gh-account

1import type { EngineInterface, Register } from 'claude-code'
2
3// Two GitHub accounts logged into gh, one active: a push to a repository the
4// other account owns fails, and Claude spends turns on `gh auth status` and
5// `gh auth switch`. Before a shell command runs, each `git push|pull|fetch|
6// clone|ls-remote` and `gh ...` step is matched to the repository's owner
7// (from the URL in the command, `-R owner/repo`, or the folder's remotes),
8// and the owner to the one logged-in account that is that owner or a member
9// of it. When that account is not gh's active one, the step alone runs with
10// its token: `GH_TOKEN="$(gh auth token --user ACCOUNT)"`, so the token itself
11// never appears in the command or its output. Nothing is guessed: no owner, no
12// single matching account, or anything unclear leaves the command as typed.
13
14const SHELLS = new Set(['Bash', 'PowerShell'])
15
16const GIT_SUBS = new Set(['push', 'pull', 'fetch', 'clone', 'ls-remote'])
17
18// gh subcommands that never reach a repository, or manage the accounts themselves.
19const GH_SKIP = new Set(['auth', 'config', 'alias', 'completion', 'help', 'version', 'extension', 'ext', 'status'])
20
21// Options of git push/pull/fetch/clone/ls-remote that take the next token as their value.
22const GIT_VALUE_OPTIONS = new Set([
23  '-o', '--push-option', '--repo', '--receive-pack', '--exec', '--upload-pack', '-u', '--depth', '-j', '--jobs',
24  '--shallow-since', '--shallow-exclude', '--deepen', '--negotiation-tip', '--server-option', '-s', '--strategy',
25  '-X', '--strategy-option', '-b', '--branch', '--origin', '--reference', '--reference-if-able',
26  '--separate-git-dir', '--template', '-c', '--config', '--filter', '--bundle-uri', '--ref-format', '--sort',
27])
28
29const LOGIN = /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/
30
31const CREDENTIAL = "-c credential.helper= -c 'credential.helper=!gh auth git-credential'"
32
33export type Account = { login: string, active: boolean, fromEnv: boolean }
34
35export type Owner = { owner: string, https: boolean }
36
37// What a step needs to find its repository's owner.
38export type Step = {
39  kind: 'git' | 'gh'
40  sub: string
41  // Named in the command itself; `null` when the command names something that is not GitHub.
42  named?: Owner | null
43  // A remote name given to git; undefined means the folder's remotes decide.
44  remote?: string
45  // `git -C dir`.
46  dir?: string
47}
48
49// Splits at top-level `&&`, `||`, `;` and newlines, outside quotes; the
50// separators are kept at odd indexes. Undefined for an unclosed quote.
51export function segments(command: string): string[] | undefined {
52  const out: string[] = []
53  let cur = ''
54  let quote: string | undefined
55  for (let i = 0; i < command.length; i++) {
56    const c = command[i]
57    if (quote !== undefined) {
58      cur += c
59      if (c === quote) quote = undefined
60      continue
61    }
62    if (c === "'" || c === '"') {
63      quote = c
64      cur += c
65      continue
66    }
67    const two = command.slice(i, i + 2)
68    if (two === '&&' || two === '||') {
69      out.push(cur, two)
70      cur = ''
71      i++
72      continue
73    }
74    if (c === ';' || c === '\n') {
75      out.push(cur, c)
76      cur = ''
77      continue
78    }
79    cur += c
80  }
81  if (quote !== undefined) return undefined
82  out.push(cur)
83  return out
84}
85
86function unquoted(text: string): string {
87  return text.replace(/'[^']*'|"[^"]*"/g, '""')
88}
89
90// Words of one step, quotes removed, up to the first pipe or redirect.
