yadflow 3.18.1 → 4.0.0-next.1

package/cli/platform.mjs

@@ -42,122 +42,80 @@ export function platformReady(platform) {
   return !!cli && has(cli);
 }
 
-// ---- roster role model (per-scope map, with legacy back-compat) ---------------------------------
-// A roster entry's roles live in a per-scope map: `roles: { hub: ["owner","reviewer"], <repo>: [...] }`.
-// `rolesForScope` normalizes the three shapes a roster entry can take on disk:
-//   1. new object map     — `entry.roles = { hub: [...], backend: [...] }`
-//   2. flat array variant — `entry.roles = ["owner","reviewer"]` (treated as hub roles)
-//   3. legacy single role — `entry.role = "owner"` (a hub role; pre per-scope schema)
-// The legacy `repos.json` `domain_owner` field is handled separately by resolveLogin's fallback.
-export function rolesForScope(entry, scope) {
-  if (!entry) return [];
-  const r = entry.roles;
-  if (r && typeof r === 'object' && !Array.isArray(r)) return Array.isArray(r[scope]) ? r[scope] : [];
-  if (Array.isArray(r)) return scope === 'hub' ? r : [];
-  if (typeof entry.role === 'string' && entry.role) return scope === 'hub' ? [entry.role] : [];
-  return [];
-}
-
-// True when the entry holds any of `wanted` roles across any of `scopes`.
-export function hasAnyRole(entry, scopes = [], wanted = []) {
-  for (const scope of scopes) {
-    for (const role of rolesForScope(entry, scope)) {
-      if (wanted.includes(role)) return true;
-    }
-  }
-  return false;
-}
-
-// Platform logins to auto-request as reviewers for the given scopes: everyone holding a `reviewer`
-// or `domain-owner` role in any scope, minus `excludeLogin` (you don't review your own PR), deduped.
-// `repos` (the registry) is consulted so a repo whose domain ownership lives ONLY in the legacy
-// `repos.json` `domain_owner`/`domain_owners` field — not the roster roles map — is still requested
-// as a reviewer for any scope that is its repo name. Without this the read side credits that login as
-// a domain-owner (resolveLogin's legacy fallback) but the open side never asks them, so an escalated
-// gate becomes structurally unsatisfiable through platform routing (BUG-1).
-export function reviewersForScopes(roster = [], scopes = [], { excludeLogin = null, repos = [] } = {}) {
-  const out = [];
-  const add = (login) => { if (login && login !== excludeLogin && !out.includes(login)) out.push(login); };
-  for (const entry of roster) {
-    if (hasAnyRole(entry, scopes, ['reviewer', 'domain-owner'])) add(entry.login);
-  }
-  for (const scope of scopes) {
-    const repo = repos.find((r) => r.name === scope);
-    if (!repo) continue;
-    const names = repo.domain_owners || (repo.domain_owner ? [repo.domain_owner] : []);
-    for (const name of names) add(roster.find((r) => r.name === name)?.login);
-  }
-  return out;
-}
-
-// The committer/PR-opener's platform login, resolved from local git identity through the roster.
-// Match on commit email first (the stable key), then fall back to name/login. null when unresolved.
-export function resolveCommitterLogin(cwd, roster = []) {
-  const email = (run('git', ['config', 'user.email'], { cwd }).stdout || '').trim().toLowerCase();
-  const name = (run('git', ['config', 'user.name'], { cwd }).stdout || '').trim();
-  if (email) {
-    const byEmail = roster.find((r) => (r.email || '').toLowerCase() === email);
-    if (byEmail) return byEmail.login || null;
-  }
-  if (name) {
-    const byName = roster.find((r) => r.name === name || r.login === name);
-    if (byName) return byName.login || null;
-  }
-  return null;
-}
-
-// Does this platform login exist on the hub? Warn-only (never throws): `checked:false` when the CLI
-// is absent/unauthenticated so callers can distinguish "not a user" from "couldn't check".
-export function validateLogin(platform, login) {
+// ---- who is running this command ------------------------------------------------------------
+// The platform login of whoever runs this command, asked of the platform's own CLI (`gh api user`,
+// `glab api user`) rather than looked up in a stored list (E62). A list is a claim that goes stale; the
+// CLI's answer is who is actually logged in. It is what a record's `by` names and what a commit subject
+// shows as `@login`.
