Tom Rochette
33e614c76b
Adds `gh` CLI as a GitHub credential fallback for users who already have `gh auth login` configured locally. OpenChamber-owned OAuth credentials remain the primary source of truth; the `gh` token is only used when no stored OpenChamber GitHub access token exists and the fallback is not disabled. The fallback is implemented as a credential provider only: GitHub features continue to use the existing Octokit/GitHub API paths for issues, pull requests, checks, merges, and related operations. The PR does not replace those endpoints with `gh issue` or `gh pr` CLI commands. Server changes: - Add `gh-cli-credential.js` to read `gh auth token` with a bounded timeout. - Cache the `gh` token lookup for 30 seconds, including negative results, to avoid repeated subprocess spawning on status/polling paths. - Hide the subprocess window on Windows via `windowsHide: true`. - Clear the gh CLI token cache when the fallback setting changes. - Update `getOctokitOrNull()` to prefer stored OpenChamber OAuth tokens and fall back to the `gh` token only when enabled. - Add `ghCliDisabled` persistence in the existing settings file with atomic writes and `0o600` file permissions. - Add `POST /api/github/auth/gh-cli` to enable or disable the fallback. - Extend `/api/github/auth/status` with `ghCli` metadata: availability, disabled state, active state, and active user when applicable. UI/runtime changes: - Extend `GitHubAuthStatus` and `GitHubAPI` with gh CLI fallback metadata and toggle support. - Add web RuntimeAPI support for toggling the gh CLI fallback through `runtimeFetch`, preserving active runtime/remote target behavior. - Add deterministic VS Code unsupported handling for the gh CLI toggle. - Update GitHub Settings to show gh CLI availability and active status. - When gh CLI is the active auth source, show it in the connected account card and offer Disable instead of Disconnect. - Keep Add Account available so users can still connect an OpenChamber OAuth account, which then takes priority over gh CLI. - Add localized gh CLI settings strings across supported settings locales. Fixes addressed during review: - Removed unreachable UI branches in the inactive gh CLI card. - Avoided duplicate and repeated `gh auth token` subprocess calls. - Hardened settings file permissions for the new persisted flag. - Routed the gh CLI toggle through the RuntimeAPI/runtimeFetch path instead of direct browser `fetch`. - Added targeted tests for hidden subprocess options and negative-result cache behavior. - Fixed a VS Code webview Response body typing issue that blocked type-check.
39 lines
800 B
JavaScript
39 lines
800 B
JavaScript
import { execFileSync } from 'child_process';
|
|
|
|
const CACHE_TTL_MS = 30_000;
|
|
let cachedToken = null;
|
|
let cachedAt = 0;
|
|
let hasCachedToken = false;
|
|
|
|
function fetchGhCliToken() {
|
|
try {
|
|
const token = execFileSync('gh', ['auth', 'token'], {
|
|
encoding: 'utf8',
|
|
stdio: ['pipe', 'pipe', 'pipe'],
|
|
timeout: 5000,
|
|
windowsHide: true,
|
|
}).trim();
|
|
return token || null;
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
export function getGhCliToken() {
|
|
const now = Date.now();
|
|
if (hasCachedToken && now - cachedAt < CACHE_TTL_MS) {
|
|
return cachedToken;
|
|
}
|
|
const token = fetchGhCliToken();
|
|
cachedToken = token;
|
|
cachedAt = now;
|
|
hasCachedToken = true;
|
|
return token;
|
|
}
|
|
|
|
export function clearGhCliTokenCache() {
|
|
cachedToken = null;
|
|
cachedAt = 0;
|
|
hasCachedToken = false;
|
|
}
|