@ricsam/r5d-worker 0.0.75 → 0.0.77

package/dist/cjs/project-worktrees.cjs

@@ -28,6 +28,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var project_worktrees_exports = {};
 __export(project_worktrees_exports, {
+  PROJECT_WORKTREE_SNAPSHOT_PREFIX: () => PROJECT_WORKTREE_SNAPSHOT_PREFIX,
+  cleanupStaleProjectWorktreeSnapshots: () => cleanupStaleProjectWorktreeSnapshots,
   createLinkedProjectBranch: () => createLinkedProjectBranch,
   deleteLinkedProjectBranch: () => deleteLinkedProjectBranch,
   deleteProjectMirrorBranch: () => deleteProjectMirrorBranch,
@@ -45,8 +47,13 @@ var import_node_crypto = require("node:crypto");
 var import_node_fs = __toESM(require("node:fs"), 1);
 var import_node_os = __toESM(require("node:os"), 1);
 var import_node_path = __toESM(require("node:path"), 1);
+var import_git_process_environment = require("./git-process-environment.cjs");
 var import_managed_paths = require("./managed-paths.cjs");
 var import_working_tree_mirror = require("./working-tree-mirror.cjs");
+const PROJECT_WORKTREE_SNAPSHOT_PREFIX = "r5d-project-worktrees-";
+const PROJECT_WORKTREE_SNAPSHOT_NAME = new RegExp(
+  `^${PROJECT_WORKTREE_SNAPSHOT_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}([1-9]\\d*)-([A-Za-z0-9]{6})$`
+);
 function projectWorktreeConfigurationFingerprint(input) {
   return (0, import_node_crypto.createHash)("sha256").update(
     JSON.stringify({
@@ -72,25 +79,15 @@ const NON_RECURSIVE_GIT_CONFIG = [
   "-c",
   "push.recurseSubmodules=false"
 ];
-function normalizedHttpOrigin(value) {
-  try {
-    const url = new URL(value);
-    return `${url.protocol}//${url.host}`;
-  } catch {
-    return value.replace(/\/+$/, "");
-  }
-}
-function authArgs(auth) {
-  if (!auth) return [];
-  const key = `http.${normalizedHttpOrigin(auth.extraHeaderUrl)}/.extraHeader`;
-  return ["-c", "http.extraHeader=", "-c", `${key}=`, "-c", `${key}=${auth.header}`];
+function gitCommandArgs(args) {
+  return ["git", ...NON_RECURSIVE_GIT_CONFIG, ...args];
 }
-function gitResult(cwd, args, auth) {
-  const result = Bun.spawnSync(["git", ...NON_RECURSIVE_GIT_CONFIG, ...authArgs(auth), ...args], {
+function gitResult(cwd, args) {
+  const result = Bun.spawnSync(gitCommandArgs(args), {
     cwd,
     stdout: "pipe",
     stderr: "pipe",
-    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+    env: (0, import_git_process_environment.workerGitProcessEnvironment)()
   });
   return {
     exitCode: result.exitCode,
@@ -98,13 +95,13 @@ function gitResult(cwd, args, auth) {
     stderr: result.stderr.toString().trim()
   };
 }
-function git(cwd, args, action, auth) {
-  const result = gitResult(cwd, args, auth);
+function git(cwd, args, action) {
+  const result = gitResult(cwd, args);
   if (result.exitCode !== 0) throw new Error(`${action}: ${result.stderr || result.stdout || `git exited ${result.exitCode}`}`);
   return result.stdout;
 }
-function tryGit(cwd, args, auth) {
-  return gitResult(cwd, args, auth).exitCode === 0;
+function tryGit(cwd, args) {
+  return gitResult(cwd, args).exitCode === 0;
 }
 function branchPath(projectRoot, branchName) {
   (0, import_managed_paths.validateManagedBranchName)(branchName);
@@ -167,17 +164,63 @@ function hasCompatibleLinkedProjectWorktreeLayout(input) {
     return kind === null || kind === "file" && commonGitDirectory(checkoutPath) === primaryCommonDir;
   });
 }
+function createProjectWorktreeSnapshotRoot() {
+  return import_node_fs.default.mkdtempSync(import_node_path.default.join(import_node_os.default.tmpdir(), `${PROJECT_WORKTREE_SNAPSHOT_PREFIX}${process.pid}-`));
+}
 function snapshotBranchTrees(projectRoot, branches) {