+//
+// Best effort, and never a gate: null when there is no platform, the CLI is missing or logged out, the
+// network is down, the answer does not look like a login, or `YAD_PLATFORM_LOGIN=0` turns the lookup
+// off (offline work, and the test suite, which must never ask the developer's real account). Callers
+// then fall back to git `user.name` — see `actorName`. On CI the job token usually cannot read `/user`,
+// so the fallback is the bot's git name, exactly what it was before.
+//
+// Asked once per platform and directory per process: a command that writes several records pays for
+// one call. The timeout keeps a hung network from holding a command that only wanted a name.
+//
+// ON GITHUB THE HOST IS PASSED. `gh api` asks github.com unless told otherwise, so someone logged in to
+// both github.com and a GitHub Enterprise server would be recorded under the wrong account. `host` is the
+// caller's (the Product's `git_url`), else the directory's origin remote. `glab api` already resolves the
+// host from the repo.
+const LOGIN_RE = /^[A-Za-z0-9_][A-Za-z0-9._-]*(\[bot\])?$/; // GitLab allows a leading underscore
+const loginCache = new Map();
+export function platformLogin(cwd, platform, { runner = run, env = process.env, host } = {}) {
+  if (env.YAD_PLATFORM_LOGIN === '0') return null;
   const cli = cliFor(platform);
-  if (!cli || !has(cli) || !login) return { ok: false, exists: false, checked: false };
+  if (!cli) return null;
+  const ghHost = platform === 'github'
+    ? (host || hostFromGitUrl(runner('git', ['remote', 'get-url', 'origin'], { cwd }).stdout) || null)
+    : null;
+  const key = `${platform}\0${cwd}\0${ghHost || ''}`;
+  if (runner === run && loginCache.has(key)) return loginCache.get(key);
+  let login = null;
   if (platform === 'github') {
-    const r = run('gh', ['api', `users/${login}`]);
-    return { ok: r.ok, exists: r.ok, checked: true };
+    const r = runner('gh', ['api', ...(ghHost ? ['--hostname', ghHost] : []), 'user', '--jq', '.login'], { cwd, timeout: 10000 });
+    if (r.ok) login = r.stdout.trim();
+  } else {
+    const r = runner('glab', ['api', 'user'], { cwd, timeout: 10000 });
+    if (r.ok) { try { login = String(JSON.parse(r.stdout).username || ''); } catch { /* not JSON — no login */ } }
   }
-  // gitlab: users?username=<login> returns an array; empty array => no such user.
-  const r = run('glab', ['api', `users?username=${encodeURIComponent(login)}`]);
-  if (!r.ok) return { ok: false, exists: false, checked: true };
-  let exists = false;
-  try { exists = Array.isArray(JSON.parse(r.stdout)) && JSON.parse(r.stdout).length > 0; } catch { /* malformed JSON -> exists stays false */ }
-  return { ok: exists, exists, checked: true };
+  if (!login || !LOGIN_RE.test(login)) login = null;
+  if (runner === run) loginCache.set(key, login);
+  return login;
 }
 
-// ---- login -> yad identity (roster + derived domain-owner) -------------------------------------
-// Returns the records this login's APPROVED review contributes. Roles are read from the per-scope
-// map: hub roles plus, for each touched domain, that repo's scoped roles (domain-owner carries the
-// `domain` tag). The legacy `repos.json` `domain_owner === name` mapping is kept as a fallback so
-// pre per-scope projects still resolve domain owners.
-export function resolveLogin(login, roster = [], repos = [], touchedDomains = []) {
-  const entry = roster.find((r) => r.login === login);
-  if (!entry) return [{ name: login, role: 'reviewer', unverified: true }];
-  const records = [];
-  const push = (rec) => {
-    if (!records.some((x) => x.name === rec.name && x.role === rec.role && x.domain === rec.domain)) records.push(rec);
-  };
-  for (const role of rolesForScope(entry, 'hub')) push({ name: entry.name, role });
-  for (const d of touchedDomains) {
-    for (const role of rolesForScope(entry, d)) {
-      push(role === 'domain-owner' ? { name: entry.name, role, domain: d } : { name: entry.name, role });
-    }
-    // Legacy fallback: a repo whose domain_owner / domain_owners[] includes this name confers
-    // domain-owner for that domain. Both spellings are honored — symmetric with reviewersForScopes,
-    // which REQUESTS from both, so a person routed as a domain owner is also credited as one.
