@gitkraken/core-gitlens 0.4.0 → 0.4.101

package/src/plus/git-github/models.ts

@@ -51,6 +51,8 @@ export interface GitHubCommitRef {
 
 export type GitHubContributor = Endpoints['GET /repos/{owner}/{repo}/contributors']['response']['data'][0];
 
+export type GitHubSshSigningKey = Endpoints['GET /users/{username}/ssh_signing_keys']['response']['data'][0];
+
 export interface GitHubMember {
 	login: string;
 	avatarUrl: string;
@@ -130,6 +132,7 @@ export type GitHubIssueOrPullRequestState = GitHubIssueState | GitHubPullRequest
 
 export interface GitHubPullRequestLite extends Omit<GitHubIssueOrPullRequest, '__typename'> {
 	author: GitHubMember;
+	body: string;
 
 	baseRefName: string;
 	baseRefOid: string;
@@ -137,10 +140,12 @@ export interface GitHubPullRequestLite extends Omit<GitHubIssueOrPullRequest, '_
 	headRefName: string;
 	headRefOid: string;
 	headRepository: {
+		isFork: boolean;
 		name: string;
 		owner: {
 			login: string;
 		};
+		sshUrl: string;
 		url: string;
 	};
 
@@ -155,6 +160,7 @@ export interface GitHubPullRequestLite extends Omit<GitHubIssueOrPullRequest, '_
 		owner: {
 			login: string;
 		};
+		sshUrl: string;
 		url: string;
 		viewerPermission: GitHubViewerPermission;
 	};
@@ -261,6 +267,9 @@ export function fromGitHubPullRequestLite(pr: GitHubPullRequestLite, provider: P
 				sha: pr.headRefOid,
 				branch: pr.headRefName,
 				url: pr.headRepository?.url,
+				cloneHttps: pr.headRepository != null ? `${pr.headRepository.url}.git` : undefined,
+				cloneSsh: pr.headRepository?.sshUrl,
+				isFork: pr.headRepository?.isFork,
 			},
 			base: {
 				exists: pr.repository != null,
@@ -269,10 +278,25 @@ export function fromGitHubPullRequestLite(pr: GitHubPullRequestLite, provider: P
 				sha: pr.baseRefOid,
 				branch: pr.baseRefName,
 				url: pr.repository?.url,
+				cloneHttps: pr.repository != null ? `${pr.repository.url}.git` : undefined,
+				cloneSsh: pr.repository?.sshUrl,
+				isFork: pr.repository?.isFork,
 			},
 			isCrossRepository: pr.isCrossRepository,
 		},
 		pr.isDraft,
+		undefined, // additions
+		undefined, // deletions
+		undefined, // commentsCount
+		undefined, // thumbsUpCount
+		undefined, // reviewDecision
+		undefined, // reviewRequests
+		undefined, // latestReviews
+		undefined, // assignees
+		undefined, // statusCheckRollupState
+		undefined, // project
+		undefined, // version
+		pr.body,
 	);
 }
 
@@ -405,6 +429,9 @@ export function fromGitHubPullRequest(pr: GitHubPullRequest, provider: Provider)
 				sha: pr.headRefOid,
 				branch: pr.headRefName,
 				url: pr.headRepository?.url,
+				cloneHttps: pr.headRepository != null ? `${pr.headRepository.url}.git` : undefined,
+				cloneSsh: pr.headRepository?.sshUrl,
+				isFork: pr.headRepository?.isFork,
 			},
 			base: {
 				exists: pr.repository != null,
@@ -413,6 +440,9 @@ export function fromGitHubPullRequest(pr: GitHubPullRequest, provider: Provider)
 				sha: pr.baseRefOid,
 				branch: pr.baseRefName,
 				url: pr.repository?.url,
+				cloneHttps: pr.repository != null ? `${pr.repository.url}.git` : undefined,
+				cloneSsh: pr.repository?.sshUrl,
+				isFork: pr.repository?.isFork,
 			},
 			isCrossRepository: pr.isCrossRepository,
 		},
@@ -454,6 +484,9 @@ export function fromGitHubPullRequest(pr: GitHubPullRequest, provider: Provider)
 			url: r.url,
 		})),
 		fromGitHubPullRequestStatusCheckRollupState(pr.commits.nodes?.[0]?.commit.statusCheckRollup?.state),
+		undefined, // project
+		undefined, // version
+		pr.body,
 	);
 }
 

