@yemi33/minions 0.1.2197 → 0.1.2199

package/engine/pr-resolve.js

@@ -0,0 +1,443 @@
+/**
+ * engine/pr-resolve.js — Projectless PR reference resolver + diff/metadata fetcher.
+ *
+ * Plan: projectless-pr-actions, item P-ppa10001. Foundation for all projectless
+ * PR actions (review / summarize / comment / triage with no configured project
+ * and no local clone).
+ *
+ * Two responsibilities:
+ *  1. `normalizePrRef(input)` — accept any GitHub or ADO PR URL OR the canonical
+ *     `github:owner/repo#N` / `ado:org/proj/repo#N` id and return a normalized
+ *     `{ host, slug, repo, number, ... }` struct. Reuses the existing parsers in
+ *     engine/shared.js (`parsePrUrl`, `parseCanonicalPrId`).
+ *  2. `fetchPrPayload(refOrInput)` — fetch `{ diff, title, body, comments, author }`
+ *     for that PR WITHOUT a configured project or clone, via `gh` (GitHub) and the
+ *     ADO REST API (`_apis/git/...`).
+ *
+ * Token routing is per-slug through engine/gh-token.js#resolveTokenForSlug; for an
+ * unknown GitHub slug (no mapping, no fleet default) it falls back across the
+ * authed accounts configured in `engine.ghAccounts` rather than relying on the
+ * active `gh auth` profile. It NEVER runs `gh auth switch`. ADO tokens come from
+ * engine/ado-token.js (`az account get-access-token` / azureauth).
+ *
+ * All shell-outs use argv form (shell:false) and slug/number are validated before
+ * interpolation, so poisoned PR refs cannot inject shell metacharacters.
+ */
+
+const path = require('path');
+const shared = require('./shared');
+const ghToken = require('./gh-token');
+const adoToken = require('./ado-token');
+
+const { safeJson, MINIONS_DIR, log } = shared;
+
+const GH_FETCH_TIMEOUT_MS = 30000;
+const GH_MAX_BUFFER = 20 * 1024 * 1024; // diffs can be large
+const ADO_FETCH_TIMEOUT_MS = 30000;
+const ADO_API_VERSION = '7.1';
+
+// ── Normalization ───────────────────────────────────────────────────────────
+
+/**
+ * Turn a `{ scope, prNumber }` pair (as returned by shared.parsePrUrl /
+ * parseCanonicalPrId) into a normalized projectless PR ref. Returns null when the
+ * scope is not a recognizable github/ado scope or the number is not a positive int.
+ */
+function _normalizeFromScope(scope, number) {
+  if (!scope || typeof scope !== 'string') return null;
+  const num = Number(number);
+  if (!Number.isInteger(num) || num <= 0) return null;
+
+  const sepIdx = scope.indexOf(':');
+  if (sepIdx <= 0) return null;
+  const host = scope.slice(0, sepIdx).toLowerCase();
+  const slug = scope.slice(sepIdx + 1);
+  const segs = slug.split('/').filter(Boolean);
+
+  if (host === 'github') {
+    if (segs.length !== 2) return null;
+    const [owner, repo] = segs;
+    return {
+      host: 'github',
+      scope,
+      slug: `${owner}/${repo}`,
+      owner,
+      repo,
+      number: num,
+      id: `github:${owner}/${repo}#${num}`,
+    };
+  }
+  if (host === 'ado') {
+    if (segs.length !== 3) return null;
+    const [org, project, repo] = segs;
+    return {
+      host: 'ado',
+      scope,
+      slug: `${org}/${project}/${repo}`,
+      org,
+      project,
+      repo,
+      number: num,
+      id: `ado:${org}/${project}/${repo}#${num}`,
+    };
+  }
+  return null;
+}
+
+/**
+ * Normalize any PR URL (GitHub or ADO) OR canonical id (`github:owner/repo#N` /
+ * `ado:org/proj/repo#N`) into `{ host, slug, repo, number, ... }`. Returns null
+ * when the input is unrecognizable. Idempotent on an already-normalized ref.
