@hienlh/ppm 0.20.10 → 0.21.0

package/src/services/edge-forwarder.ts

@@ -1,191 +1,191 @@
-/**
- * Edge forwarder — owns the public port and pipes raw TCP to the server's
- * current loopback port.
- *
- * ─── CRITICAL INVARIANT: THIS PROCESS MUST NEVER SPAWN A CHILD ───
- *
- * On Windows a child spawned with fd stdio inherits every inheritable handle,
- * including a listening socket. When such a descendant is orphaned it keeps the
- * socket open, so the port stays in LISTEN under a dead PID and can never be
- * rebound — a "zombie port". The server hits this constantly because it spawns
- * chat/tool/MCP subprocesses; those inherit its listener and wedge its port.
- *
- * The edge exists precisely because it spawns nothing, so its socket cannot be
- * inherited and its port cannot zombie. cloudflared can therefore stay pinned
- * to it forever and the public URL stops rotating. Adding any child-process
- * call to this file reintroduces the exact bug the edge was built to remove.
- *
- * Raw TCP, never HTTP: WebSocket upgrades and SSE streams pass through
- * untouched, and forwarded requests keep the headers cloudflared set.
- */
-import net from "node:net";
-import { resolveTargetPort, _resetTargetCache } from "./edge-target-resolver.ts";
-
-/** Delay between attempts while waiting for the server to come back. */
-const CONNECT_RETRY_MS = 250;
-/**
- * How long a client connection waits for a reachable server before giving up.
- * During an upgrade the server is briefly absent; refusing instantly would
- * surface as a broken page rather than a slow one.
- */
-const CONNECT_WINDOW_MS = 5000;
-
-const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
-
-/** Resolve once the socket is connected; reject on the first connect error. */
-function connectUpstream(port: number): Promise<net.Socket> {
-  return new Promise((resolvePromise, reject) => {
-    const upstream = net.connect({
-      port,
-      host: "127.0.0.1", // never taken from status.json — loopback only
-      allowHalfOpen: true,
-    });
-    const onError = (err: Error) => {
-      upstream.destroy();
-      reject(err);
-    };
-    upstream.once("error", onError);
-    upstream.once("connect", () => {
-      upstream.removeListener("error", onError);
-      resolvePromise(upstream);
-    });
-  });
-}
-
-/**
- * Largest amount of client data held while waiting for the server. Bounds the
- * memory a slow upload can pin during an upgrade window.
- */
-const MAX_PENDING_BYTES = 8 * 1024 * 1024;
-
-/**
- * Pipe one client connection to the server.
- *
- * Resolving the upstream is async, so the first bytes usually arrive before
- * there is anywhere to send them. They must be captured by a `data` listener
- * attached synchronously on this very tick and replayed once the upstream
- * exists.
- *
- * `socket.pause()` is NOT a substitute — verified against Bun 1.3.13: bytes
- * that arrive while paused are lost, and a later `pipe()`/`resume()` does not
- * bring them back. A socket with no `data` listener drops them outright too.
- * Both variants silently swallowed the first request in testing.
- */
-async function handleConnection(
-  client: net.Socket,
-  connectWindowMs: number,
-): Promise<void> {
-  const pending: Buffer[] = [];
-  let pendingBytes = 0;
-  let clientEnded = false;
-  const onEarlyData = (chunk: Buffer) => {
-    pendingBytes += chunk.length;
-    if (pendingBytes > MAX_PENDING_BYTES) {
-      client.destroy();
-      return;
-    }
-    pending.push(chunk);
-  };
-  client.on("data", onEarlyData);
-  client.once("end", () => { clientEnded = true; });
-
-  let upstream: net.Socket | null = null;
-  let clientGone = false;
-
-  // A socket error with no listener is an unhandled 'error' event, which would
-  // take the whole edge process — and the public port — down with it.
-  const teardown = () => {
-    upstream?.destroy();
-    client.destroy();
-  };
-  client.on("error", teardown);
-  client.once("close", () => { clientGone = true; });
-
-  const deadline = Date.now() + connectWindowMs;
-  while (!clientGone && Date.now() < deadline) {
-    const port = resolveTargetPort();
-    if (port !== null) {
-      try {
-        upstream = await connectUpstream(port);
-        break;
-      } catch {
-        // Server not up yet (or moved mid-restart) — re-resolve and retry.
-        _resetTargetCache();
-      }
-    }
-    await sleep(CONNECT_RETRY_MS);
-  }
-
-  if (clientGone) return;
-  if (!upstream) {
-    client.destroy();
-    return;
-  }
-
-  upstream.on("error", teardown);
-
-  // Replay what arrived during the connect, then hand both directions to the
-  // stream machinery. Removing the listener and piping happen in the same tick,
-  // so no chunk can slip through the gap.
-  client.off("data", onEarlyData);
-  for (const chunk of pending) upstream.write(chunk);
-  pending.length = 0;
-
-  client.pipe(upstream);
-  upstream.pipe(client);
-
-  // The client may have half-closed while we were still connecting.
-  if (clientEnded) upstream.end();
-}
-
-export interface EdgeForwarderOptions {
-  publicPort: number;
-  host?: string;
-  /** How long a client waits for a reachable server. Defaults to 5s. */
-  connectWindowMs?: number;
-}
-
-/**
- * Bind the public port and start forwarding. Resolves once listening so the
- * caller can fail fast when the port is unavailable.
- */
-export function startEdgeForwarder(
-  opts: EdgeForwarderOptions,
-): Promise<net.Server> {
-  const host = opts.host ?? "0.0.0.0";
-  const connectWindowMs = opts.connectWindowMs ?? CONNECT_WINDOW_MS;
-  return new Promise((resolvePromise, reject) => {
-    // allowHalfOpen keeps the other direction alive when one side sends FIN —
-    // long-lived chat WS and SSE streams depend on it.
-    const server = net.createServer({ allowHalfOpen: true }, (client) => {
-      void handleConnection(client, connectWindowMs);
-    });
-    server.once("error", reject);
-    server.listen(opts.publicPort, host, () => {
-      server.removeListener("error", reject);
-      resolvePromise(server);
-    });
-  });
-}
-
-// ─── Process entry ─────────────────────────────────────────────────────
-// Mirrors the `__serve__` guard in src/server/index.ts: the supervisor
-// re-invokes the binary as `<bin> __edge__ <publicPort> <host>`.
-if (process.argv.includes("__edge__")) {
-  const idx = process.argv.indexOf("__edge__");
-  const publicPort = parseInt(process.argv[idx + 1] ?? "", 10);
-  const host = process.argv[idx + 2] ?? "0.0.0.0";
-
-  if (!Number.isInteger(publicPort) || publicPort <= 0 || publicPort > 65535) {
-    process.stderr.write(`[edge] Invalid public port: ${process.argv[idx + 1]}\n`);
-    process.exit(2);
-  }
-
-  try {
-    await startEdgeForwarder({ publicPort, host });
-    process.stderr.write(`[edge] Listening on ${host}:${publicPort}\n`);
-  } catch (err) {
-    process.stderr.write(`[edge] Failed to bind ${host}:${publicPort}: ${err}\n`);
-    process.exit(1);
-  }
-}
+/**
+ * Edge forwarder — owns the public port and pipes raw TCP to the server's
+ * current loopback port.
+ *
+ * ─── CRITICAL INVARIANT: THIS PROCESS MUST NEVER SPAWN A CHILD ───
+ *
+ * On Windows a child spawned with fd stdio inherits every inheritable handle,
+ * including a listening socket. When such a descendant is orphaned it keeps the
+ * socket open, so the port stays in LISTEN under a dead PID and can never be
+ * rebound — a "zombie port". The server hits this constantly because it spawns
+ * chat/tool/MCP subprocesses; those inherit its listener and wedge its port.
+ *
+ * The edge exists precisely because it spawns nothing, so its socket cannot be
+ * inherited and its port cannot zombie. cloudflared can therefore stay pinned
+ * to it forever and the public URL stops rotating. Adding any child-process
+ * call to this file reintroduces the exact bug the edge was built to remove.
+ *
+ * Raw TCP, never HTTP: WebSocket upgrades and SSE streams pass through
+ * untouched, and forwarded requests keep the headers cloudflared set.
+ */
+import net from "node:net";
+import { resolveTargetPort, _resetTargetCache } from "./edge-target-resolver.ts";
+
+/** Delay between attempts while waiting for the server to come back. */
+const CONNECT_RETRY_MS = 250;
+/**
+ * How long a client connection waits for a reachable server before giving up.
+ * During an upgrade the server is briefly absent; refusing instantly would
+ * surface as a broken page rather than a slow one.
+ */
+const CONNECT_WINDOW_MS = 5000;
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+/** Resolve once the socket is connected; reject on the first connect error. */
+function connectUpstream(port: number): Promise<net.Socket> {
+  return new Promise((resolvePromise, reject) => {
+    const upstream = net.connect({
+      port,
+      host: "127.0.0.1", // never taken from status.json — loopback only
+      allowHalfOpen: true,
+    });
+    const onError = (err: Error) => {
+      upstream.destroy();
+      reject(err);
+    };
+    upstream.once("error", onError);
+    upstream.once("connect", () => {
+      upstream.removeListener("error", onError);
+      resolvePromise(upstream);
+    });
+  });
+}
+
+/**
