yadflow 4.4.0 → 4.5.1

package/cli/people.mjs

@@ -40,6 +40,7 @@ import { PROJECT_FILES, epicFiles } from './manifest.mjs';
 import { epicIds, epicRoot, unlistedLedgerDirs, FOUNDATION_EPIC, FOUNDATION_DIR, ledgerPersonLogin, legacyLogins, capLimit, capSeat, smallestTeam } from './epic-state.mjs';
 import { corruptShards, readShips } from './ledger.mjs';
 import { isBot, loginFromEmail } from './riskmap.mjs';
+import { gateMemberMap, hashEmail } from './members.mjs';
 
 // yadflow's OWN gate bot on GitLab. The GitHub workflow commits as `yad-gate-sync[bot]`, which `isBot`
 // already skips; the GitLab one commits as `yad-gate-sync` <yad-gate-sync@noreply.<host>> (the wired
@@ -313,7 +314,9 @@ export function gitHas(repoRoot, sha) {
   return r.status === 0;
 }
 
-function gitAuthors(dir, since) {
+// Exported for `yad standup` (E132), which reads the same authors over its own window: `at` is the commit's
+// exact time in epoch seconds, beside the UTC day in `ts` the count reads.
+export function gitAuthors(dir, since) {
   const git = (args) => spawnSync('git', args, { cwd: dir, encoding: 'utf8', maxBuffer: 1 << 30 });
   // Every reason below is printed: the folder is built from the shared registry (E81 review 15).
   const repoRoot = forTerminal(dir);
@@ -354,7 +357,8 @@ function gitAuthors(dir, since) {
     const secs = Number(ct);
     const ts = Number.isFinite(secs) && ct !== '' ? dayString(Math.floor(secs / 86400)) : null;
     if (ts === null) return { unknown: `${repoRoot}: a commit carries a date git cannot express as a calendar day` };
-    out.push({ ts, name: String(name || '').trim(), login: loginFromEmail(email), how: 'committed' });
+    // The email itself is never kept — only its hash, which a member file (E131) can match.
+    out.push({ ts, at: Math.floor(secs), name: String(name || '').trim(), login: loginFromEmail(email), emailHash: hashEmail(email), how: 'committed' });
   }
   return { events: out };
 }
@@ -393,7 +397,11 @@ function connectedRepos(root) {
 }
 
 // Every piece of evidence, from every source, with one list of the reasons any of it is missing.
-export function peopleEvidence(root, { today = todayString(), aliases = new Map(), sinceDays = CAPACITY_MAX_DAYS * WALK_PAD } = {}) {
+// E131: a commit whose author email a member file pairs with a login is that login's — one person, not a
+// name and a login counted twice. `members` is that pairing (`gateMemberMap`): only proven pairs on a GitHub
+// Product, never one two files share. It can only JOIN two keys, so it never removes anyone from the count;
+// a member file that cannot be read adds no pairing, and the count stays as it was (over, not under).
+export function peopleEvidence(root, { today = todayString(), aliases = new Map(), sinceDays = CAPACITY_MAX_DAYS * WALK_PAD, members = null } = {}) {
   const led = ledgerEvidence(root, aliases);
   const events = [...led.events];
   const unknown = [...led.unknown];
@@ -426,6 +434,8 @@ export function peopleEvidence(root, { today = todayString(), aliases = new Map(
       else events.push(...got.events);
     }
   }
+  const pairs = members || gateMemberMap(root);
+  if (pairs.size) for (const e of events) if (!e.login && e.emailHash && pairs.has(e.emailHash)) e.login = pairs.get(e.emailHash);
   return { events, merges: led.merges, unknown };
 }
 

package/cli/platform.mjs

@@ -67,7 +67,7 @@ export function platformReady(platform) {
 // both github.com and a GitHub Enterprise server would be recorded under the wrong account. `host` is the
 // caller's (the Product's `git_url`), else the directory's origin remote. `glab api` already resolves the
 // host from the repo.
-const LOGIN_RE = /^[A-Za-z0-9_][A-Za-z0-9._-]*(\[bot\])?$/; // GitLab allows a leading underscore
+export const LOGIN_RE = /^[A-Za-z0-9_][A-Za-z0-9._-]*(\[bot\])?$/; // GitLab allows a leading underscore
 const loginCache = new Map();
 export function platformLogin(cwd, platform, { runner = run, env = process.env, host } = {}) {
   if (env.YAD_PLATFORM_LOGIN === '0') return null;

