securewithtrace 0.2.0 → 0.3.1

package/dist/index.js

@@ -3564,6 +3564,11 @@ function createAuthCommand() {
   return auth;
 }
 
+// src/repo/commands.ts
+import { chmodSync, mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { tmpdir } from "os";
+import { join as join2 } from "path";
+
 // ../../node_modules/.bun/@ts-rest+core@3.53.0-rc.1+f9199aabcde8d6a0/node_modules/@ts-rest/core/index.esm.mjs
 var util;
 (function(util2) {
@@ -22596,6 +22601,13 @@ var RepositoryResponseSchema = external_exports.object({
   updatedAt: external_exports.date()
 });
 var ListRepositoriesResponseSchema = external_exports.array(RepositoryResponseSchema);
+var CloneTokenRequestSchema = external_exports.object({
+  repositoryUrl: external_exports.string().url()
+});
+var CloneTokenResponseSchema = external_exports.object({
+  token: external_exports.string(),
+  expiresAt: external_exports.string().datetime()
+});
 
 // ../../packages/api-contracts/src/contracts/v1/repository.ts
 var c9 = initContract();
@@ -22661,6 +22673,19 @@ var repositoryContract = c9.router({
       404: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
+  },
+  getCloneToken: {
+    method: "POST",
+    path: "/organizations/:organizationId/repositories/clone-token",
+    pathParams: OrgIdParamsSchema,
+    body: CloneTokenRequestSchema,
+    responses: {
+      200: CloneTokenResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
   }
 });
 
@@ -23738,6 +23763,7 @@ var FindingSchema = external_exports.object({
 });
 
 // src/api-client.ts
+var readTokenSafe = readToken;
 var PRODUCTION_API_URL = "https://api.securewithtrace.com";
 function getApiBaseUrl() {
   const raw = process.env["TRACE_API_URL"];
@@ -23799,6 +23825,25 @@ async function resolveOrganizationId(client) {
   }
   return id;
 }
+async function resolveOrganizationIdSafe(client) {
+  try {
+    const result = await client.organization.listOrganizations();
+    if (result.status !== 200) {
+      return null;
+    }
+    const org = result.body[0];
+    if (!org) {
+      return null;
+    }
+    const id = org.organizationId;
+    if (!SAFE_ID_PATTERN.test(id)) {
+      return null;
+    }
+    return id;
+  } catch {
+    return null;
+  }
+}
 
 // src/repo/commands.ts
 function stripAnsi(str) {
@@ -23879,11 +23924,57 @@ function createListCommand() {
     }
   });
 }
+function urlWithUsername(httpsUrl) {
+  const url2 = new URL(httpsUrl);
+  url2.username = "x-access-token";
+  url2.password = "";
+  return url2.toString();
+}
+function createAskPassScript(token) {
+  const dir = mkdtempSync(join2(tmpdir(), "trace-askpass-"));
+  const scriptPath = join2(dir, "askpass.sh");
+  writeFileSync2(scriptPath, `#!/bin/sh
+echo '${token.replace(/'/g, "'\\''")}'
+`, {
+    mode: 448
+  });
+  chmodSync(scriptPath, 448);
+  return scriptPath;
+}
+async function fetchCloneToken(repoUrl) {
+  const token = readTokenSafe();
+  if (!token) {
+    return null;
+  }
+  try {
+    const client = createClient(token);
+    const organizationId = await resolveOrganizationIdSafe(client);
+    if (!organizationId) {
+      return null;
+    }
+    const result = await client.repository.getCloneToken({
+      params: { organizationId },
+      body: { repositoryUrl: repoUrl }
+    });
+    if (result.status === 200) {
+      return result.body.token;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
 function createCloneCommand() {
   return new Command("clone").description("Clone a repository").argument("<repository>", "Repository URL or owner/repo shorthand").argument("[directory]", "Directory to clone into").option("--branch <branch>", "Branch to clone").option("--depth <depth>", "Shallow clone depth", Number.parseInt).action(
     async (repository, directory, options) => {
       const cloneUrl = resolveRepoUrl(repository);
       const targetDir = directory ?? extractRepoName(repository);
+      let installationToken = null;
+      if (cloneUrl.startsWith("https://github.com/")) {
+        installationToken = await fetchCloneToken(cloneUrl);
+      }
+      const effectiveUrl = installationToken ? urlWithUsername(cloneUrl) : cloneUrl;
+      let askPassScript;
       const args = ["clone"];
       if (options.branch) {
         validateBranchName(options.branch);
@@ -23892,17 +23983,43 @@ function createCloneCommand() {
       if (options.depth !== void 0) {
         args.push("--depth", String(options.depth));
       }
-      args.push("--", cloneUrl, targetDir);
+      args.push("--", effectiveUrl, targetDir);
       console.log(`Cloning ${cloneUrl} into ${targetDir}...`);
-      const proc = Bun.spawn(["git", ...args], {
-        stdout: "inherit",
-        stderr: "inherit"
-      });
-      const exitCode = await proc.exited;
-      if (exitCode !== 0) {
-        process.exit(exitCode);
+      const extraEnv = {};
+      if (installationToken) {
+        askPassScript = createAskPassScript(installationToken);
+        extraEnv["GIT_ASKPASS"] = askPassScript;
+        extraEnv["GIT_TERMINAL_PROMPT"] = "0";
+      }
+      try {
+        const proc = Bun.spawn(["git", ...args], {
+          stdout: "inherit",
+          stderr: "inherit",
+          env: { ...process.env, ...extraEnv }
+        });
+        const exitCode = await proc.exited;
+        if (exitCode !== 0) {
+          process.exit(exitCode);
+        }
+        if (installationToken) {
+          const resetProc = Bun.spawn(["git", "remote", "set-url", "origin", cloneUrl], {
+            cwd: targetDir,
+            stdout: "pipe",
+            stderr: "pipe"
+          });
+          const resetExitCode = await resetProc.exited;
+          if (resetExitCode !== 0) {
+            console.error(
+              "Warning: failed to reset remote URL \u2014 the token username may persist in .git/config"
+            );
+          }
+        }
+        console.log(`Repository cloned into ${targetDir}`);
+      } finally {
+        if (askPassScript) {
+          rmSync2(askPassScript.replace(/\/[^/]+$/, ""), { recursive: true, force: true });
+        }
       }
-      console.log(`Repository cloned into ${targetDir}`);
     }
   );
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Trace CLI",
   "type": "module",
   "bin": {