fd79d6170f
* feat(tasks): multi-branch tasks — N (repo, branch) pairs per task Extends multi-repo into multi-branch so a single task can hold multiple worktrees on the same repo (one per branch). Sibling worktrees layout at <task>/<repo>/ + <task>/<repo>-<slug>/, dedicated PRWatch per branch, live agentctl tracker rescan + frontend store updates so the UI splits PRs / files / commits per branch without a session restart. MCP add_branch_to_task_kandev tool is shielded to the worktree executor. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(web): unify multi-branch repo label as <repo> · <branch> across panels PR Changes and Commits panels rendered repo labels differently for multi-branch tasks — Commits showed "kandev · feature/x" while PR Changes leaked the raw "kandev-feature-x" agentctl tracker tag. Reformat tracker-tagged repo names via formatRepoLabel using the longest known-repo prefix so kandev-cli-* doesn't collapse to kandev · cli-*. * fix(tasks): address multi-branch PR review — data races, slug collisions, MCP error codes Backend - agentctl process.Manager: add repoTrackersMu RWMutex guarding repoTrackers + workspaceTracker. Reads snapshot under RLock; RescanRepositories builds trackers first, takes Lock for swap/append. Validates newWorkDir via os.Stat before publishing cfg.WorkDir. - worktree.Manager: reject invalid explicit BranchSlug up-front; cache key uses sanitized wt.BranchSlug so read/write paths are symmetric. - worktree.store: narrow isDuplicateColumnError to "duplicate column name". - task service AddBranchToTask: slug-collision guard rejects feat/a vs feat-a. - orchestrator resolvePushRepo: two-pass exact-name match before subdir prefix fallback so "backend" doesn't swallow pushes for "backend-admin". - executor buildRepoSpecs: duplicate repos always get a non-empty BranchSlug (falls back to branch-N when both branch fields sanitize to empty). - MCP handler: classifyAddBranchError maps service errors to NOT_FOUND / CONFLICT / VALIDATION_ERROR; add ErrorCodeConflict constant. - MCP server: extract registerAddBranchToTaskTool, register in task mode only (external mode contract: config tools + create_task_kandev). - workspace_rescan handler: reject malformed JSON with 400 instead of silently rescanning the current root. - branch_materializer: split MaterializeBranch into prepare + finalize helpers to satisfy the 80-line cap. Frontend - existingPrUrl returns undefined when a task has >1 PR so per-repo View PR buttons take over (no silent linking to a sibling). - formatRepoLabel checks exact known-repo match before prefix splitting so "kandev-cli" isn't mislabeled as "kandev · cli". - Repo chip key now includes base_branch so siblings differing only on base render as distinct chips. Docs - multi-branch spec uniqueness wording aligned with the canonical 4-column key (task_id, repository_id, base_branch, checkout_branch). - worktree.CreateRequest.BranchSlug doc describes the sibling layout (<repo>-<slug>) instead of the obsolete nested form. * fix(tasks): scope slug-collision check to repo only + use errors.Is for ErrTaskNotFound - service_branches: drop base_branch from the slug-collision check. Worktree path is (repo, slug); two rows on the same repo cut from different bases still collide on disk. - service_branches: prepareBranchAdd wraps taskrepo.ErrTaskNotFound via fmt.Errorf with %w so classifiers don't have to substring-match the formatted task UUID. - mcp handlers: classifyAddBranchError uses errors.Is(err, ErrTaskNotFound). * fix(agentctl): sanitize rescan work_dir before os.Stat to clear CodeQL path-injection CodeQL flagged the rescan endpoint as a path-injection sink (the HTTP-supplied work_dir flowed straight into os.Stat and downstream scanRepositorySubdirs). Add validateRescanPath which: - requires the input to be a clean absolute path with no ".." segments - rejects anything that isn't equal to or an ancestor of the current cfg.WorkDir — the only legitimate use case is the branch materializer promoting <task>/<repo>/ to <task>/ Defense in depth: agentctl binds to