+ */
+function normalizePrRef(input) {
+  if (input && typeof input === 'object' && input.host && input.slug && input.number) {
+    // Already a normalized ref — re-derive defensively so callers can pass either.
+    return _normalizeFromScope(input.scope || `${input.host}:${input.slug}`, input.number);
+  }
+  const text = String(input == null ? '' : input).trim();
+  if (!text) return null;
+  // URL forms first, then the canonical `host:scope#N` id form.
+  const parsed = shared.parsePrUrl(text) || shared.parseCanonicalPrId(text);
+  if (!parsed) return null;
+  return _normalizeFromScope(parsed.scope, parsed.prNumber);
+}
+
+// ── Config (for the unknown-slug account fallback) ───────────────────────────
+
+function _readConfig(opts = {}) {
+  if (opts.config) return opts.config;
+  return safeJson(path.join(MINIONS_DIR, 'config.json')) || {};
+}
+
+// ── GitHub fetch ─────────────────────────────────────────────────────────────
+
+function _dedupeTokens(tokens) {
+  const seen = new Set();
+  let sawAmbient = false;
+  const out = [];
+  for (const t of tokens) {
+    if (t == null) {
+      if (sawAmbient) continue;
+      sawAmbient = true;
+    } else {
+      const key = String(t);
+      if (seen.has(key)) continue;
+      seen.add(key);
+    }
+    out.push(t);
+  }
+  return out;
+}
+
+/**
+ * Build the ordered list of GH tokens to try for `slug`:
+ *  - the per-slug mapped token first (when `engine.ghAccounts` maps the owner or
+ *    a fleet default applies), else
+ *  - one token per distinct authed account in `engine.ghAccounts` (the
+ *    unknown-slug fallback — never the active `gh auth` profile), else
+ *  - `null`, meaning "let `gh` use its ambient identity".
+ */
+function _githubTokenCandidates(slug, opts = {}) {
+  const resolveTokenForSlug = opts._resolveTokenForSlug || ghToken.resolveTokenForSlug;
+  const tokenForAccount = opts._tokenForAccount || ghToken.tokenForAccount;
+  const listAccounts = opts._listConfiguredAccounts || ghToken.listConfiguredAccounts;
+
+  const config = _readConfig(opts);
+  const candidates = [];
+  const mapped = resolveTokenForSlug(slug, { config });
+  if (mapped) {
+    candidates.push(mapped);
+  } else {
+    for (const account of listAccounts({ config })) {
+      const tok = tokenForAccount(account, { config });
+      if (tok) candidates.push(tok);
+    }
+  }
+  if (!candidates.length) candidates.push(null);
+  return _dedupeTokens(candidates);
+}
+
+async function _fetchGitHubPayload(ref, opts = {}) {
+  const runGh = opts._shellSafeGh || shared.shellSafeGh;
+  const slug = shared.validateGhSlug(ref.slug);
+  const num = shared.validatePrNum(ref.number);
+  const tokens = _githubTokenCandidates(slug, opts);
+
+  let lastErr = null;
+  for (const token of tokens) {
+    try {
+      const env = token ? { ...process.env, GH_TOKEN: token } : process.env;
+      const ghOpts = { env, timeout: GH_FETCH_TIMEOUT_MS, maxBuffer: GH_MAX_BUFFER };
+
+      const prRaw = await runGh(['api', `repos/${slug}/pulls/${num}`], ghOpts);
+      const pr = JSON.parse(prRaw);
+
+      // Unified diff via the diff media type (raw text, not JSON).
