@rmyndharis/aimhooman 0.1.1 → 0.1.3

package/src/gitx.mjs

@@ -12,21 +12,8 @@ import {
     rmSync,
     symlinkSync,
 } from 'node:fs';
-import { createHash, randomUUID } from 'node:crypto';
 import { isAbsolute, join } from 'node:path';
-import { gitEnvironment } from './git-environment.mjs';
-
-export class StateMigrationError extends Error {
-    constructor(detail, { stateDir, legacyStateDirs = [], diagnostics = [], cause } = {}) {
-        super(`repository state: ${detail}`);
-        this.name = 'StateMigrationError';
-        this.stateDir = stateDir;
-        this.legacyStateDirs = legacyStateDirs;
-        this.stateDiagnostics = diagnostics;
-        this.diagnostics = diagnostics;
-        if (cause) this.cause = cause;
-    }
-}
+import { gitEnvironment, GIT_TIMEOUT_MS } from './git-environment.mjs';
 
 export class GitRevisionError extends Error {
     constructor(revision, detail, cause) {
@@ -53,6 +40,7 @@ function gitBuf(args, cwd, input) {
         env: gitEnvironment(),
         encoding: 'buffer',
         maxBuffer: 64 * 1024 * 1024,
+        timeout: GIT_TIMEOUT_MS,
         // Capture stderr into the thrown error (pipe) instead of letting git's
         // raw stderr leak to the user's terminal alongside aimhooman's own
         // diagnostics; stdin is ignored unless input is supplied.
@@ -162,257 +150,17 @@ export function openRepo(cwd = process.cwd()) {
     const gitDir = gitStr(['rev-parse', '--absolute-git-dir'], root);
     let commonDir = gitStr(['rev-parse', '--git-common-dir'], root);
     if (!isAbsolute(commonDir)) commonDir = join(root, commonDir);
-    const state = prepareSharedState(commonDir, gitDir);
     return {
         root,
         gitDir,
         commonDir,
-        stateDir: state.stateDir,
-        legacyStateDirs: state.legacyStateDirs,
-        stateDiagnostics: state.diagnostics,
+        // Shared by linked worktrees, which is why it hangs off commonDir rather
+        // than gitDir. Every released version has written here.
+        stateDir: join(commonDir, 'aimhooman'),
         excludeFile: join(commonDir, 'info', 'exclude'),
     };
 }
 
-function prepareSharedState(commonDir, gitDir) {
-    const stateDir = join(commonDir, 'aimhooman');
-    const legacyStateDirs = findLegacyStateDirs(commonDir, gitDir, stateDir);
-    const diagnostics = [];
-    if (!legacyStateDirs.length) return { stateDir, legacyStateDirs, diagnostics };
-
-    const currentExists = pathExists(stateDir);
-    let fingerprints;
-    try {
-        fingerprints = legacyStateDirs.map((path) => ({ path, fingerprint: stateFingerprint(path) }));
-        if (currentExists) {
-            const currentFingerprint = stateFingerprint(stateDir);
-            const conflicts = fingerprints.filter((entry) => entry.fingerprint !== currentFingerprint);
-            if (conflicts.length) {
-                throw stateConflict(stateDir, legacyStateDirs, conflicts.map((entry) => entry.path));
-            }
-            archiveLegacyStates(fingerprints, stateDir, diagnostics);
-            return { stateDir, legacyStateDirs, diagnostics };
-        }
-
-        const first = fingerprints[0];
-        const conflicts = fingerprints.filter((entry) => entry.fingerprint !== first.fingerprint);
-        if (conflicts.length) {
-            throw stateConflict(stateDir, legacyStateDirs, conflicts.map((entry) => entry.path));
-        }
-        try {
-            copyStateAtomically(first.path, stateDir, first.fingerprint);
-        } catch (error) {
-            if (!pathExists(stateDir)) throw error;
-            const currentFingerprint = stateFingerprint(stateDir);
-            const conflicts = fingerprints.filter((entry) => entry.fingerprint !== currentFingerprint);
-            if (conflicts.length) {
-                throw stateConflict(stateDir, legacyStateDirs, conflicts.map((entry) => entry.path));
-            }
-            diagnostics.push({
-                level: 'info',
-                code: 'legacy-state-migrated-concurrently',
-                path: first.path,
-                stateDir,
-                message: `shared state at "${stateDir}" was created by another process`,
-            });
-            archiveLegacyStates(fingerprints, stateDir, diagnostics);
-            return { stateDir, legacyStateDirs, diagnostics };
-        }
-        diagnostics.push({
-            level: 'info',
-            code: 'legacy-state-migrated',
-            path: first.path,
-            stateDir,
-            message: `copied legacy state from "${first.path}" to shared state "${stateDir}"`,
-        });
-        archiveLegacyStates(fingerprints, stateDir, diagnostics);
-        return { stateDir, legacyStateDirs, diagnostics };
-    } catch (error) {
-        if (error instanceof StateMigrationError) throw error;
-        throw new StateMigrationError(`cannot inspect or migrate legacy state: ${error.message}`, {
-            stateDir,
-            legacyStateDirs,
-            diagnostics,
-            cause: error,
-        });
-    }
-}
-
-function findLegacyStateDirs(commonDir, gitDir, stateDir) {
-    const found = new Set();
-    const adminDir = join(commonDir, 'worktrees');
-    let entries = [];
-    try {
-        entries = readdirSync(adminDir, { withFileTypes: true });
-    } catch (error) {
-        if (error?.code !== 'ENOENT') {
-            throw new StateMigrationError(`cannot list linked worktrees: ${error.message}`, {
-                stateDir,
-                cause: error,
-            });
-        }
-    }
-    for (const entry of entries) {
-        if (!entry.isDirectory()) continue;
-        const candidate = join(adminDir, entry.name, 'aimhooman');
-        if (pathExists(candidate) && !isCompatibilityLink(candidate, stateDir)) found.add(candidate);
-    }
-    const currentLegacy = join(gitDir, 'aimhooman');
-    if (currentLegacy !== stateDir
-        && pathExists(currentLegacy)
-        && !isCompatibilityLink(currentLegacy, stateDir)) {
-        found.add(currentLegacy);
-    }
-    return [...found].sort();
-}
-
-function isCompatibilityLink(path, stateDir) {
-    try {
-        if (!lstatSync(path).isSymbolicLink()) return false;
-        return realpathSync(path) === realpathSync(stateDir);
-    } catch (error) {
-        if (error?.code === 'ENOENT') return false;
-        throw error;
-    }
-}
-
-function pathExists(path) {
-    try {
-        lstatSync(path);
-        return true;
-    } catch (error) {
-        if (error?.code === 'ENOENT') return false;
-        throw error;
-    }
-}
-
-function stateFingerprint(root) {
-    const hash = createHash('sha256');
-    function visit(path, relative) {
-        const stat = lstatSync(path);
-        hash.update(relative);
-        hash.update('\0');
-        hash.update(String(stat.mode & 0o777));
-        hash.update('\0');
-        if (stat.isDirectory()) {
-            hash.update('directory\0');
-            for (const name of readdirSync(path).sort()) {
-                visit(join(path, name), relative ? join(relative, name) : name);
-            }
-            return;
-        }
-        if (stat.isFile()) {
-            hash.update('file\0');
-            hash.update(readFileSync(path));
-            hash.update('\0');
-            return;
-        }
-        if (stat.isSymbolicLink()) {
-            hash.update('symlink\0');
-            hash.update(readlinkSync(path));
-            hash.update('\0');
-            return;
-        }
-        throw new Error(`unsupported state entry "${path}"`);
-    }
-    visit(root, '');
-    return hash.digest('hex');
-}
-
-function copyStateAtomically(source, destination, expectedFingerprint) {
-    const temporary = `${destination}.migrate-${process.pid}-${randomUUID()}`;
-    try {
-        cpSync(source, temporary, {
-            recursive: true,
-            dereference: false,
-            errorOnExist: true,
-            force: false,
-            preserveTimestamps: true,
-        });
-        if (stateFingerprint(temporary) !== expectedFingerprint) {
-            throw new Error(`legacy state changed while it was copied from "${source}"`);
-        }
-        renameSync(temporary, destination);
-    } catch (error) {
-        try {
-            rmSync(temporary, { recursive: true, force: true });
-        } catch {
-            // Keep the migration error when cleanup is unavailable.
-        }
-        throw error;
-    }
-}
-
-export function archiveLegacyStates(entries, stateDir, diagnostics) {
-    for (const entry of entries) {
-        // A concurrent process may have already archived this legacy state and
-        // replaced entry.path with a compatibility symlink to stateDir. Renaming
-        // that symlink would then fingerprint stateDir (mismatching the legacy
-        // fingerprint taken before the race) and spuriously fail migration. Treat
-        // an already-symlinked entry as archived-concurrently and move on.
-        if (isCompatibilityLink(entry.path, stateDir)) {
-            diagnostics.push({
-                level: 'info',
-                code: 'legacy-state-archived-concurrently',
-                path: entry.path,
-                stateDir,
-                message: `legacy state at "${entry.path}" was archived by another process`,
-            });
-            continue;
-        }
-        const archivedPath = `${entry.path}.migrated-${randomUUID()}`;
-        let renamed = false;
-        try {
-            renameSync(entry.path, archivedPath);
-            renamed = true;
-            if (stateFingerprint(archivedPath) !== entry.fingerprint) {
-                throw new Error(`legacy state changed while it was archived from "${entry.path}"`);
-            }
-            symlinkSync(stateDir, entry.path, process.platform === 'win32' ? 'junction' : 'dir');
-        } catch (error) {
-            if (!renamed && error?.code === 'ENOENT' && !pathExists(entry.path)) {
-                diagnostics.push({
-                    level: 'info',
-                    code: 'legacy-state-archived-concurrently',
-                    path: entry.path,
-                    stateDir,
-                    message: `legacy state at "${entry.path}" was archived by another process`,
-                });
-                continue;
-            }
-            try {
-                if (isCompatibilityLink(entry.path, stateDir)) rmSync(entry.path, { force: true });
-                if (!pathExists(entry.path) && pathExists(archivedPath)) renameSync(archivedPath, entry.path);
-            } catch {
-                // Keep the migration error; both locations are named in it.
-            }
-            throw error;
-        }
-        diagnostics.push({
-            level: 'info',
-            code: 'legacy-state-archived',
-            path: entry.path,
-            archivedPath,
-            stateDir,
-            message: `archived legacy state at "${archivedPath}" and linked its old path to "${stateDir}"`,
-        });
-    }
-}
-
-function stateConflict(stateDir, legacyStateDirs, conflictingPaths) {
-    const diagnostics = conflictingPaths.map((path) => ({
-        level: 'error',
-        code: 'legacy-state-conflict',
-        path,
-        stateDir,
-        message: `legacy state at "${path}" conflicts with another per-clone state`,
-    }));
-    return new StateMigrationError(
-        `conflicting legacy state found; select which state to keep at "${stateDir}"`,
-        { stateDir, legacyStateDirs, diagnostics },
-    );
-}
-
 // stagedEntries snapshots index changes, including deletion metadata. Rename
 // and copy entries use the destination path; object IDs keep blob reads stable.
 export function stagedEntries(repo) {
@@ -452,7 +200,7 @@ export function unmergedPaths(repo) {
 export function stagedRenameSources(repo, destinations) {
     const selected = new Set(destinations);
     if (!selected.size) return [];
-    const entries = diffEntries(repo, ['--cached'], 1);
+    const entries = diffEntries(repo, ['--cached'], '1%');
     const sources = new Set(entries
         .filter((entry) => entry.status === 'R' && selected.has(entry.path) && entry.sourcePath)
         .map((entry) => entry.sourcePath));
@@ -462,7 +210,9 @@ export function stagedRenameSources(repo, destinations) {
     // there is no exact source to recover. When a blocked destination remains an
     // add even at the lowest similarity threshold, conservatively restore every
     // staged deletion. This may unstage an unrelated deletion, but it never lets
-    // automatic repair silently commit half of a possible rename.
+    // automatic repair silently commit half of a possible rename. That threshold
+    // carries a % sign because git reads a bare 1 as the fraction 0.1, so -M1
+    // asks for 10% and leaves a 3%-similar rename here as an add plus a delete.
     if (entries.some((entry) => entry.status === 'A' && selected.has(entry.path))) {
         for (const entry of entries) {
             if (entry.status === 'D') sources.add(entry.path);
@@ -478,8 +228,13 @@ export function readStagedPath(repo, path) {
     const target = 'staged';
     let records;
     try {
+        // The --literal-pathspecs flag rather than :(top,literal) magic: magic
+        // parsing is disabled by GIT_LITERAL_PATHSPECS in the environment, which
+        // would leave the pathspec a literal filename no repository contains, so
+        // git matched nothing and the read reported the policy absent. cwd is
+        // already repo.root, which is what the top magic was for.
         records = nulStrings(gitBuf([
-            'ls-files', '--stage', '-z', '--', `:(top,literal)${path}`,
+            '--literal-pathspecs', 'ls-files', '--stage', '-z', '--', path,
         ], repo.root));
     } catch (error) {
         throw new GitTargetReadError(target, path, gitErrorDetail(error), error);
@@ -526,7 +281,7 @@ export function readCommitPath(repo, revision, path) {
     let records;
     try {
         records = nulStrings(gitBuf([
-            'ls-tree', '--full-tree', '-z', oid, '--', `:(top,literal)${path}`,
+            '--literal-pathspecs', 'ls-tree', '--full-tree', '-z', oid, '--', path,
         ], repo.root));
     } catch (error) {
         throw new GitTargetReadError(target, path, gitErrorDetail(error), error);
@@ -636,21 +391,40 @@ export function withIndexFromTree(repo, treeOid, fn) {
     }
 }
 
