feat(git): HTTPS smart-HTTP (clone/fetch/push) via mbedTLS libcurl + real git-remote-http

software/git/agentos-package.json

@@ -1,10 +1,10 @@
 {
 	"commands": [
-		"git"
+		"git",
+		"git-remote-http"
 	],
 	"aliases": {
-		"git-remote-http": "git",
-		"git-remote-https": "git",
+		"git-remote-https": "git-remote-http",
 		"git-upload-pack": "git",
 		"git-receive-pack": "git",
 		"git-upload-archive": "git"

toolchain/c/Makefile

@@ -68,7 +68,7 @@ COMMANDS_DIR ?= ../target/wasm32-wasip1/release/commands
 
 # Fast real commands installed by the default software gate. Slow/heavy commands
 # (duckdb, vim) remain available through explicit parent `make cmd/<name>`.
-COMMANDS := zip unzip envsubst sqlite3 curl wget grep git tree
+COMMANDS := zip unzip envsubst sqlite3 curl wget grep git git-remote-http tree
 
 # Programs requiring patched sysroot (Tier 2+ custom host imports)
 PATCHED_PROGRAMS := http_get_test isatty_test getpid_test getppid_test getppid_verify userinfo pipe_test dup_test spawn_child spawn_exit_code pipeline kill_child waitpid_return waitpid_edge syscall_coverage getpwuid_test signal_tests sigaction_self sigaction_behavior delayed_tcp_echo delayed_kill pipe_edge tcp_accept_spawn tcp_echo tcp_server http_server udp_echo unix_socket signal_handler dns_lookup sqlite3 curl wget grep tree zip unzip fs_probe
@@ -148,6 +148,10 @@ CURL_RELEASE_VERSION := 8.11.1
 CURL_RELEASE_TAG := 8_11_1
 CURL_RELEASE_URL := https://github.com/curl/curl/releases/download/curl-$(CURL_RELEASE_TAG)/curl-$(CURL_RELEASE_VERSION).tar.xz
 CURL_UPSTREAM_BUILD_DIR := $(BUILD_DIR)/curl-upstream
+# Reusable libcurl artifact (headers + libcurl.a) installed by the curl build so
+# git's git-remote-http links the same overlaid, mbedTLS-linked libcurl.
+CURL_LIBCURL_PREFIX := $(CURL_UPSTREAM_BUILD_DIR)/install
+CURL_LIBCURL_ARTIFACT := $(CURL_LIBCURL_PREFIX)/lib/libcurl.a
 CURL_UPSTREAM_OVERLAY_DIR := ../../software/curl/native/c/overlay
 CURL_UPSTREAM_OVERLAY_FILES := $(wildcard $(CURL_UPSTREAM_OVERLAY_DIR)/lib/*.c $(CURL_UPSTREAM_OVERLAY_DIR)/lib/*.h $(CURL_UPSTREAM_OVERLAY_DIR)/lib/vtls/*.c $(CURL_UPSTREAM_OVERLAY_DIR)/lib/vtls/*.h)
 ZLIB_VERSION := 1.3.1
@@ -742,7 +746,7 @@ $(BUILD_DIR)/unzip: scripts/build-infozip-upstream.sh $(PATCHED_SYSROOT)/lib/was
 		--cc "$(abspath $(CC)) --target=wasm32-wasip1 --sysroot=$(abspath $(SYSROOT))" \
 		--output "$(abspath $@)"
 
-$(BUILD_DIR)/git: scripts/build-git-upstream.sh $(ZLIB_BUILD_DIR)/libz.a $(PATCHED_SYSROOT)/lib/wasm32-wasi/libc.a $(WASI_SDK_DIR)/bin/clang
+$(BUILD_DIR)/git: scripts/build-git-upstream.sh $(CURL_LIBCURL_ARTIFACT) $(MBEDTLS_LIBS) $(BROTLI_LIBS) $(ZSTD_LIB) $(ZLIB_BUILD_DIR)/libz.a $(PATCHED_SYSROOT)/lib/wasm32-wasi/libc.a $(WASI_SDK_DIR)/bin/clang
 	@mkdir -p $(BUILD_DIR)
 	bash scripts/build-git-upstream.sh \
 		--version "$(GIT_VERSION)" \
@@ -752,12 +756,21 @@ $(BUILD_DIR)/git: scripts/build-git-upstream.sh $(ZLIB_BUILD_DIR)/libz.a $(PATCH
 		--patch-dir "$(abspath $(GIT_PATCH_DIR))" \
 		--zlib-dir "$(abspath $(LIBS_CACHE)/zlib-$(ZLIB_VERSION))" \
 		--zlib-build-dir "$(abspath $(ZLIB_BUILD_DIR))" \
+		--curl-prefix "$(abspath $(CURL_LIBCURL_PREFIX))" \
+		--mbedtls-libdir "$(abspath $(MBEDTLS_BUILD_DIR))" \
+		--brotli-libdir "$(abspath $(BROTLI_BUILD_DIR))" \
+		--zstd-libdir "$(abspath $(ZSTD_BUILD_DIR))" \
 		--cc "$(abspath $(CC))" \
 		--ar "$(abspath $(WASI_SDK_DIR)/bin/llvm-ar)" \
 		--ranlib "$(abspath $(WASI_SDK_DIR)/bin/llvm-ranlib)" \
 		--sysroot "$(abspath $(SYSROOT))" \
+		--remote-http-output "$(abspath $(BUILD_DIR)/git-remote-http)" \
 		--output "$(abspath $@)"
 