package/cli/pr-list.mjs

@@ -0,0 +1,125 @@
+// E132 — the open and recently merged PRs/MRs of one repo, for `yad standup`. A READ, and E70's rule holds
+// here word for word: an empty list is an answer only when the platform answered it. Anything else — no
+// platform, reads turned off, no `gh`/`glab`, not logged in, offline, a 403 — is `{ ok: false, why }`, which
+// the standup prints as "platform not read — <why>", never as "no PRs".
+//
+// One call per list, never one per PR: GitHub's GraphQL answers the open PRs with their review decision
+// and check state, and the merged ones, in one query; GitLab's MR list carries `detailed_merge_status`.
+// A page is 100. A FULL page proves nothing about what is past it, so it is said ("more than 100 …, not
+// all read"), never read as the whole list.
+//
+// Facts only: the number, the author's login, draft or not, the check state and the review state the
+// platform gives. Never a title, a body, a branch name or a comment (no free text — `yad usage`'s rule).
+// `runner` is injectable so every answer is testable without a network (`YAD_PLATFORM_READ=0` in tests).
+import { run } from './lib.mjs';
+import { cliFor, detectPlatform, hostFromGitUrl, plainHost } from './platform.mjs';
+import { api, httpStatus, loggedIn, repoPathFromGitUrl, shown, whyFailed, PAGE, TIMEOUT } from './protection.mjs';
+
+// The check state, one word: GitHub's rollup, or what GitLab's merge status says about the pipeline.
+const GH_CHECKS = { SUCCESS: 'passing', FAILURE: 'failing', ERROR: 'failing', PENDING: 'running', EXPECTED: 'running' };
+
+const GH_QUERY = `query($owner:String!,$name:String!){repository(owner:$owner,name:$name){
+open:pullRequests(states:OPEN,first:${PAGE},orderBy:{field:CREATED_AT,direction:DESC}){totalCount nodes{number isDraft author{__typename login} reviewDecision reviews{totalCount} latestOpinionatedReviews(first:100){nodes{state}} commits(last:1){nodes{commit{statusCheckRollup{state}}}}}}
+merged:pullRequests(states:MERGED,first:${PAGE},orderBy:{field:UPDATED_AT,direction:DESC}){nodes{number mergedAt updatedAt author{__typename login}}}}}`;
+
+// GitHub's review state, in the words the standup prints. `none` = no review of any kind yet.
+// `reviewDecision` is null on a repo with no required-review rule — even on an approved PR — so the latest
+// opinionated review of each reviewer decides when it is null: a change request wins, then an approval.
+function ghReview(n) {
+  if (n.reviewDecision === 'CHANGES_REQUESTED') return 'changes-requested';
+  if (n.reviewDecision === 'APPROVED') return 'approved';
+  const states = (n.latestOpinionatedReviews?.nodes || []).map((r) => r?.state);
+  if (n.reviewDecision == null && states.includes('CHANGES_REQUESTED')) return 'changes-requested';
+  if (n.reviewDecision == null && states.includes('APPROVED')) return 'approved';
+  return (n.reviews?.totalCount || 0) > 0 ? 'reviewed' : 'none';
+}
+
+// GitLab's `detailed_merge_status`. Only the two pipeline words are turned into a check state; every other
+// status is printed as GitLab wrote it, because reading more into it would say what GitLab did not —
+// `mergeable` on a project with no approval rule was approved by nobody. `waits` lists the statuses where
+// the MR cannot merge until something happens: those put it under "waiting".
+const GL_CHECKS = { ci_must_pass: 'failing', ci_still_running: 'running' };
+export const GL_WAITS = ['ci_must_pass', 'ci_still_running', 'not_approved', 'requested_changes', 'discussions_not_resolved', 'need_rebase', 'conflict'];
+
+const author = (a) => (a && typeof a.login === 'string' && a.__typename !== 'Bot' && !/\[bot\]$/i.test(a.login) ? a.login : null);
+
+// Where to ask, or why yad cannot: the same preamble E70's `readProtection` runs, in the same order.
+export function prTarget({ platform = null, gitUrl = '' } = {}, { runner = run, env = process.env, authCache = new Map() } = {}) {
+  const rawHost = hostFromGitUrl(gitUrl || '');
+  const host = plainHost(rawHost);
+  const repo = repoPathFromGitUrl(gitUrl || '');
+  const plat = platform || detectPlatform(gitUrl || '') || null;
+  const base = { platform: plat, host, repo };
+  const no = (kind, why) => ({ ...base, ok: false, kind, why });
+  const cli = cliFor(plat);
+  if (!cli) return no('no-platform', plat ? `yad does not know the platform ${JSON.stringify(shown(plat))} (it reads GitHub and GitLab)` : 'no platform (GitHub or GitLab) is known for it');
+  if (env.YAD_PLATFORM_READ === '0') return no('off', 'platform reads are turned off (YAD_PLATFORM_READ=0)');
+  if (rawHost && !host) return no('no-url', 'its git URL names a host that is not a plain host name, so yad does not ask about it');
+  if (!host || !repo) return no('no-url', 'no git URL yad can read, so it cannot tell which repo to ask about');
