opencode-magi 0.0.0-dev-20260519083642 → 0.0.0-dev-20260519084318

package/dist/config/validate.js

@@ -475,7 +475,7 @@ async function validateAuth(config, exec, errors) {
 }
 async function fetchPermissions(config, exec, account) {
     const token = (await exec(`gh auth token${ghHostOption(config)} --user ${JSON.stringify(account)}`)).trim();
-    const raw = await exec(`GH_TOKEN=${JSON.stringify(token)} gh api${ghHostOption(config)} repos/${config.github?.owner}/${config.github?.repo} --jq .permissions`);
+    const raw = await exec(`gh api${ghHostOption(config)} repos/${config.github?.owner}/${config.github?.repo} --jq .permissions`, { env: { GH_TOKEN: token } });
     return JSON.parse(raw);
 }
 async function validateRepositoryPermissions(config, exec, errors, warnings) {

package/dist/github/commands.js

@@ -80,6 +80,9 @@ export function ghHostOption(repository) {
 export async function ghToken(exec, repository, account) {
     return (await exec(`gh auth token${ghHostOption(repository)} --user ${shellQuote(account)}`)).trim();
 }
+function ghTokenEnv(token) {
+    return { env: { GH_TOKEN: token } };
+}
 export async function fetchPullRequest(exec, repository, pr) {
     const json = await exec(`gh pr view ${pr} --repo ${shellQuote(repoSpecifier(repository))} --json number,title,url,isDraft,baseRefOid,headRefOid,baseRefName,headRefName,headRepository,headRepositoryOwner`);
     return JSON.parse(json);
@@ -247,14 +250,14 @@ export async function removeBranch(exec, branch) {
 }
 export async function postApproval(exec, repository, pr, account) {
     const token = await ghToken(exec, repository, account);
-    return exec(`GH_TOKEN=${shellQuote(token)} gh pr review ${pr} --repo ${shellQuote(repoSpecifier(repository))} --approve`);
+    return exec(`gh pr review ${pr} --repo ${shellQuote(repoSpecifier(repository))} --approve`, ghTokenEnv(token));
 }
 export async function postCloseComment(exec, repository, pr, account, body) {
     const token = await ghToken(exec, repository, account);
     const payloadPath = join(tmpdir(), `magi-close-${process.pid}-${Date.now()}.json`);
     await writeFile(payloadPath, JSON.stringify({ body, event: "COMMENT" }));
     try {
-        return await exec(`GH_TOKEN=${shellQuote(token)} gh api${ghHostOption(repository)} repos/${repository.github.owner}/${repository.github.repo}/pulls/${pr}/reviews --method POST --input ${shellQuote(payloadPath)} --jq .html_url`);
+        return await exec(`gh api${ghHostOption(repository)} repos/${repository.github.owner}/${repository.github.repo}/pulls/${pr}/reviews --method POST --input ${shellQuote(payloadPath)} --jq .html_url`, ghTokenEnv(token));
     }
     finally {
         await rm(payloadPath, { force: true });
@@ -285,7 +288,7 @@ export async function postChangesRequested(exec, repository, pr, account, findin
         event: "REQUEST_CHANGES",
     }));
     try {
-        return await exec(`GH_TOKEN=${shellQuote(token)} gh api${ghHostOption(repository)} repos/${repository.github.owner}/${repository.github.repo}/pulls/${pr}/reviews --method POST --input ${shellQuote(payloadPath)} --jq .html_url`);
+        return await exec(`gh api${ghHostOption(repository)} repos/${repository.github.owner}/${repository.github.repo}/pulls/${pr}/reviews --method POST --input ${shellQuote(payloadPath)} --jq .html_url`, ghTokenEnv(token));
     }
     finally {
         await rm(payloadPath, { force: true });
@@ -303,7 +306,7 @@ export async function mergePullRequest(exec, repository, pr, account) {
     const mergeFlags = repository.merge.mergeQueue
         ? ""
