opencode-magi 0.0.0-dev-20260519083642 → 0.0.0-dev-20260519091322

package/dist/config/validate.js

@@ -475,7 +475,7 @@ async function validateAuth(config, exec, errors) {
 }
 async function fetchPermissions(config, exec, account) {
     const token = (await exec(`gh auth token${ghHostOption(config)} --user ${JSON.stringify(account)}`)).trim();
-    const raw = await exec(`GH_TOKEN=${JSON.stringify(token)} gh api${ghHostOption(config)} repos/${config.github?.owner}/${config.github?.repo} --jq .permissions`);
+    const raw = await exec(`gh api${ghHostOption(config)} repos/${config.github?.owner}/${config.github?.repo} --jq .permissions`, { env: { GH_TOKEN: token } });
     return JSON.parse(raw);
 }
 async function validateRepositoryPermissions(config, exec, errors, warnings) {

package/dist/github/commands.js

@@ -80,6 +80,19 @@ export function ghHostOption(repository) {
 export async function ghToken(exec, repository, account) {
     return (await exec(`gh auth token${ghHostOption(repository)} --user ${shellQuote(account)}`)).trim();
 }
+function ghTokenEnv(token) {
+    return { env: { GH_TOKEN: token } };
+}
+async function fetchPullRequestQueueInput(exec, repository, pr, token) {
+    const query = `query($owner: String!, $repo: String!, $pr: Int!) { repository(owner: $owner, name: $repo) { pullRequest(number: $pr) { id headRefOid } } }`;
+    const raw = await exec(`gh api${ghHostOption(repository)} graphql -f query=${shellQuote(query)} -F owner=${shellQuote(repository.github.owner)} -F repo=${shellQuote(repository.github.repo)} -F pr=${pr}`, ghTokenEnv(token));
+    const data = JSON.parse(raw);
+    const pullRequest = data.data?.repository?.pullRequest;
+    if (!pullRequest?.id || !pullRequest.headRefOid) {
+        throw new Error(`Could not fetch pull request queue metadata for #${pr}`);
+    }
+    return { headRefOid: pullRequest.headRefOid, id: pullRequest.id };
+}
 export async function fetchPullRequest(exec, repository, pr) {
     const json = await exec(`gh pr view ${pr} --repo ${shellQuote(repoSpecifier(repository))} --json number,title,url,isDraft,baseRefOid,headRefOid,baseRefName,headRefName,headRepository,headRepositoryOwner`);
     return JSON.parse(json);
@@ -247,14 +260,14 @@ export async function removeBranch(exec, branch) {
 }
 export async function postApproval(exec, repository, pr, account) {
     const token = await ghToken(exec, repository, account);
-    return exec(`GH_TOKEN=${shellQuote(token)} gh pr review ${pr} --repo ${shellQuote(repoSpecifier(repository))} --approve`);
+    return exec(`gh pr review ${pr} --repo ${shellQuote(repoSpecifier(repository))} --approve`, ghTokenEnv(token));
 }
 export async function postCloseComment(exec, repository, pr, account, body) {
     const token = await ghToken(exec, repository, account);
     const payloadPath = join(tmpdir(), `magi-close-${process.pid}-${Date.now()}.json`);
     await writeFile(payloadPath, JSON.stringify({ body, event: "COMMENT" }));
     try {
-        return await exec(`GH_TOKEN=${shellQuote(token)} gh api${ghHostOption(repository)} repos/${repository.github.owner}/${repository.github.repo}/pulls/${pr}/reviews --method POST --input ${shellQuote(payloadPath)} --jq .html_url`);
+        return await exec(`gh api${ghHostOption(repository)} repos/${repository.github.owner}/${repository.github.repo}/pulls/${pr}/reviews --method POST --input ${shellQuote(payloadPath)} --jq .html_url`, ghTokenEnv(token));
     }
     finally {
         await rm(payloadPath, { force: true });
@@ -285,7 +298,7 @@ export async function postChangesRequested(exec, repository, pr, account, findin
         event: "REQUEST_CHANGES",
     }));
     try {
