Files
orca/src/main/runtime/runtime-git-command-target.ts
T
Neil d5750648c2 fix(runtime): route runtime Git by resolved execution host, not repo connectionId (#18307)
`RuntimeGitTarget` carried `connectionId?: string` and no host id, so `undefined`
spelled three different answers at once — "runtime: host", "unresolved", and
"genuinely local". Its sole resolver read `store.getRepo(worktree.repoId)?.connectionId`
and never looked at `worktree.hostId`, which outranks every repo row, so one
arbitrarily chosen row decided the execution host for 36 downstream dispatches.

The target now carries `executionHostId: ExecutionHostId` (never null, never
optional), resolved through the shared rule that landed with #17909/#17919 and
dispatched through the host-keyed routes from #18296. Dispatch sites call
`requireRuntimeGitProvider`, where `null` means exactly one thing: the host is
`local` and the command runs here as free functions.

Four answers that used to collapse into one:

- `ssh:x` with a rival row on `ssh:y` — routes to x. Previously the first row won,
  which is the reproduced cross-host leak.
- `local` with a surviving `connectionId` — a row contradicting itself; no SSH
  connection is handed out.
- `runtime:<env>` — throws `ExecutionHostNotDispatchableError`. Its repo row's
  connection names a target in the *server's* namespace; dialling it here reaches a
  same-named target on this client.
- rival rows disagreeing with no worktree host — `worktree_execution_host_unresolved`,
  matching the launch path rather than guessing a row.

An unreachable SSH host still throws `SSH_GIT_PROVIDER_UNAVAILABLE_MESSAGE`; loss of
contact is never evidence of locality (docs/reference/ssh-execution-boundary.md).

`resolveWorktreeLaunchHost` keeps its exact signature and now delegates to
`resolveWorktreeHostRouting`, the same resolution answering "which host is this on"
rather than "what may this client dial" — the git target needs the first question
because `local` and `runtime:` are two different non-SSH answers.

No wire change: `RuntimeGitTarget` is main-process internal, and the SSH and local
model-discovery host keys are byte-identical to before.

`RuntimeFileTarget` has the same defect in ~30 filesystem dispatches and is
deliberately left for a follow-up.
2026-09-02 19:26:07 -07:00

106 lines
5.0 KiB
TypeScript

import { LOCAL_EXECUTION_HOST_ID, type ExecutionHostId } from '../../shared/execution-host'
import type { GlobalSettings } from '../../shared/global-settings-types'
import type { Repo } from '../../shared/repo-types'
import type { GitPushTarget, GitWorktreeInfo, Worktree } from '../../shared/worktree/types'
import type { GitRuntimeOptions } from '../git/git-runtime-options'
import {
ExecutionHostNotDispatchableError,
resolveGitRouteForHost
} from '../providers/execution-host-provider-dispatch'
import { SSH_GIT_PROVIDER_UNAVAILABLE_MESSAGE } from '../providers/ssh-git-dispatch'
import type { SshGitProvider } from '../providers/ssh-git-provider'
import type { CommitMessageAgentEnvironmentResolvers } from '../text-generation/commit-message-agent-environment'
import type { PullRequestLinkedIssueMeta } from '../source-control/pull-request-linked-issue'
import { normalizeRuntimeRelativePath } from './runtime-relative-paths'
export type ResolvedRuntimeGitWorktree = Worktree & { git: GitWorktreeInfo }
export type RuntimeGitTarget = {
worktree: ResolvedRuntimeGitWorktree
/**
* Display and settings metadata only (shared-link paths, source-control AI defaults). It can be
* a same-id row from another host when the worktree's own host carries none, so it must not
* decide routing — `executionHostId` does.
*/
repo?: Repo
/**
* The host this worktree's Git runs on. Never optional and never null: the field it replaced
* (`connectionId?: string`) spelled "runtime host", "unresolved" and "genuinely local" all as
* `undefined`, so every path that could not resolve answered "local" and ran remote work on the
* client (#11163). Unresolved now fails at resolution time instead of arriving here as a
* silently-local target.
*/
executionHostId: ExecutionHostId
/** Only consulted when `executionHostId` is `local`; see `localGitOptionsForTarget`. */
localGitOptions?: GitRuntimeOptions
}
export type RuntimeGitCommandHost = {
resolveRuntimeGitTarget(selector: string): Promise<RuntimeGitTarget>
getRuntimeSettings(): GlobalSettings
getCommitMessageAgentEnvironment?(): CommitMessageAgentEnvironmentResolvers | undefined
/** `undefined` keeps cached metadata; `null` is the authoritative unlinked answer. */
getWorktreeLinkedIssue?(worktreeId: string): number | null | undefined
getWorktreeLinkedIssueMeta?(worktreeId: string): PullRequestLinkedIssueMeta | null | undefined
/** Why (#17828 review follow-up): RuntimeGitSyncCommands deliberately materializes with
* no store (avoids unrelated ownership-inheritance/refspec-migration side effects), so a
* lazily-minted remote still needs a way back into the store's `pushTarget.remoteCreated`
* for #17842's orphan sweep. Called only when materialize reports `remoteCreated: true`. */
persistMaterializedPushTarget?(worktreeId: string, pushTarget: GitPushTarget): void
}
/**
* The two hosts this process can itself execute a runtime Git command on, narrowed from the shared
* host-keyed route in `src/main/providers/execution-host-provider-dispatch.ts`.
*
* `runtime:<env>` is deliberately not a variant. Its Git is executed by that environment's own
* server, and the SSH target on its repo row is that server's *nested* one — addressable only as
* the pair (environmentId, targetId). Handing that id to this client's SSH table dials a
* same-named target in the wrong namespace, so it throws rather than routing.
*/
export type RuntimeGitRoute =
| { kind: 'local' }
/** `provider: null` is "remote and currently unreachable" — never "run it here". */
| { kind: 'ssh'; connectionId: string; provider: SshGitProvider | null }
export function runtimeGitRouteForTarget(target: RuntimeGitTarget): RuntimeGitRoute {
const route = resolveGitRouteForHost(target.executionHostId)
switch (route.kind) {
case 'local':
return { kind: 'local' }
case 'ssh':
return { kind: 'ssh', connectionId: route.connectionId, provider: route.provider }
case 'runtime':
throw new ExecutionHostNotDispatchableError(route.hostId)
}
}
/**
* `null` means exactly one thing: the host is `local`, and this command runs here as free
* functions. An unreachable SSH host and a `runtime:` host both throw.
*/
export function requireRuntimeGitProvider(target: RuntimeGitTarget): SshGitProvider | null {
const route = runtimeGitRouteForTarget(target)
if (route.kind === 'local') {
return null
}
if (!route.provider) {
throw new Error(SSH_GIT_PROVIDER_UNAVAILABLE_MESSAGE)
}
return route.provider
}
export function localGitOptionsForTarget(target: RuntimeGitTarget): GitRuntimeOptions {
// WSL routing describes *this* machine; no remote host may inherit it.
return target.executionHostId === LOCAL_EXECUTION_HOST_ID ? (target.localGitOptions ?? {}) : {}
}
export function normalizeRuntimeGitRelativePath(filePath: string): string {
const relativePath = normalizeRuntimeRelativePath(filePath)
if (relativePath === '') {
// Why: an empty Git pathspec can mutate the whole worktree.
throw new Error('invalid_relative_path')
}
return relativePath
}