n)}),i=null;try{i=await r.json()}catch{i=null}let a=typeof i==`object`&&i?i:null;if(a&&a.ok===!1){let e=a.error,t=e&&typeof e.message==`string`?e.message:`Request failed`;throw Error(t)}if(!r.ok)throw Error(`GitHub request failed (HTTP `+r.status+`).`);if(!a)throw Error(`Unreadable response.`);return Object.prototype.hasOwnProperty.call(a,`value`)?a.value:a}function n(e){return e<10?`0`+e:String(e)}function r(e){let t=Math.max(0,Math.ceil(e/1e3)),r=t%60,i=Math.floor(t/60)%60;return t>=3600?Math.floor(t/3600)+`:`+n(i)+`:`+n(r):n(i)+`:`+n(r)}function i(e){return e==null||!Number.isFinite(e)?`unknown`:e<=0?`expired`:e<3e5?`soon`:`valid`}function a(e,t,n){return typeof e==`number`&&Number.isFinite(e)&&e>0?e:typeof t==`number`&&Number.isFinite(t)&&t>0?t+n:null}function o(e){if(typeof document>`u`||!document.head||document.querySelector(`style[data-plugin="${e}"]`)!==null)return;let t=document.createElement(`style`);t.dataset.plugin=e,t.textContent=`.gh-section{color:var(--dsw-alias-label-primary);display:flex;flex-direction:column;font-size:14px;line-height:22px;width:100%}.gh-row{align-items:center;border-bottom:.5px solid var(--dsw-alias-border-l2);display:flex;gap:8px;padding:16px 0}.gh-row:last-of-type{border-bottom:none}.gh-text{flex:1;flex-direction:column;gap:4px;padding-right:48px}.gh-text,.gh-titleRow{display:flex;min-width:0}.gh-titleRow{align-items:center;flex-wrap:wrap;gap:8px}.gh-title{color:var(--dsw-alias-label-primary);font-size:14px;font-weight:400;line-height:22px}.gh-badge{align-items:center;border:.5px solid transparent;border-radius:999px;display:inline-flex;flex:none;font-size:11px;font-weight:500;gap:5px;line-height:17px;padding:1px 8px;white-space:nowrap}.gh-badge-missing{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary)}.gh-badge-missing,.gh-badge-pending{background:var(--dsw-alias-bg-module-platform)}.gh-badge-pending{border-color:var(--dsw-alias-label-caption);color:var(--dsw-alias-label-secondary)}.gh-badge-connected{background:var(--dsw-alias-bg-module-platform);border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary)}.gh-dot{background:currentColor;border-radius:50%;flex:none;height:6px;width:6px}.gh-desc{color:var(--dsw-alias-label-tertiary);font-size:12px;font-weight:400;line-height:18px;white-space:pre-line}.gh-desc code{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:11px}.gh-control{align-items:center;display:flex;flex:none;gap:8px;min-width:0}.gh-timer{box-sizing:border-box;color:var(--dsw-alias-label-primary);display:inline-block;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:14px;font-variant-numeric:tabular-nums;line-height:22px;min-width:72px;text-align:right}.gh-timer-soon{color:var(--dsw-alias-state-warn-primary)}.gh-timer-expired{color:var(--dsw-alias-state-error-primary)}.gh-input{background:var(--dsw-alias-bg-module-platform);border:none;border-radius:var(--dsw-radius-md);box-sizing:border-box;color:var(--dsw-alias-label-primary);font:inherit;font-size:14px;height:36px;line-height:22px;max-width:320px;padding:0 14px}.gh-input:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}.gh-input:disabled{cursor:default;opacity:.5}.gh-input:focus-visible{outline:var(--dsw-focus-ring-width,2px) solid var(--dsw-focus-ring-color,var(--dsw-alias-state-business-primary));outline-offset:2px}.gh-button{align-items:center;border:none;border-radius:var(--dsw-radius-md);box-sizing:border-box;cursor:pointer;display:inline-flex;font:inherit;font-size:14px;gap:6px;height:36px;justify-content:center;line-height:22px;padding:0 