collavre_github 0.6.3 → 0.7.0

data/app/services/collavre_github/repository_provisioning_lock.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+require "digest"
+require "monitor"
+
+module CollavreGithub
+  # Serializes link persistence and remote webhook mutation for one stable
+  # GitHub repository identity. Without this boundary, two creatives attaching
+  # a previously unseen repository can each provision from an uncommitted link
+  # and publish different secrets (or create duplicate hooks).
+  class RepositoryProvisioningLock
+    LOCK_PURPOSE = "collavre_github:repository_provisioning".freeze
+
+    @mutex_registry_guard = Mutex.new
+    @mutex_registry = {}
+
+    class << self
+      def with_lock(repository_id, &block)
+        key = repository_id.to_s
+        raise ArgumentError, "repository_id is required" if key.blank?
+
+        with_key_lock(key, &block)
+      end
+
+      def with_repository_name_lock(full_name, &block)
+        normalized_name = full_name.to_s.downcase
+        raise ArgumentError, "repository full name is required" if normalized_name.blank?
+
+        with_key_lock("name:#{normalized_name}", &block)
+      end
+
+      private
+
+      def with_key_lock(key, &block)
+        if postgres?
+          with_postgres_lock(key, &block)
+        else
+          # SQLite is used by tests and the single-process desktop app. Its
+          # adapter has no advisory-lock primitive, so use the process boundary.
+          with_process_lock(key, &block)
+        end
+      end
+
+      def postgres?
+        CollavreGithub::RepositoryLink.connection.adapter_name.casecmp?("PostgreSQL")
+      end
+
+      def with_postgres_lock(key)
+        CollavreGithub::RepositoryLink.connection_pool.with_connection do |connection|
+          advisory_key = advisory_lock_key(key)
+          # Schedule the matching unlock before asking PostgreSQL to acquire.
+          # If an asynchronous exception lands after PostgreSQL grants the lock
+          # but before the adapter returns, the ensure still releases it rather
+          # than returning a locked session to the connection pool.
+          unlock_required = true
+          connection.select_value("SELECT pg_advisory_lock(#{connection.quote(advisory_key)})")
+          yield
+        ensure
+          if unlock_required
+            connection.select_value("SELECT pg_advisory_unlock(#{connection.quote(advisory_key)})")
+          end
+        end
+      end
+
+      def advisory_lock_key(key)
+        Digest::SHA256.digest("#{LOCK_PURPOSE}:#{key}").unpack1("q>")
+      end
+
+      def with_process_lock(key)
+        mutex = register_mutex(key)
+        mutex.synchronize { yield }
+      ensure
+        unregister_mutex(key, mutex) if mutex
+      end
+
+      def register_mutex(key)
+        @mutex_registry_guard.synchronize do
+          entry = (@mutex_registry[key] ||= { mutex: Monitor.new, users: 0 })
+          entry[:users] += 1
+          entry[:mutex]
+        end
+      end
+
+      def unregister_mutex(key, mutex)
+        @mutex_registry_guard.synchronize do
+          entry = @mutex_registry[key]
+          return unless entry && entry[:mutex].equal?(mutex)
+
+          entry[:users] -= 1
+          @mutex_registry.delete(key) if entry[:users].zero?
+        end
+      end
+    end
+  end
+end

