1 files changed, 15 insertions, 5 deletions
diff --git a/internal/executor/container.go b/internal/executor/container.go
index 3afce70..39f737a 100644
--- a/internal/executor/container.go
+++ b/internal/executor/container.go
@@ -155,6 +155,14 @@ func (r *ContainerRunner) Run(ctx context.Context, t *task.Task, e *storage.Exec
 			}
 		}
 	}
+	// For non-story tasks (e.g. CI webhook tasks), also resolve local path from the task's
+	// project field. This lets the runner clone from the local mirror instead of an HTTPS
+	// remote that may require credentials not available on the host.
+	if storyLocalPath == "" && t.Project != "" && r.Store != nil {
+		if proj, err := r.Store.GetProject(t.Project); err == nil && proj != nil && proj.LocalPath != "" {
+			storyLocalPath = proj.LocalPath
+		}
+	}
 	// Fall back to task-level BranchName (e.g. set explicitly by executor or tests).
 	if storyBranch == "" {
 		storyBranch = t.BranchName
@@ -175,13 +183,15 @@ func (r *ContainerRunner) Run(ctx context.Context, t *task.Task, e *storage.Exec
 		if err := os.Remove(workspace); err != nil {
 			return fmt.Errorf("removing workspace before clone: %w", err)
 		}
-		r.Logger.Info("cloning repository", "url", repoURL, "workspace", workspace)
-		var cloneArgs []string
+		// Prefer the local path as the clone source to avoid HTTPS auth requirements.
+		// For story tasks the storyLocalPath is also available as a speed reference,
+		// but we clone from the local path directly since it is already authoritative.
+		cloneSrc := repoURL
 		if storyLocalPath != "" {
-			cloneArgs = []string{"clone", "--reference", storyLocalPath, repoURL, workspace}
-		} else {
-			cloneArgs = []string{"clone", repoURL, workspace}
+			cloneSrc = storyLocalPath
 		}
+		r.Logger.Info("cloning repository", "src", cloneSrc, "workspace", workspace)
+		cloneArgs := []string{"clone", cloneSrc, workspace}
 		if out, err := r.command(ctx, "git", cloneArgs...).CombinedOutput(); err != nil {
 			return fmt.Errorf("git clone failed: %w\n%s", err, string(out))
 		}