14px;white-space:nowrap}.gh-button:disabled{cursor:default;opacity:.4}.gh-button:focus-visible{outline:var(--dsw-focus-ring-width,2px) solid var(--dsw-focus-ring-color,var(--dsw-alias-state-business-primary));outline-offset:2px}.gh-primary{background:var(--dsw-alias-button-primary-fill);color:var(--dsw-alias-label-primary-foreground);font-weight:500}.gh-primary:hover:not(:disabled){background:var(--dsw-alias-button-primary-hover)}.gh-secondary{background:transparent;border:.5px solid var(--dsw-alias-border-l3);color:var(--dsw-alias-label-primary)}.gh-secondary:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}.gh-fileInput{color:var(--dsw-alias-label-secondary);font-size:12px}.gh-fileInput::file-selector-button{align-items:center;background:transparent;border:.5px solid var(--dsw-alias-border-l3);border-radius:var(--dsw-radius-md);box-sizing:border-box;color:var(--dsw-alias-label-primary);cursor:pointer;display:inline-flex;font:inherit;font-size:12px;height:28px;justify-content:center;line-height:18px;margin-right:8px;padding:0 10px;white-space:nowrap}.gh-fileInput::file-selector-button:hover{background:var(--dsw-alias-interactive-bg-hover)}.gh-fileInput:disabled::file-selector-button{cursor:default;opacity:.4}.gh-notice{border-radius:var(--dsw-radius-md);font-size:12px;line-height:18px;margin:0;padding:8px 12px}.gh-notice-success{color:var(--dsw-alias-state-success-primary)}.gh-notice-error,.gh-notice-success{background:var(--dsw-alias-bg-module-platform)}.gh-notice-error{color:var(--dsw-alias-state-error-primary)}.gh-loading{border-bottom:.5px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:18px;padding:16px 0}@media (max-width:640px){.gh-row{flex-wrap:wrap}.gh-text{flex-basis:100%;padding-right:0}.gh-control{align-items:stretch;width:100%}.gh-input{max-width:none;width:100%}}`,document.head.appendChild(t)}function s(e,t){return e instanceof Error&&e.message?e.message:t}let c;function l(){return c}function u(e){c=e}function d({children:e,variant:t=`primary`,disabled:n,onClick:r}){return/* @__PURE__ */ l().createElement(`button`,{className:`gh-button gh-`+t,disabled:n,onClick:r},e)}function f({expiresAt:e,onExpired:t}){let n=l(),{useEffect:a,useRef:o,useState:s}=n,[c,u]=s(()=>Date.now()),d=o(null);a(()=>{if(u(Date.now()),e===null)return;let t=setInterval(()=>u(Date.now()),1e3);return()=>clearInterval(t)},[e]);let f=e===null?null:e-c;if(a(()=>{f===null||f>0||d.current!==e&&(d.current=e,t&&t())},[e,f]),f===null)return null;let p=i(f),m=p===`soon`?`gh-timer-soon`:p===`expired`?`gh-timer-expired`:`gh-timer-valid`;return/* @__PURE__ */ n.createElement(`span`,{className:`gh-timer `+m},r(f))}function p({onChange:e,accept:t,disabled:n}){return/* @__PURE__ */ l().createElement(`input`,{className:`gh-fileInput`,type:`file`,accept:t,disabled:n,onChange:e})}function m({value:e,onChange:t,type:n=`text`,placeholder:r,disabled:i}){return/* @__PURE__ */ l().createElement(`input`,{className:`gh-input`,type:n,value:e,disabled:i,onChange:e=>t(e.target.value),placeholder:r})}function ee({kind:e,text:t}){return/* @__PURE__ */ l().createElement(`div`,{className:`gh-notice gh-notice-`+e,style:{marginTop:`16px`}},t)}function h({title:e,description:t,control:n,badge:r}){let i=l();return/* @__PURE__ */ i.createElement(`div`,{className:`gh-row`},/* @__PURE__ */ i.createElement(`div`,{className:`gh-text`},/* @__PURE__ */ i.createElement(`div`,{className:`gh-titleRow`},/* @__PURE__ */ i.createElement(`span`,{className:`gh-title`},e),r||null),t?