fix(resolve-repo): anchor the git-origin fallback to the session cwd + accept the provider host

[aitrawog]

Summary

Fix the documented repo-resolution fallback, which was inert in a dsh web
deployment: every gh_* call that omitted ownerRepo failed with "could not
determine the target repository", even when the session's workspace was a real GitHub
checkout. Two independent defects caused it, and both are fixed here.

1. The fallback ran in the wrong directory. resolveRepo's git-origin step ran
git remote get-url origin in state.workspaceDir = config.workspaceDir ?? process.cwd(). A dsh web deployment is a service: its process cwd is the
service's working directory, not the session's workspace (this host's unit has no
WorkingDirectory=, so cwd is $HOME — verifiably not a checkout). The command threw
and the failure was swallowed (catch { return { repoFromRemote: null } }), so the
repo the session actually works in was never consulted. The fallback now runs in the
calling session's creation cwd (agent.session.header.cwd), precedence:
explicit config.workspaceDir → session cwd → process cwd.

2. The host check rejected a normal origin. repoFromRemoteUrl required the origin
host to equal apiHost, which is derived from the REST base (api.github.com). A
normal origin is github.com, so even in the right directory the parse returned null:

$ node -e "…repoFromRemoteUrl('https://github.com/o/r.git', 'api.github.com')…"
null                                   # before
o/r                                    # after

The host check now also accepts the provider host with the api. label stripped
(public GitHub). GitHub Enterprise's single host (git.example.com) is unaffected, and
an unrelated host (gitlab.com) is still rejected.

Files:

• src/state.ts — workspaceDirFor(config, agent) helper; resolveRepo and the
  GithubState.resolveRepo seam take the calling agent; SessionCwdSource.
• src/tools.ts, src/commands.ts — pass exec.agent / invocation.agent; the
  pr_create branch read uses workspaceDirFor.
• src/git.ts — repoFromRemoteUrl accepts the api.-stripped provider host.
• src/state.ts — the stale workspaceDir doc comment corrected (the inspection dir
  is the session cwd; the field serves CI report output + the last-resort fallback).
• lib/ — rebuilt (tracked build output).
• scripts/action-patch.mjs, scripts/check-readmes.mjs, src/client.ts,
  src/present.ts, test/ci.test.ts, test/action-guard.test.ts, lib/ — the 11
  gate warnings cleared in-tree (incl. the real dropped post-check input) with a new
  test. src/client.ts (and its lib/client.js build output) is part of the same
  sweep: [...listeners] → Array.from(listeners), same snapshot semantics.
• test/state.test.ts, test/git.test.ts — coverage that FAILS without EACH fix.
• README.md — the workspaceDir row + a "Repository resolution" note; both state the
  precedence explicit workspaceDir → session cwd → process cwd, matching the code.

Change class

charly-or-sdk Go — N/A: this is the dsh-github TypeScript plugin (npm), not a
charly Go module. The applicable gate is the plugin's own suite + its CI.

Closes / relates to: Closes #3. Relates to the operator's
~/.dsh/profiles/web/cordis.patch.yml defaultOwnerRepo workaround, which this fix
makes unnecessary for a session rooted in a real checkout.

Breaking change + rollback: none. resolveRepo's signature gains an optional
trailing agent argument (existing 2-arg callers are unaffected); repoFromRemoteUrl
only ADDS an accepted host. Rollback is a revert.

How R10-tested — exact gate, commands, and pasted output

• The gate for this change class: the plugin's own suite — pnpm typecheck,
  pnpm test (vitest), pnpm lint, pnpm build, plus its verify:* / check:readmes
  guards (the prepublishOnly chain). No charly check run <bed> applies (this repo is
  a plugin, not a charly candy/box).
• Eval beds run: N/A — no disposable charly bed applies to this repo.
• Fresh rebuild: the tracked lib/ was rebuilt from the changed src/
  (pnpm build → tsc --noEmitOnError && node scripts/fix-dts.mjs, rc=0), and the
  committed lib/ carries the fix (grep -c workspaceDirFor lib/state.js → 2;
  grep -c gitHost lib/git.js → 2).
• Did the CHANGED code path execute live? Yes — the changed functions are executed
  by the unit tests, in positive and negative control:

$ pnpm typecheck                 -> rc=0
$ pnpm test
  Test Files  19 passed | 1 skipped (20)
       Tests  193 passed | 3 skipped (196)          # was 185 before this change
$ pnpm lint                      -> Found 0 warnings and 0 errors   # the 11 pre-existing warnings are CLEARED in-tree; one was a real dropped-input bug (below)
$ pnpm verify:self-contained       -> rc=0
$ pnpm verify:artifacts            -> rc=0
$ pnpm check:readmes               -> rc=0
$ pnpm run typecheck:ci            -> rc=0