package/src/plus/git-github/providers/github/branches.ts

@@ -366,12 +366,15 @@ export class BranchesGitSubProvider implements GitBranchesSubProvider {
 	async getDefaultBranchName(
 		repoPath: string | undefined,
 		remote?: string,
-		// `priority` is unused — the GitHub provider doesn't go through the local git command
-		// queue, so the priority signal has no effect here. Accepted for interface compatibility.
-		_options?: { priority?: GitCommandPriority },
+		// `priority` is unused — the GitHub provider doesn't go through the local git command queue, so the
+		// priority signal has no effect here. `local` asks for a network-free resolution (the graph's hot
+		// path): a remote repo has no local symref to read, so honor that contract by returning undefined
+		// rather than making the API round-trip the caller explicitly asked to avoid.
+		options?: { priority?: GitCommandPriority; local?: boolean },
 		_cancellation?: AbortSignal,
 	): Promise<string | undefined> {
 		if (repoPath == null) return undefined;
+		if (options?.local) return undefined;
 
 		remote ??= 'origin';
 

package/src/plus/git-github/providers/github/diff.ts

@@ -265,7 +265,7 @@ export class DiffGitSubProvider implements GitDiffSubProvider {
 	}
 
 	@debug()
-	// eslint-disable-next-line @typescript-eslint/require-await
+	// oxlint-disable-next-line typescript/require-await
 	async getPreviousComparisonUrisForRange(
 		_repoPath: string,
 		_path: string | Uri,

package/src/plus/git-github/providers/github/graph.ts

@@ -7,6 +7,7 @@ import type {
 	GitGraphRowRemoteHead,
 	GitGraphRowStats,
 	GitGraphRowTag,
+	GraphRowProcessor,
 } from '../../../../git/models/graph.js';
 import type {
 	GitGraphSearch,
@@ -15,6 +16,14 @@ import type {
 	GitGraphSearchResultData,
 	GitGraphSearchResults,
 } from '../../../../git/models/graphSearch.js';
+import type {
+	GitGraphSession,
+	GitGraphSessionChangedChannels,
+	GitGraphSessionRefreshOptions,
+	GitGraphSessionRefreshResult,
+	GitGraphSessionSnapshot,
+	GraphSessionRestoreResult,
+} from '../../../../git/models/graphSession.js';
 import type { GitLog } from '../../../../git/models/log.js';
 import type { GitRemote } from '../../../../git/models/remote.js';
 import type { SearchQuery } from '../../../../git/models/search.js';
@@ -22,6 +31,7 @@ import type { GitUser } from '../../../../git/models/user.js';
 import type { GitGraphSubProvider } from '../../../../git/providers/graph.js';
 import { getBranchNameWithoutRemote } from '../../../../git/utils/branch.utils.js';
 import { getChangedFilesCount } from '../../../../git/utils/commit.utils.js';
+import { appendRowsAtCursor, mergeAvatarsForward } from '../../../../git/utils/graph.utils.js';
 import { isUncommitted } from '../../../../git/utils/revision.utils.js';
 import { getSearchQueryComparisonKey, parseSearchQueryGitHubCommand } from '../../../../git/utils/search.utils.js';
 import { debug } from '../../../../utils/decorators/log.js';
@@ -35,6 +45,26 @@ const quoteRegex = /"/g;
 export class GraphGitSubProvider implements GitGraphSubProvider {
 	constructor(private readonly provider: GitHubGitProviderInternal) {}
 
