@michelj/context-guard 0.6.2 → 0.6.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@michelj/context-guard",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "Next-generation collaboration layer for humans and coding agents on Codex, Cursor, and Claude.",
   "repository": {
     "type": "git",
@@ -56,8 +56,8 @@
     "node": ">=18"
   },
   "devDependencies": {
-    "@michelj/context-guard-core": "https://github.com/Michel-Johnson/Context-Guard-Cloud/releases/download/shared-v1.1.0/michelj-context-guard-core-1.1.0.tgz",
-    "@michelj/context-guard-workbench": "https://github.com/Michel-Johnson/Context-Guard-Cloud/releases/download/shared-v1.1.0/michelj-context-guard-workbench-1.1.0.tgz",
+    "@michelj/context-guard-core": "https://github.com/Michel-Johnson/Context-Guard-Cloud/releases/download/shared-v1.1.1/michelj-context-guard-core-1.1.1.tgz",
+    "@michelj/context-guard-workbench": "https://github.com/Michel-Johnson/Context-Guard-Cloud/releases/download/shared-v1.1.1/michelj-context-guard-workbench-1.1.1.tgz",
     "marked": "15.0.12",
     "playwright": "1.62.1"
   }

package/prototype/workbench-app.js

@@ -74,7 +74,7 @@ const I18N = {
     remove:"移除", addModule:"接入模块",
     noOpenBugs:"没有 Bug。", unnamedBug:"未命名 Bug", noOpenTodos:"没有 TODO。", unnamedTodo:"未命名 TODO",
     bugSending:"发送中", bugSendFailed:"发送失败", taskQueued:"Cloud 已排队", taskCloudQueued:"等待本地接收", taskBlocked:"等待前序任务完成", taskReceived:"Codex 已收到", taskUncertain:"接收结果待确认", taskInterrupted:"执行中断", taskWaitingReview:"等待 Plan 审核",
-    allSessions:"主工作台 · 工作中 Session", globalSessionView:"仅跟随 Main",
+    allSessions:"主工作台 · 工作中 Session", globalSessionView:"仅跟随 Main", showOtherSessions:"显示其他会话", hideOtherSessions:"仅显示工作中会话",
     projectOverview:"项目总览",
     scopeRequired:"该 Session 尚未获得当前节点权限。确认后将授权当前节点、所有上级和直接关联节点，共 {n} 个新节点。",
     bugWaiting:"待处理", bugProcessing:"处理中", bugHandoff:"待接手",
@@ -178,7 +178,7 @@ const I18N = {
     remove:"Remove", addModule:"Attach module",
     noOpenBugs:"No bugs.", unnamedBug:"Untitled bug", noOpenTodos:"No TODOs.", unnamedTodo:"Untitled TODO",
     bugSending:"Sending", bugSendFailed:"Send failed", taskQueued:"Queued in Cloud", taskCloudQueued:"Waiting for local host", taskReceived:"Received by Codex", taskUncertain:"Receipt uncertain", taskInterrupted:"Interrupted", taskWaitingReview:"Waiting for Plan review",
-    allSessions:"Main workbench · Working sessions", globalSessionView:"Main branch only",
+    allSessions:"Main workbench · Working sessions", globalSessionView:"Main branch only", showOtherSessions:"Show other sessions", hideOtherSessions:"Show working sessions only",
     projectOverview:"Projects",
     scopeRequired:"This session cannot access the current node. Confirm to authorize the node, its ancestors, and direct relations ({n} new nodes).",
     bugWaiting:"Waiting", bugProcessing:"In progress", bugHandoff:"Needs handoff",
@@ -376,6 +376,7 @@ let bugPathReturn = null;
 let activeWorkPanelKind = "bug";
 let foldDormant = false;
 let foldMemoryDoc = false;
+let showOtherSessions = false;
 let foldIdea = false;
 let foldTodo = false;
 let foldBug = false;
@@ -1307,7 +1308,7 @@ function isWorkingSession(meta){
 function visibleSessionChoices(){
   const sessions=normalizeSessions(workbenchSync?.sessions||[]);
   const selected=String(workbenchSync?.activeSession||"__all__");
-  return sessions.filter(meta=>isWorkingSession(meta)||(selected!=="__all__"&&sessionIdOf(meta)===selected));
+  return sessions.filter(meta=>showOtherSessions||isWorkingSession(meta)||(selected!=="__all__"&&sessionIdOf(meta)===selected));
 }
 function browserCurrentSessionId(){
   const id=String(new URLSearchParams(location.search).get("session")||"").trim();
@@ -1469,7 +1470,12 @@ function renderSessionMenu(){
       <span class="session-option-copy"><span class="session-option-name">${esc(label.primary)}</span>${label.secondary?`<span class="session-option-context">${esc(label.secondary)}</span>`:""}</span>
       <span class="session-option-state ${lifecycle.state}">${esc(lifecycle.label)}</span><span class="session-status ${lifecycle.state}" aria-label="${lifecycle.label}"></span>
     </button>`;
-  }).join("");
+  }).join("") + `<button type="button" data-show-other-sessions aria-pressed="${showOtherSessions}">${esc(t(showOtherSessions?"hideOtherSessions":"showOtherSessions"))}</button>`;
+  menu.querySelector('[data-show-other-sessions]').onclick = ()=>{
+    showOtherSessions = !showOtherSessions;
+    syncSessionSelect();
+    renderSessionMenu();
+  };
   menu.querySelectorAll("[data-session]").forEach(button=>{
     button.onclick = async ()=>{
       try {