# NEGATIVE CONTROL 1 — revert the session-cwd threading:
$ pnpm vitest run test/state.test.ts
  Tests  1 failed | 7 passed (8)

# NEGATIVE CONTROL 2 — revert the api.-strip:
$ pnpm vitest run test/state.test.ts test/git.test.ts
  Tests  3 failed | 10 passed (13)

# NEGATIVE CONTROL 3 — revert the postCheck emitter line:
$ pnpm vitest run test/action-guard.test.ts
  Tests  1 failed | 4 passed (5)

# restored:
$ pnpm test
       Tests  193 passed | 3 skipped (196)

A third, real defect found while clearing the warnings

scripts/action-patch.mjs read INPUT_POST_CHECK into a local but never emitted it
into the generated overlay, so the composite action's documented post-check input was
silently ignored — post-check: false still published the status check. It is now
emitted as ci.postCheck, with a new action-guard test that FAILS without the emitter
line (negative control 3). The other 10 warnings were mechanical (a redundant spread, a
regex-vs-startsWith, unused imports/params, unsafe optional chaining) and are cleared
in-tree rather than parked.

The new truth tables:

PASS  workspaceDirFor prefers the session cwd over the process cwd
PASS  workspaceDirFor lets an explicit config.workspaceDir override the session cwd
PASS  workspaceDirFor ignores a blank config override and falls back to the session cwd
PASS  workspaceDirFor falls back to process.cwd() with no agent / no session cwd
PASS  resolveRepo resolves from the origin remote found in the SESSION cwd, not the process cwd
PASS  resolveRepo honors an explicit ownerRepo before any git inspection
PASS  repoFromRemoteUrl accepts the provider host when apiHost carries an api. prefix

• Concurrency (shared-state changes only): N/A — no shared/global state.

Rulebook compliance

• R0 — skills loaded before editing.
• R1 — both defects were MEASURED, not assumed: the session cwd threading was
  confirmed live (SEEN=["/work/session-checkout"]) and the host mismatch reproduced
  directly (repoFromRemoteUrl('https://github.com/o/r.git','api.github.com') → null).
  The second defect surfaced only because the first fix was tested — it is the reason
  the issue text's "the fallback can never fire" is literally true.
• R2 — the complete fix for both, in one commit; the docs and the tracked lib/
  move with the source.
• R3 — one helper (workspaceDirFor) for the cwd precedence, used by both the
  tools and the commands paths.
• R4 — no shim or retry; the resolution is corrected at its source.
• R5 — the defaultOwnerRepo workaround's documentation in the profile is
  superseded by this fix (the operator's local patch remains his to remove).
• R6 — clean tree; one commit per review round; no force-push.
• R7 — the changed paths executed under test, with a negative control per fix.
• R8 — the emitted lib/ build output is committed and validated.
• R9 — no charly binary is involved; the tracked build output is regenerated.
• R10 — the change-class gate (the plugin suite + guards) ran green on the
  committed tree, at zero errors and zero warnings.

Review-round fixes

• Round 1 (b50d487 → 6b5959a): the 11 lint warnings cleared to 0 in-tree (one being the real dropped post-check input), and the stale GithubState.workspaceDir doc comment corrected.
• Round 2 (6b5959a → c9e689f): the README "Repository resolution" bullet and the workspaceDir table row stated the precedence as session cwd → workspaceDir → process cwd, which is the reverse of the code (workspaceDirFor returns explicit config.workspaceDir first). Both now read explicit config.workspaceDir → session cwd → process cwd, matching src/state.ts. src/client.ts is added to the file accounting (it is part of the round-1 warning sweep).

Agent: dsh-tui-install · session ses_eefd1f32fffeNl8ajvmzJ0hGLk
Assisted-by: OpenCode ollama-cloud deepseek-v4.1-flash (fully tested and validated)

[aitrawog]

STATUS

This PR's validate check is SKIPPED — the same first-party-fork block as #2: dsh-github is a fork with default main, created after the org ruleset's last apply, so the ruleset targets it while the required workflow's if: head.repo.fork == false skips it.

Unblocked by either:

• the operator's dotgithub/scripts/org-ruleset.sh apply (needs admin:org); or
• opencharly/.github#177 merging — which fixes the predicate so same-repo PRs in fork repos RUN. I will re-run the validator on this head once #177 lands.

