Fixes #23044. T3 deliberately clears askpass variables during background and workspace-preparation fetches to avoid interactive prompts. In environments such as Coder, an inherited GIT_ASKPASS can instead be the existing non-interactive credential source; clearing it makes worktree preparation fail before the agent starts.
This is a focused configuration option for an established capability under CONTRIBUTING.md: no new credential store, provider, workflow, or default change. Set T3CODE_GIT_PRESERVE_ASKPASS=1 in the server environment to preserve its inherited Git askpass helper for both fetch paths. Unset/other values retain today's behavior. Terminal prompting, GCM interaction, and SSH askpass remain disabled. Documentation warns that the operator must choose a trusted non-interactive helper; T3 cannot stop an opted-in helper from opening its own dialog.
Git documents askpass independently of terminal prompting in gitcredentials and GIT_TERMINAL_PROMPT.
The new integration test uses real Git, a throwaway repository, a loopback HTTP endpoint requiring fixture-only Basic credentials, and a disposable askpass script. Repository configuration disables the developer's credential helpers and proxy. No real credentials or external repository are used.
Git could not authenticate with the remote (exit 128).0 disables the helper again. The existing background-fetch environment test now covers both opt-in states and verifies that the other four non-interactive controls stay unchanged.vp test run apps/server/src/vcs/GitVcsDriverCore.test.ts: all 165 tests pass via check:changed.vp run check:changed: formatting, lint, knip, GraphQL validation, scoped typechecks, and the affected test file all pass. Existing unrelated lint warnings remain unchanged.This is server-side fetch configuration; no web, desktop, or mobile rendering changes or UI screenshots are needed. All clients that request workspace preparation use the same server path.
Model: GPT-5-based Codex. Harness: Codex desktop app.
Fixes pingdotgg/t3code#23044
Added 1 commit
Verdict: Approved at b34f692
Macroscope's review found this PR approvable — Adds an explicit opt-in to retain a trusted Git askpass helper during fetches, while leaving default behavior and other prompt restrictions unchanged. Documentation clearly describes the helper’s trust requirements and interaction limitations.
You can add or adjust custom eligibility rules. Learn more.
No actionable comments were generated in the recent review.
The server adds T3CODE_GIT_PRESERVE_ASKPASS for background status fetches and remote fetches. When set to "1", the fetch environment retains the inherited GIT_ASKPASS; otherwise, the existing noninteractive environment remains in use.
Changes: Git askpass refresh environment
| Layer / File(s) | Summary |
|---|---|
Refresh environment and fetch coverage apps/server/src/vcs/GitVcsDriverCore.ts, apps/server/src/vcs/GitVcsDriverCore.test.ts | When the setting is "1", the refresh environment retains the host GIT_ASKPASS value, or uses an empty string if it is unset. Background status fetches and remote fetches use this environment. Tests cover enabled and disabled settings, including authenticated fetch behavior. |
Setting documentation docs/user/source-control.md | The documentation describes the opt-in setting, the fetches that use it, the default behavior, and the unchanged interactive prompt restrictions. |
Estimated code review effort: 2 (Simple) | ~10 minutes
Severity of issue fixed: Medium
Suggested reviewers: juliusmarminge
4369fThe opt-in preserves Git askpass for the documented fetch paths while leaving default prompting controls in place. No merge-blocking issue is established.
| Check name | Status | Explanation |
|---|---|---|
| Title check | Passed | The title clearly describes the opt-in askpass change. |
| Linked Issues check | Passed | [#23044] Both background and workspace-preparation fetches preserve inherited GIT_ASKPASS only when T3CODE_GIT_PRESERVE_ASKPASS=1. The default and non-interactive controls remain unchanged. Docume… |
| Out of Scope Changes check | Passed | [#23044] The Git environment selector, fetch tests, and source-control documentation support the requested option. The whole-PR source diff contains no unrelated changes. |
| Description check | Passed | The description explains the problem, the opt-in change and its scope, and the verification results. It links the related issue and explains why this focused configuration stays within an established … |
Explanation
[#23044] Both background and workspace-preparation fetches preserve inherited GIT_ASKPASS only when T3CODE_GIT_PRESERVE_ASKPASS=1. The default and non-interactive controls remain unchanged. Documentation defines the scope and helper trust requirement. Tests cover authenticated fetches and both background-fetch settings. Test results are author-reported.
