@hienlh/ppm 0.23.5 → 0.23.7

package/src/services/edge-forwarder.ts

@@ -1,191 +1,191 @@
-/**
- * Edge forwarder — owns the public port and pipes raw TCP to the server's
- * current loopback port.
- *
- * ─── CRITICAL INVARIANT: THIS PROCESS MUST NEVER SPAWN A CHILD ───
- *
- * On Windows a child spawned with fd stdio inherits every inheritable handle,
- * including a listening socket. When such a descendant is orphaned it keeps the
- * socket open, so the port stays in LISTEN under a dead PID and can never be
- * rebound — a "zombie port". The server hits this constantly because it spawns
- * chat/tool/MCP subprocesses; those inherit its listener and wedge its port.
- *
- * The edge exists precisely because it spawns nothing, so its socket cannot be
- * inherited and its port cannot zombie. cloudflared can therefore stay pinned
- * to it forever and the public URL stops rotating. Adding any child-process
- * call to this file reintroduces the exact bug the edge was built to remove.
- *
- * Raw TCP, never HTTP: WebSocket upgrades and SSE streams pass through
- * untouched, and forwarded requests keep the headers cloudflared set.
- */
-import net from "node:net";
-import { resolveTargetPort, _resetTargetCache } from "./edge-target-resolver.ts";
-
-/** Delay between attempts while waiting for the server to come back. */
-const CONNECT_RETRY_MS = 250;
-/**
- * How long a client connection waits for a reachable server before giving up.
- * During an upgrade the server is briefly absent; refusing instantly would
- * surface as a broken page rather than a slow one.
- */
-const CONNECT_WINDOW_MS = 5000;
-
-const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
-
-/** Resolve once the socket is connected; reject on the first connect error. */
-function connectUpstream(port: number): Promise<net.Socket> {
-  return new Promise((resolvePromise, reject) => {
-    const upstream = net.connect({
-      port,
-      host: "127.0.0.1", // never taken from status.json — loopback only
-      allowHalfOpen: true,
-    });
-    const onError = (err: Error) => {
-      upstream.destroy();
-      reject(err);
-    };
-    upstream.once("error", onError);
-    upstream.once("connect", () => {
-      upstream.removeListener("error", onError);
-      resolvePromise(upstream);
-    });
-  });
-}
-
-/**
- * Largest amount of client data held while waiting for the server. Bounds the
- * memory a slow upload can pin during an upgrade window.
- */
-const MAX_PENDING_BYTES = 8 * 1024 * 1024;
-
-/**
- * Pipe one client connection to the server.
- *
- * Resolving the upstream is async, so the first bytes usually arrive before
- * there is anywhere to send them. They must be captured by a `data` listener
- * attached synchronously on this very tick and replayed once the upstream
- * exists.
- *
- * `socket.pause()` is NOT a substitute — verified against Bun 1.3.13: bytes
- * that arrive while paused are lost, and a later `pipe()`/`resume()` does not
- * bring them back. A socket with no `data` listener drops them outright too.
- * Both variants silently swallowed the first request in testing.
- */
-async function handleConnection(
-  client: net.Socket,
-  connectWindowMs: number,
-): Promise<void> {
-  const pending: Buffer[] = [];
-  let pendingBytes = 0;
-  let clientEnded = false;
-  const onEarlyData = (chunk: Buffer) => {
-    pendingBytes += chunk.length;
-    if (pendingBytes > MAX_PENDING_BYTES) {
-      client.destroy();
-      return;
-    }
-    pending.push(chunk);
-  };
-  client.on("data", onEarlyData);
-  client.once("end", () => { clientEnded = true; });
-
-  let upstream: net.Socket | null = null;
-  let clientGone = false;
-
-  // A socket error with no listener is an unhandled 'error' event, which would
-  // take the whole edge process — and the public port — down with it.
-  const teardown = () => {
-    upstream?.destroy();
-    client.destroy();
-  };
-  client.on("error", teardown);
-  client.once("close", () => { clientGone = true; });
-
-  const deadline = Date.now() + connectWindowMs;
-  while (!clientGone && Date.now() < deadline) {
-    const port = resolveTargetPort();
-    if (port !== null) {
-      try {
-        upstream = await connectUpstream(port);
-        break;
-      } catch {
-        // Server not up yet (or moved mid-restart) — re-resolve and retry.
-        _resetTargetCache();
-      }
-    }
-    await sleep(CONNECT_RETRY_MS);
-  }
-
-  if (clientGone) return;
-  if (!upstream) {
-    client.destroy();
-    return;
-  }
-
-  upstream.on("error", teardown);
-
-  // Replay what arrived during the connect, then hand both directions to the
