fix: guard remote/repo mismatch vs local git remote (Closes #530)

Merge PR #555 — remote/repo mismatch guard vs local git remote (Closes #530).

gitea_mcp_server.py

@@ -748,6 +748,7 @@ import merge_approval_gate  # noqa: E402
 import already_landed_reconcile  # noqa: E402
 import author_mutation_worktree  # noqa: E402
 import root_checkout_guard  # noqa: E402
+import remote_repo_guard  # noqa: E402
 import issue_claim_heartbeat  # noqa: E402
 import issue_work_duplicate_gate  # noqa: E402
 import reviewer_pr_lease  # noqa: E402
@@ -1162,11 +1163,49 @@ def _resolve(remote: str, host: str | None, org: str | None, repo: str | None):
     if remote not in REMOTES:
         raise ValueError(f"Unknown remote '{remote}'. Choose from: {list(REMOTES)}")
     profile = REMOTES[remote]
-    return (
-        host or profile["host"],
-        org or profile["org"],
-        repo or profile["repo"],
+    resolved_host = host or profile["host"]
+    resolved_org = org or profile["org"]
+    resolved_repo = repo or profile["repo"]
+    _enforce_remote_repo_guard(
+        remote,
+        resolved_org,
+        resolved_repo,
+        org_explicit=org is not None,
+        repo_explicit=repo is not None,
     )
+    return (resolved_host, resolved_org, resolved_repo)
+
+
+def _enforce_remote_repo_guard(
+    remote: str,
+    resolved_org: str,
+    resolved_repo: str,
+    *,
+    org_explicit: bool,
+    repo_explicit: bool,
+) -> None:
+    """Fail closed on a remote/repo mismatch vs. the local git remote (#530).
+
+    Best-effort: bypassed under pytest unless ``GITEA_FORCE_REMOTE_REPO_CHECK`` is
+    set, so the unit suite (which calls tools with bare remotes against mocked APIs)
+    is unaffected. In production it protects every read/lookup/mutation tool because
+    they all resolve targets through :func:`_resolve`.
+    """
+    if "pytest" in sys.modules and not os.environ.get(
+        "GITEA_FORCE_REMOTE_REPO_CHECK"
+    ):
+        return
+    local_remote_url = _local_git_remote_url(remote)
+    assessment = remote_repo_guard.assess_remote_repo_match(
+        remote=remote,
+        resolved_org=resolved_org,
+        resolved_repo=resolved_repo,
+        local_remote_url=local_remote_url,
+        org_explicit=org_explicit,
+        repo_explicit=repo_explicit,
+    )
+    if assessment["block"]:
+        raise RuntimeError(remote_repo_guard.format_remote_repo_guard_error(assessment))
 
 
 def _auth(host: str) -> str: