fd79d6170f
* feat(tasks): multi-branch tasks — N (repo, branch) pairs per task Extends multi-repo into multi-branch so a single task can hold multiple worktrees on the same repo (one per branch). Sibling worktrees layout at <task>/<repo>/ + <task>/<repo>-<slug>/, dedicated PRWatch per branch, live agentctl tracker rescan + frontend store updates so the UI splits PRs / files / commits per branch without a session restart. MCP add_branch_to_task_kandev tool is shielded to the worktree executor. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(web): unify multi-branch repo label as <repo> · <branch> across panels PR Changes and Commits panels rendered repo labels differently for multi-branch tasks — Commits showed "kandev · feature/x" while PR Changes leaked the raw "kandev-feature-x" agentctl tracker tag. Reformat tracker-tagged repo names via formatRepoLabel using the longest known-repo prefix so kandev-cli-* doesn't collapse to kandev · cli-*. * fix(tasks): address multi-branch PR review — data races, slug collisions, MCP error codes Backend - agentctl process.Manager: add repoTrackersMu RWMutex guarding repoTrackers + workspaceTracker. Reads snapshot under RLock; RescanRepositories builds trackers first, takes Lock for swap/append. Validates newWorkDir via os.Stat before publishing cfg.WorkDir. - worktree.Manager: reject invalid explicit BranchSlug up-front; cache key uses sanitized wt.BranchSlug so read/write paths are symmetric. - worktree.store: narrow isDuplicateColumnError to "duplicate column name". - task service AddBranchToTask: slug-collision guard rejects feat/a vs feat-a. - orchestrator resolvePushRepo: two-pass exact-name match before subdir prefix fallback so "backend" doesn't swallow pushes for "backend-admin". - executor buildRepoSpecs: duplicate repos always get a non-empty BranchSlug (falls back to branch-N when both branch fields sanitize to empty). - MCP handler: classifyAddBranchError maps service errors to NOT_FOUND / CONFLICT / VALIDATION_ERROR; add ErrorCodeConflict constant. - MCP server: extract registerAddBranchToTaskTool, register in task mode only (external mode contract: config tools + create_task_kandev). - workspace_rescan handler: reject malformed JSON with 400 instead of silently rescanning the current root. - branch_materializer: split MaterializeBranch into prepare + finalize helpers to satisfy the 80-line cap. Frontend - existingPrUrl returns undefined when a task has >1 PR so per-repo View PR buttons take over (no silent linking to a sibling). - formatRepoLabel checks exact known-repo match before prefix splitting so "kandev-cli" isn't mislabeled as "kandev · cli". - Repo chip key now includes base_branch so siblings differing only on base render as distinct chips. Docs - multi-branch spec uniqueness wording aligned with the canonical 4-column key (task_id, repository_id, base_branch, checkout_branch). - worktree.CreateRequest.BranchSlug doc describes the sibling layout (<repo>-<slug>) instead of the obsolete nested form. * fix(tasks): scope slug-collision check to repo only + use errors.Is for ErrTaskNotFound - service_branches: drop base_branch from the slug-collision check. Worktree path is (repo, slug); two rows on the same repo cut from different bases still collide on disk. - service_branches: prepareBranchAdd wraps taskrepo.ErrTaskNotFound via fmt.Errorf with %w so classifiers don't have to substring-match the formatted task UUID. - mcp handlers: classifyAddBranchError uses errors.Is(err, ErrTaskNotFound). * fix(agentctl): sanitize rescan work_dir before os.Stat to clear CodeQL path-injection CodeQL flagged the rescan endpoint as a path-injection sink (the HTTP-supplied work_dir flowed straight into os.Stat and downstream scanRepositorySubdirs). Add validateRescanPath which: - requires the input to be a clean absolute path with no ".." segments - rejects anything that isn't equal to or an ancestor of the current cfg.WorkDir — the only legitimate use case is the branch materializer promoting <task>/<repo>/ to <task>/ Defense in depth: agentctl binds to localhost, but any colocated process could otherwise direct it at /etc or the user's home by POSTing /api/v1/workspace/rescan. * fix(agentctl): tighten validateRescanPath, close TOCTOU on existingTrackers, add tests - Drop the strings.Contains(clean, "..") guard. filepath.Clean already resolves traversal; the substring check rejects legitimate names like /home/u/..hidden without adding defense (the ancestor check via filepath.Rel is the real boundary). - Drop the rel == "." branch in the ancestor check — early return for clean == currentClean already covers identity. - Read existingTrackers inside the write-lock section (not under RLock then re-Lock) so two concurrent rescans can't both see 0 trackers and double-bootstrap the multi-repo set. - Add table-driven TestValidateRescanPath covering rejection paths (relative, descendant, sibling, traversal-cleaned, empty input), legitimate ancestor promotion, exact match, no-anchor first-launch, and a /home/u/..hidden dotted-segment case. * fix(agentctl): break taint flow into os.Stat — derive rescan path from cfg, not HTTP body CodeQL's