feat(github): GitHub repo picker with auto-sync instructions and runtime detection

apps/mesh/package.json

@@ -49,6 +49,9 @@
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
+    "@freestyle-sh/with-bun": "^0.2.10",
+    "@freestyle-sh/with-deno": "^0.0.2",
+    "@freestyle-sh/with-nodejs": "^0.2.8",
     "@inkjs/ui": "^2.0.0",
     "@modelcontextprotocol/ext-apps": "^1.2.2",
     "@openrouter/ai-sdk-provider": "^2.2.5",
@@ -57,6 +60,7 @@
     "ai-sdk-provider-claude-code": "^3.4.4",
     "ai-sdk-provider-codex-cli": "^1.1.0",
     "embedded-postgres": "^18.3.0-beta.16",
+    "freestyle-sandboxes": "^0.1.43",
     "ink": "^6.8.0",
     "kysely": "^0.28.12",
     "nats": "^2.29.3",
@@ -73,13 +77,13 @@
     "@decocms/better-auth": "1.5.17",
     "@decocms/bindings": "workspace:*",
     "@decocms/mcp-utils": "workspace:*",
-    "@jitl/quickjs-wasmfile-release-sync": "0.31.0",
     "@decocms/mesh-sdk": "workspace:*",
     "@decocms/runtime": "workspace:*",
     "@decocms/vite-plugin": "workspace:*",
     "@electric-sql/pglite": "^0.3.15",
     "@floating-ui/react": "^0.27.16",
     "@hookform/resolvers": "^5.2.2",
+    "@jitl/quickjs-wasmfile-release-sync": "0.31.0",
     "@modelcontextprotocol/sdk": "1.27.1",
     "@monaco-editor/react": "^4.7.0",
     "@opentelemetry/api": "^1.9.0",
@@ -123,6 +127,7 @@
     "@vercel/nft": "^1.1.1",
     "@vitejs/plugin-react": "^5.1.0",
     "ai": "^6.0.116",
+    "ansi-to-html": "^0.7.2",
     "babel-plugin-react-compiler": "^1.0.0",
     "better-auth": "1.4.5",
     "class-variance-authority": "^0.7.1",
@@ -136,14 +141,14 @@
     "jose": "^6.0.11",
     "kysely-pglite": "^0.6.1",
     "lucide-react": "^0.468.0",
-    "react-resizable-panels": "^2.1.7",
     "marked": "^15.0.6",
     "mesh-plugin-workflows": "workspace:*",
     "nanoid": "^5.1.6",
     "pg": "^8.16.3",
     "prettier": "^3.4.2",
     "react-hook-form": "^7.66.0",
     "react-markdown": "^10.1.0",
+    "react-resizable-panels": "^2.1.7",
     "react-syntax-highlighter": "^15.6.1",
     "recharts": "^3.6.0",
     "rehype-raw": "^7.0.0",

