[BUG] Localised git stderr breaks auth-failure classification, suppressing the token retry

[Naofel-eal]

Describe the bug

AuthResolver.is_public_github_auth_failure classifies a failed clone by matching English signal strings against git's stderr ("authentication failed", "could not read username", "repository not found", ...). Git localises those diagnostics through gettext, and APM does not pin a locale for the git subprocesses it spawns itself.

On a machine whose locale is not English, git writes its authentication failure in the user's language. The classifier does not recognise it, and the consequence is not cosmetic: the verdict gates the token retry in try_with_fallback (src/apm_cli/core/auth.py:797-802).

if (
    lazy_public_github
    and path is not None
    and not self.is_public_github_auth_failure(exc)
):
    raise
ctx = _auth_context()
if ctx.token:
    _log(f"Unauthenticated failed, retrying with token (source: {ctx.source})")

Since uses_public_github_anonymous_first makes every github.com access start anonymously, a misclassified failure means the token is never tried. Installing a private-repo dependency fails, and the user is pointed at the wrong cause:

Could not connect to github.com (network error, not an auth failure).
Check your internet connection and proxy settings.

while git actually said "authentication failed".

Two things make this hard to spot:

• Clones issued through GitPython are unaffected, because GitPython forces LANGUAGE=C/LC_ALL=C on every command it runs (git/cmd.py). Only APM's own subprocess calls inherit the ambient locale — and that is the path the shared bare cache uses.
• Git ships message catalogues for 19 languages today. A user whose language has no catalogue (e.g. ja) sees English and is unaffected — until that translation is added.

To Reproduce

1. Set a locale for which git ships a catalogue: export LANG=fr_FR.UTF-8 (de_DE.UTF-8 behaves identically).
2. Have a token available through gh auth login, but not exported in the environment, so it has to come from the retry path.
3. Use a cold cache: export APM_CACHE_DIR=$(mktemp -d).
4. apm install <org>/<private-repo>/<subdir> — a subdirectory package, which is the case that routes through the shared bare-cache clone.

Same command, same token, same repository; only the locale changes:

LC_ALL	Result
fr_FR.UTF-8	fails — "network error, not an auth failure"
de_DE.UTF-8	fails — same
C	installs successfully

LC_ALL=C apm install ... alone makes the install succeed with no code change, which isolates the locale as the cause.

The exception captured on the failing path (values redacted):

CalledProcessError: Command '[... 'clone', '--bare', 'https://github.com/<org>/<repo>.git', ...]'
  returned non-zero exit status 128.
  stderr: "remote: Invalid username or token. Password authentication is not supported
           for Git operations.
           fatal : Échec d'authentification pour 'https://github.com/<org>/<repo>.git/'"

is_public_github_auth_failure returns False for it, so try_with_fallback re-raises without trying the token. Instrumenting the same run under LC_ALL=C yields the untranslated fatal: Authentication failed, a True verdict, and a successful token retry.

Expected behavior

Classification of an authentication failure should not depend on the user's locale. A private-repo dependency should install regardless of the language configured on the machine, and a genuine auth failure should be reported as such instead of as a network/proxy problem.

Environment (please complete the following information):

• OS: macOS (darwin); reproducible on any non-English locale
• Python Version: 3.12
• APM Version: 0.28.0 (also on main @ 3aa0365)
• git: 2.51.0, shipping catalogues for 19 languages under share/locale/

Additional context

How this surfaced: a shared agent rule hosted in a subdirectory of a private repository. The repository root installed fine, the subdirectory package did not — the subdirectory is what routes through the shared bare cache, whose subprocess calls carry the ambient locale. The subdirectory is the trigger, not the cause. The error message sent me looking at proxy and connectivity settings for what was a credential-resolution problem.

I have a fix and will open a PR referencing this issue: normalise the message locale in AuthResolver._build_git_env, the single builder every git env in the auth path routes through. Widening the classifier's vocabulary with translated strings looks like the wrong direction — the catalogues change between git versions and cover a moving set of languages.

[github-actions]

Triage decision

accept

Proposed labels

theme/portability
area/distribution
type/bug
status/accepted
priority/high

Milestone

null -- could not resolve open milestones from this runner; a maintainer should assign the current patch milestone.

