@yemi33/minions 0.1.1989 → 0.1.1990

package/engine/ado-git-auth.js

@@ -66,26 +66,65 @@ function isAdoProject(project) {
   return !!(project && project.repoHost === 'ado');
 }
 
-// Scope the header to the ADO host so a misconfigured remote pointing at
+// Scope the header to the ADO host(s) so a misconfigured remote pointing at
 // another host (e.g. github.com on a misclassified project) doesn't leak the
 // bearer token. Falls back to the unscoped `http.extraHeader` key when we
-// can't compute a host (still safe — git only sends extraHeader on HTTP/S
+// can't compute any host (still safe — git only sends extraHeader on HTTP/S
 // transfers, and the engine only invokes ado-git-auth for ADO projects).
-function _resolveScopeUrl(project) {
+//
+// W-mped1zap00069ea5 — ADO has TWO canonical URL forms for the same org:
+//   - https://dev.azure.com/<org>/...          (modern, default for new clones)
+//   - https://<org>.visualstudio.com/...       (legacy alias, still active)
+// Git scopes `http.<url>.extraHeader` by URL PREFIX match: a header scoped to
+// `office.visualstudio.com` is silently dropped when the remote is
+// `dev.azure.com/office` (and vice-versa). The bearer token is identical for
+// either form, so we emit the header under BOTH scopes to cover whichever
+// alias the project's git remote happens to use.
+function _resolveScopeUrls(project) {
   try {
-    if (!project || !project.adoOrg) return null;
+    if (!isAdoProject(project) || !project.adoOrg) return [];
+    const scopes = new Set();
+
+    // Always include the modern dev.azure.com host. Remotes cloned via the
+    // current ADO UI use this form regardless of what `prUrlBase` says.
+    scopes.add('https://dev.azure.com/');
+
+    // Derive the visualstudio.com form from adoOrg. Works whether adoOrg is
+    // the bare org slug ("office") or already a full host ("office.visualstudio.com").
+    const orgName = project.adoOrg.includes('.')
+      ? project.adoOrg.split('.')[0]
+      : project.adoOrg;
+    if (orgName) {
+      scopes.add(`https://${orgName}.visualstudio.com/`);
+    }
+
+    // Also honor whatever host `getAdoOrgBase` resolves — covers custom
+    // prUrlBase values (e.g. self-hosted Azure DevOps Server) that don't
+    // match either canonical alias.
     const base = shared.getAdoOrgBase(project);
-    if (typeof base !== 'string' || !base.startsWith('http')) return null;
-    const m = base.match(/^(https?:\/\/[^/]+)/);
-    return m ? `${m[1]}/` : null;
+    if (typeof base === 'string' && base.startsWith('http')) {
+      const m = base.match(/^(https?:\/\/[^/]+)/);
+      if (m) scopes.add(`${m[1]}/`);
+    }
+
+    // Stable alphabetical order so tests can assert deterministically.
+    return Array.from(scopes).sort();
   } catch (_e) {
-    return null;
+    return [];
   }
 }
 
-function _buildHeaderArgs(token, scopeUrl) {
-  const key = scopeUrl ? `http.${scopeUrl}.extraHeader` : 'http.extraHeader';
-  return ['-c', `${key}=Authorization: Bearer ${token}`];
+function _buildHeaderArgs(token, scopeUrls) {
+  // Empty/null scopes → degenerate unscoped fallback (matches pre-W-mped1zap
+  // behavior). Still safe because we only inject this for ADO projects.
+  if (!Array.isArray(scopeUrls) || scopeUrls.length === 0) {
+    return ['-c', `http.extraHeader=Authorization: Bearer ${token}`];
+  }
+  const args = [];
+  for (const scopeUrl of scopeUrls) {
+    args.push('-c', `http.${scopeUrl}.extraHeader=Authorization: Bearer ${token}`);
+  }
+  return args;
 }
 
 function _acquireToken(opts = {}) {
@@ -98,7 +137,7 @@ function getAdoGitExtraArgs(project, opts = {}) {
   if (!isAdoProject(project)) return [];
   const now = Date.now();
   if (_cached && _cached.expiresAt > now) {
-    return _buildHeaderArgs(_cached.token, _resolveScopeUrl(project));
+    return _buildHeaderArgs(_cached.token, _resolveScopeUrls(project));
   }
   if (now < _backoffUntil) return [];
   try {
@@ -109,7 +148,7 @@ function getAdoGitExtraArgs(project, opts = {}) {
       return [];
     }
     _cached = { token, expiresAt: now + TOKEN_TTL_MS };
-    return _buildHeaderArgs(token, _resolveScopeUrl(project));
+    return _buildHeaderArgs(token, _resolveScopeUrls(project));
   } catch (e) {
     _backoffUntil = now + ACQUIRE_BACKOFF_MS;
     const firstLine = String(e && e.message || e).split('\n')[0];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.1989",
+  "version": "0.1.1990",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"