mergie-cli 0.1.0 → 0.1.1

package/README.md

@@ -30,7 +30,8 @@ review (just the new commits since last time) awkward, and can't help you naviga
 
 - **[Bun](https://bun.sh)** ≥ 1.2 (mergie's runtime).
 - **git** and the **[GitHub CLI](https://cli.github.com) (`gh`)**, authenticated
-  (`gh auth login`). mergie reuses `gh`'s token for all API access and your git config for cloning.
+  (`gh auth login`). mergie reuses `gh`'s token for **both** API access and cloning — it clones over
+  HTTPS via gh's credential helper, so **no SSH key or host-key setup is needed**.
 - *(Optional, for AI features)* Claude access for the Claude Agent SDK — e.g. an
   `ANTHROPIC_API_KEY` in your environment.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mergie-cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Review GitHub pull requests from a fast local web UI, driven by a small CLI.",
   "license": "GPL-3.0-or-later",
   "author": "Ayush Poddar",

package/src/daemon/createRegistry.ts

@@ -174,13 +174,15 @@ function makeWorkspace(input: WorkspaceInputs): Workspace {
   const artifacts = artifactsRepo(db);
   const aiReviews = aiReviewsRepo(db);
   const aiReviewTracker = createAiReviewTracker();
-  const sshUrl = `git@github.com:${ref.owner}/${ref.repo}.git`;
+  // Clone over HTTPS on the PR's own host (honours GitHub Enterprise), authed by
+  // the gh credential helper — reuses the user's gh login, no SSH setup needed.
+  const remoteUrl = `https://${ref.host}/${ref.owner}/${ref.repo}.git`;
   let cloned = false;
   let baselineSha = "";
 
   async function ensureClone(): Promise<void> {
     if (cloned) return;
-    await git.cloneOrFetch(sshUrl, [`refs/pull/${ref.number}/head`, meta.baseRef]);
+    await git.cloneOrFetch(remoteUrl, [`refs/pull/${ref.number}/head`, meta.baseRef]);
     baselineSha = (await git.mergeBase(`origin/${meta.baseRef}`, meta.headSha)) || meta.baseRef;
     cloned = true;
   }
@@ -320,7 +322,7 @@ function makeWorkspace(input: WorkspaceInputs): Workspace {
       pr.body = fresh.body;
       pr.baseRef = fresh.baseRef;
       pr.headRef = fresh.headRef;
-      await git.cloneOrFetch(sshUrl, [`refs/pull/${ref.number}/head`, fresh.baseRef]);
+      await git.cloneOrFetch(remoteUrl, [`refs/pull/${ref.number}/head`, fresh.baseRef]);
       baselineSha = (await git.mergeBase(`origin/${fresh.baseRef}`, fresh.headSha)) || fresh.baseRef;
       cloned = true;
     },

package/src/services/git.ts

@@ -37,16 +37,18 @@ export interface GitService {
   /**
    * Ensure the repository is available locally and up to date.
    *
-   * - If `<cloneDir>/.git` is absent: runs `git clone <sshUrl> <cloneDir>`.
+   * - If `<cloneDir>/.git` is absent: runs `git clone <remoteUrl> <cloneDir>`.
    * - If present: runs `git -C <cloneDir> fetch origin <refs...>`.
    *
+   * Both paths authenticate HTTPS remotes through the gh CLI credential helper
+   * (see {@link GH_CREDENTIAL_ARGS}), so no SSH key or host-key trust is needed.
    * Throws if the git process exits with a non-zero code; the error message
    * includes stderr so callers can surface the reason.
    *
-   * @param sshUrl - SSH remote URL, e.g. `git@github.com:org/repo.git`.
-   * @param refs   - Ref names / refspecs to fetch (e.g. `["main", "refs/pull/1/head"]`).
+   * @param remoteUrl - HTTPS remote URL, e.g. `https://github.com/org/repo.git`.
+   * @param refs      - Ref names / refspecs to fetch (e.g. `["main", "refs/pull/1/head"]`).
    */
-  cloneOrFetch(sshUrl: string, refs: string[]): Promise<void>;
+  cloneOrFetch(remoteUrl: string, refs: string[]): Promise<void>;
 
   /**
    * List commits in the range `startSha..endSha`, ordered oldest → newest.
@@ -164,6 +166,18 @@ function wsArgs(ignoreWhitespace: boolean | undefined): readonly string[] {
   return ignoreWhitespace ? [IGNORE_WHITESPACE_ARG] : [];
 }
 
+/**
+ * Per-command git config that authenticates HTTPS remotes via the **gh CLI's
+ * credential helper**, so cloning/fetching reuses the user's existing `gh`
+ * login (no separate SSH key or host-key trust required). The empty first
+ * helper resets any inherited helper; the second delegates to `gh`. Passed as
+ * `-c` flags so the user's global git config is never modified.
+ */
+const GH_CREDENTIAL_ARGS = [
+  "-c", "credential.helper=",
+  "-c", "credential.helper=!gh auth git-credential",
+] as const;
+
 // ---------------------------------------------------------------------------
 // Internal helpers
 // ---------------------------------------------------------------------------
@@ -194,11 +208,11 @@ export function createGitService(
   runner: CommandRunner = bunRunner,
 ): GitService {
   return {
-    async cloneOrFetch(sshUrl, refs) {
+    async cloneOrFetch(remoteUrl, refs) {
       const hasGit = existsSync(`${cloneDir}/.git`);
       const args: string[] = hasGit
-        ? ["-C", cloneDir, "fetch", "origin", ...refs]
-        : ["clone", sshUrl, cloneDir];
+        ? [...GH_CREDENTIAL_ARGS, "-C", cloneDir, "fetch", "origin", ...refs]
+        : [...GH_CREDENTIAL_ARGS, "clone", remoteUrl, cloneDir];
 
       const result = await runner.run("git", args);
       if (result.exitCode !== 0) {