@bridge4dev/runner 0.11.0

package/dist/git.js

@@ -0,0 +1,168 @@
+import { execFile } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { promisify } from 'node:util';
+import { worktreesDir } from './paths.js';
+const execFileAsync = promisify(execFile);
+const GIT_TIMEOUT_MS = 30_000;
+async function git(cwd, ...args) {
+    const { stdout } = await execFileAsync('git', args, { cwd, timeout: GIT_TIMEOUT_MS });
+    return stdout.trim();
+}
+export async function validateWorkspacePath(workspacePath) {
+    if (!fs.existsSync(workspacePath) || !fs.statSync(workspacePath).isDirectory()) {
+        return { ok: false, exists: false, isGitRepo: false, error: 'Directory does not exist' };
+    }
+    try {
+        const inside = await git(workspacePath, 'rev-parse', '--is-inside-work-tree');
+        if (inside !== 'true') {
+            return { ok: false, exists: true, isGitRepo: false, error: 'Not a git work tree' };
+        }
+        const branch = await git(workspacePath, 'rev-parse', '--abbrev-ref', 'HEAD');
+        return { ok: true, exists: true, isGitRepo: true, branch };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            exists: true,
+            isGitRepo: false,
+            error: `git check failed: ${String(error instanceof Error ? error.message : error).slice(0, 300)}`,
+        };
+    }
+}
+export function sessionShortId(sessionId) {
+    return sessionId.replace(/-/g, '').slice(0, 8);
+}
+export function sessionWorktreePath(sessionId) {
+    return path.join(worktreesDir(), sessionShortId(sessionId));
+}
+/**
+ * A stable key identifying the *shared* repository behind any path inside it.
+ *
+ * A linked worktree and its main checkout are the same repo: they share one
+ * object store, one index lock namespace and one branch namespace. Locking a
+ * commit by worktree path while locking a squash-merge by workspace path gave
+ * two different keys and therefore no mutual exclusion at all — a commit inside
+ * the worktree could interleave with a merge reading that same branch tip.
+ * `git rev-parse --git-common-dir` collapses both to the main `.git` directory.
+ */
+export async function repoKeyFor(pathInsideRepo) {
+    try {
+        const common = await git(pathInsideRepo, 'rev-parse', '--git-common-dir');
+        return fs.realpathSync(path.resolve(pathInsideRepo, common));
+    }
+    catch {
+        // Not a repo (yet), or git is unavailable: fall back to the path itself so
+        // callers still serialise against themselves rather than not at all.
+        try {
+            return fs.realpathSync(pathInsideRepo);
+        }
+        catch {
+            return path.resolve(pathInsideRepo);
+        }
+    }
+}
+/**
+ * Accept a branch name from the API only if git would accept it too. The value
+ * reaches a `git worktree add -b` argument, so anything odd — a leading dash, a
+ * `..`, a control character, a trailing `.lock` — is rejected in favour of the
+ * id-derived default rather than passed through.
+ */
+export function sanitizeBranch(hint) {
+    if (!hint)
+        return null;
+    const trimmed = hint.trim();
+    if (trimmed.length === 0 || trimmed.length > 120)
+        return null;
+    if (!/^[A-Za-z0-9][A-Za-z0-9._\-/]*$/.test(trimmed))
+        return null;
+    if (trimmed.includes('..') || trimmed.includes('//') || trimmed.endsWith('.lock'))
+        return null;
+    if (trimmed.endsWith('/') || trimmed.endsWith('.'))
+        return null;
+    return trimmed;
+}
+/**
+ * One branch + worktree per session (plan §7). The worktree lives under the
+ * runner's state dir so the user's checkout stays untouched; the branch lives
+ * in the workspace repo, so the work survives worktree cleanup.
+ */
+export async function ensureSessionWorktree(workspacePath, sessionId, branchHint, options = {}) {
+    const short = sessionShortId(sessionId);
+    // A ticket group gets a branch named after its tickets so the work reads as
+    // one thing in git history. The worktree DIRECTORY stays id-derived — it is
+    // the collision guard below, and two sessions must never share one.