-    const legacy = repos.find((repo) => repo.name === d
-      && (repo.domain_owner === entry.name || (Array.isArray(repo.domain_owners) && repo.domain_owners.includes(entry.name))));
-    if (legacy) push({ name: entry.name, role: 'domain-owner', domain: d });
+// Who wrote a record: the platform login, else git `user.name`, else null. Attribution is a nicety on
+// the audit trail and never blocks the command that writes it.
+export function actorName(cwd, platform, opts = {}) {
+  return platformLogin(cwd, platform, opts)
+    || ((opts.runner || run)('git', ['config', 'user.name'], { cwd }).stdout || '').trim()
+    || null;
+}
+
+// The roster names `legacyLogins` (cli/gate.mjs) leaves out because two logins share them, each with the
+// logins that share it. An older record under such a
+// name could be either person, so it is never matched by name — only as `upsertBridge` matches a record
+// no name can place (an exact submission time, or an open step's one-to-one).
+export function ambiguousLegacyNames(hub) {
+  const logins = new Map();
+  for (const e of Array.isArray(hub?.roster) ? hub.roster : []) {
+    if (!e || typeof e.name !== 'string' || !e.name || typeof e.login !== 'string' || !e.login) continue;
+    if (!logins.has(e.name)) logins.set(e.name, new Set());
+    logins.get(e.name).add(e.login);
   }
-  // An identity-only entry (no roles map and no legacy `role`) still contributes a base reviewer
-  // record so an approval from a known person is never silently dropped. An entry that DOES declare
-  // roles but none apply to these scopes contributes nothing here (it is scoped elsewhere).
-  const hasNoRoleInfo = !entry.role && !(entry.roles && (Array.isArray(entry.roles) ? entry.roles.length : Object.keys(entry.roles).length));
-  if (!records.length && hasNoRoleInfo) push({ name: entry.name, role: 'reviewer' });
-  return records;
+  return new Map([...logins].filter(([, set]) => set.size > 1));
 }
 
 // Normalized PR reviews -> approval records (only APPROVED states count). `submittedAt` rides along
 // so the gate can tell a fresh re-approval from a stale one (revoke-on-change).
-export function mapApprovers(reviews = [], { roster, repos, touchedDomains, headOid } = {}) {
+// The platform's own evidence rides along too, for the record only (E64): the review's `commit`, `url` and
+// node id (`reviewId`) on GitHub. Each is left off when the read did not give it — never written `null`,
+// because a `null` commit means a degraded read below. The gate decides on the login and the fingerprint.
+// The record names the PLATFORM LOGIN that approved (E62). There is no stored list to look it up in and
+// no role to give it: the platform's record of who approved is the evidence, and the gate counts
+// people, not roles. A review with no login cannot be told apart from another one, so it is not counted.
+export function mapApprovers(reviews = [], { headOid } = {}) {
   const out = [];
   for (const r of reviews) {
     if (r.state !== 'APPROVED') continue;
@@ -175,16 +133,20 @@ export function mapApprovers(reviews = [], { roster, repos, touchedDomains, head
     // engagement rides in the APPROVE review body (`<!-- yad:engagement verified -->`); a bare UI
     // click has no marker → 'none'. Gameable by design (it makes review quality visible, not provable).
