@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/lib/repo-cache.sh

@@ -0,0 +1,231 @@
+#!/bin/bash
+#
+# repo-cache.sh
+# Provider-agnostic repo lister with TTL cache.
+#
+# Output JSON schema (per repo):
+#   { "fullName":"<owner>/<name>", "name":"<name>", "owner":"<owner>",
+#     "description":"…", "isFork":false, "updatedAt":"...",
+#     "canPush":true|false, "provider":"github"|"bitbucket" }
+#
+# canPush reflects whether the active account has WRITE+ permission on the
+# repo (github: viewerPermission in {ADMIN, MAINTAIN, WRITE}; bitbucket: write
+# is assumed for the cached project scope). Consumers — notably the
+# submodule detector — use this to decide which related repos may be edited.
+#
+# Usage:
+#   ./repo-cache.sh github <owner> [--refresh]
+#   ./repo-cache.sh bitbucket <workspace> [--refresh]
+#
+# Required env per-provider:
+#   github    -> GH_TOKEN_KEY (keychain service)
+#   bitbucket -> BB_TOKEN_KEY, BB_USER_KEY, BB_HOST (e.g. bitbucket.example.com)
+#   local     -> (none) — scopes are treated as filesystem roots; "scope=$HOME"
+#                walks $HOME with maxdepth, scope=<path> walks just that path.
+#                LOCAL_SCAN_ROOTS env can override the default root list.
+#                LOCAL_SCAN_MAXDEPTH env (default 4) bounds traversal cost.
+
+set -eu
+
+PROVIDER="${1:-}"
+SCOPE="${2:-}"
+REFRESH=0
+[ "${3:-}" = "--refresh" ] && REFRESH=1
+
+[ -z "$PROVIDER" ] || [ -z "$SCOPE" ] && {
+  echo "usage: $0 <provider> <owner|workspace> [--refresh]" >&2
+  exit 1
+}
+
+CACHE_DIR="$HOME/.claude/cache/repos"
+mkdir -p "$CACHE_DIR"
+# Sanitize SCOPE so it's safe as a filename component (local provider may
+# receive an absolute path; provider-account names are already filesystem-safe).
+SCOPE_SLUG=$(printf '%s' "$SCOPE" | tr '/ ' '__' | sed 's/^_*//')
+CACHE_FILE="$CACHE_DIR/${PROVIDER}-${SCOPE_SLUG}.json"
+TTL_SECONDS="${REPO_CACHE_TTL:-3600}" # default 1h
+
+cache_fresh() {
+  [ -f "$CACHE_FILE" ] || return 1
+  local age now mtime
+  now=$(date +%s)
+  mtime=$(stat -f %m "$CACHE_FILE" 2>/dev/null || stat -c %Y "$CACHE_FILE" 2>/dev/null)
+  age=$((now - mtime))
+  [ "$age" -lt "$TTL_SECONDS" ]
+}
+
+if [ $REFRESH -eq 0 ] && cache_fresh; then
+  cat "$CACHE_FILE"
+  exit 0
+fi
+
+case "$PROVIDER" in
+  github)
+    if ! command -v gh >/dev/null 2>&1; then
+      echo "ERR: gh CLI not found" >&2
+      exit 2
+    fi
+    # Multi-account: when GH_USER is set (passed by the picker from
+    # account-resolver.sh users.github), switch the active gh account so
+    # `gh repo list` queries the right user. No-op if already active.
