@yemi33/minions 0.1.2355 → 0.1.2357

package/engine/queries.js

@@ -72,6 +72,25 @@ function _resetPrEnrichmentCacheForTest() {
   _prEnrichmentInFlight.clear();
 }
 
+// W-mrcs8yqk001o6893 — shared enrichment-fallback resolver. Both the prLinks
+// loop and the wi._pr fallback loop in getPrdInfo() need the SAME defensive
+// behavior when the canonical PR id has no live record in pull-requests.json
+// (e.g. it was merged and then swept by the merged-PR cleanup routine): check
+// the enrichment cache first, else synthesize PR_STATUS.ACTIVE as a
+// placeholder and kick off a fire-and-forget enrollment so the next poll
+// (within PR_ENRICHMENT_TTL_MS) resolves the real status. Previously only the
+// wi._pr loop did this (W-mq5uzmc6001d708f); the prLinks loop hardcoded
+// `pr?.status || PR_STATUS.ACTIVE` with no self-heal, so PRs reached only via
+// pr_links stayed 'active' forever once removed from pull-requests.json.
+function _resolvePrStatusWithEnrichment(pr, canonicalPrId, project, itemId) {
+  if (pr?.status) return pr.status;
+  if (!canonicalPrId) return PR_STATUS.ACTIVE;
+  const cachedStatus = _getCachedPrEnrichment(canonicalPrId);
+  if (cachedStatus) return cachedStatus;
+  _scheduleAsyncPrEnrollment(canonicalPrId, project, itemId);
+  return PR_STATUS.ACTIVE;
+}
+
 /**
  * Read the first `bytes` and last `bytes` of a file efficiently using byte offsets.
  * For files <= 2*bytes, reads the whole file. Returns { head, tail } strings.
@@ -572,15 +591,6 @@ function _buildArchiveNotesByWiMap() {
   return out;
 }
 
-// Test/maintenance hook — drop the archive notes cache (mirrors the other
-// invalidate* helpers). Not normally needed: the cache self-heals via the
-// dir-mtime gate + TTL.
-function invalidateArchiveNotesByWiCache() {
-  _archiveNotesByWiCache = null;
-  _archiveNotesByWiCacheAt = 0;
-  _archiveNotesByWiCacheMtime = null;
-}
-
 // Build a wiId → [filename, ...] map by scanning the inbox + archive dirs.
 // Archive entries are prefixed with `archive:` so the dashboard renderer can
 // tell them apart (matches the convention already used by _artifacts.notes).
@@ -883,13 +893,16 @@ function _prFreshnessMs(pr) {
 function _pickPrDedupeWinner(group, projects) {
   if (group.length === 1) return { winner: group[0], dropped: [] };
 
-  // Map each project name -> its canonical scope, so we can detect when a
-  // record's _scope matches the PR url-derived scope (preference #2 below).
-  const projectScopeByName = new Map();
+  // Map each project name -> its set of canonical scopes (primary +
+  // additionalRepoScopes, W-mrchrfe100067d3a), so we can detect when a
+  // record's _scope matches the PR url-derived scope (preference #2 below)
+  // even when the match is via an allowlisted secondary scope rather than
+  // the project's primary repo.
+  const projectScopesByName = new Map();
   for (const p of projects || []) {
     if (!p || !p.name) continue;
-    const sc = shared.getProjectPrScope(p);
-    if (sc) projectScopeByName.set(p.name, sc);
+    const scopes = shared.getProjectAllPrScopes(p);
+    if (scopes.length > 0) projectScopesByName.set(p.name, scopes);
   }
 
   // Resolve the PR's "correct" scope from its URL (independent of _scope).
@@ -907,8 +920,8 @@ function _pickPrDedupeWinner(group, projects) {
   //  bit 0: freshness rank (broken into a separate tiebreak after)
   function scoreOf(pr) {
     const scopeOk = !pr._invalidProjectScope ? 1 : 0;
-    const projectScope = projectScopeByName.get(pr._scope) || '';
-    const matchesUrl = urlScope && projectScope && projectScope === urlScope ? 1 : 0;
+    const projectScopes = projectScopesByName.get(pr._scope) || [];
+    const matchesUrl = urlScope && projectScopes.includes(urlScope) ? 1 : 0;
     return (scopeOk << 1) | matchesUrl;
   }
 
