fix: reject plain HTTP repository sources

web/workspace/src/lib/generated/workspace-api.ts

@@ -237,7 +237,6 @@ export type RepositorySourceKind =
   | "local_path"
   | "file"
   | "ssh"
-  | "http"
   | "https"
   | "invalid";
 

web/workspace/src/lib/workspace/api/workspace-model.ts

@@ -56,7 +56,6 @@ const SOURCE_KINDS = new Set<RepositorySourceKind>([
   "local_path",
   "file",
   "ssh",
-  "http",
   "https",
   "invalid",
 ]);

web/workspace/src/routes/w/[workspaceId]/settings/repositories/+page.svelte

@@ -13,7 +13,7 @@
   }
 
   function supportsRepositoryAccess(kind: RepositorySourceKind): boolean {
-    return kind === 'ssh' || kind === 'http' || kind === 'https';
+    return kind === 'ssh' || kind === 'https';
   }
   let showAddRepository = $state(false);
   let repositoryKey = $state('');

web/workspace/tests/workspace-model.test.ts

@@ -47,6 +47,19 @@ Deno.test("generated repository wrapper validates current Backend JSON", () => {
   }
 });
 
+Deno.test("plain HTTP repository source kind fails closed at the JSON boundary", () => {
+  const stale = structuredClone(repositoryList) as Record<string, unknown>;
+  const items = stale.items as Array<Record<string, unknown>>;
+  items[0].source = {
+    kind: "http",
+    uri: "http://git.example.test/team/project.git",
+  };
+  assertThrows(
+    () => parseRepositoryListResponse(stale),
+    ".source.kind is invalid",
+  );
+});
+
 Deno.test("stale repository aliases fail closed at the JSON boundary", () => {
   const stale = structuredClone(repositoryList) as Record<string, unknown>;
   const items = stale.items as Array<Record<string, unknown>>;
@@ -242,6 +255,15 @@ Deno.test("Repository settings consume the validated shared wire shape", async (
       throw new Error(`Repository settings should include ${token}`);
     }
   }
+  for (const kind of ["ssh", "https"]) {
+    if (!pageSource.includes(`kind === '${kind}'`)) {
+      throw new Error(`Repository Access should support ${kind}`);
+    }
+  }
+  if (pageSource.includes("kind === 'http'")) {
+    throw new Error("Repository Access must not support plain HTTP sources");
+  }
+
   for (
     const staleToken of [
       "repository.id",