localhost, but any colocated process could otherwise direct it at /etc or the user's home by POSTing /api/v1/workspace/rescan. * fix(agentctl): tighten validateRescanPath, close TOCTOU on existingTrackers, add tests - Drop the strings.Contains(clean, "..") guard. filepath.Clean already resolves traversal; the substring check rejects legitimate names like /home/u/..hidden without adding defense (the ancestor check via filepath.Rel is the real boundary). - Drop the rel == "." branch in the ancestor check — early return for clean == currentClean already covers identity. - Read existingTrackers inside the write-lock section (not under RLock then re-Lock) so two concurrent rescans can't both see 0 trackers and double-bootstrap the multi-repo set. - Add table-driven TestValidateRescanPath covering rejection paths (relative, descendant, sibling, traversal-cleaned, empty input), legitimate ancestor promotion, exact match, no-anchor first-launch, and a /home/u/..hidden dotted-segment case. * fix(agentctl): break taint flow into os.Stat — derive rescan path from cfg, not HTTP body CodeQL's go/path-injection trace still flagged manager_rescan.go after the prior sanitizer because the user-supplied newWorkDir flowed (after validation) into os.Stat and then into cfg.WorkDir → tracker paths → workspace_monitor os.Stat sinks. Replace validateRescanPath with resolveRescanPath: it returns a path DERIVED from currentWorkDir (no-op = currentClean, promotion = filepath.Dir(currentClean)) and uses newPath only for comparison, never as a source for the returned string. os.Stat now receives a path whose provenance is trusted manager config. Functionally the legitimate caller (branch materializer promoting <task>/<repo>/ to <task>/) is unchanged. * test(agentctl): make TestResolveRescanPath windows-portable The Linux Backend Tests job passed but the Backend (windows) job rejected every "absolute" case because filepath.IsAbs("/task/repo") is false on Windows (no volume letter). Build inputs via filepath.Join against absRoot() (filepath.Abs of "/" / "\\") so the same table covers POSIX (`/...`) and Windows (`C:\...`) without per-OS branches. Keep the traversal-after-Clean case POSIX-only since filepath.Clean is the shared primitive and that input form needs a volume to be considered absolute on Windows anyway. * fix(agentctl): serialize RescanRepositories + re-check trackers under write lock Two concurrent RescanRepositories calls could both observe an empty tracker set (between the snapshot read and the bootstrap branch) and both enter transitionToMultiRepoMode, leaking a duplicate bare-root tracker and duplicate per-repo trackers. Same race in appendNewRepoTrackers would double-append the same new child across both callers. Fix: - Add rescanMu sync.Mutex on Manager. Acquired for the full body of RescanRepositories so the snapshot → branch → mutate sequence is serialized. repoTrackersMu still guards individual field reads from unrelated goroutines (subscribe/unsubscribe/poll-mode). - appendNewRepoTrackers re-checks membership inside the write-lock before appending and drops already-present trackers (Stop + detach outside the lock). Defense in depth. - Test: add `dotted segment is legal as promotion` case so the ..hidden-segment promotion path stays exercised. --------- Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
244 lines
8.8 KiB
Go
244 lines
8.8 KiB
Go
package process
|
|
|
|
import (
|
|
"context"
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/kandev/kandev/internal/agentctl/server/config"
|
|
"github.com/kandev/kandev/internal/agentctl/types"
|
|
"github.com/kandev/kandev/internal/agentctl/types/streams"
|
|
"github.com/kandev/kandev/internal/common/logger"
|
|
)
|
|
|
|
// TestRescanRepositories_TransitionsSingleToMultiRepo simulates the
|
|
// MCP add_branch flow: the agent launched as single-repo with WorkDir set
|
|
// to the primary worktree, then a sibling worktree appears at the task
|
|
// root. After RescanRepositories the manager must hold one bare root
|
|
// tracker + one per-repo tracker for each child.
