lastlight 0.1.15 → 0.2.0

package/dist/engine/event-shim.test.js

@@ -0,0 +1,194 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { SessionLog, projectSlugForCwd } from "../session-log.js";
+import { AgenticShim } from "./event-shim.js";
+const tmpDirs = [];
+afterEach(async () => {
+    for (const d of tmpDirs.splice(0)) {
+        await fs.rm(d, { recursive: true, force: true });
+    }
+});
+async function makeShim(initialPrompt = "do the thing") {
+    const homeDir = await fs.mkdtemp(path.join(os.tmpdir(), "shim-test-"));
+    tmpDirs.push(homeDir);
+    const cwd = "/home/agent/workspace";
+    const projectSlug = projectSlugForCwd(cwd);
+    const shim = new AgenticShim({
+        homeDir,
+        projectSlug,
+        model: "openai/gpt-5.5",
+        initialPrompt,
+    });
+    const filePath = new SessionLog(homeDir).pathForProject(projectSlug, "sess1", { requireExists: false });
+    if (!filePath)
+        throw new Error("expected valid session path");
+    return { shim, filePath };
+}
+async function readEnvelopes(filePath) {
+    const raw = await fs.readFile(filePath, "utf8");
+    return raw
+        .split("\n")
+        .filter((l) => l.trim().length > 0)
+        .map((l) => JSON.parse(l));
+}
+describe("AgenticShim per-message usage", () => {
+    it("writes Claude-shaped usage onto the assistant envelope", async () => {
+        const { shim, filePath } = await makeShim();
+        shim.feed({ type: "session", id: "sess1" });
+        shim.feed({
+            type: "message_end",
+            sessionId: "sess1",
+            message: {
+                role: "assistant",
+                content: [{ type: "text", text: "hello" }],
+                usage: {
+                    input: 1200,
+                    output: 340,
+                    cacheRead: 5000,
+                    cacheWrite: 10,
+                    cost: { total: 0.07 },
+                },
+            },
+        });
+        await shim.flush();
+        const envelopes = await readEnvelopes(filePath);
+        const assistant = envelopes.find((e) => e.type === "assistant");
+        expect(assistant).toBeDefined();
+        const message = assistant?.message;
+        expect(message.usage).toEqual({
+            input_tokens: 1200,
+            output_tokens: 340,
+            cache_read_input_tokens: 5000,
+            cache_creation_input_tokens: 10,
+        });
+    });
+    it("writes an extension_status event as a system envelope line", async () => {
+        const { shim, filePath } = await makeShim();
+        shim.feed({ type: "session", id: "sess1" });
+        shim.feed({
+            type: "extension_status",
+            sessionId: "sess1",
+            extension: "file-search",
+            status: "configured",
+            mode: "override",
+            toolCount: 3,
+        });
+        await shim.flush();
+        const envelopes = await readEnvelopes(filePath);
+        const sys = envelopes.find((e) => e.type === "system" && e.subtype === "extension_status");
+        expect(sys).toBeDefined();
+        expect(sys).toMatchObject({
+            extension: "file-search",
+            status: "configured",
+            mode: "override",
+            toolCount: 3,
+        });
+        // The initial user (prompt) line precedes it — extension status lands near
+        // the top of the session log.
+        expect(envelopes[0]?.type).toBe("user");
+    });
+    it("omits the usage block when the message carries no usage", async () => {
+        const { shim, filePath } = await makeShim();
+        shim.feed({ type: "session", id: "sess1" });
+        shim.feed({
+            type: "message_end",
+            sessionId: "sess1",
+            message: { role: "assistant", content: [{ type: "text", text: "hi" }] },
+        });
+        await shim.flush();
+        const envelopes = await readEnvelopes(filePath);
+        const assistant = envelopes.find((e) => e.type === "assistant");
+        const message = assistant?.message;
+        expect(message.usage).toBeUndefined();
+    });
+});
+describe("AgenticShim thinking blocks", () => {
+    it("preserves thinking blocks on the assistant envelope and the reader extracts reasoning", async () => {
+        const { shim, filePath } = await makeShim();
+        shim.feed({ type: "session", id: "sess1" });
+        shim.feed({
+            type: "message_end",
+            sessionId: "sess1",
+            message: {
+                role: "assistant",
+                content: [
+                    { type: "thinking", thinking: "Let me reason about this..." },
+                    { type: "text", text: "Here is the answer." },
+                ],
+            },
+        });
+        await shim.flush();
+        const envelopes = await readEnvelopes(filePath);
+        const assistant = envelopes.find((e) => e.type === "assistant");
+        const content = (assistant?.message).content;
+        expect(content).toEqual([
+            { type: "thinking", thinking: "Let me reason about this..." },
+            { type: "text", text: "Here is the answer." },
+        ]);
+        // Round-trip through the reader the dashboard uses: reasoning is surfaced.
+        const normalized = await new SessionLog("").readNormalizedFile(filePath);
+        const asst = normalized.find((n) => n.msg.role === "assistant");
+        expect(asst?.msg.reasoning).toBe("Let me reason about this...");
+        expect(asst?.msg.content).toBe("Here is the answer.");
+    });
+    it("skips empty/redacted thinking blocks", async () => {
+        const { shim, filePath } = await makeShim();
+        shim.feed({ type: "session", id: "sess1" });
+        shim.feed({
+            type: "message_end",
+            sessionId: "sess1",
+            message: {
+                role: "assistant",
+                content: [
+                    { type: "thinking", thinking: "" },
+                    { type: "text", text: "answer" },
+                ],
+            },
+        });
+        await shim.flush();
+        const envelopes = await readEnvelopes(filePath);
+        const assistant = envelopes.find((e) => e.type === "assistant");
+        const content = (assistant?.message).content;
+        expect(content).toEqual([{ type: "text", text: "answer" }]);
+    });
+});
+describe("AgenticShim auto-retry breadcrumbs", () => {
+    it("emits a renderable system line on auto_retry_start", async () => {
+        const { shim, filePath } = await makeShim();
+        shim.feed({ type: "session", id: "sess1" });
+        shim.feed({
+            type: "auto_retry_start",
+            sessionId: "sess1",
+            attempt: 1,
+            maxAttempts: 3,
+            delayMs: 10000,
+            errorMessage: "429 RATE_LIMIT_EXCEEDED",
+        });
+        await shim.flush();
+        const envelopes = await readEnvelopes(filePath);
+        const sys = envelopes.find((e) => e.role === "system" && e.subtype === "auto_retry_start");
+        expect(sys).toBeDefined();
+        expect(String(sys?.content)).toContain("Auto-retry 1/3 in 10s");
+        expect(String(sys?.content)).toContain("429 RATE_LIMIT_EXCEEDED");
+        // Role-based line renders as a system message in the timeline reader.
+        const normalized = await new SessionLog("").readNormalizedFile(filePath);
+        const sysMsg = normalized.find((n) => n.msg.role === "system");
+        expect(sysMsg?.msg.content).toContain("Auto-retry 1/3 in 10s");
+    });
+    it("distinguishes recovery from give-up on auto_retry_end", async () => {
+        const { shim, filePath } = await makeShim();
+        shim.feed({ type: "session", id: "sess1" });
+        shim.feed({ type: "auto_retry_end", sessionId: "sess1", attempt: 2 });
+        shim.feed({ type: "auto_retry_end", sessionId: "sess1", attempt: 3, finalError: "still 429" });
+        await shim.flush();
+        const envelopes = await readEnvelopes(filePath);
+        const ends = envelopes.filter((e) => e.role === "system" && e.subtype === "auto_retry_end");
+        expect(ends).toHaveLength(2);
+        expect(String(ends[0]?.content)).toContain("recovered after 2 attempt");
+        expect(String(ends[1]?.content)).toContain("gave up after 3 attempt");
+        expect(String(ends[1]?.content)).toContain("still 429");
+    });
+});
+//# sourceMappingURL=event-shim.test.js.map

