@monster-orange/den 0.2.7 → 0.2.8

package/src/shared/environment-manager/workspace-manager.ts

@@ -22,6 +22,12 @@ import {
 } from "../process/spawn-streaming.js";
 import { buildServiceEnv } from "./service-env.js";
 import { assertSafeCloneDestination } from "./clone-guard.js";
+import {
+  SAFE_SLUG_RE,
+  isGitRemote,
+  isSafeRemote,
+  redactRemote,
+} from "./git-remote.js";
 import type { CommandDef } from "../types/index.js";
 
 // ── Terminal resolution (macOS) ──────────────────────────────────────────────
@@ -76,13 +82,45 @@ function resolveTerminalAppName(key: string): string | null {
 
 // ── Git helpers ───────────────────────────────────────────────────────────────
 
-function git(cmd: string, cwd?: string): void {
-  execSync(`git -c credential.helper="!gh auth git-credential" ${cmd}`, {
+const GH_CREDENTIAL = `-c credential.helper="!gh auth git-credential"`;
+
+/**
+ * Run git with gh as an extra credential helper (a GitHub clone), or as
+ * plain git (`gh` false: a clone from a catalog `remote:`, which gets only
+ * the user's own credential helper, never gh's: SEC-0).
+ */
+function git(cmd: string, cwd?: string, gh = true): void {
+  execSync(`git ${gh ? `${GH_CREDENTIAL} ` : ""}${cmd}`, {
     cwd,
     stdio: "inherit",
   });
 }
 
+/** Set in a clone made from a `remote:`; its later fetches stay plain git. */
+const PLAIN_MARK = "den.credential";
+
+/** Whether a clone's fetches use gh: every clone but one Den made from a `remote:`. */
+function usesGhCredential(repoPath: string): boolean {
+  try {
+    return (
+      execSync(`git config --local --get ${PLAIN_MARK}`, {
+        cwd: repoPath,
+        stdio: ["ignore", "pipe", "ignore"],
+        encoding: "utf-8",
+      }).trim() !== "git"
+    );
+  } catch {
+    return true; // unset: a GitHub clone, as every clone before ORG-1d
+  }
+}
+
+/** Clone `source` (a GitHub slug or a checked git URL) with its own credentials. */
+function gitClone(args: string, source: string, dest: string): void {
+  const plain = isGitRemote(source);
+  git(`clone ${args}"${cloneUrlOf(source)}" "${dest}"`, undefined, !plain);
+  if (plain) git(`config --local ${PLAIN_MARK} git`, dest, false);
+}
+
 function gitCapture(cmd: string, cwd?: string): string {
   return execSync(cmd, {
     cwd,
@@ -96,6 +134,16 @@ export function ghCloneUrl(ghSlug: string): string {
   return `https://github.com/${ghSlug}.git`;
 }
 
+/** The URL a clone of `source` is made from: a GitHub slug's, or the remote itself. */
+export function cloneUrlOf(source: string): string {
+  return isGitRemote(source) ? source : ghCloneUrl(source);
+}
+
+/** `source` for a log line: a slug as is, a remote with any user info masked. */
+function shown(source: string): string {
+  return isGitRemote(source) ? redactRemote(source) : source;
+}
+
 // ── Injection guards ──────────────────────────────────────────────────────────
 //
 // git() runs through a shell (execSync), so branch names and GitHub slugs
@@ -106,7 +154,7 @@ export function ghCloneUrl(ghSlug: string): string {
 // the single choke point for every clone path.
 
 export const SAFE_BRANCH_RE = /^[a-zA-Z0-9._/-]+$/;
-export const SAFE_SLUG_RE = /^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/;
+export { SAFE_SLUG_RE };
 
 function assertSafeBranch(branch: string): void {
   if (!SAFE_BRANCH_RE.test(branch)) {
@@ -116,10 +164,12 @@ function assertSafeBranch(branch: string): void {
   }
 }
 
