fix(agent): shallow clone repositories for cloud tasks

[tatoalo]

Problem

Repository-less cloud tasks need to discover and clone the right repository at runtime. A normal clone can download years of history and tags for large repositories, and Auto mode paused for approval before the new repository tools could run.

Changes

• expose local repository listing and cloning tools to repo-less Claude and Codex cloud sessions
• clone with a single branch, depth 1, and no tags through the existing clone saga
• tell the agent to use the repository tools and deepen history only when needed
• allow the trusted local repository setup tools to run without a permission prompt in Auto mode

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 64c1011.}

[greptile-apps]

Prompt To Fix All With AI

### Issue 1
packages/agent/src/adapters/local-tools/tools/clone-repo.ts:114
**Shallow clone breaks branch switching**

When `clone_repo` is called again for a different branch of the same repository, the existing-clone path runs `checkout(branch)` without fetching it, but the initial `--single-branch` clone has no ref for that branch, causing the checkout to fail and leaving the agent on the previously cloned branch.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix(agent): allow repository setup in au..." | Re-trigger Greptile}

[veria-ai]

PR overview

This PR changes the agent’s repository cloning tool to use shallow clones for cloud tasks, including branch checkout and fetch behavior for existing repositories.

One security issue has been addressed, but a critical credential-exposure path remains. An attacker-controlled task can prepare an existing repository with a malicious checkout hook or external origin, potentially exfiltrating the GitHub token during checkout or fetch. The PR should not be considered secure until authenticated Git operations are restricted to the intended GitHub repository and checkout hooks cannot inherit credentials.

Open issues (1)

• Critical: Existing clones can exfiltrate the GitHub token — packages/agent/src/adapters/local-tools/tools/clone-repo.ts:109

Fixed/addressed: 1 · PR risk: 9/10

[veria-ai]

Critical: Existing clones can exfiltrate the GitHub token

authenticatedGitEnv contains the GitHub authorization header and is attached to both checkout and fetch operations in an existing repository. An attacker-controlled task can create the target .git with a post-checkout hook or a credential-free external origin, then invoke clone_repo with a branch; the hook inherits the token-bearing environment, or the fallback fetch sends the header to the attacker's server. Use a clean environment for checkout, force the existing origin to exactly cloneUrl, and apply a GitHub-host-scoped authorization header only to the fetch operation.