feat: Route GitHub App credentials per repository

[danny-avila]

Summary

I made GitHub App authentication repository-aware so one BYOM worker can work across personal and organization repositories without switching a global installation ID. I also bind App-authenticated commits to the canonical GitHub bot identity so GitHub renders Lia's profile and avatar.

• Resolve the GitHub repository from each admitted command working directory.
• Look up the App installation for that repository and mint a repository-scoped token.
• Cache tokens and installation mappings independently per repository, including concurrent commands across accounts.
• Preserve the fixed installation ID as an optional compatibility fallback.
• Apply Lia's canonical bot name and no-reply email to Git commits without persisting credentials or identity in repository configuration.
• Document multi-account App installation and worker configuration.

Change Type

• New feature (non-breaking change which adds functionality)
• This change requires a documentation update

Testing

• npm run build
• npx tsc --noEmit -p tsconfig.json
• node --test dist/github.test.js dist/cli.test.js dist/native-process.test.js dist/native-sandbox.test.js (123 passing)
• Local Git integration confirming the wrapped command records both author and committer as lia-by-librechat[bot] <328778573+lia-by-librechat[bot]@users.noreply.github.com>.

Test Configuration:

• macOS
• Node.js v24
• GitHub App mode with repository-routed installations

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• I have commented in complex areas where needed
• I have made pertinent documentation changes
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective
• Local unit tests pass with my changes

[danny-avila]

@codex review

Please review the current PR head 9528676. Confirm that this exact commit is the reviewed commit and ignore findings that apply only to earlier heads.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-19T13:13:01.145394Z	e4502f3	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[danny-avila]

@codex review

Please review the current PR head de86ed0. Confirm that this exact commit is the reviewed commit and ignore findings that apply only to earlier heads.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: de86ed0023

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[danny-avila]

@codex review

Please review the current PR head e4502f3. Confirm that this exact commit is the reviewed commit and ignore findings that apply only to earlier heads.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e4502f38a5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".