chore: v2.8.49 — CodeCommit clone works across regions; Clone runs in the background

An IAM SSH key ID logs in to every region of its AWS account, but a login
was saved per host, so a repo in a region with no key ID of its own was
refused. Clone now tries the key IDs saved for the other CodeCommit regions
(each with its own key; the first ls-remote accepts, or the only one) and
keeps that user in the clone's origin.

Files → New → Clone repository steps aside for its progress chip as soon
as the clone starts; a failure asking for a login reopens the form.

client/src/components/lanes/CloneHereDialog.tsx

@@ -7,10 +7,11 @@
  * folder's account with that account's own SSH key / HTTPS login — and opens
  * a workspace on the new folder. A 409 `ECREDENTIALS` opens a login row (sent
  * once, optionally remembered), `ESSHAUTH` points to Settings → Git.
- * A running clone shows `CloneProgress` and never holds the page: closing the
- * dialog only hides it behind a small progress chip (click to reopen), the
+ * A clone runs in the background from the moment it starts: the dialog steps
+ * aside for a small progress chip (`CloneProgress`; click to reopen), the
  * request keeps going, and its outcome arrives as a toast — a failure is kept
- * for the next open so a login row is still there to fill in.
+ * for the next open, and one asking for a login reopens the dialog with its
+ * login row.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -111,6 +112,9 @@ export function CloneHereDialog({
     setTarget(into);
     setError(null);
     setSshRefused(false);
+    // Runs in the background by default: the dialog steps aside for the
+    // progress chip, and comes back only if the clone needs a login.
+    onClose();
     try {
       const result = await api.lanes.clone({
         url: u,
@@ -156,6 +160,8 @@ export function CloneHereDialog({
       if (!openRef.current) {
         keepRef.current = true;
         toast.error(message);
+        // A login to type: show the form again with its login row.
+        if (e.code === "ECREDENTIALS") onReopen();
       }
     }
   };

client/src/components/lanes/FileExplorer.tsx

@@ -229,6 +229,8 @@ async function walkEntry(
     out.push({ file, rel: `${prefix}${entry.name}` });
     return;
   }
+  // The server takes nothing into .git: never read one off the disk at all.
+  if (entry.name === ".git") return;
   const reader = (entry as FileSystemDirectoryEntry).createReader();
   // readEntries answers in pages until it answers [].
   for (;;) {
@@ -614,8 +616,14 @@ export function FileBrowser({
   };
 
   /** Upload `files` (each with its path inside the pick/drop) under `dir`. */
-  const uploadAll = async (files: { file: File; rel: string }[], dir = path) => {
+  const uploadAll = async (picked: { file: File; rel: string }[], dir = path) => {
     setMenu(null);
+    // A dropped/picked repo carries its .git, which the server refuses file by
+    // file — skip it here with ONE notice instead of a toast per object.
+    const files = picked.filter((f) => !f.rel.split("/").includes(".git"));
+    if (files.length < picked.length) {
+      toast.info(t("fx.gitSkipped", { count: picked.length - files.length }));
+    }
     if (!files.length) return;
     const bytes = files.reduce((n, f) => n + f.file.size, 0);
     if (bytes > FX_BATCH_MAX_BYTES) {

client/src/components/lanes/__tests__/FileExplorer.test.tsx

@@ -3,7 +3,8 @@
  * opens sub-folders, makes a folder inline, deletes into the Trash without a
  * confirm, copies in one workspace and pastes into another (`fromLane`),
  * asks Replace / Keep both / Skip when an upload's name is taken, refuses a
- * batch over 500 MB before sending anything, restores from the user's own
+ * batch over 500 MB before sending anything, leaves a repo's .git out of a
+ * folder upload with one notice, restores from the user's own
  * Trash, opens an admin's Trash on one folder per user (counted, an unreadable
  * one saying why), opens each user's Trash from its folder (asking before a
  * purge there, sending the item's store) and
@@ -269,6 +270,23 @@ describe("FileExplorer", () => {
     expect(api.files.uploadBatch).not.toHaveBeenCalled();
   });
 
+  it("leaves a picked repo's .git out of a folder upload, with one notice", async () => {
+    vi.mocked(api.files.upload).mockResolvedValue({ path: "x" });
+    open();
+    await screen.findByText("a.txt");
+    const mk = (rel: string) => {
+      const f = new File(["hi"], rel.split("/").pop()!);
+      Object.defineProperty(f, "webkitRelativePath", { value: rel });
+      return f;
+    };
+    const files = ["repo/.git/HEAD", "repo/.git/objects/d4/ab", "repo/src/a.js"].map(mk);
+    fireEvent.change(screen.getByTestId("fx-upload-folder"), { target: { files } });
+    await waitFor(() => expect(api.files.upload).toHaveBeenCalledTimes(1));
+    expect(vi.mocked(api.files.upload).mock.calls[0]![1]).toBe("repo/src/a.js");
+    expect(toast.info).toHaveBeenCalledTimes(1);
+    expect(toast.error).not.toHaveBeenCalled();
+  });
+
   it("refuses a batch over 500 MB before sending anything", async () => {
     open();
     await screen.findByText("a.txt");
@@ -614,14 +632,16 @@ describe("FileExplorer — New → Clone repository", () => {
     const dialog = await openClone(user);
     await user.type(within(dialog).getByLabelText("Repository URL"), "git@host:o/repo.git");
     await user.click(within(dialog).getByTestId("fx-clone-submit"));
-    expect(await within(dialog).findByRole("progressbar")).toHaveAttribute("aria-valuenow", "45");
-    await user.click(within(dialog).getByRole("button", { name: "Run in background" }));
+    // In the background straight away: the chip carries the progress.
     expect(screen.queryByTestId("fx-clone-dialog")).toBeNull();
     const chip = await screen.findByTestId("fx-clone-chip");
     expect(within(chip).getByText(/repo/)).toBeInTheDocument();
+    expect(await within(chip).findByRole("progressbar")).toHaveAttribute("aria-valuenow", "45");
     await user.click(chip);
-    expect(screen.getByTestId("fx-clone-dialog")).toBeInTheDocument();
-    await user.keyboard("{Escape}");
+    const back = screen.getByTestId("fx-clone-dialog");
+    expect(await within(back).findByRole("progressbar")).toHaveAttribute("aria-valuenow", "45");
+    await user.click(within(back).getByRole("button", { name: "Run in background" }));
+    expect(screen.queryByTestId("fx-clone-dialog")).toBeNull();
     finish({
       lane: { id: 9, title: "repo", cwd: "/w/one/repo" },
       created: true,
@@ -631,7 +651,7 @@ describe("FileExplorer — New → Clone repository", () => {
     expect(screen.queryByTestId("fx-clone-chip")).toBeNull();
   });
 
-  it("toasts a failure that lands while hidden and keeps it for the next open", async () => {
+  it("toasts a failure that lands while hidden, and reopens the form for a login", async () => {
     let fail: (e: unknown) => void = () => {};
     vi.mocked(api.lanes.clone).mockReturnValue(new Promise((_, r) => (fail = r)) as never);
     vi.mocked(api.lanes.cloneProgress).mockRejectedValue(new Error("404"));
@@ -641,12 +661,12 @@ describe("FileExplorer — New → Clone repository", () => {
     const dialog = await openClone(user);
     await user.type(within(dialog).getByLabelText("Repository URL"), "https://git.example/o/r.git");
     await user.click(within(dialog).getByTestId("fx-clone-submit"));
-    await user.keyboard("{Escape}");
     fail(
       Object.assign(new Error("login"), { code: "ECREDENTIALS", auth: { host: "git.example" } })
     );
     await waitFor(() => expect(toast.error).toHaveBeenCalled());
-    const again = await openClone(user);
+    // A login to type reopens the form by itself, its row ready.
+    const again = await screen.findByTestId("fx-clone-dialog");
     expect(within(again).getByTestId("fx-clone-login")).toBeInTheDocument();
     expect(within(again).getByLabelText("Repository URL")).toHaveValue(
       "https://git.example/o/r.git"
@@ -669,10 +689,11 @@ describe("FileExplorer — New → Clone repository", () => {
     const dialog = await openClone(user);
     await user.type(within(dialog).getByLabelText("Repository URL"), "https://git.example/o/r.git");
     await user.click(within(dialog).getByTestId("fx-clone-submit"));
-    const login = await within(dialog).findByTestId("fx-clone-login");
+    const reopened = await screen.findByTestId("fx-clone-dialog");
+    const login = await within(reopened).findByTestId("fx-clone-login");
     await user.type(within(login).getByLabelText("Username"), "ann");
     await user.type(within(login).getByLabelText("Password or access token"), "tok");
-    await user.click(within(dialog).getByTestId("fx-clone-submit"));
+    await user.click(within(reopened).getByTestId("fx-clone-submit"));
     await waitFor(() =>
       expect(api.lanes.clone).toHaveBeenLastCalledWith(
         expect.objectContaining({