go/path-injection trace still flagged manager_rescan.go after the prior sanitizer because the user-supplied newWorkDir flowed (after validation) into os.Stat and then into cfg.WorkDir → tracker paths → workspace_monitor os.Stat sinks. Replace validateRescanPath with resolveRescanPath: it returns a path DERIVED from currentWorkDir (no-op = currentClean, promotion = filepath.Dir(currentClean)) and uses newPath only for comparison, never as a source for the returned string. os.Stat now receives a path whose provenance is trusted manager config. Functionally the legitimate caller (branch materializer promoting <task>/<repo>/ to <task>/) is unchanged. * test(agentctl): make TestResolveRescanPath windows-portable The Linux Backend Tests job passed but the Backend (windows) job rejected every "absolute" case because filepath.IsAbs("/task/repo") is false on Windows (no volume letter). Build inputs via filepath.Join against absRoot() (filepath.Abs of "/" / "\\") so the same table covers POSIX (`/...`) and Windows (`C:\...`) without per-OS branches. Keep the traversal-after-Clean case POSIX-only since filepath.Clean is the shared primitive and that input form needs a volume to be considered absolute on Windows anyway. * fix(agentctl): serialize RescanRepositories + re-check trackers under write lock Two concurrent RescanRepositories calls could both observe an empty tracker set (between the snapshot read and the bootstrap branch) and both enter transitionToMultiRepoMode, leaking a duplicate bare-root tracker and duplicate per-repo trackers. Same race in appendNewRepoTrackers would double-append the same new child across both callers. Fix: - Add rescanMu sync.Mutex on Manager. Acquired for the full body of RescanRepositories so the snapshot → branch → mutate sequence is serialized. repoTrackersMu still guards individual field reads from unrelated goroutines (subscribe/unsubscribe/poll-mode). - appendNewRepoTrackers re-checks membership inside the write-lock before appending and drops already-present trackers (Stop + detach outside the lock). Defense in depth. - Test: add `dotted segment is legal as promotion` case so the ..hidden-segment promotion path stays exercised. --------- Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
267 lines
8.5 KiB
TypeScript
267 lines
8.5 KiB
TypeScript
import type { StateCreator } from "zustand";
|
|
import type { GitHubSlice, GitHubSliceState } from "./types";
|
|
|
|
export const defaultGitHubState: GitHubSliceState = {
|
|
githubStatus: { status: null, loaded: false, loading: false },
|
|
taskPRs: { byTaskId: {} },
|
|
pendingPrUrlByTaskId: { byTaskId: {} },
|
|
prWatches: { items: [], loaded: false, loading: false },
|
|
reviewWatches: { items: [], loaded: false, loading: false },
|
|
issueWatches: { items: [], loaded: false, loading: false },
|
|
actionPresets: { byWorkspaceId: {}, loading: {} },
|
|
prFeedbackCache: { byKey: {} },
|
|
};
|
|
|
|
const PR_FEEDBACK_CACHE_LIMIT = 20;
|
|
|
|
type ImmerSet = Parameters<
|
|
StateCreator<GitHubSlice, [["zustand/immer", never]], [], GitHubSlice>
|
|
>[0];
|
|
|
|
function createGitHubStatusActions(
|
|
set: ImmerSet,
|
|
): Pick<GitHubSlice, "setGitHubStatus" | "setGitHubStatusLoading"> {
|
|
return {
|
|
setGitHubStatus: (status) =>
|
|
set((draft) => {
|
|
draft.githubStatus.status = status;
|
|
draft.githubStatus.loaded = true;
|
|
}),
|
|
setGitHubStatusLoading: (loading) =>
|
|
set((draft) => {
|
|
draft.githubStatus.loading = loading;
|
|
}),
|
|
};
|
|
}
|
|
|
|
function clearPendingPrUrlForRepo(draft: GitHubSlice, taskId: string, repoKey: string) {
|
|
const pending = draft.pendingPrUrlByTaskId.byTaskId[taskId];
|
|
if (!pending) return;
|
|
delete pending[repoKey];
|
|
if (Object.keys(pending).length === 0) {
|
|
delete draft.pendingPrUrlByTaskId.byTaskId[taskId];
|
|
}
|
|
}
|
|
|
|
/** Clear client-only pending URLs for the repo that just synced (not sibling repos). */
|
|
function clearPendingForTaskPR(
|
|
draft: GitHubSlice,
|
|
taskId: string,
|
|
pr: { repository_id?: string; pr_url?: string },
|
|
) {
|
|
clearPendingPrUrlForRepo(draft, taskId, pr.repository_id ?? "");
|
|
clearPendingPrUrlForRepo(draft, taskId, "");
|
|
const pending = draft.pendingPrUrlByTaskId.byTaskId[taskId];
|
|
if (!pending || !pr.pr_url) return;
|
|
for (const key of Object.keys(pending)) {
|
|
if (pending[key] === pr.pr_url) clearPendingPrUrlForRepo(draft, taskId, key);
|
|
}
|
|
}
|
|
|
|
function createTaskPRActions(
|
|
set: ImmerSet,
|
|
): Pick<GitHubSlice, "setTaskPRs" | "setTaskPR" | "setPendingPrUrlForTask"> {
|
|
return {
|
|
setTaskPRs: (prs) =>
|
|
set((draft) => {
|
|
draft.taskPRs.byTaskId = prs;
|
|
}),
|
|
setTaskPR: (taskId, pr) =>
|
|
set((draft) => {
|
|
// Upsert by (repository_id, pr_number) so multi-branch tasks can
|
|
// hold N PRs on the same repo as siblings. Keying on
|
|
// repository_id alone collapses every PR for that repo onto one
|
|
// slot — the second WS event silently overwrites the first and
|
|
// the UI shows only the most-recent PR. Legacy rows without a
|
|
// repository_id match on the empty key + pr_number, preserving
|
|
// prior single-PR semantics for single-repo tasks.
