[BUG] GitLab sparse-fetch rewrites ssh:// URL with custom port to HTTPS on same host

[fm-knopfler]

Describe the bug

When a type: gitlab dependency uses an ssh:// URL with a non-standard port (e.g. ssh://git@gitlab-ssh.example.com:2222/...), the git sparse-fetch path constructs a remote URL using HTTPS against the same hostname. For GitLab instances where the SSH host alias differs from the web endpoint, this causes the git transport to speak TLS to an SSH-only host, then silently fall back to the GitLab REST API (which also fails because it reuses the SSH port with HTTPS).

To Reproduce

1. Host: self-hosted GitLab at gitlab.example.com:443 (HTTPS web) with SSH-only alias at gitlab-ssh.example.com:2222
2. apm.yml:

   dependencies:
     apm:
       - git: ssh://git@gitlab-ssh.example.com:2222/owner/repo.git
         path: agents/some-agent.agent.md
         type: gitlab

3. Run apm install

Observed result

HTTPSConnectionPool(host='gitlab-ssh.example.com', port=2222):
Max retries exceeded with url: /api/v4/projects/owner%2Frepo/repository/files/...
(Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number')))

With APM_DEBUG=1:

[DEBUG] git sparse fetch: host=gitlab-ssh.example.com repo=owner/repo ref=main paths=1
[DEBUG] git transport unavailable for gitlab-ssh.example.com/owner/repo; falling back to GitLab REST API (GitFileTransportError)

strace confirms the sparse-fetch worktree used git remote add origin https://gitlab-ssh.example.com/... and invoked git-remote-https. The SSH URL and custom port were lost.

Expected behavior

The original SSH URL and port should be preserved for the git transport remote URL. A git ls-remote over the same ssh:// URL with port 2222 succeeds from the same environment.

Environment:

• OS: Linux (container)
• APM Version: 0.30.0
• GitLab: self-hosted at gitlab.example.com with SSH alias gitlab-ssh.example.com:2222

Logs

strace output showing the rewritten remote URL:

execve("/usr/local/libexec/git-core/git-remote-https", [...], "origin", "https://gitlab-ssh.example.com/owner/repo.git")

Manual verification that sparse fetch works with the correct URL:

$ git -c init.defaultBranch=main init -q
$ git remote add origin ssh://git@gitlab-ssh.example.com:2222/owner/repo.git
$ git sparse-checkout init --no-cone
$ git sparse-checkout set agents/some-agent.agent.md
$ git fetch --filter=blob:none --depth=1 origin main  # succeeds
$ git checkout -q FETCH_HEAD
$ ls agents/some-agent.agent.md  # exists

Additional context

Workaround: switch the dependency to the HTTPS web URL and add a GitLab token:

- git: https://gitlab.example.com/owner/repo.git
  path: agents/some-agent.agent.md
  type: gitlab

This requires HTTPS credentials for the GitLab instance rather than SSH keys.

[mahekara28]

I’d like to work on this. I’ll look into the sparse-fetch URL handling and add a regression test to make sure the SSH URL and custom port are preserved.

[danielmeppiel]

Confirmed bug on v0.30.0 and the main revision investigated (e38261c5db). Thanks for the detailed report and working SSH comparison.

What we reproduced

We ran the same offline probe against v0.30.0 (8c2e0d9c35) and main (e38261c5db), using the reported object-form dependency. It exercises real manifest parsing, GitLab routing, URL construction, and sparse transport. Local Git setup runs in temporary directories; Git fetch and HTTP requests are intercepted before network access. No real credentials or private GitLab instance are needed.

Both revisions produce:

Requested:  ssh://git@gitlab-ssh.example.com:2222/owner/repo.git
Git remote: https://gitlab-ssh.example.com:2222/owner/repo.git

The parser retains scheme=ssh, user=git, and port=2222. The sparse-fetch caller selects HTTPS anyway. The existing SSH URL builder returns the correct URL when explicitly requested.