@@ -2360,7 +2373,18 @@ function getPrdInfo(config) {
     const url = buildPrUrlFromId(prId, pr, projects);
     for (const itemId of (itemIds || [])) {
       if (!prdToPr[itemId]) prdToPr[itemId] = [];
-      prdToPr[itemId].push({ id: prId, url, title: pr?.title || '', status: pr?.status || PR_STATUS.ACTIVE, _project: pr?._project || '' });
+      // W-mrcs8yqk001o6893 — when the pr_links mapping outlives the PR record
+      // (merged-PR sweep removes it from pull-requests.json but pr_links is
+      // never pruned), resolve the item's project so we can self-heal the
+      // status the same way the wi._pr fallback loop below does.
+      let itemProject = null;
+      if (!pr) {
+        const itemSource = (wiById[itemId] || allWiById[itemId] || {}).project
+          || (wiById[itemId] || allWiById[itemId] || {})._source || null;
+        itemProject = itemSource ? shared.resolveProjectSource(itemSource, projects, { allowCentral: false }).project || null : null;
+      }
+      const status = _resolvePrStatusWithEnrichment(pr, prId, itemProject, itemId);
+      prdToPr[itemId].push({ id: prId, url, title: pr?.title || '', status, _project: pr?._project || '' });
     }
   }
   // Fallback: work item _pr field for anything still missing
@@ -2376,17 +2400,8 @@ function getPrdInfo(config) {
     // exists (orphan _pr pointer), use a cached status from a prior async
     // enrollment if available, else synthesize ACTIVE and schedule a
     // fire-and-forget enrollment so the next status poll renders correctly.
-    let synthesizedStatus = pr?.status;
-    if (!pr && canonicalPrId) {
-      const cachedStatus = _getCachedPrEnrichment(canonicalPrId);
-      if (cachedStatus) {
-        synthesizedStatus = cachedStatus;
-      } else {
-        synthesizedStatus = PR_STATUS.ACTIVE;
-        _scheduleAsyncPrEnrollment(canonicalPrId, project, wi.id);
-      }
-    }
-    prdToPr[wi.id] = [{ id: pr?.id || canonicalPrId || wi._pr, url, title: pr?.title || '', status: synthesizedStatus || PR_STATUS.ACTIVE, _project: project?.name || '' }];
+    const synthesizedStatus = _resolvePrStatusWithEnrichment(pr, canonicalPrId, project, wi.id);
+    prdToPr[wi.id] = [{ id: pr?.id || canonicalPrId || wi._pr, url, title: pr?.title || '', status: synthesizedStatus, _project: project?.name || '' }];
   }
   // Aggregate sub-task PRs to decomposed parent (sub-tasks aren't PRD items but their PRs should show)
   for (const pr of allPrs) {
@@ -3419,7 +3434,7 @@ module.exports = {
   getKnowledgeBaseEntries, getKnowledgeBaseEntriesSnapshot, getKnowledgeBaseIndex,
 
   // Work items & PRD
-  getWorkItems, invalidateWorkItemsCache, invalidateArchiveNotesByWiCache, getPrdInfo,
+  getWorkItems, invalidateWorkItemsCache, getPrdInfo,
 
   // W-mq5uzmc6001d708f — test hooks for the defensive PR enrichment cache.
   _resetPrEnrichmentCacheForTest,

package/engine/shared.js

@@ -2306,8 +2306,47 @@ function runFile(file, args, opts = {}) {
   return _spawn(file, args, { windowsHide: true, ...opts });
 }
 
