@@ -74,6 +74,8 @@ function harness(input: {
   readonly remotes: string;
   readonly api: Partial<GitHubApi.GitHubApi["Service"]>;
   readonly localBranches?: ReadonlyArray<string>;
+  /** Fails the local branch listing, the first git read a checkout makes. */
+  readonly gitFailure?: unknown;
 }) {
   const git: Array<readonly [string, unknown]> = [];
   const record =
@@ -99,7 +101,10 @@ function harness(input: {
     fetchRemoteTrackingBranch: (args) => record("fetchRemoteTrackingBranch", undefined)(args),
     setBranchUpstream: (args) => record("setBranchUpstream", undefined)(args),
     switchRef: (args) => record("switchRef", { refName: args.refName })(args) as never,
-    listLocalBranchNames: () => Effect.succeed([...(input.localBranches ?? [])]),
+    listLocalBranchNames: () =>
+      input.gitFailure === undefined
+        ? Effect.succeed([...(input.localBranches ?? [])])
+        : Effect.fail(input.gitFailure as never),
     resolveCommit: () => Effect.succeed({ commitSha: "abc123" }),
   });
   const process = Layer.mock(VcsProcess.VcsProcess)({
@@ -182,6 +187,23 @@ describe("GitHubSourceControlProvider repository resolution", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  it.effect("names a missing repository rather than a pull request", () => {
+    const { layer } = harness({
+      remotes: remotesOutput(["origin", "[email protected]:acme/gone.git"]),
+      api: {
+        rest: (input) =>
+          Effect.fail(
+            new GitHubApi.GitHubApiNotFoundError({ host: input.host, operation: input.operation }),
+          ),
+      },
+    });
+    return Effect.gen(function* () {
+      const gh = yield* GitHubSourceControlProvider.make;
+      const error = yield* gh.getDefaultBranch({ cwd: "/repo" }).pipe(Effect.flip);
+      assert.include(error.detail, "Repository not found");
+    }).pipe(Effect.provide(layer));
+  });
+
   it.effect("fails clearly when no remote is on GitHub", () => {
     const { layer } = harness({
       remotes: remotesOutput(["origin", "[email protected]:a/b.git"]),
@@ -581,6 +603,27 @@ describe("GitHubSourceControlProvider.checkoutChangeRequest", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  it.effect("keeps git's own output out of what a failed checkout reports", () => {
+    const { layer } = harness({
+      remotes: remotesOutput(["origin", "[email protected]:acme/web.git"]),
+      gitFailure: new Error("fatal: /home/me/secret-path: permission denied"),
+      api: {
+        graphql: () =>
+          Effect.succeed(
+            encodeJson({ data: { repository: { pullRequest: node(5, "feature/x") } } }),
+          ),
+      },
+    });
+    return Effect.gen(function* () {
+      const gh = yield* GitHubSourceControlProvider.make;
+      const error = yield* gh
+        .checkoutChangeRequest({ cwd: "/repo", reference: "5" })
+        .pipe(Effect.flip);
+      assert.strictEqual(error.detail, "The pull request could not be checked out with git.");
+      assert.notInclude(error.message, "secret-path");
+    }).pipe(Effect.provide(layer));
+  });
+
   it("names the local branch the way gh pr checkout does", () => {
     const name = (headRefName: string, isCrossRepository: boolean) =>
       GitHubSourceControlProvider.pullRequestCheckoutBranchName({
 
@@ -270,7 +270,14 @@ class GitHubFailure extends Data.TaggedError("GitHubFailure")<{
 
 const failure = (detail: string, cause?: unknown) => new GitHubFailure({ detail, cause });
 
-function fromGitHubApiError(error: GitHubApi.GitHubApiError): GitHubFailure {
+const PULL_REQUEST_NOT_FOUND = "Pull request not found. Check the PR number or URL and try again.";
+const REPOSITORY_NOT_FOUND = "Repository not found. Check the owner and name and try again.";
+
+/** `notFound` names what was missing, which only the operation knows. */
+function fromGitHubApiError(
+  error: GitHubApi.GitHubApiError,
+  notFound = PULL_REQUEST_NOT_FOUND,
+): GitHubFailure {
   switch (error._tag) {
     case "GitHubCliMissingError":
       return failure(
@@ -293,7 +300,7 @@ function fromGitHubApiError(error: GitHubApi.GitHubApiError): GitHubFailure {
         error,
       );
     case "GitHubApiNotFoundError":
-      return failure("Pull request not found. Check the PR number or URL and try again.", error);
+      return failure(notFound, error);
     case "GitHubCliFailedError":
     case "GitHubApiResponseError":
     case "GitHubApiRequestError":
@@ -302,8 +309,7 @@ function fromGitHubApiError(error: GitHubApi.GitHubApiError): GitHubFailure {
   }
 }
 