package/dist/engine/event-shim.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-shim.test.js","sourceRoot":"","sources":["../../src/engine/event-shim.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,MAAM,OAAO,GAAa,EAAE,CAAC;AAE7B,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,QAAQ,CAAC,aAAa,GAAG,cAAc;IACpD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IACvE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,uBAAuB,CAAC;IACpC,MAAM,WAAW,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC;QAC3B,OAAO;QACP,WAAW;QACX,KAAK,EAAE,gBAAgB;QACvB,aAAa;KACd,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IACxG,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAgB;IAC3C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChD,OAAO,GAAG;SACP,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAA4B,CAAC,CAAC;AAC1D,CAAC;AAED,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBAC1C,KAAK,EAAE;oBACL,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,GAAG;oBACX,SAAS,EAAE,IAAI;oBACf,UAAU,EAAE,EAAE;oBACd,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACtB;aACF;SACF,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAEnB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QAChE,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,SAAS,EAAE,OAA6C,CAAC;QACzE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YAC5B,YAAY,EAAE,IAAI;YAClB,aAAa,EAAE,GAAG;YAClB,uBAAuB,EAAE,IAAI;YAC7B,2BAA2B,EAAE,EAAE;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,kBAAkB;YACxB,SAAS,EAAE,OAAO;YAClB,SAAS,EAAE,aAAa;YACxB,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,CAAC;SACb,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAEnB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,kBAAkB,CAC/D,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;YACxB,SAAS,EAAE,aAAa;YACxB,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,CAAC;SACb,CAAC,CAAC;QACH,2EAA2E;QAC3E,8BAA8B;QAC9B,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE;SACxE,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAEnB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,SAAS,EAAE,OAA8B,CAAC;QAC1D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,6BAA6B,EAAE;oBAC7D,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE;iBAC9C;aACF;SACF,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAEnB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,CAAC,SAAS,EAAE,OAAuD,CAAA,CAAC,OAAO,CAAC;QAC5F,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YACtB,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,6BAA6B,EAAE;YAC7D,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE;SAC9C,CAAC,CAAC;QAEH,2EAA2E;QAC3E,MAAM,UAAU,GAAG,MAAM,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE;oBAClC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;iBACjC;aACF;SACF,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAEnB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,CAAC,SAAS,EAAE,OAAuD,CAAA,CAAC,OAAO,CAAC;QAC5F,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,kBAAkB;YACxB,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,yBAAyB;SACxC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAEnB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,kBAAkB,CAAC,CAAC;QAC3F,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QAElE,sEAAsE;QACtE,MAAM,UAAU,GAAG,MAAM,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/F,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAEnB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,gBAAgB,CAAC,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QACtE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/git-auth.d.ts

