@modesto_ma/dsh-guanxiang 0.2.0-beta.3 → 0.2.0-beta.4

package/src/skill-update/tool.ts

@@ -4,7 +4,7 @@
  * - 只接受本进程中由同一会话派发过的任务运行目录；应用、仓库和分析时的提交
  *   取自派发记录，不取自运行目录里可被 Agent 改写的内容。
  * - 只改应用 SKILL 目录 `.dsh/skills/<skill>/` 下的文件，提交以分析时的提交为
- *   父提交，提交到新分支 `guanxiang/skill-<应用 id>-<树对象前缀>`，从不提交到
+ *   父提交，提交到新分支 `guanxiang/skill-<应用 id>-<改动摘要前缀>`，从不提交到
  *   已有分支或默认分支。
  * - 提交和创建合并请求经 dsh-repo 的 `dshRepos` 服务完成，支持 GitLab 与
  *   GitHub；令牌由 dsh-repo 按主机配置。没有该服务或版本不符时工具报错。
@@ -24,14 +24,13 @@ import { z } from 'zod'
 import { describeIssue } from '../config.ts'
 import { isDelegatedAgent } from '../dispatch/tool.ts'
 import type { ContentBlock, HostApproval, ToolDefinition, ToolRunContext } from '../host.ts'
-import type { GitRunner } from '../repos/git.ts'
+import { messageOf, repoErrorCode, requireRepos } from '../repos/lookup.ts'
 import type { RepoRegistry } from '../repos/registry.ts'
 import type { AppManifest, EditableSettings } from '../settings/contract.ts'
-import { prepareChange } from './git.ts'
-import type { FileStat, PreparedChange } from './git.ts'
+import { prepareChange } from './change.ts'
+import type { FileStat, PreparedChange } from './change.ts'
 import { DIFF_FILE, FILES_DIR, PROPOSAL_DIR, ProposalError, readProposal, REASON_FILE } from './proposal.ts'
 import type { ProposedFile } from './proposal.ts'
-import { DSH_REPOS_SERVICE, DSH_REPOS_VERSION, lookupRepos, repoErrorCode } from './repos.ts'
 
 /** Model-facing tool name. */
 export const PROPOSE_TOOL_NAME = 'guanxiang_propose_skill'
@@ -105,7 +104,7 @@ const PARAMETERS: Record<string, unknown> = {
 const FILE_STAT_SCHEMA = {
   type: 'object',
   additionalProperties: false,
-  required: ['path'],
+  required: ['path', 'added', 'removed'],
   properties: { path: { type: 'string' }, added: { type: 'number' }, removed: { type: 'number' } },
 } as const
 
@@ -132,7 +131,7 @@ const OUTPUT_SCHEMA = {
  * @returns one line.
  */
 export function describeFiles(files: readonly FileStat[]): string {
-  return files.map(file => file.added === undefined ? `${file.path}（二进制）` : `${file.path}（+${file.added} −${file.removed ?? 0}）`).join('、')
+  return files.map(file => `${file.path}（+${file.added} −${file.removed}）`).join('、')
 }
 
 /**
@@ -157,8 +156,6 @@ export function renderProposeValue(value: ProposeValue): ContentBlock[] {
 export interface SkillUpdaterDeps {
   readonly registry: RepoRegistry
   settings(): EditableSettings
-  readonly git: GitRunner
-  readonly gitTimeoutMs: number
   readonly author?: CommitAuthor
   /** DSH's approval service, when the composition has one. */
   approval(): HostApproval | undefined
@@ -166,10 +163,6 @@ export interface SkillUpdaterDeps {
   repos(): unknown
 }
 
-function messageOf(error: unknown): string {
-  return error instanceof Error ? error.message : String(error)
-}
-
 /**
  * Write a file in an agent-writable directory without following whatever
  * entry the agent left at its path: the content goes to a new file created
@@ -194,7 +187,7 @@ function skillDirOf(app: AppManifest): string {
 export class SkillUpdater {
   private readonly tasks = new Map<string, DispatchedTask>()
 
