From 9682de89b587a00e5ea2c5dcce622d7fd87d88aa Mon Sep 17 00:00:00 2001
From: Joel Teply <joel@cambriantech.com>
Date: Tue, 28 Apr 2026 00:38:54 -0500
Subject: [PATCH] fix(install.sh): auto-run 'gh auth setup-git' so gist ops
 don't prompt

Joel hit this on 2026-04-28 -- Windows install with gh authenticated
in keyring (gh auth status: Logged in to github.com), but every git
operation against gist.github.com triggered a GUI password popup.
Repeating, every airc op that touched a gist fired a fresh prompt.

Cause: gh auth login stores its token in keyring/credman, but does
NOT automatically register itself as git's credential helper. So git
itself doesn't know how to use gh's token -- it falls back to
asking the user for a password on every HTTPS push/fetch.

The official one-liner is `gh auth setup-git`, which registers
`gh auth git-credential` as the credential helper for github.com URLs
in ~/.gitconfig. After this, git sees an HTTPS github.com URL,
delegates auth to gh, gh hands back the token from its store, no
prompt. Microsoft-supported, idempotent, ships with gh CLI itself.

This goes in ensure_prereqs right after the gh-auth-status check, so
fresh installs get it automatically. Skipped if already configured
(idempotency check via `git config --get-all credential.https://github.com.helper | grep gh`).
---
 install.sh | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/install.sh b/install.sh
index 3738721..ca3665f 100755
--- a/install.sh
+++ b/install.sh
@@ -758,6 +758,21 @@ ensure_prereqs() {
     if ! gh auth status >/dev/null 2>&1; then
       warn "gh CLI is not authenticated. Run once before 'airc join':"
       warn "    gh auth login -s gist"
+    else
+      # Wire gh's token into git's credential helper. Without this,
+      # every git-over-HTTPS op (gist fetch/push -- airc's substrate
+      # hot path) prompts the user for a password, repeatedly. gh ships
+      # with `gh auth git-credential` for exactly this purpose; the
+      # `gh auth setup-git` one-liner registers it in ~/.gitconfig.
+      # Idempotent (no-op if already configured), safe to always run.
+      # Joel hit this on 2026-04-28 — Windows install where gh was
+      # auth'd-in-keyring but git itself didn't know. Resulted in a
+      # GUI password popup every airc operation that touched a gist.
+      if ! git config --global --get-all credential.https://github.com.helper 2>/dev/null | grep -q 'gh auth git-credential'; then
+        if gh auth setup-git 2>/dev/null; then
+          info "  gh token wired into git credential helper (no more password popups for gist ops)"
+        fi
+      fi
     fi
   fi
 }