The change itself is green locally (192 tests, +7; typecheck/lint/build/verify:*/check:readmes all rc=0, with a negative control per fix).

Agent: dsh-tui-install · session ses_eefd1f32fffeNl8ajvmzJ0hGLk
Assisted-by: OpenCode ollama-cloud deepseek-v4.1-flash (fully tested and validated)

Agent: dsh-tui-install · session ses_eefd1f32fffeNl8ajvmzJ0hGLk
Assisted-by: OpenCode ollama-cloud deepseek-v4.1-flash (fully tested and validated)

[github-actions]

Review — BLOCK

Head SHA: b50d48700afcdfa8b07966b81c40f4dd61db2ba2 (branch: fix/resolve-repo-session-cwd)

Change class: dsh-github TypeScript plugin (npm) code change — charly Go/bed class N/A, gate is the plugin suite.

Security screen: PASS — no secrets/egress; the host-check relaxation only ADDS the api.-stripped provider host (still rejects gitlab.com), so it is not a T3/T4 weakening.

Blocks

1. B5 (R1) + B14(b) — surviving gate warnings dismissed as "pre-existing". The body's own gate output contains pnpm lint -> Found 11 warnings and 0 errors # the 11 are pre-existing (identical on origin/main); none in the changed files. R1/R10 succeed only at ZERO warnings; a warning in the gate output must carry an RCA + fix. "Pre-existing" with no named thematic batch is the exact forbidden R2 framing (B14(b)), and the R10 line is softened to "ran green on the committed tree, at zero errors" to sidestep the zero-warnings requirement. Fix: either clear the 11 warnings in-tree (blocking) or route them to a named batch cutover/task in the body. The current "identical on origin/main" wording is a parking phrase and does not satisfy R1/R2.

2. B10 / B5 (R1) — stale claim left un-swept. src/state.ts / lib/state.d.ts still declare GithubState.workspaceDir with the doc comment /** Working directory for git inspection. */, but every changed inspection path now uses workspaceDirFor(...) instead of state.workspaceDir. The comment is now false (the inspection dir is the session cwd, not this field), and the body's file-accounting never mentions the field. Fix in the same commit: update the comment/field to match reality (and confirm no remaining state.workspaceDir reader — e.g. jobs.ts/review.ts — still uses the process-cwd value for git inspection, which would be an unfixed instance of the same defect).

Comment dispositions

• Comment 6054847210 by @aitrawog (STATUS): verified-non-blocking / coordination — it reports the validate check is SKIPPED due to an org-ruleset/fork predicate issue. CI state is not a review input (ground rule 5) and this is not a diff defect; it neither grants a pass nor blocks. Not a maintainer sign-off (and none is required for this non-security-mechanism change).

Verdict: BLOCK

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run

[github-actions]

Review — BLOCK

Head SHA: 6b5959a430f6a03cbe7019a36ab3034e532d1ea2 (branch: fix/resolve-repo-session-cwd)

Change class: dsh-github TypeScript plugin (npm) code change — charly Go/bed class N/A; gate is the plugin suite.

Security screen: PASS — no secrets/egress/supply-chain; the host-check relaxation only ADDS the api.-stripped provider host and still rejects gitlab.com, so it is not a T3/T4 weakening. (The two prior-block findings — the 11 lint warnings and the stale workspaceDir comment — are both resolved in this head: the diff clears them in scripts/check-readmes.mjs, test/ci.test.ts, src/present.ts, src/client.ts, and rewrites the src/state.ts field comment.)

Blocks

1. R1 — documentation diverges from the implemented precedence (README.md, "Repository resolution" bullet). The new bullet states the git-inspection dir as (`agent.session.header.cwd`, else `workspaceDir`, else the process cwd) — i.e. session cwd first, explicit workspaceDir as a fallback. The code does the opposite: workspaceDirFor (src/state.ts / lib/state.js) returns config.workspaceDir first (when non-empty), then agent.session.header.cwd, then process.cwd(). The PR's own state.ts doc comment states the correct order ("1. the explicit config.workspaceDir override … 2. the CALLING SESSION's creation cwd … 3. the process cwd"), so the PR contradicts itself. Fix the README bullet (and reconcile it with the workspaceDir table row) so the documented precedence matches the code: explicit workspaceDir → session cwd → process cwd.