+// True when `p` is a UNC path (`\\server\share\...` or its forward-slash
+// form `//server/share/...`, e.g. `\\wsl.localhost\Ubuntu\...` / `\\wsl$\...`
+// for a WSL-hosted project). Windows' cmd.exe — the default shell
+// `execSync`/`exec` spawn under — refuses a UNC path as its working
+// directory ("UNC paths are not supported. Defaulting to Windows
+// directory."), which silently redirects the child's actual cwd elsewhere.
+function isUncPath(p) {
+  return typeof p === 'string' && (p.startsWith('\\\\') || p.startsWith('//'));
+}
+
+// Minimal argv tokenizer for the small, hardcoded `git ...` command strings
+// built elsewhere in this file — splits on whitespace, honoring
+// double-quoted segments (the only quoting these callers use, e.g. a branch
+// name interpolated as `"refs/heads/${branch}"`). Not a general shell
+// parser; only ever fed strings this codebase constructs itself.
+function _splitGitCommandLine(cmd) {
+  const argv = [];
+  const re = /"([^"]*)"|(\S+)/g;
+  let m;
+  while ((m = re.exec(cmd)) !== null) argv.push(m[1] !== undefined ? m[1] : m[2]);
+  return argv;
+}
+
 function execSilent(cmd, opts = {}) {
-  return _execSync(cmd, { stdio: 'pipe', windowsHide: true, ...opts });
+  const merged = { stdio: 'pipe', windowsHide: true, ...opts };
+  // W-mrcv3ky7000c2338 / opg#772 — a `git ...` shellout whose `cwd` is a UNC
+  // path (WSL-hosted project, or any other UNC-rooted checkout) would
+  // otherwise run through cmd.exe, which can't chdir into a UNC path and
+  // silently defaults to the Windows directory instead — the subsequent git
+  // command then fails with "fatal: not a git repository", and callers like
+  // cleanup.js's orphan/quarantine worktree-dir reaper have no ground truth
+  // for which worktrees are registered, so quarantined worktree husks are
+  // never reaped (unbounded disk growth). Re-parse into argv and run via
+  // execFileSync (shell:false) instead — that bypasses cmd.exe entirely and
+  // Windows' CreateProcess honors a UNC cwd correctly, exactly like
+  // shared.shellSafeGitSync / shared.removeWorktree already do.
+  if (typeof cmd === 'string' && /^git\b/.test(cmd.trim()) && isUncPath(merged.cwd)) {
+    const argv = _splitGitCommandLine(cmd);
+    return _execFileSync(argv[0], argv.slice(1), merged);
+  }
+  return _execSync(cmd, merged);
 }
 
 /**
@@ -7227,6 +7266,74 @@ function getPrScopeInfo(prRef, url = '') {
   return canonical ? { ...canonical, source: 'id' } : null;
 }
 
+// W-mrchrfe100067d3a — validate + normalize `project.additionalRepoScopes`,
+// an explicit per-project opt-in allowlist of secondary canonical PR scopes
+// (e.g. `["github:yemi33/minions"]` for the minions-opg project's live
+// checkout, which legitimately carries a second git remote for backport
+// work — see CLAUDE.md "Remotes"). Deliberately NOT a wildcard: a scope must
+// be an exact `host:owner/repo` (or ADO `host:org/project/repo`) match to be
+// treated as compatible, so a typo'd or malicious PR URL can't slip into
+// auto-management just because *some* additional scope is configured.
+// Returns a deduped, normalized (lowercase, trimmed) array of scope strings;
+// malformed / empty entries are silently dropped (read-side leniency — write
+// paths should validate with validateAdditionalRepoScopes instead).
+function getProjectAdditionalPrScopes(project) {
+  const raw = project?.additionalRepoScopes;
+  if (!Array.isArray(raw) || raw.length === 0) return [];
+  const out = [];
+  const seen = new Set();
+  for (const entry of raw) {
+    const scope = _normalizeScopeString(entry);
+    if (scope && !seen.has(scope)) {
+      seen.add(scope);
+      out.push(scope);
+    }
+  }
+  return out;
+}
+
+// Normalizes+validates a single scope string of the shape `github:owner/repo`
+// or `ado:org/project/repo`. Returns '' for anything malformed.
+function _normalizeScopeString(value) {
+  const match = String(value || '').trim().match(/^(github|ado):(.+)$/i);
+  if (!match) return '';
+  const host = match[1].toLowerCase();
+  const parts = match[2].split('/').map(normalizePrScopeSegment).filter(Boolean);
+  const expectedParts = host === 'github' ? 2 : 3;
+  if (parts.length !== expectedParts) return '';
+  return `${host}:${parts.join('/')}`;
+}
+
+// Validates a project-settings-update payload for `additionalRepoScopes`.
+// Mirrors the validateCheckoutMode/validateLiveValidation contract: returns
+// undefined when the caller should clear the field (empty/null/[] input);
+// otherwise returns the normalized array, or throws HTTP 400 on malformed
+// input (non-array, non-string entries, or entries that don't match the
+// canonical `host:owner/repo[/repo]` scope grammar).
+function validateAdditionalRepoScopes(value) {
+  if (value === undefined || value === null) return undefined;
+  if (!Array.isArray(value)) {
+    throw _httpError(400, `Invalid additionalRepoScopes: must be an array of scope strings (got ${typeof value}).`);
+  }
+  if (value.length === 0) return undefined;
+  const out = [];
+  const seen = new Set();
+  for (const entry of value) {
+    if (typeof entry !== 'string' || !entry.trim()) {
+      throw _httpError(400, `Invalid additionalRepoScopes entry: "${entry}" — must be a non-empty string.`);
+    }
+    const scope = _normalizeScopeString(entry);
+    if (!scope) {
+      throw _httpError(400, `Invalid additionalRepoScopes entry: "${entry}" — expected "github:owner/repo" or "ado:org/project/repo".`);
+    }
+    if (!seen.has(scope)) {
+      seen.add(scope);
+      out.push(scope);
+    }
+  }
+  return out.length > 0 ? out : undefined;
+}
+
 function getPrProjectScopeMismatch(project, prRef, url = '') {
   const projectScope = getProjectPrScope(project);
   if (!projectScope) return null;
@@ -7240,6 +7347,11 @@ function getPrProjectScopeMismatch(project, prRef, url = '') {
     const refParts = refRest.split('/');
     if (projectParts[0] === refParts[0] && projectParts[1] === refParts[1]) return null;
   }
+  // W-mrchrfe100067d3a — explicit opt-in allowlist: a PR scoped to one of
+  // this project's configured additionalRepoScopes is NOT a mismatch. This
+  // is intentionally an exact-match allowlist (not "any scope compatible")
+  // so an unrelated/typo'd repo URL still gets flagged.
+  if (getProjectAdditionalPrScopes(project).includes(refScope)) return null;
   return { reason: 'pr_scope_mismatch', projectScope, prScope: refScope };
 }
 