+    const branch = sanitizeBranch(branchHint) ?? `devbridge/s-${short}`;
+    const worktreePath = sessionWorktreePath(sessionId);
+    if (fs.existsSync(path.join(worktreePath, '.git'))) {
+        // Runner restart — reuse, but verify the worktree really is ours: a
+        // short-id collision would silently share a worktree between sessions.
+        const head = await git(worktreePath, 'rev-parse', '--abbrev-ref', 'HEAD').catch(() => null);
+        if (head !== branch) {
+            throw new Error(`Worktree ${worktreePath} is on branch ${head ?? 'unknown'}, expected ${branch}`);
+        }
+        return { branch, worktreePath };
+    }
+    fs.mkdirSync(worktreesDir(), { recursive: true, mode: 0o700 });
+    // Repair stale registrations left by a deleted worktree dir.
+    await git(workspacePath, 'worktree', 'prune').catch(() => undefined);
+    const branchExists = await git(workspacePath, 'rev-parse', '--verify', '--quiet', branch)
+        .then(() => true)
+        .catch(() => false);
+    if (branchExists) {
+        await git(workspacePath, 'worktree', 'add', worktreePath, branch);
+    }
+    else {
+        if (options.requireExistingBranch) {
+            // The caller is restoring a session that already produced work. Creating
+            // a fresh branch off HEAD here would look like success while quietly
+            // hiding every commit the agent made — fail loudly instead.
+            throw new Error(`session branch ${branch} no longer exists in ${workspacePath}`);
+        }
+        await git(workspacePath, 'worktree', 'add', '-b', branch, worktreePath, 'HEAD');
+    }
+    return { branch, worktreePath };
+}
+/**
+ * Drop a session branch after its worktree is gone. Only ever called when the
+ * API confirmed the work was already applied to the base branch — `-D` because
+ * «Применить» is a squash-merge, which git never recognises as a merge, so `-d`
+ * would refuse exactly the branches that ARE safe to delete.
+ */
+export async function deleteSessionBranch(workspacePath, branch) {
+    const safe = sanitizeBranch(branch);
+    if (!safe)
+        throw new Error(`refusing to delete an unsafe branch name: ${branch}`);
+    await git(workspacePath, 'branch', '-D', safe);
+}
+/**
+ * Remove the session worktree (the branch — and the work — stays in the
+ * repo). The main repo is recovered from the worktree's `.git` pointer file,
+ * so the caller only needs the session id.
+ */
+export async function removeSessionWorktree(sessionId) {
+    const worktreePath = sessionWorktreePath(sessionId);
+    if (!fs.existsSync(worktreePath))
+        return;
+    const gitFile = path.join(worktreePath, '.git');
+    let mainRepo = null;
+    if (fs.existsSync(gitFile) && fs.statSync(gitFile).isFile()) {
+        // "gitdir: /repo/.git/worktrees/<name>" → /repo
+        const pointer = fs
+            .readFileSync(gitFile, 'utf8')
+            .match(/^gitdir:\s*(.+)$/m)?.[1]
+            ?.trim();
+        if (pointer) {
+            const dotGit = path.resolve(pointer, '..', '..');
+            if (path.basename(dotGit) === '.git')
+                mainRepo = path.dirname(dotGit);
+        }
+    }
+    if (mainRepo) {
+        await git(mainRepo, 'worktree', 'remove', '--force', worktreePath);
+    }
+    else {
+        fs.rmSync(worktreePath, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=git.js.map

package/dist/gitops.d.ts

@@ -0,0 +1,136 @@
+export interface GitFileEntry {
+    path: string;
+    /** A | M | D | R (git name-status letter). */
+    status: string;
+    additions: number | null;
+    deletions: number | null;
+    /** Present in the working tree but not committed yet. */
+    uncommitted: boolean;
+}
+export interface GitStatusResult {
+    branch: string;
+    baseBranch: string;
+    files: GitFileEntry[];
+    additions: number;
+    deletions: number;
+    /** Commits the agent made on the session branch (base..HEAD). */
+    agentCommits: number;
+    uncommittedFiles: number;
+}
+export declare function gitStatus(worktreePath: string, workspacePath: string, sessionBranch: string): Promise<GitStatusResult>;
+export interface GitDiffResult {
+    diff: string;
+    truncated: boolean;
+}
+/** Exposed for tests: the header check is the control worth pinning directly. */
+export declare function capDiffForTest(diff: string): GitDiffResult;
+export declare function gitDiff(worktreePath: string, workspacePath: string, sessionBranch: string, filePath: string): Promise<GitDiffResult>;
+export interface GitCommitResult {
+    committed: boolean;
+    sha?: string;
+    reason?: string;
+}
+export declare function gitCommit(worktreePath: string, message: string): Promise<GitCommitResult>;
+export interface ApplyResult {
+    applied: boolean;
+    commitSha?: string;
+    conflict?: boolean;
+    /** On conflict: the branch the agent must merge into its session branch. */
+    baseBranch?: string;
+    error?: string;
+}
+export declare function applySession(workspacePath: string, worktreePath: string, sessionBranch: string, message: string): Promise<ApplyResult>;
+/**
+ * Reading history is the one git surface where the *repository*, not the
+ * session worktree, is the right place to stand: a finished session may have
+ * had its worktree cleaned up while its branch — and everything the agent
+ * committed — is still in the repo. So every function here runs in
+ * `workspacePath` and names the branch explicitly.
