[nateEc]

Problem and scope

Fixes https://git.cafe/pingdotgg/t3code/issues/23044. T3 deliberately clears askpass variables during background and workspace-preparation fetches to avoid interactive prompts. In environments such as Coder, an inherited GIT_ASKPASS can instead be the existing non-interactive credential source; clearing it makes worktree preparation fail before the agent starts.

This is a focused configuration option for an established capability under CONTRIBUTING.md: no new credential store, provider, workflow, or default change. Set T3CODE_GIT_PRESERVE_ASKPASS=1 in the server environment to preserve its inherited Git askpass helper for both fetch paths. Unset/other values retain today's behavior. Terminal prompting, GCM interaction, and SSH askpass remain disabled. Documentation warns that the operator must choose a trusted non-interactive helper; T3 cannot stop an opted-in helper from opening its own dialog.

Git documents askpass independently of terminal prompting in gitcredentials and GIT_TERMINAL_PROMPT.

Verification

The new integration test uses real Git, a throwaway repository, a loopback HTTP endpoint requiring fixture-only Basic credentials, and a disposable askpass script. Repository configuration disables the developer's credential helpers and proxy. No real credentials or external repository are used.

• Before: the opted-in fetch still failed with Git could not authenticate with the remote (exit 128).
• After: default fetch fails without invoking the helper; opt-in fetch succeeds and stores the expected remote commit; explicit 0 disables the helper again. The existing background-fetch environment test now covers both opt-in states and verifies that the other four non-interactive controls stay unchanged.
• vp test run apps/server/src/vcs/GitVcsDriverCore.test.ts: all 165 tests pass via check:changed.
• vp run check:changed: formatting, lint, knip, GraphQL validation, scoped typechecks, and the affected test file all pass. Existing unrelated lint warnings remain unchanged.
• Tested on macOS arm64, Node 26.12.1, Git 2.50.1. The real helper integration is POSIX-only and skipped on Windows. No native Windows or actual Coder deployment claim.

This is server-side fetch configuration; no web, desktop, or mobile rendering changes or UI screenshots are needed. All clients that request workspace preparation use the same server path.

Model: GPT-5-based Codex. Harness: Codex desktop app.

Fixes #23044

[macroscopeapp]

Approvability

Verdict: Approved at d659634

Macroscope's review found this PR approvable — Adds an explicit opt-in for background and workspace Git fetches to retain a server-configured credential helper. Existing defaults and other prompt restrictions remain unchanged, with documentation requiring a non-interactive helper.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: d659634

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• Resume reviews
• Trigger review

No actionable comments were generated in the recent review.

Walkthrough

The server adds T3CODE_GIT_PRESERVE_ASKPASS for background status fetches and remote fetches. When set to "1", the fetch environment retains the inherited GIT_ASKPASS; otherwise, the existing non-interactive environment remains in use.

Changes: Git askpass refresh environment

Layer / File(s)	Summary
Refresh environment and fetch coverage apps/server/src/vcs/GitVcsDriverCore.ts, apps/server/src/vcs/GitVcsDriverCore.test.ts	When the setting is "1", the refresh environment retains the inherited GIT_ASKPASS value, or uses an empty string if it is unset. Background status fetches and remote fetches use this environment. Tests check both setting values and verify the non-interactive prompt settings.
Setting documentation docs/user/source-control.md	The documentation describes the opt-in setting, the fetches that use it, the default behavior, and the restriction against helpers that open dialogs.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature · Severity of issue fixed: Medium

Possibly related PRs

• pingdotgg/t3code#32312: Renames the non-interactive environment constant used by the status refresh and fetchRemote paths.
• pingdotgg/t3code#34042: Removes fetchRemote, which this change updates and tests.

Suggested reviewers: juliusmarminge, maria-rcks

Merge Risk: Minimal · up to d6596

This adds an opt-in setting to keep a trusted non-interactive askpass helper for background and workspace-preparation fetches. Default behavior is unchanged. No merge-blocking risk was found.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title "fix(git): allow opting into a non-interactive askpass helper" matches the main change. The PR adds the T3CODE_GIT_PRESERVE_ASKPASS=1 option, which keeps an inherited GIT_ASKPASS for backgro…
Description check		The description follows the repository template. It has a Problem section that explains the failure in Coder environments and the expected behavior. It has a Change section that describes the T3CODE_G…
Linked Issues check		[#23044] The reviewed head adds an opt-in path. upstreamRefreshEnvironment in apps/server/src/vcs/GitVcsDriverCore.ts keeps inherited GIT_ASKPASS only when T3CODE_GIT_PRESERVE_ASKPASS is exact…
Out of Scope Changes check		[#23044] The changed files support the requested option. The environment selector change in GitVcsDriverCore.ts implements the opt-in. The test changes verify the selector and the authenticated fetc…

Full details: Title check

Explanation

The title "fix(git): allow opting into a non-interactive askpass helper" matches the main change. The PR adds the T3CODE_GIT_PRESERVE_ASKPASS=1 option, which keeps an inherited GIT_ASKPASS for background and workspace-preparation fetches. It is concise, follows the conventional commit style, and is specific enough for a teammate scanning history.

Full details: Description check

Explanation

The description follows the repository template. It has a Problem section that explains the failure in Coder environments and the expected behavior. It has a Change section that describes the T3CODE_GIT_PRESERVE_ASKPASS=1 option. It links issue #23044 under Scope and explains why it is a configuration option for an existing capability. The Verification section lists the focused tests, the real-Git integration test, the check runs, the platforms tested, and the untested areas. It also states the model and harness. The template's Scope section asks for a bug fix, and the description frames this as one, so the scope is covered.

Full details: Linked Issues check

Explanation

[#23044] The reviewed head adds an opt-in path. upstreamRefreshEnvironment in apps/server/src/vcs/GitVcsDriverCore.ts keeps inherited GIT_ASKPASS only when T3CODE_GIT_PRESERVE_ASKPASS is exactly "1". Otherwise it uses the existing non-interactive environment, which sets GIT_ASKPASS="". Both background status refreshes and fetchRemote use this path, so the requested scope (workspace preparation and background fetches) is covered. GCM_INTERACTIVE=never, GIT_TERMINAL_PROMPT=0, SSH_ASKPASS="", and SSH_ASKPASS_REQUIRE=never remain unchanged, as the issue requires. The default behavior is preserved. docs/user/source-control.md documents the option and the requirement to use a non-dialog helper. The updated GitVcsDriverCore.test.ts test covers both option states for both fetch paths, and a real-Git integration case covers the authenticated fetch. Pass/fail counts and the Linux VM validation are author-reported. I did not re-run them, but the code and test changes match the stated behavior.

Full details: Out of Scope Changes check

Explanation

[#23044] The changed files support the requested option. The environment selector change in GitVcsDriverCore.ts implements the opt-in. The test changes verify the selector and the authenticated fetch path. The documentation change describes the option and its trust requirement. The summaries identify no unrelated production code, API declarations, or UI changes. The objectives text mentions test-import conflict resolution, an obsolete NodeOS import removal, and a TMPDIR adjustment used for a macOS test run. These are test-maintenance items. They do not appear as production changes in the reviewed summaries, so they are not treated as demonstrated out-of-scope work. Source-level confirmation of these test-only items relies on the summaries and was not separately inspected.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: main
• File: .coderabbit.config.ts
• Commit: 39ab6a2
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: eae6cf7b-233f-4c1e-b56e-f93fdf394492

Commits

Reviewing files that changed from the base of the PR and between 4369f5d and d659634.

Files selected for processing: 3

• apps/server/src/vcs/GitVcsDriverCore.test.ts
• apps/server/src/vcs/GitVcsDriverCore.ts
• docs/user/source-control.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 4 remain after this review.

[maria-rcks]

Note

Written by claude-opus-5-5 on behalf of Maria

merged current main (67eebaca23) into the original branch at b34f69285a, without rebasing. the production fix and docs are unchanged.

one conflict, in GitVcsDriverCore.test.ts: main moved the background-fetch test from mutating process.env to providing HostProcess.Environment. the resolution keeps this PR's preserve askpass: false/true cases in main's style. the authenticated fetch test now also spreads the host environment, since the git child env is now built from HostProcess.Environment and would otherwise lose PATH.

verification:

• blacksmith vp test run apps/server/src/vcs/GitVcsDriverCore.test.ts: 239 passed, including the 3 askpass cases.
• blacksmith vp run check:changed against main: format, lint, knip, graphql, typecheck (3 packages), and 241 tests pass.

earlier verification from the prior round (real dev server, private https remote, codex turn) still describes the unchanged production code. unverified: native windows and an actual coder deployment.