@@ -7247,6 +7359,85 @@ function isPrCompatibleWithProject(project, prRef, url = '') {
   return !getPrProjectScopeMismatch(project, prRef, url);
 }
 
+// All canonical scopes this project is configured to own: its primary scope
+// plus any additionalRepoScopes. Used by cross-project PR dedupe scoring
+// (queries.js) so a record scoped to a secondary allowlisted repo isn't
+// penalized relative to records in projects whose PRIMARY scope matches.
+function getProjectAllPrScopes(project) {
+  const primary = getProjectPrScope(project);
+  const additional = getProjectAdditionalPrScopes(project);
+  const out = [];
+  if (primary) out.push(primary);
+  for (const s of additional) if (!out.includes(s)) out.push(s);
+  return out;
+}
+
+// W-mrchrfe100067d3a — cache of `localPath -> Map(scope -> remoteName)`
+// derived from `git remote -v`, so repeated dependency-fetch resolution
+// within a tick (or across nearby ticks) doesn't re-shell-out per branch.
+const _gitRemoteScopeCache = new Map();
+const GIT_REMOTE_SCOPE_CACHE_TTL_MS = 5 * 60 * 1000;
+
+// Best-effort parse of a git remote fetch URL into a canonical scope string.
+// Handles the URL shapes git itself produces for `git remote -v` output:
+// SSH (`git@host:owner/repo.git`), HTTPS (`https://host/owner/repo.git`),
+// and the two common ADO host forms (`dev.azure.com/org/project/_git/repo`,
+// `org.visualstudio.com/project/_git/repo`). Returns null when unrecognized.
+function _parseRemoteUrlToScope(url) {
+  const cleaned = String(url || '').trim().replace(/\.git$/i, '');
+  if (!cleaned) return null;
+  let m = cleaned.match(/github\.com[:/]+([^/]+)\/([^/]+)\/?$/i);
+  if (m) return `github:${normalizePrScopeSegment(m[1])}/${normalizePrScopeSegment(m[2])}`;
+  m = cleaned.match(/dev\.azure\.com\/([^/]+)\/([^/]+)\/_git\/([^/]+)\/?$/i);
+  if (m) return `ado:${normalizePrScopeSegment(m[1])}/${normalizePrScopeSegment(m[2])}/${normalizePrScopeSegment(m[3])}`;
+  m = cleaned.match(/([^/@:]+)\.visualstudio\.com\/(?:DefaultCollection\/)?([^/]+)\/_git\/([^/]+)\/?$/i);
+  if (m) return `ado:${normalizePrScopeSegment(m[1])}/${normalizePrScopeSegment(m[2])}/${normalizePrScopeSegment(m[3])}`;
+  return null;
+}
+
+function _listGitRemoteScopes(localPath) {
+  if (!localPath) return new Map();
+  const now = Date.now();
+  const cached = _gitRemoteScopeCache.get(localPath);
+  if (cached && (now - cached.at) < GIT_REMOTE_SCOPE_CACHE_TTL_MS) return cached.remotes;
+  const remotes = new Map();
+  try {
+    const out = shellSafeGitSync(['remote', '-v'], { cwd: localPath, timeout: 10000 });
+    for (const line of String(out || '').split('\n')) {
+      const m = line.match(/^(\S+)\s+(\S+)\s+\(fetch\)/);
+      if (!m) continue;
+      const scope = _parseRemoteUrlToScope(m[2]);
+      if (scope && !remotes.has(scope)) remotes.set(scope, m[1]);
+    }
+  } catch { /* best effort — caller falls back to 'origin' */ }
+  _gitRemoteScopeCache.set(localPath, { at: now, remotes });
+  return remotes;
+}
+
+// W-mrchrfe100067d3a — resolve which git remote name owns a PR's branch when
+// that PR is scoped to one of the project's additionalRepoScopes entries
+// (e.g. a backport PR opened against `yemi33/minions` from the minions-opg
