A private repository brought from another forge clones with its credential never in argv, config or logs #8988

This adds a test proving that bringing a private repository from a connected forge never puts its credential on a command line, in the clone's config, or in a log. No source code changed. The code already worked this way: gitAuthEnv (src/origins/credentials.ts) sends the credential only through GIT_CONFIG_* env vars, as an http.<scope>.extraHeader limited to the origin's URL, with redirects off. safeRemoteUrl refuses any clone URL with a username or password in it. What was missing was a test that would catch a regression.

test/bring-private-credential.test.ts

• Setup: A real forge instance serves a private repository over smart HTTP. The test first checks that an anonymous info/refs request is refused. test/fake-origin.ts acts as the connected Forgejo, listing the repo as private: true. Alice connects it with the token and brings it through POST /bring.
• Catching argv: A git shim placed first on PATH writes down every argument of every git process the server starts, then runs the real git. So the check is on what was actually started, not on what the code builds.
• Assertions:

- The job reaches done and the copy has refs/heads/main, so the credential did get through, by the environment. - The token, both as plain text and as its Basic base64 blob, appears nowhere in the recorded argv, the clone's config, the job record, the bring page or anything the server printed to the console. - The shim's log must contain the upstream clone URL and the config must name the remote, so an empty log can't pass by accident.

• Mutation check: I temporarily changed fetchMirror to pass -c http.extraHeader=… on the command line. The test failed, naming the leaked blob in argv. The source was then restored.

Not done: fetches use a header in the environment rather than an askpass helper. The issue allows either, and the environment header was already in place. I didn't update the plan with keep_plan because that tool isn't available in this run.

To try it: bun test test/bring-private-credential.test.ts. The gate, bun x tsc --noEmit, the 13 test files scripts/fast.ts names, and test/bring.test.ts all pass: 171 tests, 0 failures.

🤖 Generated with Claude Code

Closes #8963

This adds a test proving that bringing a private repository from a connected forge never puts its credential on a command line, in the clone's config, or in a log. No source code changed. The code already worked this way: gitAuthEnv (src/origins/credentials.ts) sends the credential only through GIT_CONFIG_* env vars, as an http.<scope>.extraHeader limited to the origin's URL, with redirects off. safeRemoteUrl refuses any clone URL with a username or password in it. What was missing was a test that would catch a regression.

test/bring-private-credential.test.ts

• Setup: A real forge instance serves a private repository over smart HTTP. The test first checks that an anonymous info/refs request is refused. test/fake-origin.ts acts as the connected Forgejo, listing the repo as private: true. Alice connects it with the token and brings it through POST /bring.
• Catching argv: A git shim placed first on PATH writes down every argument of every git process the server starts, then runs the real git. So the check is on what was actually started, not on what the code builds.
• Assertions:

- The job reaches done and the copy has refs/heads/main, so the credential did get through, by the environment. - The token, both as plain text and as its Basic base64 blob, appears nowhere in the recorded argv, the clone's config, the job record, the bring page or anything the server printed to the console. - The shim's log must contain the upstream clone URL and the config must name the remote, so an empty log can't pass by accident.

• Mutation check: I temporarily changed fetchMirror to pass -c http.extraHeader=… on the command line. The test failed, naming the leaked blob in argv. The source was then restored.

Not done: fetches use a header in the environment rather than an askpass helper. The issue allows either, and the environment header was already in place. I didn't update the plan with keep_plan because that tool isn't available in this run.

To try it: bun test test/bring-private-credential.test.ts. The gate, bun x tsc --noEmit, the 13 test files scripts/fast.ts names, and test/bring.test.ts all pass: 171 tests, 0 failures.

🤖 Generated with Claude Code