+/** A GitHub slug, or (ORG-1d) a git URL from a catalog `remote:`. */
 function assertSafeSlug(ghSlug: string): void {
+  if (isGitRemote(ghSlug) && isSafeRemote(ghSlug)) return;
   if (!SAFE_SLUG_RE.test(ghSlug)) {
     throw new Error(
-      `Invalid GitHub slug "${ghSlug}" — expected "owner/repo" using only letters, digits, ".", "_" and "-"`,
+      `Invalid GitHub slug "${redactRemote(ghSlug)}" — expected "owner/repo" using only letters, digits, ".", "_" and "-"`,
     );
   }
 }
@@ -427,17 +477,15 @@ export function ensureManagedServiceClone(
   if (!fs.existsSync(cloneDir)) {
     assertSafeCloneDestination(cloneDir, repoName);
     console.log(
-      `  ⬇ Cloning ${ghSlug}@${branch} → ${product().servicesDir}/${repoName}/${branch}/`,
+      `  ⬇ Cloning ${shown(ghSlug)}@${branch} → ${product().servicesDir}/${repoName}/${branch}/`,
     );
     fs.mkdirSync(path.join(DEN_SERVICES_DIR, repoName), {
       recursive: true,
     });
-    git(
-      `clone --filter=blob:none --branch "${branch}" "${ghCloneUrl(ghSlug)}" "${cloneDir}"`,
-    );
+    gitClone(`--filter=blob:none --branch "${branch}" `, ghSlug, cloneDir);
     if (runSetup) runSetupIfDefined(cloneDir);
   } else {
-    git("pull --ff-only", cloneDir);
+    git("pull --ff-only", cloneDir, usesGhCredential(cloneDir));
   }
 
   return cloneDir;
@@ -463,12 +511,10 @@ export function ensureManagedServiceCloneNewBranch(
   if (!fs.existsSync(cloneDir)) {
     assertSafeCloneDestination(cloneDir, repoName);
     console.log(
-      `  ⬇ Cloning ${ghSlug}@${baseBranch} → ${product().servicesDir}/${repoName}/${newBranch}/ (new branch: ${newBranch})`,
+      `  ⬇ Cloning ${shown(ghSlug)}@${baseBranch} → ${product().servicesDir}/${repoName}/${newBranch}/ (new branch: ${newBranch})`,
     );
     fs.mkdirSync(path.dirname(cloneDir), { recursive: true });
-    git(
-      `clone --filter=blob:none --branch "${baseBranch}" "${ghCloneUrl(ghSlug)}" "${cloneDir}"`,
-    );
+    gitClone(`--filter=blob:none --branch "${baseBranch}" `, ghSlug, cloneDir);
     git(`checkout -b "${newBranch}"`, cloneDir);
     runSetupIfDefined(cloneDir);
   }
@@ -496,15 +542,13 @@ export function ensureDevManagedClone(
   if (!fs.existsSync(targetDir)) {
     const leafName = path.basename(targetDir);
     assertSafeCloneDestination(targetDir, leafName);
-    console.log(`  ⬇ Cloning ${ghSlug}@${branch} → ${targetDir}/`);
+    console.log(`  ⬇ Cloning ${shown(ghSlug)}@${branch} → ${targetDir}/`);
     fs.mkdirSync(path.dirname(targetDir), { recursive: true });
     try {
-      git(
-        `clone --filter=blob:none --branch "${branch}" "${ghCloneUrl(ghSlug)}" "${targetDir}"`,
-      );
+      gitClone(`--filter=blob:none --branch "${branch}" `, ghSlug, targetDir);
     } catch {
       // Branch may not exist — clone default branch and checkout/create the branch
-      git(`clone --filter=blob:none "${ghCloneUrl(ghSlug)}" "${targetDir}"`);
+      gitClone(`--filter=blob:none `, ghSlug, targetDir);
       try {
         git(`checkout "${branch}"`, targetDir);
       } catch {
@@ -538,17 +582,15 @@ export function ensureWorkspaceClone(
   if (!fs.existsSync(cloneDir)) {
     assertSafeCloneDestination(cloneDir, repoName);
     console.log(
-      `  ⬇ Cloning ${ghSlug}@${branch} → ${product().workspacesDir}/${workspaceName}/${repoName}/`,
+      `  ⬇ Cloning ${shown(ghSlug)}@${branch} → ${product().workspacesDir}/${workspaceName}/${repoName}/`,
     );
     fs.mkdirSync(wsDir, { recursive: true });
 
     try {
-      git(
-        `clone --filter=blob:none --branch "${branch}" "${ghCloneUrl(ghSlug)}" "${cloneDir}"`,
-      );
+      gitClone(`--filter=blob:none --branch "${branch}" `, ghSlug, cloneDir);
     } catch {
       // Branch doesn't exist yet — clone main and create the branch
-      git(`clone --filter=blob:none "${ghCloneUrl(ghSlug)}" "${cloneDir}"`);
+      gitClone(`--filter=blob:none `, ghSlug, cloneDir);
       git(`checkout -b "${branch}"`, cloneDir);
       console.log(`  ✓ Created new branch ${branch} in ${repoName}`);
     }
@@ -660,7 +702,7 @@ export function pullRepo(repoPath: string): void {
   } catch {
     /* best-effort — a genuinely diverged clone still errors on the pull */
   }
-  git("pull --ff-only", repoPath);
+  git("pull --ff-only", repoPath, usesGhCredential(repoPath));
 }
 
