fix(vcs): clear stale git credentials before GitHub push

[fshehadeh-sfl]

Summary

Fixes intermittent Invalid username or token. Password authentication is not supported for Git operations. failures when pushing code-gen changes to GitHub, even with a valid, freshly-reconnected push token.

Root cause

The agent's coding session shares the same Docker volume (/workspace) with gh/Copilot CLI tooling, which has its own GITHUB_TOKEN (belonging to the Copilot integration, a different token than the GitHub push integration). That tooling can leave a residual http.<host>.extraheader and/or a configured credential.helper in /workspace/.git/config. Git sends http.extraheader regardless of URL-embedded credentials, so the stale header shadows the explicit push credentials in pushDirectInVolume() and GitHub rejects the request with a generic auth error — independent of whether the push token itself is valid.

Confirmed empirically: a manual OAuth device-flow + git push with the identical client/scope/URL format, run outside any container, succeeded — proving the push token and GitHub-side permissions were never the problem.

Fix

pushDirectInVolume() (src/vcs/githubVcsConnector.ts) now, before pushing:

• clears any stale http.<host>.extraheader for the target host
• disables credential.helper for that single push invocation (git -c credential.helper=)

This forces git to rely solely on the explicit token embedded in the push URL, regardless of what gh/Copilot CLI may have configured during the agent's run.

Validation

• npm run typecheck — zero errors
• npm run lint — clean
• npx vitest run tests/unit/githubVcsConnector.test.ts — 18 passed (2 new: asserts the cleanup commands are present, and that volume push failures still throw a redacted error)

[Copilot]

Pull request overview

This PR hardens the GitHub VCS “push-from-volume” path against residual Git credential configuration left behind in the shared /workspace volume (e.g., http.<url>.extraheader and credential helpers), which can override the explicit token-in-URL used for pushes and cause intermittent GitHub auth failures.

Changes:

• In pushDirectInVolume(), clears any http.https://<host>/.extraheader entry before pushing and disables credential.helper for that push invocation.
• Adds unit coverage for the new pre-push cleanup behavior and the volume-push failure path.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/vcs/githubVcsConnector.ts	Unsets stale Git http.*.extraheader for the push host and disables credential.helper for the push command in volume-based pushes.
tests/unit/githubVcsConnector.test.ts	Adds tests asserting the cleanup commands are included for volume pushes and that volume push failures throw.