+  if (!runner(process.platform === 'win32' ? 'where' : 'which', [cli], {}).ok) return no('no-cli', `${cli} is not installed`);
+  if (!loggedIn(runner, cli, host, authCache)) return no('no-login', `${cli} is not logged in for ${host} (or ${host} did not answer)`);
+  return { ...base, ok: true, cli };
+}
+
+// The PRs/MRs of one repo: `{ ok: true, open: [...], merged: [...], openPartial, mergedPartial }` or
+// `{ ok: false, kind, why }`. `sinceMs` bounds the merged list (epoch milliseconds).
+//   open:   { number, author, draft, checks: passing|failing|running|none|null, review: none|reviewed|approved|changes-requested|null,
+//             status? (GitLab's own word), waits? (GitLab: a status that holds the merge) }
+//   merged: { number, author, mergedAt (ISO) }
+export function listPrs(target, { sinceMs, runner = run, env = process.env, authCache = new Map() } = {}) {
+  const t = target?.cli ? target : prTarget(target, { runner, env, authCache });
+  if (!t.ok) return t;
+  return t.platform === 'github' ? listGitHub(t, sinceMs, runner) : listGitLab(t, sinceMs, runner);
+}
+
+function listGitHub(t, sinceMs, runner) {
+  const parts = t.repo.split('/');
+  const fail = (res) => ({ ...t, ok: false, kind: 'other', why: whyFailed(res, { platform: 'github', host: t.host, what: `the pull requests of ${shown(t.repo)}`, plural: true }) });
+  if (parts.length !== 2) return { ...t, ok: false, kind: 'no-url', why: `${shown(t.repo)} is not an owner/name GitHub repo path` };
+  const r = runner('gh', ['api', '--hostname', t.host, 'graphql', '-f', `query=${GH_QUERY}`, '-f', `owner=${parts[0]}`, '-f', `name=${parts[1]}`], { timeout: TIMEOUT });
+  // gh exits non-zero when the answer carries GraphQL `errors`: a partial answer is not an answer. Such an
+  // error comes with no HTTP status (`GraphQL: Could not resolve to a Repository …`), and is not "offline".
+  if (!r.ok && httpStatus(r) == null && /\bGraphQL:/.test(`${r.stderr || ''}${r.stdout || ''}`)) {
+    return { ...t, ok: false, kind: 'other', why: `GitHub answered the pull-request query for ${shown(t.repo)} with an error (the repo may not exist, or your login may not see it)` };
+  }
+  if (!r.ok) return fail({ ok: false, status: httpStatus(r) });
+  let body;
+  try { body = JSON.parse(r.stdout); } catch { return fail({ unreadable: true }); }
+  const repo = body?.data?.repository;
+  if (!repo || !Array.isArray(repo.open?.nodes) || !Array.isArray(repo.merged?.nodes)) return fail({ unreadable: true });
+  const open = repo.open.nodes.map((n) => ({
+    number: n.number, author: author(n.author), draft: n.isDraft === true,
+    checks: GH_CHECKS[n.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state] || (n.commits?.nodes?.[0]?.commit?.statusCheckRollup ? null : 'none'),
+    review: ghReview(n),
+  }));
+  const nodes = repo.merged.nodes;
+  const merged = nodes.filter((n) => Date.parse(n.mergedAt) >= sinceMs).map((n) => ({ number: n.number, author: author(n.author), mergedAt: n.mergedAt }));
+  // Sorted by last update, newest first: the list is whole for the window once its oldest entry is older.
+  const last = nodes[nodes.length - 1];
+  return {
+    ...t, ok: true, open, merged,
+    openPartial: (repo.open.totalCount ?? 0) > open.length,
+    mergedPartial: nodes.length >= PAGE && !(Date.parse(last?.updatedAt) < sinceMs),
+  };
+}
+
+function listGitLab(t, sinceMs, runner) {
+  const at = `projects/${encodeURIComponent(t.repo)}/merge_requests`;
+  const what = `the merge requests of ${shown(t.repo)}`;
+  const fail = (res) => ({ ...t, ok: false, kind: 'other', why: whyFailed(res, { platform: 'gitlab', host: t.host, what, plural: true }) });
+  const o = api(runner, 'glab', t.host, `${at}?state=opened&per_page=${PAGE}`);
+  if (!o.ok) return fail(o);
+  const since = new Date(sinceMs).toISOString();
+  const m = api(runner, 'glab', t.host, `${at}?state=merged&order_by=updated_at&sort=desc&updated_after=${encodeURIComponent(since)}&per_page=${PAGE}`);
+  if (!m.ok) return fail(m);
+  if (!Array.isArray(o.body) || !Array.isArray(m.body)) return fail({ unreadable: true });
+  const who = (a) => (a && typeof a.username === 'string' && a.bot !== true && !/\[bot\]$/i.test(a.username) ? a.username : null);
+  const open = o.body.map((x) => {
+    const st = typeof x.detailed_merge_status === 'string' ? x.detailed_merge_status : null;
+    const checks = st && Object.hasOwn(GL_CHECKS, st) ? GL_CHECKS[st] : null;
+    return { number: x.iid, author: who(x.author), draft: x.draft === true, checks, review: null, ...(st && !checks ? { status: st } : {}), waits: !!st && GL_WAITS.includes(st) };
+  });
+  const merged = m.body.filter((x) => Date.parse(x.merged_at) >= sinceMs).map((x) => ({ number: x.iid, author: who(x.author), mergedAt: x.merged_at }));
+  return { ...t, ok: true, open, merged, openPartial: o.body.length >= PAGE, mergedPartial: m.body.length >= PAGE };
+}
+

