fleetd/src/main/java/dev/ltms/fleet/session/GitWorktrees.java

@@ -7,6 +7,8 @@ import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.io.UncheckedIOException;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -20,6 +22,7 @@ import java.util.Optional;
 import java.util.Set;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;
+import java.util.function.Consumer;
 import java.util.stream.Collectors;
 
 /**
@@ -64,6 +67,10 @@ public final class GitWorktrees implements Worktrees {
     /** What {@link #isolateToolSurface} writes for {@code .autoenv}: a valid, empty env file. */
     private static final String NEUTRAL_AUTOENV_CONFIG = "";
 
+    /** A credential helper command which reads only an environment variable at Git call time. */
+    private static final String ENVIRONMENT_CREDENTIAL_HELPER = "!f() { if [ \"$1\" = get ]; then "
+            + "printf 'username=%s\\npassword=%s\\n\\n' git \"$WORKER_GITEA_TOKEN\"; fi; }; f";
+
     /**
      * A tracked project config that is hostile in a provisioned worktree, and what to replace it
      * with. {@link #file} is the repo-relative path; {@link #stub} is a neutral but VALID payload for
@@ -81,6 +88,7 @@ public final class GitWorktrees implements Worktrees {
     );
 
     private final String configuredRoot;
+    private final Consumer<String> afterWorktreeAdded;
     private final SecureRandom random = new SecureRandom();
     private final AtomicLong seq = new AtomicLong();
 
@@ -91,7 +99,13 @@ public final class GitWorktrees implements Worktrees {
 
     /** @param configuredRoot nullable absolute or relative path; null/blank derives a sibling of the repo root. */
     public GitWorktrees(String configuredRoot) {
+        this(configuredRoot, _ -> {});
+    }
+
+    /** Test seam for changing a real worktree between its creation and its security check. */
+    GitWorktrees(String configuredRoot, Consumer<String> afterWorktreeAdded) {
         this.configuredRoot = configuredRoot;
+        this.afterWorktreeAdded = afterWorktreeAdded == null ? _ -> {} : afterWorktreeAdded;
     }
 
     @Override
@@ -107,11 +121,71 @@ public final class GitWorktrees implements Worktrees {
         }
         String wt = path.toAbsolutePath().toString();
         log.info("adding worktree branch={} path={} base={}", branch, wt, base);
+        removeUserInfoFromHttpsOrigin(repoRoot);
         exec("git", "-C", repoRoot, "worktree", "add", wt, "-b", branch, base);
+        afterWorktreeAdded.accept(wt);
+        requireCredentialFreeHttpsOrigin(wt);
+        configureEnvironmentCredentialHelper(repoRoot, wt);
         isolateToolSurface(wt);
         return wt;
     }
 
