From 53808f8d8b2769bcb3c10f196121aa8971696e28 Mon Sep 17 00:00:00 2001
From: Atif Ali <atif@coder.com>
Date: Thu, 22 Oct 2026 14:58:58 +0000
Subject: [PATCH 1/3] feat(coder/git-clone): add additional_args, deprecate
 extra_args

Add an additional_args map of flag to value for `git clone`, matching
the additional_args name used across the registry. Each flag is passed
exactly as written (--long or -s, the admin's choice), followed by its
value as the next argument; an empty value passes the flag alone. -b
and --branch are rejected, since the module sets the branch.

extra_args keeps working unchanged and is appended after
additional_args; it is marked deprecated, for use only where a map
cannot express the arguments (a repeated flag). Bumps to 2.1.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R2TMgCPW8SL8kUCB28L4dt
---
 registry/coder/modules/git-clone/README.md    | 51 +++++++++++--------
 .../modules/git-clone/git-clone.tftest.hcl    | 46 +++++++++++++++++
 registry/coder/modules/git-clone/main.test.ts | 32 ++++++++++++
 registry/coder/modules/git-clone/main.tf      | 26 +++++++++-
 registry/coder/modules/git-clone/run.sh       |  2 +
 5 files changed, 134 insertions(+), 23 deletions(-)

diff --git a/registry/coder/modules/git-clone/README.md b/registry/coder/modules/git-clone/README.md
index 7fa594874..6e7a87e96 100644
--- a/registry/coder/modules/git-clone/README.md
+++ b/registry/coder/modules/git-clone/README.md
@@ -14,7 +14,7 @@ This module allows you to automatically clone a repository by URL and skip if it
 module "git-clone" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/git-clone/coder"
-  version  = "2.0.5"
+  version  = "2.1.0"
   agent_id = coder_agent.example.id
   url      = "https://github.com/coder/coder"
 }
@@ -28,7 +28,7 @@ module "git-clone" {
 module "git-clone" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/git-clone/coder"
-  version  = "2.0.5"
+  version  = "2.1.0"
   agent_id = coder_agent.example.id
   url      = "https://github.com/coder/coder"
   base_dir = "~/projects/coder"
@@ -43,7 +43,7 @@ To use with [Git Authentication](https://coder.com/docs/v2/latest/admin/git-prov
 module "git-clone" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/git-clone/coder"
-  version  = "2.0.5"
+  version  = "2.1.0"
   agent_id = coder_agent.example.id
   url      = "https://github.com/coder/coder"
 }
@@ -70,7 +70,7 @@ data "coder_parameter" "git_repo" {
 module "git_clone" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/git-clone/coder"
-  version  = "2.0.5"
+  version  = "2.1.0"
   agent_id = coder_agent.example.id
   url      = data.coder_parameter.git_repo.value
 }
@@ -105,7 +105,7 @@ Configuring `git-clone` for a self-hosted GitHub Enterprise Server running at `g
 module "git-clone" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/git-clone/coder"
-  version  = "2.0.5"
+  version  = "2.1.0"
   agent_id = coder_agent.example.id
   url      = "https://github.example.com/coder/coder/tree/feat/example"
   git_providers = {
@@ -125,7 +125,7 @@ To GitLab clone with a specific branch like `feat/example`
 module "git-clone" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/git-clone/coder"
-  version  = "2.0.5"
+  version  = "2.1.0"
   agent_id = coder_agent.example.id
   url      = "https://gitlab.com/coder/coder/-/tree/feat/example"
 }
@@ -137,7 +137,7 @@ Configuring `git-clone` for a self-hosted GitLab running at `gitlab.example.com`
 module "git-clone" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/git-clone/coder"
-  version  = "2.0.5"
+  version  = "2.1.0"
   agent_id = coder_agent.example.id
   url      = "https://gitlab.example.com/coder/coder/-/tree/feat/example"
   git_providers = {
@@ -159,7 +159,7 @@ For example, to clone the `feat/example` branch:
 module "git-clone" {
   count       = data.coder_workspace.me.start_count
   source      = "registry.coder.com/coder/git-clone/coder"
-  version     = "2.0.5"
+  version     = "2.1.0"
   agent_id    = coder_agent.example.id
   url         = "https://github.com/coder/coder"
   branch_name = "feat/example"
@@ -177,7 +177,7 @@ For example, this will clone into the `~/projects/coder/coder-dev` folder:
 module "git-clone" {
   count       = data.coder_workspace.me.start_count
   source      = "registry.coder.com/coder/git-clone/coder"
-  version     = "2.0.5"
+  version     = "2.1.0"
   agent_id    = coder_agent.example.id
   url         = "https://github.com/coder/coder"
   folder_name = "coder-dev"
@@ -188,32 +188,41 @@ module "git-clone" {
 ## Extra `git clone` arguments
 