package/prototype/workbench-sync.mjs

@@ -780,18 +780,26 @@ export class WorkbenchSync {
     if (this.switchingSession) return false;
     if (this.retrying) await this.retrying;
     if (this.switchingSession) return false;
-    if (sessionId !== ALL_SESSIONS && !this.sessions.some(item => item.id === sessionId && item.bindingState !== 'unavailable')) return false;
-    if (this.dirty()) {
-      await this.flush();
-      if (this.dirty()) { this.setStatus(this.status, '当前视图仍有未保存内容，暂不能切换'); return false; }
-    }
-    if (this.switchingSession) return false;
+    const unavailable = ['unavailable', 'stale', 'closed', 'published', 'expired', 'deleted', 'invalid'];
+    if (sessionId !== ALL_SESSIONS && !this.sessions.some(item => item.id === sessionId && !unavailable.includes(String(item.bindingState || '').toLowerCase()) && !unavailable.includes(String(item.status || '').toLowerCase()))) return false;
     const privateCloud = this.config?.root?.startsWith('cloud:') && this.config.root !== 'cloud:overview';
     const nextView = sessionId === ALL_SESSIONS || (!privateCloud && this.project?.kind !== 'git') ? 'main' : `session:${sessionId}`;
-    const previous = Object.fromEntries(['activeSession', 'pendingSession', 'manualSession', 'viewId', 'captureKey', 'doc', 'version', 'source', 'baseTree', 'ready', 'initializationRequired', 'pendingRequest', 'inputDraft', 'serverRecovery', 'revision', 'sessionUnavailable'].map(key => [key, this[key]]));
-    const previousTree = copy(this.a.getRoot());
+    let previous, previousTree;
+    const previousUrl = location.href;
     this.switchingSession = true;
     try {
+    // A missing Cloud snapshot must not flush the current view's private draft.
+    // This read only checks availability; reload still obtains the final baseline.
+    if (privateCloud && nextView.startsWith('session:') && nextView !== this.viewId) {
+      const target = await this.call('/api/state', undefined, 'GET', nextView);
+      if (target.error || target.recovery || !target.doc?.root) throw Object.assign(new Error(target.error?.message || target.recovery?.message || '地图尚未同步'), { code: target.error?.code || (!target.doc?.root ? 'UNKNOWN_VIEW' : undefined) });
+    }
+    if (this.dirty()) {
+      await this.flush();
+      if (this.dirty()) { this.setStatus(this.status, '当前视图仍有未保存内容，暂不能切换'); return false; }
+    }
+    previous = Object.fromEntries(['activeSession', 'pendingSession', 'manualSession', 'viewId', 'captureKey', 'doc', 'version', 'source', 'baseTree', 'ready', 'initializationRequired', 'pendingRequest', 'inputDraft', 'serverRecovery', 'recoveryBlocked', 'revision', 'cachedDiff', 'sessionUnavailable'].map(key => [key, this[key]]));
+    previousTree = copy(this.a.getRoot());
     this.activeSession = sessionId;
     this.sessionUnavailable = false;
     this.pendingSession = '';
@@ -809,12 +817,15 @@ export class WorkbenchSync {
     setTimeout(() => this.refreshAccess().catch(error => this.setStatus('error', error.message)), 0);
     return true;
     } catch (error) {
-      Object.assign(this, previous);
-      if (previous.doc) this.a.apply({ ...previous.doc, root: previousTree });
-      this.panel.querySelector('#cg-sync-initialize').hidden = !previous.initializationRequired || (previous.viewId === 'main' && previous.source?.status !== 'local-folder');
-      this.loadGeneration = (this.loadGeneration || 0) + 1;
-      if (!this.sessionUnavailable) this.connect();
-      this.setStatus('error', '无法切换地图：' + error.message);
+      if (previous) {
+        Object.assign(this, previous);
+        history.replaceState(null, '', previousUrl);
+        if (previous.doc) this.a.apply({ ...previous.doc, root: previousTree });
+        this.panel.querySelector('#cg-sync-initialize').hidden = !previous.initializationRequired || (previous.viewId === 'main' && previous.source?.status !== 'local-folder');
+        this.loadGeneration = (this.loadGeneration || 0) + 1;
+        if (!this.sessionUnavailable) this.connect();
+      }
+      this.setStatus('error', error.code === 'UNKNOWN_VIEW' ? '地图尚未同步；原地图和草稿已保留' : '无法切换地图，原地图和草稿已保留：' + error.message);
       return false;
     } finally { this.switchingSession = false; }
   }

