@runuai/host 0.1.0

package/lib/git-diff.ts

@@ -0,0 +1,370 @@
+/**
+ * Parse `git diff` unified output into structured per-file patches.
+ *
+ * Input is whatever `git diff origin/<base>..HEAD` produces — multi-file,
+ * with headers, mode/rename/binary annotations, and `@@` hunks. The
+ * output is a list of `DiffFile`s the UI can render per-file with
+ * collapse/expand and syntax-highlighted hunks.
+ *
+ * Hand-rolled rather than pulled in as a dep — the unified-diff grammar
+ * is small and the chat-side Markdown renderer already sets the
+ * dependency-free precedent (see components/markdown.tsx).
+ */
+import { spawn } from "node:child_process";
+
+export type DiffStatus =
+  | "added"
+  | "deleted"
+  | "modified"
+  | "renamed"
+  | "copied"
+  | "binary";
+
+export interface DiffLine {
+  /** ' ' for context, '+' for added, '-' for removed. */
+  kind: "ctx" | "add" | "del";
+  /** Line content without the leading marker. */
+  content: string;
+  /** Line number in the old file (1-based) for ctx/del lines. */
+  oldNo?: number;
+  /** Line number in the new file (1-based) for ctx/add lines. */
+  newNo?: number;
+}
+
+export interface DiffHunk {
+  oldStart: number;
+  oldLines: number;
+  newStart: number;
+  newLines: number;
+  /** Raw `@@ ... @@` header text, useful for the section label git
+   *  sometimes includes after the second `@@`. */
+  header: string;
+  lines: DiffLine[];
+}
+
+export interface DiffFile {
+  path: string;
+  /** Set on rename / copy — the source path before the change. */
+  oldPath?: string;
+  status: DiffStatus;
+  /** Best-effort language hint based on the file extension. */
+  language?: string;
+  /** A `Binary files … differ` patch has no hunks. */
+  binary: boolean;
+  hunks: DiffHunk[];
+}
+
+const GIT_DIFF_ARGS = [
+  "-c",
+  "core.quotepath=false",
+  "diff",
+  "--no-color",
+  "--no-ext-diff",
+  "--src-prefix=a/",
+  "--dst-prefix=b/",
+];
+
+const NON_INTERACTIVE_GIT_ENV = {
+  GIT_TERMINAL_PROMPT: "0",
+  GCM_INTERACTIVE: "never",
+  GIT_SSH_COMMAND: "ssh -o BatchMode=yes",
+};
+
+/**
+ * Run `git diff <range>` in `cwd` and return the raw unified-diff text.
+ * Throws if git exits non-zero. Empty diff returns an empty string.
+ */
+export function runGitDiff(cwd: string, range: string): Promise<string> {
+  return runDiffCommand(
+    "git",
+    ["-C", cwd, ...GIT_DIFF_ARGS, range],
+    "git diff",
+    {
+      ...process.env,
+      ...NON_INTERACTIVE_GIT_ENV,
+    },
+  );
+}
+
+/**
+ * Run `git diff <range>` inside a running task container.
+ *
+ * Active task worktrees are bind-mounted into the container at
+ * `/workspace`. Running diff there keeps all Git credential behavior
+ * inside the task sandbox instead of leaking to the host's SSH agent
+ * (for example macOS 1Password confirmation prompts).
+ */
+export function runGitDiffInContainer(
+  containerName: string,
+  cwd: string,
+  range: string,
+): Promise<string> {
+  return runDiffCommand(
+    "docker",
+    [
+      "exec",
+      "-e",
+      `GIT_TERMINAL_PROMPT=${NON_INTERACTIVE_GIT_ENV.GIT_TERMINAL_PROMPT}`,
+      "-e",
+      `GCM_INTERACTIVE=${NON_INTERACTIVE_GIT_ENV.GCM_INTERACTIVE}`,
+      "-e",
+      `GIT_SSH_COMMAND=${NON_INTERACTIVE_GIT_ENV.GIT_SSH_COMMAND}`,
+      "-w",
+      cwd,
+      containerName,
+      "git",
+      ...GIT_DIFF_ARGS,
+      range,
+    ],
+    "docker exec git diff",
+    process.env,
+  );
+}
+
+function runDiffCommand(
+  command: string,
+  args: string[],
+  label: string,
+  env: NodeJS.ProcessEnv,
+): Promise<string> {
+  return new Promise((res, rej) => {
+    // Force ASCII paths and pull a generous unified context so the UI
+    // can render meaningful blocks. No color codes.
+    const child = spawn(command, args, {
+      env,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (b) => {
+      stdout += b.toString("utf8");
+    });
+    child.stderr.on("data", (b) => {
+      stderr += b.toString("utf8");
+    });
+    child.on("error", rej);
+    child.on("close", (code) => {
+      if (code === 0) {
+        res(stdout);
+        return;
+      }
+      rej(new Error(`${label} exited ${code}: ${stderr.trim()}`));
+    });
+  });
+}
+
+/**
+ * Parse the output of `git diff` into structured file patches.
