@bevel-software/platform-core-backend 0.12.0 → 0.13.1

package/src/modules/workflow/workflow.service.ts

@@ -49,11 +49,12 @@ import type { GitService } from './git/git.service.js';
 import type { PullRequestService } from './git/pull-request.service.js';
 import type { IReviewWorkflowService } from './review-workflow/review-workflow.interface.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
-import { workspaceIdForBranch } from '../../shared/workspace-id.js';
+import { workspaceIdForBranch, branchForWorkspaceId } from '../../shared/workspace-id.js';
 import type { IAccessControl } from '../access/access-control.interface.js';
 import { FileLockService } from './file-lock.service.js';
 import { PendingCommitsService } from './pending-commits.service.js';
 import type { WorkflowEventBus } from './event-bus.js';
+import { sanitizeError } from './sanitize-error.js';
 import type { FileChangeNotifier } from '../kb-fs/file-change-notifier.js';
 import { WorkflowHooks } from './workflow-hooks.js';
 import { WorkspaceMutex } from '../kb-fs/mutex.js';
@@ -355,7 +356,7 @@ export class WorkflowService implements IWorkflowService {
   // to discard.
 
   shareCurrentBranch(workspaceId: string, user: AuthUser): Promise<void> {
-    return this.git.push(workspaceId, user);
+    return this.trackedPush(workspaceId, user);
   }
 
   refreshRemotes(workspaceId: string): Promise<void> {
@@ -680,6 +681,7 @@ export class WorkflowService implements IWorkflowService {
     if (change) {
       try {
         await this.git.push(workspaceId, user);
+        this.noteGitSyncOk(workspaceId, branch);
       } catch (err) {
         // Non-fast-forward recovery on the autosave path: try the
         // cooperative `pull --rebase` + retry once. Autosave is
@@ -695,12 +697,15 @@ export class WorkflowService implements IWorkflowService {
         const detail = err instanceof Error ? err.message : String(err);
         const looksLikeNonFastForward = /non-fast-forward|rejected|fetch first|updates were rejected/i.test(detail);
         let recovered = false;
+        let recoveryError: unknown = null;
         if (looksLikeNonFastForward) {
           try {
             await this.git.pull(workspaceId);
             await this.git.push(workspaceId, user);
             recovered = true;
+            this.noteGitSyncOk(workspaceId, branch);
           } catch (recoveryErr) {
+            recoveryError = recoveryErr;
             console.warn(
               '[workflow] autosave cooperative recovery (pull-rebase) failed; leaving the unpushed commit for the next save / releaseLock to surface:',
               recoveryErr instanceof Error ? recoveryErr.message : recoveryErr,
@@ -708,6 +713,20 @@ export class WorkflowService implements IWorkflowService {
           }
         }
         if (!recovered) {
+          // Still best-effort — we don't fail the autosave. What gets the
+          // BANNER is only the class that cannot clear itself: auth or host
+          // failures, which no later attempt fixes. A non-fast-forward here —
+          // recovery attempted or not — is the routine two-editors race the
+          // surrounding flow already handles: the release push retries it,
+          // and if THAT fails the user gets the typed agent hand-off plus the
+          // banner from `pushWithRecovery`. Bannering it from a background
+          // autosave would tell an author mid-keystroke that the deployment
+          // is broken over a race that usually settles on its own — while an
+          // auth failure swallowed into a log line is how a broken deployment
+          // once stacked 136 local commits before anyone found out.
+          if (!looksLikeNonFastForward) {
+            this.noteGitSyncFailed(workspaceId, branch, recoveryError ?? err);
+          }
           console.warn(
             '[workflow] push after autosave commit failed (commit landed locally):',
             detail,
@@ -896,6 +915,87 @@ export class WorkflowService implements IWorkflowService {
     this.fileChanges?.emit({ workspaceId, branch, paths: [targetPath], byUser: user });
   }
 
+  /**
+   * Workspaces whose last push failed. Purely so the recovery event fires on
+   * the transition back to healthy instead of on every subsequent save — a
+   * push runs on every write, and the healthy case must stay silent.
+   *
+   * Process-local and deliberately not persisted: a restart clears it, and the
+   * worst that costs is one redundant `git-sync-recovered` on a workspace that
+   * was already fine, which clients treat as a no-op.
+   */
+  private readonly gitSyncFailing = new Set<string>();
+
+  /**
+   * Announce that a push landed. Emits only when this workspace was previously
+   * failing — see `gitSyncFailing`.
+   */
+  private noteGitSyncOk(workspaceId: string, branch: string): void {
+    // Callers hand this both spellings of a workspace id — HTTP routes pass
+    // the Express-decoded `user/feat`, internal callers (the pending-commits
+    // worker, the agent filesystem) the encoded `user%2Ffeat`. Keyed raw, a
+    // failure recorded by one caller could never be cleared by the other's
+    // success, and the banner would stick. Canonicalize the key AND the
+    // emitted id so every consumer sees one spelling.
+    const id = branchForWorkspaceId(workspaceId);
+    if (!this.gitSyncFailing.delete(id)) return;
+    console.log(`[workflow] git sync recovered for workspace=${id} branch=${branch}`);
+    this.events?.emit({ kind: 'git-sync-recovered', workspaceId: id, branch });
+  }
+
+  /**
+   * Announce that a commit is sitting locally because its push failed.
+   *
+   * This is the visibility half of the failure paths below; it never changes
+   * what they DO. The commit is already safe on disk and the retry / hand-off
+   * machinery is unaffected — all this adds is that someone finds out, rather
+   * than the deployment looking healthy while nothing reaches the remote.
+   */
+  private noteGitSyncFailed(workspaceId: string, branch: string, err: unknown): void {
+    // Same canonicalization as `noteGitSyncOk` — the pair must agree on keys.
+    const id = branchForWorkspaceId(workspaceId);
+    this.gitSyncFailing.add(id);
+    this.events?.emit({
+      kind: 'git-sync-failed',
+      workspaceId: id,
+      branch,
+      // Git stderr can quote a credentialed URL; the banner is user-facing and
+      // the string also lands in client logs, so sanitize before it leaves.
+      reason: sanitizeError(err),
+    });
+  }
+
+  /**
+   * A bare push wrapped in the sync tracker: a failure raises the banner, a
+   * success clears it. For the workflow paths that push directly — sharing a
+   * branch, publishing a CR's source, update-from-base, the decline revert,
+   * the roles.yaml restore — rather than through `pushWithRecovery`'s
+   * cooperative ladder. Behaviour is otherwise unchanged: the error still
+   * propagates to the caller exactly as the bare push's did. Without this,
+   * those pushes could fail invisibly (no banner) and, worse, a successful
+   * share could not CLEAR a banner an earlier save had raised.
+   *
+   * The branch is derived from the workspace id (they are the same string,
+   * URL-encoding aside) so call sites cannot pass a mismatched pair.
+   */
+  private async trackedPush(
+    workspaceId: string,
+    user: AuthUser,
+    opts?: { systemAuthorized?: boolean },
+  ): Promise<void> {
+    const branch = branchForWorkspaceId(workspaceId);
+    try {
+      // Preserve the exact call shape of the bare pushes this replaces — an
+      // explicit `undefined` third argument is a different call signature to
+      // every spy that asserts on it.
+      await (opts ? this.git.push(workspaceId, user, opts) : this.git.push(workspaceId, user));
+      this.noteGitSyncOk(workspaceId, branch);
+    } catch (err) {
+      this.noteGitSyncFailed(workspaceId, branch, err);
+      throw err;
+    }
+  }
+
   /**
    * Shared implementation of "push, and on non-fast-forward try a
    * cooperative pull-rebase + retry, then hand off to the agent if that
@@ -911,20 +1011,24 @@ export class WorkflowService implements IWorkflowService {
   ): Promise<void> {
     try {
       await this.git.push(workspaceId, user, opts);
+      this.noteGitSyncOk(workspaceId, branch);
     } catch (firstPushErr) {
       const firstDetail = firstPushErr instanceof Error ? firstPushErr.message : String(firstPushErr);
       const looksLikeNonFastForward = /non-fast-forward|rejected|fetch first|updates were rejected/i.test(firstDetail);
       let recovered = false;
       let recoveryDetail = '(cooperative path not attempted)';
+      let recoveryError: unknown = null;
       if (looksLikeNonFastForward) {
         try {
           await this.git.pull(workspaceId);
           await this.git.push(workspaceId, user, opts);
           recovered = true;
+          this.noteGitSyncOk(workspaceId, branch);
           console.log(
             `[workflow] non-fast-forward push recovered via pull --rebase for workspace=${workspaceId} branch=${branch} path=${targetPath}`,
           );
         } catch (recoveryErr) {
+          recoveryError = recoveryErr;
           recoveryDetail = recoveryErr instanceof Error ? recoveryErr.message : String(recoveryErr);
           console.warn(
             `[workflow] cooperative recovery (pull-rebase) failed for workspace=${workspaceId} user=${user.id}; handing off to agent:`,
@@ -933,6 +1037,14 @@ export class WorkflowService implements IWorkflowService {
         }
       }
       if (!recovered) {
+        // Banner first, then the typed throw. The throw only reaches a UI that
+        // is still mounted and listening — the release fired as an editor
+        // unmounts has nowhere to surface it — whereas the event reaches every
+        // session on the branch regardless of what triggered the push.
+        // When recovery RAN, its error is the current state of the world (the
+        // first rejection may be a stale non-fast-forward the pull already
+        // cured); when it was skipped, the first error is all there is.
+        this.noteGitSyncFailed(workspaceId, branch, recoveryError ?? firstPushErr);
         console.warn(
           `[workflow] push failed for workspace=${workspaceId} user=${user.id}; throwing PushNeedsAgentResolutionError so the frontend can hand off to the agent:`,
           firstDetail,
@@ -1129,7 +1241,7 @@ export class WorkflowService implements IWorkflowService {
 
