[vrajp-lyzr]

On POST /v1/sessions, an identity.source of {type: "git", url} is now cloned (git clone --depth 1) and replaces the image's baked-in agent. Before this, the source was ignored, so every agent ran with an empty /workspace (no agent.yaml, SOUL.md or skills).

Which agent runs: the session's git source > the image's baked-in gap_dir (COMPUTER_AGENT_GAP_DIR) > the image's working directory.

Clone:

• With a git egress route: COMPUTER_AGENT_EGRESS_GIT_URL (<proxy>/git/v1) comes from the session's envs unless the image sets it, like the other routes. The source's host moves behind it: github.com/acme/app is cloned from <proxy>/git/v1/github.com/acme/app.git. The sandbox token goes as HTTP Basic auth (x-access-token:<token>), which is the proxy's sandboxTokenGitBasic scheme. It is passed through git's environment (GIT_CONFIG_*), never on the command line or in the URL.
• Without one: the URL is cloned as received, with https:// added to a bare host/owner/repo.
• Result: with an agent.yaml the clone is the session's gap_dir, otherwise its workspace. It is removed with the session.
• Failures: a failed clone fails the session with 502 AGENT_SOURCE_FETCH_FAILED rather than quietly running the baked-in agent. URL credentials are scrubbed from git's error.
• No git URL (no source, or a local/inline one): the baked-in agent runs as before.

Also:

• ComputerAgent(workspace=…) is new: the engine's directory outside GAP mode. Given, COMPUTER_AGENT_GAP_DIR is not read; passing it together with gap_dir= is refused.
• The example images install git.

Tests (against real git, no mocks):

• a source with agent.yaml beats the baked-in GAP agent, and is removed on DELETE;
• a source without agent.yaml is the workspace;
• no git URL keeps the baked-in agent;
• failed clones (missing repo, unreachable host with URL credentials) return 502 with no credential in the error;
• through the egress route: the rewritten path and the Basic token are exactly what git sends; the image's route wins over the session's; without the route there's no auth header; a non-host/owner/repo URL is refused;
• ComputerAgent: workspace= beats the env GAP dir; gap_dir= and workspace= together are refused.

Full suite: 713 passed, 1 skipped. ruff clean. mypy: no new errors.

Smoke (the MicroVM image built from this branch, a fake AgentOS, and a fake egress git route that requires x-access-token:sbt_fake and forwards to GitHub):

• github.com/shreyas-lyzr/general-agent through the egress with gitagent: 201. The clone has agent.yaml, SOUL.md, skills, knowledge and memory.
• The wrong token: 502.
• https://github.com/octocat/Hello-World without the route: cloned directly.

Needs, outside this repo:

• CAS must send COMPUTER_AGENT_EGRESS_GIT_URL=<proxy>/git/v1 with the other routes, and the git source in identity.source.
• The agent gateway's github-app must be installed on the repo's org.