pi-git-auth 1.0.0

package/details.ts

@@ -0,0 +1,219 @@
+/**
+ * Read-only "repo details" overlay: metadata + 2-level tree + latest commits.
+ *
+ * `buildDetailsText` is pure (easy to test); `RepoDetailsPanel` is thin TUI
+ * glue that renders it in a scrollable, dismissible overlay.
+ */
+
+import type { Theme } from "@earendil-works/pi-coding-agent";
+import { matchesKey, truncateToWidth, visibleWidth, type Focusable } from "@earendil-works/pi-tui";
+import type { CommitInfo, RepoMeta, TreeEntry } from "./forge";
+
+const MAX_TOP_ENTRIES = 10;
+const MAX_CHILD_ENTRIES = 8;
+const MAX_COMMITS = 5;
+const MAX_SUBJECT = 56;
+/** Chrome rows of the panel: top border, title, hint row, bottom border (+1 slack). */
+const PANEL_CHROME = 5;
+
+function relTime(iso: string): string {
+  const then = Date.parse(iso);
+  if (Number.isNaN(then)) return "";
+  const s = Math.floor((Date.now() - then) / 1000);
+  if (s < 60) return "just now";
+  const m = Math.floor(s / 60);
+  if (m < 60) return `${m}m ago`;
+  const h = Math.floor(m / 60);
+  if (h < 24) return `${h}h ago`;
+  const d = Math.floor(h / 24);
+  if (d < 30) return `${d}d ago`;
+  const mo = Math.floor(d / 30);
+  if (mo < 12) return `${mo}mo ago`;
+  return `${Math.floor(mo / 12)}y ago`;
+}
+
+function fmtSize(kb: number): string {
+  if (!Number.isFinite(kb) || kb <= 0) return "";
+  if (kb >= 1024) return `${(kb / 1024).toFixed(1)} MB`;
+  return `${Math.round(kb)} KB`;
+}
+
+function sortEntries(list: TreeEntry[]): TreeEntry[] {
+  return [...list].sort((a, b) => {
+    const ad = a.type === "tree" ? 0 : 1;
+    const bd = b.type === "tree" ? 0 : 1;
+    if (ad !== bd) return ad - bd;
+    return a.path < b.path ? -1 : a.path > b.path ? 1 : 0;
+  });
+}
+
+/**
+ * Flat recursive tree entries → compact 2-level listing (dirs first,
+ * capped per level, with "… +N more" markers).
+ */
+export function renderTree(entries: TreeEntry[]): string[] {
+  if (entries.length === 0) return [];
+  const tops: TreeEntry[] = [];
+  const children = new Map<string, TreeEntry[]>();
+  for (const e of entries) {
+    if (!e.path.includes("/")) {
+      tops.push(e);
+      continue;
+    }
+    const topDir = `${e.path.split("/")[0]!}/`;
+    const rest = e.path.slice(topDir.length);
+    if (rest.includes("/")) continue; // depth > 2: not shown
+    let list = children.get(topDir);
+    if (!list) {
+      list = [];
+      children.set(topDir, list);
+    }
+    list.push(e);
+  }
+  const out: string[] = [];
+  const shown = sortEntries(tops).slice(0, MAX_TOP_ENTRIES);
+  for (const t of shown) {
+    out.push(`  ${t.path}${t.type === "tree" ? "/" : ""}`);
+    if (t.type === "tree") {
+      const kids = sortEntries(children.get(`${t.path}/`) ?? []);
+      for (const k of kids.slice(0, MAX_CHILD_ENTRIES)) {
+        out.push(`    ${k.path.slice(t.path.length + 1)}${k.type === "tree" ? "/" : ""}`);
+      }
+      if (kids.length > MAX_CHILD_ENTRIES) out.push(`    … +${kids.length - MAX_CHILD_ENTRIES} more`);
+    }
+  }
+  if (tops.length > MAX_TOP_ENTRIES) out.push(`  … +${tops.length - MAX_TOP_ENTRIES} more`);
+  return out;
+}
+
+/** Compose the details view content (plain text lines, no ANSI). */
+export function buildDetailsText(
+  repo: RepoMeta,
+  commits: CommitInfo[],
+  tree: TreeEntry[],
+): { title: string; lines: string[] } {
+  const meta = [
+    `branch: ${repo.defaultBranch}`,
+    fmtSize(repo.sizeKb ?? 0),
+    `★ ${repo.stars}`,
+    `${repo.forks} fork${repo.forks === 1 ? "" : "s"}`,
+    repo.lastPush ? `pushed ${relTime(repo.lastPush)}` : "",
+  ].filter(Boolean);
+
+  const lines: string[] = [];
+  if (repo.description) {
+    lines.push(repo.description);
+    lines.push("");
+  }
+  lines.push(meta.join(" · "));
+  lines.push(repo.htmlUrl);
+  lines.push("");
+  lines.push("Tree");
+  if (tree.length === 0) {
+    lines.push(`  ${commits.length > 0 ? "(could not load)" : "(empty repository)"}`);
+  } else {
+    lines.push(...renderTree(tree));
+  }
+  lines.push("");
+  if (commits.length === 0) {
+    lines.push("Commits — none");
+  } else {
+    lines.push(`Commits (${commits.length})`);
+    for (const c of commits.slice(0, MAX_COMMITS)) {
+      const subject =
+        c.subject.length > MAX_SUBJECT ? `${c.subject.slice(0, MAX_SUBJECT - 1)}…` : c.subject;
+      const when = c.date ? `  (${relTime(c.date)})` : "";
+      lines.push(`  ${c.sha.slice(0, 7)}  ${subject}${when}`);
+    }
+  }
+  return { title: `${repo.fullName} [${repo.private ? "private" : "public"}]`, lines };
+}
+
+/**
+ * Border-drawn overlay panel. Scroll with up/down/j/k/pgup/pgdn/home/end;
+ * dismiss with esc/enter/q/ctrl+c.
+ */
+export class RepoDetailsPanel implements Focusable {
+  focused = false;
+
+  private scrollTop = 0;
+  private dismissed = false;
+
+  constructor(
+    private readonly title: string,
+    private readonly lines: string[],
+    private readonly theme: Theme,
+    private readonly getRows: () => number,
+    private readonly done: () => void,
+    private readonly requestRender: () => void,
+  ) {}
+
+  handleInput(data: string): void {
+    if (
+      matchesKey(data, "escape") ||
+      matchesKey(data, "return") ||
+      matchesKey(data, "enter") ||
+      matchesKey(data, "q") ||
+      matchesKey(data, "ctrl+c")
+    ) {
+      this.dismiss();
+      return;
+    }
+    const page = Math.max(2, Math.floor(this.visibleRows() / 2));
+    if (matchesKey(data, "up") || matchesKey(data, "k")) {
+      this.move(-1);
+    } else if (matchesKey(data, "down") || matchesKey(data, "j")) {
+      this.move(1);
+    } else if (matchesKey(data, "pageUp")) {
+      this.move(-page);
+    } else if (matchesKey(data, "pageDown")) {
+      this.move(page);
+    } else if (matchesKey(data, "home")) {
+      this.scrollTop = 0;
+      this.requestRender();
+    } else if (matchesKey(data, "end")) {
+      this.scrollTop = Number.MAX_SAFE_INTEGER;
+      this.requestRender();
+    }
+  }
+
+  invalidate(): void {
+    // Stateless render — nothing to clear.
+  }
+
+  render(width: number): string[] {
+    const innerW = Math.max(10, width - 2);
+    const maxScroll = Math.max(0, this.lines.length - this.visibleRows());
+    this.scrollTop = Math.min(Math.max(0, this.scrollTop), maxScroll);
+    const view = this.lines.slice(this.scrollTop, this.scrollTop + this.visibleRows());
+
+    const B = (s: string) => this.theme.fg("border", s);
+    const row = (content: string) => {
+      const t = truncateToWidth(content, innerW - 2);
+      return B("│") + " " + t + " ".repeat(Math.max(0, innerW - 2 - visibleWidth(t))) + " " + B("│");
+    };
+
+    const out: string[] = [];
+    out.push(B("╭") + B("─".repeat(innerW)) + B("╮"));
+    out.push(row(this.theme.fg("accent", this.theme.bold(this.title))));
+    for (const line of view) out.push(row(line));
+    out.push(row(this.theme.fg("dim", "esc close")));
+    out.push(B("╰") + B("─".repeat(innerW)) + B("╯"));
+    return out;
+  }
+
+  private visibleRows(): number {
+    return Math.max(4, Math.floor(this.getRows() * 0.8) - PANEL_CHROME);
+  }
+
+  private move(delta: number): void {
+    this.scrollTop += delta;
+    this.requestRender();
+  }
+
+  private dismiss(): void {
+    if (this.dismissed) return;
+    this.dismissed = true;
+    this.done();
+  }
+}

package/forge.ts

@@ -0,0 +1,144 @@
+/**
+ * Service (forge) abstraction: GitHub and GitLab behind one interface.
+ *
+ * Everything the extension does (verify, list, create, details) goes
+ * through the Service of the ACTIVE account, so the rest of the code is
+ * service-agnostic. Normalized types keep details.ts / commands.ts
+ * independent of the two REST APIs.
+ */
+
+import {
+  getUser as ghGetUser,
+  listRepos as ghListRepos,
+  createRepo as ghCreateRepo,
+  getRepo as ghGetRepo,
+  listCommits as ghListCommits,
+  getTree as ghGetTree,
+} from "./github";
+import {
+  getUser as glGetUser,
+  listRepos as glListRepos,
+  createRepo as glCreateRepo,
+  getRepo as glGetRepo,
+  listCommits as glListCommits,
+  getTree as glGetTree,
+} from "./gitlab";
+
+export type Platform = "github" | "gitlab";
+
+/** Repo reference as "owner/name" (gitlab: path_with_namespace, may nest). */
+export interface ForgeRepo {
+  fullName: string;
+  private: boolean;
+  description?: string;
+  htmlUrl: string;
+}
+
+/** Normalized repo metadata for the details overlay. */
+export interface RepoMeta {
+  fullName: string;
+  private: boolean;
+  description?: string;
+  defaultBranch: string;
+  /** KB when the service reports it (GitHub); omitted otherwise. */
+  sizeKb?: number;
+  stars: number;
+  forks: number;
+  /** ISO date when the service reports it. */
+  lastPush?: string;
+  htmlUrl: string;
+}
+
+export interface CommitInfo {
+  /** Full or short sha, as reported. */
+  sha: string;
+  /** First line of the commit message. */
+  subject: string;
+  /** ISO date. */
+  date: string;
+}
+
+export interface TreeEntry {
+  path: string;
+  type: "blob" | "tree";
+}
+
+export interface Service {
+  id: Platform;
+  label: string;
+  /** Git host, e.g. github.com / gitlab.com (used by the git gate). */
+  host: string;
+  tokenUrl: string;
+  tokenPlaceholder: string;
+  scopesHint: string;
+  verify(token: string): Promise<{ login: string; scopes?: string }>;
+  listRepos(token: string, org?: string): Promise<ForgeRepo[]>;
+  createRepo(
+    token: string,
+    name: string,
+    opts: { org?: string; private?: boolean; description?: string },
+  ): Promise<ForgeRepo>;
+  meta(token: string, fullName: string): Promise<RepoMeta>;
+  commits(token: string, fullName: string, n: number): Promise<CommitInfo[]>;
+  /** Flat recursive tree (depth limited by the service). Returns [] without a ref. */
+  tree(token: string, fullName: string, ref?: string): Promise<TreeEntry[]>;
+}
+
+const ghService: Service = {
+  id: "github",
+  label: "GitHub",
+  host: "github.com",
+  tokenUrl: "https://github.com/settings/tokens/new",
+  tokenPlaceholder: "ghp_… / github_pat_… / gho_…",
+  scopesHint: "repo, user:email",
+  verify: (token) => ghGetUser(token),
+  listRepos: (token, org) => ghListRepos(token, { org }).then((rs) =>
+    rs.map((r) => ({
+      fullName: r.full_name,
+      private: !!r.private,
+      description: r.description ?? undefined,
+      htmlUrl: r.html_url,
+    })),
+  ),
+  createRepo: (token, name, opts) =>
+    ghCreateRepo(token, { name, org: opts.org, private: opts.private, description: opts.description }).then((r) => ({
+      fullName: r.full_name,
+      private: !!r.private,
+      description: r.description ?? undefined,
+      htmlUrl: r.html_url,
+    })),
+  meta: (token, fullName) =>
+    ghGetRepo(token, fullName).then((r) => ({
+      fullName: r.full_name,
+      private: !!r.private,
+      description: r.description,
+      defaultBranch: r.default_branch,
+      sizeKb: r.size,
+      stars: r.stargazers_count,
+      forks: r.forks_count,
+      lastPush: r.pushed_at || undefined,
+      htmlUrl: r.html_url,
+    })),
+  commits: (token, fullName, n) =>
+    ghListCommits(token, fullName, n).then((cs) =>
+      cs.map((c) => ({ sha: c.sha, subject: c.message, date: c.date })),
+    ),
+  tree: (token, fullName, ref) => (ref ? ghGetTree(token, fullName, ref) : Promise.resolve([])),
+};
+
+const glService: Service = {
+  id: "gitlab",
+  label: "GitLab",
+  host: "gitlab.com",
+  tokenUrl: "https://gitlab.com/-/user_settings/personal_access_tokens",
+  tokenPlaceholder: "glpat-…",
+  scopesHint: "api",
+  verify: (token) => glGetUser(token),
+  listRepos: (token, org) => glListRepos(token, { org }),
+  createRepo: (token, name, opts) => glCreateRepo(token, name, opts),
+  meta: (token, fullName) => glGetRepo(token, fullName),
+  commits: (token, fullName, n) => glListCommits(token, fullName, n),
+  tree: (token, fullName, ref) => (ref ? glGetTree(token, fullName, ref) : Promise.resolve([])),
+};
+
+export const SERVICES: Record<Platform, Service> = { github: ghService, gitlab: glService };

package/git-gate.ts

@@ -0,0 +1,44 @@
+/**
+ * Deterministic forge auth for git commands (GitHub / GitLab).
+ *
+ * When pi's bash tool is about to run a git command and a token is
+ * stored for a host, we rewrite the command so git uses the stored token
+ * for that host, regardless of git's own credential configuration:
+ *
+ *   export GIT_TERMINAL_PROMPT=0 \
+ *     GIT_CONFIG_COUNT=1 \
+ *     GIT_CONFIG_KEY_0="url.https://x-access-token:<token>@<host>/.insteadOf" \
+ *     GIT_CONFIG_VALUE_0="https://<host>/" && <command>
+ *
+ * Forging hosts' git-over-HTTPS endpoints ignore Authorization headers
+ * and only accept URL-embedded (Basic) credentials, hence the insteadOf
+ * rewrite.
+ *
+ * Guarantees:
+ *  - Scoped to the given host's URLs; other remotes are untouched.
+ *  - GIT_TERMINAL_PROMPT=0: a failed auth surfaces as a clean error
+ *    instead of an interactive prompt hanging the TUI.
+ *  - Deterministic: no credential-helper races, same behavior every run.
+ *  - SSH-style URLs for the host are rewritten to HTTPS so the token applies.
+ */
+
+export function looksLikeGit(command: string): boolean {
+  // git at the start of a simple command, or after a shell separator, with
+  // any number of leading VAR=value assignments allowed before it.
