🐛 [v6] contribute: disabled_repos matches repo names by substring, so disabling one repo disables others #14707

Target: v6.

Target branch: v6 only. Open the PR with --base v6. hive-open-pr defaults to the repo's default branch (v5) when --base is omitted. v5 has the same three selection call sites (contribute_sse.go:348, contribute_select.go:771, contribute_opportunistic.go:206 on v5), but this issue is for v6 only.
Citations: path:line against v6 @ dd406b3e9, paths relative to src/.

Disabling one repo for contribution silently disables every repo whose name contains it.

What happened

Seen on a hosted hive on 2026-10-27. The hub's hub.disabled_repos held projectbluefin/dakota, an untracked repo. Then projectbluefin/dakota-iso was withheld from contributors with "Repository is disabled for contribution". Its toggle under Contribute settings → Repos for contribute showed Off, though nobody had disabled it. Removing the projectbluefin/dakota entry fixed it at once.

Cause

Every disabled-repo check runs config.MatchesAny (pkg/config/filters.go:4), which calls WildcardMatch (crux/config/agent_runtime.go:1321). A pattern with no * and not wrapped in /…/ falls through to return strings.Contains(text, pattern) (agent_runtime.go:1356). So projectbluefin/dakota matches projectbluefin/dakota-iso, and the bare-name check matches dakota inside dakota-iso too.

Server call sites, all of them MatchesAny(full, disabled) || MatchesAny(name, disabled):

• pkg/dashboard/contribute_sse.go:349: ready queue and withheld reasons
• pkg/dashboard/contribute_select.go:771: task selection
• pkg/dashboard/contribute_opportunistic.go:206: opportunistic selection
• pkg/dashboard/api_contribute.go:721: GET /api/contribute/repositories

The dashboard has its own copy of the same rule, in pkg/dashboard/static/index.html:

• contribRepoWildcardMatch (:47133) does text.indexOf(pattern) >= 0 for a plain entry (:47137). It has no /regex/ support at all, so a regex entry is treated as a literal substring.
• contribRepoDisabledEntryMatches (:47153) and contribRepoMatchingDisabledEntries (:47161) build on it.
• renderGovHub uses it for the toggle state (:47171). That is why dakota-iso showed Off.
• toggleContribRepo (:47802) uses it to edit the list. Turning dakota-iso back On runs the filter at :47816, which also deletes the projectbluefin/dakota entry. Re-enabling one repo silently re-enables the other.

config.NormalizeDisabledReposForRepos (pkg/config/repo_target.go:96) already treats plain entries as exact names: it rewrites a bare name to owner/name only on an exact, case-insensitive match. Only the matching is wrong.

Fix

For repository matching, a plain entry (no *, not /…/) must equal the full name or the bare name exactly, case-insensitively. Keep * globs and /regex/ working as they do now, against both forms.

• Do not change WildcardMatch or MatchesAny. The contribute title, label and author filters use them (pkg/config/contribute_repo_filter.go:124-153, pkg/config/filters.go:49-77), and the deny-title defaults rely on *…* substring globs.
• Add a repo-specific matcher in pkg/config, for example RepoMatchesAny(full, name string, patterns []string) bool, and use it at the four server call sites above. Skip empty entries: today an empty pattern matches every repo through strings.Contains(text, "").
• Make the same change in the dashboard: an exact, case-insensitive match for plain entries in contribRepoDisabledEntryMatches. Add /regex/ support there (new RegExp(body, 'i') in a try, no match on a bad regex) so the toggle agrees with the server.
• In toggleContribRepo, treat a /regex/ blocker like a * blocker (:47809-47815): show the toast and do not delete it.
• TestGovernorHubReposUseCanonicalDisabledRepoMatching (pkg/dashboard/contribute_bugs_rest_test.go:222) pins some of these lines as text markers. Update the markers that change.

Acceptance criteria

• With disabled_repos: [projectbluefin/dakota], only projectbluefin/dakota is disabled. projectbluefin/dakota-iso is not. The same holds for the bare entry dakota.
• projectbluefin/dakota* still disables both.
• /^projectbluefin\/dakota$/ still disables only projectbluefin/dakota.
• Matching is case-insensitive: ProjectBluefin/Dakota disables projectbluefin/dakota.
• Repos for contribute shows the right state for repos whose names share a prefix. Turning one of them on leaves the other's entry in place.
• The contribute title, label and author filters behave exactly as before.

Test plan

• A table test for the new matcher: exact full name, exact bare name, prefix-sharing names (dakota vs dakota-iso, both forms), a glob, a regex, case differences, and an empty entry.
• A ready-queue test (the contribute_sse.go path) where the disabled entry is a prefix of another tracked repo. The longer-named repo must still serve work, and the disabled one must be withheld with disabled_repo.
• A node test running the shipped contribRepoDisabledEntryMatches and toggleContribRepo, through the existing jsFunc helper as in hive_advice_readable_test.go. It covers the toggle state for dakota vs dakota-iso, a regex entry, and that turning dakota-iso on keeps the projectbluefin/dakota entry.
• Run go test ./pkg/config/... ./pkg/dashboard/....

Out of scope

• The semantics of the title, label and author filters.
• NormalizeDisabledReposForRepos.
• The same bug on v5.