@goodandready/dsh-github-ops 0.5.0 → 0.6.1

package/lib/client.js

@@ -135,6 +135,16 @@ window.__ModuleLoader__.load({
       prBarReview: 'Review',
       prBarMerge: 'Merge',
       prBarCopied: 'Instruction copied: paste it into the composer and send.',
+      scmStageHunk: 'Stage Hunk',
+      scmUnstageHunk: 'Unstage Hunk',
+      scmHunk: 'Hunk',
+      scmGraphTitle: 'Git Graph',
+      scmGraphRefresh: 'Refresh Graph',
+      scmGraphEmpty: 'No commit history available.',
+      scmEventsConnected: 'Live updates active',
+      scmCiRunSuccess: 'CI run succeeded',
+      scmCiRunFailed: 'CI run failed',
+      scmPrUpdated: 'PR updated',
       prBarCopyFailed: 'Could not copy; the instruction is in the title.',
     }
 
@@ -238,6 +248,16 @@ window.__ModuleLoader__.load({
       prBarReview: '评审',
       prBarMerge: '合并',
       prBarCopied: '指令已复制：粘贴到输入框并发送。',
+      scmStageHunk: '暂存代码块',
+      scmUnstageHunk: '取消暂存块',
+      scmHunk: '代码块',
+      scmGraphTitle: 'Git 提交图',
+      scmGraphRefresh: '刷新提交图',
+      scmGraphEmpty: '暂无可用的提交历史。',
+      scmEventsConnected: '实时更新已连接',
+      scmCiRunSuccess: 'CI 运行成功',
+      scmCiRunFailed: 'CI 运行失败',
+      scmPrUpdated: 'PR 已更新',
       prBarCopyFailed: '复制失败；指令在提示中。',
     }
 
@@ -276,6 +296,9 @@ window.__ModuleLoader__.load({
       const [branchName, setBranchName] = React.useState('')
       const [stashMessage, setStashMessage] = React.useState('')
       const [mirrorStatus, setMirrorStatus] = React.useState(null)
+      const [showGraph, setShowGraph] = React.useState(false)
+      const [graphData, setGraphData] = React.useState({ phase: 'idle', entries: [] })
+      const [toasts, setToasts] = React.useState([])
       const [repoPath, setRepoPath] = React.useState(() => {
         try { return localStorage.getItem('gho-scm-cwd') || '' } catch { return '' }
       })
@@ -305,6 +328,45 @@ window.__ModuleLoader__.load({
       }, [repoPath])
 
       React.useEffect(() => { load() }, [load])
+      const loadGraph = React.useCallback(() => {
+        setGraphData((prev) => ({ ...prev, phase: 'loading' }))
+        fetchWithTimeout(`/dsh-github-ops/graph?limit=15${cwdQuery ? `&${cwdQuery}` : ''}`, { headers: { accept: 'application/json' } })
+          .then((res) => (res.ok ? res.json() : Promise.reject(new Error(`HTTP ${res.status}`))))
+          .then((data) => setGraphData({ phase: 'ready', entries: data.entries || [] }))
+          .catch((err) => setGraphData({ phase: 'error', entries: [], error: String((err && err.message) || err) }))
+      }, [cwdQuery])
+
+      React.useEffect(() => {
+        if (typeof EventSource === 'undefined') return
+        let es = null
+        try {
+          es = new EventSource('/dsh-github-ops/events')
+          es.addEventListener('ci_status', (e) => {
+            try {
+              const data = JSON.parse(e.data)
+              const title = data.conclusion === 'success' ? t('scmCiRunSuccess') : t('scmCiRunFailed')
+              const msg = `${data.name || 'CI'} #${data.id} (${data.conclusion || data.status})`
+              const tid = Date.now() + Math.random()
+              setToasts((prev) => [...prev, { id: tid, type: data.conclusion === 'success' ? 'success' : 'warn', title, message: msg }])
+              setTimeout(() => setToasts((prev) => prev.filter((x) => x.id !== tid)), 5000)
+              load()
+            } catch {}
+          })
+          es.addEventListener('pr_status', (e) => {
+            try {
+              const data = JSON.parse(e.data)
+              const title = t('scmPrUpdated')
+              const msg = `PR #${data.number}: ${data.title || ''}`
+              const tid = Date.now() + Math.random()
+              setToasts((prev) => [...prev, { id: tid, type: 'info', title, message: msg }])
+              setTimeout(() => setToasts((prev) => prev.filter((x) => x.id !== tid)), 5000)
+              load()
+            } catch {}
+          })
+        } catch {}
+        return () => { if (es) es.close() }
+      }, [load, t])
+
 
