fix(cli): resolve list/wait projects by repo URL, not directory name (COR-1577)

[juangaitanv]

Fixes COR-1577. Replaces #122, which grew well past the ticket; this is the fix on its own, and the hardening follows in a stacked PR.

The bug

corgea list and standalone corgea wait derived the project from the working-directory basename and sent it as an exact ?project= match. Where the stored name differs — the Bank of Hope case, directory dotnet-azure-web-tsb vs project bohappdev/dotnet-azure-web-tsb — list --issues and wait exited 1, and plain list silently printed an empty table.

The fix

Resolve the canonical project from the git remote — GET /api/v1/projects?repo_url=<org/repo>, discovered upward from the CWD so a subdirectory works — then query the listing endpoints by the name the backend actually stores.

Three things make it safe on older and partially-onboarded backends:

• The path re-check. The backend filters repo_url__icontains, so a query for acme/api also returns acme/api-v2 and the nested mirrors/acme/api. Every candidate is re-checked against the whole post-host path. The same check guards a pre-COR-1426 backend, which ignores the unknown param and returns all projects: none match, so we fall back instead of listing a stranger's scans.
• The fallback is unchanged behavior. Unconfirmed, the query stays exactly what the pre-COR-1577 CLI sent (determine_project_name), so an old or not-yet-onboarded backend keeps working.
• Empty is no longer silently fine. An unresolved project with no scans errors and names what was tried; a confirmed project with no scans still exits 0, so CI polling is unaffected.

Escape hatches: --project-name queries an exact name and skips resolution entirely; --repo resolves from a given slug or URL instead of the remote. Both are on list and wait.

Also removes the client-side scan.project == cwd_basename filter — the server already filtered, and that pass discarded every resolved scan.

Deliberately not here

Kept out to hold this to the ticket; all of it lands in the stacked follow-up:

• pagination of /projects (page 1 only today — see COR-1729, which would let the CLI drop both the walk and the re-check)
• host disambiguation for the same org/repo on two forges
• hard-vs-soft failure for malformed /projects envelopes
• percent-encoding the project name into /issues (pre-existing)
• --project-id, SCA selector scoping, argument structs

Verification

cargo build, cargo clippy --all-targets (clean), cargo fmt --check, and the full suite under CI=1 GITHUB_ACTIONS=true — 537 tests.

16 new e2e tests cover: the canonical name driving /scans and /issues (asserted on the request the CLI sent, from a checkout named build-123, so a fallback cannot pass); resolution from a subdirectory; --repo; the miss naming the repo with no table; confirmed-empty exiting 0; the legacy fallback name; --project-name skipping resolution; the JSON envelope preceding the miss; --scan-id skipping resolution; and the post-scan corgea scan path resolving nothing.

Size

429 lines of production code (~340 excluding comments and blank lines), 825 of tests.

[corgea-security]

Automated review risk: 4/5.

Five earlier comments are addressed, but two high-priority wait-path defects remain: canonical project links are malformed and explicit scan IDs unnecessarily depend on repository resolution.

Critical or high-priority changes must be addressed.

Automatic approval was not submitted: automated review found critical or high-priority findings.

[corgea-security]

Automated review risk: 4/5.

Core resolution logic is well tested, but two high-priority wait paths remain broken. Earlier resolved comments are addressed by the supplied diff.

Critical or high-priority changes must be addressed.

Automatic approval was not submitted: automated review found critical or high-priority findings.

[cursor]

No actionable findings.

Verified the merge-base diff at b41f553, including every wait::run call site, the list/wait empty and error paths, repository URL normalization and exact-path matching, the /projects response contract, and the new request-target assertions. The latest commit addresses the prior wait-path findings: explicit scan IDs no longer depend on project resolution, and canonical project names are percent-encoded in result links. All prior automation threads are resolved.

Validation passed locally: ./harness test (556 tests), ./harness lint (Clippy and format), and git diff --check. CI is also green across Rust tests and supported build platforms.

  

_{Sent by Cursor Automation: pr-flow}