fix(tasks): skip projects hosted on the other forge instead of failing them

config/build-plugins/plain-node-entry-guard.ts

@@ -14,7 +14,6 @@ type OutputChunk = Rollup.OutputChunk
 // The CLI loads these paths after electron-vite replaces out/main.
 export const CLI_MAIN_ENTRY_NAMES = [
   'agent-hooks/managed-agent-hook-controls',
-  'gitlab/project-ref-parser',
   'orca-profiles/profile-index-store',
   'claude-accounts/keychain',
   'skills/bundled-skill-install/cli-entry',

config/electron-builder.config.cjs

@@ -317,7 +317,6 @@ module.exports = {
     'out/main/cursor/**',
     'out/main/droid/**',
     'out/main/gemini/**',
-    'out/main/gitlab/project-ref-parser.js',
     'out/main/grok/**',
     'out/main/hermes/**',
     'out/main/asar-transparent-fs.js',

config/scripts/electron-vite-output-contract.test.ts

@@ -184,7 +184,6 @@ describe('Electron Vite output contract', () => {
       electronBuilderConfig.asarUnpack
     ).createFilter()
     for (const name of [
-      'gitlab/project-ref-parser',
       'macos-tree-clone',
       'orca-profiles/profile-index-store',
       'persistence/profile-state/profile-state-access',

src/cli/handlers/worktree-gitlab-link-context.ts

@@ -1,4 +1,4 @@
-import { parseRemoteProjectRefCandidate } from '../../main/gitlab/project-ref-parser'
+import { parseRemoteProjectRefCandidate } from '../../shared/gitlab-project-ref-parser'
 import type { Repo } from '../../shared/repo-types'
 import type { RuntimeWorktreeRecord } from '../../shared/runtime-types'
 import { parseGitLabIssueOrMRLink, type ProjectSlug } from '../../shared/new-workspace/gitlab-links'

src/main/gitlab/gitlab-known-host-probe.ts

@@ -1,7 +1,7 @@
 import { runCoalescedProbe, type CoalescedProbes } from '../git/coalesced-probe'
 import { NEGATIVE_ENTRY_TTL_MS } from '../git/remote-ref-probe-cache'
 import { glabExecFileAsync } from '../git/runner'
-import { DEFAULT_GITLAB_HOSTS, normalizeGitLabHost } from './project-ref-parser'
+import { DEFAULT_GITLAB_HOSTS, normalizeGitLabHost } from '../../shared/gitlab-project-ref-parser'
 import type { GitAdmissionTier } from '../git/command-runner/git-exec-options'
 
 export type LocalGitExecOptions = {

src/main/gitlab/gitlab-project-ref-resolution.ts

@@ -18,7 +18,7 @@ import {
   parseGitLabProjectRef,
   parseRemoteProjectRefCandidate,
   type ProjectRef
-} from './project-ref-parser'
+} from '../../shared/gitlab-project-ref-parser'
 
 export { DEFAULT_GITLAB_HOSTS, parseGitLabProjectRef }
 export type { ProjectRef }

src/main/ipc/gitlab.test.ts

@@ -2,6 +2,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { Store } from '../persistence'
 import type { Repo } from '../../shared/repo-types'
 import { toSshExecutionHostId } from '../../shared/execution-host'
+import type * as GitLabUtils from '../gitlab/gl-utils'
 
 const ORIGINAL_PLATFORM = process.platform
 
@@ -38,7 +39,8 @@ const {
   getWorkItemByProjectRefMock,
   getMergeRequestMock,
   getMergeRequestForBranchMock,
-  getProjectSlugMock
+  getProjectSlugMock,
+  getGlabKnownHostsMock
 } = vi.hoisted(() => ({
   ipcHandlers: new Map<string, (...args: unknown[]) => unknown>(),
   listMergeRequestsMock: vi.fn(),
@@ -65,7 +67,8 @@ const {
   getWorkItemByProjectRefMock: vi.fn(),
   getMergeRequestMock: vi.fn(),
   getMergeRequestForBranchMock: vi.fn(),
-  getProjectSlugMock: vi.fn()
+  getProjectSlugMock: vi.fn(),
+  getGlabKnownHostsMock: vi.fn()
 }))
 
 vi.mock('electron', () => ({
@@ -106,6 +109,11 @@ vi.mock('../gitlab/client', () => ({
   updateMRReviewers: updateMRReviewersMock
 }))
 
