@thxgg/steward 0.1.20 → 0.1.22

package/.output/server/chunks/routes/renderer.mjs

@@ -1,5 +1,5 @@
 import { createRenderer, getRequestDependencies, getPreloadLinks, getPrefetchLinks } from 'vue-bundle-renderer/runtime';
-import { n as joinRelativeURL, u as useRuntimeConfig, o as getResponseStatusText, q as getResponseStatus, t as defineRenderHandler, g as getQuery, c as createError, v as destr, w as getRouteRules, x as joinURL, y as useNitroApp } from '../nitro/nitro.mjs';
+import { K as joinRelativeURL, F as useRuntimeConfig, L as getResponseStatusText, M as getResponseStatus, N as defineRenderHandler, g as getQuery, c as createError, O as destr, P as getRouteRules, Q as joinURL, R as useNitroApp } from '../nitro/nitro.mjs';
 import { renderToString } from 'vue/server-renderer';
 import { createHead as createHead$1, propsToString, renderSSRHead } from 'unhead/server';
 import { stringify, uneval } from 'devalue';

package/.output/server/index.mjs

@@ -1,12 +1,13 @@
 import process from 'node:process';globalThis._importMeta_={url:import.meta.url,env:process.env};import 'node:http';
 import 'node:https';
-export { O as default } from './chunks/nitro/nitro.mjs';
+export { a6 as default } from './chunks/nitro/nitro.mjs';
 import 'node:events';
 import 'node:buffer';
 import 'node:fs';
 import 'node:path';
 import 'node:crypto';
 import 'node:os';
-import 'zod';
+import 'node:child_process';
 import 'node:url';
+import 'zod';
 //# sourceMappingURL=index.mjs.map

package/.output/server/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sources":[],"names":[],"mappings":";;;;;;;;;;"}
+{"version":3,"file":"index.mjs","sources":[],"names":[],"mappings":";;;;;;;;;;;"}

package/.output/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thxgg/steward-prod",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "type": "module",
   "private": true,
   "dependencies": {

package/dist/host/src/api/git.js

@@ -1,3 +1,5 @@
+import { resolve } from 'node:path';
+import { normalizeCommitRepoRefPath } from '../../../server/utils/git-repo-path.js';
 import { commitStagedChanges, getCommitDiff, getCommitInfo, getFileContent, getFileDiff, getWorkingTreeStatus, isGitRepo, stagePaths, validatePathInRepo } from '../../../server/utils/git.js';
 import { requireRepo } from './repo-context.js';
 function toGitStatus(status) {
@@ -13,15 +15,20 @@ function resolveGitRepoPath(repo, repoPath) {
     if (!repoPath) {
         return repo.path;
     }
-    if (!repo.gitRepos || repo.gitRepos.length === 0) {
-        throw new Error('repo parameter provided but no git repos discovered in this repository');
+    const normalizedRepoPath = normalizeCommitRepoRefPath(repo, repoPath);
+    if (normalizedRepoPath === null) {
+        throw new Error('Invalid repo path: path traversal not allowed');
     }
-    const matchedRepo = repo.gitRepos.find((gitRepo) => gitRepo.relativePath === repoPath);
-    if (!matchedRepo) {
-        const available = repo.gitRepos.map((gitRepo) => gitRepo.relativePath).join(', ');
-        throw new Error(`repo "${repoPath}" is not a discovered git repo. Available: ${available}`);
+    if (!normalizedRepoPath) {
+        return repo.path;
+    }
+    const matchedRepo = (repo.gitRepos || []).find((gitRepo) => {
+        return gitRepo.relativePath === normalizedRepoPath;
+    });
+    if (matchedRepo) {
+        return matchedRepo.absolutePath;
     }
-    return matchedRepo.absolutePath;
+    return resolve(repo.path, normalizedRepoPath);
 }
 export const git = {
     async getStatus(repoId, repoPath) {

