@cursor/july 0.1.55 → 0.1.62

package/templates/agentic-owners/agent/lib/owners/match.ts

@@ -0,0 +1,177 @@
+// Vendored from the Agentic Owners policy core; see README.md in this
+// directory. Precedence must stay identical to the source's.
+
+import { patternMatchesFile, patternSpecificity } from "./matching.js";
+import type {
+  AgenticOwnersMatchedConfig,
+  AgenticOwnersPathRule,
+  AgenticOwnersRepoConfig,
+} from "./types.js";
+
+type PathScopedRule = {
+  readonly scopeDepth: number;
+  readonly sourcePath: string;
+  readonly paths: readonly string[];
+  /** Root-only absolute exemption, produced from `global_exclusions`. */
+  readonly globalExclusion?: boolean;
+};
+
+function ruleMatchesFile({
+  rule,
+  filepath,
+}: {
+  rule: PathScopedRule;
+  filepath: string;
+}): boolean {
+  return rule.paths.some((pattern) => patternMatchesFile(pattern, filepath));
+}
+
+function bestMatchingPatternSpecificity(
+  rule: PathScopedRule,
+  filepath: string
+): number {
+  let best = 0;
+  for (const pattern of rule.paths) {
+    if (patternMatchesFile(pattern, filepath)) {
+      best = Math.max(best, patternSpecificity(pattern));
+    }
+  }
+  return best;
+}
+
+function compareRulePrecedence(
+  left: PathScopedRule,
+  right: PathScopedRule,
+  filepath?: string
+): number {
+  // Root `global_exclusions` model repository-wide owner-clearing rules. They
+  // must win before normal closest-directory precedence or every nested policy
+  // would need to repeat the same carve-outs. Parsing only permits them in the
+  // root policy, and the caller reads that policy from the base branch first.
+  const leftGlobalExclusion = left.globalExclusion === true;
+  const rightGlobalExclusion = right.globalExclusion === true;
+  if (leftGlobalExclusion !== rightGlobalExclusion) {
+    return leftGlobalExclusion ? 1 : -1;
+  }
+  if (left.scopeDepth !== right.scopeDepth) {
+    return left.scopeDepth - right.scopeDepth;
+  }
+  if (filepath !== undefined) {
+    const leftSpecificity = bestMatchingPatternSpecificity(left, filepath);
+    const rightSpecificity = bestMatchingPatternSpecificity(right, filepath);
+    if (leftSpecificity !== rightSpecificity) {
+      return leftSpecificity - rightSpecificity;
+    }
+  }
+  return left.sourcePath.localeCompare(right.sourcePath);
+}
+
+function pickWinningRuleForFile<T extends PathScopedRule>({
+  filepath,
+  rules,
+}: {
+  filepath: string;
+  rules: readonly T[];
+}): T | undefined {
+  let winner: T | undefined;
+  for (const rule of rules) {
+    if (!ruleMatchesFile({ rule, filepath })) {
+      continue;
+    }
+    if (
+      winner === undefined ||
+      compareRulePrecedence(rule, winner, filepath) > 0
+    ) {
+      winner = rule;
+    }
+  }
+  return winner;
+}
+
+export function matchRepoConfigForChangedFiles({
+  changedFiles,
+  config,
+}: {
+  changedFiles: readonly string[];
+  config: AgenticOwnersRepoConfig;
+}): AgenticOwnersMatchedConfig {
+  // Dedupe by rule identity, not sourcePath: two different rules in the same
+  // policy.yml can each win for different changed files, and collapsing them by
+  // file path would silently drop one (e.g. a hard-gate rule lost behind an
+  // advisory rule from the same policy).
+  const winners = new Set<AgenticOwnersPathRule>();
+  for (const filepath of changedFiles) {
+    const winner = pickWinningRuleForFile({ filepath, rules: config.rules });
+    if (winner !== undefined) {
+      winners.add(winner);
+    }
+  }
+  return {
+    matchedRules: [...winners].sort((left, right) =>
+      compareRulePrecedence(left, right)
+    ),
+  };
+}
+
+/**
+ * The changed files that NO rule wins — not owned, not carved out, not
+ * globally excluded. These are the files that enroll a change through the
+ * default fallback: a file won by an ownerless carve-out or an exclusion was
+ * deliberately opted out, but a file nothing matches has simply never been
+ * governed and still deserves a risk review.
+ *
+ * Pure; the caller passes the already-loaded rule set (committed policy rules
+ * plus the synthetic `global_exclusions` rule) and the reviewable file set.
+ */
+export function changedFilesWithoutWinningRule({
+  changedFiles,
+  rules,
+}: {
+  changedFiles: readonly string[];
+  rules: readonly AgenticOwnersPathRule[];
+}): string[] {
+  return changedFiles.filter(
+    (filepath) => pickWinningRuleForFile({ filepath, rules }) === undefined
+  );
+}
+
+/**
+ * True when there is at least one changed file AND every one of them is won by a
+ * root `global_exclusions` rule. Such a PR is inherently low risk (it only
+ * touches globally-excluded paths — Bazel files, generated trees, …), so it
+ * keeps a clean not-enrolled pass: no risk assessment, no reviewer inference.
+ * An empty file set, an unmatched file, or a file won by any non-exclusion rule
+ * all make this false.
+ */
+export function everyChangedFileGloballyExcluded({
+  changedFiles,
+  rules,
+}: {
+  changedFiles: readonly string[];
+  rules: readonly AgenticOwnersPathRule[];
+}): boolean {
+  if (changedFiles.length === 0) {
+    return false;
+  }
+  return changedFiles.every(
+    (filepath) =>
+      pickWinningRuleForFile({ filepath, rules })?.globalExclusion === true
+  );
+}
+
+function hasOwners(rule: AgenticOwnersPathRule): boolean {
+  return rule.teams.length > 0 || rule.users.length > 0;
+}
+
+/**
+ * Keep only owned policy rules — drop ownerless precedence carve-outs
+ * (`always_approve`, `global_exclusions`), which intentionally clear broader
+ * ownership and must not enroll the review. This is the same enrollment
+ * signal the CI gate uses, so "which PRs the agent reviews" cannot drift
+ * from "which PRs the gate blocks".
+ */
+export function committedMatchedRules(
+  rules: readonly AgenticOwnersPathRule[]
+): AgenticOwnersPathRule[] {
+  return rules.filter(hasOwners);
+}