-        return await exec(`GH_TOKEN=${shellQuote(token)} gh api${ghHostOption(repository)} repos/${repository.github.owner}/${repository.github.repo}/pulls/${pr}/reviews --method POST --input ${shellQuote(payloadPath)} --jq .html_url`);
+        return await exec(`gh api${ghHostOption(repository)} repos/${repository.github.owner}/${repository.github.repo}/pulls/${pr}/reviews --method POST --input ${shellQuote(payloadPath)} --jq .html_url`, ghTokenEnv(token));
     }
     finally {
         await rm(payloadPath, { force: true });
@@ -293,6 +306,11 @@ export async function postChangesRequested(exec, repository, pr, account, findin
 }
 export async function mergePullRequest(exec, repository, pr, account) {
     const token = await ghToken(exec, repository, account);
+    if (repository.merge.mergeQueue) {
+        const queueInput = await fetchPullRequestQueueInput(exec, repository, pr, token);
+        const query = `mutation($pullRequestId: ID!, $expectedHeadOid: GitObjectID!) { enqueuePullRequest(input: { pullRequestId: $pullRequestId, expectedHeadOid: $expectedHeadOid }) { mergeQueueEntry { id } } }`;
+        return exec(`gh api${ghHostOption(repository)} graphql -f query=${shellQuote(query)} -F pullRequestId=${shellQuote(queueInput.id)} -F expectedHeadOid=${shellQuote(queueInput.headRefOid)} --jq .data.enqueuePullRequest.mergeQueueEntry.id`, ghTokenEnv(token));
+    }
     const methodFlag = repository.merge.method === "merge"
         ? "--merge"
         : repository.merge.method === "rebase"
@@ -300,21 +318,29 @@ export async function mergePullRequest(exec, repository, pr, account) {
             : "--squash";
     const autoFlag = repository.merge.auto ? " --auto" : "";
     const deleteFlag = repository.merge.deleteBranch ? " --delete-branch" : "";
-    const mergeFlags = repository.merge.mergeQueue
-        ? ""
-        : ` ${methodFlag}${autoFlag}${deleteFlag}`;
-    return exec(`GH_TOKEN=${shellQuote(token)} gh pr merge ${pr} --repo ${shellQuote(repoSpecifier(repository))}${mergeFlags}`);
+    return exec(`gh pr merge ${pr} --repo ${shellQuote(repoSpecifier(repository))} ${methodFlag}${autoFlag}${deleteFlag}`, ghTokenEnv(token));
 }
 export async function fetchPullRequestMergeStatus(exec, repository, pr) {
     const json = await exec(`gh pr view ${pr} --repo ${shellQuote(repoSpecifier(repository))} --json state,mergeStateStatus,autoMergeRequest`);
     return JSON.parse(json);
 }
+export async function fetchPullRequestQueueStatus(exec, repository, pr) {
+    const query = `query($owner: String!, $repo: String!, $pr: Int!) { repository(owner: $owner, name: $repo) { pullRequest(number: $pr) { state isInMergeQueue mergeQueueEntry { id } } } }`;
+    const raw = await exec(`gh api${ghHostOption(repository)} graphql -f query=${shellQuote(query)} -F owner=${shellQuote(repository.github.owner)} -F repo=${shellQuote(repository.github.repo)} -F pr=${pr}`);
+    const data = JSON.parse(raw);
+    const status = data.data?.repository?.pullRequest;
+    if (!status)
+        throw new Error(`Could not fetch merge queue status for #${pr}`);
+    return status;
+}
 export async function waitForMergeQueue(exec, repository, pr, intervalMs = 30_000) {
     for (;;) {
-        const status = await fetchPullRequestMergeStatus(exec, repository, pr);
+        const status = await fetchPullRequestQueueStatus(exec, repository, pr);
         if (status.state === "MERGED")
             return "merged";
-        if (status.state === "OPEN" && status.autoMergeRequest == null) {
+        if (status.state === "OPEN" &&
+            !status.isInMergeQueue &&
+            status.mergeQueueEntry == null) {
             return "dequeued";
         }
         await new Promise((resolve) => setTimeout(resolve, intervalMs));
@@ -322,12 +348,23 @@ export async function waitForMergeQueue(exec, repository, pr, intervalMs = 30_00
