Bug: Git remote URL loses credentials after clone — fetch/push fails with 403

Problem

When OpenSWE clones a repository via clone_repo.py, it injects the GitHub App installation token into the clone URL: https://x-access-token:{token}@github.com/{owner}/{repo}.git

However, git deliberately strips credentials from the URL before writing it to .git/config, so the stored remote becomes: https://github.com/RadioFX/{repo}.git

All subsequent git fetch and git push operations use this bare URL with no credentials, resulting in: remote: Write access to repository not granted.

fatal: unable to access 'https://github.com/{repo}.git/': The requested URL returned error: 403

Root Cause

clone_repo.py injects the token once at clone time but there is no logic to refresh the remote URL before git operations. The installation token also expires after 1 hour, making a one-time injection insufficient even if it were stored.

Expected Behavior

Before any git fetch, git pull, or git push, the agent should generate a fresh installation token and inject it into the remote URL via:

git remote set-url origin https://x-access-token:{fresh_token}@github.com/{owner}/{repo}.git

Environment

• Self-hosted OpenSWE on GCP VM
• GitHub App authentication (not PAT)
• Triggered via GitHub issues and Slack