@icode-js/icode 3.2.0 → 3.4.0

package/src/core/git/context.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import { runCommand } from '../commands/shell.js'
+import { readRepoConfig } from '../config/repo-config.js'
 import { readConfig } from '../config/store.js'
 import { IcodeError } from '../errors.js'
 
@@ -29,11 +30,15 @@ async function ensureGitRepository(cwd) {
   })
 }
 
-async function detectDefaultBranch(topLevelPath, fallbackCandidates = ['main', 'master']) {
-  const headRefResult = await commandOutput(topLevelPath, ['symbolic-ref', 'refs/remotes/origin/HEAD'], true)
+async function detectDefaultBranch(topLevelPath, remoteName, fallbackCandidates = ['main', 'master'], preferred = '') {
+  if (preferred) {
+    return preferred
+  }
+
+  const headRefResult = await commandOutput(topLevelPath, ['symbolic-ref', `refs/remotes/${remoteName}/HEAD`], true)
   if (headRefResult.exitCode === 0) {
     const headRef = cleanOutput(headRefResult.stdout)
-    const branchName = headRef.replace('refs/remotes/origin/', '')
+    const branchName = headRef.replace(`refs/remotes/${remoteName}/`, '')
     if (branchName) {
       return branchName
     }
@@ -45,7 +50,7 @@ async function detectDefaultBranch(topLevelPath, fallbackCandidates = ['main', '
       return candidate
     }
 
-    const remoteRef = await commandOutput(topLevelPath, ['show-ref', '--verify', '--quiet', `refs/remotes/origin/${candidate}`], true)
+    const remoteRef = await commandOutput(topLevelPath, ['show-ref', '--verify', '--quiet', `refs/remotes/${remoteName}/${candidate}`], true)
     if (remoteRef.exitCode === 0) {
       return candidate
     }
@@ -54,6 +59,54 @@ async function detectDefaultBranch(topLevelPath, fallbackCandidates = ['main', '
   return 'main'
 }
 
+/**
+ * 解析本次命令使用的 remote 名称。
+ * 优先级：命令参数 > ICODE_REMOTE 环境变量 > 仓库 .icoderc > 全局配置 defaults.remote
+ *        > 当前分支 upstream 的 remote > origin > 第一个 remote。
+ * 显式指定（参数/环境变量）但仓库里不存在时直接报错，配置项不存在时回退到自动识别。
+ */
+export async function resolveRemoteName(topLevelPath, currentBranch, sources = {}) {
+  const remotesResult = await commandOutput(topLevelPath, ['remote'], true)
+  const remotes = cleanOutput(remotesResult.stdout).split('\n').map((item) => item.trim()).filter(Boolean)
+
+  for (const explicit of [sources.option, sources.env]) {
+    const name = String(explicit || '').trim()
+    if (!name) {
+      continue
+    }
+    if (!remotes.includes(name)) {
+      throw new IcodeError(`remote 不存在: ${name}。当前仓库 remote: ${remotes.join(', ') || '(无)'}`, {
+        code: 'GIT_REMOTE_NOT_FOUND',
+        exitCode: 2,
+        meta: { remote: name, remotes }
+      })
+    }
+    return { remote: name, source: explicit === sources.option ? 'option' : 'env', remotes }
+  }
+
+  for (const [configured, source] of [[sources.repoConfig, 'repo-config'], [sources.globalConfig, 'config']]) {
+    const name = String(configured || '').trim()
+    if (name && remotes.includes(name)) {
+      return { remote: name, source, remotes }
+    }
+  }
+
+  if (currentBranch) {
+    const upstreamRemote = cleanOutput(
+      (await commandOutput(topLevelPath, ['config', '--get', `branch.${currentBranch}.remote`], true)).stdout
+    )
+    if (upstreamRemote && upstreamRemote !== '.' && remotes.includes(upstreamRemote)) {
+      return { remote: upstreamRemote, source: 'upstream', remotes }
+    }
+  }
+
+  if (remotes.includes('origin') || !remotes.length) {
+    return { remote: 'origin', source: 'default', remotes }
+  }
+
+  return { remote: remotes[0], source: 'first-remote', remotes }
+}
+
 /**
  * 解析当前 Git 仓库上下文。
  * 输入为 cwd/repoMode 等选项，输出仓库根路径、git 目录、当前分支和默认分支等稳定上下文。
@@ -96,9 +149,19 @@ export async function resolveGitContext(options = {}) {
   const hasHuskyFolder = fs.existsSync(path.resolve(topLevelPath, '.husky'))
   const hasHookPath = fs.existsSync(hookPath)
 
