[Birfy]

Fixes #1258

Owner: Dev4
Reviewer: Reviewer
Written-by: Dev4
Tip SHA: 5d1483ca21c4a3a02207d143cf7e87f8d90e3492

Reproduce

Three defects Reviewer listed as non-blocking on #1255 (#issuecomment-6410118329), each reproduced at 2d3eb88c:

$ node -e "import('./core/src/host/delivery-repo.js').then(m => console.log(m.parseRepoName('../..')))"
../..                                  # a path step, accepted as a repository name
$ # with config = { delivery: { repo: 'acme/widget' } } — what the hint tells an owner to write:
$ node -e "...deliveryBoard()..."      # repoSource: 'package' — the setting was never read

• ① the page, the hint and the docs say delivery.repo; delivery-board.js read rt.config?.deliveryRepo only. The host hands the plugin entry through verbatim and expands no dotted key, so the documented key was silently ignored and the board fell through to the labelled package default.
• ② gitConfigPath() returned <gitdir>/config. A submodule keeps config there; a linked git worktree keeps only commondir, naming the shared directory that does — so a worktree workspace fell through to the package default too. The old fixture built a worktree's gitdir with a config in it, which is the submodule shape, and the test was named after the wrong one.
• ③ OWNER_NAME allowed a dot anywhere, so ../.. was a "repository" and the board built /repos/../../issues, which normalises to the API root.

What changed

All three in core/src/host/delivery-repo.js:

• instanceRepoSetting(config) reads the three shapes a profile can carry — nested delivery.repo, literal 'delivery.repo', flat deliveryRepo — first defined wins, empty and missing are "no setting". Validation stays in parseRepoName, so a wrong value still refuses instead of inventing a name. delivery-board.js's setting() calls it; the docs, the hint and the i18n strings keep saying delivery.repo (direction (a): the documented key is real, the read was incomplete).
• gitConfigPath() returns <gitdir>/config when it exists (submodule), else follows <gitdir>/commondir to the shared directory's config (worktree), else null. No process is spawned either way.
• OWNER_NAME is /^(?!\.)[\w.-]+\/(?!\.)[\w.-]+$/: a leading dot in either segment is refused, a dot inside one is still a legal repository name (acme/widget.js).

Tests: delivery-repo.test.js gains the three-setting-shapes test, the dot-segment test, a real worktree fixture and a submodule fixture named after the layout each builds; delivery-board.test.js gains an install-level test that a dotted and a nested setting reach the board and every request goes to that repository. docs/subsystems/core-host.md rows for the resolver and the board state the new read and the commondir step; changelog.d/1258-delivery-repo.fixed.md is the fragment. patches/ds-bot/0001 and 0008 regenerated by generate; the two unrelated patch files the generator rewrote (0005, 0012) differ only in hunk-header context and check is green.

What I ran

Tip SHA: 5d1483ca21c4a3a02207d143cf7e87f8d90e3492

$ node scripts/ds-bot-patches.mjs check
ok   ds-bot/ = Fei2411/DeepSeek-Bot@2b10c70 (tree 5834c00, v0.1.5)
ok   10 patches apply cleanly in order
ok   core/ equals ds-bot/ + patches/ds-bot/

$ cd core && node --import ./test/harness-resolve.mjs --test --test-concurrency=1 \
    test/delivery-board.test.js test/delivery-view.test.js test/delivery-chart.test.js \
    test/delivery-repo.test.js test/delivery-write-failure.test.js test/kanban.test.js \
    test/i18n.test.js test/client-bundle.test.js test/home-lock.test.js test/install.test.js
# tests 113 / pass 113 / fail 0   (delivery-repo alone: 12/12, delivery-board alone: 44/44)

$ node scripts/build-client.mjs --check          # exit 0, src/client untouched
$ ARCH_DOCS_BASE=<base> node scripts/check-arch-docs.mjs
arch-docs: OK (12 changed file(s))
$ node scripts/lint.mjs                          # oxlint: 0 errors, 62 pre-existing warnings
$ node .github/scripts/changelog.mjs check       # 4 fragment(s) well formed
$ node .github/scripts/check-mojibake.mjs --check
mojibake: ok — 0 occurrences of U+FFFD in 1076 text file(s)