-  /** @param deps - registry, settings, git, and approval access. */
+  /** @param deps - registry, settings, approval, and `dshRepos` access. */
   constructor(private readonly deps: SkillUpdaterDeps) {}
 
   /** @returns whether proposals are enabled in the current settings. */
@@ -231,16 +224,13 @@ export class SkillUpdater {
   /**
    * Read the proposal, build its tree, and write the diff file.
    * @returns undefined when the task wrote no proposal.
-   * @throws ProposalError or a git failure.
+   * @throws ProposalError, or an error when dsh-repo is unavailable or the mirror cannot be read.
    */
-  private async prepare(task: DispatchedTask): Promise<{ reason: string; files: readonly ProposedFile[]; change: PreparedChange; target: string; diffPath: string } | undefined> {
+  private async prepare(task: DispatchedTask, signal?: AbortSignal): Promise<{ reason: string; files: readonly ProposedFile[]; change: PreparedChange; target: string; diffPath: string } | undefined> {
     const proposal = await readProposal(task.workDir, this.deps.settings().skillUpdates)
     if (proposal === undefined) return undefined
-    const commands = { git: this.deps.git, timeoutMs: this.deps.gitTimeoutMs }
-    const { change, target } = await this.deps.registry.withClone(task.url, async clone => ({
-      change: await prepareChange(commands, clone.dir, task.commit, skillDirOf(task.app), proposal.files),
-      target: clone.branch,
-    }))
+    const target = this.deps.registry.branchOf(task.url)
+    const change = await prepareChange(requireRepos(this.deps.repos()), { url: task.url, base: task.commit, skillDir: skillDirOf(task.app) }, proposal.files, signal)
     if (change.files.length === 0) throw new ProposalError(`提议的文件与提交 ${task.commit.slice(0, 12)} 中的 SKILL 相同，没有改动`)
     const diffPath = join(task.workDir, DIFF_FILE)
     await replaceFile(diffPath, change.diff)
@@ -286,18 +276,18 @@ export class SkillUpdater {
     if (task.sessionId !== agent.session.header.id) throw new Error(`${parsed.data.workDir} 不是当前会话派发的任务`)
     const approval = this.deps.approval()
     if (approval === undefined) throw new Error('当前 DSH 组合没有审批服务（@deepseek-ai/dsh-user-approval），观象不会在未经授权时提交')
-    const lookup = lookupRepos(this.deps.repos())
-    if (lookup.availability !== 'ready') {
-      throw new Error(lookup.availability === 'missing'
-        ? `提交 SKILL 修改需要 dsh-repo 插件提供的 ${DSH_REPOS_SERVICE} 服务；请安装 dsh-repo，并在它的 hosts 中配置该应用仓库所在的主机和令牌`
-        : `dsh-repo 的 ${DSH_REPOS_SERVICE} 服务与观象不兼容（观象需要服务版本 ${DSH_REPOS_VERSION} 且提供 getBranch，即 dsh-repo 0.1.0-beta.2 及以上）；请升级 dsh-repo`)
-    }
-    const repos = lookup.service
+    const repos = requireRepos(this.deps.repos())
 
-    const prepared = await this.prepare(task)
+    let prepared: Awaited<ReturnType<SkillUpdater['prepare']>>
+    try {
+      prepared = await this.prepare(task, exec.signal)
+    } catch (error) {
+      exec.signal.throwIfAborted()
+      throw error
+    }
     if (prepared === undefined) throw new Error(`${task.workDir} 中没有 SKILL 修改提议（${PROPOSAL_DIR}/${REASON_FILE} 与 ${PROPOSAL_DIR}/${FILES_DIR}/）`)
     const { change, target, diffPath, reason } = prepared
-    const branch = `guanxiang/skill-${task.app.id}-${change.tree.slice(0, 10)}`
+    const branch = `guanxiang/skill-${task.app.id}-${change.digest.slice(0, 10)}`
     const base = { app: task.app.id, repo: task.url, branch, target, files: [...change.files], diffPath }
 
