Add explicit Git credentials for private remotes - #13
Merged
Conversation
Git drives previously relied entirely on the host git installation to authenticate, which fails on headless/CI endpoints cloning private repos. Add a GitCredential value object (HTTPS PAT, username+password, SSH key) that injects itself at the single GitCli process chokepoint — HTTPS via `-c http.extraHeader` basic auth, SSH via GIT_SSH_COMMAND — and always sets GIT_TERMINAL_PROMPT=0 so a missing/wrong credential fails fast. Credentials are host-scoped and stored only in a local credentials.json (0600), resolved by the origin's host via GitCredentialResolver. They are never placed on the Drive entity, so they never reach drives.json, the hub, or peers. Manage them with `omnydrive credential add/list/remove`; publish, clone, and sync resolve the matching credential automatically by host. Bumps version to 1.9.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Git drives previously had no credential model —
GitClishelled out togitwith just a URL, relying on whatever the host git install could authenticate with. That fails on fresh CI runners, containers, and any headless endpoint cloning/fetching/pushing a private repo.This adds first-class Git credentials so an endpoint can authenticate to private remotes over HTTPS (PAT or username+password) and SSH (private key).
Design
GitCredentialsealed value object with three variants —GitPat,GitUserPass,GitSshKey. Each injects itself at the singleGitCliprocess chokepoint: HTTPS via-c http.extraHeader=Authorization: Basic <b64>, SSH viaGIT_SSH_COMMAND=ssh -i <key>. Secrets are masked intoString()(mirrorsAuthToken).GIT_TERMINAL_PROMPT=0is always set, so a missing/wrong credential fails fast instead of hanging on an interactive prompt.credentials.json(keyed by git host, tightened to0600) and are resolved by the origin's host at invocation time via aGitCredentialResolver. They are never placed on theDriveentity, so they never reachdrives.json, the hub registry, or peer HTTP payloads.omnydrive credential add <host> (--pat | --username/--password | --ssh-key),credential list(masked),credential remove <host>.publish/clone/syncresolve the matching credential automatically by host — no new per-command flags.Passphrase-protected SSH keys still require an ssh-agent (documented limitation;
passphraseis retained for a futureSSH_ASKPASSupgrade).Tests
GitCredential(basic-auth header encoding,GIT_SSH_COMMAND, masking, JSON round-trip),GitCredentialStore(put/get/remove/resolve + save→load), andOriginUri.hostextraction.null, behavior unchanged.dart analyzeclean; full suite (234 tests) green.credentials.jsonbut notdrives.json/hub payloads.Bumps version to 1.9.0.
🤖 Generated with Claude Code