-// introducedCommits returns each commit added by a proposed branch update,
-// independent of reachability through other refs. Using `--not --all` here
-// would let an ignored tag/remote ref pre-poison reachability and suppress the
-// final scan. A newly created branch has no trusted old tip, so its full ancestry
-// is checked; ordinary updates scan exactly old..new.
+// gatedTips lists the local branch tips this guard has already cleared. Only
+// refs/heads/* qualifies, because it is the only namespace cmdRefcheck gates;
+// the refs under review are excluded, since Git already publishes them at the
+// `committed` phase and a ref must never serve as its own proof.
+function gatedTips(repo, reviewing) {
+    return gitBuf(['for-each-ref', '--format=%(refname) %(objectname)', 'refs/heads/'], repo.root)
+        .toString('utf8')
+        .split('\n')
+        .filter(Boolean)
+        .map((line) => line.split(' '))
+        .filter(([name, oid]) => name && oid && !reviewing.has(name))
+        .map(([, oid]) => oid);
+}
+
+// introducedCommits returns each commit added by a proposed branch update.
+// Reachability through refs/heads/* is trusted because those commits passed this
+// same guard when their branch was written; every other namespace is not. Using
+// `--not --all` would let an ignored tag or remote ref pre-poison reachability
+// and suppress the scan, so tips come from refs/heads/* alone. A newly created
+// branch is measured against those tips instead of its full ancestry, which
+// would otherwise rescan the entire repository on every `git checkout -b`;
+// ordinary updates scan exactly old..new.
 export function introducedCommits(repo, updates) {
     const commits = [];
     const seen = new Set();
+    const reviewing = new Set(updates.map((update) => update?.ref).filter(Boolean));
+    const gated = gatedTips(repo, reviewing);
     for (const update of updates) {
         const oldObjectId = update?.oldObjectId;
         const newObjectId = update?.newObjectId;
         assertOid(oldObjectId);
         assertOid(newObjectId);
         const revisions = /^0+$/.test(oldObjectId)
-            ? [newObjectId]
+            ? [newObjectId, ...(gated.length ? ['--not', ...gated] : [])]
             : [newObjectId, `^${oldObjectId}`];
         const resolved = gitBuf(['rev-list', '--reverse', ...revisions], repo.root)
             .toString('utf8')
@@ -686,12 +460,28 @@ export function unstagePaths(repo, paths) {
         cwd: repo.root,
         env: gitEnvironment(),
         input: pathspecs,
+        timeout: GIT_TIMEOUT_MS,
         stdio: ['pipe', 'ignore', 'pipe'],
     };
     let hasHead = true;
     try {
-        execFileSync('git', ['rev-parse', '--verify', 'HEAD'], opts);
-    } catch {
+        // Deliberately not `opts`: rev-parse never reads stdin, so feeding it the
+        // pathspec makes git exit before draining the pipe, and a pathspec over the
+        // ~64 KiB pipe buffer fails the write with EPIPE. That read as "no HEAD" and
+        // sent a repository that has one down the `rm --cached` branch, staging the
+        // deletion of every tracked path this was asked to restore.
+        execFileSync('git', ['rev-parse', '--verify', 'HEAD'], {
+            cwd: repo.root,
+            env: gitEnvironment(),
+            timeout: GIT_TIMEOUT_MS,
+            stdio: ['ignore', 'ignore', 'pipe'],
+        });
+    } catch (error) {
+        // Only git's own verdict may select the branch. An unborn HEAD exits 128;
+        // a timeout or a missing git carries no exit status, and guessing "no HEAD"
+        // there would delete instead of restore. Fail closed and let the caller stop
+        // the commit rather than silently rewrite the index.
+        if (typeof error?.status !== 'number') throw error;
         hasHead = false;
     }
     if (hasHead) {
@@ -700,8 +490,13 @@ export function unstagePaths(repo, paths) {
             '--pathspec-from-file=-', '--pathspec-file-nul',
         ], opts);
     } else {
+        // -f waives only the check that the staged blob still matches the file
+        // on disk. With no HEAD that check has nothing else to pass against, so
+        // an artifact appended to between `git add` and `git commit` could never
+        // be unstaged. --cached leaves the worktree alone either way, and the
+        // sibling `restore --staged` branch enforces no equivalent check.
         execFileSync('git', [
-            '--literal-pathspecs', 'rm', '--cached', '--quiet', '--ignore-unmatch',
+            '--literal-pathspecs', 'rm', '--cached', '-f', '--quiet', '--ignore-unmatch',
             '--pathspec-from-file=-', '--pathspec-file-nul',
         ], opts);
     }

