From 26858f813f7ccd48bfb67fa4adc0f9b90a3588ef Mon Sep 17 00:00:00 2001
From: Taylor Ho <taylorkmho@gmail.com>
Date: Wed, 26 Aug 2026 23:10:25 -0700
Subject: [PATCH] Fix GitHub review check config loading

Signed-off-by: Taylor Ho <taylorkmho@gmail.com>
---
 .../src/commands/project_git_exec.rs          | 42 ++++++++++++++++++-
 .../src/commands/project_git_file_content.rs  |  9 ++--
 .../src/features/projects/ui/ProjectsView.tsx | 12 +++++-
 3 files changed, 56 insertions(+), 7 deletions(-)

diff --git a/desktop/src-tauri/src/commands/project_git_exec.rs b/desktop/src-tauri/src/commands/project_git_exec.rs
index c616d39db1..64a25a0352 100644
--- a/desktop/src-tauri/src/commands/project_git_exec.rs
+++ b/desktop/src-tauri/src/commands/project_git_exec.rs
@@ -337,6 +337,23 @@ fn validate_github_clone_url(clone_url: &str) -> Result<(), String> {
     Ok(())
 }
 
+/// Converts GitHub's SCP-style SSH shorthand to the public HTTPS clone URL
+/// accepted by the desktop's read-only repository workflows. All other values
+/// are returned trimmed and unchanged so their existing validation still
+/// fails closed.
+pub(crate) fn normalize_local_clone_url(clone_url: &str) -> String {
+    let clone_url = clone_url.trim();
+    let Some(path) = clone_url.strip_prefix("git@github.com:") else {
+        return clone_url.to_string();
+    };
+    let candidate = format!("https://github.com/{path}");
+    if validate_github_clone_url(&candidate).is_ok() {
+        candidate
+    } else {
+        clone_url.to_string()
+    }
+}
+
 pub(crate) fn validate_local_clone_url(clone_url: &str) -> Result<(), String> {
     if validate_clone_url(clone_url).is_ok() || validate_github_clone_url(clone_url).is_ok() {
         return Ok(());
@@ -394,10 +411,31 @@ fn validate_clone_url_against_relay(clone_url: &str, relay_base: &str) -> Result
 mod tests {
     use super::{
         clean_branch, clean_target_ref, credential_helper_config_value, git_needs_credentials,
-        git_subcommand, validate_clone_url, validate_clone_url_against_relay,
-        validate_local_clone_url,
+        git_subcommand, normalize_local_clone_url, validate_clone_url,
+        validate_clone_url_against_relay, validate_local_clone_url,
     };
 
+    #[test]
+    fn normalize_local_clone_url_converts_github_ssh_shorthand() {
+        assert_eq!(
+            normalize_local_clone_url("git@github.com:block/buzz.git"),
+            "https://github.com/block/buzz.git"
+        );
+    }
+
+    #[test]
+    fn normalize_local_clone_url_preserves_unrecognized_relative_values() {
+        assert_eq!(
+            normalize_local_clone_url("../buzz"),
+            "../buzz",
+            "unrecognized values must still reach the fail-closed validator"
+        );
+        assert_eq!(
+            normalize_local_clone_url("git@github.com:block/buzz/extra.git"),
+            "git@github.com:block/buzz/extra.git"
+        );
+    }
+
     #[test]
     fn credential_helper_config_value_uses_forward_slashes() {
         let path =
diff --git a/desktop/src-tauri/src/commands/project_git_file_content.rs b/desktop/src-tauri/src/commands/project_git_file_content.rs
index 1ada9f664f..44ba55add7 100644
--- a/desktop/src-tauri/src/commands/project_git_file_content.rs
+++ b/desktop/src-tauri/src/commands/project_git_file_content.rs
@@ -1,7 +1,7 @@
 use super::project_git::first_output_line;
 use super::project_git_exec::{
-    build_git_auth_config, clean_branch, clean_target_ref, run_git, validate_workspace_clone_url,
-    GitAuthConfig,
+    build_git_clone_auth_config, clean_branch, clean_target_ref, normalize_local_clone_url,
+    run_git, validate_local_clone_url_for_workspace, GitAuthConfig,
 };
 use super::project_repo_paths::find_local_repo_dir;
 use crate::app_state::AppState;
@@ -130,9 +130,10 @@ pub async fn get_project_repo_file_content(
     path: String,
     state: State<'_, AppState>,
 ) -> Result<Option<String>, String> {
-    validate_workspace_clone_url(&clone_url, &state)?;
+    let clone_url = normalize_local_clone_url(&clone_url);
+    validate_local_clone_url_for_workspace(&clone_url, &state)?;
     validate_repo_file_path(&path)?;
-    let auth = build_git_auth_config(&state)?;
+    let auth = build_git_clone_auth_config(&clone_url, &state)?;
     let branch = clean_branch(default_branch);
     let target_ref = clean_target_ref(target_ref);
     let target_commit = target_commit
diff --git a/desktop/src/features/projects/ui/ProjectsView.tsx b/desktop/src/features/projects/ui/ProjectsView.tsx
index f33659bcfc..7241570855 100644
--- a/desktop/src/features/projects/ui/ProjectsView.tsx
+++ b/desktop/src/features/projects/ui/ProjectsView.tsx
@@ -551,9 +551,19 @@ export function ProjectsView() {
   }
 
   if (projectsQuery.isError) {
+    const errorMessage =
+      projectsQuery.error instanceof Error
+        ? projectsQuery.error.message
+        : "The relay request failed.";
     return (
-      <div className="flex flex-1 flex-col items-center justify-center gap-2 text-muted-foreground">
+      <div className="flex flex-1 flex-col items-center justify-center gap-2 px-8 text-center text-muted-foreground">
         <p className="text-sm text-red-400">Failed to load projects</p>
+        <p
+          className="max-w-xl text-xs text-muted-foreground"
+          data-testid="projects-load-error"
+        >
+          {errorMessage}
+        </p>
         <Button
           onClick={() => void projectsQuery.refetch()}
           size="sm"