yadflow 4.0.0-next.3 → 4.0.0

package/cli/openpr.mjs

@@ -5,7 +5,7 @@
 import path from 'node:path';
 import fs from 'node:fs';
 import { c, log, ok, info, warn, hand, fail, run, exists, readJSON } from './lib.mjs';
-import { PROJECT_FILES , productConfigPath } from './manifest.mjs';
+import { PROJECT_FILES , productConfigPath, settingsEditHint } from './manifest.mjs';
 import {
   detectPlatform, createPr, platformLogin, resolveBaseBranch,
 } from './platform.mjs';
@@ -17,35 +17,43 @@ import { baseChangeLevel, changedSince, recentAuthorsFor, suggestedAuthorsFor }
 import { personLabel } from './riskmap.mjs';
 import { gateOpen } from './gate.mjs';
 import { unfoldedPaths, authorStepOf } from './fold.mjs';
+import { registryEntryFor } from './find-product.mjs';
 
-// Resolve the target code repo: --repo <name> from the registry, else --dir, else cwd.
-function resolveRepo(root, { repo, dir }) {
+// Resolve the target code repo: --repo <name> from the registry, else --dir, else cwd. `product` (E80) is
+// the Product found from a code repo beside it: the registry is read there, and a repo run without
+// --repo is looked up in it by its path — so its platform and default branch are the recorded ones.
+function resolveRepo(root, { repo, dir, product }) {
+  const productRoot = product || root;
   if (repo) {
-    const reg = readJSON(path.join(root, PROJECT_FILES.reposRegistry), { repos: [] });
-    const found = reg.repos.find((r) => r.name === repo);
-    if (found) return { repoRoot: path.resolve(root, found.path), meta: found };
+    const reg = readJSON(path.join(productRoot, PROJECT_FILES.reposRegistry), { repos: [] });
+    const found = (reg.repos || []).find((r) => r.name === repo);
+    if (found) return { repoRoot: path.resolve(productRoot, found.path), meta: found };
   }
-  return { repoRoot: path.resolve(root, dir || '.'), meta: null };
+  const here = path.resolve(root, dir || '.');
+  // The checkout it runs in, when that checkout is a registered repo: worked at its top, from any
+  // folder inside it. Anything else (a worktree, a nested repo) stays exactly where it is.
+  const hit = registryEntryFor(product, here);
+  return { repoRoot: hit ? hit.top : here, meta: hit ? hit.meta : null };
 }
 
 // Which SDLC stage is this PR? The Product serves two vehicles; a code repo only one. Mirrors the
 // `--head` split the Product pattern gates (pr-title.sh/pr-template.sh) already apply:
 //   code-repo    — NOT the Product (a registry repo via --repo, or root is not a Product).
-//   hub-shape    — the Product itself AND head is a review/EP-* branch (artifact-review PR).
-//   hub-tooling  — the Product itself AND head is anything else (a tooling/CI change to the Product).
+//   product-shape    — the Product itself AND head is a review/EP-* branch (artifact-review PR).
+//   product-tooling  — the Product itself AND head is anything else (a tooling/CI change to the Product).
 // `meta` (truthy when resolved from the repos registry via --repo) is a connected code repo, so it is
 // never the Product regardless of its path. Otherwise "is the Product" = repoRoot resolves to root AND root
 // carries .sdlc/hub.json. path.resolve normalises `--dir .` / trailing slashes.
 export function detectStage(root, repoRoot, head, meta) {
   if (meta) return 'code-repo';
-  const isHub = path.resolve(repoRoot) === path.resolve(root)
+  const isProduct = path.resolve(repoRoot) === path.resolve(root)
     && exists(productConfigPath(root));
-  if (!isHub) return 'code-repo';
-  return /^review\/EP-[a-z0-9-]+\//.test(head || '') ? 'hub-shape' : 'hub-tooling';
+  if (!isProduct) return 'code-repo';
+  return /^review\/EP-[a-z0-9-]+\//.test(head || '') ? 'product-shape' : 'product-tooling';
 }
 
 // The bundled code-task template — the same file `REPO_WIRING` installs into code repos, resolved
-// from the package (mirrors how manifest.mjs reads ../package.json). Used for a hub-tooling PR, whose
+// from the package (mirrors how manifest.mjs reads ../package.json). Used for a product-tooling PR, whose
 // `.github/pull_request_template.md` is the ARTIFACT-REVIEW template (wrong shape for the code-task
 // Product gate). Falls back to a minimal body that still carries every section the gate requires.
 function codeTaskTemplate(platform) {
@@ -70,10 +78,10 @@ function codeTaskTemplate(platform) {
 }
 
 export function templateBody(repoRoot, platform, { task, summary, risk, contract, domains, stage }) {
-  // hub-tooling: the Product's own template is artifact-review — use the bundled code-task template so the
+  // product-tooling: the Product's own template is artifact-review — use the bundled code-task template so the
   // body matches the shape the Product `pr-template` gate demands for a non-review head.
   let base;
-  if (stage === 'hub-tooling') {
+  if (stage === 'product-tooling') {
     base = codeTaskTemplate(platform);
   } else {
     const tplPath = platform === 'gitlab'
@@ -241,11 +249,11 @@ export async function runOpenPr(root, opts = {}) {
   const branch = run('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd: repoRoot }).stdout;
   const stage = detectStage(root, repoRoot, branch, meta);
 