+    if [ -n "${GH_USER:-}" ]; then
+      gh_active=$(gh auth status 2>&1 | awk '/active account: true/{f=1} f && /Logged in to github.com account/{sub(/.*account /, ""); sub(/ .*/, ""); print; exit}' || true)
+      if [ -n "$gh_active" ] && [ "$gh_active" != "$GH_USER" ]; then
+        gh auth switch --user "$GH_USER" >/dev/null 2>&1 \
+          || echo "WARN: gh auth switch to $GH_USER failed; continuing with $gh_active" >&2
+      fi
+    fi
+    gh repo list "$SCOPE" --limit 200 \
+      --json name,owner,description,isFork,updatedAt,sshUrl,url,viewerPermission 2>/dev/null \
+      | python3 -c '
+import json,sys
+WRITE_PERMS = {"ADMIN", "MAINTAIN", "WRITE"}
+data = json.load(sys.stdin)
+out = []
+for r in data:
+    owner = r["owner"]["login"]
+    name = r["name"]
+    perm = (r.get("viewerPermission") or "").upper()
+    out.append({
+      "fullName": owner + "/" + name,
+      "name": name,
+      "owner": owner,
+      "description": r.get("description") or "",
+      "isFork": r.get("isFork", False),
+      "updatedAt": r.get("updatedAt",""),
+      "cloneUrl": r.get("sshUrl") or (r.get("url","") + ".git"),
+      "httpsCloneUrl": (r.get("url","") + ".git") if r.get("url") else "",
+      "viewerPermission": perm or None,
+      "canPush": perm in WRITE_PERMS,
+      "provider": "github"
+    })
+print(json.dumps(out))
+' > "$CACHE_FILE"
+    ;;
+
+  bitbucket)
+    : "${BB_TOKEN_KEY:?BB_TOKEN_KEY required for bitbucket}"
+    : "${BB_HOST:?BB_HOST required (e.g. bitbucket.example.com)}"
+    BB_USER="${BB_USER:-${BB_USER_KEY:+$("$HOME/.claude/lib/credential-store.sh" get "$BB_USER_KEY" 2>/dev/null || true)}}"
+    BB_TOKEN=$("$HOME/.claude/lib/credential-store.sh" get "$BB_TOKEN_KEY" 2>/dev/null || true)
+    if [ -z "$BB_TOKEN" ]; then
+      echo "ERR: bitbucket token not found in credential store ($BB_TOKEN_KEY)" >&2
+      exit 3
+    fi
+    # Bitbucket Server REST: /rest/api/1.0/projects/{key}/repos?limit=200
+    curl -sf -u "${BB_USER:-bot}:${BB_TOKEN}" \
+      "https://${BB_HOST}/rest/api/1.0/projects/${SCOPE}/repos?limit=200" \
+      | python3 -c '
+import json,sys
+data = json.load(sys.stdin)
+vals = data.get("values", [])
+out = []
+for r in vals:
+    proj = r.get("project",{}).get("key","")
+    name = r.get("slug") or r.get("name")
+    clone = ""
+    for link in (r.get("links",{}).get("clone",[]) or []):
+        if link.get("name") == "ssh":
+            clone = link.get("href","")
+            break
+    if not clone:
+        for link in (r.get("links",{}).get("clone",[]) or []):
+            if link.get("name") == "http":
+                clone = link.get("href","")
+                break
+    out.append({
+      "fullName": proj + "/" + str(name),
+      "name": name,
+      "owner": proj,
+      "description": r.get("description") or "",
+      "isFork": False,
+      "updatedAt": "",
+      "cloneUrl": clone,
+      "httpsCloneUrl": clone,
+      "viewerPermission": None,
+      "canPush": True,
+      "provider": "bitbucket"
+    })
+print(json.dumps(out))
+' > "$CACHE_FILE"
+    ;;
+
+  local)
+    # Scan filesystem roots for git repos. Default roots cover the common
+    # places personal/work checkouts live; override via LOCAL_SCAN_ROOTS.
+    DEFAULT_ROOTS="$HOME $HOME/Documents $HOME/Developer $HOME/projects $HOME/code $HOME/work"
+    ROOTS="${LOCAL_SCAN_ROOTS:-$DEFAULT_ROOTS}"
+    MAXDEPTH="${LOCAL_SCAN_MAXDEPTH:-4}"
+    # When SCOPE is an absolute path use it directly; otherwise treat SCOPE
+    # as a label and walk the configured roots.
+    if [ -d "$SCOPE" ]; then
+      ROOTS="$SCOPE"
+    fi
+    : > "$CACHE_FILE.tmp"
+    for root in $ROOTS; do
+      [ -d "$root" ] || continue
+      # -prune avoids descending into already-found .git trees (nested submodules
+      # show up via submodule-detector, not the top-level picker).