+ */
+export function parseGitDiff(text: string): DiffFile[] {
+  if (!text) return [];
+  const lines = text.split("\n");
+  const files: DiffFile[] = [];
+  let i = 0;
+
+  while (i < lines.length) {
+    const line = lines[i] ?? "";
+    if (!line.startsWith("diff --git ")) {
+      i += 1;
+      continue;
+    }
+    // Each file section starts with `diff --git a/<path> b/<path>` and
+    // runs to the next `diff --git` line (or EOF).
+    const header = parseDiffGitHeader(line);
+    let path = header.bPath ?? header.aPath ?? "";
+    let oldPath: string | undefined;
+    let status: DiffStatus = "modified";
+    let binary = false;
+    const hunks: DiffHunk[] = [];
+
+    i += 1;
+    while (i < lines.length && !(lines[i] ?? "").startsWith("diff --git ")) {
+      const ln = lines[i] ?? "";
+      if (ln.startsWith("new file mode")) status = "added";
+      else if (ln.startsWith("deleted file mode")) status = "deleted";
+      else if (ln.startsWith("rename from ")) {
+        status = "renamed";
+        oldPath = ln.slice("rename from ".length);
+      } else if (ln.startsWith("rename to ")) {
+        path = ln.slice("rename to ".length);
+      } else if (ln.startsWith("copy from ")) {
+        status = "copied";
+        oldPath = ln.slice("copy from ".length);
+      } else if (ln.startsWith("copy to ")) {
+        path = ln.slice("copy to ".length);
+      } else if (ln.startsWith("Binary files ")) {
+        binary = true;
+        status = status === "modified" ? "binary" : status;
+      } else if (ln.startsWith("--- ")) {
+        const p = stripPathPrefix(ln.slice(4));
+        if (p !== "/dev/null" && status === "modified") oldPath = oldPath ?? p;
+        if (p === "/dev/null") status = "added";
+      } else if (ln.startsWith("+++ ")) {
+        const p = stripPathPrefix(ln.slice(4));
+        if (p !== "/dev/null") path = p;
+        else status = "deleted";
+      } else if (ln.startsWith("@@")) {
+        const { hunk, consumed } = parseHunk(lines, i);
+        if (hunk) hunks.push(hunk);
+        i += consumed;
+        continue;
+      }
+      i += 1;
+    }
+
+    files.push({
+      path,
+      oldPath: oldPath && oldPath !== path ? oldPath : undefined,
+      status,
+      language: languageFor(path),
+      binary,
+      hunks,
+    });
+  }
+
+  return files;
+}
+
+function parseDiffGitHeader(line: string): {
+  aPath?: string;
+  bPath?: string;
+} {
+  // `diff --git a/foo b/foo` — paths may contain spaces if quoted.
+  // Quoted form is `diff --git "a/path with space" "b/path with space"`.
+  // For simplicity (uai paths are well-behaved), greedy match on the
+  // common forms.
+  const m = line.match(
+    /^diff --git (?:"a\/(.*?)"|a\/(\S+)) (?:"b\/(.*?)"|b\/(\S+))$/,
+  );
+  if (!m) return {};
+  const a = m[1] ?? m[2];
+  const b = m[3] ?? m[4];
+  return { aPath: a, bPath: b };
+}
+
+function stripPathPrefix(s: string): string {
+  // `a/foo`, `b/foo`, or `/dev/null`. Quoted form: `"a/foo"`.
+  const t = s.trim().replace(/^"(.*)"$/, "$1");
+  if (t === "/dev/null") return t;
+  if (t.startsWith("a/") || t.startsWith("b/")) return t.slice(2);
+  return t;
+}
+
+function parseHunk(
+  lines: string[],
+  start: number,
+): { hunk: DiffHunk | null; consumed: number } {
+  const headerLine = lines[start] ?? "";
+  // `@@ -<oldStart>,<oldLines> +<newStart>,<newLines> @@ optional label`
+  const m = headerLine.match(
+    /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@ ?(.*)$/,
+  );
+  if (!m) return { hunk: null, consumed: 1 };
+  const oldStart = Number(m[1]);
+  const oldLines = m[2] === undefined ? 1 : Number(m[2]);
+  const newStart = Number(m[3]);
+  const newLines = m[4] === undefined ? 1 : Number(m[4]);
+  const header = m[5] ?? "";
+
+  const out: DiffLine[] = [];
+  let oldNo = oldStart;
+  let newNo = newStart;
+  let i = start + 1;
+  let oldSeen = 0;
+  let newSeen = 0;
+
+  while (i < lines.length) {
+    const ln = lines[i] ?? "";
+    // End conditions: next hunk in the same file, next file, or EOF.
