What causes "This repository is read-only over SSH." in phacility/phabricator?

Set 'Serve Over SSH' to 'Read/Write' on the repository's SSH URI (Manage URIs)

phacility/phabricator · error · Exception

This repository is read-only over SSH.

Error message

This repository is read-only over SSH.

What it means

The generic sibling of the protocol-command error: canServeProtocol() says the repository cannot serve writes over SSH and the SSH request carried no recognizable write protocol command. This shape is typical of the svnserve workflow, where writes are detected later inside the protocol stream. Reads over SSH may still work, but all write traffic is refused.

Source

Thrown at src/applications/diffusion/ssh/DiffusionSSHWorkflow.php:294

    $protocol = PhabricatorRepositoryURI::BUILTIN_PROTOCOL_SSH;
    if ($repository->canServeProtocol($protocol, true)) {
      $can_push = PhabricatorPolicyFilter::hasCapability(
        $viewer,
        $repository,
        DiffusionPushCapability::CAPABILITY);
      if (!$can_push) {
        throw new Exception(
          pht('You do not have permission to push to this repository.'));
      }
    } else {
      if ($protocol_command !== null) {
        throw new Exception(
          pht(
            'This repository is read-only over SSH (tried to execute '.
            'protocol command "%s").',
            $protocol_command));
      } else {
        throw new Exception(
          pht('This repository is read-only over SSH.'));
      }
    }

    $this->hasWriteAccess = true;
    return $this->hasWriteAccess;
  }

  protected function shouldSkipReadSynchronization() {
    $viewer = $this->getSSHUser();

    // Currently, the only case where devices interact over SSH without
    // assuming user credentials is when synchronizing before a read. These
    // synchronizing reads do not themselves need to be synchronized.
    if ($viewer->isOmnipotent()) {
      return true;
    }

View on GitHub (pinned to 5720a38cfe)

Solutions

Set 'Serve Over SSH' to 'Read/Write' on the repository's SSH URI (Manage URIs)
Use HTTP for SVN access if SSH write serving is disabled by policy
Re-check URI serving modes after cluster/device or hosting changes to make sure they survived

Defensive patterns

Strategy: validation

Validate before calling

if (!$repository->canServeProtocol(
      PhabricatorRepositoryURI::BUILTIN_PROTOCOL_SSH,
      true)) {
  // do not begin a write-capable SVN session
}

Prevention

Because SVN sessions mix reads and writes, gate the whole session on write serving, not just commit commands
Monitor URI serving-mode changes on SVN repositories

When it happens

Trigger: An svn+ssh session against a repository whose SSH URI serving mode is 'Read Only' or 'Off' - SVN mixes reads and writes in one session, so a checkout that attempts a commit hits this mid-session.

Common situations: Same misconfiguration as the protocol-command variant: SSH serving mode left read-only after repository setup or a URI migration; SVN users hit it without ever issuing an explicit push command.

Related errors

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/8c693c15e2334e72. Report an issue: GitHub.