@ayushporwal/coja 0.0.1

package/dist/git/run.js

@@ -0,0 +1,256 @@
+import { execFile, spawn } from 'node:child_process';
+import { badRequest } from '../routes/http.js';
+/**
+ * The only module that spawns git.
+ *
+ * Every invocation is `execFile('git', argv)` (or `spawn` when stdout is
+ * streamed) — an argv array, never a shell — with prompts disabled and stable,
+ * untranslated output. Callers hand over arguments as data; pathspecs are
+ * validated with {@link assertPathspec} and always placed after a `--`,
+ * revisions with {@link assertRevision}, so no user-controlled string can ever
+ * be read as an option.
+ */
+/** 64 MiB: enough for any patch or file we are willing to hold in memory. */
+export const DEFAULT_MAX_BUFFER = 64 * 1024 * 1024;
+/** Stderr kept on a GitError is capped so a runaway process cannot bloat error responses. */
+const MAX_STDERR_CHARS = 4000;
+/** A git invocation that failed: non-zero exit, timeout, abort, or git missing. */
+export class GitError extends Error {
+    args;
+    exitCode;
+    stderr;
+    name = 'GitError';
+    constructor(
+    /** The argv git was started with (never includes secrets: credentials come from helpers). */
+    args, 
+    /** Exit code, or null when git did not exit normally (killed, aborted, not found). */
+    exitCode, stderr, message) {
+        super(message);
+        this.args = args;
+        this.exitCode = exitCode;
+        this.stderr = stderr;
+    }
+}
+/**
+ * Run `git -C <repoPath> <args>` and resolve with its output. Rejects with a
+ * GitError, or with a 400 HttpError when `repoPath` could be read as an option.
+ */
+export async function runGit(repoPath, args, opts = {}) {
+    return spawnGit(['-C', assertRepoPath(repoPath), ...args], opts);
+}
+/**
+ * Run `git <args>` without a repository (used for `git clone` and `git --version`). Everything
+ * else operates on an existing repository and must use {@link runGit}.
+ */
+export async function runGitGlobal(args, opts = {}) {
+    return spawnGit(args, opts);
+}
+/**
+ * Run `git -C <repoPath> <args>` and hand stdout to `sink` chunk by chunk
+ * instead of buffering it, for output that may not fit in memory (counting the
+ * lines of a huge blob). Resolves once git exited successfully; rejects with a
+ * GitError exactly like {@link runGit}.
+ */
+export async function runGitStreaming(repoPath, args, sink, opts = {}) {
+    const argv = ['-C', assertRepoPath(repoPath), ...args];
+    await new Promise((resolve, reject) => {
+        const child = spawn('git', argv, {
+            env: gitEnv(opts.env),
+            windowsHide: true,
+            signal: opts.signal,
+            timeout: opts.timeoutMs ?? 0,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        let stderr = '';
+        let failure;
+        let settled = false;
+        const fail = (err) => {
+            if (settled)
+                return;
+            settled = true;
+            reject(err);
+        };
+        child.stdout.on('data', (chunk) => {
+            try {
+                sink(chunk);
+            }
+            catch (err) {
+                child.kill();
+                fail(new GitError(argv, null, redact(stderr), err instanceof Error ? err.message : String(err)));
+            }
+        });
+        child.stderr.on('data', (chunk) => {
+            if (stderr.length < MAX_STDERR_CHARS)
+                stderr += chunk.toString('utf8');
+        });
+        child.on('error', (err) => {
+            failure = err;
+            // A spawn failure (git missing) never reaches 'close'; an abort does, once git has exited.
+            if (child.pid === undefined)
+                fail(toGitError(argv, failure, redact(stderr)));
+        });
+        child.on('close', (code, signal) => {
+            if (settled)
+                return;
+            if (failure)
+                return fail(toGitError(argv, failure, redact(stderr)));
+            if (code === 0) {
+                settled = true;
+                resolve();
+                return;
+            }
+            fail(toGitError(argv, { code, killed: child.killed, signal }, redact(stderr)));
+        });
+    });
+}
+function spawnGit(argv, opts) {
+    const maxBuffer = opts.maxBuffer ?? DEFAULT_MAX_BUFFER;
+    return new Promise((resolve, reject) => {
+        const child = execFile('git', [...argv], {
+            encoding: 'buffer',
+            maxBuffer,
+            timeout: opts.timeoutMs ?? 0,
+            signal: opts.signal,
+            windowsHide: true,
+            env: gitEnv(opts.env),
+        }, (error, stdout, stderr) => {
+            const settle = () => {
+                const stderrText = redact(stderr.toString('utf8'));
+                if (!error) {
+                    resolve({ stdout, stderr: stderrText, exitCode: 0, truncated: false });
+                    return;
+                }
+                const err = error;
+                if (err.code === 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER' && opts.truncateStdout) {
+                    resolve({ stdout, stderr: stderrText, exitCode: 0, truncated: true });
+                    return;
+                }
+                if (typeof err.code === 'number' && opts.okExitCodes?.includes(err.code)) {
+                    resolve({ stdout, stderr: stderrText, exitCode: err.code, truncated: false });