@@ -10,19 +10,17 @@ export type GitHubTokenPermissions = Partial<{
     metadata: GitHubPermissionLevel;
 }>;
 /**
- * Configure git globally so that git clone/push/pull work with the
- * GitHub App credentials. Called once before spawning agents.
+ * Mint a GitHub App installation token; OPTIONALLY also write the bot
+ * identity + credential helper to the user's global git config.
  *
- * Sets up:
- * - A credential helper that returns a fresh installation token
- * - Bot identity (user.name, user.email) for commits
+ * The default is to leave `~/.gitconfig` alone — every agent run happens
+ * inside a Docker sandbox where `sandbox-entrypoint.sh` configures git at
+ * the container's `--system` scope using the `GIT_TOKEN` env var the
+ * harness forwards. The harness process itself does not need git
+ * credentials for normal operation.
  *
- * Works in Docker, local dev, CI — no path assumptions.
- *
- * In local dev mode (LASTLIGHT_LOCAL_DEV=1) the global git config is NOT
- * modified — the host's identity and credential helper are left alone. The
- * token is still returned and propagates to sandboxes via env, where the
- * sandbox-entrypoint.sh sets up its own per-container credential helper.
+ * Set `LASTLIGHT_WRITE_GLOBAL_GIT=1` only if you have a non-sandboxed
+ * code path that needs the harness user to be able to push as the bot.
  */
 export declare function configureGitAuth(config: {
     appId: string;
@@ -41,12 +39,10 @@ export declare function configureGitAuth(config: {
     expiresAt: string;
 }>;
 /**
- * Refresh the git credential helper with a fresh token.
- * Call this if a push/pull fails with auth errors.
- *
- * In local dev mode the global git config is left alone — the fresh token is
- * returned to the caller (executor.ts) which forwards it to the sandbox via
- * env so the in-container credential helper picks it up.
+ * Mint a fresh installation token. Same opt-in rule as configureGitAuth:
+ * `LASTLIGHT_WRITE_GLOBAL_GIT=1` is required before this rotates the
+ * credential helper in the user's `~/.gitconfig`. Otherwise the token is
+ * just returned (executor.ts forwards it to the sandbox via env).
  */
 export declare function refreshGitAuth(config: {
     appId: string;