   getChangeRequestDetail(
     number: number,
-    opts?: { fresh?: boolean; workspaceId?: string; viewerEmail?: string },
+    opts?: { fresh?: boolean; workspaceId?: string; viewerEmail?: string; patches?: boolean },
   ): Promise<ChangeRequestDetail | null> {
     return this.prs.getPrDetail(number, opts);
   }
@@ -1214,7 +1326,7 @@ export class WorkflowService implements IWorkflowService {
     // Push the source — `gh pr create` against an unpushed branch returns
     // "head branch does not exist on remote". Push *after* the auto-merge
     // so the remote sees the merge commit too.
-    await this.git.push(workspaceId, user);
+    await this.trackedPush(workspaceId, user);
 
     const workspacePath = await this.workspaceService.getWorkspacePath(workspaceId);
     const cwd = path.join(workspacePath, this.kbDirName);
@@ -1367,7 +1479,7 @@ export class WorkflowService implements IWorkflowService {
     // If a new merge commit landed, push so the CR picks it up. When
     // already up to date there's nothing to share — short-circuit the push.
     if (!outcome.alreadyUpToDate) {
-      await this.git.push(workspaceId, user);
+      await this.trackedPush(workspaceId, user);
     }
     this.prs.invalidateDetailCache(number);
     const refreshed = await this.prs.getPrDetail(number, {
@@ -1556,7 +1668,7 @@ export class WorkflowService implements IWorkflowService {
         `Revert ${repoRelPath} (declined in change request #${number})`,
         true, // skipValidator — this restores an already-validated base version
       );
-      await this.git.push(ws.id, user);
+      await this.trackedPush(ws.id, user);
     } finally {
       // Committed inline — drop the lock row directly rather than enqueueing
       // a duplicate commit through releaseLock.
@@ -1784,6 +1896,10 @@ export class WorkflowService implements IWorkflowService {
         fresh: true,
         workspaceId,
         viewerEmail: user.email,
+        // Only `files[].path` is read below; a patch per file would be one
+        // git subprocess each, generated for nothing, on every reject by a
+        // non-author.
+        patches: false,
       });
       const paths = detail?.files.map((f) => f.path) ?? [];
       if (paths.length > 0) {
@@ -2105,7 +2221,7 @@ export class WorkflowService implements IWorkflowService {
             'roles.yaml restore produced no commit while origin still diverges from base — source workspace out of sync; refusing to merge',
           );
         }
-        await this.git.push(ws.id, user);
+        await this.trackedPush(ws.id, user);
         this.accessControl.invalidate(ws.id);
         return true;
       } finally {

package/src/modules/workspace/__tests__/workspace.service.test.ts

@@ -454,7 +454,7 @@ describe('WorkspaceService.sweepOrphanedWorkspaces', () => {
 
   beforeEach(async () => {
     root = await mkTmpRoot();
-    // The fake `.git` in seedBranchWorkspace makes normalizeCloneTracking's
+    // The fake `.git` in seedBranchWorkspace makes normalizeCloneConfig's
     // git calls fail; that path only warns, which is noise here.
     vi.spyOn(console, 'warn').mockImplementation(() => {});
   });