/* @__PURE__ */ i.createElement(`div`,{className:`gh-desc`},t):null),/* @__PURE__ */ i.createElement(`div`,{className:`gh-control`},n))}function g({state:e,label:t}){let n=l();return/* @__PURE__ */ n.createElement(`span`,{className:`gh-badge gh-badge-`+e},/* @__PURE__ */ n.createElement(`span`,{className:`gh-dot`}),t)}function _(e,t){let n={};return t===null||(e.appId!==t.appId&&(n.appId=e.appId),e.installationId!==t.installationId&&(n.installationId=e.installationId),e.gitUserName!==t.gitUserName&&(n.gitUserName=e.gitUserName),e.gitUserEmail!==t.gitUserEmail&&(n.gitUserEmail=e.gitUserEmail)),n}function te(e){return new Promise((t,n)=>{let r=new FileReader;r.onload=()=>{let e=String(r.result||``);t(e.includes(`,`)?e.split(`,`)[1]:e)},r.onerror=()=>n(r.error||/* @__PURE__ */ Error(`File read failed`)),r.readAsDataURL(e)})}function v(){let n=l(),{useState:r,useEffect:i,useRef:o}=n,[c,u]=r(!0),[v,y]=r(!1),[b,x]=r(null),[S,ne]=r(null),[C,w]=r(``),[T,E]=r(``),[D,O]=r(``),[k,A]=r(``),[j,M]=r(``),N=o(!1),P=o(null);function F(){return{appId:C,installationId:T,gitUserName:D,gitUserEmail:k}}async function I(){try{let e=await t(`status`),n=e&&e.config,r=e&&e.gitIdentity,i={appId:n&&n.appId||``,installationId:n&&n.installationId||``,gitUserName:n&&n.gitUserName||r&&r.name||``,gitUserEmail:n&&n.gitUserEmail||r&&r.email||``};ne(e),w(i.appId),E(i.installationId),O(i.gitUserName),A(i.gitUserEmail),P.current=i,N.current=!0}catch(e){x({kind:`error`,text:s(e,`Failed to load status.`)})}finally{u(!1)}}i(()=>{I()},[]),i(()=>{let e=P.current;if(!N.current||e===null)return;let n=_(F(),e);if(Object.keys(n).length===0)return;let r=setTimeout(async()=>{try{await t(`saveConfig`,n),P.current={...e,...n}}catch(e){x({kind:`error`,text:s(e,`Save failed.`)})}},600);return()=>clearTimeout(r)},[C,T,D,k]);async function re(){let e=P.current;if(e===null)return;let n=_(F(),e);Object.keys(n).length!==0&&(await t(`saveConfig`,n),P.current={...e,...n})}async function L(e){y(!0),x(null);try{await e(),await I()}catch(e){x({kind:`error`,text:s(e,`Action failed.`)})}finally{y(!1)}}async function ie(){await L(async()=>{let e=await t(`installGh`);if(e&&e.install&&e.install.ok===!1)throw Error(e.install.error||`Install failed.`);x({kind:`success`,text:`Missing components installed.`})})}function R(){let t=e(j);return t===null||(x({kind:`error`,text:t}),!1)}async function ae(e){let n=e.target.files&&e.target.files[0];n&&(R()&&await L(async()=>{let e=await te(n);await t(`saveConfig`,{..._(F(),P.current),pemBase64:e,pemFileName:n.name,passphrase:j}),x({kind:`success`,text:`Private key uploaded and encrypted.`})}),e.target.value=``)}async function oe(){R()&&await L(async()=>{await re();let e=await t(`connect`,{passphrase:j});if(e&&e.connect&&e.connect.ok===!1)throw Error(e.connect.error||`Connect failed.`);M(``),x({kind:`success`,text:`Connected.`})})}async function se(){await L(async()=>{await t(`disconnect`),M(``),x({kind:`success`,text:`Disconnected.`})})}if(c)return/* @__PURE__ */ n.createElement(`div`,{className:`gh-section`},/* @__PURE__ */ n.createElement(`div`,{className:`gh-loading`},`Loading…`));let z=S?.gh??{installed:!1,version:null},B=S?.git??{installed:!1,version:null},V=S?.config??{hasKey:!1,keyFileName:null,appId:``,installationId:``,gitUserName:``,gitUserEmail:``},H=S?.auth??{loggedIn:!1,gitConfigured:!1},U=S?.token??null,W=z.installed&&B.installed,G=v||!W,K=v||!B.installed,ce=U!==null&&Number.isFinite(U.ttlSeconds)?U.ttlSeconds:3600,le=U!==null&&Number.isFinite(U.issuedAt)?U.issuedAt:null,ue=U!==null&&Number.isFinite(U.expiresAt)?U.expiresAt:null,de=H.loggedIn?a(ue,le,ce*1e3):null,q=`Ready`,J=`connected`;W||(q=`Install required`,J=`missing`);let Y=`Pending setup`,X=`pending`;H.loggedIn?(Y=`Connected`,X=`connected`):(V.hasKey||H.error)&&(Y=`Disconnected`,X=`missing`);let Z=`Authenticate GitHub CLI with a GitHub App`;!H.loggedIn&&H.error&&(Z+=`