package/cli/protection.mjs

@@ -28,7 +28,7 @@ import { SETTINGS_EDIT_HINT } from './manifest.mjs';
 import { cliFor, hostFromGitUrl, detectPlatform, plainHost } from './platform.mjs';
 
 export const PLATFORM_NAME = { github: 'GitHub', gitlab: 'GitLab' };
-const TIMEOUT = 10_000;
+export const TIMEOUT = 10_000;
 
 // A word with an `@` after its first character may be an e-mail address, and no address is ever printed
 // (E67). A branch or a repo path is printed as written otherwise.
@@ -67,7 +67,7 @@ export function httpStatus(r) {
 // A failed call keeps its body too (E109): both CLIs print the platform's answer on stdout, so a caller
 // can read WHY it failed. A body that is not JSON is null, never an error. Only the GitLab branch read
 // looks at it today — see `gitlabBranchCause`.
-function api(runner, cli, host, pathname) {
+export function api(runner, cli, host, pathname) {
   const r = runner(cli, ['api', '--hostname', host, pathname], { timeout: TIMEOUT });
   if (r.ok) {
     try { return { ok: true, body: JSON.parse(r.stdout) }; } catch { return { ok: false, status: null, unreadable: true }; }
@@ -96,7 +96,7 @@ const gitlabBranchCause = (res) => (res.status === 404 && typeof res.body?.messa
 export const PAGE = 100;
 
 // Why a call gave no answer, as a clause that finishes "not known — ".
-function whyFailed(res, { platform, host, what, plural = false }) {
+export function whyFailed(res, { platform, host, what, plural = false }) {
   const name = PLATFORM_NAME[platform];
   if (res.unreadable) return `${name} answered ${what} with something yad could not read`;
   if (res.status == null) return `yad could not reach ${host} to read ${what} (offline, or the host did not answer)`;
@@ -134,7 +134,7 @@ const count = (v) => (typeof v === 'number' && Number.isInteger(v) && v >= 0 ? v
 // `gh auth status` is asked once per CLI and host per doctor run (`authCache`, which the caller makes
 // fresh for each run): on a network that drops packets each ask can take the full timeout, and a Product
 // with many repos on one host would pay it once per repo. Never kept longer — a login can change.
-function loggedIn(runner, cli, host, authCache) {
+export function loggedIn(runner, cli, host, authCache) {
   const key = `${cli}\0${host}`;
   if (!authCache.has(key)) authCache.set(key, runner(cli, ['auth', 'status', '--hostname', host], { timeout: TIMEOUT }).ok);
   return authCache.get(key);