[P2] Preserve custom HTTPS ports in Git credential lookup #28

Review finding R9, priority P2. Reviewed source: e112e51.

Assessment

Scores are engineering estimates, not calibrated probabilities or CVSS. Confidence rates improvement from the proposed fix; severity reflects this repository's prerequisites and safeguards. Higher difficulty/code-size scores mean more work.

The two auth phases use inconsistent keys. The fix is direct, but the affected deployment is narrow: private Git servers on nondefault HTTPS ports.

Finding and verification

Evidence: Credential keys explicitly support ports (src/bot-config.ts:10). Head resolution uses URL hostname, which removes the port (src/sandbox/render/snapshot.ts:34–35). The staged clone helper uses Git's host value, including a nondefault port (sandbox/build/git-credential-staged.sh:13–18).

Trigger and verification: A fake Git fixture recorded authentication selection for a private HTTPS server on a nondefault port. A matching host-and-port credential was skipped during head resolution, while the staged helper matched it. Source inspection confirms the inconsistent keys; no real server or credential was used.

Impact: An otherwise supported private Git configuration fails snapshot preparation unless the operator duplicates credential entries or changes the endpoint.

Fix direction: Normalize one host-and-port credential key for both phases, independently from the sanitized environment-variable name. Decide how default HTTPS ports are normalized.

Regression: Both head resolution and cloning select the same credential for a nondefault port; ordinary GitHub and default-port behavior remain intact.

Proposed implementation scope

Head-resolution credential key normalization and Git/helper tests; roughly 2–3 files.

Keep this fix separate from unrelated refactors. Preserve the qualifications above; no real Render or paid model validation was performed during review.

Acceptance and verification

• Add the focused regression described above and confirm it detects the current behavior.
• Implement the selected fix without changing unrelated public behavior.
• Run frozen dependency installation, pnpm typecheck, and the relevant existing tests; report failures and skipped checks.
• Update docs/config migration where affected.
• Record any required Render staging or snapshot-refresh validation before rollout.

Use a dedicated codex/issue-N-git-credential-port branch and a focused PR referencing this issue after the fix is selected.