91export function words(segment: string): string[] {
92  const out: string[] = []
93  const re = /'([^']*)'|"([^"]*)"|(\S+)/g
94  let cur: string | undefined
95  let last = -1
96  for (let m = re.exec(segment); m !== null; m = re.exec(segment)) {
97    const piece = m[1] ?? m[2] ?? m[3]
98    if (m[3] !== undefined && /^(\d?>|<|\||&)/.test(m[3])) break
99    if (cur !== undefined && m.index === last) cur += piece
100    else {
101      if (cur !== undefined) out.push(cur)
102      cur = piece
103    }
104    last = m.index + m[0].length
105  }
106  if (cur !== undefined) out.push(cur)
107  return out
108}
109
110// The owner in a GitHub remote URL, and whether git would reach it over https
111// (where a credential helper, and so GH_TOKEN, is used at all).
112export function githubOwner(url: string): Owner | undefined {
113  const https = url.match(/^https?:\/\/(?:[^@/]+@)?github\.com\/([A-Za-z0-9-]+)(?:\/|$)/i)
114  if (https !== null) return { owner: https[1], https: true }
115  const ssh = url.match(/^(?:ssh:\/\/)?[^@/\s]+@github\.com[:/]([A-Za-z0-9-]+)\//i)
116  if (ssh !== null) return { owner: ssh[1], https: false }
117  return undefined
118}
119
120// `owner/repo`, `github.com/owner/repo` or a URL, as gh's -R takes it.
121function repoOwner(value: string): Owner | null {
122  const url = githubOwner(value)
123  if (url !== undefined) return url
124  const m = value.match(/^(?:github\.com\/)?([A-Za-z0-9-]+)\/[A-Za-z0-9._-]+$/i)
125  return m !== null ? { owner: m[1], https: true } : null
126}
127
128// The first argument that is not an option or an option's value.
129function positional(args: string[]): string | undefined {
130  for (let i = 0; i < args.length; i++) {
131    const a = args[i]
132    if (a === '--') return args[i + 1]
133    if (a.startsWith('-')) {
134      if (GIT_VALUE_OPTIONS.has(a)) i++
135      continue
136    }
137    return a
138  }
139  return undefined
140}
141
142// What a step needs, or undefined when it is not a step this mod handles.
143export function parseStep(segment: string): Step | undefined {
144  const w = words(segment)
145  if (w[0] === 'git') {
146    let i = 1
147    let dir: string | undefined
148    while (i < w.length && w[i].startsWith('-')) {
149      if (w[i] === '-C') {
150        dir = w[i + 1]
151        i += 2
152      } else if (w[i] === '-c') i += 2
153      else if (/^--(git-dir|work-tree|namespace)/.test(w[i])) return undefined
154      else i++
155    }
156    const sub = w[i]
157    if (sub === undefined || !GIT_SUBS.has(sub)) return undefined
158    if (dir !== undefined && /[$~]/.test(dir)) return undefined
159    const target = positional(w.slice(i + 1))
160    if (sub === 'clone') return { kind: 'git', sub, named: target === undefined ? null : githubOwner(target) ?? null }
161    if (target === undefined) return { kind: 'git', sub, dir }
162    const url = githubOwner(target)
163    if (url !== undefined) return { kind: 'git', sub, named: url, dir }
164    if (/[:/\\$]|^\./.test(target)) return { kind: 'git', sub, named: null, dir }
165    return { kind: 'git', sub, remote: target, dir }
166  }
167  if (w[0] === 'gh') {
168    const sub = w[1]
169    if (sub === undefined || sub.startsWith('-') || GH_SKIP.has(sub)) return undefined
170    for (let i = 2; i < w.length; i++) {
171      const a = w[i]
172      const value = a === '-R' || a === '--repo' ? w[i + 1] : a.startsWith('--repo=') ? a.slice(7) : a.startsWith('-R') && a.length > 2 ? a.slice(2) : undefined
173      if (value !== undefined) return { kind: 'gh', sub, named: repoOwner(value) }
174    }
175    if (sub === 'api') {
176      const path = w.slice(2).find(a => !a.startsWith('-'))
177      const m = path?.match(/^\/?(?:repos|orgs|users)\/([A-Za-z0-9-]+)(?:\/|$)/)
178      if (m) return { kind: 'gh', sub, named: { owner: m[1], https: true } }
179    }
180    if (sub === 'repo' && w[3] !== undefined && !w[3].startsWith('-')) {
181      const named = repoOwner(w[3])
182      if (named !== null) return { kind: 'gh', sub, named }
183    }
184    for (const a of w.slice(2)) {
185      const url = githubOwner(a)
186      if (url !== undefined) return { kind: 'gh', sub, named: url }
187    }
188    return { kind: 'gh', sub }
189  }
190  return undefined
191}
192
193// The directory a `cd` step moves to: a string, `null` when it cannot be
194// known, undefined when the step is not a directory change.