+ *
+ * Read-only by construction. Nothing in this section can move a ref, and the
+ * two ways history could leak something it should not — an argument that git
+ * reads as an option, and a diff of a secret file — are closed by
+ * `assertRefArgument` / `sanitizeBranch` and by the same denylist the Changes
+ * panel uses.
+ */
+export interface GitLogCommit {
+    sha: string;
+    /** Empty for a root commit, more than one for a merge. */
+    parents: string[];
+    author: string;
+    /** Author date, ISO-8601 with offset. */
+    date: string;
+    subject: string;
+    /** Branch/tag names pointing at this commit (`HEAD -> ` already stripped). */
+    refs: string[];
+}
+/** Which slice of history to show. */
+export type GitLogScope = 'session' | 'branch' | 'all';
+export interface GitLogResult {
+    branch: string;
+    baseBranch: string;
+    /** Where the session branch and the base last agreed. */
+    mergeBase: string | null;
+    commits: GitLogCommit[];
+    hasMore: boolean;
+}
+export interface GitCommitFileEntry {
+    path: string;
+    status: string;
+    additions: number | null;
+    deletions: number | null;
+    /** On the secret denylist: the name is shown, the diff is refused. */
+    protected: boolean;
+}
+export interface GitCommitDetail {
+    kind: 'commit';
+    sha: string;
+    parents: string[];
+    author: string;
+    authorEmail: string;
+    date: string;
+    subject: string;
+    body: string;
+    refs: string[];
+    files: GitCommitFileEntry[];
+    /** The file list hit the cap — the commit touched more than we return. */
+    truncated: boolean;
+}
+export interface GitCommitFileDiff {
+    kind: 'diff';
+    diff: string;
+    truncated: boolean;
+}
+/** A full or abbreviated commit hash — never a ref name, never an option. */
+export declare function isCommitSha(value: string): boolean;
+/**
+ * `--numstat` names a rename as `old => new` (or `dir/{old => new}/file`),
+ * while `--name-status` gives the plain new path. Keying the two maps by
+ * different strings is why every renamed file showed `null` additions.
+ */
+export declare function normalizeNumstatPath(raw: string): string;
+export declare function gitLog(input: {
+    workspacePath: string;
+    branch: string;
+    scope?: GitLogScope;
+    limit?: number;
+    skip?: number;
+}): Promise<GitLogResult>;
+/**
+ * One commit: its metadata and the files it touched, or — when `filePath` is
+ * given — the diff of that one file.
+ *
+ * `--diff-merges=first-parent` on purpose: without it `git show` renders a
+ * merge as a combined diff that hides everything already present in one of the
+ * parents, and the answer to "what did this merge bring onto my branch" comes
+ * out empty. For an ordinary commit the flag changes nothing.
+ */
+export declare function gitShow(workspacePath: string, sha: string, filePath?: string, branch?: string): Promise<GitCommitDetail | GitCommitFileDiff>;
+export interface RevertResult {
+    reverted: boolean;
+    revertSha?: string;
+    conflict?: boolean;
+    error?: string;
+}
+export declare function revertApply(workspacePath: string, commitSha: string): Promise<RevertResult>;
+//# sourceMappingURL=gitops.d.ts.map