package/dist/server/utils/git-repo-path.js

@@ -0,0 +1,63 @@
+import { basename, isAbsolute, relative, resolve } from 'node:path';
+export function normalizePathSlashes(path) {
+    return path.replaceAll('\\', '/');
+}
+export function isWithinPath(parentPath, candidatePath) {
+    const relativePath = relative(resolve(parentPath), resolve(candidatePath));
+    return relativePath === '' || (!relativePath.startsWith('..') && !isAbsolute(relativePath));
+}
+export function normalizeRepoRelativePath(repoRoot, repoPath) {
+    const absolutePath = isAbsolute(repoPath)
+        ? resolve(repoPath)
+        : resolve(repoRoot, repoPath);
+    if (!isWithinPath(repoRoot, absolutePath)) {
+        return null;
+    }
+    const relativePath = relative(resolve(repoRoot), absolutePath);
+    if (!relativePath || relativePath === '.') {
+        return '';
+    }
+    return normalizePathSlashes(relativePath);
+}
+function normalizeComparablePath(value) {
+    return normalizePathSlashes(value).replace(/\/+$/, '');
+}
+function getKnownRepoPaths(repo) {
+    const knownPaths = new Set();
+    for (const gitRepo of repo.gitRepos || []) {
+        knownPaths.add(normalizePathSlashes(gitRepo.relativePath));
+    }
+    return knownPaths;
+}
+/**
+ * Normalize a commit repo reference or API repo parameter to canonical relative form.
+ *
+ * - `''` means repository root git repo.
+ * - Non-empty values are normalized relative paths under repo root.
+ * - Returns `null` when the path attempts traversal outside repo root.
+ */
+export function normalizeCommitRepoRefPath(repo, repoPath) {
+    const repoRoot = resolve(repo.path);
+    const trimmed = repoPath.trim();
+    if (!trimmed || trimmed === '.' || trimmed === './') {
+        return '';
+    }
+    const normalizedRelativePath = normalizeRepoRelativePath(repoRoot, trimmed);
+    if (normalizedRelativePath === null) {
+        return null;
+    }
+    if (normalizedRelativePath === '') {
+        return '';
+    }
+    const knownRepoPaths = getKnownRepoPaths(repo);
+    if (knownRepoPaths.has(normalizedRelativePath)) {
+        return normalizedRelativePath;
+    }
+    const comparable = normalizeComparablePath(trimmed);
+    const repoName = normalizeComparablePath(repo.name);
+    const repoBaseName = normalizeComparablePath(basename(repoRoot));
+    if (comparable === repoName || comparable === repoBaseName) {
+        return '';
+    }
+    return normalizedRelativePath;
+}

package/dist/server/utils/git.js

@@ -1,6 +1,7 @@
 import { spawn } from 'node:child_process';
 import { promises as fs } from 'node:fs';
-import { join, resolve, relative, isAbsolute } from 'node:path';
+import { resolve, relative, isAbsolute } from 'node:path';
+import { normalizeCommitRepoRefPath } from './git-repo-path.js';
 /**
  * Execute a git command and return stdout
  */
@@ -472,7 +473,8 @@ export async function findRepoForCommit(repoConfig, sha) {
 }
 /**
  * Resolve a commit entry (string or CommitRef) to its repository information.
- * For CommitRef objects, returns immediately (O(1)).
+ * For CommitRef objects, validates and normalizes stored repo context, then falls
+ * back to SHA lookup when stored context is stale.
  * For string SHAs, searches repositories to find the commit.
  *
  * @param repoConfig - The repository configuration
@@ -480,13 +482,28 @@ export async function findRepoForCommit(repoConfig, sha) {
  * @returns Resolved commit information with repo path
  */
 export async function resolveCommitRepo(repoConfig, commitEntry) {
-    // If it's a CommitRef object, we already have the repo info (O(1))
-    if (typeof commitEntry === 'object' && commitEntry.sha && commitEntry.repo) {
-        return {
-            sha: commitEntry.sha,
-            repoPath: commitEntry.repo,
-            absolutePath: join(repoConfig.path, commitEntry.repo),
-        };
+    const hasExplicitRepoPath = typeof commitEntry === 'object'
+        && commitEntry !== null
+        && typeof commitEntry.sha === 'string'
+        && Object.prototype.hasOwnProperty.call(commitEntry, 'repo')
+        && typeof commitEntry.repo === 'string';
+    // If it's a CommitRef object, normalize and validate its repo info first.
+    if (hasExplicitRepoPath) {
+        const normalizedRepoPath = normalizeCommitRepoRefPath(repoConfig, commitEntry.repo);
+        if (normalizedRepoPath !== null) {
+            const absolutePath = normalizedRepoPath
+                ? resolve(repoConfig.path, normalizedRepoPath)
+                : repoConfig.path;
+            if (await isGitRepo(absolutePath) && await commitExistsInRepo(absolutePath, commitEntry.sha)) {
+                return {
+                    sha: commitEntry.sha,
+                    repoPath: normalizedRepoPath,
+                    absolutePath,
+                };
+            }
+        }
+        // Stored repo context can become stale or malformed; fall back to lookup by SHA.
+        return findRepoForCommit(repoConfig, commitEntry.sha);
     }
     // It's a string SHA, need to search for it
     const sha = typeof commitEntry === 'string' ? commitEntry : commitEntry.sha;

package/dist/server/utils/state-migration.js

@@ -1,8 +1,13 @@
 import { emitChange } from './change-events.js';
 import { dbAll, dbExec, dbGet, dbRun } from './db.js';
+import { findRepoForCommit } from './git.js';
+import { normalizeCommitRepoRefPath, normalizePathSlashes } from './git-repo-path.js';
+import { getRepos } from './repos.js';
 import { needsProgressMigration, parseStoredProgressFile, parseTasksFile } from './state-schema.js';
 const MIGRATION_VERSION = 'progress-json-v2';
 const MIGRATION_META_KEY = `state-migration:${MIGRATION_VERSION}`;
+const COMMIT_REPO_MIGRATION_VERSION = 'commit-repo-ref-v1';
+const COMMIT_REPO_MIGRATION_META_KEY = `state-migration:${COMMIT_REPO_MIGRATION_VERSION}`;
 let status = {
     state: 'idle',
     version: MIGRATION_VERSION,
@@ -118,6 +123,50 @@ async function writeMigrationMarker(totalRows, migratedRows) {
         updated_at = excluded.updated_at
     `, [MIGRATION_META_KEY, JSON.stringify(marker), completedAt]);
 }
+async function readCommitRepoMigrationMarker() {
+    const row = await dbGet('SELECT value FROM app_meta WHERE key = ?', [COMMIT_REPO_MIGRATION_META_KEY]);
+    if (!row?.value) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(row.value);
+        if (!parsed || typeof parsed !== 'object') {
+            return null;
+        }
+        if (parsed.version !== COMMIT_REPO_MIGRATION_VERSION) {
+            return null;
+        }
+        if (typeof parsed.completedAt !== 'string') {
+            return null;
+        }
+        if (typeof parsed.totalRows !== 'number'
+            || typeof parsed.migratedRows !== 'number'
+            || typeof parsed.unresolvedRefs !== 'number') {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+async function writeCommitRepoMigrationMarker(totalRows, migratedRows, unresolvedRefs) {
+    const completedAt = nowIso();
+    const marker = {
+        version: COMMIT_REPO_MIGRATION_VERSION,
+        completedAt,
+        totalRows,
+        migratedRows,
+        unresolvedRefs
+    };
+    await dbRun(`
+      INSERT INTO app_meta (key, value, updated_at)
+      VALUES (?, ?, ?)
+      ON CONFLICT(key) DO UPDATE SET
+        value = excluded.value,
+        updated_at = excluded.updated_at
+    `, [COMMIT_REPO_MIGRATION_META_KEY, JSON.stringify(marker), completedAt]);
+}
 async function migrateProgressRows() {
     await ensureMetaTable();
     const marker = await readMigrationMarker();
@@ -185,9 +234,166 @@ async function migrateProgressRows() {
     await writeMigrationMarker(status.totalRows, status.migratedRows);
     markCompleted();
 }
+function getKnownGitRepoPaths(repo) {
+    const known = new Set();
+    for (const gitRepo of repo.gitRepos || []) {
+        known.add(normalizePathSlashes(gitRepo.relativePath));
+    }
+    return known;
+}
+async function normalizeTaskLogCommitRepos(repo, taskLogs) {
+    const knownRepoPaths = getKnownGitRepoPaths(repo);
+    let changed = false;
+    let unresolvedRefs = 0;
+    const normalizedLogs = [];
+    for (const taskLog of taskLogs) {
+        if (!Array.isArray(taskLog.commits) || taskLog.commits.length === 0) {
+            normalizedLogs.push(taskLog);
+            continue;
+        }
+        let taskLogChanged = false;
+        const normalizedCommits = [];
+        for (const commitEntry of taskLog.commits) {
+            if (typeof commitEntry === 'string') {
+                normalizedCommits.push(commitEntry);
+                continue;
+            }
+            const normalizedRepoPath = normalizeCommitRepoRefPath(repo, commitEntry.repo);
+            if (normalizedRepoPath !== null) {
+                let canonicalRepoPath = normalizedRepoPath;
+                if (canonicalRepoPath !== '' && !knownRepoPaths.has(canonicalRepoPath)) {
+                    try {
+                        const resolved = await findRepoForCommit(repo, commitEntry.sha);
+                        canonicalRepoPath = resolved.repoPath;
+                    }
+                    catch {
+                        // Keep normalized repo path for unknown/untracked nested repos.
+                    }
+                }
+                if (canonicalRepoPath !== commitEntry.repo) {
+                    changed = true;
+                    taskLogChanged = true;
+                    normalizedCommits.push({
+                        sha: commitEntry.sha,
+                        repo: canonicalRepoPath
+                    });
+                }
+                else {
+                    normalizedCommits.push(commitEntry);
+                }
+                continue;
+            }
+            try {
+                const resolved = await findRepoForCommit(repo, commitEntry.sha);
+                changed = true;
+                taskLogChanged = true;
+                normalizedCommits.push({
+                    sha: commitEntry.sha,
+                    repo: resolved.repoPath
+                });
+            }
+            catch {
+                unresolvedRefs += 1;
+                normalizedCommits.push(commitEntry);
+            }
+        }
+        if (taskLogChanged) {
+            normalizedLogs.push({
+                ...taskLog,
+                commits: normalizedCommits
+            });
+        }
+        else {
+            normalizedLogs.push(taskLog);
+        }
+    }
+    return {
+        taskLogs: normalizedLogs,
+        changed,
+        unresolvedRefs
+    };
+}
+async function migrateCommitRepoRefs() {
+    await ensureMetaTable();
+    const marker = await readCommitRepoMigrationMarker();
+    if (marker) {
+        return;
+    }
+    const [rows, repos] = await Promise.all([
+        dbAll(`
+        SELECT repo_id, slug, tasks_json, progress_json
+        FROM prd_states
+        WHERE progress_json IS NOT NULL
+        ORDER BY repo_id ASC, slug ASC
+      `),
+        getRepos()
+    ]);
+    const repoById = new Map(repos.map((repo) => [repo.id, repo]));
+    let migratedRows = 0;
+    let unresolvedRefs = 0;
+    for (const row of rows) {
+        const repo = repoById.get(row.repo_id);
+        if (!repo || !row.progress_json) {
+            continue;
+        }
+        try {
+            const parsedProgress = JSON.parse(row.progress_json);
+            let tasksCountHint;
+            let prdNameFallback;
+            if (row.tasks_json) {
+                try {
+                    const tasks = parseTasksFile(JSON.parse(row.tasks_json));
+                    tasksCountHint = tasks.tasks.length;
+                    prdNameFallback = tasks.prd.name;
+                }
+                catch {
+                    // Keep fallback below when tasks_json is malformed.
+                }
+            }
+            const progress = parseStoredProgressFile(parsedProgress, {
+                prdNameFallback: prdNameFallback || row.slug,
+                totalTasksHint: tasksCountHint
+            });
+            const normalized = await normalizeTaskLogCommitRepos(repo, progress.taskLogs);
+            unresolvedRefs += normalized.unresolvedRefs;
+            if (!normalized.changed) {
+                continue;
+            }
+            const updatedAt = nowIso();
+            await dbRun(`
+          UPDATE prd_states
+          SET progress_json = ?, updated_at = ?
+          WHERE repo_id = ? AND slug = ?
+        `, [
+                JSON.stringify({
+                    ...progress,
+                    taskLogs: normalized.taskLogs
+                }),
+                updatedAt,
+                row.repo_id,
+                row.slug
+            ]);
+            migratedRows += 1;
+            emitChange({
+                type: 'change',
+                path: `state://${row.repo_id}/${row.slug}/progress.json`,
+                repoId: row.repo_id,
+                category: 'progress'
+            });
+        }
+        catch {
+            // Ignore malformed rows; they remain untouched.
+        }
+    }
+    await writeCommitRepoMigrationMarker(rows.length, migratedRows, unresolvedRefs);
+}
 async function runMigration() {
     try {
         await migrateProgressRows();
+        if (status.state === 'failed') {
+            return;
+        }
+        await migrateCommitRepoRefs();
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thxgg/steward",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "Local-first PRD workflow steward with codemode MCP and web UI.",
   "type": "module",
   "author": "thxgg",