+    /**
+     * A linked worktree shares its primary checkout's git config. Remove HTTPS user info before
+     * adding one, so a credential accidentally embedded in that config cannot reach the member.
+     */
+    private void removeUserInfoFromHttpsOrigin(String repoRoot) {
+        if (exitCode("git", "-C", repoRoot, "config", "--get", "remote.origin.url") != 0) {
+            return;
+        }
+        String origin = exec("git", "-C", repoRoot, "config", "--get", "remote.origin.url").trim();
+        URI uri;
+        try {
+            uri = new URI(origin);
+        } catch (URISyntaxException e) {
+            throw new WorktreeException("origin URL is invalid; cannot provision a safe worktree", e);
+        }
+        if (!"https".equalsIgnoreCase(uri.getScheme()) || uri.getUserInfo() == null) {
+            return;
+        }
+        int schemeEnd = origin.indexOf("://") + 3;
+        int userInfoEnd = origin.indexOf('@', schemeEnd);
+        if (userInfoEnd < schemeEnd) {
+            throw new WorktreeException("origin URL has invalid HTTPS user info; cannot provision safely");
+        }
+        String cleanOrigin = origin.substring(0, schemeEnd) + origin.substring(userInfoEnd + 1);
+        exec("git", "-C", repoRoot, "remote", "set-url", "origin", cleanOrigin);
+        log.info("removed HTTPS user info from forge origin before provisioning worktree");
+    }
+
+    /** Refuse the worktree if Git still resolves any HTTPS origin URL with embedded credentials. */
+    private void requireCredentialFreeHttpsOrigin(String worktreePath) {
+        if (exitCode("git", "-C", worktreePath, "remote", "get-url", "--all", "origin") != 0) {
+            return;
+        }
+        String origins = exec("git", "-C", worktreePath, "remote", "get-url", "--all", "origin");
+        for (String origin : origins.split("\\R")) {
+            try {
+                URI uri = new URI(origin);
+                if ("https".equalsIgnoreCase(uri.getScheme()) && uri.getUserInfo() != null) {
+                    throw new WorktreeException("worktree origin contains HTTPS user info; refusing provision");
+                }
+            } catch (URISyntaxException e) {
+                throw new WorktreeException("worktree origin URL is invalid; refusing provision", e);
+            }
+        }
+    }
+
+    /** Configure a per-worktree helper that supplies a token from the member environment at call time. */
+    private void configureEnvironmentCredentialHelper(String repoRoot, String worktreePath) {
+        exec("git", "-C", repoRoot, "config", "extensions.worktreeConfig", "true");
+        // An empty helper resets values inherited from the system or global config. Without it Git
+        // asks the next helper after this one, which can expose an operator-level credential.
+        exec("git", "-C", worktreePath, "config", "--worktree", "--replace-all", "credential.helper", "");
+        exec("git", "-C", worktreePath, "config", "--worktree", "--add", "credential.helper",
+                ENVIRONMENT_CREDENTIAL_HELPER);
+    }
+
     /**
      * Neutralize the worktree's worktree-hostile project configs so a worker inherits only the tools
      * and environment its launcher mounts (the bridge via {@code --mcp-config}, the opencode config

fleetd/src/test/java/dev/ltms/fleet/session/GitWorktreesTest.java

@@ -55,12 +55,21 @@ class GitWorktreesTest {
     }
 
     private static void git(Path cwd, String... args) throws Exception {
+        gitOutput(cwd, args);
+    }
+
+    private static String gitOutput(Path cwd, String... args) throws Exception {
         List<String> cmd = new java.util.ArrayList<>(List.of("git"));
         cmd.addAll(List.of(args));
-        Process p = new ProcessBuilder(cmd).directory(cwd.toFile()).redirectErrorStream(true).start();
+        ProcessBuilder pb = new ProcessBuilder(cmd).directory(cwd.toFile()).redirectErrorStream(true);
+        pb.environment().put("GIT_CONFIG_GLOBAL", "/dev/null");
+        pb.environment().put("GIT_CONFIG_SYSTEM", "/dev/null");
+        pb.environment().put("GIT_TERMINAL_PROMPT", "0");
+        Process p = pb.start();
         String out = new String(p.getInputStream().readAllBytes());
         assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git timed out: " + String.join(" ", cmd));
         assertEquals(0, p.exitValue(), "git " + String.join(" ", args) + " failed:\n" + out);
+        return out;
     }
 
     /** Pending changes to {@code file} in {@code cwd}, empty when git considers it unmodified. */
@@ -205,6 +214,79 @@ class GitWorktreesTest {
                 "expected an explicitly empty server map, got:\n" + body);
     }
 
+    /**
+     * The worktree command shares the primary checkout's config, so this checks the URL git actually
+     * reads after {@link GitWorktrees#add}, rather than checking only a URL formatting helper.
+     */
+    @Test
+    void aProvisionedWorktreeUsesACleanHttpsOrigin(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        git(repo, "remote", "add", "origin", "https://synthetic-test-token@git.ltms.dev/akb/kb.git");
+
+        String wt = new GitWorktrees(tmp.resolve("wts").toString())
+                .add(repo.toString(), "fleetd-157-safe-origin", "HEAD");
+
+        Path worktree = Path.of(wt);
+        String origin = gitOutput(worktree, "config", "--get", "remote.origin.url").trim();
+        assertEquals("https://git.ltms.dev/akb/kb.git", origin);
+        assertFalse(origin.contains("synthetic-test-token"), "provisioned worktree kept user info");
+        assertFalse(gitOutput(worktree, "remote", "-v").contains("synthetic-test-token"),
+                "git remote -v exposed user info");
+        assertFalse(gitOutput(worktree, "config", "--list").contains("synthetic-test-token"),
+                "git config --list exposed user info");
+        String helper = gitOutput(worktree, "config", "--worktree", "--get", "credential.helper");
+        assertTrue(helper.contains("WORKER_GITEA_TOKEN"), "credential helper does not read the member environment");
+        assertFalse(helper.contains("synthetic-test-token"), "credential helper stored user info");
+    }
+
+    @Test
+    void worktreeCredentialHelperCompletesWithoutUsingAnInheritedHelper(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        git(repo, "remote", "add", "origin", "https://git.ltms.dev/akb/kb.git");
+        String wt = new GitWorktrees(tmp.resolve("wts").toString())
+                .add(repo.toString(), "fleetd-157-helper", "HEAD");
+        Path globalConfig = tmp.resolve("global.gitconfig");
+        Files.writeString(globalConfig, """
+                [credential]
+                    helper = !f() { printf 'username=%s\\npassword=%s\\n\\n' operator operator-secret; }; f
+                """);
+
+        ProcessBuilder pb = new ProcessBuilder("git", "credential", "fill")
+                .directory(Path.of(wt).toFile()).redirectErrorStream(true);
+        pb.environment().put("GIT_CONFIG_GLOBAL", globalConfig.toString());
+        pb.environment().put("GIT_CONFIG_SYSTEM", "/dev/null");
+        pb.environment().put("GIT_TERMINAL_PROMPT", "0");
+        pb.environment().put("WORKER_GITEA_TOKEN", "synthetic-worker-value");
+        Process p = pb.start();
+        p.getOutputStream().write("protocol=https\nhost=git.ltms.dev\n\n".getBytes(StandardCharsets.UTF_8));
+        p.getOutputStream().close();
+        String credential = new String(p.getInputStream().readAllBytes(), StandardCharsets.UTF_8);
+        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git credential fill timed out");
+        assertEquals(0, p.exitValue(), "git credential fill failed");
+        assertTrue(credential.contains("username=git"), "helper did not return its fixed username");
+        assertTrue(credential.contains("password=synthetic-worker-value"),
+                "helper did not return the worker token as the password");
+        assertFalse(credential.contains("operator-secret"), "Git used the inherited global helper");
+    }
+
+    @Test
+    void provisioningRefusesAWorktreeWhoseOriginStillHasHttpsUserInfo(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        git(repo, "remote", "add", "origin", "https://git.ltms.dev/akb/kb.git");
+        GitWorktrees worktrees = new GitWorktrees(tmp.resolve("wts").toString(), worktreePath -> {
+            try {
+                git(Path.of(worktreePath), "remote", "set-url", "origin",
+                        "https://synthetic-test-token@git.ltms.dev/akb/kb.git");
+            } catch (Exception e) {
+                throw new RuntimeException(e);
+            }
+        });
+
+        WorktreeException error = assertThrows(WorktreeException.class,
+                () -> worktrees.add(repo.toString(), "fleetd-157-refuse-origin", "HEAD"));
+        assertEquals("worktree origin contains HTTPS user info; refusing provision", error.getMessage());
+    }
+
     /** Neutralizing must not look like work in progress, or a worker would commit it into its PR. */
     @Test
     void theNeutralizedConfigIsNotAPendingLocalModification(@TempDir Path tmp) throws Exception {