@yemi33/minions 0.1.2452 → 0.1.2454

package/dashboard/js/render-prs.js

@@ -150,31 +150,50 @@ function prAutomationToggle(idMatch, automation, label, enabled) {
 // renders "Unknown" rather than borrowing the agent name. Links to the provider
 // profile only when a validated http(s) URL is present.
 function _prAuthorCellHtml(pr) {
-  var a = pr ? pr.author : null;
-  var login = '';
-  var displayName = '';
-  var url = '';
-  if (a && typeof a === 'object') {
-    login = a.login || '';
-    displayName = a.displayName || '';
-    url = a.url || '';
-  } else if (typeof a === 'string') {
-    login = a;
-  }
-  var primary = displayName || login;
+  var info = (window.MinionsPrAuthor && window.MinionsPrAuthor.display)
+    ? window.MinionsPrAuthor.display(pr ? pr.author : null)
+    : { name: '', handle: '', url: '' };
+  var primary = info.name;
   if (!primary) {
     return '<span style="color:var(--muted);font-size:var(--text-base)" title="Author unavailable">Unknown</span>';
   }
-  var secondary = (displayName && login && login !== displayName) ? login : '';
+  var secondary = info.handle;
   var inner = escapeHtml(primary)
     + (secondary ? ' <span style="color:var(--muted);font-size:var(--text-base)">@' + escapeHtml(secondary) + '</span>' : '');
   var titleText = secondary ? primary + ' (' + secondary + ')' : primary;
-  if (url && /^https?:\/\//i.test(url)) {
-    return '<a class="pr-agent" title="' + escapeHtml(titleText) + '" href="' + escapeHtml(safeUrl(url)) + '" target="_blank" rel="noopener">' + inner + '</a>';
+  if (info.url) {
+    return '<a class="pr-agent" title="' + escapeHtml(titleText) + '" href="' + escapeHtml(safeUrl(info.url)) + '" target="_blank" rel="noopener">' + inner + '</a>';
   }
   return '<span class="pr-agent" title="' + escapeHtml(titleText) + '">' + inner + '</span>';
 }
 
+// W-msd8pr2300ev95e1 — Foreign-author guardrail for the AutoFix column. When
+// auto-fix is ENABLED and the PR was NOT authored by the current authenticated
+// identity for that provider, render a prominent warning so the operator sees
+// that Minions may push commits to someone else's PR. Ownership tri-state is
+// stamped engine-side (pr._authorOwnership) from STABLE provider identities and
+// fails CLOSED: 'unknown' shows an "author ownership unknown" warning rather
+// than silently treating the PR as self-authored. Never warns when auto-fix is
+// off (no automatic pushes happen) or when ownership is 'self'.
+function _prAutoFixForeignAuthorWarning(pr, autoFixEnabled) {
+  if (!autoFixEnabled) return '';
+  var ownership = pr && pr._authorOwnership;
+  if (ownership === 'self') return '';
+  var isForeign = ownership === 'foreign';
+  // Author name is presentation-only (never an email) via the shared formatter.
+  var authorName = (window.MinionsPrAuthor && window.MinionsPrAuthor.name)
+    ? window.MinionsPrAuthor.name(pr ? pr.author : null) : '';
+  var label = isForeign
+    ? (authorName
+        ? 'Auto-fix enabled for another author\'s PR (author: ' + authorName + ')'
+        : 'Auto-fix enabled for another author\'s PR')
+    : 'Auto-fix enabled but author ownership unknown';
+  var cls = 'pr-autofix-warning' + (isForeign ? ' pr-autofix-warning--foreign' : ' pr-autofix-warning--unknown');
+  return '<span class="' + cls + '" role="img" '
+    + 'title="' + escapeHtml(label) + '" '
+    + 'aria-label="' + escapeHtml(label) + '">\u26A0</span>';
+}
+
 function prRow(pr) {
   // Minions review (agent) state — separate from ADO human review
   const sq = pr.minionsReview || {};
@@ -325,6 +344,7 @@ function prRow(pr) {
     : pr.contextOnly !== true;
   var autoFixBtn = prAutomationToggle(idMatch, 'fix', 'Auto Fix', autoFixEnabled);
   var autoReviewBtn = prAutomationToggle(idMatch, 'review', 'Auto Review', autoReviewEnabled);
+  var autoFixWarning = _prAutoFixForeignAuthorWarning(pr, autoFixEnabled);
   // Title attrs live on the inner element (link/span/badge) so hovering the
   // ellipsis-truncated content reveals the full text. Cell tags stay bare so
   // the header-to-cell count assertion in test/unit.test.js continues to
@@ -348,7 +368,7 @@ function prRow(pr) {
     '<td><span class="' + branchClass + '" title="' + escapeHtml(branchError || branchLabel) + '">' + escapeHtml(branchLabel) + '</span>' + pendingReasonHtml + '</td>' +
     '<td>' + authorCellHtml + '</td>' +
     '<td>' + reviewerCell + '</td>' +
-    '<td>' + (autoFixBtn || '<span style="color:var(--muted);font-size:var(--text-base)">—</span>') + '</td>' +
+    '<td>' + (autoFixBtn ? autoFixBtn + autoFixWarning : '<span style="color:var(--muted);font-size:var(--text-base)">—</span>') + '</td>' +
     '<td>' + (autoReviewBtn || '<span style="color:var(--muted);font-size:var(--text-base)">—</span>') + '</td>' +
     '<td><span class="pr-date" title="' + escapeHtml(createdLabel) + '">' + escapeHtml(createdLabel) + '</span></td>' +
     '<td><button class="btn-destructive" style="padding:1px 5px" data-pr-id="' + escapeHtml(String(prId)) + '" onclick="event.stopPropagation();unlinkPr(this.dataset.prId)" title="Remove from tracking">x</button></td>' +
@@ -622,15 +642,14 @@ function _renderPrDetail(pr) {
   // so operators can answer both "who is this for?" and "which agent handled it?".
   let author = '';
   {
-    const a = pr.author;
-    let login = '', displayName = '', url = '';
-    if (a && typeof a === 'object') { login = a.login || ''; displayName = a.displayName || ''; url = a.url || ''; }
-    else if (typeof a === 'string') { login = a; }
-    const primary = displayName || login;
+    const info = (window.MinionsPrAuthor && window.MinionsPrAuthor.display)
+      ? window.MinionsPrAuthor.display(pr.author)
+      : { name: '', handle: '', url: '' };
+    const primary = info.name;
     if (primary) {
-      const secondary = (displayName && login && login !== displayName) ? ' <span style="color:var(--muted)">@' + escapeHtml(login) + '</span>' : '';
-      const valHtml = (url && /^https?:\/\//i.test(url))
-        ? '<a href="' + escapeHtml(safeUrl(url)) + '" target="_blank" rel="noopener">' + escapeHtml(primary) + '</a>' + secondary
+      const secondary = info.handle ? ' <span style="color:var(--muted)">@' + escapeHtml(info.handle) + '</span>' : '';
+      const valHtml = info.url
+        ? '<a href="' + escapeHtml(safeUrl(info.url)) + '" target="_blank" rel="noopener">' + escapeHtml(primary) + '</a>' + secondary
         : escapeHtml(primary) + secondary;
       author = '<div><strong style="color:var(--muted);font-size:var(--text-base)">Author:</strong> ' + valHtml + '</div>';
     } else {