+`+H.error);let Q=null;W||(Q=/* @__PURE__ */ n.createElement(d,{disabled:v,onClick:ie},v?`Installing…`:`Install missing components`));let $;return $=H.loggedIn?/* @__PURE__ */ n.createElement(d,{variant:`secondary`,disabled:v||!z.installed,onClick:se},v?`Disconnecting…`:`Disconnect`):/* @__PURE__ */ n.createElement(d,{disabled:G||!V.hasKey||!C||!T,onClick:oe},v?`Connecting…`:`Connect`),/* @__PURE__ */ n.createElement(`div`,{className:`gh-section`},/* @__PURE__ */ n.createElement(h,{key:`status`,title:`CLI status`,description:(z.installed?`GitHub version `+(z.version||`unknown`):`GitHub CLI is not installed`)+`
+`+(B.installed?`Git version `+(B.version||`unknown`):`Git is not installed`),badge:/* @__PURE__ */ n.createElement(g,{state:J,label:q}),control:Q}),/* @__PURE__ */ n.createElement(h,{key:`appId`,title:`App ID`,description:`Your GitHub App ID`,control:/* @__PURE__ */ n.createElement(m,{value:C,disabled:G,onChange:w,placeholder:`123456`})}),/* @__PURE__ */ n.createElement(h,{key:`installationId`,title:`Installation ID`,description:`Your GitHub App installation ID`,control:/* @__PURE__ */ n.createElement(m,{value:T,disabled:G,onChange:E,placeholder:`12345678`})}),/* @__PURE__ */ n.createElement(h,{key:`gitUserName`,title:`Git user name`,description:`Commit author name (git config --global user.name)`,control:/* @__PURE__ */ n.createElement(m,{value:D,disabled:K,onChange:O,placeholder:`Your Name`})}),/* @__PURE__ */ n.createElement(h,{key:`gitUserEmail`,title:`Git user email`,description:`Commit author email (git config --global user.email)`,control:/* @__PURE__ */ n.createElement(m,{type:`email`,value:k,disabled:K,onChange:A,placeholder:`you@example.com`})}),/* @__PURE__ */ n.createElement(h,{key:`passphrase`,title:`Key passphrase`,description:`Encrypts the private key at rest. It is never stored and is required for upload and every connect.`,control:/* @__PURE__ */ n.createElement(m,{type:`password`,value:j,disabled:v,onChange:M,placeholder:`At least 8 characters`})}),/* @__PURE__ */ n.createElement(h,{key:`key`,title:`Private key (.pem)`,description:V.hasKey?`Key uploaded and encrypted`+(V.keyFileName?` (`+V.keyFileName+`)`:``):`Upload the GitHub App private key`,control:/* @__PURE__ */ n.createElement(p,{accept:`.pem`,disabled:G,onChange:ae})}),/* @__PURE__ */ n.createElement(h,{key:`actions`,title:`Connection`,description:Z,badge:/* @__PURE__ */ n.createElement(g,{state:X,label:Y}),control:/* @__PURE__ */ n.createElement(n.Fragment,null,/* @__PURE__ */ n.createElement(f,{expiresAt:de,onExpired:I}),$)}),b?/* @__PURE__ */ n.createElement(ee,{kind:b.kind,text:b.text}):null)}const y=`dsh-github-app`;window.__ModuleLoader__.load({id:y,factory:e=>(u(e("react")),o(y),{apply(e){e.slots.inject(`settings.section`,()=>e.slots.register({name:`settings.section`,id:`github`,order:40,label:`GitHub`},v))},inject:[`slots`]})});

package/constants.d.ts

@@ -0,0 +1,20 @@
+/** Same-origin browser API prefix (host route). */
