From a31d4b3ca0f3edda8e1b241af4c6d189631e2b48 Mon Sep 17 00:00:00 2001
From: Chuck Lantz <chuck_lantz@hotmail.com>
Date: Wed, 10 Jun 2026 12:11:20 -0700
Subject: [PATCH 1/2] Support not cloning into repo subfolder, using env var
 for cred helper

---
 package-lock.json |  4 ++--
 package.json      |  2 +-
 src/git.ts        | 10 +++++++---
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 0130325..92ff3a8 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@github/copilot-engine-sdk",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@github/copilot-engine-sdk",
-      "version": "0.1.0",
+      "version": "0.2.0",
       "license": "MIT",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.25.3",
diff --git a/package.json b/package.json
index 473aef2..fb13078 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@github/copilot-engine-sdk",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "SDK for building engines on the GitHub Copilot agent platform",
   "type": "module",
   "main": "dist/index.js",
diff --git a/src/git.ts b/src/git.ts
index db8cef5..3b712b9 100644
--- a/src/git.ts
+++ b/src/git.ts
@@ -55,6 +55,10 @@ export interface CloneRepoOptions {
     commitEmail: string;
     /** Base directory for cloning (default: /tmp/workspace) */
     cloneDir?: string;
+    /** Whether to exclude the repository subfolder (owner/repo) when cloning (default: false) */
+    excludeRepoSubfolder?: boolean;
+    /** If set, use an environment variable name for Git credential helper rather than embedding the token in the config (default: undefined) */
+    credentialHelperEnvVar?: string;
 }
 
 /**
@@ -84,9 +88,9 @@ export interface CommitAndPushResult {
  * @returns The local path where the repository was cloned
  */
 export function cloneRepo(options: CloneRepoOptions): string {
-    const { serverUrl, repository, gitToken, branchName, commitLogin, commitEmail } = options;
+    const { serverUrl, repository, gitToken, credentialHelperEnvVar, excludeRepoSubfolder, branchName, commitLogin, commitEmail } = options;
     const cloneDir = options.cloneDir ?? DEFAULT_CLONE_DIR;
-    const repoLocation = `${cloneDir}/${repository}`;
+    const repoLocation = excludeRepoSubfolder ? cloneDir : `${cloneDir}/${repository}`;
 
     const cloneUrl = `${serverUrl.replace(/\/$/, "")}/${repository}.git`;
 
@@ -95,7 +99,7 @@ export function cloneRepo(options: CloneRepoOptions): string {
         execFileSync("git", ["config", "user.email", commitEmail], { cwd: repoLocation });
         execFileSync("git", ["config", "credential.username", "x-access-token"], { cwd: repoLocation });
         execFileSync("git", ["config", "credential.helper",
-            `!f() { test "$1" = get && echo "password=${gitToken}"; }; f`], { cwd: repoLocation });
+            `!f() { test "$1" = get && echo "password=${credentialHelperEnvVar ? '${' + credentialHelperEnvVar + '}' : gitToken}"; }; f`], { cwd: repoLocation });
         execFileSync("git", ["remote", "set-url", "origin", cloneUrl], { cwd: repoLocation });
     };
 

From 79c7222acc7e003fcba5155160263ebae459d214 Mon Sep 17 00:00:00 2001
From: Chuck Lantz <chuck_lantz@hotmail.com>
Date: Wed, 10 Jun 2026 12:23:23 -0700
Subject: [PATCH 2/2] Add invalid var name check

---
 src/git.ts | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/git.ts b/src/git.ts
index 3b712b9..2111850 100644
--- a/src/git.ts
+++ b/src/git.ts
@@ -89,6 +89,11 @@ export interface CommitAndPushResult {
  */
 export function cloneRepo(options: CloneRepoOptions): string {
     const { serverUrl, repository, gitToken, credentialHelperEnvVar, excludeRepoSubfolder, branchName, commitLogin, commitEmail } = options;
+
+    if (credentialHelperEnvVar && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(credentialHelperEnvVar)) {
+        throw new Error(`Invalid credentialHelperEnvVar: must be a valid environment variable name (letters, digits, underscores; cannot start with a digit)`);
+    }
+
     const cloneDir = options.cloneDir ?? DEFAULT_CLONE_DIR;
     const repoLocation = excludeRepoSubfolder ? cloneDir : `${cloneDir}/${repository}`;