From 1908c43fef2114cba13df3fc572eeaf7f945ee52 Mon Sep 17 00:00:00 2001
From: root <root@lyon.remote>
Date: Tue, 7 Jul 2026 01:06:14 +0000
Subject: [PATCH] fix: allow jd01 gitea mirror for agentrun dispatch

---
 .../cloud/code-agent-agentrun-profile.test.ts | 23 +++++++++++++++++++
 internal/cloud/code-agent-agentrun-profile.ts | 19 +++++++++------
 2 files changed, 35 insertions(+), 7 deletions(-)
 create mode 100644 internal/cloud/code-agent-agentrun-profile.test.ts

diff --git a/internal/cloud/code-agent-agentrun-profile.test.ts b/internal/cloud/code-agent-agentrun-profile.test.ts
new file mode 100644
index 00000000..21ef9e03
--- /dev/null
+++ b/internal/cloud/code-agent-agentrun-profile.test.ts
@@ -0,0 +1,23 @@
+import { strict as assert } from "node:assert";
+import { test } from "node:test";
+
+import {
+  DEFAULT_AGENTRUN_REPO_URL,
+  GITEA_AGENTRUN_REPO_URL,
+  resolveAgentRunRepoUrl
+} from "./code-agent-agentrun-profile.ts";
+
+test("resolveAgentRunRepoUrl allows approved internal mirrors", () => {
+  assert.equal(resolveAgentRunRepoUrl({}), DEFAULT_AGENTRUN_REPO_URL);
+  assert.equal(
+    resolveAgentRunRepoUrl({ HWLAB_CODE_AGENT_AGENTRUN_REPO_URL: `${GITEA_AGENTRUN_REPO_URL}/?token=ignored#fragment` }),
+    GITEA_AGENTRUN_REPO_URL
+  );
+});
+
+test("resolveAgentRunRepoUrl rejects unapproved internal repo URLs", () => {
+  assert.throws(
+    () => resolveAgentRunRepoUrl({ HWLAB_CODE_AGENT_AGENTRUN_REPO_URL: "http://gitea-http.devops-infra.svc.cluster.local:3000/other/HWLAB.git" }),
+    (error) => error?.code === "agentrun_internal_repo_url_required"
+  );
+});
diff --git a/internal/cloud/code-agent-agentrun-profile.ts b/internal/cloud/code-agent-agentrun-profile.ts
index f5ef7a0c..43b3ae5f 100644
--- a/internal/cloud/code-agent-agentrun-profile.ts
+++ b/internal/cloud/code-agent-agentrun-profile.ts
@@ -4,6 +4,7 @@
 import { truthyFlag } from "./server-http-utils.ts";
 
 export const DEFAULT_AGENTRUN_REPO_URL = "http://git-mirror-http.devops-infra.svc.cluster.local/pikasTech/HWLAB.git";
+export const GITEA_AGENTRUN_REPO_URL = "http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-HWLAB.git";
 
 const ADAPTER_ID = "agentrun-v01";
 const AGENTRUN_BACKEND_PREFIX = ADAPTER_ID;
@@ -42,18 +43,22 @@ export function resolveAgentRunRepoUrl(env = process.env) {
   const raw = firstNonEmpty(env.HWLAB_CODE_AGENT_AGENTRUN_REPO_URL, env.HWLAB_BOOT_READ_URL, DEFAULT_AGENTRUN_REPO_URL);
   const url = new URL(raw);
   const host = url.hostname.toLowerCase();
-  const allowedHost = "git-mirror-http.devops-infra.svc.cluster.local";
   const allowedByTest = truthyFlag(env.HWLAB_CODE_AGENT_AGENTRUN_ALLOW_NON_K3S_URL) && ["127.0.0.1", "localhost"].includes(host);
-  if (url.protocol !== "http:" || (host !== allowedHost && !allowedByTest)) {
-    throw Object.assign(new Error(`HWLAB_CODE_AGENT_AGENTRUN_REPO_URL must use internal k3s git mirror ${DEFAULT_AGENTRUN_REPO_URL}; got ${redactUrl(raw)}`), {
+  url.pathname = url.pathname.replace(/\/+$/u, "");
+  url.search = "";
+  url.hash = "";
+  const normalized = url.toString().replace(/\/+$/u, "");
+  if (url.protocol !== "http:" || (!isAllowedAgentRunRepoUrl(normalized) && !allowedByTest)) {
+    throw Object.assign(new Error(`HWLAB_CODE_AGENT_AGENTRUN_REPO_URL must use an approved internal k3s git mirror (${DEFAULT_AGENTRUN_REPO_URL} or ${GITEA_AGENTRUN_REPO_URL}); got ${redactUrl(raw)}`), {
       code: "agentrun_internal_repo_url_required",
       statusCode: 500
     });
   }
-  url.pathname = url.pathname.replace(/\/+$/u, "");
-  url.search = "";
-  url.hash = "";
-  return url.toString().replace(/\/+$/u, "");
+  return normalized;
+}
+
+function isAllowedAgentRunRepoUrl(repoUrl) {
+  return repoUrl === DEFAULT_AGENTRUN_REPO_URL || repoUrl === GITEA_AGENTRUN_REPO_URL;
 }
 
 export function requireAgentRunSourceCommit(env) {