@link-assistant/hive-mind 2.0.26 → 2.0.28

package/src/solve.pr-base-guard.lib.mjs

@@ -0,0 +1,266 @@
+/**
+ * Guard PR base branch changes made during an agent session.
+ *
+ * The solve command creates or continues work against a target base branch.
+ * When --base-branch is explicit, that target is a user request, not a
+ * suggestion for the agent to retarget later.
+ */
+
+import { ghWithRateLimitRetry } from './github-rate-limit.lib.mjs';
+
+function normalizeBranchName(value) {
+  return String(value || '').trim();
+}
+
+function commandOutput(result) {
+  return [result?.stderr, result?.stdout]
+    .filter(Boolean)
+    .map(output => output.toString().trim())
+    .filter(Boolean)
+    .join('\n')
+    .trim();
+}
+
+function fallbackFormatAligned(icon, label, value) {
+  return [icon, label, value].filter(Boolean).join(' ');
+}
+
+function stripShellTokenPunctuation(value) {
+  const token = String(value || '');
+  if (isCommandBoundary(token)) return token;
+  return token.replace(/^(?:\(|\{|\[)+|(?:;|\)|&|\||\])+$/g, '');
+}
+
+function tokenizeShellCommand(command) {
+  const tokens = [];
+  const pattern = /"((?:\\.|[^"\\])*)"|'((?:\\.|[^'\\])*)'|(\S+)/g;
+  let match;
+  while ((match = pattern.exec(String(command || ''))) !== null) {
+    const rawToken = match[1] ?? match[2] ?? match[3] ?? '';
+    const token = stripShellTokenPunctuation(rawToken);
+    if (token) tokens.push(token);
+  }
+  return tokens;
+}
+
+function isCommandBoundary(token) {
+  return token === '&&' || token === '||' || token === ';' || token === '|';
+}
+
+function isGhToken(token) {
+  return token === 'gh' || token.endsWith('/gh');
+}
+
+function commandTargetsPullRequest(target, prNumber) {
+  if (!prNumber || !target) return true;
+  const normalizedTarget = String(target);
+  const normalizedPrNumber = String(prNumber);
+  return normalizedTarget === normalizedPrNumber || normalizedTarget.endsWith(`/pull/${normalizedPrNumber}`) || normalizedTarget.endsWith(`/pulls/${normalizedPrNumber}`);
+}
+
+function parseGhPrEditBaseChange(tokens, startIndex, prNumber) {
+  if (tokens[startIndex + 1] !== 'pr' || tokens[startIndex + 2] !== 'edit') return null;
+
+  let targetPullRequest = null;
+  let attemptedBaseBranch = null;
+  const optionsWithValues = new Set(['--repo', '-R', '--title', '--body', '--body-file', '--add-label', '--remove-label', '--add-assignee', '--remove-assignee', '--milestone', '--project']);
+  for (let index = startIndex + 3; index < tokens.length; index++) {
+    const token = tokens[index];
+    if (isCommandBoundary(token)) break;
+
+    if (token === '--base' || token === '-B') {
+      attemptedBaseBranch = normalizeBranchName(tokens[index + 1]);
+      index++;
+      continue;
+    }
+    if (token.startsWith('--base=')) {
+      attemptedBaseBranch = normalizeBranchName(token.slice('--base='.length));
+      continue;
+    }
+    if (optionsWithValues.has(token)) {
+      index++;
+      continue;
+    }
+    if (!targetPullRequest && !token.startsWith('-')) {
+      targetPullRequest = token;
+    }
+  }
+
+  if (!attemptedBaseBranch || !commandTargetsPullRequest(targetPullRequest, prNumber)) return null;
+  return { attemptedBaseBranch, commandKind: 'gh_pr_edit' };
+}
+
+function parseGhApiPullRequestBaseChange(tokens, startIndex, prNumber) {
+  if (tokens[startIndex + 1] !== 'api') return null;
+
+  let endpointTargetsPullRequest = false;
+  let attemptedBaseBranch = null;
+  for (let index = startIndex + 2; index < tokens.length; index++) {
