fix(desktop): restore artifacts grid views and multi-repo tasks clobbered by canvas port

.dockerignore

@@ -3,7 +3,6 @@
 !.devcontainer
 !.kearc
 !bin
-!common/alerting
 !common/hogvm
 !common/esbuilder
 !common/migration_utils

products/desktop/packages/agent/src/server/agent-server.ts

@@ -1575,7 +1575,9 @@ export class AgentServer {
         return null;
       }),
     ]);
-    this.taskRepositories = preTask?.repository ? [preTask.repository] : [];
+    this.taskRepositories =
+      preTask?.repositories ??
+      (preTask?.repository ? [preTask.repository] : []);
 
     this.prewarmedRun =
       (preTaskRun?.state as Record<string, unknown> | undefined)?.prewarmed ===

products/desktop/packages/api-client/src/task-normalization.test.ts

@@ -112,4 +112,25 @@ describe("task response normalization", () => {
       },
     });
   });
+
+  // Multi-repo handoff and cloud-run instructions read task.repositories, so
+  // dropping this fallback silently degrades every consumer to single-repo.
+  it.each([
+    [
+      "keeps the API's repositories list",
+      { repository: "posthog/posthog", repositories: ["a/b", "c/d"] },
+      ["a/b", "c/d"],
+    ],
+    [
+      "wraps a lone repository",
+      { repository: "posthog/posthog" },
+      ["posthog/posthog"],
+    ],
+    ["defaults to empty", {}, []],
+  ])("populates repositories (%s)", (_label, dto, expected) => {
+    expect(
+      normalizeTaskResponse({ id: "task-1", ...dto }, { teamId: 1 })
+        .repositories,
+    ).toEqual(expected);
+  });
 });

products/desktop/packages/api-client/src/task-normalization.ts

@@ -190,6 +190,7 @@ export function normalizeTaskResponse(
     ...(dto.created_by === undefined ? {} : { created_by: dto.created_by }),
     origin_product: dto.origin_product ?? "",
     ...(dto.repository === undefined ? {} : { repository: dto.repository }),
+    repositories: dto.repositories ?? (dto.repository ? [dto.repository] : []),
     ...(dto.github_integration === undefined
       ? {}
       : { github_integration: dto.github_integration }),

products/desktop/packages/core/src/sessions/localHandoffService.test.ts

@@ -194,7 +194,43 @@ describe("LocalHandoffService.start", () => {
     );
   });
 
-  // A task's repository is team-writable via the API, so an unsafe entry must
+  it("reuses local repositories and clones missing ones before handoff", async () => {
+    const deps = makeDeps();
+    const multiRepoTask = {
+      repositories: ["posthog/posthog", "posthog/posthog-js"],
+    } as Task;
+    deps.host.getRepositoryByRemoteUrl = vi
+      .fn()
+      .mockResolvedValueOnce({ path: "/repos/posthog" })
+      .mockResolvedValueOnce(null);
+    deps.sessionService.preflightToLocal.mockResolvedValue({
+      canHandoff: true,
+    });
+
+    await deps.service.start("task-1", multiRepoTask);
+
+    expect(deps.host.cloneRepository).toHaveBeenCalledWith(
+      expect.objectContaining({
+        repoUrl: "https://github.com/posthog/posthog-js.git",
+        targetPath: "/worktrees/linked-repositories/posthog/posthog-js",
+      }),
+    );
+    expect(deps.host.addAdditionalDirectory).toHaveBeenCalledWith({
+      taskId: "task-1",
+      path: "/worktrees/linked-repositories/posthog/posthog-js",
+    });
+    expect(deps.sessionService.handoffToLocal).toHaveBeenCalledWith(
+      "task-1",
+      "/repos/posthog",
+      {
+        "posthog/posthog": "/repos/posthog",
+        "posthog/posthog-js":
+          "/worktrees/linked-repositories/posthog/posthog-js",
+      },
+    );
+  });
+
+  // A task's repositories are team-writable via the API, so an unsafe entry must
   // never reach `git clone` (RCE via git's remote-ext transport) or escape the
   // clone root through path traversal. The safe repo alongside it still clones.
   it.each([
@@ -210,12 +246,44 @@ describe("LocalHandoffService.start", () => {
       canHandoff: true,
     });
 
-    await deps.service.start("task-1", { repository: malicious } as Task);
+    await deps.service.start("task-1", {
+      repositories: ["posthog/posthog", malicious],
+    } as Task);
 
-    expect(deps.host.cloneRepository).not.toHaveBeenCalled();
+    // Only the safe repo is cloned, and always through an explicit https URL.
+    expect(deps.host.cloneRepository).toHaveBeenCalledTimes(1);
+    expect(deps.host.cloneRepository).toHaveBeenCalledWith(
+      expect.objectContaining({
+        repoUrl: "https://github.com/posthog/posthog.git",
+      }),
+    );
     expect(deps.notifier.warn).toHaveBeenCalledWith(
       expect.stringContaining(malicious),
     );
-    expect(deps.sessionService.handoffToLocal).not.toHaveBeenCalled();
+    const [, , repositoryPaths] =
+      deps.sessionService.handoffToLocal.mock.calls[0];
+    expect(repositoryPaths).toEqual({
+      "posthog/posthog": "/worktrees/linked-repositories/posthog/posthog",
+    });
+  });
+
+  it("de-duplicates case-variant repository aliases before cloning", async () => {
+    const deps = makeDeps();
+    deps.host.getRepositoryByRemoteUrl = vi.fn().mockResolvedValue(null);
+    deps.sessionService.preflightToLocal.mockResolvedValue({
+      canHandoff: true,
+    });
+
+    await deps.service.start("task-1", {
+      repositories: ["PostHog/PostHog", "posthog/posthog"],
+    } as Task);
+
+    // Both collapse to one target, so the racing double-clone can't happen.
+    expect(deps.host.cloneRepository).toHaveBeenCalledTimes(1);
+    const [, , repositoryPaths] =
+      deps.sessionService.handoffToLocal.mock.calls[0];
+    expect(repositoryPaths).toEqual({
+      "posthog/posthog": "/worktrees/linked-repositories/posthog/posthog",
+    });
   });
 });

products/desktop/packages/core/src/sessions/localHandoffService.ts

@@ -132,7 +132,11 @@ export class LocalHandoffService {
 
   public async start(taskId: string, task: Task): Promise<void> {
     try {
-      const repositories = task.repository ? [task.repository] : [];
+      const repositories = task.repositories?.length
+        ? task.repositories
+        : task.repository
+          ? [task.repository]
+          : [];
       const repositoryPaths = await this.resolveRepositoryPaths(repositories);
       const paths = Object.values(repositoryPaths);
       const targetPath =

products/desktop/packages/shared/src/domain-types.ts

@@ -81,6 +81,7 @@ export interface Task {
   created_by?: UserBasic | null;
   origin_product: string;
   repository?: string | null; // Format: "organization/repository" (e.g., "posthog/posthog-js")
+  repositories?: string[];
   github_integration?: number | null;
   github_user_integration?: string | null;
   json_schema?: Record<string, unknown> | null;