Let pushes go by an HTTPS token or an SSH deploy key

The push credential is either a push-only account's token, handed to git
through a credential helper that names environment variables, never
values, or a deploy key in a short-lived ssh-agent. The remote URL
follows the credential. Configured as gitea.push_user and push_token, or
gitea.push_key.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/src/nisse_dev/agent.py

@@ -21,7 +21,7 @@ from nisse_dev.delegation import Caps, Delegation
 from nisse_dev.execution import SSHHost
 from nisse_dev.executor import LLMExecutor
 from nisse_dev.expert import ExpertDesk
-from nisse_dev.git import GitRepo
+from nisse_dev.git import GitRepo, HTTPSToken, PushCredential, SSHKey
 from nisse_dev.gitea import Comment, GiteaClient
 from nisse_dev.llm import AnthropicPassthroughClient, LiteLLMClient
 from nisse_dev.matrix import MatrixTransport
@@ -177,30 +177,45 @@ def build_host(config: AgentConfig) -> SSHHost:
     )
 
 
-def read_push_key(config: AgentConfig) -> str | None:
+def push_credential(config: AgentConfig) -> PushCredential | None:
+    """What pushes go by: a push-only account's token over HTTPS, or a
+    deploy key over SSH (D4)."""
+    if config.push_user and config.push_token:
+        return HTTPSToken(config.push_user, config.push_token)
     if config.push_key is None:
         return None
     try:
-        return config.push_key.read_text()
+        return SSHKey(config.push_key.read_text())
     except OSError as exc:
         raise RuntimeError(
             f"cannot read the push key {config.push_key}: {exc}"
         ) from exc
 
 
+def remote_url(gitea: GiteaClient, repo: str, credential: PushCredential | None) -> str:
+    """The credential-free URL the workspace clones from and pushes to."""
+    if isinstance(credential, SSHKey):
+        return gitea.ssh_url(repo)
+    return gitea.clone_url(repo)
+
+
 def prepare_workspace(
-    host: SSHHost, config: AgentConfig, account: str, remote: str, key: str | None
+    host: SSHHost,
+    config: AgentConfig,
+    account: str,
+    remote: str,
+    credential: PushCredential | None,
 ) -> GitRepo:
     """Ensure the workspace on the build VM is a clone of the project repo.
 
     The clone uses the repository's SSH URL, so no credential is ever stored
-    in it (#89); the push key is handed to the clone and nothing else.
+    in it (#89); the push credential is handed to the clone and nothing else.
     Cloning here rather than when a work item starts is the single-project
     shortcut that M1.4 and D3's fresh workspace replace.
     """
     repo = GitRepo(host, config.workspace)
     if not repo.exists():
-        repo.clone(remote, key=key)
+        repo.clone(remote, credential=credential)
     repo.configure_identity(account, f"{account}@users.noreply.local")
     return repo
 
@@ -229,9 +244,9 @@ def build_agent(
     account = gitea.whoami()
 
     host = build_host(config)
-    push_key = read_push_key(config)
-    remote = gitea.ssh_url(config.gitea_repo)
-    git_repo = prepare_workspace(host, config, account, remote, push_key)
+    credential = push_credential(config)
+    remote = remote_url(gitea, config.gitea_repo, credential)
+    git_repo = prepare_workspace(host, config, account, remote, credential)
     tuning = config.tuning
     workspace = Workspace(
         host,
@@ -278,7 +293,7 @@ def build_agent(
         config.gitea_repo,
         git_repo,
         remote_url=remote,
-        push_key=push_key,
+        push_credential=credential,
         base_branch=config.base_branch,
     )
 