-  const root = import_node_fs.default.mkdtempSync(import_node_path.default.join(import_node_os.default.tmpdir(), "r5d-project-worktrees-"));
+  const root = createProjectWorktreeSnapshotRoot();
   const paths = /* @__PURE__ */ new Map();
-  for (const { branchName } of branches) {
-    const checkoutPath = branchPath(projectRoot, branchName);
-    if (!import_node_fs.default.existsSync(checkoutPath)) continue;
-    const snapshotPath = import_node_path.default.join(root, ...branchName.split("/"));
-    (0, import_working_tree_mirror.mirrorWorkingTree)({ sourceRoot: checkoutPath, targetRoot: snapshotPath, sourceMode: "all", deletionMode: "all" });
-    paths.set(branchName, snapshotPath);
+  try {
+    for (const { branchName } of branches) {
+      const checkoutPath = branchPath(projectRoot, branchName);
+      if (!import_node_fs.default.existsSync(checkoutPath)) continue;
+      const snapshotPath = import_node_path.default.join(root, ...branchName.split("/"));
+      (0, import_working_tree_mirror.mirrorWorkingTree)({ sourceRoot: checkoutPath, targetRoot: snapshotPath, sourceMode: "all", deletionMode: "all" });
+      paths.set(branchName, snapshotPath);
+    }
+    return { root, paths };
+  } catch (error) {
+    import_node_fs.default.rmSync(root, { recursive: true, force: true });
+    throw error;
+  }
+}
+function isProcessAlive(processId) {
+  try {
+    process.kill(processId, 0);
+    return true;
+  } catch (error) {
+    return error.code !== "ESRCH";
   }
-  return { root, paths };
+}
+function cleanupStaleProjectWorktreeSnapshots(input = {}) {
+  const temporaryRoot = import_node_path.default.resolve(input.temporaryRoot ?? import_node_os.default.tmpdir());
+  const processAlive = input.processAlive ?? isProcessAlive;
+  const removed = [];
+  const failed = [];
+  let entries;
+  try {
+    entries = import_node_fs.default.readdirSync(temporaryRoot, { withFileTypes: true });
+  } catch (error) {
+    if (error.code === "ENOENT") return { removed, failed };
+    return { removed, failed: [{ path: temporaryRoot, error: error instanceof Error ? error.message : String(error) }] };
+  }
+  for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+    const match = PROJECT_WORKTREE_SNAPSHOT_NAME.exec(entry.name);
+    if (!match) continue;
+    const ownerProcessId = Number(match[1]);
+    if (!Number.isSafeInteger(ownerProcessId) || processAlive(ownerProcessId)) continue;
+    const candidate = import_node_path.default.join(temporaryRoot, entry.name);
+    try {
+      const stat = import_node_fs.default.lstatSync(candidate);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) continue;
+      import_node_fs.default.rmSync(candidate, { recursive: true, force: true });
+      removed.push(candidate);
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      failed.push({ path: candidate, error: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  return { removed, failed };
 }
 function configureRepository(input) {
   if (tryGit(input.primaryPath, ["remote", "get-url", "origin"])) {
@@ -185,7 +228,16 @@ function configureRepository(input) {
   } else {
     git(input.primaryPath, ["remote", "add", "origin", input.originUrl], "configure project origin");
   }
+  tryGit(input.primaryPath, ["config", "--local", "--unset-all", "remote.origin.pushurl"]);
   git(input.primaryPath, ["config", "--local", "--replace-all", "credential.helper", ""], "reset project credential helpers");
+  git(input.primaryPath, ["config", "--local", "credential.useHttpPath", "false"], "configure project credential path matching");
+  if (input.originCredentialUsername) {