+                    return;
+                }
+                reject(toGitError(argv, err, stderrText));
+            };
+            // On abort, execFile reports before git has actually exited. Wait for it, so a caller
+            // that removes a half-written clone afterwards is not racing a still-running git.
+            if (error &&
+                isAbort(error) &&
+                child.exitCode === null &&
+                child.signalCode === null) {
+                child.once('close', settle);
+            }
+            else {
+                settle();
+            }
+        });
+        // git may exit before reading stdin (EPIPE); that is not an error for us.
+        child.stdin?.on('error', () => { });
+        if (opts.input === undefined)
+            child.stdin?.end();
+        else
+            child.stdin?.end(opts.input);
+    });
+}
+/** The environment every git child gets: the caller's, plus the fixed settings we rely on. */
+function gitEnv(extra) {
+    return {
+        ...process.env,
+        ...extra,
+        // Never block on a username/password prompt; fail instead.
+        GIT_TERMINAL_PROMPT: '0',
+        // Untranslated, byte-stable messages and output.
+        LC_ALL: 'C',
+        // Read-only commands must not take the index lock in the user's checkout.
+        GIT_OPTIONAL_LOCKS: '0',
+    };
+}
+const isAbort = (err) => err.code === 'ABORT_ERR' || err.name === 'AbortError';
+function toGitError(argv, err, stderr) {
+    const cmd = `git ${subcommand(argv)}`;
+    const detail = stderr.trim().split('\n').filter(Boolean).pop();
+    const suffix = detail ? `: ${detail}` : '';
+    if (err.code === 'ENOENT') {
+        return new GitError(argv, null, stderr, 'git is not installed or not on PATH');
+    }
+    if (isAbort(err)) {
+        return new GitError(argv, null, stderr, `${cmd} was aborted`);
+    }
+    if (err.code === 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER') {
+        return new GitError(argv, null, stderr, `${cmd} produced more output than allowed`);
+    }
+    if (err.killed || (err.signal && typeof err.code !== 'number')) {
+        return new GitError(argv, null, stderr, `${cmd} timed out (${err.signal ?? 'killed'})${suffix}`);
+    }
+    const exitCode = typeof err.code === 'number' ? err.code : null;
+    return new GitError(argv, exitCode, stderr, `${cmd} failed (exit ${exitCode ?? '?'})${suffix}`);
+}
+/** The git subcommand in an argv, skipping global options such as `-C <path>` and `-c k=v`. */
+function subcommand(argv) {
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === '-C' || arg === '-c') {
+            i++;
+            continue;
+        }
+        if (arg === undefined || arg.startsWith('-'))
+            continue;
+        return arg;
+    }
+    return '';
+}
+/** Strip `user:password@` from URLs and cap the length; stderr ends up in API responses. */
+function redact(text) {
+    const clean = text.replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, '$1***@');
+    return clean.length > MAX_STDERR_CHARS ? `${clean.slice(0, MAX_STDERR_CHARS)}…` : clean;
+}
+function assertRepoPath(repoPath) {
+    if (repoPath.startsWith('-'))
+        throw badRequest('repository path must not start with "-"');
+    return repoPath;
+}
+/**
+ * Validate a repository-relative path before it is handed to git as a pathspec
+ * or as the `<path>` in `<rev>:<path>`. Returns the path unchanged.
+ *
+ * Rejects (HTTP 400): empty, control characters, a leading `-` (would be an
+ * option), a leading `:` (pathspec magic), absolute paths, and `.`/`..`
+ * segments. A single trailing slash is allowed (directory pathspecs).
+ */
+export function assertPathspec(p) {
+    if (typeof p !== 'string' || p.length === 0)
+        throw badRequest('path is required');
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: rejecting control characters is the point
+    if (/[\0-\x1f\x7f]/.test(p))
+        throw badRequest('path contains control characters');
+    if (p.startsWith('-'))
+        throw badRequest(`path must not start with "-": ${p}`);
+    if (p.startsWith(':'))
+        throw badRequest(`path must not start with ":": ${p}`);
+    if (p.startsWith('/') || p.startsWith('\\') || /^[A-Za-z]:[\\/]/.test(p)) {
+        throw badRequest(`path must be relative to the repository root: ${p}`);
+    }
+    const segments = p.split('/');
+    segments.forEach((segment, i) => {
+        if (segment === '..')
+            throw badRequest(`path must not contain "..": ${p}`);
+        if (segment === '.')
+            throw badRequest(`path must not contain "." segments: ${p}`);
+        if (segment === '' && i !== segments.length - 1) {
+            throw badRequest(`path must not contain empty segments: ${p}`);
+        }
+    });
+    return p;
+}
+/**
+ * Validate a revision argument (an oid, a ref name, or a range such as `a..b`)
+ * so it can never be parsed as an option. Returns it unchanged.
+ */
+export function assertRevision(rev) {
+    if (typeof rev !== 'string' || rev.length === 0)
+        throw badRequest('revision is required');
+    if (/[\0-\x20\x7f]/.test(rev))
+        throw badRequest('revision contains whitespace or control characters');
+    if (rev.startsWith('-'))
+        throw badRequest(`revision must not start with "-": ${rev}`);
+    return rev;
+}