package/dashboard/js/render-work-items.js

@@ -210,7 +210,12 @@ function wiRow(item) {
     var prRef = prFollowup.parent_pr_id || prFollowup.parent_pr_url;
     var prNumMatch = String(prRef).match(/(\d+)(?!.*\d)/);
     var prLabel = prNumMatch ? ('PR #' + prNumMatch[1]) : 'parent PR';
-    followupChip = ' <a class="pr-badge draft" style="font-size:var(--text-sm);text-decoration:none" target="_blank" rel="noopener" href="' + escapeHtml(prFollowup.parent_pr_url) + '" title="Follow-up dispatched from ' + escapeHtml(prRef) + (prFollowup.parent_comment_author ? ' by ' + escapeHtml(prFollowup.parent_comment_author) : '') + '" onclick="event.stopPropagation()">&#8617; from ' + escapeHtml(prLabel) + '</a>';
+    var followupBy = prFollowup.parent_comment_author
+      ? ((window.MinionsPrAuthor && window.MinionsPrAuthor.name)
+          ? window.MinionsPrAuthor.name(prFollowup.parent_comment_author)
+          : prFollowup.parent_comment_author)
+      : '';
+    followupChip = ' <a class="pr-badge draft" style="font-size:var(--text-sm);text-decoration:none" target="_blank" rel="noopener" href="' + escapeHtml(prFollowup.parent_pr_url) + '" title="Follow-up dispatched from ' + escapeHtml(prRef) + (followupBy ? ' by ' + escapeHtml(followupBy) : '') + '" onclick="event.stopPropagation()">&#8617; from ' + escapeHtml(prLabel) + '</a>';
   }
   return '<tr data-wi-id="' + escapeHtml(item.id) + '" style="cursor:pointer" onclick="if(shouldIgnoreSelectionClick(event))return;openWorkItemDetail(\'' + escapeHtml(item.id) + '\',\'' + escapeHtml(item._source || '') + '\')">' +
     '<td style="min-width:280px;max-width:320px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap" title="' + escapeHtml((item.title || '').slice(0, 200)) + '">' + escapeHtml(item.title || '') + followupChip + '</td>' +

package/dashboard/js/settings.js

@@ -780,6 +780,10 @@ async function openSettings() {
       settingsField('Operator login (used in branch names)', 'set-operatorLogin', e.operatorLogin || '', '', 'Override the human operator login used in user/<loginname>/<wi-id>-<slug> branches. Empty = auto-resolve via gh / git email / OS username (currently resolves to: ' + (e._resolvedOperatorLogin || 'unknown') + ')') +
       settingsField('Ignored Comment Authors', 'set-ignoredCommentAuthors', (e.ignoredCommentAuthors || []).join(', '), '', 'Comma-separated usernames — comments auto-closed, never trigger fixes') +
     '</div>' +
+    '<div class="settings-grid-2">' +
+      settingsField('ADO identity id', 'set-operatorAdoIdentityId', (e.operatorAdoIdentity && e.operatorAdoIdentity.id) || '', '', 'Your Azure DevOps identity GUID. Used ONLY to determine whether an auto-fix-enabled ADO PR is your own vs another author\'s (foreign-author warning). Empty = ADO ownership shows as "unknown". Never an email.') +
+      settingsField('ADO identity descriptor', 'set-operatorAdoIdentityDescriptor', (e.operatorAdoIdentity && e.operatorAdoIdentity.descriptor) || '', '', 'Your Azure DevOps identity descriptor (e.g. aad.<base64>). Alternative stable identity for the foreign-author ownership check. Never an email.') +
+    '</div>' +
     '<h4>Experimental Behavior</h4>' +
     '<div class="settings-stack">' +
       settingsToggle('Allow Temp Agents', 'set-allowTempAgents', !!e.allowTempAgents, 'Spawn ephemeral agents when all permanent agents are busy') +
@@ -1724,6 +1728,10 @@ async function saveSettings() {
       spawnPhaseGraceMs: secToMs('set-spawnPhaseGraceMs'),
       spawnPhaseMaxCpuSeconds: document.getElementById('set-spawnPhaseMaxCpuSeconds').value,
       operatorLogin: (document.getElementById('set-operatorLogin')?.value ?? '').trim(),
+      operatorAdoIdentity: {
+        id: (document.getElementById('set-operatorAdoIdentityId')?.value ?? '').trim(),
+        descriptor: (document.getElementById('set-operatorAdoIdentityDescriptor')?.value ?? '').trim(),
+      },
       autoApprovePlans: document.getElementById('set-autoApprovePlans').checked,
       evalLoop: document.getElementById('set-evalLoop').checked,
       autoDecompose: document.getElementById('set-autoDecompose').checked,