package/dist/engine/git-auth.js

@@ -1,65 +1,122 @@
-import { execSync } from "child_process";
+import { execFileSync } from "child_process";
 import { createSign } from "crypto";
-import { readFileSync } from "fs";
-import { resolve } from "path";
+import { mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join, resolve } from "path";
 /**
- * When true, all `git config --global` writes are skipped. The harness still
- * mints installation tokens and passes them to sandboxes via the GIT_TOKEN env
- * var, but the host's `~/.gitconfig` is left untouched. Set
- * `LASTLIGHT_LOCAL_DEV=1` when running the harness on your dev machine so it
- * doesn't overwrite your personal git identity or credential helper.
+ * Whether to write the bot identity + credential helper to the user's
+ * GLOBAL git config (`~/.gitconfig`). Defaults to **false** — the harness
+ * still mints installation tokens and forwards them to sandboxes via the
+ * `GIT_TOKEN` env var, where `sandbox-entrypoint.sh` configures git at the
+ * container's `--system` scope. The host's `~/.gitconfig` is left
+ * untouched.
+ *
+ * Set `LASTLIGHT_WRITE_GLOBAL_GIT=1` only when the harness itself runs git
+ * commands against your real filesystem (e.g. a non-sandboxed direct
+ * execution path). Production Docker doesn't need this — the entrypoint
+ * sets `--system` config inside the container.
+ *
+ * `LASTLIGHT_LOCAL_DEV=1` is accepted as a compat alias for the inverse
+ * (legacy meaning: "skip global writes") and silently ignored; that is
+ * now the default. The flag is harmless if left in place but the
+ * intentional opt-in is `LASTLIGHT_WRITE_GLOBAL_GIT=1`.
  */
-function isLocalDev() {
-    return process.env.LASTLIGHT_LOCAL_DEV === "1";
+function shouldWriteGlobalGitConfig() {
+    return process.env.LASTLIGHT_WRITE_GLOBAL_GIT === "1";
 }
 /**
- * Configure git globally so that git clone/push/pull work with the
- * GitHub App credentials. Called once before spawning agents.
+ * Conservative shape check on a GitHub installation token. The credentials
+ * file we write contains a single URL of the form
+ * `https://x-access-token:${token}@github.com` — any `@`, `:`, `/`, or
+ * newline in the token would break URL parsing or inject extra entries.
+ * Real GitHub tokens are alphanumeric (plus `_`); this assertion catches
+ * any future format change before we write a malformed credentials file.
+ */
+function assertSafeToken(token) {
+    if (!/^[A-Za-z0-9_-]+$/.test(token)) {
+        throw new Error("Refusing to embed a token containing characters outside [A-Za-z0-9_-] into git credentials file");
+    }
+}
+/**
+ * Resolve the path of the shared credentials file used by `credential.helper
+ * store`. Honors `LASTLIGHT_GIT_CREDENTIALS` so the sandbox entrypoint and
+ * the MCP server can agree on a path; falls back to `~/.config/lastlight/
+ * git-credentials` for the opt-in host write.
  *
- * Sets up:
- * - A credential helper that returns a fresh installation token
- * - Bot identity (user.name, user.email) for commits
+ * Whitespace in the path would break git's helper-arg splitting (the
+ * `store --file=<path>` value is shell-split on spaces, not exec'd), so
+ * reject any whitespace defensively.
+ */
+function credentialsFilePath() {
+    const fromEnv = process.env.LASTLIGHT_GIT_CREDENTIALS?.trim();
+    const path = fromEnv || join(homedir(), ".config", "lastlight", "git-credentials");
+    if (/\s/.test(path)) {
+        throw new Error(`LASTLIGHT_GIT_CREDENTIALS contains whitespace; git's helper-arg parsing would break: ${path}`);
+    }
+    return path;
+}
+/**
+ * Write the credentials file consumed by `credential.helper store`. One
+ * line: `https://x-access-token:${token}@github.com`. File is mode 600,
+ * parent dir mode 700. Returns the absolute path.
+ */
+function writeCredentialsFile(token) {
+    assertSafeToken(token);
+    const credPath = credentialsFilePath();
+    mkdirSync(dirname(credPath), { recursive: true, mode: 0o700 });
+    writeFileSync(credPath, `https://x-access-token:${token}@github.com\n`, { mode: 0o600 });
+    return credPath;
+}
+/**
+ * Mint a GitHub App installation token; OPTIONALLY also write the bot
+ * identity + credential helper to the user's global git config.
  *
- * Works in Docker, local dev, CI — no path assumptions.
+ * The default is to leave `~/.gitconfig` alone — every agent run happens
+ * inside a Docker sandbox where `sandbox-entrypoint.sh` configures git at
+ * the container's `--system` scope using the `GIT_TOKEN` env var the