client/src/i18n/locales/en/lanes.json

@@ -590,6 +590,7 @@
   "fx.dropHint": "Drag files or folders here to upload · drag onto a folder to move (Ctrl: copy)",
   "fx.uploading": "Uploading {{done}}/{{total}}…",
   "fx.uploaded": "Uploaded {{count}} file(s).",
+  "fx.gitSkipped": "Skipped {{count}} file(s) inside .git — nothing is uploaded into .git.",
   "fx.uploadFailed": "Could not upload {{name}}: {{message}}",
   "fx.tooBig": "{{size}} is more than one upload may carry ({{max}}). Upload fewer files at a time.",
   "fx.trashed": "Moved {{count}} item(s) to the Trash.",

client/src/i18n/locales/vi/lanes.json

@@ -590,6 +590,7 @@
   "fx.dropHint": "Kéo file hoặc thư mục vào đây để tải lên · kéo vào một thư mục để di chuyển (Ctrl: sao chép)",
   "fx.uploading": "Đang tải lên {{done}}/{{total}}…",
   "fx.uploaded": "Đã tải lên {{count}} file.",
+  "fx.gitSkipped": "Đã bỏ qua {{count}} file trong .git — không tải gì vào .git.",
   "fx.uploadFailed": "Không tải lên được {{name}}: {{message}}",
   "fx.tooBig": "{{size}} vượt quá giới hạn một lần tải lên ({{max}}). Hãy tải ít file hơn mỗi lần.",
   "fx.trashed": "Đã chuyển {{count}} mục vào Thùng rác.",

client/src/pages/__tests__/__snapshots__/screens.snapshot.test.tsx.snap

@@ -7316,7 +7316,7 @@ exports[`screen snapshots > Settings — about 1`] = `
                 <span
                   class="text-status-warning/90"
                 >
-                  UI build v2.8.47 (rebuild client to match)
+                  UI build v2.8.49 (rebuild client to match)
                 </span>
               </p>
             </div>