+  const repoConfig = readRepoConfig(topLevelPath)
+  const remoteInfo = await resolveRemoteName(topLevelPath, currentBranch, {
+    option: options.remote,
+    env: process.env.ICODE_REMOTE,
+    repoConfig: repoConfig.remote,
+    globalConfig: config.defaults?.remote
+  })
+
   const defaultBranch = await detectDefaultBranch(
     topLevelPath,
-    config.defaults?.defaultMainBranches || ['main', 'master']
+    remoteInfo.remote,
+    config.defaults?.defaultMainBranches || ['main', 'master'],
+    repoConfig.defaultBranch
   )
 
   return {
@@ -109,6 +172,10 @@ export async function resolveGitContext(options = {}) {
     commonDir,
     currentBranch,
     defaultBranch,
+    remote: remoteInfo.remote,
+    remoteSource: remoteInfo.source,
+    remotes: remoteInfo.remotes,
+    repoConfig,
     inheritedFromParent,
     hasHuskyFolder,
     hookPath,

package/src/core/git/file-guard.js

@@ -0,0 +1,193 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { IcodeError } from '../errors.js'
+
+// 文件名层面的敏感规则（glob 风格，匹配文件 basename 或相对路径）。
+const DEFAULT_SENSITIVE_NAME_PATTERNS = [
+  '.env',
+  '.env.*',
+  '*.pem',
+  '*.key',
+  '*.p12',
+  '*.pfx',
+  '*.keystore',
+  '*.jks',
+  'id_rsa',
+  'id_rsa.*',
+  'id_dsa',
+  'id_ecdsa',
+  'id_ed25519',
+  '.pypirc',
+  '.netrc',
+  'credentials',
+  'credentials.json',
+  '*.credentials.json',
+  'service-account*.json',
+  '*.tfstate',
+  '*.kdbx'
+]
+
+// 这些文件即使命中上面的规则也视为安全（模板/示例）。
+const DEFAULT_ALLOW_NAME_PATTERNS = [
+  '.env.example',
+  '.env.sample',
+  '.env.template',
+  '.env.dist',
+  '*.example',
+  '*.sample'
+]
+
+// 内容层面的密钥特征。只取高置信度规则，降低误报。
+const SECRET_CONTENT_RULES = [
+  { id: 'private-key', label: '私钥', pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----/ },
+  { id: 'aws-access-key', label: 'AWS Access Key', pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/ },
+  { id: 'github-token', label: 'GitHub Token', pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{60,})\b/ },
+  { id: 'gitlab-token', label: 'GitLab Token', pattern: /\bglpat-[A-Za-z0-9_-]{20,}\b/ },
+  { id: 'slack-token', label: 'Slack Token', pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/ },
+  { id: 'openai-key', label: 'OpenAI/Anthropic Key', pattern: /\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{32,}\b/ },
+  { id: 'google-api-key', label: 'Google API Key', pattern: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+  { id: 'npm-token', label: 'npm Token', pattern: /\bnpm_[A-Za-z0-9]{36}\b|_authToken\s*=\s*[^\s$]+/ }
+]
+
+const MAX_SCAN_BYTES = 1024 * 1024
+
+/**
+ * 把简单 glob（只支持 * 和 ?）转成正则。
+ * 输入为 glob 字符串，输出 RegExp。
+ */
+function globToRegExp(glob) {
+  const escaped = String(glob)
+    .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+    .replace(/\*/g, '.*')
+    .replace(/\?/g, '.')
+  return new RegExp(`^${escaped}$`, 'i')
+}
+
+function matchesAny(filePath, patterns) {
+  const baseName = path.posix.basename(filePath)
+  return patterns.some((pattern) => {
+    const regexp = globToRegExp(pattern)
+    return regexp.test(baseName) || regexp.test(filePath)
+  })
+}
+
+// 粗略判断二进制：前 8KB 里出现 NUL 字节。
+function looksBinary(buffer) {
+  const sample = buffer.subarray(0, Math.min(buffer.length, 8000))
+  return sample.includes(0)
