@bevel-software/platform-core-backend 0.33.0 → 0.34.0

package/src/modules/workflow/git/__tests__/git.service.list-branches.test.ts

@@ -8,6 +8,8 @@ import os from 'node:os';
 import type { WorkspaceService } from '../../../workspace/workspace.service.js';
 import { WorkflowHooks } from '../../workflow-hooks.js';
 import { GitService } from '../git.service.js';
+import { NodeGitRunner } from '../node-git-runner.js';
+import type { IGitRunner } from '../../../../shared/git.contract.js';
 
 const execFileAsync = promisify(execFile);
 
@@ -155,7 +157,7 @@ describe('GitService.listBranches', () => {
     expect(names).toEqual(['alice/draft-one', 'current-company-state', 'target-company-state']);
   });
 
-  it('returns local branches before remote-only ones, order preserved through parallel ahead/behind', async () => {
+  it('returns local branches before remote-only ones, then alphabetically', async () => {
     await seedWorkspace(root, workspaceId);
     const svc = new GitService(
       stubWorkspaceService(workspaceId, path.join(root, workspaceId)),
@@ -165,8 +167,7 @@ describe('GitService.listBranches', () => {
 
     // current-company-state is the workspace clone's checked-out branch (the
     // only local head); the rest are remote-only. The result order must be
-    // local-first then alphabetical — `listBranches` now computes ahead/behind
-    // with `Promise.all`, so this pins that the mapping preserves row order.
+    // local-first then alphabetical.
     const branches = await svc.listBranches(workspaceId);
     expect(branches.map((b) => b.name)).toEqual([
       'current-company-state',
@@ -231,4 +232,130 @@ describe('GitService.listBranches', () => {
       expect.arrayContaining([expect.objectContaining({ name: 'alice/draft-one' })]),
     );
   });
+
+  // A listing names branches; it counts nothing. Counting cost one to three
+  // `rev-list` spawns a branch — about 120 git processes a listing on a
+  // knowledge base with 121 branches — for numbers no listing reader shows.
+  it('runs no git per branch: a listing over many branches spawns the same few commands as one over three', async () => {
+    const { upstream } = await seedWorkspace(root, workspaceId);
+    const pusher = path.join(root, '.pusher');
+    await runGit(root, ['clone', upstream, pusher]);
+    const drafts = Array.from({ length: 12 }, (_, i) => `team/draft-${String(i).padStart(2, '0')}`);
+    for (const d of drafts) {
+      await runGit(pusher, ['checkout', '-q', '-b', d, 'origin/current-company-state']);
+      await runGit(pusher, ['commit', '--allow-empty', '-m', d]);
+    }
+    await runGit(pusher, ['push', '-q', 'origin', ...drafts]);
+    // The workspace's own branch carries an upstream and local commits too:
+    // exactly what the old listing counted against.
+    const repo = path.join(root, workspaceId, 'knowledge-base');
+    await runGit(repo, ['commit', '--allow-empty', '-m', 'unshared']);
+
+    const { runner, commands } = recordingRunner();
+    const svc = new GitService(
+      stubWorkspaceService(workspaceId, path.join(root, workspaceId)),
+      new WorkflowHooks(),
+      testKbContext(),
+      undefined,
+      null,
+      runner,
+    );
+    const branches = await svc.listBranches(workspaceId);
+
+    expect(branches.map((b) => b.name)).toEqual([
+      'current-company-state',
+      'alice/draft-one',
+      'target-company-state',
+      ...drafts,
+    ]);
+    expect(branches[0]).toEqual({ name: 'current-company-state', isProtected: true, hasRemote: true });
+    for (const b of branches) expect(Object.keys(b).sort()).toEqual(['hasRemote', 'isProtected', 'name']);
+    expect(commands.filter((c) => c === 'rev-list')).toEqual([]);
+    // Its fetch, and the two reads of what the repository holds — whatever
+    // the number of branches.
+    expect([...commands].sort()).toEqual(['fetch', 'for-each-ref', 'symbolic-ref']);
+  });
+});
+
+/** The real runner, recording the subcommand of every git it is asked to run. */