 /**
@@ -682,7 +724,7 @@ export function fetchAndFastForward(repoPath: string): {
   pulled: boolean;
   error?: string;
 } {
-  const GH_CRED = `-c credential.helper="!gh auth git-credential"`;
+  const GH_CRED = usesGhCredential(repoPath) ? GH_CREDENTIAL : "";
   try {
     execSync(`git ${GH_CRED} fetch --quiet`, {
       cwd: repoPath,

package/src/shared/environment-manager/workspace-org.ts

@@ -1,8 +1,9 @@
 /**
  * Which work org a workspace belongs to (ORG-1a, ORG-SPEC §2).
  *
- * An org is a key of `orgs:` or a GitHub owner. ORG-1a keeps today's model:
- * an org with no `sources` is the GitHub owner of the same name, and
+ * An org is a key of `orgs:` or a GitHub owner. An org with no `sources`
+ * and no `repos` is the GitHub owner of the same name (ORG-1a); ORG-1d's
+ * keys make it any name (org-sources.ts), and a repo's org is orgOf's.
  * `github_org` is the default org. A workspace's org resolves through this
  * chain, first match wins:
  *
@@ -25,6 +26,7 @@ import {
 import { readCatalog } from "./catalog.js";
 import { parseAddress, readWorkspacesFile } from "./workspaces.js";
 import { orgOf } from "../manifest/service-links.js";
+import { githubOwnersOf, orgClaimingOwner } from "../org-sources.js";
 import { cachedRead } from "../read-cache.js";
 import type {
   ServiceCatalog,
@@ -71,12 +73,16 @@ export function readOrgContext(): OrgContext {
   };
 }
 
-/** `id` spelled as its `orgs:` key when one matches case-insensitively. */
+/**
+ * `id` spelled as its `orgs:` key when one matches case-insensitively; a
+ * GitHub owner an ORG-1d source claims (`github_org: acme` with a source
+ * for acme) is that source's org.
+ */
 export function canonicalOrg(id: string, config: DenConfig): string {
   const key = Object.keys(config.orgs ?? {}).find(
     (k) => lower(k) === lower(id),
   );
-  return key ?? id;
+  return key ?? orgClaimingOwner(id, config.orgs) ?? id;
 }
 
 /** The default org: `github_org`, or null when unset. */
@@ -104,7 +110,7 @@ function workspaceRepos(
 function knownOrgs(ctx: OrgContext): Set<string> {
   const ids = new Set(Object.keys(ctx.config.orgs ?? {}).map(lower));
   for (const repo of Object.keys(ctx.catalog)) {
-    const o = orgOf(repo, ctx.catalog);
+    const o = orgOf(repo, ctx.catalog, ctx.config.orgs);
     if (o) ids.add(lower(o));
   }
   const d = ctx.config.github_org?.trim();
@@ -133,7 +139,7 @@ export function resolveWorkspaceOrg(
   const repos = workspaceRepos(ws, bp, ctx.catalog);
   const owners = new Map<string, string>(); // lowercased → first spelling
   for (const repo of repos) {
-    const o = orgOf(repo, ctx.catalog);
+    const o = orgOf(repo, ctx.catalog, ctx.config.orgs);
     if (o && !owners.has(lower(o))) owners.set(lower(o), o);
   }
 
@@ -179,7 +185,7 @@ export function resolveWorkspaceOrg(
     (owners.size <= 1 || source === "workspace" || source === "blueprint")
   )
     for (const repo of repos) {
-      const o = orgOf(repo, ctx.catalog);
+      const o = orgOf(repo, ctx.catalog, ctx.config.orgs);
       if (o && lower(o) !== lower(org))
         warnings.push(
           `workspace ${name}: repo ${repo} belongs to ${o}, not the workspace's org ${org}`,
@@ -209,16 +215,25 @@ export function resolveAllWorkspaceOrgs(ctx?: OrgContext): WorkspaceOrg[] {
 
