Remove the personal access token (PAT) limitation

The new Stacks REST API is public, so any user authenticated with the
GitHub CLI (including via a PAT with repo scope) can perform stack
operations once the feature is enabled for their repository. Remove the
PAT detection and the private-preview gating:

- Delete Config.WarnIfPAT / IsPersonalAccessToken and the TokenForHostFn
  test hook (internal/config/auth.go is no longer needed).
- Drop the submit pre-flight that aborted on a PAT.
- Rename warnStacksUnavailableOrPAT to warnStacksUnavailable and simplify
  it to the "stacked PRs not enabled" message.

Copilot-Session: 03673c26-a245-42da-93ed-dfcebc92a740

Author: skarim

cmd/checkout.go

@@ -194,7 +194,7 @@ func checkoutRemoteStack(cfg *config.Config, sf *stack.StackFile, gitDir string,
 	if err != nil {
 		var httpErr *api.HTTPError
 		if errors.As(err, &httpErr) && httpErr.StatusCode == 404 {
-			warnStacksUnavailableOrPAT(cfg)
+			warnStacksUnavailable(cfg)
 			return nil, "", ErrAPIFailure
 		}
 		cfg.Errorf("failed to list stacks: %v", err)

cmd/checkout_test.go

@@ -158,7 +158,7 @@ func TestCheckout_NumericTarget_StacksNotAvailable(t *testing.T) {
 	require.NoError(t, stack.Save(gitDir, &stack.StackFile{SchemaVersion: 1, Stacks: []stack.Stack{}}))
 
 	cfg, outR, errR := config.NewTestConfig()
-	setTestTokenForHost(cfg, "gho_test_oauth_token")
+	setTestRepo(cfg)
 	cfg.GitHubClientOverride = &github.MockClient{
 		FindStackForPRFn: func(int) (*github.RemoteStack, error) {
 			return nil, &api.HTTPError{StatusCode: 404, Message: "Not Found"}

cmd/link.go

@@ -366,7 +366,7 @@ func listStacksSafe(cfg *config.Config, client github.ClientOps) ([]github.Remot
 	if err != nil {
 		var httpErr *api.HTTPError
 		if errors.As(err, &httpErr) && httpErr.StatusCode == 404 {
-			warnStacksUnavailableOrPAT(cfg)
+			warnStacksUnavailable(cfg)
 			return nil, ErrStacksUnavailable
 		}
 		cfg.Errorf("failed to list stacks: %v", err)
@@ -559,7 +559,7 @@ func createLink(cfg *config.Config, client github.ClientOps, prNumbers []int) er
 				cfg.Errorf("Cannot create stack: %s", httpErr.Message)
 				return ErrAPIFailure
 			case 404:
-				warnStacksUnavailableOrPAT(cfg)
+				warnStacksUnavailable(cfg)
 				return ErrStacksUnavailable
 			default:
 				cfg.Errorf("Failed to create stack (HTTP %d): %s", httpErr.StatusCode, httpErr.Message)

cmd/link_test.go

@@ -244,7 +244,7 @@ func TestLink_DuplicateArgs(t *testing.T) {
 
 func TestLink_StacksUnavailable(t *testing.T) {
 	cfg, _, errR := config.NewTestConfig()
-	setTestTokenForHost(cfg, "gho_test_oauth_token")
+	setTestRepo(cfg)
 	cfg.GitHubClientOverride = &github.MockClient{
 		FindPRByNumberFn: func(n int) (*github.PullRequest, error) {
 			return &github.PullRequest{Number: n, HeadRefName: "b", BaseRefName: "main"}, nil

cmd/submit.go

@@ -113,16 +113,11 @@ func runSubmit(cfg *config.Config, opts *submitOptions) error {
 		return ErrAPIFailure
 	}
 
