@weibaohui/dsh-git-server 0.1.0 → 0.1.2

package/README.md

@@ -3,33 +3,35 @@
 [![DSH plugin](https://img.shields.io/badge/dsh-plugin-green)](https://github.com/topics/dsh-plugin)
 [![npm version](https://img.shields.io/npm/v/@weibaohui/dsh-git-server)](https://www.npmjs.com/package/@weibaohui/dsh-git-server)
 
-**Git 服务器插件**：内嵌 [ts-gogs](https://github.com/weibaohui/ts-gogs)（Gogs 的 TypeScript 平替），把一套**完整的自助 Git 服务**装进 dsh——HTTP clone/push、工单、PR、wiki、发版、标签、里程碑、webhook，全功能。网页侧全程是 dsh 原生界面（React + dsh 主题 token，零 iframe），账号可复用 user-management。
+**Git 服务器插件**：把一套完整的自助 Git 服务装进 dsh——HTTP clone/push、工单、PR、wiki、发版、标签、里程碑、webhook 全功能，网页侧全程是 dsh 原生界面，账号可复用 user-management。
 
 <video src="docs/demo-tour.webm" controls muted playsinline width="100%"></video>
 
 ## 核心功能
 
-- **完整自助 Git 服务**：ts-gogs 作为受管子进程在独立端口跑起来，提供 HTTP smart 协议 clone/push、内核 API、webhook；仓库/工单/PR/wiki/发版/标签/里程碑一条龙
-- **dsh 原生管理页**：侧栏底部「Git」入口进全屏页——仓库列表（建仓/删除/克隆地址）、仓库浏览多标签页（**文件**树+内容、**提交**历史、**分支**、**工单**、**PR**、**Wiki**、**发版**、**标签**、**里程碑**、**设置**）；React + dsh 主题 token（亮暗自动跟随）、zh/en 双语、经宿主同源 API 通信，零 iframe 零桥接
-- **账号打通**：装了 [user-management](https://github.com/weibaohui/user-management) 即复用其用户名密码——git 凭据与原生页登录免另记一套账号，打开管理页即已登录态，dsh 管理员即 Git 管理员；未装 user-management 则用内置账户（管理员 `root`，密码在设置页可见可轮换）；网页注册关闭，账号只由 dsh 管理
-- **一键启停 + 自愈**：启用/停用/端口/数据目录全在设置页；ts-gogs 崩溃 3 秒自动拉起，配置指纹变化 3 秒热生效（毫秒级停顿重启子进程）
-- **身份链安全**：原生页所有操作按当前 dsh 登录用户身份执行——宿主解析会话 → 以本人身份铸个人令牌 → 进程内代理内核 API，每一步都是本人权限，无全局管理员透传
-- **局域网 git**：默认监听 `0.0.0.0`，局域网内机器可直接 `git clone/push`（git remote 走该端口，HTTP Basic 认证）
-- **数据自持**：数据目录 = 仓库 + 数据库 + 日志；升级插件后原样沿用，备份整个目录即备份全部
+- **完整自助 Git 服务**：HTTP clone/push 开箱即用，仓库/工单/PR/wiki/发版/标签/里程碑一条龙，崩溃自动拉起
+- **dsh 原生管理页**：侧栏底部「Git」进全屏页——建仓/删仓/克隆地址，仓库浏览多标签（文件树+内容、提交历史、分支、工单、PR、Wiki、发版、标签、里程碑、设置）；React + dsh 主题（亮暗自动跟随）、zh/en 双语
+- **账号打通**：账户来源 = [user-management](https://github.com/weibaohui/user-management)（必装）——git 凭据与页面登录均走 user-management 校验，免另记一套账号；网页注册关闭，账号只由 dsh 管理
+- **一键启停**：启用/停用/端口/数据目录全在设置页，改完即生效
+- **局域网 git**：默认监听 `0.0.0.0`，局域网内机器可直接 `git clone/push`
+- **数据自持**：数据目录 = 仓库 + 数据库 + 日志，备份整个目录即备份全部
 
 ## 安装
 
+本插件依赖 [user-management](https://github.com/weibaohui/user-management) 提供登录与账户，必须先装：
+
 ```bash
+dsh plugin --profile web add @weibaohui/user-management -w
 dsh plugin --profile web add @weibaohui/dsh-git-server -w
 ```
 
-装完重启 `dsh web` 即生效。首次启动自检运行时依赖（better-sqlite3 等），缺失时自动安装，无需手动 `npm install`。
+装完重启 `dsh web` 即生效。
 
 ## 使用
 
-1. 打开 Web UI → **设置 → Git 服务器**——**默认已启用**（监听 `0.0.0.0:3400`，无需勾选；要停用在设置页取消勾选），可在此改端口/数据目录/查看兜底 `root` 密码
+1. 打开 Web UI → **设置 → Git 服务器**——**默认已启用**（监听 `0.0.0.0:3400`，无需勾选；要停用在设置页取消勾选），可在此改端口/数据目录/查看 `root` 密码
 2. 侧栏底部点「**Git**」进全屏管理页：新建仓库（或导入已有），照常开发
-3. `git clone/push` 走子进程端口，凭据用 dsh / user-management 的用户名密码（未装 user-management 则用内置管理员 `root` + 设置页展示的密码）：
+3. `git clone/push` 走子进程端口，凭据用 user-management 的用户名密码：
 
    ```sh
    git clone http://127.0.0.1:3400/root/drill-repo.git

package/client/bundle.js

@@ -57,6 +57,9 @@ window.__ModuleLoader__.load({
       noReleases: '暂无发版', noWiki: '暂无页面——创建第一个', deletePage: '删除页面',
       prMerged: '已合并', prOpen: '开启中', prClosed: '已关闭',
       labels: '标签管理', milestones: '里程碑', settings: '设置',
+      stRunning: '运行中', stStopped: '已停用', stError: '错误', stRetrying: '重试中',
+      stUnreachable: '无法连接', stFetchErr: '状态接口无响应，宿主进程可能已崩溃',
+      stPid: 'PID', stCrashes: '崩溃', stDepsFailed: '依赖缺失',
     }
     const EN = {
       nav: 'Git', title: 'Repositories',
@@ -78,6 +81,9 @@ window.__ModuleLoader__.load({
       noReleases: 'No releases', noWiki: 'No pages yet — create one', deletePage: 'Delete page',
       prMerged: 'Merged', prOpen: 'Open', prClosed: 'Closed',
       labels: 'Labels', milestones: 'Milestones', settings: 'Settings',
+      stRunning: 'Running', stStopped: 'Stopped', stError: 'Error', stRetrying: 'Retrying',
+      stUnreachable: 'Unreachable', stFetchErr: 'Status endpoint not responding — host process may have crashed',
+      stPid: 'PID', stCrashes: 'crashes', stDepsFailed: 'deps missing',
     }
 
