Fix Windows repo cloning and add docs agent

.env.example

@@ -7,3 +7,4 @@ MAX_FILES=200
 MAX_FILE_SIZE_KB=250
 MAX_CHARS_PER_CHUNK=12000
 CLONE_TIMEOUT_SECONDS=60
+CLONE_BASE_DIR=.swarm_audit_tmp

.gitignore

@@ -209,6 +209,7 @@ tempCodeRunnerFile.py
 # SwarmAudit local test artifacts
 .tmp_pytest/
 pytest-cache-files-*
+.swarm_audit_tmp/
 
 # PyPI configuration file
 .pypirc

app/config.py

@@ -13,6 +13,7 @@ class Settings(BaseSettings):
     max_file_size_kb: int = 250
     max_chars_per_chunk: int = 12000
     clone_timeout_seconds: int = 60
+    clone_base_dir: str = ".swarm_audit_tmp"
 
     model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8")
 

app/services/repo_crawler.py

@@ -1,9 +1,11 @@
+import os
 import shutil
-import tempfile
+import subprocess
+import uuid
 from pathlib import Path
 from urllib.parse import urlparse
 
-from git import Repo
+from git import GitCommandError, Repo
 
 from app.config import Settings
 from app.schemas import RepoScanResult, SourceFile
@@ -61,19 +63,11 @@ class RepoCrawler:
 
     def clone_and_scan(self, repo_url: str) -> RepoScanResult:
         clone_url = validate_github_url(repo_url)
-        temp_root = Path(tempfile.mkdtemp(prefix="swarm_audit_"))
+        temp_root = self._create_clone_root()
         repo_path = temp_root / "repo"
 
         try:
-            Repo.clone_from(
-                clone_url,
-                repo_path,
-                depth=1,
-                single_branch=True,
-                kill_after_timeout=self.settings.clone_timeout_seconds,
-                env={"GIT_TERMINAL_PROMPT": "0"},
-                multi_options=["--filter=blob:none"],
-            )
+            self._clone_repo(clone_url, repo_path)
             return self.scan_local_repo(repo_url=repo_url, repo_path=repo_path)
         except Exception:
             shutil.rmtree(temp_root, ignore_errors=True)
@@ -137,12 +131,79 @@ class RepoCrawler:
 
         repo_path = Path(scan_result.local_path)
         temp_root = repo_path.parent
-        temp_dir = Path(tempfile.gettempdir()).resolve()
 
         try:
             resolved_temp_root = temp_root.resolve()
+            resolved_base_dir = Path(self.settings.clone_base_dir).resolve()
         except FileNotFoundError:
             return
 
-        if temp_dir in resolved_temp_root.parents and temp_root.name.startswith("swarm_audit_"):
+        if resolved_base_dir in resolved_temp_root.parents and temp_root.name.startswith("swarm_audit_"):
             shutil.rmtree(temp_root, ignore_errors=True)
+
+    def _create_clone_root(self) -> Path:
+        base_dir = Path(self.settings.clone_base_dir)
+        base_dir.mkdir(parents=True, exist_ok=True)
+        clone_root = base_dir / f"swarm_audit_{uuid.uuid4().hex}"
+        clone_root.mkdir(parents=False, exist_ok=False)
+        return clone_root
+
+    def _clone_repo(self, clone_url: str, repo_path: Path) -> None:
+        clone_kwargs = {
+            "depth": 1,
+            "single_branch": True,
+            "env": self._git_env(),
+            "multi_options": ["--filter=blob:none"],
+        }
+        if os.name != "nt":
+            clone_kwargs["kill_after_timeout"] = self.settings.clone_timeout_seconds
+
+        try:
+            Repo.clone_from(clone_url, repo_path, **clone_kwargs)
+        except GitCommandError as exc:
+            if not self._should_retry_with_openssl(exc):
+                raise
+            shutil.rmtree(repo_path, ignore_errors=True)
+            self._clone_repo_with_openssl(clone_url, repo_path)
+
+    def _should_retry_with_openssl(self, exc: GitCommandError) -> bool:
+        if os.name != "nt":
+            return False
+        return "schannel" in str(exc).lower()
+
+    def _clone_repo_with_openssl(self, clone_url: str, repo_path: Path) -> None:
+        command = [
+            "git",
+            "-c",
+            "http.sslBackend=openssl",
+            "clone",
+            "-v",
+            "--depth=1",
+            "--single-branch",
+            "--filter=blob:none",
+            "--",
+            clone_url,
+            str(repo_path),
+        ]
+        result = subprocess.run(
+            command,
+            cwd=Path.cwd(),
+            env={**os.environ, **self._git_env()},
+            text=True,
+            capture_output=True,
+            timeout=self.settings.clone_timeout_seconds,
+            check=False,
+        )
+        if result.returncode != 0:
+            raise RuntimeError(f"Git clone failed with OpenSSL fallback: {result.stderr.strip()}")
+
+    def _git_env(self) -> dict[str, str]:
+        return {
+            "GIT_TERMINAL_PROMPT": "0",
+            "HTTP_PROXY": "",
+            "HTTPS_PROXY": "",
+            "ALL_PROXY": "",
+            "http_proxy": "",
+            "https_proxy": "",
+            "all_proxy": "",
+        }

tests/test_repo_crawler.py

@@ -1,6 +1,8 @@
 from pathlib import Path
+from unittest.mock import patch
 
 import pytest
+from git import GitCommandError
 
 from app.config import Settings
 from app.services.repo_crawler import RepoCrawler, validate_github_url
@@ -36,3 +38,37 @@ def test_scan_local_repo_includes_readme_for_docs_agent(tmp_path: Path):
 
     assert result.files[0].path == "README.md"
     assert result.files[0].language == "Markdown"
+
+
+def test_clone_and_scan_omits_gitpython_timeout_on_windows(tmp_path: Path):
+    crawler = RepoCrawler(Settings(max_files=10, max_file_size_kb=1, clone_base_dir=str(tmp_path / "clones")))
+
+    with patch("app.services.repo_crawler.os.name", "nt"), patch(
+        "app.services.repo_crawler.Repo.clone_from"
+    ) as clone_from, patch.object(
+        crawler,
+        "scan_local_repo",
+        return_value=crawler.scan_local_repo("https://github.com/example/project", tmp_path),
+    ):
+        crawler.clone_and_scan("https://github.com/example/project")
+
+    assert "kill_after_timeout" not in clone_from.call_args.kwargs
+    assert clone_from.call_args.kwargs["env"]["HTTPS_PROXY"] == ""
+    assert clone_from.call_args.kwargs["env"]["ALL_PROXY"] == ""
+
+
+def test_clone_and_scan_retries_schannel_failure_with_openssl(tmp_path: Path):
+    crawler = RepoCrawler(Settings(max_files=10, max_file_size_kb=1, clone_base_dir=str(tmp_path / "clones")))
+    schannel_error = GitCommandError("git clone", 128, stderr="schannel: AcquireCredentialsHandle failed")
+
+    with patch("app.services.repo_crawler.os.name", "nt"), patch(
+        "app.services.repo_crawler.Repo.clone_from",
+        side_effect=schannel_error,
+    ), patch.object(crawler, "_clone_repo_with_openssl") as clone_with_openssl, patch.object(
+        crawler,
+        "scan_local_repo",
+        return_value=crawler.scan_local_repo("https://github.com/example/project", tmp_path),
+    ):
+        crawler.clone_and_scan("https://github.com/example/project")
+
+    clone_with_openssl.assert_called_once()