data/app/services/collavre_github/tools/concerns/pr_channel_locator.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module CollavreGithub
+  module Tools
+    module Concerns
+      # Shared PR-URL parsing and channel lookup for the PR-channel tools
+      # (pr_monitor attaches, pr_state_set corrects). Both must agree on how a
+      # URL maps to a stored channel or a state correction would silently miss
+      # the very channel the monitor created.
+      module PrChannelLocator
+        extend ActiveSupport::Concern
+
+        PR_URL_RE = %r{\Ahttps?://github\.com/([^/]+/[^/]+)/pull/(\d+)\z}.freeze
+
+        private
+
+        # GitHub owner/repo identifiers are case-insensitive but webhook
+        # payloads always carry the canonical case. Normalize on parse so user
+        # input like "Owner/Repo" still matches incoming events.
+        #
+        # @return [[String, Integer]] downcased repo full name and PR number
+        def parse_pr_url(pr_url)
+          m = pr_url.to_s.match(PR_URL_RE)
+          raise ArgumentError, "Invalid PR URL: #{pr_url}" unless m
+
+          [ m[1].downcase, m[2].to_i ]
+        end
+
+        # Ruby-level compare instead of a WHERE: legacy rows can carry
+        # mixed-case repo names, and the dispatch path matches the same way.
+        def lookup_channel(topic, repo, pr_number)
+          CollavreGithub::GithubPrChannel.where(topic_id: topic.id).find do |c|
+            c.repo_full_name.to_s.downcase == repo.downcase && c.pr_number == pr_number
+          end
+        end
+
+        # Creatives whose RepositoryLinks govern this topic: the topic's own
+        # creative plus its ancestors. Mirrors pr_monitor's provisioning scope,
+        # so a tool can never reach a GitHub account the monitor itself could
+        # not have used.
+        def scoped_creative_ids(topic)
+          creative = topic.creative
+          return [] unless creative
+
+          [ creative.id ] + creative.ancestors.pluck(:id)
+        end
+      end
+    end
+  end
+end

data/app/services/collavre_github/tools/pr_monitor_service.rb

@@ -8,14 +8,14 @@ module CollavreGithub
     class PrMonitorService
       extend T::Sig
       extend ToolMeta
-
-      PR_URL_RE = %r{\Ahttps?://github\.com/([^/]+/[^/]+)/pull/(\d+)\z}.freeze
+      include Concerns::PrChannelLocator
 
       tool_name "pr_monitor"
       tool_description <<~DESC.strip
         Attach a GitHub PR monitor to a Collavre topic. After attachment,
         PR comments, review comments, and review submissions are injected
-        into the topic as chat messages. Idempotent.
+        into the topic as chat messages. The response identifies the attached
+        topic and creative and uses a typed channel reference. Idempotent.
       DESC
 
       tool_param :topic_id, description: "The Collavre topic id to attach the PR channel to."
@@ -23,13 +23,7 @@ module CollavreGithub
 
       sig { params(topic_id: Integer, pr_url: String).returns(T::Hash[Symbol, T.untyped]) }
       def call(topic_id:, pr_url:)
-        m = pr_url.match(PR_URL_RE)
-        raise ArgumentError, "Invalid PR URL: #{pr_url}" unless m
-        # GitHub owner/repo identifiers are case-insensitive but webhook payloads
-        # always carry the canonical case. Normalize on store so user input
-        # like "Owner/Repo" still matches incoming events.
-        repo = m[1].downcase
-        pr_number = m[2].to_i
+        repo, pr_number = parse_pr_url(pr_url)
 
         topic = Collavre::Topic.find(topic_id)
         Collavre::Tools::TopicAuthorizer.authorize_write!(topic)
@@ -41,7 +35,14 @@ module CollavreGithub
           channel.inject_into_topic!(channel.attached_message)
         end
 
-        result = { ok: true, channel_id: channel.id, repo: repo, pr_number: pr_number }
+        result = {
+          ok: true,
+          channel_ref: "ch_#{channel.id}",
+          topic: { id: topic.id, name: topic.name },
+          creative: { id: topic.creative.id, title: topic.creative.creative_snippet },
+          repo: repo,
+          pr_number: pr_number
+        }
         warning = ensure_webhook_events(topic, repo)
         result[:webhook_warning] = warning if warning
         result
@@ -70,13 +71,6 @@ module CollavreGithub
         )
       end
 
