pi-codex-marketplace 0.5.0 → 0.6.0

package/README.md

@@ -37,7 +37,7 @@ Nine subcommands, no arguments = 總覽：
 
 | 子命令 | 行為 |
 |--------|------|
-| `add <路徑\|網址>` | 註冊 marketplace（本機資料夾、GitHub 完整網址、`owner/repo` 簡寫皆收），自動偵測 codex／claude 格式並告知 `偵測：<format> marketplace · N plugins`。重複註冊同來源被拒絕並提示下一步。Git 來源以安全線取得（`core.hooksPath=/dev/null`、`GIT_LFS_SKIP_SMUDGE=1`、`GIT_TERMINAL_PROMPT=0`），catalog 解析失敗明示錯誤、不註冊。私有 HTTPS repo 預設 credential-free（有權限也可能 401）——先以 `PI_CODEX_MARKETPLACE_CREDENTIAL_HELPERS` 核准 credential helper 再 add（逐次生效、永不持久化），或改用 SSH 定位器；用法與範例見下方〈私有 Git repo：Credentialed Acquisition〉。 |
+| `add <路徑\|網址>` | 註冊 marketplace（本機資料夾、GitHub 完整網址、`owner/repo` 簡寫皆收），自動偵測 codex／claude 格式並告知 `偵測：<format> marketplace · N plugins`。重複註冊同來源被拒絕並提示下一步。Git 來源以安全線取得（`core.hooksPath=/dev/null`、`GIT_LFS_SKIP_SMUDGE=1`、`GIT_TERMINAL_PROMPT=0`），catalog 解析失敗明示錯誤、不註冊。私有 HTTPS repo **開箱即用**：自動偵測本機憑證來源（`gh` 登入／macOS 鑰匙圈／`credential-store`）並逐次核准；也可用 `PI_CODEX_MARKETPLACE_CREDENTIAL_HELPERS` 顯式覆蓋核准清單（逐次生效、永不持久化），或改用 SSH 定位器；用法與範例見下方〈私有 Git repo：Credentialed Acquisition〉。 |
 | `list [名稱]` | 列出 plugins（編號／所屬 marketplace／狀態：可安裝・已裝啟用・已裝停用・unavailable＋原因），可帶 marketplace 名稱過濾。 |
 | `install <編號\|名稱>` | 裝到**當下最新**並自動啟用＋reload。成功話術如 `安裝 "name"（N skills：a, b, c）· 已重新載入生效`；同名衝突列出 `⚠ skill "b" 與既有同名，未投影（名稱衝突）`。**重複安裝＝重抓最新覆寫**（重裝＝更新，不報錯）。 |
 | `update` | 對全部已註冊 marketplace 重抓最新：有變化的 plugin 升到最新、無變化各自顯示「無變化」；整體以「已重新載入生效」收尾（有變時）。 |
@@ -55,7 +55,15 @@ Nine subcommands, no arguments = 總覽：
 
 ### 私有 Git repo：Credentialed Acquisition（核准式取得）
 
-預設 `add`／`update` 對 Git 來源完全 credential-free：不執行任何 credential helper，因此「有權限卻失敗」時，私有 HTTPS repo 會以 401 失敗（並提示核准或改用 SSH）。若要核准 credential helper，以逗號分隔設定環境變數（**逐次生效、永不持久化**，`add` 與 `update` 共用同一核准來源）：
+對私有 HTTPS repo，`add`／`update` **開箱即用**：預設會自動偵測本機已存在的憑證來源並逐次核准（**固定白名單**，不讀本機 gitconfig 的任意 helper；偵測結果只限該次呼叫、永不持久化）：
+
+| 偵測來源 | 核准的 credential helper |
+|---|---|
+| `gh` CLI 已登入（`gh auth status` 成功） | `!gh auth git-credential` |
+| macOS 原生鑰匙圈 helper 存在 | `osxkeychain` |
+| git `credential-store` 存在 | `store`（明文憑證檔，請知悉風險） |
+
+已註冊或欲手動控制時，以逗號分隔設定環境變數——**顯式設定完全覆蓋自動偵測**（逐次生效、永不持久化，`add` 與 `update` 共用同一核准來源）：
 
 ```
 PI_CODEX_MARKETPLACE_CREDENTIAL_HELPERS='store, !f() { echo "username=${GITHUB_USER}"; echo "password=${GITHUB_TOKEN}"; }; f'
@@ -64,10 +72,11 @@ PI_CODEX_MARKETPLACE_CREDENTIAL_HELPERS='store, !f() { echo "username=${GITHUB_U
 
