@orion-agents/orion-code 0.3.14 → 0.3.17

package/dist/web/git-read-model-service.d.ts

@@ -1,10 +1,33 @@
+import { type GitDiffDocumentV2 } from './git-diff-document';
+import { type GitCommitDetailV1, type GitCommitFilesV1, type GitBlameResultV1, type GitGraphPageV1, type GitFileHistoryPageV1, type GitHistoryPageV1, type GitHistoryQueryV1, type GitRefsV1 } from './git-history-service';
+import { type GitCompareModeV1, type GitCompareResultV1 } from './git-compare-service';
+import { type GitBlobResultV1, type GitConflictVersionsV1, type GitSubmoduleEntryV1 } from './git-version-service';
+import { type GitWorktreeSourceV1, type WebGitFileSourceV1 } from './git-file-source';
+export type { GitWorktreeSourceV1, WebGitFileSourceV1 } from './git-file-source';
+/**
+ * v0.3.17 S1 — the comparison source a file entry belongs to.
+ *
+ * A path with an index change *and* a further worktree change (`MM`) is two
+ * distinct selectable objects, so the source is part of the file identity.
+ * Declared in `./git-file-source` and re-exported here for existing importers.
+ */
 export interface WebGitFileV1 {
     readonly fileId: string;
     readonly path: string;
+    readonly source: GitWorktreeSourceV1;
     readonly indexStatus: string;
     readonly worktreeStatus: string;
     readonly renamedFrom?: string;
 }
+/** v0.3.17 S1 — real totals per group, independent of the loaded page. */
+export interface WebGitStatusCountsV1 {
+    readonly total: number;
+    readonly conflicted: number;
+    readonly staged: number;
+    readonly unstaged: number;
+    readonly untracked: number;
+    readonly loaded: number;
+}
 export interface WebGitStatusV1 {
     readonly isRepository: boolean;
     readonly repositoryRevision: string;
@@ -21,6 +44,7 @@ export interface WebGitStatusV1 {
     readonly untracked: readonly WebGitFileV1[];
     readonly conflicted: readonly WebGitFileV1[];
     readonly totalFiles: number;
+    readonly counts: WebGitStatusCountsV1;
     readonly truncated: boolean;
     readonly nextCursor: string | null;
 }
@@ -39,12 +63,27 @@ export interface WebGitLogPageV1 {
 export interface WebGitDiffPageV1 {
     readonly fileId: string;
     readonly path: string;
+    /** Which comparison target this page was rendered against. */
+    readonly source: GitWorktreeSourceV1;
     readonly repositoryRevision: string;
     readonly binary: boolean;
     readonly lines: readonly string[];
     readonly nextCursor: string | null;
     readonly truncated: boolean;
 }
+/** v0.3.17 S1 — a Git file token resolves to a source-scoped (source, path) pair. */
+export interface ResolvedGitToken {
+    readonly source: GitWorktreeSourceV1;
+    readonly path: string;
+}
+/** v0.3.17 S1 — bounded status query accepted by `status()`. */
+export interface GitStatusQueryV1 {
+    readonly cursor?: string;
+    readonly pageSize?: number;
+    /** Only a working-tree group can be filtered on; `commit` is not a status group. */
+    readonly group?: GitWorktreeSourceV1;
+    readonly query?: string;
+}
 export interface WebGitPerformanceCountersV1 {
     readonly processCount: number;
     readonly bytesRead: number;
@@ -54,16 +93,22 @@ export interface WebGitPerformanceCountersV1 {
 export declare class GitReadModelServiceV1 {
     private readonly workspace;
     private readonly secret;
-    private readonly pathById;
-    private readonly idByPath;
+    /**
+     * v0.3.17 S1 — tokens are keyed by (source, path), not by path alone. A file that is
+     * both staged and modified in the worktree is two different selectable objects, so a
+     * path-only key silently conflated the two comparison sources.
+     */
+    private readonly targetById;
+    private readonly idByKey;
     private repositoryRoot?;
     private readonly performance;
-    constructor(workspace: string);
+    /** Overridable so the timeout-recovery path can be exercised deterministically. */
+    private readonly commitTimeoutMs;
+    constructor(workspace: string, options?: {
+        readonly commitTimeoutMs?: number;
+    });
     performanceCounters(): WebGitPerformanceCountersV1;
-    status(input?: {
-        readonly cursor?: string;
-        readonly pageSize?: number;
-    }): Promise<WebGitStatusV1>;
+    status(input?: GitStatusQueryV1): Promise<WebGitStatusV1>;
     log(input?: {
         readonly cursor?: string;
         readonly pageSize?: number;
@@ -73,27 +118,302 @@ export declare class GitReadModelServiceV1 {
         readonly cursor?: string;
         readonly lineLimit?: number;
         readonly byteLimit?: number;
+        /** v0.3.17 S5 — `git diff --ignore-all-space`. Bound into the cursor so a page can
+         * never be continued under a different whitespace setting. */
+        readonly ignoreWhitespace?: boolean;
+        /** v0.3.17 S5 — `--word-diff=plain`. Also bound into the cursor: the rendered text is
+         * different, so a page must not be continued across a mode change. */
+        readonly wordDiff?: boolean;
     }): Promise<WebGitDiffPageV1>;
+    /**
+     * v0.3.17 S2 — the structured form of the same comparison. It reuses `diff()` verbatim,
+     * so the hardened read path, byte/line budget and pagination stay in one place; only the
+     * projection changes.
+     */
+    diffDocument(input: {
+        readonly fileId: string;
+        readonly cursor?: string;
+        readonly lineLimit?: number;
+        readonly byteLimit?: number;
+        readonly ignoreWhitespace?: boolean;
+        readonly wordDiff?: boolean;
+    }): Promise<GitDiffDocumentV2>;
+    /**
+     * v0.3.17 S4 — history reading.
+     *
+     * Delegated to a separate module (plan §8.2) that owns metadata about immutable objects,
+     * while the bounded diff stream stays here. None of these methods touch the working tree or
+     * the index — the S4 exit evidence is "history browsing without workspace writes".
+     */
+    private historyReaderInstance?;
+    private historyReader;
+    private compareReaderInstance?;
+    private compareReader;
+    /**
+     * v0.3.17 S5 — branch/version comparison. Read-only.
+     *
+     * The resolved OIDs are part of the result on purpose: the UI freezes the opened result
+     * against them, so a ref that moves afterwards produces a "there is an update" hint
+     * instead of silently comparing against a different tree.
+     */
+    compare(input: {
+        readonly baseRef: string;
+        readonly headRef: string;
+        readonly mode: GitCompareModeV1;
+    }): Promise<GitCompareResultV1>;
+    /** Resolves a pair of refs without computing a comparison (used to detect ref movement). */
+    resolveComparePair(baseRef: string, headRef: string): Promise<{
+        readonly baseOid: string;
+        readonly headOid: string;
+    }>;
+    /**
+     * v0.3.17 S5 — the diff one file shows between two arbitrary commits.
+     *
+     * Same bounded stream as every other diff; the only new thing is that the base is a
+     * caller-supplied resolved OID instead of a parent. The cursor margin binds the page to
+     * this exact base/head/path triple, so a different comparison cannot continue it.
+     */
+    compareFileDiffDocument(input: {
+        readonly baseOid: string;
+        readonly headOid: string;
+        readonly path: string;
+        readonly cursor?: string;
+        readonly lineLimit?: number;
+        readonly byteLimit?: number;
+    }): Promise<GitDiffDocumentV2>;
+    private versionReaderInstance?;
+    private versionReader;
+    /**
+     * v0.3.17 S5 — base / ours / theirs / worktree for a conflicted file.
+     *
+     * Read from index stages 1/2/3 rather than assembled from two diffs: a modify/delete
+     * conflict genuinely has no base, and pretending otherwise is what plan G6 forbids.
+     */
+    conflictVersions(path: string): Promise<GitConflictVersionsV1>;
+    /** Reads one file at a revision — including a file that no longer exists locally. */
+    fileBlob(input: {
+        readonly path: string;
+        readonly rev: string;
+    }): Promise<GitBlobResultV1>;
+    /** Recorded gitlink SHAs only; submodules are never traversed (plan G6). */
+    submodules(): Promise<readonly GitSubmoduleEntryV1[]>;
+    refs(): Promise<GitRefsV1>;
+    history(query: GitHistoryQueryV1): Promise<GitHistoryPageV1>;
+    commitDetail(oid: string, parentIndex?: number): Promise<GitCommitDetailV1>;
+    commitFiles(oid: string, parentIndex?: number): Promise<GitCommitFilesV1>;
+    graph(input?: {
+        readonly limit?: number;
+    }): Promise<GitGraphPageV1>;
+    blame(input: {
+        readonly path: string;
+        readonly rev?: string;
+        readonly limit?: number;
+    }): Promise<GitBlameResultV1>;
+    fileHistory(input: {
+        readonly path: string;
+        readonly rev?: string;
+        readonly limit?: number;
+    }): Promise<GitFileHistoryPageV1>;
+    /**
+     * v0.3.17 S4 — the diff a commit introduced to one file.
+     *
+     * Rebuilds the comparison from the commit's real base (first parent, a chosen parent, or the
+     * empty tree for a root commit) and reuses `streamDiffPage`, so the byte/line budget,
+     * pagination and `--no-ext-diff`/`--no-textconv` hardening are the same code the working-tree
+     * diff uses. There is no second diff implementation to keep in sync.
