[github] bug: project path → git remote misalignment corrupts cross-repo features

apps/server/src/services/auto-mode-service.ts

@@ -141,6 +141,7 @@ import {
 import { runInitScript } from './init-script-service.js';
 import { checkFeatureRestartOutcome } from './startup-recovery-service.js';
 import { checkAppCompliance, buildComplianceRefusalMessage } from './app-compliance-service.js';
+import { validateRepoSlug, buildRepoSlugMismatchMessage } from './repo-remote-validation.js';
 import type {
   RunningFeature,
   PendingApproval,
@@ -833,6 +834,24 @@ export class AutoModeService {
       throw new Error(message);
     }
 
+    // Repo-remote alignment gate.  Refuse to run auto-mode when the project's
+    // `expectedRepoSlug` setting disagrees with the git remote origin at that path.
+    // Prevents cross-repo corruption where .automaker/ targets one repo but the
+    // git remote points to another.  AUTOMAKER_SKIP_REPO_SLUG_CHECK bypasses.
+    const projectSettings = this.settingsService
+      ? await this.settingsService.getProjectSettings(projectPath).catch(() => null)
+      : null;
+    const slugValidation = await validateRepoSlug(projectPath, projectSettings?.expectedRepoSlug);
+    if (!slugValidation.valid && !slugValidation.skipped) {
+      const message = buildRepoSlugMismatchMessage(
+        projectPath,
+        slugValidation.expectedSlug!,
+        slugValidation.actualSlug
+      );
+      logger.warn(`[repo-remote] ${message}`);
+      throw new Error(message);
+    }
+
     // App-level pause gate. The durable `pausedProjects` registry is the enforced
     // source of truth — refuse to start a loop for a paused app until it is resumed.
     if (await this.isProjectPathPausedNow(projectPath)) {

apps/server/src/services/project-health-service.ts

@@ -19,6 +19,7 @@ import type { EventEmitter } from '../lib/events.js';
 import type { ProjectService } from './project-service.js';
 import type { FeatureLoader } from './feature-loader.js';
 import type { SettingsService } from './settings-service.js';
+import { validateRepoSlug } from './repo-remote-validation.js';
 
 const logger = createLogger('ProjectHealth');
 
@@ -55,6 +56,21 @@ export class ProjectHealthService {
         return project.health ?? 'on-track';
       }
 
+      // Repo-remote alignment check — a misaligned project is always off-track.
+      const alignment = await this.checkRepoAlignment(projectPath);
+      if (alignment && !alignment.aligned) {
+        const targetHealth: ProjectHealth = 'off-track';
+        if (project.health !== targetHealth) {
+          await this.projectService.updateProject(projectPath, projectSlug, {
+            health: targetHealth,
+          });
+          logger.warn(
+            `Project "${projectSlug}" health -> off-track (repo mismatch: expected ${alignment.expected}, got ${alignment.actual})`
+          );
+        }
+        return targetHealth;
+      }
+
       const factors = await this.computeFactors(projectPath, project);
       const health = this.deriveHealth(factors);
 
@@ -88,6 +104,46 @@ export class ProjectHealthService {
     }
   }
 
+  /**
+   * Check whether a project's git remote origin aligns with its declared
+   * `expectedRepoSlug` in project settings.
+   *
+   * Returns `null` when `expectedRepoSlug` is not configured (nothing to check).
+   * Returns `{ aligned: true }` when the remote matches.
+   * Returns `{ aligned: false, expected, actual }` on mismatch.
+   *
+   * This is a public, settings-service-free entry point so that the board UI
+   * or other services can query alignment without going through the full health
+   * compute pipeline.
+   */
+  async checkRepoAlignment(projectPath: string): Promise<{
+    aligned: boolean;
+    expected?: string;
+    actual?: string | null;
+  } | null> {
+    try {
+      const projectSettings = await this.settingsService
+        .getProjectSettings(projectPath)
+        .catch(() => null);
+      if (!projectSettings?.expectedRepoSlug) return null;
+
+      const result = await validateRepoSlug(projectPath, projectSettings.expectedRepoSlug);
+
+      if (result.notConfigured || result.skipped) {
+        return null;
+      }
+
+      return {
+        aligned: result.valid,
+        expected: result.expectedSlug,
+        actual: result.actualSlug,
+      };
+    } catch (err) {
+      logger.warn(`Failed to check repo alignment for ${projectPath}:`, err);
+      return null;
+    }
+  }
+
   // ── Internal ─────────────────────────────────────────────────────────────
 