package/src/modules/workspace/__tests__/workspace.tools.test.ts

@@ -1065,3 +1065,48 @@ describe('branch is a required parameter in the tool contract', () => {
     }
   });
 });
+
+/**
+ * The tools are rooted at the WORKSPACE dir, one level above the git clone, so
+ * a path has to start with the clone folder to reach git at all. Every place an
+ * agent reads before choosing a path says so, in the `path` input itself rather
+ * than only in prose it may not read: the root listing (where the folder is
+ * discoverable) and each content-writing tool.
+ */
+describe('path inputs tell the agent about the repository folder', () => {
+  // `toolDef` wraps a tool's inputs under a single `body` property.
+  const inputDescription = (def: { inputs?: unknown } | undefined, ...keys: string[]): string => {
+    let node = (def?.inputs ?? {}) as Record<string, unknown>;
+    for (const key of ['body', ...keys]) {
+      node = ((node.properties as Record<string, unknown> | undefined)?.[key] ?? {}) as Record<string, unknown>;
+      if (key === 'files') node = (node.items ?? {}) as Record<string, unknown>;
+    }
+    return typeof node.description === 'string' ? node.description : '';
+  };
+
+  it('every content-writing tool says paths start with `knowledge-base/`, so a repo-relative path is never guessed', async () => {
+    await start();
+    const tools = await toolRegistry.listInternal();
+    const byName = (name: string) => {
+      const def = tools.find((t) => t.name === name);
+      expect(def, name).toBeDefined();
+      return def;
+    };
+    for (const name of ['write_file', 'edit_file', 'mkdir', 'delete_file', 'unzip']) {
+      expect(inputDescription(byName(name), 'path'), name).toContain(`\`${KB_DIR}/\``);
+    }
+    expect(inputDescription(byName('write_files'), 'files', 'path'), 'write_files').toContain(`\`${KB_DIR}/\``);
+    for (const name of ['move_file', 'copy_file']) {
+      expect(inputDescription(byName(name), 'dest'), name).toContain(`\`${KB_DIR}/\``);
+    }
+  });
+
+  it('the root listing names the clone folder, so an agent that lists first learns the prefix', async () => {
+    await start();
+    const tools = await toolRegistry.listInternal();
+    const list = tools.find((t) => t.name === 'list_files');
+    expect(list).toBeDefined();
+    expect(list!.description).toContain(`\`${KB_DIR}/\``);
+    expect(inputDescription(list, 'path')).toContain(`\`${KB_DIR}/\``);
+  });
+});

package/src/modules/workspace/startup/__tests__/kb-startup-runner.test.ts

@@ -5,6 +5,7 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { KbStartupRunner } from '../kb-startup-runner.js';
+import { WorkspaceService } from '../../workspace.service.js';
 import { redactSecret } from '../kb-git.js';
 import type { OnServerStart, ServerStartContext, StepResult } from '../on-server-start.js';
 
@@ -493,3 +494,143 @@ describe('redactSecret', () => {
     expect(redactSecret('https://example.com/kb.git')).toBe('https://example.com/kb.git');
   });
 });
+
+describe('KbStartupRunner credentials', () => {
+  // The phase clones the default branch into the very directory
+  // `WorkspaceService` adopts, and `GitService.push` later runs a bare
+  // `git push` from it. Position of the credential config is what decides
+  // whether that works: `git -c … clone` authenticates the clone and leaves
+  // the repo with nothing, so every later push prompts for a username, finds
+  // no tty, and dies — commits pile up locally and reach the remote never.
+  // Only real git tells the two spellings apart, so this drives real git.
+  const ORIGINAL = process.env.GITHUB_TOKEN;
+  afterEach(() => {
+    if (ORIGINAL === undefined) delete process.env.GITHUB_TOKEN;
+    else process.env.GITHUB_TOKEN = ORIGINAL;
+  });
+
+
+  /** Run the phase far enough to put the default branch's clone on disk. */
+  async function materializeDefaultBranchClone(): Promise<string> {
+    let repoDir = '';
+    await makeRunner([
+      step('touch', async (ctx) => {
+        repoDir = await (await ctx.defaultBranch()).repoDir();
+        return { outcome: 'ok' };
+      }),
+    ]).runAll();
+    expect(repoDir).toBe(path.join(workspacesRoot, DEFAULT_BRANCH, 'knowledge-base'));
+    return repoDir;
+  }
+
+  it('leaves the boot clone able to authenticate a push of its own', async () => {
+    process.env.GITHUB_TOKEN = 'ghp_boot';
+    await populatedUpstream();
+    // The branch handle clones lazily, so a step has to actually reach for the
+    // repo before there is anything on disk to inspect.
+    const repo = await materializeDefaultBranchClone();
+    const helper = (await git(repo, ['config', '--local', '--get', 'credential.helper'])).trim();
+    expect(helper).toContain('username=x-access-token');
+    // The literal, not the value — the helper resolves it per invocation, so
+    // the secret never lands in a config file we don't control the lifetime of.
+    expect(helper).toContain('password=$GITHUB_TOKEN');
+    expect(helper).not.toContain('ghp_boot');
+
+    // Exactly one value: a re-stamp must collapse, never accumulate, or git
+    // errors with "cannot overwrite multiple values".
+    const all = (await git(repo, ['config', '--local', '--get-all', 'credential.helper'])).trim();
+    expect(all.split('\n')).toHaveLength(1);
+  });
+
+  it('adopting an existing clone collapses an accumulated helper back to one value', async () => {
+    // The boot-time assertion above sees a FRESH clone, which only ever has
+    // one value by construction. The collapse guarantee lives in the adoption
+    // path (`--replace-all`), so drift a second value in out of band and let
+    // WorkspaceService adopt the clone — that is the code the guarantee is
+    // about.
+    process.env.GITHUB_TOKEN = 'ghp_boot';
+    await populatedUpstream();
+    const repo = await materializeDefaultBranchClone();
+    // App-shaped drift: a second stamp of OURS with a stale username — the
+    // realistic accumulation (an operator's own helper is a different case,
+    // covered below, and must NOT be collapsed).
+    await git(repo, ['config', '--add', 'credential.helper',
+      '!f() { echo "username=stale-user"; echo "password=$GITHUB_TOKEN"; }; f']);
+
+    const ws = new WorkspaceService(workspacesRoot, upstream, 'knowledge-base', () => 'x-access-token');
+    await ws.getOrCreateForBranch(DEFAULT_BRANCH);
+
+    const all = (await git(repo, ['config', '--local', '--get-all', 'credential.helper'])).trim();
+    expect(all.split('\n')).toHaveLength(1);
+    expect(all).toContain('username=x-access-token');
+    expect(all).not.toContain('stale-user');
+  });
+
+  it('an operator-configured helper survives both the stamp and the token-removal unset', async () => {
+    // git chains every configured helper, so an operator's clone-local
+    // `cache`/`store`/custom helper coexists with ours — and losing it on a
+    // token change would break the very fallback auth they set up.
+    process.env.GITHUB_TOKEN = 'ghp_boot';
+    await populatedUpstream();
+    const repo = await materializeDefaultBranchClone();
+    await git(repo, ['config', '--add', 'credential.helper', 'cache --timeout=300']);
+
+    const ws = new WorkspaceService(workspacesRoot, upstream, 'knowledge-base', () => 'x-access-token');
+    await ws.getOrCreateForBranch(DEFAULT_BRANCH); // stamp with token
+    let all = (await git(repo, ['config', '--local', '--get-all', 'credential.helper'])).trim();
+    expect(all).toContain('cache --timeout=300');
+    expect(all).toContain('password=$GITHUB_TOKEN');
+
+    delete process.env.GITHUB_TOKEN;
+    const ws2 = new WorkspaceService(workspacesRoot, upstream, 'knowledge-base', () => 'x-access-token');
+    await ws2.getOrCreateForBranch(DEFAULT_BRANCH); // unset OUR helper only
+    all = (await git(repo, ['config', '--local', '--get-all', 'credential.helper'])).trim();
+    expect(all).toContain('cache --timeout=300');
+    expect(all).not.toContain('password=$GITHUB_TOKEN');
+  });
+
+  it('adopting a clone after the token was removed unsets the stale helper', async () => {
+    // A deployment that lost its token must not keep a clone-local helper
+    // answering with an empty password — it would shadow whatever fallback
+    // auth the operator switched to.
+    process.env.GITHUB_TOKEN = 'ghp_boot';
+    await populatedUpstream();
+    const repo = await materializeDefaultBranchClone(); // stamped
+    delete process.env.GITHUB_TOKEN;
+
+    const ws = new WorkspaceService(workspacesRoot, upstream, 'knowledge-base', () => 'x-access-token');
+    await ws.getOrCreateForBranch(DEFAULT_BRANCH);
+
+    await expect(git(repo, ['config', '--local', '--get', 'credential.helper']))
+      .rejects.toMatchObject({ code: 1 });
+  });
+
+  it('a token added after the branch is cached reaches the clone without a restart', async () => {
+    // The rotation gap: the setup screen can supply a token AFTER a branch
+    // was first opened, and the cached fast path returns before the adoption
+    // re-stamp. The fingerprint check must catch the change there.
+    delete process.env.GITHUB_TOKEN;
+    await populatedUpstream();
+    const repo = await materializeDefaultBranchClone(); // no helper
+
+    const ws = new WorkspaceService(workspacesRoot, upstream, 'knowledge-base', () => 'x-access-token');
+    await ws.getOrCreateForBranch(DEFAULT_BRANCH); // adopt, tokenless
+    process.env.GITHUB_TOKEN = 'ghp_late';
+    await ws.getOrCreateForBranch(DEFAULT_BRANCH); // cached fast path
+
+    const helper = (await git(repo, ['config', '--local', '--get', 'credential.helper'])).trim();
+    expect(helper).toContain('password=$GITHUB_TOKEN');
+    expect(helper).not.toContain('ghp_late');
+  });
+
+  it('clones without a helper when the deployment has no token — an open remote still boots', async () => {
+    delete process.env.GITHUB_TOKEN;
+    await populatedUpstream();
+    const repo = await materializeDefaultBranchClone();
+    // `--get` exits 1 when the key is unset. Assert on that exit code rather
+    // than on "it threw": a missing clone directory throws too, which would
+    // pass this test while proving nothing.
+    await expect(git(repo, ['config', '--local', '--get', 'credential.helper']))
+      .rejects.toMatchObject({ code: 1 });
+  });
+});