|
|
func TestRescanRepositories_TransitionsSingleToMultiRepo(t *testing.T) {
|
|
taskRoot := t.TempDir()
|
|
primary := filepath.Join(taskRoot, "kandev")
|
|
sibling := filepath.Join(taskRoot, "kandev-feature-x")
|
|
initGitRepoAt(t, primary)
|
|
initGitRepoAt(t, sibling)
|
|
|
|
log, _ := logger.NewLogger(logger.LoggingConfig{Level: "error", Format: "json"})
|
|
cfg := &config.InstanceConfig{WorkDir: primary}
|
|
m := NewManager(cfg, log)
|
|
|
|
if len(m.repoTrackers) != 0 {
|
|
t.Fatalf("expected 0 repoTrackers in single-repo mode, got %d", len(m.repoTrackers))
|
|
}
|
|
|
|
m.RescanRepositories(context.Background(), taskRoot)
|
|
|
|
if len(m.repoTrackers) != 2 {
|
|
t.Fatalf("expected 2 repoTrackers after transition, got %d", len(m.repoTrackers))
|
|
}
|
|
names := map[string]bool{}
|
|
for _, tr := range m.repoTrackers {
|
|
names[tr.RepositoryName()] = true
|
|
}
|
|
if !names["kandev"] || !names["kandev-feature-x"] {
|
|
t.Errorf("expected trackers for kandev + kandev-feature-x, got %v", names)
|
|
}
|
|
if m.cfg.WorkDir != taskRoot {
|
|
t.Errorf("cfg.WorkDir = %q, want %q", m.cfg.WorkDir, taskRoot)
|
|
}
|
|
// Stop trackers so the goroutines don't outlive the test (parent
|
|
// TestMain's goleak check would otherwise flag them).
|
|
m.stopWorkspaceTrackers()
|
|
}
|
|
|
|
// TestRescanRepositories_AppendsNewRepoTrackerInMultiRepoMode covers the
|
|
// already-multi case: an extra sibling appears, the existing trackers
|
|
// remain, a new tracker is added for the new sibling.
|
|
func TestRescanRepositories_AppendsNewRepoTrackerInMultiRepoMode(t *testing.T) {
|
|
taskRoot := t.TempDir()
|
|
repoA := filepath.Join(taskRoot, "alpha")
|
|
repoB := filepath.Join(taskRoot, "beta")
|
|
initGitRepoAt(t, repoA)
|
|
initGitRepoAt(t, repoB)
|
|
|
|
log, _ := logger.NewLogger(logger.LoggingConfig{Level: "error", Format: "json"})
|
|
cfg := &config.InstanceConfig{WorkDir: taskRoot}
|
|
m := NewManager(cfg, log)
|
|
|
|
if len(m.repoTrackers) != 2 {
|
|
t.Fatalf("expected 2 repoTrackers from construct-time scan, got %d", len(m.repoTrackers))
|
|
}
|
|
|
|
// New sibling added after launch (e.g. via add_branch).
|
|
repoC := filepath.Join(taskRoot, "gamma")
|
|
initGitRepoAt(t, repoC)
|
|
|
|
m.RescanRepositories(context.Background(), taskRoot)
|
|
|
|
if len(m.repoTrackers) != 3 {
|
|
t.Fatalf("expected 3 repoTrackers after append, got %d", len(m.repoTrackers))
|
|
}
|
|
names := map[string]bool{}
|
|
for _, tr := range m.repoTrackers {
|
|
names[tr.RepositoryName()] = true
|
|
}
|
|
for _, expected := range []string{"alpha", "beta", "gamma"} {
|
|
if !names[expected] {
|
|
t.Errorf("missing tracker for %q (got %v)", expected, names)
|
|
}
|
|
}
|
|
m.stopWorkspaceTrackers()
|
|
}
|
|
|
|
// TestRescanRepositories_FileTreeReturnsTaskRootContentsAfterTransition
|
|
// covers the Files panel surface: after rescan flips a single-branch
|
|
// workspace to multi-repo mode, GetWorkspaceTracker().GetFileTree("", n)
|
|
// must list the sibling repo dirs (kandev/, kandev-feature-x/) instead of
|
|
// the contents of the original primary worktree. This is the bug the user
|
|
// hit where the Files panel still rendered .agents/.claude/apps/... from
|
|
// inside the primary worktree even though the task had become multi-branch.