+    const token = tokens[index];
+    if (isCommandBoundary(token)) break;
+
+    if (commandTargetsPullRequest(token, prNumber) && token.includes('/pulls/')) {
+      endpointTargetsPullRequest = true;
+    }
+    if (token === '-f' || token === '--field' || token === '-F' || token === '--raw-field') {
+      const field = tokens[index + 1] || '';
+      if (field.startsWith('base=')) {
+        attemptedBaseBranch = normalizeBranchName(field.slice('base='.length));
+      }
+      index++;
+      continue;
+    }
+    if (token.startsWith('-fbase=') || token.startsWith('--field=base=')) {
+      attemptedBaseBranch = normalizeBranchName(token.split('base=').at(-1));
+    }
+  }
+
+  if (!endpointTargetsPullRequest || !attemptedBaseBranch) return null;
+  return { attemptedBaseBranch, commandKind: 'gh_api_pull_update' };
+}
+
+export function getExpectedPullRequestBaseBranch({ argv = {} } = {}) {
+  const requestedBaseBranch = normalizeBranchName(argv?.baseBranch);
+  return requestedBaseBranch || null;
+}
+
+export function detectForbiddenPullRequestBaseChangeCommand(command, { expectedBaseBranch, prNumber } = {}) {
+  const normalizedExpectedBaseBranch = normalizeBranchName(expectedBaseBranch);
+  if (!normalizedExpectedBaseBranch || typeof command !== 'string' || !command.trim()) return null;
+
+  const tokens = tokenizeShellCommand(command);
+  for (let index = 0; index < tokens.length; index++) {
+    if (!isGhToken(tokens[index])) continue;
+    const parsed = parseGhPrEditBaseChange(tokens, index, prNumber) || parseGhApiPullRequestBaseChange(tokens, index, prNumber);
+    if (!parsed) continue;
+    if (parsed.attemptedBaseBranch === normalizedExpectedBaseBranch) continue;
+    return {
+      command,
+      commandKind: parsed.commandKind,
+      attemptedBaseBranch: parsed.attemptedBaseBranch,
+      expectedBaseBranch: normalizedExpectedBaseBranch,
+      prNumber: prNumber || null,
+    };
+  }
+
+  return null;
+}
+
+export function extractToolCommandTextsFromStreamEvent(event) {
+  const commands = [];
+  const seen = new Set();
+  const visit = value => {
+    if (!value || typeof value !== 'object') return;
+    if (typeof value.command === 'string' && value.command.trim() && !seen.has(value.command)) {
+      seen.add(value.command);
+      commands.push(value.command);
+    }
+    if (Array.isArray(value)) {
+      for (const item of value) visit(item);
+      return;
+    }
+    for (const child of Object.values(value)) {
+      visit(child);
+    }
+  };
+  visit(event);
+  return commands;
+}
+
+export function buildPullRequestBaseBranchInterventionMessage({ prNumber, expectedBaseBranch, attemptedBaseBranch, command } = {}) {
+  const expected = normalizeBranchName(expectedBaseBranch);
+  const attempted = normalizeBranchName(attemptedBaseBranch);
+  const pullRequestLabel = prNumber ? `PR #${prNumber}` : 'the pull request';
+  const attemptedText = attempted ? ` to ${attempted}` : '';
+  const commandText = command ? `\nForbidden command observed: ${command}` : '';
+
+  return `The user requested --base-branch ${expected}. ${pullRequestLabel} must keep that base branch. Do not change ${pullRequestLabel}'s base${attemptedText}. Restore or keep the base as ${expected}, then continue finishing the pull request and make it ready for review.${commandText}`;
+}
+
+export function buildPullRequestBaseBranchMismatchMessage({ prNumber, currentBaseBranch, expectedBaseBranch, operation = 'verify' } = {}) {