     // ── styles（dsw token 原生） ───────────────────────────────────────────────
@@ -166,6 +172,21 @@ window.__ModuleLoader__.load({
     .dgs-comment{background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:10px;padding:10px 12px;margin:8px 0}
     .dgs-empty{color:var(--dsw-alias-label-tertiary);text-align:center;padding:40px 0;font-size:13px}
     .dgs-err{color:var(--dsw-alias-state-error-primary);font-size:13px}
+    .dgs-status-row{display:flex;align-items:center;gap:8px;margin-bottom:2px}
+    .dgs-status-dot{width:8px;height:8px;border-radius:50%;flex:none}
+    .dgs-status-dot.running{background:var(--dsw-alias-state-success-primary)}
+    .dgs-status-dot.stopped{background:var(--dsw-alias-label-tertiary)}
+    .dgs-status-dot.error{background:var(--dsw-alias-state-error-primary)}
+    .dgs-status-dot.waiting{background:#f59e0b}
+    .dgs-status-dot.unreachable{background:var(--dsw-alias-state-error-primary);animation:dgs-pulse 1.5s ease-in-out infinite}
+    @keyframes dgs-pulse{0%,100%{opacity:1}50%{opacity:.3}}
+    .dgs-status-text{font-size:13px;font-weight:600}
+    .dgs-status-text.running{color:var(--dsw-alias-state-success-primary)}
+    .dgs-status-text.stopped{color:var(--dsw-alias-label-tertiary)}
+    .dgs-status-text.error{color:var(--dsw-alias-state-error-primary)}
+    .dgs-status-text.waiting{color:#f59e0b}
+    .dgs-status-text.unreachable{color:var(--dsw-alias-state-error-primary)}
+    .dgs-status-meta{font-size:12px;color:var(--dsw-alias-label-tertiary);margin-left:4px}
     .dgs-ico{margin-right:8px;opacity:.75}
     .dgs-toast{position:fixed;left:50%;bottom:28px;transform:translateX(-50%);background:var(--dsw-alias-toast-bg);color:#fff;border-radius:8px;padding:8px 16px;font-size:12px;z-index:2147483600}
     .dgs-settings{max-width:720px;display:flex;flex-direction:column;gap:12px;padding:12px 16px 24px;color:var(--dsw-alias-label-primary)}
@@ -2116,27 +2137,57 @@ window.__ModuleLoader__.load({
 
     function SettingsSection({ t }) {
       const [status, setStatus] = useState(null)
+      const [unreachable, setUnreachable] = useState(false)
       const [form, setForm] = useState({ enabled: false, host: '127.0.0.1', port: 3400, dataDir: '' })
       const [busy, setBusy] = useState(false)
       const [msg, setMsg] = useState('')
       useEffect(() => {
         fetch(API + '/status').then((r) => r.json()).then((d) => {
-          setStatus(d)
+          setStatus(d); setUnreachable(false)
           setForm({ enabled: !!d.enabled, host: d.host || '127.0.0.1', port: d.port || 3400, dataDir: d.dataDir || '' })
-        }).catch(() => {})
+        }).catch(() => setUnreachable(true))
+      }, [])
+      // 定时轮询：保持状态新鲜但不覆盖用户正在编辑的表单
+      useEffect(() => {
+        const id = setInterval(() => {
+          fetch(API + '/status').then((r) => r.json()).then((d) => { setStatus(d); setUnreachable(false) }).catch(() => setUnreachable(true))
+        }, 5000)
+        return () => clearInterval(id)
       }, [])
       const save = async () => {
         setBusy(true); setMsg('…')
         try {
           const res = await fetch(API + '/settings', { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(form) })
           const d = await res.json()
-          setStatus(d); setMsg('')
+          setStatus(d); setUnreachable(false); setMsg('')
         } catch (e) { setMsg(String(e)) } finally { setBusy(false) }
       }
       const field = (k) => ({ value: form[k], onChange: (e) => setForm({ ...form, [k]: e.target.value }) })
+      // 推导徽章状态：fetch 失败优先（宿主进程可能崩溃）
+      let stKey = 'stopped', stLabel = t('stStopped')
+      if (unreachable) {
+        stKey = 'unreachable'; stLabel = t('stUnreachable')
+      } else if (status) {
+        if (status.error) { stKey = 'error'; stLabel = t('stError') }
+        else if (status.running) { stKey = 'running'; stLabel = t('stRunning') }
+        else if (status.enabled) { stKey = 'waiting'; stLabel = t('stRetrying') }
+      }
+      const meta = []
+      if (!unreachable && status) {
+        if (status.running && status.pid) meta.push(t('stPid') + ' ' + status.pid)
+        if (status.crashes > 0) meta.push(status.crashes + ' ' + t('stCrashes'))
+        if (status.deps === 'failed') meta.push(t('stDepsFailed'))
+      }
       return h('div', { className: 'dgs-settings' },
         h('div', { className: 'dgs-card' },
-          h('div', { className: 'dgs-h1' }, t('title')),
+          h('div', { className: 'dgs-row', style: { justifyContent: 'space-between', alignItems: 'center' } },
+            h('div', { className: 'dgs-h1' }, t('title')),
+            (status || unreachable) ? h('div', { className: 'dgs-status-row' },
+              h('span', { className: 'dgs-status-dot ' + stKey }),
+              h('span', { className: 'dgs-status-text ' + stKey }, stLabel),
+              meta.length ? h('span', { className: 'dgs-status-meta' }, meta.join(' · ')) : null) : null),
+          unreachable ? h('div', { className: 'dgs-err', style: { marginBottom: 8 } }, t('stFetchErr')) : null,
+          status && status.error ? h('div', { className: 'dgs-err', style: { marginBottom: 8 } }, status.error) : null,
           h('div', { className: 'dgs-row' },
             h('label', null, '启用'),
             h('input', { type: 'checkbox', checked: form.enabled, onChange: (e) => setForm({ ...form, enabled: e.target.checked }) })),

