phase: 145_git_source_links

**Phase 145 final verification pass — all green, no code changes needed**

- **Verified (no defects found):** resolver `origin_for_source` + `_url_basename` (scp/`.git`/trailing-slash, sanitize, ambiguity WARNING); `origin:`/`branch:` lines in all four read shapes via shared `_origin_lines`; HIGH `<tools>` origin rule (verbatim + only-byte-change pins); `DocContent.origin_url/origin_branch` (absent-never-null serializer); `renderDocument` "Original" anchor (copyable verbatim URL, `_blank`/`noopener`, branch in title); mock scripted origin-link flow (disjoint trigger — grep-verified vs all other E2E files)
- **Tests:** `uv run pytest --cov=app --cov-report=term-missing` → 3402 passed, `app/` coverage **99%** (>90% gate); `uv run pytest tests/e2e/test_git_source_links.py -v --no-cov` → **4 passed** in isolation; `uv run ruff check .` → clean; `uv run pyright` → 0 errors, 0 warnings
- **Completion criteria:** (1) git read results carry origin/branch, local byte-identical — ✅ (unit pins + E2E control); (2) HIGH `<tools>` rule pinned, LOW byte-identical — ✅; (3) modal AND /document.html show Original link, branch in label when pinned, nothing for local — ✅; (4) full suite green + coverage + E2E + lint/types — ✅; (5) no completed-phase behavior change (read header line 1, mock prefix, done frame/SourceRef untouched, LOW sha) — ✅
- **Extra regression check:** re-ran shared-mock E2E suites `test_read_line_ranges.py` (2 passed) and `test_document_viewer.py` (8 passed) — no cross-suite regressions from the `mock_llm.py` addition
- **Documentation:** README.md reviewed in full (env table ⊇ `.env.example`, pages/routes, config defaults, scripts, 17-color palette, 300 s guard, 2 s sync poll, phase-145 provenance section matches implementation) and AGENTS.md (72rem container, no-CDN test, smoke test, gitignore, gates) — **verified consistent, no changes needed**
- **Notable:** phase-116 screenshot PNG was regenerated during this phase's E2E runs (byte re-encode only, visually identical, correct no-anchor local-source meta row) — left in tree for the harness commit
- **Next pending phase:** `146_search_tool_scope` (then 147, 148, 149)

tests/integration/test_document_content.py

@@ -10,7 +10,13 @@ Uses the real compose Postgres (``db`` fixture) and FastAPI's TestClient:
   tests and the anonymous 403/401 pins build their own client;
 * GET: 404 for an unknown (source, path) pair;
 * GET: 404 for traversal-style ``path`` values (no filesystem access → no
-  leak).
+  leak);
+* GET: phase 145 (task 03) — the payload's git origin fields: a seeded
+  ``kind='git'`` row (URL basename = the fixture source) adds
+  ``origin_url`` (+ ``origin_branch`` for a pinned row); a legacy
+  embedded-credential row is served sanitized (end-to-end); a plain
+  local source keeps the pre-phase key set (both keys ABSENT — never
+  ``null``).
 
 PATCH /api/documents/summary (phase 57, task 01) — the admin summary
 editor, on the same DB-backed fixtures:
@@ -27,6 +33,7 @@ editor, on the same DB-backed fixtures:
 """
 from __future__ import annotations
 
+from collections.abc import Iterator
 from datetime import UTC, datetime
 
 import pytest
@@ -37,7 +44,7 @@ from sqlalchemy.orm import Session
 import app.api.docs as docs_api
 from app.config import get_settings
 from app.main import app as fastapi_app
-from app.models import Chunk, Document
+from app.models import Chunk, Document, GitSource
 from app.rag.llm import EmbeddingError
 from tests.conftest import ADMIN_PASSWORD
 from tests.fakes import FakeEmbedder
@@ -571,6 +578,131 @@ def test_content_format_from_suffix(client, db) -> None:
         db.commit()
 
