fix: 使用 HTTPS + gh token 替代 SSH 克隆 review 仓库

将 generate-review-builtin.ts 的 CLONE_URL 从 SSH (git@github.com:)
改为 HTTPS，并通过 gh auth token 或环境变量获取认证令牌，
解决 SSH key 未配置时无法克隆私有仓库的问题。

scripts/dev.ts

@@ -54,7 +54,7 @@ const bunCmd = process.execPath;
 // Generate review builtin files before dev launch
 console.log('[dev] Generating review builtin files...');
 const genResult = Bun.spawnSync(['bun', 'run', 'scripts/generate-review-builtin.ts'], {
-  stdio: 'inherit',
+  stdio: ["inherit", "inherit", "inherit"],
   cwd: projectRoot,
 });
 if (!genResult.success) {

scripts/generate-review-builtin.ts

@@ -36,7 +36,21 @@ type IndexJson = {
 
 const REPO = 'zgsm-ai/costrict-review'
 const BRANCH = 'main'
-const CLONE_URL = `git@github.com:${REPO}.git`
+const CLONE_URL = getCloneUrl()
+
+function getCloneUrl(): string {
+  // Try gh CLI token first, then env vars, fall back to public HTTPS
+  const ghToken = (() => {
+    try {
+      return spawnSync('gh', ['auth', 'token'], { encoding: 'utf-8' }).stdout?.trim() || ''
+    } catch { return '' }
+  })()
+  const token = ghToken || process.env.GH_TOKEN || process.env.GITHUB_TOKEN || ''
+  if (token) {
+    return `https://x-access-token:${token}@github.com/${REPO}.git`
+  }
+  return `https://github.com/${REPO}.git`
+}
 
 function git(...args: string[]): { ok: boolean; stdout: string; stderr: string } {
   const result = spawnSync('git', args, { encoding: 'utf-8' })