[maria-rcks]

Note

Written by gpt-6.1-sol on behalf of Maria

Verified in a real dev environment

verified as-is at c3b9eb77544f0f9a2c6db227864243e2ee14dec2 on a disposable linux vm. installed main and the exact pr head with vp i, and ran their real dev servers sequentially with isolated state. drove the web app using the repository’s playwright and /usr/bin/google-chrome. no mocks, fixtures, replay provider, or seeded data.

added a project through the app pointing at a real private github repository with configured credential helpers disabled and a trusted inherited askpass helper. selected codex gpt-6.1-sol, new worktree, and “from main (remote)”.

• github/main (80a2351fcb) with the option enabled: workspace fetch failed with “git could not authenticate with the remote”; the helper was never invoked and the provider never started.
• exact pr head with T3CODE_GIT_PRESERVE_ASKPASS=1: authenticated fetch and worktree creation succeeded. a real codex turn read the readme and returned the worktree branch and expected commit. no files changed.
• neighboring current-checkout flow: a second real codex turn ran git status and rev-parse, reporting a clean checkout and the expected commit.
• background refresh: subsequent helper invocations occurred against the real https remote while no workspace preparation was running. helper logs confirmed GIT_TERMINAL_PROMPT=0, GCM_INTERACTIVE=never, empty SSH_ASKPASS, and SSH_ASKPASS_REQUIRE=never.
• restarted with the option unset: workspace fetch failed again with zero helper invocations. re-enabled it, restarted, and clicked retry on that failed thread: worktree creation and a real codex turn completed successfully.
• blacksmith ran vp i && vp test run apps/server/src/vcs/GitVcsDriverCore.test.ts: all 200 tests passed. existing head ci reports 32 successful checks. no source changes or pushes were needed.

main, same repository and prompt:

pr, same repository and prompt:

retrying the failed thread after re-enabling the option:

Not verified

native desktop, ios/android, macos/windows, and an actual coder deployment were not exercised on this linux vm. the real provider path covered codex only. ssh interactive prompting was not attempted; its disabled environment was observed. the recording shows the interaction sequence, not a performance measurement.

Dismissing prior approval to re-evaluate b34f692

[nateEc]

Merged main e455200 into this branch in 4369f5d, preserving the maintainer's askpass fixes and verification history. Resolved the test-import conflict with main's path handling and removed the obsolete NodeOS import. check:changed passed (format, lint, both knip checks, GraphQL, three affected-package typechecks, and 242 tests in two files). On macOS the first run exposed an unrelated main test comparing Git's canonical /private path against /var; the successful run used canonical TMPDIR=/private/tmp without changing production code or weakening that test. Earlier private-HTTPS/askpass verification remains linked in the PR description.

Dismissing prior approval to re-evaluate d659634

[juliusmarminge]

Evidence

Real web client and server; Chromium, 1280×800, light theme, fresh databases, synthetic private HTTPS remote. Both servers inherit the same non-interactive askpass helper with T3CODE_GIT_PRESERVE_ASKPASS=1. Select New worktree → From main (remote) and send the same replay request.

Before	After
39ab6a2d2f	d659634002
Before recording	After recording

The comparison exited 0: base fails and head passes. Restarting head with the option unset restores the authentication failure: control recording.

Scenario · HTTPS fixture · Driver · Proof JSON

Filesystem prefixes are redacted; the head recording masks a read-tool row containing internal paths. Its branch-naming warning comes from disabling generated naming in the fixture and does not prevent worktree preparation or agent completion.

AI-assisted; verified with the tests and tools listed above.

Not shown:

• Values other than '1' and unset were not exercised.
• Background-fetch status behavior was not separately demonstrated with a dedicated capture.
• The reproduction used a synthetic authenticated HTTPS remote rather than an actual Coder workspace.