Case	Result on both revisions
Explicit SSH, with or without a custom port	Remote becomes HTTPS
SCP-style SSH	Remote becomes HTTPS
SSH with a custom username and subgroup path	Remote becomes HTTPS
Explicit HTTPS control	Remote remains HTTPS
Controlled Git failure, protocol fallback disabled or enabled	REST targets https://gitlab-ssh.example.com:2222/api/v4/...

Scope of confirmation: this proves incorrect URL selection and the REST fallback target, not the exact Linux TLS exception. Unlike the reported Git trace, our reproduction retains port 2222 on the incorrect HTTPS remote.

Where engineering should start

Links below are pinned to the investigated main revision.

Source	Finding
models/dependency/reference.py: SSH parser	Preserves SSH details; the reproduction does not indicate a parsing fix is needed.
deps/download_strategies.py: _download_gitlab_file_via_git	Builds the remote and injected URL callback without requesting SSH. Likely starting point for the fix.
deps/download_strategies.py: build_repo_url and deps/host_backends.py: GitLab builders	The shared builder defaults to HTTPS; the SSH branch already handles host, port, and username.
deps/git_file_transport.py: _ensure_checkout	Passes the callback's result to git remote add origin; it is not independently rewriting SSH.
deps/download_strategies.py: download_gitlab_file	After Git failure, constructs REST fallback from the same host and port.

Recommendation: investigate routing this path through the existing transport-selection rules, rather than changing the shared URL builder's default globally. The specification should settle fallback behavior for an explicit SSH source; an SSH alias/port is not evidence of a usable HTTPS API endpoint.

Also review the sparse transport reuse key, which omits scheme and SSH username. That is a fix-design consideration, not a separately reproduced cache defect.

Mahek Ara (@mahekara28), thanks for volunteering. The probe below can seed a regression alongside tests/test_gitlab_git_transport.py: keep the real URL builder and sparse transport in the path, and assert the remote given to Git.

Reproduction artifacts

The original script and both JSON outputs are included below. Full revisions are recorded in the JSON. The script is an observation probe, not a passing regression test: preserves_requested_scheme: false records the defect.

To rerun, save the script outside the checkout and run from either pinned revision with APM's Python dependencies available:

PYTHONDONTWRITEBYTECODE=1 PYTHONPATH="$PWD/src" \
  python3 /path/to/reproduce_2929.py "$(git rev-parse HEAD)"

No fix or specification is included in this handoff.

reproduce_2929.py

"""Offline production-path probe; never executes network-capable Git commands."""

import json
import os
import socket
import subprocess
import sys
import tempfile
from pathlib import Path
from unittest.mock import patch
from urllib.parse import urlparse

import yaml

from apm_cli.deps.github_downloader import GitHubPackageDownloader
from apm_cli.deps.transport_selection import (
    NoOpInsteadOfResolver,
    ProtocolPreference,
    TransportSelector,
)
from apm_cli.models.apm_package import APMPackage


class BoundaryReached(BaseException):
    """Stop at an external boundary without triggering application fallbacks."""


def probe(url: str, fail_git: bool, allow_fallback: bool) -> dict:
    """Capture a real sparse remote and optional HTTP fallback without network."""
    observed = {"input": url, "fail_git": fail_git, "allow_fallback": allow_fallback}
    real_run = subprocess.run

    def run(command: list[str], **kwargs: object) -> subprocess.CompletedProcess:
        """Allow only local Git operations and intercept fetch."""
        args = list(command)
        assert Path(args[0]).name == "git", args
        if "fetch" in args:
            observed["fetch"] = args[1:]
            if fail_git:
                return subprocess.CompletedProcess(args, 1, "", "controlled offline failure")
            raise BoundaryReached()
        assert len(args) > 1 and args[1] in {
            "config", "init", "remote", "sparse-checkout", "--version"
        }, args
        if args[1:4] == ["remote", "add", "origin"]:
            observed["remote"] = args[4]
        return real_run(command, **kwargs)

    def request(session: object, method: str, url: str, **kwargs: object) -> None:
        """Record HTTP request before requests can establish any connection."""
        observed["rest"] = url
        raise BoundaryReached()