 Credentialed Acquisition 語意（安全線）：
 
-- 核准僅限該次呼叫（per-invocation）：環境變數逐指令讀取，**不寫入** Bridge State、設定檔或任何持久化位置；重開 session 後需重新設定。
-- 值為 git `credential.helper` 字串，逗號分隔、各項 trim、空項目忽略；未設定或空白＝未核准（行為與 credential-free 完全相同，安全線其餘禁制不變）。
+- 預設（未設 env）＝自動偵測固定白名單（gh／osxkeychain／store），僅限該次呼叫：**不寫入** Bridge State、設定檔或任何持久化位置；偵測到的 helper 以命令列 `credential.helper=` 傳入，gitconfig 的其他 helper（含 URL-scoped）仍被排除。
+- 設定 env 後完全覆蓋：值為 git `credential.helper` 字串，逗號分隔、各項 trim、空項目忽略；未設定且偵測無結果＝無任何 helper（行為與 credential-free 完全相同，安全線其餘禁制不變）。
 - 憑證與核准清單**永不**進入指令輸出、Bridge State、Canonical Git Locator（定位器）、Validation Snapshot（快照）或 cache identity（快取身份）——取得流程的 identity 判定與憑證完全無關。
-- 已核准 helper 仍被遠端拒絕（401）時，錯誤訊息提示檢查憑證；未核准時提示核准或改用 SSH。
+- 自動偵測或已核准的 helper 仍被遠端拒絕（401）時，錯誤訊息提示檢查登入（`gh auth status`／keychain）或設環境變數核准其他 helper；本機偵測不到任何憑證來源時提示設環境變數或改用 SSH。
+- 設定的 helper 名稱無效時（例如直接寫 `gh`——它不是 git 原生的 credential helper 執行檔），錯誤訊息指出正確寫法：原生 helper 名稱（`osxkeychain`／`store`）或 shell form（`!gh auth git-credential`）。
 
 #### SSH 定位器：私有 repo 的替代路徑
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-codex-marketplace",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Bridge Package for Codex and Claude Marketplace compatibility in Pi — 極簡 /codex-marketplace 純文字指令（add/list/install/update/disable/enable/remove/forget）、單一 Global Bridge State、當下最新安裝與即時投影",
   "type": "module",
   "keywords": [

package/src/bridge/command.ts

@@ -31,7 +31,11 @@ import { findEntryByManifestName, GIT_FAMILY_UNAVAILABLE_REASON, type Catalog, t
 import type { ValidationFinding } from '../registration/findings.js';
 import { normalizeGitLocator } from '../registration/git-locator.js';
 import { acquireGitSource, cleanupAcquisition, type GitExecutor } from '../registration/git-acquisition.js';
-import { CREDENTIAL_HELPERS_ENV, parseCredentialHelpers } from '../registration/credential-helpers.js';
+import {
+  CREDENTIAL_HELPERS_ENV,
+  resolveApprovedHelpers,
+  type CredentialHelperDetector,
+} from '../registration/credential-helpers.js';
 import { gitSourceKey } from '../registration/source-key.js';
 import { buildGitSnapshot } from '../registration/snapshot.js';
 import { SourceCache } from '../cache/source-cache.js';
@@ -43,6 +47,8 @@ export interface CommandOptions {
   cwd?: string;
   /** Git executor seam for tests — mocks `git` invocations (ls-remote/clone/checkout). */