-const notFound = (cause: string) =>
-  failure("Pull request not found. Check the PR number or URL and try again.", new Error(cause));
+const notFound = (cause: string) => failure(PULL_REQUEST_NOT_FOUND, new Error(cause));
 
 const RawRepositorySchema = Schema.Struct({
   full_name: TrimmedNonEmptyString,
@@ -506,8 +512,8 @@ export const make = Effect.gen(function* () {
       }),
     );
 
-  const rest = (input: GitHubApi.GitHubRestInput) =>
-    api.rest(input).pipe(Effect.mapError(fromGitHubApiError));
+  const rest = (input: GitHubApi.GitHubRestInput, notFoundDetail?: string) =>
+    api.rest(input).pipe(Effect.mapError((error) => fromGitHubApiError(error, notFoundDetail)));
 
   const headResolver = RequestResolver.makeGrouped<PullRequestsByHeadRead, string>({
     key: ({ request, context }) =>
@@ -654,12 +660,15 @@ export const make = Effect.gen(function* () {
   const readRepository = Effect.fn("GitHubSourceControlProvider.readRepository")(function* (
     locator: GitHubRepositoryLocator,
   ) {
-    const response = yield* rest({
-      host: locator.host,
-      operation: "getRepository",
-      path: `repos/${encodeURIComponent(locator.owner)}/${encodeURIComponent(locator.name)}`,
-      allowReserve: true,
-    });
+    const response = yield* rest(
+      {
+        host: locator.host,
+        operation: "getRepository",
+        path: `repos/${encodeURIComponent(locator.owner)}/${encodeURIComponent(locator.name)}`,
+        allowReserve: true,
+      },
+      REPOSITORY_NOT_FOUND,
+    );
     const decoded = decodeRawRepository(response.body);
     if (Result.isFailure(decoded)) {
       return yield* failure("GitHub returned an invalid repository.", decoded.failure);
@@ -678,13 +687,10 @@ export const make = Effect.gen(function* () {
     return decoded.success.login;
   });
 
+  // Git and filesystem errors can carry arguments, paths and stderr, so the detail a client
+  // sees is fixed and the raw error stays in `cause`.
   const gitFailure = (cause: unknown) =>
-    failure(
-      cause instanceof Error && cause.message.trim() !== ""
-        ? cause.message.trim()
-        : "GitHub request failed.",
-      cause,
-    );
+    failure("The pull request could not be checked out with git.", cause);
 
   const runGit = (cwd: string, operation: string, args: ReadonlyArray<string>) =>
     git.execute({
@@ -929,7 +935,11 @@ export const make = Effect.gen(function* () {
         const locator = yield* resolveRepository({ cwd: input.cwd });
         const body = yield* fileSystem
           .readFileString(input.bodyFile)
-          .pipe(Effect.mapError(gitFailure));
+          .pipe(
+            Effect.mapError((cause) =>
+              failure("The pull request description could not be read.", cause),
+            ),
+          );
         yield* rest({
           host: locator.host,
           operation: "createPullRequest",
@@ -975,14 +985,18 @@ export const make = Effect.gen(function* () {
         const name = locator?.name ?? input.repository.trim();
         const host = locator?.host ?? (environment.GH_HOST?.trim().toLowerCase() || "github.com");
         const isViewer = viewer !== null && owner?.toLowerCase() === viewer.toLowerCase();
-        const response = yield* rest({
-          host,
-          operation: "createRepository",
-          method: "POST",
-          path:
-            isViewer || owner === null ? "user/repos" : `orgs/${encodeURIComponent(owner)}/repos`,
-          body: { name, private: input.visibility === "private" },
-        });
+        const response = yield* rest(
+          {
+            host,
+            operation: "createRepository",
+            method: "POST",
+            path:
+              isViewer || owner === null ? "user/repos" : `orgs/${encodeURIComponent(owner)}/repos`,
+            body: { name, private: input.visibility === "private" },
+          },
+          // GitHub answers 404 for an organization the account cannot create repositories in.
+          `No organization named ${owner ?? "that"} that this account can create repositories in.`,
+        );
         const decoded = decodeRawRepository(response.body);
         if (Result.isFailure(decoded)) {
           return yield* failure("GitHub returned an invalid repository.", decoded.failure);