+function recordingRunner(): { runner: IGitRunner; commands: string[] } {
+  const inner = new NodeGitRunner();
+  const commands: string[] = [];
+  const runner = {
+    defaultTimeoutMs: inner.defaultTimeoutMs,
+    credentials: inner.credentials,
+    run: async (cwd: string, args: string[], opts?: object) => {
+      // Skip `-c key=value` pairs: the subcommand is the first bare word.
+      let i = 0;
+      while (i < args.length && args[i].startsWith('-')) i += args[i] === '-c' ? 2 : 1;
+      commands.push(args[i] ?? '');
+      return inner.run(cwd, args, opts as never);
+    },
+  } as unknown as IGitRunner;
+  return { runner, commands };
+}
+
+describe('GitService.branchCounts', () => {
+  let root: string;
+
+  beforeEach(async () => {
+    root = await mkTmpRoot();
+  });
+
+  afterEach(async () => {
+    await fs.rm(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+  });
+
+  const draftWs = encodeURIComponent('alice/draft-one');
+
+  /** The draft's own workspace, on the draft, three commits ahead of what it shared. */
+  async function seedDraft(): Promise<{ upstream: string; repo: string }> {
+    const { upstream, repo } = await seedWorkspace(root, draftWs);
+    await runGit(repo, ['checkout', '-q', 'alice/draft-one']);
+    for (const m of ['one', 'two', 'three']) await runGit(repo, ['commit', '--allow-empty', '-m', m]);
+    return { upstream, repo };
+  }
+
+  function svcFor(runner: IGitRunner = new NodeGitRunner(), kb = testKbContext()): GitService {
+    return new GitService(stubWorkspaceService(draftWs, path.join(root, draftWs)), new WorkflowHooks(), kb, undefined, null, runner);
+  }
+
+  it('counts the workspace\'s own branch against its upstream, with rev-list for that branch alone', async () => {
+    const { upstream, repo } = await seedDraft();
+    // A teammate shares one commit on the same draft, which this clone fetches.
+    const pusher = path.join(root, '.pusher');
+    await runGit(root, ['clone', '-q', '-b', 'alice/draft-one', upstream, pusher]);
+    await runGit(pusher, ['commit', '--allow-empty', '-m', 'teammate']);
+    await runGit(pusher, ['push', '-q', 'origin', 'alice/draft-one']);
+    await runGit(repo, ['fetch', '-q', 'origin']);
+
+    const { runner, commands } = recordingRunner();
+    await expect(svcFor(runner).branchCounts(draftWs)).resolves.toEqual({ ahead: 3, behind: 1 });
+    // The upstream resolved, so one count was enough.
+    expect(commands.filter((c) => c === 'rev-list')).toHaveLength(1);
+  });
+
+  it('falls back to the protected branch on origin it is fewest commits ahead of when it has no upstream', async () => {
+    const { upstream, repo } = await seedDraft();
+    await runGit(repo, ['branch', '--unset-upstream']);
+    // `target-company-state` moves on by two commits; `current-company-state` stays.
+    const pusher = path.join(root, '.pusher');
+    await runGit(root, ['clone', '-q', '-b', 'target-company-state', upstream, pusher]);
+    for (const m of ['t1', 't2']) await runGit(pusher, ['commit', '--allow-empty', '-m', m]);
+    await runGit(pusher, ['push', '-q', 'origin', 'target-company-state']);
+    await runGit(repo, ['fetch', '-q', 'origin']);
+
+    const { runner, commands } = recordingRunner();
+    // Three ahead of both; ties keep the first protected branch, which is behind by nothing.
+    await expect(svcFor(runner).branchCounts(draftWs)).resolves.toEqual({ ahead: 3, behind: 0 });
+    // The upstream it tried, then each protected branch.
+    expect(commands.filter((c) => c === 'rev-list')).toHaveLength(3);
+  });
+
+  it('answers null for a branch never shared, with no protected base to count against', async () => {
+    const { repo } = await seedDraft();
+    await runGit(repo, ['branch', '--unset-upstream']);
+    const kb = testKbContext({ branchModel: { defaultBranch: 'main', protectedBranches: ['main'] } });
+    await expect(svcFor(undefined, kb).branchCounts(draftWs)).resolves.toEqual({ ahead: null, behind: null });
+  });
 });

