Allow preserving GIT_ASKPASS for Coder authentication during workspace creation #23044

What happened

Creating a workspace in a Coder environment failed because T3 Code’s Git fetch overrides GIT_ASKPASS, which Coder uses to provide repository credentials.

Please add an opt-in configuration option to preserve the inherited GIT_ASKPASS. A helper can supply credentials without opening an interactive dialog, so disabling all askpass helpers also breaks non-interactive authentication.

Diagnosis

The failed run requested worktree preparation with startFromOrigin: true. Workspace preparation failed in GitVcsDriver.fetchRemote before the coding agent started.

Inspection of the installed 0.1.1 executable shows that fetchRemote uses STATUS_UPSTREAM_REFRESH_ENV, which sets:

{
  GCM_INTERACTIVE: "never",
  GIT_ASKPASS: "",
  GIT_TERMINAL_PROMPT: "0",
  SSH_ASKPASS: "",
  SSH_ASKPASS_REQUIRE: "never"
}

Blanking GIT_ASKPASS prevents Git from invoking Coder’s inherited authentication helper.

Proposed behavior:

• Preserve the current default that suppresses authentication dialogs.
• Add a documented server/environment option to preserve inherited GIT_ASKPASS for installations with a trusted, non-interactive helper.
• Keep terminal prompting disabled with GIT_TERMINAL_PROMPT=0.
• Define whether the option applies to workspace preparation, background fetches, or both.

Steps to reproduce

1. Run T3 Code in a Coder workspace where HTTPS repository authentication is supplied through GIT_ASKPASS.
2. Add a private repository that relies on that helper, without a separate Git credential helper.
3. Create a new thread and worktree with “start from origin” enabled.
4. Workspace preparation attempts a remote fetch and fails with an authentication error.

Expected: With the proposed option enabled, Git can invoke the inherited Coder helper and workspace preparation succeeds.

Actual: T3 Code clears GIT_ASKPASS, and workspace preparation fails.

These steps describe the observed failure; a separate controlled reproduction was not performed during triage.

Version

Local server: 0.1.1 at the time of the failure.

Triage CLI: 0.1.1.

Environment

• Coder workspace
• Linux x64, kernel 7.1.10-200.fc44.x86_64
• Node.js v26.8.2
• Thread metadata records the creation surface as mobile
• HTTPS repository authentication supplied by Coder through GIT_ASKPASS

Evidence

Recorded failure at 2026-10-21T19:02:30.495Z, with the repository path redacted:

Workspace preparation failed during provision worktree:
Git command failed in GitVcsDriver.fetchRemote (<repository>):
Git could not authenticate with the remote.
Check Git credentials or SSH access on the server, then retry.

Related issues

#1467, closed via #2605, describes background Git refreshes opening disruptive SSH passphrase dialogs.

This request preserves that default behavior while allowing administrators to opt into an existing non-interactive credential helper. No exact duplicate was found in the available search; the introducing commit was not verified.

Fix applied or workaround

The user configured the affected repository to use glab authentication through a Git credential helper instead of relying on Coder’s GIT_ASKPASS. This is a workaround; preserving Coder’s existing authentication integration would avoid per-repository changes.

Filed by

Prepared by Codex (GPT-6; exact model identifier unavailable) via T3 Code triage.