fix(agent): secure repo-less cloud clones

Author: tatoalo

packages/agent/src/adapters/codex-app-server/codex-app-server-agent.test.ts

@@ -929,6 +929,54 @@ describe("CodexAppServerAgent", () => {
     expect(requestPermission).not.toHaveBeenCalled();
   });
 
+  it("auto-accepts repository tools from the built-in local MCP server in auto mode", async () => {
+    const stub = makeStubRpc({
+      initialize: {},
+      "thread/start": { thread: { id: "thr_1" } },
+    });
+    const requestPermission = vi.fn();
+    const client = {
+      sessionUpdate: async () => {},
+      requestPermission,
+      extNotification: async () => {},
+    } as unknown as AgentSideConnection;
+    const agent = new CodexAppServerAgent(client, {
+      processOptions: { binaryPath: "/bundle/codex" },
+      model: "gpt-5.5",
+      rpcFactory: stub.factory,
+    });
+    await agent.initialize(init);
+    await agent.newSession({
+      cwd: "/repo",
+      _meta: {
+        environment: "cloud",
+        channelMode: true,
+        permissionMode: "auto",
+      },
+    } as unknown as NewSessionRequest);
+
+    stub.emit("item/started", {
+      item: {
+        type: "mcpToolCall",
+        id: "m1",
+        server: "posthog-code-tools",
+        tool: "clone_repo",
+        arguments: { repo: "PostHog/posthog" },
+      },
+    });
+    const decision = await stub.invokeRequest("mcpServer/elicitation/request", {
+      threadId: "thr_1",
+      turnId: "turn_1",
+      serverName: "posthog-code-tools",
+      mode: "form",
+      message:
+        'Allow the posthog-code-tools MCP server to run tool "clone_repo"?',
+    });
+
+    expect(decision).toMatchObject({ action: "accept" });
+    expect(requestPermission).not.toHaveBeenCalled();
+  });
+
   it("auto-accepts a gated PostHog exec sub-tool in local hands-off modes", async () => {
     const stub = makeStubRpc({
       initialize: {},

packages/agent/src/adapters/codex-app-server/codex-app-server-agent.ts

@@ -53,6 +53,7 @@ import {
   estimateTokens,
 } from "../claude/context-breakdown";
 import { isLocalSkillCommandChunk } from "../local-skill";
+import { LOCAL_TOOLS_MCP_NAME } from "../local-tools";
 import { resolveSpokenNarration } from "../session-meta";
 import {
   AppServerClient,
@@ -1939,6 +1940,22 @@ export class CodexAppServerAgent extends BaseAcpAgent {
     );
   }
 
+  private shouldAutoAcceptMcpToolCall(mcp: {
+    server: string;
+    tool: string;
+    args: unknown;
+  }): boolean {
+    const isHandsOffMode =
+      this.config.mode === "auto" || this.config.mode === "full-access";
+    const isRepositoryTool =
+      mcp.server === LOCAL_TOOLS_MCP_NAME &&
+      (mcp.tool === "list_repos" || mcp.tool === "clone_repo");
+    return (
+      (isHandsOffMode && isRepositoryTool) ||
+      this.shouldAutoAcceptPostHogExec(mcp)
+    );
+  }
+
   /**
    * Server-initiated requests. Simple approvals resolve to a `{ decision }` envelope (a bare
    * string is rejected); richer ones (AskUserQuestion / permission profile / elicitation) go
@@ -1953,7 +1970,7 @@ export class CodexAppServerAgent extends BaseAcpAgent {
       logger: this.logger,
       resolveMcpToolCall: (serverName) => this.mcp.byServer(serverName),
       shouldAutoAcceptMcpToolCall: (mcp) =>
-        this.shouldAutoAcceptPostHogExec(mcp),
+        this.shouldAutoAcceptMcpToolCall(mcp),
     });
     if (richer.handled) {
       return richer.response;
@@ -2001,7 +2018,7 @@ export class CodexAppServerAgent extends BaseAcpAgent {
     // Codex has no MCP-specific approval; a known MCP call surfaces the real server/tool/args
     // so the host renders the proper MCP permission (incl. PostHog `exec` unwrapping).
     const mcp = this.mcp.byItemId(detail.itemId);
-    if (mcp && this.shouldAutoAcceptPostHogExec(mcp)) {
+    if (mcp && this.shouldAutoAcceptMcpToolCall(mcp)) {
       return { decision: "accept" };
     }
     // kind + content route plain command/file approvals to Execute/EditPermission (not the fallback).

packages/agent/src/adapters/local-tools/tools/clone-repo.test.ts

@@ -42,20 +42,66 @@ describe("clone_repo", () => {
     await rm(cwd, { recursive: true, force: true });
   });
 
