fix(server): look up GitLab repositories pasted as a URL

[CyberStefNef]

GitLab repository lookup encodes a pasted Git URL as the API project ID, producing requests such as projects/https%3A%2F%2F... instead of projects/group%2Fproject.

Normalize web, clone, SSH, scp-style, and project-content links to the namespace/project path. Read the configured relative installation root when present, preserve nested namespaces, and leave bare project paths unchanged. The API call still uses glab's existing host selection. It does not send authentication to an arbitrary pasted hostname.

Check the returned project's web host and the requested web port before returning clone URLs. SSH remotes do not identify a web port, so they retain the existing host-only check. During preparation, two regressions exposed a default-port bug in the original patch: web URLs with an omitted port or explicit 443 accepted a result from 8443. The fix distinguishes an unknown SSH web port from a known default web port.

Addresses #7849. Carries the relative-install-root cases requested from #7944.

Verification rebased onto main 82f64cd8:

• The normalization regression fails against the unchanged production implementation. Full URLs and SSH remotes are encoded into the project ID; the bare project-path control remains correct.
• The two new default-port controls fail on the original PR and pass after the fix. The existing SSH-to-nondefault-web-port control still passes.
• A review follow-up reproduced a Unicode installation root being sliced at the length of its lowercased spelling: İ/group/project became roup/project. Preserve the original prefix for slicing; the focused regression fails before and passes after this fix.
• vp test run apps/server/src/sourceControl/GitLabCli.test.ts apps/server/src/sourceControl/GitLabSourceControlProvider.test.ts apps/server/src/sourceControl/SourceControlRepositoryService.test.ts --maxWorkers=2: 36 tests pass. Targeted lint/format and the server typecheck pass.

Human review is required for host selection and installation-root behavior. Legitimate deployments with different SSH and web hostnames still fail the returned-web-host check; deciding how to trust or map those aliases remains unresolved. A live authenticated self-hosted GitLab check is also missing. These are explicit remaining gates, not claims of completed support. Leave this PR unmerged.

Refreshed September 5 onto main ce4712d, which fixes the Ubuntu CI mirror transport upstream. Both changed source/test files are byte-identical to the previously reviewed candidate. All 36 focused tests, the server typecheck and targeted lint/format pass again. Current-head CI and Bugbot pass at 1116c2ed. All ten review threads are resolved, with no active change requests. The earlier approvability rejection and the stated human decisions remain; passing CI does not waive them. The previous CI run 33935585794 exhausted its one retry on the old HTTP mirror failure; it is not counted as passing. This PR adds no workflow changes or bypasses. The stated human and live-account gates remain, so it is not merge-ready.

The verification uses production services with a recorded process boundary, not a live account. Screenshots cannot establish request arguments and no visual change is claimed.

Original implementation by StefNef. Port regression fix and updated verification by GPT 6 Astra via Codex in T3 Code.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR changes production GitLab repository resolution by adding URL parsing, installation-root handling, configuration reads, and host/port mismatch failures, with behavior varying across self-hosted deployments. It also adds several line-level static-analysis diagnostic suppressions in the tests, so the change warrants explicit review.

No code changes detected at 1116c2e. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Note

🤖 GPT-6 Astra (preview) responding on behalf of Theo

This note is part of an automated cleanup pass.

Carry the relative-install-root cases from #7944 at head 56ceb832 into this parser. For https://example.com/gitlab/group/project.git, both example.com/gitlab and https://example.com/gitlab from glab config get host must yield API project path group/project. Keep nested subgroups and the test that a bare project path skips the config lookup. Preserve the returned-host check, and handle legitimate SSH/web host or port differences explicitly. The relative-root cases are not implemented here yet.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bce6c0582e31ff32e941519efa9d89f8552818c9. Configure here.}

[juliusmarminge]

Reproduced #7849 with the production GitLabCli.getRepositoryCloneUrls: passing https://sourcecontrol.example.com/group/project produces glab api projects/https%3A%2F%2Fsourcecontrol.example.com%2Fgroup%2Fproject. The full URL is used as the project ID. Tested at dd7bc147; this code is unchanged through September 4 main 0dd5c64b.

Keep this existing PR rather than opening another fix. Human review is still needed for its host-validation and install-root behavior, including legitimate separate SSH/web host names and ports. The isolated fixture does not establish live self-hosted authentication or validate every input shape in this PR. No merge-readiness claim yet.

GPT 6 Astra via Codex in T3 Code.

[valshin]

One related case this doesn't cover, which is expected since it's out of scope here: bare project names still fail on GitLab after this change. project is sent as glab api projects/project and returns 404, while user/project works. GitHub doesn't have this problem, because gh repo view project resolves the name to the user's own account.

I don't think this PR should special-case it. Prefixing the current username would only fix personal projects, not group ones (app → group/subgroup/app). A search-backed picker fixes both, and I've suggested a GitLab implementation for the optional search capability in #13228.

[maria-rcks]

Note

Written by claude-opus-5-5 on behalf of Maria

Hi! We are cleaning up open PRs, and this one names a harness (Codex) but not which model version created it. If this change is really important, we recommend rebuilding the PR with a newer model and noting the model in the PR description.