package/src/modules/workflow/git/git.service.ts

@@ -5,6 +5,7 @@ import type {
   AppliedChangeRef,
   AppliedMergeResult,
   AuthUser,
+  BranchCounts,
   BranchInfo,
   ChangedPathPair,
   CommitAttribution,
@@ -60,6 +61,7 @@ import {
 } from '../../../shared/git.contract.js';
 import { NodeGitRunner } from './node-git-runner.js';
 import { printable } from '../../../shared/printable.js';
+import { branchForWorkspaceId } from '../../../shared/workspace-id.js';
 import { sanitizeError } from '../sanitize-error.js';
 
 const log = logger('git');
@@ -292,11 +294,6 @@ export class GitService implements IGitService {
   /** Whether the last implicit fetch per workspace SUCCEEDED — see `fetchOriginIfStale`. */
   private readonly lastImplicitFetchOk = new Map<string, boolean>();
   private static readonly IMPLICIT_FETCH_TTL_MS = 5_000;
-  // Cap on concurrent `aheadBehindForBranch` calls inside `listBranches`. Each
-  // call serializes up to 3 `git rev-list` spawns, so 8 workers ≈ ≤24
-  // concurrent processes worst case — fast for typical (<8) feature-branch
-  // counts, calm under large branch lists.
-  private static readonly MAX_AHEAD_BEHIND_CONCURRENCY = 8;
 
   /**
    * A change request's changed entries, keyed by the two commits its diff
@@ -545,7 +542,7 @@ export class GitService implements IGitService {
         )
       ).trim();
 
-      type Row = { shortName: string; ref: string; hasLocal: boolean; hasRemote: boolean };
+      type Row = { shortName: string; hasLocal: boolean; hasRemote: boolean };
       const buckets = new Map<string, Row>();
       for (const line of stdout.split('\n')) {
         const trimmed = line.trim();
@@ -573,16 +570,12 @@ export class GitService implements IGitService {
         if (!existing) {
           buckets.set(shortName, {
             shortName,
-            ref,
             hasLocal: isLocal,
             hasRemote: !isLocal,
           });
           continue;
         }
-        // Prefer the local entry's ref when both exist — ahead/behind against the
-        // configured upstream is more meaningful than against origin directly.
         if (isLocal && !existing.hasLocal) {
-          existing.ref = ref;
           existing.hasLocal = true;
         } else if (!isLocal) {
           existing.hasRemote = true;
@@ -594,36 +587,14 @@ export class GitService implements IGitService {
         return a.shortName.localeCompare(b.shortName);
       });
 
-      // Compute ahead/behind for every branch with bounded concurrency — each
-      // branch is 1–3 `git rev-list` spawns, and the unbounded `Promise.all`
-      // we used before could put N×3 processes in flight on repos with many
-      // branches. Workers pull indices off a shared counter and write into a
-      // pre-sized array, so input order (and the sort above) is preserved.
-      const infos: BranchInfo[] = new Array(rows.length);
-      let nextIndex = 0;
-      const workerCount = Math.min(GitService.MAX_AHEAD_BEHIND_CONCURRENCY, rows.length);
-      await Promise.all(
-        Array.from({ length: workerCount }, async () => {
-          while (true) {
-            const i = nextIndex++;
-            if (i >= rows.length) return;
-            const row = rows[i];
-            const { ahead, behind } = await this.aheadBehindForBranch(
-              cwd,
-              row.shortName,
-              row.ref,
-              row.hasLocal,
-            );
-            infos[i] = {
-              name: row.shortName,
-              isProtected: this.kb.isProtectedBranch(row.shortName),
-              ahead,
-              behind,
-              hasRemote: row.hasRemote,
-            };
-          }
-        }),
-      );
+      // No git per branch: commit counts are not part of a listing (they cost
+      // one to three `rev-list` spawns a branch, over every branch the
+      // repository has). The one branch that wants them asks `branchCounts`.
+      const infos: BranchInfo[] = rows.map((row) => ({
+        name: row.shortName,
+        isProtected: this.kb.isProtectedBranch(row.shortName),
+        hasRemote: row.hasRemote,
+      }));
       // Every name this listing showed — origin's refs and the local heads
       // alike, since a branch checked out here is one the platform has
       // plainly heard of. A listener that misbehaves must not turn a good
@@ -639,6 +610,24 @@ export class GitService implements IGitService {
     });
   }
 
