feat(sandbox): user-provided git submodule credentials per virtual MCP

[guitavano]

Summary

Private git submodules live in repositories the main clone's per-repo GitHub App token can't reach (a different repo/org), so today a sandbox clone leaves them empty and the dev server fails with module not found. This lets a user supply a per-host PAT (stored as a vault secret) on the virtual MCP; Studio resolves it on every SANDBOX_START and hands the token to the daemon on a git-only channel so git submodule update can authenticate.

How it works

UI (Sandbox card)  →  metadata.runtime.submoduleCredentials [{host, secretId}]
  →  start.ts resolves secretId in the vault → [{host, token}]
  →  runner.ensure → buildConfigPayload → git.repository.submoduleCredentials
  →  daemon config-store (deep-merge)
  →  clone.ts: write .git-credentials (0o600) + insteadOf SSH→HTTPS
     → git submodule update --init --recursive --depth 1 → delete the file

• The token never enters the env bag the dev server sees, never appears in argv, and is never persisted into the repo's .git/config. It lives only in a short-lived credentials file (mode 0o600, next to the no-op askpass, outside the repo) read by credential.helper=store, then deleted.
• insteadOf rewrites (which carry no token) turn git@host: / ssh://git@host/ submodule URLs into HTTPS so the store credential applies — covering SSH-form submodules like git@github.com:ZeeDog/zee.git.
• Opt-in and best-effort: no-op without credentials or a .gitmodules; a fetch failure warns and leaves the working tree intact rather than failing the whole clone.

UI

A "Submodule credentials" editor in the virtual MCP Sandbox card (below Environment variables), reusing the existing secret picker + create-secret dialog. Each row = { host, secret }. Incomplete rows are stripped from the autosave payload.

Testing

• bun run check (all workspaces) ✓ · bun run lint 0 errors ✓ · knip clean ✓ · bun run fmt ✓
• New unit tests: clone.test.ts (+7 — host validation, dedupe, token percent-encoding, insteadOf/helper argv, no-token-in-argv), helpers.test.ts (+3 — defensive metadata reader).
• Existing suites green: sandbox setup + start.test.ts 101/101, config-store/payload 47/47.
• Not exercised end-to-end here (requires a real sandbox + a PAT with access to a private submodule repo). To test the Zee case: create a secret with a PAT for ZeeDog/zee, add github.com → that secret in the virtual MCP UI, then start the sandbox.

Notes for reviewers

1. PAT persistence on recovery. submoduleCredentials rides through ensureOpts.repo (preserved by withFreshCloneUrl), so autonomous recovery re-clones with submodules. Cost: the long-lived PAT is persisted in sandbox_runner_state alongside the cloneUrl token (which is short-lived ~1h by design). If we'd rather not persist it, we can strip it and accept that recovery drops submodules until the next SANDBOX_START — happy to change.
2. Username x-access-token is correct for GitHub (the target case). GitLab accepts it; Bitbucket may need a different username — extensible later.

Out of scope (agreed)

Native SSH deploy keys · active token rotation · per-host username.

🤖 Generated with Claude Code

---

Summary by cubic

Adds per-host submodule PATs to virtual MCPs so sandboxes can fetch private submodules during clone. Tokens are resolved at start, forwarded to the daemon over a git-only channel, and never exposed to the app or config APIs.

• New Features

  • Submodule credentials editor in the Sandbox card; each row maps a host to a secret. Incomplete rows are stripped before autosave. Shared SecretPicker extracted for consistency.
  • Secrets resolved on SANDBOX_START to {host, token}; missing or inaccessible secrets are skipped (best-effort). Forwarded through the link daemon/provider so linked desktop sandboxes receive them.
  • Daemon writes a short-lived 0600 .git-credentials file, applies SSH→HTTPS insteadOf rewrites, runs a shallow recursive git submodule update, then deletes the file. Tokens are percent-encoded, never placed in env/argv, and never persisted in repo config.
  • Host validation centralized via SUBMODULE_HOST_RE in @decocms/mesh-sdk and enforced in the schema/UI; invalid hosts are skipped and hosts are deduped. submoduleCredentials added to SDK and provider types and forwarded in the config payload.

• Bug Fixes

  • Redacts resolved PATs from both GET and PUT/POST /_sandbox/config responses; tokens remain only in the daemon’s in-memory store.
  • Enforces best-effort: wraps credentials-file write/spawn errors and always deletes the temp file; no submodules or failures leave the clone intact.
  • Adds tests for redaction (read/echo), payload pass-through, helpers validation, submodule integration (invalid-host skip, no .gitmodules no-op), and the credentials-file write failure catch.

^{Written for commit c086ee6. Summary will update on new commits.}