[juliusmarminge]

Adding a project clones over SSH for GitCafe, GitLab, Bitbucket and Azure DevOps, and Retry repeats the same URL. On a machine with no SSH key registered with the host, every clone failed with Permission denied (publickey), even when Git's HTTPS credential helper for that host worked. Nothing offered HTTPS instead.

SourceControlRepositoryService.cloneRepository now retries once over HTTPS when git reports the SSH login was refused (authentication_failed or host_key_unverified):

• Skipped when the caller asked for SSH explicitly, and for any other failure.
• A looked-up repository uses the provider's own HTTPS URL. A pasted or tracked SSH URL is rewritten with the same converter the add-to-machine dialog uses, which refuses custom ports rather than guess. It moves from the web app to @t3tools/shared/cloneUrl so the server shares it.
• If HTTPS fails too, the error shows both: the SSH refusal, then why HTTPS failed.
• The clone result reports the HTTPS remote when the fallback was used, so the project's remote matches what git set.

Every clone path goes through this method: the command palette, mobile, the tracked clone and its Retry, the synchronous RPC, and the MCP clone tool. Publishing keeps its existing SSH/HTTPS picker, so it has no fallback. The user guide's clone section mentions the fallback, since the project's remote ends up on HTTPS.

Tests cover the retry, both attempts failing, and no retry for an explicit SSH request or a non-login failure. The two retry tests fail on main.

Model: Claude Opus 5.5, via Claude Code in T3 Code.

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Approved at 23849bd

Macroscope's review found this PR approvable — This is a focused source-control bug fix that retries failed automatic SSH clones over HTTPS only for SSH authentication or host-key rejections, while preserving explicit SSH and unrelated failure behavior. The fallback and failure-reporting paths are covered by tests, and the remaining changes are mechanical, documentation, or package wiring.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.9 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	−24 B (−0.5%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	−24 B (−2.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	−41 B (−0.2%)	29.3 KiB	✅
Claude	Live turn messages	2	1	−1 (−50.0%)	8	✅

Baseline: b5a226e · PR result: 23849bd · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Team
• Run ID: 9c87a1c1-1efa-40fa-89bd-24d3dd3d3878

📥 Commits

Reviewing files that changed from the base of the PR and between b5a226e and 23849bd.

📒 Files selected for processing: 8

• apps/server/src/sourceControl/SourceControlRepositoryService.test.ts
• apps/server/src/sourceControl/SourceControlRepositoryService.ts
• apps/web/src/components/AddProjectToMachineDialog.tsx
• apps/web/src/lib/addProjectToMachine.ts
• docs/user/source-control.md
• packages/shared/package.json
• packages/shared/src/cloneUrl.test.ts
• packages/shared/src/cloneUrl.ts

💤 Files with no reviewable changes: 1

• apps/web/src/lib/addProjectToMachine.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

📝 Walkthrough

The shared package now provides clone URL protocol utilities. The server retries eligible SSH clone failures over HTTPS, reports both errors if the retry fails, and returns the effective remote URL.

Changes: Repository clone protocol fallback

Layer / File(s)	Summary
Shared clone URL utilities packages/shared/src/cloneUrl.ts, packages/shared/package.json, packages/shared/src/cloneUrl.test.ts, apps/web/src/components/AddProjectToMachineDialog.tsx, apps/web/src/lib/addProjectToMachine.ts	Clone URL detection and conversion moved into the shared package. The package exports the helpers, and the web dialog imports them from the shared module.
Server clone retry apps/server/src/sourceControl/SourceControlRepositoryService.ts, apps/server/src/sourceControl/SourceControlRepositoryService.test.ts, docs/user/source-control.md	The server retries SSH clones over HTTPS for authentication or unverified-host-key errors. If both attempts fail, the error includes both failure details. Tests cover retry eligibility and outcomes; the documentation describes the fallback and HTTPS remote.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant cloneRepository
  participant runClone
  participant Git
  cloneRepository->>runClone: Clone with the prepared URL
  runClone->>Git: Execute clone
  Git-->>runClone: Return authentication or host-key error
  runClone-->>cloneRepository: Return clone error
  cloneRepository->>runClone: Retry with HTTPS URL when eligible
  runClone->>Git: Execute HTTPS clone
  Git-->>runClone: Return clone result
  runClone-->>cloneRepository: Return clone result

Loading

Suggested reviewers: saphid, t3dotgg

Merge Risk: ⚪ Minimal · up to 23849

The SSH-to-HTTPS clone fallback is ready to merge after normal checks.

Pre-merge checks: 3 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description explains the problem, implementation, scope, fallback behavior, affected clone paths, documentation, and tests. However, it does not provide the required issue or maintainer approval r…	Add the required issue or maintainer approval reference, or explain why this obvious focused bug fix qualifies for the exemption. State which focused tests were run after the changes and their observed results, including any tests that rema…

Passed checks: 3 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: SSH clone failures now retry over HTTPS.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the problem, implementation, scope, fallback behavior, affected clone paths, documentation, and tests. However, it does not provide the required issue or maintainer approval reference, or explain why this focused fix qualifies for the exemption. It also does not clearly state the verification result after the changes; it only states that two tests fail on main.

Resolution

Add the required issue or maintainer approval reference, or explain why this obvious focused bug fix qualifies for the exemption. State which focused tests were run after the changes and their observed results, including any tests that remain unavailable or failing.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}