Repository: All-Hands-AI/OpenHands
File: openhands/runtime/base.py (Python)

Code before:
                provider = ProviderType.GITLAB
            elif 'bitbucket.org' in old_url:
                provider = ProviderType.BITBUCKET

            if not provider or provider not in git_provider_tokens:
                return

            # Get fresh token
            token_info = git_provider_tokens[provider]
            if (
                not token_info
                or not hasattr(token_info, 'token')
                or not token_info.token
            ):
                return

            new_token = token_info.token.get_secret_value()

            # Build new URL with fresh token
            import re

            if provider == ProviderType.GITHUB:
                new_url = re.sub(
                    r'https://[^@]+@github\.com',
                    f'https://{new_token}@github.com',
                    old_url,
                )
            elif provider == ProviderType.GITLAB:
                new_url = re.sub(
                    r'https://oauth2:[^@]+@gitlab\.com',
                    f'https://oauth2:{new_token}@gitlab.com',
                    old_url,
                )
            elif provider == ProviderType.BITBUCKET:
                new_url = re.sub(
                    r'https://x-token-auth:[^@]+@bitbucket\.org',
                    f'https://x-token-auth:{new_token}@bitbucket.org',
                    old_url,
                )
            else:
                new_url = old_url

            if new_url != old_url:
                set_url_action = CmdRunAction(
                    command=f'cd {repo_dir} && git remote set-url origin {new_url}'
                )
                obs = await call_sync_from_async(self.run_action, set_url_action)

                if isinstance(obs, CmdOutputObservation) and obs.exit_code == 0:
                    self.log(
                        'info',

Review comment (suggestion):
Two small questions here:
- it seems we only embed it in the URL, so iirc the old one remains in env? And in other remotes than `origin`. I do see how this helps, though... this is the most used case 🤔
- could we test that this works or doesn't break on OpenHands? (not Saas) I think V0 doesn't have token refresh. That _shouldn't_ matter here, just to be sure

Code after:
        random_str = ''.join(
            random.choices(string.ascii_lowercase + string.digits, k=8)
        )
        openhands_workspace_branch = f'openhands-workspace-{random_str}'

        repo_path = self.workspace_root / dir_name
        quoted_repo_path = shlex.quote(str(repo_path))
        quoted_remote_repo_url = shlex.quote(remote_repo_url)

        # Clone repository command
        clone_command = f'git clone {quoted_remote_repo_url} {quoted_repo_path}'

        # Checkout to appropriate branch
        checkout_command = (
            f'git checkout {selected_branch}'
            if selected_branch
            else f'git checkout -b {openhands_workspace_branch}'
        )

        clone_action = CmdRunAction(command=clone_command)
        await call_sync_from_async(self.run_action, clone_action)

        cd_checkout_action = CmdRunAction(
            command=f'cd {quoted_repo_path} && {checkout_command}'
        )
        action = cd_checkout_action
        self.log('info', f'Cloning repo: {selected_repository}')
        await call_sync_from_async(self.run_action, action)

        if remote_repo_url:
            set_remote_action = CmdRunAction(
                command=(
                    f'cd {quoted_repo_path} && '
                    f'git remote set-url origin {quoted_remote_repo_url}'
                )
            )
            obs = await call_sync_from_async(self.run_action, set_remote_action)
            if isinstance(obs, CmdOutputObservation) and obs.exit_code == 0:
                self.log(
                    'info',
                    f'Set git remote origin to authenticated URL for {selected_repository}',
                )
            else:
                self.log(
                    'warning',
                    (
                        'Failed to set git remote origin while ensuring fresh token '
                        f'for {selected_repository}: '
                        f'{obs.content if isinstance(obs, CmdOutputObservation) else "unknown error"}'
                    ),
                )