-  // stream machinery. Removing the listener and piping happen in the same tick,
-  // so no chunk can slip through the gap.
-  client.off("data", onEarlyData);
-  for (const chunk of pending) upstream.write(chunk);
-  pending.length = 0;
-
-  client.pipe(upstream);
-  upstream.pipe(client);
-
-  // The client may have half-closed while we were still connecting.
-  if (clientEnded) upstream.end();
-}
-
-export interface EdgeForwarderOptions {
-  publicPort: number;
-  host?: string;
-  /** How long a client waits for a reachable server. Defaults to 5s. */
-  connectWindowMs?: number;
-}
-
-/**
- * Bind the public port and start forwarding. Resolves once listening so the
- * caller can fail fast when the port is unavailable.
- */
-export function startEdgeForwarder(
-  opts: EdgeForwarderOptions,
-): Promise<net.Server> {
-  const host = opts.host ?? "0.0.0.0";
-  const connectWindowMs = opts.connectWindowMs ?? CONNECT_WINDOW_MS;
-  return new Promise((resolvePromise, reject) => {
-    // allowHalfOpen keeps the other direction alive when one side sends FIN —
-    // long-lived chat WS and SSE streams depend on it.
-    const server = net.createServer({ allowHalfOpen: true }, (client) => {
-      void handleConnection(client, connectWindowMs);
-    });
-    server.once("error", reject);
-    server.listen(opts.publicPort, host, () => {
-      server.removeListener("error", reject);
-      resolvePromise(server);
-    });
-  });
-}
-
-// ─── Process entry ─────────────────────────────────────────────────────
-// Mirrors the `__serve__` guard in src/server/index.ts: the supervisor
-// re-invokes the binary as `<bin> __edge__ <publicPort> <host>`.
-if (process.argv.includes("__edge__")) {
-  const idx = process.argv.indexOf("__edge__");
-  const publicPort = parseInt(process.argv[idx + 1] ?? "", 10);
-  const host = process.argv[idx + 2] ?? "0.0.0.0";
-
-  if (!Number.isInteger(publicPort) || publicPort <= 0 || publicPort > 65535) {
-    process.stderr.write(`[edge] Invalid public port: ${process.argv[idx + 1]}\n`);
-    process.exit(2);
-  }
-
-  try {
-    await startEdgeForwarder({ publicPort, host });
-    process.stderr.write(`[edge] Listening on ${host}:${publicPort}\n`);
-  } catch (err) {
-    process.stderr.write(`[edge] Failed to bind ${host}:${publicPort}: ${err}\n`);
-    process.exit(1);
-  }
-}
+/**
+ * Edge forwarder — owns the public port and pipes raw TCP to the server's
+ * current loopback port.
+ *
+ * ─── CRITICAL INVARIANT: THIS PROCESS MUST NEVER SPAWN A CHILD ───
+ *
+ * On Windows a child spawned with fd stdio inherits every inheritable handle,
+ * including a listening socket. When such a descendant is orphaned it keeps the
+ * socket open, so the port stays in LISTEN under a dead PID and can never be
+ * rebound — a "zombie port". The server hits this constantly because it spawns
+ * chat/tool/MCP subprocesses; those inherit its listener and wedge its port.
+ *
+ * The edge exists precisely because it spawns nothing, so its socket cannot be
+ * inherited and its port cannot zombie. cloudflared can therefore stay pinned
+ * to it forever and the public URL stops rotating. Adding any child-process
+ * call to this file reintroduces the exact bug the edge was built to remove.
+ *
+ * Raw TCP, never HTTP: WebSocket upgrades and SSE streams pass through
+ * untouched, and forwarded requests keep the headers cloudflared set.
+ */
+import net from "node:net";
+import { resolveTargetPort, _resetTargetCache } from "./edge-target-resolver.ts";
+
+/** Delay between attempts while waiting for the server to come back. */
+const CONNECT_RETRY_MS = 250;
+/**
+ * How long a client connection waits for a reachable server before giving up.
+ * During an upgrade the server is briefly absent; refusing instantly would
+ * surface as a broken page rather than a slow one.
+ */
+const CONNECT_WINDOW_MS = 5000;
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+/** Resolve once the socket is connected; reject on the first connect error. */
+function connectUpstream(port: number): Promise<net.Socket> {
+  return new Promise((resolvePromise, reject) => {
+    const upstream = net.connect({
+      port,
+      host: "127.0.0.1", // never taken from status.json — loopback only
+      allowHalfOpen: true,
+    });
+    const onError = (err: Error) => {
+      upstream.destroy();
+      reject(err);
+    };
+    upstream.once("error", onError);
+    upstream.once("connect", () => {
+      upstream.removeListener("error", onError);
+      resolvePromise(upstream);
+    });
+  });
+}
+
+/**
+ * Largest amount of client data held while waiting for the server. Bounds the