package/client/index.js

@@ -47,6 +47,9 @@ const ZH = {
   noReleases: '暂无发版', noWiki: '暂无页面——创建第一个', deletePage: '删除页面',
   prMerged: '已合并', prOpen: '开启中', prClosed: '已关闭',
   labels: '标签管理', milestones: '里程碑', settings: '设置',
+  stRunning: '运行中', stStopped: '已停用', stError: '错误', stRetrying: '重试中',
+  stUnreachable: '无法连接', stFetchErr: '状态接口无响应，宿主进程可能已崩溃',
+  stPid: 'PID', stCrashes: '崩溃', stDepsFailed: '依赖缺失',
 }
 const EN = {
   nav: 'Git', title: 'Repositories',
@@ -68,6 +71,9 @@ const EN = {
   noReleases: 'No releases', noWiki: 'No pages yet — create one', deletePage: 'Delete page',
   prMerged: 'Merged', prOpen: 'Open', prClosed: 'Closed',
   labels: 'Labels', milestones: 'Milestones', settings: 'Settings',
+  stRunning: 'Running', stStopped: 'Stopped', stError: 'Error', stRetrying: 'Retrying',
+  stUnreachable: 'Unreachable', stFetchErr: 'Status endpoint not responding — host process may have crashed',
+  stPid: 'PID', stCrashes: 'crashes', stDepsFailed: 'deps missing',
 }
 
 // ── styles（dsw token 原生） ───────────────────────────────────────────────
@@ -156,6 +162,21 @@ textarea.dgs-input,.dgs-card>.dgs-input{width:100%;box-sizing:border-box;flex:no
 .dgs-comment{background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:10px;padding:10px 12px;margin:8px 0}
 .dgs-empty{color:var(--dsw-alias-label-tertiary);text-align:center;padding:40px 0;font-size:13px}
 .dgs-err{color:var(--dsw-alias-state-error-primary);font-size:13px}
+.dgs-status-row{display:flex;align-items:center;gap:8px;margin-bottom:2px}
+.dgs-status-dot{width:8px;height:8px;border-radius:50%;flex:none}
+.dgs-status-dot.running{background:var(--dsw-alias-state-success-primary)}
+.dgs-status-dot.stopped{background:var(--dsw-alias-label-tertiary)}
+.dgs-status-dot.error{background:var(--dsw-alias-state-error-primary)}
+.dgs-status-dot.waiting{background:#f59e0b}
+.dgs-status-dot.unreachable{background:var(--dsw-alias-state-error-primary);animation:dgs-pulse 1.5s ease-in-out infinite}
+@keyframes dgs-pulse{0%,100%{opacity:1}50%{opacity:.3}}
+.dgs-status-text{font-size:13px;font-weight:600}
+.dgs-status-text.running{color:var(--dsw-alias-state-success-primary)}
+.dgs-status-text.stopped{color:var(--dsw-alias-label-tertiary)}
+.dgs-status-text.error{color:var(--dsw-alias-state-error-primary)}
+.dgs-status-text.waiting{color:#f59e0b}
+.dgs-status-text.unreachable{color:var(--dsw-alias-state-error-primary)}
+.dgs-status-meta{font-size:12px;color:var(--dsw-alias-label-tertiary);margin-left:4px}
 .dgs-ico{margin-right:8px;opacity:.75}
 .dgs-toast{position:fixed;left:50%;bottom:28px;transform:translateX(-50%);background:var(--dsw-alias-toast-bg);color:#fff;border-radius:8px;padding:8px 16px;font-size:12px;z-index:2147483600}
 .dgs-settings{max-width:720px;display:flex;flex-direction:column;gap:12px;padding:12px 16px 24px;color:var(--dsw-alias-label-primary)}
@@ -2106,27 +2127,57 @@ function GitPage({ onClose, t }) {
 
