yatfa 1.0.94 → 1.0.95

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yatfa",
-  "version": "1.0.94",
+  "version": "1.0.95",
   "description": "YATFA - Yet Another Tool For Agents",
   "bin": "./bin/run-yatfa-agent.rb",
   "files": [

package/setup/git_credential_helper.rb

@@ -0,0 +1,250 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Repo-aware GitHub App token credential helper for YATFA agent containers.
+#
+# Installed as /usr/local/bin/git-auth-helper and wired into git via:
+#   git config --global credential.helper  '!/usr/local/bin/git-auth-helper'
+#   git config --global credential.useHttpPath true
+#
+# Two invocation modes:
+#
+# 1. git credential helper — git invokes this as `git-auth-helper <action>`
+#    (action = get|store|erase) and feeds the credential description on stdin.
+#    With useHttpPath=true, that description includes `path=owner/repo[.git]`,
+#    which lets us mint a token scoped to THAT repository's GitHub App
+#    installation. This is required for projects spanning multiple installations
+#    (e.g. repos across different orgs): a single installation token cannot
+#    clone cross-org repos. On `get`, the full credential response
+#    (protocol/host/username/password) is printed to stdout.
+#
+# 2. token-only mode — invoked with no recognized action (e.g. by the `gh`
+#    wrapper as `$(git-auth-helper)`). Prints just the default project token.
+#
+# Tokens are cached per installation (a repo->installation index plus one cache
+# file per installation_id), so sibling repos under the same installation share
+# a single minted token and only hit the backend once per expiry window.
+#
+# This file is BOTH the standalone in-container script (run via its shebang, the
+# `if __FILE__ == $PROGRAM_NAME` guard fires) AND a require-able module for the
+# test suite (the guard does not fire when required, exposing the unit-testable
+# class methods).
+
+require "json"
+require "net/http"
+require "uri"
+require "time"
+require "fileutils"
+
+module YatfaAgent
+  module GitCredentialHelper
+    DEFAULT_CACHE_DIR = "/tmp/github-token-cache"
+    DEFAULT_HOST = "github.com"
+    DEFAULT_USERNAME = "x-access-token"
+    DEFAULT_KEY = "__default__"
+    BUFFER_SECONDS = 300 # refresh 5 minutes before the token expires
+    CREDENTIAL_ACTIONS = %w[get store erase].freeze
+
+    module_function
+
+    # Reduce a git credential `path` attribute to a normalized "owner/repo"
+    # full name, or nil when it can't be reduced to exactly owner/repo.
+    #
+    #   "RoM4iK/yatfa.git" -> "RoM4iK/yatfa"
+    #   "/yatfa-ai/router"  -> "yatfa-ai/router"
+    #   nil / "" / "info/refs" -> nil
+    def normalize_path(path)
+      return nil if path.nil?
+
+      p = path.to_s.strip
+      return nil if p.empty?
+
+      p = p.sub(/\/+\z/, "")    # trailing slashes
+      p = p.sub(/\A\/+/, "")    # leading slashes
+      p = p.sub(/\.git\z/i, "") # trailing .git
+      p = p.sub(/\A\/+/, "")    # leading slashes again (after .git strip)
+      return nil if p.empty?
+
+      owner, repo = p.split("/", 2)
+      return nil if owner.to_s.empty? || repo.to_s.empty?
+      # Reject multi-segment paths (e.g. "org/repo/extra") — not a repo root.
+      return nil if repo.include?("/")
+
+      "#{owner}/#{repo}"
+    end
+
+    # Parse git's newline-delimited `key=value` credential input into a Hash.
+    def parse_input(input)
+      attrs = {}
+      input.to_s.each_line do |line|
+        line = line.strip
+        next if line.empty?
+        key, value = line.split("=", 2)
+        attrs[key] = value if key && !key.empty?
+      end
+      attrs
+    end
+
+    # Build the backend token URL, appending `?repo=<full_name>` when scoped.
+    def build_token_url(api_url, repo)
+      base = api_url.to_s.chomp("/")
+      url = "#{base}/github/token"
+      return url if repo.nil? || repo.empty?
+      "#{url}?repo=#{URI.encode_www_form_component(repo)}"
+    end
+
+    # Default backend fetcher. Returns the parsed response Hash on HTTP 200,
+    # nil on any failure (non-2xx, network error, bad JSON). Never raises.
+    def fetch_token_data(api_url, api_key, repo)
+      uri = URI(build_token_url(api_url, repo))
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = (uri.scheme == "https")
+      http.open_timeout = 5
+      http.read_timeout = 10
+      request = Net::HTTP::Get.new(uri)
+      request["X-API-Key"] = api_key.to_s
+      request["Accept"] = "application/json"
+      response = http.request(request)
+      return nil unless response.is_a?(Net::HTTPSuccess)
+      parsed = JSON.parse(response.body)
+      parsed.is_a?(Hash) ? parsed : nil
+    rescue StandardError
+      nil
+    end
+
+    # Resolve a usable token for `repo` (or the default project token when nil),
+    # using the per-installation cache and falling back to the default token
