@feng0531/dsh-vcs 0.4.9 → 0.5.1

package/local-command.mjs

@@ -1,46 +1,79 @@
 import {spawn} from 'node:child_process';
+import path from 'node:path';
+import {currentOperationBudget} from './src/operation-budget.mjs';
 
 const MAX_OUTPUT = 16 * 1024 * 1024;
 export const TIMEOUT = 15000;
+const KILL_GRACE_MS = 100;
 
 // Local adapter primitive, not the remote SVN transport. Preserve its error contract.
-export function run(command, args, cwd, max = MAX_OUTPUT, { signal, timeoutMs = TIMEOUT } = {}) {
+export function run(command, args, cwd, max = MAX_OUTPUT, {signal, timeoutMs = TIMEOUT} = {}) {
   return new Promise((resolve, reject) => {
-    if (signal?.aborted) { reject(Object.assign(new Error('Discovery cancelled'), { code: 'ABORT_ERR' })); return; }
+    const budget = currentOperationBudget();
+    if (signal?.aborted) { reject(Object.assign(new Error('Discovery cancelled'), {code: 'ABORT_ERR'})); return; }
+    try {
+      budget?.throwIfExpired();
+      if (!Number.isInteger(max) || max < 1 || max > MAX_OUTPUT || !Number.isFinite(timeoutMs) || timeoutMs <= 0) throw new Error('Invalid local command bounds.');
+      timeoutMs = Math.min(timeoutMs, TIMEOUT, budget?.remaining() ?? TIMEOUT);
+    } catch (error) { reject(error); return; }
     // Inherited Git overrides must not redirect reads to a different repository.
     const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.toUpperCase().startsWith('GIT_')));
-    Object.assign(env, { GIT_OPTIONAL_LOCKS: '0', GIT_TERMINAL_PROMPT: '0', GIT_NO_REPLACE_OBJECTS: '1', GIT_NO_LAZY_FETCH: '1', GIT_ALLOW_PROTOCOL: '', LC_ALL: process.platform === 'linux' ? 'C.UTF-8' : 'en_US.UTF-8' });
-    const child = spawn(command, args, { cwd, shell: false, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'], env });
+    Object.assign(env, {GIT_OPTIONAL_LOCKS: '0', GIT_TERMINAL_PROMPT: '0', GIT_NO_REPLACE_OBJECTS: '1', GIT_NO_LAZY_FETCH: '1', GIT_ALLOW_PROTOCOL: '', LC_ALL: process.platform === 'linux' ? 'C.UTF-8' : 'en_US.UTF-8'});
+    const child = spawn(command, args, {cwd, shell: false, windowsHide: true, detached: process.platform !== 'win32', stdio: ['ignore', 'pipe', 'pipe'], env});
     const out = [], err = [];
-    let size = 0, error, done = false;
+    let size = 0, error, done = false, closed = false, exitCode, stopping = false, cleanupDone = true, killTimer;
+    const signals = [...new Set([signal, budget?.signal].filter(Boolean))];
+    const finish = () => {
+      if (done || !closed || !cleanupDone) return;
+      done = true;
+      clearTimeout(timer);
+      clearTimeout(killTimer);
+      for (const source of signals) source.removeEventListener('abort', abort);
+      if (error) reject(error);
+      else if (exitCode !== 0) reject(Object.assign(new Error(command + ': ' + Buffer.concat(err).toString('utf8').trim()), {code: 'VCS_COMMAND', exitCode}));
+      else resolve(Buffer.concat(out));
+    };
+    const killGroup = strength => {
+      try { process.kill(-child.pid, strength); } catch (failure) {
+        if (failure.code !== 'ESRCH') { try { child.kill(strength); } catch {} }
+      }
+    };
     const stop = failure => {
       error ??= failure;
-      child.kill();
+      if (stopping || !child.pid) return;
+      stopping = true; cleanupDone = false;
+      if (process.platform === 'win32') {
+        // Kill the tree before its parent can disappear and orphan pipe-owning descendants.
+        const executable = path.join(process.env.SystemRoot || 'C:/Windows', 'System32', 'taskkill.exe');
+        const killer = spawn(executable, ['/PID', String(child.pid), '/T', '/F'], {windowsHide: true, shell: false, stdio: 'ignore'});
+        killer.on('error', () => { try { child.kill('SIGKILL'); } catch {} });
+        const guard = setTimeout(() => { try { child.kill('SIGKILL'); killer.kill(); } catch {} }, 1000);