package/scripts/workbench/browser-login.mjs

@@ -1,13 +1,14 @@
 import path from 'node:path';
 import os from 'node:os';
 import { randomBytes, randomUUID } from 'node:crypto';
+import { performance } from 'node:perf_hooks';
 import { atomicWrite, encode, readJSON, withFileLock, pause } from '../shared/io.mjs';
 import { fail } from '../shared/protocol.mjs';
 
-async function request(origin, route, input, fetcher) {
+async function request(origin, route, input, fetcher, timeoutMs = 15000) {
   let response;
   try {
-    response = await fetcher(new URL(route, origin), { method: 'POST', redirect: 'error', signal: AbortSignal.timeout(15000),
+    response = await fetcher(new URL(route, origin), { method: 'POST', redirect: 'error', signal: AbortSignal.timeout(timeoutMs),
       headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(input) });
   } catch { fail('UNAVAILABLE', 'Cloud authorization is unavailable; retry the same connection command'); }
   if ([404, 405, 426].includes(response.status)) fail('UPGRADE_REQUIRED', 'Cloud does not support browser authorization; upgrade Cloud or use the explicit private-input login');
@@ -25,17 +26,32 @@ async function request(origin, route, input, fetcher) {
 
 // The model sees only the verification URL/code. The backend keeps the claim
 // secret and final credential private, including across a stopped CLI invocation.
-export async function browserLogin(device, { repository, repositoryId, wait = false, onPending = () => {}, fetcher = fetch, label = os.hostname() }) {
+export async function browserLogin(device, { repository, repositoryId, wait = false, onPending = () => {}, fetcher = fetch, label = os.hostname(), clock = () => performance.now(), sleep = pause }) {
   const origin = new URL(device.origin);
   if (origin.username || origin.password || origin.pathname !== '/' || origin.search || origin.hash || origin.protocol !== 'https:' && !(device.allowLoopback && origin.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(origin.hostname))) fail('FORBIDDEN', 'Cloud authorization requires an HTTPS origin');
   const file = path.join(device.directory, 'browser-login.json');
+  let deadline = clock() + 600000, grant;
+  const checkDeadline = () => {
+    if (wait && clock() >= deadline) fail('UNAUTHORIZED', 'Browser authorization expired; retry the connection command');
+  };
+  const authorize = async (route, input) => {
+    checkDeadline();
+    try {
+      const result = await request(device.origin, route, input, fetcher, wait ? Math.max(1, Math.min(15000, Math.ceil(deadline - clock()))) : 15000);
+      checkDeadline();
+      return result;
+    } catch (error) { checkDeadline(); throw error; }
+  };
   let first = true;
   for (;;) {
+    checkDeadline();
     const outcome = await withFileLock(file + '.lock', async () => {
+      checkDeadline();
       const connected = await readJSON(device.file, null);
       if (connected?.origin === device.origin && connected.repositoryId === repositoryId && connected.credential) {
         try {
           await device.transmit({ v: 2, id: randomUUID(), type: 'sync.heartbeat', payload: { sessions: [] } });
+          checkDeadline();
           const { credential: _secret, origin: _origin, ...data } = connected;
           return { connected: true, ...data };
         } catch (error) {
@@ -43,23 +59,31 @@ export async function browserLogin(device, { repository, repositoryId, wait = fa
         }
       }
       let pending = await readJSON(file, null);
-      if (!pending?.deviceCode || pending.origin !== device.origin || pending.repository !== repository || pending.repositoryId !== repositoryId || Date.parse(pending.expiresAt) <= Date.now()) {
+      checkDeadline();
+      if (grant && ['deviceCode', 'verificationUrl', 'userCode', 'expiresAt', 'origin', 'repository', 'repositoryId'].some(key => pending?.[key] !== grant[key])) fail('CONFLICT', 'Browser authorization changed; retry the connection command');
+      if (!pending?.deviceCode || pending.origin !== device.origin || pending.repository !== repository || pending.repositoryId !== repositoryId || !Number.isFinite(Date.parse(pending.expiresAt)) || !grant && Date.parse(pending.expiresAt) <= Date.now()) {
         pending = { origin: device.origin, repository, repositoryId, deviceCode: randomBytes(32).toString('base64url'), label: String(label).slice(0, 80),
           expiresAt: new Date(Date.now() + 600000).toISOString() };
         await atomicWrite(file, encode(pending));
       }
       if (!pending.verificationUrl) {
         const identity = await device.identity();
-        const { data } = await request(device.origin, '/api/auth/device/start', { repository, clientId: identity.clientId, deviceCode: pending.deviceCode, label: pending.label }, fetcher);
+        const { data } = await authorize('/api/auth/device/start', { repository, clientId: identity.clientId, deviceCode: pending.deviceCode, label: pending.label });
         const verification = new URL(data.verificationPath, device.origin);
         if (verification.origin !== device.origin || verification.pathname !== '/connect' || !/^[A-F0-9]{4}-[A-F0-9]{4}$/.test(data.userCode) || verification.searchParams.get('code') !== data.userCode || !Number.isFinite(Date.parse(data.expiresAt)) || !Number.isInteger(data.expiresIn) || data.expiresIn <= 0 || data.expiresIn > 600) fail('UNAVAILABLE', 'Cloud returned an invalid authorization link');
         pending = { ...pending, verificationUrl: verification.href, userCode: data.userCode, expiresAt: new Date(Date.now() + data.expiresIn * 1000).toISOString() };
         await atomicWrite(file, encode(pending));
       }
       const safe = { connected: false, authorizationRequired: true, verificationUrl: pending.verificationUrl, userCode: pending.userCode, expiresAt: pending.expiresAt };
+      if (wait && !grant) {
+        // A displayed grant and this invocation's budget never renew in a wait loop.
+        deadline = Math.min(deadline, clock() + Math.max(0, Date.parse(pending.expiresAt) - Date.now()));
+        grant = { ...pending };
+      }
+      checkDeadline();
       if (first) await onPending(safe);
       let result;
-      try { result = await request(device.origin, '/api/auth/device/poll', { deviceCode: pending.deviceCode }, fetcher); }
+      try { result = await authorize('/api/auth/device/poll', { deviceCode: pending.deviceCode }); }
       catch (error) {
         if (['UNAUTHORIZED', 'FORBIDDEN'].includes(error.code)) await atomicWrite(file, encode({ status: error.code }));
         throw error;
@@ -71,8 +95,9 @@ export async function browserLogin(device, { repository, repositoryId, wait = fa
       return { connected: true, ...result.data };
     });
     if (outcome.connected || !wait) return outcome;
-    if (Date.now() >= Date.parse(outcome.expiresAt)) fail('UNAUTHORIZED', 'Browser authorization expired; retry the connection command');
+    checkDeadline();
     first = false;
-    await pause(5000);
+    await sleep(Math.min(5000, Math.max(1, deadline - clock())));
+    checkDeadline();
   }
 }

