Function buildCredentialArgs

src/node/runtime/DockerRuntime.ts:161–178

* Build Docker args for credential sharing. * Forwards SSH agent into the container. * Note: ~/.gitconfig is copied (not mounted) after container creation so gh can modify it. * Uses agent forwarding only (no ~/.ssh mount) to avoid passphrase/permission issues.

()

 * Uses agent forwarding only (no ~/.ssh mount) to avoid passphrase/permission issues.
 */
function buildCredentialArgs(): string[] {
  const args: string[] = [];

  // SSH agent forwarding (no ~/.ssh mount - causes passphrase/permission issues)
  const sshForwarding = resolveSshAgentForwarding("/ssh-agent");
  if (sshForwarding) {
    args.push("-v", `${sshForwarding.hostSocketPath}:${sshForwarding.targetSocketPath}:ro`);
    args.push("-e", `SSH_AUTH_SOCK=${sshForwarding.targetSocketPath}`);
  }

  // GitHub CLI auth via token
  const ghToken = resolveGhToken();
  if (ghToken) {
    args.push("-e", `GH_TOKEN=${ghToken}`);
  }

  return args;
}

/**
 * Run docker run with streaming output (for image pull progress).