fix(git): explain pull failures without exposing remote output

[TinBane]

What Changed

pullCurrentBranch now explains a failed git pull --ff-only with the fixed diagnoses #12485 added for fetch. When Git's output matches a known case the error says "Git could not authenticate with the remote…", "Git could not reach the remote…", "Git could not access the remote repository…" or the reference-lock message. Anything else keeps "git pull failed".

Raw Git output still never enters the error; only the fixed messages do. To match them on any server, git pull now runs with LC_ALL=C, like the fetch path.

Why

The triage of #11872 names this as its secondary problem: when a desktop SSH remote loses its forwarded agent, Pull fails with only "git pull failed", and the Permission denied (publickey) that explains it never reaches the UI. #12485 fixed that for fetches during worktree preparation; the Pull action was left on the generic message.

I'm submitting it as a small, focused fix for that defect: one call site, reusing the existing helper, with no change to what Pull does or to any default. It does not fix the agent lifetime bug in #11872 itself.

UI Changes

Clicking Pull in the app, connected over an SSH tunnel to a server on a Linux host that is in the state #11872 describes: it was started inside an ssh session with a forwarded agent, the session closed, and its SSH_AUTH_SOCK now points at a socket that no longer exists. Browser zoomed to 200% so the toast is legible.

Before (server built from main):

Pull failed: Git command failed in GitVcsDriver.pullCurrentBranch.pull (/home/tinyadmin/t3-pull-test/probe-repo): git pull failed

After (server built from this branch):

Pull failed: Git command failed in GitVcsDriver.pullCurrentBranch.pull (/home/tinyadmin/t3-pull-test/probe-repo): Git could not authenticate with the remote. Check Git credentials or SSH access on the server, then retry.

The same click against a local server on macOS

Real git and ssh to git@github.com with no identity and a dead agent socket.

Before:

After:

Verification

To reproduce: in a repository with an upstream branch and at least one commit to pull, set core.sshCommand to ssh -F /dev/null -o BatchMode=yes -o IdentitiesOnly=yes -o IdentityFile=/nonexistent -o IdentityAgent=/tmp/dead.sock with an SSH remote, then click Pull. That leaves ssh with no key and an agent socket that doesn't exist, which is the state #11872 leaves the managed server in.

• In the app against a local server on macOS: the toast changed from "git pull failed" to the authentication message when I ran the same click on main and on this branch (screenshots above).

• vp test run src/vcs/GitVcsDriverCore.test.ts from apps/server: 110 passed on current main (108 when the Linux and Windows runs below were done; main has gained two tests since). Three of those are new, all using real Git:

  • a stand-in for ssh prints OpenSSH's Permission denied (publickey) line and exits 255; the pull is reported as an authentication failure and a marker printed alongside it never appears in the error. On main this fails with expected 'git pull failed' to include 'could not authenticate'.
  • a branch tracks a local bare remote whose URL is then pointed at a missing path; the pull fails with "could not access the remote repository". Also fails on main.
  • a branch that has diverged from its upstream still fails with exactly "git pull failed".

• vp run --filter t3 typecheck, vp lint and vp fmt --check on the two changed files: clean.

• In the app against a Linux host over SSH (Ubuntu 24.04.3 x86_64, OpenSSH 9.6p1, git 2.43.0, Node 24.21.0), set up the way [Bug]: Desktop SSH remote's managed server inherits a per-session forwarded SSH_AUTH_SOCK that dies with the launching session #11872 describes. Inside an ssh session with a throwaway agent forwarded, I started the server with the line the managed launch uses (nohup env T3CODE_NO_BROWSER=1 … serve --host 127.0.0.1 --port … < /dev/null &) and let the session close. The running server's /proc/<pid>/environ still had SSH_AUTH_SOCK=/tmp/ssh-…/agent.N, and that path no longer existed. With the app connected to that server through an ssh -N -L tunnel, clicking Pull on a repository with a GitHub SSH remote gave the before and after screenshots above, once with a server built from main and once from this branch.

• On the same host, from a process left in that state: ssh -v reported get_agent_identities: ssh_get_authentication_socket: No such file or directory (it had reported agent returned 1 keys while the session was open), git pull --ff-only printed git@github.com: Permission denied (publickey)., and pullCurrentBranch returned "git pull failed" with main's driver and the authentication message with this branch.

