Files
orca/src/main/runtime/runtime-github-repository-query-commands.ts
T
c34b944136 feat(github): bind projects to a specific gh account (#13664)
* feat(github): bind projects to a specific gh account

Adds per-project `Repo.ghAccount` so repo-scoped gh calls (create-worktree
issue/PR search, work items, hosted-review reads and mutations) run as the bound
account via ephemeral child-env token injection instead of the globally active
gh login. Multi-account resolution is capability-gated (gh >= 2.40) and fails
closed when the bound account or host is unavailable; Project View stays
ambient by design.

Repository settings gains a section for selecting or clearing a keyring-backed
account (shadcn `Select`), with mixed-version "not enforced" handling for older
remote runtimes. Attached `-Rhost/owner/repo` forms are covered by the host-drift
guard and its tests; es/ja/ko/zh catalogs carry the section's strings.

`getLocalProjectGhExecOptions` centralizes the binding lookup so every gh
execution path picks it up, including the Electron `hostedReview:*` handlers
that previously stayed on the ambient login. `gh auth token` (a keyring read)
is exempt from the rate-limit breaker gate so a tripped bucket cannot turn a
bound-token resolve into a false "unavailable".

The `ghAccount` update field and the two binding RPC methods live in the shared
RPC params contract; the generated catalog is regenerated.

Fixes #13612

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012B3QEP5iP4WGGEpPLtkHqA

* fix(settings): make GitHub account refresh secondary

* fix(github): satisfy strict casting quality checks

* test(rpc): use runtime fixture for repo binding

* fix(github): preserve project account for PR worktree lookups

* test(rpc): avoid incomplete runtime settings fixture

* fix(i18n): add GitHub account refresh label

* fix(i18n): refresh runtime required catalog

* fix(windows): preserve mobile patch bytes

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: Neil <neil@stably.ai>
2026-09-18 20:39:52 -07:00

180 lines
5.2 KiB
TypeScript

import type { ListWorkItemsResult } from '../../shared/github/work-item-types'
import type { Repo } from '../../shared/repo-types'
import type { LocalProjectGhExecOptions } from '../project-runtime-git-options'
import {
countWorkItems,
getWorkItem,
getWorkItemByOwnerRepo,
listAssignableUsers,
listIssues,
listLabels,
listWorkItems,
type MainWorkItem
} from '../github/client'
import {
listGhAccountBindingInventory,
validateGhAccountBinding
} from '../github/gh-account-binding-inventory'
import { getRateLimit } from '../github/rate-limit'
import { githubHostFromIdentityKey } from '../../shared/github/repository-identity-key'
import { getWorkItemDetails } from '../github/work-item-details'
type LocalGitArgs = [] | [LocalProjectGhExecOptions]
type RuntimeGitHubRepositoryQueryCommandsDeps = {
resolveRepo: (selector: string) => Promise<Repo>
getLocalGitArgs: (repo: Repo) => LocalGitArgs
}
export class RuntimeGitHubRepositoryQueryCommands {
constructor(private readonly deps: RuntimeGitHubRepositoryQueryCommandsDeps) {}
async listRepoWorkItems(
repoSelector: string,
limit?: number,
query?: string,
page?: number,
noCache?: boolean
): Promise<ListWorkItemsResult<MainWorkItem>> {
const repo = await this.deps.resolveRepo(repoSelector)
return listWorkItems(
repo.path,
limit,
query,
page,
repo.issueSourcePreference,
repo.connectionId ?? null,
noCache,
...this.deps.getLocalGitArgs(repo)
)
}
async listRepoIssues(
repoSelector: string,
limit?: number
): Promise<Awaited<ReturnType<typeof listIssues>>['items']> {
const repo = await this.deps.resolveRepo(repoSelector)
const result = await listIssues(
repo.path,
limit,
repo.issueSourcePreference,
repo.connectionId ?? null,
...this.deps.getLocalGitArgs(repo)
)
return result.items
}
async getRepoWorkItem(
repoSelector: string,
number: number,
type?: 'issue' | 'pr'
): Promise<Awaited<ReturnType<typeof getWorkItem>>> {
const repo = await this.deps.resolveRepo(repoSelector)
return getWorkItem(
repo.path,
number,
type,
repo.connectionId ?? null,
this.deps.getLocalGitArgs(repo)[0] ?? {},
repo.issueSourcePreference
)
}
async getRepoWorkItemByOwnerRepo(
repoSelector: string,
ownerRepo: { owner: string; repo: string; host?: string },
number: number,
type: 'issue' | 'pr'
): Promise<Awaited<ReturnType<typeof getWorkItemByOwnerRepo>>> {
const repo = await this.deps.resolveRepo(repoSelector)
return getWorkItemByOwnerRepo(
repo.path,
ownerRepo,
number,
type,
repo.connectionId ?? null,
...this.deps.getLocalGitArgs(repo)
)
}
async getRepoWorkItemDetails(
repoSelector: string,
number: number,
type?: 'issue' | 'pr'
): Promise<Awaited<ReturnType<typeof getWorkItemDetails>>> {
const repo = await this.deps.resolveRepo(repoSelector)
return getWorkItemDetails(
repo.path,
number,
type,
repo.connectionId ?? null,
this.deps.getLocalGitArgs(repo)[0] ?? {},
repo.issueSourcePreference
)
}
async countRepoWorkItems(repoSelector: string, query?: string): Promise<number> {
const repo = await this.deps.resolveRepo(repoSelector)
return countWorkItems(
repo.path,
query,
repo.issueSourcePreference,
repo.connectionId ?? null,
...this.deps.getLocalGitArgs(repo)
)
}
async listRepoLabels(repoSelector: string): Promise<Awaited<ReturnType<typeof listLabels>>> {
const repo = await this.deps.resolveRepo(repoSelector)
return listLabels(
repo.path,
repo.issueSourcePreference,
repo.connectionId ?? null,
...this.deps.getLocalGitArgs(repo)
)
}
async listRepoAssignableUsers(
repoSelector: string
): Promise<Awaited<ReturnType<typeof listAssignableUsers>>> {
const repo = await this.deps.resolveRepo(repoSelector)
return listAssignableUsers(
repo.path,
repo.issueSourcePreference,
repo.connectionId ?? null,
...this.deps.getLocalGitArgs(repo)
)
}
getGitHubRateLimit(options?: {
force?: boolean
}): Promise<Awaited<ReturnType<typeof getRateLimit>>> {
return getRateLimit(options)
}
async listGitHubBindableAccounts(
repoSelector: string,
options?: { refreshCapability?: boolean }
): Promise<Awaited<ReturnType<typeof listGhAccountBindingInventory>>> {
const repo = await this.deps.resolveRepo(repoSelector)
const requiredHost = githubHostFromIdentityKey(repo.gitRemoteIdentity?.canonicalKey)
return listGhAccountBindingInventory(this.deps.getLocalGitArgs(repo)[0] ?? {}, {
refreshCapability: options?.refreshCapability === true,
...(requiredHost ? { requiredHost } : {})
})
}
async validateGitHubAccountBinding(
repoSelector: string,
binding: { host: string; user: string }
): Promise<Awaited<ReturnType<typeof validateGhAccountBinding>>> {
const repo = await this.deps.resolveRepo(repoSelector)
const requiredHost = githubHostFromIdentityKey(repo.gitRemoteIdentity?.canonicalKey)
return validateGhAccountBinding(
binding,
this.deps.getLocalGitArgs(repo)[0] ?? {},
requiredHost ? { requiredHost } : {}
)
}
}