     if (await repos.getBranch(task.url, branch, { signal: exec.signal }) !== undefined) return { ...base, status: 'exists' }

package/src/repos/credentials.ts

@@ -1,104 +0,0 @@
-/**
- * HTTPS 访问令牌：按地址前缀为仓库挑选令牌配置，并生成只对一次 git 进程生效的
- * 凭据助手配置。令牌经子进程环境变量交给 git，不出现在命令行参数、仓库的
- * `.git/config` 或 git 输出里；只有服务器要求认证时 git 才向助手取令牌，
- * 本机为同一主机配置的其他凭据助手在这次调用中不参与。
- *
- * @module dsh-guanxiang/repos/credentials
- */
-
-import type { GitCredentialSpec } from '../settings/contract.ts'
-
-export { TOKEN_ENV_PATTERN } from '../settings/contract.ts'
-
-/** Environment variables the helper reads; set only on git child processes. */
-const USERNAME_VARIABLE = 'GUANXIANG_GIT_USERNAME'
-const TOKEN_VARIABLE = 'GUANXIANG_GIT_TOKEN'
-
-/** Answers git's `get` request from the two variables and ignores `store` and `erase`. */
-const HELPER = `!f() { test "$1" = get || exit 0; printf 'username=%s\\npassword=%s\\n' "$${USERNAME_VARIABLE}" "$${TOKEN_VARIABLE}"; }; f`
-
-/** Longest accepted token; personal access tokens are far shorter. */
-export const MAX_TOKEN_LENGTH = 4096
-
-/**
- * Normalize an access-token address prefix to `scheme://host[:port][/path]`
- * with a lowercase host and no trailing slash.
- * @param value - candidate prefix.
- * @returns the normalized prefix, or undefined when it is not an `https`/`http` URL without credentials, query, or fragment.
- */
-export function normalizeCredentialUrl(value: string): string | undefined {
-  let url: URL
-  try {
-    url = new URL(value)
-  } catch {
-    // Not a URL: refused.
-    return undefined
-  }
-  if (url.protocol !== 'https:' && url.protocol !== 'http:') return undefined
-  if (url.host === '' || url.username !== '' || url.password !== '' || url.search !== '' || url.hash !== '') return undefined
-  return `${url.protocol}//${url.host}${url.pathname.replace(/\/+$/, '')}`
-}
-
-/**
- * Whether a token value can be handed to git: non-empty, bounded, and free of
- * control characters, which would break the credential helper protocol.
- * @param value - candidate token.
- * @returns whether it is accepted.
- */
-export function isAcceptedToken(value: string): boolean {
-  return value.length > 0 && value.length <= MAX_TOKEN_LENGTH && !/[\u0000-\u001f\u007f]/.test(value)
-}
-
-/**
- * The access-token configuration for a repository address: the entry whose
- * prefix has the same scheme and host and the longest path that contains the
- * repository path. scp-like addresses, SSH URLs, and local paths never match.
- * @param url - repository address.
- * @param specs - configured access tokens with normalized prefixes.
- * @returns the matching entry, if any.
- */
-export function credentialFor(url: string, specs: readonly GitCredentialSpec[]): GitCredentialSpec | undefined {
-  let repo: URL
-  try {
-    repo = new URL(url)
-  } catch {
-    // scp-like addresses and local paths use other credentials.
-    return undefined
-  }
-  let best: { spec: GitCredentialSpec; length: number } | undefined
-  for (const spec of specs) {
-    const prefix = new URL(spec.url)
-    if (prefix.protocol !== repo.protocol || prefix.host !== repo.host) continue
-    const path = prefix.pathname.replace(/\/+$/, '')
-    if (path !== '' && repo.pathname !== path && !repo.pathname.startsWith(`${path}/`)) continue
-    if (best === undefined || path.length > best.length) best = { spec, length: path.length }
-  }
-  return best?.spec
-}
-
-/**
- * Environment that makes one git process answer the credential request for
- * the token's host with the given token. Existing `GIT_CONFIG_COUNT` entries
- * are kept; the helper list for that host is reset first so a stale password
- * from another helper cannot shadow the token.
- * @param spec - matching access-token configuration.
- * @param token - token value.
- * @param env - environment of the git process before this call.
- * @returns variables to add to the git process environment.
- */
-export function credentialEnvironment(spec: GitCredentialSpec, token: string, env: NodeJS.ProcessEnv = process.env): Record<string, string> {
-  const prefix = new URL(spec.url)
-  const key = `credential.${prefix.protocol}//${prefix.host}.helper`
-  const parsed = Number(env.GIT_CONFIG_COUNT ?? '0')
-  const base = Number.isInteger(parsed) && parsed > 0 ? parsed : 0
-  return {
-    GIT_CONFIG_COUNT: String(base + 2),
-    [`GIT_CONFIG_KEY_${base}`]: key,
-    [`GIT_CONFIG_VALUE_${base}`]: '',
-    [`GIT_CONFIG_KEY_${base + 1}`]: key,
-    [`GIT_CONFIG_VALUE_${base + 1}`]: HELPER,
-    [USERNAME_VARIABLE]: spec.username,
-    [TOKEN_VARIABLE]: token,
-  }
-}

