@hienlh/ppm 0.19.12 → 0.20.0

package/src/server/routes/git.ts

@@ -1,5 +1,7 @@
 import { Hono } from "hono";
 import { gitService } from "../../services/git.service.ts";
+import { gitHunksService, type HunkRequest, type HunkScope } from "../../services/git-hunks/git-hunks.service.ts";
+import { gitBlameService } from "../../services/git-blame/git-blame.service.ts";
 import { ok, err } from "../../types/api.ts";
 
 type Env = { Variables: { projectPath: string; projectName: string } };
@@ -163,6 +165,101 @@ gitRoutes.post("/unstage", async (c) => {
   }
 });
 
+/**
+ * GET /git/blame?path=&rev= — the whole file's blame, for the editor annotation.
+ *
+ * `rev` blames the file as it stood at that revision, which is what each side of
+ * the diff viewer needs; omitted, it blames the working tree.
+ */
+gitRoutes.get("/blame", async (c) => {
+  try {
+    const projectPath = c.get("projectPath");
+    const filePath = c.req.query("path");
+    if (!filePath) return c.json(err("Missing: path"), 400);
+    const rev = c.req.query("rev") || undefined;
+    const result = await gitBlameService.blameFile(projectPath, filePath, rev);
+    // Untracked, or absent at that revision — not an error the UI should show.
+    return c.json(ok(result ?? { lines: [], commits: {} }));
+  } catch (e) {
+    return c.json(err((e as Error).message), 500);
+  }
+});
+
+/** GET /git/hunks?path=&scope=worktree|index — the hunks the UI selects from */
+gitRoutes.get("/hunks", async (c) => {
+  try {
+    const projectPath = c.get("projectPath");
+    const filePath = c.req.query("path");
+    if (!filePath) return c.json(err("Missing: path"), 400);
+    const scope = c.req.query("scope") === "index" ? "index" : "worktree";
+    const result = await gitHunksService.getHunks(projectPath, filePath, scope as HunkScope);
+    return c.json(ok(result));
+  } catch (e) {
+    return c.json(err((e as Error).message), 500);
+  }
+});
+
+/**
+ * Hunk-level staging. Each entry carries the `id` that `GET /git/hunks` gave
+ * for that hunk; a hunk without `lines` is taken whole.
+ *
+ * `id` is required, and that is the whole safety property: the service reads
+ * the diff again at apply time, so a positional index alone would be resolved
+ * against a *different* list than the one the user ticked and would stage
+ * whatever now sits at that position. `git apply` cannot catch it either,
+ * because the patch is built from the fresh diff and therefore applies. An
+ * entry with no `id` is refused rather than trusted.
+ */
+function readHunkBody(body: { path?: string; hunks?: HunkRequest[] }): { filePath: string; hunks: HunkRequest[] } | string {
+  if (!body.path) return "Missing: path";
+  if (!Array.isArray(body.hunks) || body.hunks.length === 0) return "Missing: hunks";
+  for (const entry of body.hunks) {
+    if (!entry || typeof entry.id !== "string" || entry.id.length === 0) {
+      return "Each hunk needs the id it was listed with";
+    }
+  }
+  return { filePath: body.path, hunks: body.hunks };
+}
+
+/** POST /git/stage-hunks { path, hunks: [{ hunk, id, lines? }] } */
+gitRoutes.post("/stage-hunks", async (c) => {
+  try {
+    const projectPath = c.get("projectPath");
+    const parsed = readHunkBody(await c.req.json());
+    if (typeof parsed === "string") return c.json(err(parsed), 400);
+    await gitHunksService.stage(projectPath, parsed.filePath, parsed.hunks);
+    return c.json(ok({ staged: parsed.filePath }));
+  } catch (e) {
+    return c.json(err((e as Error).message), 500);
+  }
+});
+
+/** POST /git/unstage-hunks { path, hunks: [{ hunk, id, lines? }] } */
+gitRoutes.post("/unstage-hunks", async (c) => {
+  try {
+    const projectPath = c.get("projectPath");
+    const parsed = readHunkBody(await c.req.json());
+    if (typeof parsed === "string") return c.json(err(parsed), 400);
+    await gitHunksService.unstage(projectPath, parsed.filePath, parsed.hunks);
+    return c.json(ok({ unstaged: parsed.filePath }));
+  } catch (e) {
+    return c.json(err((e as Error).message), 500);
+  }
+});
+
+/** POST /git/discard-hunks { path, hunks: [{ hunk, id, lines? }] } — not recoverable */
+gitRoutes.post("/discard-hunks", async (c) => {
+  try {
+    const projectPath = c.get("projectPath");
+    const parsed = readHunkBody(await c.req.json());
+    if (typeof parsed === "string") return c.json(err(parsed), 400);
+    await gitHunksService.discard(projectPath, parsed.filePath, parsed.hunks);
+    return c.json(ok({ discarded: parsed.filePath }));
+  } catch (e) {
+    return c.json(err((e as Error).message), 500);
+  }
+});
+
 /** POST /git/commit { message, amend? } */
 gitRoutes.post("/commit", async (c) => {
   try {

