Forgejo git credential helper broken on kai-tower-3026 WSL (two independent faults) #958

New issue

Open

opened 2026-08-27 03:25:26 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-27 03:25:26 +00:00

Owner

Git push and clone against Forgejo fail on the tower's WSL. Two separate faults stack, and both fail silently.

Fault 1: global credential.helper points at a path that does not exist

credential.helper resolves to projects/coilyco-bridge/agentic-os-kai/scripts/git-credential-forgejo-ssm.sh, but agentic-os-kai is not cloned on this host - projects/coilyco-bridge/ is empty. Git reports:

.../git-credential-forgejo-ssm.sh get: 1: ...: not found
fatal: could not read Username for 'https://forgejo.coilysiren.me'

The script does exist at projects/coilyco-flight-deck/agentic-os/scripts/git-credential-forgejo-ssm.sh.

Note for anyone working around this: git -c credential.helper=<path> does not override, it appends, and the broken helper still runs. Resetting the list first works: git -c credential.helper= -c credential.helper=<path>.

Fault 2: the helper itself calls a retired command

Even at the correct path the helper cannot succeed. It shells out to:

token="$(coily ops aws ssm get-parameter --name /forgejo/api-token ...)" || exit 0

coily ops is retired in favour of aosguard ops. On this host coily is still installed (linuxbrew) but aosguard is not, so the call reaches AWS and fails there instead:

aws: [ERROR]: An error occurred (ParameterNotFound) when calling the GetParameter operation
coily: exit status 254

So /forgejo/api-token is either renamed, moved region, or gone. AWS auth itself is fine (admin role assumes cleanly, region us-east-1 configured).

The || exit 0 on that line means every one of these failures is silent - git just reports a missing username with no indication the helper ran and gave up.

Impact

No git push or clone against Forgejo from this host. Cloning from a Mac session works, so this is host-local. Found while pushing coilyco-gaming/executive-assault-2-mods, which had to be pushed from the Mac instead.

Suggested fixes

Point the global helper at the path that exists, or clone agentic-os-kai onto this host.
Update the helper in agentic-os to use aosguard ops (authored there, rolled out via ansible per the authoring-vs-rollout split).
Confirm the correct SSM parameter name and region for the Forgejo token.
Consider dropping || exit 0 in favour of a diagnostic on stderr. A credential helper that fails silently costs more than one that complains.

Git push and clone against Forgejo fail on the tower's WSL. Two separate faults stack, and both fail silently. ## Fault 1: global credential.helper points at a path that does not exist `credential.helper` resolves to `projects/coilyco-bridge/agentic-os-kai/scripts/git-credential-forgejo-ssm.sh`, but `agentic-os-kai` is not cloned on this host - `projects/coilyco-bridge/` is empty. Git reports: ``` .../git-credential-forgejo-ssm.sh get: 1: ...: not found fatal: could not read Username for 'https://forgejo.coilysiren.me' ``` The script does exist at `projects/coilyco-flight-deck/agentic-os/scripts/git-credential-forgejo-ssm.sh`. Note for anyone working around this: `git -c credential.helper=<path>` does **not** override, it appends, and the broken helper still runs. Resetting the list first works: `git -c credential.helper= -c credential.helper=<path>`. ## Fault 2: the helper itself calls a retired command Even at the correct path the helper cannot succeed. It shells out to: ```sh token="$(coily ops aws ssm get-parameter --name /forgejo/api-token ...)" || exit 0 ``` `coily ops` is retired in favour of `aosguard ops`. On this host `coily` is still installed (linuxbrew) but `aosguard` is not, so the call reaches AWS and fails there instead: ``` aws: [ERROR]: An error occurred (ParameterNotFound) when calling the GetParameter operation coily: exit status 254 ``` So `/forgejo/api-token` is either renamed, moved region, or gone. AWS auth itself is fine (admin role assumes cleanly, region us-east-1 configured). The `|| exit 0` on that line means every one of these failures is silent - git just reports a missing username with no indication the helper ran and gave up. ## Impact No git push or clone against Forgejo from this host. Cloning from a Mac session works, so this is host-local. Found while pushing `coilyco-gaming/executive-assault-2-mods`, which had to be pushed from the Mac instead. ## Suggested fixes * Point the global helper at the path that exists, or clone `agentic-os-kai` onto this host. * Update the helper in agentic-os to use `aosguard ops` (authored there, rolled out via ansible per the authoring-vs-rollout split). * Confirm the correct SSM parameter name and region for the Forgejo token. * Consider dropping `|| exit 0` in favour of a diagnostic on stderr. A credential helper that fails silently costs more than one that complains.

coilyco-ops added this to the Credentials and access milestone

2026-08-29 06:09:52 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/infrastructure#958

No description provided.

Rows
Columns