fix(desktop): discover nested local repositories

[BradGroux]

Summary

Buzz currently treats each configured repositories directory as a flat list. That misses projects organized under common grouping folders such as ~/code/client/web-app or ~/code/projects/buzz-tools, even though those paths are still inside the configured root.

This change adds one shared, bounded repository-discovery path and uses it for both local repository listing and project checkout resolution.

Problem

Two code paths assumed repositories were direct children of the configured root:

• list_project_local_repositories read only the root's immediate entries.
• find_local_repo_dir checked only <repos_root>/<candidate>.

As a result, nested repositories were absent from the Desktop repository list and could not be resolved for project operations. Users had to create direct-child symlinks as a workaround.

Approach

The new project_repo_discovery helper applies the same traversal contract everywhere:

• Search at most four directory levels below each configured root. This covers common organization, team, and project groupings while keeping traversal bounded.
• Canonicalize the root and every candidate directory before evaluating it.
• Follow a symlink only when its canonical target remains inside the configured root.
• Track canonical paths so symlink aliases and cycles are visited once and repositories are not duplicated.
• Treat a directory containing .git as a terminal repository boundary. Discovery does not descend into a checkout and surface its submodules or nested repositories separately.
• Surface an inaccessible configured root as an error, but skip individual nested directories that become unreadable during traversal.
• Sort discovered paths for deterministic results.

list_project_local_repositories now consumes the helper and retains its existing cross-root path deduplication.

find_local_repo_dir preserves the existing direct-child fast path. If that misses, it searches discovered repositories by candidate name and retains the existing clone-origin check when a clone URL is available.

Discovery behavior

Layout	Result
<root>/repo/.git	Discovered through the existing direct path and recursive listing
<root>/client/web-app/.git	Discovered
Repository at depth four	Discovered
Repository below depth four	Not scanned
Symlink to a directory inside the root	Followed and deduplicated by canonical path
Symlink escaping the root	Ignored
Repository nested inside another repository	Not scanned past the outer repository boundary

Related issue

Fixes #4013

Duplicate search: no overlapping open pull request found before implementation or publication.

Testing

Focused coverage verifies:

• A repository at the depth-four boundary is discovered while one beyond it is not.
• A symlink escaping the configured root is rejected.
• An in-root symlink alias resolves to one canonical repository result.
• A repository nested under a grouping directory is listed and resolved by find_local_repo_dir.

Commands run:

• cargo test --manifest-path desktop/src-tauri/Cargo.toml --lib commands::project_repo -- --nocapture (4 passed)
• cargo check --manifest-path desktop/src-tauri/Cargo.toml --lib
• just ci: all workspace, Desktop, web, Tauri, build, lint, and analysis gates passed. The final mobile suite remains blocked by the reproducible current-main failure ChannelDetailPage keeps follow mode off while a tall newest message stays visible at mobile/test/features/channels/channel_detail_page_test.dart:1053; 1,021 mobile tests passed and 1 was skipped before the suite reported that single failure. This PR does not change mobile sources.
• Screenshot: not applicable; this changes local repository discovery without changing rendered UI.

Scope and tradeoffs

• The four-level limit is intentional. This is repository discovery under an explicitly configured root, not an unbounded filesystem crawl.
• Repository boundaries are terminal by design, so submodules and repositories nested inside another checkout are not presented as independent top-level projects.
• No settings, stored configuration, dependencies, or rendered UI are changed.

[BradGroux]

Rebased this branch onto current block/buzz main at 7bee84da8267605ada939c4f911d90f1b0ff1a11 and rechecked #4013 against the current repository and pull-request landscape.

The submission remains valid. Current main still treats configured repository roots as flat in the two affected project paths, #4013 remains open, and no competing pull request implements the same bounded nested discovery behavior. The recent upstream changes, including the latest mobile read-state retry fix, do not overlap these four Tauri files. No external review comment or inline thread required a code change.

The rebase was clean. The branch still keeps discovery bounded to four levels, rejects symlink escapes, deduplicates in-root aliases by canonical path, and stops at repository boundaries. No dependency, configuration, or rendered-UI behavior changed.

Verification at head 346d7cc8afbbb280ef24b4706cdfc16faf524a40:

• cargo test --manifest-path desktop/src-tauri/Cargo.toml --lib commands::project_repo -- --nocapture: 4 passed.
• just desktop-tauri-test: passed; the main Tauri library run completed with 2,203 passed and 14 ignored, and all executed integration and doc-test targets passed.
• just desktop-tauri-fmt-check: passed.
• just desktop-tauri-check: passed.
• just desktop-tauri-clippy: passed with warnings denied.