• The same test file on that Linux host: 108 passed.

• The same test file on Windows 11 (git 2.53.0.windows.1, Node 24.21.0): the three new tests pass, including the stand-in ssh one. The file as a whole is 106 passed, 1 failed, 1 skipped. The failure is the existing "keeps untracked filenames with pathspec magic in the review" test from fix(server): detect file renames in review diffs #8086, which creates a file named :(exclude)after.ts and gets ENOENT because Windows doesn't allow : in a filename; the skip is the existing Windows skip for newline paths. pnpm install didn't finish linking on that machine, so I started the run with node node_modules\vite-plus\bin\vp test run src/vcs/GitVcsDriverCore.test.ts.

Not checked: the desktop app issuing that launch itself. I ran its launch line by hand, so the server ended up in the same state without going through the desktop's SSH environment setup.

[macroscopeapp]

Approvability

Verdict: Approved at bdee946

Macroscope's review found this PR approvable — This is a small, localized Git pull error-reporting fix that preserves successful pull behavior and never exposes raw remote output. Targeted integration tests cover the new diagnostics, secret redaction, and unchanged handling of non-fast-forward failures.

No code changes detected at 2f2afb0. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: pingdotgg/t3code/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 83bb55df-e3c1-4b8d-9d0e-71a2c9e50548

📥 Commits

Reviewing files that changed from the base of the PR and between bc1b535 and 2f2afb0.

📒 Files selected for processing (2)

• apps/server/src/vcs/GitVcsDriverCore.test.ts
• apps/server/src/vcs/GitVcsDriverCore.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

pullCurrentBranch captures failed pull results and reports a recognized failure detail when available. Tests cover repository-access and authentication failures, plus a non-fast-forward failure that retains the generic detail.

Changes

Pull failure diagnostics

Layer / File(s)	Summary
Pull failure handling and validation apps/server/src/vcs/GitVcsDriverCore.ts, apps/server/src/vcs/GitVcsDriverCore.test.ts	pullCurrentBranch allows a nonzero exit and uses fetchFailureDetail to classify recognized failures. It includes the exit code and output lengths in GitCommandError. Tests check that repository-access and authentication errors do not expose sensitive output, and that a non-fast-forward failure retains the generic detail.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: t3dotgg

Merge Risk: ⚪ Minimal · up to 2f2af

The pull diagnostics change appears mergeable after normal checks.

Architecture Summary

Architecture risk: 🔵 Low · up to 2f2af

The change affects 1 system.

Changed systems: apps/server

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — apps/server (service) was modified; 2 changed files map to changed impact.

Before / after behavior

• observed — Modified behavior in apps/server/src/vcs/GitVcsDriverCore.test.ts: Adds a test that changes the configured origin URL to a missing local path, calls pullCurrentBranch, and checks for a repository-access error, exit code 1, and no remote path or stderr in the exposed error.
• observed — Modified behavior in apps/server/src/vcs/GitVcsDriverCore.test.ts: Adds a test using a fake SSH command that emits a public-key denial and secret. It checks that pullCurrentBranch reports an authentication error without exposing the secret or stderr.
• observed — Modified behavior in apps/server/src/vcs/GitVcsDriverCore.test.ts: Adds a diverged local and remote history test that checks a rejected pull retains the generic git pull failed detail.
• observed — Modified behavior in apps/server/src/vcs/GitVcsDriverCore.ts: pullCurrentBranch now captures pull output and handles nonzero exits explicitly, returning a GitCommandError with recognized fetch diagnostics when available, the generic "git pull failed" fallback otherwise, and output lengths plus the exit code when present. The prior execution path used a fixed fallback error detail.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: improving Git pull failure messages without exposing raw remote output.
Description check	✅ Passed	The description is detailed and covers the problem, implementation, scope, UI impact, verification results, platform-specific limitations, and unverified areas. It uses equivalent headings instead of …

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[TinBane]

Force-pushed to drop a merge commit. I'd used the Update branch button, which authored it with a personal email address I don't want public. The branch is now the single fix commit rebased onto current main; the code is unchanged from what Macroscope approved at bdee946.