15a970d1

Serve nested repositories over HTTP

a73x 2026-08-11 16:06

Commit message

Serve nested repositories over HTTP

Governance hands an agent a wild repo at `agents/<name>` and it works over
SSH, but `repos::discover` read exactly one level of `repos_dir`, so the
repository existed, accepted pushes, and appeared nowhere: not in the
listing, not at any URL, and — the part that matters more than the UI —
with no way for an HTTP clone to fetch its `refs/collab/*`.

Discovery now recurses, and a repository is named by its full path under
`repos_dir` rather than by its last component.

The naming rule is the one governance already writes its rules against:
the path relative to `repos_dir`, `/`-separated, with a trailing `.git`
stripped from the last segment — unless a sibling with the stripped name
is itself a repository, in which case the suffix stays. That is what
finally separates `tools.git` from `tools`; stripping both collapsed them
onto one name and left whichever `discover` reached second unreachable.

The walk stops at each repository rather than descending into its object
store, skips anything dot-prefixed (which is what keeps `.server/` out),
and is bounded at eight segments — it is reached from an anonymous page,
and without a bound whatever an operator leaves under `repos_dir` sets
the cost of rendering the repository list.

`resolve` no longer scans. A name determines a path, so it probes: the
name is validated first and the walk down refuses to pass through a
symlink, so a name cannot address anything outside `repos_dir`. That
removes the full-scan-per-request this carried, and with it the reason to
consider a cache — which is just as well, because a wild repo is created
by a push over SSH and has to be visible on the very next HTTP request.
Nothing here is cached, and a test holds that line.

Routing disambiguates by taking the longest leading run of segments that
names a repository as the repository and the rest as the sub-route,
folding the name into one percent-encoded segment ahead of the router so
every existing route and template goes on working unchanged.

Fixes d0d1bf5c.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/server/http/git_http.rs

Old		New
@@ -33,7 +33,7 @@ pub async fn info_refs(
33		33
34	let repo_name = repo_dot_git.strip_suffix(".git").unwrap_or(&repo_dot_git);	34	let repo_name = repo_dot_git.strip_suffix(".git").unwrap_or(&repo_dot_git);
35		35
36	let entry = match crate::repos::resolve(&state.repos_dir, repo_name) {	36	let entry = match crate::repos::resolve_clone_target(&state.repos_dir, &repo_dot_git) {
37	Some(e) => e,	37	Some(e) => e,
38	None => {	38	None => {
39	return (	39	return (
@@ -117,7 +117,7 @@ pub async fn upload_pack(
117	) -> Response {	117	) -> Response {
118	let repo_name = repo_dot_git.strip_suffix(".git").unwrap_or(&repo_dot_git);	118	let repo_name = repo_dot_git.strip_suffix(".git").unwrap_or(&repo_dot_git);
119		119
120	let entry = match crate::repos::resolve(&state.repos_dir, repo_name) {	120	let entry = match crate::repos::resolve_clone_target(&state.repos_dir, &repo_dot_git) {
121	Some(e) => e,	121	Some(e) => e,
122	None => {	122	None => {
123	return (	123	return (