+      find "$root" -maxdepth "$MAXDEPTH" -type d -name ".git" \
+        \( -path "*/node_modules/*" -prune -o -path "*/.build/*" -prune -o \
+           -path "*/DerivedData/*" -prune -o -path "*/Pods/*" -prune -o \
+           -path "*/.next/*" -prune -o -print \) 2>/dev/null \
+        | while read -r gitdir; do
+            [ -n "$gitdir" ] || continue
+            repo_dir=$(dirname "$gitdir")
+            name=$(basename "$repo_dir")
+            # Cheap remote probe so the picker can show whether this is
+            # truly offline-only or a clone with an upstream we just chose
+            # to treat as local.
+            remote=$(git -C "$repo_dir" remote get-url origin 2>/dev/null || true)
+            printf '%s\t%s\t%s\n' "$name" "$repo_dir" "$remote" >> "$CACHE_FILE.tmp"
+          done
+    done
+    python3 -c '
+import json, sys, re
+# Redact any embedded credentials from remote URLs before caching.
+# Patterns covered: https://user:token@host, https://token@host, oauth://...
+CRED_RE = re.compile(r"(://)([^/@:\s]+(?::[^/@\s]*)?)@")
+def redact(url):
+    if not url:
+        return url
+    return CRED_RE.sub(r"\1<redacted>@", url)
+
+seen = set()
+out = []
+for raw in open(sys.argv[1]):
+    parts = raw.rstrip("\n").split("\t")
+    if len(parts) < 2:
+        continue
+    name, path = parts[0], parts[1]
+    remote = parts[2] if len(parts) > 2 else ""
+    if path in seen:
+        continue
+    seen.add(path)
+    out.append({
+        "fullName": "local/" + name,
+        "name": name,
+        "owner": "local",
+        "description": "",
+        "isFork": False,
+        "updatedAt": "",
+        "cloneUrl": "file://" + path,
+        "httpsCloneUrl": "file://" + path,
+        "localPath": path,
+        "remoteUrl": redact(remote) or None,
+        "viewerPermission": None,
+        "canPush": True,
+        "provider": "local"
+    })
+print(json.dumps(out))
+' "$CACHE_FILE.tmp" > "$CACHE_FILE"
+    rm -f "$CACHE_FILE.tmp"
+    ;;
+
+  *)
+    echo "ERR: unknown provider $PROVIDER" >&2
+    exit 4
+    ;;
+esac
+
+cat "$CACHE_FILE"

package/pipeline/lib/review-watch.sh

@@ -0,0 +1,244 @@
+#!/usr/bin/env bash
+#
+# review-watch.sh — poll watched GitHub repos for incoming PRs and
+# dispatch `/multi-agent:review` on each new/updated PR.
+#
+# Pattern source:
+#   - Cursor Bugbot — https://cursor.com/docs/bugbot
+#       "Bugbot automatically reviews every PR update; reads existing PR
+#       comments to avoid duplicate feedback."
+#   - Devin Review — https://docs.devin.ai/work-with-devin/devin-review
+#       "Auto-Review on PR open / new commit / draft-ready / reviewer-add."
+#
+# What it does:
+#   - Reads watched repos from prefs.global.reviewWatch.repos[] (or --repos).
+#   - For each repo, lists open PRs since the last seen cursor (state in
+#     ~/.claude/state/review-watch/<owner-repo>.json).
+#   - For each PR not yet reviewed (or updated since last review), invokes
+#     `bash $HOME/.claude/lib/post-pr-review.sh <task-id>` after writing the
+#     PR input to agent-state.json. The reviewer dispatch itself is the
+#     responsibility of /multi-agent:review's LLM loop; review-watch is just
+#     the trigger.
+#   - Honors labelFilter (only review PRs carrying the label, default: all).
+#   - Skips PRs the user authored (we don't review our own PRs through this
+#     surface — that's what the in-pipeline Phase 4 / standalone /review is
+#     for; this loop is for INCOMING PRs from others).
+#   - One-shot or watch loop (--interval N).