 function SettingsSection({ t }) {
   const [status, setStatus] = useState(null)
+  const [unreachable, setUnreachable] = useState(false)
   const [form, setForm] = useState({ enabled: false, host: '127.0.0.1', port: 3400, dataDir: '' })
   const [busy, setBusy] = useState(false)
   const [msg, setMsg] = useState('')
   useEffect(() => {
     fetch(API + '/status').then((r) => r.json()).then((d) => {
-      setStatus(d)
+      setStatus(d); setUnreachable(false)
       setForm({ enabled: !!d.enabled, host: d.host || '127.0.0.1', port: d.port || 3400, dataDir: d.dataDir || '' })
-    }).catch(() => {})
+    }).catch(() => setUnreachable(true))
+  }, [])
+  // 定时轮询：保持状态新鲜但不覆盖用户正在编辑的表单
+  useEffect(() => {
+    const id = setInterval(() => {
+      fetch(API + '/status').then((r) => r.json()).then((d) => { setStatus(d); setUnreachable(false) }).catch(() => setUnreachable(true))
+    }, 5000)
+    return () => clearInterval(id)
   }, [])
   const save = async () => {
     setBusy(true); setMsg('…')
     try {
       const res = await fetch(API + '/settings', { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(form) })
       const d = await res.json()
-      setStatus(d); setMsg('')
+      setStatus(d); setUnreachable(false); setMsg('')
     } catch (e) { setMsg(String(e)) } finally { setBusy(false) }
   }
   const field = (k) => ({ value: form[k], onChange: (e) => setForm({ ...form, [k]: e.target.value }) })
+  // 推导徽章状态：fetch 失败优先（宿主进程可能崩溃）
+  let stKey = 'stopped', stLabel = t('stStopped')
+  if (unreachable) {
+    stKey = 'unreachable'; stLabel = t('stUnreachable')
+  } else if (status) {
+    if (status.error) { stKey = 'error'; stLabel = t('stError') }
+    else if (status.running) { stKey = 'running'; stLabel = t('stRunning') }
+    else if (status.enabled) { stKey = 'waiting'; stLabel = t('stRetrying') }
+  }
+  const meta = []
+  if (!unreachable && status) {
+    if (status.running && status.pid) meta.push(t('stPid') + ' ' + status.pid)
+    if (status.crashes > 0) meta.push(status.crashes + ' ' + t('stCrashes'))
+    if (status.deps === 'failed') meta.push(t('stDepsFailed'))
+  }
   return h('div', { className: 'dgs-settings' },
     h('div', { className: 'dgs-card' },
-      h('div', { className: 'dgs-h1' }, t('title')),
+      h('div', { className: 'dgs-row', style: { justifyContent: 'space-between', alignItems: 'center' } },
+        h('div', { className: 'dgs-h1' }, t('title')),
+        (status || unreachable) ? h('div', { className: 'dgs-status-row' },
+          h('span', { className: 'dgs-status-dot ' + stKey }),
+          h('span', { className: 'dgs-status-text ' + stKey }, stLabel),
+          meta.length ? h('span', { className: 'dgs-status-meta' }, meta.join(' · ')) : null) : null),
+      unreachable ? h('div', { className: 'dgs-err', style: { marginBottom: 8 } }, t('stFetchErr')) : null,
+      status && status.error ? h('div', { className: 'dgs-err', style: { marginBottom: 8 } }, status.error) : null,
       h('div', { className: 'dgs-row' },
         h('label', null, '启用'),
         h('input', { type: 'checkbox', checked: form.enabled, onChange: (e) => setForm({ ...form, enabled: e.target.checked }) })),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@weibaohui/dsh-git-server",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "dsh 插件 · Git 服务器：内嵌 ts-gogs（Gogs 的 TypeScript 平替），独立端口跑完整 Git 服务（HTTP clone/push、网页端、issue/PR/wiki），可复用 user-management 的用户名密码，设置页一键启停。",
   "repository": {
     "type": "git",
@@ -24,6 +24,10 @@
     "cordis.patch.yml",
     "README.md"
   ],
+  "engines": {
+    "node": ">=22.5",
+    "dsh": ">=0.1.2-rc.1"
+  },
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
@@ -57,9 +61,6 @@
     "ini": "^5.0.0",
     "marked": "^15.0.0"
   },
-  "engines": {
-    "node": ">=22.5"
-  },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.12",
     "@types/busboy": "^1.5.4",