+  const action = operation === 'auto-merge' ? 'auto-merge' : 'continue';
+  return `Cannot ${action} PR #${prNumber} because its base branch changed to ${currentBaseBranch}. The user requested --base-branch ${expectedBaseBranch}; restore the PR base to ${expectedBaseBranch} before ${action}.`;
+}
+
+export async function getPullRequestBaseBranch({ owner, repo, prNumber, $, log }) {
+  if (typeof $ !== 'function') {
+    throw new Error('Cannot verify pull request base branch without a command runner');
+  }
+
+  const result = await ghWithRateLimitRetry(() => $`gh pr view ${prNumber} --repo ${owner}/${repo} --json baseRefName --jq .baseRefName`, {
+    label: 'gh pr view baseRefName',
+    log,
+  });
+  if (result.code !== 0) {
+    const details = commandOutput(result) || 'unknown error';
+    throw new Error(`Could not verify pull request base branch for #${prNumber}: ${details}`);
+  }
+
+  const baseBranch = normalizeBranchName(result.stdout);
+  if (!baseBranch) {
+    throw new Error(`Could not verify pull request base branch for #${prNumber}: gh returned an empty baseRefName`);
+  }
+
+  return baseBranch;
+}
+
+export async function ensurePullRequestBaseBranch({ owner, repo, prNumber, argv = {}, log = async () => {}, formatAligned = fallbackFormatAligned, $, onMismatch = 'restore', operation = 'verify' }) {
+  const expectedBaseBranch = getExpectedPullRequestBaseBranch({ argv });
+  if (!expectedBaseBranch) {
+    return { checked: false, restored: false, reason: 'no_explicit_base_branch' };
+  }
+
+  if (!owner || !repo || !prNumber) {
+    return { checked: false, restored: false, reason: 'missing_pull_request_context' };
+  }
+
+  const currentBaseBranch = await getPullRequestBaseBranch({ owner, repo, prNumber, $, log });
+  if (currentBaseBranch === expectedBaseBranch) {
+    await log(formatAligned('🎯', 'Base branch locked:', `${expectedBaseBranch} (verified)`, 2), { verbose: true });
+    return {
+      checked: true,
+      restored: false,
+      currentBaseBranch,
+      expectedBaseBranch,
+    };
+  }
+
+  await log(formatAligned('⚠️', 'Base branch changed:', `PR #${prNumber} targets ${currentBaseBranch}, expected ${expectedBaseBranch}`, 2), { level: 'warning' });
+
+  if (onMismatch === 'throw' || onMismatch === 'fail') {
+    throw new Error(
+      buildPullRequestBaseBranchMismatchMessage({
+        prNumber,
+        currentBaseBranch,
+        expectedBaseBranch,
+        operation,
+      })
+    );
+  }
+
+  await log(formatAligned('🔁', 'Restoring PR base:', expectedBaseBranch, 2));
+
+  const editResult = await ghWithRateLimitRetry(() => $`gh pr edit ${prNumber} --repo ${owner}/${repo} --base ${expectedBaseBranch}`, {
+    label: 'gh pr edit base',
+    log,
+  });
+  if (editResult.code !== 0) {
+    const details = commandOutput(editResult) || 'unknown error';
+    throw new Error(`Could not restore pull request #${prNumber} base branch to ${expectedBaseBranch}: ${details}`);
+  }
+
+  const restoredBaseBranch = await getPullRequestBaseBranch({ owner, repo, prNumber, $, log });
+  if (restoredBaseBranch !== expectedBaseBranch) {
+    throw new Error(`Pull request #${prNumber} still targets ${restoredBaseBranch} after attempting to restore ${expectedBaseBranch}`);
+  }
+
+  await log(formatAligned('✅', 'Base branch restored:', `PR #${prNumber} now targets ${expectedBaseBranch}`, 2));
+
+  return {
+    checked: true,
+    restored: true,
+    previousBaseBranch: currentBaseBranch,
+    currentBaseBranch: restoredBaseBranch,
+    expectedBaseBranch,
+  };
+}