195export function cdTarget(segment: string, base: string): string | null | undefined {
196  const w = words(segment)
197  if (w.length === 0) return undefined
198  const verb = w[0].toLowerCase()
199  if (verb === 'pushd' || verb === 'popd' || verb === 'push-location' || verb === 'pop-location') return null
200  if (verb !== 'cd' && verb !== 'set-location' && verb !== 'sl' && verb !== 'chdir') return undefined
201  const args = w.slice(1).filter(a => a.toLowerCase() !== '-path' && a.toLowerCase() !== '-literalpath')
202  if (args.length !== 1) return null
203  return resolveDir(base, args[0])
204}
205
206export function resolveDir(base: string, path: string): string | null {
207  if (path === '-' || /[$~*?%]/.test(path) || path.startsWith('-')) return null
208  // Git Bash's `/d/repo` is `D:/repo`, on Windows only.
209  const drive = /^[a-zA-Z]:/.test(base) ? path.match(/^\/([a-zA-Z])(\/.*)?$/) : null
210  if (drive !== null) return `${drive[1].toUpperCase()}:${drive[2] ?? '/'}`
211  if (/^([a-zA-Z]:)?[\\/]/.test(path)) return path
212  return `${base.replace(/[\\/]+$/, '')}/${path}`
213}
214
215// `gh auth status --json hosts`, or the plain text older gh versions print.
216export function parseAccounts(output: string): Account[] {
217  try {
218    const parsed = JSON.parse(output) as { hosts?: Record<string, { login?: string, active?: boolean, state?: string, tokenSource?: string }[]> }
219    const list = parsed.hosts?.['github.com']
220    if (Array.isArray(list)) {
221      return list
222        .filter(a => typeof a.login === 'string' && LOGIN.test(a.login) && (a.state === undefined || a.state === 'success'))
223        .map(a => ({ login: a.login as string, active: a.active === true, fromEnv: /TOKEN$/.test(a.tokenSource ?? '') }))
224    }
225  } catch {
226    // Plain text below.
227  }
228  const out: Account[] = []
229  let host = ''
230  for (const line of output.split(/\r?\n/)) {
231    if (/^\S/.test(line)) host = line.trim()
232    const m = line.match(/Logged in to (\S+) account (\S+)(?: \((\S+)\))?/)
233    if (m !== null) {
234      if (m[1] === 'github.com' && LOGIN.test(m[2])) out.push({ login: m[2], active: false, fromEnv: /TOKEN$/.test(m[3] ?? '') })
235      continue
236    }
237    if (host === 'github.com' && /Active account: true/.test(line) && out.length > 0) out[out.length - 1].active = true
238  }
239  return out
240}
241
242// The account for an owner: the one whose login is the owner, else the one
243// account that is a member of it. `orgs` absent checks the login alone; any
244// account's orgs unknown means no answer.