+ * harness forwards. The harness process itself does not need git
+ * credentials for normal operation.
  *
- * In local dev mode (LASTLIGHT_LOCAL_DEV=1) the global git config is NOT
- * modified — the host's identity and credential helper are left alone. The
- * token is still returned and propagates to sandboxes via env, where the
- * sandbox-entrypoint.sh sets up its own per-container credential helper.
+ * Set `LASTLIGHT_WRITE_GLOBAL_GIT=1` only if you have a non-sandboxed
+ * code path that needs the harness user to be able to push as the bot.
  */
 export async function configureGitAuth(config) {
     const token = await getInstallationToken(config);
-    if (isLocalDev()) {
-        console.log(`[git-auth] LOCAL DEV MODE — skipping global git config writes. ` +
-            `Token is still passed to sandboxes via GIT_TOKEN env (expires: ${token.expiresAt}).`);
+    if (!shouldWriteGlobalGitConfig()) {
+        console.log(`[git-auth] Minted GitHub App token (expires: ${token.expiresAt}). ` +
+            `Global git config left untouched; sandboxes receive the token via GIT_TOKEN. ` +
+            `Set LASTLIGHT_WRITE_GLOBAL_GIT=1 to also write ~/.gitconfig.`);
         return token;
     }
-    // Set up credential helper — git will call this for any github.com URL
-    const credHelper = `!f() { echo "username=x-access-token"; echo "password=${token.token}"; }; f`;
-    exec(`git config --global credential.helper '${credHelper}'`);
-    // Bot identity
+    // Opt-in path: write the token to a 600-mode credentials file and point
+    // git's built-in `store` helper at it. No shell interpolation anywhere
+    // along the way — git invokes `credential-store --file=<path>` as
+    // argv-array, not through a shell.
+    const credPath = writeCredentialsFile(token.token);
+    execGit(["config", "--global", "credential.helper", `store --file=${credPath}`]);
     const botName = config.botName || "last-light";
-    exec(`git config --global user.name "${botName}[bot]"`);
-    exec(`git config --global user.email "${botName}[bot]@users.noreply.github.com"`);
-    console.log(`[git-auth] Configured git with GitHub App token (expires: ${token.expiresAt})`);
+    execGit(["config", "--global", "user.name", `${botName}[bot]`]);
+    execGit(["config", "--global", "user.email", `${botName}[bot]@users.noreply.github.com`]);
+    console.log(`[git-auth] Configured GLOBAL git with GitHub App token (file: ${credPath}, expires: ${token.expiresAt})`);
     return token;
 }
 /**
- * Refresh the git credential helper with a fresh token.
- * Call this if a push/pull fails with auth errors.
- *
- * In local dev mode the global git config is left alone — the fresh token is
- * returned to the caller (executor.ts) which forwards it to the sandbox via
- * env so the in-container credential helper picks it up.
+ * Mint a fresh installation token. Same opt-in rule as configureGitAuth:
+ * `LASTLIGHT_WRITE_GLOBAL_GIT=1` is required before this rotates the
+ * credential helper in the user's `~/.gitconfig`. Otherwise the token is
+ * just returned (executor.ts forwards it to the sandbox via env).
  */
 export async function refreshGitAuth(config) {
     const token = await getInstallationToken(config);
-    if (isLocalDev()) {
+    if (!shouldWriteGlobalGitConfig()) {
         return token;
     }
-    const credHelper = `!f() { echo "username=x-access-token"; echo "password=${token.token}"; }; f`;
-    exec(`git config --global credential.helper '${credHelper}'`);
-    console.log(`[git-auth] Refreshed token (expires: ${token.expiresAt})`);
+    const credPath = writeCredentialsFile(token.token);
+    // The credential.helper config already points at this path from the
+    // initial configureGitAuth call, but set it again so refreshGitAuth is
+    // safe to call standalone (idempotent).
+    execGit(["config", "--global", "credential.helper", `store --file=${credPath}`]);
+    console.log(`[git-auth] Refreshed token in GLOBAL git config (file: ${credPath}, expires: ${token.expiresAt})`);
     return token;
 }
 // ── Internal ────────────────────────────────────────────────────────
@@ -98,7 +155,7 @@ async function getInstallationToken(config) {
     const data = await res.json();
     return { token: data.token, expiresAt: data.expires_at };
 }
-function exec(cmd) {
-    execSync(cmd, { stdio: "pipe" });
+function execGit(args) {
+    execFileSync("git", args, { stdio: "pipe" });
 }
 //# sourceMappingURL=git-auth.js.map

