@orion-agents/orion-code 0.3.14 → 0.3.17

package/dist/web/git-index-transaction.js

@@ -0,0 +1,174 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeGitEnvironment = writeGitEnvironment;
+exports.writeGitPrefix = writeGitPrefix;
+exports.indexLockPath = indexLockPath;
+exports.withIndexTransaction = withIndexTransaction;
+exports.isIndexConflictOutput = isIndexConflictOutput;
+/**
+ * v0.3.17 S3 — index transaction.
+ *
+ * Plan §7.7 is explicit: an internal queue cannot defend against external Git, and checking
+ * status before and after is **not** an atomic compare-and-swap. This module implements the
+ * real check-then-write window:
+ *
+ *   1. acquire `<index>.lock` with `O_CREAT|O_EXCL` — Git's own mutual exclusion, so a
+ *      concurrent `git add` in the user's terminal fails instead of interleaving;
+ *   2. copy the current index to a sibling temp file and do **all** index work against
+ *      `GIT_INDEX_FILE=<temp>`, so a failure never leaves a half-written index;
+ *   3. verify the result against the caller's expectations;
+ *   4. publish with a single `rename()` — atomic on POSIX, same filesystem by construction;
+ *   5. release only the lock this transaction created.
+ *
+ * What it deliberately does NOT do:
+ *   - never removes a lock it did not create (a lock owned by the user's Git is reported as
+ *     `git_index_busy` and left alone);
+ *   - never rolls back external changes after a failure (§7.9).
+ */
+const fs_1 = require("fs");
+const crypto_1 = require("crypto");
+const path_1 = require("path");
+const errors_1 = require("./errors");
+const GIT_NULL_DEVICE = process.platform === 'win32' ? 'NUL' : '/dev/null';
+/** Non-secret marker proving we own a lock file, so we never unlink someone else's. */
+const LOCK_MARKER_PREFIX = 'orion-code index transaction ';
+/**
+ * Environment for index writes.
+ *
+ * `GIT_CONFIG_GLOBAL` is intentionally *not* pointed at /dev/null here, unlike the read
+ * path: staging must resolve the user's `core.autocrlf`, filters and `.gitattributes`
+ * exactly as their own Git would, otherwise we would silently stage different bytes than
+ * they expect (plan §7.8). Hooks stay disabled — `add`/`apply` must not run user hooks.
+ */
+function writeGitEnvironment(overrides = {}) {
+    return {
+        PATH: process.env.PATH,
+        HOME: process.env.HOME,
+        LANG: 'C.UTF-8',
+        LC_ALL: 'C.UTF-8',
+        GIT_TERMINAL_PROMPT: '0',
+        GIT_CONFIG_NOSYSTEM: '1',
+        GIT_PAGER: 'cat',
+        PAGER: 'cat',
+        ...overrides,
+    };
+}
+/**
+ * `-c` prefix for index writes. Hooks are disabled because none of the index mutations run
+ * hooks; the commit runner uses its own prefix and does not reuse this one.
+ */
+function writeGitPrefix() {
+    return [
+        '-c',
+        'core.quotepath=false',
+        '-c',
+        `core.hooksPath=${GIT_NULL_DEVICE}`,
+        '--literal-pathspecs',
+    ];
+}
+function indexLockPath(indexPath) {
+    return `${indexPath}.lock`;
+}
+function acquireIndexLock(indexPath) {
+    const path = indexLockPath(indexPath);
+    const marker = `${LOCK_MARKER_PREFIX}${process.pid} ${(0, crypto_1.randomBytes)(8).toString('hex')}\n`;
+    let handle;
+    try {
+        handle = (0, fs_1.openSync)(path, 'wx', 0o600);
+    }
+    catch (error) {
+        if (error.code === 'EEXIST') {
+            // Someone else holds it. Report busy and leave their lock untouched.
+            throw new errors_1.WebWorkbenchError(409, 'Git index is locked by another process.', 'git_index_busy');
+        }
+        throw error;
+    }
+    try {
+        (0, fs_1.writeSync)(handle, marker);
+    }
+    finally {
+        (0, fs_1.closeSync)(handle);
+    }
+    return { path, marker };
+}
+function releaseIndexLock(lock) {
+    try {
+        // Only remove a lock whose content is still ours. If the user's Git replaced it, that is
+        // their lock now and we must not delete it.
+        const current = (0, fs_1.readFileSync)(lock.path, 'utf8');
+        if (!current.startsWith(LOCK_MARKER_PREFIX) || current !== lock.marker)
+            return;
+    }
+    catch {
+        return;
+    }
+    try {
+        (0, fs_1.unlinkSync)(lock.path);
+    }
+    catch {
+        // Already gone; nothing to release.
+    }
+}
+/**
+ * Runs `work` against a private copy of the index and publishes it atomically.
+ *
+ * `verify` receives the temp index path so the caller can assert the mutation actually did
+ * what it intended (for example that the target path is now staged) before publication.
+ */
+async function withIndexTransaction(paths, seed, work, verify) {
+    const lock = acquireIndexLock(paths.indexPath);
+    const tempIndex = (0, path_1.join)((0, path_1.dirname)(paths.indexPath), `orion-index-${process.pid}-${(0, crypto_1.randomBytes)(6).toString('hex')}.tmp`);
+    const env = writeGitEnvironment({ GIT_INDEX_FILE: tempIndex });
+    const before = (0, fs_1.existsSync)(paths.indexPath)
+        ? (0, fs_1.readFileSync)(paths.indexPath).toString('base64').slice(0, 32)
+        : 'absent';
+    const context = { indexFile: tempIndex, env, before };
+    try {
+        // Seed the private index from the real one, or from an empty tree in a repository that
+        // has no index yet (fresh clone-less init, or a worktree created before any add).
+        if ((0, fs_1.existsSync)(paths.indexPath)) {
+            (0, fs_1.copyFileSync)(paths.indexPath, tempIndex);
+            // Copy the ORIGINAL timestamps onto the copy.
+            //
+            // This is not cosmetic. Git decides whether a cached stat entry may be trusted by
+            // asking whether the index is at least as new as the file. A freshly copied index is
+            // newer than everything, which makes git trust stale stat data — so a file edited
+            // within the same timestamp granularity and with an unchanged size would not be
+            // re-hashed, and `git add` would silently do nothing. Preserving the mtime keeps the
+            // racy-clean defence that a real index has.
+            const stats = (0, fs_1.statSync)(paths.indexPath);
+            (0, fs_1.utimesSync)(tempIndex, stats.atime, stats.mtime);
+        }
+        else {
+            await seed(context);
+        }
+        const result = await work(context);
+        if (verify)
+            await verify(result, context);
+        // Single atomic publish; the real index is never partially written.
+        (0, fs_1.renameSync)(tempIndex, paths.indexPath);
+        return result;
+    }
+    catch (error) {
+        if ((0, fs_1.existsSync)(tempIndex)) {
+            try {
+                (0, fs_1.unlinkSync)(tempIndex);
+            }
+            catch {
+                // Best effort; a leftover temp index is inert because nothing reads it.
+            }
+        }
+        throw error;
+    }
+    finally {
+        releaseIndexLock(lock);
+    }
+}
+/**
+ * Failure text Git prints when it refuses because the index changed under it. Surfaced so
+ * callers can report an honest conflict instead of a generic error.
+ */
+function isIndexConflictOutput(text) {
+    return /index file smaller than expected|index file corrupt|unable to read index|needs update/i.test(text);
+}
+//# sourceMappingURL=git-index-transaction.js.map

