[Detail Bug] VCS: Repo auto-inference fails for HTTPS remotes when password/token contains '@'

[detail-app]

Detail Bug Report

https://app.detail.dev/org_5f375fe3-a706-4e9a-a6f7-800f2439b3f6/bugs/bug_d102137a-c78a-4974-a918-472dc9e5053a

Introduced in #260 by @sachiniyer on Apr 22, 2026

Summary

• Context: URL authority format is [user[:password]@]host. The @ separates credentials from host.
• Bug: strip_http_credentials uses split_once('@') instead of rsplit_once('@'), breaking URLs when credentials contain @ characters.
• Actual vs. expected: For https://user:p@ss@github.com/owner/repo.git, current parsing yields https://ss@github.com/owner/repo.git (and repo inference returns None), but it should strip credentials and produce https://github.com/owner/repo.git (repo inference returns Some("owner/repo")).
• Impact: Users with @ in passwords or tokens cannot use repo auto-inference.

Code with Bug

if let Some((_, host)) = authority.split_once('@') { // <-- BUG 🔴 splits on first '@', but separator is last '@' when creds contain '@'
    return Some(format!("{scheme}{host}/{path}"));
}

Explanation

In an authority string like user:p@ss@github.com, the credentials/host separator is the last @. Using split_once('@') splits at the first @, leaving part of the password in the “host” segment (e.g., ss@github.com), producing an invalid URL and causing downstream repo auto-inference to fail.

Codebase Inconsistency

strip_ssh_port in the same file correctly uses rsplit_once('@') to handle multiple @ characters:

let (user_at, host_port) = match authority.rsplit_once('@') {

Recommended Fix

Change credential stripping to split on the last @:

if let Some((_, host)) = authority.rsplit_once('@') {

History

This bug was introduced in commit fb56132. The commit added strip_http_credentials but used split_once('@') instead of rsplit_once('@'); no tests covered passwords containing @.