Fix find_remote_for_url matching across path boundaries

target.startswith(remote_base) matched any URL whose host+path happened
to share a leading string with the remote, regardless of path component
boundaries. A remote base https://github.com/myorg therefore matched an
unrelated URL https://github.com/myorg-private/repo, and dfetch add
would attach the wrong remote (and compute a bogus repo-path). Require
either an exact match or a "/" path boundary.

https://claude.ai/code/session_01KKvrvnVvsBChohuxbRRmzA

Author: claude

CHANGELOG.rst

@@ -3,6 +3,7 @@ Release 0.14.1 (unreleased)
 
 * Fix ``dfetch import`` mangling the namespace of a generic VCS URL whose path contains ``.git`` other than as a suffix
 * Fix ``Version`` comparison raising ``AttributeError`` when compared against a non-``Version`` object
+* Fix ``dfetch add`` matching a remote whose base URL is only a string prefix (not a path prefix) of the project URL
 
 Release 0.14.0 (released 2026-06-14)
 ===========================

dfetch/manifest/manifest.py

@@ -592,7 +592,7 @@ def find_remote_for_url(self, remote_url: str) -> Remote | None:
         target = remote_url.rstrip("/")
         for remote in self.remotes:
             remote_base = remote.url.rstrip("/")
-            if target.startswith(remote_base):
+            if target == remote_base or target.startswith(remote_base + "/"):
                 return remote
         return None
 

tests/test_add.py

@@ -151,6 +151,26 @@ def test_determine_remote_returns_none_for_empty_remotes():
     assert result is None
 
 
+def test_determine_remote_requires_path_boundary():
+    """An org-scoped remote must not match a different org sharing its prefix."""
+    m = Mock()
+    m.remotes = [_make_remote("myorg", "https://github.com/myorg")]
+    result = Manifest.find_remote_for_url(
+        m, "https://github.com/myorg-private/repo.git"
+    )
+    assert result is None
+
+
+def test_determine_remote_matches_exact_and_subpath():
+    """The boundary check still matches the remote itself and any URL beneath it."""
+    m = Mock()
+    m.remotes = [_make_remote("myorg", "https://github.com/myorg")]
+    assert Manifest.find_remote_for_url(m, "https://github.com/myorg") is not None
+    assert (
+        Manifest.find_remote_for_url(m, "https://github.com/myorg/repo.git") is not None
+    )
+
+
 # ---------------------------------------------------------------------------
 # Add command – non-interactive
 # ---------------------------------------------------------------------------