From 78ca891c0cc739f26b3ecba52c93b65b9775a61b Mon Sep 17 00:00:00 2001
From: Andrey Avtomonov <andreybavt@gmail.com>
Date: Sun, 17 May 2026 00:27:59 +0200
Subject: [PATCH] fix(context): allow release git askpass env

---
 packages/context/src/core/git-env.ts          |  2 +-
 packages/context/src/core/git.service.test.ts | 28 +++++++++++++++++++
 packages/context/src/ingest/git-env.ts        |  3 +-
 3 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/packages/context/src/core/git-env.ts b/packages/context/src/core/git-env.ts
index 7952d9c2..9ad3f121 100644
--- a/packages/context/src/core/git-env.ts
+++ b/packages/context/src/core/git-env.ts
@@ -25,5 +25,5 @@ function sanitizedGitEnv(env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEn
 }
 
 export function createSimpleGit(baseDir: string): SimpleGit {
-  return simpleGit({ baseDir }).env(sanitizedGitEnv());
+  return simpleGit({ baseDir, unsafe: { allowUnsafeAskPass: true } }).env(sanitizedGitEnv());
 }
diff --git a/packages/context/src/core/git.service.test.ts b/packages/context/src/core/git.service.test.ts
index 8ad74b22..e8a5aa73 100644
--- a/packages/context/src/core/git.service.test.ts
+++ b/packages/context/src/core/git.service.test.ts
@@ -59,6 +59,34 @@ describe('GitService', () => {
       expect(config).toMatch(/\[gc]\n\s+autoDetach = false/);
       expect(config).toMatch(/\[maintenance]\n\s+autoDetach = false/);
     });
+
+    it('initializes when release automation sets GIT_ASKPASS', async () => {
+      const releaseEnvDir = await mkdtemp(join(tmpdir(), 'git-service-release-env-'));
+      const previousAskPass = process.env.GIT_ASKPASS;
+      process.env.GIT_ASKPASS = 'echo';
+
+      try {
+        const releaseEnvService = new GitService({
+          storage: { configDir: releaseEnvDir, homeDir: releaseEnvDir },
+          git: {
+            userName: 'Test User',
+            userEmail: 'test@example.com',
+            bootstrapMessage: 'Initialize test config repo',
+            bootstrapAuthor: 'test-system',
+            bootstrapAuthorEmail: 'system@example.com',
+          },
+        });
+
+        await expect(releaseEnvService.onModuleInit()).resolves.toBeUndefined();
+      } finally {
+        if (previousAskPass === undefined) {
+          delete process.env.GIT_ASKPASS;
+        } else {
+          process.env.GIT_ASKPASS = previousAskPass;
+        }
+        await rm(releaseEnvDir, { recursive: true, force: true });
+      }
+    });
   });
 
   describe('commitFile `created` flag', () => {
diff --git a/packages/context/src/ingest/git-env.ts b/packages/context/src/ingest/git-env.ts
index 25a5f021..98590536 100644
--- a/packages/context/src/ingest/git-env.ts
+++ b/packages/context/src/ingest/git-env.ts
@@ -3,6 +3,7 @@ import { type SimpleGit, simpleGit } from 'simple-git';
 const SANITIZED_GIT_ENV_KEYS = [
   'EDITOR',
   'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+  'GIT_ASKPASS',
   'GIT_CONFIG',
   'GIT_CONFIG_COUNT',
   'GIT_CONFIG_GLOBAL',
@@ -31,5 +32,5 @@ export function createSimpleGit(baseDir?: string): SimpleGit {
   for (const key of SANITIZED_GIT_ENV_KEYS) {
     delete env[key];
   }
-  return simpleGit(baseDir).env(env);
+  return simpleGit({ baseDir, unsafe: { allowUnsafeAskPass: true } }).env(env);
 }