     const engagement = parseEngagement(r.body);
-    for (const rec of resolveLogin(r.login, roster, repos, touchedDomains)) {
-      out.push({ ...rec, submittedAt: r.submittedAt || null, engagement });
-    }
+    if (!r.login) continue;
+    out.push({
+      name: r.login, submittedAt: r.submittedAt || null, engagement,
+      ...(typeof r.commit === 'string' && r.commit ? { commit: r.commit } : {}),
+      ...(typeof r.url === 'string' && r.url ? { url: r.url } : {}),
+      ...(typeof r.id === 'string' && r.id ? { reviewId: r.id } : {}),
+    });
   }
   return out;
 }
 
 // ---- read PR state (github) ---------------------------------------------------------------------
-function readPrGitHub(n, { cwd } = {}) {
-  const view = run('gh', ['pr', 'view', String(n), '--json', 'state,mergedAt,headRefOid'], { cwd });
+function readPrGitHub(n, { cwd, runner = run } = {}) {
+  const view = runner('gh', ['pr', 'view', String(n), '--json', 'state,mergedAt,mergedBy,mergeCommit,headRefOid'], { cwd });
   if (!view.ok) return { ok: false, reason: view.stderr || 'gh pr view failed' };
   const meta = JSON.parse(view.stdout);
   let reviews = [];
@@ -192,7 +154,7 @@ function readPrGitHub(n, { cwd } = {}) {
   // Review-thread resolution via GraphQL (REST does not expose isResolved). Paginate so a PR with
   // >100 threads is not mistakenly read as "all resolved".
   let threads = [];
-  const nwo = run('gh', ['repo', 'view', '--json', 'owner,name'], { cwd });
+  const nwo = runner('gh', ['repo', 'view', '--json', 'owner,name'], { cwd });
   if (nwo.ok) {
     const { owner, name } = JSON.parse(nwo.stdout);
     // latestReviews collapses a reviewer's superseded reviews to their current one; commit.oid binds
@@ -201,17 +163,17 @@ function readPrGitHub(n, { cwd } = {}) {
     // latestReviews` does not expose the commit, so read it via GraphQL. Paginate so a PR with >100
     // reviewers never silently omits one; any page failure aborts to the commitless fallback below,
     // which fails closed rather than advancing on a partial read.
-    const rq = `query($o:String!,$r:String!,$n:Int!,$c:String){repository(owner:$o,name:$r){pullRequest(number:$n){latestReviews(first:100,after:$c){pageInfo{hasNextPage endCursor} nodes{author{login} state submittedAt body commit{oid}}}}}}`;
+    const rq = `query($o:String!,$r:String!,$n:Int!,$c:String){repository(owner:$o,name:$r){pullRequest(number:$n){latestReviews(first:100,after:$c){pageInfo{hasNextPage endCursor} nodes{id url author{login} state submittedAt body commit{oid}}}}}}`;
     let rcursor = null;
     reviewsOk = true;
     for (let guard = 0; guard < 50; guard++) {
       const args = ['api', 'graphql', '-f', `query=${rq}`, '-F', `o=${owner.login}`, '-F', `r=${name}`, '-F', `n=${n}`];
       if (rcursor) args.push('-F', `c=${rcursor}`);
-      const rg = run('gh', args, { cwd });
+      const rg = runner('gh', args, { cwd });
       if (!rg.ok) { reviewsOk = false; reviews = []; break; }
       const conn = JSON.parse(rg.stdout)?.data?.repository?.pullRequest?.latestReviews;
       for (const x of conn?.nodes || []) {
-        reviews.push({ login: x.author?.login, state: x.state, submittedAt: x.submittedAt, body: x.body, commit: x.commit?.oid || null });
+        reviews.push({ login: x.author?.login, state: x.state, submittedAt: x.submittedAt, body: x.body, commit: x.commit?.oid || null, id: x.id, url: x.url });
       }
       if (!conn?.pageInfo?.hasNextPage) break;
       rcursor = conn.pageInfo.endCursor;
@@ -221,7 +183,7 @@ function readPrGitHub(n, { cwd } = {}) {
     for (let guard = 0; guard < 50; guard++) {
       const args = ['api', 'graphql', '-f', `query=${q}`, '-F', `o=${owner.login}`, '-F', `r=${name}`, '-F', `n=${n}`];
       if (cursor) args.push('-F', `c=${cursor}`);
-      const g = run('gh', args, { cwd });
+      const g = runner('gh', args, { cwd });
       if (!g.ok) break;
       const page = JSON.parse(g.stdout)?.data?.repository?.pullRequest?.reviewThreads;
       for (const t of page?.nodes || []) {
@@ -241,7 +203,7 @@ function readPrGitHub(n, { cwd } = {}) {
   // is for the merged content), while CHANGES_REQUESTED is still honored — so a transient failure
   // holds the gate, never advances it.
