fix(#2814): retry git fetch without token on auth failure

[fullsend-ai-coder]

When FetchTree is called with a token scoped to repo A but the target repository is public repo B, GitHub rejects the authenticated request instead of allowing anonymous access. This regression was introduced in PR #2736 which replaced the GitHub Contents API with git sparse checkout.

Add an unauthenticated retry fallback in FetchTree: when git fetch fails with an auth-related error (401, 403, "could not read Username", etc.) and a token was provided, retry the fetch without the Authorization header. If the retry succeeds, subsequent git commands (checkout) also run unauthenticated.

This restores cross-repo skill directory fetching for config-registered agents (ADR-0058) whose skills live in a different public repo than the minted token's scope.

Note: pre-commit could not run in the sandbox due to a shellcheck installation failure (network policy). go vet and all unit tests pass.

---

Closes #2814

Post-script verification

• Branch is not main/master (agent/2814-gitfetch-auth-fallback)
• Secret scan passed (gitleaks — ce784b4ead93663aeaa35fd150fd9da7b2d27227..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[github-actions]

E2E tests did not run

E2E tests run automatically for org/repo members and collaborators on pull requests.

For other contributors, a maintainer must add the ok-to-test label after the latest push.

See E2E testing guide for details.

[github-actions]

Site preview

Preview: https://ccdbf58a-site.fullsend-ai.workers.dev

Commit: 20a791fcaac834a7c44bf9dcf506e1f86d9a0179

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ggallen]

/fs-fix fix so the code coverage test passes, making sure coverage >= 80%

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 2:34 AM UTC · Completed 2:45 AM UTC
Commit: e6b1ae3 · View workflow run →

[fullsend-ai-coder]

🔧 Fix agent — iteration 1 (human-triggered)

Added an integration test using a local HTTPS git server that rejects authenticated requests, exercising the auth fallback retry path in FetchTree. All changed lines in gitfetch.go now have test coverage. Overall package coverage rose from 85.2% to 87.7%.

Fixed (1):

1. patch coverage below 80% threshold on auth fallback lines: Added TestFetchTree_AuthFallbackHTTP test that uses a local HTTPS server (via git-http-backend + httptest.NewTLSServer) to reject authenticated requests with 403, forcing FetchTree to exercise the auth-retry fallback path (lines 83-91). This raises patch coverage on changed lines from ~75% to 100%.

Tests: passed

_{Updated by fullsend fix agent}

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 3:03 AM UTC · Completed 3:13 AM UTC
Commit: 20a791f · View workflow run →

[fullsend-ai-retro]

Retro: PR #2815 — fix(#2814): retry git fetch without token on auth failure

Timeline: Issue #2814 was filed at 02:04 UTC reporting that git fetch fails when GH_TOKEN is scoped to a different repo than the skill source. The triage agent ran immediately (02:04), followed by the code agent (02:10), which opened PR #2815 at 02:20 with auth-fallback retry logic and unit tests. However, patch coverage was below the 80% threshold, so the human (ggallen) triggered /fs-fix at 02:31 to improve coverage. The fix agent added an HTTP-based integration test by 02:42, bringing coverage to 100% on changed lines. The human approved at 02:49, and the PR merged at 02:59 — 55 minutes end-to-end.

Workflow quality: Overall strong. The code agent produced a correct fix with good error-pattern matching and a clean retry mechanism. The fix agent's contribution (a real HTTPS server test exercising the fallback path) was high-quality. The total rework was one fix agent iteration, triggered by the human, not by review feedback.

Improvement opportunities identified (all already tracked):

1. Code agent should meet coverage threshold before opening PR — The code agent's initial commit had ~75% patch coverage, requiring human intervention to trigger the fix agent. This is already tracked in #2810 ("Code agent should validate patch coverage meets repo threshold before opening PR").

2. Review agent never dispatched — No review agent ran on this agent-authored PR. The pull_request_target shim runs completed successfully, but no review.yml run was created in the dispatch repo. This is likely the authorization gate issue described in #2674 ("dispatch: ADR 0054 authorization gate blocks review dispatch for coder-bot PRs"). The related issue #2637 ("Review agent should always leave a visible trace on agent-authored PRs") also applies.

3. Silent review skip — The review dispatch was skipped with no user-visible feedback, which is tracked in #2724 ("Post user-visible feedback when /fs-review dispatch is skipped").

No new proposals filed — all identified improvements are already covered by open issues.