apps/mesh/src/tools/github/device-flow-poll.ts

@@ -0,0 +1,94 @@
+/**
+ * GITHUB_DEVICE_FLOW_POLL Tool
+ *
+ * Polls GitHub Device Flow for access token.
+ * App-only tool — not visible to AI models.
+ */
+
+import { z } from "zod";
+import { defineTool } from "../../core/define-tool";
+import { requireAuth } from "../../core/mesh-context";
+
+const GITHUB_CLIENT_ID = "Iv23liLNDj260RBdPV7p";
+
+export const GITHUB_DEVICE_FLOW_POLL = defineTool({
+  name: "GITHUB_DEVICE_FLOW_POLL",
+  description: "Poll GitHub Device Flow for the access token.",
+  annotations: {
+    title: "Poll GitHub Device Flow",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: true,
+  },
+  _meta: { ui: { visibility: "app" } },
+  inputSchema: z.object({
+    deviceCode: z.string().describe("Device code from the start step"),
+  }),
+  outputSchema: z.object({
+    status: z.enum(["pending", "success", "expired", "error"]),
+    token: z.string().nullable(),
+    error: z.string().nullable(),
+  }),
+
+  handler: async (input, ctx) => {
+    requireAuth(ctx);
+    await ctx.access.check();
+
+    const response = await fetch(
+      "https://github.com/login/oauth/access_token",
+      {
+        method: "POST",
+        headers: {
+          Accept: "application/json",
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+          client_id: GITHUB_CLIENT_ID,
+          device_code: input.deviceCode,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        }),
+      },
+    );
+
+    if (!response.ok) {
+      return {
+        status: "error" as const,
+        token: null,
+        error: `HTTP ${response.status}`,
+      };
+    }
+
+    const data = (await response.json()) as {
+      access_token?: string;
+      error?: string;
+      error_description?: string;
+    };
+
+    if (data.access_token) {
+      return {
+        status: "success" as const,
+        token: data.access_token,
+        error: null,
+      };
+    }
+
+    if (data.error === "authorization_pending" || data.error === "slow_down") {
+      return { status: "pending" as const, token: null, error: null };
+    }
+
+    if (data.error === "expired_token") {
+      return {
+        status: "expired" as const,
+        token: null,
+        error: "Device code expired",
+      };
+    }
+
+    return {
+      status: "error" as const,
+      token: null,
+      error: data.error_description ?? data.error ?? "Unknown error",
+    };
+  },
+});

apps/mesh/src/tools/github/device-flow-start.ts

@@ -0,0 +1,71 @@
+/**
+ * GITHUB_DEVICE_FLOW_START Tool
+ *
+ * Starts GitHub Device Flow authentication.
+ * App-only tool — not visible to AI models.
+ */
+
+import { z } from "zod";
+import { defineTool } from "../../core/define-tool";
+import { requireAuth } from "../../core/mesh-context";
+
+// Deco CMS GitHub App client ID (public, safe to hardcode)
+const GITHUB_CLIENT_ID = "Iv23liLNDj260RBdPV7p";
+
+export const GITHUB_DEVICE_FLOW_START = defineTool({
+  name: "GITHUB_DEVICE_FLOW_START",
+  description: "Start GitHub Device Flow authentication to get a user code.",
+  annotations: {
+    title: "Start GitHub Device Flow",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: true,
+  },
+  _meta: { ui: { visibility: "app" } },
+  inputSchema: z.object({}),
+  outputSchema: z.object({
+    userCode: z.string(),
+    verificationUri: z.string(),
+    deviceCode: z.string(),
+    expiresIn: z.number(),
+    interval: z.number(),
+  }),
+
+  handler: async (_input, ctx) => {
+    requireAuth(ctx);
+    await ctx.access.check();
+
+    const response = await fetch("https://github.com/login/device/code", {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        client_id: GITHUB_CLIENT_ID,
+        scope: "",
+      }),
+    });
+
+    if (!response.ok) {
+      throw new Error(`GitHub Device Flow error: ${response.status}`);
+    }
+
+    const data = (await response.json()) as {
+      device_code: string;
+      user_code: string;
+      verification_uri: string;
+      expires_in: number;
+      interval: number;
+    };
+
+    return {
+      userCode: data.user_code,
+      verificationUri: data.verification_uri,
+      deviceCode: data.device_code,
+      expiresIn: data.expires_in,
+      interval: data.interval,
+    };
+  },
+});