+vi.mock('../gitlab/gl-utils', async (importOriginal) => ({
+  ...(await importOriginal<typeof GitLabUtils>()),
+  getGlabKnownHosts: getGlabKnownHostsMock
+}))
+
 vi.mock('../gitlab/work-item-details', () => ({
   getWorkItemDetails: getWorkItemDetailsMock
 }))
@@ -171,7 +179,8 @@ describe('GitLab IPC handlers', () => {
       getWorkItemByProjectRefMock,
       getMergeRequestMock,
       getMergeRequestForBranchMock,
-      getProjectSlugMock
+      getProjectSlugMock,
+      getGlabKnownHostsMock
     ]) {
       mock.mockReset()
     }
@@ -274,6 +283,46 @@ describe('GitLab IPC handlers', () => {
     )
   })
 
+  it("answers glab's known hosts from the repo's own execution context", async () => {
+    const remoteRepo = repo({
+      id: 'repo-ssh',
+      path: '/ssh/orca',
+      connectionId: 'builder',
+      executionHostId: toSshExecutionHostId('builder')
+    })
+    getGlabKnownHostsMock.mockResolvedValueOnce(['gitlab.com', 'git.example.co.jp'])
+    registerGitLabHandlers(storeWithRepos([repo(), remoteRepo]) as Store)
+
+    const handler = ipcHandlers.get('gitlab:knownHosts')
+    await expect(handler?.(null, { repoPath: '/ssh/orca', repoId: 'repo-ssh' })).resolves.toEqual([
+      'gitlab.com',
+      'git.example.co.jp'
+    ])
+    expect(getGlabKnownHostsMock).toHaveBeenCalledWith('builder')
+
+    await expect(handler?.(null, { repoPath: '/not/registered' })).rejects.toThrow(
+      'Access denied: unknown repository path'
+    )
+    expect(getGlabKnownHostsMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('asks the SSH host of a row that names it only as its execution host', async () => {
+    const remoteRepo = repo({
+      id: 'repo-ssh',
+      path: '/ssh/orca',
+      executionHostId: toSshExecutionHostId('builder')
+    })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The knownHosts handler reads only the store methods stubbed here.
+    registerGitLabHandlers(storeWithRepos([remoteRepo]) as Store)
+
+    await ipcHandlers.get('gitlab:knownHosts')?.(null, {
+      repoPath: '/ssh/orca',
+      repoId: 'repo-ssh'
+    })
+
+    expect(getGlabKnownHostsMock).toHaveBeenCalledWith('builder')
+  })
+
   it('rejects source context for a different host', async () => {
     registerGitLabHandlers(
       storeWithRepos([repo({ id: 'repo-local', path: '/local/orca' })]) as Store
@@ -360,6 +409,7 @@ describe('GitLab IPC handlers', () => {
     listLabelsMock.mockResolvedValue([])
     listAssignableUsersMock.mockResolvedValue([])
     listTodosMock.mockResolvedValue([])
+    getGlabKnownHostsMock.mockResolvedValue(['gitlab.com'])
     getProjectSlugMock.mockResolvedValue({ host: 'gitlab.com', path: 'stablyai/orca' })
     getMergeRequestForBranchMock.mockResolvedValue(null)
     getMergeRequestMock.mockResolvedValue(null)
@@ -409,6 +459,7 @@ describe('GitLab IPC handlers', () => {
     await ipcHandlers.get('gitlab:listLabels')?.(null, { repoPath: '/local/orca' })
     await ipcHandlers.get('gitlab:listAssignableUsers')?.(null, { repoPath: '/local/orca' })
     await ipcHandlers.get('gitlab:todos')?.(null, { repoPath: '/local/orca' })
+    await ipcHandlers.get('gitlab:knownHosts')?.(null, { repoPath: '/local/orca' })
 
     const hostedReviewOptions = { localGitExecOptions: localGitOptions }
     expect(getProjectSlugMock).toHaveBeenCalledWith('/local/orca', null, hostedReviewOptions)
@@ -486,6 +537,7 @@ describe('GitLab IPC handlers', () => {
       localGitOptions
     )
     expect(listTodosMock).toHaveBeenCalledWith('/local/orca', null, localGitOptions)
+    expect(getGlabKnownHostsMock).toHaveBeenCalledWith(null, localGitOptions)
   })
 
