Sites credential issued but not injected into git-remote-https fetch — initial request returns 401

What version of the Codex App are you using (From “About Codex” dialog)?

App version: not available from About Codex dialog Bundled Codex CLI: 0.147.0

What subscription do you have?

ChatGPT paid plan

What platform is your computer?

Windows 11 x64

What issue are you seeing?

OpenAI Sites production deployment fails because the platform-managed Sites credential is issued but is not injected into the Git HTTPS fetch subprocess.

I reproduced the failing read-only fetch with GIT_TRACE=1 and GIT_TRACE_CURL=1 at OpenAI Support's request.

The trace confirms that the initial git-remote-https request to git.chatgpt-team.site contains no Authorization header.

The server responds:

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realm="artifacts"

Git then invokes:

git credential-manager get

and fails because the Codex/Sites environment is non-interactive:

fatal: Cannot prompt because user interactivity has been disabled.
fatal: could not read Username for 'https://git.chatgpt-team.site': terminal prompts disabled

Trace summary:

INITIAL AUTHORIZATION HEADER: ABSENT
FIRST HTTP RESPONSE STATUS: HTTP/1.1 401 Unauthorized
AUTH CHALLENGE OBSERVED: YES
CREDENTIAL HELPER INVOKED: YES
FINAL FETCH RESULT: FAILED

Relevant environment:

http.*.extraheader = none
GIT_ASKPASS = unset
SSH_ASKPASS = unset
GIT_TERMINAL_PROMPT = 0
GCM_INTERACTIVE = Never

The platform-managed Sites credential was reported as successfully issued before the fetch, but it does not reach the actual Git HTTPS request.

No manual credentials, tokens, API keys, force-push, or insecure authentication workaround were used.

OpenAI Support feedback session ID:
019ff44a-6d53-71a0-a8dd-0cdb77e38b80

Codex CLI:
0.147.0

Push: NOT ATTEMPTED
Production deployment: NOT STARTED

What steps can reproduce the bug?

1. Open a Codex App project connected to OpenAI Sites on Windows.

2. Complete the site locally and initiate the supported Sites production synchronization/deployment flow.

3. The platform-managed short-lived Sites credential is reported as successfully issued.

4. Codex performs a read-only fetch of the Sites repository over HTTPS:

   git fetch --no-tags origin main

5. The fetch fails and Git attempts credential-helper fallback, but interactive authentication is disabled.

6. At OpenAI Support's request, reproduce the same read-only fetch once in the same Codex/Sites environment with:

   GIT_TRACE=1
   GIT_TRACE_CURL=1

7. The trace shows the first git-remote-https request is sent to:

   https://git.chatgpt-team.site/

   without an Authorization header.

8. The server responds:

   HTTP/1.1 401 Unauthorized
   WWW-Authenticate: Basic realm="artifacts"

9. Git then invokes:

   git credential-manager get

10. The operation terminates with:

fatal: Cannot prompt because user interactivity has been disabled.
fatal: could not read Username for 'https://git.chatgpt-team.site': terminal prompts disabled

Reproduction result:

INITIAL AUTHORIZATION HEADER: ABSENT
FIRST HTTP RESPONSE STATUS: HTTP/1.1 401 Unauthorized
AUTH CHALLENGE OBSERVED: YES
CREDENTIAL HELPER INVOKED: YES
FINAL FETCH RESULT: FAILED

No push or Production deployment is required to reproduce the issue.

What is the expected behavior?

When OpenAI Sites successfully issues a platform-managed short-lived repository credential, that credential should be securely propagated to the Git subprocess used by Codex/Sites.

The initial git-remote-https request to git.chatgpt-team.site should therefore contain the required authentication information and successfully authenticate without requiring an interactive username/password prompt.

The read-only fetch should complete successfully so Codex can verify remote main and continue the supported Sites synchronization/deployment flow.

Git Credential Manager should not need to fall back to interactive authentication for the platform-managed Sites repository.

Additional information

OpenAI Support is already investigating this issue and requested the traced reproduction.

Feedback session ID:
019ff44a-6d53-71a0-a8dd-0cdb77e38b80

Codex CLI:
0.147.0

Git:
2.55.0.windows.3

Origin protocol:
HTTPS

Origin hostname:
git.chatgpt-team.site

Relevant environment/config:

http.*.extraheader = none
GIT_ASKPASS = unset
SSH_ASKPASS = unset
GIT_TERMINAL_PROMPT = 0
GCM_INTERACTIVE = Never

Redacted trace excerpt:

trace: built-in: git fetch --no-tags origin main
trace: exec: git-remote-https origin https://git.chatgpt-team.site/

=> Send header: GET //info/refs?service=git-upload-pack HTTP/1.1
=> Send header: Host: git.chatgpt-team.site
=> Send header: User-Agent: git/2.55.0.windows.3
=> Send header: Accept: /
=> Send header: Accept-Encoding: deflate, gzip, br, zstd
=> Send header: Pragma: no-cache
=> Send header: Git-Protocol: version=2

<= Recv header: HTTP/1.1 401 Unauthorized
<= Recv header: Cache-Control: no-store
<= Recv header: WWW-Authenticate: Basic realm="artifacts"
<= Recv header: set-cookie:
<= Recv data: Authentication required

trace: run_command: 'git credential-manager get'
trace: exec: git-credential-manager get
trace: run_command: git-credential-manager get

fatal: Cannot prompt because user interactivity has been disabled.
fatal: could not read Username for 'https://git.chatgpt-team.site': terminal prompts disabled

No manual username/password, personal access token, API key, force-push, or insecure authentication workaround was used.

Push: NOT ATTEMPTED
Production deployment: NOT STARTED

The trace appears to isolate the failure to propagation/injection of the platform-managed Sites credential into the actual Git HTTPS subprocess.

Start with the Sites synchronization/deployment flow that launches git fetch --no-tags origin main, then trace how the platform-managed credential reaches git-remote-https; the issue names no source files or tests. Reproduce on Windows with GIT_TRACE and GIT_TRACE_CURL, and verify that the initial request is authenticated and the non-interactive fetch completes without invoking git credential-manager get.