Greptile Summary

This PR adds support for richer token sources in GitLab and Forgejo backends, aligning them with the existing GitHub token resolution system. It also introduces a new mise token top-level command (with forgejo, github, gitlab subcommands) for debugging which credential mise will use for a given host.

Key changes:

• New src/tokens.rs shared module: consolidates TOML/YAML token-file parsing, credential_command execution (cached per provider:host), git credential fill integration, and token masking — eliminating duplicated code across provider modules
• forgejo.rs and gitlab.rs: each gains a 6-step prioritised resolve_token(host) function mirroring the GitHub pattern: enterprise env var → standard env vars → credential_command → *_tokens.toml → CLI tool (fj/glab) → git credential fill
• src/http.rs: github_headers renamed host_auth_headers and extended to inject Authorization headers for GitLab and Forgejo host patterns during asset downloads, HEAD requests, and text fetches
• Enterprise-token-leak fix: the MISE_FORGEJO_ENTERPRISE_TOKEN.is_some() branch was removed from is_forgejo_host (and the equivalent from is_gitlab_host), preventing tokens from being injected into requests for unrelated hosts
• mise github token hidden (hide = true) in favour of the new mise token github subcommand; no breaking change since the old path still works

Confidence Score: 5/5

Safe to merge — no new P0/P1 issues found; the enterprise-token-leak fix is correctly implemented by removing the enterprise-check from is_forgejo_host/is_gitlab_host

All remaining architectural gaps (credential_command and use_git_credentials not reflected in is_forgejo_host, so HTTP-download middleware misses those sources) were already flagged in prior review threads and represent known limitations rather than new regressions introduced here. New token resolution logic is consistent across providers and thoroughly exercised by e2e tests. Code is clean with good separation of concerns via the new tokens.rs module.

No files require special attention; src/http.rs host_auth_headers and the is_forgejo_host/is_gitlab_host gap are areas to follow up in a subsequent PR for full credential_command and git-credentials HTTP-download authentication coverage

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant User
    participant CLI as mise token forgejo [host]
    participant RT as resolve_token(host)
    participant Env as Environment Vars
    participant CC as credential_command
    participant TF as forgejo_tokens.toml
    participant FJ as fj CLI keys.json
    participant GC as git credential fill

    User->>CLI: mise token forgejo [host]
    CLI->>RT: resolve_token(host)
    RT->>Env: MISE_FORGEJO_ENTERPRISE_TOKEN (non-codeberg only)
    alt enterprise token found
        Env-->>RT: (token, EnvVar)
    else
        RT->>Env: MISE_FORGEJO_TOKEN / FORGEJO_TOKEN
        alt env token found
            Env-->>RT: (token, EnvVar)
        else
            RT->>CC: sh -c credential_command host
            alt credential_command returns token
                CC-->>RT: (token, CredentialCommand)
            else
                RT->>TF: lookup host
                alt token in toml
                    TF-->>RT: (token, TokensFile)
                else
                    RT->>FJ: lookup host in keys.json
                    alt fj CLI token found
                        FJ-->>RT: (token, FjCli)
                    else
                        RT->>GC: git credential fill
                        GC-->>RT: (token or None, GitCredential)
                    end
                end
            end
        end
    end
    RT-->>CLI: Option<(String, TokenSource)>
    CLI-->>User: host: xxxx...yyyy (source: SOURCE)

_{Reviews (15): Last reviewed commit: "Merge branch 'main' into feat/tokensourc..." | Re-trigger Greptile}

@jdx I think the github token command should rather have been the inverse token github instead, to allow for other implementations without polluting the command space too much.

I agree, I think we should hide/deprecate mise github token and create mise token github