Files
kandev/apps/backend/internal/agent/runtime/lifecycle/env_preparer.go
T
João Salavisa fd79d6170f feat(tasks): multi-branch tasks — N (repo, branch) pairs per task (#1226)
* feat(tasks): multi-branch tasks — N (repo, branch) pairs per task

Extends multi-repo into multi-branch so a single task can hold multiple
worktrees on the same repo (one per branch). Sibling worktrees layout at
<task>/<repo>/ + <task>/<repo>-<slug>/, dedicated PRWatch per branch,
live agentctl tracker rescan + frontend store updates so the UI splits
PRs / files / commits per branch without a session restart. MCP
add_branch_to_task_kandev tool is shielded to the worktree executor.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix(web): unify multi-branch repo label as <repo> · <branch> across panels

PR Changes and Commits panels rendered repo labels differently for multi-branch
tasks — Commits showed "kandev · feature/x" while PR Changes leaked the raw
"kandev-feature-x" agentctl tracker tag. Reformat tracker-tagged repo names via
formatRepoLabel using the longest known-repo prefix so kandev-cli-* doesn't
collapse to kandev · cli-*.

* fix(tasks): address multi-branch PR review — data races, slug collisions, MCP error codes

Backend
- agentctl process.Manager: add repoTrackersMu RWMutex guarding repoTrackers
  + workspaceTracker. Reads snapshot under RLock; RescanRepositories builds
  trackers first, takes Lock for swap/append. Validates newWorkDir via
  os.Stat before publishing cfg.WorkDir.
- worktree.Manager: reject invalid explicit BranchSlug up-front; cache key
  uses sanitized wt.BranchSlug so read/write paths are symmetric.
- worktree.store: narrow isDuplicateColumnError to "duplicate column name".
- task service AddBranchToTask: slug-collision guard rejects feat/a vs feat-a.
- orchestrator resolvePushRepo: two-pass exact-name match before subdir
  prefix fallback so "backend" doesn't swallow pushes for "backend-admin".
- executor buildRepoSpecs: duplicate repos always get a non-empty BranchSlug
  (falls back to branch-N when both branch fields sanitize to empty).
- MCP handler: classifyAddBranchError maps service errors to NOT_FOUND /
  CONFLICT / VALIDATION_ERROR; add ErrorCodeConflict constant.
- MCP server: extract registerAddBranchToTaskTool, register in task mode
  only (external mode contract: config tools + create_task_kandev).
- workspace_rescan handler: reject malformed JSON with 400 instead of
  silently rescanning the current root.
- branch_materializer: split MaterializeBranch into prepare + finalize
  helpers to satisfy the 80-line cap.

Frontend
- existingPrUrl returns undefined when a task has >1 PR so per-repo View PR
  buttons take over (no silent linking to a sibling).
- formatRepoLabel checks exact known-repo match before prefix splitting so
  "kandev-cli" isn't mislabeled as "kandev · cli".
- Repo chip key now includes base_branch so siblings differing only on
  base render as distinct chips.

Docs
- multi-branch spec uniqueness wording aligned with the canonical 4-column
  key (task_id, repository_id, base_branch, checkout_branch).
- worktree.CreateRequest.BranchSlug doc describes the sibling layout
  (<repo>-<slug>) instead of the obsolete nested form.

* fix(tasks): scope slug-collision check to repo only + use errors.Is for ErrTaskNotFound

- service_branches: drop base_branch from the slug-collision check. Worktree
  path is (repo, slug); two rows on the same repo cut from different bases
  still collide on disk.
- service_branches: prepareBranchAdd wraps taskrepo.ErrTaskNotFound via
  fmt.Errorf with %w so classifiers don't have to substring-match the
  formatted task UUID.
- mcp handlers: classifyAddBranchError uses errors.Is(err, ErrTaskNotFound).

* fix(agentctl): sanitize rescan work_dir before os.Stat to clear CodeQL path-injection

CodeQL flagged the rescan endpoint as a path-injection sink (the
HTTP-supplied work_dir flowed straight into os.Stat and downstream
scanRepositorySubdirs). Add validateRescanPath which:
- requires the input to be a clean absolute path with no ".." segments
- rejects anything that isn't equal to or an ancestor of the current
  cfg.WorkDir — the only legitimate use case is the branch materializer
  promoting <task>/<repo>/ to <task>/

Defense in depth: agentctl binds to localhost, but any colocated process
could otherwise direct it at /etc or the user's home by POSTing
/api/v1/workspace/rescan.