   gitExecutor?: GitExecutor;
+  /** 自動偵測 seam for tests — mocks gh/keychain/store detection (#117). */
+  credentialHelperDetector?: CredentialHelperDetector;
 }
 
 export interface CommandResult {
@@ -599,12 +605,14 @@ export async function runCommand(
 ): Promise<CommandResult> {
   const rawArgs = typeof argv === 'string' ? argv.trim().split(/\s+/).filter(Boolean) : [...argv];
 
-  // Credentialed Acquisition (#109)：逐次核准的 credential helper allowlist。
-  // 解析結果只經既有 AcquisitionTrustOptions 傳給 Git 取得；底層不讀環境變數，
-  // 未核准（空字串／未設定）時 trust 為 undefined，行為與 credential-free 完全一致。
-  const approvedHelpers = parseCredentialHelpers(process.env[CREDENTIAL_HELPERS_ENV]);
-  const acquireTrust: { allowedCredentialHelpers: string[] } | undefined =
-    approvedHelpers.length > 0 ? { allowedCredentialHelpers: approvedHelpers } : undefined;
+  // Credentialed Acquisition (#109，#117)：逐次核准的 credential helper allowlist。
+  // env 顯式設定 → 完全覆蓋；未設定／空白 → 自動偵測固定白名單（gh／keychain／store），
+  // 開箱即用（私有 repo 不再要求先設 env）。解析結果只經既有 AcquisitionTrustOptions
+  // 傳給 Git 取得；底層不讀環境變數，未核准（偵測也無結果）時 trust 為 undefined，
+  // 行為與 credential-free 完全一致。
+  const resolved = resolveApprovedHelpers(process.env[CREDENTIAL_HELPERS_ENV], opts.credentialHelperDetector);
+  const acquireTrust: { allowedCredentialHelpers: string[]; helperMode: 'detected' | 'approved' } | undefined =
+    resolved.helpers.length > 0 ? { allowedCredentialHelpers: resolved.helpers, helperMode: resolved.mode as 'detected' | 'approved' } : undefined;
 
   // Strip leading command token if passed
   if (rawArgs.length > 0 && (rawArgs[0] === '/codex-marketplace' || rawArgs[0] === 'codex-marketplace')) {

package/src/registration/credential-helpers.ts

@@ -4,17 +4,71 @@
  *
  * Per-invocation approval of git credential helpers via
  * `PI_CODEX_MARKETPLACE_CREDENTIAL_HELPERS` (comma-separated `credential.helper`
- * strings). Empty/unset means "not approved" — behavior identical to today.
- * This module only parses; the resulting allowlist travels through
+ * strings). Empty/unset means "not approved" — but since #117 the approval may also
+ * come from an auto-detected fixed allowlist, so empty/unset falls back to detection.
+ * This module only parses/detects; the resulting allowlist travels through
  * AcquisitionTrustOptions and never touches Bridge State, snapshots, or cache identity.
