From a9bc03fb01b5d1ac41bf5592f384d22df5425aa4 Mon Sep 17 00:00:00 2001
From: Melodi <62381002+Melodi17@users.noreply.github.com>
Date: Sun, 6 Sep 2026 09:02:31 +1000
Subject: feat: vcs and secret management support

---
 src/marlin.core/functional/TokenGitCredential.cs | 32 ++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 src/marlin.core/functional/TokenGitCredential.cs

(limited to 'src/marlin.core/functional/TokenGitCredential.cs')

diff --git a/src/marlin.core/functional/TokenGitCredential.cs b/src/marlin.core/functional/TokenGitCredential.cs
new file mode 100644
index 0000000..5dfef66
--- /dev/null
+++ b/src/marlin.core/functional/TokenGitCredential.cs
@@ -0,0 +1,32 @@
+namespace marlin.core.functional;
+
+using System.Diagnostics;
+using System.Text;
+
+/// <summary>
+/// HTTPS auth via a bearer/basic token. Injected as an Authorization header for a
+/// single git invocation through GIT_CONFIG_* env vars, so it never appears in argv
+/// (visible via ps) or in git's own error output (which echoes the URL, not headers).
+/// </summary>
+public sealed class TokenGitCredential : IGitCredential
+{
+    private readonly string _username;
+    private readonly string _token;
+
+    public TokenGitCredential(string token, string username = "x-access-token")
+    {
+        this._token = token;
+        this._username = username;
+    }
+
+    public Task<IAsyncDisposable> ApplyAsync(ProcessStartInfo psi)
+    {
+        string header = Convert.ToBase64String(Encoding.UTF8.GetBytes($"{this._username}:{this._token}"));
+
+        psi.Environment["GIT_CONFIG_COUNT"] = "1";
+        psi.Environment["GIT_CONFIG_KEY_0"] = "http.extraheader";
+        psi.Environment["GIT_CONFIG_VALUE_0"] = $"AUTHORIZATION: basic {header}";
+
+        return Task.FromResult<IAsyncDisposable>(NoopAsyncDisposable.Instance);
+    }
+}
-- 
cgit v1.3.1