+	async openGraphSession(
+		repoPath: string,
+		options?: {
+			rowProcessor?: GraphRowProcessor;
+			rev?: string;
+			limit?: number;
+			include?: { stats?: boolean };
+			restore?: GitGraphSessionSnapshot;
+			onRestore?: (result: GraphSessionRestoreResult) => void;
+		},
+		cancellation?: AbortSignal,
+	): Promise<GitGraphSession> {
+		// GitHub-backed graphs have no incremental machinery (and `getGraph` takes no row processor); the
+		// session is a thin window accumulator over full fetches. `rowProcessor` and `restore`/`onRestore`
+		// (there's no incremental restore path) are accepted for interface parity and ignored — always a full walk.
+		const session = new GraphSession(this, repoPath);
+		await session.initialize(options, cancellation);
+		return session;
+	}
+
 	@debug()
 	async getGraph(
 		repoPath: string,
@@ -509,3 +539,104 @@ export class GraphGitSubProvider implements GitGraphSubProvider {
 		}
 	}
 }
+
+/**
+ * GitHub-backed {@link GitGraphSession}: a thin window accumulator over {@link GraphGitSubProvider.getGraph}.
+ * There's no incremental head-walk yet, so every {@link refresh} is a full fetch (`path: 'full'`); the
+ * window accumulates across {@link more} via the shared cursor-anchored helper, and prior avatar URLs are
+ * carried forward write-once — matching the CLI session's observable window/avatar behavior.
+ */
+class GraphSession implements GitGraphSession {
+	// Assigned by `initialize` before the session is handed out; never read before then.
+	private _current!: GitGraph;
+	private _window: readonly GitGraphRow[] = [];
+
+	constructor(
+		private readonly provider: GraphGitSubProvider,
+		readonly repoPath: string,
+	) {}
+
+	get window(): readonly GitGraphRow[] {
+		return this._window;
+	}
+
+	get current(): GitGraph {
+		return this._current;
+	}
+
+	async initialize(
+		options?: { rev?: string; limit?: number; include?: { stats?: boolean } },
+		cancellation?: AbortSignal,
+	): Promise<void> {
+		const graph = await this.provider.getGraph(
+			this.repoPath,
+			options?.rev,
+			{ include: options?.include, limit: options?.limit },
+			cancellation,
+		);
+		this.apply(graph);
+	}
+
+	async refresh(
+		options?: GitGraphSessionRefreshOptions,
+		cancellation?: AbortSignal,
+	): Promise<GitGraphSessionRefreshResult> {
+		const prior = this._current;
+		let graph = await this.provider.getGraph(
+			this.repoPath,
+			options?.rev,
+			{ include: options?.include, limit: options?.limit },
+			cancellation,
+		);
+
+		// Host-serialization backstop: the host serializes refresh against more() per repo. Should a more() still
+		// land mid-refresh (`_current` swapped out from under this await), the rebuild predates that appended page
+		// — refresh carries newer repo truth so we still apply it, but when the accumulated window outran the
+		// rebuild the dropped page must re-page, not vanish. `paging.hasMore` is readonly, so re-wrap it truthful.
+		if (this._current !== prior && graph.paging != null && this._window.length > graph.rows.length) {
+			graph = { ...graph, paging: { ...graph.paging, hasMore: true } };
+		}
+
+		mergeAvatarsForward(prior.avatars, graph.avatars);
+		this.apply(graph);
+		// The GitHub provider always does a full walk (no incremental fast path), so every channel changed.
+		const changed: GitGraphSessionChangedChannels = {
+			rows: true,
+			reachability: true,
+			rowsStats: true,
+			avatars: true,
+			downstreams: true,
+		};
+		return { path: 'full', changed: changed };
+	}
+
+	async more(limit?: number, targetId?: string, cancellation?: AbortSignal): Promise<boolean> {
+		const prior = this._current;
+		const updated = await prior.more?.(limit ?? 0, targetId, cancellation);
+		if (this._current !== prior || updated == null) return false;
+		// A more() past the end returns a degenerate empty graph (no rows, no paging) — nothing to add, so don't
+		// let it REPLACE the accumulated window with empty.
+		if (updated.rows.length === 0 && updated.paging == null) return false;
+
+		mergeAvatarsForward(prior.avatars, updated.avatars);
+		this.apply(updated);
+		return true;
+	}
+
+	serialize(): GitGraphSessionSnapshot | undefined {
+		// No incremental restore path (no ref-tip gate / reachability table), so nothing worth persisting.
+		return undefined;
+	}
+
+	dispose(): void {
+		// No-op — the window lives entirely in memory.
+	}
+
+	/** Cursor-less graph IS the full window; a paged graph appends at its cursor. */
+	private apply(graph: GitGraph): void {
+		this._current = graph;
+		const startingCursor = graph.paging?.startingCursor;
+		this._window =
+			startingCursor == null ? graph.rows : appendRowsAtCursor(this._window, startingCursor, graph.rows);
+	}
+}

