fix: extract fragment from SCP-style git URLs

giturls.Parse doesn't handle fragments (#branch) in SCP-style URLs
like git@github.com:user/repo.git#branch. This adds ExtractFragment()
to manually extract the fragment before parsing, enabling branch/commit
selection for SSH URLs.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: hext-dev

git/git.go

@@ -43,13 +43,30 @@ type CloneRepoOptions struct {
 	ProxyOptions transport.ProxyOptions
 }
 
+// ExtractFragment extracts a #fragment from a URL string before parsing.
+// This is needed because giturls.Parse doesn't handle fragments in SCP-style
+// URLs (e.g., git@github.com:user/repo.git#branch).
+func ExtractFragment(rawURL string) (urlWithoutFragment, fragment string) {
+	// Only split on # if it appears after the host/path portion.
+	// For SCP-style URLs (git@host:path), # is never part of the valid URL.
+	// For standard URLs, # marks the fragment.
+	if idx := strings.LastIndex(rawURL, "#"); idx != -1 {
+		return rawURL[:idx], rawURL[idx+1:]
+	}
+	return rawURL, ""
+}
+
 // CloneRepo will clone the repository at the given URL into the given path.
 // If a repository is already initialized at the given path, it will not
 // be cloned again.
 //
 // The bool returned states whether the repository was cloned or not.
 func CloneRepo(ctx context.Context, logf func(string, ...any), opts CloneRepoOptions) (bool, error) {
-	parsed, err := giturls.Parse(opts.RepoURL)
+	// Extract fragment before parsing, as giturls.Parse doesn't handle
+	// fragments in SCP-style URLs (git@github.com:user/repo.git#branch).
+	repoURL, manualFragment := ExtractFragment(opts.RepoURL)
+
+	parsed, err := giturls.Parse(repoURL)
 	if err != nil {
 		return false, fmt.Errorf("parse url %q: %w", opts.RepoURL, err)
 	}
@@ -92,7 +109,11 @@ func CloneRepo(ctx context.Context, logf func(string, ...any), opts CloneRepoOpt
 	if err != nil {
 		return false, fmt.Errorf("mkdir %q: %w", opts.Path, err)
 	}
-	reference := parsed.Fragment
+	// Use manually extracted fragment (for SCP-style URLs) or parsed fragment
+	reference := manualFragment
+	if reference == "" {
+		reference = parsed.Fragment
+	}
 	if reference == "" && opts.SingleBranch {
 		// When SingleBranch is true and no branch is specified, don't set a
 		// default. go-git will automatically detect and use the remote's HEAD

git/git_test.go

@@ -27,6 +27,76 @@ import (
 	gossh "golang.org/x/crypto/ssh"
 )
 
+func TestExtractFragment(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name             string
+		input            string
+		expectedURL      string
+		expectedFragment string
+	}{
+		{
+			name:             "HTTPS with branch",
+			input:            "https://github.com/user/repo#main",
+			expectedURL:      "https://github.com/user/repo",
+			expectedFragment: "main",
+		},
+		{
+			name:             "HTTPS with refs/heads",
+			input:            "https://github.com/user/repo#refs/heads/feature",
+			expectedURL:      "https://github.com/user/repo",
+			expectedFragment: "refs/heads/feature",
+		},
+		{
+			name:             "HTTPS with commit",
+			input:            "https://github.com/user/repo#a1b2c3d",
+			expectedURL:      "https://github.com/user/repo",
+			expectedFragment: "a1b2c3d",
+		},
+		{
+			name:             "HTTPS no fragment",
+			input:            "https://github.com/user/repo",
+			expectedURL:      "https://github.com/user/repo",
+			expectedFragment: "",
+		},
+		{
+			name:             "SCP-style with branch",
+			input:            "git@github.com:user/repo.git#main",
+			expectedURL:      "git@github.com:user/repo.git",
+			expectedFragment: "main",
+		},
+		{
+			name:             "SCP-style with refs/heads",
+			input:            "git@github.com:user/repo.git#refs/heads/feature",
+			expectedURL:      "git@github.com:user/repo.git",
+			expectedFragment: "refs/heads/feature",
+		},
+		{
+			name:             "SCP-style no fragment",
+			input:            "git@github.com:user/repo.git",
+			expectedURL:      "git@github.com:user/repo.git",
+			expectedFragment: "",
+		},
+		{
+			name:             "SSH URL with branch",
+			input:            "ssh://git@github.com/user/repo.git#main",
+			expectedURL:      "ssh://git@github.com/user/repo.git",
+			expectedFragment: "main",
+		},
+	}
+
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			url, fragment := git.ExtractFragment(tc.input)
+			require.Equal(t, tc.expectedURL, url)
+			require.Equal(t, tc.expectedFragment, fragment)
+		})
+	}
+}
+
 func TestCloneRepo(t *testing.T) {
 	t.Parallel()