+# git-remote-http is produced by the same git build invocation.
+$(BUILD_DIR)/git-remote-http: $(BUILD_DIR)/git
+	@test -f $@ || { echo "Error: git-remote-http missing at $@ (git build did not produce it)"; exit 1; }
+
 # curl_test: links libcurl (HTTP/HTTPS build for WASM via host_net + host_tls)
 CURL_SRCS := $(wildcard libs/curl/lib/*.c) $(wildcard libs/curl/lib/vauth/*.c) \
              $(wildcard libs/curl/lib/vtls/*.c) $(wildcard libs/curl/lib/vquic/*.c) \
@@ -786,8 +799,14 @@ $(BUILD_DIR)/curl: scripts/build-curl-upstream.sh $(CURL_UPSTREAM_OVERLAY_FILES)
 		--zstd-include "$(abspath $(ZSTD_INCLUDE_DIR))" \
 		--zstd-libdir "$(abspath $(ZSTD_BUILD_DIR))" \
 		--ca-bundle "/etc/ssl/certs/ca-certificates.crt" \
+		--install-prefix "$(abspath $(CURL_LIBCURL_PREFIX))" \
 		--output "$(abspath $@)"
 
+# The libcurl install artifact is produced as a side effect of the curl build.
+# Declare it so git can depend on it; verify it exists after the curl target ran.
+$(CURL_LIBCURL_ARTIFACT): $(BUILD_DIR)/curl
+	@test -f $@ || { echo "Error: libcurl artifact missing at $@ (curl build did not install it)"; exit 1; }
+
 $(BUILD_DIR)/wget: scripts/build-wget-upstream.sh $(WGET_UPSTREAM_OVERLAY_FILES) $(PATCHED_SYSROOT)/lib/wasm32-wasi/libc.a $(WASI_SDK_DIR)/bin/clang
 	@mkdir -p $(BUILD_DIR)
 	bash scripts/build-wget-upstream.sh \
@@ -863,12 +882,18 @@ install:
 		fi; \
 	done; \
 	echo "Installed $$INSTALLED C command(s) to $(COMMANDS_DIR)"
-	@# Create symlinks for Git helper entry points used by upstream Git.
+	@# Git helper entry points. upload-pack/receive-pack/upload-archive ARE git
+	@# builtins, so they alias the git binary. The HTTPS transport lives in the
+	@# real git-remote-http binary (libcurl in-process); git-remote-https is an
+	@# alias to it (same binary, ftp/ftps schemes unsupported and unused).
 	@if [ -f "$(COMMANDS_DIR)/git" ]; then \
-		for alias in git-remote-http git-remote-https git-upload-pack git-receive-pack git-upload-archive; do \
+		for alias in git-upload-pack git-receive-pack git-upload-archive; do \
 			ln -sf git "$(COMMANDS_DIR)/$$alias"; \
 		done; \
 	fi
+	@if [ -f "$(COMMANDS_DIR)/git-remote-http" ]; then \
+		ln -sf git-remote-http "$(COMMANDS_DIR)/git-remote-https"; \
+	fi
 
 # --- Clean ---
 

toolchain/c/scripts/build-curl-upstream.sh

@@ -22,7 +22,8 @@ Usage: build-curl-upstream.sh \
   --zstd-include <dir> \
   --zstd-libdir <dir> \
   --ca-bundle <path> \
-  --output <output>
+  --output <output> \
+  [--install-prefix <dir>]
 EOF
 }
 
@@ -45,9 +46,11 @@ ZSTD_INCLUDE=""
 ZSTD_LIBDIR=""
 CA_BUNDLE=""
 OUTPUT=""
+INSTALL_PREFIX=""
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
+    --install-prefix) INSTALL_PREFIX="$2"; shift 2 ;;
     --version) VERSION="$2"; shift 2 ;;
     --tag) TAG="$2"; shift 2 ;;
     --url) URL="$2"; shift 2 ;;
@@ -217,6 +220,33 @@ make -C lib libcurl.la
 echo "Building upstream curl tool..."
 make -C src curl
 