package/src/plus/git-github/providers/github/tags.ts

@@ -80,6 +80,8 @@ export class TagsGitSubProvider implements GitTagsSubProvider {
 									tag.target.message ?? tag.target.target?.message ?? '',
 									authoredDate != null ? new Date(authoredDate) : undefined,
 									committedDate != null ? new Date(committedDate) : undefined,
+									// Annotated tags carry a tagger (and a nested target commit); lightweight tags don't.
+									tag.target.tagger != null || tag.target.target != null,
 								),
 							);
 						}

package/src/plus/integrations/authentication/cloudIntegrationService.ts

@@ -1,9 +1,70 @@
 import { getScopedLogger } from '../../../utils/logger.scoped.js';
 import type { IntegrationIds } from '../constants.js';
 import type { IntegrationServiceContext } from '../context.js';
-import type { CloudIntegrationAuthenticationSession, CloudIntegrationConnection } from './models.js';
+import type {
+	CloudIntegrationAuthenticationSession,
+	CloudIntegrationConnection,
+	CloudIntegrationType,
+} from './models.js';
 import { toCloudIntegrationType } from './models.js';
 
+/**
+ * Wire shape of a `v1/provider-tokens` connection descriptor. The list endpoint returns one such
+ * entry per provider as the primary, with additional accounts nested under `secondaries`. Field casing
+ * is the backend's (camelCase, `tokenId`).
+ */
+interface GKProviderTokenData {
+	tokenId: string;
+	provider: CloudIntegrationType;
+	type: CloudIntegrationAuthenticationSession['type'];
+	domain: string;
+	/** Human-readable account handle; the backend includes it on the connection when available. */
+	accountName?: string;
+}
+
+/** Wire shape of a single `v1/provider-tokens/...` token response (`data`). */
+interface GKProviderToken {
+	tokenId?: string;
+	isPrimary?: boolean;
+	accessToken: string;
+	appKey?: string;
+	expiresIn: number;
+	scopes: string;
+	type: CloudIntegrationAuthenticationSession['type'];
+	domain?: string;
+}
+
+/**
+ * Whether the backend definitively answered that this connection has no fetchable token, so it can be
+ * cleanly disconnected (#5497). Everything else is retryable — notably 401/403, which reject our GK
+ * *account* token rather than the connection. The asymmetry is deliberate: a wrongly-kept descriptor
+ * self-corrects on the next sync, a wrongly-dropped one needs a manual reconnect (#5569).
+ */
+function isTerminalStatus(status: number): boolean {
+	switch (status) {
+		case 400: // e.g. a non-uuid token id (#5497)
+		case 404:
+		case 410:
+		case 422:
+			return true;
+		default:
+			return false;
+	}
+}
+
+function toSession(data: GKProviderToken): CloudIntegrationAuthenticationSession {
+	// Normalize the backend's `tokenId` onto our `id` so callers get a stable per-connection identity.
+	return {
+		type: data.type,
+		accessToken: data.accessToken,
+		domain: data.domain ?? '',
+		expiresIn: data.expiresIn,
+		scopes: data.scopes,
+		id: data.tokenId,
+		appKey: data.appKey,
+	};
+}
+
 export class CloudIntegrationService {
 	constructor(private readonly ctx: IntegrationServiceContext) {}
 
