Add hidden Basic auth defaults for git tools

[threepointone]

Summary

• Adds gitTools(workspace, { auth: { username, password } }) and gitToolsFromFs(..., { auth }) for hidden default Basic auth credentials.
• Preserves existing hidden token behavior while making precedence explicit: direct tool-call auth, default Basic auth, then default token.
• Keeps injected credentials out of model-visible tool declarations/descriptions and adds regression coverage that provider results do not echo hidden credentials.
• Documents the Basic auth configuration path and adds a patch changeset for @cloudflare/shell.

Test plan

• npm run format
• npm run test -- src/tests/git.test.ts from packages/shell
• npm run build from packages/shell
• npm run check

Fixes #1427

Made with Cursor

---

[changeset-bot]

🦋 Changeset detected

Latest commit: 6983364

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cloudflare/shell	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.

[pkg-pr-new]

Open in StackBlitz

agents

npm i https://pkg.pr.new/agents@1431

@cloudflare/ai-chat

npm i https://pkg.pr.new/@cloudflare/ai-chat@1431

@cloudflare/codemode

npm i https://pkg.pr.new/@cloudflare/codemode@1431

hono-agents

npm i https://pkg.pr.new/hono-agents@1431

@cloudflare/shell

npm i https://pkg.pr.new/@cloudflare/shell@1431

@cloudflare/think

npm i https://pkg.pr.new/@cloudflare/think@1431

@cloudflare/voice

npm i https://pkg.pr.new/@cloudflare/voice@1431

@cloudflare/worker-bundler

npm i https://pkg.pr.new/@cloudflare/worker-bundler@1431

commit: 6983364