[Birfy]

Fixes #1250

Owner: Dev4
Reviewer: Reviewer
Written-by: Dev4
Tip SHA: cd907943d0bd39c0cea8cfacb88e82b394d98829

Reproduce

An instance that is not this repository showed this repository's numbers and said nothing about whose they were. At 0b2a9859 the board took repo once at install:

const repo = (() => { try { return rt.repoSlug?.() ?? repoSlug() } catch { return repoSlug() } })()

repoSlug() parses the shipped package's repository.url (core/src/host/update.js:163) and nothing in the tree assigns rt.repoSlug, so every instance read /repos/ThinkFlowLab/FlyBot. A fork instance, or one with no token, showed our board.

What changed

One resolver, core/src/host/delivery-repo.js, imported by the host and by core/scripts/delivery-probe.mjs (two call sites, one implementation, so they cannot drift): delivery.repo (config.deliveryRepo) → the team workspace's [remote "origin"] url read straight out of .git/config → the package's repository.url as a labelled default. No process is spawned; a .git file is followed through its gitdir:. A name is normalised from owner/name, a GitHub URL, git@github.com:owner/name.git or ssh://…; another host is refused rather than mined.

• install() resolves { repo, source } on every rt.deliveryBoard() call and keeps Map<repo, board>: a changed setting gets a new board whose first read is loading, never the previous repository's columns.
• Nothing resolving answers state: 'failed' with no repository — set delivery.repo before a board exists and before any request — no /repos/null.
• The header shows acme/widget · from config / from remote / from the package (default), the Diagnose text names the source, and a no-repo hint points at delivery.repo rather than at the token.
• A repository the token cannot read keeps the #1211 failure shape and its message names the repository and the endpoint.
• Docs: core-host (resolver row + how the board resolves), core-client (the header line), install (--workspace and the shared resolver), changelog fragment. patches/ds-bot/0001 and 0008 regenerated; the generator moved the steward.js block in 0001 to its alphabetical place — same 52 file sections, content identical, check green.

What I ran

Tip SHA: cd907943d0bd39c0cea8cfacb88e82b394d98829

$ node scripts/ds-bot-patches.mjs check
ok   ds-bot/ = Fei2411/DeepSeek-Bot@2b10c70 (tree 5834c00, v0.1.5)
ok   10 patches apply cleanly in order
ok   core/ equals ds-bot/ + patches/ds-bot/

$ cd core && node scripts/build-client.mjs            # real rebuild from src/client
$ node scripts/build-client.mjs --check               # exit 0
$ ARCH_DOCS_BASE=82964e5 node scripts/check-arch-docs.mjs   # OK (23 changed file(s))
$ node scripts/lint.mjs                               # oxlint: 0 errors, 62 pre-existing warnings
$ node .github/scripts/changelog.mjs check             # 1 fragment well formed
$ node --import ./test/harness-resolve.mjs --test --test-concurrency=1 \
    test/delivery-board.test.js test/delivery-view.test.js test/delivery-chart.test.js \
    test/delivery-repo.test.js test/delivery-write-failure.test.js test/kanban.test.js \
    test/i18n.test.js test/client-bundle.test.js test/home-lock.test.js test/install.test.js
# tests 109 / pass 109 / fail 0 / skipped 0

delivery-repo.test.js is the table-driven knife: config wins over a disagreeing remote, all four remote URL forms, the gitdir: file, origin only, package last, none at all, and the probe shell's own order. delivery-board.test.js holds the install wiring: config → both board and probe read acme/widget with repoSource: 'config'; the workspace remote → 'remote'; a changed setting → loading; package → 'package' and exactly one (default) warning; no repository → zero requests; a 404 names acme/widget and /repos/acme/widget/issues.

Red without the source change

Two knives, each removing one branch of resolveRepo():

• delete the config branch → 5 red: delivery.repo in the instance setting answers first…, the instance setting names the repository for the board and the probe…, a changed setting re-resolves…, a repository the token cannot read fails naming…, and the pre-existing the token is read per request… (its host fixture now names the repository through the setting).
• delete the remote branch → 5 different red: the workspace origin answers…, an origin written as a URL, an scp path or a name with no .git reads the same, a .git file is followed through its gitdir…, only origin counts…, the workspace git remote names the repository….

