Regression: sandboxed git has no way to use a credential that differs from the Copilot/gh sign-in identity #5102

Summary

sandbox.auth.git authenticates sandboxed git using only the Copilot/gh sign-in identity. There's no way to supply a different credential (e.g. fine-grained PAT). The sandbox injects an empty, highest-precedence credential.helper override into every sandboxed git subprocess, discarding any helper configured in .git/config. This is independent of auth.git/auth.gh settings.

Related tickets #4804 #1460

Regression marker

 v1.0.92  (2026-10-05) changelog: "Sandboxed scripts that run Git now authenticate with masked credentials and SSH remote rewrites."  v1.0.91  does not exhibit this.

Affected version

GitHub Copilot CLI 1.0.92

Steps to reproduce the behavior

mkdir repo && cd repo && git init
cat > /tmp/fake-helper.sh << 'EOF'
#!/bin/sh
echo "username=alice"
echo "password=hunter2"
EOF
chmod +x /tmp/fake-helper.sh
git config --local credential.helper '!/tmp/fake-helper.sh'

# Works on the host:
printf 'protocol=https\nhost=example.com\n\n' | git credential fill
# -> username=alice / password=hunter2

# Fails identically inside the sandbox:
copilot --sandbox --add-dir . -p "printf 'protocol=https\nhost=example.com\n\n' | git credential fill"

Host: helper fills the fake credential correctly.
Sandboxed: bash git config --show-origin --show-scope --get-all credential.helper shows the local helper present, but a trailing  command line: scope entry with an empty value overrides it ( env | grep GIT_CONFIG  shows  GIT_CONFIG_COUNT=6 ,  GIT_CONFIG_KEY_5=credential.helper ,  GIT_CONFIG_VALUE_5=  empty).  git credential fill  returns nothing; real-world  git clone / pull  against a credential-helper-only remote fails with  fatal: unable to get password from user .

Expected behavior

Sandboxed git should have a supported way to authenticate as an identity other than whichever account Copilot itself is signed in as :

• Let the masking process accept a user-supplied credential.
  Extend sandbox.auth.git (or sandbox.credentials.envVars) to accept a PAT/token supplied by the user (e.g. via a settings field or an env var name to mask), and have the masking proxy substitute that credential into git's HTTPS requests instead of always deriving it from the Copilot/gh sign-in session. This would let native masking work for repos/orgs the signed-in identity can't access, without exposing the raw token to the sandboxed process.

• Don't force out a user-configured credential.helper when native masking isn't handling that credential.
  Today, the sandbox always injects an empty, highest-precedence credential.helper override into every sandboxed git subprocess, regardless of auth.git/auth.gh. This unconditionally discards any helper a user configured in .git/config, even when auth.git is off and no native masking is in play for that request. Could be opt-in/configurable, e.g. a sandbox policy flag (sandbox.auth.gitCredentialHelper or similar) that leaves a user-configured helper intact when native git masking isn't being used for that repo/host, so a custom helper can still supply credentials for identities the built-in masking doesn't cover.