package/dist/open-browser.js

@@ -0,0 +1,27 @@
+import { spawn } from 'node:child_process';
+/**
+ * Open `url` in the user's default browser without any dependency.
+ * Best effort: failures are swallowed, the URL is printed anyway.
+ */
+export function openBrowser(url) {
+    const [command, args] = commandFor(process.platform, url);
+    try {
+        const child = spawn(command, args, { stdio: 'ignore', detached: true });
+        child.on('error', () => { });
+        child.unref();
+    }
+    catch {
+        // ignore: the user can still open the printed URL by hand
+    }
+}
+function commandFor(platform, url) {
+    switch (platform) {
+        case 'darwin':
+            return ['open', [url]];
+        case 'win32':
+            // The empty string is the window title `start` would otherwise steal the URL for.
+            return ['cmd', ['/c', 'start', '', url]];
+        default:
+            return ['xdg-open', [url]];
+    }
+}

package/dist/paths.js

@@ -0,0 +1,18 @@
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+/**
+ * Absolute path of the `coja` package root (the directory holding package.json).
+ * Both `src/` (run via tsx) and `dist/` (built) sit one level below it, so the
+ * same relative hop works in either case.
+ */
+export const packageRoot = fileURLToPath(new URL('..', import.meta.url));
+/** Where the built web UI lives inside the published package. */
+export function resolvePublicDir() {
+    return path.join(packageRoot, 'public');
+}
+export function packageVersion() {
+    const raw = readFileSync(path.join(packageRoot, 'package.json'), 'utf8');
+    const pkg = JSON.parse(raw);
+    return pkg.version;
+}