package/dist/web/git-patch-builder.d.ts

@@ -0,0 +1,30 @@
+/**
+ * v0.3.17 S3 — Host-side patch builder for hunk and line level staging.
+ *
+ * Plan §7.6 is unambiguous: the Host rebuilds the patch from the content the user actually
+ * reviewed, and the browser never submits a patch, a path, a Git flag or a shell command.
+ * §7.8 adds the other half: a partial operation is **refused** when the target bytes cannot
+ * be reconstructed faithfully, rather than guessing and staging different content.
+ *
+ * Reconstruction rules for a partial selection of one hunk:
+ *   - an unselected deletion becomes context (the line stays in the index);
+ *   - an unselected addition is dropped entirely (it never enters the index);
+ *   - selected deletions/additions keep their marker.
+ * That is exactly "apply only what was ticked", expressed as a patch whose pre-image is the
+ * untouched index and whose post-image is index + selection.
+ */
+import type { GitDiffDocumentV2 } from './git-diff-document';
+export interface PatchSelectionRequest {
+    readonly hunkIds?: readonly string[];
+    readonly lineIds?: readonly string[];
+}
+export type PatchBuildResult = {
+    readonly ok: true;
+    readonly patch: string;
+    readonly selectedChanges: number;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+export declare function buildSelectionPatch(doc: GitDiffDocumentV2, request: PatchSelectionRequest): PatchBuildResult;
+//# sourceMappingURL=git-patch-builder.d.ts.map