+  async branchCounts(workspaceId: string): Promise<BranchCounts> {
+    return this.mutex.run(workspaceId, async () => {
+      const cwd = await this.repoDir(workspaceId);
+      const branch = branchForWorkspaceId(workspaceId);
+      // The workspace's own branch is its local head while it is checked out;
+      // otherwise only origin's ref names it — as a listing would read it.
+      const ownBranch = (
+        await this.git(cwd, ['symbolic-ref', '--quiet', '--short', 'HEAD']).then(
+          (r) => r.stdout,
+          () => '',
+        )
+      ).trim();
+      return ownBranch === branch
+        ? this.aheadBehindForBranch(cwd, branch, `refs/heads/${branch}`, true)
+        : this.aheadBehindForBranch(cwd, branch, `refs/remotes/origin/${branch}`, false);
+    });
+  }
+
   /**
    * Run `git fetch --prune origin` outside the workspace mutex, with a short
    * TTL so back-to-back callers (mount + dropdown-open + 30s poll) coalesce
@@ -757,12 +746,6 @@ export class GitService implements IGitService {
         await this.git(cwd, ['branch', '-D', name]).catch(() => undefined);
         throw err;
       }
-      const { ahead, behind } = await this.aheadBehindForBranch(
-        cwd,
-        name,
-        `refs/heads/${name}`,
-        true,
-      );
       // Drop the now-vestigial local head. Under the per-branch workspace model
       // this clone's identity is its OWN branch; the new draft lives in its own
       // workspace (cloned from origin on first navigation), so this clone never
@@ -782,8 +765,6 @@ export class GitService implements IGitService {
       return {
         name,
         isProtected: false,
-        ahead,
-        behind,
         hasRemote: true,
       };
     });

package/src/modules/workflow/workflow.service.ts

@@ -37,6 +37,7 @@ import type {
   AcquireLockResult,
   AuthUser,
   Branch,
+  BranchCounts,
   BranchSyncOutcome,
   BranchWorkspaceStatus,
   CancelChangeRequestResult,
@@ -932,6 +933,10 @@ export class WorkflowService implements IWorkflowService {
     return this.git.status(workspaceId);
   }
 
+  branchCounts(workspaceId: string): Promise<BranchCounts> {
+    return this.git.branchCounts(workspaceId);
+  }
+
   // `discardWorkingChanges` removed: under save=share there's nothing dirty
   // to discard.
 

package/src/modules/workspace/__tests__/git-internals.security.test.ts

@@ -36,11 +36,11 @@ import { createDiffRoutes } from '../../diff/diff.routes.js';
 import { DiffService } from '../../diff/diff.service.js';
 import { WorkspaceMutex } from '../../kb-fs/mutex.js';
 import { WorkspaceService } from '../workspace.service.js';
-import { WorkerPatternMatcher } from '../bounded-matcher.js';
+import { RipgrepPatternMatcher } from '../index.js';
 import { newWorkspaceService } from '../../../__tests__/workspace-service.js';
 
 /** The grep matcher this file's harness wires, closed once the file is done. */
-const patternMatcher = new WorkerPatternMatcher();
+const patternMatcher = new RipgrepPatternMatcher();
 afterAll(() => patternMatcher.close());
 