 
+# ---------------------------------------------------------------------------
+# Phase 145 (task 03) — the content payload's git origin fields
+# (the task-01 resolver's output, end-to-end over the real registry)
+# ---------------------------------------------------------------------------
+
+
+@pytest.fixture()
+def origin_registry(db) -> Iterator[None]:
+    """A FRESH ``git_sources`` table around the origin tests: the
+    resolver reads EVERY ``kind='git'`` row, so a controlled registry
+    is required (truncated before and after — the
+    ``test_agent_tools.py`` registry pattern)."""
+    db.execute(text("TRUNCATE git_sources"))
+    db.commit()
+    yield
+    db.execute(text("TRUNCATE git_sources"))
+    db.commit()
+
+
+def test_content_carries_origin_url_for_a_seeded_git_row(
+    client, db, origin_registry
+) -> None:
+    """A ``kind='git'`` row whose URL basename matches the document's
+    source → the payload carries ``origin_url`` (the sanitized clone
+    URL). The row pins no branch (NULL = the default branch) →
+    ``origin_branch`` is ABSENT from the JSON (not ``null`` — the
+    omission pinned on the wire); every pre-phase key stands."""
+    _seed_doc(db)
+    db.add(GitSource(url="https://github.com/reese/Homelab.git", kind="git"))
+    db.commit()
+    try:
+        r = client.get(
+            "/api/documents/content",
+            params={"source": "Homelab", "path": "kubernetes.md"},
+        )
+        assert r.status_code == 200
+        body = r.json()
+        assert set(body) == {
+            "source", "path", "title", "format", "summary", "created_at",
+            "content", "indexed_at", "chunks", "is_image", "origin_url",
+        }
+        assert body["origin_url"] == "https://github.com/reese/Homelab.git"
+        assert "origin_branch" not in body  # absent — never null
+    finally:
+        db.execute(text("TRUNCATE chunks, documents"))
+        db.commit()
+
+
+def test_content_carries_origin_branch_for_a_pinned_row(
+    client, db, origin_registry
+) -> None:
+    """A pinned row (phase 135 ``branch``) also carries
+    ``origin_branch`` — the value the viewer's title attribute shows."""
+    _seed_doc(db)
+    db.add(
+        GitSource(
+            url="https://github.com/reese/Homelab.git", kind="git", branch="docs"
+        )
+    )
+    db.commit()
+    try:
+        r = client.get(
+            "/api/documents/content",
+            params={"source": "Homelab", "path": "kubernetes.md"},
+        )
+        body = r.json()
+        assert body["origin_url"] == "https://github.com/reese/Homelab.git"
+        assert body["origin_branch"] == "docs"
+    finally:
+        db.execute(text("TRUNCATE chunks, documents"))
+        db.commit()
+
+
+def test_content_origin_is_sanitized_end_to_end(client, db, origin_registry) -> None:
+    """A legacy row whose credential is still embedded in the stored
+    URL never leaks it: the payload carries the phase-121 sanitized
+    URL (the resolver's guarantee, end-to-end — the stored row value
+    is untouched, the output mask does the work)."""
+    _seed_doc(db)
+    db.add(
+        GitSource(url="https://user:tok@example.com/reese/Homelab.git", kind="git")
+    )
+    db.commit()
+    try:
+        r = client.get(
+            "/api/documents/content",
+            params={"source": "Homelab", "path": "kubernetes.md"},
+        )
+        body = r.json()
+        assert body["origin_url"] == "https://example.com/reese/Homelab.git"
+        assert "user:tok" not in r.text  # the credential stays out of the wire
+    finally:
+        db.execute(text("TRUNCATE chunks, documents"))
+        db.commit()
+
+
+def test_content_origin_absent_for_a_plain_local_source(
+    client, db, origin_registry
+) -> None:
+    """No unambiguous git row (a local row is never an origin, and a
+    non-matching git row does not count) → BOTH origin keys ABSENT
+    from the JSON (not ``null`` — the omission pinned on the wire; the
+    payload is byte-identical to pre-phase)."""
+    _seed_doc(db)
+    db.add(GitSource(url="/srv/Homelab", kind="local", path="/srv/Homelab"))
+    db.add(GitSource(url="https://github.com/reese/OtherRepo.git", kind="git"))
+    db.commit()
+    try:
+        r = client.get(
+            "/api/documents/content",
+            params={"source": "Homelab", "path": "kubernetes.md"},
+        )
+        assert r.status_code == 200
+        body = r.json()
+        assert set(body) == {
+            "source", "path", "title", "format", "summary", "created_at",
+            "content", "indexed_at", "chunks", "is_image",
+        }
+        assert "origin_url" not in body
+        assert "origin_branch" not in body
+    finally:
+        db.execute(text("TRUNCATE chunks, documents"))
+        db.commit()
+
+
 def test_content_format_name_token_extensionless(
     client, db, monkeypatch
 ) -> None: