pi-lens 4.2.0 → 4.3.0

package/dist/clients/zizmor-config.js

@@ -157,10 +157,12 @@ function classifyGhTokenFailure(res, hostStallMs) {
         classifiedBy: "caller",
     };
 }
-async function deriveGhCliToken() {
+async function deriveGhCliToken(consumer) {
     const sampler = startHostStallSampler();
     const startedAt = Date.now();
-    // Best-effort: a missing/unauthenticated `gh` just leaves zizmor offline.
+    // Best-effort: a missing/unauthenticated `gh` leaves the requesting
+    // consumer without a derived token; only the zizmor wrapper turns that into
+    // an offline-mode degradation.
     // ignoreAmbientSignal so a mid-turn Esc can't silently drop the server into
     // offline mode; short timeout so a wedged `gh` never stalls the warm spawn.
     // safeSpawnAsync never rejects (every failure resolves into `res`), so no
@@ -176,7 +178,7 @@ async function deriveGhCliToken() {
         if (token.length > 0) {
             ghTokenLatch.noteAvailable();
             logAvailabilityDecision({
-                tool: "zizmor-gh-token",
+                tool: consumer === "zizmor" ? "zizmor-gh-token" : "github-token",
                 verdict: "available",
                 outcome: "success",
                 cause: "ok",
@@ -195,13 +197,13 @@ async function deriveGhCliToken() {
         // regardless of whether `token` was empty, so the record claimed the
         // online audits ran while zizmor was actually about to launch offline
         // — the #1535 silence moved into the telemetry instead of being fixed.
-        return recordGhTokenUnavailable({
+        return recordGhTokenUnavailable(consumer, {
             outcome: "non-installable",
             cause: "empty-result",
             classifiedBy: "caller",
         }, elapsedMs, hostStallMs);
     }
-    return recordGhTokenUnavailable(classifyGhTokenFailure(res, hostStallMs), elapsedMs, hostStallMs);
+    return recordGhTokenUnavailable(consumer, classifyGhTokenFailure(res, hostStallMs), elapsedMs, hostStallMs);
 }
 /**
  * Shared tail for every "no token" verdict: latches (or cools down) the
@@ -209,13 +211,13 @@ async function deriveGhCliToken() {
  * and logs the decision. Centralized so the empty-answer and failure paths
  * can't drift on which fields get set.
  */
-function recordGhTokenUnavailable({ outcome, cause, classifiedBy }, elapsedMs, hostStallMs) {
+function recordGhTokenUnavailable(consumer, { outcome, cause, classifiedBy }, elapsedMs, hostStallMs) {
     const retryAfterMs = ghTokenLatch.noteUnavailable(outcome, cause);
-    if (outcome === "transient") {
+    if (consumer === "zizmor" && outcome === "transient") {
         recordZizmorOfflineDegradation(`gh auth token probe ${cause}; running offline until the next zizmor start (retry allowed in ${Math.round(retryAfterMs / 1000)}s)`);
     }
     logAvailabilityDecision({
-        tool: "zizmor-gh-token",
+        tool: consumer === "zizmor" ? "zizmor-gh-token" : "github-token",
         verdict: "unavailable",
         outcome,
         cause,
@@ -278,14 +280,25 @@ export async function resolveZizmorGitHubToken() {
     // Respect an explicit offline request — never derive a token then.
     if (process.env.ZIZMOR_OFFLINE)
         return undefined;
-    const fromEnv = process.env.ZIZMOR_GITHUB_TOKEN ||
-        process.env.GH_TOKEN ||
-        process.env.GITHUB_TOKEN;
+    return resolveGitHubToken(["ZIZMOR_GITHUB_TOKEN", "GH_TOKEN", "GITHUB_TOKEN"], { consumer: "zizmor" });
+}
+/**
+ * Resolve a GitHub token for an API client. Explicit environment variables are
+ * checked in the caller's order; when none is present, reuse the bounded,
+ * session-reset `gh auth token` resolver above rather than spawning once per
+ * request. The returned token is ephemeral and callers must not persist or
+ * send it to non-API hosts.
+ */
+export async function resolveGitHubToken(envKeys = ["GITHUB_TOKEN", "GH_TOKEN"], options = {}) {
+    const consumer = options.consumer ?? "github-api";
+    const fromEnv = envKeys.map((key) => process.env[key]).find(Boolean);
     if (fromEnv)
         return fromEnv;
     const memo = ghTokenLatch.read();
     if (memo !== null) {
-        if (memo === false && ghTokenLatch.getOutcome() === "transient") {
+        if (consumer === "zizmor" &&
+            memo === false &&
+            ghTokenLatch.getOutcome() === "transient") {
             // Served straight from the still-cooling latch: no new probe runs,
             // so `deriveGhCliToken`'s own logging never fires. Without this, once
             // the cooldown ladder crosses zizmor's own respawn cadence (bounded
@@ -322,6 +335,6 @@ export async function resolveZizmorGitHubToken() {
         }
         return memo ? cachedToken : undefined;
     }
-    cachedToken = await deriveGhCliToken();
+    cachedToken = await deriveGhCliToken(consumer);
     return cachedToken;
 }