-	// Pre-flight: abort early if the user is authenticating with a PAT.
-	if cfg.WarnIfPAT() {
-		return ErrStacksUnavailable
-	}
-
 	// Verify that the repository has stacked PRs enabled.
 	stacksAvailable := s.ID != ""
 	if !stacksAvailable {
 		if _, err := client.ListStacks(); err != nil {
-			warnStacksUnavailableOrPAT(cfg)
+			warnStacksUnavailable(cfg)
 			if cfg.IsInteractive() {
 				p := prompter.New(cfg.In, cfg.Out, cfg.Err)
 				proceed, promptErr := p.Confirm("Would you still like to create regular PRs?", false)
@@ -917,7 +912,7 @@ func createNewStack(cfg *config.Config, client github.ClientOps, s *stack.Stack,
 	case 422:
 		return handleCreate422(cfg, httpErr, prNumbers)
 	case 404:
-		warnStacksUnavailableOrPAT(cfg)
+		warnStacksUnavailable(cfg)
 		return false
 	default:
 		cfg.Warningf("Failed to create stack on GitHub: %s", httpErr.Message)

cmd/submit_test.go

@@ -1590,9 +1590,7 @@ func TestSubmit_PreflightCheck_404_BailsOut(t *testing.T) {
 		},
 	}
 
-	// Use an OAuth token so the PAT pre-flight check passes and we
-	// exercise the ListStacks 404 path.
-	setTestTokenForHost(cfg, "gho_test_oauth_token")
+	setTestRepo(cfg)
 
 	cmd := SubmitCmd(cfg)
 	cmd.SetArgs([]string{"--auto"})
@@ -1645,9 +1643,7 @@ func TestSubmit_PreflightCheck_404_Interactive_UserDeclinesAborts(t *testing.T)
 		},
 	}
 
-	// Use an OAuth token so the PAT pre-flight check passes and we
-	// exercise the ListStacks 404 path.
-	setTestTokenForHost(cfg, "gho_test_oauth_token")
+	setTestRepo(cfg)
 
 	cmd := SubmitCmd(cfg)
 	cmd.SetArgs([]string{"--auto"})
@@ -2345,91 +2341,6 @@ func TestSubmit_NoTemplate_UsesFooter(t *testing.T) {
 	assert.Contains(t, capturedBody, feedbackURL)
 }
 
-func TestSubmit_PreflightCheck_PAT_BailsOut(t *testing.T) {
-	s := stack.Stack{
-		Trunk: stack.BranchRef{Branch: "main"},
-		Branches: []stack.BranchRef{
-			{Branch: "b1"},
-			{Branch: "b2"},
-		},
-	}
-
-	tmpDir := t.TempDir()
-	writeStackFile(t, tmpDir, s)
-
-	pushed := false
-	mock := newSubmitMock(tmpDir, "b1")
-	mock.PushFn = func(string, []string, bool, bool) error {
-		pushed = true
-		return nil
-	}
-	restore := git.SetOps(mock)
-	defer restore()
-
-	listStacksCalled := false
-	cfg, _, errR := config.NewTestConfig()
-	cfg.GitHubClientOverride = &github.MockClient{
-		ListStacksFn: func() ([]github.RemoteStack, error) {
-			listStacksCalled = true
-			return nil, nil
-		},
-	}
-
-	// Simulate a classic PAT — the pre-flight check should abort.
-	setTestTokenForHost(cfg, "ghp_classic_pat_token")
-
-	cmd := SubmitCmd(cfg)
-	cmd.SetArgs([]string{"--auto"})
-	cmd.SetOut(io.Discard)
-	cmd.SetErr(io.Discard)
-	err := cmd.Execute()
-
-	cfg.Err.Close()
-	errOut, _ := io.ReadAll(errR)
-	output := string(errOut)
-
-	assert.ErrorIs(t, err, ErrStacksUnavailable)
-	assert.Contains(t, output, "Personal access tokens are not supported by gh stack")
-	assert.Contains(t, output, "gh auth login")
-	assert.False(t, pushed, "should not push when using a PAT")
-	assert.False(t, listStacksCalled, "should not call ListStacks when PAT detected")
-}
-
-func TestSubmit_PreflightCheck_FinegrainedPAT_BailsOut(t *testing.T) {
-	s := stack.Stack{
-		Trunk: stack.BranchRef{Branch: "main"},
-		Branches: []stack.BranchRef{
-			{Branch: "b1"},
-			{Branch: "b2"},
-		},
-	}
-
-	tmpDir := t.TempDir()
-	writeStackFile(t, tmpDir, s)
-
-	mock := newSubmitMock(tmpDir, "b1")
-	restore := git.SetOps(mock)
-	defer restore()
-
-	cfg, _, errR := config.NewTestConfig()
-	cfg.GitHubClientOverride = &github.MockClient{}
-
-	setTestTokenForHost(cfg, "github_pat_11AABBCC_xxxx")
-
-	cmd := SubmitCmd(cfg)
-	cmd.SetArgs([]string{"--auto"})
-	cmd.SetOut(io.Discard)
-	cmd.SetErr(io.Discard)
-	err := cmd.Execute()
-
-	cfg.Err.Close()
-	errOut, _ := io.ReadAll(errR)
-	output := string(errOut)
-
-	assert.ErrorIs(t, err, ErrStacksUnavailable)
-	assert.Contains(t, output, "Personal access tokens are not supported by gh stack")
-}
-
 func TestSubmit_DisablesAutoMergeOnExistingPR(t *testing.T) {
 	s := stack.Stack{
 		Trunk: stack.BranchRef{Branch: "main"},

