@marktrue/dsh-mobile-remote 3.2.3-rc.1 → 3.2.4-alpha.1

package/lib/git-read-bundled-provider.js

@@ -41,6 +41,51 @@ function gitError(code, status, message = code) {
 	return error;
 }
 
+const refShortName = (name) => name === "HEAD" ? "HEAD" : String(name).replace(/^refs\/(?:heads|remotes|tags)\//, "");
+const HISTORY_STATUS_LETTER = { A: "A", M: "M", D: "D", R: "R", C: "C", T: "T" };
+
+/**
+ * Parse `git log --format=%x00<meta> --name-status -M -z` output into file
+ * history entries. Records are NUL-delimited: a `\x00` start marker, the
+ * `\x1f`-separated metadata, then `\x00\n<status>` and its NUL-separated paths.
+ * A deadline-aborted command may end mid-record; incomplete trailing records
+ * are ignored while every fully parsed commit stays usable.
+ */
+function parseFileHistory(stdout) {
+	const tokens = String(stdout ?? "").split("\0");
+	const entries = [];
+	let index = 0;
+	while (index < tokens.length) {
+		const metadata = tokens[index++];
+		if (!metadata || metadata.startsWith("\n")) continue;
+		const fields = metadata.split("\x1f");
+		if (fields.length < 5) continue;
+		const oid = fields[0];
+		if (!/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(oid)) continue;
+		let status = "M";
+		if (index < tokens.length) {
+			const marker = tokens[index];
+			if (typeof marker === "string" && marker.startsWith("\n")) {
+				index++;
+				const code = marker.slice(1).trim();
+				if (code) {
+					status = HISTORY_STATUS_LETTER[code[0]] ?? "M";
+					index += /^[RC]/.test(code) ? 2 : 1;
+				}
+			}
+		}
+		entries.push({
+			oid,
+			shortOid: fields[1] || oid.slice(0, 7),
+			author: fields[2] ?? "",
+			timestamp: Number(fields[3]) || 0,
+			subject: fields.slice(4).join("\x1f"),
+			status,
+		});
+	}
+	return entries;
+}
+
 /** Bundled, read-only Git provider. Every command uses the host subprocess service. */
 export function createBundledGitReadProvider(ctx) {
 	const get = (name) => {
@@ -61,7 +106,7 @@ export function createBundledGitReadProvider(ctx) {
 		if (!roots.some((root) => root && inside(canonical, root))) throw gitError("workspace-not-allowed", 403);
 		return canonical;
 	};
-	const run = async (root, args, disableFilters = false, allowNoMatches = false) => {
+	const spawnGit = async (root, args, { disableFilters = false, allowNoMatches = false, timeoutMs = 0 } = {}) => {
 		root = await assertWorkspace(root);
 		const executor = subprocess();
 		if (!executor?.spawn) throw gitError("git-provider-unavailable", 503);
@@ -71,63 +116,80 @@ export function createBundledGitReadProvider(ctx) {
 			const names = await run(root, ["config", "--null", "--name-only", "--get-regexp", "^filter\\..*\\.(clean|process)$"], false, true);
 			filterOverrides = names.split("\0").filter(Boolean).flatMap((name) => ["-c", `${name}=`]);
 		}
-		const child = executor.spawn({
-			argv: [
-				process.platform === "win32" ? "git.exe" : "git",
-				"-c", "core.fsmonitor=false",
-				"-c", `core.hooksPath=${noHooksPath}`,
-				...filterOverrides,
-				"-C", root,
-				"--no-optional-locks",
-				...args,
-			],
-			cwd: root,
-			// Prevent ambient Git repository/config overrides from redirecting a
-			// session-authorized read. Undefined values are seam tombstones.
-			env: {
-				GIT_TERMINAL_PROMPT: "0",
-				GCM_INTERACTIVE: "never",
-				GIT_DIR: undefined,
-				GIT_WORK_TREE: undefined,
-				GIT_INDEX_FILE: undefined,
-				GIT_COMMON_DIR: undefined,
-				GIT_OBJECT_DIRECTORY: undefined,
-				GIT_ALTERNATE_OBJECT_DIRECTORIES: undefined,
-				GIT_CONFIG: undefined,
-				GIT_CONFIG_PARAMETERS: undefined,
-				GIT_CONFIG_COUNT: "0",
-				// Trace destinations open files even for otherwise read-only Git commands.