 > [!NOTE]
-> **Upgrading from v1.x?** The `depth` variable was removed in v2.0.0. Use `extra_args = ["--depth=1"]` instead.
+> **Upgrading from v1.x?** The `depth` variable was removed in v2.0.0. Use `additional_args = { "--depth" = "1" }` instead.
+> `additional_args` rejects `-b` and `--branch`; set `branch_name` instead.
 > Do not pass `-b` or `--branch` in `extra_args` when `branch_name` is
 > already set (or extracted from the URL). Git silently accepts the last
 > `-b` flag, so the two values would conflict.
 
-Pass any additional flags through `extra_args` (one element per argument).
+Pass any additional flags through `additional_args`, a map of flag to value.
 This lets you enable anything `git clone` supports without the module having
 to expose it explicitly, for example a shallow clone, submodules, parallel
-fetches, or partial clones.
+fetches, or partial clones. Each flag is passed exactly as written, so use
+`--name` or `-n` as `git clone` expects, followed by its value as the next
+argument; an empty value passes the flag alone. Terraform orders map keys
+alphabetically.
 
 ```tf
 module "git-clone" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/git-clone/coder"
-  version  = "2.0.5"
+  version  = "2.1.0"
   agent_id = coder_agent.example.id
   url      = "https://github.com/coder/coder"
-  extra_args = [
-    "--depth=1",
-    "--recurse-submodules",
-    "--jobs=8",
-    "--filter=blob:none",
-  ]
+  additional_args = {
+    "--depth"              = "1"
+    "--recurse-submodules" = ""
+    "--jobs"               = "8"
+    "--filter"             = "blob:none"
+  }
 }
 ```
 
+`extra_args` (a list, one element per argument) is deprecated in favor of
+`additional_args` but still works, and is appended after `additional_args`.
+Use it only for what a map cannot express, such as a flag repeated more than
+once.
+
 ## Pre-clone script
 
 Run a custom script before cloning the repository by setting the `pre_clone_script` variable.
@@ -223,7 +232,7 @@ This is useful for preparing the environment or validating prerequisites before
 module "git-clone" {
   count            = data.coder_workspace.me.start_count
   source           = "registry.coder.com/coder/git-clone/coder"
-  version          = "2.0.5"
+  version          = "2.1.0"
   agent_id         = coder_agent.example.id
   url              = "https://github.com/coder/coder"
   pre_clone_script = <<-EOT
@@ -246,7 +255,7 @@ This is useful for running initialization tasks like installing dependencies or
 module "git-clone" {
   count             = data.coder_workspace.me.start_count
   source            = "registry.coder.com/coder/git-clone/coder"
-  version           = "2.0.5"
+  version           = "2.1.0"
   agent_id          = coder_agent.example.id
   url               = "https://github.com/coder/coder"
   post_clone_script = <<-EOT
diff --git a/registry/coder/modules/git-clone/git-clone.tftest.hcl b/registry/coder/modules/git-clone/git-clone.tftest.hcl
index 7943bd6be..ff7a7fc0c 100644
--- a/registry/coder/modules/git-clone/git-clone.tftest.hcl
+++ b/registry/coder/modules/git-clone/git-clone.tftest.hcl
@@ -77,3 +77,49 @@ run "skips_clone_script_for_whitespace_url" {
     error_message = "folder_name and repo_dir should be empty when there is no repository and no folder name"
   }
 }
+
+run "deprecated_extra_args_still_applied" {
+  command = plan
+
+  variables {
+    agent_id        = "foo"
+    url             = "https://github.com/coder/coder"
+    additional_args = { "--depth" = "1", "--recurse-submodules" = "", "-c" = "core.sshCommand=ssh -i /tmp/key" }
+    extra_args      = ["--jobs=8"]
+  }
+
+  # Map keys sort byte-wise, so --flags come before -f flags.
+  assert {
+    condition     = local.additional_args == ["--depth", "1", "--recurse-submodules", "-c", "core.sshCommand=ssh -i /tmp/key"]
+    error_message = "each flag must be passed as written, followed by its value unless the value is empty"
+  }
+
+  assert {
+    condition     = local.encoded_extra_args == base64encode("--depth\n1\n--recurse-submodules\n-c\ncore.sshCommand=ssh -i /tmp/key\n--jobs=8")
+    error_message = "extra_args must still be passed, after additional_args"
+  }
+}
+
+run "additional_args_rejects_bad_flag" {
+  command = plan
+
+  variables {
+    agent_id        = "foo"
+    url             = "https://github.com/coder/coder"
+    additional_args = { "depth" = "1" }
+  }
+
+  expect_failures = [var.additional_args]
+}
+
+run "additional_args_rejects_branch" {
+  command = plan
+
+  variables {
+    agent_id        = "foo"
+    url             = "https://github.com/coder/coder"
+    additional_args = { "--branch" = "main" }
+  }
+
+  expect_failures = [var.additional_args]
+}
diff --git a/registry/coder/modules/git-clone/main.test.ts b/registry/coder/modules/git-clone/main.test.ts
index d906f5ad5..8eaf0cd21 100644
--- a/registry/coder/modules/git-clone/main.test.ts
+++ b/registry/coder/modules/git-clone/main.test.ts
@@ -417,6 +417,38 @@ describe("git-clone", async () => {
     );
   });
 
+  it("passes additional_args to git clone before extra_args", async () => {
+    const state = await runTerraformApply(import.meta.dir, {
+      agent_id: "foo",
+      url: "fake-url",
+      additional_args: JSON.stringify({
+        "--recurse-submodules": "",
+        "--config": "user.name=Coder User",
+        "-c": "core.sshCommand=ssh -i /tmp/key",
+      }),
+      extra_args: JSON.stringify(["--jobs=8"]),
+    });
+    const output = await executeScriptInContainer(
+      state,
+      "alpine/git",
+      installFakeGit,
+    );
+    expect(output.exitCode).toBe(0);
+    expect(output.stdout.join("\n")).toContain(
+      [
+        "argv:clone",
+        "argv:--config",
+        "argv:user.name=Coder User",
+        "argv:--recurse-submodules",
+        "argv:-c",
+        "argv:core.sshCommand=ssh -i /tmp/key",
+        "argv:--jobs=8",
+        "argv:fake-url",
+        "argv:/root/fake-url",
+      ].join("\n"),
+    );
+  });
+
   it("passes extra_args alongside branch_name in the correct order", async () => {
     const state = await runTerraformApply(import.meta.dir, {
       agent_id: "foo",
diff --git a/registry/coder/modules/git-clone/main.tf b/registry/coder/modules/git-clone/main.tf
index bf7146ecf..ae01477bc 100644
--- a/registry/coder/modules/git-clone/main.tf
+++ b/registry/coder/modules/git-clone/main.tf
@@ -56,8 +56,26 @@ variable "folder_name" {
   default     = ""
 }
 
+variable "additional_args" {
+  description = "Additional flags to pass to `git clone`, as a map of flag to value. Each flag is passed as written (e.g. `--depth` or `-c`) followed by its value as the next argument; an empty value passes the flag alone (e.g. `{ \"--depth\" = \"1\", \"--recurse-submodules\" = \"\" }`)."
+  type        = map(string)
+  default     = {}
+
+  validation {
+    condition     = alltrue([for k, v in var.additional_args : can(regex("^--?[A-Za-z0-9][A-Za-z0-9._-]*$", k)) && !can(regex("\n", v))])
+    error_message = "additional_args keys must be flags such as --name or -n (letters, digits, '.', '_', '-'), and values must not contain newlines."
+  }
+
+  # The module already sets the branch from branch_name or the URL. Keep this
+  # list in sync with the `git clone` flags in run.sh.
+  validation {
+    condition     = length(setintersection(keys(var.additional_args), ["-b", "--branch"])) == 0
+    error_message = "additional_args must not set -b or --branch; use branch_name instead."
+  }
+}
+
 variable "extra_args" {
-  description = "Extra arguments to pass to `git clone`, one element per argument (e.g. `[\"--recurse-submodules\", \"--jobs=8\", \"--filter=blob:none\"]`)."
+  description = "Deprecated: use `additional_args` instead. Still honored and appended after `additional_args`; use it only for arguments a flag map cannot express, such as a repeated flag."
   type        = list(string)
   default     = []
 }
@@ -75,6 +93,10 @@ variable "pre_clone_script" {
 }
 
 locals {
+  # Render additional_args as argv: each key as written, followed by its
+  # value as a separate argument unless the value is empty.
+  additional_args = flatten([for k, v in var.additional_args : v == "" ? [k] : [k, v]])
+
   # Remove query parameters and fragments from the URL
   url = replace(replace(var.url, "/\\?.*/", ""), "/#.*/", "")
 
@@ -99,7 +121,7 @@ locals {
   encoded_post_clone_script = var.post_clone_script != null ? base64encode(var.post_clone_script) : ""
   # Encode the pre_clone_script for passing to the shell script
   encoded_pre_clone_script = var.pre_clone_script != null ? base64encode(var.pre_clone_script) : ""
-  encoded_extra_args       = base64encode(join("\n", var.extra_args))
+  encoded_extra_args       = base64encode(join("\n", concat(local.additional_args, var.extra_args)))
 
   # Module directory paths (matches coder-utils convention)
   # Use folder_name so two git-clone instances in the same template get
diff --git a/registry/coder/modules/git-clone/run.sh b/registry/coder/modules/git-clone/run.sh
index b9d2ff83a..9b6e5e1ca 100644
--- a/registry/coder/modules/git-clone/run.sh
+++ b/registry/coder/modules/git-clone/run.sh
@@ -118,6 +118,8 @@ if [ -z "$(ls -A "$CLONE_PATH")" ]; then
     git clone $${extra_args[@]+"$${extra_args[@]}"} "$REPO_URL" "$CLONE_PATH"
   else
     echo "Cloning $REPO_URL to $CLONE_PATH on branch $BRANCH_NAME..."
+    # Keep -b in sync with the reserved-flag list in additional_args'
+    # validation in main.tf, so additional_args cannot set it a second time.
     git clone $${extra_args[@]+"$${extra_args[@]}"} -b "$BRANCH_NAME" "$REPO_URL" "$CLONE_PATH"
   fi
 else

From 4b04dd606a15e80b2b13fc08a6b1b3cfe4229c3a Mon Sep 17 00:00:00 2001
From: Atif Ali <atif@coder.com>
Date: Thu, 22 Oct 2026 15:03:26 +0000
Subject: [PATCH 2/3] test(coder/git-clone): raise test timeout to 60s

The first tests to use the alpine and alpine/git images pull them, which
outlasts bun's 5s default on a cold CI runner ("fails without git" and
"runs with git" timed out). Matches the 60s other modules use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R2TMgCPW8SL8kUCB28L4dt
---
 registry/coder/modules/git-clone/main.test.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/registry/coder/modules/git-clone/main.test.ts b/registry/coder/modules/git-clone/main.test.ts
index 8eaf0cd21..e6cbd3b9b 100644
--- a/registry/coder/modules/git-clone/main.test.ts
+++ b/registry/coder/modules/git-clone/main.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it } from "bun:test";
+import { describe, expect, it, setDefaultTimeout } from "bun:test";
 import {
   execContainer,
   findResourceInstance,
@@ -10,6 +10,9 @@ import {
   type TerraformState,
 } from "~test";
 
+// The first test to use an image pulls it, which can outlast bun's 5s default.
+setDefaultTimeout(60 * 1000);
+
 const executeScriptInContainer = async (
   state: TerraformState,
   image: string,

From 289f6b0022a244bb65335273be1033f75424e067 Mon Sep 17 00:00:00 2001
From: Atif Ali <atif@coder.com>
Date: Fri, 23 Oct 2026 03:05:09 +0000
Subject: [PATCH 3/3] feat(coder/git-clone): make additional_args a list of
 strings

Per review on coder/registry#1202, a map cannot repeat a flag (a
repeated key silently keeps only the last value). additional_args is now
a list with one element per argument, passed in order, the same type as
the extra_args it replaces, so migrating is a rename. -b and --branch
are still rejected, with or without =value.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R2TMgCPW8SL8kUCB28L4dt
---
 registry/coder/modules/git-clone/README.md    | 33 +++++++++----------
 .../modules/git-clone/git-clone.tftest.hcl    | 17 ++++------
 registry/coder/modules/git-clone/main.test.ts | 16 +++++----
 registry/coder/modules/git-clone/main.tf      | 20 +++++------
 4 files changed, 38 insertions(+), 48 deletions(-)

diff --git a/registry/coder/modules/git-clone/README.md b/registry/coder/modules/git-clone/README.md
index 6e7a87e96..cb0fcec3f 100644
--- a/registry/coder/modules/git-clone/README.md
+++ b/registry/coder/modules/git-clone/README.md
@@ -188,19 +188,18 @@ module "git-clone" {
 ## Extra `git clone` arguments
 
 > [!NOTE]
-> **Upgrading from v1.x?** The `depth` variable was removed in v2.0.0. Use `additional_args = { "--depth" = "1" }` instead.
+> **Upgrading from v1.x?** The `depth` variable was removed in v2.0.0. Use `additional_args = ["--depth", "1"]` instead.
 > `additional_args` rejects `-b` and `--branch`; set `branch_name` instead.
 > Do not pass `-b` or `--branch` in `extra_args` when `branch_name` is
 > already set (or extracted from the URL). Git silently accepts the last
 > `-b` flag, so the two values would conflict.
 
-Pass any additional flags through `additional_args`, a map of flag to value.
-This lets you enable anything `git clone` supports without the module having
-to expose it explicitly, for example a shallow clone, submodules, parallel
-fetches, or partial clones. Each flag is passed exactly as written, so use
-`--name` or `-n` as `git clone` expects, followed by its value as the next
-argument; an empty value passes the flag alone. Terraform orders map keys
-alphabetically.
+Pass any additional arguments through `additional_args`, a list with one
+element per argument. This lets you enable anything `git clone` supports
+without the module having to expose it explicitly, for example a shallow
+clone, submodules, parallel fetches, or partial clones. Each element is passed
+exactly as written and in order, so a flag can repeat and a value can contain
+spaces.
 
 ```tf
 module "git-clone" {
@@ -209,19 +208,17 @@ module "git-clone" {
   version  = "2.1.0"
   agent_id = coder_agent.example.id
   url      = "https://github.com/coder/coder"
-  additional_args = {
-    "--depth"              = "1"
-    "--recurse-submodules" = ""
-    "--jobs"               = "8"
-    "--filter"             = "blob:none"
-  }
+  additional_args = [
+    "--depth", "1",
+    "--recurse-submodules",
+    "--jobs", "8",
+    "--filter", "blob:none",
+  ]
 }
 ```
 
-`extra_args` (a list, one element per argument) is deprecated in favor of
-`additional_args` but still works, and is appended after `additional_args`.
-Use it only for what a map cannot express, such as a flag repeated more than
-once.
+`extra_args` is deprecated in favor of `additional_args`, which takes the same
+list. It still works and is appended after `additional_args`.
 
