refactor: add git-credentials route and gh env plugin, pass internal token to OpenCode

Author: chriswritescode-dev

backend/src/routes/internal/git-credentials.ts

@@ -0,0 +1,14 @@
+import { Hono } from 'hono'
+import type { Database } from 'bun:sqlite'
+import { CredentialProvider } from '../../services/credential-provider'
+
+export function createInternalGitCredentialsRoutes(db: Database) {
+  const app = new Hono()
+
+  app.get('/gh-env', (c) => {
+    const provider = new CredentialProvider(db)
+    return c.json(provider.getGhCliEnv())
+  })
+
+  return app
+}

backend/src/routes/internal/index.ts

@@ -13,6 +13,7 @@ import { createInternalRepoSyncRoutes } from './repo-sync'
 import { createInternalRepoMirrorRoutes as mirrorRoutes } from './repo-mirror'
 import { createInternalOpenCodeWorkspacesRoutes } from './opencode-workspaces'
 import { createInternalAssistantRoutes } from './assistant'
+import { createInternalGitCredentialsRoutes } from './git-credentials'
 
 export function createInternalRoutes(
   db: Database,
@@ -34,5 +35,6 @@ export function createInternalRoutes(
   app.route('/repos', repos)
   app.route('/opencode-workspaces', createInternalOpenCodeWorkspacesRoutes(db))
   app.route('/assistant', createInternalAssistantRoutes(openCodeClient))
+  app.route('/git-credentials', createInternalGitCredentialsRoutes(db))
   return app
 }

backend/src/services/credential-provider.ts

@@ -4,7 +4,6 @@ import { SettingsService } from './settings'
 import {
   findPatCredentialForHost,
   getSSHCredentialsForHost,
-  findGitHubCredential,
   createGhCliEnv,
   type ResolvedGitCredential,
 } from '../utils/git-auth'
@@ -29,10 +28,6 @@ export class CredentialProvider {
     return getSSHCredentialsForHost(this.getGitCredentials(), host)
   }
 
-  getGitHubCredential(): GitCredential | null {
-    return findGitHubCredential(this.getGitCredentials())
-  }
-
   getGhCliEnv(): Record<string, string> {
     return createGhCliEnv(this.getGitCredentials())
   }

backend/src/services/git-auth.ts

@@ -177,8 +177,6 @@ export class GitAuthService {
       }
     }
 
-    Object.assign(env, this.credentialProvider?.getGhCliEnv() || {})
-
     return env
   }
 }

backend/src/services/opencode-gh-env-plugin.ts

@@ -0,0 +1,51 @@
+import { promises as fs } from 'fs'
+import path from 'path'
+import { logger } from '../utils/logger'
+
+const PLUGIN_FILENAME = 'ocm-gh-env.js'
+
+const PLUGIN_SOURCE = `const TTL_MS = 5000
+let cache = { expiry: 0, env: {} }
+
+async function fetchGhEnv() {
+  const baseUrl = process.env.OCM_INTERNAL_API_URL
+  const token = process.env.OCM_INTERNAL_TOKEN
+  if (!baseUrl || !token) return {}
+  const now = Date.now()
+  if (now < cache.expiry) return cache.env
+  try {
+    const res = await fetch(baseUrl + '/git-credentials/gh-env', {
+      headers: { Authorization: 'Bearer ' + token },
+    })
+    if (!res.ok) return cache.env
+    const env = await res.json()
+    cache = { expiry: now + TTL_MS, env: env && typeof env === 'object' ? env : {} }
+    return cache.env
+  } catch {
+    return cache.env
+  }
+}
+
+export default async function () {
+  return {
+    'shell.env': async (_input, output) => {
+      const env = await fetchGhEnv()
+      Object.assign(output.env, env)
+    },
+  }
+}
+`
+
+export function getGhEnvPluginDir(configHome: string): string {
+  return path.join(configHome, 'opencode', 'plugin')
+}
+
+export async function installGhEnvPlugin(configHome: string): Promise<void> {
+  try {
+    const dir = getGhEnvPluginDir(configHome)
+    await fs.mkdir(dir, { recursive: true })
+    await fs.writeFile(path.join(dir, PLUGIN_FILENAME), PLUGIN_SOURCE, 'utf-8')
+  } catch (error) {
+    logger.warn('Failed to install gh-env OpenCode plugin:', error)
+  }
+}

