setup-github-login.ps1

<#
  setup-github-login.ps1 - one-time GitHub sign-in for pushing.

  Why this exists: on locked-down machines the interactive Git credential
  manager needs a console and hangs inside the windowless app (you'll see
  "sign-in failed / could not read Username"). This switches Git to its
  built-in `store` helper and saves a Personal Access Token (PAT) so pushes
  just work.

  The PAT is stored in plain text in %USERPROFILE%\.git-credentials - on THIS
  machine only, never uploaded anywhere. Use a fine-grained token limited to
  the repositories you sync, with Contents: read and write. You type the token
  here; this script never transmits it.

  (Prompts are ASCII on purpose: Windows PowerShell 5.1 reads .ps1 files as the
  local ANSI code page, which would garble non-ASCII text on screen.)

  Run it:  .\scripts\setup-github-login.ps1
#>
$ErrorActionPreference = 'Stop'

Write-Host ""
Write-Host "== work-capsule - GitHub one-time sign-in ==" -ForegroundColor Cyan
Write-Host "Create a fine-grained token in the browser first, then paste it here."
Write-Host "(GitHub -> Settings -> Developer settings -> Personal access tokens"
Write-Host " -> Fine-grained tokens -> Generate; Repository access = your repos;"
Write-Host " Permissions -> Contents = Read and write.)"
Write-Host ""

$user = Read-Host "GitHub username"
$sec  = Read-Host "Paste GitHub token (PAT, hidden while typing)" -AsSecureString
$bstr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($sec)
$tok  = [Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr)
[Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr)

if ([string]::IsNullOrWhiteSpace($user) -or [string]::IsNullOrWhiteSpace($tok)) {
    Write-Host "Username or token was empty; cancelled." -ForegroundColor Yellow
    exit 1
}

# Use Git's built-in `store` helper. github.com gets a *scoped* reset so the
# system credential manager (which forks sh.exe and hangs on locked-down
# machines) is skipped for GitHub only - other hosts, e.g. a work GitLab, keep
# whatever they already use.
git config --global credential.helper store
git config --global "credential.https://github.com.helper" ""
git config --global --add "credential.https://github.com.helper" store

# TLS reliability on corporate / campus networks (avoids curl 35 / RPC failed).
git config --global http.version HTTP/1.1
git config --global http.postBuffer 524288000
git config --global http.sslBackend schannel

$u = [uri]::EscapeDataString($user)
$t = [uri]::EscapeDataString($tok)
$cred = "https://${u}:${t}@github.com"

$path = Join-Path $env:USERPROFILE ".git-credentials"
$kept = @()
if (Test-Path $path) {
    $kept = Get-Content $path | Where-Object { $_ -and ($_ -notmatch '@github\.com$') }
}
$kept += $cred
Set-Content -Path $path -Value $kept -Encoding ascii

Write-Host ""
Write-Host "Done. Token saved to $path (this machine only)." -ForegroundColor Green
Write-Host "Now open the app and click Sync, or verify with (use one of your repos):"
Write-Host "    git -C D:\work-capsule ls-remote --heads origin" -ForegroundColor Gray