docs/API.md

@@ -1203,7 +1203,7 @@ GET    /api/me/git                 { account: "member"|"host", writable, ssh: {
 POST   /api/me/git/ssh-key         Make an SSH key — Body: { replace?, type?: "ed25519" | "rsa", name? } — without `name` the DEFAULT key of that type (`id_ed25519`/`id_rsa`), with `name` (lowercase letters, digits, `-`, ≤ 32; 400 EBADKEYNAME) one more beside it, `id_<type>_<name>` — for another AWS account or a second GitHub user. 409 EEXISTS when that key exists without replace, or the name is taken by a key of the other type; 409 ETOOMANYKEYS past 10 keys → 201, same shape
 DELETE /api/me/git/ssh-key         Delete one key — `?id=<key id>` (400 EBADKEYNAME for a malformed id), or the default key of `?type=ed25519|rsa` — or every key without either (404 ENOTFOUND, 400 EBADKEYTYPE). A login naming a deleted key goes back to every key; our terminal `core.sshCommand` follows the keys and goes with the last one
 PUT    /api/me/git/ssh-terminal    Use the keys for git typed in the account's own terminal — Body: { on } — sets/unsets `core.sshCommand` in its `~/.gitconfig` (every AgentHub key first, then `~/.ssh/id_*`; rewritten as keys are made or deleted while on); on by default when a member makes a key; 409 EFOREIGNSSH over one the user wrote, which is never touched
-PUT    /api/me/git/ssh-user        An SSH login — Body: { host, user, alias?, key? } — writes `url."ssh://<user>@<host>/".insteadOf "ssh://<from>/"` to the account's `~/.gitconfig`, `<from>` = `alias` or the host itself (replacing ours for that host/alias), so `ssh://<from>/…` logs in as `user` (AWS CodeCommit: the IAM SSH key ID `APKA…`). `alias` (lowercase letters, digits, `-`, NO dot — 400 EBADALIAS) is one more account on the same host: two AWS accounts clone as `ssh://aws-prod/v1/repos/x` and `ssh://aws-dev/v1/repos/x`. `key` (a key id, 400 ENOKEY) is stored as `agenthub.<from>.sshKey` there: a clone of a `ssh://<from>/…` URL then offers ONLY that key (`IdentitiesOnly`) and persists it into the clone's config; without it every key is offered. 400 EBADHOST / EBADSSHUSER
+PUT    /api/me/git/ssh-user        An SSH login — Body: { host, user, alias?, key? } — writes `url."ssh://<user>@<host>/".insteadOf "ssh://<from>/"` to the account's `~/.gitconfig`, `<from>` = `alias` or the host itself (replacing ours for that host/alias), so `ssh://<from>/…` logs in as `user` (AWS CodeCommit: the IAM SSH key ID `APKA…`). `alias` (lowercase letters, digits, `-`, NO dot — 400 EBADALIAS) is one more account on the same host: two AWS accounts clone as `ssh://aws-prod/v1/repos/x` and `ssh://aws-dev/v1/repos/x`. `key` (a key id, 400 ENOKEY) is stored as `agenthub.<from>.sshKey` there: a clone of a `ssh://<from>/…` URL then offers ONLY that key (`IdentitiesOnly`) and persists it into the clone's config; without it every key is offered. An IAM SSH key ID logs in to every region of its AWS account, so a Clone of `ssh://git-codecommit.<region>.amazonaws.com/…` whose region has no login of its own borrows the ones saved for other CodeCommit regions (each with its own key): the first the remote accepts (`git ls-remote`), or the only one, and the clone's `origin` then names that user. 400 EBADHOST / EBADSSHUSER
 DELETE /api/me/git/ssh-user/:from  Drop the rule of that host or alias and its key link (404 ENOTFOUND); any other `insteadOf` the user wrote is never touched
 POST   /api/me/git/https           Save an https login — Body: { host, username, password }
 DELETE /api/me/git/https/:host     Delete one (404 ENOTFOUND)