+        killer.once('close', () => { clearTimeout(guard); cleanupDone = true; finish(); });
+      } else {
+        killGroup('SIGTERM');
+        killTimer = setTimeout(() => { killGroup('SIGKILL'); cleanupDone = true; finish(); }, KILL_GRACE_MS);
+      }
     };
-    const abort = () => stop(Object.assign(new Error('Discovery cancelled'), { code: 'ABORT_ERR' }));
-    signal?.addEventListener('abort', abort, { once: true });
-    const timer = setTimeout(() => stop(Object.assign(new Error(command + ' timed out'), { code: 'TIMEOUT' })), timeoutMs);
-    // Both streams consume the same budget; never expose partial success.
+    const abort = () => {
+      const source = signals.find(value => value.aborted);
+      const reason = source?.reason?.code === 'TIMEOUT' ? source.reason : Object.assign(new Error('Discovery cancelled'), {code: 'ABORT_ERR'});
+      stop(reason);
+    };
+    const timer = setTimeout(() => stop(Object.assign(new Error(command + ' timed out'), {code: 'TIMEOUT'})), timeoutMs);
+    // Both streams consume the same budget; never retain unbounded or partial output.
     const collect = chunks => bytes => {
+      if (error) return;
       size += bytes.length;
-      if (size > max) {
-        stop(Object.assign(new Error('Output exceeds size limit'), {code: 'TOO_LARGE'}));
-      } else {
-        chunks.push(bytes);
-      }
+      if (size > max) stop(Object.assign(new Error('Output exceeds size limit'), {code: 'TOO_LARGE'}));
+      else chunks.push(bytes);
     };
     child.stdout.on('data', collect(out));
     child.stderr.on('data', collect(err));
-    const finish = failure => {
-      if (done) return;
-      done = true;
-      clearTimeout(timer);
-      signal?.removeEventListener('abort', abort);
-      if (failure) reject(failure);
-      else resolve(Buffer.concat(out));
-    };
-    child.on('error', finish);
-    child.on('close', code => finish(error || (code !== 0 ? Object.assign(new Error(command + ': ' + Buffer.concat(err).toString('utf8').trim()), { code: 'VCS_COMMAND', exitCode: code }) : null)));
+    child.on('error', failure => { error ??= failure; });
+    child.once('close', code => { closed = true; exitCode = code; finish(); });
+    for (const source of signals) source.addEventListener('abort', abort, {once: true});
+    // Abort can race spawn/listener registration.
+    if (signals.some(value => value.aborted)) abort();
   });
 }
 export const git = (root, args, max, options) => run('git', ['--no-pager', '--literal-pathspecs', '-c', 'core.fsmonitor=false', ...args], root, max, options);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-vcs",
-  "version": "0.4.9",
+  "version": "0.5.1",
   "private": false,
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },
   "type": "module",
@@ -27,6 +27,9 @@
     "src/svn-path.mjs",
     "src/svn-revision.mjs",
     "src/commit-signature.mjs",
+    "src/operation-budget.mjs",
+    "src/historical-access.mjs",
+    "src/preview-capabilities.mjs",
     "dist",
     "locale",
     "icon.svg",
@@ -43,10 +46,15 @@
     "prepare": "npm run build",
     "prepack": "npm run check",
     "verify:package": "node scripts/verify-package.mjs",
-    "test:install": "node scripts/test-install.mjs"
+    "test:install": "node scripts/test-install.mjs",
+    "test:host-compat": "node scripts/test-host-compat.mjs",
+    "test:release": "node scripts/run-release-tests.mjs",
+    "test:preflight": "node scripts/test-preflight.mjs",
+    "test:browser": "node scripts/monaco-fixture.mjs && node scripts/run-isolated-browser.mjs",
+    "test:performance": "node scripts/performance-baseline.mjs"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh": "0.1.7-rc.2 || 0.2.0-rc.2"
+    "@deepseek-ai/dsh": "0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || 0.2.1-rc.5"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh": { "optional": true }

package/src/commit-signature.mjs

@@ -1,15 +1,28 @@
-// Bounded commit-signature presence detection from the raw commit-object header.
-// Read-only by design: only inspects the header for gpgsig / gpgsig-sha256 / sshsig
-// markers. It never runs gpg/ssh-keygen verification, never touches the network, and
-// never writes. A result of {signed:true} means "a signature header is present", not
-// "trust-verified".
+// Signature presence only: Git stores SSH and OpenPGP armor in gpgsig or
+// gpgsig-sha256 multiline headers. The suffix names the object hash, not the
+// signature algorithm. This never invokes a verifier or implies trust.
 export function parseCommitSignature(raw) {
-  const none = { signed: false, format: null };
+  const none = {signed:false, format:null};
   if (typeof raw !== 'string') return none;
-  const boundary = raw.indexOf('\n\n');
-  const header = boundary === -1 ? raw : raw.slice(0, boundary);
-  if (/^sshsig /m.test(header)) return { signed: true, format: 'SSH' };
-  if (/^gpgsig-sha256 /m.test(header)) return { signed: true, format: 'OpenPGP-SHA256' };
-  if (/^gpgsig /m.test(header)) return { signed: true, format: 'OpenPGP' };
-  return none;
-}
+  const lf = String.fromCharCode(10);
+  const boundary = raw.indexOf(lf + lf);
+  const header = boundary === -1 ? raw : raw.slice(0,boundary);
+  const signatures = [];
+  let current;
+  for (const line of header.split(lf)) {
+    if (line.startsWith(' ')) {
+      if (current) current.push(line.slice(1));
+      continue;
+    }
+    current = undefined;
+    const match = /^(?:gpgsig|gpgsig-sha256) (.*)$/.exec(line);
+    if (match) {current = [match[1]]; signatures.push(current);}
+  }
+  if (!signatures.length) return none;
+  for (const signature of signatures) {
+    const armor = signature.join(lf).trimStart();
+    if (armor.startsWith('-----BEGIN SSH SIGNATURE-----' + lf)) return {signed:true,format:'SSH'};
+    if (armor.startsWith('-----BEGIN PGP SIGNATURE-----' + lf)) return {signed:true,format:'OpenPGP'};
+  }
+  return {signed:true,format:'Unknown'};
+}