package/src/index.js

@@ -25,7 +25,7 @@ const path = require('node:path')
 const engine = require('./runner')
 
 const name = engine.PLUGIN_ID
-const inject = ['webServer', 'settings']
+const inject = ['webServer', 'settings', 'connection']
 const API_PREFIX = '/' + engine.PLUGIN_ID + '/api'
 const SETTINGS_NS = engine.PLUGIN_ID
 
@@ -452,6 +452,14 @@ module.exports = {
           kind: 'prefix',
           path: API_PREFIX,
           handler: async (req, res) => {
+            // 与其它 host 路由一致的信任栅栏：connection 服务的 Host/Origin 检查
+            // 加浏览器认证，防止本机任意网页跨站调用。
+            const rejection = ctx.connection.requestRejection(req)
+            if (rejection !== undefined) {
+              res.writeHead(rejection)
+              res.end()
+              return
+            }
             const url = new URL(req.url || '/', 'http://dsh.local')
             const rest = url.pathname.slice(API_PREFIX.length)
             try {

package/server/dist/serv.js

@@ -1,43 +0,0 @@
-// serv subcommand: entrypoint for authorized_keys mode. The system sshd runs
-// `<ts-gogs> serv key-<id>` via a command= restriction on each public key line;
-// the actual git command arrives in SSH_ORIGINAL_COMMAND (gogs cmd/gogs/serv.go).
-import * as db from './db/db.js';
-export async function runServ(keyArg) {
-    const keyID = Number(String(keyArg).replace(/^key-/, ''));
-    const key = db.getPublicKeyByID(keyID);
-    if (!key) {
-        console.error('Serv: cannot find public key:', keyArg);
-        process.exit(1);
-    }
-    const userID = key.owner_id;
-    const identity = {
-        userID,
-        keyID,
-        deployRepoID: null,
-    };
-    if (key.type === 2) {
-        const dk = db.db().prepare('SELECT repo_id FROM deploy_key WHERE key_id = ?').get(keyID);
-        identity.deployRepoID = dk?.repo_id ?? null;
-    }
-    const sshCmd = process.env.SSH_ORIGINAL_COMMAND ?? '';
-    if (!sshCmd) {
-        console.error('Serv: interactive shell is disabled.');
-        process.exit(1);
-    }
-    const { dispatchSSHCommand } = await import('./sshx/dispatch.js');
-    // keep the event loop alive until close() — async handlers (LFS transfer)
-    // must never be cut off by a premature exit
-    const keepAlive = setInterval(() => { }, 1 << 30);
-    dispatchSSHCommand(sshCmd, identity, {
-        write: (chunk) => process.stdout.write(chunk),
-        onStdin: (cb) => {
-            process.stdin.on('data', (d) => cb(d));
-            process.stdin.resume();
-        },
-        close: (code) => {
-            clearInterval(keepAlive);
-            process.exit(code);
-        },
-    });
-}
-//# sourceMappingURL=serv.js.map