+      let diff = '';
+      try {
+        diff = String(await runGh(
+          ['api', '-H', 'Accept: application/vnd.github.v3.diff', `repos/${slug}/pulls/${num}`],
+          ghOpts,
+        ) || '');
+      } catch (e) {
+        log('warn', `pr-resolve: GitHub diff fetch failed for ${ref.id}: ${e?.message || e}`);
+      }
+
+      // Issue comments (PR conversation). Review comments are a separate endpoint;
+      // the conversation comments are the relevant untrusted surface for triage.
+      let comments = [];
+      try {
+        const raw = await runGh(['api', '--paginate', `repos/${slug}/issues/${num}/comments`], ghOpts);
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed)) {
+          comments = parsed.map((c) => ({ author: c?.user?.login || '', body: c?.body || '' }));
+        }
+      } catch (e) {
+        log('warn', `pr-resolve: GitHub comments fetch failed for ${ref.id}: ${e?.message || e}`);
+      }
+
+      return {
+        ref,
+        host: 'github',
+        number: num,
+        slug,
+        title: pr.title || '',
+        body: pr.body || '',
+        author: pr?.user?.login || '',
+        diff,
+        comments,
+      };
+    } catch (e) {
+      lastErr = e;
+    }
+  }
+  throw new Error(`pr-resolve: GitHub PR fetch failed for ${ref.id}: ${lastErr ? (lastErr.message || lastErr) : 'no authed account'}`);
+}
+
+// ── ADO fetch ─────────────────────────────────────────────────────────────────
+
+async function _defaultAdoFetch(url, token) {
+  const res = await fetch(url, {
+    headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+    signal: AbortSignal.timeout(ADO_FETCH_TIMEOUT_MS),
+  });
+  if (!res.ok) throw new Error(`ADO API ${res.status}: ${res.statusText}`);
+  const text = await res.text();
+  if (!text || text.trimStart().startsWith('<')) {
+    throw new Error(`ADO returned HTML instead of JSON (likely auth redirect) for ${url.split('?')[0]}`);
+  }
+  return JSON.parse(text);
+}
+
+function _flattenAdoThreads(threads) {
+  const out = [];
+  for (const thread of (threads?.value || [])) {
+    for (const c of (thread?.comments || [])) {
+      // Skip ADO system threads (status changes, vote updates, etc).
+      if (c?.commentType && c.commentType !== 'text') continue;
+      const body = c?.content || '';
+      if (!body) continue;
+      out.push({ author: c?.author?.displayName || c?.author?.uniqueName || '', body });
+    }
+  }
+  return out;
+}
+
+function _formatAdoChanges(changes) {
+  const entries = changes?.changeEntries || changes?.value || [];
+  const lines = [];
+  for (const ch of entries) {
+    const p = ch?.item?.path || ch?.originalPath || '';
+    if (!p) continue;
+    lines.push(`${(ch?.changeType || 'edit')}\t${p}`);
+  }
+  return lines.join('\n');
+}
+
+async function _fetchAdoPayload(ref, opts = {}) {
+  const doFetch = opts._adoFetch || _defaultAdoFetch;
+  let token = opts.adoToken;
+  if (!token) {
+    const acquire = opts._acquireAdoToken || adoToken.acquireAdoToken;
+    const acquired = await acquire();
+    token = acquired && acquired.token;
+  }
+  if (!token) throw new Error(`pr-resolve: could not acquire ADO token for ${ref.id}`);
+
+  const orgBase = opts.adoOrgBase || `https://dev.azure.com/${encodeURIComponent(ref.org)}`;
+  const project = encodeURIComponent(ref.project);
+  const repo = encodeURIComponent(ref.repo);
+  const base = `${orgBase}/${project}/_apis/git/repositories/${repo}/pullRequests/${ref.number}`;
+
+  const pr = await doFetch(`${base}?api-version=${ADO_API_VERSION}`, token);
+
+  let comments = [];
+  try {
+    const threads = await doFetch(`${base}/threads?api-version=${ADO_API_VERSION}`, token);
+    comments = _flattenAdoThreads(threads);
+  } catch (e) {
+    log('warn', `pr-resolve: ADO threads fetch failed for ${ref.id}: ${e?.message || e}`);
+  }
+
+  // ADO has no single unified-diff endpoint without a clone; the latest
+  // iteration's change list is the projectless diff surrogate downstream can fence.
