feat: declare workspace repository in installation config

backend/test/workspace-registry.test.ts

@@ -632,7 +632,11 @@ test("normalizes historical operational state during offline fallback after rest
   rmSync(remote.remote, { recursive: true, force: true });
 
   const restored = new WorkspaceRegistry(config(root, remote.remote));
-  await expect(restored.pull()).resolves.toMatchObject({ degraded: true, head: remote.initialCommit });
+  await expect(restored.pull()).resolves.toMatchObject({
+    degraded: true,
+    head: remote.initialCommit,
+    repository: { host: "local", repository: "configured-repository", transport: "local" },
+  });
   const listed = await restored.list();
   const read = await restored.read("psd-clinical");
   expect(listed[0]).not.toHaveProperty("state");

backend/test/workspaces-git-repository.test.ts

@@ -4,7 +4,11 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import { afterEach, expect, test } from "vitest";
-import { GitWorkspaceRepository, WorkspaceRepositoryLock } from "../src/workspaces/git-repository.js";
+import {
+  GitWorkspaceRepository,
+  WorkspaceRepositoryLock,
+  normalizeRepositoryIdentity,
+} from "../src/workspaces/git-repository.js";
 import type { WorkspaceRegistryConfig } from "../src/workspaces/types.js";
 
 const validYaml = `workspace:
@@ -102,6 +106,28 @@ test("does not expose repository mutation or publication operations", async () =
   expect(repository).not.toHaveProperty("commitAndPush");
 });
 
+test.each([
+  ["https://github.com/aritmolab/workspaces.git", {
+    host: "github.com", repository: "aritmolab/workspaces", transport: "https",
+  }],
+  ["ssh://git@gitlab.example.org/clinical/workspaces.git", {
+    host: "gitlab.example.org", repository: "clinical/workspaces", transport: "ssh",
+  }],
+  ["git@gitea.example.org:clinical/workspaces.git", {
+    host: "gitea.example.org", repository: "clinical/workspaces", transport: "ssh",
+  }],
+] as const)("normalizes the safe repository identity for %s", (remote, expected) => {
+  expect(normalizeRepositoryIdentity(remote)).toEqual(expected);
+});
+
+test.each([
+  "https://user:secret@github.com/aritmolab/workspaces.git",
+  "https://github.com/aritmolab/workspaces.git?token=secret",
+  "ssh://git:secret@gitlab.example.org/clinical/workspaces.git",
+])("rejects a remote that could expose embedded credentials: %s", (remote) => {
+  expect(() => normalizeRepositoryIdentity(remote)).toThrow("Workspace Git remote is invalid");
+});
+
 test("bootstraps a persistent checkout from a local bare repository", async () => {
   const fixture = await temporaryRemote();
   const repository = new GitWorkspaceRepository(config(join(fixture.root, "registry"), fixture.remote));