João Salavisa
6ceda6ae4e
* fix(local-executor): preserve commits in changes panel after refresh
For a local executor on a feature branch, the create-task dialog sent
the chip's branch as base_branch with empty checkout_branch. agentctl
then recomputed merge-base(HEAD, origin/<branch>) on every changes-panel
refresh; for a never-pushed branch that collapsed to HEAD and the panel
went empty. Repository creation also pinned default_branch to .git/HEAD,
permanently anchoring the repo's integration ref to whatever feature
branch the user happened to be on at first task-create time.
The frontend now splits the chip into base_branch=default_branch +
checkout_branch=working_branch (skipping the split when fresh-branch is
on, where the chip semantically means "fork from"). The backend probes
origin/HEAD then origin/main → main → master (new common/gitref
package) to pick a repo's integration branch, and resolveRepoInput no
longer falls back to BaseBranch when default_branch is missing.
Covered by 9 unit tests on the helper, 6 Go tests on the probe order,
and 7 e2e tests across plain creation, the fork toggle, and the
validate-path probe.
* fix: address PR review feedback
- gitref: preserve slashes in HEAD-fallback branch names (TrimPrefix
refs/heads/ instead of Split + last component); branches like
"feature/my-feature" no longer collapse to "my-feature" and poison
the stored default_branch.
- gitref: drop the broken packed-refs symref scan in readOriginHEAD;
the loose refs/remotes/origin/HEAD check + pickFirstExistingBranch
candidates already cover every realistic clone.
- service.resolveRepoInput: validate repoInput.LocalPath via
resolveAllowedLocalPath() before probing — closes 8 CodeQL
path-injection alerts.
- buildRepositoriesPayload: fall through to the legacy non-split shape
when default_branch is unknown for the row (legacy repos with unset
default_branch). Synthesizing base_branch=rowBranch was reproducing
the very bug this PR fixes.
* fix(gitref): explicit traversal guard at I/O boundary for CodeQL
Move the path validation from service.resolveAllowedLocalPath (which
CodeQL's taint analysis doesn't recognize as a sanitizer) into a
guardRepoPath check at gitref.DefaultBranch's entry. The new check
rejects relative paths and any '..' segments before any os.Stat /
os.ReadFile call sees the value, which CodeQL recognizes as a
go/path-injection sanitizer.
The upstream allowlist check stays in place — this is a belt-and-
suspenders second barrier at the actual I/O boundary, and it also
makes the gitref package safe for any future callers (migrations,
tests) without requiring them to thread a Service in.
* fix: address review feedback on hardening + e2e race
- gitref.guardRepoPath: check the RAW input for '..' segments before
filepath.Clean. Clean resolves '..' away from absolute paths
("/allowed/../etc" -> "/etc"), so iterating the cleaned path was a
silent no-op for the very inputs we wanted to reject. Split on both
'/' and the OS separator. Updated the test with three traversal
cases.
- gitref_test.go: switch from strings.EqualFold to strict equality —
git branch names are case-sensitive, "Main" should not pass for
"main".
- e2e: replace waitForRequest with waitForResponse in
local-executor-branch-split.spec.ts. waitForRequest resolves on send
(before the server has persisted the task), so the followup
apiClient.getTask call could race the write on slow CI. The two
tests that need the request body keep access via
(await waitForResponse).request().
* fix(ws): forward CheckoutBranch in wsUpdateTask
The PR fix added CheckoutBranch forwarding to wsCreateTask but missed
the same conversion loop in wsUpdateTask. Any task-update payload with
a repositories array would silently zero out checkout_branch and
re-introduce the merge-base collapse on refresh — same root cause this
PR fixes, in the update path.