+  let diff = '';
+  try {
+    const iters = await doFetch(`${base}/iterations?api-version=${ADO_API_VERSION}`, token);
+    const last = (iters?.value || []).slice(-1)[0];
+    if (last && last.id != null) {
+      const changes = await doFetch(`${base}/iterations/${last.id}/changes?api-version=${ADO_API_VERSION}`, token);
+      diff = _formatAdoChanges(changes);
+    }
+  } catch (e) {
+    log('warn', `pr-resolve: ADO changes fetch failed for ${ref.id}: ${e?.message || e}`);
+  }
+
+  return {
+    ref,
+    host: 'ado',
+    number: ref.number,
+    slug: ref.slug,
+    title: pr.title || '',
+    body: typeof pr.description === 'string' ? pr.description : '',
+    author: pr?.createdBy?.displayName || pr?.createdBy?.uniqueName || '',
+    diff,
+    comments,
+  };
+}
+
+// ── Branch / clone metadata (for the temp-clone executor, P-ppa10006) ────────
+
+function _stripRefsHeads(ref) {
+  return typeof ref === 'string' ? ref.replace(/^refs\/heads\//, '') : '';
+}
+
+/**
+ * Fetch the source/target branch names + a clone URL for a PR with NO configured
+ * project and NO local clone. The temp-clone fix executor (engine/pr-temp-clone.js)
+ * needs the PR's HEAD branch to clone + push the fix back to, plus the clone URL
+ * (fork-aware on GitHub). Token routing mirrors `fetchPrPayload` (per-slug GH
+ * tokens / ADO bearer); shell-outs are argv-form and validated.
+ *
+ * Returns `{ ref, host, slug, number, sourceBranch, targetBranch, cloneUrl,
+ *            sourceRepoSlug, isFork }`. `sourceBranch` is validated via
+ * `shared.validateGitRef` before return so a poisoned ref name can never reach a
+ * downstream `git` invocation. Throws when the branch can't be resolved.
+ */
+async function _fetchGitHubBranches(ref, opts = {}) {
+  const runGh = opts._shellSafeGh || shared.shellSafeGh;
+  const slug = shared.validateGhSlug(ref.slug);
+  const num = shared.validatePrNum(ref.number);
+  const tokens = _githubTokenCandidates(slug, opts);
+
+  let lastErr = null;
+  for (const token of tokens) {
+    try {
+      const env = token ? { ...process.env, GH_TOKEN: token } : process.env;
+      const ghOpts = { env, timeout: GH_FETCH_TIMEOUT_MS };
+      const prRaw = await runGh(['api', `repos/${slug}/pulls/${num}`], ghOpts);
+      const pr = JSON.parse(prRaw);
+
+      const sourceBranch = pr?.head?.ref ? String(pr.head.ref).trim() : '';
+      if (!sourceBranch) throw new Error('PR head.ref missing');
+      shared.validateGitRef(sourceBranch);
+
+      const sourceRepoSlug = pr?.head?.repo?.full_name || slug;
+      const isFork = sourceRepoSlug.toLowerCase() !== slug.toLowerCase();
+      const cloneUrl = pr?.head?.repo?.clone_url || `https://github.com/${sourceRepoSlug}.git`;
+
+      return {
+        ref,
+        host: 'github',
+        slug,
+        number: num,
+        sourceBranch,
+        targetBranch: pr?.base?.ref ? String(pr.base.ref).trim() : '',
+        cloneUrl,
+        sourceRepoSlug,
+        isFork,
+      };
+    } catch (e) {
+      lastErr = e;
+    }
+  }
+  throw new Error(`pr-resolve: GitHub branch fetch failed for ${ref.id}: ${lastErr ? (lastErr.message || lastErr) : 'no authed account'}`);