+    if (ln.startsWith("@@") || ln.startsWith("diff --git ")) break;
+    // `` markers — annotate the previous
+    // line by not advancing counters. Just skip.
+    if (ln.startsWith("\\ ")) {
+      i += 1;
+      continue;
+    }
+    const c = ln.charAt(0);
+    if (c === "+") {
+      out.push({ kind: "add", content: ln.slice(1), newNo });
+      newNo += 1;
+      newSeen += 1;
+    } else if (c === "-") {
+      out.push({ kind: "del", content: ln.slice(1), oldNo });
+      oldNo += 1;
+      oldSeen += 1;
+    } else if (c === " " || ln === "") {
+      // Context line. Git emits a space prefix for context; an empty
+      // line in unified diff is still a context line (an empty file
+      // line).
+      out.push({
+        kind: "ctx",
+        content: c === " " ? ln.slice(1) : "",
+        oldNo,
+        newNo,
+      });
+      oldNo += 1;
+      newNo += 1;
+      oldSeen += 1;
+      newSeen += 1;
+    } else {
+      // Anything else — probably the start of metadata for a fresh
+      // file we somehow didn't catch. Bail out so the outer loop can
+      // re-process it.
+      break;
+    }
+    i += 1;
+    // Hunks are self-delimiting by their counts. Once we've consumed
+    // them, stop — anything further belongs to the next section.
+    if (oldSeen >= oldLines && newSeen >= newLines) break;
+  }
+
+  return {
+    hunk: {
+      oldStart,
+      oldLines,
+      newStart,
+      newLines,
+      header,
+      lines: out,
+    },
+    consumed: i - start,
+  };
+}
+
+const LANG_BY_EXT: Record<string, string> = {
+  ts: "typescript",
+  tsx: "typescript",
+  js: "javascript",
+  jsx: "javascript",
+  mjs: "javascript",
+  cjs: "javascript",
+  json: "json",
+  md: "markdown",
+  mdx: "markdown",
+  css: "css",
+  scss: "scss",
+  html: "html",
+  yml: "yaml",
+  yaml: "yaml",
+  toml: "toml",
+  py: "python",
+  rb: "ruby",
+  go: "go",
+  rs: "rust",
+  java: "java",
+  c: "c",
+  h: "c",
+  cpp: "cpp",
+  hpp: "cpp",
+  sh: "bash",
+  bash: "bash",
+  sql: "sql",
+  swift: "swift",
+  kt: "kotlin",
+  php: "php",
+};
+
+function languageFor(path: string): string | undefined {
+  const ext = path.includes(".") ? path.split(".").pop()!.toLowerCase() : "";
+  return LANG_BY_EXT[ext];
+}

package/lib/git-identity.ts

@@ -0,0 +1,65 @@
+/**
+ * Set the task creator's git identity inside the container (ADR-029) so commits
+ * are authored as the user who created the task, not the image's generic
+ * identity. Best-effort, mirrors the SSH setup: a failure logs but never aborts
+ * task-up. Name falls back to the email when no display name is known.
+ */
+
+import { spawnSync } from "node:child_process";
+
+const EXEC_TIMEOUT_MS = 10_000;
+
+/** Injectable docker-exec seam (mocked in tests). */
+export type DockerExec = (args: string[]) => {
+  status: number | null;
+  stderr: string;
+};
+
+const defaultExec: DockerExec = (args) => {
+  const res = spawnSync("docker", args, {
+    encoding: "utf8",
+    timeout: EXEC_TIMEOUT_MS,
+  });
+  return { status: res.status, stderr: res.stderr ?? "" };
+};
+
+export function setupTaskGitIdentity(
+  taskId: string,
+  name: string | null,
+  email: string | null,
+  exec: DockerExec = defaultExec,
+): boolean {
+  if (!email) {
+    console.log(`[git] task ${taskId}: no owner email — leaving git identity`);
+    return false;
+  }
+  const displayName = name && name.trim() ? name.trim() : email;
+  const container = `task-${taskId}-app-1`;
+  // Values are passed as argv (never interpolated into a shell string), so a
+  // name/email can't shell-inject.
+  const entries: ReadonlyArray<readonly [string, string]> = [
+    ["user.name", displayName],
+    ["user.email", email],
+  ];
+  for (const [key, value] of entries) {
+    const res = exec([
+      "exec",
+      "-u",
+      "node",
+      container,
+      "git",
+      "config",
+      "--global",
+      key,
+      value,
+    ]);
+    if (res.status !== 0) {
+      console.warn(
+        `[git] task ${taskId}: git config ${key} failed: ${res.stderr.trim()}`,
+      );
+      return false;
+    }
+  }
+  console.log(`[git] task ${taskId}: git identity → ${displayName} <${email}>`);
+  return true;
+}