fix(dashboard): pass -R repo to gh commands so multi-remote setups work#169
Merged
Conversation
When a fork adds upstream as a second remote (recommended by README's two-repo strategy), `gh secret list/set/delete` errors with "multiple remotes detected" because it can't pick a default repo. The auth and secrets API routes invoked gh without -R, so authentication and secret management both broke as soon as upstream was added. Both routes now resolve the active repo via `gh repo set-default --view` (falls back to `gh repo view`) and pass it explicitly via -R.
3 tasks
Both routes share the same ghRepo/ghArgsRepo pattern now — strip the shell-string ghRepoFlag() from auth and switch its three gh invocations to execFileSync. Also drop the unused listSecrets shell branch in secrets. Behaviour-identical; just kills the inconsistency between the two routes. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
aaronjmars
added a commit
that referenced
this pull request
May 17, 2026
…ps work (#178) #169 fixed gh secret/auth invocations under multi-remote setups (forks with upstream added as a second remote) but missed the three other API routes that shell out to gh — `runs/route.ts`, `runs/[id]/logs/route.ts`, and `analytics/route.ts` all call `gh run list` / `gh run view` without -R. Same "multiple remotes detected" error, same fix. Each route now resolves the active repo via `gh repo set-default --view` (falls back to `gh repo view`) and passes it explicitly via -R. Also switches the three call sites to execFileSync + array form to match the hardening pattern from #150/#158/#169 — id is already validated to digits in the logs route so it wasn't a shell-injection risk, but the array form keeps the codebase consistent. Helper duplicated inline (3 copies) rather than extracted, matching the established pattern from #169 which kept ghRepo/ghArgsRepo local to each route. A future refactor can DRY them up across all five.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Split of #167 — dashboard fix only. Sync-upstream workflow lives in a separate PR.
Summary
The README recommends a two-repo strategy: run production from a private fork and add the public upstream as a second remote. As soon as
upstreamis added, the dashboard's auth and secrets API routes break:gh secret list/set/deleteerrors out because it can't pick a default repo. Auth modal and any change in the Secrets panel return HTTP 500.Fix
Both routes resolve the active repo once via
gh repo set-default --view(withgh repo view --json nameWithOwneras fallback) and pass it to everyghinvocation via-R. When only a single remote is present, the helper falls back to no flag so single-remote forks are unchanged.Files touched:
dashboard/app/api/auth/route.ts— GET (list) + POST (set) pathsdashboard/app/api/secrets/route.ts— GET (list) + POST (set) + DELETE pathsTest plan
origin+upstreamremotes, paste a token into the Auth modal → 200, secret lands.origin+upstreamremotes, set/delete custom secrets in the Secrets panel → 200, secret lands.origin, both flows still work unchanged.Credit: @traewang (original PR #167)