🔑 feat: Broker GitHub CLI Authentication

[danny-avila]

Summary

I extended the native BYOM GitHub App credential broker so GitHub CLI operations can create pull requests and use the GitHub API without exposing installation tokens inside the sandbox.

• Provide GH_TOKEN for GitHub.com and GH_ENTERPRISE_TOKEN plus GH_HOST for GitHub Enterprise Server through SRT masked-environment sentinels.
• Restrict secret substitution to the configured GitHub API host while retaining the separate Git-over-HTTPS boundary.
• Preserve the existing exported Git credential helper contract by adding a dedicated command-sandbox credential bundle.
• Document GitHub CLI support and the credential boundary.
• Verify the flow live by creating ⚗️ refactor: Separate Content, Tool, and Agent Types From the Assistants Module danny-avila/LibreChat#15910 as app/lia-by-librechat from a BYOM Skynet worker.

Change Type

• New feature (non-breaking change which adds functionality)

Testing

• npm run build
• node --test --test-name-pattern=GitHub|credential|enterprise\ host dist/github.test.js dist/native-sandbox.test.js dist/cli.test.js
• Live BYOM GitHub App test: git push, gh pr create, and gh pr view through the SRT credential proxy

Test Configuration

• Node.js 24
• Linux Skynet worker using native-srt
• GitHub App installed on selected repositories only

Checklist

• My code adheres to this project style
• I have performed a self-review of my own code
• I have made pertinent documentation changes
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective
• Local focused tests pass with my changes

[danny-avila]

@codex review

Please review the current PR head 2ad6d7d. Confirm that this exact commit is the reviewed commit and ignore findings that apply only to earlier heads.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T05:27:04.974021Z	a42e2ae	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 2ad6d7dc2d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[danny-avila]

@codex review

Please review the current PR head a42e2ae. Confirm that this exact commit is the reviewed commit and ignore findings that apply only to earlier heads.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: a42e2ae256

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".