package/src/modules/workspace/startup/kb-git.ts

@@ -3,6 +3,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import { cloneCredentialArgs, credentialHelperValue } from '../../kb-fs/clone-config.js';
 
 const execFileAsync = promisify(execFile);
 
@@ -36,18 +37,30 @@ export function redactSecret(text: string): string {
  */
 function credArgs(gitUsername: string): string[] {
   const args = ['-c', 'core.longpaths=true'];
-  if (process.env.GITHUB_TOKEN) {
-    args.push(
-      '-c',
-      `credential.helper=!f() { echo "username=${gitUsername}"; echo "password=$GITHUB_TOKEN"; }; f`,
-    );
-  }
+  const helper = credentialHelperValue(gitUsername);
+  if (helper) args.push('-c', `credential.helper=${helper}`);
   return args;
 }
 
+/**
+ * `credArgs` authenticates the invocation and nothing more — the `-c` pairs sit
+ * BEFORE the subcommand, so git applies them to this process and forgets them.
+ * That is right for every command here except `clone`, whose product is a
+ * repository other code pushes from later: the phase clones the default branch
+ * into `<workspacesRoot>/<id>/<kbDirName>`, exactly where `WorkspaceService`
+ * adopts it, and `GitService.push` then runs a bare `git push` expecting the
+ * clone to carry its own credentials. Persist them with `clone --config` (which
+ * only means "write into the new repo" after the subcommand) so it does.
+ */
+function withPersistedCloneConfig(gitUsername: string, args: string[]): string[] {
+  if (args[0] !== 'clone') return args;
+  return [args[0], ...cloneCredentialArgs(gitUsername), ...args.slice(1)];
+}
+
 export async function git(cwd: string, gitUsername: string, args: string[]): Promise<string> {
   try {
-    const { stdout } = await execFileAsync('git', [...credArgs(gitUsername), ...args], {
+    const argv = [...credArgs(gitUsername), ...withPersistedCloneConfig(gitUsername, args)];
+    const { stdout } = await execFileAsync('git', argv, {
       cwd,
       // A stalled remote must FAIL the phase, not hang the boot forever —
       // fail-closed (and KB_SAFE_BOOT's demotion) can only engage on an error