fix(remote): redact credentialed URLs in ls-remote errors

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: suhaanthayyil

cmd/entire/cli/checkpoint/remote/git.go

@@ -462,15 +462,17 @@ func lsRemote(ctx context.Context, dir, remote string, patterns ...string) ([]by
 	disableTerminalPrompt(cmd)
 	out, err := cmd.Output()
 	if err != nil {
-		return out, fmt.Errorf("git ls-remote: %w", formatGitCommandError(ctx, err))
+		return out, fmt.Errorf("git ls-remote: %w", formatGitCommandError(ctx, err, remote))
 	}
 	return out, nil
 }
 
 // formatGitCommandError enriches an exec error from git Output() so callers see
 // useful detail: context deadline expiry by name, and git's stderr (auth denied,
 // repository not found, DNS) which ExitError otherwise hides behind "exit status N".
-func formatGitCommandError(ctx context.Context, err error) error {
+// When remote is a URL it may carry credentials that git echoes into stderr;
+// those are redacted before the error is returned (same pattern as FetchBlobs).
+func formatGitCommandError(ctx context.Context, err error, remote string) error {
 	if err == nil {
 		return nil
 	}
@@ -480,6 +482,9 @@ func formatGitCommandError(ctx context.Context, err error) error {
 	var exitErr *exec.ExitError
 	if errors.As(err, &exitErr) {
 		if stderr := strings.TrimSpace(string(exitErr.Stderr)); stderr != "" {
+			if remote != "" {
+				stderr = strings.ReplaceAll(stderr, remote, RedactURL(remote))
+			}
 			// Collapse whitespace so multi-line git stderr stays one log/attr value.
 			stderr = strings.Join(strings.Fields(stderr), " ")
 			return fmt.Errorf("%w (%s)", err, stderr)

cmd/entire/cli/checkpoint/remote/git_test.go

@@ -1274,3 +1274,21 @@ func TestIsNonInteractiveSSH(t *testing.T) {
 	assert.False(t, IsNonInteractiveSSH(context.Background()))
 	assert.True(t, IsNonInteractiveSSH(WithNonInteractiveSSH(context.Background())))
 }
+
+func TestFormatGitCommandError_RedactsRemoteURL(t *testing.T) {
+	t.Parallel()
+
+	remote := "https://user:hunter2@github.com/org/repo.git"
+	// Output() populates ExitError.Stderr (Run() does not).
+	cmd := exec.CommandContext(context.Background(), "sh", "-c",
+		fmt.Sprintf(`printf 'fatal: repository "%s" not found\n' >&2; exit 128`, remote))
+	_, err := cmd.Output()
+	require.Error(t, err)
+
+	formatted := formatGitCommandError(context.Background(), err, remote)
+	require.Error(t, formatted)
+	msg := formatted.Error()
+	assert.NotContains(t, msg, "hunter2")
+	assert.NotContains(t, msg, "user:hunter2")
+	assert.Contains(t, msg, RedactURL(remote))
+}