stack

mosaicstack/stack

Fork 0

Author	SHA1	Message	Date
mosaic-coder	4b472a2242	fix(tools/git): restore executable bit on new per-agent-identity scripts All checks were successful ci/woodpecker/pr/ci Pipeline was successful Details core.filemode=false in this worktree meant the initial commit recorded git-credential-mosaic, test-git-credential-mosaic.sh, and test-gitea-token-identity.sh as 100644. git invokes a path-configured credential.helper directly (exec, not `sh <path>`), so git-credential-mosaic must carry the executable bit; the two test scripts match the 100755 convention already used by the other test-*.sh harnesses in this directory. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-23 12:54:46 -05:00
mosaic-coder	9d7038d325	feat(tools/git): per-agent Gitea identity (git-credential-mosaic + get_gitea_token) Adds an opt-in per-agent Gitea identity so a fleet agent can push/commit/open PRs under its own token instead of the single shared account, giving cryptographic author-!=-reviewer separation (Gate-16). Resolution priority (both tools): MOSAIC_GIT_IDENTITY env > git config mosaic.gitIdentity (per-worktree, persists on disk) > git-supplied username (git-credential-mosaic only). If the resolved identity has a token file at ~/.config/mosaic/secrets/gitea-tokens/gitea-{usc,mosaicstack}-<id>.token, that identity is used; otherwise both tools fall through to the existing shared-account path unchanged, so this is a no-op on any host without per-slot tokens configured. - tools/git/git-credential-mosaic: new git credential helper (get verb). - tools/git/detect-platform.sh: get_gitea_token() gains the same identity resolution, prepended ahead of the existing shared-token logic, so API tooling (pr-create.sh, issue-create.sh, ...) authors under the same identity as git push/fetch. - install.sh: explicit chmod +x for git-credential-mosaic (it ships without a .sh suffix, so the existing .sh glob does not cover it); tools/* is already framework-owned so the file syncs automatically. - tools/git/README.md: documents the feature, the one-time `git config credential.helper` registration step (deliberately not auto-wired — see README for why), and the PowerShell-parity decision (detect-platform.ps1 authenticates via tea logins, not a raw-token function, so there is nothing to port there). - tools/git/test-git-credential-mosaic.sh, tools/git/test-gitea-token-identity.sh: new regression harnesses (red verified against the pre-patch code) covering identity-resolution priority, per-host token path selection, and shared-account fallback. Wired into package.json's test:framework-shell. Upstreams Mos host-local tooling-patch kit (2026-07-23), Patches 1+2. Closes #873 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-23 12:54:45 -05:00

Author

SHA1

Message

Date

mosaic-coder

4b472a2242

fix(tools/git): restore executable bit on new per-agent-identity scripts

ci/woodpecker/pr/ci Pipeline was successful

Details

core.filemode=false in this worktree meant the initial commit recorded
git-credential-mosaic, test-git-credential-mosaic.sh, and
test-gitea-token-identity.sh as 100644. git invokes a path-configured
credential.helper directly (exec, not `sh <path>`), so git-credential-mosaic
must carry the executable bit; the two test scripts match the 100755
convention already used by the other test-*.sh harnesses in this directory.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-23 12:54:46 -05:00

mosaic-coder

9d7038d325

feat(tools/git): per-agent Gitea identity (git-credential-mosaic + get_gitea_token)

Adds an opt-in per-agent Gitea identity so a fleet agent can push/commit/open
PRs under its own token instead of the single shared account, giving
cryptographic author-!=-reviewer separation (Gate-16).

Resolution priority (both tools): MOSAIC_GIT_IDENTITY env > git config
mosaic.gitIdentity (per-worktree, persists on disk) > git-supplied username
(git-credential-mosaic only). If the resolved identity has a token file at
~/.config/mosaic/secrets/gitea-tokens/gitea-{usc,mosaicstack}-<id>.token, that
identity is used; otherwise both tools fall through to the existing
shared-account path unchanged, so this is a no-op on any host without
per-slot tokens configured.

- tools/git/git-credential-mosaic: new git credential helper (get verb).
- tools/git/detect-platform.sh: get_gitea_token() gains the same identity
  resolution, prepended ahead of the existing shared-token logic, so API
  tooling (pr-create.sh, issue-create.sh, ...) authors under the same
  identity as git push/fetch.
- install.sh: explicit chmod +x for git-credential-mosaic (it ships without
  a .sh suffix, so the existing *.sh glob does not cover it); tools/** is
  already framework-owned so the file syncs automatically.
- tools/git/README.md: documents the feature, the one-time
  `git config credential.helper` registration step (deliberately not
  auto-wired — see README for why), and the PowerShell-parity decision
  (detect-platform.ps1 authenticates via tea logins, not a raw-token
  function, so there is nothing to port there).
- tools/git/test-git-credential-mosaic.sh,
  tools/git/test-gitea-token-identity.sh: new regression harnesses (red
  verified against the pre-patch code) covering identity-resolution
  priority, per-host token path selection, and shared-account fallback.
  Wired into package.json's test:framework-shell.

Upstreams Mos host-local tooling-patch kit (2026-07-23), Patches 1+2.

Closes #873

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-23 12:54:45 -05:00

Compare commits

2 Commits

f068a54a8d ... 4b472a2242

Diff Content Not Available

Compare commits

2 Commits f068a54a8d ... 4b472a2242

Diff Content Not Available

2 Commits

f068a54a8d ... 4b472a2242