src/server/http/mod.rs

@@ @@ -2,12 +2,13 @@ pub mod git_http; @@
+pub mod repo;
+pub mod repo_list;
+use axum::extract::{DefaultBodyLimit, Request, State};
+use axum::http::uri::{PathAndQuery, Uri};
+use axum::http::{HeaderName, HeaderValue};
+use axum::middleware::{self, Next};
+use axum::response::Response;
+use axum::Router;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+#[derive(Debug, Clone)]
@@ @@ -18,7 +19,7 @@ pub struct AppState { @@
+pub fn router(state: AppState) -> Router {
+    let shared = Arc::new(state);
+    let routes = Router::new()
+        .route("/", axum::routing::get(repo_list::handler))
+        .route("/{repo_name}", axum::routing::get(repo::overview))
+        .route("/{repo_name}/commits", axum::routing::get(repo::commits))
@@ @@ -55,7 +56,111 @@ pub fn router(state: AppState) -> Router { @@
+                .layer(DefaultBodyLimit::max(git_http::UPLOAD_PACK_BODY_LIMIT)),
+        .layer(middleware::from_fn(add_nosniff))
+        .with_state(shared.clone());
+    // Wrapped around the whole router rather than layered into it:
+    // `Router::layer` runs *after* routing, and a repository name has to be
+    // folded into one segment before the router tries to match it.
+    Router::new()
+        .fallback_service(routes)
+        .layer(middleware::from_fn_with_state(shared, fold_repo_name))
+}
+/// Fold a multi-segment repository name into one path segment, so that every
+/// route below can go on matching `/{repo_name}/...`.
+///
+/// A repository name may contain `/` (`agents/claude-a`) and so may the path
+/// hanging off it (`/agents/claude-a/tree/src/main.rs`). Where one ends and
+/// the other begins is not decidable from the URL, so it is decided against
+/// what is on disk: **the longest leading run of segments that names a
+/// repository is the repository, and the rest is the sub-route.**
+///
+/// Longest wins because the repository is the concrete fact — a directory
+/// that exists — while the sub-route vocabulary (`issues`, `tree`, `diff`) is
+/// ours to define. Preferring it means every repository on disk is reachable
+/// at its own address, which is exactly the property that was missing. The
+/// price is that a repository named `agents/issues` would shadow the issue
+/// list of a repository named `agents`; that is a collision an operator
+/// chose, and the alternative — preferring the shorter name — leaves the
+/// nested repository with no address at all, which is the bug, not the fix.
+///
+/// The fold re-emits the name with its separators percent-encoded. The router
+/// matches on the raw path, where `%2F` is not a separator, and the `Path`
+/// extractor decodes it again, so handlers see `agents/claude-a` and no route
+/// or template had to learn about nesting.
+async fn fold_repo_name(
+    State(state): State<Arc<AppState>>,
+    mut request: Request,
+    next: Next,
+) -> Response {
+    if let Some(uri) = folded_uri(&state.repos_dir, request.uri()) {
+        *request.uri_mut() = uri;
+    }
+    next.run(request).await
+}
+fn folded_uri(repos_dir: &Path, uri: &Uri) -> Option<Uri> {
+    let path = uri.path().strip_prefix('/')?;
+    let raw: Vec<&str> = path.split('/').collect();
+    // A single segment already routes, and an empty segment anywhere means
+    // this is not a path we have anything to say about.
+    if raw.len() < 2 || raw.iter().any(|segment| segment.is_empty()) {
+        return None;
+    }
+    let decoded: Vec<String> = raw.iter().map(|segment| percent_decode(segment)).collect();
+    let longest = raw.len().min(crate::repos::MAX_DEPTH);
+    for take in (2..=longest).rev() {
+        let candidate = decoded[..take].join("/");
+        if crate::repos::resolve_clone_target(repos_dir, &candidate).is_none() {
+            continue;
+        }
+        let mut folded = String::from("/");
+        folded.push_str(&raw[..take].join("%2F"));
+        for segment in &raw[take..] {
+            folded.push('/');
+            folded.push_str(segment);
+        }
+        if let Some(query) = uri.query() {
+            folded.push('?');
+            folded.push_str(query);
+        }
+        let mut parts = uri.clone().into_parts();
+        parts.path_and_query = Some(folded.parse::<PathAndQuery>().ok()?);
+        return Uri::from_parts(parts).ok();
+    }
+    None
+}
+/// Decode one percent-encoded path segment. Invalid escapes and bytes that do
+/// not form UTF-8 are left as they are: the result is only ever compared
+/// against a repository name, and something undecodable is simply not one.
+fn percent_decode(segment: &str) -> String {
+    if !segment.contains('%') {
+        return segment.to_string();
+    }
+    let bytes = segment.as_bytes();
+    let mut out = Vec::with_capacity(bytes.len());
+    let mut index = 0;
+    while index < bytes.len() {
+        if bytes[index] == b'%' && index + 2 < bytes.len() {
+            let hex = std::str::from_utf8(&bytes[index + 1..index + 3]).ok();
+            if let Some(byte) = hex.and_then(|h| u8::from_str_radix(h, 16).ok()) {
+                out.push(byte);
+                index += 3;
+                continue;
+            }
+        }
+        out.push(bytes[index]);
+        index += 1;
+    }
+    String::from_utf8(out).unwrap_or_else(|_| segment.to_string())
+/// `X-Content-Type-Options: nosniff` on every response. This is additive —
+    );
+    response
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::process::Command;
+    use tempfile::TempDir;
+    fn init_bare(repos_dir: &Path, relative: &str) {
+        let path = repos_dir.join(relative);
+        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+        Command::new("git")
+            .args(["init", "--bare", path.to_str().unwrap()])
+            .output()
+            .expect("git init --bare failed");
+    }
+    fn fold(repos_dir: &Path, path: &str) -> Option<String> {
+        let uri: Uri = path.parse().unwrap();
+        folded_uri(repos_dir, &uri).map(|uri| uri.to_string())
+    }
+    #[test]
+    fn a_single_segment_path_is_left_alone() {
+        let tmp = TempDir::new().unwrap();
+        init_bare(tmp.path(), "alpha.git");
+        assert_eq!(fold(tmp.path(), "/alpha"), None);
+        assert_eq!(fold(tmp.path(), "/"), None);
+    }
+    #[test]
+    fn a_nested_name_is_folded_and_its_sub_route_kept() {
+        let tmp = TempDir::new().unwrap();
+        init_bare(tmp.path(), "agents/claude-a.git");
+        assert_eq!(
+            fold(tmp.path(), "/agents/claude-a").as_deref(),
+            Some("/agents%2Fclaude-a")
+        );
+        assert_eq!(
+            fold(tmp.path(), "/agents/claude-a/issues").as_deref(),
+            Some("/agents%2Fclaude-a/issues")
+        );
+        assert_eq!(
+            fold(tmp.path(), "/agents/claude-a/tree/main/src/lib.rs").as_deref(),
+            Some("/agents%2Fclaude-a/tree/main/src/lib.rs")
+        );
+        // The clone-URL spelling folds too, suffix intact for git_http.
+        assert_eq!(
+            fold(
+                tmp.path(),
+                "/agents/claude-a.git/info/refs?service=git-upload-pack"
+            )
+            .as_deref(),
+            Some("/agents%2Fclaude-a.git/info/refs?service=git-upload-pack")
+        );
+    }
+    /// Nothing on disk to fold onto: the path goes through untouched and
+    /// routing 404s it exactly as before.
+    #[test]
+    fn a_path_that_names_no_repository_is_left_alone() {
+        let tmp = TempDir::new().unwrap();
+        init_bare(tmp.path(), "alpha.git");
+        assert_eq!(fold(tmp.path(), "/agents/claude-a"), None);
+        assert_eq!(fold(tmp.path(), "/alpha/issues"), None);
+        assert_eq!(fold(tmp.path(), "/alpha/tree/src/main.rs"), None);
+    }
+    /// The disambiguation rule, stated as a test: the longest leading run of
+    /// segments that names a repository is the repository.
+    #[test]
+    fn the_longest_repository_prefix_wins() {
+        let tmp = TempDir::new().unwrap();
+        init_bare(tmp.path(), "agents.git");
+        init_bare(tmp.path(), "agents/claude-a.git");
+        // `agents` is a repository and `agents/claude-a` is a longer one.
+        assert_eq!(
+            fold(tmp.path(), "/agents/claude-a/issues").as_deref(),
+            Some("/agents%2Fclaude-a/issues")
+        );
+        // With nothing longer to match, `agents` keeps its own sub-routes.
+        assert_eq!(fold(tmp.path(), "/agents/issues"), None);
+    }
+    #[test]
+    fn a_dot_prefixed_or_traversing_path_folds_onto_nothing() {
+        let tmp = TempDir::new().unwrap();
+        init_bare(tmp.path(), "alpha.git");
+        std::fs::create_dir_all(tmp.path().join(".server")).unwrap();
+        init_bare(tmp.path(), ".server/sneaky.git");
+        assert_eq!(fold(tmp.path(), "/.server/sneaky"), None);
+        assert_eq!(fold(tmp.path(), "/../alpha"), None);
+        assert_eq!(fold(tmp.path(), "/%2E%2E/alpha"), None);
+        assert_eq!(fold(tmp.path(), "/alpha//issues"), None);
+    }
+    #[test]
+    fn percent_escapes_decode_and_bad_ones_survive() {
+        assert_eq!(percent_decode("plain"), "plain");
+        assert_eq!(percent_decode("agents%2Fclaude-a"), "agents/claude-a");
+        assert_eq!(percent_decode("a%2"), "a%2");
+        assert_eq!(percent_decode("a%zz"), "a%zz");
+        // Not valid UTF-8 once decoded: returned unchanged rather than lossy.
+        assert_eq!(percent_decode("a%FFb"), "a%FFb");
+    }
+}