245export function pickAccount(owner: string, accounts: readonly Account[], orgs?: Readonly<Record<string, readonly string[] | undefined>>): string | undefined {
246  const lower = owner.toLowerCase()
247  const self = accounts.find(a => a.login.toLowerCase() === lower)
248  if (self !== undefined) return self.login
249  if (orgs === undefined || accounts.some(a => orgs[a.login] === undefined)) return undefined
250  const members = accounts.filter(a => orgs[a.login]?.some(o => o.toLowerCase() === lower))
251  return members.length === 1 ? members[0].login : undefined
252}
253
254// The step run as `account`; git also asks gh for the credential.
255export function rewriteStep(segment: string, kind: 'git' | 'gh', account: string, shell: string): string {
256  const lead = segment.match(/^\s*/)?.[0] ?? ''
257  const trail = segment.match(/\s*$/)?.[0] ?? ''
258  let body = segment.slice(lead.length, segment.length - trail.length)
259  if (kind === 'git') body = `git ${CREDENTIAL}${body.slice(3)}`
260  if (shell === 'PowerShell') {
261    return `${lead}$ghAccountPrev = $env:GH_TOKEN; try { $env:GH_TOKEN = (gh auth token --user ${account}); ${body} } finally { $env:GH_TOKEN = $ghAccountPrev }${trail}`
262  }
263  return `${lead}GH_TOKEN="$(gh auth token --user ${account})" ${body}${trail}`
264}
265
266// Commands this mod leaves whole: a token already chosen, or shell syntax
267// (subshells, substitutions, blocks) where steps and folders cannot be read exactly.
268export function untouchable(command: string, shell: string): boolean {
269  if (/GH_TOKEN|GITHUB_TOKEN|GH_ENTERPRISE_TOKEN/.test(command)) return true
270  const bare = unquoted(command)
271  return shell === 'PowerShell' ? /[{}()`]/.test(bare) : /[()`{}]|\$\(/.test(bare)
272}
273
274type Remote = { name: string, fetch?: string, push?: string }
275
276export function parseRemotes(output: string): Remote[] {
277  const byName = new Map<string, Remote>()
278  for (const line of output.split(/\r?\n/)) {
279    const m = line.match(/^(\S+)\s+(\S+)\s+\((fetch|push)\)$/)
280    if (m === null) continue
281    const remote = byName.get(m[1]) ?? { name: m[1] }
282    remote[m[3] as 'fetch' | 'push'] = m[2]
283    byName.set(m[1], remote)
284  }
285  return [...byName.values()]
286}
287
288// The owner a step reaches from the folder's remotes: the named remote, or
289// every remote when none is named, and then only if they all agree.
290export function remoteOwner(step: Step, remotes: readonly Remote[]): Owner | undefined {
291  const urlOf = (r: Remote) => (step.sub === 'push' ? r.push ?? r.fetch : r.fetch ?? r.push)
292  if (step.remote !== undefined) {
293    const r = remotes.find(x => x.name === step.remote)
294    const url = r === undefined ? undefined : urlOf(r)
295    return url === undefined ? undefined : githubOwner(url)
296  }
297  const owners = remotes.map(r => {
298    const url = urlOf(r)
299    return url === undefined ? undefined : githubOwner(url)
300  })
301  if (owners.length === 0 || owners.some(o => o === undefined)) return undefined
302  const first = owners[0] as Owner
303  const same = owners.every(o => o!.owner.toLowerCase() === first.owner.toLowerCase() && o!.https === first.https)
304  return same ? first : undefined
305}
306
307export function describeMap(map: Readonly<Record<string, string>>): string {
308  const pairs = Object.entries(map).sort(([a], [b]) => a.localeCompare(b))
309  if (pairs.length === 0) return 'gh-account: nothing learned yet'
310  return `gh-account: ${pairs.map(([owner, account]) => `${owner} -> ${account}`).join(', ')}`
311}
312
313export function describeSent(sent: ReadonlyMap<string, number>): string {
314  return [...sent].map(([account, n]) => `${n} ${n === 1 ? 'command' : 'commands'} sent as ${account}`).join(' · ')
315}
316
317const STORE_KEY = 'owners'
318
319// What one session has read: accounts, remotes per folder, orgs per account,
320// owners no account matched, and how many commands went out as whom.