package/dashboard/shared/pr-author.js

@@ -0,0 +1,75 @@
+// Shared PR author display formatter (browser). Single source of truth for
+// turning a structured PR author identity into a human-readable NAME that never
+// exposes an email address, reused by every dashboard surface that renders a PR
+// author (the classic Pull Requests table cell + detail panel, and the shared
+// author filter — which slim embeds too). Mirrors engine/core/shared.js
+// prAuthorDisplayName so the label the operator sees matches the projected SQL
+// label; keep the two in sync (pinned by test/unit/pr-author.test.js).
+//
+// The structured identity fields (login/id/descriptor/url) are left untouched:
+// this is a presentation-only transform, not destructive normalization of the
+// machine identity used for filtering, matching, and reconciliation.
+
+(function () {
+  function _text(value) {
+    if (value == null) return '';
+    return typeof value === 'string' ? value.trim() : String(value).trim();
+  }
+
+  // A human-readable name from ONE identity fragment that never contains an
+  // email address. Any '@' forces local-part extraction ("Name <addr>" keeps the
+  // display part; a bare/embedded address drops the domain). '' when unusable.
+  function _fragmentName(raw) {
+    var s = _text(raw);
+    if (!s) return '';
+    var m = s.match(/^\s*"?([^"<]*?)"?\s*<[^>]*>\s*$/);
+    if (m && m[1].trim() && m[1].indexOf('@') === -1) return m[1].trim();
+    if (s.indexOf('@') !== -1) {
+      s = s.replace(/<([^>]*)>/, '$1');
+      return s.split('@')[0].replace(/^["'<\s]+|["'>\s]+$/g, '').trim();
+    }
+    return s;
+  }
+
+  // Accept the canonical author shape, a raw provider createdBy object, or a
+  // bare string. `login` also reads ADO's `uniqueName`; `displayName` its `name`.
+  function _fields(author) {
+    if (author && typeof author === 'object') {
+      return {
+        displayName: _text(author.displayName) || _text(author.name),
+        login: _text(author.login) || _text(author.uniqueName),
+        id: _text(author.id),
+        url: _text(author.url),
+      };
+    }
+    if (typeof author === 'string') return { displayName: '', login: _text(author), id: '', url: '' };
+    return { displayName: '', login: '', id: '', url: '' };
+  }
+
+  // Human-readable name that NEVER exposes an email address. '' → render Unknown.
+  function name(author) {
+    var f = _fields(author);
+    return _fragmentName(f.displayName) || _fragmentName(f.login) || f.id || '';
+  }
+
+  // Optional secondary handle (rendered as "@handle"). Only a real login with no
+  // '@' that adds information beyond the name — never an email address.
+  function handle(author) {
+    var f = _fields(author);
+    if (f.login && f.login.indexOf('@') === -1 && f.login !== name(author)) return f.login;
+    return '';
+  }
+
+  // A validated http(s) profile URL, or '' — so a caller never links an
+  // unvalidated href.
+  function url(author) {
+    var f = _fields(author);
+    return /^https?:\/\//i.test(f.url) ? f.url : '';
+  }
+
+  function display(author) {
+    return { name: name(author), handle: handle(author), url: url(author) };
+  }
+
+  window.MinionsPrAuthor = { name: name, handle: handle, url: url, display: display };
+})();

package/dashboard/shared/pr-filters.js

@@ -35,14 +35,37 @@ function _prFilterKey(value) {
   return window.MinionsRecordFilters.key(value);
 }
 
+function _prAuthorSource(pr) {
+  if (!pr || typeof pr !== 'object') return null;
+  return pr.author || pr.createdBy || pr.created_by || null;
+}
+
+// Stable machine identity for the author filter VALUE (grouping key). Prefers a
+// non-email provider id/descriptor/login so two people who happen to share a
+// display name do not collapse, and an email is never used as a visible label.
+// The displayed option text stays the email-free name from normalizePrAuthor.
+function _prAuthorMachineKey(source) {
+  if (!source) return '';
+  if (typeof source === 'string') return source;
+  if (typeof source !== 'object') return '';
+  return _prFilterText(source.id)
+    || _prFilterText(source.descriptor)
+    || _prFilterText(source.login)
+    || _prFilterText(source.uniqueName)
+    || _prFilterText(source.displayName)
+    || _prFilterText(source.name);
+}
+
 function normalizePrAuthor(pr) {
-  if (!pr || typeof pr !== 'object') return '';
   // Real author only. Deliberately NOT falling back to pr.agent: the Minions
   // agent is a separate identity (W-mscibegy005e8b74) and a legacy record with
   // no author must group/render as Unknown rather than borrow the agent name.
-  return _prFilterName(pr.author)
-    || _prFilterName(pr.createdBy)
-    || _prFilterName(pr.created_by);
+  // The email-free display name comes from the shared formatter so the filter
+  // dropdown matches the PR table's Author column (W-msd8ls85).
+  var src = _prAuthorSource(pr);
+  if (!src) return '';
+  if (window.MinionsPrAuthor && window.MinionsPrAuthor.name) return window.MinionsPrAuthor.name(src);
+  return _prFilterName(src);
 }
 
 function normalizePrLifecycleStatus(pr) {
@@ -96,7 +119,7 @@ function _prFilterEntry(pr, dimension) {
   var value = '';
   if (dimension === 'author') {
     label = normalizePrAuthor(pr);
-    value = _prFilterKey(label);
+    value = _prFilterKey(_prAuthorMachineKey(_prAuthorSource(pr)) || label);
   } else if (dimension === 'lifecycle') {
     value = normalizePrLifecycleStatus(pr);
     label = PR_LIFECYCLE_FILTER_LABELS[value] || _formatPrFilterLabel(value);

package/dashboard/styles.css

@@ -518,6 +518,18 @@
     outline: 2px solid var(--blue); outline-offset: 2px;
   }
 