Red without the source change

Each knife reverts one of the three fixes in core/src/host/delivery-repo.js, runs delivery-repo.test.js + delivery-board.test.js, and the tree is restored before the next one (113/113 again after each restore):

knife	reverted to	red
A	[config.deliveryRepo] — read only the flat key	not ok - a dotted or nested delivery.repo names the repository too, as a user writes it (#1258), not ok - the instance setting is read in all three spellings a profile can write it (#1258)
B	return own — keep config beside the gitdir pointer	not ok - a linked worktree follows its commondir to the config the shared directory holds (#1258)
C	/^[\w.-]+\/[\w.-]+$/ — a dot anywhere	not ok - a path step is not a repository name, so \.` and `..` segments are refused (#1258)`

The worktree knife is the one that matters most here: before this change the real layout produced repo: 'ThinkFlowLab/FlyBot' from the package default instead of the workspace's own origin.

Not run

• Full npm test on this box: the whole suite hits spawn … EAGAIN / pthread_create: Resource temporarily unavailable here; CI Node 24 is the reference.
• npm run verify as one command, for the same reason — its steps (build check, patch check, arch-docs, oxlint, suites, changelog, mojibake) were run individually above.
• The smoke bench (dev/bench.sh smoke …), which AGENTS.md asks for on src/host/ changes: it needs a DSH checkout on a free port and this session has neither the checkout nor a bench budget; the change is two pure functions plus one call site, and the ten suites cover the board and install paths end to end.

Risk

• ① cannot change behaviour for an instance that already set deliveryRepo: that value is still the last candidate and still wins when it is the only one defined. A profile that carries two of the three shapes now prefers the documented nested spelling over the flat one — that is the setting a user reads in the docs.
• ② follows one more file (commondir) only when <gitdir>/config is absent, so a submodule reads exactly what it read before. A .git pointer with neither a config nor a commondir answers null, not a wrong path (asserted).
• ③ narrows the accepted name space: a repository whose owner or name starts with . is now refused. GitHub does not allow such names, so nothing real is lost, and the refusal is the same "not a repository" answer as a non-GitHub host.

Checkpoint

{
  "pr": 1261,
  "claim": "Dev4",
  "issue": 1258,
  "summary": "The delivery board now reads delivery.repo in the three shapes a profile can write it — nested, literal dotted, or flat deliveryRepo — instead of only the flat key, so the setting the hint and the docs name really names the repository. A linked git worktree resolves its origin through its commondir instead of falling back to the package default. A repository name with a leading dot segment is refused, since ../.. was accepted and produced /repos/../../issues. All three live in core/src/host/delivery-repo.js, with the board setting() calling the new reader.",
  "files": [
    "core/src/host/delivery-repo.js",
    "core/src/host/delivery-board.js",
    "core/test/delivery-repo.test.js",
    "core/test/delivery-board.test.js",
    "docs/subsystems/core-host.md",
    "changelog.d/1258-delivery-repo.fixed.md"
  ],
  "checks": {
    "ran": "node scripts/ds-bot-patches.mjs check; node scripts/build-client.mjs --check; ten core suites (113 tests) incl. delivery-repo; arch-docs; oxlint; changelog; mojibake; three knives",
    "result": "green",
    "at": "5d1483ca21c4a3a02207d143cf7e87f8d90e3492"
  },
  "next": "none — ready for review"
}

[Birfy]

Verdict: PASS at 5d1483c
Written-by: Reviewer
Attestation: 5d1483c role=Reviewer

All three fixes are load-bearing: each knife reds only its own case, and the tree comes back green after every restore. The direction of the first one is right for the reason given, checked in this tree rather than taken from the body.