321type State = {
322  accounts?: Promise<Account[]>
323  remotes: Map<string, Promise<Remote[] | undefined>>
324  orgs: Map<string, Promise<string[] | undefined>>
325  misses: Set<string>
326  sent: Map<string, number>
327}
328
329function run($: EngineInterface, argv: string[], init: { cwd?: string, env?: Record<string, string> } = {}) {
330  return $.process.run(argv, { ...init, timeoutMs: 15_000 }).catch(() => ({ exitCode: 1, stdout: '', stderr: '' }))
331}
332
333function listAccounts($: EngineInterface, state: State): Promise<Account[]> {
334  state.accounts ??= (async () => {
335    const json = await run($, ['gh', 'auth', 'status', '--json', 'hosts'])
336    if (json.exitCode === 0) {
337      const found = parseAccounts(json.stdout)
338      if (found.length > 0) return found
339    }
340    const text = await run($, ['gh', 'auth', 'status'])
341    return parseAccounts(`${text.stdout}\n${text.stderr}`)
342  })()
343  return state.accounts
344}
345
346function remotesOf($: EngineInterface, state: State, dir: string): Promise<Remote[] | undefined> {
347  let found = state.remotes.get(dir)
348  if (found === undefined) {
349    found = run($, ['git', 'remote', '-v'], { cwd: dir }).then(r => (r.exitCode === 0 ? parseRemotes(r.stdout) : undefined))
350    state.remotes.set(dir, found)
351  }
352  return found
353}
354
355// The token stays inside this call: handed to `gh api` as its environment only.
356function orgsOf($: EngineInterface, state: State, login: string): Promise<string[] | undefined> {
357  let found = state.orgs.get(login)
358  if (found === undefined) {
359    found = (async () => {
360      const token = await run($, ['gh', 'auth', 'token', '--user', login])
361      const value = token.stdout.trim()
362      if (token.exitCode !== 0 || value === '') return undefined
363      const listed = await run($, ['gh', 'api', 'user/orgs', '--paginate', '--jq', '.[].login'], { env: { GH_TOKEN: value } })
364      return listed.exitCode === 0 ? listed.stdout.split(/\r?\n/).map(s => s.trim()).filter(Boolean) : undefined
365    })()
366    state.orgs.set(login, found)
367  }
368  return found
369}
370
371async function learned($: EngineInterface): Promise<Record<string, string>> {
372  return ((await $.store.get(STORE_KEY)) ?? {}) as Record<string, string>
373}
374
375// The login match first, then an owner learned in an earlier session (still
376// logged in), then the org lists; the answer is kept in the store.
