requireRuntimeGitProvider now returns a provider for the local host too (the
local git provider, built per call from the worktree's WSL options and shared
link paths), so the runtime git commands drop their "SSH provider, else local
free function" branches. Push-target materialization stays host-specific and
moves into one helper. Branch-diff keeps its two arms because the local git
function returns one pinned diff, not the contract's list.
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
`RuntimeGitTarget` carried `connectionId?: string` and no host id, so `undefined`
spelled three different answers at once — "runtime: host", "unresolved", and
"genuinely local". Its sole resolver read `store.getRepo(worktree.repoId)?.connectionId`
and never looked at `worktree.hostId`, which outranks every repo row, so one
arbitrarily chosen row decided the execution host for 36 downstream dispatches.
The target now carries `executionHostId: ExecutionHostId` (never null, never
optional), resolved through the shared rule that landed with #17909/#17919 and
dispatched through the host-keyed routes from #18296. Dispatch sites call
`requireRuntimeGitProvider`, where `null` means exactly one thing: the host is
`local` and the command runs here as free functions.
Four answers that used to collapse into one:
- `ssh:x` with a rival row on `ssh:y` — routes to x. Previously the first row won,
which is the reproduced cross-host leak.
- `local` with a surviving `connectionId` — a row contradicting itself; no SSH
connection is handed out.
- `runtime:<env>` — throws `ExecutionHostNotDispatchableError`. Its repo row's
connection names a target in the *server's* namespace; dialling it here reaches a
same-named target on this client.
- rival rows disagreeing with no worktree host — `worktree_execution_host_unresolved`,
matching the launch path rather than guessing a row.
An unreachable SSH host still throws `SSH_GIT_PROVIDER_UNAVAILABLE_MESSAGE`; loss of
contact is never evidence of locality (docs/reference/ssh-execution-boundary.md).
`resolveWorktreeLaunchHost` keeps its exact signature and now delegates to
`resolveWorktreeHostRouting`, the same resolution answering "which host is this on"
rather than "what may this client dial" — the git target needs the first question
because `local` and `runtime:` are two different non-SSH answers.
No wire change: `RuntimeGitTarget` is main-process internal, and the SSH and local
model-discovery host keys are byte-identical to before.
`RuntimeFileTarget` has the same defect in ~30 filesystem dispatches and is
deliberately left for a follow-up.
OrcaWinandm4air
Neil