src/server/repos.rs

+/// How deep under `repos_dir` a repository may be nested, in path segments.
+/// `agents/claude-a` is two.
+///
+/// Bounded rather than unlimited, even though gitolite allows arbitrary
+/// nesting, because `discover` walks every directory that is not a repository
+/// and is reached from an anonymous, unauthenticated page. Without a bound,
+/// whatever an operator happens to leave under `repos_dir` sets the cost of
+/// rendering the repository list. Eight is far past any layout anyone has
+/// asked for and keeps the worst case finite. Resolution applies the same
+/// bound, so a repository is never resolvable but unlisted.
+pub const MAX_DEPTH: usize = 8;
+/// Whether this directory is a git repository, by the same test used to build
+/// an entry from it.
+fn is_repo_dir(path: &Path) -> bool {
+    path.join("HEAD").is_file() || path.join(".git").is_dir()
+}
+/// The name a repository at `path` is served under.
+///
+/// The rule: its path relative to `repos_dir`, `/`-separated, with a trailing
+/// `.git` stripped from the last segment — unless a sibling directory with
+/// the stripped name is itself a repository, in which case the suffix stays
+/// and the two remain distinct. `tools.git` and `tools` are two directories
+/// and therefore two repositories; collapsing them onto one name left
+/// whichever `discover` reached second permanently unreachable.
+///
+/// This is the same key governance writes its rules against
+/// (`governance::repo_key`), so a rule and a URL name the same repository.
+fn repo_name_for(repos_dir: &Path, path: &Path) -> Option<String> {
+    let relative = path.strip_prefix(repos_dir).ok()?;
+    let mut segments: Vec<String> = Vec::new();
+    for component in relative.components() {
+        match component {
+            std::path::Component::Normal(segment) => {
+                segments.push(segment.to_str()?.to_string());
+            }
+            // `..`, a root, or a drive prefix: not a name under repos_dir.
+            _ => return None,
+        }
+    }
+    if segments.is_empty() || segments.len() > MAX_DEPTH {
+        return None;
+    }
+    if segments.iter().any(|s| s.starts_with('.')) {
+        return None;
+    }
+    let last = segments.last()?.clone();
+    if let Some(stem) = last.strip_suffix(".git") {
+        if !stem.is_empty() && !stem.starts_with('.') {
+            let mut sibling = path.to_path_buf();
+            sibling.set_file_name(stem);
+            if !is_repo_dir(&sibling) {
+                *segments.last_mut()? = stem.to_string();
+            }
+        }
+    }
+    Some(segments.join("/"))
+}
+/// Split a requested name into path segments, or `None` if it is not a name
+/// this server will serve: empty, too deep, or containing a segment that is
+/// empty, dot-prefixed (`.`, `..`, `.server`), or otherwise not a plain
+/// directory name. This is the gate against traversal — `resolve` builds a
+/// path from the name rather than searching for it.
+fn name_segments(name: &str) -> Option<Vec<&str>> {
+    if name.is_empty() {
+        return None;
+    }
+    let segments: Vec<&str> = name.split('/').collect();
+    if segments.len() > MAX_DEPTH {
+        return None;
+    }
+    if segments
+        .iter()
+        .any(|s| s.is_empty() || s.starts_with('.') || s.contains('\0'))
+    {
+        return None;
+    }
+    Some(segments)
+}
+/// Walk `segments` down from `repos_dir`, refusing to pass *through* a
+/// symbolic link.
+///
+/// The final segment may be a link — a repository symlinked into place is a
+/// legitimate layout, and one that has always been discovered — but an
+/// intermediate link could point anywhere, so neither a URL nor the directory
+/// walk is allowed to follow one. Keeping both to the same rule is what stops
+/// a repository being resolvable but unlisted, or the reverse.
+fn descend(repos_dir: &Path, segments: &[&str]) -> Option<PathBuf> {
+    let mut path = repos_dir.to_path_buf();
+    for (index, segment) in segments.iter().enumerate() {
+        path.push(segment);
+        let is_last = index + 1 == segments.len();
+        if !is_last && std::fs::symlink_metadata(&path).ok()?.is_symlink() {
+            return None;
+        }
+    }
+    Some(path)
+fn load_policy(path: &Path, bare: bool) -> RepoPolicy {
@@ @@ -196,17 +295,17 @@ fn load_policy(path: &Path, bare: bool) -> RepoPolicy { @@
+fn repo_entry_from_path(path: &Path, name: String) -> Option<RepoEntry> {
+    if path.join("HEAD").is_file() {
+        Some(RepoEntry {
+            name,
+            path: path.to_path_buf(),
+            bare: true,
+            policy: load_policy(path, true),
+        })
+    } else if path.join(".git").is_dir() {
+        Some(RepoEntry {
+            name,
+            path: path.to_path_buf(),
+            bare: false,
+            policy: load_policy(path, false),
+/// Build a repo entry directly from an on-disk path under `repos_dir`.
+///
+/// Takes `repos_dir` because the name is a property of where the repository
+/// sits in the tree, not of its own directory name: SSH addresses a
+/// repository by path and HTTP by name, and the two have to be the same
+/// repository or a repository reachable over one is invisible over the other.
+pub fn entry_for_path(repos_dir: &Path, path: &Path) -> Option<RepoEntry> {
+    if !path.is_dir() {
+        return None;
+    let name = repo_name_for(repos_dir, path)?;
+    let mut entry = repo_entry_from_path(path, name)?;
+    apply_governance_default(repos_dir, &mut entry);
+    Some(entry)
+}
+/// Apply the governance repository's closed-by-default posture.
+///
+/// Creating `settings.git` must not silently publish the key roster and the
+/// access rules to the internet. An operator who wants them browsable can say
+/// so in `settings.git/.collab/server.toml`, and then this steps out of the
+/// way. Authenticated access over SSH is unaffected — it never comes through
+/// here — so a contributor can still read the rules it is subject to.
+///
+/// Applied wherever an entry is built, not only in `discover`: the anonymous
+/// HTTP surface reaches a repository by resolving a name, and a default that
+/// only the listing page honoured would not be a default at all.
+fn apply_governance_default(repos_dir: &Path, entry: &mut RepoEntry) {
+    if is_governance_repo(repos_dir, entry)
+        && !repo_server_config_path(&entry.path, entry.bare).exists()
+    {
+        entry.policy = std::mem::take(&mut entry.policy).without_anonymous_access();
+    }
+/// Whether this entry is the repository that governs the server.
+    entry.path == repos_dir.join(format!("{}.git", crate::governance::SETTINGS_REPO))
+/// Scan `repos_dir` for git repositories, recursively.
+///
+/// Nesting is the point: governance hands an agent a wild repo at
+/// `agents/<name>`, and a single `read_dir` never saw past the plain `agents`
+/// directory, so the repository existed, accepted pushes, and appeared
+/// nowhere.
+///
+/// The walk stops at each repository. A bare repo is full of directories and
+/// a non-bare one has a whole working tree; descending into either would be
+/// slow and would invent entries out of object directories. It also skips
+/// anything dot-prefixed, which keeps `.server/` — the SSH host key — out
+/// along with anything else an operator has tucked away.
+///
+/// Results are uncached, deliberately. A wild repo is created by a push over