-  // hub-shape: this is a Shape artifact-review PR (review/EP-*/<artifact> head on the Product). The
+  // product-shape: this is a Shape artifact-review PR (review/EP-*/<artifact> head on the Product). The
   // artifact-review title, body, and ledger bookkeeping all live in `yad gate open` — delegate to it
   // rather than emit the code-task shape (which the Product gate would reject). Push first (gateOpen does
   // not push), then hand off; any --title/--message is dropped (gateOpen sets `review: …`).
-  if (stage === 'hub-shape') {
+  if (stage === 'product-shape') {
     const parsed = parseReviewBranch(branch);
     if (!parsed) { fail(`could not parse review branch '${branch}' (expected review/EP-<slug>/<artifact>)`); process.exitCode = 1; return; }
     // E44: the review carries what was FOLDED. A step file changed since then is not on this branch.
@@ -268,17 +276,17 @@ export async function runOpenPr(root, opts = {}) {
   }
 
   // The Product's default_branch, which only applies when the PR targets the Product ITSELF
-  // (a hub-tooling branch) — for a connected code repo the Product's trunk belongs to a different repo and
-  // must never leak in. Resolved AFTER the hub-shape hand-off above, which delegates its own base to
+  // (a product-tooling branch) — for a connected code repo the Product's trunk belongs to a different repo and
+  // must never leak in. Resolved AFTER the product-shape hand-off above, which delegates its own base to
   // `yad gate open`: resolving before it would spend a platform round-trip and print a base that the
   // delegated path then ignores.
-  const hub = readJSON(productConfigPath(root), {});
+  const productConfig = readJSON(productConfigPath(root), {});
 
   // Resolve the base rather than assume it (#168). Hardcoding 'main' mis-based every PR on a repo
   // whose trunk is something else — and CodeRabbit decides auto-review eligibility from the base at
   // PR-OPEN time, so those PRs silently got no AI first pass at all.
   const { base: baseBranch, source: baseSource, platformDefault } = resolveBaseBranch(platform, {
-    cwd: repoRoot, explicit: opts.base, meta, hub: stage === 'code-repo' ? null : hub, runner: opts.runner,
+    cwd: repoRoot, explicit: opts.base, meta, productConfig: stage === 'code-repo' ? null : productConfig, runner: opts.runner,
   });
   if (branch === baseBranch) { fail(`on ${baseBranch} — switch to your task branch first`); process.exitCode = 1; return; }
   info(`base ${baseBranch} ${c.dim(`(from ${baseSource})`)}`);
@@ -288,8 +296,8 @@ export async function runOpenPr(root, opts = {}) {
   // would mean contradicting their own committed config on every PR, forever.
   if (platformDefault && platformDefault !== baseBranch) {
     warn(`base '${baseBranch}' is not the repo default '${platformDefault}' — CodeRabbit skips auto-review on a non-default base unless .coderabbit.yaml lists it under reviews.base_branches, and retargeting later does NOT undo the skip`);
-    if (baseSource === 'registry' || baseSource === 'hub') {
-      hand(`the configured default_branch (${baseSource === 'hub' ? '.sdlc/hub.json' : '.sdlc/repos.json'}) disagrees with the platform — reconcile them, or allow '${baseBranch}' in .coderabbit.yaml`);
+    if (baseSource === 'registry' || baseSource === 'product') {
+      hand(`the configured default_branch (${baseSource === 'product' ? settingsEditHint(root) : '.sdlc/repos.json'}) disagrees with the platform — reconcile them, or allow '${baseBranch}' in .coderabbit.yaml`);
     } else {
       hand(`open against '${platformDefault}' (or pass --base ${platformDefault}) unless you meant to stack this PR`);
     }
@@ -342,7 +350,7 @@ export async function runOpenPr(root, opts = {}) {
   // feeding the number E72 caps with. `null` is the honest answer there: we are not standing in a
   // Product, so we did not count.
   const active = (() => {
-    // Only the `code-repo` stage prints it (`routeCount`, below). On a `hub-tooling` PR this would
+    // Only the `code-repo` stage prints it (`routeCount`, below). On a `product-tooling` PR this would
     // otherwise walk the Product and every connected repo's history and throw the answer away.
     if (stage !== 'code-repo') return null;
     if (!exists(productConfigPath(root))) return null;

package/cli/people.mjs

@@ -34,7 +34,8 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 
-import { c, info, readJSONStrict, warn } from './lib.mjs';
+import { c, info, readJSONStrict, warn, forTerminal, asArg } from './lib.mjs';
+import { judgeRepo, runnable } from './workspace.mjs';
 import { PROJECT_FILES, epicFiles } from './manifest.mjs';
 import { epicIds, epicRoot, unlistedLedgerDirs, FOUNDATION_EPIC, FOUNDATION_DIR, ledgerPersonLogin, legacyLogins, capLimit, capSeat, smallestTeam } from './epic-state.mjs';
 import { corruptShards, readShips } from './ledger.mjs';
@@ -312,10 +313,12 @@ export function gitHas(repoRoot, sha) {
   return r.status === 0;
 }
 