+    git(
+      input.primaryPath,
+      ["config", "--local", "--replace-all", (0, import_git_process_environment.gitCredentialUsernameConfigKey)(input.originUrl), input.originCredentialUsername],
+      "configure project credential username"
+    );
+  }
   if (input.credentialHelper) {
     git(
       input.primaryPath,
@@ -202,19 +254,25 @@ function configureRepository(input) {
   }
 }
 function fetchProjectHeads(input) {
-  const originFetch = gitResult(
-    input.primaryPath,
-    ["fetch", "--no-recurse-submodules", "--prune", "origin", "+refs/heads/*:refs/remotes/origin/*"],
-    input.originAuth
-  );
+  const originFetch = gitResult(input.primaryPath, [
+    ...(0, import_git_process_environment.gitTransportSecurityArgs)(input.originUrl, input.credentialHelper, input.originCredentialUsername),
+    "fetch",
+    "--no-recurse-submodules",
+    "--prune",
+    "origin",
+    "+refs/heads/*:refs/remotes/origin/*"
+  ]);
   if (originFetch.exitCode !== 0) {
     throw new Error(`Fetch project origin: ${originFetch.stderr || originFetch.stdout || `git exited ${originFetch.exitCode}`}`);
   }
-  const mirrorFetch = gitResult(
-    input.primaryPath,
-    ["fetch", "--no-recurse-submodules", "--prune", input.mirrorUrl, "+refs/heads/*:refs/r5d/mirror/*"],
-    input.mirrorAuth
-  );
+  const mirrorFetch = gitResult(input.primaryPath, [
+    ...(0, import_git_process_environment.gitTransportSecurityArgs)(input.mirrorUrl, input.credentialHelper, input.mirrorCredentialUsername),
+    "fetch",
+    "--no-recurse-submodules",
+    "--prune",
+    input.mirrorUrl,
+    "+refs/heads/*:refs/r5d/mirror/*"
+  ]);
   if (mirrorFetch.exitCode !== 0 && !/(couldn't find remote ref|does not have any commits|remote repository is empty|no such ref)/i.test(
     `${mirrorFetch.stderr}
 ${mirrorFetch.stdout}`
@@ -224,11 +282,19 @@ ${mirrorFetch.stdout}`
 }
 function ensureCommitAvailable(input) {
   if (tryGit(input.primaryPath, ["cat-file", "-e", `${input.commitHash}^{commit}`])) return;
-  for (const [url, auth] of [
-    [input.mirrorUrl, input.mirrorAuth],
-    [input.originUrl, input.originAuth]
+  for (const [url, username] of [
+    [input.mirrorUrl, input.mirrorCredentialUsername],
+    [input.originUrl, input.originCredentialUsername]
   ]) {
-    if (tryGit(input.primaryPath, ["fetch", "--no-recurse-submodules", "--no-tags", url, input.commitHash], auth)) return;
+    if (tryGit(input.primaryPath, [
+      ...(0, import_git_process_environment.gitTransportSecurityArgs)(url, input.credentialHelper, username),
+      "fetch",
+      "--no-recurse-submodules",
+      "--no-tags",
+      url,
+      input.commitHash
+    ]))
+      return;
   }
   throw new Error(`Project base commit ${input.commitHash} is unavailable from origin and the canonical mirror`);
 }
@@ -373,7 +439,7 @@ function createLinkedProjectBranch(input) {
   });
   if (overlappingWorktree) throw new Error(`Project branch folder overlaps linked worktree ${overlappingWorktree}`);
   const sourceHead = git(sourcePath, ["rev-parse", "HEAD"], "resolve source branch head");
-  const snapshotRoot = import_node_fs.default.mkdtempSync(import_node_path.default.join(import_node_os.default.tmpdir(), "r5d-project-branch-"));
+  const snapshotRoot = createProjectWorktreeSnapshotRoot();
   try {
     (0, import_working_tree_mirror.mirrorWorkingTree)({ sourceRoot: sourcePath, targetRoot: snapshotRoot, sourceMode: "git", deletionMode: "all" });
     git(sourcePath, ["branch", input.branchName, sourceHead], `create project branch ${input.branchName}`);
@@ -432,11 +498,13 @@ function removeProjectWorktrees(input) {