 ## Pre-clone script
 
diff --git a/registry/coder/modules/git-clone/git-clone.tftest.hcl b/registry/coder/modules/git-clone/git-clone.tftest.hcl
index ff7a7fc0c..519ccb7c2 100644
--- a/registry/coder/modules/git-clone/git-clone.tftest.hcl
+++ b/registry/coder/modules/git-clone/git-clone.tftest.hcl
@@ -84,29 +84,24 @@ run "deprecated_extra_args_still_applied" {
   variables {
     agent_id        = "foo"
     url             = "https://github.com/coder/coder"
-    additional_args = { "--depth" = "1", "--recurse-submodules" = "", "-c" = "core.sshCommand=ssh -i /tmp/key" }
+    additional_args = ["--depth", "1", "-c", "http.extraHeader=X-A: 1", "-c", "http.extraHeader=X-B: 2"]
     extra_args      = ["--jobs=8"]
   }
 
-  # Map keys sort byte-wise, so --flags come before -f flags.
+  # additional_args keeps its order and repeated flags, then extra_args follows.
   assert {
-    condition     = local.additional_args == ["--depth", "1", "--recurse-submodules", "-c", "core.sshCommand=ssh -i /tmp/key"]
-    error_message = "each flag must be passed as written, followed by its value unless the value is empty"
-  }
-
-  assert {
-    condition     = local.encoded_extra_args == base64encode("--depth\n1\n--recurse-submodules\n-c\ncore.sshCommand=ssh -i /tmp/key\n--jobs=8")
+    condition     = local.encoded_extra_args == base64encode("--depth\n1\n-c\nhttp.extraHeader=X-A: 1\n-c\nhttp.extraHeader=X-B: 2\n--jobs=8")
     error_message = "extra_args must still be passed, after additional_args"
   }
 }
 
-run "additional_args_rejects_bad_flag" {
+run "additional_args_rejects_newline" {
   command = plan
 
   variables {
     agent_id        = "foo"
     url             = "https://github.com/coder/coder"
-    additional_args = { "depth" = "1" }
+    additional_args = ["--depth\n1"]
   }
 
   expect_failures = [var.additional_args]
@@ -118,7 +113,7 @@ run "additional_args_rejects_branch" {
   variables {
     agent_id        = "foo"
     url             = "https://github.com/coder/coder"
-    additional_args = { "--branch" = "main" }
+    additional_args = ["--branch=main"]
   }
 
   expect_failures = [var.additional_args]
diff --git a/registry/coder/modules/git-clone/main.test.ts b/registry/coder/modules/git-clone/main.test.ts
index e6cbd3b9b..dfad4d83f 100644
--- a/registry/coder/modules/git-clone/main.test.ts
+++ b/registry/coder/modules/git-clone/main.test.ts
@@ -424,11 +424,13 @@ describe("git-clone", async () => {
     const state = await runTerraformApply(import.meta.dir, {
       agent_id: "foo",
       url: "fake-url",
-      additional_args: JSON.stringify({
-        "--recurse-submodules": "",
-        "--config": "user.name=Coder User",
-        "-c": "core.sshCommand=ssh -i /tmp/key",
-      }),
+      additional_args: JSON.stringify([
+        "--recurse-submodules",
+        "-c",
+        "user.name=Coder User",
+        "-c",
+        "core.sshCommand=ssh -i /tmp/key",
+      ]),
       extra_args: JSON.stringify(["--jobs=8"]),
     });
     const output = await executeScriptInContainer(
@@ -440,10 +442,10 @@ describe("git-clone", async () => {
     expect(output.stdout.join("\n")).toContain(
       [
         "argv:clone",
-        "argv:--config",
-        "argv:user.name=Coder User",
         "argv:--recurse-submodules",
         "argv:-c",
+        "argv:user.name=Coder User",
+        "argv:-c",
         "argv:core.sshCommand=ssh -i /tmp/key",
         "argv:--jobs=8",
         "argv:fake-url",
diff --git a/registry/coder/modules/git-clone/main.tf b/registry/coder/modules/git-clone/main.tf
index ae01477bc..d9a32c7c7 100644
--- a/registry/coder/modules/git-clone/main.tf
+++ b/registry/coder/modules/git-clone/main.tf
@@ -57,25 +57,25 @@ variable "folder_name" {
 }
 