package/src/historical-access.mjs

@@ -0,0 +1,139 @@
+import {isObjectId} from '../git-history.mjs';
+
+export const HISTORICAL_CACHE_LIMITS = Object.freeze({maxBytes: 32 * 1024 * 1024, maxEntries: 8, ttlMs: 60000});
+const MAX_BLOB_BYTES = 16 * 1024 * 1024;
+const MAX_LIST_BYTES = 16 * 1024 * 1024;
+const MAX_DIRECTORY_ENTRIES = 100000;
+const CHUNK_BYTES = 64 * 1024;
+
+export function validateHistoricalPath(file, allowRoot = false) {
+  if (typeof file !== 'string' || file.length > 32768 || (!file && !allowRoot) || file.includes('\0') || file.startsWith('/') || file.split('/').some(part => (!part || part === '.' || part === '..') && !(allowRoot && file === ''))) {
+    throw Error('Invalid historical path');
+  }
+}
+
+export function parseTreeEntries(buffer, prefix = '', maxEntries = MAX_DIRECTORY_ENTRIES) {
+  if (!buffer.length) return [];
+  const fields = buffer.toString('utf8').split('\0');
+  if (fields.pop() !== '') throw Error('Truncated historical tree');
+  if (fields.length > maxEntries) throw Error('Historical directory exceeds entry limit');
+  const paths = new Set();
+  return fields.map(record => {
+    const tab = record.indexOf('\t');
+    const match = /^(040000|100644|100755|120000|160000) (tree|blob|commit) ([a-f0-9]{40}|[a-f0-9]{64})$/.exec(record.slice(0, tab));
+    const file = record.slice(tab + 1);
+    if (tab < 0 || !file || !match) throw Error('Invalid historical tree entry');
+    validateHistoricalPath(file);
+    const [,mode,type,oid] = match;
+    if (type !== (mode === '040000' ? 'tree' : mode === '160000' ? 'commit' : 'blob')) throw Error('Invalid historical tree type');
+    const fullPath = prefix + file;
+    if (paths.has(fullPath)) throw Error('Duplicate historical tree entry');
+    paths.add(fullPath);
+    return {path: fullPath, mode, type, oid};
+  });
+}
+
+/** Object cache only, never an authorization cache. Callers must revalidate the repository first. */
+export function createHistoricalAccess({run, now = Date.now, maxBytes = HISTORICAL_CACHE_LIMITS.maxBytes, maxEntries = HISTORICAL_CACHE_LIMITS.maxEntries, ttlMs = HISTORICAL_CACHE_LIMITS.ttlMs} = {}) {
+  if (typeof run !== 'function' || !Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > HISTORICAL_CACHE_LIMITS.maxBytes || !Number.isSafeInteger(maxEntries) || maxEntries < 1 || maxEntries > HISTORICAL_CACHE_LIMITS.maxEntries || !Number.isSafeInteger(ttlMs) || ttlMs < 1 || ttlMs > HISTORICAL_CACHE_LIMITS.ttlMs) throw Error('Invalid historical cache configuration');
+  const cache = new Map();
+  let bytes = 0, reservedBytes = 0, reservedEntries = 0, epoch = 0, blobReads = 0, blobReadBytes = 0, decodeCount = 0, cacheHits = 0;
+  const remove = key => {
+    const entry = cache.get(key);
+    if (!entry) return;
+    clearTimeout(entry.timer);
+    bytes -= entry.buffer.length;
+    cache.delete(key);
+  };
+  const purge = () => {for (const [key,entry] of cache) if (entry.expiresAt <= now()) remove(key);};
+  const clear = root => {
+    epoch++; // In-flight reads predating revocation must never repopulate the cache.
+    for (const [key,entry] of cache) if (root === undefined || root === entry.root) remove(key);
+  };
+  const ensureCommit = async (root, commit, signal) => {
+    signal?.throwIfAborted();
+    if (!isObjectId(commit)) throw Error('Invalid commit id');
+    const type = (await run(root, ['cat-file','-t',commit], 2097152, {signal})).toString('utf8').trim();
+    if (type !== 'commit') throw Error('Commit object required');
+  };
+  const lookup = async (root, {commit,path:file,signal,missingMessage = 'Path is not part of selected commit'}) => {
+    validateHistoricalPath(file);
+    await ensureCommit(root, commit, signal);
+    const listing = await run(root, ['ls-tree','-z','--full-tree',commit,'--',file], 2097152, {signal});
+    const entries = parseTreeEntries(listing);
+    const entry = entries.find(row => row.path === file);
+    if (!entry) throw Error(missingMessage);
+    signal?.throwIfAborted();
+    return entry;
+  };
+  const treePage = async (root, {commit,path:directory = '',offset = 0,limit = 100,query = '',signal} = {}) => {
+    validateHistoricalPath(directory, true);
+    if (typeof query !== 'string' || query.length > 1024 || /[\0\r\n]/.test(query)) throw Error('Invalid historical tree query');
+    if (!Number.isInteger(offset) || offset < 0 || offset > MAX_DIRECTORY_ENTRIES || !Number.isInteger(limit) || limit < 1 || limit > 100) throw Error('Invalid tree pagination');
+    let tree = commit;
+    if (directory) {
+      const entry = await lookup(root, {commit,path:directory,signal});
