From ade4e9d3e01be7a90f037e06a5c0262b0c73288f Mon Sep 17 00:00:00 2001
From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Date: Mon, 10 Aug 2026 21:32:04 -0700
Subject: [PATCH] fix(project-groups): preserve repo owner routing

---
 src/main/ipc/repos.ts        |  7 ++++++-
 src/main/persistence.test.ts | 11 +++++++++++
 src/main/persistence.ts      |  6 +++++-
 3 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/src/main/ipc/repos.ts b/src/main/ipc/repos.ts
index 1e3e8578730..37e1bddd49e 100644
--- a/src/main/ipc/repos.ts
+++ b/src/main/ipc/repos.ts
@@ -1780,7 +1780,12 @@ export function registerRepoHandlers(mainWindow: BrowserWindow, store: Store): v
           const group = groupResolver.getGroupForRepo(repoPath)
           if (existing) {
             if (group) {
-              store.moveProjectToGroup(existing.id, group.id, projectGroupOrder)
+              store.moveProjectToGroup(
+                existing.id,
+                group.id,
+                projectGroupOrder,
+                getRepoExecutionHostId(existing)
+              )
             }
             importedProjectIdsByRepoPath.set(normalizedImportRepoPath, existing.id)
             results.push({ path: repoPath, projectId: existing.id, status: 'already-known' })
diff --git a/src/main/persistence.test.ts b/src/main/persistence.test.ts
index f9199defa7a..771ba1c8b1f 100644
--- a/src/main/persistence.test.ts
+++ b/src/main/persistence.test.ts
@@ -3953,6 +3953,17 @@ describe('Store', () => {
     expect(updated?.projectGroupOrder).toBe(1)
   })
 
+  it('rejects repo membership in a group owned by another host', async () => {
+    const store = await createStore()
+    store.addRepo(makeRepo({ id: 'local-repo', path: '/local' }))
+    const remoteGroup = store.createProjectGroup({ name: 'Remote', createdFrom: 'manual' })
+    remoteGroup.executionHostId = 'runtime:env-1'
+
+    const updated = store.updateRepo('local-repo', { projectGroupId: remoteGroup.id }, 'local')
+
+    expect(updated?.projectGroupId).toBeNull()
+  })
+
   it('updates repo execution host identity', async () => {
     const store = await createStore()
     store.addRepo(makeRepo({ id: 'r1' }))
diff --git a/src/main/persistence.ts b/src/main/persistence.ts
index 5dea1b4abf9..f6ca234051e 100644
--- a/src/main/persistence.ts
+++ b/src/main/persistence.ts
@@ -5030,7 +5030,11 @@ export class Store {
       if (
         typeof nextGroupId !== 'string' ||
         nextGroupId.trim().length === 0 ||
-        !this.state.projectGroups.some((group) => group.id === nextGroupId)
+        !resolveProjectGroupMembership(
+          buildProjectGroupOwnerIndex(this.state.projectGroups),
+          nextGroupId,
+          getRepoExecutionHostId(repo)
+        )
       ) {
         sanitizedUpdates.projectGroupId = null
       }