nisse-dev/src/nisse_dev/config.py

@@ -55,6 +55,8 @@ OPTIONAL_KEYS = (
     "llm.request_timeout_s",
     "gitea.base_branch",
     "gitea.push_key",
+    "gitea.push_user",
+    "gitea.push_token",
     "build_host.user",
     "build_host.port",
 )
@@ -241,9 +243,12 @@ class AgentConfig:
     gitea_operators: frozenset[str]
     build_host: BuildHost
     base_branch: str = "main"
-    # The key that may push to the project repository, handed to each push on
-    # the build VM and to nothing else (D4).
+    # What may push to the project repository, handed to each push on the
+    # build VM and to nothing else (D4): a push-only account's HTTPS token
+    # (push_user, push_token), or the path to a deploy key (push_key).
     push_key: Path | None = None
+    push_user: str | None = None
+    push_token: str | None = None
     max_output_tokens: int = DEFAULT_MAX_OUTPUT_TOKENS
     request_timeout_s: float = DEFAULT_REQUEST_TIMEOUT_S
     tuning: Tuning = field(default_factory=Tuning)
@@ -331,6 +336,12 @@ class AgentConfig:
                 raise ValueError
         except (TypeError, ValueError):
             errors.append("build_host.port: must be a TCP port number")
+        push_user = values.get("gitea.push_user")
+        push_token = values.get("gitea.push_token")
+        if bool(push_user) != bool(push_token):
+            errors.append("gitea.push_user and gitea.push_token: set both or neither")
+        if push_token and values.get("gitea.push_key"):
+            errors.append("gitea: set a push token or a push key, not both")
         if errors:
             raise ConfigError("cannot start: " + "; ".join(errors))
 
@@ -365,6 +376,8 @@ class AgentConfig:
                 port=port,
             ),
             push_key=Path(push_key).expanduser() if push_key else None,
+            push_user=str(push_user) if push_user else None,
+            push_token=str(push_token) if push_token else None,
             base_branch=str(values.get("gitea.base_branch") or "main"),
             max_output_tokens=max_output,
             request_timeout_s=request_timeout,

nisse-dev/src/nisse_dev/git.py

@@ -3,9 +3,15 @@
 Every command runs on the build VM over SSH. Remotes are plain URLs with no
 credential in them, so nothing secret is ever written to the clone's
 configuration (#89). Operations that reach the remote (clone, fetch, push,
-ls-remote) are handed the push key for that one operation: it is fed over
-stdin to a short-lived ``ssh-agent`` on the VM and gone when the command
-ends. The model's commands never receive it.
+ls-remote) are handed the push credential for that one operation, and the
+model's commands never receive it:
+
+- an HTTPS token (the default: HTTPS reaches the forge from everywhere) goes
+  to git through a credential helper that names environment variables, never
+  values; the values are that one command's secrets, so they are never on a
+  command line and are redacted from its output;
+- an SSH key is fed over stdin to a short-lived ``ssh-agent`` on the VM, gone
+  when the command ends.
 
 Pull requests are opened from the agent's own host with its Gitea API token
 (publish.py), which never reaches the VM.
@@ -27,6 +33,31 @@ class GitError(RuntimeError):
     pass
 
 
+@dataclass(frozen=True)
+class HTTPSToken:
+    """A push-only account's token, for HTTPS remotes (D4)."""
+
+    username: str
+    token: str
+
+
+@dataclass(frozen=True)
+class SSHKey:
+    """A deploy key's private half, for SSH remotes (D4)."""
+
+    private_key: str
+
+
+PushCredential = HTTPSToken | SSHKey
+
+# git asks the helper for credentials; it answers from the environment, so
+# the command line names variables, never values.
+_HELPER = (
+    '!f() { test "$1" = get || return 0; '
+    'echo "username=$NISSE_PUSH_USER"; echo "password=$NISSE_PUSH_TOKEN"; }; f'
+)
+
+
 def _with_key(command: str, known_hosts: str | None) -> str:
     """Run ``command`` with the key on stdin loaded into a throwaway agent."""
     git_ssh = _GIT_SSH
@@ -48,13 +79,33 @@ class GitRepo:
     # the VM user's own known_hosts.
     known_hosts: str | None = None
 
-    def _git(self, *args: str, key: str | None = None, cwd: str | None = None) -> str:
-        command = "git " + " ".join(shlex.quote(a) for a in args)
+    def _git(
+        self,
+        *args: str,
+        credential: PushCredential | None = None,
+        cwd: str | None = None,
+    ) -> str:
+        quoted = " ".join(shlex.quote(a) for a in args)
+        command, stdin, secrets = f"git {quoted}", None, {}
+        if isinstance(credential, SSHKey):
+            command = _with_key(command, self.known_hosts)
+            stdin = credential.private_key
+        elif isinstance(credential, HTTPSToken):
+            # The empty helper first clears any configured on the VM.
+            command = (
+                "GIT_TERMINAL_PROMPT=0 git -c credential.helper= "
+                f"-c credential.helper={shlex.quote(_HELPER)} {quoted}"
+            )
+            secrets = {
+                "NISSE_PUSH_USER": credential.username,
+                "NISSE_PUSH_TOKEN": credential.token,
+            }
         try:
             result = self.host.execute(
-                _with_key(command, self.known_hosts) if key else command,
+                command,
                 cwd=cwd or str(self.root),
-                stdin=key,
+                stdin=stdin,
+                secrets=secrets,
                 timeout_s=TIMEOUT_S,
             )
         except HostUnavailable as exc:
@@ -87,11 +138,13 @@ class GitRepo:
         return int(self._git("rev-list", "--count", f"{ref}..HEAD"))
 
     def remote_sha(
-        self, remote_url: str, branch: str, *, key: str | None = None
+        self, remote_url: str, branch: str, *, credential: PushCredential | None = None
     ) -> str | None:
         """What the remote's branch points at, or None if it has no such
         branch. Pushes go by URL, so there is no tracking ref to read."""
-        out = self._git("ls-remote", remote_url, f"refs/heads/{branch}", key=key)
+        out = self._git(
+            "ls-remote", remote_url, f"refs/heads/{branch}", credential=credential
+        )
         return out.split()[0] if out else None
 
     def exists(self) -> bool:
@@ -110,12 +163,16 @@ class GitRepo:
         self.host.execute(f"mkdir -p -- {shlex.quote(str(self.root))}")
         self._git("init", "-q", "-b", default_branch)
 
-    def clone(self, remote_url: str, *, key: str | None = None) -> None:
+    def clone(
+        self, remote_url: str, *, credential: PushCredential | None = None
+    ) -> None:
         """Clone into the workspace root. The remote URL carries no
         credential, so none is stored in the clone's configuration."""
         parent = str(self.root.parent)
         self.host.execute(f"mkdir -p -- {shlex.quote(parent)}")
-        self._git("clone", "-q", remote_url, str(self.root), key=key, cwd=parent)
+        self._git(
+            "clone", "-q", remote_url, str(self.root), credential=credential, cwd=parent
+        )
 
     def configure_identity(self, name: str, email: str) -> None:
         self._git("config", "user.name", name)
@@ -143,10 +200,14 @@ class GitRepo:
         self._git("commit", "-q", "-m", message)
         return self.head_sha()
 
-    def push(self, remote_url: str, branch: str, *, key: str | None = None) -> None:
+    def push(
+        self, remote_url: str, branch: str, *, credential: PushCredential | None = None
+    ) -> None:
         # By URL, per invocation, rather than a configured remote with a
         # credential in it.
-        self._git("push", "-q", remote_url, f"HEAD:refs/heads/{branch}", key=key)
+        self._git(
+            "push", "-q", remote_url, f"HEAD:refs/heads/{branch}", credential=credential
+        )
 
     def discard_branch(self, branch: str, *, back_to: str) -> None:
         """Throw away a branch and everything on it.
@@ -159,6 +220,8 @@ class GitRepo:
         self._git("branch", "-q", "-D", branch)
 
     def delete_remote_branch(
-        self, remote_url: str, branch: str, *, key: str | None = None
+        self, remote_url: str, branch: str, *, credential: PushCredential | None = None
     ) -> None:
-        self._git("push", "-q", remote_url, f":refs/heads/{branch}", key=key)
+        self._git(
+            "push", "-q", remote_url, f":refs/heads/{branch}", credential=credential
+        )

nisse-dev/src/nisse_dev/gitea.py

@@ -74,6 +74,10 @@ class GiteaClient:
         """The repository's SSH clone URL, which carries no credential."""
         return str(self._request("GET", f"/repos/{repo}")["ssh_url"])
 
