🤖 fix: bound workspace creation when Coder Git authentication waits indefinitely

[ThomasK33]

Creating a Git worktree workspace can wait indefinitely when Coder's GitHub external authentication is missing or expired. The UI appears to do nothing, while the app remains healthy and workspace/list continues to succeed. The user confirmed that reconnecting GitHub resolved the incident.

Reproduction

1. Run Xum inside a Coder workspace with an HTTPS GitHub origin and Coder's Git askpass helper, but without valid GitHub external authentication.
2. Create a worktree workspace from main, either through the UI or workspace/create.
3. Observe that creation never finishes and no workspace appears in the list. A direct API caller in this incident reached its own 60-second timeout; this was not a captured server timeout or HTTP 504.
4. Reconnect GitHub through Coder external authentication. Pending requests may then proceed.

Confirmed cause and evidence

WorktreeManager awaits a best-effort git fetch origin main before adding the worktree and persisting workspace metadata. This fetch has no deadline. Coder's askpass helper waits for external authentication, so the entire creation operation remains pending.

• Four app-owned fetch processes were observed waiting on Coder askpass for 41–48 minutes. The helper was requesting a username for https://github.com.
• Coder's external-auth access-token command reported that GitHub authorization was required.
• The test workspace had no corresponding branch, worktree, or config entry when inspected. No creation retry was needed to reproduce the stall.
• A deterministic subprocess reproduction showed the same behavior on main 373257bbc68f5f3fe2009e2abd7433563287bd7e and the pre-agent-loop-refactor baseline 5cca5bf5f. This predates the Effect refactor.
• Installed code from 42863ff6b also contained the unbounded fetch. The app reported v0.28.5-nightly.41-2-g42863ff6b-dirty during the original report.

Expected behavior / proposed fix

Bound the best-effort fetch and terminate its process tree on timeout, then use the existing local-trunk fallback. Preserve explicit cancellation as cancellation. Surface enough diagnostic context to distinguish authentication waiting from normal workspace initialization; genuine creation failures should produce a visible error.

A local candidate using a 15-second fetch deadline plus process-tree termination passed 50 targeted tests and the full static check. It is not yet submitted or deployed. Tests cover a stalled helper with inherited pipes, cleanup of descendants, local fallback, explicit cancellation, and successful fetch using the fresh remote trunk. A timeout without process-tree termination was insufficient because descendants retained the subprocess pipes.

Recovery caveat

Reauthorizing GitHub can release every pending creation request. Killing only the askpass helper is not request cancellation: the failed fetch can trigger local fallback and continue creation. Check for in-flight operations and orphaned branches/worktrees before retrying.

---

Generated with xum • Model: unavailable • Thinking: unavailable • Cost: $unavailable

[linear-code]

MUX-131