+export declare const API_PREFIX = "/github/api";
+/** Maximum request body size for the browser API (bytes). */
+export declare const MAX_BODY_BYTES: number;
+/** This package's name as the profile manifest declares it. */
+export declare const PACKAGE_NAME = "dsh-github-app";
+/** Plugin data directory name under the DSH home. */
+export declare const PLUGIN_DIR_NAME = "dsh-github-app";
+/** Settings file name inside the plugin directory. */
+export declare const SETTINGS_FILENAME = "github.json";
+/** Encrypted private key file name inside the plugin directory. */
+export declare const KEY_ENCRYPTED_FILENAME = "github-app.pem.enc";
+/** Default hostname for GitHub. */
+export declare const DEFAULT_HOSTNAME = "github.com";
+/** GitHub App installation access tokens are issued for one hour. */
+export declare const TOKEN_TTL_SECONDS = 3600;
+/** Minimum length of the passphrase that encrypts the private key. */
+export declare const MIN_PASSPHRASE_CHARS = 8;
+/** Maximum accepted passphrase length (guards scrypt input size). */
+export declare const MAX_PASSPHRASE_CHARS = 1024;

package/constants.mjs

@@ -0,0 +1,20 @@
+// src/constants.ts
+/** Same-origin browser API prefix (host route). */
+const API_PREFIX = "/github/api";
+/** Maximum request body size for the browser API (bytes). */
+const MAX_BODY_BYTES = 1048576;
+/** This package's name as the profile manifest declares it. */
+const PACKAGE_NAME = "dsh-github-app";
+/** Plugin data directory name under the DSH home. */
+const PLUGIN_DIR_NAME = "dsh-github-app";
+/** Settings file name inside the plugin directory. */
+const SETTINGS_FILENAME = "github.json";
+/** Encrypted private key file name inside the plugin directory. */
+const KEY_ENCRYPTED_FILENAME = "github-app.pem.enc";
+/** Default hostname for GitHub. */
+const DEFAULT_HOSTNAME = "github.com";
+/** GitHub App installation access tokens are issued for one hour. */
+const TOKEN_TTL_SECONDS = 3600;
+/** Maximum accepted passphrase length (guards scrypt input size). */
+const MAX_PASSPHRASE_CHARS = 1024;
+export { API_PREFIX, DEFAULT_HOSTNAME, KEY_ENCRYPTED_FILENAME, MAX_BODY_BYTES, MAX_PASSPHRASE_CHARS, PACKAGE_NAME, PLUGIN_DIR_NAME, SETTINGS_FILENAME, TOKEN_TTL_SECONDS };

package/contracts.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Shapes shared by the host API and the browser settings UI.
+ *
+ * Type-only: importing this module never adds runtime code to either bundle.
+ */
+export interface ToolStatus {
+    installed: boolean;
+    version: string | null;
+}
+export interface GitIdentity {
+    name: string;
+    email: string;
+}
+export interface StatusAuth {
+    loggedIn: boolean;
+    gitConfigured: boolean;
+    error?: string;
+}
+export interface StatusConfig {
+    appId: string;
+    installationId: string;
+    gitUserName: string;
+    gitUserEmail: string;
+    keyFileName: string | null;
+    hasKey: boolean;
+}
+export interface StatusToken {
+    issuedAt: number | null;
+    expiresAt: number | null;
+    ttlSeconds: number;
+    active: boolean;
+}
+export interface StatusPayload {
+    gh: ToolStatus;
+    git: ToolStatus;
+    config: StatusConfig;
+    auth: StatusAuth;
+    token: StatusToken;
+    gitIdentity: GitIdentity;
+}

package/cordis.patch.yml

@@ -0,0 +1,5 @@
+# dsh-github-app profile patch layer.
+# Registers the GitHub CLI integration (settings + host API).
+- insert:
+    - id: github
+      name: 'dsh-github-app'