Verify GitLab repo source selectors

Co-authored-by: Orca <help@stably.ai>

notes/host-context-implementation-checklist.md

@@ -136,7 +136,7 @@ Done means: Local, SSH, remote server, and future cloud VMs share one Host model
 - [x] Integration-test project available on local and SSH hosts, then create workspaces on each host.
 - [x] Integration-test task source on Host A with workspace run on Host B.
 - [ ] Integration-test two hosts with different GitHub accounts and verify issue/PR lists and mutations use the selected source.
-- [ ] Integration-test GitLab where path-only selectors previously existed.
+- [x] Integration-test GitLab where path-only selectors previously existed.
 - [~] Integration-test Linear/Jira with explicit source account selection.
 - [x] Integration-test automations on local host, SSH host, and remote server where supported.
 - [x] Integration-test disconnected host UX for Tasks, New Workspace modal, sidebar, and automations.
@@ -296,6 +296,7 @@ Done means: reviewers and future agents can understand the vision, implementatio
 - [x] 2026-06-13: Routed File Explorer directory reads, stat/import/create/move/duplicate operations, ignored-file checks, and background git/conflict polling through the selected worktree runtime owner instead of ambient focused settings. Verified with focused right-sidebar boundary/projection/polling/drag tests, targeted oxlint, `git diff --check`, and full `pnpm run typecheck`.
 - [x] 2026-06-13: Fed runtime-owned GitHub/GitLab preflight into Tasks source availability by checking each available, task-source-capable runtime host with `preflight.check` and applying that host's `gh`/`glab` auth/tool status to only its own task sources. Verified with provider availability tests, TaskPage source-boundary tests, source-summary tests, targeted oxlint, `git diff --check`, and full `pnpm run typecheck`.
 - [x] 2026-06-13: Completed Tasks source picker/display and drawer mutation verification by combining prior Electron source-display coverage with source-boundary regression tests for GitHub, GitLab, Linear, and Jira drawers. The mutation tests assert provider actions reuse the drawer item's `TaskSourceContext`/repo selector and source-scoped optimistic patches; live mutation against external providers was intentionally not performed to avoid modifying real issues. Verified with 5 focused task/source tests, targeted oxlint, full `pnpm run typecheck`, and `git diff --check`.
+- [x] 2026-06-13: Completed GitLab path-only selector verification. GitLab Tasks/list/detail/mutation paths now carry `repoId`/`TaskSourceContext`, desktop IPC validates repo/source-host mismatches, runtime/RPC tests route selectors as `id:<repoId>` and preserve `projectRef`, and web preload now has explicit repo-id selector coverage instead of only path fallback coverage. Verified with GitLab IPC/runtime/source-boundary/web-preload tests, targeted oxlint, full `pnpm run typecheck`, and `git diff --check`.
 - [x] 2026-06-13: Fed saved automation source contexts into Run Now availability so internal Orca automations now disable before dispatch when the saved source host is unavailable, still checking capabilities, missing task-source support, missing GitHub/GitLab auth, or missing provider tooling. Verified with focused automation availability tests, provider availability tests, targeted oxlint, `git diff --check`, and full `pnpm run typecheck`.
 - [x] 2026-06-13: Closed another request/cache ownership slice by routing right-sidebar search, create-review field generation, browser tab default profile selection, Smart Workspace GitHub/GitLab/Linear lookups, GitHub Project browse cache, Project slug comments, and standalone GitHub issue comments through explicit worktree/repo/source ownership instead of ambient focused runtime state. Verified with focused ownership/browser/smart-submit tests, targeted oxlint, `git diff --check`, and full `pnpm run typecheck`.
 - [x] 2026-06-13: Routed Quick Open file listing through the selected worktree runtime owner instead of ambient focused settings, matching File Explorer and sidebar search ownership. Verified with focused Quick Open and file-owner boundary tests, targeted oxlint, `git diff --check`, and full `pnpm run typecheck`.

notes/multihost-remote-verification-report.html

@@ -285,6 +285,12 @@
             task source context or repo selector through provider mutations and source-scoped
             optimistic patches; live external mutations were skipped to avoid editing real issues.
           </li>
+          <li class="pass">
+            GitLab path-only selector replacement is covered across renderer, desktop IPC, runtime
+            RPC, and web preload. The web preload regression now verifies that GitLab task/detail
+            mutation calls use <code>repo: id:&lt;repoId&gt;</code> when a repo id is supplied while
+            preserving the original task source context.
+          </li>
           <li class="pass">
             Focused locked-SSH Add Project regression test passed:
             <code>src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx</code>,

src/renderer/src/web/web-preload-api.test.ts

@@ -4,6 +4,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { PreloadApi } from '../../../preload/api-types'
 import type { FeatureInteractionState } from '../../../shared/feature-interactions'
 import type { RuntimeRpcResponse } from '../../../shared/runtime-rpc-envelope'
+import type { TaskSourceContext } from '../../../shared/task-source-context'
 
 class MemoryStorage implements Storage {
   private readonly values = new Map<string, string>()
@@ -1974,6 +1975,101 @@ describe('web GitLab preload API', () => {
     )
   })
 
+  it('routes GitLab repo selectors through repo id when provided', async () => {
+    const runtimeCalls: { method: string; params: unknown }[] = []
+    vi.doMock('./web-runtime-client', () => ({
+      WebRuntimeClient: class {
+        call(method: string, params?: unknown): Promise<RuntimeRpcResponse<unknown>> {
+          runtimeCalls.push({ method, params })
+          return Promise.resolve({
+            id: `call-${runtimeCalls.length}`,
+            ok: true,
+            result: method === 'gitlab.workItemDetails' ? null : { ok: true, items: [] },
+            _meta: { runtimeId: 'runtime-1' }
+          })
+        }
+
+        close(): void {}
+      }
+    }))
+
+    const globals = installBrowserGlobals('Linux')
+    writeStoredRuntimeEnvironment(globals.storage)
+    const { installWebPreloadApi } = await import('./web-preload-api')
+    installWebPreloadApi()
+    const api = globals.window.api
+    const sourceContext: TaskSourceContext = {
+      kind: 'task-source',
+      provider: 'gitlab',
+      projectId: 'gitlab:gitlab.example.com/group/project',
+      hostId: 'runtime:web-env-1',
+      repoId: 'repo-gitlab-runtime',
+      providerIdentity: {
+        provider: 'gitlab',
+        projectId: '42',
+        namespace: 'group',
+        project: 'project',
+        webUrl: 'https://gitlab.example.com/group/project'
+      }
+    }
+
+    await api.gl.listIssues({
+      repoPath: '/workspace/repo',
+      repoId: 'repo-gitlab-runtime',
+      sourceContext,
+      state: 'opened'
+    })
+    await api.gl.updateMR({
+      repoPath: '/workspace/repo',
+      repoId: 'repo-gitlab-runtime',
+      sourceContext,
+      iid: 9,
+      updates: { title: 'New title' }
+    })
+    await api.gl.workItemDetails({
+      repoPath: '/workspace/repo',
+      repoId: 'repo-gitlab-runtime',
+      sourceContext,
+      iid: 9,
+      type: 'mr'
+    })
+
+    expect(runtimeCalls).toEqual([
+      {
+        method: 'gitlab.listIssues',
+        params: {
+          repoPath: '/workspace/repo',
+          repoId: 'repo-gitlab-runtime',
+          sourceContext,
+          repo: 'id:repo-gitlab-runtime',
+          state: 'opened'
+        }
+      },
+      {
+        method: 'gitlab.updateMR',
+        params: {
+          repoPath: '/workspace/repo',
+          repoId: 'repo-gitlab-runtime',
+          sourceContext,
+          repo: 'id:repo-gitlab-runtime',
+          iid: 9,
+          updates: { title: 'New title' }
+        }
+      },
+      {
+        method: 'gitlab.workItemDetails',
+        params: {
+          repoPath: '/workspace/repo',
+          repoId: 'repo-gitlab-runtime',
+          sourceContext,
+          repo: 'id:repo-gitlab-runtime',
+          iid: 9,
+          type: 'mr'
+        }
+      }
+    ])
+  })
+
   it('exposes the GitLab task methods used by the shared Tasks page', async () => {
     const runtimeCalls: { method: string; params: unknown }[] = []
     vi.doMock('./web-runtime-client', () => ({