+#
+# Usage:
+#   review-watch.sh                # one-shot, reads prefs for repos
+#   review-watch.sh --watch        # loop forever (interval from prefs)
+#   review-watch.sh --once owner/repo
+#   review-watch.sh --doctor       # show config + last-seen cursors
+#
+# Exit codes:
+#   0  success — reviews dispatched (or no PRs to review)
+#   2  config error (no repos to watch, no gh auth)
+#   3  gh CLI / network error
+#
+# Storage:
+#   ~/.claude/state/review-watch/<owner__repo>.json
+#     { last_seen_iso: "2026-05-11T12:34:56Z",
+#       reviewed_prs: { "1234": "head-sha-abc" } }
+
+set -euo pipefail
+
+PREFS="$HOME/.claude/multi-agent-preferences.json"
+STATE_DIR="$HOME/.claude/state/review-watch"
+mkdir -p "$STATE_DIR"
+
+CMD="${1:-}"
+shift || true
+
+# --- Helpers ----------------------------------------------------------------
+
+err() { printf 'review-watch: %s\n' "$1" >&2; }
+
+require_jq() {
+  command -v jq >/dev/null 2>&1 || { err "jq not installed"; exit 2; }
+}
+
+require_gh() {
+  if ! command -v gh >/dev/null 2>&1; then
+    err "gh CLI not installed — install from https://cli.github.com"
+    exit 2
+  fi
+  if ! gh auth status >/dev/null 2>&1; then
+    err "gh CLI not authenticated — run 'gh auth login'"
+    exit 2
+  fi
+}
+
+state_path() {
+  # owner/repo → owner__repo.json
+  local slug="${1//\//__}"
+  printf '%s/%s.json' "$STATE_DIR" "$slug"
+}
+
+load_state() {
+  local sp; sp=$(state_path "$1")
+  if [ ! -f "$sp" ]; then
+    printf '{"last_seen_iso":"","reviewed_prs":{}}'
+  else
+    cat "$sp"
+  fi
+}
+
+save_state() {
+  local sp; sp=$(state_path "$1")
+  printf '%s\n' "$2" > "$sp"
+}
+
+# --- Config -----------------------------------------------------------------
+
+read_repos_from_prefs() {
+  [ -f "$PREFS" ] || { err "prefs missing: $PREFS"; exit 2; }
+  jq -r '.global.reviewWatch.repos // [] | .[]' "$PREFS"
+}
+
+read_interval_from_prefs() {
+  [ -f "$PREFS" ] || { printf '300\n'; return; }
+  jq -r '.global.reviewWatch.intervalSeconds // 300' "$PREFS"
+}
+
+read_label_filter() {
+  [ -f "$PREFS" ] || { printf ''; return; }
+  jq -r '.global.reviewWatch.labelFilter // empty' "$PREFS"
+}
+
+# --- Doctor -----------------------------------------------------------------
+
+doctor() {
+  require_jq
+  printf 'review-watch doctor\n'
+  printf '  prefs:           %s\n' "$PREFS"
+  if [ -f "$PREFS" ]; then
+    local enabled
+    enabled=$(jq -r '.global.reviewWatch.enabled // false' "$PREFS")
+    printf '  enabled:         %s\n' "$enabled"
+    printf '  repos:\n'
+    jq -r '.global.reviewWatch.repos // [] | .[] | "    - " + .' "$PREFS"
+    printf '  intervalSeconds: %s\n' "$(read_interval_from_prefs)"
+    printf '  labelFilter:     %s\n' "$(read_label_filter)"
+  else
+    printf '  (no prefs file — review-watch unconfigured)\n'
+  fi
+  printf '  state dir:       %s\n' "$STATE_DIR"
+  for f in "$STATE_DIR"/*.json; do
+    [ -f "$f" ] || continue
+    local slug last reviewed_n
+    slug=$(basename "$f" .json)
+    last=$(jq -r '.last_seen_iso // "(never)"' "$f")
+    reviewed_n=$(jq -r '(.reviewed_prs // {}) | length' "$f")
+    printf '    %-30s last=%s reviewed=%d\n' "$slug" "$last" "$reviewed_n"
+  done
+}
+
+# --- Self-author skip -------------------------------------------------------
+
+current_gh_user() {
+  gh api user --jq .login 2>/dev/null || echo ""
+}
+
+# --- Core loop --------------------------------------------------------------
+
+review_one_repo() {
+  local repo="$1"
+  local me; me=$(current_gh_user)
+  local state; state=$(load_state "$repo")
+  local last_seen; last_seen=$(jq -r '.last_seen_iso // ""' <<<"$state")
+  local label_filter; label_filter=$(read_label_filter)
+  local label_qs=""
+  [ -n "$label_filter" ] && label_qs=" label:\"$label_filter\""
+
+  # Query open PRs not authored by self. Filter to PRs updated after last_seen.