       // Every write is one named action; the host validates it and runs argv, never a shell.
       const runAction = (action, args) => {
@@ -322,6 +384,9 @@ window.__ModuleLoader__.load({
             setConfirming('')
             if (!payload || payload.ok !== true) setActionError((payload && payload.error) || t('scmActionFailed'))
             load()
+            if (selected && selected.path && !selected.isStash) {
+              openDiff(selected, selected.staged)
+            }
           })
           .catch((err) => { setBusy(''); setActionError(String((err && err.message) || err)) })
       }
@@ -350,17 +415,19 @@ window.__ModuleLoader__.load({
 
       const openDiff = (file, staged) => {
         setSelected({ path: file.path, staged })
-        setDiff({ phase: 'loading', text: '', hasConflicts: false, conflicts: [] })
+        setDiff({ phase: 'loading', text: '', hunks: [], hasConflicts: false, conflicts: [], staged })
         const query = `?file=${encodeURIComponent(file.path)}${staged ? '&staged=1' : ''}${cwdQuery ? `&${cwdQuery}` : ''}`
         fetchWithTimeout(SCM_PATH + query, { headers: { accept: 'application/json' } })
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
           .then((payload) => setDiff({
             phase: 'ready',
             text: payload.diff || '',
+            hunks: payload.hunks || [],
+            staged,
             hasConflicts: Boolean(payload.hasConflicts || (file.status === 'U') || (payload.diff && payload.diff.includes('<<<<<<<'))),
             conflicts: payload.conflicts || [],
           }))
-          .catch((err) => setDiff({ phase: 'error', text: String((err && err.message) || err), hasConflicts: false }))
+          .catch((err) => setDiff({ phase: 'error', text: String((err && err.message) || err), hunks: [], hasConflicts: false, staged }))
       }
 
       const resolveConflict = (choice, blockIndex) => {
@@ -571,9 +638,35 @@ window.__ModuleLoader__.load({
             )
           : null,
         selected
-          ? React.createElement('pre', { className: 'gho-scm-diff' },
-            diff.phase === 'loading' ? t('scmLoading') : (diff.text || t('scmDiffEmpty')))
+          ? (diff.phase === 'loading'
+              ? React.createElement('pre', { className: 'gho-scm-diff' }, t('scmLoading'))
+              : (diff.hunks && diff.hunks.length > 0
+                  ? React.createElement('div', { className: 'gho-diff-container' },
+                      diff.hunks.map((hunk, hIdx) => React.createElement('div', { key: hIdx, className: 'gho-diff-hunk' },
+                        React.createElement('div', { className: 'gho-diff-hunk-head' },
+                          React.createElement('span', { className: 'gho-diff-hunk-title' }, hunk.header),
+                          button(
+                            selected.staged ? t('scmUnstageHunk') : t('scmStageHunk'),
+                            () => runAction(selected.staged ? 'unstage_patch' : 'stage_patch', { patch: hunk.patch }),
+                          ),
+                        ),
+                        React.createElement('div', { className: 'gho-diff-hunk-body' },
+                          hunk.lines.map((line, lIdx) => React.createElement('div', {
+                            key: lIdx,
+                            className: `gho-diff-line gho-diff-${line.type}`,
+                          },
+                            React.createElement('span', { className: 'gho-diff-char' }, line.type === 'add' ? '+' : (line.type === 'del' ? '-' : ' ')),
+                            React.createElement('span', { className: 'gho-diff-text' }, line.type === 'add' || line.type === 'del' ? line.text.slice(1) : line.text),
+                          )),
+                        ),
+                      )),
+                    )
+                  : React.createElement('pre', { className: 'gho-scm-diff' }, diff.text || t('scmDiffEmpty'))
+                )
+            )
           : null,
+        graphBar,
+        graphView,
         branchBar,
         stashBar,
         worktreeBar,
@@ -581,6 +674,17 @@ window.__ModuleLoader__.load({
         React.createElement('div', { className: 'gho-scm-meta' },
           React.createElement('span', null, `${t('scmTags')}: ${(payload.tags || []).join(', ') || '—'}`),
         ),
+        toasts.length > 0
+          ? React.createElement('div', { className: 'gho-toasts' },
+              toasts.map((toast) => React.createElement('div', {
+                key: toast.id,
+                className: `gho-toast gho-toast-${toast.type}`,
+              },
+                React.createElement('strong', null, toast.title),
+                toast.message ? React.createElement('div', null, toast.message) : null,
+              ))
+            )
+          : null,
       )
     }
 
@@ -606,6 +710,45 @@ window.__ModuleLoader__.load({
       }, [])
 
       React.useEffect(() => { load() }, [load])
+      const loadGraph = React.useCallback(() => {
+        setGraphData((prev) => ({ ...prev, phase: 'loading' }))
+        fetchWithTimeout(`/dsh-github-ops/graph?limit=15${cwdQuery ? `&${cwdQuery}` : ''}`, { headers: { accept: 'application/json' } })
+          .then((res) => (res.ok ? res.json() : Promise.reject(new Error(`HTTP ${res.status}`))))
+          .then((data) => setGraphData({ phase: 'ready', entries: data.entries || [] }))
+          .catch((err) => setGraphData({ phase: 'error', entries: [], error: String((err && err.message) || err) }))
+      }, [cwdQuery])
+
+      React.useEffect(() => {
+        if (typeof EventSource === 'undefined') return
+        let es = null
+        try {
+          es = new EventSource('/dsh-github-ops/events')
+          es.addEventListener('ci_status', (e) => {
+            try {
+              const data = JSON.parse(e.data)
+              const title = data.conclusion === 'success' ? t('scmCiRunSuccess') : t('scmCiRunFailed')
+              const msg = `${data.name || 'CI'} #${data.id} (${data.conclusion || data.status})`
+              const tid = Date.now() + Math.random()
+              setToasts((prev) => [...prev, { id: tid, type: data.conclusion === 'success' ? 'success' : 'warn', title, message: msg }])
+              setTimeout(() => setToasts((prev) => prev.filter((x) => x.id !== tid)), 5000)
+              load()
+            } catch {}
+          })
+          es.addEventListener('pr_status', (e) => {
+            try {
+              const data = JSON.parse(e.data)
+              const title = t('scmPrUpdated')
+              const msg = `PR #${data.number}: ${data.title || ''}`
+              const tid = Date.now() + Math.random()
+              setToasts((prev) => [...prev, { id: tid, type: 'info', title, message: msg }])
+              setTimeout(() => setToasts((prev) => prev.filter((x) => x.id !== tid)), 5000)
+              load()
+            } catch {}
+          })
+        } catch {}
+        return () => { if (es) es.close() }
+      }, [load, t])
+
 
       const payload = state.payload
       const ahead = payload && payload.isRepository && payload.upstream ? (payload.ahead || 0) : 0
@@ -946,6 +1089,34 @@ window.__ModuleLoader__.load({
         '.gho-note{font-size:12px;color:var(--dsw-alias-label-secondary);margin-right:auto}',
         '.gho-chev{margin-left:auto;flex:none;color:var(--dsw-alias-label-tertiary);transition:transform .16s}',
         '.gho-chev-open{transform:rotate(180deg)}',
+        '.gho-diff-container{display:flex;flex-direction:column;gap:8px;max-height:450px;overflow:auto}',
+        '.gho-diff-hunk{border:1px solid var(--dsw-alias-border-l2);border-radius:8px;overflow:hidden;background:var(--dsw-alias-bg-layer-3)}',
+        '.gho-diff-hunk-head{display:flex;align-items:center;justify-content:space-between;padding:4px 8px;background:rgba(99,102,241,0.08);border-bottom:1px solid var(--dsw-alias-border-l2);font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:11px}',
+        '.gho-diff-hunk-title{color:var(--dsw-alias-label-secondary);font-weight:600}',
+        '.gho-diff-hunk-body{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:12px;line-height:1.45}',
+        '.gho-diff-line{display:flex;white-space:pre}',
+        '.gho-diff-char{width:20px;user-select:none;text-align:center;flex-shrink:0}',
+        '.gho-diff-text{flex:1;overflow-x:auto}',
+        '.gho-diff-add{background:rgba(34,197,94,0.12);color:var(--dsw-alias-label-primary)}',
+        '.gho-diff-add .gho-diff-char{color:#22c55e}',
+        '.gho-diff-del{background:rgba(239,68,68,0.12);color:var(--dsw-alias-label-primary)}',
+        '.gho-diff-del .gho-diff-char{color:#ef4444}',
+        '.gho-diff-hunk_header{background:rgba(99,102,241,0.05);color:var(--dsw-alias-label-secondary);padding:2px 8px}',
+        '.gho-diff-meta{color:var(--dsw-alias-label-tertiary)}',
+        '.gho-git-graph{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:11px;max-height:220px;overflow:auto;padding:8px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-layer-3);display:flex;flex-direction:column;gap:3px}',
+        '.gho-graph-row{display:flex;align-items:center;gap:6px;white-space:nowrap}',
+        '.gho-graph-conn{color:var(--dsw-alias-label-tertiary)}',
+        '.gho-graph-glyph{font-weight:700;color:#6366f1;white-space:pre}',
+        '.gho-graph-sha{color:#f59e0b;font-weight:600}',
+        '.gho-graph-refs{display:inline-flex;gap:4px}',
+        '.gho-graph-ref{background:rgba(99,102,241,0.15);color:#818cf8;border-radius:4px;padding:1px 5px;font-size:10px}',
+        '.gho-graph-msg{color:var(--dsw-alias-label-primary);overflow:hidden;text-overflow:ellipsis}',
+        '.gho-graph-meta{color:var(--dsw-alias-label-tertiary);margin-left:auto;padding-left:8px;font-size:10px}',
+        '.gho-toasts{position:fixed;bottom:16px;right:16px;z-index:99999;display:flex;flex-direction:column;gap:8px;pointer-events:none}',
+        '.gho-toast{pointer-events:auto;min-width:240px;max-width:360px;padding:8px 12px;border-radius:8px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);box-shadow:0 4px 12px rgba(0,0,0,0.15);font-size:12px;display:flex;flex-direction:column;gap:2px}',
+        '.gho-toast-success{border-left:4px solid #22c55e}',
+        '.gho-toast-warn{border-left:4px solid #ef4444}',
+        '.gho-toast-info{border-left:4px solid #6366f1}',
       ].join('\n')
       document.head.appendChild(style)
     }

package/lib/events.js

@@ -0,0 +1,201 @@
+// Server-Sent Events (SSE) notification manager for CI runs and PR events.
+//
+// Maintains client subscriptions, broadcasts real-time events, and runs an adaptive
+// background polling loop only when at least one client is connected, conserving
+// GitHub API rate limits.
+
+import { listRuns } from './tools/actions.js'
+import { listIssues } from './tools/issues.js'
+
+export class SseEventManager {
+  constructor({ client, liveConfig, describeError, baseIntervalMs = 60000, activeIntervalMs = 15000 } = {}) {
+    this.client = client || (async () => null)
+    this.liveConfig = liveConfig || (() => ({}))
+    this.describeError = describeError || ((e) => String((e && e.message) || e))
+    this.baseIntervalMs = baseIntervalMs
+    this.activeIntervalMs = activeIntervalMs
+
+    this.clients = new Set()
+    this.timer = null
+    this.isPolling = false
+    this.lastRuns = new Map() // runId -> { status, conclusion }
+    this.lastPulls = new Map() // pullNumber -> { updated, state }
+    this.hasActiveWork = false
+  }
+
+  get clientCount() {
+    return this.clients.size
+  }
+
+  addClient(res, req) {
+    this.clients.add(res)
+
+    try {
+      res.write(': connected\n\n')
+      res.write(`data: ${JSON.stringify({ type: 'connected', clients: this.clients.size, timestamp: Date.now() })}\n\n`)
+    } catch {
+      this.clients.delete(res)
+      return
+    }
+
+    if (req) {
+      req.on('close', () => {
+        this.removeClient(res)
+      })
+    }
+
+    if (this.clients.size === 1) {
+      this.startPolling()
+    }
+  }
+
+  removeClient(res) {
+    this.clients.delete(res)
+    if (this.clients.size === 0) {
+      this.stopPolling()
+    }
+  }
+
+  broadcast(event, data) {
+    if (this.clients.size === 0) return
+    const payload = `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`
+    for (const res of Array.from(this.clients)) {
+      try {
+        res.write(payload)
+      } catch {
+        this.clients.delete(res)
+      }
+    }
+    if (this.clients.size === 0) {
+      this.stopPolling()
+    }
+  }
+
+  startPolling() {
+    if (this.timer) return
+    this.scheduleNext(1000)
+  }
+
+  stopPolling() {
+    if (this.timer) {
+      clearTimeout(this.timer)
+      this.timer = null
+    }
+  }
+
+  scheduleNext(delayMs) {
+    if (this.timer) clearTimeout(this.timer)
+    if (this.clients.size === 0) return
+    const delay = typeof delayMs === 'number' ? delayMs : (this.hasActiveWork ? this.activeIntervalMs : this.baseIntervalMs)
+    this.timer = setTimeout(() => {
+      this.poll().finally(() => {
+        if (this.clients.size > 0) {
+          this.scheduleNext()
+        }
+      })
+    }, delay)
+    if (this.timer && typeof this.timer.unref === 'function') {
+      this.timer.unref()
+    }
+  }
+
+  async poll() {
+    if (this.isPolling) return
+    this.isPolling = true
+    try {
+      const cfg = this.liveConfig()
+      const owner = cfg.owner
+      const repo = cfg.repo
+      if (!owner || !repo) {
+        this.hasActiveWork = false
+        return
+      }
+
+      const github = await this.client()
+      if (!github) {
+        this.hasActiveWork = false
+        return
+      }
+
+      // 1. Check CI workflow runs
+      let runs = []
+      try {
+        const runsResult = await listRuns(github, { owner, repo, limit: 10 })
+        runs = (runsResult && runsResult.runs) || []
+      } catch {
+        // ignore fetch error during polling
+      }
+
+      let activeRunsFound = false
+      for (const run of runs) {
+        const id = run.id
+        const status = run.status
+        const conclusion = run.conclusion
+        if (status === 'in_progress' || status === 'queued') {
+          activeRunsFound = true
+        }
+        const previous = this.lastRuns.get(id)
+        if (previous) {
+          if (previous.status !== status || previous.conclusion !== conclusion) {
+            this.broadcast('ci_status', {
+              id,
+              name: run.name,
+              status,
+              conclusion,
+              html_url: run.html_url,
+              head_branch: run.head_branch,
+              head_sha: run.head_sha ? run.head_sha.slice(0, 7) : '',
+              timestamp: Date.now(),
+            })
+          }
+        }
+        this.lastRuns.set(id, { status, conclusion })
+      }
+
+      // 2. Check open Pull Requests
+      let pulls = []
+      try {
+        const pullsResult = await listIssues(github, { owner, repo, kind: 'pr', state: 'open', limit: 10 })
+        pulls = (pullsResult && pullsResult.issues) || []
+      } catch {
+        // ignore fetch error during polling
+      }
+
+      for (const pr of pulls) {
+        const number = pr.number
+        const previous = this.lastPulls.get(number)
+        const updated = pr.updatedAt || pr.updated_at || pr.updated
+        if (previous && previous.updated !== updated) {
+          this.broadcast('pr_status', {
+            number,
+            title: pr.title,
+            state: pr.state,
+            user: pr.author || (pr.user && pr.user.login) || '',
+            updated_at: updated,
+            html_url: pr.html_url || '',
+            timestamp: Date.now(),
+          })
+        }
+        this.lastPulls.set(number, { updated, state: pr.state })
+      }
+
+      this.hasActiveWork = activeRunsFound
+    } catch {
+      // do not crash on polling errors
+    } finally {
+      this.isPolling = false
+    }
+  }
+
+  destroy() {
+    this.stopPolling()
+    for (const res of this.clients) {
+      try {
+        res.end()
+      } catch {}
+    }
+    this.clients.clear()
+    this.lastRuns.clear()
+    this.lastPulls.clear()
+  }
+}

package/lib/index.js

@@ -44,22 +44,38 @@ const callContext = new AsyncLocalStorage()
 
 /** git runner: never throws, always answers with a code and both streams. */
 function makeGitRunner() {
-  return async (args, { cwd, env, timeoutMs, timeout } = {}) => {
-    try {
-      const { stdout, stderr } = await execFileAsync('git', args, {
-        cwd: cwd || process.cwd(),
-        env: { ...process.env, ...(env || {}) },
-        timeout: typeof timeoutMs === 'number' ? timeoutMs : (typeof timeout === 'number' ? timeout : undefined),
-        maxBuffer: 8 * 1024 * 1024,
-      })
-      return { code: 0, stdout, stderr }
-    } catch (err) {
-      return {
-        code: typeof err.code === 'number' ? err.code : 1,
-        stdout: err.stdout || '',
-        stderr: err.stderr || String((err && err.message) || err),
+  return async (args, { cwd, env, timeoutMs, timeout, input } = {}) => {
+    return new Promise((resolve) => {
+      const child = execFile(
+        'git',
+        args,
+        {
+          cwd: cwd || process.cwd(),
+          env: { ...process.env, ...(env || {}) },
+          timeout: typeof timeoutMs === 'number' ? timeoutMs : (typeof timeout === 'number' ? timeout : undefined),
+          maxBuffer: 8 * 1024 * 1024,
+        },
+        (err, stdout, stderr) => {
+          if (err) {
+            resolve({
+              code: typeof err.code === 'number' ? err.code : 1,
+              stdout: stdout || (err && err.stdout) || '',
+              stderr: stderr || (err && err.stderr) || String((err && err.message) || err),
+            })
+          } else {
+            resolve({
+              code: 0,
+              stdout: stdout || '',
+              stderr: stderr || '',
+            })
+          }
+        }
+      )
+      if (input !== undefined && input !== null && child.stdin) {
+        child.stdin.on('error', () => {})
+        child.stdin.end(input)
       }
-    }
+    })
   }
 }
 

package/lib/routes.js

@@ -10,7 +10,9 @@ import { join as joinPath } from 'node:path'
 
 import { statusPayload, isTrustedRequest, isTrustedWriteRequest, sendJson } from './status.js'
 import { buildAction, validateCwd, validateStashRef, resolveConflictFile } from './scm-write.js'
-import { parseStatus, parseBranches, parseStashes, parseWorktrees, parseCount, scmPayload, mergeStateFrom, hasConflicts, parseConflictBlocks } from './scm.js'
+import { parseStatus, parseBranches, parseStashes, parseWorktrees, parseCount, scmPayload, mergeStateFrom, hasConflicts, parseConflictBlocks, parseDiffHunks, parseGitGraph } from './scm.js'
+import { SseEventManager } from './events.js'
+import { encodeRepoPath } from './github.js'
 import { listIssues } from './tools/issues.js'
 import { listRuns } from './tools/actions.js'
 import { listNotifications, repoTreeView } from './tools/panel-data.js'
@@ -32,6 +34,12 @@ export const MIRROR_PATH = '/dsh-github-ops/mirror'
 /** Where organization matrix status is read. */
 export const MATRIX_PATH = '/dsh-github-ops/matrix'
 
+/** Where Git commit graph is read. */
+export const GRAPH_PATH = '/dsh-github-ops/graph'
+
+/** Where real-time CI and PR events are streamed via SSE. */
+export const EVENTS_PATH = '/dsh-github-ops/events'
+
 /**
  * Register the three routes.
  *
@@ -176,7 +184,7 @@ export function registerRoutes(ctx, deps = {}) {
             }
             const steps = []
             for (const argv of built.steps) {
-              const answer = await git(argv, { cwd, timeoutMs: 120000 })
+              const answer = await git(argv, { cwd, timeoutMs: 120000, input: built.input })
               steps.push({
                 argv,
                 code: answer.code,
@@ -209,10 +217,12 @@ export function registerRoutes(ctx, deps = {}) {
             } catch {
               // ignore
             }
+            const hunks = diff.code === 0 ? parseDiffHunks(text) : []
             return sendJson(res, 200, {
               file,
               staged,
               diff: String(text || '').slice(0, 200000),
+              hunks,
               hasConflicts: hasConflictsFlag,
               conflicts,
             })
@@ -458,6 +468,67 @@ export function registerRoutes(ctx, deps = {}) {
       if (typeof wctx.effect === 'function') wctx.effect(registerMatrix, 'dsh-github-ops: matrix route')
       else registerMatrix()
 
+      const registerGraph = () => wctx.webServer.register({
+        kind: 'exact',
+        path: GRAPH_PATH,
+        handler: async (req, res) => {
+          try {
+            if (req.method !== 'GET') return sendJson(res, 405, { error: 'method not allowed' })
+            if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+            const git = makeGitRunner()
+            const url = new URL(req.url || '/', 'http://localhost')
+            const requested = validateCwd(url.searchParams.get('cwd') || '')
+            let cwd = safeCwd(ctx)
+            if (requested) {
+              if (!existsSync(requested) || !statSync(requested).isDirectory()) {
+                return sendJson(res, 400, { error: `not a directory: ${requested}` })
+              }
+              cwd = requested
+            }
+            const limitParam = parseInt(url.searchParams.get('limit') || '15', 10)
+            const limit = Math.max(1, Math.min(Number.isFinite(limitParam) ? limitParam : 15, 50))
+            const answer = await git(['log', `-n`, String(limit), '--graph', '--date=short', '--format=format:%h|%d|%s|%an|%cd'], { cwd })
+            if (answer.code !== 0) {
+              return sendJson(res, 200, { ok: false, error: answer.stderr || 'git log failed', entries: [] })
+            }
+            const entries = parseGitGraph(answer.stdout)
+            return sendJson(res, 200, { ok: true, limit, entries, raw: answer.stdout })
+          } catch (err) {
+            return sendJson(res, 500, { ok: false, error: describeError(err) })
+          }
+        },
+      })
+      if (typeof wctx.effect === 'function') wctx.effect(registerGraph, 'dsh-github-ops: graph route')
+      else registerGraph()
+
+      const eventManager = new SseEventManager({
+        client,
+        liveConfig,
+        describeError,
+      })
+      if (typeof wctx.effect === 'function') {
+        wctx.effect(() => () => eventManager.destroy(), 'dsh-github-ops: events teardown')
+      }
+
+      const registerEvents = () => wctx.webServer.register({
+        kind: 'exact',
+        path: EVENTS_PATH,
+        handler: async (req, res) => {
+          if (req.method !== 'GET') return sendJson(res, 405, { error: 'method not allowed' })
+          if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+          res.writeHead(200, {
+            'Content-Type': 'text/event-stream',
+            'Cache-Control': 'no-cache, no-transform',
+            'Connection': 'keep-alive',
+            'X-Accel-Buffering': 'no',
+          })
+          if (typeof res.flushHeaders === 'function') res.flushHeaders()
+          eventManager.addClient(res, req)
+        },
+      })
+      if (typeof wctx.effect === 'function') wctx.effect(registerEvents, 'dsh-github-ops: events route')
+      else registerEvents()
+
     } catch (err) {
       ctx.logger?.warn?.('[dsh-github-ops] panel route not registered:', err && err.message)
     }
@@ -469,7 +540,7 @@ export function registerRoutes(ctx, deps = {}) {
  * Read a small JSON body, bounded, so a POST that names an action cannot exhaust memory.
  * The panel sends a few hundred bytes; anything larger is refused rather than buffered.
  */
-function readJsonBody(req, limit = 64 * 1024) {
+function readJsonBody(req, limit = 512 * 1024) {
   return new Promise((resolve, reject) => {
     let size = 0
     const chunks = []