+}
+
+/**
+ * 扫描即将提交的文件，找出敏感文件、疑似密钥和大文件。
+ * 输入为仓库根目录、文件列表和规则选项，输出 findings 数组：
+ * [{ file, type: 'sensitive-file' | 'secret' | 'large-file', detail }]
+ */
+export function scanFilesForRisks(repoRoot, files = [], options = {}) {
+  const maxFileSizeMB = Number(options.maxFileSizeMB) > 0 ? Number(options.maxFileSizeMB) : 5
+  const maxBytes = maxFileSizeMB * 1024 * 1024
+  const sensitivePatterns = [...DEFAULT_SENSITIVE_NAME_PATTERNS, ...(options.sensitivePatterns || [])]
+  const allowPatterns = [...DEFAULT_ALLOW_NAME_PATTERNS, ...(options.allowPatterns || [])]
+  const findings = []
+
+  for (const file of files) {
+    const normalized = String(file).replace(/\\/g, '/')
+    if (matchesAny(normalized, allowPatterns)) {
+      continue
+    }
+
+    if (matchesAny(normalized, sensitivePatterns)) {
+      findings.push({ file: normalized, type: 'sensitive-file', detail: '文件名命中敏感规则' })
+    }
+
+    const absolutePath = path.resolve(repoRoot, normalized)
+    let stats
+    try {
+      stats = fs.statSync(absolutePath)
+    } catch {
+      continue
+    }
+    if (!stats.isFile()) {
+      continue
+    }
+
+    if (stats.size > maxBytes) {
+      findings.push({
+        file: normalized,
+        type: 'large-file',
+        detail: `${(stats.size / 1024 / 1024).toFixed(1)}MB，超过 ${maxFileSizeMB}MB（可考虑 Git LFS）`
+      })
+      continue
+    }
+
+    if (stats.size > MAX_SCAN_BYTES) {
+      continue
+    }
+
+    let buffer
+    try {
+      buffer = fs.readFileSync(absolutePath)
+    } catch {
+      continue
+    }
+    if (looksBinary(buffer)) {
+      continue
+    }
+
+    const content = buffer.toString('utf8')
+    for (const rule of SECRET_CONTENT_RULES) {
+      if (rule.pattern.test(content)) {
+        findings.push({ file: normalized, type: 'secret', detail: `疑似包含 ${rule.label}` })
+        break
+      }
+    }
+  }
+
+  return findings
+}
+
+/**
+ * 格式化风险列表为多行文本。
+ */
+export function formatRiskFindings(findings = []) {
+  const typeLabel = {
+    'sensitive-file': '敏感文件',
+    secret: '疑似密钥',
+    'large-file': '大文件'
+  }
+  return findings.map((item) => `  - [${typeLabel[item.type] || item.type}] ${item.file}: ${item.detail}`).join('\n')
+}
+
+/**
+ * 有风险时抛错阻断提交，allowRisky=true 时放行。
+ * 输入为 findings、命令名、错误码与 allowRisky，输出为空。
+ */
+export function assertNoRiskyFiles(findings, commandName, code, allowRisky = false) {
+  if (!findings.length || allowRisky) {
+    return
+  }
+
+  throw new IcodeError(
+    `检测到 ${findings.length} 个有风险的文件，${commandName} 已停止：\n${formatRiskFindings(findings)}\n` +
+      '确认无误可加 --allow-risky 继续；不想提交的文件请加入 .gitignore，或只提交指定路径。',
+    {
+      code,
+      exitCode: 2,
+      meta: { findings }
+    }
+  )
+}
+
+/**
+ * 一站式：列出待提交文件并扫描风险。
+ * 输入为 GitService、上下文和 { mode, paths }，输出 { files, findings }。
+ */
+export async function inspectPendingFiles(git, context, options = {}) {
+  const files = await git.listPendingFiles({ mode: options.mode, paths: options.paths })
+  const saveRules = context.repoConfig?.save || {}
+  const findings = scanFilesForRisks(context.topLevelPath, files, {
+    maxFileSizeMB: saveRules.maxFileSizeMB,
+    sensitivePatterns: saveRules.sensitivePatterns,
+    allowPatterns: saveRules.allowPatterns
+  })
+  return { files, findings }
+}