         : ` ${methodFlag}${autoFlag}${deleteFlag}`;
-    return exec(`GH_TOKEN=${shellQuote(token)} gh pr merge ${pr} --repo ${shellQuote(repoSpecifier(repository))}${mergeFlags}`);
+    return exec(`gh pr merge ${pr} --repo ${shellQuote(repoSpecifier(repository))}${mergeFlags}`, ghTokenEnv(token));
 }
 export async function fetchPullRequestMergeStatus(exec, repository, pr) {
     const json = await exec(`gh pr view ${pr} --repo ${shellQuote(repoSpecifier(repository))} --json state,mergeStateStatus,autoMergeRequest`);
@@ -322,12 +325,23 @@ export async function waitForMergeQueue(exec, repository, pr, intervalMs = 30_00
 }
 export async function closePullRequest(exec, repository, pr, account) {
     const token = await ghToken(exec, repository, account);
-    return exec(`GH_TOKEN=${shellQuote(token)} gh pr close ${pr} --repo ${shellQuote(repoSpecifier(repository))}`);
+    return exec(`gh pr close ${pr} --repo ${shellQuote(repoSpecifier(repository))}`, ghTokenEnv(token));
 }
 export async function pushHead(exec, repository, worktreePath, account, head) {
     const token = await ghToken(exec, repository, account);
     const url = repositoryGitUrl(repository, head.owner, head.repo);
-    await exec(`git -c credential.helper= -c credential.helper=${shellQuote(`!f() { echo username=x-access-token; echo password=${token}; }; f`)} push ${shellQuote(url)} ${shellQuote(`HEAD:refs/heads/${head.ref}`)}`, { cwd: worktreePath });
+    await exec(`git push ${shellQuote(url)} ${shellQuote(`HEAD:refs/heads/${head.ref}`)}`, {
+        cwd: worktreePath,
+        env: {
+            GIT_CONFIG_COUNT: "2",
+            GIT_CONFIG_KEY_0: "credential.helper",
+            GIT_CONFIG_KEY_1: "credential.helper",
+            GIT_CONFIG_VALUE_0: "",
+            GIT_CONFIG_VALUE_1: "!f() { echo username=x-access-token; echo password=$GIT_PASSWORD; }; f",
+            GIT_PASSWORD: token,
+            GIT_TERMINAL_PROMPT: "0",
+        },
+    });
 }
 export async function configureGitIdentity(exec, worktreePath, identity) {
     if (identity.name) {
@@ -392,7 +406,7 @@ export async function postReply(exec, repository, pr, account, commentId, body)
     const payloadPath = join(tmpdir(), `magi-reply-${process.pid}-${Date.now()}-${commentId}.json`);
     await writeFile(payloadPath, JSON.stringify({ body }));
     try {
-        return await exec(`GH_TOKEN=${shellQuote(token)} gh api${ghHostOption(repository)} repos/${repository.github.owner}/${repository.github.repo}/pulls/${pr}/comments/${commentId}/replies --method POST --input ${shellQuote(payloadPath)} --jq .html_url`);
+        return await exec(`gh api${ghHostOption(repository)} repos/${repository.github.owner}/${repository.github.repo}/pulls/${pr}/comments/${commentId}/replies --method POST --input ${shellQuote(payloadPath)} --jq .html_url`, ghTokenEnv(token));
     }
     finally {
         await rm(payloadPath, { force: true });
@@ -401,5 +415,5 @@ export async function postReply(exec, repository, pr, account, commentId, body)
 export async function resolveThread(exec, repository, account, threadId) {
     const token = await ghToken(exec, repository, account);
     const query = `mutation($threadId: ID!) { resolveReviewThread(input: { threadId: $threadId }) { thread { id } } }`;
-    await exec(`GH_TOKEN=${shellQuote(token)} gh api${ghHostOption(repository)} graphql -f query=${shellQuote(query)} -F threadId=${shellQuote(threadId)}`);
+    await exec(`gh api${ghHostOption(repository)} graphql -f query=${shellQuote(query)} -F threadId=${shellQuote(threadId)}`, ghTokenEnv(token));
 }

