Sync only the listed repository: verify an existing folder's origin and tie git credentials to the listed host #139

New Issue

2026-11-10T18:17:08Z

james.maes commented

2026-11-10 18:17:08 +00:00

Problem

When a folder with a repository's name already exists under the target, gclo pulls it through whatever origin that folder has. It never checks that the folder is a clone of the repository the listing returned, so:

a same-named folder from another organization, a fork, or another host is reported Updated although the listed repository was not synced;
the git transport is not tied to the host the listing came from.

The WSL recovery clone has the same looseness: its organization and repository arguments are not checked to be single path segments, and its credential setup is not tied to the clone URL's host.

Scope

IGitClient.FetchAndPullAsync takes the expected clone URL. A folder whose origin names a different repository fails its row with a message that says what the folder holds and what was expected; nothing is fetched.
Fetches use the listed URL; credentials are offered only to that URL's host over HTTPS.
WslCloner: validate the organization and repository as single segments, require an HTTPS URL, scope the credential helper to the URL's host, and check an existing destination's origin before pulling.
Reject an organization name that is not a single name segment before any request is made.
Threat model updated in the same change.

Acceptance

Tests: a folder with a different origin fails and is not fetched; an SSH-form origin of the same repository still syncs; credentials are refused for any other host or for HTTP; WSL argument and script checks.
100% line coverage holds; zero warnings; format clean.

## Problem When a folder with a repository's name already exists under the target, gclo pulls it through whatever `origin` that folder has. It never checks that the folder is a clone of the repository the listing returned, so: - a same-named folder from another organization, a fork, or another host is reported **Updated** although the listed repository was not synced; - the git transport is not tied to the host the listing came from. The WSL recovery clone has the same looseness: its organization and repository arguments are not checked to be single path segments, and its credential setup is not tied to the clone URL's host. ## Scope - `IGitClient.FetchAndPullAsync` takes the expected clone URL. A folder whose `origin` names a different repository fails its row with a message that says what the folder holds and what was expected; nothing is fetched. - Fetches use the listed URL; credentials are offered only to that URL's host over HTTPS. - `WslCloner`: validate the organization and repository as single segments, require an HTTPS URL, scope the credential helper to the URL's host, and check an existing destination's origin before pulling. - Reject an organization name that is not a single name segment before any request is made. - Threat model updated in the same change. ## Acceptance - Tests: a folder with a different origin fails and is not fetched; an SSH-form origin of the same repository still syncs; credentials are refused for any other host or for HTTP; WSL argument and script checks. - 100% line coverage holds; zero warnings; format clean.

james.maes added the bug quality labels 2026-11-10 18:17:08 +00:00

james.maes referenced this issue from a commit

2026-11-10 18:29:11 +00:00

fix(sync): pull only a clone of the listed repository, over the listed URL

james.maes referenced a pull request that will close this issue

2026-11-10 18:29:32 +00:00

fix(sync): pull only a clone of the listed repository, over the listed URL #140

james.maes referenced this issue from a commit

2026-11-10 18:54:54 +00:00

fix(sync): refuse URL rewrites from the folder, keep the user's remotes safe

james.maes referenced this issue from a commit

2026-11-10 18:55:24 +00:00