  */
 
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+
 export const CREDENTIAL_HELPERS_ENV = 'PI_CODEX_MARKETPLACE_CREDENTIAL_HELPERS';
 
+/**
+ * 允許清單來源：#117 開箱即用後，credential helper 可能有兩種來源。
+ * - approved：使用者經 `PI_CODEX_MARKETPLACE_CREDENTIAL_HELPERS` 顯式核准（可完全覆蓋偵測）。
+ * - detected：預設自動偵測的固定白名單（gh CLI／macOS keychain／git credential-store）。
+ * - none：無任何 helper 可用（錯誤訊息給「未核准」指引變體）。
+ */
+export type CredentialHelperMode = 'none' | 'detected' | 'approved';
+
+/**
+ * 自動偵測介面——可注入（測試）或使用預設真機偵測。偵測目標是**固定白名單**，
+ * 不是讀本機 gitconfig：gitconfig 的任意 helper（含 URL-scoped）仍被命令列
+ * `credential.helper=` 清空排除，僅白名單上的 helper 參與（#117，與 ADR 0006
+ * 被拒的「隱式信任本機 git config」不同）。
+ */
+export interface CredentialHelperDetector {
+  /** gh CLI 已登入（`gh auth status` exit 0） */
+  ghLoggedIn(): boolean;
+  /** git 原生 credential helper 執行檔存在（`git --exec-path` 或 PATH） */
+  hasGitHelper(name: string): boolean;
+}
+
+const defaultDetector: CredentialHelperDetector = {
+  ghLoggedIn() {
+    try {
+      const res = spawnSync('gh', ['auth', 'status'], { stdio: 'ignore', timeout: 5000 });
+      return res.status === 0;
+    } catch {
+      return false;
+    }
+  },
+  hasGitHelper(name) {
+    try {
+      const execPath = spawnSync('git', ['--exec-path'], { stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 });
+      if (execPath.status === 0) {
+        const dir = String(execPath.stdout ?? '').trim();
+        if (dir && existsSync(join(dir, `git-${name}`))) return true;
+      }
+    } catch {
+      // fall through to PATH check
+    }
+    try {
+      const which = spawnSync('sh', ['-c', `command -v git-${name}`], { stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 });
+      return which.status === 0 && String(which.stdout ?? '').trim().length > 0;
+    } catch {
+      return false;
+    }
+  },
+};
+
 /**
  * Parse the approval env var into a helper allowlist.
  * Comma-separated, each entry trimmed, empty entries ignored.
- * Empty/unset → no approval ([]).
+ * Empty/unset → no explicit approval ([]).
  */
 export function parseCredentialHelpers(raw: string | undefined): string[] {
   if (!raw) return [];
@@ -22,4 +76,27 @@ export function parseCredentialHelpers(raw: string | undefined): string[] {
     .split(',')
     .map((entry) => entry.trim())
     .filter((entry) => entry.length > 0);
+}
+
+export interface ResolvedCredentialAllowlist {
+  helpers: string[];
+  mode: CredentialHelperMode;
+}
+
+/**
+ * 解析最終 allowlist（#117 開箱即用）：
+ * - env 有非空內容 → 顯式核准，完全覆蓋自動偵測（可預測性不變）。
+ * - env 未設定／空白 → 自動偵測固定白名單。
+ */
+export function resolveApprovedHelpers(
+  raw: string | undefined,
+  detector: CredentialHelperDetector = defaultDetector,
+): ResolvedCredentialAllowlist {
+  const parsed = parseCredentialHelpers(raw);
+  if (parsed.length > 0) return { helpers: parsed, mode: 'approved' };
+  const detected: string[] = [];
+  if (detector.ghLoggedIn()) detected.push('!gh auth git-credential');
+  if (detector.hasGitHelper('credential-osxkeychain')) detected.push('osxkeychain');
+  if (detector.hasGitHelper('credential-store')) detected.push('store');
+  return { helpers: detected, mode: detected.length > 0 ? 'detected' : 'none' };
 }

package/src/registration/findings.ts

@@ -53,6 +53,7 @@ export const RULE = {
   GIT_TRUST_REDIRECT: 'GIT-32',
   GIT_TRUST_CREDENTIAL_HELPER: 'GIT-33',
   GIT_TRUST_AUTH_REQUIRED: 'GIT-34',
+  GIT_TRUST_CREDENTIAL_HELPER_INVALID: 'GIT-35',
