git-workspace-service 0.3.0 → 0.3.1

package/dist/index.d.cts

@@ -312,9 +312,11 @@ interface Workspace {
      */
     branch: BranchInfo;
     /**
-     * Credential for this workspace
+     * Credential for this workspace.
+     * Optional for public repositories (read-only operations).
+     * Required for write operations (push, PR creation).
      */
-    credential: GitCredential;
+    credential?: GitCredential;
     /**
      * When the workspace was provisioned
      */
@@ -1233,6 +1235,10 @@ declare class WorkspaceService {
      * Clean up all workspaces for an execution
      */
     cleanupForExecution(executionId: string): Promise<void>;
+    /**
+     * Try to clone a public repository without authentication
+     */
+    private tryUnauthenticatedClone;
     private cloneRepo;
     private createBranch;
     private addWorktreeFromParent;

package/dist/index.d.ts

@@ -312,9 +312,11 @@ interface Workspace {
      */
     branch: BranchInfo;
     /**
-     * Credential for this workspace
+     * Credential for this workspace.
+     * Optional for public repositories (read-only operations).
+     * Required for write operations (push, PR creation).
      */
-    credential: GitCredential;
+    credential?: GitCredential;
     /**
      * When the workspace was provisioned
      */
@@ -1233,6 +1235,10 @@ declare class WorkspaceService {
      * Clean up all workspaces for an execution
      */
     cleanupForExecution(executionId: string): Promise<void>;
+    /**
+     * Try to clone a public repository without authentication
+     */
+    private tryUnauthenticatedClone;
     private cloneRepo;
     private createBranch;
     private addWorktreeFromParent;