+ * Largest amount of client data held while waiting for the server. Bounds the
+ * memory a slow upload can pin during an upgrade window.
+ */
+const MAX_PENDING_BYTES = 8 * 1024 * 1024;
+
+/**
+ * Pipe one client connection to the server.
+ *
+ * Resolving the upstream is async, so the first bytes usually arrive before
+ * there is anywhere to send them. They must be captured by a `data` listener
+ * attached synchronously on this very tick and replayed once the upstream
+ * exists.
+ *
+ * `socket.pause()` is NOT a substitute — verified against Bun 1.3.13: bytes
+ * that arrive while paused are lost, and a later `pipe()`/`resume()` does not
+ * bring them back. A socket with no `data` listener drops them outright too.
+ * Both variants silently swallowed the first request in testing.
+ */
+async function handleConnection(
+  client: net.Socket,
+  connectWindowMs: number,
+): Promise<void> {
+  const pending: Buffer[] = [];
+  let pendingBytes = 0;
+  let clientEnded = false;
+  const onEarlyData = (chunk: Buffer) => {
+    pendingBytes += chunk.length;
+    if (pendingBytes > MAX_PENDING_BYTES) {
+      client.destroy();
+      return;
+    }
+    pending.push(chunk);
+  };
+  client.on("data", onEarlyData);
+  client.once("end", () => { clientEnded = true; });
+
+  let upstream: net.Socket | null = null;
+  let clientGone = false;
+
+  // A socket error with no listener is an unhandled 'error' event, which would
+  // take the whole edge process — and the public port — down with it.
+  const teardown = () => {
+    upstream?.destroy();
+    client.destroy();
+  };
+  client.on("error", teardown);
+  client.once("close", () => { clientGone = true; });
+
+  const deadline = Date.now() + connectWindowMs;
+  while (!clientGone && Date.now() < deadline) {
+    const port = resolveTargetPort();
+    if (port !== null) {
+      try {
+        upstream = await connectUpstream(port);
+        break;
+      } catch {
+        // Server not up yet (or moved mid-restart) — re-resolve and retry.
+        _resetTargetCache();
+      }
+    }
+    await sleep(CONNECT_RETRY_MS);
+  }
+
+  if (clientGone) return;
+  if (!upstream) {
+    client.destroy();
+    return;
+  }
+
+  upstream.on("error", teardown);
+
+  // Replay what arrived during the connect, then hand both directions to the
+  // stream machinery. Removing the listener and piping happen in the same tick,
+  // so no chunk can slip through the gap.
+  client.off("data", onEarlyData);
+  for (const chunk of pending) upstream.write(chunk);
+  pending.length = 0;
+
+  client.pipe(upstream);
+  upstream.pipe(client);
+
+  // The client may have half-closed while we were still connecting.
+  if (clientEnded) upstream.end();
+}
+
+export interface EdgeForwarderOptions {
+  publicPort: number;
+  host?: string;
+  /** How long a client waits for a reachable server. Defaults to 5s. */
+  connectWindowMs?: number;
+}
+
+/**
+ * Bind the public port and start forwarding. Resolves once listening so the
+ * caller can fail fast when the port is unavailable.
+ */
+export function startEdgeForwarder(
+  opts: EdgeForwarderOptions,
+): Promise<net.Server> {
+  const host = opts.host ?? "0.0.0.0";
+  const connectWindowMs = opts.connectWindowMs ?? CONNECT_WINDOW_MS;
+  return new Promise((resolvePromise, reject) => {
+    // allowHalfOpen keeps the other direction alive when one side sends FIN —
+    // long-lived chat WS and SSE streams depend on it.
+    const server = net.createServer({ allowHalfOpen: true }, (client) => {
+      void handleConnection(client, connectWindowMs);
+    });
+    server.once("error", reject);
+    server.listen(opts.publicPort, host, () => {
+      server.removeListener("error", reject);
+      resolvePromise(server);
+    });
+  });
+}
+
+// ─── Process entry ─────────────────────────────────────────────────────
+// Mirrors the `__serve__` guard in src/server/index.ts: the supervisor
+// re-invokes the binary as `<bin> __edge__ <publicPort> <host>`.
+if (process.argv.includes("__edge__")) {
+  const idx = process.argv.indexOf("__edge__");
+  const publicPort = parseInt(process.argv[idx + 1] ?? "", 10);
+  const host = process.argv[idx + 2] ?? "0.0.0.0";
+
+  if (!Number.isInteger(publicPort) || publicPort <= 0 || publicPort > 65535) {
+    process.stderr.write(`[edge] Invalid public port: ${process.argv[idx + 1]}\n`);
+    process.exit(2);
+  }
+
+  try {
+    await startEdgeForwarder({ publicPort, host });
+    process.stderr.write(`[edge] Listening on ${host}:${publicPort}\n`);
+  } catch (err) {
+    process.stderr.write(`[edge] Failed to bind ${host}:${publicPort}: ${err}\n`);
+    process.exit(1);
+  }
+}

