fix: tolerate transient sandbox Git credential transport delays

Honor the native duplex opt-in and align repeat-safe credential acquisition with the file bridge response budget, without retrying Git commands.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/__tests__/native-github-bridge.test.ts

@@ -0,0 +1,51 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import type { AdapterSandboxExecutionTarget } from "@paperclipai/adapter-utils/execution-target";
+import { startNativeGitHubCallbackBridge } from "../services/native-github-bridge.js";
+
+const mocks = vi.hoisted(() => ({ start: vi.fn() }));
+vi.mock("@paperclipai/adapter-utils/execution-target", async (importOriginal) => ({
+  ...await importOriginal<typeof import("@paperclipai/adapter-utils/execution-target")>(),
+  startAdapterExecutionTargetPaperclipBridge: mocks.start,
+}));
+afterEach(() => vi.clearAllMocks());
+
+function target(enabled?: boolean): AdapterSandboxExecutionTarget {
+  return {
+    kind: "remote", transport: "sandbox", providerKey: "daytona",
+    environmentId: "environment", leaseId: "lease", remoteCwd: "/home/daytona/repos/primary",
+    timeoutMs: 30_000, runner: { execute: vi.fn() }, enableSandboxDuplexBridge: enabled,
+  };
+}
+
+describe("native GitHub callback transport", () => {
+  it.each([true, false, undefined])("preserves the target duplex opt-in %s", async (enabled) => {
+    const executionTarget = target(enabled);
+    const onLog = vi.fn();
+    const bridge = { env: { PAPERCLIP_API_URL: "http://127.0.0.1:8123" }, stop: vi.fn() };
+    mocks.start.mockResolvedValueOnce(bridge);
+    expect(await startNativeGitHubCallbackBridge({
+      runId: "current-run", target: executionTarget, hostApiToken: "current-run-capability", onLog,
+    })).toBe(bridge);
+    expect(mocks.start).toHaveBeenCalledWith({
+      runId: "current-run", target: executionTarget, hostApiToken: "current-run-capability", onLog,
+      runtimeRootDir: "/home/daytona/repos/primary/.paperclip-runtime/github/current-run",
+      adapterKey: "native-github", enableSandboxDuplexBridge: enabled === true,
+      duplexObservabilityRecorder: null,
+    });
+  });
+
+  it("forwards the operator-gated recorder without changing its lifetime", async () => {
+    const executionTarget = target(true);
+    const recorder: NonNullable<AdapterSandboxExecutionTarget["duplexObservabilityRecorder"]> = {
+      recordSpan: vi.fn(), incrementCounter: vi.fn(), emitEvent: vi.fn(),
+    };
+    executionTarget.duplexObservabilityRecorder = recorder;
+    await startNativeGitHubCallbackBridge({runId:"run",target:executionTarget,hostApiToken:"capability"});
+    expect(mocks.start.mock.calls[0][0].duplexObservabilityRecorder).toBe(recorder);
+  });
+
+  it("leaves local execution unchanged", async () => {
+    expect(await startNativeGitHubCallbackBridge({runId:"run",target:null,hostApiToken:"capability"})).toBeNull();
+    expect(mocks.start).not.toHaveBeenCalled();
+  });
+});

server/src/services/heartbeat.ts

@@ -1,6 +1,7 @@
 import { initializeRunIdentity } from "./run-identity.js";
+import { startNativeGitHubCallbackBridge } from "./native-github-bridge.js";
 import { githubBrokerEnvironment } from "@paperclipai/adapter-utils/github-launcher";
-import { cleanupGitHubOperationLaunchers, prepareGitHubOperationLaunchers, startAdapterExecutionTargetPaperclipBridge } from "@paperclipai/adapter-utils/execution-target";
+import { cleanupGitHubOperationLaunchers, prepareGitHubOperationLaunchers } from "@paperclipai/adapter-utils/execution-target";
 import fs from "node:fs/promises";
 import { retainUnsavedWorkFolderLease, workFolderSandboxKey } from "./work-folder-retention.js";
 import { findUnboundLegacyTaskWorkspace, hasLegacySandboxWorkspace } from "./legacy-sandbox-workspace.js";
@@ -21436,14 +21437,12 @@ export function heartbeatService(
             // Native Git/gh uses the same authenticated remote callback
             // transport as managed adapters. A bridge failure must not make
             // GitHub a prerequisite for otherwise unrelated native work.
-            let nativeGitHubBridge: Awaited<ReturnType<typeof startAdapterExecutionTargetPaperclipBridge>> = null;
+            let nativeGitHubBridge: Awaited<ReturnType<typeof startNativeGitHubCallbackBridge>> = null;
             if (executionTarget?.kind === "remote" && adapterEnv.PAPERCLIP_GITHUB_BROKER_TOKEN) {
               try {
-                nativeGitHubBridge = await startAdapterExecutionTargetPaperclipBridge({
+                nativeGitHubBridge = await startNativeGitHubCallbackBridge({
                   runId: run.id,
                   target: executionTarget,
-                  runtimeRootDir: path.posix.join(executionTarget.remoteCwd, ".paperclip-runtime", "github", run.id),
-                  adapterKey: "native-github",
                   hostApiToken: adapterEnv.PAPERCLIP_GITHUB_BROKER_TOKEN,
                   // Forward inside this API process. The public tenant origin
                   // requires a browser session and rejects runtime capabilities.

server/src/services/native-github-bridge.ts

@@ -0,0 +1,26 @@
+import path from "node:path";
+import {
+  adapterExecutionTargetDuplexObservabilityRecorder,
+  adapterExecutionTargetEnablesSandboxDuplexBridge,
+  startAdapterExecutionTargetPaperclipBridge,
+} from "@paperclipai/adapter-utils/execution-target";
+
+type BridgeInput = Parameters<typeof startAdapterExecutionTargetPaperclipBridge>[0];
+
+/** Native Git uses the same opt-in and capability gates as managed adapters. */
+export async function startNativeGitHubCallbackBridge(
+  input: Pick<BridgeInput, "runId" | "target" | "hostApiToken" | "onLog">,
+) {
+  const target = input.target;
+  if (target?.kind !== "remote") return null;
+  return startAdapterExecutionTargetPaperclipBridge({
+    ...input,
+    target,
+    runtimeRootDir: path.posix.join(target.remoteCwd, ".paperclip-runtime", "github", input.runId),
+    adapterKey: "native-github",
+    // Without forwarding this opt-in, native Git silently selects remote-file
+    // polling even when the same sandbox uses HTTP/2 for its legacy adapters.
+    enableSandboxDuplexBridge: adapterExecutionTargetEnablesSandboxDuplexBridge(target),
+    duplexObservabilityRecorder: adapterExecutionTargetDuplexObservabilityRecorder(target),
+  });
+}