 /**

package/src/modules/workspace/__tests__/holds-nul.test.ts

@@ -0,0 +1,66 @@
+import { lstat, mkdtemp, rename, rm, symlink, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { holdsNul } from '../nul-scan.js';
+import { PatternTooExpensiveError, type IPatternSearch } from '../pattern-matcher.contract.js';
+
+/**
+ * The unit `grep` asks whether a named text file ripgrep answered no line from
+ * is binary (`nul-scan.ts`). What a caller observes — a NUL past the first
+ * chunk makes the answer "no searchable text" — is pinned through the grep
+ * tool itself in `workspace.tools.test.ts`. Two properties stay here because
+ * no caller can stage them: the file swapped for another, or for a link,
+ * between the stat that judged it and the open that reads it is a race a tool
+ * call cannot time; and a budget already spent is told apart from ripgrep's
+ * own spending only by handing the unit a search whose budget is gone.
+ */
+let dir = '';
+const free: IPatternSearch = {
+  files: () => (async function* () {})(),
+  list: async () => [],
+  matchingLines: async (texts) => texts.map(() => []),
+  charged: (work) => work(),
+};
+
+beforeEach(async () => {
+  dir = await mkdtemp(join(tmpdir(), 'holds-nul-'));
+});
+afterEach(async () => {
+  await rm(dir, { recursive: true, force: true });
+});
+
+describe('holdsNul', () => {
+  it('finds a NUL wherever it is, past the first chunk too, and answers false for text', async () => {
+    const text = join(dir, 'text.md');
+    const late = join(dir, 'late.bin');
+    await writeFile(text, 'plain text\n'.repeat(20_000));
+    await writeFile(late, Buffer.concat([Buffer.alloc(200 * 1024, 'x'), Buffer.from([0])]));
+    expect(await holdsNul(text, await lstat(text), free)).toBe(false);
+    expect(await holdsNul(late, await lstat(late), free)).toBe(true);
+  });
+
+  it.skipIf(process.platform === 'win32')('reads nothing from a file swapped in since it was judged, nor through a link', async () => {
+    const p = join(dir, 'named.md');
+    await writeFile(p, 'text\n');
+    const judged = await lstat(p);
+    // Another file holding a NUL, moved in under the judged name.
+    await writeFile(join(dir, 'other'), Buffer.from([0]));
+    await rename(join(dir, 'other'), p);
+    expect(await holdsNul(p, judged, free)).toBe(false);
+    // A link to a file holding a NUL, under the judged name.
+    await writeFile(join(dir, 'outside'), Buffer.from([0]));
+    await rm(p);
+    await symlink(join(dir, 'outside'), p);
+    expect(await holdsNul(p, judged, free)).toBe(false);
+    expect(await holdsNul(p, await lstat(join(dir, 'outside')), free)).toBe(false);
+  });
+
+  it('runs under the search budget: a budget already spent answers for it', async () => {
+    const p = join(dir, 'named.md');
+    await writeFile(p, 'text\n');
+    const spent = new PatternTooExpensiveError('needle', 5_000);
+    const exhausted: IPatternSearch = { ...free, charged: () => Promise.reject(spent) };
+    await expect(holdsNul(p, await lstat(p), exhausted)).rejects.toBe(spent);
+  });
+});

package/src/modules/workspace/__tests__/rest-tool-arguments.test.ts

@@ -22,10 +22,10 @@ import { AccessControlService } from '../../access/access-control.service.js';
 import { NodeFs } from '../../kb-fs/node-fs.js';
 import { BRANCH_REQUIRED_MESSAGE } from '../../../shared/domain-errors.js';
 import { callLine, compileCheck, exampleArguments } from '@bevel-software/platform-mcp-core';
-import { WorkerPatternMatcher } from '../bounded-matcher.js';
+import { RipgrepPatternMatcher } from '../index.js';
 
 /** The grep matcher this file's harness wires, closed once the file is done. */
-const patternMatcher = new WorkerPatternMatcher();
+const patternMatcher = new RipgrepPatternMatcher();
 afterAll(() => patternMatcher.close());
 
 /**
@@ -179,7 +179,7 @@ describe('POST /api/agent/tools/<name> checks the arguments against the tool', (
     expect(status).toBe(400);
     expect(body.kind).toBe('arguments-do-not-match');
     expect(body.error).toContain('"pattern" is required, and was not given.');
-    expect(body.error).toContain('pattern (string, required) — JavaScript regular expression.');
+    expect(body.error).toContain('pattern (string, required) — Regular expression, RE2-style (ripgrep): no look-around, no backreferences.');
     // Not a 200 that matched every file, which is what this surface answered
     // before the check lived in the route.
     expect(body.matches).toBeUndefined();