package/lib/scm-write.js

@@ -1,5 +1,5 @@
 import { realpathSync, existsSync, readFileSync, writeFileSync } from 'node:fs'
-import { join as joinPath } from 'node:path'
+import { join as joinPath, posix, win32 } from 'node:path'
 import { hasConflicts, resolveConflictContent } from './scm.js'
 // Writing to a working copy, from the Source Control tab.
 //
@@ -46,6 +46,19 @@ export function validateStashRef(ref) {
   return value
 }
 
+
+export function validatePatch(patch) {
+  const value = String(patch == null ? '' : patch)
+  if (value.includes('\u0000')) throw new Error('refusing a patch with a NUL byte')
+  const trimmed = value.trim()
+  if (!trimmed) throw new Error('a patch cannot be empty')
+  if (trimmed.length > 500000) throw new Error('refusing a patch longer than 500000 characters')
+  if (!trimmed.includes('@@') && !trimmed.includes('---')) {
+    throw new Error('refusing an invalid patch format: missing diff hunk markers')
+  }
+  return value
+}
+
 const CONTINUE_VERBS = ['merge', 'rebase', 'cherry-pick', 'revert']
 
 /**
@@ -115,6 +128,20 @@ export function buildAction(action, args = {}) {
       const verb = String(args.verb || '').trim()
       if (!CONTINUE_VERBS.includes(verb)) throw new Error(`refusing to abort an unknown operation: "${verb.slice(0, 20)}"`)
       return result(name, [[verb, '--abort']], destructive, `abort the ${verb}`)
+    }
+        case 'stagePatch':
+    case 'stage_patch': {
+      const patch = validatePatch(args.patch)
+      const res = result('stage_patch', [['apply', '--cached', '-']], false, 'stage patch hunk')
+      res.input = patch
+      return res
+    }
+    case 'unstagePatch':
+    case 'unstage_patch': {
+      const patch = validatePatch(args.patch)
+      const res = result('unstage_patch', [['apply', '--cached', '--reverse', '-']], false, 'unstage patch hunk')
+      res.input = patch
+      return res
     }
     case 'resolveConflict': {
       const path = validatePath(args.path)
@@ -179,29 +206,47 @@ export const OPERATION_VERBS = Object.freeze(CONTINUE_VERBS.slice())
  */
 const DISALLOWED_ROOTS = ['/etc', '/proc', '/sys', '/dev', '/root', '/bin', '/sbin', '/usr', '/boot', '/var/run']
 
+function checkDisallowed(p) {
+  const norm = p.replace(/\\/g, '/')
+  for (const root of DISALLOWED_ROOTS) {
+    if (norm === root || norm.startsWith(root + '/')) {
+      throw new Error(`access to system directory "${root}" is not allowed`)
+    }
+  }
+  const driveMatch = norm.match(/^[a-zA-Z]:(\/.*)?$/)
+  if (driveMatch) {
+    const sub = (driveMatch[1] || '/').toLowerCase()
+    if (sub === '/' || sub === '') {
+      throw new Error('access to system drive root is not allowed')
+    }
+    for (const winDir of ['/windows', '/winnt', '/system32', '/boot']) {
+      if (sub === winDir || sub.startsWith(winDir + '/')) {
+        throw new Error(`access to system directory "${winDir.slice(1)}" is not allowed`)
+      }
+    }
+  }
+}
+
 export function validateCwd(path) {
   const value = String(path == null ? '' : path).trim()
   if (!value) return ''
-  if (!value.startsWith('/')) throw new Error('a repository path must be absolute')
+  if (!posix.isAbsolute(value) && !win32.isAbsolute(value)) {
+    throw new Error('a repository path must be absolute')
+  }
   if (value.includes('..')) throw new Error('a repository path may not contain ".."')
   if (/[\x00-\x1f]/.test(value)) throw new Error('a repository path may not contain control characters')
   if (value.length > 500) throw new Error('a repository path is too long')
-  for (const root of DISALLOWED_ROOTS) {
-    if (value === root || value.startsWith(root + '/')) {
-      throw new Error(`access to system directory "${root}" is not allowed`)
-    }
-  }
+
+  checkDisallowed(value)
+
   let realPath = value
   try {
     realPath = realpathSync(value)
   } catch {
     realPath = value
   }
-  for (const root of DISALLOWED_ROOTS) {
-    if (realPath === root || realPath.startsWith(root + '/')) {
-      throw new Error(`access to system directory "${root}" is not allowed`)
-    }
-  }
+  checkDisallowed(realPath)
+
   return value
 }
 