+/// SSH and has to be visible on the next HTTP request; that is the entire
+/// workflow it exists for. `resolve` no longer comes through here, so the
+/// per-request cost this once carried is gone, and what remains is one walk
+/// per rendering of the repository list.
+pub fn discover(repos_dir: &Path) -> Result<Vec<RepoEntry>, std::io::Error> {
+    let mut entries = Vec::new();
+    // The top level is the caller's business — a missing or unreadable
+    // repos_dir is a real error. Failures further down are not worth
+    // blanking the whole listing for.
+    let read_dir = std::fs::read_dir(repos_dir)?;
+    collect(repos_dir, read_dir, 1, &mut entries);
+    entries.sort_by(|a, b| a.name.cmp(&b.name));
+    Ok(entries)
+}
+fn collect(
+    repos_dir: &Path,
+    read_dir: std::fs::ReadDir,
+    depth: usize,
+    entries: &mut Vec<RepoEntry>,
+) {
+    for entry in read_dir {
+        let entry = match entry {
+            Ok(entry) => entry,
+            Err(error) => {
+                tracing::warn!("skipping unreadable directory entry: {}", error);
+                continue;
+            }
+        };
+        if entry.file_name().to_string_lossy().starts_with('.') {
+            continue;
+        }
+        let path = entry.path();
+        if !path.is_dir() {
+            continue;
+        if let Some(repo) = entry_for_path(repos_dir, &path) {
+            entries.push(repo);
+            continue;
+        // Not a repository, so look inside it — unless it is a symlink, which
+        // could point out of the tree or back into it.
+        let is_symlink = entry.file_type().map(|t| t.is_symlink()).unwrap_or(true);
+        if is_symlink || depth >= MAX_DEPTH {
+            continue;
+        }
+        match std::fs::read_dir(&path) {
+            Ok(read_dir) => collect(repos_dir, read_dir, depth + 1, entries),
+            Err(error) => {
+                tracing::warn!("skipping unreadable directory {:?}: {}", path, error)
+            }
+        }
+    }
+/// Resolve a repo name to its on-disk entry.
+///
+/// A name determines a path, so this probes rather than searches: no
+/// directory scan, no cache to go stale, and a repository created moments ago
+/// over SSH answers on the next request. The name is validated first —
+/// nothing empty, dot-prefixed, or past the depth limit — and the walk down
+/// refuses to pass through a symlink, so a name cannot address anything
+/// outside `repos_dir`.
+///
+/// The entry is only returned if its canonical name is the one asked for.
+/// That is what keeps `tools` and `tools.git` apart: each answers to its own
+/// name and neither answers to the other's.
+pub fn resolve(repos_dir: &Path, name: &str) -> Option<RepoEntry> {
+    let segments = name_segments(name)?;
+    // The canonical bare layout first, then the literal directory.
+    let mut suffixed: Vec<&str> = segments.clone();
+    let with_git = format!("{}.git", segments.last()?);
+    *suffixed.last_mut()? = &with_git;
+    for candidate in [suffixed, segments] {
+        let Some(path) = descend(repos_dir, &candidate) else {
+            continue;
+        };
+        if let Some(entry) = entry_for_path(repos_dir, &path) {
+            if entry.name == name {
+                return Some(entry);
+            }
+        }
+    }
+    None
+}
+/// Resolve the repository a git smart-HTTP URL names.
+///
+/// `foo.git` is the conventional clone-URL spelling of the repository `foo`,
+/// but a directory literally named `foo.git` sitting next to a repository
+/// `foo` is a repository in its own right. The literal name is tried first so
+/// that each of the two is clonable, and the conventional spelling still
+/// works wherever there is nothing to collide with.
+pub fn resolve_clone_target(repos_dir: &Path, requested: &str) -> Option<RepoEntry> {
+    resolve(repos_dir, requested).or_else(|| resolve(repos_dir, requested.strip_suffix(".git")?))
+/// Open a git2::Repository from a RepoEntry.
@@ @@ -351,6 +552,203 @@ mod tests { @@
+        assert_eq!(entry.name, "myrepo");
+    // --- nesting -------------------------------------------------------
+    #[test]
+    fn discover_finds_nested_repos_under_their_full_path() {
+        let tmp = TempDir::new().unwrap();
+        init_bare(tmp.path(), "alpha.git");
+        let agents = tmp.path().join("agents");
+        std::fs::create_dir_all(&agents).unwrap();
+        init_bare(&agents, "claude-a.git");
+        let names: Vec<String> = discover(tmp.path())
+            .unwrap()
+            .into_iter()
+            .map(|r| r.name)
+            .collect();
+        assert_eq!(names, vec!["agents/claude-a", "alpha"]);
+    }
+    #[test]
+    fn resolve_finds_a_nested_repo_by_its_full_path() {
+        let tmp = TempDir::new().unwrap();
+        let agents = tmp.path().join("agents");
+        std::fs::create_dir_all(&agents).unwrap();
+        init_bare(&agents, "claude-a.git");
+        let entry = resolve(tmp.path(), "agents/claude-a").unwrap();
+        assert_eq!(entry.name, "agents/claude-a");
+        assert_eq!(entry.path, agents.join("claude-a.git"));
+        // The last component alone is not a name for it.
+        assert!(resolve(tmp.path(), "claude-a").is_none());
+        // Neither is the plain directory that contains it.
+        assert!(resolve(tmp.path(), "agents").is_none());
+    }
+    /// A repository is a leaf. Descending into one would walk the object
+    /// store, which is both slow and a source of nonsense entries.
+    #[test]
+    fn discover_does_not_descend_into_a_repository() {
+        let tmp = TempDir::new().unwrap();
+        init_bare(tmp.path(), "alpha.git");
+        init_non_bare(tmp.path(), "work");
+        // A bare repo has directories inside it (objects/, refs/), and a
+        // non-bare one has a whole working tree.
+        std::fs::create_dir_all(tmp.path().join("work").join("sub")).unwrap();
+        let names: Vec<String> = discover(tmp.path())
+            .unwrap()
+            .into_iter()
+            .map(|r| r.name)
+            .collect();
+        assert_eq!(names, vec!["alpha", "work"]);
+    }
+    #[test]
+    fn nesting_is_bounded() {
+        let tmp = TempDir::new().unwrap();
+        let mut deep = tmp.path().to_path_buf();
+        for _ in 0..(MAX_DEPTH + 2) {
+            deep = deep.join("d");
+        }
+        std::fs::create_dir_all(&deep).unwrap();
+        init_bare(&deep, "buried.git");
+        assert!(
+            discover(tmp.path()).unwrap().is_empty(),
+            "a repo nested past the depth limit must not be discovered"
+        );
+        let name = format!("{}/buried", ["d"; MAX_DEPTH + 2].join("/"));
+        assert!(
+            resolve(tmp.path(), &name).is_none(),
+            "and must not be resolvable either — discovery and resolution \
+             have to agree about what exists"
+        );
+    }
+    // --- reserved names ------------------------------------------------
+    /// `.server/` holds the SSH host key. Nothing under a dot-prefixed
+    /// directory is a repository.
+    #[test]
+    fn the_server_state_directory_is_never_a_repository() {
+        let tmp = TempDir::new().unwrap();
+        let server_dir = tmp.path().join(".server");
+        std::fs::create_dir_all(&server_dir).unwrap();
+        std::fs::write(server_dir.join("host_key"), "secret").unwrap();
+        // Even if something repo-shaped is planted underneath it.