package/dist/pr/fetcher.js

@@ -0,0 +1,173 @@
+import { nowIso } from '../db.js';
+import { fetch as gitFetch, mergeBase, revParse } from '../git/plumbing.js';
+import { GitError } from '../git/run.js';
+import { githubPullHeadRef, prBaseRef, prHeadRef } from './refs.js';
+const REMOTE = 'origin';
+const key = (projectId, number) => `${projectId}#${number}`;
+/**
+ * Brings a pull request's objects into a project's repository, lazily and in
+ * the background (design.md: "Fetch is lazy and non-blocking").
+ *
+ * `ensure` compares the namespaced refs with the oids GitHub reports and only
+ * fetches when they differ, so re-opening a PR whose head moved re-fetches
+ * while an unchanged PR is `ready` without touching the network. Status is
+ * kept in memory per `${projectId}#${number}`; the refs themselves persist in
+ * the repository.
+ *
+ * Requests are never dropped: when `ensure` is asked for other oids while a
+ * fetch is in flight, the newest oids are decided again as soon as that fetch
+ * finishes, so a head that moves mid-fetch still ends `ready` at the new oids.
+ */
+export class PrFetcher {
+    statuses = new Map();
+    /** Background fetches, by key. */
+    inflight = new Map();
+    /** `ensure` calls still deciding whether to fetch, by key; concurrent callers share one. */
+    ensuring = new Map();
+    status(projectId, number) {
+        return this.statuses.get(key(projectId, number)) ?? { state: 'idle' };
+    }
+    /**
+     * Make sure `refs` are fetched. Returns immediately: `ready` when the
+     * repository already holds exactly these oids, otherwise `fetching` after
+     * starting a background fetch (or while one is running).
+     */
+    ensure(project, refs) {
+        const k = key(project.id, refs.number);
+        const running = this.inflight.get(k);
+        if (running) {
+            // The newest request wins; the oids already being fetched need nothing more.
+            running.next = sameOids(running.refs, refs) ? undefined : refs;
+            return Promise.resolve(this.status(project.id, refs.number));
+        }
+        const deciding = this.ensuring.get(k);
+        if (deciding) {
+            if (sameOids(deciding.refs, refs))
+                return deciding.done;
+            return deciding.done.then(() => this.ensure(project, refs));
+        }
+        return this.beginDecision(project, refs, k);
+    }
+    /** Resolve once nothing is pending or running for the PR (tests and eager callers). */
+    async waitFor(projectId, number) {
+        const k = key(projectId, number);
+        for (;;) {
+            const deciding = this.ensuring.get(k);
+            if (deciding) {
+                await deciding.done;
+                continue;
+            }
+            const running = this.inflight.get(k);
+            if (running) {
+                await running.done;
+                continue;
+            }
+            return this.status(projectId, number);
+        }
+    }
+    beginDecision(project, refs, k) {
+        const entry = {
+            refs,
+            done: this.decide(project, refs, k).finally(() => {
+                if (this.ensuring.get(k) === entry)
+                    this.ensuring.delete(k);
+            }),
+        };
+        this.ensuring.set(k, entry);
+        return entry.done;
+    }
+    /** Never rejects: a failing check (e.g. no merge base) becomes an `error` status, like a failed fetch. */
+    async decide(project, refs, k) {
+        try {
+            const repo = project.path;
+            const n = refs.number;
+            const [head, base] = await Promise.all([
+                revParse(repo, prHeadRef(n)),
+                revParse(repo, prBaseRef(n)),
+            ]);
+            if (head && base && head === refs.headRefOid && base === refs.baseRefOid) {