docs/SERVER-MODE.md

@@ -886,7 +886,7 @@ What runs as the member, and how:
   - In a member's folder, git and `gh` run as `sudo -n -u ah-<name> git …`, so git's own ownership check passes and every file stays the member's.
   - The editor and `.gitignore` saves go through `/opt/agenthub/libexec/write-as`.
   - A file uploaded in the Files tab (`POST /api/lanes/:id/git/upload`) is written the same way, AS the member through `write-as` (content on stdin), and only as a NEW file in an existing folder of the workspace — never over an existing name, never into `.git`, never a home dot folder, at most 25 MB. With **Download** on a file (`GET /api/lanes/:id/git/download`, read like any member file below, up to 512 MB) this is how a member with no SSH or `scp` to the host moves files in and out of their own folder; both work in a folder that is not a git repo.
-  - AgentHub's stored git logins are never handed to a member's git, and a password typed in the git bar goes into the member's OWN store (below) for that one call — through `write-as`'s stdin, never sudo's argv or env — and out again unless "remember" was ticked; a store that cannot be read is never rewritten (`409 ESTOREUNREADABLE`). The member keeps their OWN identity in Settings → Git → **Your git identity** (`/api/me/git`): a commit author (`user.name`/`user.email` in their `~/.gitconfig` — commits fail without one; a new member has none), SSH keys AgentHub makes for them (an ED25519 and/or an RSA one — AWS CodeCommit takes only RSA) and HTTPS logins, both under `~/.config/agenthub/` in their home, written as them by `write-as` (0600). Add workspace → **Clone** (`POST /api/lanes/clone`) clones as them with it and writes it into the clone's own config (`core.sshCommand` / `credential.helper=store --file=…`), so the git bar and their agents' pushes in that repo use it too. A plain `git` they type themselves in a pane reads none of that, so making the key also sets `core.sshCommand` in their `~/.gitconfig` (the key first, then `~/.ssh/id_*`; a switch under the key, issue #82) — unless they already set their own, which is left alone. The SSH keys are shown one TAB per kind of host, each with only its own steps: **GitHub · GitLab** (ED25519, for Gitea and Bitbucket too) and **AWS CodeCommit** (RSA: copy → upload in IAM → paste the SSH key ID `APKA…` and pick the region), then **Other hosts** (advanced); a tab's **Add another key** makes one more key of that kind at once (named `aws-2`, `aws-3`… / `git-2`…) as its own card below, with the same steps (an AWS one's step 3 saves its key ID under the key's name, tied to that key — clone `ssh://<name>/v1/repos/<repo>`; a GitHub one's ties the key to its host — clone `ssh://<name>/<org>/<repo>.git`); it opens on the AWS tab when only an RSA key exists. The terminal switch sits under the tabs. The key ID (or another host's user) is saved as `url."ssh://<user>@<host>/".insteadOf "ssh://<host>/"` in the same `~/.gitconfig`, so the plain `git clone ssh://git-codecommit.<region>.amazonaws.com/v1/repos/<repo>` works in a pane and in Clone. A login typed in the Clone dialog goes to their store through `write-as`'s stdin, never sudo's argv or env, and is removed again after the clone unless "remember" was ticked.
+  - AgentHub's stored git logins are never handed to a member's git, and a password typed in the git bar goes into the member's OWN store (below) for that one call — through `write-as`'s stdin, never sudo's argv or env — and out again unless "remember" was ticked; a store that cannot be read is never rewritten (`409 ESTOREUNREADABLE`). The member keeps their OWN identity in Settings → Git → **Your git identity** (`/api/me/git`): a commit author (`user.name`/`user.email` in their `~/.gitconfig` — commits fail without one; a new member has none), SSH keys AgentHub makes for them (an ED25519 and/or an RSA one — AWS CodeCommit takes only RSA) and HTTPS logins, both under `~/.config/agenthub/` in their home, written as them by `write-as` (0600). Add workspace → **Clone** (`POST /api/lanes/clone`) clones as them with it and writes it into the clone's own config (`core.sshCommand` / `credential.helper=store --file=…`), so the git bar and their agents' pushes in that repo use it too. A plain `git` they type themselves in a pane reads none of that, so making the key also sets `core.sshCommand` in their `~/.gitconfig` (the key first, then `~/.ssh/id_*`; a switch under the key, issue #82) — unless they already set their own, which is left alone. The SSH keys are shown one TAB per kind of host, each with only its own steps: **GitHub · GitLab** (ED25519, for Gitea and Bitbucket too) and **AWS CodeCommit** (RSA: copy → upload in IAM → paste the SSH key ID `APKA…` and pick the region), then **Other hosts** (advanced); a tab's **Add another key** makes one more key of that kind at once (named `aws-2`, `aws-3`… / `git-2`…) as its own card below, with the same steps (an AWS one's step 3 saves its key ID under the key's name, tied to that key — clone `ssh://<name>/v1/repos/<repo>`; a GitHub one's ties the key to its host — clone `ssh://<name>/<org>/<repo>.git`); it opens on the AWS tab when only an RSA key exists. The terminal switch sits under the tabs. The key ID (or another host's user) is saved as `url."ssh://<user>@<host>/".insteadOf "ssh://<host>/"` in the same `~/.gitconfig`, so the plain `git clone ssh://git-codecommit.<region>.amazonaws.com/v1/repos/<repo>` works in a pane and in Clone — and Clone also lends a region with no key ID of its own the key IDs saved for other regions (an IAM key ID works in every region of its AWS account), keeping the one that logs in in the clone's `origin`. A login typed in the Clone dialog goes to their store through `write-as`'s stdin, never sudo's argv or env, and is removed again after the clone unless "remember" was ticked.
 - **Files a pane reads.** These are written into `~/.agenthub/handoff/` AS the member (`write-as`). The dashboard never writes, changes or deletes anything in a member's home itself: the member could have swapped the name for a link. The files are:
   - the workspace prompt and its context files;
   - the AI Proxy settings: no key, only that pane's own token for the gateway;