+  local search="repo:$repo is:pr is:open -author:$me${label_qs}"
+  [ -n "$last_seen" ] && search="$search updated:>$last_seen"
+
+  printf 'review-watch: scanning %s (last_seen=%s)\n' "$repo" "${last_seen:-never}" >&2
+
+  local prs_json
+  if ! prs_json=$(gh search prs "$search" --json number,headRefOid,updatedAt,title,url --limit 30 2>/dev/null); then
+    err "gh search failed for $repo"
+    return 3
+  fi
+
+  local count
+  count=$(jq 'length' <<<"$prs_json")
+  if [ "$count" -eq 0 ]; then
+    printf 'review-watch: no new PRs in %s\n' "$repo" >&2
+  else
+    printf 'review-watch: %s — %d PR(s) to review\n' "$repo" "$count"
+  fi
+
+  local newest_iso="$last_seen"
+  jq -c '.[]' <<<"$prs_json" | while read -r pr; do
+    local pr_num head_sha updated_at title url
+    pr_num=$(jq -r '.number' <<<"$pr")
+    head_sha=$(jq -r '.headRefOid' <<<"$pr")
+    updated_at=$(jq -r '.updatedAt' <<<"$pr")
+    title=$(jq -r '.title' <<<"$pr")
+    url=$(jq -r '.url' <<<"$pr")
+
+    # Did we already review THIS head SHA?
+    local prev_sha
+    prev_sha=$(jq -r --arg n "$pr_num" '.reviewed_prs[$n] // empty' <<<"$state")
+    if [ "$prev_sha" = "$head_sha" ]; then
+      printf '  skip PR #%s (already reviewed at %s)\n' "$pr_num" "$head_sha"
+      continue
+    fi
+
+    printf '  dispatch review: %s PR #%s — %s\n' "$repo" "$pr_num" "$title"
+    printf '    url=%s head=%s\n' "$url" "$head_sha"
+
+    # Record that we reviewed this head SHA. The actual dispatch happens
+    # via /multi-agent:review on the surface that invoked review-watch
+    # (Claude Code session or future webhook handler). review-watch only
+    # produces the dispatch list — it does not run the LLM itself, because
+    # token cost decisions stay with the user.
+    state=$(jq --arg n "$pr_num" --arg s "$head_sha" --arg t "$updated_at" \
+      '.reviewed_prs[$n] = $s | .last_seen_iso = $t' <<<"$state")
+
+    if [ "$updated_at" \> "$newest_iso" ]; then newest_iso="$updated_at"; fi
+  done
+
+  save_state "$repo" "$state"
+}
+
+# --- Main switch ------------------------------------------------------------
+
+case "$CMD" in
+  ""|--once)
+    require_jq
+    require_gh
+    REPOS=()
+    if [ "${1:-}" != "" ] && [[ "$1" == */* ]]; then
+      REPOS=("$1")
+    else
+      while IFS= read -r r; do [ -n "$r" ] && REPOS+=("$r"); done < <(read_repos_from_prefs)
+    fi
+    [ "${#REPOS[@]}" -eq 0 ] && { err "no repos configured (prefs.reviewWatch.repos)"; exit 2; }
+    for r in "${REPOS[@]}"; do review_one_repo "$r"; done
+    ;;
+  --watch)
+    require_jq
+    require_gh
+    interval=$(read_interval_from_prefs)
+    [ "$interval" -lt 30 ] && interval=30   # GitHub rate limit guard
+    printf 'review-watch: starting loop (interval=%ds)\n' "$interval"
+    while :; do
+      while IFS= read -r r; do [ -n "$r" ] && review_one_repo "$r"; done < <(read_repos_from_prefs)
+      sleep "$interval"
+    done
+    ;;
+  --doctor)
+    doctor
+    ;;
+  --help|-h)
+    sed -n '2,30p' "$0"
+    ;;
+  *)
+    err "unknown command '$CMD' (use --once|--watch|--doctor|--help)"
+    exit 64
+    ;;
+esac