kandev/docs/plans/github-managed-tools-login-shell/task-01-path-independent-git-helper.md

id, title, status, wave, depends_on, plan, spec

id	title	status	wave	depends_on	plan	spec
01-path-independent-git-helper	Path-independent Git credential helper	done	1		plan.md	../../specs/integrations/requirements/github-authentication.md

Task 01: Path-Independent Git Credential Helper

Acceptance

• Managed Git invokes the instance-owned agentctl helper even when the active shell PATH does not contain the helper executable, including an absolute helper path containing whitespace.
• The helper reset/order and fail-closed behavior remain unchanged; no ambient helper or prompt is used when the managed helper is missing or fails.
• Executor inheritance removes both current and legacy managed-helper entries while preserving unrelated indexed Git configuration in order.

Verification

RED first:

cd apps/backend && rtk go test ./internal/orchestrator/executor -run 'TestConfigureGitHubCredentialBrokerHelperSurvivesPathReset' -count=1

GREEN and focused regression checks:

cd apps/backend && rtk go test ./internal/orchestrator/executor -run 'Test.*(GitHubCredential|ManagedGitHubHelper)' -count=1

Files likely touched

• apps/backend/internal/githubauth/environment.go
• apps/backend/internal/orchestrator/executor/executor_credentials.go
• apps/backend/internal/orchestrator/executor/executor_credentials_test.go
• this task file and plan.md

Dependencies

None.

Parallelism

Sequential. Task 02 consumes the shared managed-helper and shim-environment constants established here.

Inputs

• Spec: managed runtime-tool behavior, security constraints, failure modes, and login-PATH scenarios.
• Plan: confirmed root cause and path-independent helper design.
• Existing patterns: configureGitHubCredentialBrokerForRepositories, removeManagedGitHubCredentials, and gitconfigenv.Filter.

Output contract

Report the RED failure reason, final helper command and quoting behavior, legacy-removal behavior, files changed, exact test results, security/secret boundary, and synchronized task/plan status.

Results

• RED: cd apps/backend && rtk go test ./internal/orchestrator/executor -run 'TestConfigureGitHubCredentialBrokerHelperSurvivesPathReset' -count=1 failed as expected with agentctl: not found and Git's terminal-prompt-disabled error.
• GREEN: the same regression test initially passed after the helper changed to the shim-directory variable. Task 03 superseded that lifetime assumption with a dedicated absolute helper-executable variable so preparation-time Git works before the shim directory exists.
• GREEN: cd apps/backend && rtk go test ./internal/orchestrator/executor -run 'Test.*(GitHubCredential|ManagedGitHubHelper)' -count=1 passed (7 tests).
• The regression uses a temporary helper path containing whitespace and fake non-secret credentials; the test process owns and removes its temporary directory automatically. No credential values, leases, or tokens were persisted. Final git diff --check passed after Task 02 completed.