+    def clone_url(self, repo: str) -> str:
+        """The repository's HTTPS clone URL, which carries no credential."""
+        return str(self._request("GET", f"/repos/{repo}")["clone_url"])
+
     def whoami(self) -> str:
         return str(self._request("GET", "/user")["login"])
 

nisse-dev/src/nisse_dev/publish.py

@@ -9,7 +9,7 @@ an idempotent transition reconciled against external truth.
 
 from dataclasses import dataclass
 
-from nisse_dev.git import GitRepo
+from nisse_dev.git import GitRepo, PushCredential
 from nisse_dev.gitea import (
     GiteaClient,
     GiteaError,
@@ -37,7 +37,7 @@ class MilestonePublisher:
         git_repo: GitRepo,
         *,
         remote_url: str,
-        push_key: str | None = None,
+        push_credential: PushCredential | None = None,
         base_branch: str = "main",
     ) -> None:
         self._store = store
@@ -45,10 +45,10 @@ class MilestonePublisher:
         self._repo = repo
         self._git = git_repo
         self._base_branch = base_branch
-        # A URL with no credential in it; the push key is handed to each push
-        # on the build VM and nothing else (D4, L12).
+        # A URL with no credential in it; the push credential is handed to
+        # each push on the build VM and nothing else (D4, L12).
         self._remote = remote_url
-        self._key = push_key
+        self._credential = push_credential
 
     def reconcilers(self) -> dict[str, Reconciler]:
         return {OPEN_PR_INTENT: pull_request_reconciler(self._client, self._repo)}
@@ -85,7 +85,7 @@ class MilestonePublisher:
             cause=f"publishing milestone {milestone}",
             work_item=task_id,  # owned by the work item it publishes (L1)
         )
-        self._git.push(self._remote, branch, key=self._key)
+        self._git.push(self._remote, branch, credential=self._credential)
         # Idempotent: if a PR for this branch is already open (a crash after
         # opening it, or a response lost on the way back), the push above
         # has updated it; adopt it rather than fail on a second.
@@ -150,10 +150,12 @@ class MilestonePublisher:
         if sha is None:
             # The executor may have committed the fix itself.
             sha = self._git.head_sha()
-            pushed = self._git.remote_sha(self._remote, branch, key=self._key)
+            pushed = self._git.remote_sha(
+                self._remote, branch, credential=self._credential
+            )
             if sha == pushed:
                 return None
-        self._git.push(self._remote, branch, key=self._key)
+        self._git.push(self._remote, branch, credential=self._credential)
         return sha
 
 

nisse-dev/tests/test_agent_build.py

@@ -151,7 +151,7 @@ def build_offline(tmp_path: Path, origin: Path, monkeypatch: Any) -> Any:
     )
     monkeypatch.setattr("nisse_dev.agent.MatrixTransport", lambda cfg: FakeTransport())
     monkeypatch.setattr(
-        "nisse_dev.agent.GiteaClient.ssh_url", lambda self, repo: str(origin)
+        "nisse_dev.agent.GiteaClient.clone_url", lambda self, repo: str(origin)
     )
     return build_agent(config)
 
@@ -355,7 +355,7 @@ def test_tuning_reaches_every_component(
     )
     monkeypatch.setattr("nisse_dev.agent.MatrixTransport", lambda cfg: FakeTransport())
     monkeypatch.setattr(
-        "nisse_dev.agent.GiteaClient.ssh_url", lambda self, repo: str(origin)
+        "nisse_dev.agent.GiteaClient.clone_url", lambda self, repo: str(origin)
     )
     agent = build_agent(config)
     executor = agent.orchestrator._executor

nisse-dev/tests/test_config.py

@@ -351,3 +351,12 @@ def test_a_bad_build_host_port_is_reported() -> None:
 def test_the_push_key_is_optional_and_a_path() -> None:
     assert build().push_key is None
     assert build(gitea__push_key="~/k").push_key == Path("~/k").expanduser()
+
+
+def test_a_push_token_needs_its_user_and_excludes_a_key() -> None:
+    config = build(gitea__push_user="pusher", gitea__push_token="${TEST_GITEA_TOKEN}")
+    assert (config.push_user, config.push_token) == ("pusher", "gt")
+    with pytest.raises(ConfigError, match="set both or neither"):
+        build(gitea__push_user="pusher")
+    with pytest.raises(ConfigError, match="not both"):
+        build(gitea__push_user="p", gitea__push_token="t", gitea__push_key="~/k")