+# Reusable libcurl artifact: install the overlaid, mbedTLS-linked libcurl into a
+# prefix (headers + libcurl.a) so git can link it in-process. Same overlay and
+# configure as above, so git's git-remote-http gets the identical TLS backend.
+if [[ -n "$INSTALL_PREFIX" ]]; then
+  echo "Installing libcurl to $INSTALL_PREFIX ..."
+  rm -rf "$INSTALL_PREFIX"
+  mkdir -p "$INSTALL_PREFIX/include/curl" "$INSTALL_PREFIX/lib/pkgconfig"
+  make -C lib install prefix="$INSTALL_PREFIX" >/dev/null 2>&1 || true
+  make -C include install prefix="$INSTALL_PREFIX" >/dev/null 2>&1 || true
+  # Guarantee headers + the static archive land regardless of libtool install
+  # quirks under a cross toolchain.
+  cp -a include/curl/*.h "$INSTALL_PREFIX/include/curl/" 2>/dev/null || true
+  if [[ -f lib/.libs/libcurl.a && ! -f "$INSTALL_PREFIX/lib/libcurl.a" ]]; then
+    cp -a lib/.libs/libcurl.a "$INSTALL_PREFIX/lib/libcurl.a"
+  fi
+  cp -a libcurl.pc "$INSTALL_PREFIX/lib/pkgconfig/" 2>/dev/null || true
+  if [[ ! -f "$INSTALL_PREFIX/lib/libcurl.a" ]]; then
+    echo "libcurl.a missing after install into $INSTALL_PREFIX" >&2
+    exit 1
+  fi
+  if [[ ! -f "$INSTALL_PREFIX/include/curl/curl.h" ]]; then
+    echo "curl/curl.h missing after install into $INSTALL_PREFIX" >&2
+    exit 1
+  fi
+  echo "Installed libcurl artifact ($(wc -c < "$INSTALL_PREFIX/lib/libcurl.a") bytes) at $INSTALL_PREFIX"
+fi
+
 BIN=""
 for candidate in "src/.libs/curl" "src/curl" "src/curl.wasm"; do
   if [[ -f "$candidate" ]]; then

toolchain/c/scripts/build-git-upstream.sh

@@ -11,11 +11,16 @@ Usage: build-git-upstream.sh \
   --patch-dir <patch-dir> \
   --zlib-dir <zlib-source-dir> \
   --zlib-build-dir <zlib-build-dir> \
+  --curl-prefix <libcurl-install-prefix> \
+  --mbedtls-libdir <dir> \
+  --brotli-libdir <dir> \
+  --zstd-libdir <dir> \
   --cc <cc> \
   --ar <ar> \
   --ranlib <ranlib> \
   --sysroot <sysroot> \
-  --output <output>
+  --output <output> \
+  --remote-http-output <output>
 EOF
 }
 
@@ -25,12 +30,17 @@ CACHE_DIR=""
 BUILD_DIR=""
 ZLIB_DIR=""
 ZLIB_BUILD_DIR=""
+CURL_PREFIX=""
+MBEDTLS_LIBDIR=""
+BROTLI_LIBDIR=""
+ZSTD_LIBDIR=""
 PATCH_DIR=""
 CC_CMD=""
 AR_CMD=""
 RANLIB_CMD=""
 SYSROOT=""
 OUTPUT=""
+REMOTE_HTTP_OUTPUT=""
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
@@ -41,16 +51,21 @@ while [[ $# -gt 0 ]]; do
     --patch-dir) PATCH_DIR="$2"; shift 2 ;;
     --zlib-dir) ZLIB_DIR="$2"; shift 2 ;;
     --zlib-build-dir) ZLIB_BUILD_DIR="$2"; shift 2 ;;
+    --curl-prefix) CURL_PREFIX="$2"; shift 2 ;;
+    --mbedtls-libdir) MBEDTLS_LIBDIR="$2"; shift 2 ;;
+    --brotli-libdir) BROTLI_LIBDIR="$2"; shift 2 ;;
+    --zstd-libdir) ZSTD_LIBDIR="$2"; shift 2 ;;
     --cc) CC_CMD="$2"; shift 2 ;;
     --ar) AR_CMD="$2"; shift 2 ;;
     --ranlib) RANLIB_CMD="$2"; shift 2 ;;
     --sysroot) SYSROOT="$2"; shift 2 ;;
     --output) OUTPUT="$2"; shift 2 ;;
+    --remote-http-output) REMOTE_HTTP_OUTPUT="$2"; shift 2 ;;
     *) echo "Unknown argument: $1" >&2; usage >&2; exit 1 ;;
   esac
 done
 