 /**
  * The GitHub owner to clone and register a workspace's repos under: its
- * resolved org. With none at all (no org anywhere and no `github_org`) this
- * throws exactly as requireGithubOrg does, so an old config fails as before.
+ * resolved org, which for a legacy org is that GitHub owner. An org with
+ * ORG-1d `sources` gives its first GitHub source's owner, and one with no
+ * GitHub source throws (its repos clone from `remote:`; discovery is off).
+ * With no org at all (no org anywhere and no `github_org`) this throws
+ * exactly as requireGithubOrg does, so an old config fails as before.
  */
 export function githubOrgFor(workspace: string, ctx?: OrgContext): string {
   const hit = ctx
     ? resolveWorkspaceOrg(workspace, ctx)
     : (resolveAllWorkspaceOrgs().find((w) => w.workspace === workspace) ??
       resolveWorkspaceOrg(workspace, readOrgContext()));
-  if (hit.org) return hit.org;
-  return requireGithubOrg(ctx?.config);
+  if (!hit.org) return requireGithubOrg(ctx?.config);
+  const orgs = (ctx?.config ?? readDenConfig()).orgs;
+  const owner = githubOwnersOf(hit.org, orgs)[0];
+  if (owner) return owner;
+  throw new Error(
+    `org ${hit.org} has no GitHub source (orgs.${hit.org}.sources): ` +
+      `give workspace ${workspace}'s repos a remote: in the service catalog`,
+  );
 }
 
 export interface OrgEntry {

package/src/shared/manifest/service-links.ts

@@ -12,6 +12,7 @@ import type {
   ServiceCatalog,
   ServiceManagementConfig,
 } from "../types/index.js";
+import { orgOfRepo, type WorkOrgsConfig } from "../org-sources.js";
 
 export interface OpenLink {
   label: string;
@@ -63,11 +64,18 @@ export function linksFor(
   return out;
 }
 
-/** The GitHub owner a repo is catalogued under ("acme"), or "". */
-export function orgOf(repo: string, catalog: ServiceCatalog): string {
-  const gh = catalog[repo]?.gh ?? "";
-  const slash = gh.indexOf("/");
-  return slash > 0 ? gh.slice(0, slash) : "";
+/**
+ * The org a repo belongs to (ORG-1d): an org whose `repos` lists it, then an
+ * org with a source that claims its owner, then (legacy) its bare GitHub
+ * owner from `gh` ("acme"), else "". Without `orgs` (or with no ORG-1d keys
+ * in it) this is the repo's GitHub owner, as before.
+ */
+export function orgOf(
+  repo: string,
+  catalog: ServiceCatalog,
+  orgs: WorkOrgsConfig = {},
+): string {
+  return orgOfRepo(repo, catalog, orgs);
 }
 
 export interface OrgDisplay {
@@ -75,14 +83,18 @@ export interface OrgDisplay {
   color?: string;
 }
 
-/** Every org in the catalog with its display name, configured ones first. */
+/**
+ * Every org with its display name, configured ones first, then each
+ * catalogued repo's org. An owner a source claims is not an org of its own,
+ * so it is not listed.
+ */
 export function listOrgs(
   catalog: ServiceCatalog,
-  configured: Record<string, OrgDisplay> = {},
+  configured: WorkOrgsConfig = {},
 ): Array<{ id: string; label: string; color?: string }> {
   const ids = new Set<string>(Object.keys(configured));
   for (const repo of Object.keys(catalog)) {
-    const o = orgOf(repo, catalog);
+    const o = orgOf(repo, catalog, configured);
     if (o) ids.add(o);
   }
   return [...ids].map((id) => ({