package/dist/engine/git-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-auth.js","sourceRoot":"","sources":["../../src/engine/git-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAe/B;;;;;;GAMG;AACH,SAAS,UAAU;IACjB,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAYtC;IACC,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAEjD,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,iEAAiE;YAC3E,kEAAkE,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC;QACzF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uEAAuE;IACvE,MAAM,UAAU,GAAG,yDAAyD,KAAK,CAAC,KAAK,SAAS,CAAC;IACjG,IAAI,CAAC,0CAA0C,UAAU,GAAG,CAAC,CAAC;IAE9D,eAAe;IACf,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,YAAY,CAAC;IAC/C,IAAI,CAAC,kCAAkC,OAAO,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,mCAAmC,OAAO,iCAAiC,CAAC,CAAC;IAElF,OAAO,CAAC,GAAG,CAAC,6DAA6D,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IAE7F,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAWpC;IACC,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAEjD,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,UAAU,GAAG,yDAAyD,KAAK,CAAC,KAAK,SAAS,CAAC;IACjG,IAAI,CAAC,0CAA0C,UAAU,GAAG,CAAC,CAAC;IAE9D,OAAO,CAAC,GAAG,CAAC,wCAAwC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AAEvE,KAAK,UAAU,oBAAoB,CAAC,MAMnC;IACC,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;IAEzE,+CAA+C;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxH,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;IAErD,kCAAkC;IAClC,MAAM,WAAW,GAA4B,EAAE,CAAC;IAChD,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,WAAW,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IACjD,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrE,WAAW,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAC/C,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAE3D,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,4CAA4C,MAAM,CAAC,cAAc,gBAAgB,EACjF;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,QAAQ,EAAE;YACnC,MAAM,EAAE,6BAA6B;YACrC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE;QACD,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;KAC/D,CACF,CAAC;IAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,IAAI,CAAC,GAAW;IACvB,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"git-auth.js","sourceRoot":"","sources":["../../src/engine/git-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAe9C;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,0BAA0B;IACjC,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,GAAG,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;IACrH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACnF,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,wFAAwF,IAAI,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,KAAa;IACzC,eAAe,CAAC,KAAK,CAAC,CAAC;IACvB,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,aAAa,CAAC,QAAQ,EAAE,0BAA0B,KAAK,eAAe,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAYtC;IACC,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAEjD,IAAI,CAAC,0BAA0B,EAAE,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,gDAAgD,KAAK,CAAC,SAAS,KAAK;YAC9E,+EAA+E;YAC/E,8DAA8D,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,kEAAkE;IAClE,mCAAmC;IACnC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnD,OAAO,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,mBAAmB,EAAE,gBAAgB,QAAQ,EAAE,CAAC,CAAC,CAAC;IAEjF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,YAAY,CAAC;IAC/C,OAAO,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,OAAO,gCAAgC,CAAC,CAAC,CAAC;IAE1F,OAAO,CAAC,GAAG,CAAC,iEAAiE,QAAQ,cAAc,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IAEvH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAWpC;IACC,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAEjD,IAAI,CAAC,0BAA0B,EAAE,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnD,oEAAoE;IACpE,uEAAuE;IACvE,wCAAwC;IACxC,OAAO,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,mBAAmB,EAAE,gBAAgB,QAAQ,EAAE,CAAC,CAAC,CAAC;IAEjF,OAAO,CAAC,GAAG,CAAC,0DAA0D,QAAQ,cAAc,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IAChH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AAEvE,KAAK,UAAU,oBAAoB,CAAC,MAMnC;IACC,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;IAEzE,+CAA+C;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxH,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;IAErD,kCAAkC;IAClC,MAAM,WAAW,GAA4B,EAAE,CAAC;IAChD,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,WAAW,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IACjD,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrE,WAAW,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAC/C,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAE3D,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,4CAA4C,MAAM,CAAC,cAAc,gBAAgB,EACjF;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,QAAQ,EAAE;YACnC,MAAM,EAAE,6BAA6B;YACrC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE;QACD,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;KAC/D,CACF,CAAC;IAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,OAAO,CAAC,IAAc;IAC7B,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AAC/C,CAAC"}

package/dist/engine/git-auth.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/engine/git-auth.test.js