+  /* W-msd8pr2300ev95e1 — AutoFix foreign-author guardrail warning icon. Sits
+     beside the Auto Fix toggle when auto-fix is enabled on a PR the current
+     identity did not author (foreign), or when ownership can't be established
+     (unknown). Cursor:help so the accessible tooltip is discoverable. */
+  .pr-autofix-warning {
+    display: inline-block; margin-left: var(--space-3);
+    vertical-align: middle; cursor: help; font-size: var(--text-base);
+    line-height: 1;
+  }
+  .pr-autofix-warning--foreign { color: var(--red, #f85149); }
+  .pr-autofix-warning--unknown { color: var(--yellow, #d29922); }
+
   .archive-btn {
     background: var(--surface2); border: 1px solid var(--border); color: var(--muted);
     font-size: var(--text-base); padding: var(--space-2) var(--space-5); border-radius: var(--radius-sm); cursor: pointer; transition: all var(--transition-base); margin-left: auto;

package/dashboard-build.js

@@ -13,7 +13,7 @@ const MINIONS_DIR = __dirname;
 // 'wi-filters' publishes window.MinionsWorkItemFilters (the Work Items table's
 // filter + sort semantics), consumed by render-work-items.js — hence it precedes
 // the renderer bundle (DASHBOARD_JS_FILES) too.
-const DASHBOARD_SHARED_JS = ['record-filters', 'pr-merge-state', 'pr-filters', 'wi-filters', 'cc-suggestions', 'cc-limits', 'cc-queue-store', 'model-display', 'watches-source', 'project-git-summary', 'welcome-popup'];
+const DASHBOARD_SHARED_JS = ['record-filters', 'pr-merge-state', 'pr-author', 'pr-filters', 'wi-filters', 'cc-suggestions', 'cc-limits', 'cc-queue-store', 'model-display', 'watches-source', 'project-git-summary', 'welcome-popup'];
 
 // ── Canonical classic-dashboard assembly manifest ──────────────────────────
 // Single source of truth, consumed by BOTH assemblers: buildDashboardHtml()

package/docs/pr-author-identity.md

@@ -62,8 +62,15 @@ agent id. `pr.agent` is now **never** a human login.
   non-empty incoming value wins, otherwise the existing value is preserved, so a
   **partial provider refresh never erases a richer author already stored**. A
   provider change trusts the newer identity wholesale.
-- `prAuthorLabel(author)` — human-readable label (displayName → login → id) for
-  the typed SQL column and filter/search text.
+- `prAuthorDisplayName(author)` — the **email-free** human-readable name every
+  surface should show. Prefers a real `displayName` → `login`, and only when the
+  sole usable identity is an email does it fall back to the **local-part** (domain
+  dropped). Any `@` anywhere forces local-part extraction, so a malformed value
+  (`"Name <a@b>"`, `weird@x@y`, a bare address) can never leak an `@`. Returns
+  `''` (→ **Unknown**) when nothing usable remains. Presentation only — the
+  structured `login`/`id`/`descriptor` fields are left untouched.
+- `prAuthorLabel(author)` — thin delegate to `prAuthorDisplayName` (kept for
+  callers wanting a "label"); therefore also email-free.
 
 `upsertPullRequestRecord` normalizes `author` on the create path and merges it
 via `mergePrAuthorIdentity` on the update path (and in `_mergeDuplicatePrInto`),
@@ -76,7 +83,11 @@ manual link, dashboard enrich, dedup — converge on one merge behavior.
 projection column (plus `idx_pr_author`). The canonical structured identity
 always lives in the row's `data` JSON; the column is a label projection for
 filters/sort. `engine/persistence/pull-requests-store.js` writes it via a local
-`_authorLabel(pr.author)` (displayName → login → id).
+`_authorLabel(pr.author)` (displayName → login → id). This column feeds only the
+`idx_pr_author` index for server-side filter/sort — it is **never selected back
+or surfaced to any client** (reads return the `data` JSON), so it may still
+contain an email and is deliberately left as machine-facing projection, not a
+display label.
 
 Backfill is **fail-closed**. A legacy row whose `agent` is a human login (i.e.
 not `'human'`, not a configured Minions agent id from `config.json`, not
@@ -96,14 +107,26 @@ alongside the existing `agent` field.
 
 ## Dashboard
 
+Every dashboard surface that shows a PR author routes through **one** shared
+browser formatter, `window.MinionsPrAuthor` (`dashboard/shared/pr-author.js`),
+which mirrors the engine `prAuthorDisplayName` so the operator-visible name is
+always **email-free** — an ADO author stored as `Name <email>` or a bare email
+`uniqueName` renders as the name / email local-part, never the address. It is
+listed in `DASHBOARD_SHARED_JS` before `pr-filters`, so classic and slim share it.
+
 `dashboard/js/render-prs.js` replaces the Pull Requests table's **Agent** column
-with **Author** (display name + `@login`, safely escaped, linked to the provider
-profile only when a validated `http(s)` URL is present). The Minions agent stays
-visible in the PR detail panel under **Minions agent**, next to a new **Author**
-line, so operators can still answer both "who is this for?" and "which agent
-handled it?". The shared author filter (`dashboard/shared/pr-filters.js`) now
-reads structured `pr.author` only and no longer falls back to `pr.agent`, so the
-filter and the displayed column stay aligned (legacy rows group as Unknown).
+with **Author** (`MinionsPrAuthor.display` → name + optional `@handle` — a handle
+is offered only for a real non-email login, safely escaped, linked to the
+provider profile only when a validated `http(s)` URL is present). The Minions
+agent stays visible in the PR detail panel under **Minions agent**, next to the
+**Author** line, so operators can still answer both "who is this for?" and "which
+agent handled it?". The shared author filter (`dashboard/shared/pr-filters.js`)
+shows the same email-free **label** while grouping on a stable machine **key**
+(`id` → `descriptor` → `login` → … via `_prAuthorMachineKey`), so two people who
+share a display name never collapse and the filter stays aligned with the column
+(legacy rows group as Unknown). The work-item follow-up chip
+(`dashboard/js/render-work-items.js`) strips the email from a
+`pr_followup.parent_comment_author` the same way.
 