-				...Object.fromEntries(Object.keys(process.env).filter((key) => /^GIT_TRACE(?:2)?(?:_|$)/.test(key)).map((key) => [key, undefined])),
-				GIT_TRACE: undefined,
-				GIT_TRACE2: undefined,
-				GIT_TRACE2_EVENT: undefined,
-				GIT_TRACE2_PERF: undefined,
-			},
-			stdio: { stdin: "ignore", stdout: { maxBytes: 8 * 1024 * 1024 }, stderr: { maxBytes: 1024 * 1024 } },
-			graceMs: 10_000,
-		});
-		const done = await child.done;
-		const stdoutResult = await child.collected?.stdout?.readFrom?.(0);
-		const stderrResult = await child.collected?.stderr?.readFrom?.(0);
-		if (stdoutResult?.lossy || stderrResult?.lossy) {
-			throw gitError("git-output-too-large", 413);
-		}
-		const stdout = stdoutResult?.text ?? "";
-		const stderr = stderrResult?.text ?? "";
-		if (done?.exitCode !== 0) {
-			if (allowNoMatches && done?.exitCode === 1) return "";
-			if (/not a git repository/i.test(stderr)) throw gitError("not-git-repository", 404);
-			throw gitError("git-command-failed", 400);
+		// A soft deadline aborts the command and returns the output collected so far,
+		// so file history can degrade to a partial, explicitly truncated page instead
+		// of failing the request. Hardening below is shared with the batch helper.
+		const controller = timeoutMs > 0 ? new AbortController() : null;
+		const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : null;
+		try {
+			const child = executor.spawn({
+				argv: [
+					process.platform === "win32" ? "git.exe" : "git",
+					"-c", "core.fsmonitor=false",
+					"-c", `core.hooksPath=${noHooksPath}`,
+					...filterOverrides,
+					"-C", root,
+					"--no-optional-locks",
+					...args,
+				],
+				cwd: root,
+				// Prevent ambient Git repository/config overrides from redirecting a
+				// session-authorized read. Undefined values are seam tombstones.
+				env: {
+					GIT_TERMINAL_PROMPT: "0",
+					GCM_INTERACTIVE: "never",
+					GIT_DIR: undefined,
+					GIT_WORK_TREE: undefined,
+					GIT_INDEX_FILE: undefined,
+					GIT_COMMON_DIR: undefined,
+					GIT_OBJECT_DIRECTORY: undefined,
+					GIT_ALTERNATE_OBJECT_DIRECTORIES: undefined,
+					GIT_CONFIG: undefined,
+					GIT_CONFIG_PARAMETERS: undefined,
+					GIT_CONFIG_COUNT: "0",
+					// Trace destinations open files even for otherwise read-only Git commands.
+					...Object.fromEntries(Object.keys(process.env).filter((key) => /^GIT_TRACE(?:2)?(?:_|$)/.test(key)).map((key) => [key, undefined])),
+					GIT_TRACE: undefined,
+					GIT_TRACE2: undefined,
+					GIT_TRACE2_EVENT: undefined,
+					GIT_TRACE2_PERF: undefined,
+				},
+				stdio: { stdin: "ignore", stdout: { maxBytes: 8 * 1024 * 1024 }, stderr: { maxBytes: 1024 * 1024 } },
+				graceMs: 10_000,
+				...(controller ? { signal: controller.signal } : {}),
+			});
+			let done;
+			try { done = await child.done; } catch (error) {
+				if (!controller?.signal.aborted) throw error;
+				done = { exitCode: null };
+			}
+			const stdoutResult = await child.collected?.stdout?.readFrom?.(0);
+			const stderrResult = await child.collected?.stderr?.readFrom?.(0);
+			if (stdoutResult?.lossy || stderrResult?.lossy) {
+				throw gitError("git-output-too-large", 413);
+			}
+			const stdout = stdoutResult?.text ?? "";
+			const stderr = stderrResult?.text ?? "";
+			if (controller?.signal.aborted) return { stdout, stderr, timedOut: true };
+			if (done?.exitCode !== 0) {
+				if (allowNoMatches && done?.exitCode === 1) return { stdout: "", stderr, timedOut: false };
+				if (/not a git repository/i.test(stderr)) throw gitError("not-git-repository", 404);
+				throw gitError("git-command-failed", 400);
+			}
+			return { stdout, stderr, timedOut: false };
+		} finally {
+			if (timer) clearTimeout(timer);
 		}
-		return stdout;
 	};
+	const run = async (root, args, disableFilters = false, allowNoMatches = false) =>
+		(await spawnGit(root, args, { disableFilters, allowNoMatches })).stdout;
 	const repositoryRoot = async (cwd) => {
 		const allowed = await assertWorkspace(cwd);
 		const root = (await run(allowed, ["rev-parse", "--show-toplevel"])).trim();
 		return assertWorkspace(root);
 	};
 	return {
-		contractVersion: "1.0.0",
+		contractVersion: "1.1.0",
 		capabilities() {
 			const available = Boolean(subprocess()?.spawn) && workspaces().length > 0;