 }
 function deleteProjectMirrorBranch(input) {
   (0, import_managed_paths.validateManagedBranchName)(input.branchName);
-  const deleted = gitResult(
-    input.gitDirectory,
-    ["push", "--no-recurse-submodules", input.mirrorUrl, `:refs/heads/${input.branchName}`],
-    input.mirrorAuth
-  );
+  const deleted = gitResult(input.gitDirectory, [
+    ...(0, import_git_process_environment.gitTransportSecurityArgs)(input.mirrorUrl, input.credentialHelper, input.credentialUsername),
+    "push",
+    "--no-recurse-submodules",
+    input.mirrorUrl,
+    `:refs/heads/${input.branchName}`
+  ]);
   if (deleted.exitCode !== 0 && !/(remote ref does not exist|unable to delete|no such ref)/i.test(`${deleted.stderr}
 ${deleted.stdout}`)) {
     throw new Error(
@@ -456,9 +524,14 @@ function pushProjectMirrorHeads(input) {
     }
     git(
       checkoutPath,
-      ["push", "--no-recurse-submodules", input.mirrorUrl, `+HEAD:refs/heads/${branchName}`],
-      `push hidden project mirror for ${branchName}`,
-      input.mirrorAuth
+      [
+        ...(0, import_git_process_environment.gitTransportSecurityArgs)(input.mirrorUrl, input.credentialHelper, input.credentialUsername),
+        "push",
+        "--no-recurse-submodules",
+        input.mirrorUrl,
+        `+HEAD:refs/heads/${branchName}`
+      ],
+      `push hidden project mirror for ${branchName}`
     );
     results.push({ branchName, head, pushed: true });
   }
@@ -466,11 +539,14 @@ function pushProjectMirrorHeads(input) {
 }
 function fastForwardProjectHeadsFromMirror(input) {
   const primaryPath = branchPath(input.projectRoot, input.primaryBranchName);
-  const fetch = gitResult(
-    primaryPath,
-    ["fetch", "--no-recurse-submodules", "--prune", input.mirrorUrl, "+refs/heads/*:refs/r5d/mirror/*"],
-    input.mirrorAuth
-  );
+  const fetch = gitResult(primaryPath, [
+    ...(0, import_git_process_environment.gitTransportSecurityArgs)(input.mirrorUrl, input.credentialHelper, input.credentialUsername),
+    "fetch",
+    "--no-recurse-submodules",
+    "--prune",
+    input.mirrorUrl,
+    "+refs/heads/*:refs/r5d/mirror/*"
+  ]);
   if (fetch.exitCode !== 0)
     throw new Error(`Refresh project head mirror: ${fetch.stderr || fetch.stdout || `git exited ${fetch.exitCode}`}`);
   return [...input.branchNames].sort().map((branchName) => {
@@ -487,10 +563,13 @@ function fastForwardProjectHeadsFromMirror(input) {
   });
 }
 const projectWorktreesTestHarness = {
-  commandArgs: (args, auth) => ["git", ...NON_RECURSIVE_GIT_CONFIG, ...authArgs(auth), ...args]
+  commandArgs: gitCommandArgs,
+  configureRepository
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  PROJECT_WORKTREE_SNAPSHOT_PREFIX,
+  cleanupStaleProjectWorktreeSnapshots,
   createLinkedProjectBranch,
   deleteLinkedProjectBranch,
   deleteProjectMirrorBranch,

package/dist/cjs/working-tree-mirror.cjs

@@ -34,6 +34,7 @@ __export(working_tree_mirror_exports, {
 module.exports = __toCommonJS(working_tree_mirror_exports);
 var import_node_fs = __toESM(require("node:fs"), 1);
 var import_node_path = __toESM(require("node:path"), 1);
+var import_git_process_environment = require("./git-process-environment.cjs");
 function isGitMetadataPath(relativePath) {
   return relativePath.split("/").includes(".git");
 }
@@ -70,7 +71,7 @@ function gitEligibleRoots(root) {
       cwd: root,
       stdout: "pipe",
       stderr: "pipe",
-      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+      env: (0, import_git_process_environment.workerGitProcessEnvironment)()
     }
   );
   if (result.exitCode !== 0) {

package/dist/cjs/workspace-git-sync.cjs

@@ -40,6 +40,7 @@ __export(workspace_git_sync_exports, {
 module.exports = __toCommonJS(workspace_git_sync_exports);
 var import_node_fs = __toESM(require("node:fs"), 1);
 var import_node_path = __toESM(require("node:path"), 1);
+var import_git_process_environment = require("./git-process-environment.cjs");
 var import_working_tree_mirror = require("./working-tree-mirror.cjs");
 const WORKSPACE_GIT_BRANCH = "main";
 const MAX_WORKSPACE_GIT_DIFF_BYTES = 5 * 1024 * 1024;
@@ -53,25 +54,18 @@ const NON_RECURSIVE_GIT_CONFIG = [
   "-c",
   "push.recurseSubmodules=false"
 ];
-function normalizedHttpOrigin(value) {
-  try {
-    const url = new URL(value);
-    return `${url.protocol}//${url.host}`;
-  } catch {
-    return value.replace(/\/+$/, "");
-  }
+function gitCommandArgs(args) {
+  return ["git", ...NON_RECURSIVE_GIT_CONFIG, ...args];
 }
-function authArgs(auth) {
-  if (!auth) return [];
-  const key = `http.${normalizedHttpOrigin(auth.extraHeaderUrl)}/.extraHeader`;
-  return ["-c", "http.extraHeader=", "-c", `${key}=`, "-c", `${key}=${auth.header}`];
+function workspaceCloneCommandArgs(args, remoteUrl, credentialHelper, credentialUsername) {
+  return gitCommandArgs([...(0, import_git_process_environment.gitTransportSecurityArgs)(remoteUrl, credentialHelper, credentialUsername), ...args]);
 }
-function gitResult(cwd, args, auth) {
-  const result = Bun.spawnSync(["git", ...NON_RECURSIVE_GIT_CONFIG, ...authArgs(auth), ...args], {
+function gitResult(cwd, args) {
+  const result = Bun.spawnSync(gitCommandArgs(args), {
     cwd,
     stdout: "pipe",
     stderr: "pipe",
-    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+    env: (0, import_git_process_environment.workerGitProcessEnvironment)()
   });
   return {
     exitCode: result.exitCode,
@@ -79,13 +73,13 @@ function gitResult(cwd, args, auth) {
     stderr: result.stderr.toString().trim()
   };
 }
-function git(cwd, args, action, auth) {
-  const result = gitResult(cwd, args, auth);
+function git(cwd, args, action) {
+  const result = gitResult(cwd, args);
   if (result.exitCode !== 0) throw new Error(`${action}: ${result.stderr || result.stdout || `git exited ${result.exitCode}`}`);
   return result.stdout;
 }
-function tryGit(cwd, args, auth) {
-  return gitResult(cwd, args, auth).exitCode === 0;
+function tryGit(cwd, args) {
+  return gitResult(cwd, args).exitCode === 0;
 }
 function revParse(workspacePath, revision) {
   const result = gitResult(workspacePath, ["rev-parse", "--verify", revision]);
@@ -131,9 +125,22 @@ function configureWorkspaceRepository(input) {
   } else {
     git(input.workspacePath, ["remote", "add", "origin", input.remoteUrl], "configure workspace origin");
   }
+  tryGit(input.workspacePath, ["config", "--local", "--unset-all", "remote.origin.pushurl"]);
   git(input.workspacePath, ["config", "--local", "--replace-all", "credential.helper", ""], "reset workspace credential helpers");
+  git(input.workspacePath, ["config", "--local", "credential.useHttpPath", "false"], "configure workspace credential path matching");
+  if (input.credentialUsername) {
+    git(
+      input.workspacePath,
+      ["config", "--local", "--replace-all", (0, import_git_process_environment.gitCredentialUsernameConfigKey)(input.remoteUrl), input.credentialUsername],
+      "configure workspace credential username"
+    );
+  }
   if (input.credentialHelper) {
-    git(input.workspacePath, ["config", "--local", "--add", "credential.helper", input.credentialHelper], "configure workspace credential helper");
+    git(
+      input.workspacePath,
+      ["config", "--local", "--add", "credential.helper", input.credentialHelper],