backend/src/services/opencode-single-server.ts

@@ -2,7 +2,7 @@ import { spawn, execSync, spawnSync } from 'child_process'
 import path from 'path'
 import { promises as fs } from 'fs'
 import { logger } from '../utils/logger'
-import { createGitEnv, createGitIdentityEnv, createGhCliEnv, resolveGitIdentity } from '../utils/git-auth'
+import { createGitEnv, createGitIdentityEnv, resolveGitIdentity } from '../utils/git-auth'
 import type { GitCredential } from '@opencode-manager/shared'
 import {
   buildSSHCommandWithKnownHosts,
@@ -24,6 +24,8 @@ import { compareVersions } from '../utils/version-utils'
 import { patchConfigWithRecovery } from './opencode/config-recovery'
 import type { OpenCodeClient } from './opencode/client'
 import { writeFileContent } from './file-operations'
+import { getOrCreateInternalToken } from './internal-token'
+import { installGhEnvPlugin } from './opencode-gh-env-plugin'
 
 
 const MIN_OPENCODE_VERSION = '1.0.137'
@@ -327,6 +329,7 @@ class OpenCodeServerManager {
     logger.info(`OpenCode server GIT_SSH_COMMAND: ${gitSshCommand}`)
 
     await this.initializeOpencodeBinDirectory()
+    await installGhEnvPlugin(path.join(openCodeServerDirectory, '.config'))
     const configuredPlugins = await this.getConfiguredPlugins(openCodeConfigPath)
     await this.installConfiguredPlugins(configuredPlugins)
     const configuredPluginCount = configuredPlugins.length
@@ -351,8 +354,13 @@ class OpenCodeServerManager {
           ...cleanEnv,
           ...userEnvVars,
           ...gitEnv,
-          ...createGhCliEnv(gitCredentials),
           ...gitIdentityEnv,
+          ...(this.db
+            ? {
+              OCM_INTERNAL_API_URL: `http://localhost:${ENV.SERVER.PORT}/api/internal`,
+              OCM_INTERNAL_TOKEN: getOrCreateInternalToken(this.db),
+            }
+            : {}),
           GIT_SSH_COMMAND: gitSshCommand,
           XDG_DATA_HOME: path.join(openCodeServerDirectory, '.opencode/state'),
           XDG_STATE_HOME: path.join(openCodeServerDirectory, '.opencode/state'),

backend/test/routes/internal/git-credentials.test.ts

@@ -0,0 +1,40 @@
+import { describe, it, expect, beforeEach } from 'vitest'
+import { Database } from 'bun:sqlite'
+import { migrate } from '../../../src/db/migration-runner'
+import { allMigrations } from '../../../src/db/migrations'
+import { SettingsService } from '../../../src/services/settings'
+import { createInternalGitCredentialsRoutes } from '../../../src/routes/internal/git-credentials'
+import type { GitCredential } from '@opencode-manager/shared'
+
+describe('internal git-credentials routes', () => {
+  let db: Database
+  let settingsService: SettingsService
+  let app: ReturnType<typeof createInternalGitCredentialsRoutes>
+
+  beforeEach(() => {
+    db = new Database(':memory:')
+    migrate(db, allMigrations)
+    settingsService = new SettingsService(db)
+    app = createInternalGitCredentialsRoutes(db)
+  })
+
+  it('GET /gh-env returns GH_TOKEN and GITHUB_TOKEN for a GitHub PAT', async () => {
+    settingsService.updateSettings({
+      gitCredentials: [
+        { name: 'github', host: 'github.com', type: 'pat', token: 'ghp_test_token' } as GitCredential,
+      ],
+    })
+
+    const res = await app.request('/gh-env')
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ GH_TOKEN: 'ghp_test_token', GITHUB_TOKEN: 'ghp_test_token' })
+  })
+
+  it('GET /gh-env returns an empty object when no GitHub credential exists', async () => {
+    const res = await app.request('/gh-env')
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({})
+  })
+})

backend/test/services/credential-provider.test.ts

@@ -72,18 +72,6 @@ describe('CredentialProvider', () => {
     it('getSshCredentialsForHost returns empty array for unmatched host', () => {
       expect(provider.getSshCredentialsForHost('gitlab.com')).toEqual([])
     })
-
-    it('getGitHubCredential returns the GitHub PAT', () => {
-      const cred = provider.getGitHubCredential()
-      expect(cred).not.toBeNull()
-      expect(cred!.host).toBe('github.com')
-      expect(cred!.token).toBe('ghp_test_token')
-    })
-
-    it('getGitHubCredential excludes SSH credentials', () => {
-      const cred = provider.getGitHubCredential()
-      expect(cred!.type).not.toBe('ssh')
-    })
   })
 
   describe('with no credentials', () => {
@@ -98,10 +86,6 @@ describe('CredentialProvider', () => {
     it('getSshCredentialsForHost returns empty array', () => {
       expect(provider.getSshCredentialsForHost('github.com')).toEqual([])
     })
-
-    it('getGitHubCredential returns null', () => {
-      expect(provider.getGitHubCredential()).toBeNull()
-    })
   })
 
   describe('getGitCredentials', () => {

backend/test/services/git-auth.integration.test.ts

@@ -108,7 +108,6 @@ vi.mock('../../src/services/credential-provider', () => ({
     getGhCliEnv: vi.fn().mockReturnValue({}),
     getSshCredentialsForHost: vi.fn().mockReturnValue([]),
     getPatCredentialForHost: vi.fn().mockReturnValue(null),
-    getGitHubCredential: vi.fn().mockReturnValue(null),
     getGitCredentials: vi.fn().mockReturnValue([]),
   })),
 }))
@@ -302,27 +301,6 @@ describe('GitAuthService with passphrase support', () => {
     })
   })
 
-  describe('getGitEnvironment', () => {
-    it('includes GH_TOKEN and GITHUB_TOKEN when a GitHub PAT is configured', () => {
-      const mockProvider = gitAuthService['credentialProvider']!
-      vi.mocked(mockProvider.getGhCliEnv).mockReturnValue({
-        GH_TOKEN: 'ghp_test_token',
-        GITHUB_TOKEN: 'ghp_test_token',
-      })
-
-      const env = gitAuthService.getGitEnvironment()
-
-      expect(env.GH_TOKEN).toBe('ghp_test_token')
-      expect(env.GITHUB_TOKEN).toBe('ghp_test_token')
-    })
-
-    it('does not include GH_TOKEN when no GitHub credential is available', () => {
-      const env = gitAuthService.getGitEnvironment()
-      expect(env.GH_TOKEN).toBeUndefined()
-      expect(env.GITHUB_TOKEN).toBeUndefined()
-    })
-  })
-
   describe('integration with passphrase-protected keys', () => {
     it('properly handles full SSH key lifecycle with passphrase', async () => {
       const privateKey = '-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\nQyNTUxOQAAACBmNkCQ0YDZiVJmHqMvK1PqjWxV4aRqK2Pm8RlV4aRqK2Pm8RlV4aRqK2Pm8RlV4\naRqK2Pm8RlV4aRqK2Pm8RlV4aRqK2Pm8RlV4aAAAAgBmNkCQ0YDZiVJmHqMvK1PqjWxV4aRqK2Pm8RlV4\naRqK2Pm8RlV4aRqK2Pm8RlV4aRqK2Pm8RlV4aAAAADHN0cmluZy1rZXktdGVzdAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4v\nMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWpr\nbG1ub3BxcnN0dXZ3eHl6e3x9fn+AgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaan\nqKmqq6ytrq+wsbKztLW2t7i5uru8vb6/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t/g4eLj\n5OXm5+jp6uvs7e7v8PHy8/T19vf4+fr7/P3+/w==\n-----END OPENSSH PRIVATE KEY-----'