 variable "additional_args" {
-  description = "Additional flags to pass to `git clone`, as a map of flag to value. Each flag is passed as written (e.g. `--depth` or `-c`) followed by its value as the next argument; an empty value passes the flag alone (e.g. `{ \"--depth\" = \"1\", \"--recurse-submodules\" = \"\" }`)."
-  type        = map(string)
-  default     = {}
+  description = "Additional arguments to pass to `git clone`, one list element per argument, in order (e.g. `[\"--depth\", \"1\", \"--recurse-submodules\", \"-c\", \"http.extraHeader=X-A: 1\", \"-c\", \"http.extraHeader=X-B: 2\"]`). Each element is passed as written, so a flag can repeat and a value may contain spaces."
+  type        = list(string)
+  default     = []
 
   validation {
-    condition     = alltrue([for k, v in var.additional_args : can(regex("^--?[A-Za-z0-9][A-Za-z0-9._-]*$", k)) && !can(regex("\n", v))])
-    error_message = "additional_args keys must be flags such as --name or -n (letters, digits, '.', '_', '-'), and values must not contain newlines."
+    condition     = alltrue([for a in var.additional_args : a != "" && !can(regex("\n", a))])
+    error_message = "additional_args elements must be non-empty and must not contain newlines."
   }
 
   # The module already sets the branch from branch_name or the URL. Keep this
   # list in sync with the `git clone` flags in run.sh.
   validation {
-    condition     = length(setintersection(keys(var.additional_args), ["-b", "--branch"])) == 0
+    condition     = !anytrue([for a in var.additional_args : contains(["-b", "--branch"], split("=", a)[0])])
     error_message = "additional_args must not set -b or --branch; use branch_name instead."
   }
 }
 
 variable "extra_args" {
-  description = "Deprecated: use `additional_args` instead. Still honored and appended after `additional_args`; use it only for arguments a flag map cannot express, such as a repeated flag."
+  description = "Deprecated: use `additional_args` instead, which takes the same list. Still honored and appended after `additional_args`."
   type        = list(string)
   default     = []
 }
@@ -93,10 +93,6 @@ variable "pre_clone_script" {
 }
 
 locals {
-  # Render additional_args as argv: each key as written, followed by its
-  # value as a separate argument unless the value is empty.
-  additional_args = flatten([for k, v in var.additional_args : v == "" ? [k] : [k, v]])
-
   # Remove query parameters and fragments from the URL
   url = replace(replace(var.url, "/\\?.*/", ""), "/#.*/", "")
 
@@ -121,7 +117,7 @@ locals {
   encoded_post_clone_script = var.post_clone_script != null ? base64encode(var.post_clone_script) : ""
   # Encode the pre_clone_script for passing to the shell script
   encoded_pre_clone_script = var.pre_clone_script != null ? base64encode(var.pre_clone_script) : ""
-  encoded_extra_args       = base64encode(join("\n", concat(local.additional_args, var.extra_args)))
+  encoded_extra_args       = base64encode(join("\n", concat(var.additional_args, var.extra_args)))
 
   # Module directory paths (matches coder-utils convention)
   # Use folder_name so two git-clone instances in the same template get