+// checkout, which has both `origin` -> opg-microsoft/minions and `yemi33` ->
+// yemi33/minions configured). For the project's own primary scope, or any
+// scope NOT in additionalRepoScopes, this always returns 'origin' —
+// preserving today's universal default for every project that doesn't opt
+// into multi-scope tracking. Only when the scope is allowlisted AND a local
+// remote's fetch URL actually resolves to that scope do we return the
+// non-origin remote name; otherwise 'origin' remains the safe fallback (the
+// caller's existing fetch-failure handling is unchanged).
+function resolveGitRemoteForPrScope(project, prScopeOrRef, url = '') {
+  if (!project) return 'origin';
+  const scope = (typeof prScopeOrRef === 'string' && /^(github|ado):/i.test(prScopeOrRef))
+    ? prScopeOrRef
+    : (getPrScopeInfo(prScopeOrRef, url)?.scope || '');
+  if (!scope) return 'origin';
+  const projectScope = getProjectPrScope(project);
+  if (scope === projectScope) return 'origin';
+  if (!getProjectAdditionalPrScopes(project).includes(scope)) return 'origin';
+  const remotes = _listGitRemoteScopes(project.localPath);
+  return remotes.get(scope) || 'origin';
+}
+
 /**
  * Check if a parsed ADO PR scope is compatible with a project config,
  * considering that the repo segment in the URL might be either the friendly
@@ -8012,12 +8203,21 @@ function mutatePullRequests(filePath, mutator) {
   if (insideMinionsDir) {
     const store = require('./pull-requests-store');
     const scope = store.scopeForFilePath(filePath);
+    // W-mrcg7j9k000ja233 (#759) — the JSON mirror is now written INSIDE
+    // applyPullRequestsMutation's SQL transaction (before commit), not here
+    // after the fact. Mirroring post-commit left a cross-process window
+    // where a sibling process (dashboard vs. engine — separate Node
+    // processes) could observe the new SQL row before the JSON file caught
+    // up and destructively rehydrate the scope from that stale file,
+    // dropping the just-written row. See
+    // pull-requests-store.js#applyPullRequestsMutation for the full
+    // rationale (mirrors the identical work-items-store.js fix,
+    // W-mr9vcxvy000cdb4e).
     const { wrote, result } = store.applyPullRequestsMutation(scope, (prs) => {
       if (!Array.isArray(prs)) prs = [];
       return mutator(prs) || prs;
-    });
+    }, { mirrorPath: filePath });
     if (wrote) {
-      try { store._mirrorJsonFromSql(scope, filePath); } catch { /* mirror best-effort */ }
       try { require('./db-events').emitStateEvent('pull_requests'); } catch { /* optional */ }
     }
     return result;
@@ -9013,6 +9213,7 @@ module.exports = {
   exec,
   execAsync,
   execSilent,
+  isUncPath,
   shellSafeGh,
   shellSafeGit,
   removeStaleIndexLock,
@@ -9098,6 +9299,10 @@ module.exports = {
   rewriteInboxRefsAcrossProjects,
   _artifactNoteFileToken, // exported so the one-time note-link backfill shares the token grammar
   getProjectPrScope,
+  getProjectAdditionalPrScopes,
+  getProjectAllPrScopes,
+  validateAdditionalRepoScopes,
+  resolveGitRemoteForPrScope,
   getPrNumber,
   getPrDisplayId,
   getPrScopeInfo,