+        init_bare(&server_dir, "sneaky.git");
+        init_bare(tmp.path(), "real.git");
+        let names: Vec<String> = discover(tmp.path())
+            .unwrap()
+            .into_iter()
+            .map(|r| r.name)
+            .collect();
+        assert_eq!(names, vec!["real"]);
+        assert!(resolve(tmp.path(), ".server").is_none());
+        assert!(resolve(tmp.path(), ".server/sneaky").is_none());
+    }
+    #[test]
+    fn resolve_refuses_to_escape_the_repos_directory() {
+        let tmp = TempDir::new().unwrap();
+        let root = tmp.path().join("repos");
+        std::fs::create_dir_all(&root).unwrap();
+        init_bare(tmp.path(), "outside.git");
+        init_bare(&root, "inside.git");
+        assert!(resolve(&root, "inside").is_some());
+        for name in [
+            "../outside",
+            "a/../../outside",
+            "/outside",
+            "..",
+            "",
+            "a//b",
+            "./inside",
+        ] {
+            assert!(
+                resolve(&root, name).is_none(),
+                "{name:?} must not resolve to anything"
+            );
+        }
+    }
+    // --- the `.git` suffix collision -----------------------------------
+    /// `tools.git` and `tools` are two directories, so they are two
+    /// repositories. Stripping `.git` from both would collapse them into one
+    /// name and leave whichever lost the race unreachable.
+    #[test]
+    fn tools_and_tools_dot_git_are_distinct_repositories() {
+        let tmp = TempDir::new().unwrap();
+        init_bare(tmp.path(), "tools.git");
+        init_bare(tmp.path(), "tools");
+        let entries = discover(tmp.path()).unwrap();
+        let names: Vec<&str> = entries.iter().map(|r| r.name.as_str()).collect();
+        assert_eq!(names, vec!["tools", "tools.git"]);
+        let plain = resolve(tmp.path(), "tools").unwrap();
+        assert_eq!(plain.path, tmp.path().join("tools"));
+        let suffixed = resolve(tmp.path(), "tools.git").unwrap();
+        assert_eq!(suffixed.path, tmp.path().join("tools.git"));
+    }
+    /// With no collision, the suffix is stripped as before — the ordinary
+    /// case, and the one every existing URL depends on.
+    #[test]
+    fn a_lone_dot_git_directory_is_named_without_the_suffix() {
+        let tmp = TempDir::new().unwrap();
+        init_bare(tmp.path(), "tools.git");
+        let entries = discover(tmp.path()).unwrap();
+        assert_eq!(entries.len(), 1);
+        assert_eq!(entries[0].name, "tools");
+        assert!(resolve(tmp.path(), "tools").is_some());
+        // And the name it does not have.
+        assert!(resolve(tmp.path(), "tools.git").is_none());
+    }
+    /// The clone-URL spelling stays a way in, whichever repository it names.
+    #[test]
+    fn clone_urls_may_spell_the_repository_with_a_dot_git_suffix() {
+        let tmp = TempDir::new().unwrap();
+        init_bare(tmp.path(), "solo.git");
+        let agents = tmp.path().join("agents");
+        std::fs::create_dir_all(&agents).unwrap();
+        init_bare(&agents, "claude-a.git");
+        assert_eq!(
+            resolve_clone_target(tmp.path(), "solo.git").unwrap().name,
+            "solo"
+        );
+        assert_eq!(
+            resolve_clone_target(tmp.path(), "solo").unwrap().name,
+            "solo"
+        );
+        assert_eq!(
+            resolve_clone_target(tmp.path(), "agents/claude-a.git")
+                .unwrap()
+                .name,
+            "agents/claude-a"
+        );
+        // When both exist, the literal directory wins over the stripped one.
+        init_bare(tmp.path(), "tools.git");
+        init_bare(tmp.path(), "tools");
+        assert_eq!(
+            resolve_clone_target(tmp.path(), "tools.git").unwrap().path,
+            tmp.path().join("tools.git")
+        );
+        assert_eq!(
+            resolve_clone_target(tmp.path(), "tools").unwrap().path,
+            tmp.path().join("tools")
+        );
+    }
+    #[test]
+    fn resolve_returns_none_for_unknown() {
+        let tmp = TempDir::new().unwrap();
@@ @@ -388,7 +786,7 @@ mod tests { @@
+    fn missing_policy_defaults_to_public_access() {
+        let tmp = TempDir::new().unwrap();
+        init_bare(tmp.path(), "public.git");
+        let entry = entry_for_path(tmp.path(), &tmp.path().join("public.git")).unwrap();
+        assert_eq!(entry.policy.visibility, RepoVisibility::Public);
+        assert!(entry.policy.allows_anonymous_ui());
+        assert!(entry.policy.allows_anonymous_http());
@@ @@ -407,7 +805,7 @@ mod tests { @@
+            "visibility = \"private\"\ndescription = \"Secret repo\"\n[ui]\nanonymous = false\n[http]\nanonymous_clone = false\n[access]\nread = [\"key:SHA256:reader\"]\nwrite = [\"key:SHA256:writer\"]\n",
+        );
+        let entry = entry_for_path(tmp.path(), &repo_path).unwrap();
+        assert_eq!(entry.policy.visibility, RepoVisibility::Private);
+        assert_eq!(
+            entry.policy.normalized_description().as_deref(),
@@ @@ -432,7 +830,7 @@ mod tests { @@
+            "description = \"Workspace repo\"\n[access]\nwrite = [\"key:SHA256:writer\"]\n",
+        );
+        let entry = entry_for_path(tmp.path(), &repo_path).unwrap();
+        assert_eq!(
+            entry.policy.normalized_description().as_deref(),
+            Some("Workspace repo")
@@ @@ -473,16 +871,38 @@ mod tests { @@
+    /// A repository called `settings` that is not *the* settings repository —
+    /// nested under another directory — is an ordinary repository. Now that
+    /// discovery recurses it is actually reachable, so this matters: a wild
+    /// repo an agent creates at `agents/settings` must not inherit the
+    /// governance repository's closed-by-default posture, and more to the
+    /// point must not be mistaken for the thing that governs the server.
+    #[test]
+    fn only_the_top_level_settings_repo_gets_the_governance_default() {
+        let tmp = TempDir::new().unwrap();
+        init_bare(tmp.path(), "settings.git");
+        let agents = tmp.path().join("agents");
+        std::fs::create_dir_all(&agents).unwrap();
+        init_bare(&agents, "settings.git");
+        let repos = discover(tmp.path()).unwrap();
+        let nested = repos.iter().find(|r| r.name == "agents/settings").unwrap();
+        let governance = repos.iter().find(|r| r.name == "settings").unwrap();
+        assert!(!is_governance_repo(tmp.path(), nested));
+        assert!(is_governance_repo(tmp.path(), governance));
+        assert!(nested.policy.allows_anonymous_ui());
+        assert!(nested.policy.allows_anonymous_http());
+        assert!(!governance.policy.allows_anonymous_ui());
+        // And the same conclusion by the route a request actually takes.
+        assert!(resolve(tmp.path(), "agents/settings")
+            .unwrap()
+            .policy
+            .allows_anonymous_ui());
+        assert!(!resolve(tmp.path(), "settings")
+            .unwrap()
+            .policy
+            .allows_anonymous_ui());
+    #[test]
@@ @@ -492,7 +912,7 @@ mod tests { @@
+        init_bare(tmp.path(), "broken.git");
+        write_policy(&repo_path, true, "visibility = [broken toml");
+        let entry = entry_for_path(tmp.path(), &repo_path).unwrap();
+        assert_eq!(entry.policy.visibility, RepoVisibility::Private);
+        assert!(!entry.policy.allows_anonymous_ui());
+        assert!(!entry.policy.allows_anonymous_http());

