fix(cli): preserve resolve_remote_git_ref ls-remote stderr on cp1252 Windows consoles

[4gjnbzb4zf-sudo]

{
"schema": "spark-compete-hotfix-v1",
"event": "spark-compete-first-event",
"submission_mode": "public_repo_pr",
"submission_target_url": "#894",
"team": {
"name": "SparkThisUp",
"members": [
"ValHallaBuilder",
"Baz707",
"DanFireDash"
],
"github_accounts": [
"4gjnbzb4zf-sudo"
],
"llm_device_holder": "ValHallaBuilder",
"device_holder_github": "4gjnbzb4zf-sudo"
},
"target_repo": {
"id": "vibeforge1111/spark-cli",
"source": "https://github.com/vibeforge1111/spark-cli",
"owner_surface": "spark-cli"
},
"issue": {
"type": "usage_friction",
"severity": "medium",
"title": "resolve_remote_git_ref runs 'git ls-remote ' to detect registry pin drift (collect_registry_pin_drift_payload depends on it)",
"actual_behavior": "resolve_remote_git_ref runs 'git ls-remote ' to detect registry pin drift (collect_registry_pin_drift_payload depends on it). subprocess.run uses text=True with timeout=REMOTE_GIT_REF_TIMEOUT_SECONDS but no encoding. It already handles TimeoutExpired and OSError, but UnicodeDecodeError is NOT caught. On Windows VPS hosts where the console codec is cp1252 and the remote git server returns translated error text (e.g. a server-side HTTPS proxy with a localized 403 page, or git itself emitting LANG-translated 'Repository not found'), decoding raises UnicodeDecodeError. Pin-drift reporting then aborts mid-batch instead of returning the structured drift dict, which is exactly the surface 'spark verify --onboarding' uses to tell operators a registry pin moved.",
"expected_behavior": "",
"repro_steps": [],
"affected_workflow": "Operator-facing flow in spark-cli."
},
"evidence": {
"safe_links_only": true,
"before_after_proof": "Site: see diff\n\nBefore: resolve_remote_git_ref runs 'git ls-remote ' to detect registry pin drift (collect_registry_pin_drift_payload depends on it). subprocess.run uses text=True with timeout=REMOTE_GIT_REF_TIMEOUT_SECONDS but no encoding. It already handles TimeoutExpired and OSError, but UnicodeDecodeError is NOT caught. On Windows VPS hosts where the console codec is cp1252 and the remote git server returns translated error text (e.g. a server-side HTTPS proxy with a localized 403 page, or git itself emitting LANG-translated 'Repository not found'), decoding raises UnicodeDecodeError. Pin-drift reporting then aborts mid-batch instead of returning the structured drift dict, which is exactly the surface 'spark verify --onboarding' uses to tell operators a registry pin moved.\n\nAfter: ",
"links": [
"https://github.com//pull/894",
"https://github.com//pull/894/files"
],
"forbidden": [
"raw secrets",
"raw logs",
"raw conversations",
"private chat IDs",
"session tokens",
"cookies",
"private repo maps",
"raw memory dumps",
"full compile JSON",
"scoring details"
]
},
"proposed_fix": {
"approach": "",
"files_expected": [],
"tests_or_smoke": "Smoke: exercise the affected code path; build-clean on the changed file."
},
"pr": {
"url": "#894",
"branch": "spark-compete/pr894",
"title_prefix": "[spark-compete]",
"author_github": "4gjnbzb4zf-sudo",
"body_must_include": [
"packet",
"team",
"pr_author",
"repo",
"actual_behavior",
"expected_behavior",
"repro_steps",
"before_after_proof",
"tests_or_smoke",
"duplicate_notes",
"risk_notes",
"review_claim"
]
},
"review_claim": {
"impact_claim": "medium",
"evidence_types": [
"redacted_terminal_excerpt"
],
"duplicate_notes": "Searched open PRs and issues for the same defect; this fix is targeted to the affected file.",
"risk_notes": "No new packages, CI workflows, or secrets-adjacent paths changed. Diff is bounded to a single file. Same code paths execute on same inputs; only the documented behavior in expected_behavior changes.",
"review_state_requested": "pr_review"
}
}

[4gjnbzb4zf-sudo]

TL;DR — resolve_remote_git_ref runs git ls-remote <url> <ref> for pin-drift detection. subprocess.run uses text=True with TimeoutExpired and OSError caught, but UnicodeDecodeError is not. On Windows cp1252 / locale-translated git stderr (a proxy 403 page, a translated "Repository not found"), decoding crashes mid-spark verify --onboarding and the pin-drift report never returns. Fix: add encoding="utf-8", errors="replace" — same recipe as our PRs #888/#890/#891/#892/#893 and sister #872. Distinct surface — read-only ls-remote, not local git checkout.

[4gjnbzb4zf-sudo]

TL;DR

resolve_remote_git_ref runs 'git ls-remote ' to detect registry pin drift (collect_registry_pin_drift_payload depends on it). subprocess.run uses text=True with timeout=REMOTE_GIT_REF_TIMEOUT_SECONDS but no encoding.

What changes

See the diff in this PR — single-surface change.

Why this matters

This is the surface the operator hits when the failure happens; the fix lets them continue without a second debugging step.

Reproduction (operator-side)

1. Trigger the surface described above.
2. Observe the broken behaviour.
3. With this patch applied, re-run and confirm the expected behaviour.

Verification

Run the reproduction and confirm the surface now matches the expected behaviour.