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
228 lines
8.7 KiB
TypeScript
228 lines
8.7 KiB
TypeScript
import { describe, it, expect } from "vitest";
|
|
import { buildRepositoriesPayload } from "./task-create-dialog-helpers";
|
|
|
|
describe("buildRepositoriesPayload — unified rows", () => {
|
|
it("maps each row in order, dropping empty ones silently", () => {
|
|
const payload = buildRepositoriesPayload({
|
|
useGitHubUrl: false,
|
|
githubUrl: "",
|
|
githubBranch: "",
|
|
githubPrHeadBranch: null,
|
|
repositories: [
|
|
{ key: "r0", repositoryId: "repo-front", branch: "main" },
|
|
{ key: "r1", repositoryId: "repo-back", branch: "develop" },
|
|
{ key: "r2", branch: "" }, // no repo picked yet — dropped
|
|
{ key: "r3", repositoryId: "repo-shared", branch: "" },
|
|
],
|
|
discoveredRepositories: [],
|
|
});
|
|
expect(payload).toEqual([
|
|
{ repository_id: "repo-front", base_branch: "main", checkout_branch: undefined },
|
|
{ repository_id: "repo-back", base_branch: "develop", checkout_branch: undefined },
|
|
{ repository_id: "repo-shared", base_branch: undefined, checkout_branch: undefined },
|
|
]);
|
|
});
|
|
|
|
it("emits local_path + default_branch for discovered (on-machine) rows", () => {
|
|
const payload = buildRepositoriesPayload({
|
|
useGitHubUrl: false,
|
|
githubUrl: "",
|
|
githubBranch: "",
|
|
githubPrHeadBranch: null,
|
|
repositories: [
|
|
{ key: "r0", localPath: "/home/me/projects/local-project", branch: "trunk" },
|
|
{ key: "r1", repositoryId: "repo-back", branch: "main" },
|
|
],
|
|
discoveredRepositories: [
|
|
{ path: "/home/me/projects/local-project", default_branch: "trunk" },
|
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
] as any,
|
|
});
|
|
expect(payload).toEqual([
|
|
{
|
|
repository_id: "",
|
|
base_branch: "trunk",
|
|
checkout_branch: undefined,
|
|
local_path: "/home/me/projects/local-project",
|
|
default_branch: "trunk",
|
|
},
|
|
{ repository_id: "repo-back", base_branch: "main", checkout_branch: undefined },
|
|
]);
|
|
});
|
|
});
|
|
|
|
// Regression for the "new branch on local executor" bug: the chip's branch
|
|
// is the working branch on disk (e.g. "feature/x"), not the integration
|
|
// branch. We must send it as `checkout_branch`, with `base_branch` anchored
|
|
// to the repo's `default_branch`. Without this, agentctl recomputes
|
|
// merge-base(HEAD, origin/feature/x) which collapses to HEAD and the
|
|
// changes panel is empty after refresh.
|
|
describe("buildRepositoriesPayload — local executor branch split (core)", () => {
|
|
it("rowBranch != default_branch → swap into checkout_branch", () => {
|
|
const payload = buildRepositoriesPayload({
|
|
useGitHubUrl: false,
|
|
githubUrl: "",
|
|
githubBranch: "",
|
|
githubPrHeadBranch: null,
|
|
repositories: [{ key: "r0", repositoryId: "repo-1", branch: "feature/x" }],
|
|
discoveredRepositories: [],
|
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
workspaceRepositories: [{ id: "repo-1", default_branch: "main" }] as any,
|
|
isLocalExecutor: true,
|
|
});
|
|
expect(payload).toEqual([
|
|
{ repository_id: "repo-1", base_branch: "main", checkout_branch: "feature/x" },
|
|
]);
|
|
});
|
|
|
|
it("rowBranch matches default_branch → no checkout_branch", () => {
|
|
const payload = buildRepositoriesPayload({
|
|
useGitHubUrl: false,
|
|
githubUrl: "",
|
|
githubBranch: "",
|
|
githubPrHeadBranch: null,
|
|
repositories: [{ key: "r0", repositoryId: "repo-1", branch: "main" }],
|
|
discoveredRepositories: [],
|
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
workspaceRepositories: [{ id: "repo-1", default_branch: "main" }] as any,
|
|
isLocalExecutor: true,
|
|
});
|
|
expect(payload).toEqual([
|
|
{ repository_id: "repo-1", base_branch: "main", checkout_branch: undefined },
|
|
]);
|
|
});
|
|
|
|
it("localPath row uses discoveredRepositories.default_branch", () => {
|
|
const payload = buildRepositoriesPayload({
|
|
useGitHubUrl: false,
|
|
githubUrl: "",
|
|
githubBranch: "",
|
|
githubPrHeadBranch: null,
|
|
repositories: [{ key: "r0", localPath: "/p/r", branch: "feature/y" }],
|
|
discoveredRepositories: [
|
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
{ path: "/p/r", default_branch: "main" } as any,
|
|
],
|
|
isLocalExecutor: true,
|
|
});
|
|
expect(payload).toEqual([
|
|
{
|
|
repository_id: "",
|
|
base_branch: "main",
|
|
checkout_branch: "feature/y",
|
|
local_path: "/p/r",
|
|
default_branch: "main",
|
|
},
|
|
]);
|
|
});
|
|
});
|
|
|
|
describe("buildRepositoriesPayload — local executor branch split (edge cases)", () => {
|
|
it("fresh-branch flow: skips the split so the picked base is preserved as base_branch", () => {
|
|
// When the user enables "Fork a new branch", the chip's branch is the
|
|
// BASE TO FORK FROM (e.g. "develop"), not a working branch. The backend
|
|
// creates a new branch from that base and rewrites base_branch to the
|
|
// new branch name. If we split here, base_branch would land on the
|
|
// repo's default ("main") and the fork would happen from main instead
|
|
// of develop — silently wrong.
