d962e5e7f4
The computer's git and gh shims passed a literal "--" into the JSON argv (python -c keeps it in sys.argv), so every brokered clone arrived as "git -- clone" and the broker refused it. Agents then fell back to real git with the broker run token as a password, which GitHub rejects. - Drop the stray "--" from both shim payloads. - Route git through the broker even behind -c/-C/--no-pager options. - Share one broker client that falls back to the default gateway for computers created before host.docker.internal was mapped, and says plainly when the broker is unreachable or refuses a request. - Broker normalizes GitHub SSH remotes and pasted credentials to plain HTTPS and points a rejected stored token at reconnecting GitHub. - Prompt says plain git clone works and the run token is not a GitHub token. Claude-Session: https://claude.ai/code/session_01Tgvrj34NMnaqvtgvruYQZZ Co-authored-by: Claude <noreply@anthropic.com>
30 lines
918 B
Bash
Executable File
30 lines
918 B
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
REAL_GIT=/usr/bin/git
|
|
if [[ "${RAKAZO_GITHUB_BROKER_URL:-}" == "" || "${RAKAZO_GITHUB_BROKER_RUN_TOKEN:-}" == "" ]]; then
|
|
exec "$REAL_GIT" "$@"
|
|
fi
|
|
# Skip global options so `git -c … clone` and `git -C dir fetch` still go through the broker.
|
|
# Config overrides are dropped: the broker supplies the credentials.
|
|
args=("$@")
|
|
i=0
|
|
cwd="$PWD"
|
|
while (( i < ${#args[@]} )); do
|
|
case "${args[i]}" in
|
|
-c) i=$((i + 2)) ;;
|
|
-C)
|
|
cwd="$(cd "$cwd" && cd "${args[i + 1]:-}" && pwd)" || exec "$REAL_GIT" "$@"
|
|
i=$((i + 2))
|
|
;;
|
|
--no-pager | -P) i=$((i + 1)) ;;
|
|
*) break ;;
|
|
esac
|
|
done
|
|
case "${args[i]:-}" in
|
|
push | fetch | pull | clone | ls-remote)
|
|
payload="$(python3 -c 'import json,sys; print(json.dumps({"argv":["git"]+sys.argv[2:],"cwd":sys.argv[1]}))' "$cwd" "${args[@]:i}")"
|
|
exec rakazo-broker v1/git "$payload"
|
|
;;
|
|
esac
|
|
exec "$REAL_GIT" "$@"
|