docs,config: aggiorna AGENTS.md, config.example, HOST-SETUP.md, checklist faseA e fix vari orchestrator (workstation, build, job, wait, winrm, test)

src/ci_orchestrator/backends/workstation.py

@@ -121,11 +121,16 @@ class WorkstationVmrunBackend:
         args: list[str] = [handle.identifier]
         if timeout > 0:
             args.extend(["-wait"])
-        result = self._run("getGuestIPAddress", *args, check=False, timeout=timeout or None)
+        try:
+            result = self._run("getGuestIPAddress", *args, check=False, timeout=timeout or None)
+        except subprocess.TimeoutExpired:
+            return None
         if result.returncode != 0:
             return None
         ip = (result.stdout or "").strip()
-        return ip or None
+        if not ip or ip.lower().startswith("error:"):
+            return None
+        return ip
 
     def list_snapshots(self, handle: VmHandle) -> list[str]:
         result = self._run("listSnapshots", handle.identifier)

src/ci_orchestrator/commands/build.py

@@ -144,6 +144,7 @@ def _linux_build(
         elif clone_url:
             click.echo(f"[build run] cloning {clone_url} into guest:{workdir}")
             cmd = (
+                f"GIT_TERMINAL_PROMPT=0 "
                 f"git clone --depth 1 --branch {_sh_quote(clone_branch)} "
                 f"{'--recurse-submodules ' if clone_submodules else ''}"
                 f"{_sh_quote(clone_url)} {_sh_quote(workdir)}"
@@ -314,12 +315,14 @@ def _windows_build(
             f"$src = {src_expr}; "
             f"$zip = {_ps_quote(artifact_zip)}; "
             "if (-not (Test-Path $src)) { "
-            "  Write-Host \"[build run] artifact source not found: $src\"; "
-            "  exit 2 } ; "
+            "  throw \"[build run] artifact source not found: $src\" }; "
             "$dir = Split-Path $zip -Parent; "
             "if (-not (Test-Path $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null }; "
             "if (Test-Path $zip) { Remove-Item $zip -Force }; "
-            "Compress-Archive -Path (Join-Path $src '*') -DestinationPath $zip -Force"
+            "if (Test-Path $src -PathType Leaf) { "
+            "  Compress-Archive -Path $src -DestinationPath $zip -Force "
+            "} else { "
+            "  Compress-Archive -Path (Join-Path $src '*') -DestinationPath $zip -Force }"
         )
         t.run(pkg_ps)
         click.echo(f"[build run] artifact written to {artifact_zip}")

src/ci_orchestrator/commands/job.py

@@ -135,14 +135,14 @@ def _wait_running(
 def _wait_for_ip(
     backend: VmBackend, handle: VmHandle, deadline: float, poll: float
 ) -> str | None:
-    while _now() < deadline:
+    while (now := _now()) < deadline:
+        call_timeout = min(poll, deadline - now)
         try:
-            ip = backend.get_ip(handle)
+            ip = backend.get_ip(handle, timeout=call_timeout)
         except BackendError:
             ip = None
         if ip:
             return ip
-        time.sleep(poll)
     return None
 
 
@@ -328,7 +328,22 @@ def job(
     """
     # Reserved for future host-side clone variant; the Python port always
     # provisions sources via in-guest ``git clone``.
-    del submodules, use_git_clone, gitea_credential_target
+    del submodules, use_git_clone
+
+    # Inject Gitea credentials into HTTP(S) clone URL so git doesn't prompt.
+    authed_repo_url = repo_url
+    if repo_url and repo_url.startswith(("http://", "https://")):
+        from urllib.parse import urlparse, urlunparse
+
+        try:
+            gitea_cred = KeyringCredentialStore().get(gitea_credential_target)
+            parsed = urlparse(repo_url)
+            host = parsed.hostname or ""
+            port_part = f":{parsed.port}" if parsed.port else ""
+            netloc = f"{gitea_cred.username}:{gitea_cred.password}@{host}{port_part}"
+            authed_repo_url = urlunparse(parsed._replace(netloc=netloc))
+        except Exception:
+            pass  # no credential stored — try unauthenticated (public repo)
 
     config: Config = load_config()
     if not template_path:
@@ -463,7 +478,7 @@ def job(
                 workdir="/opt/ci/build",
                 output_dir="/opt/ci/output",
                 host_source_dir=None,
-                clone_url=repo_url,
+                clone_url=authed_repo_url,
                 clone_branch=branch,
                 clone_commit=commit,
                 clone_submodules=False,
@@ -479,7 +494,7 @@ def job(
                 workdir="C:\\CI\\build",
                 artifact_zip="C:\\CI\\output\\artifacts.zip",
                 host_source_dir=None,
-                clone_url=repo_url,
+                clone_url=authed_repo_url,
                 clone_branch=branch,
                 clone_commit=commit,
                 clone_submodules=False,

src/ci_orchestrator/commands/wait.py

@@ -61,14 +61,14 @@ def _wait_running(
 def _wait_for_ip(
     backend: VmBackend, handle: VmHandle, deadline: float, poll: float
 ) -> str | None:
-    while time.monotonic() < deadline:
+    while (now := time.monotonic()) < deadline:
+        call_timeout = min(poll, deadline - now)
         try:
-            ip = backend.get_ip(handle)
+            ip = backend.get_ip(handle, timeout=call_timeout)
         except BackendError:
             ip = None
         if ip:
             return ip
-        time.sleep(poll)
     return None
 
 
@@ -153,6 +153,7 @@ def wait_ready(
         sys.exit(_EXIT_TIMEOUT_RUNNING)
 
     if ip_address is None:
+        click.echo("[wait-ready] waiting for guest IP (VMware Tools must be running)...")
         ip = _wait_for_ip(backend, handle, deadline, poll_interval)
         if not ip:
             click.echo("[wait-ready] timeout waiting for guest IP.", err=True)

src/ci_orchestrator/transport/winrm.py

@@ -116,11 +116,15 @@ class WinRmTransport:
             stdout, stderr, returncode = client.execute_ps(script)
         except Exception as exc:
             raise TransportConnectError(f"WinRM execute_ps failed: {exc}") from exc
-        # pypsrp returns stderr as a list of PSRP error records in some versions;
-        # normalise to a string.
+        # pypsrp returns stderr as a PSDataStreams object (newer versions) or a
+        # list of error records (older versions); normalise to a plain string.
         stderr_any: Any = stderr
         if isinstance(stderr_any, str):
             stderr_str = stderr_any
+        elif hasattr(stderr_any, "error"):
+            # PSDataStreams — extract .error records.
+            error_records = getattr(stderr_any, "error", None) or []
+            stderr_str = "\n".join(str(e) for e in error_records)
         else:
             try:
                 stderr_str = "\n".join(str(s) for s in stderr_any)