+ * memory a slow upload can pin during an upgrade window.
+ */
+const MAX_PENDING_BYTES = 8 * 1024 * 1024;
+
+/**
+ * Pipe one client connection to the server.
+ *
+ * Resolving the upstream is async, so the first bytes usually arrive before
+ * there is anywhere to send them. They must be captured by a `data` listener
+ * attached synchronously on this very tick and replayed once the upstream
+ * exists.
+ *
+ * `socket.pause()` is NOT a substitute — verified against Bun 1.3.13: bytes
+ * that arrive while paused are lost, and a later `pipe()`/`resume()` does not
+ * bring them back. A socket with no `data` listener drops them outright too.
+ * Both variants silently swallowed the first request in testing.
+ */
+async function handleConnection(
+  client: net.Socket,
+  connectWindowMs: number,
+): Promise<void> {
+  const pending: Buffer[] = [];
+  let pendingBytes = 0;
+  let clientEnded = false;
+  const onEarlyData = (chunk: Buffer) => {
+    pendingBytes += chunk.length;
+    if (pendingBytes > MAX_PENDING_BYTES) {
+      client.destroy();
+      return;
+    }
+    pending.push(chunk);
+  };
+  client.on("data", onEarlyData);
+  client.once("end", () => { clientEnded = true; });
+
+  let upstream: net.Socket | null = null;
+  let clientGone = false;
+
+  // A socket error with no listener is an unhandled 'error' event, which would
+  // take the whole edge process — and the public port — down with it.
+  const teardown = () => {
+    upstream?.destroy();
+    client.destroy();
+  };
+  client.on("error", teardown);
+  client.once("close", () => { clientGone = true; });
+
+  const deadline = Date.now() + connectWindowMs;
+  while (!clientGone && Date.now() < deadline) {
+    const port = resolveTargetPort();
+    if (port !== null) {
+      try {
+        upstream = await connectUpstream(port);
+        break;
+      } catch {
+        // Server not up yet (or moved mid-restart) — re-resolve and retry.
+        _resetTargetCache();
+      }
+    }
+    await sleep(CONNECT_RETRY_MS);
+  }
+
+  if (clientGone) return;
+  if (!upstream) {
+    client.destroy();
+    return;
+  }
+
+  upstream.on("error", teardown);
+
+  // Replay what arrived during the connect, then hand both directions to the
+  // stream machinery. Removing the listener and piping happen in the same tick,
+  // so no chunk can slip through the gap.
+  client.off("data", onEarlyData);
+  for (const chunk of pending) upstream.write(chunk);
+  pending.length = 0;
+
+  client.pipe(upstream);
+  upstream.pipe(client);
+
+  // The client may have half-closed while we were still connecting.
+  if (clientEnded) upstream.end();
+}
+
+export interface EdgeForwarderOptions {
+  publicPort: number;
+  host?: string;
+  /** How long a client waits for a reachable server. Defaults to 5s. */
+  connectWindowMs?: number;
+}
+
+/**
+ * Bind the public port and start forwarding. Resolves once listening so the
+ * caller can fail fast when the port is unavailable.
+ */
+export function startEdgeForwarder(
+  opts: EdgeForwarderOptions,
+): Promise<net.Server> {
+  const host = opts.host ?? "0.0.0.0";
+  const connectWindowMs = opts.connectWindowMs ?? CONNECT_WINDOW_MS;
+  return new Promise((resolvePromise, reject) => {
+    // allowHalfOpen keeps the other direction alive when one side sends FIN —
+    // long-lived chat WS and SSE streams depend on it.
+    const server = net.createServer({ allowHalfOpen: true }, (client) => {
+      void handleConnection(client, connectWindowMs);
+    });
+    server.once("error", reject);
+    server.listen(opts.publicPort, host, () => {
+      server.removeListener("error", reject);
+      resolvePromise(server);
+    });
+  });
+}
+
+// ─── Process entry ─────────────────────────────────────────────────────
+// Mirrors the `__serve__` guard in src/server/index.ts: the supervisor
+// re-invokes the binary as `<bin> __edge__ <publicPort> <host>`.
+if (process.argv.includes("__edge__")) {
+  const idx = process.argv.indexOf("__edge__");
+  const publicPort = parseInt(process.argv[idx + 1] ?? "", 10);
+  const host = process.argv[idx + 2] ?? "0.0.0.0";
+
+  if (!Number.isInteger(publicPort) || publicPort <= 0 || publicPort > 65535) {
+    process.stderr.write(`[edge] Invalid public port: ${process.argv[idx + 1]}\n`);
+    process.exit(2);
+  }
+
+  try {
+    await startEdgeForwarder({ publicPort, host });
+    process.stderr.write(`[edge] Listening on ${host}:${publicPort}\n`);
+  } catch (err) {
+    process.stderr.write(`[edge] Failed to bind ${host}:${publicPort}: ${err}\n`);
+    process.exit(1);
+  }
+}