   if (!reviewsOk) {
-    const rev = run('gh', ['pr', 'view', String(n), '--json', 'latestReviews'], { cwd });
+    const rev = runner('gh', ['pr', 'view', String(n), '--json', 'latestReviews'], { cwd });
     if (rev.ok) reviews = (JSON.parse(rev.stdout).latestReviews || [])
       .map((x) => ({ login: x.author?.login, state: x.state, submittedAt: x.submittedAt, body: x.body, commit: null }));
   }
@@ -249,6 +211,10 @@ function readPrGitHub(n, { cwd } = {}) {
     ok: true,
     state: meta.state,
     merged: meta.state === 'MERGED' || !!meta.mergedAt,
+    // What a closing record points at (E18). Null when the platform does not say, never invented.
+    mergedAt: meta.mergedAt || null,
+    mergedBy: meta.mergedBy?.login || null,
+    mergeCommit: meta.mergeCommit?.oid || null,
     headOid: meta.headRefOid,
     reviews,
     threads,
@@ -256,13 +222,13 @@ function readPrGitHub(n, { cwd } = {}) {
 }
 
 // ---- read PR state (gitlab) ---------------------------------------------------------------------
-function readPrGitLab(n, { cwd } = {}) {
-  const view = run('glab', ['mr', 'view', String(n), '-F', 'json'], { cwd });
+function readPrGitLab(n, { cwd, runner = run } = {}) {
+  const view = runner('glab', ['mr', 'view', String(n), '-F', 'json'], { cwd });
   if (!view.ok) return { ok: false, reason: view.stderr || 'glab mr view failed' };
   const mr = JSON.parse(view.stdout);
-  const approvals = run('glab', ['api', `projects/:id/merge_requests/${mr.iid}/approvals`], { cwd });
+  const approvals = runner('glab', ['api', `projects/:id/merge_requests/${mr.iid}/approvals`], { cwd });
   const approvedBy = approvals.ok ? (JSON.parse(approvals.stdout).approved_by || []) : [];
-  const disc = run('glab', ['api', `projects/:id/merge_requests/${mr.iid}/discussions`], { cwd });
+  const disc = runner('glab', ['api', `projects/:id/merge_requests/${mr.iid}/discussions`], { cwd });
   const discussions = disc.ok ? (JSON.parse(disc.stdout) || []) : [];
   // A GitLab approval carries no body, so the companion's engagement marker rides in a NOTE the
   // reviewer posts; attach the latest engagement-bearing note per username to their approval so
@@ -273,7 +239,13 @@ function readPrGitLab(n, { cwd } = {}) {
       if (/<!--\s*yad:engagement\s+\w+\s*-->/i.test(nt.body || '')) engagementByUser.set(nt.author?.username, nt.body);
     }
   }
-  const reviews = approvedBy.map((a) => ({ login: a.user?.username, state: 'APPROVED', body: engagementByUser.get(a.user?.username) }));
+  // `approved_at` is the time GitLab records for each approval (E64). An older self-managed instance may not
+  // send it; the approval then has no time, as every GitLab approval had before E64 read it. There is no
+  // per-approval commit on GitLab — the MR head is not the commit an approval was given on — so none is set.
+  const reviews = approvedBy.map((a) => ({
+    login: a.user?.username, state: 'APPROVED', body: engagementByUser.get(a.user?.username),
+    ...(typeof a.approved_at === 'string' && a.approved_at ? { submittedAt: a.approved_at } : {}),
+  }));
   const threads = discussions
     .filter((d) => d.notes?.some((nt) => nt.resolvable))
     .map((d, i) => ({
@@ -286,6 +258,10 @@ function readPrGitLab(n, { cwd } = {}) {
     ok: true,
     state: mr.state,
     merged: mr.state === 'merged',
+    mergedAt: mr.merged_at || null,
+    // `merge_user` since GitLab 14.7; `merged_by` is the deprecated spelling older instances still send.