+      if (entry.type !== 'tree' || entry.mode !== '040000') throw Error('Historical directory required');
+      tree = entry.oid;
+    } else await ensureCommit(root, commit, signal);
+    // The revision is an already-validated OID, never user-controlled rev:path syntax.
+    const buffer = await run(root, ['ls-tree','-z',tree], MAX_LIST_BYTES, {signal});
+    const entries = parseTreeEntries(buffer, directory ? directory + '/' : '');
+    if (entries.some(entry => entry.path.slice(directory ? directory.length + 1 : 0).includes('/'))) throw Error('Expected direct historical directory entries');
+    signal?.throwIfAborted();
+    const needle = query.toLowerCase();
+    const prefixLength = directory ? directory.length + 1 : 0;
+    const filtered = needle ? entries.filter(entry => entry.path.slice(prefixLength).toLowerCase().includes(needle)) : entries;
+    filtered.sort((a,b) => Number(b.type === 'tree') - Number(a.type === 'tree') || (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    return {commit,path:directory,query,entries:filtered.slice(offset,offset + limit),nextOffset:offset + limit < filtered.length ? offset + limit : null};
+  };
+  const segment = async (root, {commit,path:file,offset = 0,signal,expectedEpoch = epoch} = {}) => {
+    const generation = expectedEpoch; // Includes caller repository validation and all member lookups.
+    if (!Number.isInteger(offset) || offset < 0 || offset > MAX_BLOB_BYTES) throw Error('Invalid segment offset');
+    const entry = await lookup(root, {commit,path:file,signal,missingMessage:'Segment requires a selected committed regular file'});
+    if (entry.type !== 'blob' || !['100644','100755'].includes(entry.mode)) throw Error('Segment requires a selected committed regular file');
+    purge();
+    const key = JSON.stringify([root,commit,entry.oid]);
+    let buffer = generation === epoch ? cache.get(key)?.buffer : undefined;
+    if (buffer) cacheHits++;
+    if (!buffer) {
+      const rawSize = (await run(root, ['cat-file','-s',entry.oid], 2097152, {signal})).toString('utf8').trim();
+      if (!/^\d+$/.test(rawSize)) throw Error('Invalid object size');
+      const size = Number(rawSize);
+      if (!Number.isSafeInteger(size) || size > MAX_BLOB_BYTES) throw Error('Segmented file exceeds 16 MiB limit');
+      if (offset > size) throw Error('Segment offset exceeds file size');
+      if (size > maxBytes) throw Error('Segmented file exceeds cache byte budget');
+      purge();
+      while (cache.size && (bytes + reservedBytes + size > maxBytes || cache.size + reservedEntries >= maxEntries)) remove(cache.keys().next().value);
+      if (bytes + reservedBytes + size > maxBytes || cache.size + reservedEntries >= maxEntries) throw Object.assign(Error('Historical cache is busy; retry the read'), {code:'vcs/busy'});
+      reservedBytes += size; reservedEntries++;
+      try {
+        blobReads++;
+        buffer = await run(root, ['cat-file','blob',entry.oid], Math.max(1,size), {signal});
+        blobReadBytes += buffer.length;
+        signal?.throwIfAborted();
+        if (buffer.length !== size) throw Error('Historical blob size mismatch');
+        if (buffer.includes(0) || buffer.some(byte => byte < 32 && ![9,10,12,13].includes(byte))) throw Error('Segments support UTF-8 text only');
+        new TextDecoder('utf-8',{fatal:true}).decode(buffer);
+        decodeCount++;
+        if (generation === epoch) {
+          remove(key);
+          const timer = setTimeout(() => remove(key), ttlMs);
+          timer.unref?.();
+          cache.set(key, {root,buffer,expiresAt:now() + ttlMs,timer});
+          bytes += buffer.length;
+        }
+      } finally {reservedBytes -= size; reservedEntries--;}
+    }
+    signal?.throwIfAborted();
+    const size = buffer.length;
+    if (offset > size) throw Error('Segment offset exceeds file size');
+    if (offset < size && (buffer[offset] & 192) === 128) throw Error('Segment offset splits UTF-8 character');
+    let end = Math.min(size, offset + CHUNK_BYTES);
+    while (end < size && (buffer[end] & 192) === 128) end--;
+    const text = new TextDecoder('utf-8',{fatal:true,ignoreBOM:true}).decode(buffer.subarray(offset,end));
+    signal?.throwIfAborted();
+    return {commit,path:file,oid:entry.oid,encoding:'UTF-8',offset,endOffset:end,totalBytes:size,nextOffset:end < size ? end : null,text};
+  };
+  return {lookup,treePage,segment,clear,captureEpoch:() => epoch,stats:() => {purge();return {bytes,entries:cache.size,reservedBytes,reservedEntries,blobReads,blobReadBytes,decodeCount,cacheHits};}};
+}