|
|
const current = draft.taskPRs.byTaskId[taskId];
|
|
const existing = Array.isArray(current) ? current : [];
|
|
const repoKey = pr.repository_id ?? "";
|
|
const idx = existing.findIndex(
|
|
(p) => (p.repository_id ?? "") === repoKey && p.pr_number === pr.pr_number,
|
|
);
|
|
if (idx >= 0) existing[idx] = pr;
|
|
else existing.push(pr);
|
|
draft.taskPRs.byTaskId[taskId] = existing;
|
|
clearPendingForTaskPR(draft, taskId, pr);
|
|
}),
|
|
setPendingPrUrlForTask: (taskId, repoKey, prUrl) =>
|
|
set((draft) => {
|
|
const trimmed = prUrl.trim();
|
|
if (!trimmed) {
|
|
clearPendingPrUrlForRepo(draft, taskId, repoKey);
|
|
return;
|
|
}
|
|
if (!draft.pendingPrUrlByTaskId.byTaskId[taskId]) {
|
|
draft.pendingPrUrlByTaskId.byTaskId[taskId] = {};
|
|
}
|
|
draft.pendingPrUrlByTaskId.byTaskId[taskId][repoKey] = trimmed;
|
|
}),
|
|
};
|
|
}
|
|
|
|
function createWatchActions(
|
|
set: ImmerSet,
|
|
): Pick<
|
|
GitHubSlice,
|
|
| "setPRWatches"
|
|
| "setPRWatchesLoading"
|
|
| "removePRWatch"
|
|
| "setReviewWatches"
|
|
| "setReviewWatchesLoading"
|
|
| "addReviewWatch"
|
|
| "updateReviewWatch"
|
|
| "removeReviewWatch"
|
|
| "setIssueWatches"
|
|
| "setIssueWatchesLoading"
|
|
| "addIssueWatch"
|
|
| "updateIssueWatch"
|
|
| "removeIssueWatch"
|
|
> {
|
|
return {
|
|
setPRWatches: (watches) =>
|
|
set((draft) => {
|
|
draft.prWatches.items = watches;
|
|
draft.prWatches.loaded = true;
|
|
}),
|
|
setPRWatchesLoading: (loading) =>
|
|
set((draft) => {
|
|
draft.prWatches.loading = loading;
|
|
}),
|
|
removePRWatch: (id) =>
|
|
set((draft) => {
|
|
draft.prWatches.items = draft.prWatches.items.filter((w) => w.id !== id);
|
|
}),
|
|
setReviewWatches: (watches) =>
|
|
set((draft) => {
|
|
draft.reviewWatches.items = watches;
|
|
draft.reviewWatches.loaded = true;
|
|
}),
|
|
setReviewWatchesLoading: (loading) =>
|
|
set((draft) => {
|
|
draft.reviewWatches.loading = loading;
|
|
}),
|
|
addReviewWatch: (watch) =>
|
|
set((draft) => {
|
|
draft.reviewWatches.items = [
|
|
...draft.reviewWatches.items.filter((w) => w.id !== watch.id),
|
|
watch,
|
|
];
|
|
draft.reviewWatches.loaded = true;
|
|
}),
|
|
updateReviewWatch: (watch) =>
|
|
set((draft) => {
|
|
const idx = draft.reviewWatches.items.findIndex((w) => w.id === watch.id);
|
|
if (idx >= 0) {
|
|
draft.reviewWatches.items[idx] = watch;
|
|
}
|
|
}),
|
|
removeReviewWatch: (id) =>
|
|
set((draft) => {
|
|
draft.reviewWatches.items = draft.reviewWatches.items.filter((w) => w.id !== id);
|
|
}),
|
|
setIssueWatches: (watches) =>
|
|
set((draft) => {
|
|
draft.issueWatches.items = watches;
|
|
draft.issueWatches.loaded = true;
|
|
}),
|
|
setIssueWatchesLoading: (loading) =>
|
|
set((draft) => {
|
|
draft.issueWatches.loading = loading;
|
|
}),
|
|
addIssueWatch: (watch) =>
|
|
set((draft) => {
|
|
draft.issueWatches.items = [
|
|
