fix(server): Stop re-probing hosting CLIs for unrecognized hosts

[mwolson]

Fixes #12060

Problem

When a project's remote points at a host T3 Code does not recognize, the server asks glab, fj, tea and the GitHub credential layer whether they own that host. Examples are a <tenant>.ghe.com GitHub Enterprise host or an SSH alias. Nothing remembered the answer, so the pull request sweep asked again for every project on that host, every minute. With several such projects, sidebar VCS took 10 to 20 seconds to settle and the desktop app showed "Reconnecting". On macOS, the burst of failed spawns exhausted Gatekeeper.

Change

• The answer is remembered for five minutes (SourceControlProviderRegistry). Checkouts whose remotes share a server and path prefix share one lookup. Callers that ask while a probe is running wait on it instead of starting their own.
• Only answers that every integration gave are kept. A refiner returns the provider it claims or null, and any failure means "could not tell" (refineUnknownRemoteProvider in source-control-core). A missing CLI or a missing login counts as an answer. A timeout, API or keyring failure, or a claim reached after an earlier check failed is not kept, so the next read asks again. When fj cannot read its logins, Forgejo still asks tea.
• glab is asked about the remote's own host (glab auth status --hostname, spelled as the remote spells it). Without --hostname, glab reports on its default host. Its "not logged in" messages count as an answer.
• Settings clear it. Saving a credential or turning a host on or off in Settings clears the remembered answers. A login made in a terminal is picked up when the five minutes run out. One known limit: gh reports a locked keyring the same way as "no login", so in that case GitHub may not claim the host for up to five minutes after the keyring unlocks.

Hosts that no integration claims still show as unsupported, just without the repeated probes.

Verification

• SourceControlProviderRegistry.test.ts:
  • Several checkouts of one unrecognized server, including concurrent reads, probe each CLI once, and probe again after five minutes. glab is asked with --hostname in the remote's spelling.
  • A check that times out is asked again on the next read.
  • A Settings change makes the next read ask again.
• GitLabSourceControlProvider.test.ts: glab's "not logged in" messages count as an answer, and an API failure does not.
• Each test fails when the part it covers is reverted. The registry, core, Forgejo, GitLab and GitHub suites pass.
• Not reproduced: the macOS Gatekeeper and WSL timings from the issue.

Originally by @mwolson, building on @only21mil's #18270 and @JorrinKievit's #12071. The maintainer takeover moved the "did every integration answer" rule from each adapter into the core and trimmed the tests.

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR not approvable — This PR changes existing source-control authentication discovery behavior across GitHub, GitLab, and Forgejo while adding shared caching, concurrency, invalidation, and retry semantics. The authentication sensitivity and cross-provider runtime complexity warrant human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 57da107c-377d-4197-9b50-a9ed7e0b0a9b

📥 Commits

Reviewing files that changed from the base of the PR and between aa92be3 and f0f0fed.

📒 Files selected for processing: 6

• apps/server/src/sourceControl/SourceControlProviderRegistry.test.ts
• apps/server/src/sourceControl/SourceControlProviderRegistry.ts
• packages/source-control-core/src/server/discovery.ts
• packages/source-control-forgejo/src/server/ForgejoSourceControlProvider.ts
• packages/source-control-github/src/server/GitHubSourceControlProvider.ts
• packages/source-control-gitlab/src/server/GitLabSourceControlProvider.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

📝 Walkthrough

Unknown-remote provider discovery now distinguishes a confirmed absence from an inconclusive check. The registry shares concurrent lookups, caches settled verdicts for five minutes, and clears the cache when server settings change. Provider adapters handle missing executables and authentication failures according to their results.

Changes: Unknown Remote Refinement

Layer / File(s)	Summary
Refinement verdicts and provider checks packages/source-control-core/src/server/discovery.ts, packages/source-control-forgejo/src/server/ForgejoSourceControlProvider.ts, packages/source-control-github/src/server/GitHubSourceControlProvider.ts, packages/source-control-gitlab/src/server/GitLabSourceControlProvider.ts, packages/source-control-gitlab/src/server/GitLabSourceControlProvider.test.ts	Discovery returns a provider claim or null with a settlement status. Provider checks distinguish missing integrations and known unauthenticated states from other failures. GitLab passes the remote host to its authentication check.
Registry caching and lookup integration apps/server/src/sourceControl/SourceControlProviderRegistry.ts, apps/server/src/sourceControl/SourceControlProviderRegistry.test.ts	The registry deduplicates lookups by remote identity, caches settled verdicts for five minutes, and invalidates the cache on settings changes. Tests cover concurrent lookups, expiry, timeouts, and settings changes.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant SourceControlProviderRegistry
  participant refineUnknownRemoteProvider
  participant ProviderChecks
  SourceControlProviderRegistry->>refineUnknownRemoteProvider: Refine unknown remote
  refineUnknownRemoteProvider->>ProviderChecks: Check provider credentials and logins
  ProviderChecks-->>refineUnknownRemoteProvider: Return claim, no claim, or failure
  refineUnknownRemoteProvider-->>SourceControlProviderRegistry: Return verdict and settlement status
  SourceControlProviderRegistry->>SourceControlProviderRegistry: Cache settled verdict

Loading

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to f0f0f

Unknown-remote provider discovery now caches confirmed results for five minutes and retries inconclusive checks. No concrete merge-blocking problem was identified in the supplied evidence.

Security architecture risk: 🔵 Low · up to f0f0f

The change reuses host-detection results without storing credentials in those results. Reviewed operations still obtain credentials separately. No new security attack path was established, but concurrent invalidation and third-party login behavior remain partially verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — A mistaken or stale verdict can affect multiple checkouts sharing a lookup key within one registry instance, rather than only the initiating checkout. The cached payload is provider routing information, not repository data or credentials; downstream credential selection remains a separate boundary.

Trust Boundaries and Controls

• observed — Remote-derived GitLab host input is passed as a structured argument to the provider-declared glab executable. Discovery still requires an authenticated matching host before claiming GitLab; this change does not introduce shell-text interpolation at that boundary.
• observed — For fj, credential storage paths come from platform, home, and process environment rather than checkout cwd. Forgejo operations reselect a login against the current remote and requested host, and reread fj credentials before authenticated requests. This counters the hypothesis that omitting cwd alone transfers one checkout's credential authority to another.

Resilience and Maintainability Implications

• inferred — Invalidation is not a cancellation barrier for existing lookup waiters. A late verdict can still select a provider, but the reviewed normal GitHub request path obtains credentials separately and Forgejo rechecks login selection. A late routing result was therefore not established as a newly introduced credential-revocation bypass.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: preventing repeated CLI probing for unrecognized hosts.
Description check		The description explains the problem, the caching and invalidation behavior, edge cases, and focused verification. It references issue #12060 but does not include a separate Scope and approval section…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[juliusmarminge]

Taking over this one to get it landed. I'll keep your commits and push on top of this branch.