@@ -24,12 +85,54 @@ export class CloudIntegrationService {
 			return undefined;
 		}
 
-		return ((await providersRsp.json()) as { data?: unknown })?.data as CloudIntegrationConnection[] | undefined;
+		const data = ((await providersRsp.json()) as { data?: unknown })?.data as
+			| (GKProviderTokenData & { secondaries?: GKProviderTokenData[] })[]
+			| undefined;
+		// A non-array `data` (unexpected backend shape) would throw on iteration below and abort the
+		// whole cloud-sync path, so bail gracefully instead.
+		if (!Array.isArray(data)) return undefined;
+
+		// Flatten the primary + `secondaries[]` grouping into one connection per account. Primacy is
+		// positional on the wire (top-level entry = primary), so we set the `primary` flag here.
+		const connections: CloudIntegrationConnection[] = [];
+		for (const item of data) {
+			connections.push({
+				id: item.tokenId,
+				type: item.type,
+				provider: item.provider,
+				domain: item.domain,
+				primary: true,
+				accountName: item.accountName,
+			});
+			// `secondaries` comes from the same unknown payload as `data`; guard against a non-array shape so
+			// an unexpected value doesn't throw here and abort the whole cloud-sync path.
+			for (const secondary of Array.isArray(item.secondaries) ? item.secondaries : []) {
+				connections.push({
+					id: secondary.tokenId,
+					type: secondary.type,
+					provider: secondary.provider ?? item.provider,
+					domain: secondary.domain || item.domain,
+					primary: false,
+					accountName: secondary.accountName,
+				});
+			}
+		}
+
+		return connections;
 	}
 
+	/**
+	 * Fetches a connection's token, refreshing it first when `refreshToken` is given; `connectionId` targets
+	 * a specific connection (multi-account) rather than the provider's primary.
+	 *
+	 * Resolves `undefined` ONLY on a terminal failure (see {@link isTerminalStatus}, or an ok response with
+	 * no `data`), which callers may treat as "the connection is gone" (#5497). THROWS on every other
+	 * failure, which they must catch and treat as retryable instead of disconnecting (#5569).
+	 */
 	async getConnectionSession(
 		id: IntegrationIds,
 		refreshToken?: string,
+		connectionId?: string,
 	): Promise<CloudIntegrationAuthenticationSession | undefined> {
 		const scope = getScopedLogger();
 
@@ -49,10 +152,13 @@ export class CloudIntegrationService {
 				}
 			: { method: 'GET' };
 
-		const tokenRsp = await this.ctx.account.fetchGkApi(
-			`v1/provider-tokens/${cloudIntegrationType}${refresh ? '/refresh' : ''}`,
-			reqInitOptions,
-		);
+		// A specific connection (multi-account) is addressed by its token id under `/tokens/{tokenId}`,
+		// including refresh (`/tokens/{tokenId}/refresh`). The provider-scoped endpoints only ever operate
+		// on the provider's PRIMARY connection, so they must NOT be used to refresh a secondary.
+		const path = connectionId
+			? `v1/provider-tokens/tokens/${encodeURIComponent(connectionId)}${refresh ? '/refresh' : ''}`
+			: `v1/provider-tokens/${cloudIntegrationType}${refresh ? '/refresh' : ''}`;
+		const tokenRsp = await this.ctx.account.fetchGkApi(path, reqInitOptions);
 		if (!tokenRsp.ok) {
 			const error = ((await tokenRsp.json()) as { error?: unknown })?.error;
 			const errorMessage =
@@ -70,23 +176,36 @@ export class CloudIntegrationService {
 			});
 