package/src/server/routes/settings.ts

@@ -112,6 +112,7 @@ const UI_PREFS_KEY = "ui_prefs";
 /** Whitelisted UI pref keys with their validators */
 const UI_PREF_VALIDATORS: Record<string, (v: unknown) => boolean> = {
   wordWrap: (v) => typeof v === "boolean",
+  inlineBlame: (v) => typeof v === "boolean",
   tabWrap: (v) => typeof v === "boolean",
   sidebarCollapsed: (v) => typeof v === "boolean",
   remoteDesktopStatsVisible: (v) => typeof v === "boolean",

package/src/server/routes/teams.ts

@@ -44,7 +44,13 @@ teamRoutes.get("/:name/activity", async (c) => {
   return c.json(ok({ members, outbound }));
 });
 
-/** Full transcript of one teammate's work session, for the member window. */
+/**
+ * One teammate's work session, for the member window.
+ *
+ * `sinceBytes` makes this pollable: the window keeps the offset it has consumed
+ * and gets back only the steps appended since, because a teammate transcript is
+ * several MB and a working teammate appends to it continuously.
+ */
 teamRoutes.get("/:name/members/:member/transcript", async (c) => {
   const name = c.req.param("name");
   const member = c.req.param("member");
@@ -55,8 +61,13 @@ teamRoutes.get("/:name/members/:member/transcript", async (c) => {
   );
   const path = resolveMemberTranscript(name, member, c.req.query("projectPath") ?? null);
   if (!path) return c.json(err("Member transcript not found"), 404);
-  const { parseAgentTranscript } = await import("../../services/subagent-transcript-merger.ts");
-  return c.json(ok({ member, events: parseAgentTranscript(path) }));
+  const parsedSince = Number(c.req.query("sinceBytes") ?? 0);
+  const sinceBytes = Number.isFinite(parsedSince) && parsedSince > 0 ? Math.floor(parsedSince) : 0;
+  const { readMemberTranscriptSlice } = await import(
+    "../../services/team-member-activity/member-transcript-tail.ts"
+  );
+  const slice = readMemberTranscriptSlice(path, sinceBytes);
+  return c.json(ok({ member, ...slice }));
 });
 
 teamRoutes.delete("/:name", async (c) => {

package/src/services/account-selector.service.ts

@@ -21,6 +21,18 @@ const FIVE_HOUR_SKIP_THRESHOLD = 0.95;
 /** Weekly utilization at which an account has nothing left to give until its reset. */
 const WEEKLY_EXHAUSTED_UTIL = 1.0;
 
+/**
+ * Whether a utilisation reads as a reached cap.
+ *
+ * Rounded to whole percent because that is what the usage bars display, and a refusal has to
+ * agree with the number the user is looking at. On the raw value, 0.996 is "not yet at the
+ * cap" while the card beside it already says 100% — so the button stayed enabled on an
+ * account the user could see was finished.
+ */
+function atCap(util: number | null | undefined): boolean {
+  return Math.round((util ?? 0) * 100) >= 100;
+}
+
 class AccountSelectorService {
   private cursor = 0;
   private retryCounts = new Map<string, number>();
@@ -96,6 +108,96 @@ class AccountSelectorService {
     return acc.status === "active" || (!cooldownOn && acc.status === "cooldown");
   }
 