    with tempfile.TemporaryDirectory(prefix="apm-2929-") as directory:
        isolated_env = {
            "PATH": os.environ["PATH"],
            "HOME": directory,
            "XDG_CONFIG_HOME": directory,
            "GIT_CONFIG_NOSYSTEM": "1",
            "GIT_CONFIG_GLOBAL": os.devnull,
            "GIT_CONFIG_SYSTEM": os.devnull,
            "GIT_TERMINAL_PROMPT": "0",
            "APM_ALLOW_PROTOCOL_FALLBACK": "1" if allow_fallback else "0",
        }
        with (
            patch.dict(os.environ, isolated_env, clear=True),
            patch("subprocess.run", side_effect=run),
            patch("requests.sessions.Session.request", new=request),
            patch.object(socket.socket, "connect", side_effect=AssertionError("Network forbidden")),
            patch(
                "apm_cli.core.token_manager.GitHubTokenManager.resolve_credential_from_git",
                return_value=None,
            ),
        ):
            data = yaml.safe_load(
                "name: triage-fixture\nversion: 1.0.0\n"
                "dependencies:\n  apm:\n"
                f"    - git: {url}\n"
                "      path: agents/some-agent.agent.md\n      type: gitlab\n"
            )
            package = APMPackage.from_mapping(
                data, package_path=Path(directory), create_config=False
            )
            dep = package.dependencies["apm"][0]
            observed["parsed"] = {
                "scheme": dep.explicit_scheme,
                "host": dep.host,
                "port": dep.port,
                "user": dep.ssh_user,
                "repo": dep.repo_url,
                "type": dep.host_type,
            }
            downloader = GitHubPackageDownloader(
                protocol_pref=ProtocolPreference.NONE,
                allow_fallback=allow_fallback,
                transport_selector=TransportSelector(NoOpInsteadOfResolver()),
            )
            observed["cache_key"] = downloader._strategies._git_file_transport_key(dep, "main")
            observed["ssh_builder"] = downloader._strategies.build_repo_url(
                dep.repo_url, dep_ref=dep, use_ssh=True, token=""
            )
            try:
                downloader._download_github_file(dep, "agents/some-agent.agent.md", "main")
            except BoundaryReached:
                pass
            finally:
                for transport in downloader._strategies._git_file_transports.values():
                    transport.close()
            assert "remote" in observed, observed
            remote = urlparse(observed["remote"])
            observed["preserves_requested_scheme"] = remote.scheme == dep.explicit_scheme
            assert remote.hostname == dep.host
            assert remote.port == dep.port
            assert remote.path == f"/{dep.repo_url}.git"
            if dep.explicit_scheme == "ssh":
                ssh = urlparse(observed["ssh_builder"])
                if dep.port:
                    assert ssh.scheme == "ssh"
                    assert ssh.port == dep.port
                    assert ssh.username == dep.ssh_user
            if fail_git:
                assert "rest" in observed, observed
                rest = urlparse(observed["rest"])
                assert rest.scheme == "https"
                assert rest.hostname == dep.host
                assert rest.port == dep.port
    return observed


if __name__ == "__main__":
    inputs = [
        "ssh://git@gitlab-ssh.example.com:2222/owner/repo.git",
        "ssh://git@gitlab-ssh.example.com/owner/repo.git",
        "git@gitlab-ssh.example.com:owner/repo.git",
        "https://gitlab.example.com/owner/repo.git",
        "ssh://deploy@gitlab-ssh.example.com:2222/owner/subgroup/repo.git",
    ]
    observations = [probe(url, False, False) for url in inputs]
    observations.extend(probe(inputs[0], True, permitted) for permitted in (False, True))
    print(json.dumps({"revision": sys.argv[1], "observations": observations}, indent=2))