377async function accountFor($: EngineInterface, state: State, owner: string, list: Account[]): Promise<string | undefined> {
378  const key = owner.toLowerCase()
379  let chosen = pickAccount(owner, list)
380  const map = await learned($)
381  if (chosen === undefined && map[key] !== undefined && list.some(a => a.login === map[key])) chosen = map[key]
382  if (chosen === undefined && !state.misses.has(key)) {
383    const known: Record<string, string[] | undefined> = {}
384    for (const a of list) known[a.login] = await orgsOf($, state, a.login)
385    chosen = pickAccount(owner, list, known)
386  }
387  if (chosen === undefined) {
388    state.misses.add(key)
389    return undefined
390  }
391  if (map[key] !== chosen) await $.store.set(STORE_KEY, { ...map, [key]: chosen })
392  return chosen
393}
394
395async function rewriteCommand($: EngineInterface, state: State, command: string, shell: string): Promise<{ command: string, account: string } | undefined> {
396  if (untouchable(command, shell)) return undefined
397  const parts = segments(command)
398  if (parts === undefined) return undefined
399
400  let cwd: string | undefined
401  let dir: string | null | undefined
402  let list: Account[] | undefined
403  let account: string | undefined
404
405  for (let i = 0; i < parts.length; i += 2) {
406    const part = parts[i]
407    const body = part.trimStart()
408    const base = dir === undefined ? (cwd ??= await $.session.cwd()) : dir
409    if (base !== null) {
410      const moved = cdTarget(body, base)
411      if (moved !== undefined) {
412        dir = moved
413        continue
414      }
415    } else if (cdTarget(body, '.') !== undefined) continue
416
417    const step = parseStep(body)
418    if (step === undefined) continue
419
420    let owner: Owner | undefined
421    if (step.named !== undefined) owner = step.named ?? undefined
422    else if (base !== null) {
423      const where = step.dir === undefined ? base : resolveDir(base, step.dir)
424      const found = where === null ? undefined : await remotesOf($, state, where)
425      owner = found === undefined ? undefined : remoteOwner(step, found)
426    }
427    if (owner === undefined || (step.kind === 'git' && !owner.https)) continue
428
429    list ??= await listAccounts($, state)
430    if (list.length === 0 || list.some(a => a.fromEnv)) return undefined
431    const chosen = await accountFor($, state, owner.owner, list)
432    if (chosen === undefined || list.find(a => a.active)?.login === chosen) continue
433
434    parts[i] = rewriteStep(part, step.kind, chosen, shell)
435    account = chosen
436  }
437
438  return account !== undefined ? { command: parts.join(''), account } : undefined
439}
440
441export const register: Register = on => {
442  const state: State = { remotes: new Map(), orgs: new Map(), misses: new Set(), sent: new Map() }
443
444  on('session.start', async ($, e, next) => {
445    state.accounts = undefined
446    state.remotes.clear()
447    state.orgs.clear()
448    state.misses.clear()
449    state.sent.clear()
450    await $.command.register({
451      name: 'gh-account',
452      description: 'gh-account: /gh-account shows which account each GitHub owner uses · forget clears it',
453    })
454    return next(e)
455  })
456
457  on('tool.call', async ($, e, next) => {
458    if (!SHELLS.has(e.tool) || typeof e.command !== 'string') return next(e)
459    const command = e.command
460
461    const changed = await rewriteCommand($, state, command, e.tool).catch(() => undefined)
462    const ran = await next(changed === undefined ? e : { ...e, command: changed.command })
463
464    // An account switch, login or logout, or a remote added or moved: read them again.
465    if (/\bgh\s+auth\s+(switch|login|logout|refresh)\b/.test(command)) {
466      state.accounts = undefined
467      state.orgs.clear()
468      state.misses.clear()
469    }
470    if (/\bgit\b[^;&|\n]*\b(remote|clone|init)\b/.test(command)) state.remotes.clear()
471
472    if (changed !== undefined && ran.deny === undefined) {
473      state.sent.set(changed.account, (state.sent.get(changed.account) ?? 0) + 1)
474      $.ui.status(describeSent(state.sent))
475    }
476    return ran
477  })
478
479  // Answered as a toast: nothing is added to the conversation.
480  on('command.run', { command: 'gh-account' }, async ($, e) => {
481    const args = (e.args ?? '').trim()
482    if (args === '') {
483      $.ui.toast(describeMap(await learned($)))
484      return {}
485    }
486    if (args === 'forget') {
487      const count = Object.keys(await learned($)).length
488      await $.store.delete(STORE_KEY)
489      state.orgs.clear()
490      state.misses.clear()
491      $.ui.toast(`gh-account: forgot ${count} ${count === 1 ? 'owner' : 'owners'}`)
492      return {}
493    }
494    $.ui.toast('gh-account: use /gh-account to list, /gh-account forget to clear')
495    return {}
496  })
497}
498