fix: tolerate transient sandbox Git credential transport delays

Honor the native duplex opt-in and align repeat-safe credential acquisition with the file bridge response budget, without retrying Git commands.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/services/heartbeat.ts

@@ -1,6 +1,7 @@
 import { initializeRunIdentity } from "./run-identity.js";
+import { startNativeGitHubCallbackBridge } from "./native-github-bridge.js";
 import { githubBrokerEnvironment } from "@paperclipai/adapter-utils/github-launcher";
-import { cleanupGitHubOperationLaunchers, prepareGitHubOperationLaunchers, startAdapterExecutionTargetPaperclipBridge } from "@paperclipai/adapter-utils/execution-target";
+import { cleanupGitHubOperationLaunchers, prepareGitHubOperationLaunchers } from "@paperclipai/adapter-utils/execution-target";
 import fs from "node:fs/promises";
 import { retainUnsavedWorkFolderLease, workFolderSandboxKey } from "./work-folder-retention.js";
 import { findUnboundLegacyTaskWorkspace, hasLegacySandboxWorkspace } from "./legacy-sandbox-workspace.js";
@@ -21436,14 +21437,12 @@ export function heartbeatService(
             // Native Git/gh uses the same authenticated remote callback
             // transport as managed adapters. A bridge failure must not make
             // GitHub a prerequisite for otherwise unrelated native work.
-            let nativeGitHubBridge: Awaited<ReturnType<typeof startAdapterExecutionTargetPaperclipBridge>> = null;
+            let nativeGitHubBridge: Awaited<ReturnType<typeof startNativeGitHubCallbackBridge>> = null;
             if (executionTarget?.kind === "remote" && adapterEnv.PAPERCLIP_GITHUB_BROKER_TOKEN) {
               try {
-                nativeGitHubBridge = await startAdapterExecutionTargetPaperclipBridge({
+                nativeGitHubBridge = await startNativeGitHubCallbackBridge({
                   runId: run.id,
                   target: executionTarget,
-                  runtimeRootDir: path.posix.join(executionTarget.remoteCwd, ".paperclip-runtime", "github", run.id),
-                  adapterKey: "native-github",
                   hostApiToken: adapterEnv.PAPERCLIP_GITHUB_BROKER_TOKEN,
                   // Forward inside this API process. The public tenant origin
                   // requires a browser session and rejects runtime capabilities.

server/src/services/native-github-bridge.ts

@@ -0,0 +1,26 @@
+import path from "node:path";
+import {
+  adapterExecutionTargetDuplexObservabilityRecorder,
+  adapterExecutionTargetEnablesSandboxDuplexBridge,
+  startAdapterExecutionTargetPaperclipBridge,
+} from "@paperclipai/adapter-utils/execution-target";
+
+type BridgeInput = Parameters<typeof startAdapterExecutionTargetPaperclipBridge>[0];
+
+/** Native Git uses the same opt-in and capability gates as managed adapters. */
+export async function startNativeGitHubCallbackBridge(
+  input: Pick<BridgeInput, "runId" | "target" | "hostApiToken" | "onLog">,
+) {
+  const target = input.target;
+  if (target?.kind !== "remote") return null;
+  return startAdapterExecutionTargetPaperclipBridge({
+    ...input,
+    target,
+    runtimeRootDir: path.posix.join(target.remoteCwd, ".paperclip-runtime", "github", input.runId),
+    adapterKey: "native-github",
+    // Without forwarding this opt-in, native Git silently selects remote-file
+    // polling even when the same sandbox uses HTTP/2 for its legacy adapters.
+    enableSandboxDuplexBridge: adapterExecutionTargetEnablesSandboxDuplexBridge(target),
+    duplexObservabilityRecorder: adapterExecutionTargetDuplexObservabilityRecorder(target),
+  });
+}