+      "configure workspace credential helper"
+    );
   }
   const name = input.gitIdentity.name.trim();
   const email = input.gitIdentity.email.trim();
@@ -141,19 +148,16 @@ function configureWorkspaceRepository(input) {
   git(input.workspacePath, ["config", "--local", "user.name", name], "configure workspace Git user name");
   git(input.workspacePath, ["config", "--local", "user.email", email], "configure workspace Git user email");
 }
-function fetchWorkspaceHead(workspacePath, remoteAuth) {
-  const result = gitResult(
-    workspacePath,
-    [
-      "fetch",
-      "--no-recurse-submodules",
-      "--prune",
-      "--update-shallow",
-      "origin",
-      `+refs/heads/${WORKSPACE_GIT_BRANCH}:refs/remotes/origin/${WORKSPACE_GIT_BRANCH}`
-    ],
-    remoteAuth
-  );
+function fetchWorkspaceHead(workspacePath, remoteUrl, credentialHelper, credentialUsername) {
+  const result = gitResult(workspacePath, [
+    ...(0, import_git_process_environment.gitTransportSecurityArgs)(remoteUrl, credentialHelper, credentialUsername),
+    "fetch",
+    "--no-recurse-submodules",
+    "--prune",
+    "--update-shallow",
+    "origin",
+    `+refs/heads/${WORKSPACE_GIT_BRANCH}:refs/remotes/origin/${WORKSPACE_GIT_BRANCH}`
+  ]);
   if (result.exitCode !== 0) {
     const detail = `${result.stderr}
 ${result.stdout}`;
@@ -170,11 +174,17 @@ function ensureWorkspaceGitClone(input) {
   if (!import_node_fs.default.existsSync(gitPath)) {
     import_node_fs.default.rmSync(workspacePath, { recursive: true, force: true });
     import_node_fs.default.mkdirSync(import_node_path.default.dirname(workspacePath), { recursive: true });
-    const clone = gitResult(
-      void 0,
+    const cloneCommand = workspaceCloneCommandArgs(
       ["clone", "--no-recurse-submodules", "--branch", WORKSPACE_GIT_BRANCH, input.remoteUrl, workspacePath],
-      input.remoteAuth
+      input.remoteUrl,
+      input.credentialHelper,
+      input.credentialUsername
     );
+    const clone = Bun.spawnSync(cloneCommand, {
+      stdout: "pipe",
+      stderr: "pipe",
+      env: (0, import_git_process_environment.workerGitProcessEnvironment)()
+    });
     if (clone.exitCode !== 0) {
       import_node_fs.default.rmSync(workspacePath, { recursive: true, force: true });
       import_node_fs.default.mkdirSync(workspacePath, { recursive: true });
@@ -187,7 +197,7 @@ function ensureWorkspaceGitClone(input) {
   if (!revParse(workspacePath, WORKSPACE_GIT_INTEGRATED_REF) && previousRemoteHead && localHeadBeforeFetch && tryGit(workspacePath, ["merge-base", "--is-ancestor", previousRemoteHead, localHeadBeforeFetch])) {
     updateIntegratedWorkspaceHead(workspacePath, previousRemoteHead);
   }
-  const remoteHead = fetchWorkspaceHead(workspacePath, input.remoteAuth);
+  const remoteHead = fetchWorkspaceHead(workspacePath, input.remoteUrl, input.credentialHelper, input.credentialUsername);
   let localHead = revParse(workspacePath, "HEAD");
   if (!localHead && remoteHead) {
     git(
@@ -273,7 +283,7 @@ function resetWorkspaceGit(input) {
   const initial = ensureWorkspaceGitClone({ ...input, workspacePath });
   const status = gitResult(workspacePath, ["status", "--porcelain=v1", "-z"]);
   const discardedPaths = status.exitCode === 0 ? status.stdout.split("\0").filter(Boolean).map((entry) => entry.slice(3)).sort() : [];
-  const remoteHead = fetchWorkspaceHead(workspacePath, input.remoteAuth);
+  const remoteHead = fetchWorkspaceHead(workspacePath, input.remoteUrl, input.credentialHelper, input.credentialUsername);
   if (remoteHead) {
