fix: corrects tracked-user scoping, config wipe, upstream discovery

Author: wgordon17

src/app/components/onboarding/OnboardingWizard.tsx

@@ -115,6 +115,7 @@ export default function OnboardingWizard() {
                   showUpstreamDiscovery={true}
                   upstreamRepos={upstreamRepos()}
                   onUpstreamChange={setUpstreamRepos}
+                  trackedUsers={config.trackedUsers}
                 />
               </Match>
             </Switch>

src/app/components/onboarding/RepoSelector.tsx

@@ -25,6 +25,7 @@ interface RepoSelectorProps {
   showUpstreamDiscovery?: boolean;
   upstreamRepos?: RepoRef[];
   onUpstreamChange?: (repos: RepoRef[]) => void;
+  trackedUsers?: { login: string; avatarUrl: string; name: string | null }[];
 }
 
 interface OrgRepoState {
@@ -165,7 +166,7 @@ export default function RepoSelector(props: RepoSelectorProps) {
               allOrgFullNames.add(repo.fullName);
             }
           });
-          void discoverUpstreamRepos(discoveryClient, currentUser.login, allOrgFullNames)
+          void discoverUpstreamRepos(discoveryClient, currentUser.login, allOrgFullNames, props.trackedUsers)
             .then((repos) => {
               if (version !== effectVersion) return;
               setDiscoveredRepos(repos);

src/app/components/settings/SettingsPage.tsx

@@ -323,6 +323,7 @@ export default function SettingsPage() {
                   showUpstreamDiscovery={true}
                   upstreamRepos={localUpstream()}
                   onUpstreamChange={handleUpstreamChange}
+                  trackedUsers={config.trackedUsers}
                 />
               </div>
             </Show>

src/app/services/api.ts

@@ -1200,52 +1200,6 @@ function mergeEnrichment(
   });
 }
 
-/**
- * Global (unscoped) light search for a single tracked user — no repo: qualifiers.
- * Returns the same LightSearchResult shape as graphqlLightCombinedSearch.
- */
-async function graphqlGlobalUserSearch(
-  octokit: GitHubOctokit,
-  userLogin: string
-): Promise<LightSearchResult> {
-  if (!VALID_TRACKED_LOGIN.test(userLogin)) {
-    return {
-      issues: [],
-      pullRequests: [],
-      prNodeIds: [],
-      errors: [{ repo: "global-search", statusCode: null, message: "Invalid userLogin", retryable: false }],
-    };
-  }
-
-  const issueSeen = new Set<number>();
-  const issues: Issue[] = [];
-  const prMap = new Map<number, PullRequest>();
-  const nodeIdMap = new Map<number, string>();
-  const errors: ApiError[] = [];
-  const ISSUE_CAP = 1000;
-  const PR_CAP = 1000;
-
-  const issueQ = `is:issue is:open involves:${userLogin}`;
-  const prInvQ = `is:pr is:open involves:${userLogin}`;
-  const prRevQ = `is:pr is:open review-requested:${userLogin}`;
-
-  try {
-    await executeLightCombinedQuery(
-      octokit, issueQ, prInvQ, prRevQ, `global-search:${userLogin}`,
-      issueSeen, issues, prMap, nodeIdMap, errors, ISSUE_CAP, PR_CAP,
-    );
-  } catch (err) {
-    const { statusCode, message } = extractRejectionError(err);
-    errors.push({ repo: `global-search:${userLogin}`, statusCode, message, retryable: statusCode === null || statusCode >= 500 });
-  }
-
-  const pullRequests = [...prMap.values()];
-  if (pullRequests.length >= PR_CAP) pullRequests.splice(PR_CAP);
-  const prNodeIds = pullRequests.map((pr) => nodeIdMap.get(pr.id)).filter((id): id is string => id != null);
-
-  return { issues, pullRequests, prNodeIds, errors };
-}
-
 /**
  * Merges tracked user search results into the main issue/PR maps.
  * Items already present get the tracked user's login appended to surfacedBy.
@@ -1309,8 +1263,8 @@ export async function fetchIssuesAndPullRequests(
 
   const hasTrackedUsers = (trackedUsers?.length ?? 0) > 0;
 
-  // Early exit when there is nothing to search
-  if (repos.length === 0 && !hasTrackedUsers) {
+  // Early exit — tracked user searches are scoped to repos, so no repos = no results
+  if (repos.length === 0) {
     return { issues: [], pullRequests: [], errors: [] };
   }
 