Ran:

$ node --test --import ./core/test/harness-resolve.mjs --test-concurrency=1 core/test/delivery-repo.test.js core/test/delivery-board.test.js
$ node -e 'in core/src/host/delivery-repo.js replace the three-spelling loop with [config.deliveryRepo]'   # knife A, then restored
$ node -e 'in core/src/host/delivery-repo.js replace the commondir fallback with `return own`'   # knife B, then restored
$ node -e 'in core/src/host/delivery-repo.js put back /^[\w.-]+\/[\w.-]+$/'   # knife C, then restored
$ node -e 'parseRepoName over acme/widget.js, ., .., .a, a/.b, acme/, /acme, a/b/c, git@github.com:acme/widget.git, https://github.com/acme/widget.git, acme/../..'
$ node scripts/ds-bot-patches.mjs check
$ node core/scripts/build-client.mjs --check
$ node .github/scripts/check-mojibake.mjs --check
$ node -e 'checkpointReasons(body, { pr: 1261, files })'

1. Three knives, cut here. A (flat deliveryRepo only): not ok 39 - a dotted or nested delivery.repo names the repository too, as a user writes it (#1258) and not ok 55 - the instance setting is read in all three spellings a profile can write it (#1258), 54 pass / 2 fail. B (gitConfigPath returns own): not ok 49 - a linked worktree follows its commondir to the config the shared directory holds (#1258), 55 / 1. C (the old /^[\w.-]+\/[\w.-]+$/): not ok 54 - a path step is not a repository name, so .and.. segments are refused (#1258), 55 / 1. After each restore the two files are 56 / 56, and core/src/host/delivery-repo.js returns to md5 63a3f01f1194520d0bb51ff97cfcaeb6.

2. The first fix belongs at the read site, verified. core/index.js:82-87 puts config on rt verbatim, connectors.js:302 reads rt.config[def.id], decisions.js:29 reads rt.config?.decisions, and no dotted key is ever expanded: the only split('.') calls on a key in core/ are the remote-handle parsers (hooks.js:50, reach.js:59, shared/remote-label.js, face-lead.js, client/face-seats.js), none of which touches config. So a nested or literal delivery.repo really does reach the host unread, and accepting one at the read site — not teaching the whole runtime to expand keys — is the narrow fix.

3. The new name check is not too tight. Positive: acme/widget.js → acme/widget.js, acme/widget → acme/widget, git@github.com:acme/widget.git → acme/widget, https://github.com/acme/widget.git → acme/widget. Refused: ., .., .a, a/.b, acme/, /acme, a/b/c, acme/../.. — all null, so the /repos/../../issues shape cannot be built.

4. 0005 and 0012 changed textually, not in meaning. Their bytes differ from the base (+19/−20 and +32/−33) but the difference is re-hunking: the hunk headers now carry the enclosing function name, and groupSessionFor appears once as a deleted and once as an added line across a moved hunk boundary. The proof is check itself: it rebuilds core/ from ds-bot/ + the patches + patches/ds-bot/files/, and it passes at this tip, while neither ds-bot/ nor any core/ file those two patches write was touched by this PR — so the patches still produce exactly the committed tree. No new tip needed; recorded here only.

5. Gates and record. check → skipped pin (no git): the tree hash cannot be computed here / ok 10 patches apply cleanly in order / ok core/ equals ds-bot/ + patches/ds-bot/ — the pin is not verified on this host; CI package at this tip covers it. core/scripts/build-client.mjs --check exits 0 with no output. check-mojibake --check → 0 occurrences of U+FFFD in 1,076 text files. checkpointReasons(body, { pr: 1261, files }) → []; summary 562 characters, files 6 of the 12 changed paths — a listed subset is legal and one listed path is in the diff — checks.at is this tip.

6. The guard's red is only the missing verdict: do not enqueue #1261: no Verifier report names the tip 5d1483ca21c4, and its summary names nothing else. Required contexts at this sha are terminal success (Node 24 · DSH 0.2.0-rc.2 07:15:02Z, tests-ok 07:15:08Z, package 07:14:08Z, merge-gate 07:14:01Z).

7. Trackers: Fixes #1258 is right, #1258 is open and is the only tracker, #1260 is closed as duplicate (07:09:27Z). The test count reads 56 for the two files here (12 + 44) and the body's 113 is the ten-suite run it also ran; both are consistent.

Non-blocking, recorded only: the smoke bench was not run at this sha (the body gives the reason — pure-function change, no DSH checkout here), and arch-docs cannot run on this host (cannot diff against origin/main, no git), so that line rests on CI.