🤖 fix: branch SSH workspaces from upstream source

[ethanndickson]

Summary

Fresh SSH/Coder workspaces now treat the selected Source Branch as the upstream remote-tracking branch when it is available, instead of letting the synced local snapshot in refs/mux-bundle/* override it.

Issue

A newly-created Coder workspace on an SSH runtime could immediately show as hundreds of commits behind origin/main even when the UI's Source Branch was set to main. In the reported case, the workspace was created on pog2.coder with Source Branch main, and the UI showed it as 236 commits behind origin/main right after creation. That is surprising because selecting main should mean the fresh workspace starts from upstream origin/main, so the initial behind count should be zero.

Why it happened

The SSH worktree refactor split the remote VM's shared bare repo into two different kinds of refs: refs/mux-bundle/main is the user's local laptop main uploaded as a transport snapshot, while refs/remotes/origin/main is the actual upstream branch fetched on the SSH host. Fresh workspace creation still treated the uploaded local snapshot as eligible to define the new workspace base. Specifically, it only chose origin/<source> if the local snapshot ref could fast-forward to upstream; if local main was stale, ahead, diverged, or the origin fetch path failed, mux fell back to refs/mux-bundle/main. A background fetch could then update origin/main to the real upstream tip, making the newly-created workspace appear immediately behind even though the user explicitly selected Source Branch main.

How this fixes it

Fresh SSH checkout now uses a remote-first source selection policy. It fetches the selected source branch into an explicit remote-tracking ref, verifies that refs/remotes/origin/<source> exists, and bases the new worktree on origin/<source> whenever that upstream source is available. refs/mux-bundle/* remains as a transport/local-snapshot cache and is used only as an explicit fallback when the upstream source branch cannot be fetched. The existing fast-forward safety check is preserved for existing workspace re-init paths, where protecting local workspace state still matters.

Implementation

The fresh SSH checkout path now fetches with an explicit refspec like +refs/heads/main:refs/remotes/origin/main, resolves the fresh workspace base with origin/<source> first, and logs when it has to fall back to the local snapshot. Tests cover the upstream-first selection, explicit fallback behavior, and the new fetch refspec.

Risks

This changes fresh SSH/Coder workspace initialization semantics when a local branch is ahead of or diverged from upstream. That is intentional for the Source Branch selector, but users relying on local main drift as the implicit fresh-workspace base will now need to create from that local branch explicitly or rely on the logged fallback when upstream is unavailable.

---

Generated with mux • Model: openai:gpt-5.5 • Thinking: xhigh • Cost: $13.34

[ethanndickson]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".