fix(server): check out a pull request only in a checkout of its repository#20727

Fixes #16455.

A pull request handoff could prepare an unrelated project, fetch its history, and run setup there. The shared server method now refuses a definite hosted repository mismatch before checkout, fetch, remote changes, worktree creation/reuse, or setup. Numbered pull request refs are fetched only from a remote naming the base repository, so a fork's own pull request with the same number cannot supply the wrong commit.

Maintainer takeover of only21mil's #20727, preserving the contributor's history and credit. This builds on the earlier guard work credited to @Absterrg0 in the original description. Main was merged without rebasing or force-pushing. The guard stays in GitManager; the VCS driver receives the selected remote. No client, contract, repository-identity, or read-routing changes are included.

Human policy decision remains: any remote whose first effective raw URL names the base or known head fork can vouch for the checkout. This supports fork clones with an arbitrarily named base remote. It also permits an unrelated checkout with an extra matching remote, including a fork remote retained after an older wrong handoff. This batch preserves that declared policy and does not claim maintainer approval or merge the PR.

Numbered refs use a matching base remote, preferring the primary. If hosted remotes exist but none names the base, no numbered PR ref is fetched, even when the primary is a local path. The old primary fallback remains only without hosted evidence, or when the PR URL cannot be classified.

Remote matching uses configured URLs before Git URL rewrites, preserves existing host/path normalization and the GitHub SSH endpoint, compares HTTP ports, and retains Forgejo installation mounts for HTTP forks. Dotless SSH aliases compare paths. An empty URL entry contributes no evidence for that remote. Local paths, no usable hosted remotes, and unreadable PR URL shapes do not establish a mismatch. Nonzero config exit status still permits stdout parsing; spawn, output-read, and timeout failures stop preparation.

Known compatibility limits remain part of the human landing decision. With no other matching remote, this guard can falsely refuse dotted SSH aliases such as github.com-work, alternate SSH hosts such as altssh.gitlab.com and altssh.bitbucket.org, mounted GitLab/Forgejo installations cloned over SSH without their HTTP mount, Azure fork checkouts, redirecting old names after a repository rename/transfer, and local mirrors retaining a hosted remote for a different fork, and HTTP host aliases. Dotless SSH aliases are compared by path, so a same-path repository behind another alias can also be accepted or selected for fetching. The remedy is to open the matching project or update its configured remote. A sole remote containing an empty URL can instead be allowed for lack of evidence. These are naming checks over trusted local Git configuration, not isolation from hostile configuration.

Verification on headless Linux:

• Original additions: 50 cases in one existing GitManager test file → nine service-level cases in that file. All 170 main cases remain. The driver suite keeps its existing option-like remote test, with the required API argument adjustment.
• The original eight replacement cases pass on the branch and fail meaningfully against main: early refusal, raw first/empty URLs, arbitrary option-like base remote, new/reused exact head commits, fork-only and retained-fork layouts, SSH endpoint/host, mounted Forgejo HTTP port, and config-output/failure behavior.
• pnpm exec vp test run apps/server/src/git/GitManager.test.ts: 179/179 passed after the review fix. The earlier combined GitManager/driver run passed 168/169 driver cases; driver code is unchanged since that run. The untouched rename/unusual-path/mode/binary preview test fails on this host’s Git2.43 and reproduces against main. It is not counted as a passing suite.
• pnpm --filter t3 typecheck, targeted lint/format check, and git diff --check pass. Lint reports two warnings on untouched main lines.

The parent reran a manual headless server-service probe after integrating the rebuild, using real GitManager/GitVcsDriver services, actual Git and local bare repositories, in-memory stores, a synthetic hosting response, and a recorded setup callback:

Integrated server proof and output. Setup was recorded at its service boundary; no user setup script was executed. This is nonvisual behavior, so the current proof is output and focused tests. The original author’s earlier browser screenshots are not presented as current-head verification.

The service is shared by web/desktop checkout and Resolve/Fix flows, mobile handoffs, and local or remote server connections. Round 1 Sol identified a local-path primary with a hosted fork remote that could still fetch an unrelated numbered PR during reuse or fallback. A separate server probe reproduced it. The fix limits the unclassified primary fallback to checkouts with no hosted remote evidence; one additional row in the existing fork-layout case covers missing-head creation and reuse. All 179 GitManager cases pass after the fix, including three fork-layout rows. Scoped server typecheck, targeted lint/format and the two refreshed server probes pass; a fresh second whole-diff round by both Sol and Opus found no code blockers. The human policy gate remains pending. Published head b12de823af has been pushed. The single scheduled status read at 23:20 UTC showed all CI jobs that ran passing and mergeability MERGEABLE; CodeRabbit remained pending. CI pending; the coordinator owns later status reads under the shared-token budget rule. Unmerged; landing is handled centrally. Native macOS, Windows, Electron, iOS, Android, real hosting, relay/tunnel behavior, and UI handoff flows have not been rerun for this revision.

Models: GPT-6-Astra (tests), GPT-6.1-Sol (implementation), Claude Opus 5.5 and GPT-6-Sol (review). Harness: Codex and Claude through T3 Code.