@@ -0,0 +1,117 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+vi.mock("child_process", () => ({
+    execSync: vi.fn(),
+    execFileSync: vi.fn(),
+}));
+vi.mock("fs", async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        readFileSync: vi.fn().mockReturnValue("fake-pem"),
+        writeFileSync: vi.fn(),
+        mkdirSync: vi.fn(),
+    };
+});
+vi.mock("crypto", async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        createSign: vi.fn().mockReturnValue({
+            update: vi.fn(),
+            sign: vi.fn().mockReturnValue("fakesig"),
+        }),
+    };
+});
+import { execSync, execFileSync } from "child_process";
+import * as fs from "fs";
+import { configureGitAuth, refreshGitAuth } from "./git-auth.js";
+const mockExecSync = vi.mocked(execSync);
+const mockExecFileSync = vi.mocked(execFileSync);
+function mockFetchToken(token = "ghs_testtoken123") {
+    vi.stubGlobal("fetch", vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({ token, expires_at: "2099-01-01T00:00:00Z" }),
+    }));
+}
+const baseConfig = {
+    appId: "12345",
+    privateKeyPath: "/fake/key.pem",
+    installationId: "67890",
+};
+describe("git-auth — global ~/.gitconfig writes are opt-in", () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        mockFetchToken();
+        // Default: NOT opted in — must not touch global git config.
+        delete process.env.LASTLIGHT_WRITE_GLOBAL_GIT;
+    });
+    it("configureGitAuth does NOT touch ~/.gitconfig by default", async () => {
+        await configureGitAuth(baseConfig);
+        expect(mockExecFileSync).not.toHaveBeenCalled();
+    });
+    it("refreshGitAuth does NOT touch ~/.gitconfig by default", async () => {
+        await refreshGitAuth(baseConfig);
+        expect(mockExecFileSync).not.toHaveBeenCalled();
+    });
+    it("configureGitAuth still returns the minted token when opted out", async () => {
+        const out = await configureGitAuth(baseConfig);
+        expect(out.token).toBe("ghs_testtoken123");
+        expect(out.expiresAt).toBe("2099-01-01T00:00:00Z");
+    });
+});
+describe("git-auth — opt-in global writes use execFileSync safely", () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        mockFetchToken();
+        process.env.LASTLIGHT_WRITE_GLOBAL_GIT = "1";
+    });
+    it("configureGitAuth does not use execSync", async () => {
+        await configureGitAuth(baseConfig);
+        expect(mockExecSync).not.toHaveBeenCalled();
+    });
+    it("configureGitAuth calls execFileSync with git array args", async () => {
+        await configureGitAuth(baseConfig);
+        expect(mockExecFileSync).toHaveBeenCalled();
+        for (const call of mockExecFileSync.mock.calls) {
+            expect(call[0]).toBe("git");
+            expect(Array.isArray(call[1])).toBe(true);
+        }
+    });
+    it("configureGitAuth writes the token to a 600-mode credentials file (no shell interp)", async () => {
+        const token = "ghs_testtoken123";
+        mockFetchToken(token);
+        await configureGitAuth(baseConfig);
+        const writeMock = vi.mocked(fs.writeFileSync);
+        expect(writeMock).toHaveBeenCalled();
+        const [path, contents, opts] = writeMock.mock.calls[0];
+        expect(typeof path).toBe("string");
+        expect(contents).toBe(`https://x-access-token:${token}@github.com\n`);
+        expect(opts?.mode).toBe(0o600);
+        const credHelperCall = mockExecFileSync.mock.calls.find((c) => Array.isArray(c[1]) && c[1].includes("credential.helper"));
+        expect(credHelperCall).toBeDefined();
+        const args = credHelperCall[1];
+        const valueArg = args[args.length - 1];
+        // Helper value is the non-shell `store --file=<path>` form (no `!f`,
+        // no quotes, no interpolation).
+        expect(valueArg).toMatch(/^store --file=/);
+        expect(valueArg).not.toContain("!f()");
+        expect(valueArg).not.toContain(token);
+    });
+    it("configureGitAuth refuses tokens containing characters outside [A-Za-z0-9_-]", async () => {
+        mockFetchToken('ghs_evil";rm -rf /;"');
+        await expect(configureGitAuth(baseConfig)).rejects.toThrow(/outside \[A-Za-z0-9_-\]/);
+    });
+    it("refreshGitAuth does not use execSync", async () => {
+        await refreshGitAuth(baseConfig);
+        expect(mockExecSync).not.toHaveBeenCalled();
+    });
+    it("refreshGitAuth calls execFileSync with git array args", async () => {
+        await refreshGitAuth(baseConfig);
+        expect(mockExecFileSync).toHaveBeenCalled();
+        for (const call of mockExecFileSync.mock.calls) {
+            expect(call[0]).toBe("git");
+            expect(Array.isArray(call[1])).toBe(true);
+        }
+    });
+});
+//# sourceMappingURL=git-auth.test.js.map