 } as const;
 
 export const CODE = {
@@ -77,6 +78,7 @@ export const CODE = {
   GIT_TRUST_REDIRECT: 'GIT_TRUST_REDIRECT',
   GIT_TRUST_CREDENTIAL_HELPER: 'GIT_TRUST_CREDENTIAL_HELPER',
   GIT_TRUST_AUTH_REQUIRED: 'GIT_TRUST_AUTH_REQUIRED',
+  GIT_TRUST_CREDENTIAL_HELPER_INVALID: 'GIT_TRUST_CREDENTIAL_HELPER_INVALID',
   GIT_REPO_NOT_FOUND: 'GIT_REPO_NOT_FOUND',
 } as const;
 

package/src/registration/git-acquisition.ts

@@ -15,7 +15,7 @@ import { join } from 'node:path';
 
 import { CODE, RULE, blocking, type ValidationFinding } from './findings.js';
 import type { CanonicalGitLocator } from './git-locator.js';
-import { CREDENTIAL_HELPERS_ENV } from './credential-helpers.js';
+import { CREDENTIAL_HELPERS_ENV, type CredentialHelperMode } from './credential-helpers.js';
 
 export interface GitExecutor {
   (args: string[], opts?: { cwd?: string; env?: Record<string, string> }): Promise<{
@@ -47,6 +47,8 @@ export function defaultGitExecutor(): GitExecutor {
 export interface AcquisitionTrustOptions {
   knownHostsFile?: string;
   allowedCredentialHelpers?: string[];
+  /** 允許清單來源（#117）：approved＝env 顯式核准；detected＝自動偵測白名單；缺省視為 approved（相容既有 caller）。 */
+  helperMode?: CredentialHelperMode;
   gitPath?: string;
   sshCommand?: string;
   allowRedirects?: boolean;
@@ -129,19 +131,33 @@ function isFullHex(s: string): boolean {
 
 /**
  * 共用失敗分類（#110）：ls-remote 與 clone 兩條取得路徑採用同一分類與訊息。
- * - auth：伺服器 401（authentication failed）→ GIT-34，訊息依核准狀態分兩變體；
- * - helper：credential source 拒絕（原字串匹配的 helper 拒絕情境）→ GIT-33 保留；
+ * - auth：伺服器 401（authentication failed）→ GIT-34，訊息依 helper 模式分三變體（none／detected／approved）。
+ * - invalid-helper：核准的 helper 名稱無效（git 找不到對應執行檔，如 `gh`）→ GIT-35，
+ *   訊息指出正確寫法（原生 helper 名稱或 `!命令` shell form）。放在 auth 之前：stderr 常同時含兩者。
  * - not-found：「repository not found」類字串 → 標明 repo 不存在（保留非 GitHub 情境；
  *   GitHub smart-HTTP 對不存在 repo 實測回 401，落入 auth 分支）。
+ * - helper：credential source 拒絕（原字串匹配的 helper 拒絕情境）→ GIT-33 保留。
  */
 type FailureKind =
   | { kind: 'host-key'; isChanged: boolean }
   | { kind: 'redirect' }
   | { kind: 'not-found' }
-  | { kind: 'auth'; approved: boolean }
-  | { kind: 'helper'; approved: boolean };
+  | { kind: 'invalid-helper'; name: string }
+  | { kind: 'auth'; mode: CredentialHelperMode }
+  | { kind: 'helper'; mode: CredentialHelperMode };
 
-function classifyFailure(stderr: string, approvedHelpers: boolean): FailureKind | null {
+const INVALID_HELPER_RE = /git: 'credential-([^']+)' is not a git command/i;
+
+/**
+ * 從 allowlist 推導模式：未提供時視為 approved（既有 caller 語意）；
+ * 空 allowlist → none。
+ */
+function modeOf(trust: AcquisitionTrustOptions | undefined): CredentialHelperMode {
+  if (trust?.helperMode) return trust.helperMode;
+  return (trust?.allowedCredentialHelpers?.length ?? 0) > 0 ? 'approved' : 'none';
+}
+
+function classifyFailure(stderr: string, mode: CredentialHelperMode): FailureKind | null {
   const lower = stderr.toLowerCase();
   if (lower.includes('host key verification failed') || lower.includes('unknown host key') || lower.includes('offending')) {
     return { kind: 'host-key', isChanged: lower.includes('changed') || lower.includes('offending') || lower.includes('key changed') };
@@ -152,8 +168,12 @@ function classifyFailure(stderr: string, approvedHelpers: boolean): FailureKind