+    # when a repo-scoped fetch fails (older backend, unregistered repo, etc.).
+    def resolve_token(repo, cache_dir:, env:, http_fetch:)
+      api_url = env["YATFA_API_URL"]
+      api_key = env["YATFA_API_KEY"]
+      return nil if api_url.nil? || api_url.to_s.empty?
+      return nil if api_key.nil? || api_key.to_s.empty?
+
+      cached = read_cached_token(repo, cache_dir)
+      return cached if cached
+
+      data = http_fetch.call(api_url, api_key, repo)
+      # Fallback: repo-scoped fetch failed -> try the default token path.
+      data = http_fetch.call(api_url, api_key, nil) if data.nil? && !repo.nil?
+      return nil if data.nil? || data["token"].nil? || data["token"].to_s.empty?
+
+      expires_at = parse_expires_at(data["expires_at"])
+      write_cached_token(repo, data["installation_id"], data["token"], expires_at, cache_dir)
+      data["token"]
+    end
+
+    # Dispatch entry point. Returns a process exit code (0 success, 1 failure).
+    def run(argv, stdin: $stdin, stdout: $stdout, stderr: $stderr,
+            cache_dir: DEFAULT_CACHE_DIR, env: nil, http_fetch: nil)
+      env_hash = env || ENV.to_h
+      fetch = http_fetch || method(:fetch_token_data)
+      action = argv.first.to_s
+
+      if CREDENTIAL_ACTIONS.include?(action)
+        if action == "get"
+          attrs = parse_input(read_stdin(stdin))
+          repo = normalize_path(attrs["path"])
+          token = resolve_token(repo, cache_dir: cache_dir, env: env_hash, http_fetch: fetch)
+          if token.nil?
+            stderr.puts("git-auth-helper: failed to obtain GitHub token" + (repo ? " for #{repo}" : ""))
+            return 1
+          end
+          stdout.puts("protocol=https")
+          stdout.puts("host=#{DEFAULT_HOST}")
+          stdout.puts("username=#{DEFAULT_USERNAME}")
+          stdout.puts("password=#{token}")
+        end
+        # store/erase: no-op — we manage our own cache, not git's credential store.
+        return 0
+      end
+
+      # Token-only mode (e.g. the `gh` wrapper): print just the default token.
+      token = resolve_token(nil, cache_dir: cache_dir, env: env_hash, http_fetch: fetch)
+      if token.nil?
+        stderr.puts("git-auth-helper: failed to obtain GitHub token")
+        return 1
+      end
+      stdout.puts(token)
+      0
+    end
+
+    # -----------------------------------------------------------------
+    # Per-installation cache (repo -> installation_id index + one file per id)
+    # -----------------------------------------------------------------
+
+    def index_path(cache_dir)
+      File.join(cache_dir, "index.json")
+    end
+
+    def read_index(cache_dir)
+      return {} unless File.exist?(index_path(cache_dir))
+      parsed = JSON.parse(File.read(index_path(cache_dir)))
+      parsed.is_a?(Hash) ? parsed : {}
+    rescue StandardError
+      {}
+    end
+
+    def write_index(cache_dir, map)
+      FileUtils.mkdir_p(cache_dir)
+      File.write(index_path(cache_dir), map.to_json)
+    rescue StandardError
+      nil
+    end
+
+    def installation_cache_path(cache_dir, installation_id)
+      return nil if installation_id.nil?
+      id = installation_id.to_s.gsub(/[^0-9a-zA-Z_-]/, "")
+      File.join(cache_dir, "inst-#{id}.json")
+    end
+
+    # Look up a non-expired cached token for `repo` (or the default token).
+    def read_cached_token(repo, cache_dir)
+      map = read_index(cache_dir)
+      inst_id = repo ? map[repo] : map[DEFAULT_KEY]
+      return nil if inst_id.nil?
+
+      path = installation_cache_path(cache_dir, inst_id)
+      return nil unless path && File.exist?(path)
+      data = JSON.parse(File.read(path))
+      return nil unless data.is_a?(Hash) && data["token"] && data["expires_at"]
+      return data["token"] if Time.parse(data["expires_at"]) > Time.now + BUFFER_SECONDS
+      nil
+    rescue StandardError
+      nil
+    end
+
+    # Persist a token keyed by installation_id, and record the repo->id mapping.
+    def write_cached_token(repo, installation_id, token, expires_at, cache_dir)
+      path = installation_cache_path(cache_dir, installation_id)
+      if path
+        FileUtils.mkdir_p(cache_dir)
+        File.write(path, { "token" => token, "expires_at" => expires_at.iso8601 }.to_json)
+      end
+      if installation_id
+        map = read_index(cache_dir)
+        map[repo || DEFAULT_KEY] = installation_id
+        write_index(cache_dir, map)
+      end
+    rescue StandardError
+      nil
+    end
+
+    def parse_expires_at(value)
+      return Time.now + 3600 - BUFFER_SECONDS if value.nil? || value.to_s.empty?
+      Time.parse(value.to_s)
+    rescue StandardError
+      Time.now + 3600 - BUFFER_SECONDS
+    end
+
+    def read_stdin(stdin)
+      stdin.read
+    rescue StandardError
+      ""
+    end
+  end
+end
+
+if __FILE__ == $PROGRAM_NAME
+  exit(YatfaAgent::GitCredentialHelper.run(ARGV))
+end