+                const current = this.statuses.get(k);
+                if (current?.state === 'ready' && current.headOid === head && current.baseOid === base) {
+                    return current;
+                }
+                const ready = {
+                    state: 'ready',
+                    headOid: head,
+                    baseOid: base,
+                    mergeBaseOid: await mergeBase(repo, base, head),
+                    ...(current?.startedAt ? { startedAt: current.startedAt } : {}),
+                    finishedAt: current?.finishedAt ?? nowIso(),
+                };
+                this.statuses.set(k, ready);
+                return ready;
+            }
+            return this.start(project, refs, k);
+        }
+        catch (err) {
+            const failed = { state: 'error', error: describe(err), finishedAt: nowIso() };
+            this.statuses.set(k, failed);
+            return failed;
+        }
+    }
+    start(project, refs, k) {
+        const startedAt = nowIso();
+        const fetching = { state: 'fetching', startedAt };
+        this.statuses.set(k, fetching);
+        const entry = {
+            refs,
+            done: this.runFetch(project, refs, startedAt).then((final) => {
+                this.statuses.set(k, final);
+                if (this.inflight.get(k) === entry)
+                    this.inflight.delete(k);
+                // The oids changed while we fetched: check the repository against the newest ones.
+                if (entry.next)
+                    void this.beginDecision(project, entry.next, k);
+                return final;
+            }),
+        };
+        this.inflight.set(k, entry);
+        return fetching;
+    }
+    /** Never rejects: failures become an `error` status. */
+    async runFetch(project, refs, startedAt) {
+        const repo = project.path;
+        const n = refs.number;
+        const headSpec = `+${githubPullHeadRef(n)}:${prHeadRef(n)}`;
+        try {
+            try {
+                // GitHub serves any reachable commit by full oid, so the base is pinned to
+                // exactly the oid the PR was compared against.
+                await gitFetch(repo, REMOTE, [headSpec, `+${refs.baseRefOid}:${prBaseRef(n)}`]);
+            }
+            catch (err) {
+                if (!(err instanceof GitError) || !isValidRefName(refs.baseRefName))
+                    throw err;
+                // Servers that refuse wants by oid still serve the branch tip.
+                await gitFetch(repo, REMOTE, [headSpec, `+refs/heads/${refs.baseRefName}:${prBaseRef(n)}`]);
+            }
+            const [headOid, baseOid] = await Promise.all([
+                revParse(repo, prHeadRef(n)),
+                revParse(repo, prBaseRef(n)),
+            ]);
+            if (!headOid || !baseOid)
+                throw new Error(`refs for PR #${n} are missing after the fetch`);
+            const mergeBaseOid = await mergeBase(repo, baseOid, headOid);
+            return { state: 'ready', headOid, baseOid, mergeBaseOid, startedAt, finishedAt: nowIso() };
+        }
+        catch (err) {
+            return { state: 'error', error: describe(err), startedAt, finishedAt: nowIso() };
+        }
+    }
+}
+const sameOids = (a, b) => a.headRefOid === b.headRefOid && a.baseRefOid === b.baseRefOid;
+function isValidRefName(name) {
+    return (name.length > 0 && !name.startsWith('-') && !/[\s~^:?*[\\]/.test(name) && !name.includes('..'));
+}
+/** Human-readable failure: git's stderr (already redacted by the runner) or the error message. */
+function describe(err) {
+    if (err instanceof GitError) {
+        const stderr = err.stderr.trim();
+        return stderr ? `${err.message}\n${stderr}`.slice(0, 2000) : err.message;
+    }
+    return err instanceof Error ? err.message : String(err);
+}