package/src/solve.restart-shared.lib.mjs

@@ -31,6 +31,7 @@ const fs = (await use('fs')).promises;
 // Import shared library functions
 const lib = await import('./lib.mjs');
 const { log, formatAligned, extractToolErrorCore } = lib;
+const { ensurePullRequestBaseBranch } = await import('./solve.pr-base-guard.lib.mjs');
 
 // Import Sentry integration
 const sentryLib = await import('./sentry.lib.mjs');
@@ -460,6 +461,7 @@ export const executeToolIteration = async params => {
     });
   }
 
+  await ensurePullRequestBaseBranch({ owner, repo, prNumber, argv, log, formatAligned, $ });
   return toolResult;
 };
 

package/src/telegram-bot.mjs

@@ -1234,8 +1234,7 @@ bot.on('message', async (ctx, next) => {
   // /subscribe + /unsubscribe (#1688) are intentionally not in the text fallback — Telegraf's bot.command() is sufficient.
   const solveHandlers = Object.fromEntries(SOLVE_COMMAND_NAMES.map(command => [command, handleSolveCommand]));
   const taskHandlers = Object.fromEntries(TASK_COMMAND_NAMES.map(command => [command, handleTaskCommand]));
-  // /queue is the short alias for /solve_queue (issue #1837)
-  const handlers = { ...solveHandlers, ...taskHandlers, auth: handleAuthCommand, hive: handleHiveCommand, solve_queue: handleSolveQueueCommand, solvequeue: handleSolveQueueCommand, queue: handleSolveQueueCommand };
+  const handlers = { ...solveHandlers, ...taskHandlers, auth: handleAuthCommand, hive: handleHiveCommand, queue: handleSolveQueueCommand };
 
   const handler = handlers[extracted.command];
   if (!handler) return next();

package/src/telegram-solve-queue-command.lib.mjs

@@ -1,7 +1,7 @@
 /**
- * Telegram /solve_queue command implementation
+ * Telegram /queue command implementation
  *
- * This module provides the /solve_queue command functionality for the Telegram bot,
+ * This module provides the /queue command functionality for the Telegram bot,
  * allowing users to view the current solve queue status.
  *
  * Features:
@@ -15,7 +15,7 @@
 
 import { t } from './i18n.lib.mjs';
 
-const GROUP_ONLY_MESSAGE = '❌ The /solve_queue command only works in group chats. Please add this bot to a group and make it an admin.';
+const GROUP_ONLY_MESSAGE = '❌ The /queue command only works in group chats. Please add this bot to a group and make it an admin.';
 
 function commandText(key, params = {}, locale = null, fallback = key) {
   const translated = t(key, params, locale ? { locale } : {});
@@ -23,7 +23,7 @@ function commandText(key, params = {}, locale = null, fallback = key) {
 }
 
 /**
- * Registers the /solve_queue command handler with the bot
+ * Registers the /queue command handler with the bot
  * @param {Object} bot - The Telegraf bot instance
  * @param {Object} options - Options object
  * @param {boolean} options.VERBOSE - Whether to enable verbose logging
@@ -41,11 +41,11 @@ export function registerSolveQueueCommand(bot, options) {
   const { VERBOSE = false, isOldMessage, isForwardedOrReply, isGroupChat, isChatAuthorized, isTopicAuthorized, buildAuthErrorMessage, addBreadcrumb, getSolveQueue, safeReply, resolveLocale } = options;
 
   async function handleSolveQueueCommand(ctx) {
-    VERBOSE && console.log('[VERBOSE] /solve_queue command received');
+    VERBOSE && console.log('[VERBOSE] /queue command received');
 
     await addBreadcrumb({
       category: 'telegram.command',
-      message: '/solve_queue command received',
+      message: '/queue command received',
       level: 'info',
       data: { chatId: ctx.chat?.id, chatType: ctx.chat?.type, userId: ctx.from?.id, username: ctx.from?.username },
     });
@@ -54,18 +54,18 @@ export function registerSolveQueueCommand(bot, options) {
 
     // Ignore messages sent before bot started
     if (isOldMessage(ctx)) {
-      VERBOSE && console.log('[VERBOSE] /solve_queue ignored: old message');
+      VERBOSE && console.log('[VERBOSE] /queue ignored: old message');
       return;
     }
 
     // Ignore forwarded or reply messages
     if (isForwardedOrReply(ctx)) {
-      VERBOSE && console.log('[VERBOSE] /solve_queue ignored: forwarded or reply');
+      VERBOSE && console.log('[VERBOSE] /queue ignored: forwarded or reply');
       return;
     }
 
     if (!isGroupChat(ctx)) {
-      VERBOSE && console.log('[VERBOSE] /solve_queue ignored: not a group chat');
+      VERBOSE && console.log('[VERBOSE] /queue ignored: not a group chat');
       await replyWithFallback(commandText('telegram.solve_queue_only_in_groups', {}, locale, GROUP_ONLY_MESSAGE), {
         reply_to_message_id: ctx.message.message_id,
         fallbackLocale: locale,
@@ -75,13 +75,13 @@ export function registerSolveQueueCommand(bot, options) {
 
     const authorize = isTopicAuthorized || (ctx => isChatAuthorized(ctx.chat.id));
     if (!authorize(ctx)) {
-      VERBOSE && console.log('[VERBOSE] /solve_queue ignored: not authorized');
+      VERBOSE && console.log('[VERBOSE] /queue ignored: not authorized');
       const errMsg = buildAuthErrorMessage ? buildAuthErrorMessage(ctx) : `❌ This chat (ID: ${ctx.chat.id}) is not authorized.`;
       await replyWithFallback(errMsg, { reply_to_message_id: ctx.message.message_id, fallbackLocale: locale });
       return;
     }
 