   it('routes local WSL project GitLab MR details, review, job, and pasted URL IPC through project git options', async () => {

src/main/ipc/gitlab.ts

@@ -7,6 +7,8 @@ import {
   getRateLimit,
   listTodos
 } from '../gitlab/client'
+import { getGlabKnownHosts } from '../gitlab/gl-utils'
+import { getRepoRoutingConnectionId } from '../../shared/execution-host'
 import { registerGitLabCiJobHandlers } from './gitlab-ci-job-handlers'
 import { registerGitLabIssueHandlers } from './gitlab-issue-handlers'
 import { registerGitLabMergeRequestMutationHandlers } from './gitlab-merge-request-mutation-handlers'
@@ -33,6 +35,13 @@ export function registerGitLabHandlers(store: Store): void {
       getRateLimit({ force: Boolean(args?.force), host: args?.host ?? null })
   )
 
+  // Why: answers from the repo's own execution context so the Tasks page can tell a
+  // self-hosted GitLab origin from a GitHub one without querying either forge.
+  ipcMain.handle('gitlab:knownHosts', async (_event, args: GitLabRepoSelectorArgs) => {
+    const repo = assertRegisteredRepo(args, store)
+    return getGlabKnownHosts(getRepoRoutingConnectionId(repo), ...localGitOptionArgs(store, repo))
+  })
+
   ipcMain.handle('gitlab:projectSlug', async (_event, args: GitLabRepoSelectorArgs) => {
     const repo = assertRegisteredRepo(args, store)
     return getProjectSlug(repo.path, repoConnectionId(repo), ...hostedReviewOptionArgs(store, repo))

src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts

@@ -9,6 +9,7 @@ import {
   getGitLabJobTraceMock,
   getGitLabWorkItemByProjectRefMock,
   getGitLabWorkItemDetailsMock,
+  getGlabKnownHostsMock,
   listGitLabIssuesMock,
   listGitLabLabelsMock,
   listGitLabAssignableUsersMock,
@@ -90,6 +91,7 @@ describe('OrcaRuntimeService', () => {
     await runtime.listGitLabRepoWorkItems(TEST_REPO_ID, 'closed', 2, 25, 'ambiguous selector')
     const issues = await runtime.listGitLabRepoIssues(TEST_REPO_ID, 'opened', '@me', 50, 3)
     await runtime.listGitLabRepoTodos(TEST_REPO_ID)
+    await runtime.listGitLabRepoKnownHosts(TEST_REPO_ID)
     await runtime.listGitLabRepoLabels(TEST_REPO_ID)
     await runtime.listGitLabRepoAssignableUsers(TEST_REPO_ID)
     await runtime.createGitLabRepoIssue(TEST_REPO_ID, 'New issue', 'Body')
@@ -120,6 +122,7 @@ describe('OrcaRuntimeService', () => {
       'issue'
     )
 
+    expect(getGlabKnownHostsMock).toHaveBeenCalledWith('ssh-1')
     expect(listGitLabMergeRequestsMock).toHaveBeenCalledWith(
       '/remote/repo',
       'closed',
@@ -315,6 +318,7 @@ describe('OrcaRuntimeService', () => {
     await runtime.listGitLabRepoWorkItems(TEST_REPO_ID, 'opened', 1, 20)
     await runtime.listGitLabRepoIssues(TEST_REPO_ID, 'opened', undefined, 20)
     await runtime.listGitLabRepoTodos(TEST_REPO_ID)
+    await runtime.listGitLabRepoKnownHosts(TEST_REPO_ID)
     await runtime.listGitLabRepoLabels(TEST_REPO_ID)
     await runtime.createGitLabRepoIssue(TEST_REPO_ID, 'Title', 'Body')
     await runtime.updateGitLabRepoIssue(TEST_REPO_ID, 7, { body: 'Updated' })
@@ -351,6 +355,7 @@ describe('OrcaRuntimeService', () => {
       1
     )
     expect(listGitLabTodosMock).toHaveBeenCalledWith(TEST_REPO_PATH, null, localGitOptions)
+    expect(getGlabKnownHostsMock).toHaveBeenCalledWith(null, localGitOptions)
     expect(listGitLabLabelsMock).toHaveBeenCalledWith(
       TEST_REPO_PATH,
       undefined,