 }
 export async function closePullRequest(exec, repository, pr, account) {
     const token = await ghToken(exec, repository, account);
-    return exec(`GH_TOKEN=${shellQuote(token)} gh pr close ${pr} --repo ${shellQuote(repoSpecifier(repository))}`);
+    return exec(`gh pr close ${pr} --repo ${shellQuote(repoSpecifier(repository))}`, ghTokenEnv(token));
 }
 export async function pushHead(exec, repository, worktreePath, account, head) {
     const token = await ghToken(exec, repository, account);
     const url = repositoryGitUrl(repository, head.owner, head.repo);
-    await exec(`git -c credential.helper= -c credential.helper=${shellQuote(`!f() { echo username=x-access-token; echo password=${token}; }; f`)} push ${shellQuote(url)} ${shellQuote(`HEAD:refs/heads/${head.ref}`)}`, { cwd: worktreePath });
+    await exec(`git push ${shellQuote(url)} ${shellQuote(`HEAD:refs/heads/${head.ref}`)}`, {
+        cwd: worktreePath,
+        env: {
+            GIT_CONFIG_COUNT: "2",
+            GIT_CONFIG_KEY_0: "credential.helper",
+            GIT_CONFIG_KEY_1: "credential.helper",
+            GIT_CONFIG_VALUE_0: "",
+            GIT_CONFIG_VALUE_1: "!f() { echo username=x-access-token; echo password=$GIT_PASSWORD; }; f",
+            GIT_PASSWORD: token,
+            GIT_TERMINAL_PROMPT: "0",
+        },
+    });
 }
 export async function configureGitIdentity(exec, worktreePath, identity) {
     if (identity.name) {
@@ -392,7 +429,7 @@ export async function postReply(exec, repository, pr, account, commentId, body)
     const payloadPath = join(tmpdir(), `magi-reply-${process.pid}-${Date.now()}-${commentId}.json`);
     await writeFile(payloadPath, JSON.stringify({ body }));
     try {
-        return await exec(`GH_TOKEN=${shellQuote(token)} gh api${ghHostOption(repository)} repos/${repository.github.owner}/${repository.github.repo}/pulls/${pr}/comments/${commentId}/replies --method POST --input ${shellQuote(payloadPath)} --jq .html_url`);
+        return await exec(`gh api${ghHostOption(repository)} repos/${repository.github.owner}/${repository.github.repo}/pulls/${pr}/comments/${commentId}/replies --method POST --input ${shellQuote(payloadPath)} --jq .html_url`, ghTokenEnv(token));
     }
     finally {
         await rm(payloadPath, { force: true });
@@ -401,5 +438,5 @@ export async function postReply(exec, repository, pr, account, commentId, body)
 export async function resolveThread(exec, repository, account, threadId) {
     const token = await ghToken(exec, repository, account);
     const query = `mutation($threadId: ID!) { resolveReviewThread(input: { threadId: $threadId }) { thread { id } } }`;
-    await exec(`GH_TOKEN=${shellQuote(token)} gh api${ghHostOption(repository)} graphql -f query=${shellQuote(query)} -F threadId=${shellQuote(threadId)}`);
+    await exec(`gh api${ghHostOption(repository)} graphql -f query=${shellQuote(query)} -F threadId=${shellQuote(threadId)}`, ghTokenEnv(token));
 }

package/dist/orchestrator/run-manager.js

@@ -20,6 +20,14 @@ function createRunId() {
 function now() {
     return new Date().toISOString();
 }
+export function redactSecrets(value) {
+    return value
+        .replace(/\b(GH_TOKEN|GITHUB_TOKEN|GH_ENTERPRISE_TOKEN)=('[^']*'|"[^"]*"|\S+)/g, "$1=<redacted>")
+        .replace(/(password=)([^;'\s]+)/g, "$1<redacted>");
+}
+function errorMessage(error) {
+    return redactSecrets(error instanceof Error ? error.message : String(error));
+}
 function isActiveStatus(status) {
     return (status === "blocked" ||
         status === "preparing" ||
@@ -927,7 +935,7 @@ export class MagiRunManager {
         }
         if (input.event.type === "session.error") {
             agent.status = "failed";