 ## Backward-compatible reads
 
@@ -112,3 +135,33 @@ filter and the displayed column stay aligned (legacy rows group as Unknown).
 author string keeps rendering. This is a tolerant read, not a retained
 compatibility shim — the overloaded `agent = login` write behavior was removed
 outright (no `docs/deprecated.json` entry required).
+
+## AutoFix foreign-author guardrail (W-msd8pr2300ev95e1)
+
+When AutoFix is enabled on a PR whose author is **not** the current authenticated
+identity for that provider/repo scope, the Pull Requests table's **AutoFix** cell
+renders a prominent warning icon beside the toggle: a red `⚠`
+("Auto-fix enabled for another author's PR", naming the author when known) or, if
+ownership cannot be established, a yellow `⚠` ("author ownership unknown"). This
+never changes behavior — enabling auto-fix on another author's PR stays an
+explicit operator action — it only surfaces the risk.
+
+Ownership is resolved by `shared.resolvePrAuthorOwnership(pr, selfByProvider)`
+(`self` | `foreign` | `unknown`) using **stable provider identities only** —
+GitHub canonical `login` / numeric `id`; ADO identity `id` / `descriptor`. Display
+names and emails are never compared, and the determination **fails closed** to
+`unknown` (shown as the neutral warning, never silently treated as self) whenever
+either side's stable identity is missing.
+
+`engine/core/queries.js#getPullRequests` stamps `pr._authorOwnership` once per
+build, resolving the current identity per provider:
+
+- **GitHub** — `operator-identity.resolveGithubViewerLoginStrict(config)`, which
+  accepts only `engine.operatorLogin` or `gh api user` (never a git-email / OS
+  fallback).
+- **ADO** — the optional operator-configured `engine.operatorAdoIdentity`
+  (`{ id?, descriptor? }`). There is no automatic ADO current-identity seam, so
+  when it is unset every ADO PR reports `unknown` (fail-closed). Set it under
+  **Settings → Operator & Comments → ADO identity id / descriptor**. It is a
+  read-only identity value (like `operatorLogin`), never an email — the ADO
+  `uniqueName`/login is deliberately excluded from both storage and comparison.

package/engine/api/settings-validation.js

@@ -108,6 +108,7 @@ const ENGINE_SPECIAL_FIELDS = new Set([
   'ccWorkerIdleTimeoutMs',
   'worktreeRoot',
   'operatorLogin',
+  'operatorAdoIdentity',
   'defaultCli',
   'defaultModel',
   'ccCli',
@@ -338,6 +339,30 @@ function applyEngineSettings(candidate, bodyEngine, errors) {
     const value = parseClearableString(bodyEngine.operatorLogin, 'engine.operatorLogin', errors);
     setOrDelete(engine, 'operatorLogin', value);
   }
+  if (hasOwn(bodyEngine, 'operatorAdoIdentity')) {
+    // Structured ADO self-identity used ONLY by the AutoFix foreign-author
+    // guardrail (id/descriptor — never email). An empty object clears it.
+    const raw = bodyEngine.operatorAdoIdentity;
+    if (raw === null || raw === undefined || CLEAR_SENTINELS.has(raw)) {
+      delete engine.operatorAdoIdentity;
+    } else if (typeof raw === 'object') {
+      const next = {};
+      if (raw.id !== undefined && raw.id !== null && raw.id !== '') {
+        const id = parseString(raw.id, 'engine.operatorAdoIdentity.id', errors);
+        if (id) next.id = id;
+      }
+      if (raw.descriptor !== undefined && raw.descriptor !== null && raw.descriptor !== '') {
+        const descriptor = parseString(raw.descriptor, 'engine.operatorAdoIdentity.descriptor', errors);
+        if (descriptor) next.descriptor = descriptor;
+      }
+      if (Object.keys(next).length) engine.operatorAdoIdentity = next;
+      else delete engine.operatorAdoIdentity;
+    } else {
+      errors.add('engine.operatorAdoIdentity', 'invalid-object',
+        'engine.operatorAdoIdentity must be an object with id and/or descriptor', raw,
+        { expected: 'object' });
+    }
+  }
   for (const key of ['defaultCli', 'ccCli']) {
     if (!hasOwn(bodyEngine, key)) continue;
     const value = parseRuntimeName(bodyEngine[key], `engine.${key}`, errors);

package/engine/core/operator-identity.js

@@ -75,9 +75,31 @@ function resolveOperatorLogin(config, { force = false } = {}) {
 
 // Clear the process-lifetime cache. Called by the dashboard when the operator
 // login override changes in Settings so the next resolve picks up the new value.
-function _resetOperatorLoginCacheForTest() { _cached = null; }
+function _resetOperatorLoginCacheForTest() { _cached = null; _cachedGithubViewer = null; }
+
+// ── Strict GitHub viewer login (W-msd8pr2300ev95e1) ─────────────────────────
+// Unlike resolveOperatorLogin, this NEVER falls back to the git-email localpart
+// or the OS username — those are not GitHub logins and must never be used to
+// decide "did the current GitHub token author this PR?". It accepts ONLY:
+//   1. `config.engine.operatorLogin` — explicit Settings override
+//   2. `gh api user --jq .login`     — the token's own canonical login
+// and returns '' otherwise, so the caller fails CLOSED (author ownership
+// "unknown") rather than guessing self-authorship from a weak fallback.
+let _cachedGithubViewer = null;
+function resolveGithubViewerLoginStrict(config, { force = false } = {}) {
+  if (!force && _cachedGithubViewer !== null) return _cachedGithubViewer;
+  const override = config?.engine?.operatorLogin;
+  if (override && typeof override === 'string' && override.trim()) {
+    _cachedGithubViewer = override.trim();
+    return _cachedGithubViewer;
+  }
+  const ghLogin = _execImpl('gh api user --jq .login');
+  _cachedGithubViewer = ghLogin ? ghLogin : '';
+  return _cachedGithubViewer;
+}
 
 module.exports = {
   resolveOperatorLogin,
+  resolveGithubViewerLoginStrict,
   _resetOperatorLoginCacheForTest,
 };

package/engine/core/queries.js

@@ -1151,6 +1151,28 @@ function getPullRequests(config) {
   const projectByName = new Map(projects.map(p => [p.name, p]));
   const allPrs = [];
 