package/dist/orchestrator/run-manager.js

@@ -20,6 +20,14 @@ function createRunId() {
 function now() {
     return new Date().toISOString();
 }
+export function redactSecrets(value) {
+    return value
+        .replace(/\b(GH_TOKEN|GITHUB_TOKEN|GH_ENTERPRISE_TOKEN)=('[^']*'|"[^"]*"|\S+)/g, "$1=<redacted>")
+        .replace(/(password=)([^;'\s]+)/g, "$1<redacted>");
+}
+function errorMessage(error) {
+    return redactSecrets(error instanceof Error ? error.message : String(error));
+}
 function isActiveStatus(status) {
     return (status === "blocked" ||
         status === "preparing" ||
@@ -927,7 +935,7 @@ export class MagiRunManager {
         }
         if (input.event.type === "session.error") {
             agent.status = "failed";
-            agent.error = JSON.stringify(input.event.properties?.error ?? "session error");
+            agent.error = redactSecrets(JSON.stringify(input.event.properties?.error ?? "session error"));
             markUpdated(true);
             dirty = true;
         }
@@ -1226,7 +1234,7 @@ export class MagiRunManager {
         if (progress.type === "ci_classifier_failed") {
             const classifier = state.ciClassifiers?.[progress.reviewer];
             if (classifier) {
-                classifier.error = progress.error;
+                classifier.error = redactSecrets(progress.error);
                 classifier.status = "failed";
                 classifier.lastUpdate = now();
             }
@@ -1282,7 +1290,7 @@ export class MagiRunManager {
             if (!reviewer)
                 return;
             reviewer.status = "failed";
-            reviewer.error = progress.error;
+            reviewer.error = redactSecrets(progress.error);
             reviewer.lastUpdate = now();
         }
         if (progress.type === "reviewer_completed") {
@@ -1328,7 +1336,7 @@ export class MagiRunManager {
             await this.notify(state, `**CI classifier ${progress.reviewer}** completed for ${prMarkdownLink(state)}: ${progress.classification} - ${progress.reason}`);
         }
         if (progress.type === "ci_classifier_failed") {
-            await this.notify(state, `**CI classifier ${progress.reviewer}** failed for ${prMarkdownLink(state)}: ${progress.error}`);
+            await this.notify(state, `**CI classifier ${progress.reviewer}** failed for ${prMarkdownLink(state)}: ${redactSecrets(progress.error)}`);
         }
         if (progress.type === "worktree_created") {
             await this.notify(state, `Worktree is ready for ${prMarkdownLink(state)}.`);
@@ -1344,7 +1352,7 @@ export class MagiRunManager {
         }
         if (progress.type === "reviewer_failed") {
             await this.notify(state, reviewerFailureText({
-                error: progress.error,
+                error: redactSecrets(progress.error),
                 pr: prMarkdownLink(state),
                 repairAttempts: state.reviewers[progress.reviewer]?.repairAttempts ?? 0,
                 reviewer: progress.reviewer,
@@ -1451,7 +1459,7 @@ export class MagiRunManager {
         }
         if (progress.type === "editor_failed") {
             editor.status = "failed";
-            editor.error = progress.error;
+            editor.error = redactSecrets(progress.error);
             editor.lastUpdate = now();
         }
         if (progress.type === "editor_completed") {
@@ -1475,7 +1483,7 @@ export class MagiRunManager {
         }
         if (progress.type === "editor_failed") {
             await this.notify(state, editorFailureText({
-                error: progress.error,
+                error: redactSecrets(progress.error),
                 pr: prMarkdownLink(state),
                 repairAttempts: state.editor?.repairAttempts ?? 0,
             }));
@@ -1493,7 +1501,7 @@ export class MagiRunManager {
         state.status = "failed";
         state.phase = "failed";
         state.completedAt = now();
-        state.error = error instanceof Error ? error.message : String(error);
+        state.error = errorMessage(error);
         if (state.editor?.status === "pending" ||
             state.editor?.status === "running" ||
             state.editor?.status === "repairing" ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-magi",
-  "version": "0.0.0-dev-20260519083642",
+  "version": "0.0.0-dev-20260519084318",
   "description": "Multi-agent PR review and merge orchestration plugin for OpenCode.",
   "license": "MIT",
   "author": "Hirotomo Yamada <hirotomo.yamada@avap.co.jp>",