gh-cli-auto-auth (squashed)

Author: frenchie4111

CLAUDE.md

@@ -252,7 +252,15 @@ which the PtyManager sets when spawning each terminal.
 The user pastes a GitHub personal access token into Settings. It's encrypted
 via `safeStorage` and stored in `userData/secrets.enc`. All GitHub data
 (PR status, check runs, statuses) goes through `src/main/github.ts` using
-`fetch()` against the REST API — there is **no dependency on the `gh` CLI**.
+`fetch()` against the REST API.
+
+Token resolution lives in `src/main/github-auth.ts` and runs once at boot
+(re-runs on a 401): an explicit PAT in `secrets.enc` or `GITHUB_TOKEN` wins,
+then `gh auth token` (spawned through a login zsh so Homebrew's `gh` is on
+PATH), then nothing. The `gh` CLI is an **optional** auto-detect convenience
+— if it's installed and authenticated, Harness uses its token automatically;
+if not, the PAT paste flow in Settings is still the fallback. Harness has no
+hard dependency on `gh`.
 
 ## Important quirks
 

src/main/github-auth.ts

@@ -0,0 +1,134 @@
+import { execFile } from 'child_process'
+import { promisify } from 'util'
+import { log } from './debug'
+import { getSecret } from './secrets'
+
+const execFileAsync = promisify(execFile)
+
+export type TokenSource = 'pat' | 'gh-cli'
+
+interface ResolvedToken {
+  token: string
+  source: TokenSource
+}
+
+let cached: ResolvedToken | null = null
+let resolving: Promise<ResolvedToken | null> | null = null
+
+/** Probe GET /user to confirm the token works. Returns scopes on success. */
+async function probeToken(token: string): Promise<{ ok: boolean; scopes: string[]; status: number }> {
+  try {
+    const res = await fetch('https://api.github.com/user', {
+      headers: {
+        Accept: 'application/vnd.github+json',
+        'User-Agent': 'Harness',
+        Authorization: `Bearer ${token}`
+      }
+    })
+    const scopesHeader = res.headers.get('x-oauth-scopes') || ''
+    const scopes = scopesHeader
+      .split(',')
+      .map((s) => s.trim())
+      .filter(Boolean)
+    return { ok: res.ok, scopes, status: res.status }
+  } catch (err) {
+    log('github-auth', 'probe failed', err instanceof Error ? err.message : err)
+    return { ok: false, scopes: [], status: 0 }
+  }
+}
+
+const DESIRED_SCOPES = ['repo', 'read:org']
+
+function warnIfScopesShort(source: TokenSource, scopes: string[]): void {
+  // Fine-grained PATs return an empty x-oauth-scopes header — don't warn
+  // on empty, only on explicitly-present-but-insufficient classic scopes.
+  if (scopes.length === 0) return
+  const missing = DESIRED_SCOPES.filter(
+    (needed) => !scopes.some((s) => s === needed || s.startsWith(`${needed}:`))
+  )
+  if (missing.length > 0) {
+    log('github-auth', `${source} token missing desired scopes: ${missing.join(', ')} (have: ${scopes.join(', ')})`)
+  }
+}
+
+/** Try reading a token from `gh auth token`. Returns null if gh is absent or not logged in. */
+async function readGhCliToken(): Promise<string | null> {
+  // Login shell so Homebrew's gh is on PATH (matching PtyManager). Login-only
+  // (no -i) avoids .zshrc side effects that can break non-TTY invocations —
+  // PATH from Homebrew lives in .zprofile/.zlogin which login mode sources.
+  try {
+    const { stdout } = await execFileAsync('/bin/zsh', ['-lc', 'gh auth token'], {
+      timeout: 3000
+    })
+    // gh auth token can include trailing newline + nothing else on stderr.
+    const token = stdout.trim()
+    if (!token) {
+      log('github-auth', 'gh auth token returned empty stdout')
+      return null
+    }
+    return token
+  } catch (err) {
+    // execFile errors carry .stdout/.stderr from the failed process.
+    const e = err as { code?: string | number; stderr?: string; stdout?: string; message?: string }
+    log('github-auth', `gh auth token failed: code=${e.code} stderr=${(e.stderr || '').trim()} stdout=${(e.stdout || '').trim()} msg=${e.message}`)
+    return null
+  }
+}
+
+async function doResolve(): Promise<ResolvedToken | null> {
+  // 1. Explicit PAT from secrets or env wins.
+  const pat = getSecret('githubToken') || process.env.GITHUB_TOKEN || null
+  if (pat) {
+    const probe = await probeToken(pat)
+    if (probe.ok) {
+      warnIfScopesShort('pat', probe.scopes)
+      log('github-auth', 'resolved token source=pat')
+      return { token: pat, source: 'pat' }
+    }
+    log('github-auth', `PAT probe failed (status ${probe.status}), falling through to gh CLI`)
+  }
+
+  // 2. gh CLI.
+  const ghToken = await readGhCliToken()
+  if (ghToken) {
+    const probe = await probeToken(ghToken)
+    if (probe.ok) {
+      warnIfScopesShort('gh-cli', probe.scopes)
+      log('github-auth', 'resolved token source=gh-cli')
+      return { token: ghToken, source: 'gh-cli' }
+    }
+    log('github-auth', `gh CLI token probe failed (status ${probe.status})`)
+  }
+
+  // 3. Nothing.
+  log('github-auth', 'no GitHub token available')
+  return null
+}
+
+/** Resolve and cache a GitHub token. Safe to call concurrently — only one resolution runs at a time. */
+export async function resolveGitHubToken(): Promise<ResolvedToken | null> {
+  if (cached) return cached
+  if (resolving) return resolving
+  resolving = doResolve().then((result) => {
+    cached = result
+    resolving = null
+    return result
+  })
+  return resolving
+}
+
+/** Synchronous read of the cached token. Returns null if resolve hasn't been called yet or failed. */
+export function getCachedToken(): string | null {
+  return cached?.token ?? null
+}
+
+/** Current auth source, or null if unresolved. */
+export function getTokenSource(): TokenSource | null {
+  return cached?.source ?? null
+}
+
+/** Drop the cached token so the next resolveGitHubToken() call re-probes. */
+export function invalidateTokenCache(): void {
+  log('github-auth', 'invalidating token cache')
+  cached = null
+}

