[brennanb2025]

	Files	Added	Deleted	Net
Test	2	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​58	$\color{#cf222e}{\Huge{\mathbf{−}}}$​3	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​55
Prod	2	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​26	$\color{#cf222e}{\Huge{\mathbf{−}}}$​11	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​15

The rule

An operation on a remote repoPath must never fall back to the client machine's filesystem. "We could not ask the host" has to fail closed. Already stated in:

• src/renderer/src/lib/connection-context.ts:22-24 — "Callers must not fall back to a LOCAL read of a remote path"
• src/main/source-control/repo-default-branch.ts:76-78 — "a dropped SSH provider must not fall back to local git — the repoPath is remote, so a local run could answer for the wrong repo"
• src/main/runtime/orca-runtime.ts:24242-24246

The site

src/main/repo-icon-file-detection.ts:265 (pre-change):

return fsProvider ? detectRemoteImageIcon(repoPath, fsProvider) : detectLocalImageIcon(repoPath)

reached from src/main/repo-icon-autodetect.ts:105-113. The ternary keys off provider presence, not repo location. When the repo is SSH-hosted but getSshFilesystemProvider(connectionId) returns undefined — connection dropped, or not yet reattached after a restore — this stats and reads the client filesystem at a remote absolute path. On a machine where a same-named path exists locally (very common: ~/code/<repo> on both sides), the sidebar shows the wrong repository's icon, silently and persistently, since the detected icon is stored on the repo record at add time.

The identical fallback sat five lines below in the package-homepage probe (detectLocalPackageHomepageIcon), so it is closed by the same gate.

The fix

connectionId was already resolved in detectRepoIcon — it just was not passed down. It is now threaded into detectRepoFileIcon, which distinguishes the three cases explicitly:

repo	provider	behavior
local (connectionId null/undefined)	—	local probe, unchanged
remote	present	remote probe, unchanged
remote	missing	no icon (the existing not-detected path)

detectRepoIcon gates both filesystem probes on the same condition. The GitHub-avatar fallback is deliberately untouched: it routes through the connection-aware git transport (getRepoSlug(repoPath, connectionId)), not the client filesystem, so a missing filesystem provider must not suppress it.

Remoteness is derived from the threaded connection identity only — never inferred from the path string.

Red-first evidence

Both new assertions were verified failing before the fix, by reverting source while keeping the tests.

RED-A — end-to-end, source reverted to HEAD (git checkout HEAD -- src/main/repo-icon-autodetect.ts). A real temp repo with a favicon.png, connectionId: 'ssh-target-not-connected', no provider registered:

FAIL src/main/repo-icon-autodetect.test.ts > detectRepoIcon >
     returns no icon for an SSH-hosted repo whose filesystem provider is missing
AssertionError: expected { type: 'image', …(3) } to be undefined

- Expected: undefined
+ Received: {
    "label": "favicon.png",
    "source": "file",
    "src": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAAB…",
    "type": "image",
  }

Tests  1 failed | 15 passed (16)

That received value is the defect: the local repo's icon returned for a remote repo.

RED-B — guard-only revert (new signature kept, only the if (connectionId) return null block deleted), so the unit assertion cannot pass for the wrong reason:

FAIL src/main/repo-icon-file-detection.test.ts > detectRepoFileIcon connection boundary >
     never reads the client filesystem for a remote repo whose provider is missing

expect(stat).not.toHaveBeenCalled()
  37th vi.fn() call: [ "/repo/src/index.html" ]
  Number of calls: 37

Tests  1 failed | 4 passed (5)

37 local stat calls against the remote path. The unit test spies the real node:fs/promises entrypoints, so it asserts the absence of the read itself rather than only the return value.

GREEN (fix restored): Test Files 3 passed (3) · Tests 28 passed (28) across repo-icon-file-detection.test.ts, repo-icon-autodetect.test.ts, repos-add-linked-worktree.test.ts.

Local-repo behavior is unchanged

connectionId is null/undefined for every local repo (the local add/clone/create call sites do not pass one), so the guard is never reached and the local probe runs exactly as before. Two tests pin this rather than leaving it to inspection:

• still detects local icons when the repo has no connection — connectionId: null still returns the favicon.png icon.
• still probes the local filesystem for a repo with no connection — asserts stat is called, so the guard cannot silently widen into local repos.

All 14 pre-existing icon-detection tests pass untouched (only the detectRepoFileIcon call sites were updated for the options-object argument).

