git clone over HTTPS fails with socket error while node's HTTPS to the same host succeeds (secure-exec VM)

[chinkitp]

Summary

git clone over HTTPS fails inside the secure-exec VM with a socket error, while node's own TCP and HTTPS reach the same host from the same VM in the same session. Network egress is permitted to github.com, so this looks like the git transport rather than the sandbox policy.

$ git clone https://github.com/octocat/Hello-World.git /tmp/repo
  exit=128
  Cloning into '/tmp/repo'...
  fatal: fetch info/refs failed: socket error: connect(github.com:443) failed: errno 21

Immediately afterwards, in the same VM:

same VM, node stdlib to the same host:
  TCP ok
  HTTPS 200

Environment

@rivet-dev/agentos	0.2.15
@agentos-software/git	0.3.3
@agentos-software/common	0.2.15
engine	rivetdev/engine:2.3.9 (self-hosted)
worker base	node:24-slim

VM permissions are default: deny with an explicit allowlist; github.com is allowed for both tcp://github.com:* and dns://github.com. A denied host fails differently and says so explicitly (EACCES … blocked by network.http policy), which is how we ruled the policy out — the message above is a socket error with no policy mention.

Reproduction

const vm = client.vm.getOrCreate("repro-" + Date.now());

// fails
await vm.exec("git clone https://github.com/octocat/Hello-World.git /tmp/repo");

// succeeds, same VM, same host
const probe = `
const net = require('net'), https = require('https');
net.connect({host:'github.com', port:443}, function(){ console.log('TCP ok'); this.destroy(); });
https.get({host:'github.com', path:'/', headers:{'User-Agent':'p'}}, r => { console.log('HTTPS ' + r.statusCode); r.destroy(); });
`;
await vm.exec(`node -e "eval(Buffer.from('${Buffer.from(probe).toString("base64")}','base64').toString())"`);

Questions

1. Is HTTPS a supported clone transport for @agentos-software/git? The error text points at registry/native/crates/libs/git/README.md, which I can't see from the published package — the .aospkg does contain git://, ssh:// and https:// strings, so it reads as intended-but-not-working rather than unsupported.
2. If HTTPS is supported, does the git transport use a different egress path from node's stdlib — one that needs allowlisting separately from tcp://host:port? That would explain a socket error while node succeeds.
3. What does errno 21 mean here? Other in-VM errors use WASI numbering (os error 44 for ENOENT), which would make 21 EFAULT and doesn't obviously fit a connect().

Also, minor

A few subcommands report as unimplemented — flagging in case the list is unintentional rather than by design:

• git --version → GitSubcommandUnsupported
• git log → GitSubcommandUnsupported
• git clone --depth 1 <url> <dest> → fatal: usage: git clone <source> [<destination>]

--version in particular is a common probe for "is git usable here", so it failing makes capability detection awkward.

Workaround

Fetching the repository as a tarball from codeload.github.com over plain HTTPS and unpacking with tar from @agentos-software/common, which works. Posting mainly because a working clone would give us verbatim transport output and ref handling that the tarball path doesn't.