apps/mesh/src/tools/github/get-file-content.ts

@@ -0,0 +1,56 @@
+/**
+ * GITHUB_GET_FILE_CONTENT Tool
+ *
+ * Fetches raw file content from a GitHub repository.
+ * App-only tool — not visible to AI models.
+ */
+
+import { z } from "zod";
+import { defineTool } from "../../core/define-tool";
+import { requireAuth } from "../../core/mesh-context";
+
+export const GITHUB_GET_FILE_CONTENT = defineTool({
+  name: "GITHUB_GET_FILE_CONTENT",
+  description: "Fetch raw file content from a GitHub repository by path.",
+  annotations: {
+    title: "Get GitHub File Content",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: true,
+  },
+  _meta: { ui: { visibility: "app" } },
+  inputSchema: z.object({
+    token: z.string().describe("GitHub access token"),
+    owner: z.string().describe("Repository owner"),
+    repo: z.string().describe("Repository name"),
+    path: z.string().describe("File path within the repository"),
+  }),
+  outputSchema: z.object({
+    content: z.string().nullable(),
+    found: z.boolean(),
+  }),
+
+  handler: async (input, ctx) => {
+    requireAuth(ctx);
+    await ctx.access.check();
+
+    const url = `https://raw.githubusercontent.com/${input.owner}/${input.repo}/HEAD/${input.path}`;
+    const response = await fetch(url, {
+      headers: {
+        Authorization: `Bearer ${input.token}`,
+      },
+    });
+
+    if (response.status === 404) {
+      return { content: null, found: false };
+    }
+
+    if (!response.ok) {
+      throw new Error(`GitHub API error: ${response.status}`);
+    }
+
+    const content = await response.text();
+    return { content, found: true };
+  },
+});

apps/mesh/src/tools/github/index.ts

@@ -0,0 +1,11 @@
+/**
+ * GitHub Tools
+ *
+ * Tools for GitHub integration (app-only, not visible to AI models).
+ */
+
+export { GITHUB_LIST_INSTALLATIONS } from "./list-installations";
+export { GITHUB_LIST_REPOS } from "./list-repos";
+export { GITHUB_DEVICE_FLOW_START } from "./device-flow-start";
+export { GITHUB_DEVICE_FLOW_POLL } from "./device-flow-poll";
+export { GITHUB_GET_FILE_CONTENT } from "./get-file-content";

apps/mesh/src/tools/github/list-installations.ts

@@ -0,0 +1,93 @@
+/**
+ * GITHUB_LIST_INSTALLATIONS Tool
+ *
+ * Lists GitHub App installations of the Deco CMS app for the current user.
+ * App-only tool — not visible to AI models.
+ */
+
+import { z } from "zod";
+import { defineTool } from "../../core/define-tool";
+import { requireAuth } from "../../core/mesh-context";
+
+const InstallationSchema = z.object({
+  installationId: z.number(),
+  orgName: z.string(),
+  avatarUrl: z.string().nullable(),
+});
+
+export const GITHUB_LIST_INSTALLATIONS = defineTool({
+  name: "GITHUB_LIST_INSTALLATIONS",
+  description:
+    "List GitHub App installations of the Deco CMS app for the current user.",
+  annotations: {
+    title: "List GitHub Installations",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: true,
+  },
+  _meta: { ui: { visibility: "app" } },
+  inputSchema: z.object({
+    token: z.string().describe("GitHub access token"),
+  }),
+  outputSchema: z.object({
+    installations: z.array(InstallationSchema),
+  }),
+
+  handler: async (input, ctx) => {
+    requireAuth(ctx);
+    await ctx.access.check();
+
+    const headers = {
+      Authorization: `Bearer ${input.token}`,
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28",
+    };
+
+    type GitHubInstallation = {
+      id: number;
+      account: {
+        login: string;
+        avatar_url: string;
+      };
+    };
+
+    const allInstallations: GitHubInstallation[] = [];
+    let nextUrl: string | undefined =
+      "https://api.github.com/user/installations?per_page=100";
+
+    while (nextUrl) {
+      const response: Response = await fetch(nextUrl, { headers });
+
+      if (!response.ok) {
+        throw new Error(`GitHub API error: ${response.status}`);
+      }
+
+      const data = (await response.json()) as {
+        installations: GitHubInstallation[];
+      };
+      allInstallations.push(...data.installations);
+
+      // Parse Link header for next page
+      nextUrl = undefined;
+      const link = response.headers.get("link");
+      if (link) {
+        const next = link
+          .split(",")
+          .find((part: string) => part.includes('rel="next"'));
+        if (next) {
+          const match = next.match(/<([^>]+)>/);
+          if (match?.[1]) nextUrl = match[1];
+        }
+      }
+    }
+
+    const installations = allInstallations.map((inst) => ({
+      installationId: inst.id,
+      orgName: inst.account.login,
+      avatarUrl: inst.account.avatar_url,
+    }));
+
+    return { installations };
+  },
+});