Code review leaves git ls-remote running and repeatedly triggers hardware-backed SSH authentication
What happened?
While using /plannotator-review with OpenCode on Linux, I noticed that my YubiKey continued blinking after I stopped interacting with the review and left OpenCode waiting for input.
The OpenCode UI did not show an active tool call, SSH operation, Git operation, or pending authentication request. When asked whether it was doing anything, the agent reported that it was idle.
Process inspection showed a background process chain equivalent to:
opencode
git -c core.quotePath=false -c credential.interactive=false ls-remote --symref origin HEAD
ssh -o BatchMode=yes -o ConnectTimeout=5 -o SendEnv=GIT_PROTOCOL git@<git-host> git-upload-pack '<repository>'
The SSH authentication was routed through GPG's SSH agent and scdaemon, which repeatedly attempted smartcard authentication and timed out approximately once per minute. This caused repeated YubiKey activity even though the OpenCode UI appeared idle.
Closing the Plannotator review page stopped the Git/SSH child process and the subsequent smartcard timeout messages. No Git/SSH child process or new smartcard timeout appeared during several minutes of monitoring afterward.
Expected behavior
Code review should either:
- avoid remote checks that require hardware-backed SSH authentication unless explicitly requested; or
- show the remote check as an active, cancellable operation; and
- terminate the Git/SSH process when the review page is closed or the review is otherwise cancelled.
An option such as --no-remote-check or a configuration setting to disable the origin default-branch/stale-baseline check would also be useful.
Environment
- OS: Omarchy 4.0.3 (Linux, x86_64; kernel 7.2.3-arch1-3)
- Agent: OpenCode
- Surface: Code review (
/plannotator-review)
- Plannotator version: 0.27.14
- OpenCode version: 1.18.30
- OpenCode plugin:
@plannotator/opencode 0.27.14, configured through @plannotator/opencode@latest
Additional context
The Plannotator README currently documents that local Git code review may query origin with git ls-remote to detect the default branch and stale baseline, and says there is no opt-out setting. The behavior is understandable for ordinary SSH keys, but it is problematic when SSH authentication is backed by a hardware token because a background retry loop causes repeated physical token activity without a visible UI indication.
No credentials, keys, hostnames, usernames, IP addresses, repository names, or other private system identifiers are included in this report. This report created with AI assistance and reviewed by the submitter.
Code review leaves
git ls-remoterunning and repeatedly triggers hardware-backed SSH authenticationWhat happened?
While using
/plannotator-reviewwith OpenCode on Linux, I noticed that my YubiKey continued blinking after I stopped interacting with the review and left OpenCode waiting for input.The OpenCode UI did not show an active tool call, SSH operation, Git operation, or pending authentication request. When asked whether it was doing anything, the agent reported that it was idle.
Process inspection showed a background process chain equivalent to:
The SSH authentication was routed through GPG's SSH agent and
scdaemon, which repeatedly attempted smartcard authentication and timed out approximately once per minute. This caused repeated YubiKey activity even though the OpenCode UI appeared idle.Closing the Plannotator review page stopped the Git/SSH child process and the subsequent smartcard timeout messages. No Git/SSH child process or new smartcard timeout appeared during several minutes of monitoring afterward.
Expected behavior
Code review should either:
An option such as
--no-remote-checkor a configuration setting to disable theorigindefault-branch/stale-baseline check would also be useful.Environment
/plannotator-review)@plannotator/opencode0.27.14, configured through@plannotator/opencode@latestAdditional context
The Plannotator README currently documents that local Git code review may query
originwithgit ls-remoteto detect the default branch and stale baseline, and says there is no opt-out setting. The behavior is understandable for ordinary SSH keys, but it is problematic when SSH authentication is backed by a hardware token because a background retry loop causes repeated physical token activity without a visible UI indication.No credentials, keys, hostnames, usernames, IP addresses, repository names, or other private system identifiers are included in this report. This report created with AI assistance and reviewed by the submitter.