@@ -1353,9 +1307,9 @@ export async function fetchIssuesAndPullRequests(
     ? fetchPREnrichment(octokit, mainNodeIds)
     : Promise.resolve({ enrichments: new Map<number, PREnrichmentData>(), errors: [] as ApiError[] });
 
-  // Tracked user global searches — run in parallel with main backfill
-  const trackedSearchPromise = hasTrackedUsers
-    ? Promise.allSettled(trackedUsers!.map((u) => graphqlGlobalUserSearch(octokit, u.login)))
+  // Tracked user searches — scoped to the same repos as the main user
+  const trackedSearchPromise = hasTrackedUsers && repos.length > 0
+    ? Promise.allSettled(trackedUsers!.map((u) => graphqlLightCombinedSearch(octokit, repos, u.login)))
     : Promise.resolve([] as PromiseSettledResult<LightSearchResult>[]);
 
   const [mainBackfill, trackedResults] = await Promise.all([mainBackfillPromise, trackedSearchPromise]);
@@ -2075,14 +2029,14 @@ export async function validateGitHubUser(
  * Discovers repos the user participates in but doesn't own, via unscoped
  * GraphQL search (no repo: qualifiers). Returns up to 100 repos sorted
  * alphabetically, excluding any in the provided excludeRepos set.
+ * When trackedUsers is provided, also discovers repos those users participate in.
  */
 export async function discoverUpstreamRepos(
   octokit: GitHubOctokit,
   userLogin: string,
-  excludeRepos: Set<string>
+  excludeRepos: Set<string>,
+  trackedUsers?: TrackedUser[]
 ): Promise<RepoRef[]> {
-  if (!VALID_TRACKED_LOGIN.test(userLogin)) return [];
-
   const repoNames = new Set<string>();
   const errors: ApiError[] = [];
   const CAP = 100;
@@ -2095,21 +2049,32 @@ export async function discoverUpstreamRepos(
     return true;
   }
 
-  const issueQ = `is:issue is:open involves:${userLogin}`;
-  const prQ = `is:pr is:open involves:${userLogin}`;
-
-  await Promise.allSettled([
-    paginateGraphQLSearch<GraphQLIssueSearchResponse, GraphQLIssueNode>(
-      octokit, ISSUES_SEARCH_QUERY, issueQ, "upstream-issues", errors,
-      (node) => extractRepoName(node),
-      () => repoNames.size, CAP,
-    ),
-    paginateGraphQLSearch<LightPRSearchResponse, GraphQLLightPRNode>(
-      octokit, LIGHT_PR_SEARCH_QUERY, prQ, "upstream-prs", errors,
-      (node) => extractRepoName(node),
-      () => repoNames.size, CAP,
-    ),
-  ]);
+  function discoverForUser(login: string) {
+    const issueQ = `is:issue is:open involves:${login}`;
+    const prQ = `is:pr is:open involves:${login}`;
+    return Promise.allSettled([
+      paginateGraphQLSearch<GraphQLIssueSearchResponse, GraphQLIssueNode>(
+        octokit, ISSUES_SEARCH_QUERY, issueQ, `upstream-issues:${login}`, errors,
+        (node) => extractRepoName(node),
+        () => repoNames.size, CAP,
+      ),
+      paginateGraphQLSearch<LightPRSearchResponse, GraphQLLightPRNode>(
+        octokit, LIGHT_PR_SEARCH_QUERY, prQ, `upstream-prs:${login}`, errors,
+        (node) => extractRepoName(node),
+        () => repoNames.size, CAP,
+      ),
+    ]);
+  }
+
+  // Collect all valid logins to discover for
+  const logins: string[] = [];
+  if (VALID_TRACKED_LOGIN.test(userLogin)) logins.push(userLogin);
+  for (const u of trackedUsers ?? []) {
+    if (VALID_TRACKED_LOGIN.test(u.login)) logins.push(u.login);
+  }
+  if (logins.length === 0) return [];
+
+  await Promise.allSettled(logins.map((login) => discoverForUser(login)));
 
   if (errors.length > 0) {
     pushNotification(

tests/components/onboarding/RepoSelector.test.tsx

@@ -436,7 +436,8 @@ describe("RepoSelector — upstream discovery", () => {
     expect(api.discoverUpstreamRepos).toHaveBeenCalledWith(
       expect.anything(),
       "testuser",
-      expect.any(Set)
+      expect.any(Set),
+      undefined
     );
   });
 

tests/services/api-users.test.ts

@@ -354,6 +354,47 @@ describe("discoverUpstreamRepos", () => {
     expect(result).toHaveLength(1);
     expect(result[0]).toEqual({ owner: "my-org", name: "my-repo", fullName: "my-org/my-repo" });
   });
+
+  it("discovers repos from tracked users in addition to primary user", async () => {
+    const octokit = makeOctokit(
+      async () => ({}),
+      async (_query: string, vars: unknown) => {
+        const v = vars as { q: string };
+        if (v.q.includes("involves:primary") && v.q.includes("is:issue")) {
+          return makeSearchPage(["org/primary-repo"]);
+        }
+        if (v.q.includes("involves:tracked1") && v.q.includes("is:issue")) {
+          return makeSearchPage(["org/tracked1-repo"]);
+        }
+        return makeSearchPage([]);
+      }
+    );
+
+    const trackedUsers = [makeTrackedUser("tracked1")];
+    const result = await discoverUpstreamRepos(octokit as never, "primary", new Set(), trackedUsers);
+    const names = result.map((r) => r.fullName);
+    expect(names).toContain("org/primary-repo");
+    expect(names).toContain("org/tracked1-repo");
+  });
+
+  it("deduplicates repos found by both primary and tracked users", async () => {
+    const octokit = makeOctokit(
+      async () => ({}),
+      async (_query: string, vars: unknown) => {
+        const v = vars as { q: string };
+        if (v.q.includes("is:issue")) {
+          // Both users discover the same repo
+          return makeSearchPage(["org/shared-repo"]);
+        }
+        return makeSearchPage([]);
+      }
+    );
+
+    const trackedUsers = [makeTrackedUser("tracked1")];
+    const result = await discoverUpstreamRepos(octokit as never, "primary", new Set(), trackedUsers);
+    expect(result).toHaveLength(1);
+    expect(result[0].fullName).toBe("org/shared-repo");
+  });
 });
 
 // ── multi-user search (fetchIssuesAndPullRequests with trackedUsers) ───────────
@@ -471,16 +512,14 @@ describe("multi-user search", () => {
       async () => ({}),
       async (_query: string, vars: unknown) => {
         const v = vars as Record<string, unknown>;
-        // Heavy backfill query has 'ids' variable
         if ("ids" in v) return makeBackfillResponse([]);
-        // Light combined query: distinguish by issueQ content
+        // Both main and tracked user searches are now repo-scoped;
+        // distinguish by the involves: login in the query
         const issueQ = v["issueQ"] as string | undefined;
-        if (issueQ?.includes("repo:")) {
-          // Main user search (scoped to repos)
+        if (issueQ?.includes("involves:mainuser") || issueQ?.includes("involves:trackeduser")) {
           return makeLightCombinedResponse([{ databaseId: sharedIssueId, repoFullName: "org/repo" }]);
         }
-        // Tracked user search (unscoped)
-        return makeLightCombinedResponse([{ databaseId: sharedIssueId, repoFullName: "org/repo" }]);
+        return makeLightCombinedResponse([]);
       }
     );
 
@@ -506,14 +545,17 @@ describe("multi-user search", () => {
         const v = vars as Record<string, unknown>;
         if ("ids" in v) return makeBackfillResponse([]);
         const issueQ = v["issueQ"] as string | undefined;
-        if (issueQ?.includes("repo:")) {
+        if (issueQ?.includes("involves:mainuser")) {
           return makeLightCombinedResponse([{ databaseId: mainIssueId, repoFullName: "org/repo" }]);
         }
-        // Tracked user has both the shared one and a unique one
-        return makeLightCombinedResponse([
-          { databaseId: mainIssueId, repoFullName: "org/repo" },
-          { databaseId: trackedOnlyIssueId, repoFullName: "org/other-repo" },
-        ]);
+        if (issueQ?.includes("involves:trackeduser")) {
+          // Tracked user has both the shared one and a unique one
+          return makeLightCombinedResponse([
+            { databaseId: mainIssueId, repoFullName: "org/repo" },
+            { databaseId: trackedOnlyIssueId, repoFullName: "org/repo" },
+          ]);
+        }
+        return makeLightCombinedResponse([]);
       }
     );
 