-if [[ -z "$VERSION" || -z "$URL" || -z "$CACHE_DIR" || -z "$BUILD_DIR" || -z "$PATCH_DIR" || -z "$ZLIB_DIR" || -z "$ZLIB_BUILD_DIR" || -z "$CC_CMD" || -z "$AR_CMD" || -z "$RANLIB_CMD" || -z "$SYSROOT" || -z "$OUTPUT" ]]; then
+if [[ -z "$VERSION" || -z "$URL" || -z "$CACHE_DIR" || -z "$BUILD_DIR" || -z "$PATCH_DIR" || -z "$ZLIB_DIR" || -z "$ZLIB_BUILD_DIR" || -z "$CURL_PREFIX" || -z "$MBEDTLS_LIBDIR" || -z "$BROTLI_LIBDIR" || -z "$ZSTD_LIBDIR" || -z "$CC_CMD" || -z "$AR_CMD" || -z "$RANLIB_CMD" || -z "$SYSROOT" || -z "$OUTPUT" || -z "$REMOTE_HTTP_OUTPUT" ]]; then
   usage >&2
   exit 1
 fi
@@ -97,7 +112,15 @@ if [[ -d "$PATCH_DIR" ]]; then
   done
 fi
 
-echo "Building upstream Git ${VERSION} for wasm32-wasip1..."
+# libcurl + its TLS/compression backends, linked in-process by git-remote-http.
+# Defining CURL_CFLAGS/CURL_LDFLAGS makes Git's Makefile skip the curl-config
+# probe entirely and use these flags verbatim. Static link order matters:
+# libcurl first, then mbedTLS (tls -> x509 -> crypto), then zlib and the brotli /
+# zstd decoders curl's --compressed path pulls in.
+CURL_CFLAGS="-I$CURL_PREFIX/include"
+CURL_LDFLAGS="-L$CURL_PREFIX/lib -lcurl -L$MBEDTLS_LIBDIR -lmbedtls -lmbedx509 -lmbedcrypto -L$ZLIB_BUILD_DIR -lz -L$BROTLI_LIBDIR -lbrotlidec -lbrotlicommon -L$ZSTD_LIBDIR -lzstd"
+
+echo "Building upstream Git ${VERSION} for wasm32-wasip1 (with in-process libcurl)..."
 make -j"${MAKE_JOBS:-2}" \
   uname_S=WASI \
   CC="$CC_CMD" \
@@ -106,6 +129,8 @@ make -j"${MAKE_JOBS:-2}" \
   RANLIB="$RANLIB_CMD" \
   CFLAGS="--target=wasm32-wasip1 --sysroot=$SYSROOT -I$ZLIB_DIR -O2 -D_WASI_EMULATED_PROCESS_CLOCKS -D_WASI_EMULATED_MMAN" \
   LDFLAGS="--target=wasm32-wasip1 --sysroot=$SYSROOT -L$ZLIB_BUILD_DIR -lwasi-emulated-process-clocks -lwasi-emulated-mman" \
+  CURL_CFLAGS="$CURL_CFLAGS" \
+  CURL_LDFLAGS="$CURL_LDFLAGS" \
   CSPRNG_METHOD=getentropy \
   HAVE_PATHS_H=YesPlease \
   HAVE_DEV_TTY=YesPlease \
@@ -114,7 +139,6 @@ make -j"${MAKE_JOBS:-2}" \
   HAVE_GETDELIM=YesPlease \
   NO_RUST=1 \
   NO_OPENSSL=1 \
-  NO_CURL=1 \
   NO_EXPAT=1 \
   NO_GETTEXT=1 \
   NO_TCLTK=1 \
@@ -128,16 +152,29 @@ make -j"${MAKE_JOBS:-2}" \
   NO_UNIX_SOCKETS=1 \
   NO_SYS_POLL_H=1 \
   NO_NSEC=1 \
-  git
-
-mkdir -p "$(dirname "$OUTPUT")"
-if command -v wasm-opt >/dev/null 2>&1; then
-  echo "Optimizing Git WASM binary..."
-  wasm-opt -O3 --strip-debug --all-features git -o "$OUTPUT"
-else
-  cp git "$OUTPUT"
+  git git-remote-http
+
+if [[ ! -f git-remote-http ]]; then
+  echo "Expected git-remote-http binary was not produced" >&2
+  exit 1
 fi
 
+emit() {
+  local src="$1"
+  local out="$2"
+  mkdir -p "$(dirname "$out")"
+  if command -v wasm-opt >/dev/null 2>&1; then
+    echo "Optimizing $src WASM binary -> $out..."
+    wasm-opt -O3 --strip-debug --all-features "$src" -o "$out"
+  else
+    cp "$src" "$out"
+  fi
+}
+
+emit git "$OUTPUT"
+emit git-remote-http "$REMOTE_HTTP_OUTPUT"
+
 popd >/dev/null
 
 echo "Built upstream Git at $OUTPUT"
+echo "Built git-remote-http at $REMOTE_HTTP_OUTPUT"