   if (lower.includes('repository not found') || lower.includes('repo not found') || lower.includes('does not appear to be a git repository') || lower.includes("' not found")) {
     return { kind: 'not-found' };
   }
+  const invalidMatch = stderr.match(INVALID_HELPER_RE);
+  if (invalidMatch && (lower.includes('credentials') || lower.includes('credential-'))) {
+    return { kind: 'invalid-helper', name: invalidMatch[1] };
+  }
   if (lower.includes('authentication failed')) {
-    return { kind: 'auth', approved: approvedHelpers };
+    return { kind: 'auth', mode };
   }
   if (
     lower.includes('could not read username') ||
@@ -161,7 +181,7 @@ function classifyFailure(stderr: string, approvedHelpers: boolean): FailureKind
     lower.includes('terminal prompts disabled') ||
     lower.includes('credential')
   ) {
-    return { kind: 'helper', approved: approvedHelpers };
+    return { kind: 'helper', mode };
   }
   return null;
 }
@@ -186,11 +206,27 @@ function failureFinding(kind: FailureKind, locator: CanonicalGitLocator, stderr:
         RULE.GIT_TRUST_AUTH_REQUIRED,
         `Acquisition Trust Base violation: repository not found — '${locator.canonicalUrl}' does not exist (check the URL or owner/repo name) — ${stderr.trim()}`,
       );
+    case 'invalid-helper': {
+      // GIT-35：核准的 helper 名稱無效（git 找不到 `git-credential-<name>` 執行檔）。
+      // 典型：使用者直覺設 `PI_CODEX_MARKETPLACE_CREDENTIAL_HELPERS=gh`，git 抱怨
+      // `credential-gh` is not a git command；正確寫法是 `!gh auth git-credential`。
+      return trustFinding(
+        CODE.GIT_TRUST_CREDENTIAL_HELPER_INVALID,
+        RULE.GIT_TRUST_CREDENTIAL_HELPER_INVALID,
+        `Acquisition Trust Base violation: '${kind.name}' is not a valid git credential helper — use a native helper name (osxkeychain / store) or a shell form like '!gh auth git-credential' — ${stderr.trim()}`,
+      );
+    }
     case 'auth': {
-      // 伺服器 401：訊息依核准狀態分兩變體（未核准 → 指出 credential-free 且需認證，指引核准或 SSH；已核准仍 401 → 指引檢查登入）。
-      const why = kind.approved
-        ? `approved credential helper did not provide valid credentials — check your login with 'gh auth status' or your keychain`
-        : `repository requires authentication (private or nonexistent) and this acquisition is credential-free — approve a credential helper via ${CREDENTIAL_HELPERS_ENV}, or switch to an SSH locator`;
+      // 伺服器 401：訊息依 helper 模式分三變體（#117）：
+      // - none：本機也偵測不到任何憑證來源 → 指引設 env 或改 SSH。
+      // - detected：自動偵測白名單被伺服器拒絕 → 指引檢查登入，或手動核准其他 helper。
+      // - approved：顯式核准仍 401 → 指引檢查登入。
+      const why =
+        kind.mode === 'none'
+          ? `repository requires authentication (private or nonexistent); no credential source was detected on this machine (gh CLI / macOS keychain / git credential-store) and this acquisition is credential-free — approve a credential helper via ${CREDENTIAL_HELPERS_ENV}, or switch to an SSH locator`
+          : kind.mode === 'detected'
+            ? `repository requires authentication; the credential sources auto-detected on this machine (gh / macOS keychain / credential-store) were rejected by the server — check your login with 'gh auth status' or your keychain, or set ${CREDENTIAL_HELPERS_ENV} to approve a different helper`
+            : `approved credential helper did not provide valid credentials — check your login with 'gh auth status' or your keychain`;
       return trustFinding(
         CODE.GIT_TRUST_AUTH_REQUIRED,
         RULE.GIT_TRUST_AUTH_REQUIRED,