package/src/shared/org-sources.ts

@@ -0,0 +1,309 @@
+/**
+ * Orgs are Den's own concept; sources are bindings (ORG-1d, ORG-SPEC §1).
+ *
+ * An org is a key of `orgs:`. It may name the git hosts its repos live on
+ * (`sources: [{host: github, owner: acme}, {host: gitlab, group: globex}]`)
+ * and list repos outright (`repos: [widget]`). A repo's org resolves:
+ *
+ *   1. an org whose `repos` lists it
+ *   2. an org with a source that claims the repo's owner
+ *   3. (legacy) the repo's bare GitHub owner, from `gh: owner/repo`
+ *
+ * An org that sets neither `sources` nor `repos` is a legacy org: the GitHub
+ * owner of its own name (ORG-1a). So a config with no new keys resolves
+ * exactly as before, and only the new keys can raise an error (C1).
+ *
+ * A source claims an owner; it never brings credentials of its own here.
+ * GitHub sources clone through the user's gh, a repo with no source clones
+ * from its catalog `remote:` through plain git (SEC-0).
+ */
+import { ConfigError } from "./config-error.js";
+import type { ServiceCatalog, ServiceCatalogEntry } from "./types/index.js";
+
+/** `orgs.<id>.sources[i]`: a git host and the owner (or group) it claims. */
+export interface OrgSourceConfig {
+  /** `github` (built in), or a git-host id such as `gitlab` (ORG-1e). */
+  host: string;
+  owner?: string;
+  group?: string;
+}
+
+/** One `orgs.<id>` entry. */
+export interface WorkOrgConfig {
+  label?: string;
+  color?: string;
+  /** ORG-1d: the git hosts and owners this org's repos come from. */
+  sources?: OrgSourceConfig[];
+  /** ORG-1d: repos that belong to this org whatever their owner. */
+  repos?: string[];
+}
+
+export type WorkOrgsConfig = Record<string, WorkOrgConfig>;
+
+/** Where a repo lives: a host id (`github`, else the remote's hostname) and owner path. */
+export interface RepoOwner {
+  host: string;
+  hostname: string;
+  owner: string;
+}
+
+const lower = (s: string): string => s.toLowerCase();
+const HOST_RE = /^[a-z][a-z0-9-]*$/;
+const GH_OWNER_RE = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
+const GROUP_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*(\/[A-Za-z0-9][A-Za-z0-9._-]*)*$/;
+
+/** True when the entry uses the ORG-1d keys (its sources are then exactly `sources`). */
+export function isSourcedOrg(entry: WorkOrgConfig | undefined): boolean {
+  return (
+    !!entry &&
+    typeof entry === "object" &&
+    ("sources" in entry || "repos" in entry)
+  );
+}
+
+const sourceOwner = (s: OrgSourceConfig): string =>
+  (s.owner ?? s.group ?? "").trim();
+
+/**
+ * Check the ORG-1d keys of `orgs:` and throw on the first problem, naming the
+ * key. Entries without them are not looked at (C1). A repo listed by two
+ * orgs, or an owner claimed by two orgs' sources (or by a source and a
+ * legacy org of that name), names both.
+ */
+export function validateOrgSources(orgs: unknown, file: string): void {
+  if (!orgs || typeof orgs !== "object" || Array.isArray(orgs)) return;
+  const entries = Object.entries(orgs as Record<string, unknown>);
+  const repoAt = new Map<string, string>();
+  const ownerAt = new Map<string, string>();
+  for (const [id, raw] of entries) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
+    const e = raw as Record<string, unknown>;
+    const at = `orgs.${id}`;
+    if ("sources" in e) {
+      if (!Array.isArray(e.sources))
+        throw new ConfigError(
+          `${file}: ${at}.sources must be a list of { host, owner } or { host, group }`,
+        );
+      e.sources.forEach((s: unknown, i: number) => {
+        const k = `${at}.sources[${i}]`;
+        if (!s || typeof s !== "object" || Array.isArray(s))
+          throw new ConfigError(
+            `${file}: ${k} must be a map: { host: github, owner: <owner> }`,
+          );
+        const src = s as Record<string, unknown>;
+        for (const key of Object.keys(src))
+          if (!["host", "owner", "group"].includes(key))
+            throw new ConfigError(
+              `${file}: ${k}: unknown key "${key}" (known: host, owner, group)`,
+            );
+        if (typeof src.host !== "string" || !HOST_RE.test(src.host))
+          throw new ConfigError(