-      sig { params(topic: Collavre::Topic, repo: String, pr_number: Integer).returns(T.nilable(CollavreGithub::GithubPrChannel)) }
-      def lookup_channel(topic, repo, pr_number)
-        CollavreGithub::GithubPrChannel.where(topic_id: topic.id).find do |c|
-          c.repo_full_name.to_s.downcase == repo.downcase && c.pr_number == pr_number
-        end
-      end
-
       # Make sure the repo's webhook subscribes to the PR-channel events
       # (issue_comment / pull_request_review / pull_request_review_comment).
       # Without these, GitHub never delivers comment payloads and the channel
@@ -84,62 +78,87 @@ module CollavreGithub
       # Returns a warning string when provisioning cannot run or fails; nil on
       # success so the MCP response stays clean.
       def ensure_webhook_events(topic, repo)
-        scoped_link = scoped_repository_link_for(topic, repo)
-        return "no RepositoryLink found for #{repo} in topic creative scope; webhook events not auto-provisioned" unless scoped_link
-
-        # Provision through the *global* primary link (lowest id across all
-        # creatives), not the scoped link. WebhookProvisioner only patches hook
-        # events when the link IS the primary; non-primary links short-circuit
-        # to secret alignment and skip the GitHub edit_hook call. So if we
-        # provisioned the scoped link and it was not the global primary, the
-        # existing hook would keep its old event list. The scoped link is only
-        # used as an authorization gate above.
-        provisioning_link = global_primary_repository_link_for(repo) || scoped_link
-
-        account = provisioning_link.github_account
-        return "RepositoryLink for #{repo} has no GitHub account; webhook events not auto-provisioned" unless account
-
-        results = CollavreGithub::WebhookProvisioner.ensure_for_links(
-          account: account,
-          links: [ provisioning_link ],
-          webhook_url: github_webhook_url
-        )
-        status = results.first&.last
-        # :failed means Client returned nil (Octokit/Faraday error rescued in
-        # CollavreGithub::Client). Surface that to the MCP caller so they know
-        # webhook events were not actually patched.
-        return "webhook provisioning failed: GitHub API rejected the hook request (see logs)" if status == :failed
-        nil
+        scoped_repository_ids(topic, repo).each do |repository_id|
+          outcome = CollavreGithub::RepositoryProvisioningLock.with_lock(repository_id) do
+            scoped_links = verified_scoped_repository_links_for(
+              topic,
+              repo,
+              repository_id: repository_id
+            )
+            next :unverified if scoped_links.empty?
+
+            all_failed = scoped_links.all? do |scoped_link|
+              results = CollavreGithub::WebhookProvisioner.ensure_for_links(
+                account: scoped_link.github_account,
+                links: [ scoped_link ],
+                webhook_url: github_webhook_url,
+                force_hook_refresh: true
+              )
+              results.first&.last == :failed
+            end
+            if all_failed
+              "webhook provisioning failed: GitHub API rejected the hook request (see logs)"
+            end
+          end
+          next if outcome == :unverified
+
+          # A nil outcome means a verified hook was refreshed successfully.
+          # :shared is also success: the registered hook was patched before
+          # WebhookProvisioner returned that status.
+          return outcome
+        end
+
+        "no verified RepositoryLink found for #{repo} in topic creative scope; " \
+          "webhook events not auto-provisioned"
       rescue => e
         Rails.logger.warn("[pr_monitor] webhook provisioning failed for #{repo}: #{e.class}: #{e.message}")
         "webhook provisioning failed: #{e.message}"
       end
 
-      # Authorization gate: a RepositoryLink for `repo` must live in this
-      # topic's creative subtree (the topic creative itself or one of its
-      # ancestors). Without one, the dispatch path in WebhooksController would
-      # silently drop events for this topic anyway.
-      def scoped_repository_link_for(topic, repo)
-        creative = topic.creative
-        return nil unless creative
+      def scoped_repository_ids(topic, repo)
+        candidate_ids = scoped_creative_ids(topic)
+        return [] if candidate_ids.empty?
 
