Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

git: host-held credentials for model-driven clone, fetch, pull and push

未关闭
  • 哪里不对？
#218 3 条评论 1 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 1 天内回复

@aron-cf 已经在做这个了。

开始于 2026年10月8日。

评估

这个 Issue 还没有评估数据。

描述

enhancement

The model-facing git entry points, which are the worker-shell git command and ws:git (cli, clone), have no way to authenticate. Host code can pass onAuth or headers on each GitClient call. A model running git push or git clone against a private repo can't, unless it puts a token on the command line, and then the token sits in the transcript.

@cloudflare/shell in cloudflare/agents had gitTools(ws, { token }) / { auth: { username, password } }. The host held the credential and added it to clone, fetch, pull, and push, so the model never saw it. We're deprecating Shell for Computer and need the same thing.

Proposal

Add a host-side auth resolver to the git client factory:

createGitClient({
  auth: (url) =>
    new URL(url).host === "github.com"
      ? { username: "x-access-token", password: env.GITHUB_TOKEN }
      : undefined,
});
  • clone, fetch, pull, push, and ls-remote call the resolver for every network request. That covers the typed client, git.cli, the worker-shell git command, and ws:git.
  • Auth passed explicitly on a call still wins over the resolver.
  • The credential never shows up in command output, error messages, .git/config, or remote URLs written to the repo.
  • The resolver takes the URL, so one workspace can hold different credentials for different hosts.
主要语言
TypeScript
星标
9.5k
派生
552
平均合并
1 天 17 小时
30 天内合并 PR
50

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

cloudflare/computer 的其他 Issue

查看 cloudflare/computer 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。