Suggested next action

Add LANGUAGE=C and LC_ALL=C to the git subprocess env in AuthResolver._build_git_env so that auth-failure classification in is_public_github_auth_failure is locale-independent.

Suggested issue comment

Thank you for this report -- the locale-by-locale comparison table and the CalledProcessError excerpt make the root cause unambiguous.

This is a confirmed type/bug at the intersection of locale and auth-failure classification. is_public_github_auth_failure matches English git error strings, but APM's own subprocess calls (unlike GitPython, which pins LANGUAGE=C/LC_ALL=C on every command) inherit the ambient locale. On a non-English locale with a git translation catalogue, git writes its auth failure in the user's language, the classifier returns False, and try_with_fallback never retries with the token -- producing a misleading "network error" message.

Your proposed fix is correct: pinning LANGUAGE=C and LC_ALL=C in _build_git_env (the single builder every auth-path git subprocess routes through) follows GitPython's own approach and is the narrowest correct fix. Widening the classifier with translated strings is the wrong direction -- catalogues change between git versions.

Priority high: private-repo dependencies silently fail for non-English users with no actionable error.

A PR against main that adds the locale pins to _build_git_env and a test with a French/German git error message would be a direct path to merge.

Per-lens notes (collapsed)

DevX UX Expert -- User-Need Reviewer

Severe DX defect: private-repo installs silently fail for non-English users with a misleading "network error" message. The user cannot tell from the error that the real cause is auth. The locale-isolation table (fr_FR/de_DE fail, C succeeds) is definitive. The subdirectory package type is what routes through the affected subprocess path, making this a layered but not complex issue.

Supply Chain Security Expert -- Risk-Surface Reviewer

is_public_github_auth_failure gates the token retry in try_with_fallback. Misclassification means the token is never tried, which is a functional auth failure rather than a security vulnerability. However, the auth path is a security-adjacent surface (area/distribution + theme/portability). The fix (locale pins) is purely additive and does not weaken any security boundary. No new risk surface introduced.

OSS Growth Hacker -- Contributor-Tone Reviewer

First-time contributor (author_association=NONE) with an exceptionally well-researched report: identifies the GitPython vs. APM subprocess divergence, provides a stacktrace with redacted values, locale-comparison table, proposed fix, and explains why widening the classifier's vocabulary is the wrong approach. Acknowledge the investigation depth and note the reporter intends to open a PR.

Python Architect -- Architecture Reviewer

_build_git_env is the single builder for all auth-path git subprocess calls. Adding LANGUAGE=C / LC_ALL=C there is the correct design: it mirrors GitPython, is cross-cutting in the right way (affects all git subprocesses in the auth path uniformly), and requires no new interface or data model. The alternative (classifier vocabulary expansion) is fragile against catalogue changes. Accept.

Doc Writer -- Documentation Reviewer

Not activated -- internal bug fix in the auth subprocess environment. No new user-facing documentation or command surface changes needed.

APM CEO -- Triage Arbiter

Clear accept with high priority. Silent auth failures on non-English locales with a misleading network-error message are a severe DX regression for a global user base. The fix is one env variable in one function, mirrors an established pattern (GitPython), and the reporter already has a PR in mind. Current patch cycle.

{
  "decision": "accept",
  "decision_detail": "",
  "theme": "theme/portability",
  "areas": ["area/distribution"],
  "type": "type/bug",
  "status": "status/accepted",
  "priority": "priority/high",
  "preserved_labels": [],
  "milestone": null,
  "next_action": "Add LANGUAGE=C and LC_ALL=C to AuthResolver._build_git_env so auth-failure classification is locale-independent.",
  "comment_markdown": "See above."
}

---

Triage status: agentic proposal pending human ratification.
Silence is approval. Maintainers can:

• Override any label or milestone above by editing it directly --
  human edits are authoritative and will not be reverted on
  subsequent runs.
• Re-trigger triage by applying the status/needs-triage label, or
  by removing status/triaged to enroll the issue in the next
  daily sweep.

Posted by the Triage Panel workflow. See .apm/skills/apm-triage-panel for the panel skill.

Generated by Triage Panel · 123.7 AIC · ⌖ 9.46 AIC · ⊞ 9.2K · ◷