-        candidate_ids = [ creative.id ] + creative.ancestors.pluck(:id)
         CollavreGithub::RepositoryLink
           .where("LOWER(repository_full_name) = ?", repo.downcase)
           .where(creative_id: candidate_ids)
-          .order(:id)
-          .first
+          .where.not(repository_id: nil)
+          .distinct
+          .pluck(:repository_id)
       end
 
-      # Mirrors WebhookProvisioner#primary_link_for: the lowest-id link for the
-      # repo across ALL creatives. This is the link whose secret + events the
-      # hook is aligned to, so we must provision through it to trigger an
-      # actual edit_hook call.
-      def global_primary_repository_link_for(repo)
-        CollavreGithub::RepositoryLink
+      # Authorization and identity gate: a RepositoryLink for `repo` must live
+      # in this topic's creative subtree, carry a stable repository id, and
+      # resolve to that same id through its GitHub account. A stored name alone
+      # is not safe provisioning evidence because GitHub can reuse a renamed
+      # repository's old name.
+      def verified_scoped_repository_links_for(topic, repo, repository_id:)
+        candidate_ids = scoped_creative_ids(topic)
+        return [] if candidate_ids.empty?
+
+        candidates = CollavreGithub::RepositoryLink
           .where("LOWER(repository_full_name) = ?", repo.downcase)
+          .where(creative_id: candidate_ids)
+          .where(repository_id: repository_id)
           .order(:id)
-          .first
+          .to_a
+        identities = {}
+
+        candidates.uniq(&:github_account_id).select do |link|
+          account = link.github_account
+          next false if link.repository_id.blank? || account.nil?
+
+          identity = identities.fetch(account.id) do
+            identities[account.id] = CollavreGithub::Client.new(account).repository_identity(repo)
+          rescue Octokit::Error, Faraday::Error => e
+            Rails.logger.warn(
+              "[pr_monitor] repository identity lookup failed for #{repo} through " \
+              "account #{account.id}: #{e.class}: #{e.message}"
+            )
+            identities[account.id] = nil
+          end
+          identity&.id.to_s == link.repository_id.to_s
+        end
       end
 
