fix(vcs): resolve SSH aliases before classifying GitHub hosts

[maslinedwin]

Fixes #6198. git@github-personal:owner/repo no longer becomes GitHub Self-Hosted. SSH aliases are resolved via ssh -G to HostName for API/browser host; git auth still uses the alias.

---

Note

Medium Risk
Touches provider detection, repository identity, and PR host routing with subprocess ssh -G calls; failures are designed to fall back safely, but wrong resolution could mis-route API calls for affected remotes.

Overview
Fixes misclassification of undotted SSH host aliases (e.g. git@github-personal:…) as self-hosted GitHub/GitLab/Bitbucket. Provider detection now uses a resolved detectionUrl while the stored git remote URL stays unchanged for clone/auth.

SSH resolution: New resolveGitRemoteForSourceControl runs ssh -G only for undotted, non-public aliases, rewrites the remote host via rewriteGitRemoteUrlHost, and falls back to the original URL on failure or timeout. Wired through RepositoryIdentityResolver, SourceControlProviderRegistry, and PullRequestService (with async refinement and cached detection per remote).

Classification: detectSourceControlProviderFromRemoteUrl treats label matches like github in github-personal as unknown unless the host is the public domain or contains a dot (real enterprise hostname).

PR listing: hostnameFromProviderBaseUrl uses URL.host so self-hosted bases keep nonstandard ports (e.g. :8443).

Docs note SSH-alias behavior; @t3tools/ssh gains optional timeout and fallbackOnError on resolveSshTarget.

^{Reviewed by Cursor Bugbot for commit 9c2eaa9. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Resolve SSH host aliases before classifying GitHub/GitLab/Bitbucket remotes

• SSH remotes with undotted host aliases (e.g. github-personal) were previously misclassified as self-hosted instances or unknown providers. The fix resolves the real hostname via ssh -G before provider detection and canonicalization.
• Adds resolveGitRemoteForSourceControl which rewrites the SSH alias host using rewriteGitRemoteUrlHost from shared; the original remote URL is kept for Git authentication.
• SourceControlProviderRegistry, RepositoryIdentityResolver, and PullRequestService all now resolve a detectionUrl before classifying or grouping remotes.
• Adds hostnameFromProviderBaseUrl to preserve nonstandard ports in host values used for provider API selection and grouping.
• Behavioral Change: undotted SSH aliases (e.g. github-personal) are no longer treated as enterprise/self-hosted domains by isGitHubHost/isGitLabHost/isBitbucketHost.

^{Macroscope summarized 9c2eaa9.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9105ea65-fc38-4d93-b655-a2e33ee3355e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 11cbd8c. Configure here.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces new runtime behavior by spawning SSH processes to resolve aliases before provider detection. The cross-cutting changes to multiple services (identity resolution, PR listing, provider registry) and new external I/O operations warrant human review to verify the integration and error handling.

^{You can customize Macroscope's approvability policy. Learn more.}

[t3dotgg]

Note

🤖 GPT-6 Astra (preview) responding on behalf of Theo

This note is part of an automated cleanup pass.

Preserving these details from items reviewed in the cleanup pass.

Carryover from #9497 at 1f21017: preserve packages/shared/src/git.test.ts and sourceControl.test.ts cases for SCP and SSH-URL github.com-work, GitLab aliases, unchanged HTTPS hosts, canonical repository identity, and owner/repo parsing. The resolver currently skips dotted aliases. Extend it to consult SSH configuration for these names, and verify the resolved identity reaches GitManager's PR consumers while Git authentication keeps the original alias. Keep SSH ports out of HTTPS API origins. Add a real github.com-work.example negative case so host spelling alone never selects GitHub. These are follow-up requirements, not claims that tests or code have been ported.

Additional alias fixtures from #9487 at de7462b: sourceControl.test.ts covers ssh.dev.azure.com-work, bitbucket.org-personal, GitHub SCP/SSH forms, and HTTPS hosts that resemble aliases. Preserve those inputs when testing actual SSH HostName resolution. Do not preserve its expected https://gitlab.com:2222 result for ssh://git@gitlab.com-personal:2222/...: the SSH port is not the HTTPS API port. These cases are recorded for follow-up, not implemented by this note.

Carryover from #6196 at 0fed43997d: cover GitManager's direct reads of the branch-selected remote, its origin fallback, and pull request repository identity. These readers need the resolved detection URL without changing the raw remote used for SSH authentication. Keep tests for ssh:// ports, IPv6 HostName values, retry after a failed SSH probe, and unchanged local/non-SSH paths. Dotted and user-less aliases also need review. This records missing coverage, not a completed port.

[Mnigos]

Verified on the branch: the five touched test files pass, and swapping in main's sourceControl.ts makes the classifier and rewrite tests fail, so they pin the change. ssh -G on an alias that isn't in ssh config just echoes the name back, so the fallback never invents github.com.

One gap worth closing here, since #9497 was closed in favor of this PR: gitRemoteSshAliasToResolve skips any host containing a dot, so the documented multi-account form git@github.com-work:owner/repo.git (the case in #9458) never reaches ssh -G, and the new classifier still reports it as GitHub Self-Hosted with https://github.com-work as the base URL. On this branch detect returns {kind: github, name: GitHub Self-Hosted, baseUrl: https://github.com-work}, the canonical key stays github.com-work/owner/repo, and owner/repo parsing returns null. Dropping the dot gate and keeping only the public-host skip should be safe, since a dotted name that isn't an alias echoes back unchanged. Happy to send the carried-over test cases from #9497 as a follow-up if you'd rather keep this one focused.