+     */
+    commitDiffDocument(input: {
+        readonly oid: string;
+        readonly path: string;
+        readonly parentIndex?: number;
+        readonly cursor?: string;
+        readonly lineLimit?: number;
+        readonly byteLimit?: number;
+    }): Promise<GitDiffDocumentV2>;
     private capture;
     private projectFile;
-    private rememberPath;
+    private rememberTarget;
+    /**
+     * v0.3.17 S1 — the single place a Git file token becomes a path. Git mutations resolve
+     * tokens here instead of going through FileReadService, whose token space is unrelated.
+     */
+    resolveTarget(fileId: string): ResolvedGitToken;
+    /**
+     * v0.3.17 S1 — resolve Git file tokens for a mutation and enforce the source each
+     * action may write. This replaces FileReadService token lookup, whose token space is
+     * unrelated to Git and silently rejected every real Git list token.
+     */
+    resolveMutationPaths(action: 'stage' | 'unstage', fileIds: readonly string[]): readonly string[];
     /** v0.3.12 S3 — guarded stage: paths are host-resolved file ids only. */
-    stagePaths(paths: readonly string[]): Promise<{
-        readonly repositoryRevision: string;
-    }>;
-    unstagePaths(paths: readonly string[]): Promise<{
-        readonly repositoryRevision: string;
-    }>;
-    commit(message: string): Promise<{
-        readonly repositoryRevision: string;
-        readonly commitSha: string;
-    }>;
+    stagePaths(paths: readonly string[]): Promise<GitMutationResultV1>;
+    /**
+     * v0.3.17 S3 — prove the index entry for each path really equals what `git add` should
+     * have produced.
+     *
+     * Checking "the path is present in the index" is not enough: the path was usually already
+     * there, so a silent no-op would pass. `hash-object --path` applies exactly the filters and
+     * attributes git itself would, so comparing the two oids is a precise postcondition — and
+     * it is what turns a stat-cache no-op into a loud failure instead of a lost edit.
+     */
+    private assertIndexMatchesWorktree;
+    unstagePaths(paths: readonly string[]): Promise<GitMutationResultV1>;
+    /**
+     * v0.3.17 S3 — apply a hunk or line selection to the index only (plan §7.6/§7.8).
+     *
+     * The document is re-read on the Host, the patch is rebuilt from it, and `--check` runs
+     * before the write. The browser only ever sends ids, never patch text.
+     */
+    applySelection(input: {
+        readonly fileId: string;
+        readonly hunkIds?: readonly string[];
+        readonly lineIds?: readonly string[];
+    }): Promise<GitMutationResultV1>;
+    /**
+     * Applies a Host-rebuilt patch to the index only (plan §7.6). The patch never comes from
+     * the browser: it is rebuilt from the reviewed document, and `--check` runs first so a
+     * patch that cannot apply is rejected before anything is written into the private index.
+     */
+    applyIndexPatch(patch: string, options?: {
+        readonly reverse?: boolean;
+    }): Promise<GitMutationResultV1>;
+    private readTreeEmpty;
+    /** `ls-files --stage -z` parsed into path → blob oid, honouring a private index env. */
+    private indexEntries;
+    /** Resolves root, git dir and the real index path (worktree-aware). */
+    private resolveIndexPaths;
+    private mutationResult;
+    /**
+     * v0.3.17 S3 — what a commit would actually include.
+     *
+     * This is deliberately independent of the change-list filter: plan G3 requires the form to
+     * show the real index, not the currently filtered view, so the reader can never commit a
+     * subset they did not intend.
+     */
+    commitPreview(): Promise<GitCommitPreviewV1>;
+    /** Bounded `--cached --numstat` read; used only for the summary line of the form. */
+    private stagedNumstat;
+    /**
+     * v0.3.17 S3 — commit against a frozen expectation of HEAD and the index tree (plan §7.9).
+     *
+     * Differences from the previous implementation, all deliberate:
+     *   - a **separate runner** that leaves the repository's own hooks and signing
+     *     configuration in place, instead of the read hardening that disables hooks;
+     *   - the message may contain real newlines (summary + body) and is rejected only for
+     *     control characters that would corrupt a commit object;
+     *   - the index and HEAD are captured before and re-read after, and any change that is not
+     *     ours is reported rather than rolled back;
+     *   - a timeout is not treated as "not committed": the outcome is queried by requestId.
+     */
+    commit(input: {
+        readonly summary: string;
+        readonly body?: string;
+        readonly expectedRepositoryRevision: string;
+        readonly requestId: string;
+    }): Promise<GitCommitOutcomeV1>;
+    /**
+     * A commit is confirmed by HEAD having moved to a *new* commit, never by exit code alone.