-function gitAuthors(repoRoot, since) {
-  const git = (args) => spawnSync('git', args, { cwd: repoRoot, encoding: 'utf8', maxBuffer: 1 << 30 });
+function gitAuthors(dir, since) {
+  const git = (args) => spawnSync('git', args, { cwd: dir, encoding: 'utf8', maxBuffer: 1 << 30 });
+  // Every reason below is printed: the folder is built from the shared registry (E81 review 15).
+  const repoRoot = forTerminal(dir);
   if (since === null) return { unknown: 'the window has no readable start date' };
-  if (!fs.existsSync(repoRoot)) return { unknown: `${repoRoot} is not on disk` };
+  if (!fs.existsSync(dir)) return { unknown: `${repoRoot} is not on disk` };
   if (git(['rev-parse', '--is-inside-work-tree']).status !== 0) return { unknown: `${repoRoot} is not a git repo` };
   // A shallow clone holds only the newest commits. E67's rule, and the reason is even stronger here:
   // reading a truncated history as "these are all the people" is exactly the quiet under-count.
@@ -374,8 +377,17 @@ function connectedRepos(root) {
     if (!r || typeof r.name !== 'string' || !r.name) return { unknown: `${PROJECT_FILES.reposRegistry} holds a repo with no name` };
     // A repo with no path is registered but not on this machine. It is NOT "zero people": we cannot
     // read it, so the count is unknown rather than smaller.
-    if (typeof r.path !== 'string' || !r.path) return { unknown: `repo '${r.name}' has no local path — its history cannot be counted here` };
-    repos.push({ name: r.name, root: path.resolve(root, r.path), syncedHead: typeof r.syncedHead === 'string' ? r.syncedHead : null });
+    if (typeof r.path !== 'string' || !r.path) return { unknown: `repo '${forTerminal(r.name)}' has no local path — its history cannot be counted here` };
+    // Judged before git runs (E81 review 15), as every command that runs git in a registered path is: git
+    // run in a folder the Product commits, shaped as a repo, reads its `config`, which can run a
+    // command (`gpg.program` with `log.showSignature`). A refused entry is not "zero people" either —
+    // it is an unknown, said with the reason, never a silent skip.
+    const name = forTerminal(r.name);
+    const j = judgeRepo(root, r);
+    if (!runnable(j)) return { unknown: `repo '${name}': ${j.state === 'missing' ? 'not cloned on this machine' : j.linked ? 'reached through a link inside a repo\'s tree' : j.reason} — its history cannot be counted here` };
+    // A commit id only: `git cat-file -e <syncedHead>^{commit}` must never see anything else.
+    const syncedHead = typeof r.syncedHead === 'string' && /^[0-9a-f]{40,64}$/i.test(r.syncedHead) ? r.syncedHead : null;
+    repos.push({ name, arg: asArg(r.name), root: path.resolve(root, r.path), syncedHead });
   }
   return { repos };
 }
@@ -406,7 +418,7 @@ export function peopleEvidence(root, { today = todayString(), aliases = new Map(
       // error rather than throwing, so `gitHas` would answer false for a repo that is simply not on
       // this machine and send the reader off to fix the wrong thing.
       if (fs.existsSync(repo.root) && repo.syncedHead && !gitHas(repo.root, repo.syncedHead)) {
-        unknown.push(`repo '${repo.name}': this clone does not hold the commit the registry last packed — it is behind, and a behind clone shows fewer people; fetch it, or re-pack it with \`yad repo refresh ${repo.name}\``);
+        unknown.push(`repo '${repo.name}': this clone does not hold the commit the registry last packed — it is behind, and a behind clone shows fewer people; fetch it, or re-pack it with \`yad repo refresh ${repo.arg}\``);
         continue;
       }
       const got = gitAuthors(repo.root, since);
@@ -611,10 +623,10 @@ export function teamHint(counted) {
 // The ONE wiring every surface uses (`yad mode`, `gate status`, `yad next`, `yad doctor`): null outside
 // solo mode, where no count is read; otherwise `teamHint` over the count the caller already read, or a
 // fresh one with the roster aliases (without them an older roster-shaped approval reads as a second
-// person). `solo` is the caller's `isSolo(hub)` — it lives in cli/gate.mjs, which imports this file.
-export function soloTeamHint(root, hub, { solo, headCount = null, today = null } = {}) {
+// person). `solo` is the caller's `isSolo(productConfig)` — it lives in cli/gate.mjs, which imports this file.
+export function soloTeamHint(root, productConfig, { solo, headCount = null, today = null } = {}) {
   if (!solo) return null;
-  return teamHint(headCount || activePeople(root, { today: today || undefined, aliases: legacyLogins(hub) }));
+  return teamHint(headCount || activePeople(root, { today: today || undefined, aliases: legacyLogins(productConfig) }));
 }
 
 // The ONE way a suggestion is printed on a text surface: a known one as a warning line (`! …`), an