src/server/ssh/session.rs

Old		New
@@ -179,7 +179,7 @@ impl SshHandler {
179	const NOT_FOUND: &str = "error: repository not found\n";	179	const NOT_FOUND: &str = "error: repository not found\n";
180		180
181	// Releases never auto-create a repo (unlike git-receive-pack).	181	// Releases never auto-create a repo (unlike git-receive-pack).
182	let entry = match crate::repos::entry_for_path(resolved_path) {	182	let entry = match crate::repos::entry_for_path(&self.config.repos_dir, resolved_path) {
183	Some(entry) => entry,	183	Some(entry) => entry,
184	None => {	184	None => {
185	warn!("Rejected release command: unknown repo {:?}", resolved_path);	185	warn!("Rejected release command: unknown repo {:?}", resolved_path);
@@ -667,7 +667,7 @@ impl Handler for SshHandler {
667	let bare;	667	let bare;
668		668
669	if resolved_path.exists() {	669	if resolved_path.exists() {
670	let entry = match crate::repos::entry_for_path(&resolved_path) {	670	let entry = match crate::repos::entry_for_path(&self.config.repos_dir, &resolved_path) {
671	Some(entry) => entry,	671	Some(entry) => entry,
672	None => {	672	None => {
673	warn!(	673	warn!(