 			return { available, reason: available ? null : !subprocess()?.spawn ? "git-provider-unavailable" : "workspace-registry-unavailable" };
@@ -157,8 +219,8 @@ export function createBundledGitReadProvider(ctx) {
 		},
 		async commit(root, oid) {
 			if (typeof oid !== "string" || !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(oid)) throw gitError("invalid-oid", 400);
-			const metadata = (await run(root, ["show", "-s", "--format=%H%x1f%P%x1f%an%x1f%at%x1f%B%x00", oid])).split("\0")[0].split("\x1f");
-			const [hash, parentText, author, timestamp, ...messageParts] = metadata;
+			const metadata = (await run(root, ["show", "-s", "--decorate=full", "--format=%H%x1f%P%x1f%an%x1f%at%x1f%D%x1f%B%x00", oid])).split("\0")[0].split("\x1f");
+			const [hash, parentText, author, timestamp, decorations, ...messageParts] = metadata;
 			const diffBase = parentText ? [parentText.split(" ")[0], hash] : ["--root", hash];
 			const statusParts = (await run(root, ["diff-tree", "--no-commit-id", "-r", "-M", "--name-status", "-z", ...diffBase])).split("\0");
 			const files = [];
@@ -187,7 +249,140 @@ export function createBundledGitReadProvider(ctx) {
 				stats.set(path, { binary: added === "-" || deleted === "-", additions: added === "-" ? null : Number(added), deletions: deleted === "-" ? null : Number(deleted) });
 			}
 			for (const file of files) Object.assign(file, stats.get(file.path) ?? { binary: false, additions: 0, deletions: 0 });
-			return { oid: hash, parents: parentText ? parentText.split(" ") : [], author, timestamp: Number(timestamp) || 0, message: messageParts.join("\x1f").trim(), files };
+			return {
+				oid: hash, parents: parentText ? parentText.split(" ") : [], author, timestamp: Number(timestamp) || 0,
+				message: messageParts.join("\x1f").trim(),
+				refs: decorations ? decorations.split(",").map((value) => value.trim()).filter(Boolean) : [],
+				files,
+			};
+		},
+		/**
+		 * All branch, remote, tag and HEAD refs with name-level facts plus
+		 * annotated-tag metadata. Non-commit and nested tag targets carry a hint
+		 * instead of failing the whole read.
+		 */
+		async refs(root) {
+			const records = [];
+			// NUL/US-delimited fields keep tagger names and tag subjects that contain
+			// tabs intact; a tab-delimited line format would corrupt such records.
+			const text = await run(root, ["for-each-ref", "--format=%(refname)%1f%(objectname)%1f%(objecttype)%1f%(HEAD)%1f%(taggername)%1f%(taggerdate:unix)%1f%(subject)%1f%(*objectname)%1f%(*objecttype)%00", "refs/heads", "refs/remotes", "refs/tags"]);
+			for (const raw of text.split("\0")) {
+				const record = raw.replace(/^[\r\n]+|[\r\n]+$/g, "");
+				if (!record) continue;
+				const fields = record.split("\x1f");
+				if (fields.length < 9) continue;
+				// Peeled fields are fixed at the tail so a subject containing the
+				// unit separator cannot swallow them.
+				const [name, oid, objectType, headFlag, taggerName, taggerDate] = fields;
+				const peeledType = fields.at(-1);
+				const peeledOid = fields.at(-2);
+				const subject = fields.slice(6, -2).join("\x1f");
+				if (!name || !oid) continue;
+				if (name.startsWith("refs/remotes/") && name.endsWith("/HEAD")) continue;
+				if (name.startsWith("refs/heads/") || name.startsWith("refs/remotes/")) {
+					const commit = objectType === "commit";
+					records.push({
+						name, shortName: refShortName(name),
+						kind: name.startsWith("refs/heads/") ? "localBranch" : "remoteBranch",
+						oid, commitOid: commit ? oid : null, current: headFlag === "*", annotated: false,
+						...(commit ? {} : { hint: "non-commit-target" }),
+					});
+					continue;
+				}
+				if (!name.startsWith("refs/tags/")) continue;
+				if (objectType !== "tag") {
+					// Lightweight tag: the ref itself points at the target object.
+					const commit = objectType === "commit";
+					records.push({
+						name, shortName: refShortName(name), kind: "tag",
+						oid, commitOid: commit ? oid : null, current: false, annotated: false,
+						...(commit ? {} : { hint: "non-commit-target" }),
+					});
+					continue;
+				}
+				let commitOid = null, hint;
+				if (peeledType === "commit") commitOid = peeledOid;
+				else if (peeledType === "tag") {
+					// Nested tag: peel recursively; when the chain ends outside a
+					// commit we still keep the name and advertise the hint.