package/src/services/fs-ops/fs-real-path.ts

@@ -42,3 +42,26 @@ export function realPathOrSelfSync(target: string): string {
     }
   }
 }
+
+/**
+ * Is `child` the same directory as `parent`, or somewhere inside it?
+ *
+ * Case-folded on Windows, where `C:\Users\PC\ppm` and `c:\users\pc\ppm` are
+ * one directory under two spellings: a case-sensitive prefix test refuses the
+ * second, which reads to the caller as "outside the project" for a path the
+ * server itself handed out. Nowhere else — on Linux two spellings really are
+ * two directories.
+ *
+ * The separator follows the platform rather than `sep`, and `platform` is a
+ * parameter, so win32 semantics can be asserted from a Linux test run the way
+ * `assertSafeFilePaths` takes its `PathApi`. A backslash is a separator only on
+ * Windows: on Linux `/home/x\evil` is a file *beside* `/home/x`, not inside it.
+ */
+export function isInsideDir(child: string, parent: string, platform: string = process.platform): boolean {
+  const separators = platform === "win32" ? ["\\", "/"] : ["/"];
+  const fold = (path: string) => (platform === "win32" ? path.toLowerCase() : path);
+  const from = fold(parent).replace(/[\\/]+$/, "");
+  const to = fold(child);
+  if (to === from) return true;
+  return to.startsWith(from) && separators.includes(to.charAt(from.length));
+}