+     * This is what makes the timeout path safe: we ask Git what actually happened.
+     */
+    private recoverCommit;
+    /** Identity and hook configuration the commit will actually run under (plan §7.9). */
+    private describeCommitConfiguration;
     private mutate;
     private requireRepositoryRoot;
+    /**
+     * v0.3.17 S1 — a mutation reports the same state digest `status()` reports. Returning
+     * `rev-parse HEAD` was a different value space AND did not move on stage/unstage, so it
+     * could never express "the index changed".
+     *
+     * NOTE: this is post-write verification, not an atomic compare-and-swap. The real
+     * check-write window is S3 scope (plan §7.7); until then nothing may claim atomicity.
+     */
     private revisionAfterMutation;
+    /**
+     * v0.3.17 S3 — one exec path, three explicit profiles.
+     *
+     * `read` keeps every hardening from v0.3.12. `index` relaxes only what staging must
+     * resolve (user config for filters/CRLF) while keeping hooks disabled. `commit` is the
+     * deliberate exception from plan §7.9: it lets the repository's own hooks and signing
+     * configuration run, and gets its own bounded budget instead of the 5s read budget.
+     * The profiles are separate on purpose — enabling commit hooks must not relax reads.
+     *
+     * Implemented with `spawn` rather than `execFile` for two reasons found the hard way:
+     *   1. the async `execFile`/`exec` `input` option is silently ignored, so `git apply -`
+     *      blocked forever waiting for stdin that never closed;
+     *   2. a timeout must kill the whole process group, otherwise a slow `pre-commit` hook
+     *      survives as an orphan while we report failure.
+     */
     private runGit;
+    /**
+     * v0.3.17 S5 — the byte-level primitive behind `runGit`.
+     *
+     * Historical file content may not be valid UTF-8, so blob reads must not round-trip
+     * through a string. Everything else (hardening prefix, profile, byte budget, timeout,
+     * process-group kill) is shared, which is why this is the same body and not a copy.
+     */
+    private runGitBytes;
     private tryGit;
     private encodeCursor;
     private decodeCursor;
 }
+/** v0.3.17 S3 — every index mutation answers with the state version it produced. */
+export interface GitMutationResultV1 {
+    readonly repositoryRevision: string;
+}
+/**
+ * v0.3.17 S3 — the identity, signing and hook configuration a commit will actually run
+ * under. Shown in the form so a failure is explainable instead of mysterious (plan §7.9).
+ */
+export interface GitCommitIdentityV1 {
+    readonly name: string | null;
+    readonly email: string | null;
+    readonly signingKey: string | null;
+    readonly signingEnabled: boolean;
+    readonly hooksDir: string | null;
+    readonly hooksPresent: boolean;
+}
+export interface GitCommitOutcomeV1 {
+    readonly status: 'committed';
+    readonly commitSha: string;
+    readonly repositoryRevision: string;
+    readonly durationMs: number;
+    readonly identity: GitCommitIdentityV1;
+    /** Set when the process reported failure but Git had in fact committed. */
+    readonly warning?: string;
+}
+/** One entry of the actual index that a commit would include. */
+export interface GitIndexEntryV1 {
+    readonly path: string;
+    readonly source: WebGitFileSourceV1;
+    readonly status: string;
+}
+export interface GitCommitPreviewV1 {
+    readonly repositoryRevision: string;
+    readonly branch: string | null;
+    readonly detached: boolean;
+    readonly entries: readonly GitIndexEntryV1[];
+    readonly additions: number;
+    readonly deletions: number;
+    readonly filesChanged: number;
+    readonly identity: GitCommitIdentityV1;
+    readonly canCommit: boolean;
+    /** Why the form is disabled, when it is. */
+    readonly blockedReason: string | null;
+}
+/**
+ * v0.3.17 S3 — summary plus optional body.
+ *
+ * The previous validator rejected any newline, which made a real commit body impossible
+ * (plan G3 asks for exactly that fix). What must still be rejected are characters that would
+ * corrupt or truncate the commit object: NUL and other C0 controls, except the newlines and
+ * tabs a message legitimately contains.
+ */
+export declare function normalizeCommitMessage(summary: string, body?: string): string;
+/**
+ * v0.3.17 S4 — a repository-relative path coming from a history request.
+ *
+ * Validated, never escaped: anything that could be read as a revision expression, a pathspec
+ * magic prefix or an absolute path is refused outright rather than passed to argv.
+ */
+export declare function assertRelativeGitPath(path: unknown): string;
 //# sourceMappingURL=git-read-model-service.d.ts.map