Git authentication & identity

1. HTTPS authentication: every git invocation that needs it — admin terminal, non-admin terminal (pull, fetch, push, and ls-remote only), command presets, and the structured Git API — injects a host-scoped http.https://<PAUIOPS_GIT_HOST>/.extraHeader config entry, computed fresh from PAUIOPS_GIT_USERNAME/PAUIOPS_GIT_PASSWORD on that single command. Administrator project clone uses the same mechanism, scoped to the exact clone URL via http.extraHeader.
2. Commit authorship: app-triggered commits receive user.name and user.email per invocation from PAUIOPS_GIT_AUTHOR_NAME/PAUIOPS_GIT_AUTHOR_EMAIL. Commit identity does not authenticate the remote or change global/repository author settings.

PAUIOPS_GIT_USERNAME=<git-provider-username>
PAUIOPS_GIT_PASSWORD=<scoped-provider-access-token>
PAUIOPS_GIT_HOST=<git-provider-host>
PAUIOPS_GIT_AUTHOR_NAME=PAUIOps Automation
PAUIOPS_GIT_AUTHOR_EMAIL=<git-author-email>

The host is bare: no https:// and no repository path. When both credential values are set, Manager computes the http.https://<host>/.extraHeader entry fresh on every git invocation that needs it — never at startup, and never to a file. Loading a changed value still requires restarting Manager, but there is no separate credential-store step afterward: the very next command authenticates correctly.

Non-admin sessions run with GIT_CONFIG_NOSYSTEM=1 and GIT_CONFIG_GLOBAL=/dev/null, so a session can never reach user-controlled global git config, alias injection, or core.sshCommand. The same host-scoped credential header used by the admin terminal is injected only for the four network subcommands a non-admin can run — pull, fetch, push, and ls-remote — so authentication works without weakening that isolation.

Structured PAUIOps-owned Git runners, private clone, and the fresh-per-command credential injection remove PAUIOPS_*, deprecated DOCKER_MGR_*, and SUDO_PASSWORD before spawning Git or its hooks. A raw or interactive terminal inherits the service process environment before it invokes Git, scripts, helpers, or hooks. Treat terminal access and executable repository hooks as trusted-code boundaries.

safe.directory remains scoped to the active repository. PAUIOps never uses safe.directory=*. A missing or mismatched credential now fails with a clear, actionable error naming the missing variable or the PAUIOPS_GIT_HOST mismatch, instead of hanging on a disabled prompt.

Update PAUIOPS_GIT_PASSWORD (and PAUIOPS_GIT_USERNAME if it changed) in the protected environment, then restart Manager. There is no stored credential to replace, reject, or clean up — nothing persists between commands or across a restart. Clearing either variable simply disables authenticated Git for that host.