|
|
const payload = buildRepositoriesPayload({
|
|
useGitHubUrl: false,
|
|
githubUrl: "",
|
|
githubBranch: "",
|
|
githubPrHeadBranch: null,
|
|
repositories: [{ key: "r0", repositoryId: "repo-1", branch: "develop" }],
|
|
discoveredRepositories: [],
|
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
workspaceRepositories: [{ id: "repo-1", default_branch: "main" }] as any,
|
|
isLocalExecutor: true,
|
|
freshBranch: { confirmDiscard: false, consentedDirtyFiles: [] },
|
|
});
|
|
expect(payload).toEqual([
|
|
{
|
|
repository_id: "repo-1",
|
|
base_branch: "develop",
|
|
checkout_branch: undefined,
|
|
fresh_branch: true,
|
|
confirm_discard: false,
|
|
consented_dirty_files: [],
|
|
},
|
|
]);
|
|
});
|
|
|
|
it("falls through when default_branch is unknown (legacy repos)", () => {
|
|
// Repos created before the backend probe fix may have an unset
|
|
// default_branch in the workspace store. If we synthesize base_branch=
|
|
// rowBranch here (as the original draft did), we reproduce the very bug
|
|
// this PR fixes: agentctl recomputes merge-base(HEAD, origin/<rowBranch>)
|
|
// → collapses to HEAD → empty changes panel. Better to leave the legacy
|
|
// shape alone — the next backend createRepository call will populate
|
|
// default_branch via the gitref probe.
|
|
const payload = buildRepositoriesPayload({
|
|
useGitHubUrl: false,
|
|
githubUrl: "",
|
|
githubBranch: "",
|
|
githubPrHeadBranch: null,
|
|
repositories: [{ key: "r0", repositoryId: "repo-1", branch: "feature/x" }],
|
|
discoveredRepositories: [],
|
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
workspaceRepositories: [{ id: "repo-1", default_branch: "" }] as any,
|
|
isLocalExecutor: true,
|
|
});
|
|
expect(payload).toEqual([
|
|
{ repository_id: "repo-1", base_branch: "feature/x", checkout_branch: undefined },
|
|
]);
|
|
});
|
|
|
|
it("non-local executor leaves rowBranch as base_branch (worktree flow unchanged)", () => {
|
|
const payload = buildRepositoriesPayload({
|
|
useGitHubUrl: false,
|
|
githubUrl: "",
|
|
githubBranch: "",
|
|
githubPrHeadBranch: null,
|
|
repositories: [{ key: "r0", repositoryId: "repo-1", branch: "main" }],
|
|
discoveredRepositories: [],
|
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
workspaceRepositories: [{ id: "repo-1", default_branch: "main" }] as any,
|
|
isLocalExecutor: false,
|
|
});
|
|
expect(payload).toEqual([
|
|
{ repository_id: "repo-1", base_branch: "main", checkout_branch: undefined },
|
|
]);
|
|
});
|
|
});
|
|
|
|
describe("buildRepositoriesPayload — single-row and URL mode", () => {
|
|
it("URL mode produces a single github_url entry and ignores the rows", () => {
|
|
const payload = buildRepositoriesPayload({
|
|
useGitHubUrl: true,
|
|
githubUrl: "github.com/owner/repo",
|
|
githubBranch: "feature-x",
|
|
githubPrHeadBranch: null,
|
|
repositories: [{ key: "r0", repositoryId: "ignored", branch: "ignored" }],
|
|
discoveredRepositories: [],
|
|
});
|
|
expect(payload).toEqual([
|
|
{
|
|
repository_id: "",
|
|
base_branch: "feature-x",
|
|
checkout_branch: undefined,
|
|
github_url: "github.com/owner/repo",
|
|
},
|
|
]);
|
|
});
|
|
|
|
it("single-row workspace repo: payload mirrors the row", () => {
|
|
const payload = buildRepositoriesPayload({
|
|
useGitHubUrl: false,
|
|
githubUrl: "",
|
|
githubBranch: "",
|
|
githubPrHeadBranch: null,
|
|
repositories: [{ key: "r0", repositoryId: "repo-only", branch: "main" }],
|
|
discoveredRepositories: [],
|
|
});
|
|
expect(payload).toEqual([
|
|
{ repository_id: "repo-only", base_branch: "main", checkout_branch: undefined },
|
|
]);
|
|
});
|
|
});
|