package/src/core/git/operation-state.js

@@ -0,0 +1,63 @@
+import fs from 'node:fs'
+import path from 'node:path'
+
+// 多步骤命令（push 合并多个分支、migrate、sync）被冲突打断时，把剩下的步骤记在这里，
+// 解决冲突后 icode continue 读取它接着做完，icode abort 读取它切回原分支。
+// 放在 gitDir（每个 worktree 独立）下，不会被提交。
+
+const STATE_DIR = 'icode'
+const STATE_FILE = 'operation.json'
+
+function statePath(context) {
+  return path.resolve(context.gitDir, STATE_DIR, STATE_FILE)
+}
+
+/**
+ * 保存中断的操作。state 至少包含 command 与 originalBranch。
+ */
+export function saveOperationState(context, state) {
+  const filePath = statePath(context)
+  fs.mkdirSync(path.dirname(filePath), { recursive: true })
+  fs.writeFileSync(filePath, `${JSON.stringify({ ...state, savedAt: new Date().toISOString() }, null, 2)}\n`, 'utf8')
+  return filePath
+}
+
+/**
+ * 读取中断的操作，没有或损坏时返回 null。
+ */
+export function loadOperationState(context) {
+  const filePath = statePath(context)
+  if (!fs.existsSync(filePath)) {
+    return null
+  }
+  try {
+    const state = JSON.parse(fs.readFileSync(filePath, 'utf8'))
+    return state && typeof state === 'object' && state.command ? state : null
+  } catch {
+    return null
+  }
+}
+
+export function clearOperationState(context) {
+  fs.rmSync(statePath(context), { force: true })
+}
+
+/**
+ * 用一句话描述中断的操作，供 ready / 菜单 / continue 展示。
+ */
+export function describeOperationState(state) {
+  if (!state) {
+    return ''
+  }
+  if (state.command === 'push') {
+    const pending = [state.pendingPush, ...(state.remainingTargets || [])].filter(Boolean)
+    return `push ${state.sourceBranch}${pending.length ? ` → ${pending.join(', ')}` : ''}`
+  }
+  if (state.command === 'migrate') {
+    return `migrate ${state.sourceBranch} → ${state.targetBranch}`
+  }
+  if (state.command === 'sync') {
+    return `sync ${[state.currentBranch, ...(state.remainingTargets || [])].filter(Boolean).join(', ')}`
+  }
+  return state.command
+}