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "agenthub",
-  "version": "2.8.47",
+  "version": "2.8.49",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "agenthub",
-      "version": "2.8.47",
+      "version": "2.8.49",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "agenthub",
-  "version": "2.8.47",
+  "version": "2.8.49",
   "bin": {
     "agenthub": "bin/agenthub.js"
   },

server/__tests__/git-clone.test.js

@@ -5,7 +5,7 @@
  * ECREDENTIALS for a remote wanting a login), `/api/me/git` (key made once,
  * only the public half returned, 0600 on disk; named keys beside the default
  * ones, SSH logins per alias tied to one key, which a clone then offers
- * alone), and the member (S3) path of
+ * alone; a CodeCommit region with no login borrowing another region's), and the member (S3) path of
  * `server/lib/git-identity.js` with run-as and git stubbed — what reaches
  * git's argv, and that a login typed without "remember" leaves the member's
  * store as it was.
@@ -650,6 +650,44 @@ describe("several accounts: named keys and SSH logins per alias", () => {
   });
 });
 
+describe("CodeCommit: a region with no login borrows another region's", () => {
+  it("clones as the first saved CodeCommit user the remote accepts, and keeps that user in origin", async () => {
+    const bare = path.join(ROOT, "bare.git");
+    const R = "git-codecommit.ap-southeast-2.amazonaws.com";
+    const saved = [
+      ["git-codecommit.ap-southeast-1.amazonaws.com", "APKAONE"],
+      ["git-codecommit.us-east-1.amazonaws.com", "APKATWO"],
+    ];
+    for (const [host, user] of saved) {
+      assert.equal((await request("PUT", "/api/me/git/ssh-user", { host, user })).status, 200);
+    }
+    // The test forge stands in for the region: APKAONE is refused (no such
+    // repo behind it), APKATWO is the account that owns the repo.
+    const rules = [
+      [`url.file://${ROOT}/nowhere.git.insteadOf`, `ssh://APKAONE@${R}/v1/repos/r`],
+      [`url.file://${bare}.insteadOf`, `ssh://APKATWO@${R}/v1/repos/r`],
+    ];
+    for (const [k, v] of rules) execFileSync("git", ["config", "--global", "--add", k, v]);
+    try {
+      const r = await request("POST", "/api/lanes/clone", {
+        url: `ssh://${R}/v1/repos/r`,
+        parent: WORK,
+        name: "borrowed-login",
+      });
+      assert.equal(r.status, 201, JSON.stringify(r.body));
+      const origin = execFileSync(
+        "git",
+        ["-C", path.join(WORK, "borrowed-login"), "config", "remote.origin.url"],
+        { encoding: "utf8" }
+      ).trim();
+      assert.equal(origin, `ssh://APKATWO@${R}/v1/repos/r`);
+    } finally {
+      for (const [k] of rules) execFileSync("git", ["config", "--global", "--unset-all", k]);
+      for (const [host] of saved) await request("DELETE", `/api/me/git/ssh-user/${host}`);
+    }
+  });
+});
+
 describe("git-identity, member account (S3, stubbed)", () => {
   const runAs = require("../lib/run-as");
   const worktree = require("../lib/worktree");

server/lib/git-identity.js

@@ -715,6 +715,42 @@ async function linkedKeyFile(account, url) {
   return row ? (currentKeys(account).find((k) => k.id === row.key)?.file ?? null) : null;
 }
 