+            `${file}: ${k}.host must be a git host id such as github or gitlab`,
+          );
+        const hasOwner = src.owner !== undefined;
+        const hasGroup = src.group !== undefined;
+        if (hasOwner === hasGroup)
+          throw new ConfigError(
+            `${file}: ${k} needs exactly one of owner or group`,
+          );
+        const key = hasOwner ? "owner" : "group";
+        const v = src[key];
+        const ok =
+          typeof v === "string" &&
+          (src.host === "github" ? GH_OWNER_RE : GROUP_RE).test(v.trim());
+        if (!ok)
+          throw new ConfigError(
+            src.host === "github"
+              ? `${file}: ${k}.${key} must be a GitHub owner name (letters, digits and hyphens)`
+              : `${file}: ${k}.${key} must be an owner or group path`,
+          );
+        const claim = `${src.host}:${lower((v as string).trim())}`;
+        const prior = ownerAt.get(claim);
+        if (prior && !prior.startsWith(`${at}.`))
+          throw new ConfigError(
+            `${file}: ${src.host} owner ${(v as string).trim()} is claimed by both ${prior} and ${k}`,
+          );
+        if (!prior) ownerAt.set(claim, k);
+      });
+    }
+    if ("repos" in e) {
+      if (
+        !Array.isArray(e.repos) ||
+        e.repos.some((r) => typeof r !== "string" || !r.trim())
+      )
+        throw new ConfigError(
+          `${file}: ${at}.repos must be a list of repo names`,
+        );
+      for (const r of e.repos as string[]) {
+        const prior = repoAt.get(r.trim());
+        if (prior && prior !== `${at}.repos`)
+          throw new ConfigError(
+            `${file}: repo ${r.trim()} is claimed by both ${prior} and ${at}.repos`,
+          );
+        repoAt.set(r.trim(), `${at}.repos`);
+      }
+    }
+  }
+  // A legacy org is the GitHub owner of its own name: a source elsewhere that
+  // claims that owner would split it silently.
+  for (const [id, raw] of entries) {
+    if (isSourcedOrg(raw as WorkOrgConfig)) continue;
+    const prior = ownerAt.get(`github:${lower(id)}`);
+    if (prior)
+      throw new ConfigError(
+        `${file}: github owner ${id} is claimed by both ${prior} and orgs.${id} ` +
+          `(an org with no sources: is the GitHub owner of its own name)`,
+      );
+  }
+}
+
+/** `gh: owner/repo`'s owner, as spelled, or "" (the legacy orgOf). */
+export function ghOwnerOf(entry: ServiceCatalogEntry | undefined): string {
+  const gh = entry?.gh ?? "";
+  const slash = gh.indexOf("/");
+  return slash > 0 ? gh.slice(0, slash) : "";
+}
+
+/** Host, hostname and owner path of a git URL; null for a local path or an unparsable one. */
+export function parseRemote(remote: string): RepoOwner | null {
+  const r = remote.trim();
+  let hostname = "";
+  let p = "";
+  const scp = /^[A-Za-z0-9._-]+@([A-Za-z0-9.-]+):(.+)$/.exec(r);
+  if (scp) {
+    hostname = scp[1];
+    p = scp[2];
+  } else {
+    try {
+      const u = new URL(r);
+      if (u.protocol === "file:") return null;
+      hostname = u.hostname;
+      p = u.pathname;
+    } catch {
+      return null;
+    }
+  }
+  const parts = p
+    .replace(/\.git$/, "")
+    .split("/")
+    .filter(Boolean);
+  if (!hostname || parts.length < 2) return null;
+  const host = lower(hostname) === "github.com" ? "github" : lower(hostname);
+  return {
+    host,
+    hostname: lower(hostname),
+    owner: parts.slice(0, -1).join("/"),
+  };
+}
+
+/** Where a catalogued repo lives: `gh` first (GitHub shorthand), else its `remote`. */
+export function repoOwnerOf(
+  entry: ServiceCatalogEntry | undefined,
+): RepoOwner | null {
+  const gh = ghOwnerOf(entry);
+  if (gh) return { host: "github", hostname: "github.com", owner: gh };
+  return entry?.remote ? parseRemote(entry.remote) : null;
+}
+
+/**
+ * Whether `src` claims `owner`. A GitHub source claims a github.com owner;
+ * another host's source claims the owner (or a subgroup of it) on a remote
+ * whose hostname is `<host>.com` or starts with `<host>.`.
+ */
+export function sourceClaims(src: OrgSourceConfig, owner: RepoOwner): boolean {
+  const want = lower(sourceOwner(src));
+  if (!want) return false;
+  const have = lower(owner.owner);