+  /**
+   * Whether an account still holds a token it could authenticate with.
+   *
+   * An account with no refresh token whose access token has already expired cannot serve
+   * anything: there is no way back to a live token without a fresh sign-in. Picking one
+   * only moves the failure later, into the middle of a turn, where it costs a retry and
+   * an account switch instead of simply being skipped here.
+   *
+   * Same test the enable path and the account card use, so a card reading "Expired" and
+   * the router agreeing it is unusable can never drift apart.
+   *
+   * Three outcomes, not two. A token that cannot be decrypted is deliberately kept in the
+   * pool: that is the machine-key mismatch, which has its own diagnostic downstream ("copy
+   * ~/.ppm/account.key from the original machine"). Dropping those accounts here would
+   * leave the caller reporting them as merely disabled and swallow the one message that
+   * actually tells the user what went wrong.
+   *
+   * The decrypt only runs for an account whose access token has already expired, so the
+   * cipher stays off the hot path for the healthy case.
+   */
+  private hasUsableToken(accountId: string): boolean {
+    const acc = accountService.list().find((a) => a.id === accountId);
+    if (!acc) return false;
+    // A grant the server has rejected is refused by `ensureFreshTokenChecked` before it even
+    // looks at how fresh the access token is, so such an account cannot serve a turn no
+    // matter what it still holds. Routing to it only moves that refusal into the middle of
+    // a request.
+    if (acc.reauthRequired) return false;
+    if (!acc.expiresAt) return true;
+    if (acc.expiresAt >= Math.floor(Date.now() / 1000)) return true;
+    const withTokens = accountService.getWithTokens(accountId);
+    if (!withTokens) return true; // undecryptable — not this filter's call to make
+    return withTokens.refreshToken.length > 0;
+  }
+
+  /**
+   * The hard test: an account that fails this cannot serve a turn at all.
+   *
+   * Kept separate from [[hasQuotaRoom]] on purpose. Quota is a soft limit — when every
+   * account is near its cap the router still hands one back, because a throttled turn beats
+   * no turn. A dead token has no such fallback: there is nothing on the other side of it,
+   * so it is filtered out with no escape hatch.
+   */
+  private isUsable(accountId: string): boolean {
+    return this.isSelectable(accountId) && this.hasUsableToken(accountId);
+  }
+
+  /**
+   * Whether an account has actually reached a cap, as opposed to merely being close to one.
+   *
+   * Distinct from [[hasQuotaRoom]], which treats 95% as "no room" so the router steers away
+   * early. That margin is right for routing and wrong for a refusal: an account at 96% still
+   * answers. At 100% it does not — the next turn fails outright — and that is the only point
+   * at which telling a user "no" is honest.
+   */
+  private isExhausted(accountId: string): boolean {
+    const snap = getLatestSnapshotForAccount(accountId);
+    if (!snap) return false;
+    return atCap(snap.five_hour_util) || atCap(snap.weekly_util);
+  }
+
+  /**
+   * Whether this account could serve a turn if a caller asked for it by name.
+   *
+   * Looser than the router's own filter in one direction and stricter in another. An account
+   * merely near its cap is allowed — naming it is a choice to accept a slower turn. An
+   * account that has reached its cap is not, because the turn would simply fail, and neither
+   * is one that is disabled or out of a live token.
+   */
+  canServe(accountId: string): boolean {
+    return this.isUsable(accountId) && !this.isExhausted(accountId);
+  }
+
+  /** Why [[canServe]] said no, in words a user can act on. Null when it said yes. */
+  refusalReason(accountId: string): string | null {
+    const acc = accountService.list().find((a) => a.id === accountId);
+    if (!acc) return "That account no longer exists.";
+    if (!this.isSelectable(accountId)) return "That account is switched off.";
+    if (!this.hasUsableToken(accountId)) return "That account needs to be signed in again.";
+    if (this.isExhausted(accountId)) {
+      const snap = getLatestSnapshotForAccount(accountId);
+      const weekly = (snap?.weekly_util ?? 0) >= 1;
+      const resetsAt = weekly ? snap?.weekly_resets_at : snap?.five_hour_resets_at;
+      const window = weekly ? "weekly" : "5-hour";
+      const when = resetsAt ? ` It resets at ${new Date(resetsAt).toLocaleString()}.` : "";
+      return `That account has reached its ${window} limit.${when}`;
+    }
+    return null;
+  }
+
   /**
    * Whether an account has quota left to serve a turn.
    *
@@ -118,10 +220,9 @@ class AccountSelectorService {
    * "everything is near the cap, take one anyway" — a distinction a binding must not ignore.
    */
   private anyAccountHasQuotaRoom(excludeIds?: Set<string>): boolean {
-    const cooldownOn = this.isCooldownEnabled();
     return accountService.list().some((a) => {
       if (excludeIds?.has(a.id)) return false;
-      if (!(a.status === "active" || (!cooldownOn && a.status === "cooldown"))) return false;
+      if (!this.isUsable(a.id)) return false;
       return this.hasQuotaRoom(a.id);
     });
   }
@@ -141,7 +242,7 @@ class AccountSelectorService {
   forSession(sessionId: string, excludeIds?: Set<string>): AccountWithTokens | null {
     this.clearExpiredCooldowns();
     const boundId = getSessionAccount(sessionId);
-    if (boundId && !excludeIds?.has(boundId) && this.isSelectable(boundId)) {
+    if (boundId && !excludeIds?.has(boundId) && this.isUsable(boundId)) {
       // Hold the binding while it has room, and also when nothing else does. In that second
       // case next() falls back to returning a near-capped account anyway, and round-robin
       // would hand back a different one each turn — paying a full cache write per turn to
@@ -173,12 +274,11 @@ class AccountSelectorService {
     this._lastFailReason = "none";
     this.clearExpiredCooldowns();
 