Gates

• npx oxlint on the four changed files — clean (verified live: it flagged a consistent-type-imports violation on the first pass, which is fixed).
• oxfmt via lint-staged; react-doctor config also ran on commit. No prettier.
• tsc --noEmit -p config/tsconfig.node.json — clean. No tsc -b.
• No max-lines disable added.

Scope

Four files, one behavior change. No new files, no renames, no product surface touched.

Review QA evidence

Validated commit 64128add6e in the exact PR worktree with isolated Electron user data and Playwright CDP. pnpm build:relay passed before connecting; app identity reported Orca: brennanb2025/gate-14947.

A disposable Ubuntu 22.04 Linux SSH target (linux-arm64, Node 20.20.2) hosted a real demo-project cloned from a transferred Git bundle after direct HTTPS clone was blocked by authentication. Connected repos.addRemote discovered the remote favicon.png; the rendered sidebar showed the project on the SSH host, and SSH backing-state checks confirmed /work/demo-project, branch main, its worktree, and only the deliberate icon fixture.

After disconnecting, the rendered app showed Connect and 0 hosts; a real repos.addRemote call failed with the not-connected error and left repo state unchanged despite an identically pathed local repo/icon fixture.

The product API rejects a disconnected remote add before icon detection, so the exact missing-filesystem-provider race cannot be driven through the user surface without bypassing the changed code. That branch is covered by the deterministic no-local-stat/readFile tests and the end-to-end icon test. Renderer console had zero errors; relay logs showed successful handshake/streaming and clean disconnect. The app session, remote repo/target, container, relay, keys, profile, and temporary bundles were removed after verification.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7a209c40-1b2a-4a88-adba-879ae8091a5d

📥 Commits

Reviewing files that changed from the base of the PR and between 5e189d6 and 64128ad.

📒 Files selected for processing (4)

• src/main/repo-icon-autodetect.test.ts
• src/main/repo-icon-autodetect.ts
• src/main/repo-icon-file-detection.test.ts
• src/main/repo-icon-file-detection.ts

🚧 Files skipped from review as they are similar to previous changes (4)

• src/main/repo-icon-file-detection.test.ts
• src/main/repo-icon-autodetect.ts
• src/main/repo-icon-autodetect.test.ts
• src/main/repo-icon-file-detection.ts

Included review availability: Your plan includes up to 10 reviews per rolling hour; 4 remain after this review.

---

📝 Walkthrough

Walkthrough

Repository icon detection now distinguishes connected repositories from local repositories. Connected repositories use a filesystem provider for file and package icon probing. Connected repositories without a provider return no icon instead of probing the local filesystem. Repositories without a connection continue local icon detection. Tests cover filesystem boundaries, provider-based detection, concurrency behavior, and local favicon detection.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check	⚠️ Warning	The description explains the change, rationale, implementation, tests, and QA, but omits required template sections and a linked issue.	Add the required template sections, especially ELI5, Linked Issue with an issue number, AI Disclosure, Review, boundary checklist, Notes, and Checklist.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly states the main fix: remote repository icon detection must not probe the client filesystem.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[brennanb2025]

Review verdict: LAND

No P0, P1, or P2 findings. The four-file patch is focused and matches the SSH execution-boundary rule: a remote repoPath with no filesystem provider fails closed, while connected remote and local/folder-workspace behavior remain unchanged. The independent adversarial, precedent, and final readiness passes all returned clean; no additional code change was warranted.

Observed verification:

• 21 focused icon tests passed; linked-worktree coverage also passed.
• oxlint, Node typecheck, and all-platform relay builds passed.
• Native Linux ARM64 live SSH relay/connect/PTY QA passed.
• Full PR CI is green, including Windows packaging, Git compatibility, wire compatibility, static analysis, typecheck, packaging, and Node 24/26 test shards.
• Performance is neutral-to-better: the disconnected path removes erroneous client filesystem I/O, connected concurrency remains bounded at six, and the patch adds no polling, retries, timers, caches, listeners, or subprocess fanout.
• No persisted schema, RPC/wire, pairing, dependency, mobile, or platform-specific surface changed.

The connected/disconnected Playwright-CDP screenshots already attached to the PR were downloaded and visually inspected and are valid evidence for commit 64128add6e. In this resumed session, a fresh product-level Electron SSH retry reached successful relay handshake/socket acceptance but then stalled without returning a connection result, so that retry is blocked and not counted as a pass; the lower-level live SSH pass and deterministic no-client-stat/readFile tests are separate observed passes.

Residual risk is low. Previously persisted incorrect file icons are not migrated, which is appropriate scope because they cannot be safely distinguished from legitimate remote file icons.