package/dist/web/git-patch-builder.js

@@ -0,0 +1,134 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSelectionPatch = buildSelectionPatch;
+/** Sources whose comparison can be expressed as an index patch. */
+const PATCHABLE_SOURCES = new Set(['unstaged', 'staged']);
+function refusal(doc) {
+    if (!PATCHABLE_SOURCES.has(doc.source)) {
+        return doc.source === 'untracked'
+            ? '未跟踪文件首版仅支持整文件暂存。'
+            : '冲突文件本版不提供部分暂存，请在 Files 中处理。';
+    }
+    if (doc.kind !== 'text') {
+        return doc.kind === 'binary'
+            ? '二进制差异无法重建为可应用的 patch。'
+            : '仅元数据（mode/rename）变化无法进行部分暂存。';
+    }
+    if (doc.completeness !== 'complete') {
+        return 'Diff 未完整加载，未加载的 Hunk 不能执行任何写入。';
+    }
+    if (doc.hunks.some(hunk => !hunk.complete)) {
+        return '存在未完整加载的 Hunk，无法重建可应用的 patch。';
+    }
+    if (doc.hunks.length === 0) {
+        return '没有可暂存的文本改动。';
+    }
+    // A partial patch for an added/removed/renamed file needs a different pre-image shape.
+    // Rather than emit a patch we cannot prove, the file stays a whole-file operation
+    // (plan §7.8: refuse when the target bytes cannot be reconstructed faithfully).
+    const structural = doc.meta.find(line => /^(new file mode|deleted file mode|rename from|rename to|old mode|new mode|similarity index)/u.test(line));
+    if (structural) {
+        return '新增、删除、重命名或纯权限变化的文件不支持部分暂存，请使用整文件操作。';
+    }
+    return null;
+}
+/** Escapes a path for the `diff --git` / `---` / `+++` headers. */
+function patchPath(path) {
+    return /[\s"\\]/u.test(path) ? `"${path.replace(/\\/gu, '\\\\').replace(/"/gu, '\\"')}"` : path;
+}
+function buildHunkBody(hunk, selection) {
+    const body = [];
+    let oldCount = 0;
+    let newCount = 0;
+    let changes = 0;
+    for (const line of hunk.lines) {
+        const selected = selection.whole || selection.lineIds.has(line.lineId);
+        if (line.kind === 'context') {
+            body.push(line.raw);
+            oldCount += 1;
+            newCount += 1;
+            continue;
+        }
+        if (line.kind === 'meta') {
+            // `` only belongs after a change we are actually applying.
+            if (selected)
+                body.push(line.raw);
+            continue;
+        }
+        if (line.kind === 'deletion') {
+            if (selected) {
+                body.push(line.raw);
+                oldCount += 1;
+                changes += 1;
+            }
+            else {
+                // Kept in the index: becomes context.
+                body.push(` ${line.text}`);
+                oldCount += 1;
+                newCount += 1;
+            }
+            continue;
+        }
+        // addition
+        if (selected) {
+            body.push(line.raw);
+            newCount += 1;
+            changes += 1;
+        }
+        // An unselected addition is simply absent from the post-image.
+    }
+    return { body, oldCount, newCount, changes };
+}
+function buildSelectionPatch(doc, request) {
+    const blocked = refusal(doc);
+    if (blocked)
+        return { ok: false, reason: blocked };
+    const wholeHunks = new Set(request.hunkIds ?? []);
+    const selectedLines = new Set(request.lineIds ?? []);
+    if (wholeHunks.size === 0 && selectedLines.size === 0) {
+        return { ok: false, reason: '没有选择任何 Hunk 或行。' };
+    }
+    // Selected line ids must belong to this document; an unknown id means the reader's view is
+    // stale and applying anything would be guesswork.
+    if (selectedLines.size > 0) {
+        const known = new Set(doc.hunks.flatMap(hunk => hunk.lines.map(line => line.lineId)));
+        for (const lineId of selectedLines) {
+            if (!known.has(lineId)) {
+                return { ok: false, reason: '选中的行已不在当前 Diff 中，请刷新后重试。' };
+            }
+        }
+    }
+    // Standard orientation for both directions. Unstaging is the same patch applied with
+    // `git apply --reverse`, so the headers must NOT be swapped for the staged source.
+    const headers = [
+        `diff --git a/${patchPath(doc.path)} b/${patchPath(doc.path)}`,
+        `--- a/${patchPath(doc.path)}`,
+        `+++ b/${patchPath(doc.path)}`,
+    ];
+    const bodyParts = [];
+    let cumulativeDelta = 0;
+    let totalChanges = 0;
+    for (const hunk of doc.hunks) {
+        const whole = wholeHunks.has(hunk.hunkId);
+        const built = buildHunkBody(hunk, { whole, lineIds: selectedLines });
+        // A hunk with nothing ticked contributes neither content nor offset.
+        if (built.changes === 0)
+            continue;
+        const appliedDelta = built.newCount - built.oldCount;
+        const oldStart = hunk.oldStart;
+        // The post-image offset absorbs only the deltas we are actually applying.
+        const newStart = oldStart + cumulativeDelta;
+        cumulativeDelta += appliedDelta;
+        totalChanges += built.changes;
+        bodyParts.push(`@@ -${oldStart},${built.oldCount} +${newStart},${built.newCount} @@${hunk.contextLabel ? ` ${hunk.contextLabel}` : ''}`, ...built.body);
+    }
+    if (totalChanges === 0) {
+        return { ok: false, reason: '选中的内容没有实际改动。' };
+    }
+    return {
+        ok: true,
+        patch: `${[...headers, ...bodyParts].join('\n')}\n`,
+        selectedChanges: totalChanges,
+    };
+}
+//# sourceMappingURL=git-patch-builder.js.map