[Bug]: Windows/WSL commit actions fail for SSH-signed commits because SSH_AUTH_SOCK is not inherited

Before submitting

• I searched existing issues and did not find an exact duplicate.
• I included enough detail to reproduce or investigate the problem.

Related but distinct reports: #274 covers passphrase-protected GPG signing, #971 covers a missing SSH_AUTH_SOCK in the macOS desktop app, and #3067 covers forwarded agents in devcontainers. This report is for the Windows desktop app using the WSL backend with SSH commit signing.

Area

apps/desktop

Steps to reproduce

1. On Windows, configure T3 Code to use a repository and worktree inside WSL.

2. Configure Git in WSL to sign commits with an SSH key:

   git config --global commit.gpgsign true
   git config --global gpg.format ssh
   git config --global user.signingkey "<public SSH key>"
   

3. Make the SSH agent available from the normal WSL login shell. Confirm that this succeeds:

   test -S "$SSH_AUTH_SOCK"
   ssh-add -l
   

4. Open the repository in the T3 Code Windows desktop app and make changes in a T3-managed WSL worktree.

5. Use any UI action that begins with a commit: Commit, Commit & push, or Commit, push & PR.

Expected behavior

T3 Code should inherit or resolve the WSL login shell's SSH agent environment so Git can create an SSH-signed commit.

If the signing agent is unavailable, the UI should surface Git's actionable stderr and identify commit signing as the failure instead of only reporting a non-zero exit status.

Actual behavior

Every UI action fails at the commit step. Files are staged, but no commit is created.

The toast only shows:

Action failed

Git command failed in
GitVcsDriver.commit.commit
(/home/<user>/.t3/worktrees/<repo>/<worktree>):
Git command exited with a non-zero status.

The environment differs between the T3 backend and a normal login shell:

T3 backend environment:
SSH_AUTH_SOCK=unset
ssh-add -l -> Could not open a connection to your authentication agent.

bash -lic login-shell environment:
SSH_AUTH_SOCK points to a valid socket
ssh-add -l -> succeeds and lists the available identities

The repository configuration at the time of failure is:

commit.gpgsign=true
gpg.format=ssh
user.signingkey=<public SSH key>

This strongly indicates that the Windows/WSL backend is not hydrating the login-shell SSH_AUTH_SOCK before it invokes git commit.

Impact

Major degradation or frequent failure

All three UI workflows are blocked for repositories where SSH commit signing is required.

Version or commit

T3 Code Nightly 0.0.33-nightly.20260808.1035

Environment

• Windows desktop app
• Windows NT 10.0.26200.0
• WSL2, Ubuntu 24.04.4 LTS
• Linux kernel 6.6.87.2-microsoft-standard-WSL2
• Git 2.43.0
• Repository and T3-managed worktree stored in the WSL filesystem
• Provider: Codex app-server

Logs or stack traces

GitCommandError: Git command failed in GitVcsDriver.commit.commit
(/home/<user>/.t3/worktrees/<repo>/<worktree>):
Git command exited with a non-zero status.

at commit (.../apps/server/dist/bin.mjs:34267:74)
at runCommitStep (.../apps/server/dist/bin.mjs:43913:112)
at runStackedAction.runAction (.../apps/server/dist/bin.mjs:43944:5)
at runStackedAction (.../apps/server/dist/bin.mjs:44072:132)

The server trace and toast omit the underlying Git stderr, which makes the signing failure invisible.

Screenshots, recordings, or supporting files

The failure toast shows the same generic GitVcsDriver.commit.commit non-zero-status error quoted above when clicking the "Commit" button.

Workaround

Commit manually from a normal WSL login shell where SSH_AUTH_SOCK is populated, then use the remaining push/PR actions.

If unsigned commits are acceptable for the repository, a temporary alternative is:

git -c commit.gpgsign=false commit ...

This should not require changing the user's global Git configuration.

Start in the apps/desktop area and trace the commit path through GitVcsDriver.commit.commit, runCommitStep, and the stacked action shown in the server trace. Reproduce the Windows/WSL case with SSH signing, then verify that the backend resolves SSH_AUTH_SOCK and that commit failures expose Git's stderr instead of only the non-zero exit status.