+  // W-msd8pr2300ev95e1 — resolve the CURRENT authenticated identity per provider
+  // ONCE (cached) so we can stamp each PR's author-ownership tri-state for the
+  // AutoFix foreign-author guardrail. STABLE identities only (GitHub canonical
+  // login / numeric id; ADO id / descriptor) — never display names or emails.
+  // Fails CLOSED: a missing/blank provider entry yields 'unknown'.
+  const selfByProvider = {};
+  try {
+    const ghLogin = require('./operator-identity').resolveGithubViewerLoginStrict(config);
+    if (ghLogin) selfByProvider.github = { login: ghLogin };
+  } catch { /* identity resolution is best-effort; absence → unknown */ }
+  try {
+    const adoSelf = config?.engine?.operatorAdoIdentity;
+    if (adoSelf && typeof adoSelf === 'object') {
+      const entry = {};
+      if (adoSelf.id) entry.id = String(adoSelf.id);
+      if (adoSelf.descriptor) entry.descriptor = String(adoSelf.descriptor);
+      // Deliberately NOT copying uniqueName/login: ADO login is an email, and
+      // the guardrail contract forbids comparing emails.
+      if (Object.keys(entry).length) selfByProvider.ado = entry;
+    }
+  } catch { /* best-effort */ }
+
   // SQL is the canonical (and only) PR store after Phase 9.
   const store = require('../persistence/pull-requests-store');
   const sqlPrs = store.readAllPullRequests() || [];
@@ -1231,6 +1253,10 @@ function getPullRequests(config) {
     // dashboards / API consumers can render a chip without re-parsing
     // _noOpFixes themselves.
     pr._pausedCauses = shared.getPrPausedCauses(pr);
+    // W-msd8pr2300ev95e1 — author-ownership tri-state for the AutoFix
+    // foreign-author warning. 'self' | 'foreign' | 'unknown' (fail closed).
+    try { pr._authorOwnership = shared.resolvePrAuthorOwnership(pr, selfByProvider); }
+    catch { pr._authorOwnership = shared.PR_AUTHOR_OWNERSHIP.UNKNOWN; }
     allPrs.push(pr);
   }
   allPrs.sort((a, b) => {

package/engine/core/shared.js

@@ -8702,11 +8702,113 @@ function mergePrAuthorIdentity(existing, incoming) {
   return out;
 }
 
-// Human-readable label for a PR author (typed SQL column + filter/search text).
-function prAuthorLabel(author) {
+// A human-readable name from ONE identity fragment that never contains an email
+// address:
+//  - "Display Name <user@example.com>" → "Display Name"
+//  - "user@example.com"                → "user"   (local-part, domain dropped)
+//  - "Display Name"                    → "Display Name"
+// Any '@' anywhere forces local-part extraction, so a malformed address can
+// never leak through. Returns '' when nothing usable remains.
+function _authorFragmentName(raw) {
+  let s = _authorField(raw, 256);
+  if (!s) return '';
+  // "Name <addr>" — keep the display part when it is a real (non-email) name.
+  const m = s.match(/^\s*"?([^"<]*?)"?\s*<[^>]*>\s*$/);
+  if (m && m[1].trim() && m[1].indexOf('@') === -1) return m[1].trim();
+  if (s.indexOf('@') !== -1) {
+    s = s.replace(/<([^>]*)>/, '$1'); // unwrap a "<addr>"
+    return s.split('@')[0].replace(/^["'<\s]+|["'>\s]+$/g, '').trim();
+  }
+  return s;
+}
+
+// Human-readable author name that NEVER exposes an email address. Prefers a real
+// provider display name / login, and only when the sole usable identity is an
+// email does it fall back to the local-part (no domain). Returns '' (→ renders
+// "Unknown") when nothing usable is present. The structured identity fields
+// (login/id/descriptor) are untouched — this is a presentation label only.
+function prAuthorDisplayName(author) {
   const a = normalizePrAuthorIdentity(author);
   if (!a) return '';
-  return a.displayName || a.login || a.id || '';
+  return _authorFragmentName(a.displayName)
+    || _authorFragmentName(a.login)
+    || _authorField(a.id, 64)
+    || '';
+}
+
+// Human-readable label for a PR author (typed SQL column + filter/search text).
+// Routed through prAuthorDisplayName so the projected label is always email-free.
+function prAuthorLabel(author) {
+  return prAuthorDisplayName(author);
+}
+
+// ── Foreign-author ownership for the AutoFix guardrail (W-msd8pr2300ev95e1) ──
+//
+// Decide whether the CURRENT authenticated identity for a PR's provider authored
+// that PR, so the dashboard can warn when auto-fix is enabled on someone else's
+// PR (Minions would push commits to a PR the operator only asked to read/review).
+//
+// STABLE identities only — never display names or emails:
+//   GitHub: canonical login (case-insensitive) or numeric id.
+//   ADO:    identity id or descriptor (exact), or uniqueName login (ci).
+//
+// Fail CLOSED: returns 'unknown' whenever EITHER the PR author identity or the
+// current provider identity cannot be established. The caller must render an
+// "author ownership unknown" warning rather than treating unknown as self.
+//
+// `selfByProvider` is `{ github: { login, id }, ado: { id, descriptor, login } }`
+// resolved by the caller (queries.js) from the per-provider token identity; a
+// missing provider entry (or empty fields) yields 'unknown' for that provider.
+const PR_AUTHOR_OWNERSHIP = { SELF: 'self', FOREIGN: 'foreign', UNKNOWN: 'unknown' };
+
+function _ciEq(a, b) {
+  const x = _authorField(a, 256).toLowerCase();
+  const y = _authorField(b, 256).toLowerCase();
+  return !!x && x === y;
+}
+function _exactEq(a, b) {
+  const x = _authorField(a, 256);
+  const y = _authorField(b, 256);
+  return !!x && x === y;
+}
+
+function _prProviderFromRecord(pr, author) {
+  const p = _authorField(author && author.provider, 32).toLowerCase();
+  if (p === 'github' || p === 'ado') return p;
+  const id = _authorField(pr && pr.id, 128).toLowerCase();
+  if (id.startsWith('github:') || id.startsWith('gh:')) return 'github';
+  if (id.startsWith('ado:')) return 'ado';
+  const url = _authorField(pr && pr.url, 400).toLowerCase();
+  if (url.includes('github.com')) return 'github';
+  if (url.includes('dev.azure.com') || url.includes('visualstudio.com') || url.includes('/_git/')) return 'ado';
+  return '';
+}
+
+function resolvePrAuthorOwnership(pr, selfByProvider) {
+  const author = normalizePrAuthorIdentity(pr && pr.author);
+  if (!author) return PR_AUTHOR_OWNERSHIP.UNKNOWN;
+  const provider = _prProviderFromRecord(pr, author);
+  if (!provider) return PR_AUTHOR_OWNERSHIP.UNKNOWN;
+  const self = selfByProvider && selfByProvider[provider];
+  if (!self) return PR_AUTHOR_OWNERSHIP.UNKNOWN;
+
+  if (provider === 'github') {
+    const haveSelf = _authorField(self.login, 256) || _authorField(self.id, 64);
+    const haveAuthor = _authorField(author.login, 256) || _authorField(author.id, 64);
+    if (!haveSelf || !haveAuthor) return PR_AUTHOR_OWNERSHIP.UNKNOWN;
+    if (_exactEq(self.id, author.id) || _ciEq(self.login, author.login)) return PR_AUTHOR_OWNERSHIP.SELF;
+    return PR_AUTHOR_OWNERSHIP.FOREIGN;
+  }
+  // ADO: compare stable identity id/descriptor ONLY. ADO `login` is the
+  // uniqueName (a sign-in email), and the guardrail contract forbids comparing
+  // emails, so it is deliberately excluded here.
+  const haveSelf = _authorField(self.id, 64) || _authorField(self.descriptor, 256);
+  const haveAuthor = _authorField(author.id, 64) || _authorField(author.descriptor, 256);
+  if (!haveSelf || !haveAuthor) return PR_AUTHOR_OWNERSHIP.UNKNOWN;
+  if (_exactEq(self.id, author.id) || _exactEq(self.descriptor, author.descriptor)) {
+    return PR_AUTHOR_OWNERSHIP.SELF;
+  }
+  return PR_AUTHOR_OWNERSHIP.FOREIGN;
 }
 