package/src/core/git/operations.js

@@ -0,0 +1,32 @@
+// 按 Git 操作类型执行 continue / abort，undo 与 continue/abort 命令共用。
+
+export const OPERATION_LABELS = {
+  merge: '合并 (merge)',
+  rebase: '变基 (rebase)',
+  'cherry-pick': '摘取提交 (cherry-pick)',
+  revert: '回滚 (revert)'
+}
+
+export async function continueOperation(git, operation) {
+  if (operation === 'revert') {
+    await git.revertContinue()
+  } else if (operation === 'merge') {
+    await git.mergeContinue()
+  } else if (operation === 'rebase') {
+    await git.rebaseContinue()
+  } else {
+    await git.cherryPickContinue()
+  }
+}
+
+export async function abortOperation(git, operation) {
+  if (operation === 'revert') {
+    await git.revertAbort()
+  } else if (operation === 'merge') {
+    await git.mergeAbort()
+  } else if (operation === 'rebase') {
+    await git.rebaseAbort()
+  } else {
+    await git.abortCherryPick()
+  }
+}

package/src/core/git/semver.js

@@ -0,0 +1,194 @@
+import { IcodeError } from '../errors.js'
+
+const VERSION_PATTERN = /^(.*?)(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/
+
+/**
+ * 解析版本 tag，例如 v1.2.3、release-1.2.3、1.2.3-beta.1。
+ * 输出 { prefix, major, minor, patch, prerelease } 或 null。
+ */
+export function parseVersionTag(tag) {
+  const match = String(tag || '').trim().match(VERSION_PATTERN)
+  if (!match) {
+    return null
+  }
+  return {
+    prefix: match[1],
+    major: Number(match[2]),
+    minor: Number(match[3]),
+    patch: Number(match[4]),
+    prerelease: match[5] || ''
+  }
+}
+
+export function formatVersion(version, prefix = version.prefix ?? 'v') {
+  const core = `${version.major}.${version.minor}.${version.patch}`
+  return `${prefix}${core}${version.prerelease ? `-${version.prerelease}` : ''}`
+}
+
+// 比较两个版本：a>b 返回正数；正式版大于同号预发布版。
+export function compareVersions(a, b) {
+  for (const key of ['major', 'minor', 'patch']) {
+    if (a[key] !== b[key]) {
+      return a[key] - b[key]
+    }
+  }
+  if (a.prerelease === b.prerelease) {
+    return 0
+  }
+  if (!a.prerelease) {
+    return 1
+  }
+  if (!b.prerelease) {
+    return -1
+  }
+  return a.prerelease.localeCompare(b.prerelease, undefined, { numeric: true })
+}
+
+/**
+ * 从 tag 列表中找最新的版本 tag（可按前缀过滤，默认忽略预发布版）。
+ */
+export function findLatestVersionTag(tags = [], options = {}) {
+  let latest = null
+  for (const tag of tags) {
+    const version = parseVersionTag(tag)
+    if (!version) {
+      continue
+    }
+    if (options.prefix != null && version.prefix !== options.prefix) {
+      continue
+    }
+    if (version.prerelease && !options.includePrerelease) {
+      continue
+    }
+    if (!latest || compareVersions(version, latest.version) > 0) {
+      latest = { tag, version }
+    }
+  }
+  return latest
+}
+
+const CONVENTIONAL_PATTERN = /^(\w+)(?:\(([^)]*)\))?(!)?:\s*(.+)$/
+
+export function parseConventionalSubject(subject = '') {
+  const match = String(subject).match(CONVENTIONAL_PATTERN)
+  if (!match) {
+    return { type: '', scope: '', breaking: false, description: String(subject).trim() }
+  }
+  return {
+    type: match[1].toLowerCase(),
+    scope: match[2] || '',
+    breaking: Boolean(match[3]),
+    description: match[4].trim()
+  }
+}
+
+/**
+ * 根据 Conventional Commits 推断版本升级类型：破坏性变更 -> major，feat -> minor，其它 -> patch。
+ * 0.x 版本的破坏性变更只升 minor（semver 约定）。
+ */
+export function inferBump(commits = [], currentVersion = null) {