repro-head.json

{
  "revision": "e38261c5db4d893d6ddebc3925742e4e3bd2ba74",
  "observations": [
    {
      "input": "ssh://git@gitlab-ssh.example.com:2222/owner/repo.git",
      "fail_git": false,
      "allow_fallback": false,
      "parsed": {
        "scheme": "ssh",
        "host": "gitlab-ssh.example.com",
        "port": 2222,
        "user": "git",
        "repo": "owner/repo",
        "type": "gitlab"
      },
      "cache_key": [
        "gitlab-ssh.example.com",
        "owner/repo",
        "main",
        2222
      ],
      "ssh_builder": "ssh://git@gitlab-ssh.example.com:2222/owner/repo.git",
      "remote": "https://gitlab-ssh.example.com:2222/owner/repo.git",
      "fetch": [
        "fetch",
        "--filter=blob:none",
        "--depth=1",
        "origin",
        "main"
      ],
      "preserves_requested_scheme": false
    },
    {
      "input": "ssh://git@gitlab-ssh.example.com/owner/repo.git",
      "fail_git": false,
      "allow_fallback": false,
      "parsed": {
        "scheme": "ssh",
        "host": "gitlab-ssh.example.com",
        "port": null,
        "user": "git",
        "repo": "owner/repo",
        "type": "gitlab"
      },
      "cache_key": [
        "gitlab-ssh.example.com",
        "owner/repo",
        "main",
        null
      ],
      "ssh_builder": "git@gitlab-ssh.example.com:owner/repo.git",
      "remote": "https://gitlab-ssh.example.com/owner/repo.git",
      "fetch": [
        "fetch",
        "--filter=blob:none",
        "--depth=1",
        "origin",
        "main"
      ],
      "preserves_requested_scheme": false
    },
    {
      "input": "git@gitlab-ssh.example.com:owner/repo.git",
      "fail_git": false,
      "allow_fallback": false,
      "parsed": {
        "scheme": "ssh",
        "host": "gitlab-ssh.example.com",
        "port": null,
        "user": "git",
        "repo": "owner/repo",
        "type": "gitlab"
      },
      "cache_key": [
        "gitlab-ssh.example.com",
        "owner/repo",
        "main",
        null
      ],
      "ssh_builder": "git@gitlab-ssh.example.com:owner/repo.git",
      "remote": "https://gitlab-ssh.example.com/owner/repo.git",
      "fetch": [
        "fetch",
        "--filter=blob:none",
        "--depth=1",
        "origin",
        "main"
      ],
      "preserves_requested_scheme": false
    },
    {
      "input": "https://gitlab.example.com/owner/repo.git",
      "fail_git": false,
      "allow_fallback": false,
      "parsed": {
        "scheme": "https",
        "host": "gitlab.example.com",
        "port": null,
        "user": null,
        "repo": "owner/repo",
        "type": "gitlab"
      },
      "cache_key": [
        "gitlab.example.com",
        "owner/repo",
        "main",
        null
      ],
      "ssh_builder": "git@gitlab.example.com:owner/repo.git",
      "remote": "https://gitlab.example.com/owner/repo.git",
      "fetch": [
        "fetch",
        "--filter=blob:none",
        "--depth=1",
        "origin",
        "main"
      ],
      "preserves_requested_scheme": true
    },
    {
      "input": "ssh://deploy@gitlab-ssh.example.com:2222/owner/subgroup/repo.git",
      "fail_git": false,
      "allow_fallback": false,
      "parsed": {
        "scheme": "ssh",
        "host": "gitlab-ssh.example.com",
        "port": 2222,
        "user": "deploy",
        "repo": "owner/subgroup/repo",
        "type": "gitlab"
      },
      "cache_key": [
        "gitlab-ssh.example.com",
        "owner/subgroup/repo",
        "main",
        2222
      ],
      "ssh_builder": "ssh://deploy@gitlab-ssh.example.com:2222/owner/subgroup/repo.git",
      "remote": "https://gitlab-ssh.example.com:2222/owner/subgroup/repo.git",
      "fetch": [
        "fetch",
        "--filter=blob:none",
        "--depth=1",
        "origin",
        "main"
      ],
      "preserves_requested_scheme": false
    },
    {
      "input": "ssh://git@gitlab-ssh.example.com:2222/owner/repo.git",
      "fail_git": true,
      "allow_fallback": false,
      "parsed": {
        "scheme": "ssh",
        "host": "gitlab-ssh.example.com",
        "port": 2222,
        "user": "git",
        "repo": "owner/repo",
        "type": "gitlab"
      },
      "cache_key": [
        "gitlab-ssh.example.com",
        "owner/repo",
        "main",
        2222
      ],
      "ssh_builder": "ssh://git@gitlab-ssh.example.com:2222/owner/repo.git",
      "remote": "https://gitlab-ssh.example.com:2222/owner/repo.git",
      "fetch": [
        "fetch",
        "--filter=blob:none",
        "--depth=1",
        "origin",
        "main"
      ],
      "rest": "https://gitlab-ssh.example.com:2222/api/v4/projects/owner%2Frepo/repository/files/agents%2Fsome-agent.agent.md/raw?ref=main",
      "preserves_requested_scheme": false
    },
    {
      "input": "ssh://git@gitlab-ssh.example.com:2222/owner/repo.git",
      "fail_git": true,
      "allow_fallback": true,
      "parsed": {
        "scheme": "ssh",
        "host": "gitlab-ssh.example.com",
        "port": 2222,
        "user": "git",
        "repo": "owner/repo",
        "type": "gitlab"
      },
      "cache_key": [
        "gitlab-ssh.example.com",
        "owner/repo",
        "main",
        2222
      ],
      "ssh_builder": "ssh://git@gitlab-ssh.example.com:2222/owner/repo.git",
      "remote": "https://gitlab-ssh.example.com:2222/owner/repo.git",
      "fetch": [
        "fetch",
        "--filter=blob:none",
        "--depth=1",
        "origin",
        "main"
      ],
      "rest": "https://gitlab-ssh.example.com:2222/api/v4/projects/owner%2Frepo/repository/files/agents%2Fsome-agent.agent.md/raw?ref=main",
      "preserves_requested_scheme": false
    }
  ]
}