 function _jsonEqual(a, b) {
@@ -9396,16 +9498,35 @@ function classifyPrRefForVerification(prRef, project = null) {
 // .parent_pr_url). Description-only PR mentions are INTENTIONALLY skipped
 // per the "structured-vs-loose split" — enrollment must be intentional.
 //
+// Enrollment mode is type-dependent (W-msd8pr2300ev95e1): mutating PR-requiring
+// types (fix / test / build-fix-complex) enroll AUTO-MANAGED (contextOnly:false)
+// — the normal coding workflow; a read-only `review` WI enrolls CONTEXT-ONLY so
+// a "review this PR" request never silently enables auto-fix on the PR.
+//
 // Returns:
-//   { skipped: true, reason }            — not a pr-requiring type / no ref / no URL / upsert error
-//   { alreadyEnrolled: true, id }        — PR already tracked
-//   { enrolled: true, id, scope }        — newly enrolled
+//   { skipped: true, reason }                       — not a pr-requiring type / no ref / no URL / upsert error
+//   { alreadyEnrolled: true, id }                   — PR already tracked
+//   { enrolled: true, id, scope, contextOnly }      — newly enrolled (contextOnly true for review)
 const _PR_REQUIRING_TYPES = new Set([
   WORK_TYPE.FIX,
   WORK_TYPE.BUILD_FIX_COMPLEX,
   WORK_TYPE.REVIEW,
   WORK_TYPE.TEST,
 ]);
+// W-msd8pr2300ev95e1 — READ-ONLY PR-requiring types. A `review` WI enrolls the
+// PR record so the review dispatch clears the `pr_not_found` gate (the #536
+// rationale), but a human "review this PR" request is one-shot / read-review
+// intent by default: it must NOT enable auto-fix, auto-review, auto-merge, or
+// any future automatic fix / re-review dispatch on someone else's PR. So a
+// review enrollment is context-only. The explicit review WI still dispatches
+// (isExplicitlyRequestedPrDispatch keeps work-item-sourced review dispatches
+// even on a contextOnly PR), and the upsert's non-demote guard means a review
+// WI that happens to target an ALREADY auto-managed PR (a normal coding
+// workflow) never demotes it. Mutating PR-requiring types (fix / test /
+// build-fix-complex) stay auto-managed — that is the normal coding workflow.
+const _READ_ONLY_PR_ENROLL_TYPES = new Set([
+  WORK_TYPE.REVIEW,
+]);
 function autoEnrollPrFromWorkItem(item, project, minionsDir) {
   if (!item || !_PR_REQUIRING_TYPES.has(item.type)) return { skipped: true, reason: 'not-pr-requiring-type' };
   const prRef = extractStructuredWorkItemPrRef(item);
@@ -9420,6 +9541,7 @@ function autoEnrollPrFromWorkItem(item, project, minionsDir) {
   const parsedUrl = parsePrUrl(url);
   const prNum = parsedUrl ? parsedUrl.prNumber : null;
   const prId = getCanonicalPrId(project, prRef, url);
+  const readOnlyEnroll = _READ_ONLY_PR_ENROLL_TYPES.has(item.type);
   try {
     const result = upsertPullRequestRecord(source, {
       id: prId,
@@ -9432,10 +9554,15 @@ function autoEnrollPrFromWorkItem(item, project, minionsDir) {
       status: 'active',
       created: new Date().toISOString(),
       url,
-      contextOnly: false,
+      // Read-review intent enrolls context-only with the per-row automation
+      // controls explicitly OFF (belt-and-suspenders over the contextOnly
+      // default derivation), so no later default change can silently re-enable
+      // auto-fix on a review-enrolled PR.
+      contextOnly: readOnlyEnroll,
+      ...(readOnlyEnroll ? { autoFixEnabled: false, autoReviewEnabled: false } : {}),
     }, { project, itemId: item.id });
     return result.created
-      ? { enrolled: true, id: result.id, scope: stateScope(source) }
+      ? { enrolled: true, id: result.id, scope: stateScope(source), contextOnly: readOnlyEnroll }
       : { alreadyEnrolled: true, id: result.id };
   } catch (e) {
     log('warn', `autoEnrollPrFromWorkItem ${item.id}: ${e.message}`);
@@ -11087,6 +11214,9 @@ module.exports = {
   normalizePrAuthorIdentity,
   mergePrAuthorIdentity,
   prAuthorLabel,
+  prAuthorDisplayName,
+  resolvePrAuthorOwnership,
+  PR_AUTHOR_OWNERSHIP,
   applyPrFieldDelta,
   normalizePrRecord,
   normalizePrRecords,