     git(workspacePath, ["checkout", "--no-recurse-submodules", "-B", WORKSPACE_GIT_BRANCH, remoteHead], "reset workspace main");
     git(workspacePath, ["clean", "-fd", "--", "."], "remove untracked workspace changes");
@@ -299,9 +309,10 @@ function emptyTreeHash(workspacePath) {
     stdin: Buffer.alloc(0),
     stdout: "pipe",
     stderr: "pipe",
-    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+    env: (0, import_git_process_environment.workerGitProcessEnvironment)()
   });
-  if (result.exitCode !== 0) throw new Error(`Create empty workspace tree: ${result.stderr.toString().trim() || `git exited ${result.exitCode}`}`);
+  if (result.exitCode !== 0)
+    throw new Error(`Create empty workspace tree: ${result.stderr.toString().trim() || `git exited ${result.exitCode}`}`);
   return result.stdout.toString().trim();
 }
 function changedPaths(workspacePath, baseRevision, headRevision) {
@@ -310,15 +321,12 @@ function changedPaths(workspacePath, baseRevision, headRevision) {
 }
 async function diffSizeBytes(workspacePath, baseRevision, headRevision, limit) {
   const base = baseRevision ?? emptyTreeHash(workspacePath);
-  const subprocess = Bun.spawn(
-    ["git", ...NON_RECURSIVE_GIT_CONFIG, "diff", "--binary", "--no-ext-diff", base, headRevision],
-    {
-      cwd: workspacePath,
-      stdout: "pipe",
-      stderr: "pipe",
-      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
-    }
-  );
+  const subprocess = Bun.spawn(["git", ...NON_RECURSIVE_GIT_CONFIG, "diff", "--binary", "--no-ext-diff", base, headRevision], {
+    cwd: workspacePath,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: (0, import_git_process_environment.workerGitProcessEnvironment)()
+  });
   const stderrPromise = new Response(subprocess.stderr).text();
   const reader = subprocess.stdout.getReader();
   let total = 0;
@@ -439,7 +447,7 @@ async function synchronizeWorkspaceGit(input) {
       "commit workspace working trees"
     );
   }
-  let remoteHead = fetchWorkspaceHead(workspacePath, input.remoteAuth);
+  let remoteHead = fetchWorkspaceHead(workspacePath, input.remoteUrl, input.credentialHelper, input.credentialUsername);
   let rebaseCount = 0;
   let updated = false;
   for (let pushAttempt = 0; pushAttempt < maxPushAttempts; pushAttempt += 1) {
@@ -515,10 +523,14 @@ async function synchronizeWorkspaceGit(input) {
         skippedMountIds: selected.skipped.map(({ id }) => id).sort()
       };
     }
-    const pushArgs = ["push", "--no-recurse-submodules"];
+    const pushArgs = [
+      ...(0, import_git_process_environment.gitTransportSecurityArgs)(input.remoteUrl, input.credentialHelper, input.credentialUsername),
+      "push",
+      "--no-recurse-submodules"
+    ];
     if (input.allowLargeDiff) pushArgs.push(`--push-option=${WORKSPACE_GIT_CONFIRMED_LARGE_DIFF_PUSH_OPTION}`);
     pushArgs.push("origin", `HEAD:refs/heads/${WORKSPACE_GIT_BRANCH}`);
-    const push = gitResult(workspacePath, pushArgs, input.remoteAuth);
+    const push = gitResult(workspacePath, pushArgs);
     if (push.exitCode === 0) {
       updateIntegratedWorkspaceHead(workspacePath, localHead);
       await input.afterWorkspacePublished?.({
@@ -543,12 +555,14 @@ async function synchronizeWorkspaceGit(input) {
 ${push.stdout}`)) {
       throw new Error(`Push workspace main: ${push.stderr || push.stdout || `git exited ${push.exitCode}`}`);
     }
-    remoteHead = fetchWorkspaceHead(workspacePath, input.remoteAuth);
+    remoteHead = fetchWorkspaceHead(workspacePath, input.remoteUrl, input.credentialHelper, input.credentialUsername);
   }
   throw new Error(`Workspace push did not converge after ${maxPushAttempts} attempts`);
