fix(server): end clone options before the repository URL

[saphid]

Problem

When you clone a repository whose URL or local path starts with -, the server passes that value to Git, which parses it as a git clone option. This affects Add Project → clone on web, desktop and mobile, and the t3_project_clone tool. For example, cloning a local repository named --bare fails with fatal: repository 'checkout' does not exist instead of creating the checkout.

Why this qualifies

This is the CONTRIBUTING "small, obvious bug" route. It is a one-line fix for a positional-argument bug at the only git clone call site, and it uses Git's standard -- option terminator. Normal clone URLs and existing flows do not change. There is no linked issue and no prior maintainer discussion.

Fix

SourceControlRepositoryService.cloneRepository now passes -- after the clone options. That puts the repository URL or path and the destination directory after the terminator, so Git always treats them as positional arguments. This also covers a destination directory name that starts with -.

The same parsing means an option-like operand can do more than fail. For example, a destination named --upload-pack=<command> makes Git run that command during the clone. Only a client that is already allowed to clone can supply that value, and standard paired clients can already run terminal commands. So this closes argument injection at the Git process boundary; it does not fix a privilege escalation.

Tests:

• The existing argument assertion now expects the terminator.
• A new real-Git test clones a local bare repository named --bare, and an ordinary source.git as a control. Each must produce a working tree at the requested destination.

Evidence

Environment: macOS 26.5.2 (arm64), Git 2.50.1 (Apple Git-155), Node 24.12.0. Verified on upstream main f870c419fc. This branch is that commit plus this one change.

Reproduction (real server process). I ran each step against a server built from upstream main, then against one built from this branch:

1. Start the real server (t3 serve) on a fresh, isolated data directory, with GIT_TRACE pointing at a file.
2. Issue a bearer session with t3 auth session issue.
3. Open the authenticated /ws socket. Call the same sourceControl.cloneRepository RPC the clients use, with remoteUrl: "--bare" (a local bare repository) and the destination checkout in the same directory.

Observed before (upstream main):

RPC result: Failure {"_tag":"SourceControlRepositoryError","provider":"unknown","operation":"cloneRepository","detail":"fatal: repository 'checkout' does not exist", ...}
git clone argv recorded by GIT_TRACE:
  git clone --progress --bare checkout
<fixture>/checkout/.git exists: false

Observed after (this branch):

RPC result: Success {"cwd":"<fixture>/checkout","remoteUrl":"--bare","repository":null}
git clone argv recorded by GIT_TRACE:
  git clone --progress -- --bare checkout
<fixture>/checkout/.git exists: true

Focused checks, run at this head:

Command	Result
vp test run src/sourceControl/SourceControlRepositoryService.test.ts (from apps/server), with main's SourceControlRepositoryService.ts swapped in	Fails: 2 failed, 11 passed. The --bare case fails with fatal: repository 'checkout' does not exist, and the argument assertion fails.
The same command on this branch	Passes: 13/13, including the source.git control.
vp run --filter t3 typecheck	Pass
vp lint --report-unused-disable-directives on both changed files	Pass
vp fmt --check on both changed files	Pass
vp run --filter t3 build:bundle	Pass
node scripts/release-smoke.ts	Pass

There is no UI change, so there are no screenshots. The evidence is the server trace above.

Surfaces

• Web, desktop and mobile: fixed with no client change. Add Project → clone in the web/desktop command palette and on the mobile Add Project screen both reach this call site through the projectClone.start / sourceControl.cloneRepository RPCs.
• MCP t3_project_clone: fixed. It calls the same service method.
• Local, remote-relay and tunnel: not affected. The change is in the server's Git invocation, after transport. Local was exercised; remote-relay and tunnel were not.
• Providers (Codex, Claude, Cursor, Grok, OpenCode, Antigravity): not affected. Cloning is not provider-shaped, and no adapter changed.
• Contracts and docs: no change. Inputs and results are unchanged, and documented behavior is unchanged.

Not checked

• Windows and Linux Git, authenticated network remotes, and provider lookups were not exercised. The lookup path (provider + repository) feeds the same argument list.
• Remote-relay and tunnel connections were not exercised.
• I did not demonstrate an option-injection effect beyond the misparsed --bare case.

GPT-6.1 Sol and Claude Opus 5.5 via T3 Code
🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Approved at bd5567c

Macroscope's review found this PR approvable — This is a narrowly scoped Git argument-handling bug fix that preserves normal clone behavior and adds regression coverage for option-like local repository paths. It changes no schemas, defaults, deployment configuration, or sensitive code.

^{You can add or adjust custom eligibility rules. Learn more.}

Dismissing prior approval to re-evaluate 75883b3

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: pingdotgg/t3code/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 21480423-80cb-44b3-b0dd-d40bcf62f32a

📥 Commits

Reviewing files that changed from the base of the PR and between 75883b3 and bd5567c.

📒 Files selected for processing (1)

• apps/server/src/sourceControl/SourceControlRepositoryService.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

cloneRepository now passes -- between Git clone options and the remote URL. Tests cover local repositories named --bare and source.git.

Changes

Git clone argument handling

Layer / File(s)	Summary
Separate clone options from the remote apps/server/src/sourceControl/SourceControlRepositoryService.ts, apps/server/src/sourceControl/SourceControlRepositoryService.test.ts	cloneRepository adds -- before the remote URL. Tests check the expected arguments and verify that cloning local repositories named --bare and source.git returns a destination containing .git.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to bd556

No actionable merge-blocking risk is identified for this change. It is ready to merge after normal checks.

Architecture Summary

Architecture risk: 🔵 Low · up to bd556

The change affects 1 system.

Changed systems: apps/server

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — apps/server (service) was modified; 2 changed files map to changed impact.

Before / after behavior

• observed — Modified behavior in apps/server/src/sourceControl/SourceControlRepositoryService.ts: cloneRepository adds -- after --progress; previously Git received the remote URL immediately after the options.
• observed — Modified behavior in apps/server/src/sourceControl/SourceControlRepositoryService.test.ts: The expected Git clone arguments now include -- before the remote URL.
• observed — Modified behavior in apps/server/src/sourceControl/SourceControlRepositoryService.test.ts: Adds a parameterized test for cloning local bare repositories named --bare or source.git; each case asserts the clone result points to the requested destination and that it contains a .git directory.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: ending Git clone options before the repository URL.
Description check	✅ Passed	The description covers the problem, fix, scope rationale, and focused verification results. It also states what was not checked and identifies the agent and harness.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

Dismissing prior approval to re-evaluate bd5567c

[saphid]

Review requested

Date (UTC)	Reviewer	Where
2026-10-03	Julius	Discord DM

_{Logged so this PR shows when a maintainer was asked to review it.}