+    mergedBy: mr.merge_user?.username || mr.merged_by?.username || null,
+    mergeCommit: mr.merge_commit_sha || mr.squash_commit_sha || null,
     headOid: mr.diff_refs?.head_sha || mr.sha,
     reviews,
     threads,
@@ -293,13 +269,16 @@ function readPrGitLab(n, { cwd } = {}) {
 }
 
 // Injectable entry point. gate.mjs accepts a `reader` override; default dispatches to gh/glab.
+// `opts.runner` replaces the gh/glab calls, so the parsing is unit-testable without either installed
+// (mirrors platformDefaultBranch). With a runner there is no CLI to probe, only a platform to name.
 export function readPr(platform, n, opts = {}) {
-  if (!platformReady(platform)) return { ok: false, reason: `${cliFor(platform) || 'platform CLI'} not available` };
+  const ready = opts.runner ? !!cliFor(platform) : platformReady(platform);
+  if (!ready) return { ok: false, reason: `${cliFor(platform) || 'platform CLI'} not available` };
   return platform === 'gitlab' ? readPrGitLab(n, opts) : readPrGitHub(n, opts);
 }
 
 // ---- find the PR/MR for a branch ----------------------------------------------------------------
-// The review PR/MR opened for `review/EP-<slug>/<artifact>`, by HEAD/source branch. Under the bridge
+// The review PR/MR opened for `review/EP-<slug>/<artifact>`, by HEAD/source branch. Under the verified ledger
 // the ledger records that pointer only at merge (CI is the sole writer), so without this a human has
 // no way to name the review a merged PR belongs to — `gate sync` would just report "no open review PR
 // recorded" for a PR that is sitting merged on the platform (issue #158).
@@ -418,7 +397,7 @@ export function platformDefaultBranch(platform, { cwd, runner = run } = {}) {
 // though only this chain has a platform rung — they stop at the local `origin/HEAD`:
 //   1 flag        — an explicit --base; the human said so
 //   2 registry    — the repo's `default_branch` in .sdlc/repos.json
-//   3 hub         — hub.json's `default_branch`, for a PR against the product hub itself
+//   3 hub         — hub.json's `default_branch`, for a PR against the Product itself
 //   4 platform    — what the remote says (see platformDefaultBranch)
 //   5 origin-head — local `refs/remotes/origin/HEAD`, the same read repo.mjs/hubcommit.mjs use.
 //                   Deliberately NOT `ls-remote`: see branchExists above for why a network probe on
@@ -467,9 +446,11 @@ export function resolveBaseBranch(platform, {
 }
 
 // ---- create a PR/MR -----------------------------------------------------------------------------
-// `assignees` = the committer/PR-opener (always set, so the PR is owned by whoever pushed it);
-// `reviewers` = the scope's reviewers + domain-owners (computed by reviewersForScopes). On GitHub an
-// empty assignee list falls back to `@me` so the opener still self-assigns even without a roster.
+// `assignees` = the committer/PR-opener on GitLab (empty when `glab` cannot say who is logged in);
+// GitHub callers pass none and get `@me`, so the PR is owned by whoever pushed it;
+// `reviewers` = logins to request. No caller passes any since E62 removed the roster that chose them;
+// the parameter stays for E68, which suggests reviewers from history. On GitHub an empty assignee list
+// falls back to `@me` so the opener still self-assigns when the platform login is unknown.
 // Pure argv builder for the create command — exported so the reviewer/assignee/label wiring is
 // unit-testable without shelling out. gh always self-assigns (@me) when no assignee resolved.
 export function buildPrArgs(platform, { title, body, base, head, reviewers = [], labels = [], assignees = [] } = {}) {
@@ -586,7 +567,7 @@ export function createPr(platform, opts = {}) {
   let mentioned = []; let dropped = [];
   if (rest.length && iid) {
     const ats = rest.map((m) => `@${m}`).join(' ');
-    const note = run('glab', ['mr', 'note', iid, '-m', `Review requested (owner + reviewer rule): ${ats} — please review and approve/comment on this MR (this drives the gate).`], { cwd: opts.cwd });
+    const note = run('glab', ['mr', 'note', iid, '-m', `Review requested: ${ats} — please review and approve/comment on this MR (this drives the gate).`], { cwd: opts.cwd });
     if (note.ok) mentioned = rest; else dropped = rest;
   } else if (rest.length) {
     dropped = rest; // could not parse the IID to post the note