   /**

apps/server/src/services/repo-remote-validation.ts

@@ -0,0 +1,180 @@
+/**
+ * Repo-Remote Validation Service
+ *
+ * Validates that a project's git remote origin matches the expected repo slug
+ * declared in project settings (`expectedRepoSlug`).  Prevents cross-repo
+ * corruption where `.automaker/` boards target one repo but the git remote
+ * points to another.
+ *
+ * Used as a startup gate in `startAutoLoopForProject` (like the compliance
+ * gate) and surfaced as a project-health warning on the board.
+ *
+ * Default: REFUSE auto-mode when `expectedRepoSlug` is set and origin disagrees.
+ * Escape hatch: set AUTOMAKER_SKIP_REPO_SLUG_CHECK=1 (truthy) to bypass.
+ *
+ * When `expectedRepoSlug` is NOT set, validation is skipped silently — no
+ * warning, no block.  The field is the canonical declaration of intent.
+ */
+
+import { exec } from 'node:child_process';
+import { promisify } from 'node:util';
+import { createLogger } from '@protolabsai/utils';
+
+const execAsync = promisify(exec);
+const logger = createLogger('RepoRemoteValidation');
+
+/** Env var operators can set (truthy) to bypass the repo-slug gate entirely. */
+export const REPO_SLUG_SKIP_ENV = 'AUTOMAKER_SKIP_REPO_SLUG_CHECK';
+
+/** Regex for HTTPS GitHub remotes: https://github.com/owner/repo.git */
+const GITHUB_HTTPS_REMOTE_REGEX = /https:\/\/github\.com\/([^/]+)\/([^/.]+)/;
+/** Regex for SSH GitHub remotes: git@github.com:owner/repo.git */
+const GITHUB_SSH_REMOTE_REGEX = /git@github\.com:([^/]+)\/([^/.]+)/;
+
+function isTruthyEnv(value: string | undefined): boolean {
+  if (!value) return false;
+  const v = value.trim().toLowerCase();
+  return v === '1' || v === 'true' || v === 'yes' || v === 'on';
+}
+
+/**
+ * Extract the "owner/repo" slug from a git remote URL.
+ * Returns null if the URL is not a recognizable GitHub remote.
+ */
+export function extractRepoSlug(remoteUrl: string): string | null {
+  const trimmed = remoteUrl.trim();
+  const httpsMatch = trimmed.match(GITHUB_HTTPS_REMOTE_REGEX);
+  if (httpsMatch) return `${httpsMatch[1]}/${httpsMatch[2]}`;
+
+  const sshMatch = trimmed.match(GITHUB_SSH_REMOTE_REGEX);
+  if (sshMatch) return `${sshMatch[1]}/${sshMatch[2]}`;
+
+  return null;
+}
+
+/**
+ * Read the git remote origin URL for a project path.
+ * Returns null if there is no origin remote or the command fails.
+ */
+export async function readGitRemoteOrigin(projectPath: string): Promise<string | null> {
+  try {
+    const { stdout } = await execAsync('git remote get-url origin', {
+      cwd: projectPath,
+      timeout: 10000,
+    });
+    const url = stdout.trim();
+    return url || null;
+  } catch {
+    // No origin remote, not a git repo, or timeout — all non-fatal
+    return null;
+  }
+}
+
+/**
+ * Result of validating a project's git remote against its expected slug.
+ */
+export interface RepoSlugValidationResult {
+  /** True when validation passed or was skipped. */
+  valid: boolean;
+  /** True when the gate was bypassed via the opt-out env var. */
+  skipped: boolean;
+  /** True when `expectedRepoSlug` was not set (nothing to validate). */
+  notConfigured: boolean;
+  /** The expected slug from settings, if any. */
+  expectedSlug?: string;
