phase: 145_git_source_links

**Phase 145 final verification pass — all green, no code changes needed**

- **Verified (no defects found):** resolver `origin_for_source` + `_url_basename` (scp/`.git`/trailing-slash, sanitize, ambiguity WARNING); `origin:`/`branch:` lines in all four read shapes via shared `_origin_lines`; HIGH `<tools>` origin rule (verbatim + only-byte-change pins); `DocContent.origin_url/origin_branch` (absent-never-null serializer); `renderDocument` "Original" anchor (copyable verbatim URL, `_blank`/`noopener`, branch in title); mock scripted origin-link flow (disjoint trigger — grep-verified vs all other E2E files)
- **Tests:** `uv run pytest --cov=app --cov-report=term-missing` → 3402 passed, `app/` coverage **99%** (>90% gate); `uv run pytest tests/e2e/test_git_source_links.py -v --no-cov` → **4 passed** in isolation; `uv run ruff check .` → clean; `uv run pyright` → 0 errors, 0 warnings
- **Completion criteria:** (1) git read results carry origin/branch, local byte-identical — ✅ (unit pins + E2E control); (2) HIGH `<tools>` rule pinned, LOW byte-identical — ✅; (3) modal AND /document.html show Original link, branch in label when pinned, nothing for local — ✅; (4) full suite green + coverage + E2E + lint/types — ✅; (5) no completed-phase behavior change (read header line 1, mock prefix, done frame/SourceRef untouched, LOW sha) — ✅
- **Extra regression check:** re-ran shared-mock E2E suites `test_read_line_ranges.py` (2 passed) and `test_document_viewer.py` (8 passed) — no cross-suite regressions from the `mock_llm.py` addition
- **Documentation:** README.md reviewed in full (env table ⊇ `.env.example`, pages/routes, config defaults, scripts, 17-color palette, 300 s guard, 2 s sync poll, phase-145 provenance section matches implementation) and AGENTS.md (72rem container, no-CDN test, smoke test, gitignore, gates) — **verified consistent, no changes needed**
- **Notable:** phase-116 screenshot PNG was regenerated during this phase's E2E runs (byte re-encode only, visually identical, correct no-anchor local-source meta row) — left in tree for the harness commit
- **Next pending phase:** `146_search_tool_scope` (then 147, 148, 149)

app/rag/git_sources.py

@@ -86,6 +86,83 @@ def sanitize_url(url: str) -> str:
     return _USERINFO_RE.sub(r"\1", url, count=1)
 
 
+def _url_basename(url: str) -> str:
+    """Phase 145 (task 01) — the repository directory a git row's URL
+    imports into.
+
+    The URL's path component — after the ``://``, or after the ``:``
+    for scp-style ``git@host:owner/repo`` (the port-carrying
+    ``ssh://user@host:22/…`` form already fell into the ``://``
+    branch) — with trailing ``/`` stripped, a single trailing ``.git``
+    suffix stripped, and the last segment taken. The importer clones
+    into (and names the source after) exactly this basename
+    (``source = root.name``), so it is the join key between a
+    document's ``source`` name and the ``git_sources`` row whose clone
+    produced it. An ``@`` inside the *path* is not userinfo and is
+    never treated as one (no split, no strip).
+    """
+    rest = url
+    if "://" in rest:
+        rest = rest.partition("://")[2]
+    elif ":" in rest:
+        # scp-style ``git@host:owner/repo`` — the path component starts
+        # after the colon (``host:port`` has no other form here: the
+        # only colon-carrying scheme without ``//`` is the scp one).
+        rest = rest.partition(":")[2]
+    rest = rest.rstrip("/")
+    if rest.endswith(".git"):
+        rest = rest[: -len(".git")]
+    return rest.rsplit("/", 1)[-1]
+
+
+def origin_for_source(db: Session, source_name: str) -> tuple[str, str | None] | None:
+    """Phase 145 (task 01) — the origin a read result of *source_name*
+    documents carries: the sanitized repository URL (and the pinned
+    branch, when one exists), or ``None``.
+
+    The candidate rows are the ``kind='git'`` rows (local rows are
+    never origins — nothing to link to from the user's browser); a row
+    matches when its URL basename (:func:`_url_basename` — the clone
+    directory the importer names the source after) equals
+    ``source_name``.
+
+    * EXACTLY ONE match → ``(sanitize_url(row.url), row.branch)`` —
+      the phase-121 output mask keeps a legacy embedded-credential
+      row's secret out of the prompt (the stored value is never
+      modified — the :func:`clone_url_for` lesson), and ``branch`` is
+      the pinned branch or ``None`` (NULL = the default branch);
+    * zero matches, or TWO-OR-MORE (two repos sharing a basename) →
+      ``None`` + a WARNING log (the ambiguity names the sanitized
+      candidates) — never guess: the read result would otherwise
+      carry a wrong origin into every answer about the document, and
+      a ``None`` result is byte-identical to pre-phase.
+
+    Pure-DB helper — one query, no git subprocess
+    (``scripts/git_sync.py`` stays the only git-invocation site, PLAN
+    §13), no caching (the table is a handful of rows; a read's extra
+    query is trivial).
+    """
+    rows = db.scalars(select(GitSource).where(GitSource.kind == "git")).all()
+    candidates = [row for row in rows if _url_basename(row.url) == source_name]
+    if len(candidates) == 1:
+        row = candidates[0]
+        return sanitize_url(row.url), row.branch
+    if not candidates:
+        logger.warning(
+            "no git origin for source %r: no kind='git' row's URL basename matches",
+            source_name,
+        )
+        return None
+    logger.warning(
+        "ambiguous git origin for source %r: %d rows share the URL basename (%s) — "
+        "no origin line is added to its read results",
+        source_name,
+        len(candidates),
+        ", ".join(sanitize_url(row.url) for row in candidates),
+    )
+    return None
+
+
 def clone_url_for(row: GitSource) -> str:
     """Phase 121, LOCKED A2 — the URL git actually clones, with the
     row's credential injected ONLY here.