package/src/history-scan.mjs

@@ -2,7 +2,7 @@ import { execFileSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { GitRevisionError } from './gitx.mjs';
-import { gitEnvironment } from './git-environment.mjs';
+import { gitEnvironment, GIT_TIMEOUT_MS } from './git-environment.mjs';
 
 export const EMPTY_HISTORY_OID = '0'.repeat(40);
 
@@ -12,6 +12,11 @@ function gitBuffer(repo, args, input) {
         env: gitEnvironment(),
         encoding: 'buffer',
         maxBuffer: 128 * 1024 * 1024,
+        timeout: GIT_TIMEOUT_MS,
+        // Same reason as gitBuf in gitx.mjs: without an explicit stdio,
+        // execFileSync echoes the child's stderr before it checks the exit
+        // status, so git's raw output reaches the terminal even on success.
+        stdio: [input === undefined ? 'ignore' : 'pipe', 'pipe', 'pipe'],
         ...(input === undefined ? {} : { input }),
     });
 }
@@ -26,6 +31,7 @@ function gitStringQuiet(repo, args) {
         env: gitEnvironment(),
         encoding: 'utf8',
         maxBuffer: 128 * 1024 * 1024,
+        timeout: GIT_TIMEOUT_MS,
         stdio: ['ignore', 'pipe', 'pipe'],
     }).trim();
 }
@@ -223,6 +229,7 @@ function isAncestor(repo, ancestor, descendant) {
             cwd: repo.root,
             env: gitEnvironment(),
             stdio: ['ignore', 'ignore', 'pipe'],
+            timeout: GIT_TIMEOUT_MS,
         });
         return true;
     } catch (error) {