package/scripts/workbench/project.mjs

@@ -11,7 +11,7 @@ const digest = value => createHash('sha256').update(String(value)).digest('hex')
 export const nonInteractiveGitEnvironment = (parent = process.env) => ({ ...parent, GIT_TERMINAL_PROMPT: '0' });
 export const optionalGitMiss = error => Number.isInteger(error?.code) && error.code !== 0 && !error.killed && error.signal == null;
 
-async function git(root, args, { optional = false } = {}) {
+async function git(root, args, { optional = false, rawOutput = false } = {}) {
   try {
     const { stdout } = await execFileAsync('git', args, {
       cwd: root,
@@ -21,7 +21,7 @@ async function git(root, args, { optional = false } = {}) {
       timeout: 10000,
       maxBuffer: 16 * 1024 * 1024,
     });
-    return stdout.trim();
+    return rawOutput ? stdout : stdout.trim();
   } catch (error) {
     if (optional && optionalGitMiss(error)) return '';
     throw error;
@@ -62,13 +62,40 @@ async function defaultBranch(root, remote = 'origin') {
   return '';
 }
 
-async function worktreeMetadata(root, main = null) {
+async function physicalGitDirectories(root) {
+  let output;
+  try {
+    output = await git(root, ['rev-parse', '--path-format=absolute', '--show-toplevel', '--git-common-dir', '--git-dir'], { rawOutput: true });
+  } catch (error) {
+    if (!optionalGitMiss(error)) throw error;
+    // Supported Git reports these misses without any directory records. Other
+    // failures may be older-option incompatibilities; keep the legacy path.
+    if (/fatal: (?:not a git repository|this operation must be run in a work tree)/.test(String(error.stderr || ''))) return null;
+  }
+  if (output !== undefined) {
+    const records = (output.endsWith('\n') ? output.slice(0, -1) : output).split('\n');
+    if (records.length === 3 && records.every(value => value && !value.includes('\r') && path.isAbsolute(value))) {
+      return { topLevel: records[0], commonDir: records[1], gitDir: records[2] };
+    }
+  }
+  const topLevel = await git(root, ['rev-parse', '--show-toplevel'], { optional: true });
+  if (!topLevel) return null;
+  const worktreeRoot = await fs.realpath(topLevel);
+  let commonDir = await git(worktreeRoot, ['rev-parse', '--path-format=absolute', '--git-common-dir'], { optional: true });
+  if (!commonDir) {
+    const relative = await git(worktreeRoot, ['rev-parse', '--git-common-dir']);
+    commonDir = path.resolve(worktreeRoot, relative);
+  }
+  return { topLevel, commonDir };
+}
+
+async function worktreeMetadata(root, main = null, physicalGitDir) {
   const mainBranch = main?.branch || '';
   const mainRef = main?.ref || '';
   const [head, currentBranch, rawGitDir, mainSha] = await Promise.all([
     git(root, ['rev-parse', 'HEAD'], { optional: true }),
     git(root, ['branch', '--show-current'], { optional: true }),
-    git(root, ['rev-parse', '--path-format=absolute', '--git-dir'], { optional: true }),
+    physicalGitDir === undefined ? git(root, ['rev-parse', '--path-format=absolute', '--git-dir'], { optional: true }) : physicalGitDir,
     mainRef ? git(root, ['rev-parse', '--verify', '--quiet', `${mainRef}^{commit}`], { optional: true }) : '',
   ]);
   const gitDir = rawGitDir ? await fs.realpath(rawGitDir).catch(() => path.resolve(root, rawGitDir)) : '';
@@ -91,8 +118,8 @@ function mainTarget({ mode = 'remote', remote = 'origin', branch } = {}) {
 