The branch is current with main; required maintainer review remains the only expected merge gate.

[BradGroux]

Review and rebase summary

Reviewed the PR for accuracy against current block/buzz main at d42d60d64 and rebased the branch onto that commit.

What this PR does

Extracts repo discovery into a bounded recursive walker (discover_local_repo_dirs) that finds Git working trees up to 4 levels below a configured reposDir, without following symlinks outside the root or recursing into submodules. The old single-level read_dir scan is replaced; find_local_repo_dir now tries the fast conventional <root>/<repo> path first, then falls back to discovered nested paths.

Accuracy review

• The depth-bounded BFS with a visited HashSet correctly prevents symlink cycles and escapes. The path.starts_with(&repos_root) check after canonicalize() is the right boundary.
• Repository roots are terminal — discovery stops at .git, so submodule directories are not surfaced as separate repos.
• The find_local_repo_dir change preserves the fast path before walking nested directories, so existing flat-layout users see no performance regression.
• Three new unit tests cover depth bounds, symlink escape, and in-root symlink deduplication. The project_repo_paths.rs test covers the nested-group integration path.
• No unwrap() or expect() in production paths. No new dependencies. Follows the existing module conventions in desktop/src-tauri/src/commands/.

Rebase result

Head moved from 346d7cc8a to 6064a8b3d. No conflicts — the 41 commits on main since the last rebase did not touch the repo discovery or project git command paths. git range-diff shows the patch is unchanged.

CI

DCO, Semgrep OSS, and zizmor all pass on the rebased head.

[BradGroux]

Rebase and accuracy review (2026-08-07)

Rebased onto current main (2b873cf20). Clean fast-forward — 52 commits applied, no conflicts.

Branch state: 7da03e70a (was 6064a8b3d) Mergeable: ✅ MERGEABLE · BLOCKED (branch protection — awaiting maintainer review)

Accuracy review

Adds nested local repository discovery by scanning subdirectories one level deep under known project roots. The new project_repo_discovery.rs module walks .git directories and reports nested repos back through the Tauri command layer. Existing path resolution in project_repo_paths.rs is extended to handle the nested case.

No unwrap()/expect() in production paths. Boundary checks are present for path traversal (rejects .., symlinks). No new dependencies. Tests are in the Tauri command test suite.

[BradGroux]

This is the third recurring review + rebase pass for the open BradGroux PRs on block/buzz.

What this PR does

Extends local repository discovery in the desktop app to find Git working trees nested in subdirectories below a configured repositories root, rather than only scanning one level deep. The new discover_local_repo_dirs function in project_repo_discovery.rs performs a bounded breadth-first traversal (max depth 4), canonicalizes paths, rejects symlinks that escape the configured root, treats repository roots as terminal (does not descend into checkouts/submodules), and deduplicates via a visited set.

The existing list_project_local_repositories function is refactored to use the new discovery function instead of its inline single-level scan.

Correctness

• The depth bound (MAX_LOCAL_REPO_DISCOVERY_DEPTH = 4) prevents unbounded recursion.
• The visited HashSet prevents infinite loops through symlink cycles.
• The path.starts_with(&repos_root) check after canonicalization prevents symlink-escape attacks.
• Repository roots are terminal — once .git is found, the directory is added to results but not descended into, avoiding submodule noise.
• The error handling is tiered: depth-0 read errors are fatal (propagated), deeper read errors are silently skipped (permission-denied subdirectories don't abort discovery).
• Comprehensive tests: depth bounding, symlink escape (Unix-only), and the TestDir RAII pattern ensures cleanup.
• No new dependencies. No unwrap/expect in production paths (test-only expect is acceptable).

Rebase result

Already based on current main (02f640bc4). No rebase needed — 0 commits behind.

• Head SHA: 921c23d5daefcb37de7a0c08f4476b8b3f48146c (unchanged)
• Mergeable: ✅ MERGEABLE
• CI: DCO ✅, Semgrep OSS ✅, zizmor ✅

No code changes were made — this was a review + rebase pass only.

[BradGroux]

Portfolio review update (2026-08-09)

I rechecked nested repository discovery against current main. The change is still needed and is correctly bounded to four levels, stops at discovered repositories, avoids escaped symlinks and cycles, and has no newer replacement on main.

I rebased the branch onto 5bf78671f45178f8de02ba18d3d321cbbf19cd1f. The implementation is patch-equivalent after the rebase and merges cleanly. Existing checks were green before the history rewrite; upstream checks are rerunning on the new head.