Repository navigation
T50 — Ship a git credential helper in grant boxes so git sends a header the proxy substitutes #2531
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Conditions closed | M | needs care | standard | an agent | 340 (160 code, 180 tests) |
From a grant box with no git configuration of its own, git clone and git push send an Authorization header the proxy substitutes.
Covers:
- BEP-015
Layers:
- spec:
- docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md: adds the requirement for the git credential helper a grant box carries (Gatehouse §6.4 line 718), under BEP-015
- box:
- crates/minimald/src/box_actor.rs: declares the new module
- crates/minimald/src/box_runtime/launcher.rs: the
connectionenv layer carriesGIT_CONFIG_COUNT,GIT_CONFIG_KEY_<n>andGIT_CONFIG_VALUE_<n>for a box that holds sealed deliveries, so the shipped helper is git's sole helper for each grant host withstoreandcachedisabled, at a scope git reads after every config file (widened 2026-10-25 per arch C1 on feat(minimald): ship a git credential helper in grant boxes (T50) #2547) - crates/minimald/Cargo.toml: depends on
bep, so the helper reads the host set frombep::module::GITHUBinstead of a copy (widened 2026-10-25 per arch C2 on feat(minimald): ship a git credential helper in grant boxes (T50) #2547) - Cargo.lock: regenerated by the new
bepdependency ofminimald(widened 2026-10-25) - crates/minimald/src/box_actor/tests.rs: the helper's tests
- crates/minimald/src/box_actor/bep_git_helper.rs (new): writes the helper and its
git config credential.helperline into a grant box at creation, for the grant's hosts only, with the sealed value as the placeholder the proxy substitutes cargo nextest run -p minimald grant_box_git_credential_helper_answers_for_grant_hosts
- e2e:
- scripts/session-e2e.sh: a case that clones and pushes from a grant box with the shipped helper and no helper of its own; records NOT RUN off macOS, without a sign-in or without E2E_BEP_PRIVATE_REPO (T82 — Run the Box Eg 8000 ress Proxy legs on the macOS lane #2500)
./scripts/session-e2e.sh bep_git_credential_helper_sends_header
Waits on:
- T11 — Validate the upstream before substituting, pass unsealed requests through, and stream responses #2272
- T18 — Run the proxy beside gvproxy so git and gh reach GitHub from a box #2275
Implements the filed residual #2499; those issues close with this task and do not block it.
Plan block
### T50 — Ship a git credential helper in grant boxes so git sends a header the proxy substitutes
slice: S9
kind: task
covers: BEP-015
size: M
est: 160 code, 180 tests
executor: agent
difficulty: needs care
model: standard
diagnostics: `git credential fill` inside a grant box answers for the grant's hosts with the placeholder, and `min box spec` lists the helper under the grant
observability: one debug log line per helper answer naming the host, never the value
layers:
- spec:
- docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md: adds the requirement for the git credential helper a grant box carries (Gatehouse §6.4 line 718), under BEP-015
- box:
- crates/minimald/src/box_actor.rs: declares the new module
- crates/minimald/src/box_runtime/launcher.rs: the `connection` env layer carries `GIT_CONFIG_COUNT`, `GIT_CONFIG_KEY_<n>` and `GIT_CONFIG_VALUE_<n>` for a box that holds sealed deliveries, so the shipped helper is git's sole helper for each grant host with `store` and `cache` disabled, at a scope git reads after every config file (widened 2026-10-25 per arch C1 on #2547)
- crates/minimald/Cargo.toml: depends on `bep`, so the helper reads the host set from `bep::module::GITHUB` instead of a copy (widened 2026-10-25 per arch C2 on #2547)
- Cargo.lock: regenerated by the new `bep` dependency of `minimald` (widened 2026-10-25)
- crates/minimald/src/box_actor/tests.rs: the helper's tests
- crates/minimald/src/box_actor/bep_git_helper.rs (new): writes the helper and its `git config credential.helper` line into a grant box at creation, for the grant's hosts only, with the sealed value as the placeholder the proxy substitutes
test: cargo nextest run -p minimald grant_box_git_credential_helper_answers_for_grant_hosts
- e2e:
- scripts/session-e2e.sh: a case that clones and pushes from a grant box with the shipped helper and no helper of its own; records NOT RUN off macOS, without a sign-in or without E2E_BEP_PRIVATE_REPO (#2500)
test: ./scripts/session-e2e.sh bep_git_credential_helper_sends_header
produces: none
consumes:
- crates/bep/src/forward.rs
proof: From a grant box with no git configuration of its own, git clone and git push send an Authorization header the proxy substitutes.
depends on:
- blocked by T11
- blocked by T18
Generated by Claude Code
Reacted by minimal-foundry
Activity
minimal-foundry commentedon Oct 25, 2026
Done. #2547 merged.
branch
agent/2531-ship-a-git-credential-helper-in-grant-boxes-so-g· epic #1501 · PR #254770f8927e76b4a028e72ac2e600904a5a8589cc2bUpdated 2026-10-25T18:41:56.340Z.