       def github_webhook_url

data/app/services/collavre_github/tools/pr_state_set_service.rb

@@ -0,0 +1,170 @@
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "rails_mcp_engine"
+
+module CollavreGithub
+  module Tools
+    class PrStateSetService
+      extend T::Sig
+      extend ToolMeta
+      include Concerns::PrChannelLocator
+
+      tool_name "pr_state_set"
+      tool_description <<~DESC.strip
+        Correct the state of a GitHub PR channel attached with pr_monitor, for
+        when a `pull_request` webhook was missed (hook added after the merge,
+        delivery failure) and the chip is stuck on the wrong badge.
+
+        Omit `state` to resynchronize from the GitHub API — that is the
+        preferred form, because it cannot record a state the PR does not
+        actually have. Pass `state` explicitly only as a fallback when no
+        GitHub account is connected for the repository.
+
+        Closing the channel (merged / closed_without_merge) posts the closing
+        message and detaches it; reopening it resumes monitoring. Idempotent.
+      DESC
+
+      tool_param :topic_id, description: "The Collavre topic id the PR channel is attached to."
+      tool_param :pr_url, description: "Full GitHub PR URL, e.g. https://github.com/owner/repo/pull/123"
+      tool_param :state,
+        description: "Target state. Omit to read the real state from GitHub.",
+        required: false,
+        enum: CollavreGithub::GithubPrChannel::PR_STATES
+
+      sig do
+        params(
+          topic_id: Integer,
+          pr_url: String,
+          state: T.nilable(String)
+        ).returns(T::Hash[Symbol, T.untyped])
+      end
+      def call(topic_id:, pr_url:, state: nil)
+        repo, pr_number = parse_pr_url(pr_url)
+
+        topic = Collavre::Topic.find(topic_id)
+        Collavre::Tools::TopicAuthorizer.authorize_write!(topic)
+
+        channel = lookup_channel(topic, repo, pr_number)
+        unless channel
+          return {
+            ok: false,
+            error: "No PR channel for #{repo}##{pr_number} on topic #{topic_id}. Attach it with pr_monitor first."
+          }
+        end
+
+        target, source = resolve_state(topic, repo, pr_number, state)
+        return target if target.is_a?(Hash) # error payload
+
+        result = CollavreGithub::PrChannelStateUpdater.call(channel: channel, state: target)
+        {
+          ok: true,
+          channel_id: channel.id,
+          repo: repo,
+          pr_number: pr_number,
+          pr_state: target,
+          previous_state: result.previous_state,
+          status: result.status.to_s,
+          state_source: source
+        }
+      end
+
+      private
+
+      # Returns [state, source] or an error hash. An explicit `state` is
+      # validated here rather than at the updater so a typo surfaces as an
+      # ArgumentError naming the tool parameter the caller actually passed.
+      sig do
+        params(
+          topic: Collavre::Topic,
+          repo: String,
+          pr_number: Integer,
+          state: T.nilable(String)
+        ).returns([ T.any(String, T::Hash[Symbol, T.untyped]), String ])
+      end
+      def resolve_state(topic, repo, pr_number, state)
+        if state.present?
+          unless CollavreGithub::GithubPrChannel::PR_STATES.include?(state)
+            raise ArgumentError,
+              "Invalid state: #{state.inspect} (expected one of #{CollavreGithub::GithubPrChannel::PR_STATES.join(', ')})"
+          end
+          return [ state, "explicit" ]
+        end
+
+        clients = verified_github_clients_for(topic, repo)
+        if clients.empty?
+          return [ {
+            ok: false,
+            error: "No verified connected GitHub account for #{repo} in this topic's creative scope, " \
+                   "so the state could not be read from GitHub. Pass `state` explicitly instead."
+          }, "github" ]
+        end
+
+        clients.each do |client|
+          remote = remote_state(client, repo, pr_number)
+          return [ remote, "github" ] if remote
+        end
+
+        [ {
+          ok: false,
+          error: "Could not read #{repo}##{pr_number} from GitHub (not found, or the API call failed). " \
+                 "Pass `state` explicitly instead."
+        }, "github" ]
+      end
+
+      # GitHub reports merge and closure separately: `merged` is the
+      # authoritative merge flag, and `state` only distinguishes open from
+      # closed. Checking `merged` first is what keeps a squash-merged PR from
+      # being recorded as closed_without_merge.
+      def remote_state(client, repo, pr_number)
+        pr = client.pull_request_details(repo, pr_number)
+        return nil unless pr
+        return "merged" if pr.merged
+
+        pr.state.to_s == "closed" ? "closed_without_merge" : "open"
+      end
+
+      # A repository name is not an identity: GitHub can reuse it after a
+      # rename. Keep only accounts whose live repository id matches a stable id
+      # stored on an in-scope RepositoryLink, and reject the entire inherited
+      # scope when another link claims the same name with a conflicting id.
+      # Then let resync try each verified account until one can read the PR.
+      def verified_github_clients_for(topic, repo)
+        candidate_ids = scoped_creative_ids(topic)
+        return [] if candidate_ids.empty?
+
+        links = CollavreGithub::RepositoryLink
+          .where("LOWER(repository_full_name) = ?", repo.downcase)
+          .where(creative_id: candidate_ids)
+          .where.not(repository_id: nil)
+          .order(:id)
+          .to_a
+
+        links.group_by(&:github_account_id).filter_map do |account_id, account_links|
+          verified_client_for(account_id, account_links, topic, repo)
+        end
+      end
+
+      def verified_client_for(account_id, links, topic, repo)
+        client = CollavreGithub::Client.new(links.first.github_account)
+        identity = client.repository_identity(repo)
+        return nil if CollavreGithub::RepositoryLink.conflicting_repository_in_scope?(
+          creative: topic.creative,
+          full_name: repo,
+          repository_id: identity.id
+        )
+
+        return client if links.any? { |link| link.repository_id.to_s == identity.id.to_s }
+
+        nil
+      rescue Octokit::Error, Faraday::Error => e
+        Rails.logger.warn(
+          "[pr_state_set] repository identity lookup failed for #{repo} through " \
+          "account #{account_id}: #{e.class}: #{e.message}"
+        )
+
+        nil
+      end
+    end
+  end
+end