Sandbox has no git credentials: git push and git fetch both fail with "could not read Username" for public HTTPS remote

[evolve-bch]

Problem

In the current agent sandbox session (checkout at /workspace, remote https://github.com/uk-agents/evolve.git), no git network operation succeeds — not just pushes. This blocks implementing issue #15 (and any other code-change issue): the branch and commit are ready locally but cannot be pushed, so no pull request can be opened.

Evidence

• git fetch origin main, git ls-remote origin main, and git clone into a scratch directory all fail identically:

  fatal: could not read Username for 'https://github.com': No such device or address
  

  (with GIT_TERMINAL_PROMPT=0: terminal prompts disabled). GIT_TRACE=1 GIT_CURL_VERBOSE=1 git ls-remote shows the server responds 401 with www-authenticate: Basic realm="GitHub" — i.e. git genuinely has no credential to present, this is not a guard rejection.
• Anonymous HTTPS reads work fine (curl -sI https://github.com/... → 200; curl https://api.github.com/repos/uk-agents/evolve/commits?sha=main → 200 JSON), so outbound network access itself is not the blocker — it's specifically git's authentication for github.com git-over-HTTPS.
• git push -u origin <branch> (the exact form the shell guard documentation says is permitted) is not rejected by the guard — it passes through to real git and fails with the same could not read Username error, both via the interactive bash tool and via start_background. Disallowed push forms (e.g. --dry-run, explicit refspecs, pushes to main) are correctly rejected by the guard with its own message, confirming the guard itself is working — there is simply no credential available to inject for the allowed form.
• No credential helper, .netrc, GIT_ASKPASS, or token is present in the environment (git config -l, env, and common credential-file locations were all checked and are empty).

Impact

Any agent task that requires pushing a branch (essentially all code-change work) cannot be completed end-to-end in a session with this defect: the branch/commit can be prepared locally but not published, so no PR can be opened for review.

Ask

This looks like a session/credential-provisioning defect in the platform rather than something fixable from repository code. Needs maintainer/platform-operator attention to confirm whether git push credentials are expected to be injected transparently for permitted git push -u origin <branch> commands, and why that didn't happen in this session.

Context

Hit while implementing #15 ("Add unit tests for GitHub channel dispatch gates"). That work is complete and committed locally on branch agent/15-github-channel-dispatch-tests (commit a409216), verified with npm run typecheck, npm test, and npm run build, but is stuck unpublished until this is resolved.

[paulieb89]

Resolved — not reproducible in current prod. Sandbox git push works with the Vercel Connect-brokered GitHub App credential (evolve-bch[bot]), which eve injects into the channel-managed checkout.

Evidence:

• The task that triggered this ([agent] Add unit tests for GitHub channel dispatch gates #15) later succeeded as its re-dispatch [agent] Add unit tests for GitHub channel dispatch gates #23 → merged as test(channels): add unit tests for GitHub dispatch gates (#23) #29 (agent/23-github-dispatch-gate-tests pushed to the remote).
• Multiple agent branches pushed since, e.g. agent/41-add-nvmrc @ 7d2a1e5, authored by evolve-bch[bot], pushed today.
• open_pull_request only opens PRs from already-pushed branches, so every merged agent PR ([agent] Add Dependabot config for npm and GitHub Actions (#27) #34, [agent] Unit-test the shell command guard (agent/lib/command-guard.ts) #35, Add .editorconfig matching the project's TypeScript style (#28) #39, and PR [agent] Add .nvmrc pinning Node 24 to match CI (#41) #42) is proof the sandbox push path works.

Original cause was almost certainly a transient provisioning race in that early session (connector/redeploy not yet fully propagated). Flagging as a possible intermittent for the upstream notes, but nothing to fix in-repo.

[evolve-bch]

The issue is already in closed state and paulieb89 has added the resolving comment with evidence. No further action needed.

Summary for the record: Issue #24 — "Sandbox has no git credentials" — was a transient provisioning race in early agent sessions. It self-resolved as the platform stabilised. Evidence of resolution: the original task (#15) eventually merged as #29, multiple subsequent agent branches (including agent/41-add-nvmrc pushed today) succeeded, and every merged agent PR proves the push path works. Nothing to fix in-repo as noted.