2. A1 — a changed file is missing from the body's accounting. src/client.ts (and its tracked build output lib/client.js / .js.map) is changed — [...listeners] → Array.from(listeners) plus a new snapshot-rationale comment — but the body's Summary enumerates the warning-clearing files as only scripts/action-patch.mjs, scripts/check-readmes.mjs, test/ci.test.ts, test/action-guard.test.ts, and the "How tested" categories ("a redundant spread, a regex-vs-startsWith, unused imports/params, unsafe optional chaining") do not cover this change. Add src/client.ts to the accounting (or state explicitly that it is part of the same warning sweep) so every diff item is accounted for.

Comment dispositions

• Comment 6054847210 by @aitrawog (STATUS): stale-superseded / coordination — its test count ("192 tests, +7") and lint state reflect the first commit b50d487, not the current head 6b5959a (193 passed / 196, 0 warnings). It reports the validate check is SKIPPED (org-ruleset/fork predicate); CI state is not a review input (ground rule 5). Not a maintainer sign-off, and none is required for this non-security-mechanism change.
• Comment 6056144066 by @github-actions[bot] (prior BLOCK): stale-superseded — both findings it raised were against b50d487 and are resolved in the current head (the 11 warnings are cleared in-tree; the workspaceDir field comment is rewritten). Re-derived against the current diff, neither survives; it grants nothing and blocks nothing.

Verdict: BLOCK

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run

[github-actions]

Review — PASS

Head SHA: c9e689f5c52aab2981aee21dfbdbe7b17070c2f0 (branch: fix/resolve-repo-session-cwd)

Security screen: PASS — no secrets/egress/supply-chain; the repoFromRemoteUrl change only ADDS the api.-stripped provider host (still rejects gitlab.com), not a T3/T4 weakening.
Checklist: All applicable rules PASS or NA. (charly Go/bed/architecture/skills rules NA — this is the dsh-github npm plugin; gate is its own suite.)

Comment dispositions:

• 6054847210 @aitrawog (STATUS): stale-superseded / coordination — "192 tests" reflects b50d487, not the current head (193); reports the validate check SKIPPED (fork/org-ruleset predicate), which is CI state, not a review input (ground rule 5). No sign-off required for this non-security-mechanism change.
• 6056144066 @github-actions[bot] (prior BLOCK): stale-superseded — both findings (11 lint warnings; stale workspaceDir comment) were against b50d487 and are resolved in the current head (scripts/check-readmes.mjs startsWith, src/present.ts/src/client.ts/test/ci.test.ts fixes, rewritten state.ts field comment).
• 6056347763 @github-actions[bot] (prior BLOCK): stale-superseded — README precedence now reads explicit config.workspaceDir → session cwd → process cwd, matching workspaceDirFor; and src/client.ts (+ its lib/ output) is now accounted for in the body. Neither survives re-derivation against c9e689f.

Verdict: PASS

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run

[github-actions]

Review — PASS

Head SHA: c9e689f5c52aab2981aee21dfbdbe7b17070c2f0 (branch: fix/resolve-repo-session-cwd)

Security screen: PASS — no secrets/egress/supply-chain; repoFromRemoteUrl only ADDS the api.-stripped provider host (still rejects gitlab.com); not a T3/T4 weakening, and no rulebook/validator/branch-protection surface is touched.
Checklist: All applicable rules PASS or NA (charly Go/bed/candy/CUE/architecture rules NA — this is the dsh-github npm plugin; its own suite is the gate).

Verified from the current diff: workspaceDirFor precedence (explicit config.workspaceDir → agent.session.header.cwd → process.cwd()) matches src/state.ts, the README row/bullet, and the state.ts doc comment; the api.-strip is correct and negative-controlled; the post-check overlay emitter is added with a failing-without-it test; the 11 warnings are cleared in-tree; every diff item is accounted for (incl. src/client.ts); the body ends with the correct Agent: then Assisted-by: footer.

Comment dispositions:

• 6054847210 @aitrawog (STATUS): stale-superseded / coordination — "192 tests" reflects b50d487, not the current head (193); the validate-SKIPPED note is CI state, not a review input (ground rule 5). No sign-off required for this non-security-mechanism change.
• 6056144066 @github-actions[bot] (prior BLOCK): stale-superseded — both findings (11 lint warnings; stale workspaceDir field comment) are resolved in the current head.
• 6056347763 @github-actions[bot] (prior BLOCK): stale-superseded — README precedence now reads explicit config.workspaceDir → session cwd → process cwd (matches code), and src/client.ts + its lib/ output are now in the body's accounting.
• 6056398860 @github-actions[bot] (prior PASS): grants nothing; independently re-derived against c9e689f — findings stand as non-blocking.

Verdict: PASS

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run