fix: reverted github pem auth

Author: jahilldev

.gitignore

@@ -26,3 +26,6 @@ logs/
 
 # isolated, project-local Hermes home (config/credentials/sessions/state)
 .hermes/
+
+# generated files
+api/prisma/dev.db

api/src/orchestrator/orchestrator.service.ts

@@ -84,7 +84,7 @@ export class OrchestratorService {
     });
     await this.queue.enqueue({ jobId: job.id, kind: 'PLAN' });
     const ref = this.refFor(job, installation);
-    await this.github.createIssueReaction(ref, evt.issueNumber, 'eyes');
+    await this.safeReaction(ref, evt.issueNumber, 'eyes');
     await this.safeComment(
       ref,
       evt.issueNumber,
@@ -656,4 +656,16 @@ export class OrchestratorService {
       this.logger.warn(`failed to post comment: ${(e as Error).message}`);
     }
   }
+
+  private async safeReaction(
+    ref: RepoRef,
+    issueNumber: number,
+    content: Parameters<GithubService['createIssueReaction']>[2],
+  ): Promise<void> {
+    try {
+      await this.github.createIssueReaction(ref, issueNumber, content);
+    } catch (e) {
+      this.logger.warn(`failed to add reaction: ${(e as Error).message}`);
+    }
+  }
 }

api/src/workspace/workspace.module.ts

@@ -1,8 +1,9 @@
 import { Module } from '@nestjs/common';
+import { GithubModule } from '../github/github.module.js';
 import { WorkspaceService } from './workspace.service.js';
 
 @Module({
-  imports: [],
+  imports: [GithubModule],
   providers: [WorkspaceService],
   exports: [WorkspaceService],
 })

api/src/workspace/workspace.service.ts

@@ -4,9 +4,10 @@ import { mkdir, rm } from 'node:fs/promises';
 import { Injectable, Logger } from '@nestjs/common';
 import { simpleGit, type SimpleGit } from 'simple-git';
 import { AppConfigService } from '../config/config.service.js';
+import { GithubService } from '../github/github.service.js';
 import { type DiffSummary, type Workspace, type WorkspacePrepareInput } from './workspace.model.js';
 import {
-  sshRemoteUrl,
+  authenticatedRemoteUrl,
   changedFilesFromStatus,
   workspaceDir,
 } from './workspace.utility.js';
@@ -20,13 +21,17 @@ import {
 export class WorkspaceService {
   private readonly logger = new Logger(WorkspaceService.name);
 
-  constructor(private readonly config: AppConfigService) {}
+  constructor(
+    private readonly config: AppConfigService,
+    private readonly app: GithubService,
+  ) {}
 
   /** Clone (if needed) and check out the job's branch. Idempotent across attempts. */
   async prepare(input: WorkspacePrepareInput): Promise<Workspace> {
     const root = this.config.get('WORKSPACE_ROOT');
     const dir = workspaceDir(root, input.jobId);
-    const remote = sshRemoteUrl(input.owner, input.repo);
+    const token = await this.app.getInstallationToken(input.installationId);
+    const remote = authenticatedRemoteUrl(input.owner, input.repo, token);
 
     if (existsSync(`${dir}/.git`)) {
       const git = simpleGit(dir);
@@ -81,11 +86,13 @@ export class WorkspaceService {
     return (await git.revparse(['HEAD'])).trim();
   }
 
-  /** Push the job branch using the host machine's SSH credentials. */
+  /** Push the job branch, refreshing the remote token first (tokens expire ~1h). */
   async push(input: WorkspacePrepareInput): Promise<string> {
     const root = this.config.get('WORKSPACE_ROOT');
     const dir = workspaceDir(root, input.jobId);
     const git = simpleGit(dir);
+    const token = await this.app.getInstallationToken(input.installationId);
+    await git.remote(['set-url', 'origin', authenticatedRemoteUrl(input.owner, input.repo, token)]);
     await git.push(['-u', 'origin', input.branchName]);
     const sha = (await git.revparse(['HEAD'])).trim();
     this.logger.log(`[job ${input.jobId}] pushed ${input.branchName} @ ${sha}`);

api/src/workspace/workspace.utility.ts

@@ -5,9 +5,9 @@ export function workspaceDir(root: string, jobId: string): string {
   return resolve(root, jobId);
 }
 
-/** SSH remote URL — authentication is handled by the host machine's SSH credentials. */
-export function sshRemoteUrl(owner: string, repo: string): string {
-  return `git@github.com:${owner}/${repo}.git`;
+/** HTTPS remote URL carrying a short-lived installation token. */
+export function authenticatedRemoteUrl(owner: string, repo: string, token: string): string {
+  return `https://x-access-token:${token}@github.com/${owner}/${repo}.git`;
 }
 
 /** Files touched in the working tree, from a simple-git StatusResult. */