Restored, both suites are 109/109 again.

Both knives are one deletion in core/src/host/delivery-repo.js:84-91 — a reviewer can re-run them without reading the tests:

84 export function resolveRepo({ setting = null, workspace = null, packageSlug = null } = {}) {
85   const configured = parseRepoName(setting)      <- knife A: delete 85-86
86   if (configured !== null) return { repo: configured, source: 'config' }
87   const remote = gitOriginRepo(workspace)        <- knife B: delete 87-88
88   if (remote !== null) return { repo: remote, source: 'remote' }
89   const packaged = parseRepoName(packageSlug)

Restore with git checkout -- core/src/host/delivery-repo.js; the same file is mirrored under patches/ds-bot/files/, so undo the knife before npm run ds-bot-patches check.

Not run

• Full npm test on this box: it hits spawn … EAGAIN / pthread_create: Resource temporarily unavailable under the whole suite; CI Node 24 is the reference.
• npm run verify as one command, for the same reason — its steps (build check, patch check, arch-docs, oxlint, suites) were run individually above.
• Smoke / Web / Desktop check.sh steps: this change is a host read plus one header line; no UI flow is re-shot.
• enqueue-guard as a whole: its CLI does not start on this box (spawnSync gh ENOENT), so only its checkpoint half was run here — checkpointReasons(body, { pr: 1255, files }) imported from .github/scripts/enqueue-rules.mjs against this pull request's 22 changed paths returns []. The guard's own reason on this head is no Verifier report names the tip cd907943d0bd.

Risk

• Level 2 exists only when the instance has no delivery.repo; a workspace that is not a git checkout falls to the package default, which the header labels from the package (default) instead of presenting as fact.
• delivery.repo is a new instance key. Without it, behaviour is unchanged except that the fallback is now visibly a default and is logged once.
• A package with no repository field now fails with the named message rather than showing another repository's numbers — intended, and asserted with zero requests.

Checkpoint

{
  "pr": 1255,
  "claim": "Dev4",
  "issue": 1250,
  "summary": "One resolver (core/src/host/delivery-repo.js), shared by the host and core/scripts/delivery-probe.mjs: delivery.repo (config.deliveryRepo) first, then the team workspace's git origin from .git/config, then the package's repository.url labelled as a default. The board keeps one instance per repository, so a changed setting starts its new repository at loading; nothing resolving refuses with a stated message before any request, never /repos/null. The header and the Diagnose text name the repository and its source.",
  "files": [
    "core/src/host/delivery-repo.js",
    "core/src/host/delivery-board.js",
    "core/src/client/delivery-view.js",
    "core/src/client/i18n.js",
    "core/scripts/delivery-probe.mjs",
    "core/test/delivery-repo.test.js",
    "core/test/delivery-board.test.js",
    "core/test/delivery-view.test.js",
    "docs/subsystems/core-host.md",
    "changelog.d/1250-delivery-repo.added.md",
    "core/client.js",
    "patches/ds-bot/0001-core-fixes.patch"
  ],
  "checks": {
    "ran": "node scripts/ds-bot-patches.mjs check; node scripts/build-client.mjs --check; node --import ./test/harness-resolve.mjs --test --test-concurrency=1 (10 suites incl. delivery-repo, 109 tests)",
    "result": "green",
    "at": "cd907943d0bd39c0cea8cfacb88e82b394d98829"
  },
  "next": "none — ready for review"
}

[Birfy]

Verdict: PASS at cd90794
Written-by: Reviewer
Attestation: cd90794 role=Reviewer

The three-level resolver and the wiring around it hold, and I cut both knives myself rather than reading the body's Ran:.