+  return /(^|[\n;&|]\s*)(?:[A-Za-z_][A-Za-z_0-9]*=\S*\s+)*git(\s|$)/.test(command);
+}
+
+export function instrumentGit(command: string, host: string, token: string): string {
+  if (!looksLikeGit(command)) return command;
+  if (command.includes("GIT_CONFIG_COUNT=")) return command; // already instrumented
+
+  const rewritten = command
+    .replace(new RegExp(`ssh://git@${host}/`, "g"), `https://${host}/`)
+    .replace(new RegExp(`git@${host}:`, "g"), `https://${host}/`);
+  const prefix =
+    `export GIT_TERMINAL_PROMPT=0 ` +
+    `GIT_CONFIG_COUNT=1 ` +
+    `GIT_CONFIG_KEY_0="url.https://x-access-token:${token}@${host}/.insteadOf" ` +
+    `GIT_CONFIG_VALUE_0="https://${host}/" && `;
+  return prefix + rewritten;
+}

package/github.ts

@@ -0,0 +1,189 @@
+/**
+ * Minimal GitHub API client (REST, no dependencies).
+ * Covers exactly what pi-git-auth needs: token verification, repo CRUD.
+ */
+
+const API_BASE = "https://api.github.com";
+
+export interface RepoInfo {
+  full_name: string;
+  private: boolean;
+  description?: string | null;
+  html_url: string;
+}
+
+export interface UserInfo {
+  login: string;
+  /** Best-effort scopes (classic OAuth/PAT tokens only). */
+  scopes?: string;
+}
+
+interface ApiResult {
+  status: number;
+  data: any;
+  headers: Headers;
+}
+
+async function apiFetch(path: string, token: string, init: RequestInit = {}, signal?: AbortSignal): Promise<ApiResult> {
+  const res = await fetch(`${API_BASE}${path}`, {
+    ...init,
+    signal,
+    headers: {
+      accept: "application/vnd.github+json",
+      "x-github-api-version": "2022-11-28",
+      authorization: `bearer ${token}`,
+      ...(init.body ? { "content-type": "application/json" } : {}),
+    },
+  });
+  let data: any = null;
+  if (res.status !== 204) {
+    try {
+      data = await res.json();
+    } catch {
+      data = null;
+    }
+  }
+  return { status: res.status, data, headers: res.headers };
+}
+
+/** Verify a token by resolving the login user. Throws on 401/403. */
+export async function getUser(token: string, signal?: AbortSignal): Promise<UserInfo> {
+  const { status, data, headers } = await apiFetch("/user", token, {}, signal);
+  if (status === 401) throw new Error("Token invalid or revoked (HTTP 401)");
+  if (status === 403) throw new Error(`Token lacks permissions (HTTP 403)${data?.message ? `: ${data.message}` : ""}`);
+  if (status === 404 || !data) throw new Error(`Unexpected response (HTTP ${status})`);
+  return {
+    login: data.login,
+    scopes: headers.get("x-oauth-scopes") ?? undefined,
+  };
+}
+
+export async function listRepos(
+  token: string,
+  opts: { org?: string; perPage?: number; signal?: AbortSignal },
+): Promise<RepoInfo[]> {
+  const perPage = opts.perPage ?? 100;
+  const path = opts.org
+    ? `/orgs/${encodeURIComponent(opts.org)}/repos?per_page=${perPage}&type=owner`
+    : `/user/repos?affiliation=owner&per_page=${perPage}`;
+  const { status, data } = await apiFetch(path, token, {}, opts.signal);
+  if (status === 401) throw new Error("Token invalid (HTTP 401)");
+  if (status === 403) throw new Error("Insufficient scopes to list repos (needs `repo`)");
+  if (status >= 400 || !Array.isArray(data)) throw new Error(`List repos failed (HTTP ${status})`);
+  return data.map((r: any) => ({
+    full_name: r.full_name,
+    private: !!r.private,
+    description: r.description ?? undefined,
+    html_url: r.html_url,
+  }));
+}
+
+export interface RepoDetail {
+  full_name: string;
+  private: boolean;
+  description?: string;
+  default_branch: string;
