feat: add HTTP Basic Auth for git operations and inject host git config (#174)

* feat: add HTTP Basic Auth for git operations and inject host git config

This commit adds two key features to enable git operations in Docker containers:

1. **HTTP Basic Auth for Git Operations**
   - Added AuthEncoding enum with Simple and BasicAuthWithToken variants
   - Updated proxy rules to use BasicAuthWithToken for github.com
   - Encodes credentials as "Basic base64(x-access-token:TOKEN)"
   - Enables git push/pull/clone through the HTTPS proxy
   - Added comprehensive unit tests for Basic Auth encoding

2. **Git User Configuration Injection**
   - Added read_git_user_config() to read host git config
   - Injects GIT_AUTHOR_NAME, GIT_COMMITTER_NAME environment variables
   - Injects GIT_AUTHOR_EMAIL, GIT_COMMITTER_EMAIL environment variables
   - Ensures git commits in containers have proper attribution
   - Added tests for git config injection and graceful handling

Files modified:
- src/proxy/rules.rs: HTTP Basic Auth implementation
- src/backends/docker.rs: Git config reading and injection
- Cargo.toml: Added base64 dependency
- tests/*: Updated all tests with new parameters

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* security: sanitize git config values to prevent injection attacks

Added sanitize_git_config_value() function that removes control
characters (except tabs) to prevent environment variable injection.

- Filters out newlines that could inject malicious env vars
- Removes other control characters that could cause issues
- Preserves tabs as they're valid in git names
- Added 4 tests to verify sanitization works correctly

Addresses security concern from automated code review.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: shepherdjerred

packages/multiplexer/Cargo.toml

@@ -59,6 +59,7 @@ fs2 = "0.4"
 # HTTP Proxy with TLS interception
 hudsucker = { version = "0.24", default-features = false, features = ["rcgen-ca", "rustls-client"] }
 http = "1"
+base64 = "0.22"
 
 # TLS
 rustls = "0.23"

packages/multiplexer/src/backends/docker.rs

@@ -4,6 +4,56 @@ use tokio::process::Command;
 
 use super::traits::ExecutionBackend;
 
+/// Sanitize git config value to prevent environment variable injection
+///
+/// Removes newlines and other control characters that could be used for injection attacks
+fn sanitize_git_config_value(value: &str) -> String {
+    value
+        .chars()
+        .filter(|c| !c.is_control() || *c == '\t')
+        .collect()
+}
+
+/// Read git user configuration from the host system
+///
+/// Returns (user.name, user.email) if available from git config
+/// Values are sanitized to prevent environment variable injection
+async fn read_git_user_config() -> (Option<String>, Option<String>) {
+    let name = Command::new("git")
+        .args(["config", "--get", "user.name"])
+        .output()
+        .await
+        .ok()
+        .and_then(|output| {
+            if output.status.success() {
+                String::from_utf8(output.stdout)
+                    .ok()
+                    .map(|s| sanitize_git_config_value(s.trim()))
+                    .filter(|s| !s.is_empty())
+            } else {
+                None
+            }
+        });
+
+    let email = Command::new("git")
+        .args(["config", "--get", "user.email"])
+        .output()
+        .await
+        .ok()
+        .and_then(|output| {
+            if output.status.success() {
+                String::from_utf8(output.stdout)
+                    .ok()
+                    .map(|s| sanitize_git_config_value(s.trim()))
+                    .filter(|s| !s.is_empty())
+            } else {
+                None
+            }
+        });
+
+    (name, email)
+}
+
 /// Detect if a directory is a git worktree and return the parent .git directory path
 ///
 /// # Errors
@@ -172,6 +222,8 @@ impl DockerBackend {
         proxy_config: Option<&DockerProxyConfig>,
         print_mode: bool,
         images: &[String],
+        git_user_name: Option<&str>,
+        git_user_email: Option<&str>,
     ) -> anyhow::Result<Vec<String>> {
         let container_name = format!("mux-{name}");
         let escaped_prompt = initial_prompt.replace('\'', "'\\''");
@@ -338,6 +390,25 @@ impl DockerBackend {
             }
         }
 
+        // Git user configuration from host
+        // Set both AUTHOR and COMMITTER variables so git commits have proper attribution
+        if let Some(name) = git_user_name {
+            args.extend([
+                "-e".to_string(),
+                format!("GIT_AUTHOR_NAME={}", name),
+                "-e".to_string(),
+                format!("GIT_COMMITTER_NAME={}", name),
+            ]);
+        }
+        if let Some(email) = git_user_email {
+            args.extend([
+                "-e".to_string(),
+                format!("GIT_AUTHOR_EMAIL={}", email),
+                "-e".to_string(),
+                format!("GIT_COMMITTER_EMAIL={}", email),
+            ]);
+        }
+
         // NOTE: We intentionally do NOT create a fake .credentials.json file.
         // The ANTHROPIC_API_KEY env var is sufficient and avoids validation issues.
         // When a credentials file exists, Claude Code validates it against the API,
@@ -477,6 +548,9 @@ impl ExecutionBackend for DockerBackend {
             None
         };
 
+        // Read git user configuration from the host
+        let (git_user_name, git_user_email) = read_git_user_config().await;
+
         let args = Self::build_create_args(
             name,
             workdir,
@@ -485,6 +559,8 @@ impl ExecutionBackend for DockerBackend {
             proxy_config_ref,
             options.print_mode,
             &options.images,
+            git_user_name.as_deref(),
+            git_user_email.as_deref(),
         )?;
         let output = Command::new("docker")
             .args(&args)
@@ -637,6 +713,8 @@ mod tests {
             None,
             false, // interactive mode
             &[],   // no images
+            None,  // git user name
+            None,  // git user email
         ).expect("Failed to build args");
 
         // Must have -dit for interactive TTY sessions
@@ -651,6 +729,43 @@ mod tests {
         );
     }
 
+    /// Test sanitization of git config values to prevent injection attacks
+    #[test]
+    fn test_sanitize_git_config_removes_newlines() {
+        // Test newline injection attempt
+        let malicious = "John Doe\nGIT_EVIL=injected";
+        let sanitized = sanitize_git_config_value(malicious);
+        assert_eq!(sanitized, "John DoeGIT_EVIL=injected");
+        assert!(!sanitized.contains('\n'));
+    }
+
+    #[test]
+    fn test_sanitize_git_config_removes_control_chars() {
+        // Test various control characters
+        let malicious = "user\x00name\x01with\x02control";
+        let sanitized = sanitize_git_config_value(malicious);
+        assert!(!sanitized.contains('\x00'));
+        assert!(!sanitized.contains('\x01'));
+        assert!(!sanitized.contains('\x02'));
+        assert_eq!(sanitized, "usernamewithcontrol");
+    }
+
+    #[test]
+    fn test_sanitize_git_config_preserves_tabs() {
+        // Tabs should be preserved as they're valid in names
+        let with_tab = "John\tDoe";
+        let sanitized = sanitize_git_config_value(with_tab);
+        assert_eq!(sanitized, "John\tDoe");
+    }
+
+    #[test]
+    fn test_sanitize_git_config_preserves_normal_chars() {
+        // Normal characters should pass through
+        let normal = "John Doe <john@example.com>";
+        let sanitized = sanitize_git_config_value(normal);
+        assert_eq!(sanitized, normal);
+    }
+
     /// Test that docker run includes --user flag with non-root UID
     #[test]
     fn test_create_runs_as_non_root() {