 export async function resolveProject(openedRoot) {
   const requestedRoot = await fs.realpath(path.resolve(openedRoot));
-  const topLevel = await git(requestedRoot, ['rev-parse', '--show-toplevel'], { optional: true });
-  if (!topLevel) {
+  const directories = await physicalGitDirectories(requestedRoot);
+  if (!directories) {
     const projectId = `folder-${digest(requestedRoot).slice(0, 20)}`;
     return {
       projectId,
@@ -111,27 +138,28 @@ export async function resolveProject(openedRoot) {
       branch: '', head: '', gitDir: '', mainBranch: '', mainRef: '', mainSha: '',
     };
   }
-  const worktreeRoot = await fs.realpath(topLevel);
-  let commonDir = await git(worktreeRoot, ['rev-parse', '--path-format=absolute', '--git-common-dir'], { optional: true });
-  if (!commonDir) {
-    const relative = await git(worktreeRoot, ['rev-parse', '--git-common-dir']);
-    commonDir = path.resolve(worktreeRoot, relative);
-  }
-  commonDir = await fs.realpath(commonDir);
+  const worktreeRoot = await fs.realpath(directories.topLevel);
+  const commonDir = await fs.realpath(directories.commonDir);
   const projectId = `git-${digest(commonDir).slice(0, 20)}`;
   const sharedDir = path.join(commonDir, 'context-guard');
   const stored = await readJSON(path.join(sharedDir, 'project-binding.json'), null);
   if (stored && (stored.projectId !== projectId || !stored.main?.branch)) throw new Error('Invalid project binding; repair it explicitly, do not recreate it');
-  const originUrl = await git(worktreeRoot, ['config', '--get', 'remote.origin.url'], { optional: true });
-  const originGithub = githubRepository(originUrl);
-  const automaticBranch = originGithub ? await defaultBranch(worktreeRoot) : '';
-  const automatic = automaticBranch ? mainTarget({ remote: 'origin', branch: automaticBranch }) : null;
-  const selected = stored?.projectId === projectId && stored?.main?.branch ? mainTarget(stored.main) : automatic;
-  const remote = selected?.mode === 'remote'
-    ? await git(worktreeRoot, ['config', '--get', `remote.${selected.remote}.url`], { optional: true })
-    : '';
+  let selected;
+  if (stored) {
+    selected = mainTarget(stored.main);
+  } else {
+    const originUrl = await git(worktreeRoot, ['config', '--get', 'remote.origin.url'], { optional: true });
+    const originGithub = githubRepository(originUrl);
+    const automaticBranch = originGithub ? await defaultBranch(worktreeRoot) : '';
+    selected = automaticBranch ? mainTarget({ remote: 'origin', branch: automaticBranch }) : null;
+  }
+  const [remote, metadata] = await Promise.all([
+    selected?.mode === 'remote'
+      ? git(worktreeRoot, ['config', '--get', `remote.${selected.remote}.url`], { optional: true })
+      : '',
+    worktreeMetadata(worktreeRoot, selected, directories.gitDir),
+  ]);
   const github = githubRepository(remote);
-  const metadata = await worktreeMetadata(worktreeRoot, selected);
   return {
     projectId,
     kind: 'git',