src/main/github.ts

@@ -1,17 +1,13 @@
 import { execFile } from 'child_process'
 import { promisify } from 'util'
 import { log } from './debug'
-import { getSecret } from './secrets'
+import { getCachedToken, invalidateTokenCache, resolveGitHubToken } from './github-auth'
 import type { CheckStatus, PRReview, PRStatus } from '../shared/state/prs'
 
 export type { CheckStatus, PRReview, PRStatus }
 
 const execFileAsync = promisify(execFile)
 
-function getToken(): string | null {
-  return getSecret('githubToken') || process.env.GITHUB_TOKEN || null
-}
-
 /** Parse the GitHub owner/repo from a remote URL like git@github.com:owner/repo.git or https://github.com/owner/repo.git */
 function parseRemoteUrl(url: string): { owner: string; repo: string } | null {
   // SSH: git@github.com:owner/repo.git
@@ -52,17 +48,27 @@ async function getCurrentBranch(worktreePath: string): Promise<string | null> {
   }
 }
 
-/** Make an authenticated request to the GitHub REST API */
-async function githubFetch(url: string): Promise<unknown> {
-  const token = getToken()
+async function doFetch(url: string, token: string | null): Promise<Response> {
   const headers: Record<string, string> = {
     Accept: 'application/vnd.github+json',
     'User-Agent': 'Harness',
     'X-GitHub-Api-Version': '2022-11-28'
   }
   if (token) headers.Authorization = `Bearer ${token}`
+  return fetch(url, { headers })
+}
 
-  const res = await fetch(url, { headers })
+/** Make an authenticated request to the GitHub REST API. On 401, invalidate the token cache and retry once. */
+async function githubFetch(url: string): Promise<unknown> {
+  let token = getCachedToken()
+  let res = await doFetch(url, token)
+  if (res.status === 401) {
+    log('github', '401 from GitHub, re-resolving token')
+    invalidateTokenCache()
+    const resolved = await resolveGitHubToken()
+    token = resolved?.token ?? null
+    res = await doFetch(url, token)
+  }
   if (!res.ok) {
     throw new Error(`GitHub API ${res.status}: ${res.statusText}`)
   }
@@ -166,7 +172,7 @@ function computeOverall(checks: CheckStatus[]): PRStatus['checksOverall'] {
 