package/templates/agentic-owners/agent/lib/owners/matching.ts

@@ -0,0 +1,95 @@
+// Vendored verbatim from the Agentic Owners policy core; see README.md in
+// this directory. Matching semantics must stay identical to the source's.
+
+import { minimatch } from "minimatch";
+
+/**
+ * CODEOWNERS-style path matching. Complex prefixes before a terminal `/**`
+ * deliberately fall through to minimatch below.
+ */
+export function patternMatchesFile(pattern: string, filepath: string): boolean {
+  const patternIsRooted = pattern.startsWith("/");
+  const normalizedPattern = pattern.replace(/^\/+/, "");
+  const normalizedPath = filepath.replace(/^\/+/, "");
+
+  if (normalizedPattern === "**" || normalizedPattern === "*") {
+    return true;
+  }
+
+  // Keep the fast prefix path for literal `dir/**` rules. A wildcard before
+  // the terminal `/**` (for example `**/agent-serve/**`) must fall through to
+  // minimatch; treating its wildcard text as a literal prefix never matches.
+  if (
+    normalizedPattern.endsWith("**") &&
+    !hasComplexGlob(normalizedPattern.replace(/\*+$/, ""))
+  ) {
+    const rawPrefix = normalizedPattern.replace(/\*+$/, "");
+    const prefix = rawPrefix.replace(/\\(.)/g, "$1").replace(/\/+$/, "");
+    return (
+      normalizedPath === prefix ||
+      (prefix !== "" && normalizedPath.startsWith(`${prefix}/`))
+    );
+  }
+
+  if (normalizedPattern.endsWith("/")) {
+    const prefix = normalizedPattern
+      .replace(/\\(.)/g, "$1")
+      .replace(/\/+$/, "");
+    if (!patternIsRooted && !prefix.includes("/")) {
+      return (
+        normalizedPath.startsWith(`${prefix}/`) ||
+        normalizedPath.includes(`/${prefix}/`)
+      );
+    }
+    return prefix !== "" && normalizedPath.startsWith(`${prefix}/`);
+  }
+
+  if (globstarDirectoryPatternMatches(normalizedPattern, normalizedPath)) {
+    return true;
+  }
+
+  try {
+    return minimatch(normalizedPath, normalizedPattern, {
+      dot: true,
+      matchBase: !normalizedPattern.includes("/"),
+      nocase: false,
+    });
+  } catch {
+    return false;
+  }
+}
+
+function hasComplexGlob(pattern: string): boolean {
+  return /[*?[\]{}!()+@]/.test(pattern);
+}
+
+/** Higher score means a more specific pattern (used to break ties within one policy.yml). */
+export function patternSpecificity(pattern: string): number {
+  const normalized = pattern.replace(/^\/+/, "");
+  const globIndex = normalized.search(/[*?[\]{}!]/);
+  const literalPrefix =
+    globIndex === -1 ? normalized : normalized.slice(0, globIndex);
+  const segments = literalPrefix
+    .split("/")
+    .filter((segment) => segment !== "").length;
+  return literalPrefix.length * 100 + segments;
+}
+
+function globstarDirectoryPatternMatches(
+  pattern: string,
+  filepath: string
+): boolean {
+  if (!pattern.startsWith("**/")) {
+    return false;
+  }
+  const suffix = pattern.slice("**/".length);
+  if (suffix === "" || hasComplexGlob(suffix)) {
+    return false;
+  }
+  return (
+    filepath === suffix ||
+    filepath.endsWith(`/${suffix}`) ||
+    filepath.startsWith(`${suffix}/`) ||
+    filepath.includes(`/${suffix}/`)
+  );
+}