package/src/services/git-blame/commit-line-diff.ts

@@ -0,0 +1,124 @@
+/**
+ * Reading one `git show` into the pieces the editor's blame hover needs: the
+ * commit's own fields, its full message, and the change it made to one line.
+ *
+ * One command carries all of it. `--format=%H%x00%an%x00...%B%x00` puts the
+ * fields before the diff with NUL separators, which is the only separator that
+ * cannot occur inside a commit message — and a commit message is exactly where
+ * a chosen delimiter would eventually turn up.
+ *
+ * `--unified=0` is what makes the line lookup possible: with no context lines,
+ * every line in a hunk body is a real change, so the hunk containing the blamed
+ * line names that line's own edit rather than an edit up to three lines away.
+ */
+
+/**
+ * The byte git writes for `%x00`, built rather than typed. A literal NUL in a
+ * source file is invisible in every diff and makes the file read as binary to
+ * grep; this has already cost this codebase an afternoon once.
+ */
+const NUL = String.fromCharCode(0);
+
+export interface ShowFields {
+  hash: string;
+  author: string;
+  authorMail: string;
+  /** Unix seconds. */
+  authorTime: number;
+  /** Subject and body, as committed, with trailing blank lines removed. */
+  message: string;
+  /** Everything after the message. Empty for a merge commit, which shows none. */
+  diff: string;
+}
+
+export function parseShow(raw: string): ShowFields | null {
+  // Five fields then the diff; a short split means the format did not run, which
+  // is what a bad revision looks like when git still exits zero.
+  const parts = raw.split(NUL);
+  if (parts.length < 6) return null;
+  const [hash, author, authorMail, authorTime, message] = parts;
+  if (!hash?.trim()) return null;
+  return {
+    hash: hash.trim(),
+    author: author ?? "",
+    authorMail: authorMail ?? "",
+    authorTime: Number(authorTime) || 0,
+    message: (message ?? "").replace(/\s+$/, ""),
+    diff: parts.slice(5).join(NUL).replace(/^\s*\n/, ""),
+  };
+}
+
+export interface LineChange {
+  /** What the commit removed at this line, oldest first. */
+  removed: string[];
+  /** The line as this commit wrote it. */
+  added: string[];
+}
+
+interface Hunk {
+  newStart: number;
+  newCount: number;
+  removed: string[];
+  added: string[];
+}
+
+/**
+ * `@@ -12,3 +14,2 @@` — and `@@ -14,0 +15 @@`, because git omits a count of one.
+ * Reading a missing count as zero would make every single-line hunk unmatchable.
+ */
+const HUNK_HEADER = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
+
+function parseHunks(diff: string): Hunk[] {
+  const hunks: Hunk[] = [];
+  let current: Hunk | null = null;
+  for (const line of diff.split("\n")) {
+    const header = HUNK_HEADER.exec(line);
+    if (header) {
+      current = {
+        newStart: Number(header[3]),
+        newCount: header[4] === undefined ? 1 : Number(header[4]),
+        removed: [],
+        added: [],
+      };
+      hunks.push(current);
+      continue;
+    }
+    if (!current) continue;
+    // A new `diff --git` ends the previous file's hunks. Checked before the
+    // `-`/`+` tests because `--- a/x` and `+++ b/x` follow it and would
+    // otherwise be read as a removed and an added line.
+    if (line.startsWith("diff --git")) current = null;
+    else if (line.startsWith("+")) current.added.push(line.slice(1));
+    else if (line.startsWith("-")) current.removed.push(line.slice(1));
+  }
+  return hunks;
+}
+
+/**
+ * The change this commit made at `newLine`, where `newLine` is the line number
+ * in the file *as that commit left it* — which is what `git blame --porcelain`
+ * reports as the original line, and not the line number in the file now.
+ *
+ * Null when the commit did not touch that line: a merge commit shows no diff at
+ * all, and a line can also be attributed to a commit that only moved it.
+ */
+export function lineChangeAt(diff: string, newLine: number, maxRemoved = 3): LineChange | null {
+  for (const hunk of parseHunks(diff)) {
+    // `+n,0` means the commit deleted lines here and added none, so this hunk
+    // contains no line of the new file at all.
+    if (hunk.newCount === 0) continue;
+    if (newLine < hunk.newStart || newLine >= hunk.newStart + hunk.newCount) continue;
+
+    const offset = newLine - hunk.newStart;
+    const line = hunk.added[offset];
+    return {
+      // Capped: a hunk that replaced two hundred lines would otherwise put all
+      // of them into a hover.
+      removed: hunk.removed.slice(0, maxRemoved),
+      // The blamed line itself, not the whole hunk. Falls back to the hunk's
+      // first added line if the header's count and the body ever disagree.
+      added: line === undefined ? hunk.added.slice(0, 1) : [line],
+    };
+  }
+  return null;
+}

package/src/services/git-blame/git-blame.service.ts

@@ -7,7 +7,8 @@
  */
 import simpleGit from "simple-git";
 import { parseBlamePorcelain } from "./blame-porcelain.ts";
-import type { BlameResult } from "../../shared/blame.ts";
+import { lineChangeAt, parseShow } from "./commit-line-diff.ts";
+import type { BlameLineDetail, BlameResult } from "../../shared/blame.ts";
 
 /**
  * Reject a path that is absolute, escapes the repository, or could be read as
@@ -56,6 +57,17 @@ export function assertSafeRev(rev: string): string {
   return rev;
 }
 
+/**
+ * Reject anything that is not a commit hash. Stricter than `assertSafeRev` on
+ * purpose: this value is the one argument to `git show`, and the hover only ever
+ * has a hash from a blame it already ran, so `HEAD~1` and friends are not
+ * requests to honour — they are a sign the caller is not the hover.
+ */
+export function assertCommitHash(hash: string): string {
+  if (!/^[0-9a-f]{7,40}$/.test(hash)) throw new Error(`Invalid commit hash: "${hash}"`);
+  return hash;
+}
+
 class GitBlameService {
   /**
    * Blame every line of `filePath`, in the working tree or as it stood at `rev`.
@@ -85,6 +97,89 @@ class GitBlameService {
       throw e;
     }
   }
+
+  /**
+   * The commit message and the one-line diff behind a blamed line, for the
+   * editor's hover.
+   *
+   * `filePath` must be the path the file had *at that commit* — after a rename
+   * the current path did not exist there, and `git show` would report no diff
+   * at all rather than an error. `git blame --porcelain` supplies it as
+   * `filename`, which is why the caller passes it rather than the open file's
+   * path.
+   *
+   * `origLine` is likewise the line number at that commit, not now.
+   *
+   * Returns null when there is nothing to show — an unknown hash, or a path git
+   * has never heard of. A commit with no diff for this line is *not* null: the
+   * message is still worth showing, so `removed` and `added` come back empty.
+   * That is the ordinary case for a merge commit, which shows no diff.
+   */
+  async lineDetail(
+    projectPath: string,
+    hash: string,
+    filePath: string,
+    origLine: number,
+  ): Promise<BlameLineDetail | null> {
+    assertCommitHash(hash);
+    assertSafeFilePath(filePath);
+    const git = simpleGit(projectPath);
+    // Two commands, not one, and the reason is not obvious: a pathspec puts
+    // `git show` through the diff machinery, which drops the commit entirely
+    // when that path is unchanged — the same filtering that makes `git log --
+    // <path>` skip it. So `show --format=… <hash> -- <path>` prints *nothing*,
+    // not a header with an empty diff, and asking one command for both loses
+    // the fields exactly when the hover still wants them: a line the commit
+    // never touched should still say who wrote the commit and why.
+    const metaArgs = [
+      "show",
+      // NUL-separated fields, no diff. See `commit-line-diff.ts`.
+      "--format=%H%x00%an%x00%ae%x00%at%x00%B%x00",
+      "--no-patch",
+      hash,
+    ];
+    // `--unified=0` so every line in a hunk body is a real change.
+    const diffArgs = ["show", "--format=", "--unified=0", hash, "--", filePath];
+
+    /** True for the family of git errors that all mean "nothing to show here". */
+    const isAbsent = (e: unknown): boolean => {
+      const message = e instanceof Error ? e.message : String(e);
+      // git's wording varies by which lookup failed: a hash it cannot resolve is
+      // "bad revision", one that resolves to nothing is "bad object", and a path
+      // that commit never had is "exists on disk, but not in".
+      return /bad revision|unknown revision|bad object|not a valid object name|no such path|does not exist|but not in/i.test(message);
+    };
+
+    let metaRaw: string;
+    try {
+      metaRaw = await git.raw(metaArgs);
+    } catch (e) {
+      if (isAbsent(e)) return null;
+      throw e;
+    }
+
+    const fields = parseShow(metaRaw);
+    if (!fields) return null;
+
+    let diffRaw = "";
+    try {
+      diffRaw = await git.raw(diffArgs);
+    } catch (e) {
+      // A path this commit never had is not a failed hover, just an absent diff
+      // section. Anything else is still worth reporting.
+      if (!isAbsent(e)) throw e;
+    }
+    const change = lineChangeAt(diffRaw, origLine);
+    return {
+      hash: fields.hash,
+      author: fields.author,
+      authorMail: fields.authorMail,
+      authorTime: fields.authorTime,
+      message: fields.message,
+      removed: change?.removed ?? [],
+      added: change?.added ?? [],
+    };
+  }
 }
 
 export const gitBlameService = new GitBlameService();