#!/usr/bin/env python3
"""The git credential helper of the executor's clone (plan section 6.2).

The executor gives git a pipe with the token and puts the descriptor
number in IMBI_GIT_TOKEN_FD. This helper reads the inherited descriptor
directly: a reopen through /proc/self/fd would need access to a pipe
that the executor owns, and dash cannot redirect a descriptor above 9.
The token is never in the command line, the environment, or a file.
"""

import os
import sys

sys.stdin.read()
fd = os.environ.get('IMBI_GIT_TOKEN_FD')
# No descriptor: an anonymous clone.
if sys.argv[1:2] == ['get'] and fd:
    token = os.read(int(fd), 65536).decode()
    if token:
        sys.stdout.write(f'username=x-access-token\npassword={token}\n')