nisse-dev/tests/test_git.py

@@ -7,7 +7,7 @@ from pathlib import Path
 import pytest
 
 from nisse_dev.execution import SSHHost
-from nisse_dev.git import GitError, GitRepo
+from nisse_dev.git import GitError, GitRepo, HTTPSToken, SSHKey
 
 
 @pytest.fixture
@@ -76,16 +76,16 @@ def test_commits_since_and_remote_sha_against_a_local_remote(
 
 
 @pytest.fixture
-def ssh_remote(ssh_host: SSHHost, tmp_path: Path) -> tuple[str, str]:
+def ssh_remote(ssh_host: SSHHost, tmp_path: Path) -> tuple[str, SSHKey]:
     """A bare repository reached by git over SSH, and the key that may push
     to it: the forge, as the build VM sees it."""
     remote = bare_remote(tmp_path / "forge.git")
     url = f"ssh://{ssh_host.user}@127.0.0.1:{ssh_host.port}{remote}"
-    return url, ssh_host._key.read_text()
+    return url, SSHKey(ssh_host._key.read_text())
 
 
 def test_clone_and_push_with_the_key_store_no_credential(
-    ssh_host: SSHHost, tmp_path: Path, ssh_remote: tuple[str, str]
+    ssh_host: SSHHost, tmp_path: Path, ssh_remote: tuple[str, SSHKey]
 ) -> None:
     url, key = ssh_remote
     seed = GitRepo(ssh_host, tmp_path / "seed", known_hosts=str(tmp_path / "kh"))
@@ -93,10 +93,10 @@ def test_clone_and_push_with_the_key_store_no_credential(
     seed.configure_identity("t", "t@example.test")
     (seed.root / "a.txt").write_text("a")
     seed.commit_all("first")
-    seed.push(url, "main", key=key)
+    seed.push(url, "main", credential=key)
 
     clone = GitRepo(ssh_host, tmp_path / "clone", known_hosts=str(tmp_path / "kh"))
-    clone.clone(url, key=key)
+    clone.clone(url, credential=key)
     assert (clone.root / "a.txt").read_text() == "a"
     config = (clone.root / ".git" / "config").read_text()
     assert "PRIVATE KEY" not in config
@@ -105,7 +105,7 @@ def test_clone_and_push_with_the_key_store_no_credential(
 
 
 def test_the_key_is_gone_when_the_command_ends(
-    ssh_host: SSHHost, tmp_path: Path, ssh_remote: tuple[str, str]
+    ssh_host: SSHHost, tmp_path: Path, ssh_remote: tuple[str, SSHKey]
 ) -> None:
     url, key = ssh_remote
     repo = GitRepo(ssh_host, tmp_path / "w", known_hosts=str(tmp_path / "kh"))
@@ -114,12 +114,12 @@ def test_the_key_is_gone_when_the_command_ends(
     (repo.root / "a.txt").write_text("a")
     repo.commit_all("first")
     before = _agents()
-    repo.push(url, "main", key=key)
+    repo.push(url, "main", credential=key)
     assert _agents() == before  # the throwaway ssh-agent was killed
 
 
 def test_a_failed_push_still_kills_its_agent(
-    ssh_host: SSHHost, tmp_path: Path, ssh_remote: tuple[str, str]
+    ssh_host: SSHHost, tmp_path: Path, ssh_remote: tuple[str, SSHKey]
 ) -> None:
     _, key = ssh_remote
     repo = GitRepo(ssh_host, tmp_path / "w", known_hosts=str(tmp_path / "kh"))
@@ -127,7 +127,9 @@ def test_a_failed_push_still_kills_its_agent(
     before = _agents()
     with pytest.raises(GitError):
         repo.push(
-            f"ssh://nobody@127.0.0.1:{ssh_host.port}/nowhere.git", "main", key=key
+            f"ssh://nobody@127.0.0.1:{ssh_host.port}/nowhere.git",
+            "main",
+            credential=key,
         )
     assert _agents() == before
 
@@ -144,3 +146,52 @@ def test_a_remote_url_is_quoted_not_interpreted(repo: GitRepo, tmp_path: Path) -
     with pytest.raises(GitError):
         repo.push(f"x; touch {shlex.quote(str(marker))}", "main")
     assert not marker.exists()
+
+
+class RecordingHost:
+    """Captures what would be sent to the build VM."""
+
+    def __init__(self) -> None:
+        self.calls: list[dict] = []
+
+    def execute(self, command: str, **kwargs):
+        from nisse_dev.execution import Result
+
+        self.calls.append({"command": command, **kwargs})
+        return Result(0, "", "")
+
+
+def test_an_https_token_travels_only_as_a_secret(tmp_path: Path) -> None:
+    host = RecordingHost()
+    repo = GitRepo(host, tmp_path)  # type: ignore[arg-type]
+    token = "tok-" + "9f3a" * 6
+    repo.push(
+        "https://gitea.test/o/r.git", "m1", credential=HTTPSToken("pusher", token)
+    )
+    [call] = host.calls
+    assert token not in call["command"]  # never on a command line
+    assert "pusher" not in call["command"]
+    assert call["secrets"] == {"NISSE_PUSH_USER": "pusher", "NISSE_PUSH_TOKEN": token}
+    # Git asks a helper that reads the environment, and any helper configured
+    # on the VM is cleared first.
+    assert "credential.helper= " in call["command"]
+    assert "$NISSE_PUSH_TOKEN" in call["command"]
+    assert "GIT_TERMINAL_PROMPT=0" in call["command"]
+
+
+def test_an_https_token_answers_git_through_the_helper(
+    ssh_host: SSHHost, tmp_path: Path
+) -> None:
+    # The helper as git runs it, on the build host: asked to "get", it
+    # answers from the environment; asked anything else, nothing.
+    from nisse_dev.git import _HELPER
+
+    body = _HELPER.removeprefix("!")
+    asked = ssh_host.execute(
+        f"{body} get",
+        secrets={"NISSE_PUSH_USER": "pusher", "NISSE_PUSH_TOKEN": "tok-1234567"},
+    )
+    # Both travel as secrets, so both are masked in what comes back.
+    assert asked.stdout == "username=[redacted]\npassword=[redacted]\n"
+    stored = ssh_host.execute(f"{body} store", secrets={"NISSE_PUSH_TOKEN": "x"})
+    assert stored.stdout == ""

nisse-dev/tests/test_publish.py

@@ -6,7 +6,7 @@ from typing import Any
 import pytest
 
 from nisse_dev.execution import SSHHost
-from nisse_dev.git import GitRepo
+from nisse_dev.git import GitRepo, HTTPSToken
 from nisse_dev.gitea import GiteaError, PullRequest
 from nisse_dev.oplog import OpLog
 from nisse_dev.publish import OPEN_PR_INTENT, MilestonePublisher
@@ -77,7 +77,7 @@ class FakeGit:
         return self.repo.commits_since(ref)
 
     def remote_sha(
-        self, remote_url: str, branch: str, *, key: str | None = None
+        self, remote_url: str, branch: str, *, credential: object = None
     ) -> str | None:
         return self.remote.get(branch)
 
@@ -90,7 +90,7 @@ class FakeGit:
     def commit_all(self, message: str) -> str | None:
         return self.repo.commit_all(message)
 
-    def push(self, remote_url: str, branch: str, *, key: str | None = None) -> None:
+    def push(self, remote_url: str, branch: str, *, credential: object = None) -> None:
         self.pushed.append(branch)
         self.remote[branch] = self.repo.head_sha()
 
@@ -111,7 +111,7 @@ def build(store: StateStore, git: Any, client: Any) -> MilestonePublisher:
         "o/sandbox",
         git,
         remote_url="ssh://git@gitea.test/o/sandbox.git",
-        push_key="KEY",
+        push_credential=HTTPSToken("pusher", "tok"),
     )