tests/common/mod.rs

Old		New
@@ -1100,6 +1100,12 @@ impl ServerHarness {
1100	std::fs::write(policy_path, content).unwrap();	1100	std::fs::write(policy_path, content).unwrap();
1101	}	1101	}
1102		1102
		1103	/// An absolute `http://` URL for `path` on this server, for handing to a
		1104	/// real git client (`git clone`, `git ls-remote`) rather than to `get`.
		1105	pub fn http_url(&self, path: &str) -> String {
		1106	format!("http://{}{}", self.http_addr, path)
		1107	}
		1108
1103	pub fn get_ok(&self, path: &str) -> HttpResponse {	1109	pub fn get_ok(&self, path: &str) -> HttpResponse {
1104	let response = self.get(path);	1110	let response = self.get(path);
1105	assert!(	1111	assert!(

tests/nested_repo_http_test.rs

@@ @@ -0,0 +1,313 @@ @@
+//! Nested repositories over HTTP, end to end through the real server.
+//!
+//! Governance grants wild repos of the shape `agents/<name>`, and they are
+//! created by pushing over SSH. The HTTP surface has to reach them under the
+//! same name, or the feature is half-delivered: an agent can create and push
+//! to its own repository and then nobody, itself included, can see it.
+//!
+//! Everything here drives a live `git-collab-server` and talks real HTTP,
+//! because the failure being guarded against was invisible to unit tests —
+//! discovery, name resolution and URL routing each looked fine on their own.
+mod common;
+use common::{git_cmd, ServerHarness};
+use std::path::Path;
+use std::process::{Command, Output};
+/// The access rules used by the wild-repo test: one prefix per agent, with
+/// the creating key owning what it creates.
+const ACCESS_CONF: &str = "\
+@admins = alex
+@agents = claude-a
+repo settings
+    RW+                    =   @admins
+repo governed
+    RW+                    =   @admins
+    R                      =   @all
+repo agents/[a-z-]+
+    C                      =   @agents
+    RW+                    =   CREATOR
+";
+/// Create a bare repository at `repos_dir/<relative>`, making parents as
+/// needed, and give it one commit plus a collab ref so there is something to
+/// fetch.
+fn seed_bare_repo(repos_dir: &Path, relative: &str) {
+    let bare = repos_dir.join(relative);
+    std::fs::create_dir_all(bare.parent().unwrap()).unwrap();
+    git_cmd(
+        repos_dir,
+        &["init", "--bare", "-b", "main", bare.to_str().unwrap()],
+    );
+}
+/// Populate a bare repo from a scratch working tree: one commit on `main`,
+/// and one ref under `refs/collab/` so a fetch has something to show.
+fn seed_content(work_root: &Path, repos_dir: &Path, relative: &str, marker: &str) {
+    let bare = repos_dir.join(relative);
+    let work = work_root.join(marker);
+    std::fs::create_dir_all(&work).unwrap();
+    git_cmd(&work, &["init", "-q", "-b", "main"]);
+    git_cmd(&work, &["config", "user.email", "seed@example.com"]);
+    git_cmd(&work, &["config", "user.name", "Seed"]);
+    std::fs::write(work.join("README.md"), format!("# {marker}\n")).unwrap();
+    git_cmd(&work, &["add", "-A"]);
+    git_cmd(&work, &["commit", "-q", "-m", marker]);
+    git_cmd(&work, &["push", "-q", bare.to_str().unwrap(), "main:main"]);
+    // A collab-shaped ref, pushed by its full name. Its content does not
+    // matter here; that it is advertised over HTTP does.
+    git_cmd(
+        &work,
+        &[
+            "push",
+            "-q",
+            bare.to_str().unwrap(),
+            &format!("main:refs/collab/issues/{marker}"),
+        ],
+    );
+}
+/// `git ls-remote` against an http:// URL, unasserted.
+fn ls_remote(dir: &Path, url: &str) -> Output {
+    Command::new("git")
+        .args(["ls-remote", url])
+        .env("GIT_TERMINAL_PROMPT", "0")
+        .current_dir(dir)
+        .output()
+        .expect("failed to run git ls-remote")
+}
+/// The reproduction from the issue, as a table: with `alpha.git` and
+/// `agents/claude-a.git` both on disk, the nested one must be listed, must
+/// answer on its own path, and must advertise its collab refs.
+#[test]
+fn a_nested_repository_is_listed_browsable_and_serves_its_collab_refs() {
+    let harness = ServerHarness::new("alpha");
+    let repos_dir = harness.repos_dir();
+    let scratch = tempfile::TempDir::new().unwrap();
+    seed_content(scratch.path(), &repos_dir, "alpha.git", "alpha");
+    seed_bare_repo(&repos_dir, "agents/claude-a.git");
+    seed_content(
+        scratch.path(),
+        &repos_dir,
+        "agents/claude-a.git",
+        "claude-a",
+    );
+    // Listed, under its full path, not its last component.
+    let list = harness.get_ok("/");
+    assert!(
+        list.body.contains("href=\"/agents/claude-a\""),
+        "the repo list must link the nested repo by its full path; got:\n{}",
+        list.body
+    );
+    assert!(
+        !list.body.contains("href=\"/claude-a\""),
+        "the nested repo must not be listed under its last component alone; got:\n{}",
+        list.body
+    );
+    // Reachable at that same path, and only that path.
+    let nested = harness.get("/agents/claude-a");
+    assert!(
+        nested.status_line.contains("200"),
+        "GET /agents/claude-a: expected 200, got {}\n{}",
+        nested.status_line,
+        nested.body
+    );
+    assert!(
+        harness.get("/claude-a").status_line.contains("404"),
+        "the last component alone must not resolve the nested repo"
+    );
+    // The unnested repo is untouched.
+    harness.get_ok("/alpha");
+    // Sub-routes hang off the multi-segment name.
+    for suffix in ["issues", "patches", "commits", "tree"] {
+        let path = format!("/agents/claude-a/{suffix}");
+        let response = harness.get(&path);
+        assert!(
+            response.status_line.contains("200"),
+            "GET {path}: expected 200, got {}\n{}",
+            response.status_line,
+            response.body
+        );
+    }
+    // And the thing that matters more than the UI: a client can fetch the
+    // repo's collab refs over HTTP. Advertised first (GET info/refs), then
+    // actually transferred (POST git-upload-pack) — a clone over HTTP being
+    // unable to reach `refs/collab/*` is the substance of the bug.