+// AWS CodeCommit's SSH key ID belongs to an IAM user, so it logs in to EVERY
+// region of that AWS account — but our login rules are per host, and a repo
+// in a region the user never saved stayed refused. Such a clone borrows the
+// logins saved for the other CodeCommit regions (not aliases' hosts only: an
+// alias row's user is as valid), each with its own key when it names one.
+const CODECOMMIT_RE = /^git-codecommit\.[a-z0-9-]+\.amazonaws\.com$/;
+
+/** `[{url, keyFile}]`: `url` with each borrowable CodeCommit user in it. */
+async function borrowedLogins(account, url) {
+  if (!url.startsWith("ssh://")) return [];
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return [];
+  }
+  const host = u.host.toLowerCase();
+  if (u.username || !CODECOMMIT_RE.test(host)) return [];
+  const rows = await listSshUsers(account);
+  // The region has a login of its own: git's insteadOf already applies it.
+  if (rows.some((r) => (r.alias ?? r.host) === host)) return [];
+  const keys = currentKeys(account);
+  const seen = new Set();
+  const out = [];
+  for (const r of rows) {
+    if (!CODECOMMIT_RE.test(r.host)) continue;
+    const keyFile = r.key ? (keys.find((k) => k.id === r.key)?.file ?? null) : null;
+    if (r.key && !keyFile) continue;
+    const id = `${r.user}\0${keyFile ?? ""}`;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    out.push({ url: `ssh://${r.user}@${host}${u.pathname}`, keyFile });
+  }
+  return out;
+}
+
 // ── Network commands in an existing repo (git bar fetch/pull/push) ─────────
 
 /**
@@ -878,12 +914,35 @@ async function cloneNow({ url, parent, name, once = null, partial = false }, thr
     if (once) throw err("EBADCRED", "a typed login is for https only — SSH uses your key");
     // A login naming its key (another AWS account, a second GitHub user)
     // offers that key ONLY — another key could log in as the wrong account.
-    const linked = await linkedKeyFile(account, url);
+    let linked = await linkedKeyFile(account, url);
+    const sshFor = (file) => {
+      const k = file ? [file] : keyFiles(account);
+      const b = k.length ? `ssh${identityArgs(k)} -o IdentitiesOnly=yes` : "ssh";
+      // BatchMode: no terminal to answer a prompt; accept-new: first contact
+      // records the host key, a CHANGED one still fails.
+      return `core.sshCommand=${b} -o BatchMode=yes -o StrictHostKeyChecking=accept-new`;
+    };
+    // A CodeCommit region with no login of its own: the first borrowed login
+    // the remote accepts (one is taken as is). The clone's URL then names
+    // that user, so the repo's `origin` keeps logging in the same way.
+    const borrowed = await borrowedLogins(account, url);
+    for (const b of borrowed) {
+      const ok =
+        borrowed.length === 1 ||
+        (await git(parent, ["-c", sshFor(b.keyFile), "ls-remote", "--", b.url, "HEAD"], {
+          timeout: 60_000,
+        }).then(
+          () => true,
+          () => false
+        ));
+      if (ok) {
+        url = b.url;
+        linked = b.keyFile;
+        break;
+      }
+    }
     const keys = linked ? [linked] : keyFiles(account);
-    const base = keys.length ? `ssh${identityArgs(keys)} -o IdentitiesOnly=yes` : "ssh";
-    // BatchMode: no terminal to answer a prompt; accept-new: first contact
-    // records the host key, a CHANGED one still fails.
-    pre.push("-c", `core.sshCommand=${base} -o BatchMode=yes -o StrictHostKeyChecking=accept-new`);
+    pre.push("-c", sshFor(linked));
     if (keys.length) {
       // Persisted by FILE name — both default types plus every named key:
       // a default key made later is offered too (ssh skips a missing