 /** Get PR status for the branch checked out in a worktree. Returns null if no PR or no token. */
 export async function getPRStatus(worktreePath: string): Promise<PRStatus | null> {
-  const token = getToken()
+  const token = getCachedToken()
   if (!token) return null
 
   const repoInfo = await getRepoInfo(worktreePath)
@@ -274,6 +280,43 @@ export async function getPRStatus(worktreePath: string): Promise<PRStatus | null
   }
 }
 
+/** Check whether the authenticated user has starred the repo. */
+export async function isRepoStarred(token: string, owner: string, repo: string): Promise<boolean | null> {
+  try {
+    const res = await fetch(`https://api.github.com/user/starred/${owner}/${repo}`, {
+      headers: {
+        Accept: 'application/vnd.github+json',
+        'User-Agent': 'Harness',
+        Authorization: `Bearer ${token}`
+      }
+    })
+    if (res.status === 204) return true
+    if (res.status === 404) return false
+    return null
+  } catch {
+    return null
+  }
+}
+
+/** Unstar a repository. Idempotent. */
+export async function unstarRepo(token: string, owner: string, repo: string): Promise<{ ok: boolean; error?: string }> {
+  try {
+    const res = await fetch(`https://api.github.com/user/starred/${owner}/${repo}`, {
+      method: 'DELETE',
+      headers: {
+        Accept: 'application/vnd.github+json',
+        'User-Agent': 'Harness',
+        Authorization: `Bearer ${token}`,
+        'X-GitHub-Api-Version': '2022-11-28'
+      }
+    })
+    if (res.status === 204) return { ok: true }
+    return { ok: false, error: `${res.status} ${res.statusText}` }
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) }
+  }
+}
+
 /** Star a repository on behalf of the authenticated user. Idempotent. */
 export async function starRepo(token: string, owner: string, repo: string): Promise<{ ok: boolean; error?: string }> {
   try {

src/main/index.ts

@@ -12,9 +12,10 @@ import { PanesFSM, stripTransientTabFields } from './panes-fsm'
 import { ActivityDeriver } from './activity-deriver'
 import type { TerminalTab, WorkspacePane } from '../shared/state/terminals'
 import { listWorktrees, listBranches, continueWorktree, removeWorktree, isWorktreeDirty, defaultWorktreeDir, getChangedFiles, getFileDiff, getBranchCommits, getCommitDiff, getMainWorktreeStatus, prepareMainForMerge, mergeWorktreeLocally, getBranchSha, previewMergeConflicts, getBranchDiffStats, listAllFiles, readWorktreeFile, runWorktreeScript, type MergeStrategy } from './worktree'
-import { getPRStatus, testToken, starRepo } from './github'
+import { getPRStatus, testToken, starRepo, unstarRepo, isRepoStarred } from './github'
 import { AVAILABLE_EDITORS, DEFAULT_EDITOR_ID, openInEditor } from './editor'
 import { setSecret, hasSecret, deleteSecret } from './secrets'
+import { resolveGitHubToken, getTokenSource, invalidateTokenCache, getCachedToken } from './github-auth'
 import {
   loadConfig,
   saveConfig,
@@ -119,11 +120,36 @@ const store = new Store({
     editor: config.editor || DEFAULT_EDITOR_ID,
     worktreeBase: config.worktreeBase || DEFAULT_WORKTREE_BASE,
     mergeStrategy: config.mergeStrategy || DEFAULT_MERGE_STRATEGY,
-    hasGithubToken: hasSecret('githubToken')
+    hasGithubToken: hasSecret('githubToken'),
+    githubAuthSource: null
   }
 })
 registerStateTransport(store)
 