package/setup/repositories.rb

@@ -54,16 +54,27 @@ def clone_repositories!
         end
       else
         puts "   ✓ #{repo_name} already exists at #{sandbox_path}"
-        # Fetch all remotes to ensure branches are up to date
+        # Fetch all remotes to ensure branches are up to date.
+        # The repo ALREADY EXISTS, so a fetch failure (transient network blip,
+        # DNS hiccup, expired creds) is NOT fatal — the agent can still work on
+        # previously-fetched code. Surface the failure honestly with a warning
+        # rather than a false "✓" (and do NOT exit, which would restart-loop).
         Dir.chdir(sandbox_path) do
-          system("git", "fetch", "--all")
-          puts "   ✓ Fetched all remotes for #{repo_name}"
+          fetch_success = system("git", "fetch", "--all")
+          if fetch_success
+            puts "   ✓ Fetched all remotes for #{repo_name}"
+          else
+            puts "   ⚠️  git fetch for #{repo_name} failed — checkout may be stale; continuing on previously-fetched state"
+          end
         end
       end
 
-      # Add repository path to git safe.directory to avoid "dubious ownership" errors
-      system("git", "config", "--global", "--add", "safe.directory", sandbox_path)
-      puts "   ✓ Added #{sandbox_path} to git safe.directory"
+      # Add repository path to git safe.directory to avoid "dubious ownership" errors.
+      # Surface a config failure honestly rather than a false "✓" (non-fatal — the
+      # repo still works, the user may just see a "dubious ownership" warning later).
+      config_success = system("git", "config", "--global", "--add", "safe.directory", sandbox_path)
+      puts config_success ? "   ✓ Added #{sandbox_path} to git safe.directory" :
+                            "   ⚠️  Failed to add #{sandbox_path} to git safe.directory (may see 'dubious ownership' errors)"
     end
 
     puts "✅ Repositories cloned"

package/setup/setup-github.rb

@@ -29,98 +29,20 @@ def setup_github_auth!
   if rails_api_url && !rails_api_url.empty? && rails_api_key && !rails_api_key.empty?
     puts "🔐 Configuring GitHub App authentication (via backend)..."
 
