Problem
There is an authentication asymmetry between folder-level and file-level dependency downloads:
|
Folder deps (org/repo/folder) |
File deps (org/repo/folder/file.md) |
| Mechanism |
git clone via _clone_with_fallback() |
GitHub REST API via _download_github_file() |
| Auth fallbacks |
Token → SSH → git credential helpers |
Token only |
| Private repos without PAT |
✅ Works (credential helpers) |
❌ Fails |
Users with gh auth login, macOS Keychain, or any git credential helper configured can download folder deps from private repos without setting GITHUB_APM_PAT. But targeting a single file from the same repo fails with an auth error.
This violates the principle of least surprise — if git clone works, downloading one file should also work.
Root Cause
_clone_with_fallback() (line 395-462) relaxes GIT_ASKPASS/GIT_CONFIG_* when no token is present, allowing OS credential helpers to provide auth_download_github_file() (line 675-768) uses only self.github_token (from GITHUB_APM_PAT/GITHUB_TOKEN env vars) — no SSH, no credential helper fallback
Solution
- Add
GH_TOKEN to token precedence for modules (catches gh CLI users)
- Add
git credential fill as a last-resort token resolver — the same mechanism git uses internally, platform-agnostic, cached per host
- Improve error messages to mention
gh auth login as a zero-config fix
Related: #319
Problem
There is an authentication asymmetry between folder-level and file-level dependency downloads:
org/repo/folder)org/repo/folder/file.md)git clonevia_clone_with_fallback()_download_github_file()Users with
gh auth login, macOS Keychain, or any git credential helper configured can download folder deps from private repos without settingGITHUB_APM_PAT. But targeting a single file from the same repo fails with an auth error.This violates the principle of least surprise — if
git cloneworks, downloading one file should also work.Root Cause
_clone_with_fallback()(line 395-462) relaxesGIT_ASKPASS/GIT_CONFIG_*when no token is present, allowing OS credential helpers to provide auth_download_github_file()(line 675-768) uses onlyself.github_token(fromGITHUB_APM_PAT/GITHUB_TOKENenv vars) — no SSH, no credential helper fallbackSolution
GH_TOKENto token precedence for modules (catchesghCLI users)git credential fillas a last-resort token resolver — the same mechanism git uses internally, platform-agnostic, cached per hostgh auth loginas a zero-config fixRelated: #319