package/src/repos/git.ts

@@ -1,74 +0,0 @@
-/**
- * 本机 git 命令的调用封装：沿用本机已有凭据（SSH key 或 credential helper），
- * 或由调用方经环境变量提供的访问令牌；禁止交互式提示，避免后台拉取卡在
- * 密码输入上。
- *
- * @module dsh-guanxiang/repos/git
- */
-
-import { execFile } from 'node:child_process'
-
-/** A failed git command with its combined output. */
-export class GitError extends Error {
-  /**
-   * @param args - git arguments that failed.
-   * @param output - trimmed stderr (or stdout when stderr is empty).
-   */
-  constructor(readonly args: readonly string[], readonly output: string) {
-    super(`git ${args.join(' ')} 失败：${output === '' ? '无输出' : output}`)
-  }
-}
-
-/** Options of one git command. */
-export interface GitRunOptions {
-  cwd?: string
-  timeoutMs: number
-  /** Variables added to the environment of this command only (credentials for network commands). */
-  env?: Readonly<Record<string, string>>
-  /** Text written to the command's standard input. */
-  input?: string
-  /** `all` resolves, or reports on failure, stdout followed by stderr, for commands such as `push --porcelain` that split their report. */
-  output?: 'stdout' | 'all'
-}
-
-/** Runs one git command and resolves its stdout (or all output, per {@link GitRunOptions.output}). */
-export type GitRunner = (args: readonly string[], options: GitRunOptions) => Promise<string>
-
-/**
- * Environment for non-interactive git: no terminal prompts, and SSH in batch
- * mode unless the user configured their own SSH command.
- * @param env - base environment.
- * @returns environment for git child processes.
- */
-export function gitEnvironment(env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
-  const next: NodeJS.ProcessEnv = { ...env, GIT_TERMINAL_PROMPT: '0' }
-  if (env.GIT_SSH_COMMAND === undefined && env.GIT_SSH === undefined) next.GIT_SSH_COMMAND = 'ssh -o BatchMode=yes'
-  return next
-}
-
-/**
- * Default runner backed by the `git` executable on PATH.
- * @param args - git arguments.
- * @param options - working directory, timeout, extra environment, input, and output selection.
- * @returns stdout, or stdout followed by stderr.
- */
-export const runGit: GitRunner = (args, options) => new Promise((resolve, reject) => {
-  const child = execFile('git', [...args], {
-    cwd: options.cwd,
-    env: { ...gitEnvironment(), ...options.env },
-    timeout: options.timeoutMs,
-    maxBuffer: 16 * 1024 * 1024,
-    windowsHide: true,
-  }, (error, stdout, stderr) => {
-    if (error === null) {
-      resolve(options.output === 'all' ? `${stdout}${stderr}` : stdout)
-      return
-    }
-    const output = (options.output === 'all' || stderr.trim() === '' ? `${stdout}${stderr}` : stderr).trim()
-    const killed = (error as { killed?: boolean }).killed === true
-    reject(new GitError(args, killed ? `超时（${options.timeoutMs} ms）后被终止${output === '' ? '' : `：${output}`}` : output || error.message))
-  })
-  // A command that exits without reading its input fails through its exit status, not EPIPE.
-  child.stdin?.on('error', () => {})
-  child.stdin?.end(options.input)
-})