-    # Create helper script that calls backend API
-    helper_content = <<~RUBY
-      #!/usr/bin/env ruby
-      require 'json'
-      require 'net/http'
-      require 'uri'
-      require 'time'
-
-      def get_token_from_backend
-        rails_api_url = ENV['YATFA_API_URL']
-        rails_api_key = ENV['YATFA_API_KEY']
-
-        unless rails_api_url && rails_api_key
-          STDERR.puts "❌ Error: YATFA_API_URL or YATFA_API_KEY not set"
-          exit 1
-        end
-
-        # Build GitHub token endpoint URL
-        token_url = "\#{rails_api_url.chomp('/')}/github/token"
-
-        uri = URI(token_url)
-        http = Net::HTTP.new(uri.host, uri.port)
-        http.use_ssl = uri.scheme == 'https'
-        http.open_timeout = 5
-        http.read_timeout = 10
-
-        request = Net::HTTP::Get.new(uri)
-        request['X-API-Key'] = rails_api_key
-        request['Accept'] = 'application/json'
-
-        response = http.request(request)
-
-        unless response.is_a?(Net::HTTPSuccess)
-          STDERR.puts "❌ Error: Backend API returned \#{response.code} for GitHub token"
-          exit 1
-        end
-
-        data = JSON.parse(response.body)
-        token = data['token']
-
-        unless token
-          STDERR.puts "❌ Error: No token in backend response"
-          exit 1
-        end
-
-        data  # Return full response including expires_at
-      rescue Net::OpenTimeout, Net::ReadTimeout => e
-        STDERR.puts "❌ Error: Backend API timeout: \#{e.message}"
-        exit 1
-      rescue StandardError => e
-        STDERR.puts "❌ Error: \#{e.class} - \#{e.message}"
-        exit 1
-      end
-
-      def find_or_create_cached_token
-        cache_file = '/tmp/github-app-token-cache'
-        cached_token = read_cached_token(cache_file)
-        return cached_token if cached_token
-
-        token_data = get_token_from_backend
-        expires_at = token_data['expires_at'] ? Time.parse(token_data['expires_at']) : (Time.now + 3600 - 300)
-        token = token_data['token']
-
-        cache_data = {
-          token: token,
-          expires_at: expires_at.iso8601
-        }
-        File.write(cache_file, cache_data.to_json)
-        token
-      end
-
-      def read_cached_token(cache_file)
-        return nil unless File.exist?(cache_file)
-        cache = JSON.parse(File.read(cache_file))
-        return nil if cache['token'].nil? || cache['expires_at'].nil?
-        return cache['token'] if Time.parse(cache['expires_at']) > Time.now + 300
-        nil
-      rescue JSON::ParserError
-        nil
-      end
-
-      puts find_or_create_cached_token
-    RUBY
-
-    # Install helper via sudo to /usr/local/bin
+    # Install the repo-aware credential helper (setup/git_credential_helper.rb).
+    # It mints a token scoped to the requested repo's GitHub App installation,
+    # which is required for projects spanning multiple installations/orgs.
     helper_path = "/usr/local/bin/git-auth-helper"
-    File.write("/tmp/git-auth-helper", helper_content)
+    source_path = File.join(__dir__, "git_credential_helper.rb")
+    File.write("/tmp/git-auth-helper", File.read(source_path))
     system("sudo", "mv", "/tmp/git-auth-helper", helper_path)
     system("sudo", "chmod", "+x", helper_path)
 
-    # Configure git (array form avoids shell interpolation of helper path)
-    system("git", "config", "--global", "credential.helper", "!f() { test \"$1\" = get && echo \"protocol=https\" && echo \"host=github.com\" && echo \"username=x-access-token\" && p=$(#{helper_path}) && echo \"password=$p\"; }; f")
+    # Wire the helper into git. useHttpPath=true makes git send the repo path on
+    # stdin so the helper can request a repo-scoped token (?repo=owner/repo).
+    # Array form avoids shell interpolation of the helper path.
+    system("git", "config", "--global", "credential.helper", "!#{helper_path}")
+    system("git", "config", "--global", "credential.useHttpPath", "true")
 
     # Configure gh CLI wrapper for auto-refresh and permission controls
     if install_gh_wrapper!(real_gh_path: "/usr/bin/gh", with_token_refresh: true, token_helper_path: helper_path)
@@ -172,7 +94,9 @@ def install_gh_wrapper!(real_gh_path:, with_token_refresh: false, token_helper_p
 
   wrapper_path = "/usr/local/bin/gh"
 
-  # Build token export line if auto-refresh is enabled
+  # Build token export line if auto-refresh is enabled.
+  # Invoked with no args, git-auth-helper runs in token-only mode and prints the
+  # default project token (cached per installation).
   token_export = with_token_refresh ? "export GH_TOKEN=$(#{token_helper_path})\n\n" : ""
 
   wrapper_content = <<~BASH