repro-release.json

{
  "revision": "8c2e0d9c352e2ed0e8c56b40063a63e1dd4a1937",
  "observations": [
    {
      "input": "ssh://git@gitlab-ssh.example.com:2222/owner/repo.git",
      "fail_git": false,
      "allow_fallback": false,
      "parsed": {
        "scheme": "ssh",
        "host": "gitlab-ssh.example.com",
        "port": 2222,
        "user": "git",
        "repo": "owner/repo",
        "type": "gitlab"
      },
      "cache_key": [
        "gitlab-ssh.example.com",
        "owner/repo",
        "main",
        2222
      ],
      "ssh_builder": "ssh://git@gitlab-ssh.example.com:2222/owner/repo.git",
      "remote": "https://gitlab-ssh.example.com:2222/owner/repo.git",
      "fetch": [
        "fetch",
        "--filter=blob:none",
        "--depth=1",
        "origin",
        "main"
      ],
      "preserves_requested_scheme": false
    },
    {
      "input": "ssh://git@gitlab-ssh.example.com/owner/repo.git",
      "fail_git": false,
      "allow_fallback": false,
      "parsed": {
        "scheme": "ssh",
        "host": "gitlab-ssh.example.com",
        "port": null,
        "user": "git",
        "repo": "owner/repo",
        "type": "gitlab"
      },
      "cache_key": [
        "gitlab-ssh.example.com",
        "owner/repo",
        "main",
        null
      ],
      "ssh_builder": "git@gitlab-ssh.example.com:owner/repo.git",
      "remote": "https://gitlab-ssh.example.com/owner/repo.git",
      "fetch": [
        "fetch",
        "--filter=blob:none",
        "--depth=1",
        "origin",
        "main"
      ],
      "preserves_requested_scheme": false
    },
    {
      "input": "git@gitlab-ssh.example.com:owner/repo.git",
      "fail_git": false,
      "allow_fallback": false,
      "parsed": {
        "scheme": "ssh",
        "host": "gitlab-ssh.example.com",
        "port": null,
        "user": "git",
        "repo": "owner/repo",
        "type": "gitlab"
      },
      "cache_key": [
        "gitlab-ssh.example.com",
        "owner/repo",
        "main",
        null
      ],
      "ssh_builder": "git@gitlab-ssh.example.com:owner/repo.git",
      "remote": "https://gitlab-ssh.example.com/owner/repo.git",
      "fetch": [
        "fetch",
        "--filter=blob:none",
        "--depth=1",
        "origin",
        "main"
      ],
      "preserves_requested_scheme": false
    },
    {
      "input": "https://gitlab.example.com/owner/repo.git",
      "fail_git": false,
      "allow_fallback": false,
      "parsed": {
        "scheme": "https",
        "host": "gitlab.example.com",
        "port": null,
        "user": null,
        "repo": "owner/repo",
        "type": "gitlab"
      },
      "cache_key": [
        "gitlab.example.com",
        "owner/repo",
        "main",
        null
      ],
      "ssh_builder": "git@gitlab.example.com:owner/repo.git",