-            agent.error = JSON.stringify(input.event.properties?.error ?? "session error");
+            agent.error = redactSecrets(JSON.stringify(input.event.properties?.error ?? "session error"));
             markUpdated(true);
             dirty = true;
         }
@@ -1226,7 +1234,7 @@ export class MagiRunManager {
         if (progress.type === "ci_classifier_failed") {
             const classifier = state.ciClassifiers?.[progress.reviewer];
             if (classifier) {
-                classifier.error = progress.error;
+                classifier.error = redactSecrets(progress.error);
                 classifier.status = "failed";
                 classifier.lastUpdate = now();
             }
@@ -1282,7 +1290,7 @@ export class MagiRunManager {
             if (!reviewer)
                 return;
             reviewer.status = "failed";
-            reviewer.error = progress.error;
+            reviewer.error = redactSecrets(progress.error);
             reviewer.lastUpdate = now();
         }
         if (progress.type === "reviewer_completed") {
@@ -1328,7 +1336,7 @@ export class MagiRunManager {
             await this.notify(state, `**CI classifier ${progress.reviewer}** completed for ${prMarkdownLink(state)}: ${progress.classification} - ${progress.reason}`);
         }
         if (progress.type === "ci_classifier_failed") {
-            await this.notify(state, `**CI classifier ${progress.reviewer}** failed for ${prMarkdownLink(state)}: ${progress.error}`);
+            await this.notify(state, `**CI classifier ${progress.reviewer}** failed for ${prMarkdownLink(state)}: ${redactSecrets(progress.error)}`);
         }
         if (progress.type === "worktree_created") {
             await this.notify(state, `Worktree is ready for ${prMarkdownLink(state)}.`);
@@ -1344,7 +1352,7 @@ export class MagiRunManager {
         }
         if (progress.type === "reviewer_failed") {
             await this.notify(state, reviewerFailureText({
-                error: progress.error,
+                error: redactSecrets(progress.error),
                 pr: prMarkdownLink(state),
                 repairAttempts: state.reviewers[progress.reviewer]?.repairAttempts ?? 0,
                 reviewer: progress.reviewer,
@@ -1451,7 +1459,7 @@ export class MagiRunManager {
         }
         if (progress.type === "editor_failed") {
             editor.status = "failed";
-            editor.error = progress.error;
+            editor.error = redactSecrets(progress.error);
             editor.lastUpdate = now();
         }
         if (progress.type === "editor_completed") {
@@ -1475,7 +1483,7 @@ export class MagiRunManager {
         }
         if (progress.type === "editor_failed") {
             await this.notify(state, editorFailureText({
-                error: progress.error,
+                error: redactSecrets(progress.error),
                 pr: prMarkdownLink(state),
                 repairAttempts: state.editor?.repairAttempts ?? 0,
             }));
@@ -1493,7 +1501,7 @@ export class MagiRunManager {
         state.status = "failed";
         state.phase = "failed";
         state.completedAt = now();
-        state.error = error instanceof Error ? error.message : String(error);
+        state.error = errorMessage(error);
         if (state.editor?.status === "pending" ||
             state.editor?.status === "running" ||
             state.editor?.status === "repairing" ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-magi",
-  "version": "0.0.0-dev-20260519083642",
+  "version": "0.0.0-dev-20260519091322",
   "description": "Multi-agent PR review and merge orchestration plugin for OpenCode.",
   "license": "MIT",
   "author": "Hirotomo Yamada <hirotomo.yamada@avap.co.jp>",