* fix(agentctl): tighten validateRescanPath, close TOCTOU on existingTrackers, add tests

- Drop the strings.Contains(clean, "..") guard. filepath.Clean already
  resolves traversal; the substring check rejects legitimate names like
  /home/u/..hidden without adding defense (the ancestor check via
  filepath.Rel is the real boundary).
- Drop the rel == "." branch in the ancestor check — early return for
  clean == currentClean already covers identity.
- Read existingTrackers inside the write-lock section (not under RLock
  then re-Lock) so two concurrent rescans can't both see 0 trackers and
  double-bootstrap the multi-repo set.
- Add table-driven TestValidateRescanPath covering rejection paths
  (relative, descendant, sibling, traversal-cleaned, empty input),
  legitimate ancestor promotion, exact match, no-anchor first-launch,
  and a /home/u/..hidden dotted-segment case.

* fix(agentctl): break taint flow into os.Stat — derive rescan path from cfg, not HTTP body

CodeQL's go/path-injection trace still flagged manager_rescan.go after the
prior sanitizer because the user-supplied newWorkDir flowed (after
validation) into os.Stat and then into cfg.WorkDir → tracker paths →
workspace_monitor os.Stat sinks.

Replace validateRescanPath with resolveRescanPath: it returns a path
DERIVED from currentWorkDir (no-op = currentClean, promotion =
filepath.Dir(currentClean)) and uses newPath only for comparison, never
as a source for the returned string. os.Stat now receives a path whose
provenance is trusted manager config.

Functionally the legitimate caller (branch materializer promoting
<task>/<repo>/ to <task>/) is unchanged.

* test(agentctl): make TestResolveRescanPath windows-portable

The Linux Backend Tests job passed but the Backend (windows) job rejected
every "absolute" case because filepath.IsAbs("/task/repo") is false on
Windows (no volume letter).

Build inputs via filepath.Join against absRoot() (filepath.Abs of "/" /
"\\") so the same table covers POSIX (`/...`) and Windows (`C:\...`)
without per-OS branches. Keep the traversal-after-Clean case POSIX-only
since filepath.Clean is the shared primitive and that input form needs a
volume to be considered absolute on Windows anyway.

* fix(agentctl): serialize RescanRepositories + re-check trackers under write lock

Two concurrent RescanRepositories calls could both observe an empty
tracker set (between the snapshot read and the bootstrap branch) and both
enter transitionToMultiRepoMode, leaking a duplicate bare-root tracker
and duplicate per-repo trackers. Same race in appendNewRepoTrackers would
double-append the same new child across both callers.

Fix:
- Add rescanMu sync.Mutex on Manager. Acquired for the full body of
  RescanRepositories so the snapshot → branch → mutate sequence is
  serialized. repoTrackersMu still guards individual field reads from
  unrelated goroutines (subscribe/unsubscribe/poll-mode).
- appendNewRepoTrackers re-checks membership inside the write-lock
  before appending and drops already-present trackers (Stop + detach
  outside the lock). Defense in depth.
- Test: add `dotted segment is legal as promotion` case so the
  ..hidden-segment promotion path stays exercised.