package/src/services/fs-ops/fs-ops-trash.service.ts

@@ -47,28 +47,40 @@ function osaLiteral(value: string): string {
   return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 }
 
-function windowsCommand(path: string, isDirectory: boolean): string[] {
+/**
+ * How a backend binary is found, replaceable for the same reason `TrashRunner` is.
+ *
+ * Which tool is present is as much a property of the host as what running it does, and
+ * leaving the lookup outside the seam meant a test could fake the run and still be refused
+ * before reaching it — on any machine without `gio` or `trash-put`, which includes the
+ * container the suite runs in.
+ */
+export type TrashLookup = (name: string) => string | null;
+
+const defaultLookup: TrashLookup = (name) => Bun.which(name);
+
+function windowsCommand(path: string, isDirectory: boolean, which: TrashLookup): string[] {
   const method = isDirectory ? "DeleteDirectory" : "DeleteFile";
   const script =
     "Add-Type -AssemblyName Microsoft.VisualBasic; " +
     `[Microsoft.VisualBasic.FileIO.FileSystem]::${method}(${psLiteral(path)},'OnlyErrorDialogs','SendToRecycleBin')`;
-  const shell = Bun.which("powershell") ?? Bun.which("pwsh");
+  const shell = which("powershell") ?? which("pwsh");
   if (!shell) throw noTrash("powershell not found on PATH");
   return [shell, "-NoProfile", "-NonInteractive", "-Command", script];
 }
 