 }
 const workspaceGitSyncTestHarness = {
-  commandArgs: (args, auth) => ["git", ...NON_RECURSIVE_GIT_CONFIG, ...authArgs(auth), ...args],
+  commandArgs: gitCommandArgs,
+  workspaceCloneCommandArgs,
+  configureWorkspaceRepository,
   mirrorMountsToWorkspace,
   hydrateMountsFromWorkspace: hydrateWorkspaceGitMounts
 };

package/dist/mjs/git-process-environment.mjs

@@ -0,0 +1,105 @@
+import { devNull } from "node:os";
+const ALLOWED_GIT_ENVIRONMENT_KEYS = [
+  "PATH",
+  "USER",
+  "LOGNAME",
+  "SHELL",
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  "TZ",
+  "LANG",
+  "LANGUAGE",
+  "LC_ALL",
+  "LC_CTYPE",
+  "LC_COLLATE",
+  "LC_MESSAGES",
+  "LC_MONETARY",
+  "LC_NUMERIC",
+  "LC_TIME",
+  "LC_ADDRESS",
+  "LC_IDENTIFICATION",
+  "LC_MEASUREMENT",
+  "LC_NAME",
+  "LC_PAPER",
+  "LC_TELEPHONE",
+  "SystemRoot",
+  "SYSTEMROOT",
+  "WINDIR",
+  "COMSPEC",
+  "PATHEXT",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR",
+  "CURL_CA_BUNDLE",
+  "GIT_SSL_CAINFO",
+  "GIT_SSL_CAPATH",
+  "GIT_EXEC_PATH",
+  "GIT_OPTIONAL_LOCKS"
+];
+function workerGitProcessEnvironment(source = process.env) {
+  const environment = {
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_CONFIG_GLOBAL: devNull,
+    GIT_CONFIG_NOSYSTEM: "1",
+    GIT_ATTR_NOSYSTEM: "1"
+  };
+  for (const key of ALLOWED_GIT_ENVIRONMENT_KEYS) {
+    if (source[key] !== void 0) environment[key] = source[key];
+  }
+  return environment;
+}
+function gitHttpAuthorizationClearArgs(remoteUrl) {
+  let remote;
+  try {
+    remote = new URL(remoteUrl);
+  } catch {
+    return ["-c", "http.extraHeader="];
+  }
+  if ((remote.protocol === "https:" || remote.protocol === "http:") && (remote.username || remote.password)) {
+    throw new Error("Git credentials must not be embedded in a remote URL");
+  }
+  if (remote.protocol !== "https:" && remote.protocol !== "http:") return ["-c", "http.extraHeader="];
+  remote.hash = "";
+  remote.search = "";
+  return ["-c", "http.extraHeader=", "-c", `http.${remote.origin}/.extraHeader=`, "-c", `http.${remote.href}.extraHeader=`];
+}
+function gitCredentialHelperConfigArgs(credentialHelper) {
+  return [
+    "-c",
+    "credential.helper=",
+    ...credentialHelper ? ["-c", `credential.helper=${credentialHelper}`] : [],
+    "-c",
+    "credential.useHttpPath=false"
+  ];
+}
+function gitCredentialUsernameConfigKey(remoteUrl) {
+  const remote = new URL(remoteUrl);
+  if ((remote.protocol === "https:" || remote.protocol === "http:") && (remote.username || remote.password)) {
+    throw new Error("Git credentials must not be embedded in a remote URL");
+  }
+  if (remote.protocol !== "https:" && remote.protocol !== "http:") {
+    throw new Error("Git credential usernames require an HTTP remote URL");
+  }
+  remote.hash = "";
+  remote.search = "";
+  return `credential.${remote.href}.username`;
+}
+function gitCredentialUsernameConfigArgs(remoteUrl, credentialUsername) {
+  if (!credentialUsername) return [];
+  if (/[\0\r\n]/.test(credentialUsername)) throw new Error("Invalid Git credential username");
+  return ["-c", `${gitCredentialUsernameConfigKey(remoteUrl)}=${credentialUsername}`];
+}
+function gitTransportSecurityArgs(remoteUrl, credentialHelper, credentialUsername) {
+  return [
+    ...gitHttpAuthorizationClearArgs(remoteUrl),
+    ...gitCredentialHelperConfigArgs(credentialHelper),
+    ...gitCredentialUsernameConfigArgs(remoteUrl, credentialUsername)
+  ];
+}
+export {
+  gitCredentialHelperConfigArgs,
+  gitCredentialUsernameConfigKey,
+  gitHttpAuthorizationClearArgs,
+  gitTransportSecurityArgs,
+  workerGitProcessEnvironment
+};