@@ -541,8 +583,7 @@ describe("multi-user search", () => {
         const v = vars as Record<string, unknown>;
         if ("ids" in v) return makeBackfillResponse([]);
         const issueQ = v["issueQ"] as string | undefined;
-        if (issueQ?.includes("repo:")) {
-          // Main user: only shared item
+        if (issueQ?.includes("involves:mainuser")) {
           return makeLightCombinedResponse([{ databaseId: sharedId, repoFullName: "org/repo" }]);
         }
         if (issueQ?.includes("involves:usera")) {
@@ -609,7 +650,7 @@ describe("multi-user search", () => {
         const v = vars as Record<string, unknown>;
         if ("ids" in v) return makeBackfillResponse([]);
         const issueQ = v["issueQ"] as string | undefined;
-        if (issueQ?.includes("repo:")) {
+        if (issueQ?.includes("involves:mainuser")) {
           return makeLightCombinedResponse([{ databaseId: 1001, repoFullName: "org/repo" }]);
         }
         // Tracked user search fails
@@ -626,7 +667,6 @@ describe("multi-user search", () => {
     expect(result.issues).toHaveLength(1);
     expect(result.issues[0].id).toBe(1001);
     expect(result.issues[0].surfacedBy).toEqual(["mainuser"]);
-    // Error is captured (graphqlGlobalUserSearch uses "global-search:" prefix internally)
     expect(result.errors.length).toBeGreaterThan(0);
     expect(callCount).toBeGreaterThan(0);
   });
@@ -641,16 +681,13 @@ describe("multi-user search", () => {
       async (_query: string, vars: unknown) => {
         const v = vars as Record<string, unknown>;
         if ("ids" in v) {
-          // Heavy backfill: return enrichment for the PR
           return makeBackfillResponse([prId]);
         }
         const issueQ = v["issueQ"] as string | undefined;
-        if (issueQ?.includes("repo:")) {
-          // Main user light search: includes a PR
+        if (issueQ?.includes("involves:mainuser") || issueQ?.includes("involves:trackeduser")) {
           return makeLightCombinedResponse([], [{ databaseId: prId, nodeId: prNodeId, repoFullName: "org/repo" }]);
         }
-        // Tracked user search: same PR
-        return makeLightCombinedResponse([], [{ databaseId: prId, nodeId: prNodeId, repoFullName: "org/repo" }]);
+        return makeLightCombinedResponse([]);
       }
     );
 
@@ -660,42 +697,30 @@ describe("multi-user search", () => {
 
     expect(result.pullRequests).toHaveLength(1);
     const pr = result.pullRequests[0];
-    // surfacedBy survives enrichment (spread preserves it since PREnrichmentData lacks surfacedBy)
     expect(pr.surfacedBy).toContain("mainuser");
     expect(pr.surfacedBy).toContain("trackeduser");
-    // And it's fully enriched
     expect(pr.enriched).toBe(true);
     expect(pr.checkStatus).toBe("success");
   });
 
-  it("empty repos with tracked users still runs tracked user searches", async () => {
-    const trackedIssueId = 9001;
-
+  it("empty repos returns empty results even with tracked users", async () => {
     const octokit = makeOctokit(
-      async () => ({}),
-      async (_query: string, vars: unknown) => {
-        const v = vars as Record<string, unknown>;
-        if ("ids" in v) return makeBackfillResponse([]);
-        // Only tracked user search should run (no repo: qualifier)
-        const issueQ = v["issueQ"] as string | undefined;
-        if (issueQ && !issueQ.includes("repo:")) {
-          return makeLightCombinedResponse([{ databaseId: trackedIssueId, repoFullName: "org/tracked-repo" }]);
-        }
-        return makeLightCombinedResponse([]);
-      }
+      async () => { throw new Error("should not be called"); },
+      async () => { throw new Error("should not be called"); }
     );
 
     const result = await fetchIssuesAndPullRequests(
       octokit as never,
-      [], // empty repos — skip main user search
+      [], // empty repos — tracked user searches are also repo-scoped
       "mainuser",
       undefined,
       [makeTrackedUser("trackeduser")]
     );
 
-    expect(result.issues).toHaveLength(1);
-    expect(result.issues[0].id).toBe(trackedIssueId);
-    expect(result.issues[0].surfacedBy).toEqual(["trackeduser"]);
+    expect(result.issues).toEqual([]);
+    expect(result.pullRequests).toEqual([]);
+    expect(result.errors).toEqual([]);
+    expect(octokit.graphql).not.toHaveBeenCalled();
   });
 
   it("surfacedBy logins are always lowercase", async () => {