---------

Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-06-01 19:36:20 +01:00

242 lines
9.2 KiB
Go

package lifecycle
import (
"context"
"strings"
"time"
"github.com/kandev/kandev/internal/agent/executor"
"github.com/kandev/kandev/internal/common/logger"
"github.com/kandev/kandev/internal/task/models"
)
// PrepareStepStatus represents the status of a preparation step.
type PrepareStepStatus string
const (
PrepareStepPending PrepareStepStatus = "pending"
PrepareStepRunning PrepareStepStatus = "running"
PrepareStepCompleted PrepareStepStatus = "completed"
PrepareStepFailed PrepareStepStatus = "failed"
PrepareStepSkipped PrepareStepStatus = "skipped"
)
// RepoPrepareSpec describes one repository for multi-repo environment preparation.
// Mirrors the per-repo prepare fields that EnvPrepareRequest historically
// carried at the top level. When EnvPrepareRequest.Repositories is non-empty,
// each entry produces one prepared worktree under the shared TaskDirName.
type RepoPrepareSpec struct {
RepositoryID string
RepositoryPath string
RepoName string
BaseBranch string
DefaultBranch string // Repository's default_branch, used as fallback when BaseBranch is missing
CheckoutBranch string
PRNumber int // GitHub PR number when CheckoutBranch is a PR head; enables refs/pull/<N>/head fetch for fork PRs.
WorktreeID string
WorktreeBranch string
WorktreeBranchPrefix string
PullBeforeWorktree bool
RepoSetupScript string
// BranchSlug, when set, nests the worktree path under {RepoName}/{BranchSlug}/
// so two specs sharing a RepositoryID don't collide on disk.
BranchSlug string
}
// EnvPrepareRequest contains the parameters for environment preparation.
type EnvPrepareRequest struct {
TaskID string
SessionID string
TaskTitle string
ExecutionID string
ExecutorType executor.Name
WorkspacePath string
RepositoryPath string
RepositoryID string
UseWorktree bool
SetupScript string
RepoSetupScript string // Repository-level setup script (e.g. "make install")
BaseBranch string
DefaultBranch string // Repository's default_branch, used as fallback when BaseBranch is missing
CheckoutBranch string
PRNumber int // GitHub PR number when CheckoutBranch is a PR head; enables refs/pull/<N>/head fetch for fork PRs.
WorktreeID string
WorktreeBranch string
WorktreeBranchPrefix string
PullBeforeWorktree bool
TaskDirName string // Per-task directory name within the workspace (e.g. "task-abc123")
RepoName string // Repository slug used with TaskDirName to locate checkouts
BranchSlug string // Optional branch subdir for multi-branch tasks (legacy single-repo path)
// Repositories carries one entry per repository when the request is
// multi-repo. When non-empty it is the source of truth; the legacy
// single-repo top-level fields above are populated from Repositories[0]
// for callers that have not yet been updated.
Repositories []RepoPrepareSpec
Env map[string]string
}
// RepoSpecs returns the per-repo prepare specs for this request. When
// Repositories is set it is returned verbatim; otherwise a length-1 list is
// synthesized from the legacy top-level single-repo fields. Returns an empty
// slice for repo-less requests.
func (r *EnvPrepareRequest) RepoSpecs() []RepoPrepareSpec {
if len(r.Repositories) > 0 {
return r.Repositories
}
if r.RepositoryID == "" && r.RepositoryPath == "" {
return nil
}
return []RepoPrepareSpec{{
RepositoryID: r.RepositoryID,
RepositoryPath: r.RepositoryPath,
RepoName: r.RepoName,
BaseBranch: r.BaseBranch,
DefaultBranch: r.DefaultBranch,
CheckoutBranch: r.CheckoutBranch,
PRNumber: r.PRNumber,
WorktreeID: r.WorktreeID,
WorktreeBranch: r.WorktreeBranch,
WorktreeBranchPrefix: r.WorktreeBranchPrefix,
PullBeforeWorktree: r.PullBeforeWorktree,
RepoSetupScript: r.RepoSetupScript,
BranchSlug: r.BranchSlug,
}}
}
// PrepareStep represents a single step in the preparation process.
type PrepareStep struct {
Name string `json:"name"`
Command string `json:"command,omitempty"`
Status PrepareStepStatus `json:"status"`
Output string `json:"output,omitempty"`
Error string `json:"error,omitempty"`
Warning string `json:"warning,omitempty"`
WarningDetail string `json:"warning_detail,omitempty"`
StartedAt *time.Time `json:"started_at,omitempty"`
EndedAt *time.Time `json:"ended_at,omitempty"`
}
// RepoWorktreeResult is the per-repository outcome of environment preparation.
// Populated by preparers that handle multi-repo launches; each entry corresponds