+  /** The actual slug resolved from git remote origin, if any. */
+  actualSlug?: string | null;
+  /** Human-readable mismatch message when valid is false. */
+  mismatchMessage?: string;
+}
+
+/**
+ * Build a clear, operator-facing refusal message from a slug mismatch.
+ */
+export function buildRepoSlugMismatchMessage(
+  projectPath: string,
+  expectedSlug: string,
+  actualSlug: string | null
+): string {
+  const actual = actualSlug ?? '(no origin remote)';
+  const lines = [
+    `protoMaker refused to run auto-mode for ${projectPath}: git remote origin does not match the expected repo.`,
+    '',
+    `  Expected: ${expectedSlug}`,
+    `  Actual:   ${actual}`,
+    '',
+    `This usually means the .automaker/ board at ${projectPath} targets a different repo`,
+    `than the git repository cloned at that path.  Fix the mismatch by either:`,
+    `  1. Re-cloning the correct repo at this path, or`,
+    `  2. Moving the .automaker/ board to a path that matches the expected repo.`,
+    '',
+    `To bypass this gate (not recommended), set ${REPO_SLUG_SKIP_ENV}=1.`,
+  ];
+  return lines.join('\n');
+}
+
+/**
+ * Validate that a project's git remote origin matches the expected repo slug
+ * from project settings.
+ *
+ * @param projectPath - Absolute path to the project directory
+ * @param expectedRepoSlug - The expected "owner/repo" slug from settings, or undefined to skip
+ * @returns Validation result
+ */
+export async function validateRepoSlug(
+  projectPath: string,
+  expectedRepoSlug?: string
+): Promise<RepoSlugValidationResult> {
+  const result: RepoSlugValidationResult = {
+    valid: true,
+    skipped: false,
+    notConfigured: !expectedRepoSlug,
+    expectedSlug: expectedRepoSlug,
+    actualSlug: null,
+  };
+
+  // If no expected slug is configured, skip silently
+  if (!expectedRepoSlug) {
+    return result;
+  }
+
+  // Opt-out: don't fight people's systems
+  if (isTruthyEnv(process.env[REPO_SLUG_SKIP_ENV])) {
+    logger.info(
+      `[repo-remote] ${REPO_SLUG_SKIP_ENV} set — skipping repo slug validation for ${projectPath}`
+    );
+    result.skipped = true;
+    return result;
+  }
+
+  // Read the actual remote URL
+  const remoteUrl = await readGitRemoteOrigin(projectPath);
+  const actualSlug = remoteUrl ? extractRepoSlug(remoteUrl) : null;
+  result.actualSlug = actualSlug;
+
+  // If we can't resolve the actual slug (non-GitHub remote or no remote),
+  // do NOT block — refusing to run a legitimate local/non-GitHub repo would
+  // be worse than the gap. Only block when we positively detect a mismatch.
+  if (!actualSlug) {
+    logger.info(
+      `[repo-remote] Cannot resolve repo slug from origin (${remoteUrl ?? 'null'}) for ${projectPath} — skipping validation`
+    );
+    return result;
+  }
+
+  // Compare slugs (case-insensitive — GitHub is case-insensitive for owner names)
+  if (actualSlug.toLowerCase() !== expectedRepoSlug.toLowerCase()) {
+    result.valid = false;
+    result.mismatchMessage = buildRepoSlugMismatchMessage(
+      projectPath,
+      expectedRepoSlug,
+      actualSlug
+    );
+    logger.warn(
+      `[repo-remote] Mismatch detected for ${projectPath}: expected "${expectedRepoSlug}", got "${actualSlug}"`
+    );
+    return result;
+  }
+
+  return result;
+}