 /** Paths are always absolute here, so no leading-dash option confusion. */
-function posixCommand(path: string): string[] {
+function posixCommand(path: string, which: TrashLookup): string[] {
   if (process.platform === "darwin") {
-    const trash = Bun.which("trash");
+    const trash = which("trash");
     if (trash) return [trash, path];
-    const osascript = Bun.which("osascript");
+    const osascript = which("osascript");
     if (!osascript) throw noTrash("neither trash nor osascript found on PATH");
     return [osascript, "-e", `tell application "Finder" to delete POSIX file ${osaLiteral(path)}`];
   }
-  const gio = Bun.which("gio");
+  const gio = which("gio");
   if (gio) return [gio, "trash", path];
-  const trashPut = Bun.which("trash-put");
+  const trashPut = which("trash-put");
   if (trashPut) return [trashPut, path];
   throw noTrash("neither gio nor trash-put found on PATH");
 }
@@ -85,7 +97,7 @@ async function isDirectoryTarget(path: string): Promise<boolean> {
 
 export async function trashPath(
   path: string,
-  options?: { run?: TrashRunner },
+  options?: { run?: TrashRunner; which?: TrashLookup },
 ): Promise<{ trashed: true; path: string }> {
   const target = resolvePath(path);
   assertAllowed(target);
@@ -94,8 +106,9 @@ export async function trashPath(
   await assertNotProtected(target);
   const isDir = await isDirectoryTarget(target);
 
+  const which = options?.which ?? defaultLookup;
   const cmd =
-    process.platform === "win32" ? windowsCommand(target, isDir) : posixCommand(target);
+    process.platform === "win32" ? windowsCommand(target, isDir, which) : posixCommand(target, which);
 
   const run = options?.run ?? spawnRunner;
   let result: { exitCode: number; stderr: string };

package/src/services/git-refs/for-each-ref.ts

@@ -0,0 +1,118 @@
+/**
+ * Every checkout target — local branches, remote-tracking branches and tags —
+ * out of a single `git for-each-ref`, with the commit each one points at.
+ *
+ * The format string is built from the field list rather than written out,
+ * because the parser reads fields *positionally*: a field added to one and not
+ * the other shifts everything after it, and git answers just as happily either
+ * way — the picker would simply show a date where the author belongs, with
+ * nothing failing.
+ *
+ * Six of the twelve fields are the `*`-dereferenced twins of six others, and
+ * they are what makes an **annotated** tag readable. `refs/tags/v1` resolves to
+ * the tag *object*, not to a commit: its `objectname` is the tag's own hash,
+ * it has a tagger rather than an author (so `%(authorname)` and
+ * `%(committerdate)` come back empty) and its `contents:subject` is the tag
+ * message. A lightweight tag has no such object and leaves every `*` field
+ * empty — which is why each pair is resolved as "dereferenced when non-empty,
+ * else plain" rather than by asking what kind of ref it is.
+ */
+import type { GitRef } from "../../types/git.ts";
+
+const FIELDS = [
+  "refname",
+  "objectname",
+  "*objectname",
+  "HEAD",
+  "upstream:short",
+  "upstream:track",
+  "authorname",
+  "*authorname",
+  "committerdate:iso-strict",
+  "*committerdate:iso-strict",
+  "contents:subject",
+  "*contents:subject",
+] as const;
+
+/** NUL between fields, newline between records: no ref name or subject may contain either. */
+export const FOR_EACH_REF_FORMAT = FIELDS.map((f) => `%(${f})`).join("%00");
+
+export const FOR_EACH_REF_ARGS = [
+  "for-each-ref",
+  `--format=${FOR_EACH_REF_FORMAT}`,
+  "refs/heads",
+  "refs/remotes",
+  "refs/tags",
+];
+
+const PREFIX: Record<GitRef["type"], string> = {
+  branch: "refs/heads/",
+  remote: "refs/remotes/",
+  tag: "refs/tags/",
+};
+
+/**
+ * `%(upstream:track)` as git writes it: `[ahead 1, behind 26]`, either half on
+ * its own, `[gone]` when the remote branch was deleted, or empty when the
+ * branch has no upstream at all.
+ */
+export function parseUpstreamTrack(track: string): Pick<GitRef, "ahead" | "behind" | "gone"> {
+  if (track.includes("gone")) return { ahead: 0, behind: 0, gone: true };
+  const ahead = /ahead (\d+)/.exec(track);
+  const behind = /behind (\d+)/.exec(track);
+  return {
+    ahead: ahead ? Number(ahead[1]) : 0,
+    behind: behind ? Number(behind[1]) : 0,
+    gone: false,
+  };
+}
+
+function refType(refName: string): GitRef["type"] | null {
+  for (const [type, prefix] of Object.entries(PREFIX)) {
+    if (refName.startsWith(prefix)) return type as GitRef["type"];
+  }
+  return null;
+}
+
+/** Newest commit first. Compared as instants, never as strings: `iso-strict` carries the author's own offset. */
+function newestFirst(a: GitRef, b: GitRef): number {
+  const at = Date.parse(a.date);
+  const bt = Date.parse(b.date);
+  if (Number.isNaN(at) || Number.isNaN(bt)) return a.name.localeCompare(b.name);
+  return bt - at;
+}
+
+export function parseForEachRef(stdout: string): GitRef[] {
+  const refs: GitRef[] = [];
+
+  for (const line of stdout.split("\n")) {
+    if (!line) continue;
+    const f = line.split("\0");
+    // A short record means a field carried a newline after all. Skipping it
+    // loses one row; reading it would silently shift every field of that row.
+    if (f.length < FIELDS.length) continue;
+
+    const refName = f[0]!;
+    const type = refType(refName);
+    if (!type) continue;
+    // `origin/HEAD` is a symbolic pointer at another row of this same list.
+    if (type === "remote" && refName.endsWith("/HEAD")) continue;
+
+    const hash = f[2] || f[1]!;
+    refs.push({
+      refName,
+      name: refName.slice(PREFIX[type].length),
+      type,
+      current: f[3] === "*",
+      hash,
+      shortHash: hash.slice(0, 7),
+      subject: f[11] || f[10]!,
+      author: f[7] || f[6]!,
+      date: f[9] || f[8]!,
+      upstream: f[4] || null,
+      ...parseUpstreamTrack(f[5]!),
+    });
+  }
+
+  return refs.sort(newestFirst);
+}

