Add github-pat-install for the per-org PAT files - #25
Merged
Conversation
The four existing ~/.config/github-pats/<owner> tokens were created by hand.
That is fine once and error-prone thereafter: the credential helper fails
SILENTLY when a token file is missing or malformed — it exits without a token
and lets git proceed unauthenticated, which on a private repo surfaces as a 404
rather than an auth error. A typo or stray newline is indistinguishable from
"that repo doesn't exist".
So this installs one properly: hidden prompt (never an argument — argv is
visible to every user via ps), validates the token shape and rejects embedded
whitespace, writes 0600 with no trailing newline, and refuses to clobber an
existing token without confirmation.
It then verifies two separate things, because writing the file proves nothing:
1. that the credential helper chain actually resolves a token for that owner,
exercising gitconfig's useHttpPath -> helper -> file; and
2. that GitHub accepts it, reporting which account it authenticates as.
Both were exercised in a sandbox before this landed. Every refusal path was
confirmed to write nothing, the clobber prompt confirmed to leave the existing
file byte-identical, and a deliberately invalid token confirmed to FAIL check 2
— a validity check that passes for a bogus token would be worse than none.
Reads from stdin when not on a terminal, so it works piped as well as
interactively.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017XXtMcWtVAxm3BYXdxXiLW
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
~/.local/bin/github-pat-install, a one-command installer for the per-org GitHub PATs thatgit-credential-github-organd theghshim read.Why
The four existing
~/.config/github-pats/<owner>files were created by hand. The failure mode that makes that worth fixing: the credential helper fails silently. With no readable token file it exits without a credential and lets git proceed unauthenticated — which on a private repo surfaces as a 404, not an auth error. A typo, a stray newline, or a wrong filename is indistinguishable from "that repo does not exist."Written while adding a fifth org (
offerlab) for OL-3431.What it does
psgithub_pat_…/ghp_…) and rejects embedded whitespace0600, no trailing newline, lowercased filename to match the helper's owner lookupThen it verifies two separate things, because writing the file proves nothing:
credential.useHttpPath→ helper → fileVerified
Exercised in a sandbox
GITHUB_PAT_DIRwith fake tokens before this landed:../evil)NyA deliberately invalid token failed verification step 2 — a validity check that passes for a bogus token would be worse than no check at all.
CI's exact shellcheck invocations (
install.sh home/*.sh,home/dot_local/bin/*,modify_settings.json) all pass locally.chezmoi catagainst this source renders byte-identically to the already-installed live file, so applying this changes nothing on disk.🤖 Generated with Claude Code
https://claude.ai/code/session_017XXtMcWtVAxm3BYXdxXiLW