repos with username password

tests/test_git_ingestion.py

@@ -45,3 +45,38 @@ def test_ingestion_clones_file_url(tmp_path):
         text=True,
     ).stdout.strip()
     assert branch == "main"
+
+
+def test_git_commands_fail_fast_and_accept_ephemeral_http_credentials(monkeypatch):
+    calls = []
+
+    def fake_run(command, **kwargs):
+        calls.append((command, kwargs))
+        return subprocess.CompletedProcess(
+            command,
+            128,
+            stdout="",
+            stderr="fatal: could not read Username for 'https://example.com': terminal prompts disabled",
+        )
+
+    monkeypatch.setattr(subprocess, "run", fake_run)
+
+    service = GitIngestionService()
+
+    try:
+        service._run_git(
+            ["clone", "https://example.com/private.git", "/tmp/private"],
+            cwd=None,
+            access_username="user",
+            access_password="secret",
+        )
+    except RuntimeError as exc:
+        message = str(exc)
+    else:
+        raise AssertionError("expected authentication failure")
+
+    command, kwargs = calls[0]
+    assert command[:3] == ["git", "-c", "http.extraHeader=Authorization: Basic dXNlcjpzZWNyZXQ="]
+    assert kwargs["env"]["GIT_TERMINAL_PROMPT"] == "0"
+    assert "authentication required" in message
+    assert "secret" not in message

tests/test_web_api.py

@@ -1074,12 +1074,15 @@ def test_ui_register_analyze_and_approve_loop(tmp_path):
         assert index_response.status_code == 200
         assert "Register Repository" in index_response.text
         assert "Registering repository..." in index_response.text
+        assert "Password or access token" in index_response.text
 
         create_response = client.post(
             "/ui/repos",
             data={
                 "url": str(source),
                 "branch": "main",
+                "access_username": "",
+                "access_password": "",
             },
             follow_redirects=False,
         )