Merge cursor/network-failfast-env-971d into cursor/parallel-rain-workers-971d

Co-authored-by: Ben Schellenberger <bschellenberger2600@users.noreply.github.com>

Author: cursoragent

internal/git/command.go

@@ -9,7 +9,7 @@ import (
 // PrepareNetworkGit configures cmd for fetch/push operations that may contact
 // a remote. Delegates to git-harness for GIT_TERMINAL_PROMPT=0, then adds
 // fail-fast SSH and HTTP env unless the user already set GIT_SSH_COMMAND,
-// GIT_HTTP_LOW_SPEED_*, or core.sshCommand in the repo.
+// GIT_SSH, GIT_HTTP_LOW_SPEED_*, or core.sshCommand.
 func PrepareNetworkGit(cmd *exec.Cmd) {
 	harnessgit.PrepareNetworkGit(cmd)
 	applyFailFastNetworkEnv(cmd)

internal/git/command_test.go

@@ -20,12 +20,14 @@ func TestFetchFailureReason_TerminalPromptsDisabled(t *testing.T) {
 }
 
 func isolatedPrepareNetworkEnv(t *testing.T) []string {
+	t.Helper()
 	return []string{
 		"PATH=" + os.Getenv("PATH"),
 		"HOME=" + os.Getenv("HOME"),
 		"USER=" + os.Getenv("USER"),
 		"GIT_CONFIG_NOSYSTEM=1",
 		"GIT_CONFIG_GLOBAL=/dev/null",
+		"GIT_CONFIG_SYSTEM=/dev/null",
 	}
 }
 
@@ -64,6 +66,20 @@ func TestPrepareNetworkGit_PreservesUserGitSSHCommand(t *testing.T) {
 	}
 }
 
+func TestPrepareNetworkGit_PreservesUserGitSSH(t *testing.T) {
+	repo := testutil.CreateTestRepo(t, testutil.RepoOptions{Name: "failfast-user-git-ssh"})
+	cmd := exec.Command("git", "fetch", "--all")
+	cmd.Dir = repo
+	cmd.Env = append(isolatedPrepareNetworkEnv(t), "GIT_SSH=/usr/bin/custom-ssh")
+	PrepareNetworkGit(cmd)
+
+	for _, e := range cmd.Env {
+		if strings.HasPrefix(e, "GIT_SSH_COMMAND=") {
+			t.Fatalf("should not set GIT_SSH_COMMAND when GIT_SSH is set, got %s", e)
+		}
+	}
+}
+
 func TestPrepareNetworkGit_PreservesCoreSSHCommand(t *testing.T) {
 	repo := testutil.CreateTestRepo(t, testutil.RepoOptions{Name: "failfast-core-ssh"})
 	runGit := exec.Command("git", "-C", repo, "config", "core.sshCommand", "ssh -o IdentityFile=/tmp/from-core")

internal/git/network_env.go

@@ -21,7 +21,9 @@ func applyFailFastNetworkEnv(cmd *exec.Cmd) {
 	env = setEnvIfUnset(env, "GIT_HTTP_LOW_SPEED_LIMIT", defaultHTTPLowSpeedLimit)
 	env = setEnvIfUnset(env, "GIT_HTTP_LOW_SPEED_TIME", defaultHTTPLowSpeedTimeSec)
 
-	if !envHasPrefix(env, "GIT_SSH_COMMAND=") && !envHasPrefix(env, "GIT_SSH=") && !repoHasCoreSSHCommand(cmd.Dir) {
+	// GIT_SSH_COMMAND overrides GIT_SSH; only inject when neither is set and
+	// core.sshCommand is unset (same preserve path as an explicit SSH wrapper).
+	if !envHasPrefix(env, "GIT_SSH_COMMAND=") && !envHasPrefix(env, "GIT_SSH=") && !repoHasCoreSSHCommand(cmd.Dir, env) {
 		sshCmd := fmt.Sprintf("ssh -o BatchMode=yes -o ConnectTimeout=%d", defaultSSHConnectTimeoutSec)
 		env = append(env, "GIT_SSH_COMMAND="+sshCmd)
 	}
@@ -47,10 +49,12 @@ func envHasPrefix(env []string, prefix string) bool {
 	return false
 }
 
-func repoHasCoreSSHCommand(repoDir string) bool {
+func repoHasCoreSSHCommand(repoDir string, env []string) bool {
 	if strings.TrimSpace(repoDir) == "" {
 		return false
 	}
-	out, err := exec.Command("git", "-C", repoDir, "config", "--get", "core.sshCommand").Output()
+	probe := exec.Command("git", "-C", repoDir, "config", "--get", "core.sshCommand")
+	probe.Env = env
+	out, err := probe.Output()
 	return err == nil && strings.TrimSpace(string(out)) != ""
 }