Worktree verbs, single sign-on URL, and OAuth device flow

[matt-edmondson]

Three additive capabilities a consuming desktop launcher needs and this library did not have. No existing member changes shape, and no existing behaviour changes for a caller that does not opt in.

Changed since first opened. This branch originally also added a GitHubOwnerKind property for routing repository enumeration. While it was in flight, #115 solved the same problem by inferring the owner's type from GET /users/{login} instead of taking an explicit kind from the caller. Ours has been dropped in favour of upstream's, which handles cases ours did not: an unauthenticated provider skips the probes, a GitHub App installation token whose GET /user answers 403 falls back to the public route, and it deliberately avoids inferring from a 404 because an organisation enforcing SSO also answers 404. origin/main is merged in and the enumeration code here is upstream's.

Worktree verbs

Worktrees(), AddWorktree(path), RemoveWorktree(path) and PruneWorktrees() on GitRepository, with a GitWorktree model and a parser for git worktree list --porcelain. The library previously had no worktree verb at all — GitProbes.IsWorkTreeAsync asks whether a path is a working tree and GitStatusEntry.WorkTreeState names half a status code, but neither creates, lists, or removes anything.

GitWorktree.IsMain is positional: git's porcelain has no attribute for it, the main working tree is simply the first record. It exists so a caller can refuse to remove the worktree that owns the repository.

CheckingOut and From write the same <commit-ish> operand, so they are one field under two names and the later call wins — the same last-call-wins rule that governs the four mode settings, matching IGitBranchListBuilder's existing LocalOnly/RemoteOnly.

Deliberately out of scope: worktree move, lock and unlock, and --dry-run on prune.

Single sign-on authorisation URL

A 403 carrying X-GitHub-SSO now surfaces the authorisation URL in the exception message. Previously a token one click away from working was indistinguishable from a bad one, and the fix was a link the caller could not see.

The header is read case-insensitively by scanning rather than by keyed lookup, matching how TryGetRetryAfterSeconds already reads Retry-After and for the same reason. The URL is only ever appended — a 403 without the header produces exactly the exception it produced before, and the arm ordering in Translate is untouched.

This reaches all three of Translate's call sites, so pull request listing and creation benefit from it as well as enumeration.

OAuth device flow

GitHubDeviceFlow obtains a credential rather than only resolving one. Two calls rather than one, because the pause between them is minutes long and the user code must stay on screen throughout; a single call taking a callback would fire it from an HTTP continuation and force every graphical caller to marshal back to a UI thread. It stores nothing — the caller decides where the secret lives.

Built on a raw HttpClient rather than Octokit's OauthClient. Two problems turned up empirically: InitiateDeviceFlow percent-encodes the scope colon, and CreateAccessTokenForDeviceFlow throws ApiException for an OAuth error body instead of returning it — collapsing a refused authorisation and an expired code into the same shape a transport failure gets, which is precisely the distinction this feature exists to make. It mirrors AzureDevOpsProvider, which already talks raw HttpClient with a source-generated JsonSerializerContext. The design document records the reasoning.

GitHubDeviceCode carries both UserCode (shown to a person) and DeviceCode (sent in the poll). They are not interchangeable.

The poll loop enforces a monotonic expiry deadline from ExpiresIn and a five-second interval floor — an interval of 0 off the wire would otherwise busy-loop against github.com. Error codes are split deliberately: access_denied and expired_token are authentication failures, while incorrect_client_credentials, unsupported_grant_type and device_flow_disabled are request failures, so a deleted client ID surfaces as a configuration fault rather than looping a user through a sign-in that can never succeed.

Not yet verified end to end

No GitHub OAuth App exists for this yet, so every device-flow test runs against a fake transport. Registering one — device flow enabled, SSO-approved, scopes repo and read:org — is what remains before the flow can be confirmed against the real service.

One further note: these two endpoints accept a JSON request body although GitHub's documentation shows form encoding. That is relied upon and recorded in the type's remarks.

Testing

668 passing, 0 failing. Build clean on net10.0 and net9.0, zero warnings, and no [SuppressMessage] added anywhere in GitIntegration/.

Device-flow tests inject the delay and clock, so the suite exercises the poll loop's wait, cumulative slow_down widening, expiry and cancellation without sleeping.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
70 New issues
0 Accepted issues

Measures
0 Security Hotspots
96.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud