Repository navigation
skills: remoteHeadSha() can open a Git Credential Manager dialog on Windows (GIT_TERMINAL_PROMPT does not cover GUI helpers; slug unvalidated) #4702
Description
Summary
packages/cli/src/utils/skillsManifest.ts remoteHeadSha() runs
execFileAsync("git", ["ls-remote", `https://github.com/${repoSlug}.git`, "refs/heads/main"], { env: { ...process.env, GIT_TERMINAL_PROMPT: "0" } })GIT_TERMINAL_PROMPT=0 only suppresses terminal prompts. On Windows with Git Credential Manager (the Git for Windows default), a slug for a nonexistent or private repository makes GitHub answer with an authentication challenge, and GCM opens a GUI "Connect to GitHub" window instead of failing. The function's catch never sees it because the process is blocked on the dialog until the user cancels. repoSlug is also passed through unvalidated, so any --source value shaped like a/b reaches git.
We hit the same mechanism this week through a different caller (OpenCode's plugin install, reported at anomalyco/opencode#51943) and noticed this helper has the same latent shape while tracing it.
Suggested fix
- Validate the slug before spawning:
/^[\w.-]+\/[\w.-]+$/, else returnnull. - Spawn git so it can never prompt:
git -c credential.helper= ls-remote ...plusGCM_INTERACTIVE: "never"andGIT_ASKPASS: ""in the env. An anonymous read of a public repo never needs a credential helper, so disabling it for this call loses nothing.
Low priority; reported for completeness while the details were fresh.
Activity
RaphaelFakhri commentedon Sep 30, 2026
I'd like to take this one. I plan to validate the slug as
owner/repobefore spawning git, and run the lookup with-c credential.helper=,GCM_INTERACTIVE=neverand an emptyGIT_ASKPASSso it can never prompt. I'll add a test inskillsManifest.test.tsthat checks the git arguments and environment. Does that work for you?fix(cli): skills update check never opens a Git Credential Manager wi…
fix(cli): skills update check never opens a Git Credential Manager wi…
miguel-heygen commentedon Oct 24, 2026
Thanks for the report and the clear mechanism.
I confirmed this on 0.8.193. With a logging credential helper and no stored GitHub credentials,
hyperframes skills check --source <missing-owner>/<repo>runsgit ls-remotewith onlyGIT_TERMINAL_PROMPT=0set, and git still calls the credential helper (get). On Windows that's Git Credential Manager, which explains the window. The default source is a public repo, so this only shows up with a custom--source.#5198 implements the fix you suggested (clear
credential.helper, emptyGIT_ASKPASS,GCM_INTERACTIVE=never, validate the slug) with tests, and is waiting for review.@RaphaelFakhri, thanks for offering. Since #5198 already covers this, a review or a test of it on Windows would be the most useful help.