[Bug]: Recent upstream commits are attributed to the agent during a pure fast-forward sync #25452

Before submitting

• I searched existing issues and found related reports, but no open report of this specific timestamp edge case.
• I included reproduction steps, observed results, and investigation limits.

Area

apps/server

Summary

A turn that only synchronizes a clean repository can still show a changed-files card for imported upstream files when their commit timestamps are later than the preceding checkpoint.

This appears to be an uncovered case of #10348, closed by #17161. The closing comment explicitly invites a new report if external Git changes are still attributed to the agent after that fix.

Related open issue #22315 concerns cross-chat attribution in a shared checkout. Its concrete reproduction involves another thread's uncommitted edits. This report instead concerns a pure fast-forward importing a recent upstream commit, without concurrent edits being needed to reproduce the classifier behavior.

Steps to reproduce

1. Open a clean Git repository in T3 Code and complete a turn to establish a checkpoint.
2. In an upstream repository, prepare a commit whose committer timestamp is later than that checkpoint.
3. Ask the agent to fetch upstream and fast-forward the local branch, without editing files or creating commits.
4. Wait for the turn to finish.
5. Inspect the changed-files card and run git status --porcelain.

Expected behavior

No changed-files card appears: all content changes were imported through Git, not authored by this turn.

The source-control documentation states that files brought in by pulls, merges, or rebases are excluded from turn changes. Genuine edits, commits, and conflict resolutions by the agent should remain visible.

Actual behavior

The working tree is clean, but imported upstream files appear as changes made by the agent.

In the observed case, on 2026-10-26 (UTC+8):

The local branch fast-forwarded from aaf4a901c4 to 184d915d87. The agent did not edit repository files. After synchronization, local main, origin/main, and upstream/main matched, and git status --porcelain was empty.

The card nevertheless displayed 4 changed files, +349 / -438:

Recomputing the actual checkpoint diff with the authored-path filter reproduced these exact totals. The completion checkpoint's content tree matched the synchronized HEAD.

Source hint

GitVcsDriver.checkpoints.listAuthoredPaths includes paths from incoming commits selected by:

git log --since=@<preceding-checkpoint-timestamp> <startHead>..<endHead>

A recently created upstream commit satisfies this condition even though the agent did not author it. Its paths survive the import filter in CheckpointService. Their displayed line counts come from the full checkpoint-to-checkpoint diff, not just that incoming commit.

The cutoff is the preceding checkpoint's timestamp, not necessarily the current turn's start time. An upstream commit does not have to be created during the synchronization itself to trigger this case.

Verification and limits

An isolated Git fixture using the classifier's Git commands and fixed timestamps produced:

Upstream commit before checkpoint -> no retained files
Upstream commit after checkpoint  -> upstream-only.txt retained
AssertionError: Expected no agent changes; recent upstream commit was misattributed

Both cases performed only a fast-forward and ended with a clean working tree. There were no working-tree edits relative to either checkpoint's parent HEAD. The fixture reproduces the Git classification rule; it is not a full T3 integration test or an invocation of the Effect service itself. No fix has been implemented.

Impact

Minor bug or occasional failure. The card misleads users reviewing the agent's work. No data corruption was observed.

Version or commit

• Source inspected: main @ 184d915d8774615a01ebae0350235a1039852e85, which includes fix(checkpoint): pulls and rebases no longer flood a turn's changed files #17161.
• Current running desktop app bundle: 0.1.3-nightly.20261026.3710.
• The installed version at the original observation time was not separately recorded; the current version was read from the running app's bundle when preparing this report.

Environment

macOS 27.0, arm64, T3 Code Nightly desktop.

Workaround

Verify the current working tree separately with git status --porcelain. In a pure synchronization turn, the changed-files card should not be treated as evidence of uncommitted or agent-authored edits.