package/dist/pr/objects.js

@@ -0,0 +1,83 @@
+import { blobInfo, countLines, diff, diffNameStatus, showFile } from '../git/plumbing.js';
+import { assertPathspec } from '../git/run.js';
+import { badRequest, notFound } from '../routes/http.js';
+/**
+ * Read-side views of a fetched pull request, all computed from git objects.
+ * `mergeBase` is the diff base (decisions.md), matching GitHub's own PR diff.
+ */
+export function getChangedFiles(repo, mergeBase, head) {
+    return diffNameStatus(repo, mergeBase, head);
+}
+/**
+ * The unified patch for one file. Pass `previousPath` for renames so git sees
+ * both sides and can pair them; without it a rename shows as delete + add.
+ */
+export async function getFileDiff(repo, mergeBase, head, path, previousPath) {
+    assertPathspec(path);
+    const paths = [path];
+    if (previousPath !== undefined && previousPath !== path)
+        paths.push(assertPathspec(previousPath));
+    const { patch, truncated } = await diff(repo, mergeBase, head, { paths });
+    const binary = !truncated && isBinaryPatch(patch);
+    return {
+        path,
+        ...(previousPath !== undefined ? { previousPath } : {}),
+        patch: binary || truncated ? '' : patch,
+        binary,
+        tooLarge: truncated,
+    };
+}
+const isBinaryPatch = (patch) => /^Binary files .* differ$/m.test(patch) || /^GIT binary patch$/m.test(patch);
+/**
+ * A file's text at `oid`, optionally a 1-based inclusive line range (clamped
+ * to the file). 404 when the path does not exist at that commit; 400 for
+ * directories and binary files.
+ *
+ * Only the first `maxBytes` of a blob are read. When that cuts the file short,
+ * `text` keeps whole lines only (the cut line is dropped), `lineCount` is
+ * counted from the full blob, and `truncated` tells whether the requested text
+ * — the whole file or the range — reached past what was read.
+ */
+export async function getBlob(repo, ref, oid, path, start, end, opts = {}) {
+    assertPathspec(path);
+    const info = await blobInfo(repo, oid, path);
+    if (!info.exists)
+        throw notFound(`${path} at ${ref}`);
+    if (info.type !== 'blob')
+        throw badRequest(`${path} is a ${info.type ?? 'non-file'}, not a file`);
+    const file = await showFile(repo, oid, path, opts.maxBytes === undefined ? {} : { maxBytes: opts.maxBytes });
+    if (file.binary)
+        throw badRequest(`${path} is a binary file`);
+    const lines = splitLines(file.text);
+    if (file.truncated && !file.text.endsWith('\n'))
+        lines.pop(); // the cut fell inside this line
+    const lineCount = file.truncated ? await countLines(repo, oid, path) : lines.length;
+    const base = { ref, oid, path, size: file.size, lineCount };
+    if (start === undefined && end === undefined) {
+        const text = file.truncated ? joinLines(lines) : file.text;
+        return { ...base, text, truncated: file.truncated };
+    }
+    if (lineCount === 0)
+        return { ...base, text: '', truncated: false };
+    const startLine = clamp(start ?? 1, 1, lineCount);
+    const endLine = clamp(end ?? lineCount, startLine, lineCount);
+    return {
+        ...base,
+        startLine,
+        endLine,
+        text: lines.slice(startLine - 1, endLine).join('\n'),
+        truncated: endLine > lines.length,
+    };
+}
+/** Lines of `text`; a trailing newline does not start an extra empty line. */
+function splitLines(text) {
+    if (text === '')
+        return [];
+    const lines = text.split('\n');
+    if (lines[lines.length - 1] === '')
+        lines.pop();
+    return lines;
+}
+/** Inverse of {@link splitLines} for complete lines: each one newline-terminated. */
+const joinLines = (lines) => (lines.length === 0 ? '' : `${lines.join('\n')}\n`);
+const clamp = (n, min, max) => Math.min(Math.max(n, min), max);

package/dist/pr/refs.js

@@ -0,0 +1,17 @@
+/**
+ * Where fetched pull requests live inside a project's repository.
+ *
+ * Refs are namespaced under `refs/coja/` (decisions.md): the objects stay
+ * reachable (no gc), while the user's branches, remote-tracking refs and
+ * FETCH_HEAD are never written.
+ */
+export const prHeadRef = (number) => `refs/coja/pull/${assertPrNumber(number)}/head`;
+export const prBaseRef = (number) => `refs/coja/pull/${assertPrNumber(number)}/base`;
+/** GitHub's read-only ref for a pull request's head commit (works for fork PRs). */
+export const githubPullHeadRef = (number) => `refs/pull/${assertPrNumber(number)}/head`;
+function assertPrNumber(number) {
+    if (!Number.isSafeInteger(number) || number <= 0) {
+        throw new RangeError(`invalid pull request number: ${String(number)}`);
+    }
+    return number;
+}