+}
+
+async function _fetchAdoBranches(ref, opts = {}) {
+  const doFetch = opts._adoFetch || _defaultAdoFetch;
+  let token = opts.adoToken;
+  if (!token) {
+    const acquire = opts._acquireAdoToken || adoToken.acquireAdoToken;
+    const acquired = await acquire();
+    token = acquired && acquired.token;
+  }
+  if (!token) throw new Error(`pr-resolve: could not acquire ADO token for ${ref.id}`);
+
+  const orgBase = opts.adoOrgBase || `https://dev.azure.com/${encodeURIComponent(ref.org)}`;
+  const project = encodeURIComponent(ref.project);
+  const repo = encodeURIComponent(ref.repo);
+  const base = `${orgBase}/${project}/_apis/git/repositories/${repo}/pullRequests/${ref.number}`;
+  const pr = await doFetch(`${base}?api-version=${ADO_API_VERSION}`, token);
+
+  const sourceBranch = _stripRefsHeads(pr.sourceRefName);
+  if (!sourceBranch) throw new Error('PR sourceRefName missing');
+  shared.validateGitRef(sourceBranch);
+
+  const cloneUrl = pr?.repository?.remoteUrl || `${orgBase}/${project}/_git/${repo}`;
+  return {
+    ref,
+    host: 'ado',
+    slug: ref.slug,
+    number: ref.number,
+    sourceBranch,
+    targetBranch: _stripRefsHeads(pr.targetRefName),
+    cloneUrl,
+    sourceRepoSlug: ref.slug,
+    isFork: false,
+  };
+}
+
+/**
+ * Resolve a PR's branch + clone metadata projectlessly. Accepts a raw
+ * URL/canonical-id string or an already-normalized ref.
+ */
+async function fetchPrBranches(refOrInput, opts = {}) {
+  const ref = (refOrInput && typeof refOrInput === 'object' && refOrInput.host)
+    ? refOrInput
+    : normalizePrRef(refOrInput);
+  if (!ref) throw new Error(`pr-resolve: unrecognized PR reference: ${JSON.stringify(String(refOrInput).slice(0, 120))}`);
+  if (ref.host === 'github') return _fetchGitHubBranches(ref, opts);
+  if (ref.host === 'ado') return _fetchAdoBranches(ref, opts);
+  throw new Error(`pr-resolve: unsupported PR host: ${ref.host}`);
+}
+
+// ── Public entry ──────────────────────────────────────────────────────────────
+
+/**
+ * Resolve + fetch a PR's diff/metadata with no configured project. Accepts a raw
+ * URL/canonical-id string or an already-normalized ref. Returns
+ * `{ ref, host, number, slug, title, body, author, diff, comments }`.
+ * Throws when the input is unrecognizable or every fetch attempt fails.
+ */
+async function fetchPrPayload(refOrInput, opts = {}) {
+  const ref = (refOrInput && typeof refOrInput === 'object' && refOrInput.host)
+    ? refOrInput
+    : normalizePrRef(refOrInput);
+  if (!ref) throw new Error(`pr-resolve: unrecognized PR reference: ${JSON.stringify(String(refOrInput).slice(0, 120))}`);
+  if (ref.host === 'github') return _fetchGitHubPayload(ref, opts);
+  if (ref.host === 'ado') return _fetchAdoPayload(ref, opts);
+  throw new Error(`pr-resolve: unsupported PR host: ${ref.host}`);
+}
+
+module.exports = {
+  normalizePrRef,
+  fetchPrPayload,
+  fetchPrBranches,
+  // Exported for testing.
+  _normalizeFromScope,
+  _githubTokenCandidates,
+  _flattenAdoThreads,
+  _formatAdoChanges,
+  _stripRefsHeads,
+};