package/src/operation-budget.mjs

@@ -0,0 +1,44 @@
+import {AsyncLocalStorage} from 'node:async_hooks';
+import {performance} from 'node:perf_hooks';
+
+const operations = new AsyncLocalStorage();
+export const operationTimeout = () => Object.assign(new Error('VCS operation deadline exceeded.'), {code: 'TIMEOUT'});
+
+/** One monotonic deadline per RPC. Nested commands never reset this budget. */
+export async function withOperationBudget({signal, timeoutMs = 15000} = {}, work) {
+  if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 15000) throw new Error('Invalid operation timeout.');
+  const parent = operations.getStore();
+  const deadline = Math.min(performance.now() + timeoutMs, parent?.deadline ?? Infinity);
+  const controller = new AbortController();
+  const signals = [signal, parent?.signal].filter(Boolean);
+  const abort = () => {
+    const source = signals.find(value => value.aborted);
+    if (source) controller.abort(source.reason);
+  };
+  for (const source of signals) source.addEventListener('abort', abort, {once: true});
+  abort();
+  const timer = setTimeout(() => controller.abort(operationTimeout()), Math.max(1, Math.ceil(deadline - performance.now())));
+  const budget = {
+    deadline,
+    signal: controller.signal,
+    remaining() {
+      this.throwIfExpired();
+      return Math.max(1, Math.ceil(deadline - performance.now()));
+    },
+    throwIfExpired() {
+      if (!controller.signal.aborted && performance.now() >= deadline) controller.abort(operationTimeout());
+      controller.signal.throwIfAborted();
+    },
+  };
+  try {
+    budget.throwIfExpired();
+    const value = await operations.run(budget, work);
+    budget.throwIfExpired();
+    return value;
+  } finally {
+    clearTimeout(timer);
+    for (const source of signals) source.removeEventListener('abort', abort);
+  }
+}
+
+export const currentOperationBudget = () => operations.getStore();

package/src/preview-capabilities.mjs

@@ -0,0 +1,19 @@
+import {MAX_TEXT,MAX_LARGE_TEXT} from '../text-content.mjs';
+
+/** Machine-readable capability contract. Human notices never decide an action. */
+export function comparisonPreview({left = {},right = {},large = false,allowLarge = false,conflicted = false} = {}) {
+  const sides = [left,right];
+  const reason = sides.some(side => side.binary) ? 'binary'
+    : sides.some(side => side.previewReason === 'size-limit') ? 'size-limit'
+    : sides.find(side => side.previewReason)?.previewReason ?? null;
+  return {
+    reason,
+    canLoadLarge: !large && allowLarge && !conflicted && reason === 'size-limit' && sides.every(side => side.largeEligible !== false),
+    complete: reason === null,
+    limits: {previewBytes:MAX_TEXT,largeBytes:MAX_LARGE_TEXT},
+  };
+}
+
+export function withComparisonPreview(comparison, options = {}) {
+  return {...comparison,preview:comparisonPreview({...options,large:comparison.large ?? options.large,left:options.left ?? comparison.left,right:options.right ?? comparison.right})};
+}