package/src/skill-update/git.ts

@@ -1,84 +0,0 @@
-/**
- * 在拉取仓库中用 git 底层命令检查 SKILL 修改：用临时索引文件在分析时的提交上
- * 替换文件、写出树对象，算出逐文件行数和 diff，不改动任何检出、快照或本地
- * 分支。树对象的前缀用作新分支名，提交本身经 dsh-repo 完成。
- *
- * @module dsh-guanxiang/skill-update/git
- */
-
-import { mkdtemp, rm } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import type { GitRunner } from '../repos/git.ts'
-import type { ProposedFile } from './proposal.ts'
-
-/** Line counts of one changed file. */
-export interface FileStat {
-  /** Path relative to the repository root. */
-  readonly path: string
-  /** Added lines; undefined for a binary change. */
-  readonly added?: number
-  /** Removed lines; undefined for a binary change. */
-  readonly removed?: number
-}
-
-/** A proposal turned into a tree object on top of its base commit. */
-export interface PreparedChange {
-  readonly base: string
-  readonly tree: string
-  readonly files: readonly FileStat[]
-  /** Unified diff from the base commit to {@link tree}, limited to the skill directory. */
-  readonly diff: string
-}
-
-/** git runner and the timeout of one command. */
-export interface GitCommands {
-  readonly git: GitRunner
-  readonly timeoutMs: number
-}
-
-const DIFF_FLAGS = ['--no-color', '--no-ext-diff', '--no-renames']
-
-/**
- * Write the proposed files over the skill directory of `base` into a new tree.
- * @param commands - git runner and timeout.
- * @param dir - repository directory whose object database receives the objects.
- * @param base - commit the analysis ran on.
- * @param skillDir - skill directory relative to the repository root, `/`-separated.
- * @param files - proposed files relative to `skillDir`.
- * @returns the tree, per-file line counts, and the diff; `files` is empty when nothing changes.
- * @throws when a proposed path replaces a symbolic link or a directory, or a git command fails.
- */
-export async function prepareChange(commands: GitCommands, dir: string, base: string, skillDir: string, files: readonly ProposedFile[]): Promise<PreparedChange> {
-  const { git, timeoutMs } = commands
-  const scratch = await mkdtemp(join(tmpdir(), 'guanxiang-index-'))
-  try {
-    const env = { GIT_INDEX_FILE: join(scratch, 'index') }
-    await git(['read-tree', base], { cwd: dir, timeoutMs, env })
-    const listing = await git(['ls-tree', '-r', '-t', '-z', base, '--', `${skillDir}/`], { cwd: dir, timeoutMs })
-    const modes = new Map<string, string>()
-    for (const record of listing.split('\0')) {
-      const tab = record.indexOf('\t')
-      if (tab < 0) continue
-      modes.set(record.slice(tab + 1), record.slice(0, record.indexOf(' ')))
-    }
-    for (const file of files) {
-      const path = `${skillDir}/${file.path}`
-      const existing = modes.get(path)
-      if (existing === '120000') throw new Error(`${path} 在仓库中是符号链接，不能用提议覆盖`)
-      if (existing === '040000') throw new Error(`${path} 在仓库中是目录，不能用文件覆盖`)
-      const blob = (await git(['hash-object', '-w', '--stdin'], { cwd: dir, timeoutMs, input: file.content })).trim()
-      await git(['update-index', '--add', '--cacheinfo', `${existing === '100755' ? '100755' : '100644'},${blob},${path}`], { cwd: dir, timeoutMs, env })
-    }
-    const tree = (await git(['write-tree'], { cwd: dir, timeoutMs, env })).trim()
-    const numstat = await git(['diff', ...DIFF_FLAGS, '--numstat', base, tree, '--', `${skillDir}/`], { cwd: dir, timeoutMs })
-    const stats = numstat.split('\n').filter(line => line !== '').map((line): FileStat => {
-      const [added = '-', removed = '-', ...path] = line.split('\t')
-      return { path: path.join('\t'), ...added === '-' ? {} : { added: Number(added) }, ...removed === '-' ? {} : { removed: Number(removed) } }
-    })
-    const diff = stats.length === 0 ? '' : await git(['diff', ...DIFF_FLAGS, base, tree, '--', `${skillDir}/`], { cwd: dir, timeoutMs })
-    return { base, tree, files: stats, diff }
-  } finally {
-    await rm(scratch, { recursive: true, force: true })
-  }
-}