-    // When cooldown is disabled, treat parked (cooldown) accounts as selectable too —
-    // any leftover cooldown from before the flag flip shouldn't lock an account out.
-    const cooldownOn = this.isCooldownEnabled();
-    const active = accountService.list().filter(
-      (a) => a.status === "active" || (!cooldownOn && a.status === "cooldown"),
-    );
+    // Status and token together: isUsable() keeps a parked account in the running when
+    // cooldown is switched off, and drops one whose token is past saving. Dead tokens are
+    // filtered here rather than at the quota step below, because that step falls back to
+    // "take one anyway" and an unauthenticable account must not be reachable through it.
+    const active = accountService.list().filter((a) => this.isUsable(a.id));
     // Skip accounts excluded by caller (e.g., pre-flight loop)
     const notExcluded = excludeIds?.size ? active.filter((a) => !excludeIds.has(a.id)) : active;
     if (notExcluded.length === 0) {
@@ -186,12 +286,9 @@ class AccountSelectorService {
       return null;
     }
 
-    // Proactive: skip accounts whose 5-hour utilization >= 95%
-    const usable = notExcluded.filter((a) => {
-      const snap = getLatestSnapshotForAccount(a.id);
-      return !snap || (snap.five_hour_util ?? 0) < FIVE_HOUR_SKIP_THRESHOLD;
-    });
-    const candidates = usable.length > 0 ? usable : notExcluded; // fallback to all if every account is near limit
+    // Proactive: skip accounts that are out of 5-hour or weekly room
+    const withRoom = notExcluded.filter((a) => this.hasQuotaRoom(a.id));
+    const candidates = withRoom.length > 0 ? withRoom : notExcluded; // fallback to all if every account is near limit
 
     let pickedId: string;
     const strategy = this.getStrategy();
@@ -221,21 +318,29 @@ class AccountSelectorService {
   peek(): AccountWithTokens | null {
     const now = Math.floor(Date.now() / 1000);
     const cooldownOn = this.isCooldownEnabled();
+    // Same two-tier filter next() applies: dead tokens are out with no escape hatch,
+    // out-of-quota accounts are skipped but still reachable when nothing else is left.
+    // A preview that answers from a looser filter than the router is a preview that
+    // names an account the very next turn will refuse to use.
     const active = accountService.list().filter(
-      (a) => a.status === "active" || (a.status === "cooldown" && (!cooldownOn || (a.cooldownUntil ?? 0) <= now)),
+      (a) =>
+        (a.status === "active" || (a.status === "cooldown" && (!cooldownOn || (a.cooldownUntil ?? 0) <= now)))
+        && this.hasUsableToken(a.id),
     );
     if (active.length === 0) return null;
+    const withRoom = active.filter((a) => this.hasQuotaRoom(a.id));
+    const candidates = withRoom.length > 0 ? withRoom : active;
 
     const strategy = this.getStrategy();
     let pickedId: string;
     if (strategy === "lowest-usage") {
-      pickedId = this.pickLowestUsage(active);
+      pickedId = this.pickLowestUsage(candidates);
     } else if (strategy === "fill-first") {
-      const sorted = [...active].sort((a, b) => b.priority - a.priority || a.createdAt - b.createdAt);
+      const sorted = [...candidates].sort((a, b) => b.priority - a.priority || a.createdAt - b.createdAt);
       pickedId = sorted[0]!.id;
     } else {
-      const idx = this.cursor % active.length;
-      pickedId = active[idx]!.id;
+      const idx = this.cursor % candidates.length;
+      pickedId = candidates[idx]!.id;
     }
     return accountService.getWithTokens(pickedId);
   }