+  /** Size in KB (GitHub's `size` field). */
+  size: number;
+  stargazers_count: number;
+  forks_count: number;
+  pushed_at: string;
+  html_url: string;
+}
+
+export interface CommitInfo {
+  sha: string;
+  /** First line of the commit message. */
+  message: string;
+  author: string;
+  /** ISO date. */
+  date: string;
+}
+
+export interface TreeEntry {
+  path: string;
+  type: "blob" | "tree";
+}
+
+/** Full repo metadata for the details view. */
+export async function getRepo(token: string, fullName: string, signal?: AbortSignal): Promise<RepoDetail> {
+  const { status, data } = await apiFetch(`/repos/${fullName}`, token, {}, signal);
+  if (status === 401) throw new Error("Token invalid (HTTP 401)");
+  if (status === 404) throw new Error(`Repository ${fullName} not found (HTTP 404)`);
+  if (status >= 400 || !data) throw new Error(`Get repo failed (HTTP ${status})`);
+  return {
+    full_name: data.full_name,
+    private: !!data.private,
+    description: data.description ?? undefined,
+    default_branch: data.default_branch,
+    size: data.size ?? 0,
+    stargazers_count: data.stargazers_count ?? 0,
+    forks_count: data.forks_count ?? 0,
+    pushed_at: data.pushed_at ?? "",
+    html_url: data.html_url,
+  };
+}
+
+/** Latest commits, newest first. */
+export async function listCommits(
+  token: string,
+  fullName: string,
+  perPage = 5,
+  signal?: AbortSignal,
+): Promise<CommitInfo[]> {
+  const { status, data } = await apiFetch(`/repos/${fullName}/commits?per_page=${perPage}`, token, {}, signal);
+  if (status === 401) throw new Error("Token invalid (HTTP 401)");
+  if (status === 404) throw new Error(`Repository ${fullName} not found (HTTP 404)`);
+  if (status >= 400 || !Array.isArray(data)) throw new Error(`List commits failed (HTTP ${status})`);
+  return data.map((c: any) => ({
+    sha: c.sha,
+    message: String(c.commit?.message ?? "").split("\n")[0],
+    author: c.author?.login ?? c.commit?.author?.name ?? "unknown",
+    date: c.commit?.author?.date ?? c.commit?.committer?.date ?? "",
+  }));
+}
+
+/** Flat recursive tree (all paths). Returns [] on 404/409 (missing ref). */
+export async function getTree(
+  token: string,
+  fullName: string,
+  ref: string,
+  signal?: AbortSignal,
+): Promise<TreeEntry[]> {
+  const { status, data } = await apiFetch(
+    `/repos/${fullName}/git/trees/${encodeURIComponent(ref)}?recursive=1`,
+    token,
+    {},
+    signal,
+  );
+  if (status === 404 || status === 409) return [];
+  if (status >= 400 || !data) throw new Error(`Get tree failed (HTTP ${status})`);
+  return (data.tree ?? []).map((t: any) => ({
+    path: String(t.path),
+    type: t.type === "tree" ? "tree" as const : ("blob" as const),
+  }));
+}
+
+export async function createRepo(
+  token: string,
+  opts: { name: string; org?: string; private?: boolean; description?: string; signal?: AbortSignal },
+): Promise<RepoInfo> {
+  const path = opts.org ? `/orgs/${encodeURIComponent(opts.org)}/repos` : "/user/repos";
+  const body = JSON.stringify({
+    name: opts.name,
+    description: opts.description ?? null,
+    private: !!opts.private,
+    has_issues: true,
+  });
+  const { status, data } = await apiFetch(path, token, { method: "POST", body }, opts.signal);
+  if (status === 409) throw new Error(`Repository ${opts.name} already exists`);
+  if (status >= 400) throw new Error(`Create repo failed (HTTP ${status}): ${data?.message ?? ""}`);
+  return {
+    full_name: data.full_name,
+    private: !!data.private,
+    description: data.description,
+    html_url: data.html_url,
+  };
+}
+
+