### Summary Git commands that attempt to reach the remote repository are failing on staging with a 403 error barring the Duo Developer and similar flows from pushing their changes. The error slightly changes based on whether Network isolation via SRT is turned on. It changes again / was able to recover on Friday by setting the remote URL manually. ### Steps to reproduce 1. Set up a group/project in staging and enable foundational flows (or use `https://staging.gitlab.com/dap-flows-test`) 2. Set up an issue or use https://staging.gitlab.com/dap-flows-test/dap-flows-1/-/work_items/1 3. Press the "Generate MR with Duo" button 4. Go into the created session to see reports of git tools failing 5. Go to the linked Job to see more clear 403 errors. ### Examples with Logs Error in the job logs: With Network Isolation ([Job](https://staging.gitlab.com/dap-flows-test/dap-flows-1/-/jobs/143076967)) ``` Error: git command failed with exit code 128: fatal: unable to access 'https://staging.gitlab.com//dap-flows-test/dap-flows-1.git/': Received HTTP code 403 from proxy after CONNECT ``` Without Network Isolation ([Job](https://staging.gitlab.com/dap-flows-test/dap-flows-1/-/jobs/143077389)) ``` Error: git command failed with exit code 128: fatal: unable to access 'https://staging.gitlab.com//dap-flows-test/dap-flows-1.git/': Could not resolve host: staging.gitlab.comhttps ``` After agent decided to run `git remote set-url origin https://staging.gitlab.com/dap-flows-test/dap-flows-1.git/ `: ``` Error: git command failed with exit code 128: remote: You are not allowed to push code to this project. fatal: unable to access 'https://staging.gitlab.com/dap-flows-test/dap-flows-1.git/': The requested URL returned error: 403 ``` On Friday the flow was able to recover via * **Session that did recover** * [Session](https://staging.gitlab.com/kpalchyk-2026-01-07-demo/publications/-/automate/agent-sessions/2001595) * [Job](https://staging.gitlab.com/kpalchyk-2026-01-07-demo/publications/-/jobs/143054195) * [LangSMith](https://smith.langchain.com/o/477de7ad-583e-47b6-a1c4-c4a0300e7aca/projects/p/2919c60c-5d75-4bd5-8a96-f13e75b9cec8?columnVisibilityModel_runs%3AcolumnVisibilityModel%3Adefault=%7B%22feedback_stats%22%3Afalse%2C%22reference_example%22%3Afalse%2C%22reference_example_id%22%3Afalse%2C%22tags%22%3Afalse%2C%22first_token_time%22%3Afalse%2C%22total_cost%22%3Atrue%2C%22total_tokens%22%3Atrue%2C%22last_queued_at%22%3Afalse%2C%22latency%22%3Atrue%2C%22in_dataset%22%3Afalse%2C%22error%22%3Afalse%2C%22outputs%22%3Afalse%2C%22inputs%22%3Atrue%2C%22start_time%22%3Atrue%2C%22metadata%22%3Afalse%7D&timeModel=%7B%22duration%22%3A%227d%22%7D&searchModel=%7B%22filter%22%3A%22and%28eq%28is_root%2C+true%29%2C+and%28eq%28metadata_key%2C+%5C%22workflow_type%5C%22%29%2C+eq%28metadata_value%2C+%5C%22developer%5C%22%29%29%29%22%7D&peek=21e178f7-dbc1-4dc3-af16-8b0240a7a447&peeked_trace=23480e97-8045-4fc1-b565-764d3743d7de) * **Session that did not recover** * [Session](https://staging.gitlab.com/dap-flows-test/dap-flows-1/-/automate/agent-sessions/2001693) * [Job](https://staging.gitlab.com/dap-flows-test/dap-flows-1/-/jobs/143070567) * [Langsmith](https://smith.langchain.com/o/477de7ad-583e-47b6-a1c4-c4a0300e7aca/projects/p/2919c60c-5d75-4bd5-8a96-f13e75b9cec8?timeModel=%7B%22duration%22%3A%227d%22%7D&searchModel=%7B%22filter%22%3A%22and%28eq%28metadata_key%2C+%5C%22thread_id%5C%22%29%2C+eq%28metadata_value%2C+%5C%222001693%5C%22%29%29%22%7D&peek=7857a74b-ccf1-4d2a-8427-1995f337f73b&peeked_trace=9f89b8cc-ab4e-4614-aa11-849495fe3a18) ## State of Investigation 1. The last error after `git remote set-url` is the same one as was fixed for Self-Managed by https://gitlab.com/gitlab-org/gitlab/-/merge_requests/217964, pointing to an auth issue, potentially this could be completely fixed now since https://gitlab.com/gitlab-org/gitlab/-/merge_requests/217964 was not merged the last time the agent decided to use this approach 2. The URL in the errors with Network Isolation contains a double slash `//` after the staging.gitlab.com, and the error without Network isolation also points to an issue with the url since it is trying to resolve a host of `staging.gitlab.comhttps` 3. We had problems with malformed urls specifically for staging/sub-domains in https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/merge_requests/2585 ## Next steps 1. Change Duo Developer to experimental in staging and make it run `git remote set-url origin` to see whether this can solve or at least change the error. 2. Investigate the Language Server to understand what can cause the double slash. Investigation issue created by Duo: https://gitlab.com/gitlab-org/editor-extensions/gitlab-lsp/-/work_items/1897