[Fix] Mixed-provider workspaces fail during task launch

[roomote-community]

Created by Roomote. Follow up by mentioning @roomote, in the web UI, or in Discord.

What changed

• Add an optional per-repository provider map to task payloads while preserving the existing scalar provider contract and serialized shape for single-provider workspaces.
• Resolve mixed providers from connected repository rows in caller-defined order, preserve selection order through setup persistence and prompts, and stamp fresh, resumed, relaunched, and auto-resolved PR tasks.
• Make selection order define the primary compatibility provider while comparing picker selections as sets so reordering alone does not regenerate task suggestions.
• Prefer active same-name repository connections, with inactive rows used only as a fallback when no active connection exists.
• Allow explicit mixed-provider repository selections while rejecting ambiguous or duplicate repository identities, repeated environment repository entries at write boundaries, ambiguous environment create/update configs, and environments spanning multiple GitHub App installations.
• Keep legacy stored environment configs readable and metadata-editable even when they contain repository entries that new writes no longer accept.
• Treat provider maps as authoritative, prevent task-wide hosts from leaking across mapped repositories, and inherit snapshot-resume hosts only with the matching provider context.
• Mint one credential set per provider with isolated retries, mint GitLab scoped tokens last to avoid orphaned tokens, redact broad deployment tokens after scoped credentials are derived, and merge runtime metadata fail-closed.
• Prepare each workspace repository with its own provider, including mapped all-repositories workspaces, and route pull request, merge request, and issue operations without applying the primary provider's host to mapped targets.
• Document mixed-provider credential and GitHub App installation requirements.

Why this change was made

Mixed-provider workspaces could be configured or selected, but task bootstrap assumed one provider across launch stamping, token provisioning, repository preparation, and source-control operations. The resulting fallback, launch restriction, or mismatched host could prevent these tasks from preparing all selected repositories correctly.

Impact

Environment-backed and explicitly selected tasks can now clone and operate on repositories from GitHub, GitLab, Gitea, Azure DevOps, and Bitbucket using provider-scoped credentials. The first selected repository remains the primary compatibility provider, reordering an unchanged setup selection no longer resets suggestions, and ambiguous or repeated repository identities fail on new writes instead of routing by database order or reaching mapping constraints. Existing stored configs remain parseable for read paths and metadata-only edits.

Fixes #1082

cc @jantekb

[roomote-community]

No code issues found. See task

• packages/sdk/src/server/lib/task-runs/dequeue-helpers.ts:454 The new repositoryProviders map is never consumed. Token creation still selects only payload.sourceControlProvider, and the worker receives that single token provider for every environment repository. A GitLab+GitHub environment will therefore mint credentials for only the first provider and still fail when it clones the other repository. Extend dequeue token provisioning and worker repository preparation to operate per repository/provider rather than only stamping the map.
• apps/worker/src/commands/setup/workspace/repositories.ts:161 Mixed all_repositories tasks still list repositories with only resolvedSourceControlProvider, which is the first provider stamped from the map. The API filters on that parameter, so every repository owned by secondary providers is omitted before the per-repository override can be applied. List the mapped repositories without a scalar filter, or fetch and merge each provider's list.
• packages/sdk/src/server/lib/pull-requests/source-control-pull-request-reads.ts:616 Target-provider routing still passes the task-wide sourceControlHost into lookup. For a mapped secondary repository, this is the primary repository's host (for example github.com for a GitLab target), so resolveRepositoryRow rejects the existing target repository. Resolve the host for the target repository too, and apply the same fix to write/create and issue operations.
• apps/web/src/trpc/commands/setup-new/index.ts:2497 Setup onboarding no longer rejects an ambiguous cross-provider selection. If GitHub and GitLab both contain owner/repo, the selected IDs are accepted, this picks the first provider, and buildSetupNewWorkspacePayload() deduplicates the matching full names, silently dropping the second repository before provider-map stamping. Reject duplicate full names across the selected IDs (or make the workspace selection provider-scoped) instead of launching a one-repository task.
• apps/web/src/trpc/commands/environments/index.ts:468 Environment create and update still resolve repositories only by fullName. Once GitHub and GitLab each expose owner/repo, getEnvironmentRepositoryRows() returns both rows but the Map at line 487/641 keeps one arbitrary ID, so the saved environment maps and later launches against the wrong provider. Reject ambiguous full names in these config paths (or persist a provider-qualified repository reference) instead of selecting a row by query order.
• apps/web/src/trpc/commands/environments/index.ts:159 getConfiguredRepositoryNames() removes repeated names before the new ambiguity check runs. A config that repeats the same repository passes validation, but create/update then inserts duplicate (environment_id, repository_id) mappings and fails the env_repo_mappings_unique constraint; the MCP create endpoint has the same pattern. Validate uniqueness in config.repositories before deduplicating names.

_{Reviewed 24b3d69}

[roomote-community]

Addressed both remaining findings in fa82104: mapped all-repositories workspaces now prepare every repository directly from the provider map (with GitLab token scope derived from that map), and PR/MR/issue routing no longer applies the primary provider's host to mapped secondary repositories. Focused worker, GitLab, and SDK suites pass (133 tests), along with lint, package type checks, and pre-push checks.

[roomote-community]

Reconciled the supplied review and pushed the remaining fixes in eed726d.

Fixed the valid findings: snapshot resumes no longer inherit a host from a different provider; mixed environment re-stamping clears unsafe scalar hosts; provider maps are authoritative for token and operation routing; retries are isolated per provider and GitLab scoped tokens mint last; and duplicate full-name setup selections are rejected instead of silently collapsed.

The name-based resolver no longer adds the unrelated active-only restriction. Bitbucket deployment-token redaction remains intentionally in place because worker credentials are generated separately and the deployment secret should not enter the sandbox. The shared provider-map parser also removes the duplicated unchecked casts, and the docs now state credential and GitHub App installation requirements.

[roomote-community]

Fixed the failing Test job in 315e0a0: repository IDs are now deduplicated in caller order before workspace construction, and the DB regression expectations reflect the order-preserving contract.

The complete @roomote/db suite passes locally (45 files), and the refreshed GitHub Actions CI run completed successfully, including the Test job and release-script tests.

[roomote-community]

Addressed the second review pass in 04ffc57: active repository rows now win over stale inactive duplicates; suggestion selections compare as sets; scan primary-provider resolution follows explicit repository order; out-of-scope operations preserve the scope error; and duplicate repository identities return validation errors across setup and environment create/update paths.

Also completed the requested cleanup: intentional Bitbucket deployment-token redaction is documented and tested, GitLab uses the shared provider-map parser, the API uses the shared payload-record helper, mapped all-repositories precedence is documented, and the obsolete nondeterministic primary resolver was removed.

Repeated config.repositories entries are rejected at web and MCP write boundaries, without tightening the shared read schema. The compatibility follow-up in 24b3d69 keeps existing duplicate configs parseable for custom skills, previews, and other readers; preserves metadata-only edits; restores environment lookup ordering; and makes ambiguity copy caller-neutral.

Direct regression tests cover all four write entry points plus legacy read/edit behavior. All affected full suites pass locally, along with lint, type checks, Knip, and pre-push checks. Browser proof is not applicable to these provider-routing and validation semantics.