 			if (refresh) {
-				// try once to just get the latest token if the refresh fails, and give up if that fails too
-				const newTokenRsp = await this.ctx.account.fetchGkApi(`v1/provider-tokens/${cloudIntegrationType}`, {
-					method: 'GET',
-				});
+				// try once to just get the latest token if the refresh fails, and give up if that fails too;
+				// stay scoped to the same connection (by token id) so we don't fall back to the primary.
+				const latestPath = connectionId
+					? `v1/provider-tokens/tokens/${encodeURIComponent(connectionId)}`
+					: `v1/provider-tokens/${cloudIntegrationType}`;
+				const newTokenRsp = await this.ctx.account.fetchGkApi(latestPath, { method: 'GET' });
 				if (newTokenRsp.ok) {
-					return ((await newTokenRsp.json()) as { data?: unknown })?.data as
-						| CloudIntegrationAuthenticationSession
-						| undefined;
+					const data = ((await newTokenRsp.json()) as { data?: GKProviderToken })?.data;
+					return data != null ? toSession(data) : undefined;
 				}
+
+				// Report the fallback's own status (as a get, not a refresh) — it's what decides the outcome.
+				this.ctx.hooks?.connection?.onConnectionFetchFailed?.({
+					id: id,
+					code: newTokenRsp.status,
+					refreshing: false,
+				});
+
+				if (isTerminalStatus(newTokenRsp.status)) return undefined;
+
+				throw new Error(`Retryable failure (${newTokenRsp.status}) refreshing ${id} token from cloud`);
 			}
 
-			return undefined;
+			if (isTerminalStatus(tokenRsp.status)) return undefined;
+
+			throw new Error(`Retryable failure (${tokenRsp.status}) getting ${id} token from cloud`);
 		}
 
-		return ((await tokenRsp.json()) as { data?: unknown })?.data as
-			| CloudIntegrationAuthenticationSession
-			| undefined;
+		const data = ((await tokenRsp.json()) as { data?: GKProviderToken })?.data;
+		return data != null ? toSession(data) : undefined;
 	}
 
 	async disconnect(id: IntegrationIds): Promise<boolean> {
@@ -117,4 +236,57 @@ export class CloudIntegrationService {
 
 		return true;
 	}
+
+	/**
+	 * Disconnects a single connection by its token id (multi-account). The backend promotes a secondary
+	 * to primary when the removed connection was the primary, so the provider stays connected if others
+	 * remain. Returns whether the delete succeeded.
+	 */
+	async disconnectConnection(id: IntegrationIds, connectionId: string): Promise<boolean> {
+		const scope = getScopedLogger();
+
+		const tokenRsp = await this.ctx.account.fetchGkApi(
+			`v1/provider-tokens/tokens/${encodeURIComponent(connectionId)}`,
+			{ method: 'DELETE' },
+		);
+		if (!tokenRsp.ok) {
+			const error = ((await tokenRsp.json()) as { error?: unknown })?.error;
+			const errorMessage =
+				typeof error === 'string' ? error : ((error as { message?: string })?.message ?? tokenRsp.statusText);
+			if (error != null) {
+				scope?.error(undefined, `Failed to disconnect connection '${connectionId}' for ${id}: ${errorMessage}`);
+			}
+			this.ctx.hooks?.connection?.onDisconnectFailed?.({ id: id, code: tokenRsp.status });
+			return false;
+		}
+
+		return true;
+	}
+
+	/**
+	 * Promotes a connection to primary by its token id (multi-account), clearing primacy on the provider's
+	 * other connections server-side. Returns whether the switch succeeded.
+	 */
+	async setPrimaryConnection(id: IntegrationIds, connectionId: string): Promise<boolean> {
+		const scope = getScopedLogger();
+
+		const tokenRsp = await this.ctx.account.fetchGkApi(
+			`v1/provider-tokens/tokens/${encodeURIComponent(connectionId)}/primary`,
+			{ method: 'POST' },
+		);
+		if (!tokenRsp.ok) {
+			const error = ((await tokenRsp.json()) as { error?: unknown })?.error;
+			const errorMessage =
+				typeof error === 'string' ? error : ((error as { message?: string })?.message ?? tokenRsp.statusText);
+			if (error != null) {
+				scope?.error(
+					undefined,
+					`Failed to set primary connection '${connectionId}' for ${id}: ${errorMessage}`,
+				);
+			}
+			return false;
+		}
+
+		return true;
+	}
 }