package/dist/engine/git-auth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-auth.test.js","sourceRoot":"","sources":["../../src/engine/git-auth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9D,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9B,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE;IACjB,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;CACtB,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACrC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAuB,CAAC;IAC3D,OAAO;QACL,GAAG,MAAM;QACT,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC;QACjD,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;QACtB,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE;KACnB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACzC,MAAM,MAAM,GAAG,MAAM,cAAc,EAA2B,CAAC;IAC/D,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC;YAClC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;YACf,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC;SACzC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEjE,MAAM,YAAY,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACzC,MAAM,gBAAgB,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AAEjD,SAAS,cAAc,CAAC,KAAK,GAAG,kBAAkB;IAChD,EAAE,CAAC,UAAU,CACX,OAAO,EACP,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;QACxB,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC;KAClE,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG;IACjB,KAAK,EAAE,OAAO;IACd,cAAc,EAAE,eAAe;IAC/B,cAAc,EAAE,OAAO;CACxB,CAAC;AAEF,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAChE,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,cAAc,EAAE,CAAC;QACjB,4DAA4D;QAC5D,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;QACjC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACvE,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,cAAc,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,0BAA0B,GAAG,GAAG,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,CAAC,gBAAgB,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,MAAM,KAAK,GAAG,kBAAkB,CAAC;QACjC,cAAc,CAAC,KAAK,CAAC,CAAC;QACtB,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAEnC,MAAM,SAAS,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;QAC9C,MAAM,CAAC,SAAS,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAwC,CAAC;QAC9F,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,0BAA0B,KAAK,eAAe,CAAC,CAAC;QACtE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE/B,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CACrD,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,CAAC,CAAc,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAC/E,CAAC;QACF,MAAM,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,cAAe,CAAC,CAAC,CAAa,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvC,qEAAqE;QACrE,gCAAgC;QAChC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,cAAc,CAAC,sBAAsB,CAAC,CAAC;QACvC,MAAM,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;QACjC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;QACjC,MAAM,CAAC,gBAAgB,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/github-app-client.d.ts

@@ -0,0 +1,7 @@
+import { Octokit } from "octokit";
+export interface GitHubAppClientConfig {
+    appId: string;
+    privateKeyPath: string;
+    installationId: string;
+}
+export declare function githubAppClient(config: GitHubAppClientConfig): Octokit;

package/dist/engine/github-app-client.js

@@ -0,0 +1,16 @@
+import { createAppAuth } from "@octokit/auth-app";
+import { readFileSync } from "fs";
+import { Octokit } from "octokit";
+import { resolve } from "path";
+export function githubAppClient(config) {
+    const privateKey = readFileSync(resolve(config.privateKeyPath), "utf-8");
+    return new Octokit({
+        authStrategy: createAppAuth,
+        auth: {
+            appId: config.appId,
+            privateKey,
+            installationId: config.installationId,
+        },
+    });
+}
+//# sourceMappingURL=github-app-client.js.map

package/dist/engine/github-app-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-app-client.js","sourceRoot":"","sources":["../../src/engine/github-app-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAQ/B,MAAM,UAAU,eAAe,CAAC,MAA6B;IAC3D,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;IACzE,OAAO,IAAI,OAAO,CAAC;QACjB,YAAY,EAAE,aAAa;QAC3B,IAAI,EAAE;YACJ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU;YACV,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/engine/github-app-client.test.d.ts

@@ -0,0 +1 @@
+export {};