Explanation
The description explains the problem, the opt-in change and its scope, and the verification results. It links the related issue and explains why this focused configuration stays within an established capability. The verification section reports specific tests, results, and platform limits.
e6ac28d0-056f-435c-b9f1-61002a60b872Reviewing files that changed from the base of the PR and between b34f69285a2ee07ee2241e4474e2a1af4b424882 and 4369f5d5f6ac653dfbbecead5a5944fadc8e7610.
apps/server/src/vcs/GitVcsDriverCore.test.tsapps/server/src/vcs/GitVcsDriverCore.tsIncluded review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.
Added 2 commits
Note
Written by claude-opus-5-5 on behalf of Maria
merged current main (67eebaca23) into the original branch at b34f69285a, without rebasing. the production fix and docs are unchanged.
one conflict, in GitVcsDriverCore.test.ts: main moved the background-fetch test from mutating process.env to providing HostProcess.Environment. the resolution keeps this PR's preserve askpass: false/true cases in main's style. the authenticated fetch test now also spreads the host environment, since the git child env is now built from HostProcess.Environment and would otherwise lose PATH.
verification:
vp test run apps/server/src/vcs/GitVcsDriverCore.test.ts: 239 passed, including the 3 askpass cases.vp run check:changed against main: format, lint, knip, graphql, typecheck (3 packages), and 241 tests pass.earlier verification from the prior round (real dev server, private https remote, codex turn) still describes the unchanged production code. unverified: native windows and an actual coder deployment.
Note
Written by gpt-6.1-sol on behalf of Maria
verified as-is at c3b9eb77544f0f9a2c6db227864243e2ee14dec2 on a disposable linux vm. installed main and the exact pr head with vp i, and ran their real dev servers sequentially with isolated state. drove the web app using the repository’s playwright and /usr/bin/google-chrome. no mocks, fixtures, replay provider, or seeded data.
added a project through the app pointing at a real private github repository with configured credential helpers disabled and a trusted inherited askpass helper. selected codex gpt-6.1-sol, new worktree, and “from main (remote)”.
github/main (80a2351fcb) with the option enabled: workspace fetch failed with “git could not authenticate with the remote”; the helper was never invoked and the provider never started.T3CODE_GIT_PRESERVE_ASKPASS=1: authenticated fetch and worktree creation succeeded. a real codex turn read the readme and returned the worktree branch and expected commit. no files changed.GIT_TERMINAL_PROMPT=0, GCM_INTERACTIVE=never, empty SSH_ASKPASS, and SSH_ASKPASS_REQUIRE=never.vp i && vp test run apps/server/src/vcs/GitVcsDriverCore.test.ts: all 200 tests passed. existing head ci reports 32 successful checks. no source changes or pushes were needed.main, same repository and prompt:
main fails authenticated workspace preparation
pr, same repository and prompt:
pr creates worktree and completes real codex turn
retrying the failed thread after re-enabling the option:
retry provisions the worktree and completes codex turn
native desktop, ios/android, macos/windows, and an actual coder deployment were not exercised on this linux vm. the real provider path covered codex only. ssh interactive prompting was not attempted; its disabled environment was observed. the recording shows the interaction sequence, not a performance measurement.
Added 1 commit
Added 1 commit
Merged main e455200077ce into this branch in 4369f5d5f6, preserving the maintainer's askpass fixes and verification history. Resolved the test-import conflict with main's path handling and removed the obsolete NodeOS import. check:changed passed (format, lint, both knip checks, GraphQL, three affected-package typechecks, and 242 tests in two files). On macOS the first run exposed an unrelated main test comparing Git's canonical /private path against /var; the successful run used canonical TMPDIR=/private/tmp without changing production code or weakening that test. Earlier private-HTTPS/askpass verification remains linked in the PR description.