src/main/runtime/rpc/methods/gitlab.test.ts

@@ -32,6 +32,7 @@ describe('gitlab RPC methods', () => {
   })
 
   it('routes GitLab task queries and mutations to the runtime server', async () => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The dispatcher calls only the runtime methods stubbed here.
     const runtime = {
       getRuntimeId: () => 'test-runtime',
       diagnoseGitLabAuth: vi.fn().mockResolvedValue({ glabAvailable: true }),
@@ -40,6 +41,7 @@ describe('gitlab RPC methods', () => {
       listGitLabRepoWorkItems: vi.fn().mockResolvedValue({ items: [] }),
       listGitLabRepoIssues: vi.fn().mockResolvedValue({ items: [] }),
       listGitLabRepoTodos: vi.fn().mockResolvedValue([{ id: 1 }]),
+      listGitLabRepoKnownHosts: vi.fn().mockResolvedValue(['gitlab.com']),
       listGitLabRepoLabels: vi.fn().mockResolvedValue(['bug']),
       createGitLabRepoIssue: vi.fn().mockResolvedValue({ ok: true, number: 7 }),
       updateGitLabRepoIssue: vi.fn().mockResolvedValue({ ok: true }),
@@ -98,6 +100,7 @@ describe('gitlab RPC methods', () => {
       })
     )
     await dispatcher.dispatch(makeRequest('gitlab.todos', { repo: 'id:repo-1' }))
+    await dispatcher.dispatch(makeRequest('gitlab.knownHosts', { repo: 'id:repo-1' }))
     await dispatcher.dispatch(makeRequest('gitlab.listLabels', { repo: 'id:repo-1' }))
     await dispatcher.dispatch(
       makeRequest('gitlab.updateIssue', {
@@ -228,6 +231,7 @@ describe('gitlab RPC methods', () => {
     expect(runtime.listGitLabRepoIssues).toHaveBeenCalledWith('id:repo-1', 'opened', '@me', 50, 2)
     expect(runtime.createGitLabRepoIssue).toHaveBeenCalledWith('id:repo-1', 'Fix bug', 'Details')
     expect(runtime.listGitLabRepoTodos).toHaveBeenCalledWith('id:repo-1')
+    expect(runtime.listGitLabRepoKnownHosts).toHaveBeenCalledWith('id:repo-1')
     expect(runtime.listGitLabRepoLabels).toHaveBeenCalledWith('id:repo-1')
     expect(runtime.updateGitLabRepoIssue).toHaveBeenCalledWith(
       'id:repo-1',

src/main/runtime/rpc/methods/gitlab.ts

@@ -71,6 +71,12 @@ export const GITLAB_METHODS = [
     params: RepoSelector,
     handler: async (params, { runtime }) => runtime.listGitLabRepoTodos(params.repo)
   }),
+  defineMethod({
+    name: 'gitlab.knownHosts',
+    permission: 'workspace',
+    params: RepoSelector,
+    handler: async (params, { runtime }) => runtime.listGitLabRepoKnownHosts(params.repo)
+  }),
   defineMethod({
     name: 'gitlab.diagnoseAuth',
     permission: 'workspace',

src/main/runtime/runtime-gitlab-query-commands.ts

@@ -19,6 +19,7 @@ import {
 } from '../gitlab/gitlab-preload-args'
 import { getWorkItemDetails } from '../gitlab/work-item-details'
 import { getRepoRoutingConnectionId } from '../../shared/execution-host'
+import { getGlabKnownHosts } from '../gitlab/gl-utils'
 
 type LocalGitArgs = [] | [{ wslDistro?: string }]
 
