[agentHits]

What is this PR about?

Git provider tokens were embedded in the clone URL (oauth2:<token>@, x-bitbucket-api-token-auth:<token>@, user:app-password@), so git clone stored them in <code>/.git/config and in submodule configs. Build steps and bind mounts of the service directory could read them.

• buildGitCloneCommand now clones from a URL without credentials and passes them only as git -c http.<provider origin>/.extraHeader=Authorization: Basic .... git -c values are not persisted, they reach submodule clones, and the origin scope keeps the header away from submodules hosted elsewhere.
• GitHub, GitLab, Gitea and Bitbucket (API token and app password) use it. Custom Git HTTPS URLs with user:password@ are split the same way, so the stored remote has no credentials.
• Exact compose deployments (expectedRevision) used a separate git fetch origin <sha> that relied on the stored credentials. The fetch and checkout --detach now run inside the clone command (in a subshell, so a failure still fails under set -e) with the same per-invocation credentials. Afterwards only rev-parse HEAD runs.
• The custom Git SSH key no longer goes to a shared, fixed /tmp/id_rsa. It is written to a uniquely named file created with umask 077 and removed after the clone, including on failure.
• Local and remote-server deployments are both covered because they run the same command string. When a command shows up in an ExecError, redactSensitiveText already masks Authorization: Basic ....

Checks

• CI=true bunx vitest run --config __test__/vitest.config.ts on the new and changed tests (git-provider/clone-credentials-persistence, git-provider/clone-command-boundary, git-provider/github-clone-host, env/compose-env-upsert): 45/45 passed.
• The same runner on the git-provider, env, compose, deployment, placement, volume-backups, security/patch-path and deploy/application.command tests: 79 files, 789 passed, 1 skipped.
• With the provider and compose sources taken from origin/AgentHits-Dev, all 18 new and changed tests fail.
• bun run typecheck: exit 0.
• bunx biome check <changed files>: 0 errors.
• Not run: a real clone against a Git server, including submodules. Propagation of git -c to submodules and http.<url>.extraHeader matching rely on documented Git behaviour.

Rollout notes

• Checkouts made before this change keep the old token in .git/config until the next deployment recreates the code directory. Redeploy the services that use providers. Rotate long-lived Bitbucket API tokens or app passwords if those directories were exposed.
• Authorization is now sent preemptively as Basic to the provider origin. Custom Git servers that accept only NTLM/Negotiate can no longer authenticate with user:password@ in the URL.
• Same-host submodules with absolute URLs now also authenticate. Submodules on other hosts still get no credentials.
• The token is still part of the deploy shell command (process arguments) while it runs, as before. This PR only stops it from being written to disk.

🤖 Generated with Claude Code