package/dist/index.js

@@ -299,24 +299,28 @@ var WorkspaceService = class {
       credential = parent.credential;
     } else {
       await fs3.mkdir(workspacePath, { recursive: true });
-      credential = await this.credentialService.getCredentials({
-        repo: config.repo,
-        access: "write",
-        context: {
+      if (config.userCredentials) {
+        credential = await this.credentialService.getCredentials({
+          repo: config.repo,
+          access: "write",
+          context: {
+            executionId: config.execution.id,
+            taskId: config.task.id,
+            userId: config.user?.id,
+            reason: `Workspace for ${config.task.role} in ${config.execution.patternName}`
+          },
+          userProvided: config.userCredentials
+        });
+      }
+      if (credential) {
+        await this.emitEvent({
+          type: "credential:granted",
+          workspaceId,
+          credentialId: credential.id,
           executionId: config.execution.id,
-          taskId: config.task.id,
-          userId: config.user?.id,
-          reason: `Workspace for ${config.task.role} in ${config.execution.patternName}`
-        },
-        userProvided: config.userCredentials
-      });
-      await this.emitEvent({
-        type: "credential:granted",
-        workspaceId,
-        credentialId: credential.id,
-        executionId: config.execution.id,
-        timestamp: /* @__PURE__ */ new Date()
-      });
+          timestamp: /* @__PURE__ */ new Date()
+        });
+      }
     }
     const branchInfo = createBranchInfo(
       {
@@ -333,6 +337,7 @@ var WorkspaceService = class {
       repo: config.repo,
       branch: branchInfo,
       credential,
+      // Will be set before any write operations
       provisionedAt: /* @__PURE__ */ new Date(),
       status: "provisioning",
       strategy,
@@ -348,7 +353,38 @@ var WorkspaceService = class {
     try {
       if (strategy === "clone") {
         this.updateProgress(workspace, "cloning", "Cloning repository");
-        await this.cloneRepo(workspace, credential.token);
+        if (!credential) {
+          const cloneResult = await this.tryUnauthenticatedClone(workspace);
+          if (!cloneResult.success) {
+            this.log(
+              "info",
+              { workspaceId, error: cloneResult.error },
+              "Unauthenticated clone failed, requesting credentials"
+            );
+            credential = await this.credentialService.getCredentials({
+              repo: config.repo,
+              access: "write",
+              context: {
+                executionId: config.execution.id,
+                taskId: config.task.id,
+                userId: config.user?.id,
+                reason: `Workspace for ${config.task.role} in ${config.execution.patternName}`
+              }
+            });
+            workspace.credential = credential;
+            this.workspaces.set(workspaceId, workspace);
+            await this.emitEvent({
+              type: "credential:granted",
+              workspaceId,
+              credentialId: credential.id,
+              executionId: config.execution.id,
+              timestamp: /* @__PURE__ */ new Date()
+            });
+            await this.cloneRepo(workspace, credential.token);
+          }
+        } else {
+          await this.cloneRepo(workspace, credential.token);
+        }
         this.updateProgress(workspace, "creating_branch", "Creating branch");
         await this.createBranch(workspace);
       } else {
@@ -569,7 +605,7 @@ var WorkspaceService = class {
         });
       }
     }
-    if (workspace.strategy === "clone") {
+    if (workspace.strategy === "clone" && workspace.credential) {
       await this.credentialService.revokeCredential(workspace.credential.id);
       await this.emitEvent({
         type: "credential:revoked",
@@ -605,6 +641,36 @@ var WorkspaceService = class {
   // ─────────────────────────────────────────────────────────────
   // Private Methods
   // ─────────────────────────────────────────────────────────────
+  /**
+   * Try to clone a public repository without authentication
+   */
+  async tryUnauthenticatedClone(workspace) {
+    let cloneUrl = workspace.repo;
+    if (cloneUrl.startsWith("git@github.com:")) {
+      cloneUrl = cloneUrl.replace("git@github.com:", "https://github.com/");
+    }
+    if (!cloneUrl.endsWith(".git")) {
+      cloneUrl = `${cloneUrl}.git`;
+    }
+    if (!cloneUrl.startsWith("https://")) {
+      cloneUrl = `https://${cloneUrl}`;
+    }
+    try {
+      await this.execInDir(
+        workspace.path,
+        `git clone --depth 1 --branch ${workspace.branch.baseBranch} ${cloneUrl} .`
+      );
+      this.log("info", { workspaceId: workspace.id }, "Public repository cloned without authentication");
+      return { success: true };
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      const isAuthError = errorMessage.includes("401") || errorMessage.includes("403") || errorMessage.includes("Authentication failed") || errorMessage.includes("could not read Username") || errorMessage.includes("terminal prompts disabled");
+      if (isAuthError) {
+        return { success: false, error: "Authentication required" };
+      }
+      throw error;
+    }
+  }
   async cloneRepo(workspace, token) {
     const cloneUrl = token ? this.buildAuthenticatedUrl(workspace.repo, token) : workspace.repo;
     await this.execInDir(
@@ -628,11 +694,11 @@ var WorkspaceService = class {
   async configureGit(workspace) {
     await this.execInDir(workspace.path, 'git config user.name "Workspace Agent"');
     await this.execInDir(workspace.path, 'git config user.email "agent@workspace.local"');
-    if (!workspace.credential.token) {
+    if (!workspace.credential || !workspace.credential.token) {
       this.log(
         "debug",
         { workspaceId: workspace.id },
-        "Using SSH authentication, skipping credential helper"
+        workspace.credential ? "Using SSH authentication, skipping credential helper" : "No credentials (public repo), skipping credential helper"
       );
       return;
     }
@@ -658,9 +724,19 @@ var WorkspaceService = class {
     );
   }
   async pushBranch(workspace) {
+    if (!workspace.credential) {
+      throw new Error(
+        "Push requires authentication. This workspace was cloned from a public repository without credentials."
+      );
+    }
     await this.execInDir(workspace.path, `git push -u origin ${workspace.branch.name}`);
   }
   async createPullRequest(workspace, config) {
+    if (!workspace.credential) {
+      throw new Error(
+        "Pull request creation requires authentication. This workspace was cloned from a public repository without credentials."
+      );
+    }
     const repoInfo = this.parseRepo(workspace.repo);
     if (!repoInfo) {
       throw new Error(`Invalid repository format: ${workspace.repo}`);