-  it("requests a shallow clone of the selected branch", async () => {
+  it("authenticates a shallow clone without persisting the token in origin", async () => {
+    mocks.cloneRun.mockImplementationOnce(async (input) => {
+      await mkdir(input.targetPath, { recursive: true });
+      const git = createGitClient(input.targetPath);
+      await git.init();
+      await git.addRemote("origin", input.repoUrl);
+      return { success: true, data: { targetPath: input.targetPath } };
+    });
+
     const result = await cloneRepoTool.handler(
       { cwd, token: "test-token" },
       { repo: "PostHog/posthog", branch: "feature" },
     );
 
     expect(result.isError).toBeUndefined();
-    expect(mocks.cloneRun).toHaveBeenCalledWith({
-      repoUrl:
-        "https://x-access-token:test-token@github.com/PostHog/posthog.git",
+    const cloneInput = mocks.cloneRun.mock.calls[0]?.[0];
+    expect(cloneInput).toMatchObject({
+      repoUrl: "https://github.com/PostHog/posthog.git",
       targetPath: path.join(cwd, "repos", "PostHog", "posthog"),
       branch: "feature",
       shallow: true,
     });
+    expect(cloneInput.env).toMatchObject({
+      GIT_CONFIG_COUNT: "1",
+      GIT_CONFIG_KEY_0: "http.extraHeader",
+    });
+    expect(cloneInput.env.GIT_CONFIG_VALUE_0).not.toContain("test-token");
+    expect(
+      Buffer.from(
+        cloneInput.env.GIT_CONFIG_VALUE_0.replace("AUTHORIZATION: basic ", ""),
+        "base64",
+      ).toString("utf8"),
+    ).toBe("x-access-token:test-token");
+    const targetGit = createGitClient(
+      path.join(cwd, "repos", "PostHog", "posthog"),
+    );
+    expect((await targetGit.remote(["get-url", "origin"]))?.trim()).toBe(
+      "https://github.com/PostHog/posthog.git",
+    );
+  });
+
+  it("removes credentials from an existing clone origin", async () => {
+    const targetPath = path.join(cwd, "repos", "PostHog", "posthog");
+    await mkdir(targetPath, { recursive: true });
+    const git = createGitClient(targetPath);
+    await git.init();
+    await git.addRemote(
+      "origin",
+      "https://x-access-token:stale-token@github.com/PostHog/posthog.git",
+    );
+
+    const result = await cloneRepoTool.handler(
+      { cwd, token: "test-token" },
+      { repo: "PostHog/posthog" },
+    );
+
+    expect(result.isError).toBeUndefined();
+    expect((await git.remote(["get-url", "origin"]))?.trim()).toBe(
+      "https://github.com/PostHog/posthog.git",
+    );
   });
 
   it("fetches a missing branch into an existing shallow clone", async () => {

packages/agent/src/adapters/local-tools/tools/clone-repo.ts

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { createGitClient } from "@posthog/git/client";
+import { getCleanEnv } from "@posthog/git/operation-manager";
 import { getCurrentBranch } from "@posthog/git/queries";
 import { CloneSaga } from "@posthog/git/sagas/clone";
 import { parseGithubUrl } from "@posthog/git/utils";
@@ -26,6 +27,28 @@ function fail(text: string): LocalToolResult {
   return { content: [{ type: "text", text }], isError: true };
 }
 
+function githubAuthEnv(token: string | undefined): Record<string, string> {
+  if (!token) return {};
+  const basicAuth = Buffer.from(`x-access-token:${token}`).toString("base64");
+  return {
+    GIT_CONFIG_COUNT: "1",
+    GIT_CONFIG_KEY_0: "http.extraHeader",
+    GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${basicAuth}`,
+  };
+}
+
+function hasHttpCredentials(remoteUrl: string): boolean {
+  try {
+    const url = new URL(remoteUrl);
+    return (
+      (url.protocol === "http:" || url.protocol === "https:") &&
+      Boolean(url.username || url.password)
+    );
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Lazily brings a repo into a repo-less channel session's scratch workspace.
  * Clones into `<cwd>/repos/<repo>` (a subdir of the session cwd, so no session
@@ -61,6 +84,11 @@ export const cloneRepoTool = defineLocalTool({
     const slug = `${parsed.owner}/${parsed.repo}`;
     const repoName = parsed.repo;
     const targetPath = path.join(ctx.cwd, "repos", slug);
+    const cloneUrl = `https://github.com/${slug}.git`;
+    const authenticatedGitEnv = {
+      ...getCleanEnv(),
+      ...githubAuthEnv(token),
+    };
 
     const done = async (note?: string): Promise<LocalToolResult> => {
       const checkedOut = (await getCurrentBranch(targetPath)) ?? branch ?? null;
@@ -78,7 +106,7 @@ export const cloneRepoTool = defineLocalTool({
 
     const checkout = async (): Promise<LocalToolResult | null> => {
       if (!branch) return null;
-      const git = createGitClient(targetPath);
+      const git = createGitClient(targetPath).env(authenticatedGitEnv);
       try {
         await git.checkout(branch);
         return null;
@@ -115,24 +143,35 @@ export const cloneRepoTool = defineLocalTool({
     // the repo in place. Reuse it instead of letting git abort on a non-empty
     // destination, which the agent would receive as an opaque error.
     if (fs.existsSync(path.join(targetPath, ".git"))) {
+      const git = createGitClient(targetPath);
+      try {
+        const originUrl = await git.remote(["get-url", "origin"]);
+        if (
+          typeof originUrl === "string" &&
+          hasHttpCredentials(originUrl.trim())
+        ) {
+          await git.remote(["set-url", "origin", cloneUrl]);
+        }
+      } catch (err) {
+        return fail(
+          `clone_repo couldn't secure the existing origin: ${redact(
+            err instanceof Error ? err.message : String(err),
+          )}`,
+        );
+      }
       return (
         (await checkout()) ??
         (await done(`${slug} already cloned at ${targetPath}`))
       );
     }
 
-    // GitHub accepts a token as the basic-auth username for https clones; this
-    // covers private repos. Public repos clone fine without it.
-    const cloneUrl = token
-      ? `https://x-access-token:${token}@github.com/${slug}.git`
-      : `https://github.com/${slug}.git`;
-
     try {
       const result = await new CloneSaga().run({
         repoUrl: cloneUrl,
         targetPath,
         branch,
         shallow: true,
+        env: githubAuthEnv(token),
       });
       if (!result.success) {
         return fail(`clone_repo failed: ${redact(result.error)}`);

packages/agent/src/pi/repository-tools-extension.test.ts

@@ -0,0 +1,35 @@
+import type {
+  ExtensionAPI,
+  ToolDefinition,
+} from "@earendil-works/pi-coding-agent";
+import { describe, expect, it } from "vitest";
+import { createPiRepositoryToolsExtension } from "./repository-tools-extension";
+
+describe("createPiRepositoryToolsExtension", () => {
+  it("registers the repo-less clone and discovery tools", async () => {
+    type RegisteredTool = Pick<ToolDefinition, "name" | "execute">;
+    const registered: RegisteredTool[] = [];
+    const extension = createPiRepositoryToolsExtension("/tmp/workspace");
+    await extension.factory({
+      registerTool: (tool: ToolDefinition) => {
+        registered.push(tool);
+      },
+    } as unknown as ExtensionAPI);
+
+    expect(registered.map((tool) => tool.name)).toEqual([
+      "list_repos",
+      "clone_repo",
+    ]);
+    const cloneTool = registered.find((tool) => tool.name === "clone_repo");
+    expect(cloneTool).toBeDefined();
+    await expect(
+      cloneTool?.execute(
+        "call-1",
+        { repo: "not a repository" },
+        undefined,
+        undefined,
+        {} as never,
+      ),
+    ).rejects.toThrow('clone_repo: invalid repo "not a repository"');
+  });
+});

packages/agent/src/pi/repository-tools-extension.ts

@@ -0,0 +1,61 @@
+import type {
+  ExtensionFactory,
+  InlineExtension,
+} from "@earendil-works/pi-coding-agent";
+import { defineTool } from "@earendil-works/pi-coding-agent";
+import { convertJsonSchemaToTypebox } from "@posthog/harness/extensions/mcp/schema";
+import { z } from "zod";
+import { enabledLocalTools, type LocalToolCtx } from "../adapters/local-tools";
+
+const REPOSITORY_TOOL_NAMES = new Set(["list_repos", "clone_repo"]);
+type NamedInlineExtension = Exclude<InlineExtension, ExtensionFactory>;
+
+function toolLabel(name: string): string {
+  return name
+    .replaceAll("_", " ")
+    .replace(/^./, (first) => first.toUpperCase());
+}
+
+function createRepositoryToolsFactory(cwd: string): ExtensionFactory {
+  return (pi) => {
+    const context: LocalToolCtx = { cwd };
+    const tools = enabledLocalTools(context, { channelMode: true }).filter(
+      (tool) => REPOSITORY_TOOL_NAMES.has(tool.name),
+    );
+
+    for (const localTool of tools) {
+      const schema = z.object(localTool.schema);
+      pi.registerTool(
+        defineTool({
+          name: localTool.name,
+          label: toolLabel(localTool.name),
+          description: localTool.description,
+          promptSnippet: localTool.description,
+          parameters: convertJsonSchemaToTypebox(z.toJSONSchema(schema)),
+          execute: async (_toolCallId, params) => {
+            const parsed = schema.safeParse(params);
+            if (!parsed.success) {
+              throw new Error(parsed.error.message);
+            }
+            const result = await localTool.handler(context, parsed.data);
+            if (result.isError) {
+              throw new Error(
+                result.content.map((item) => item.text).join("\n"),
+              );
+            }
+            return { content: result.content, details: {} };
+          },
+        }),
+      );
+    }
+  };
+}
+
+export function createPiRepositoryToolsExtension(
+  cwd: string,
+): NamedInlineExtension {
+  return {
+    name: "posthog-code-repository-tools",
+    factory: createRepositoryToolsFactory(cwd),
+  };
+}