• Remove the config branch (core/src/host/delivery-repo.js:85-86) → 5 red: the per-request token read (pre-existing), the instance-setting case, a changed setting re-resolves…, the unreadable-repository message, and delivery.repo in the instance setting answers first….
• Remove the remote branch (:87-88) → 5 red: the workspace git remote names the repository…, the workspace origin answers…, the URL/scp/no-.git table, the .git-file-through-gitdir case, and only `origin` counts….
• Both knives land on the same 52 tests as 47 pass / 5 fail; the tree was restored (md5 6e232e8d45fe51134e6660d41b1c2c6f) before the runs below.
• The ten suites the body names are 109/109; build-client --check exits 0; ds-bot-patches check prints skipped pin (no git) / 10 patches apply cleanly in order / core/ equals ds-bot/ + patches/ds-bot/; mojibake 0/1075; 3 changelog fragments well formed.
• Seven patches/ds-bot/files/ counterparts are byte-identical to core/ (probe, delivery-view, delivery-board, delivery-repo, and the three tests). 0001 carries 52 diff --git sections at both 0b2a9859 and this tip, so the steward block is a reorder, not a content change; topics.json is untouched and check passing is what proves the list is complete.
• Checkpoint on the live body: parseCheckpoint() ok, checkpointReasons(body, { pr: 1255, files: <the 22 changed paths> }) → []; summary 517 chars, files 12 (the cap), block 1460 chars, checks.at = this tip. The body was edited after 06:45Z, so these are re-read live, not copied.
• Wiring, not just the resolver: the instance setting beats a disagreeing remote with repoSource: 'config' and every request on acme/widget; a workspace origin answers 'remote'; a changed setting gets a new board whose first read is loading and keeps no old columns; the package answers last and warns exactly once; a workspace with nothing resolvable answers state: 'failed', kind: 'no-repo', and the probe exits 2 having made 0 requests — asserted, not described; a 404 names both acme/widget and /repos/acme/widget/issues.
• New UI strings are real keys in HOST_ZH (no repository — set delivery.repo, from config, from remote, from the package (default), and the Set delivery.repo in this instance's settings… hint), and core/client.js is the build of src/client as --check confirms.
• Checks on this tip: 14 success / 3 cancelled / 1 failure — the failure is enqueue-guard (expected without a verdict), the three cancelled are two judge and one agent-audience superseded by a later run. In the required contexts ubuntu-latest · Node 24 · DSH 0.2.0-rc.2, tests-ok, package and merge-gate are all success.

Non-blocking notes:

1. The setting's key is config.deliveryRepo (delivery-board.js:764), but the page, the hint and the docs all say delivery.repo. A user who copies the hint into the plugin entry writes a key the host never reads and silently lands on the labelled package default. Either name the literal key in the hint/docs, or read config.delivery?.repo ?? config.deliveryRepo.
2. A linked worktree is not the shape the test builds. git worktree add keeps config in the common dir reachable through <gitdir>/commondir, not in <gitdir>; gitConfigPath (:74-79) returns <gitdir>/config, the read fails, and a worktree workspace falls to the package default — while the comment (:16) and delivery-repo.test.js:59 call that shape a worktree. The submodule layout does have a config there. Follow commondir (one extra read) or drop the worktree word from the comment and the test name.
3. OWNER_NAME (:24) accepts . and .., so parseRepoName('../..') answers ../.., and the board would build a URL that normalises to /repos/../../issues on api.github.com. Same host, so no token leaves, but dot segments should be refused the way a non-github host is.
4. As on every run from this host, the pin line is skipped pin (no git), so the pin itself is unverified here; CI's package job has git and passed on this tip at 06:41:53Z.

Ran:

$ node --test --import ./core/test/harness-resolve.mjs --test-concurrency=1 core/test/delivery-board.test.js core/test/delivery-view.test.js core/test/delivery-chart.test.js core/test/delivery-repo.test.js core/test/delivery-write-failure.test.js core/test/kanban.test.js core/test/i18n.test.js core/test/client-bundle.test.js core/test/home-lock.test.js core/test/install.test.js
$ node core/scripts/build-client.mjs --check
$ node scripts/ds-bot-patches.mjs check
$ node .github/scripts/changelog.mjs check
$ node .github/scripts/check-mojibake.mjs --check
$ node -e "const r = await import('./.github/scripts/enqueue-rules.mjs'); r.parseCheckpoint(body); r.checkpointReasons(body, { pr: 1255, files: changed })"

Not run:

• check.sh, the Web and Desktop smoke paths: the change sits in the board's repository resolution and nothing in the host wiring around it moved; the body says the same.
• The pin under git: no git on this host, delegated to CI's package job as stated above.