package/src/services/git.service.ts

@@ -1,13 +1,16 @@
 import path from "node:path";
 import simpleGit, { type SimpleGit } from "simple-git";
 import { isBinaryContent } from "./binary-content.ts";
+import { FOR_EACH_REF_ARGS, parseForEachRef } from "./git-refs/for-each-ref.ts";
 import type {
+  CheckoutMode,
   FileFullDiff,
   GitStatus,
   GitFileChange,
   GitCommit,
   GitBranch,
   GitGraphData,
+  GitRef,
   GitWorktree,
 } from "../types/git.ts";
 
@@ -319,8 +322,28 @@ class GitService {
     await this.git(projectPath).checkoutBranch(name, from ?? "HEAD");
   }
 
-  async checkout(projectPath: string, ref: string): Promise<void> {
-    await this.git(projectPath).checkout(ref);
+  /**
+   * `track` is not a nicety: `git checkout origin/foo` lands on a **detached
+   * HEAD**, because the remote-tracking ref is not a branch anyone can commit
+   * to. `-t` is what creates the local `foo` that follows it. The picker
+   * chooses between the three modes; the service only has to keep them apart.
+   */
+  async checkout(
+    projectPath: string,
+    ref: string,
+    mode: CheckoutMode = "checkout",
+  ): Promise<void> {
+    const flags = mode === "detach" ? ["--detach"] : mode === "track" ? ["-t"] : [];
+    // `--` or the ref is read as a pathspec when no such ref exists: `git checkout src`
+    // in a repository with no branch named `src` restores every unstaged change under
+    // that directory, silently and with exit 0. `assertSafeRev` refuses a leading dash
+    // and a range, but a plain directory name is a legitimate ref shape.
+    await this.git(projectPath).checkout([...flags, ref, "--"]);
+  }
+
+  /** Every local branch, remote-tracking branch and tag, newest commit first. */
+  async refs(projectPath: string): Promise<GitRef[]> {
+    return parseForEachRef(await this.git(projectPath).raw(FOR_EACH_REF_ARGS));
   }
 
   async deleteBranch(