Improve support for installation tokens

[tnm]

What This PR Does

This PR fixes GitHub authentication issues when using installation tokens or Personal Access Tokens (PATs) for Git operations. The change improves how the code handles Git's credential prompts by properly distinguishing between username and password requests.

Key Changes

• Enhanced the Git askpass helper script to handle both username and password prompts separately
• Sets username to "x-access-token" (GitHub's recommended approach) when prompted
• Provides the actual token only when Git asks for the password
• Prevents authentication failures that occurred when the token was used for both username and password

Impact

• Areas affected: Git repository cloning functionality in src/kit/repository.py
• Benefits: Resolves 404/authentication errors when cloning private GitHub repositories with installation tokens
• Risk: Low risk change that improves existing authentication flow without breaking existing functionality

Generated by kit v1.3.2 • Model: claude-sonnet-4-20250514

[tnm]

🛠️ Kit AI Code Review

Priority Issues

Medium Priority: The askpass script lacks proper error handling and cleanup mechanisms that could lead to resource leaks or authentication failures in edge cases.

Summary

This PR improves GitHub authentication by fixing how Git credentials are provided when using tokens (PATs or installation tokens). The change addresses a critical issue where Git's two-prompt authentication flow (username + password) was being handled incorrectly, causing 404/authentication errors.

Key changes:

• Replaces simple token echo with a conditional script that responds appropriately to Git's username/password prompts
• Uses GitHub's recommended "x-access-token" as the username when authenticating with tokens
• Implements proper prompt detection using case matching on the $1 parameter

Recommendations

1. Add error handling for edge cases at src/kit/repository.py:260:

   askpass_script.write(
       "#!/bin/sh\n"
       'case "$1" in\n'
       '  *Username*|*username*) echo "x-access-token" ;;\n'  # Handle case variations
       '  *Password*|*password*) echo "%s" ;;\n'
       '  *) echo "x-access-token" ;;\n'  # Default to username for unknown prompts
       "esac\n" % token
   )

   The current fallback echo "" could cause authentication failures. Defaulting to username is safer since Git typically asks for username first.

2. Improve token sanitization at src/kit/repository.py:265:

   # Escape shell special characters in token
   escaped_token = token.replace('"', '\\"').replace('$', '\\$').replace('`', '\\`')
   # ... use escaped_token in the script

   Tokens containing shell metacharacters could break the script or create security issues.

3. Add logging for debugging - Consider adding debug logging to track which prompt type Git is requesting, as authentication issues can be difficult to troubleshoot.

The core logic is sound and addresses a real authentication problem. The implementation correctly follows GitHub's token authentication patterns and should resolve the 404 errors mentioned in the comments.

---

Generated by cased kit v1.3.2 • Mode: kit • Model: claude-sonnet-4-20250514