+/** Query the harness star state, dispatch it to the slice, and auto-star
+ *  exactly once per user (sticky so manual unstars survive reboots). Safe
+ *  to call after any token resolution — boot, PAT save, etc. */
+async function refreshHarnessStarState(): Promise<void> {
+  const token = getCachedToken()
+  if (!token) {
+    store.dispatch({ type: 'settings/harnessStarredChanged', payload: null })
+    return
+  }
+  const starred = await isRepoStarred(token, 'frenchie4111', 'harness')
+  if (starred === false && !config.harnessAutoStarred) {
+    const result = await starRepo(token, 'frenchie4111', 'harness')
+    if (result.ok) {
+      config.harnessAutoStarred = true
+      saveConfig(config)
+      store.dispatch({ type: 'settings/harnessStarredChanged', payload: true })
+      log('app', 'auto-starred harness on first GitHub connection')
+      return
+    }
+    log('app', 'auto-star failed', result.error)
+  }
+  store.dispatch({ type: 'settings/harnessStarredChanged', payload: starred })
+}
+
 const prPoller = new PRPoller(store, {
   getRepoRoots: () => config.repoRoots || [],
   getLocallyMerged: () => config.locallyMerged || {},
@@ -886,36 +912,51 @@ function registerIpcHandlers(): void {
     return store.getSnapshot().state.settings.hasGithubToken
   })
 
-  ipcMain.handle('settings:setGithubToken', async (_, token: string, options?: { starRepo?: boolean }) => {
+  ipcMain.handle('settings:setGithubToken', async (_, token: string) => {
     const trimmed = token.trim()
     if (!trimmed) {
       deleteSecret('githubToken')
       store.dispatch({ type: 'settings/hasGithubTokenChanged', payload: false })
+      invalidateTokenCache()
+      await resolveGitHubToken()
+      store.dispatch({ type: 'settings/githubAuthSourceChanged', payload: getTokenSource() })
+      await refreshHarnessStarState()
       return { ok: true }
     }
     // Validate the token first by hitting /user
     const test = await testToken(trimmed)
     if (!test.ok) return { ok: false, error: test.error }
     setSecret('githubToken', trimmed)
     store.dispatch({ type: 'settings/hasGithubTokenChanged', payload: true })
-
-    // Optionally star the repo — fire and forget, don't fail token save if this fails
-    let starred = false
-    if (options?.starRepo) {
-      const result = await starRepo(trimmed, 'frenchie4111', 'harness')
-      starred = result.ok
-      if (!result.ok) log('app', 'failed to star repo', result.error)
-    }
-
-    return { ok: true, username: test.username, starred }
+    invalidateTokenCache()
+    await resolveGitHubToken()
+    store.dispatch({ type: 'settings/githubAuthSourceChanged', payload: getTokenSource() })
+    await refreshHarnessStarState()
+    return { ok: true, username: test.username }
   })
 
-  ipcMain.handle('settings:clearGithubToken', () => {
+  ipcMain.handle('settings:clearGithubToken', async () => {
     deleteSecret('githubToken')
     store.dispatch({ type: 'settings/hasGithubTokenChanged', payload: false })
+    invalidateTokenCache()
+    await resolveGitHubToken()
+    store.dispatch({ type: 'settings/githubAuthSourceChanged', payload: getTokenSource() })
+    await refreshHarnessStarState()
     return true
   })
 
+  ipcMain.handle('settings:setHarnessStarred', async (_, starred: boolean) => {
+    const token = getCachedToken()
+    if (!token) return { ok: false, error: 'No GitHub token' }
+    const result = starred
+      ? await starRepo(token, 'frenchie4111', 'harness')
+      : await unstarRepo(token, 'frenchie4111', 'harness')
+    if (result.ok) {
+      store.dispatch({ type: 'settings/harnessStarredChanged', payload: starred })
+    }
+    return result
+  })
+
   // Updater
   ipcMain.handle('updater:getVersion', () => {
     return app.getVersion()
@@ -1228,10 +1269,17 @@ app.whenReady().then(() => {
   // and writes recordActivity + lastActive without renderer involvement.
   activityDeriver.start()
 
-  // Kick off the PR poller. An initial refreshAll() runs immediately and
-  // then on a 5-minute interval.
-  prPoller.start()
-  void prPoller.refreshAll()
+  // Resolve the GitHub token (PAT → gh CLI → none) before the PR poller
+  // makes its first call. The poller's initial refreshAll waits on this.
+  void (async () => {
+    await resolveGitHubToken()
+    const source = getTokenSource()
+    store.dispatch({ type: 'settings/githubAuthSourceChanged', payload: source })
+    prPoller.start()
+    void prPoller.refreshAll()
+
+    await refreshHarnessStarState()
+  })()
 
   // Seed hooks.consent from disk. If any known worktree already has the
   // hooks installed, the user must have accepted at some point — remember