+  if (src.host === "github") return owner.host === "github" && have === want;
+  const onHost =
+    owner.hostname === `${src.host}.com` ||
+    owner.hostname.startsWith(`${src.host}.`);
+  return onHost && (have === want || have.startsWith(`${want}/`));
+}
+
+/** The org that lists `repo` in its `repos`, and the org whose source claims its owner. */
+function claimsOf(
+  repo: string,
+  catalog: ServiceCatalog,
+  orgs: WorkOrgsConfig,
+): { listed?: string; claimed?: { org: string; source: OrgSourceConfig } } {
+  const out: ReturnType<typeof claimsOf> = {};
+  const owner = repoOwnerOf(catalog[repo]);
+  for (const [id, e] of Object.entries(orgs)) {
+    if (!isSourcedOrg(e)) continue;
+    if (!out.listed && Array.isArray(e.repos) && e.repos.includes(repo))
+      out.listed = id;
+    if (!out.claimed && owner && Array.isArray(e.sources)) {
+      const src = e.sources.find((s) => sourceClaims(s, owner));
+      if (src) out.claimed = { org: id, source: src };
+    }
+  }
+  return out;
+}
+
+/** The org `repo` belongs to (see the module comment), or "" when none. */
+export function orgOfRepo(
+  repo: string,
+  catalog: ServiceCatalog,
+  orgs: WorkOrgsConfig = {},
+): string {
+  const { listed, claimed } = claimsOf(repo, catalog, orgs);
+  if (listed) return listed;
+  if (claimed) return claimed.org;
+  const gh = ghOwnerOf(catalog[repo]);
+  if (gh) return gh;
+  const remote = repoOwnerOf(catalog[repo]);
+  return remote?.host === "github" ? remote.owner : "";
+}
+
+/**
+ * The source `repo` clones through: one of its own org's sources that claims
+ * its owner. Null when it has none: a legacy repo (GitHub by its `gh`), or a
+ * repo of an org with no matching source (it clones from `remote:`).
+ */
+export function repoSource(
+  repo: string,
+  catalog: ServiceCatalog,
+  orgs: WorkOrgsConfig = {},
+): OrgSourceConfig | null {
+  const { listed, claimed } = claimsOf(repo, catalog, orgs);
+  if (listed) {
+    const owner = repoOwnerOf(catalog[repo]);
+    const srcs = orgs[listed]?.sources ?? [];
+    return (owner && srcs.find((s) => sourceClaims(s, owner))) || null;
+  }
+  return claimed?.source ?? null;
+}
+
+/** The org's GitHub owners: its own name for a legacy org, else its GitHub sources'. */
+export function githubOwnersOf(
+  org: string,
+  orgs: WorkOrgsConfig = {},
+): string[] {
+  const key = Object.keys(orgs).find((k) => lower(k) === lower(org));
+  const e = key === undefined ? undefined : orgs[key];
+  if (!isSourcedOrg(e)) return [org];
+  return (e?.sources ?? [])
+    .filter((s) => s.host === "github")
+    .map(sourceOwner)
+    .filter(Boolean);
+}
+
+/** True when the org reaches GitHub (discovery, branches, releases work for it). */
+export function orgHasGithub(org: string, orgs: WorkOrgsConfig = {}): boolean {
+  return githubOwnersOf(org, orgs).length > 0;
+}
+
+/** The ORG-1d org whose GitHub source claims GitHub owner `owner`, if any. */
+export function orgClaimingOwner(
+  owner: string,
+  orgs: WorkOrgsConfig = {},
+): string | undefined {
+  const o: RepoOwner = { host: "github", hostname: "github.com", owner };
+  return Object.entries(orgs).find(
+    ([, e]) =>
+      isSourcedOrg(e) &&
+      Array.isArray(e.sources) &&
+      e.sources.some((s) => sourceClaims(s, o)),
+  )?.[0];
+}

package/src/shared/types/index.ts

@@ -622,8 +622,18 @@ export interface DiscoveredRepo {
 // ── Service catalog & workspace types ────────────────────────────────────────
 
 export interface ServiceCatalogEntry {
-  /** Full GitHub slug: "Globex-Corp/repo-name" — used when cloning managed repos */
-  gh: string;
+  /**
+   * Full GitHub slug: "Globex-Corp/repo-name" — used when cloning managed
+   * repos. GitHub shorthand: a repo on another host (or none) sets `remote`.
+   */
+  gh?: string;
+  /**
+   * The repo's git URL, for any host (ORG-1d): `https://…`, `ssh://…`,
+   * `git@host:owner/repo.git`, `file://…` or an absolute path. A repo whose
+   * org has no source that claims it clones and pulls from here through
+   * plain git and the user's own credential helper.
+   */
+  remote?: string;
 }
 
 /** Keyed by GH repo name (e.g. "shop", "tasks-runner") */