|
|
func TestRescanRepositories_FileTreeReturnsTaskRootContentsAfterTransition(t *testing.T) {
|
|
taskRoot := t.TempDir()
|
|
primary := filepath.Join(taskRoot, "kandev")
|
|
sibling := filepath.Join(taskRoot, "kandev-feature-x")
|
|
initGitRepoAt(t, primary)
|
|
initGitRepoAt(t, sibling)
|
|
// Seed each worktree with a "marker" file so we can tell which one a
|
|
// file-tree response is rooted at.
|
|
if err := os.WriteFile(filepath.Join(primary, "primary-marker.txt"), []byte("p"), 0o644); err != nil {
|
|
t.Fatalf("write primary marker: %v", err)
|
|
}
|
|
if err := os.WriteFile(filepath.Join(sibling, "sibling-marker.txt"), []byte("s"), 0o644); err != nil {
|
|
t.Fatalf("write sibling marker: %v", err)
|
|
}
|
|
|
|
log, _ := logger.NewLogger(logger.LoggingConfig{Level: "error", Format: "json"})
|
|
cfg := &config.InstanceConfig{WorkDir: primary}
|
|
m := NewManager(cfg, log)
|
|
defer m.stopWorkspaceTrackers()
|
|
|
|
// Pre-rescan: workspaceTracker is bound to the primary, so the file
|
|
// tree must include the primary's marker (and NOT the sibling's).
|
|
preTree, err := m.workspaceTracker.GetFileTree("", 1)
|
|
if err != nil {
|
|
t.Fatalf("pre-rescan GetFileTree: %v", err)
|
|
}
|
|
preNames := fileTreeChildNames(preTree)
|
|
if !preNames["primary-marker.txt"] {
|
|
t.Errorf("pre-rescan tree missing primary marker: %v", preNames)
|
|
}
|
|
if preNames["sibling-marker.txt"] {
|
|
t.Errorf("pre-rescan tree should not contain sibling marker yet: %v", preNames)
|
|
}
|
|
|
|
m.RescanRepositories(context.Background(), taskRoot)
|
|
|
|
postTree, err := m.workspaceTracker.GetFileTree("", 1)
|
|
if err != nil {
|
|
t.Fatalf("post-rescan GetFileTree: %v", err)
|
|
}
|
|
postNames := fileTreeChildNames(postTree)
|
|
if !postNames["kandev"] || !postNames["kandev-feature-x"] {
|
|
t.Errorf("post-rescan tree should list sibling repo dirs, got %v", postNames)
|
|
}
|
|
if postNames["primary-marker.txt"] {
|
|
t.Errorf("post-rescan tree should not include primary's inner files at root: %v", postNames)
|
|
}
|
|
}
|
|
|
|
// fileTreeChildNames returns the set of top-level child names from a
|
|
// FileTreeNode. Returns an empty map for nil / leaf nodes so the caller can
|
|
// just index without nil checks.
|
|
func fileTreeChildNames(n *streams.FileTreeNode) map[string]bool {
|
|
out := map[string]bool{}
|
|
if n == nil {
|
|
return out
|
|
}
|
|
for _, c := range n.Children {
|
|
out[c.Name] = true
|
|
}
|
|
return out
|
|
}
|
|
|
|
// TestRescanRepositories_PropagatesSubscriberToNewTrackers locks in the
|
|
// subscriber-list invariant: any workspace-stream subscriber attached
|
|
// BEFORE the rescan must remain attached to the resulting tracker set so
|
|
// the Changes panel receives events from newly-discovered repos. Without
|
|
// this, the single→multi transition would silently drop the existing
|
|
// gateway subscriber when it stops the old workspaceTracker, and the UI
|
|
// would go quiet.