+  let bump = 'patch'
+  for (const commit of commits) {
+    const parsed = parseConventionalSubject(commit.subject)
+    const breaking = parsed.breaking || /BREAKING[ -]CHANGE/.test(commit.body || '')
+    if (breaking) {
+      return currentVersion && currentVersion.major === 0 ? 'minor' : 'major'
+    }
+    if (parsed.type === 'feat') {
+      bump = 'minor'
+    }
+  }
+  return bump
+}
+
+/**
+ * 计算下一个版本。kind: major | minor | patch | prerelease；preid 用于预发布版（如 beta）。
+ */
+export function bumpVersion(version, kind, preid = '') {
+  const base = version || { prefix: 'v', major: 0, minor: 0, patch: 0, prerelease: '' }
+  const next = { ...base, prerelease: '' }
+
+  if (kind === 'major') {
+    next.major += 1
+    next.minor = 0
+    next.patch = 0
+  } else if (kind === 'minor') {
+    next.minor += 1
+    next.patch = 0
+  } else if (kind === 'patch') {
+    // 从预发布版发正式版时不再额外加 patch。
+    if (!base.prerelease) {
+      next.patch += 1
+    }
+  } else if (kind === 'prerelease') {
+    const id = preid || 'beta'
+    const match = base.prerelease.match(new RegExp(`^${id}\\.(\\d+)$`))
+    if (match) {
+      next.prerelease = `${id}.${Number(match[1]) + 1}`
+    } else {
+      next.patch += base.prerelease ? 0 : 1
+      next.prerelease = `${id}.0`
+    }
+  } else {
+    throw new IcodeError(`不支持的版本升级类型: ${kind}（可选 major | minor | patch | prerelease | auto）`, {
+      code: 'SEMVER_BUMP_INVALID',
+      exitCode: 2
+    })
+  }
+
+  if (preid && kind !== 'prerelease') {
+    next.prerelease = `${preid}.0`
+  }
+  return next
+}
+
+const SECTION_TITLES = [
+  ['breaking', '⚠️ 破坏性变更'],
+  ['feat', '新功能'],
+  ['fix', '问题修复'],
+  ['perf', '性能优化'],
+  ['refactor', '重构'],
+  ['docs', '文档'],
+  ['other', '其它']
+]
+
+/**
+ * 生成 Markdown changelog 片段。
+ * 输入为提交列表与 { version, date, compareUrl, commitUrl }，输出字符串。
+ */
+export function buildChangelog(commits = [], options = {}) {
+  const groups = new Map(SECTION_TITLES.map(([key]) => [key, []]))
+  for (const commit of commits) {
+    const parsed = parseConventionalSubject(commit.subject)
+    if (['chore', 'ci', 'build', 'test', 'style'].includes(parsed.type) && !parsed.breaking) {
+      continue
+    }
+    if (/^Merge (branch|pull request|remote-tracking)/.test(commit.subject)) {
+      continue
+    }
+    const breaking = parsed.breaking || /BREAKING[ -]CHANGE/.test(commit.body || '')
+    const key = breaking ? 'breaking' : groups.has(parsed.type) ? parsed.type : 'other'
+    const scope = parsed.scope ? `**${parsed.scope}**: ` : ''
+    const shortHash = String(commit.hash || '').slice(0, 7)
+    const link = shortHash && options.commitUrl ? ` ([${shortHash}](${options.commitUrl(commit.hash)}))` : shortHash ? ` (${shortHash})` : ''
+    groups.get(key).push(`- ${scope}${parsed.description}${link}`)
+  }
+
+  const heading = options.compareUrl
+    ? `## [${options.version}](${options.compareUrl}) (${options.date})`
+    : `## ${options.version} (${options.date})`
+  const lines = [heading, '']
+  let hasEntries = false
+  for (const [key, title] of SECTION_TITLES) {
+    const items = groups.get(key)
+    if (!items.length) {
+      continue
+    }
+    hasEntries = true
+    lines.push(`### ${title}`, '', ...items, '')
+  }
+  if (!hasEntries) {
+    lines.push('- 维护性更新', '')
+  }
+  return lines.join('\n')
+}