package/lib/scm.js

@@ -334,3 +334,109 @@ export function resolveConflictContent(content, resolutions = 'ours') {
 
   return resultLines.join(eol)
 }
+
+/**
+ * Splits a unified diff into individual hunks with their headers and ready-to-apply patches.
+ */
+export function parseDiffHunks(diffText) {
+  if (typeof diffText !== 'string' || !diffText.trim()) return []
+  const lines = diffText.split('\n')
+  const fileHeaderLines = []
+  let i = 0
+  while (i < lines.length && !lines[i].startsWith('@@')) {
+    fileHeaderLines.push(lines[i])
+    i++
+  }
+  const fileHeader = fileHeaderLines.length > 0 ? fileHeaderLines.join('\n') + '\n' : ''
+
+  const hunks = []
+  let currentHunk = null
+
+  while (i < lines.length) {
+    const line = lines[i]
+    if (line.startsWith('@@')) {
+      if (currentHunk) {
+        currentHunk.patch = fileHeader + currentHunk.lines.map((l) => l.raw).join('\n') + '\n'
+        hunks.push(currentHunk)
+      }
+      const match = line.match(/^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(.*)$/)
+      currentHunk = {
+        header: line,
+        oldStart: match ? parseInt(match[1], 10) : 0,
+        oldCount: match ? (match[2] !== undefined ? parseInt(match[2], 10) : 1) : 0,
+        newStart: match ? parseInt(match[3], 10) : 0,
+        newCount: match ? (match[4] !== undefined ? parseInt(match[4], 10) : 1) : 0,
+        heading: match ? match[5].trim() : '',
+        lines: [{ type: 'hunk_header', text: line, raw: line }],
+        patch: '',
+      }
+    } else if (currentHunk) {
+      let type = 'context'
+      if (line.startsWith('+')) type = 'add'
+      else if (line.startsWith('-')) type = 'del'
+      else if (line.startsWith('\\')) type = 'meta'
+      currentHunk.lines.push({ type, text: line, raw: line })
+    }
+    i++
+  }
+
+  if (currentHunk) {
+    currentHunk.patch = fileHeader + currentHunk.lines.map((l) => l.raw).join('\n') + '\n'
+    hunks.push(currentHunk)
+  }
+
+  return hunks
+}
+
+/**
+ * Parses git log --graph --date=short --format=format:'%h|%d|%s|%an|%cd' output.
+ */
+export function parseGitGraph(text) {
+  if (typeof text !== 'string' || !text.trim()) return []
+  const lines = text.split('\n')
+  const results = []
+
+  for (const rawLine of lines) {
+    if (!rawLine.trim()) continue
+    const match = rawLine.match(/^([*|/\\_\-\s]*?)\s*([0-9a-f]{7,40})\|([^|]*)\|([^|]*)\|([^|]*)\|(.*)$/)
+    if (match) {
+      const graph = match[1] || '*'
+      const hash = match[2]
+      const rawRefs = match[3].trim()
+      const subject = match[4].trim()
+      const author = match[5].trim()
+      const date = match[6].trim()
+
+      let refs = []
+      if (rawRefs) {
+        const cleanRefs = rawRefs.replace(/^\(|\)$/g, '').trim()
+        if (cleanRefs) {
+          refs = cleanRefs.split(',').map((r) => r.trim()).filter(Boolean)
+        }
+      }
+      results.push({
+        isCommit: true,
+        graph,
+        hash,
+        refs,
+        subject,
+        author,
+        date,
+        raw: rawLine,
+      })
+    } else {
+      results.push({
+        isCommit: false,
+        graph: rawLine,
+        hash: '',
+        refs: [],
+        subject: '',
+        author: '',
+        date: '',
+        raw: rawLine,
+      })
+    }
+  }
+
+  return results
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-github-ops",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "GitHub operations for DeepSeek Harness: releases, tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror publication.",
   "license": "MIT",
   "type": "module",