// to one RepoPrepareSpec from the request.
type RepoWorktreeResult struct {
RepositoryID string `json:"repository_id"`
WorktreeID string `json:"worktree_id,omitempty"`
WorktreeBranch string `json:"worktree_branch,omitempty"`
WorktreePath string `json:"worktree_path,omitempty"`
MainRepoGitDir string `json:"main_repo_git_dir,omitempty"`
ErrorMessage string `json:"error_message,omitempty"`
}
// EnvPrepareResult contains the result of environment preparation.
type EnvPrepareResult struct {
Success bool `json:"success"`
Steps []PrepareStep `json:"steps"`
WorkspacePath string `json:"workspace_path,omitempty"`
ErrorMessage string `json:"error_message,omitempty"`
Duration time.Duration `json:"duration"`
// Worktree fields (populated when worktree preparer runs).
// Legacy single-worktree fields; for multi-repo results they mirror Worktrees[0].
WorktreeID string `json:"worktree_id,omitempty"`
WorktreeBranch string `json:"worktree_branch,omitempty"`
MainRepoGitDir string `json:"main_repo_git_dir,omitempty"`
// Worktrees is the per-repository outcome list when the preparer ran in
// multi-repo mode. Empty for single-repo or repo-less results.
Worktrees []RepoWorktreeResult `json:"worktrees,omitempty"`
}
// PrepareProgressCallback is called when a preparation step changes status.
type PrepareProgressCallback func(step PrepareStep, stepIndex int, totalSteps int)
// EnvironmentPreparer prepares the execution environment before an agent is launched.
type EnvironmentPreparer interface {
// Name returns the name of this preparer (e.g. "local", "worktree", "docker").
Name() string
// Prepare executes the environment preparation steps.
Prepare(ctx context.Context, req *EnvPrepareRequest, onProgress PrepareProgressCallback) (*EnvPrepareResult, error)
}
// MaxStepOutputBytes is the maximum size of a single step's Output field
// when persisting to session metadata.
const MaxStepOutputBytes = 10 * 1024
// SerializePrepareResult converts a prepare result into a map suitable for
// storage in session metadata. Used by both the synchronous persistence path
// (persistLaunchState) and the async event handler (handlePrepareCompleted).
func SerializePrepareResult(result *EnvPrepareResult) map[string]interface{} {
status := "completed"
if !result.Success {
status = "failed"
}
steps := make([]map[string]interface{}, 0, len(result.Steps))
for _, step := range result.Steps {
output := step.Output
if len(output) > MaxStepOutputBytes {
// Truncate at a valid UTF-8 boundary to avoid splitting multi-byte runes.
output = strings.ToValidUTF8(output[:MaxStepOutputBytes], "") + "\n... (truncated)"
}
entry := map[string]interface{}{
"name": step.Name, "status": string(step.Status),
"output": output, "command": step.Command,
}
if step.Error != "" {
entry["error"] = step.Error
}
if step.Warning != "" {
entry["warning"] = step.Warning
}
if step.WarningDetail != "" {
entry["warning_detail"] = step.WarningDetail
}
if step.StartedAt != nil {
entry["started_at"] = step.StartedAt.Format(time.RFC3339Nano)
}
if step.EndedAt != nil {
entry["ended_at"] = step.EndedAt.Format(time.RFC3339Nano)
}
steps = append(steps, entry)
}
return map[string]interface{}{
"status": status, "steps": steps,
"error_message": result.ErrorMessage,
"duration_ms": result.Duration.Milliseconds(),
}
}
// PreparerRegistry maps executor types (models.ExecutorType — the "local",
// "worktree", "local_docker", "sprites" taxonomy) to environment preparers.
//
// Keyed by ExecutorType, not Runtime: preparers do per-executor-type filesystem
// setup (e.g. worktree creation for the worktree type), and different
// ExecutorTypes that share a Runtime (local + worktree both run on standalone)
// can still get distinct preparation logic.
type PreparerRegistry struct {
preparers map[models.ExecutorType]EnvironmentPreparer
logger *logger.Logger
}
// NewPreparerRegistry creates a new PreparerRegistry.
func NewPreparerRegistry(log *logger.Logger) *PreparerRegistry {
return &PreparerRegistry{
preparers: make(map[models.ExecutorType]EnvironmentPreparer),
logger: log,
}
}
// Register adds a preparer for the given executor type.
func (r *PreparerRegistry) Register(execType models.ExecutorType, preparer EnvironmentPreparer) {
r.preparers[execType] = preparer
}
// Get returns the preparer for the given executor type, or nil if not found.
func (r *PreparerRegistry) Get(execType models.ExecutorType) EnvironmentPreparer {
return r.preparers[execType]
}