Allow preserving GIT_ASKPASS for Coder authentication during workspace creation#23044

What happened

Creating a workspace in a Coder environment failed because T3 Code’s Git fetch overrides GIT_ASKPASS, which Coder uses to provide repository credentials.

Please add an opt-in configuration option to preserve the inherited GIT_ASKPASS. A helper can supply credentials without opening an interactive dialog, so disabling all askpass helpers also breaks non-interactive authentication.

Diagnosis

The failed run requested worktree preparation with startFromOrigin: true. Workspace preparation failed in GitVcsDriver.fetchRemote before the coding agent started.

Inspection of the installed 0.1.1 executable shows that fetchRemote uses STATUS_UPSTREAM_REFRESH_ENV, which sets:

1	{
2	GCM_INTERACTIVE: "never",
3	GIT_ASKPASS: "",
4	GIT_TERMINAL_PROMPT: "0",
5	SSH_ASKPASS: "",
6	SSH_ASKPASS_REQUIRE: "never"
7	}

Blanking GIT_ASKPASS prevents Git from invoking Coder’s inherited authentication helper.

Proposed behavior:

Preserve the current default that suppresses authentication dialogs.
Add a documented server/environment option to preserve inherited GIT_ASKPASS for installations with a trusted, non-interactive helper.
Keep terminal prompting disabled with GIT_TERMINAL_PROMPT=0.
Define whether the option applies to workspace preparation, background fetches, or both.

Steps to reproduce

Run T3 Code in a Coder workspace where HTTPS repository authentication is supplied through GIT_ASKPASS.
Add a private repository that relies on that helper, without a separate Git credential helper.
Create a new thread and worktree with “start from origin” enabled.
Workspace preparation attempts a remote fetch and fails with an authentication error.

Expected: With the proposed option enabled, Git can invoke the inherited Coder helper and workspace preparation succeeds.

Actual: T3 Code clears GIT_ASKPASS, and workspace preparation fails.

These steps describe the observed failure; a separate controlled reproduction was not performed during triage.

Version

Local server: 0.1.1 at the time of the failure.

Triage CLI: 0.1.1.

Environment

Coder workspace
Linux x64, kernel 7.1.10-200.fc44.x86_64
Node.js v26.8.2
Thread metadata records the creation surface as mobile
HTTPS repository authentication supplied by Coder through GIT_ASKPASS

Evidence

Recorded failure at 2026-10-21T19:02:30.495Z, with the repository path redacted:

text

1	Workspace preparation failed during provision worktree:
2	Git command failed in GitVcsDriver.fetchRemote (<repository>):
3	Git could not authenticate with the remote.
4	Check Git credentials or SSH access on the server, then retry.

#1467, closed via #2605, describes background Git refreshes opening disruptive SSH passphrase dialogs.

This request preserves that default behavior while allowing administrators to opt into an existing non-interactive credential helper. No exact duplicate was found in the available search; the introducing commit was not verified.

Fix applied or workaround

The user configured the affected repository to use glab authentication through a Git credential helper instead of relying on Coder’s GIT_ASKPASS. This is a workaround; preserving Coder’s existing authentication integration would avoid per-repository changes.

Filed by

Prepared by Codex (GPT-6; exact model identifier unavailable) via T3 Code triage.