      "remote": "https://gitlab.example.com/owner/repo.git",
      "fetch": [
        "fetch",
        "--filter=blob:none",
        "--depth=1",
        "origin",
        "main"
      ],
      "preserves_requested_scheme": true
    },
    {
      "input": "ssh://deploy@gitlab-ssh.example.com:2222/owner/subgroup/repo.git",
      "fail_git": false,
      "allow_fallback": false,
      "parsed": {
        "scheme": "ssh",
        "host": "gitlab-ssh.example.com",
        "port": 2222,
        "user": "deploy",
        "repo": "owner/subgroup/repo",
        "type": "gitlab"
      },
      "cache_key": [
        "gitlab-ssh.example.com",
        "owner/subgroup/repo",
        "main",
        2222
      ],
      "ssh_builder": "ssh://deploy@gitlab-ssh.example.com:2222/owner/subgroup/repo.git",
      "remote": "https://gitlab-ssh.example.com:2222/owner/subgroup/repo.git",
      "fetch": [
        "fetch",
        "--filter=blob:none",
        "--depth=1",
        "origin",
        "main"
      ],
      "preserves_requested_scheme": false
    },
    {
      "input": "ssh://git@gitlab-ssh.example.com:2222/owner/repo.git",
      "fail_git": true,
      "allow_fallback": false,
      "parsed": {
        "scheme": "ssh",
        "host": "gitlab-ssh.example.com",
        "port": 2222,
        "user": "git",
        "repo": "owner/repo",
        "type": "gitlab"
      },
      "cache_key": [
        "gitlab-ssh.example.com",
        "owner/repo",
        "main",
        2222
      ],
      "ssh_builder": "ssh://git@gitlab-ssh.example.com:2222/owner/repo.git",
      "remote": "https://gitlab-ssh.example.com:2222/owner/repo.git",
      "fetch": [
        "fetch",
        "--filter=blob:none",
        "--depth=1",
        "origin",
        "main"
      ],
      "rest": "https://gitlab-ssh.example.com:2222/api/v4/projects/owner%2Frepo/repository/files/agents%2Fsome-agent.agent.md/raw?ref=main",
      "preserves_requested_scheme": false
    },
    {
      "input": "ssh://git@gitlab-ssh.example.com:2222/owner/repo.git",
      "fail_git": true,
      "allow_fallback": true,
      "parsed": {
        "scheme": "ssh",
        "host": "gitlab-ssh.example.com",
        "port": 2222,
        "user": "git",
        "repo": "owner/repo",
        "type": "gitlab"
      },
      "cache_key": [
        "gitlab-ssh.example.com",
        "owner/repo",
        "main",
        2222
      ],
      "ssh_builder": "ssh://git@gitlab-ssh.example.com:2222/owner/repo.git",
      "remote": "https://gitlab-ssh.example.com:2222/owner/repo.git",
      "fetch": [
        "fetch",
        "--filter=blob:none",
        "--depth=1",
        "origin",
        "main"
      ],
      "rest": "https://gitlab-ssh.example.com:2222/api/v4/projects/owner%2Frepo/repository/files/agents%2Fsome-agent.agent.md/raw?ref=main",
      "preserves_requested_scheme": false
    }
  ]
}