|
|
func TestRescanRepositories_PropagatesSubscriberToNewTrackers(t *testing.T) {
|
|
taskRoot := t.TempDir()
|
|
primary := filepath.Join(taskRoot, "kandev")
|
|
sibling := filepath.Join(taskRoot, "kandev-branch-2")
|
|
initGitRepoAt(t, primary)
|
|
initGitRepoAt(t, sibling)
|
|
|
|
log, _ := logger.NewLogger(logger.LoggingConfig{Level: "error", Format: "json"})
|
|
cfg := &config.InstanceConfig{WorkDir: primary}
|
|
m := NewManager(cfg, log)
|
|
defer m.stopWorkspaceTrackers()
|
|
|
|
sub := m.SubscribeWorkspaceStream()
|
|
defer m.UnsubscribeWorkspaceStream(sub)
|
|
// Drain the initial replay so the channel doesn't carry stale state
|
|
// into our post-rescan assertions.
|
|
drainChannel(sub)
|
|
|
|
m.RescanRepositories(context.Background(), taskRoot)
|
|
|
|
// After transition, every active tracker must hold the subscriber:
|
|
// bare root + 2 per-repo trackers = 3 attach references. The exported
|
|
// surface doesn't expose subscriber count directly, so we verify by
|
|
// inspecting the trackers' internal subscriber maps via the same
|
|
// concurrency primitives the tracker uses (read lock).
|
|
checkTrackerHasSub := func(name string, tr *WorkspaceTracker) {
|
|
tr.workspaceSubMu.RLock()
|
|
defer tr.workspaceSubMu.RUnlock()
|
|
if _, ok := tr.workspaceStreamSubscribers[sub]; !ok {
|
|
t.Errorf("subscriber missing from %q tracker after rescan", name)
|
|
}
|
|
}
|
|
checkTrackerHasSub("workspaceTracker (bare root)", m.workspaceTracker)
|
|
for _, tr := range m.repoTrackers {
|
|
checkTrackerHasSub("repoTracker "+tr.RepositoryName(), tr)
|
|
}
|
|
}
|
|
|
|
// drainChannel non-blocking-empties a workspace-stream subscriber so test
|
|
// assertions about post-rescan messages aren't muddied by initial replays.
|
|
func drainChannel(ch types.WorkspaceStreamSubscriber) {
|
|
for {
|
|
select {
|
|
case <-ch:
|
|
default:
|
|
return
|
|
}
|
|
}
|
|
}
|
|
|
|
// initGitRepoAt creates a git repo at dir with one commit so
|
|
// scanRepositorySubdirs (which gates on a valid `.git/index` file)
|
|
// recognizes it. git init alone leaves the index missing until the first
|
|
// add/commit.
|
|
func initGitRepoAt(t *testing.T, dir string) {
|
|
t.Helper()
|
|
if err := os.MkdirAll(dir, 0o755); err != nil {
|
|
t.Fatalf("mkdir %s: %v", dir, err)
|
|
}
|
|
runIn := func(name string, args ...string) {
|
|
cmd := exec.Command(name, args...)
|
|
cmd.Dir = dir
|
|
if out, err := cmd.CombinedOutput(); err != nil {
|
|
t.Fatalf("%s %v in %s: %v\n%s", name, args, dir, err, out)
|
|
}
|
|
}
|
|
runIn("git", "init", "-b", "main")
|
|
runIn("git", "config", "user.email", "test@example.com")
|
|
runIn("git", "config", "user.name", "Test User")
|
|
runIn("git", "config", "commit.gpgsign", "false")
|
|
runIn("git", "commit", "--allow-empty", "-m", "initial")
|
|
}
|