@@ -124,6 +125,11 @@ export class RuntimeGitLabQueryCommands {
     )
   }
 
+  async listGitLabRepoKnownHosts(repoSelector: string): Promise<readonly string[]> {
+    const repo = await this.deps.resolveRepo(repoSelector)
+    return getGlabKnownHosts(getRepoRoutingConnectionId(repo), ...this.deps.getLocalGitArgs(repo))
+  }
+
   diagnoseGitLabAuth(): Promise<Awaited<ReturnType<typeof diagnoseAuth>>> {
     return diagnoseAuth()
   }

src/main/runtime/runtime-review-command-surface.ts

@@ -65,6 +65,7 @@ export function installRuntimeReviewCommandSurface(
     listGitLabRepoMRs: glq.listGitLabRepoMRs.bind(glq),
     listGitLabRepoIssues: glq.listGitLabRepoIssues.bind(glq),
     listGitLabRepoTodos: glq.listGitLabRepoTodos.bind(glq),
+    listGitLabRepoKnownHosts: glq.listGitLabRepoKnownHosts.bind(glq),
     diagnoseGitLabAuth: glq.diagnoseGitLabAuth.bind(glq),
     getGitLabRateLimit: glq.getGitLabRateLimit.bind(glq),
     listGitLabRepoLabels: glq.listGitLabRepoLabels.bind(glq),

src/preload/api/gitlab-api.ts

@@ -96,6 +96,8 @@ export type GitLabApi = {
   listAssignableUsers: (args: GitLabRepoSelectorArgs) => Promise<GitLabAssignableUser[]>
   /** Cross-project user-scoped todos (gitlab.com/dashboard/todos). */
   todos: (args: GitLabRepoSelectorArgs) => Promise<GitLabTodo[]>
+  /** Hosts glab is signed in to (plus gitlab.com) on the machine that runs the repo's glab. */
+  knownHosts: (args: GitLabRepoSelectorArgs) => Promise<string[]>
   workItemDetails: (
     args: GitLabRepoSelectorArgs & {
       iid: number

src/preload/gitlab.ts

@@ -81,6 +81,9 @@ export const glApi = {
 
   todos: (args: GitLabRepoSelectorArgs) => ipcRenderer.invoke('gitlab:todos', args),
 
+  knownHosts: (args: GitLabRepoSelectorArgs): Promise<string[]> =>
+    ipcRenderer.invoke('gitlab:knownHosts', args),
+
   workItemDetails: (
     args: GitLabRepoSelectorArgs & {
       iid: number

src/renderer/src/components/task-page/SkippedReposNotice.tsx

@@ -0,0 +1,55 @@
+import { useState } from 'react'
+import { ChevronDown, ChevronRight } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import { Collapsible, CollapsibleContent, CollapsibleTrigger } from '@/components/ui/collapsible'
+import { translate } from '@/i18n/i18n'
+import type { Repo } from '../../../../shared/repo-types'
+import type { RepoBackedTaskSourceProvider } from '../../../../shared/task-source-repo-host-match'
+
+/**
+ * Selected repos a source never queried because their origin is on the other forge.
+ * Why collapsed and without Retry: a retry cannot change the answer (#16473).
+ */
+export function TaskPageSkippedReposNotice({
+  provider,
+  repos
+}: {
+  provider: RepoBackedTaskSourceProvider
+  repos: readonly Repo[]
+}): React.JSX.Element | null {
+  const [open, setOpen] = useState(false)
+  if (repos.length === 0) {
+    return null
+  }
+  const summary =
+    provider === 'github'
+      ? translate(
+          'auto.components.TaskPage.skippedReposHostedOnGitLab',
+          'Skipped — hosted on GitLab ({{value0}})',
+          { value0: repos.length }
+        )
+      : translate(
+          'auto.components.TaskPage.skippedReposHostedOnGitHub',
+          'Skipped — hosted on GitHub ({{value0}})',
+          { value0: repos.length }
+        )
+  return (
+    <div className="border-b border-border/50 px-2.5 py-1 text-muted-foreground">
+      <Collapsible open={open} onOpenChange={setOpen}>
+        <CollapsibleTrigger asChild>
+          <Button type="button" variant="ghost" size="xs">
+            {open ? <ChevronDown /> : <ChevronRight />}
+            {summary}
+          </Button>
+        </CollapsibleTrigger>
+        <CollapsibleContent>
+          <ul className="flex flex-wrap gap-x-3 gap-y-1 pb-1.5 pl-5.5 pt-0.5 font-mono text-xs">
+            {repos.map((repo) => (
+              <li key={repo.id}>{repo.displayName || repo.path}</li>
+            ))}
+          </ul>
+        </CollapsibleContent>
+      </Collapsible>
+    </div>
+  )
+}