* fix(daemon): report the checkout's own repo sync error
ensureRepoReady read the sync failure from a per-workspace slot that any
concurrent background sync overwrote, so a later successful sync of another
repo erased the error and checkout reported only "repo is configured but
not synced". syncWorkspaceReposContext now returns its error to the caller
and the shared slot is removed.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
* feat(server): share SSL_CERT_DIR CAs with daemons for git
Daemons clone with the system git, which never sees the backend's
SSL_CERT_DIR, so a repository on a host with an internal CA could not
sync even after the operator made the backend trust that CA.
The new gitca package mirrors crypto/x509's SSL_CERT_DIR loading, skips
the system directories, and keeps only certificates crypto/x509 trusts.
The register and workspace repos responses carry them as ca_certs. The
daemon writes its system CA bundle plus those certificates to a bundle
file, adds http.sslCAInfo to its git environment, and records it in the
cache and isolated checkout config so agents' fetch and push use it too.
An empty value removes the bundle; Windows daemons skip it.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
* docs: document private CA trust for daemons
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
* fix(daemon): keep operator CA trust and existing checkouts working
Review of the private CA support found two regressions for repositories
that already worked:
- Removing the last backend CA deleted the bundle while existing linked
worktrees and isolated checkouts still pointed at it, so their HTTPS
fetch and push failed. The bundle is now rewritten to the machine's own
trust instead, and each repository drops the reference the next time
the cache configures it.
- The bundle started from the system bundle and was injected through the
environment, overriding an operator's general http.sslCAInfo and any
repository-local value. It now starts from the file a general
http.sslCAInfo names (system bundle otherwise), the environment no
longer carries it, clone passes it with -c, and repository config is
only set where unset and only unset where it is ours. URL-scoped
settings, repository-local values, and GIT_SSL_CAINFO keep precedence.
Isolated checkouts record the setting before their first checkout, which
can lazily fetch from origin, and clones before the refspec migration
fetch.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
---------
Co-authored-by: Iliya Anastasov <[email protected]>
Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>