@@ -199,10 +235,11 @@ function failureFinding(kind: FailureKind, locator: CanonicalGitLocator, stderr:
     }
     case 'helper': {
       // GIT-33 保留：credential source 拒絕（could not read Username/Password 等原字串匹配）；
-      // 訊息依核准狀態分兩變體，未核准時維持原「not approved」措辭。
-      const why = kind.approved
-        ? `approved credential helper failed to supply credentials — check your login with 'gh auth status' or your keychain`
-        : `credential helper/agent not approved — set ${CREDENTIAL_HELPERS_ENV} to approve one, or use SSH`;
+      // 訊息依模式分變體：none 維持原「not approved」措辭。
+      const why =
+        kind.mode === 'none'
+          ? `credential helper/agent not approved — set ${CREDENTIAL_HELPERS_ENV} to approve one, or use SSH`
+          : `approved or auto-detected credential helper failed to supply credentials — check your login with 'gh auth status' or your keychain`;
       return trustFinding(
         CODE.GIT_TRUST_CREDENTIAL_HELPER,
         RULE.GIT_TRUST_CREDENTIAL_HELPER,
@@ -217,12 +254,12 @@ async function resolveHead(
   executor: GitExecutor,
   env: Record<string, string>,
   configArgs: string[],
-  approvedHelpers: boolean,
+  mode: CredentialHelperMode,
 ): Promise<{ ok: true; sha: string } | { ok: false; findings: ValidationFinding[]; stderr?: string }> {
   const lsArgs = [...configArgs, 'ls-remote', locator.canonicalUrl, 'HEAD'];
   const res = await executor(lsArgs, { env });
   if (res.exitCode !== 0) {
-    const kind = classifyFailure(res.stderr || '', approvedHelpers);
+    const kind = classifyFailure(res.stderr || '', mode);
     if (kind) {
       return {
         ok: false,
@@ -268,8 +305,8 @@ export async function resolveGitRevision(
 ): Promise<{ ok: true; sha: string } | { ok: false; findings: ValidationFinding[]; stderr?: string }> {
   const env = hardenedEnv(opts.trust, locator);
   const configArgs = hardenedConfigArgs(opts.trust);
-  const approvedHelpers = (opts.trust?.allowedCredentialHelpers?.length ?? 0) > 0;
-  return resolveHead(locator, opts.executor ?? defaultGitExecutor(), env, configArgs, approvedHelpers);
+  const mode = modeOf(opts.trust);
+  return resolveHead(locator, opts.executor ?? defaultGitExecutor(), env, configArgs, mode);
 }
 
 /**
@@ -281,8 +318,9 @@ export async function acquireGitSource(opts: AcquireOptions): Promise<AcquireRes
   const trust = opts.trust;
   const env = hardenedEnv(trust, locator);
   const configArgs = hardenedConfigArgs(trust);
+  const mode = modeOf(trust);
 
-  const resolved = await resolveHead(locator, executor, env, configArgs, (trust?.allowedCredentialHelpers?.length ?? 0) > 0);
+  const resolved = await resolveHead(locator, executor, env, configArgs, mode);
   if (!resolved.ok) {
     return { ok: false, findings: (resolved as { findings: ValidationFinding[] }).findings, stderr: (resolved as { stderr?: string }).stderr };
   }
@@ -301,7 +339,7 @@ export async function acquireGitSource(opts: AcquireOptions): Promise<AcquireRes
   const cloneRes = await executor(cloneArgs, { env });
   if (cloneRes.exitCode !== 0) {
     const stderr = cloneRes.stderr || '';
-    const kind = classifyFailure(stderr, (trust?.allowedCredentialHelpers?.length ?? 0) > 0);
+    const kind = classifyFailure(stderr, mode);
     const finding = kind
       ? failureFinding(kind, locator, stderr)
       : acquireFinding(`git clone failed: ${stderr.trim() || `exit ${cloneRes.exitCode}`}`);