[github-actions]

Triage decision

Confirmed bug, already in-flight. A maintainer (danielmeppiel) independently reproduced the defect on both v0.30.0 and main with an offline test probe, confirming the GitLab sparse-fetch path drops the requested SSH scheme/port and rebuilds an HTTPS remote (and REST fallback) against the same host. A fix PR (#2939, "fix(deps): preserve GitLab sparse-fetch transport") and a specification sub-issue (#2938) are already open against this issue, and a community contributor (mahekara28) has volunteered to work on it. No further investigation is needed from this panel; the issue should be marked triaged and tracked as in-flight pending #2939 merging.

Proposed labels

• type/bug (already present)
• area/lockfile (dependency resolution / git transport selection domain)
• priority/high (blocks install for any self-hosted GitLab user whose SSH alias/port differs from the HTTPS host; workaround requires switching auth model entirely)
• status/triaged
• status/in-flight (active fix PR fix(deps): preserve GitLab sparse-fetch transport #2939 open)

Milestone

null - the open-milestones API call returned 401 in this run, so no milestone can be verified/assigned. A maintainer should assign manually once milestone titles are available.

Suggested next action

Review and merge #2939 (or continue if it supersedes mahekara28's offer), keep #2938 linked as the design record, and close this issue once the fix lands with a regression test per the reproduction in the comment thread.

Suggested issue comment

Thanks fm-knopfler for the detailed report and repro steps - this is confirmed and already has a fix in flight at #2939, with the design captured in #2938. Marking triaged and in-flight.

Per-lens notes (collapsed)

DevX UX Expert

No CLI UX surface changes needed beyond the eventual fix; the error message users see (SSLError: WRONG_VERSION_NUMBER bubbling from a misrouted HTTPS request) is confusing and unrelated to the real cause. Once fixed, consider whether a clearer transport-selection error is warranted for future protocol-mismatch cases, but that's out of scope for this bug fix.

Supply Chain Security Expert

No credential or integrity implications - the defect silently downgrades protocol choice (SSH to HTTPS/REST) rather than exposing secrets, but it does mean a user's SSH-only trust model is bypassed without their consent, which is worth calling out in the fix's regression test (assert no REST/HTTPS fallback is attempted when SSH is explicitly requested and functional).

Python Architect

Maintainer's investigation already points to `download_strategies.py::_download_gitlab_file_via_git` and the shared `build_repo_url` defaulting to HTTPS as the likely fix site, routed through existing `transport_selection.py` rules rather than changing the shared builder's global default. This looks architecturally sound - respects single-owner boundaries per `architecture.instructions.md`.

Doc Writer

Not applicable - no user-facing docs describe git transport selection in enough detail to need updates from this bug fix alone; the fix PR should note in its description if any GitLab dependency docs pages need clarification on SSH support.

OSS Growth Hacker

Not applicable - internal bug fix, no community/positioning angle beyond the existing volunteer contribution, which is a healthy community signal worth a courteous ack.

APM CEO (arbiter)

Clear accept. High confidence given independent maintainer reproduction and an already-open fix PR. No breaking-change or design ambiguity - just needs the fix merged and issue closed. Routing straight to in-flight tracking rather than needs-design.

{
  "issue": 2929,
  "decision": "accept-in-flight",
  "labels": ["type/bug", "area/lockfile", "priority/high", "status/triaged", "status/in-flight"],
  "milestone": null,
  "confidence": "HIGH"
}

---

Triage status: agentic proposal pending human ratification.
Silence is approval. Maintainers can:

• Override any label or milestone above by editing it directly --
  human edits are authoritative and will not be reverted on
  subsequent runs.
• Re-trigger triage by applying the status/needs-triage label, or
  by removing status/triaged to enroll the issue in the next
  daily sweep.

Posted by the Triage Panel workflow. See packages/apm-triage-panel for the panel skill.

Generated by Triage Panel for #2929 · copilot · auto · 40.7 AIC · ⌖ 5.67 AIC · ⊞ 14.1K · ◷