package/src/skill-update/repos.ts

@@ -1,51 +0,0 @@
-/**
- * dsh-repo `dshRepos` 服务的查找：SKILL 修改提议经它在代码托管平台上建分支、
- * 提交并创建合并请求（GitLab MR 或 GitHub PR）。
- *
- * 只从 `dsh-repo/contract` 引入类型；服务在运行时经 `ctx.get('dshRepos')`
- * 取得，版本不符或缺少 `getBranch`（早于 0.1.0-beta.2 的 dsh-repo，提交时会忽略
- * `baseSha` 与 `newBranch`）时不调用。
- *
- * @module dsh-guanxiang/skill-update/repos
- */
-
-import type { DshRepoService, DshReposVersion, RepoErrorCode } from 'dsh-repo/contract'
-
-/** Name dsh-repo provides the service under. */
-export const DSH_REPOS_SERVICE = 'dshRepos'
-
-/** The `dshRepos` contract version this plugin speaks. */
-export const DSH_REPOS_VERSION: DshReposVersion = 1
-
-/** Result of looking the service up. */
-export type ReposLookup =
-  | { readonly availability: 'ready'; readonly service: DshRepoService }
-  | { readonly availability: 'missing' | 'incompatible' }
-
-/**
- * Classify the value `ctx.get('dshRepos')` returned. The provider is another
- * package that may be older or newer than this one, so its version is checked
- * at run time; `getBranch` marks a provider that also honors `baseSha` and
- * `newBranch` on commits.
- * @param value - the looked-up service, or undefined.
- * @returns the usable service, or why there is none.
- */
-export function lookupRepos(value: unknown): ReposLookup {
-  if (value === undefined || value === null) return { availability: 'missing' }
-  const service = value as Partial<Record<keyof DshRepoService, unknown>>
-  if (service.version !== DSH_REPOS_VERSION || typeof service.getBranch !== 'function' || typeof service.commitFiles !== 'function' || typeof service.createChange !== 'function') {
-    return { availability: 'incompatible' }
-  }
-  return { availability: 'ready', service: value as DshRepoService }
-}
-
-/**
- * The failure class of a `dshRepos` rejection.
- * @param error - the rejection.
- * @returns its `code` when it is a `RepoError`.
- */
-export function repoErrorCode(error: unknown): RepoErrorCode | undefined {
-  if (!(error instanceof Error) || error.name !== 'RepoError') return undefined
-  const code = (error as Error & { code?: unknown }).code
-  return typeof code === 'string' ? code as RepoErrorCode : undefined
-}