+					try { commitOid = (await run(root, ["rev-parse", "--verify", `${name}^{commit}`])).trim() || null; } catch { commitOid = null; }
+					hint = commitOid ? "nested-tag" : "non-commit-target";
+				} else hint = "non-commit-target";
+				const date = Number(taggerDate);
+				records.push({
+					name, shortName: refShortName(name), kind: "tag", oid, commitOid, current: false, annotated: true,
+					...(taggerName ? { tagger: taggerName } : {}),
+					...(Number.isFinite(date) && date > 0 ? { date } : {}),
+					...(subject ? { subject } : {}),
+					...(hint ? { hint } : {}),
+				});
+			}
+			let headOid = null;
+			try { headOid = (await run(root, ["rev-parse", "--verify", "HEAD"])).trim() || null; } catch (error) { if (error?.code !== "git-command-failed") throw error; }
+			if (headOid) records.unshift({ name: "HEAD", shortName: "HEAD", kind: "head", oid: headOid, commitOid: headOid, current: true, annotated: false });
+			return records;
+		},
+		/** Tracked files at HEAD, bounded and filtered by a case-insensitive path substring. */
+		async files(root, { q = "", limit = 200 } = {}) {
+			const pageSize = Math.max(1, Math.min(200, Number(limit) || 200));
+			// The recursive HEAD path list is bounded by the subprocess stdout cap
+			// (8 MiB, see spawnGit). Repositories above that cap fail closed with
+			// `git-output-too-large` (413) instead of returning a partial list; the
+			// bound is documented in docs/03-api.md §6.19.7.
+			let text;
+			try { text = await run(root, ["ls-tree", "-r", "-z", "--name-only", "HEAD"]); } catch (error) {
+				if (error?.code !== "git-command-failed") throw error;
+				// An unborn HEAD is an empty repository, not a failure: /git/files
+				// must answer 200 with an empty list for it.
+				try { await run(root, ["rev-parse", "--verify", "HEAD"]); } catch (inner) {
+					if (inner?.code === "git-command-failed") return { files: [], truncated: false };
+					throw inner;
+				}
+				throw error;
+			}
+			const query = typeof q === "string" ? q.toLowerCase() : "";
+			let paths = text.split("\0").filter((path) => path !== "");
+			if (query) paths = paths.filter((path) => path.toLowerCase().includes(query));
+			paths.sort((left, right) => left < right ? -1 : left > right ? 1 : 0);
+			const truncated = paths.length > pageSize;
+			return { files: paths.slice(0, pageSize), truncated };
+		},
+		/**
+		 * Commits touching one file, newest first, with the change status that
+		 * commit applied to the path. Bounded by `maxCommits` or the soft
+		 * deadline; both report an explicitly truncated (partial) list.
+		 */
+		async fileHistory(root, path, { maxCommits = 5000, timeoutMs = 20000 } = {}) {
+			if (typeof path !== "string" || path === "" || path.includes("\0")) throw gitError("git-command-failed", 400);
+			try { await run(root, ["rev-parse", "--verify", "HEAD"]); } catch (error) {
+				if (error?.code === "git-command-failed") return { entries: [], truncated: false, reason: "no-history" };
+				throw error;
+			}
+			let tracked = false;
+			try {
+				const tree = await run(root, ["ls-tree", "-z", "HEAD", "--", `:(literal)${path}`]);
+				for (const record of tree.split("\0")) {
+					const separator = record.indexOf("\t");
+					if (separator < 0) continue;
+					const entryPath = record.slice(separator + 1);
+					const entryType = record.slice(0, separator).split(" ")[1];
+					// Directories, gitlinks and other tree entries are not file paths;
+					// only blobs (regular files and symlinks) have a file history.
+					if (entryPath === path && entryType === "blob") tracked = true;
+				}
+			} catch (error) {
+				if (error?.code !== "git-command-failed") throw error;
+			}
+			if (!tracked) return { entries: [], truncated: false, reason: "not-tracked" };
+			const cap = Math.max(1, Math.min(5000, Number(maxCommits) || 5000));
+			const result = await spawnGit(root, ["--literal-pathspecs", "log", `--max-count=${cap + 1}`, "--format=%x00%H%x1f%h%x1f%an%x1f%at%x1f%s", "--name-status", "-M", "-z", "--", path], { timeoutMs });
+			let entries = parseFileHistory(result.stdout);
+			let truncated = result.timedOut === true;
+			if (entries.length > cap) {
+				entries = entries.slice(0, cap);
+				truncated = true;
+			}
+			return { entries, truncated };
 		},
 		async worktree(root) {
 			const text = await run(root, ["status", "--porcelain=v1", "-z", "--untracked-files=all"], true);