package/engine/db/migrations/032-review-enrolled-pr-context-only.js

@@ -0,0 +1,95 @@
+// engine/db/migrations/032-review-enrolled-pr-context-only.js
+//
+// W-msd8pr2300ev95e1 — repair PR records that were SILENTLY auto-enrolled by a
+// review request.
+//
+// Regression: PR #536 widened `autoEnrollPrFromWorkItem` from FIX-only to
+// {FIX, REVIEW, TEST} and enrolled every one with `contextOnly:false`. Because
+// `isPrAutoFixEnabled` / `isPrAutoReviewEnabled` derive from `!contextOnly`
+// when no explicit boolean is stored, a human "review this PR" request turned
+// another author's PR into an AUTO-MANAGED record — the engine then dispatched
+// fixes/re-reviews and pushed commits to a PR the operator only asked to read.
+// The code fix makes review enrollment context-only going forward; this
+// migration conservatively repairs records already enrolled that way.
+//
+// CONSERVATIVE, STRUCTURED-PROVENANCE ONLY — never title/description text:
+//   1. status === 'active'                     (don't touch merged/abandoned)
+//   2. contextOnly !== true                    (currently auto-managed by default)
+//   3. NO explicit autoFixEnabled/autoReviewEnabled boolean stored
+//        → an explicitly TRACKED PR (POST /api/pull-requests/link,
+//          /api/pr-action/track, or the per-row automation toggle) always
+//          persists these booleans, so this gate alone preserves every
+//          intentionally-tracked record.
+//   4. agent === 'human'                       (the sentinel autoEnroll stamps;
+//          excludes agent-authored/synced coding PRs, which stay tracked)
+//   5. prdItems links to >= 1 still-existing work item, and EVERY linked,
+//      still-existing work item is type `review` (no fix/test/implement/…):
+//        → proves the record's only provenance is a read-review request. If a
+//          mutating WI is linked, or no linked WI still exists, we cannot prove
+//          review-only provenance and DO NOT touch the record.
+//
+// Repair = set contextOnly:true + autoFixEnabled:false + autoReviewEnabled:false
+// (belt-and-suspenders), matching the new read-review enrollment shape.
+
+function _hasTable(db, table) {
+  return !!db.prepare(`
+    SELECT 1 FROM sqlite_master WHERE type='table' AND name=?
+  `).get(table);
+}
+
+module.exports = {
+  version: 32,
+  description: 'repair review-enrolled PRs to context-only (W-msd8pr2300ev95e1)',
+  up(db) {
+    if (!_hasTable(db, 'pull_requests')) return;
+
+    // Build id -> type map for every work item. Archived items live in the same
+    // `work_items` table (migration 021 added an `archived` column, not a
+    // separate table), so this single scan covers both live and archived rows.
+    const wiTypeById = new Map();
+    if (_hasTable(db, 'work_items')) {
+      for (const row of db.prepare('SELECT id, type FROM work_items').all()) {
+        if (row && row.id) wiTypeById.set(String(row.id), String(row.type || '').trim().toLowerCase());
+      }
+    }
+
+    const rows = db.prepare('SELECT scope, id, agent, status, data FROM pull_requests').all();
+    const update = db.prepare('UPDATE pull_requests SET data = ? WHERE scope = ? AND id = ?');
+
+    let repaired = 0;
+
+    for (const row of rows) {
+      let record;
+      try { record = JSON.parse(row.data); }
+      catch { continue; }
+      if (!record || typeof record !== 'object') continue;
+
+      // (1) active only.
+      if (String(record.status || row.status || '').toLowerCase() !== 'active') continue;
+      // (2) currently auto-managed by default (not already context-only).
+      if (record.contextOnly === true) continue;
+      // (3) no explicit per-row automation booleans → excludes intentional tracking.
+      if (typeof record.autoFixEnabled === 'boolean' || typeof record.autoReviewEnabled === 'boolean') continue;
+      // (4) enrolled under the human sentinel (autoEnroll stamp), not an agent author.
+      if (String(record.agent || row.agent || '').trim().toLowerCase() !== 'human') continue;
+
+      // (5) structured provenance: every linked, still-existing WI is a review.
+      const links = Array.isArray(record.prdItems) ? record.prdItems : [];
+      const knownTypes = [];
+      for (const wiId of links) {
+        const t = wiTypeById.get(String(wiId));
+        if (t) knownTypes.push(t);
+      }
+      if (knownTypes.length === 0) continue; // cannot prove provenance → leave alone
+      if (!knownTypes.every(t => t === 'review')) continue; // a mutating WI is linked → coding workflow
+
+      record.contextOnly = true;
+      record.autoFixEnabled = false;
+      record.autoReviewEnabled = false;
+      update.run(JSON.stringify(record), row.scope, row.id);
+      repaired += 1;
+    }
+
+    console.log(`[db-migrate] v32: repaired ${repaired} review-enrolled PR record(s) to context-only`);
+  },
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2452",
+  "version": "0.1.2454",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"