cmd/utils.go

@@ -72,13 +72,9 @@ func printInterrupt(cfg *config.Config) {
 	cfg.Infof("Received interrupt, aborting operation")
 }
 
-// warnStacksUnavailableOrPAT prints an appropriate warning when a stacks API
-// call returns 404. If the token is a PAT the message focuses on the auth
-// issue; otherwise it falls back to the generic "not enabled" message.
-func warnStacksUnavailableOrPAT(cfg *config.Config) {
-	if cfg.WarnIfPAT() {
-		return
-	}
+// warnStacksUnavailable prints a warning when a stacks API call returns 404,
+// indicating stacked PRs are not enabled for the repository.
+func warnStacksUnavailable(cfg *config.Config) {
 	cfg.Warningf("Stacked PRs are not enabled for this repository")
 }
 

cmd/utils_test.go

@@ -691,39 +691,21 @@ func TestStackNeedsRebase_SkipsMergedBranches(t *testing.T) {
 	assert.False(t, stackNeedsRebase(s), "should skip merged branches and find stack up to date")
 }
 
-// setTestTokenForHost sets cfg.TokenForHostFn to return the given token for
-// any host. Also sets RepoOverride so tests don't depend on real git context.
-func setTestTokenForHost(cfg *config.Config, token string) {
-	cfg.TokenForHostFn = func(string) (string, string) { return token, "test" }
+// setTestRepo sets RepoOverride so tests don't depend on real git context.
+func setTestRepo(cfg *config.Config) {
 	cfg.RepoOverride = &repository.Repository{Host: "github.com", Owner: "o", Name: "r"}
 }
 
-func TestWarnStacksUnavailableOrPAT_ShowsPATMessage(t *testing.T) {
+func TestWarnStacksUnavailable_ShowsNotEnabled(t *testing.T) {
 	cfg, _, errR := config.NewTestConfig()
-	setTestTokenForHost(cfg, "github_pat_fine_grained")
 
-	warnStacksUnavailableOrPAT(cfg)
-
-	cfg.Err.Close()
-	errOut, _ := io.ReadAll(errR)
-	output := string(errOut)
-
-	assert.Contains(t, output, "Personal access tokens are not supported by gh stack")
-	assert.NotContains(t, output, "Stacked PRs are not enabled")
-}
-
-func TestWarnStacksUnavailableOrPAT_ShowsNotEnabledForOAuth(t *testing.T) {
-	cfg, _, errR := config.NewTestConfig()
-	setTestTokenForHost(cfg, "gho_oauth_token")
-
-	warnStacksUnavailableOrPAT(cfg)
+	warnStacksUnavailable(cfg)
 
 	cfg.Err.Close()
 	errOut, _ := io.ReadAll(errR)
 	output := string(errOut)
 
 	assert.Contains(t, output, "Stacked PRs are not enabled for this repository")
-	assert.NotContains(t, output, "Personal access tokens")
 }
 
 func TestEnsureLocalTrunk_AlreadyExists(t *testing.T) {