+    let url = harness.http_url("/agents/claude-a.git");
+    let output = ls_remote(scratch.path(), &url);
+    assert!(
+        output.status.success(),
+        "git ls-remote {url} failed:\n{}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let refs = String::from_utf8_lossy(&output.stdout).to_string();
+    assert!(
+        refs.contains("refs/collab/issues/claude-a"),
+        "collab refs must be advertised over HTTP for a nested repo; got:\n{refs}"
+    );
+    let clone = scratch.path().join("fetched");
+    std::fs::create_dir_all(&clone).unwrap();
+    git_cmd(&clone, &["init", "-q", "-b", "main"]);
+    let fetch = Command::new("git")
+        .args(["fetch", "-q", &url, "refs/collab/*:refs/collab/*"])
+        .env("GIT_TERMINAL_PROMPT", "0")
+        .current_dir(&clone)
+        .output()
+        .expect("failed to run git fetch");
+    assert!(
+        fetch.status.success(),
+        "fetching collab refs over HTTP failed:\n{}",
+        String::from_utf8_lossy(&fetch.stderr)
+    );
+    let fetched = Command::new("git")
+        .args(["for-each-ref", "--format=%(refname)", "refs/collab/"])
+        .current_dir(&clone)
+        .output()
+        .expect("failed to run git for-each-ref");
+    assert!(
+        String::from_utf8_lossy(&fetched.stdout).contains("refs/collab/issues/claude-a"),
+        "the collab ref should have landed locally; got:\n{}",
+        String::from_utf8_lossy(&fetched.stdout)
+    );
+}
+/// `tools.git` and `tools` are two directories and so two repositories. The
+/// old naming stripped `.git` from both, collapsed them onto one name, and
+/// served whichever `discover` happened to reach first.
+#[test]
+fn tools_and_tools_dot_git_are_served_as_two_repositories() {
+    let harness = ServerHarness::new("alpha");
+    let repos_dir = harness.repos_dir();
+    let scratch = tempfile::TempDir::new().unwrap();
+    seed_bare_repo(&repos_dir, "tools.git");
+    seed_bare_repo(&repos_dir, "tools");
+    seed_content(scratch.path(), &repos_dir, "tools.git", "suffixed");
+    seed_content(scratch.path(), &repos_dir, "tools", "plain");
+    let list = harness.get_ok("/");
+    assert!(
+        list.body.contains("href=\"/tools\"") && list.body.contains("href=\"/tools.git\""),
+        "both must be listed, under distinct names; got:\n{}",
+        list.body
+    );
+    // Each answers on its own address, with its own content.
+    assert!(harness.get_ok("/tools").body.contains("plain"));
+    assert!(harness.get_ok("/tools.git").body.contains("suffixed"));
+    // And each is clonable as itself.
+    for (url_path, marker) in [("/tools", "plain"), ("/tools.git", "suffixed")] {
+        let url = harness.http_url(url_path);
+        let output = ls_remote(scratch.path(), &url);
+        assert!(
+            output.status.success(),
+            "git ls-remote {url} failed:\n{}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+        let refs = String::from_utf8_lossy(&output.stdout).to_string();
+        assert!(
+            refs.contains(&format!("refs/collab/issues/{marker}")),
+            "{url} should serve the {marker} repository; got:\n{refs}"
+        );
+    }
+}
+/// `repos_dir/.server/` holds the SSH host key. It is not a repository and
+/// must never be presented as one, however discovery walks the tree.
+#[test]
+fn the_server_state_directory_is_never_a_repository() {
+    let harness = ServerHarness::new("alpha");
+    let host_key = harness.repos_dir().join(".server").join("host_key");
+    assert!(
+        host_key.exists(),
+        "expected the server to have written {}",
+        host_key.display()
+    );
+    let list = harness.get_ok("/");
+    assert!(
+        !list.body.contains(".server"),
+        "the server state directory must not appear in the repo list; got:\n{}",
+        list.body
+    );
+    assert!(harness.get("/.server").status_line.contains("404"));
+    assert!(harness.get("/.server/host_key").status_line.contains("404"));
+}
+/// A repository whose name would escape `repos_dir` is not a repository.
+#[test]
+fn a_traversing_repo_path_is_not_served() {
+    let harness = ServerHarness::new("alpha");
+    for path in [
+        "/../../etc/passwd",
+        "/alpha/../../etc",
+        "/..%2F..%2Fetc%2Fpasswd",
+    ] {
+        let response = harness.get(path);
+        assert!(
+            !response.status_line.contains("200"),
+            "GET {path} must not succeed, got {}",
+            response.status_line
+        );
+    }
+}
+/// The workflow wild repos exist for: an agent creates its repository by
+/// pushing to it over SSH, and it is visible over HTTP on the very next
+/// request. Nothing may cache discovery across that boundary.
+#[test]
+fn a_wild_repo_created_over_ssh_is_visible_over_http_immediately() {
+    let harness = ServerHarness::new("governed");
+    harness.bootstrap_settings(
+        ACCESS_CONF,
+        &[("alex.pub", "alex"), ("claude-a.pub", "claude-a")],
+    );
+    let agent = harness.named_key("claude-a");
+    // Not there yet.
+    assert!(
+        harness.get("/agents/claude-a").status_line.contains("404"),
+        "the wild repo must not exist before it is created"
+    );
+    harness.work_repo().commit_file("mine.txt", "1", "mine");
+    let push = harness.ssh_push_from(
+        harness.work_repo().dir.path(),
+        &agent,
+        "agents/claude-a",
+        "main:main",
+    );
+    assert!(
+        push.status.success(),
+        "the agent's push should create the wild repo:\n{}",
+        String::from_utf8_lossy(&push.stderr)
+    );
+    // Visible on the next request, with no restart and no wait.
+    let response = harness.get("/agents/claude-a");
+    assert!(
+        response.status_line.contains("200"),
+        "a wild repo must be browsable as soon as it exists, got {}\n{}",
+        response.status_line,
+        response.body
+    );
+    assert!(
+        harness
+            .get_ok("/")
+            .body
+            .contains("href=\"/agents/claude-a\""),
+        "a wild repo must be listed as soon as it exists"
+    );
+}