...draft.issueWatches.items.filter((w) => w.id !== watch.id),
|
|
watch,
|
|
];
|
|
draft.issueWatches.loaded = true;
|
|
}),
|
|
updateIssueWatch: (watch) =>
|
|
set((draft) => {
|
|
const idx = draft.issueWatches.items.findIndex((w) => w.id === watch.id);
|
|
if (idx >= 0) {
|
|
draft.issueWatches.items[idx] = watch;
|
|
}
|
|
}),
|
|
removeIssueWatch: (id) =>
|
|
set((draft) => {
|
|
draft.issueWatches.items = draft.issueWatches.items.filter((w) => w.id !== id);
|
|
}),
|
|
};
|
|
}
|
|
|
|
function createActionPresetActions(
|
|
set: ImmerSet,
|
|
): Pick<GitHubSlice, "setActionPresets" | "setActionPresetsLoading"> {
|
|
return {
|
|
setActionPresets: (workspaceId, presets) =>
|
|
set((draft) => {
|
|
draft.actionPresets.byWorkspaceId[workspaceId] = presets;
|
|
}),
|
|
setActionPresetsLoading: (workspaceId, loading) =>
|
|
set((draft) => {
|
|
draft.actionPresets.loading[workspaceId] = loading;
|
|
}),
|
|
};
|
|
}
|
|
|
|
function createPRFeedbackCacheActions(
|
|
set: ImmerSet,
|
|
): Pick<GitHubSlice, "setPRFeedbackCacheEntry" | "removePRFeedbackCacheEntry"> {
|
|
return {
|
|
setPRFeedbackCacheEntry: (key, feedback) =>
|
|
set((draft) => {
|
|
draft.prFeedbackCache.byKey[key] = { feedback, lastUpdatedAt: Date.now() };
|
|
// Bound cache size: drop the oldest entries when over the limit so a
|
|
// user opening many PRs doesn't grow the slice unboundedly.
|
|
const entries = Object.entries(draft.prFeedbackCache.byKey);
|
|
if (entries.length > PR_FEEDBACK_CACHE_LIMIT) {
|
|
entries.sort((a, b) => a[1].lastUpdatedAt - b[1].lastUpdatedAt);
|
|
const drop = entries.length - PR_FEEDBACK_CACHE_LIMIT;
|
|
for (let i = 0; i < drop; i++) {
|
|
delete draft.prFeedbackCache.byKey[entries[i][0]];
|
|
}
|
|
}
|
|
}),
|
|
removePRFeedbackCacheEntry: (key) =>
|
|
set((draft) => {
|
|
delete draft.prFeedbackCache.byKey[key];
|
|
}),
|
|
};
|
|
}
|
|
|
|
function createRateLimitActions(set: ImmerSet): Pick<GitHubSlice, "applyGitHubRateLimitUpdate"> {
|
|
return {
|
|
applyGitHubRateLimitUpdate: (update) =>
|
|
set((draft) => {
|
|
const existing = draft.githubStatus.status;
|
|
if (!existing) {
|
|
// Status not yet hydrated; defer until the SSR/HTTP fetch lands.
|
|
return;
|
|
}
|
|
const rateLimit = { ...(existing.rate_limit ?? {}) };
|
|
for (const snap of update.snapshots) {
|
|
rateLimit[snap.resource] = snap;
|
|
}
|
|
draft.githubStatus.status = { ...existing, rate_limit: rateLimit };
|
|
}),
|
|
};
|
|
}
|
|
|
|
export const createGitHubSlice: StateCreator<
|
|
GitHubSlice,
|
|
[["zustand/immer", never]],
|
|
[],
|
|
GitHubSlice
|
|
> = (set) => ({
|
|
...defaultGitHubState,
|
|
...createGitHubStatusActions(set),
|
|
...createTaskPRActions(set),
|
|
...createWatchActions(set),
|
|
...createActionPresetActions(set),
|
|
...createRateLimitActions(set),
|
|
...createPRFeedbackCacheActions(set),
|
|
});
|