-    VERBOSE && console.log('[VERBOSE] /solve_queue passed all checks, generating status...');
+    VERBOSE && console.log('[VERBOSE] /queue passed all checks, generating status...');
 
     const solveQueue = getSolveQueue({ verbose: VERBOSE });
 
@@ -97,12 +97,7 @@ export function registerSolveQueueCommand(bot, options) {
     });
   }
 
-  // Match /solve_queue, /solve-queue, /solvequeue, or the short /queue alias (case-insensitive)
-  // Note: Telegram Bot API only supports underscores in command names, not hyphens.
-  // The entity-based matching handles /solve_queue, /solvequeue, and /queue.
-  // /solve-queue is handled by the text-based fallback in telegram-bot.mjs (issue #1232).
-  // The /queue alias was added in issue #1837 to make checking the queue faster to type.
-  bot.command(/^(?:solve[_-]?queue|queue)$/i, handleSolveQueueCommand);
+  bot.command(/^queue$/i, handleSolveQueueCommand);
 
   return { handleSolveQueueCommand };
 }

package/src/telegram-solve-queue.helpers.lib.mjs

@@ -8,7 +8,7 @@ const execAsync = promisify(exec);
 
 /**
  * Build a clickable, human-readable link to a queued issue/PR for the
- * /solve_queue (/queue) detailed status (issue #1837).
+ * /queue detailed status (issue #1837).
  *
  * For GitHub issue/PR URLs we render a compact `[owner/repo#number](url)`
  * Markdown link so the list is scannable and clickable. When the label would
@@ -269,7 +269,7 @@ export async function getRunningSessionItems(verbose = false) {
     return await impl(verbose);
   } catch (error) {
     if (verbose) {
-      console.error('[VERBOSE] /solve_queue error getting running session items:', error.message);
+      console.error('[VERBOSE] /queue error getting running session items:', error.message);
     }
     return [];
   }
@@ -300,9 +300,9 @@ export async function getRunningProcesses(processName, verbose = false) {
       .filter(p => p.pid);
 
     if (verbose) {
-      console.log(`[VERBOSE] /solve_queue found ${processes.length} running ${processName} processes`);
+      console.log(`[VERBOSE] /queue found ${processes.length} running ${processName} processes`);
       if (processes.length > 0) {
-        console.log(`[VERBOSE] /solve_queue processes: ${JSON.stringify(processes)}`);
+        console.log(`[VERBOSE] /queue processes: ${JSON.stringify(processes)}`);
       }
     }
 
@@ -312,7 +312,7 @@ export async function getRunningProcesses(processName, verbose = false) {
     };
   } catch (error) {
     if (verbose) {
-      console.error(`[VERBOSE] /solve_queue error counting ${processName} processes:`, error.message);
+      console.error(`[VERBOSE] /queue error counting ${processName} processes:`, error.message);
     }
     return { count: 0, processes: [] };
   }

package/src/telegram-solve-queue.lib.mjs

@@ -250,7 +250,7 @@ export class SolveQueue {
    */
   log(message) {
     if (this.verbose) {
-      console.log(`[VERBOSE] /solve_queue: ${message}`);
+      console.log(`[VERBOSE] /queue: ${message}`);
     }
   }
 
@@ -1469,7 +1469,7 @@ export async function getRunningIsolatedSessions(verbose = false) {
     return await getRunningTrackedIsolationSessions(verbose);
   } catch (error) {
     if (verbose) {
-      console.error(`[VERBOSE] /solve_queue error getting isolated sessions:`, error.message);
+      console.error(`[VERBOSE] /queue error getting isolated sessions:`, error.message);
     }
     return { count: 0, sessions: [], byTool: {} };
   }