From d9533032bcdc77b1006132b3540aea65ebfe39c5 Mon Sep 17 00:00:00 2001
From: Chris Wanstrath <chris@ozmm.org>
Date: Sun, 8 Mar 2026 23:26:12 -0700
Subject: [PATCH] Use git URL from tunnel if available

---
 apps/git/index.tsx         | 13 +++++++++++--
 src/cli/commands/manage.ts |  4 ++--
 src/cli/http.ts            |  8 ++++++--
 3 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/apps/git/index.tsx b/apps/git/index.tsx
index f8dfdc4..60fbb79 100644
--- a/apps/git/index.tsx
+++ b/apps/git/index.tsx
@@ -641,8 +641,13 @@ app.on('GET', ['/:repo{.+\\.git}/info/refs', '/:repo/info/refs'], async c => {
     return c.text('Invalid service', 400)
   }
 
-  if (service === 'git-receive-pack' && c.req.header('x-sneaker')) {
-    return c.text('Push access denied over sneaker', 403)
+  if (c.req.header('x-sneaker')) {
+    if (service === 'git-receive-pack') {
+      return c.text('Push access denied over sneaker', 403)
+    }
+    if (await getVisibility(repoParam) !== 'public') {
+      return c.text('Repository not found', 404)
+    }
   }
 
   if (service === 'git-receive-pack') {
@@ -666,6 +671,10 @@ app.on('POST', ['/:repo{.+\\.git}/git-upload-pack', '/:repo/git-upload-pack'], a
     return c.text('Invalid repository name', 400)
   }
 
+  if (c.req.header('x-sneaker') && await getVisibility(repoParam) !== 'public') {
+    return c.text('Repository not found', 404)
+  }
+
   const bare = repoPath(repoParam)
   if (!(await dirExists(bare))) {
     return c.text('Repository not found', 404)
diff --git a/src/cli/commands/manage.ts b/src/cli/commands/manage.ts
index d6720ab..1735229 100644
--- a/src/cli/commands/manage.ts
+++ b/src/cli/commands/manage.ts
@@ -179,7 +179,7 @@ export async function newApp(name: string | undefined, options: NewAppOptions) {
   await run(['git', 'init'])
   await run(['git', 'add', '.'])
   await run(['git', 'commit', '-m', 'init'])
-  await run(['git', 'remote', 'add', 'toes', gitUrl(appName)])
+  await run(['git', 'remote', 'add', 'toes', await gitUrl(appName)])
   await run(['git', 'push', 'toes', 'main'])
 
   console.log(color.green(`✓ Created ${appName}`))
@@ -196,7 +196,7 @@ export async function getApp(name: string, directory?: string) {
     return
   }
 
-  const url = gitUrl(name)
+  const url = await gitUrl(name)
   const args = ['git', 'clone', url]
   if (directory) args.push(directory)
   const proc = Bun.spawn(args, { stdout: 'inherit', stderr: 'inherit' })
diff --git a/src/cli/http.ts b/src/cli/http.ts
index 6a15200..3911000 100644
--- a/src/cli/http.ts
+++ b/src/cli/http.ts
@@ -1,4 +1,4 @@
-import type { Manifest } from '@types'
+import type { App, Manifest } from '@types'
 import { buildAppUrl } from '@urls'
 import { AsyncLocalStorage } from 'node:async_hooks'
 
@@ -21,7 +21,11 @@ export const HOST = process.env.TOES_URL
   ? normalizeUrl(process.env.TOES_URL)
   : DEFAULT_HOST
 
-export const gitUrl = (name: string) => `${buildAppUrl('git', HOST)}/${name}`
+export async function gitUrl(name: string): Promise<string> {
+  const git: App | undefined = await get('/api/apps/git')
+  if (git?.tunnelUrl) return `${git.tunnelUrl}/${name}`
+  return `${buildAppUrl('git', HOST)}/${name}`
+}
 
 export const getSignal = () => signalStore.getStore()