Authenticate git drives to private remotes (global + per-principal)

[gmpassos]

Summary

Adopts omnydrive 1.10.0's git-credential feature so a node can authenticate to private git remotes itself, instead of relying on the node host's ambient git config. Git clone/push runs on the node, so credentials are node-local state.

• New CLI omnyshell node git-credential add/list/remove (secrets masked) — configures credentials on the node host that performs the clone/push.
• Credentials are injected into the node's git clone/fetch/push via omnydrive's single GitCli chokepoint; GIT_TERMINAL_PROMPT=0 makes a missing/wrong credential fail fast instead of hanging.

Global + per-principal

Each credential is either global (node-wide) or scoped to a connecting principal via --principal <p>. At mount time the node resolves a host's credential principal-first, then global: the (hub-authenticated) connecting principal's credential wins, falling back to the node's global one — and one principal never sees another's.

omnyshell node git-credential add github.com --pat <token>               # global
omnyshell node git-credential add github.com --pat <alice> --principal alice
omnyshell node git-credential list                # grouped: [global] / [principal: …]
omnyshell node git-credential remove github.com --principal alice

Storage & safety

Stored in ~/.omnyshell/git-credentials.json (mode 600) as a single backward-compatible structured file — the legacy flat {credentials:{…}} loads as the global scope; principals are JSON keys so arbitrary identities need no sanitization. Credentials live only on the node: never sent to the hub/peers, never serialized onto a mount (mounts.json) or drive. The store is loaded fresh per drive session, so new credentials apply without a node restart.

NodeDriveService was already resolver-shaped; the per-principal logic lives in a new NodeGitCredentials wrapper that reuses omnydrive's host-keyed GitCredentialStore per scope.

⚠️ Blocked on omnydrive 1.10.0

Temporarily builds against the omnydrive branch via a git dependency_overrides (OmnyGrid/omnydrive#14). Before merge: merge/publish omnydrive 1.10.0, switch to omnydrive: ^1.10.0, and drop the override block in pubspec.yaml.

Test plan

• dart analyze — clean.
• dart test — 658 unit tests pass, incl. new test/unit/node/node_git_credentials_test.dart (principal-first/global-fallback, "B never sees A's", legacy-file compat, arbitrary principal keys, mode 600); drive integration (41) and version tests pass.
• Manual CLI e2e: global + per-principal add, structured file, grouped/scoped list, removal pruning emptied scopes, mode 600 — all verified.

🤖 Generated with Claude Code