package/server/dist/sshx/dispatch.js

@@ -1,160 +0,0 @@
-// Shared SSH command dispatch used by both the builtin SSH server and the
-// `serv` subcommand (authorized_keys mode). Verbs mirror gogs cmd/gogs/serv.go
-// plus the LFS-over-SSH extensions (git-lfs-authenticate, git-lfs-transfer).
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import { spawn } from 'node:child_process';
-import { conf } from '../conf.js';
-import * as db from '../db/db.js';
-import { runLFSTransfer } from './lfs-transfer.js';
-export function parseSSHCmd(cmd) {
-    const m = /^\s*(git[-\s][a-z-]+|git-lfs-authenticate|git-lfs-transfer)\s+'(.*)'\s*$/.exec(cmd) ??
-        /^\s*(git[-\s][a-z-]+|git-lfs-authenticate|git-lfs-transfer)\s+"(.*)"\s*$/.exec(cmd) ??
-        /^\s*(git[-\s][a-z-]+|git-lfs-authenticate|git-lfs-transfer)\s+(.*)\s*$/.exec(cmd);
-    if (!m)
-        return [];
-    return [m[1], m[2].replace(/^~\//, '')];
-}
-function resolveRepo(repoFullName) {
-    let repoName = repoFullName.replace(/^\//, '').replace(/\.git$/, '');
-    let isWiki = false;
-    if (repoName.endsWith('.wiki')) {
-        isWiki = true;
-        repoName = repoName.slice(0, -5);
-    }
-    const slash = repoName.indexOf('/');
-    const ownerName = slash > 0 ? repoName.slice(0, slash) : repoName;
-    const name = slash > 0 ? repoName.slice(slash + 1) : repoName;
-    const owner = db.getUserByUsername(ownerName);
-    const repo = owner ? db.getRepoByOwnerAndName(owner, name) : null;
-    if (!owner || !repo)
-        return null;
-    const repoDir = isWiki ? repo.WikiPath() : repo.RepoPath();
-    if (!fs.existsSync(repoDir))
-        return null;
-    return { owner, repo, repoDir };
-}
-/** git-upload-pack / git-receive-pack with gogs permission semantics. */
-export function serveGit(verb, repoFullName, identity, io) {
-    let repoName = repoFullName.replace(/^\//, '').replace(/\.git$/, '');
-    let isWiki = false;
-    if (repoName.endsWith('.wiki')) {
-        isWiki = true;
-        repoName = repoName.slice(0, -5);
-    }
-    const slash = repoName.indexOf('/');
-    const ownerName = slash > 0 ? repoName.slice(0, slash) : repoName;
-    const name = slash > 0 ? repoName.slice(slash + 1) : repoName;
-    const owner = db.getUserByUsername(ownerName);
-    const repo = owner ? db.getRepoByOwnerAndName(owner, name) : null;
-    const fail = (msg) => {
-        io.write(Buffer.from(`\r\n${msg}\r\n`));
-        io.close(1);
-    };
-    if (!owner || !repo)
-        return fail('Repository does not exist');
-    const repoDir = isWiki ? repo.WikiPath() : repo.RepoPath();
-    if (!fs.existsSync(repoDir))
-        return fail('Repository does not exist');
-    const isPull = verb === 'git-upload-pack';
-    // deploy keys: single-repo, read-only
-    if (identity.deployRepoID !== null && (!isPull || identity.deployRepoID !== repo.id)) {
-        return fail('Access denied');
-    }
-    const mode = db.accessMode(identity.userID, repo);
-    const need = isPull ? db.AccessMode.READ : db.AccessMode.WRITE;
-    if (!(isPull && !repo.is_private && !conf.requireSigninView) && mode < need) {
-        return fail('Access denied');
-    }
-    if (!isPull && repo.is_mirror)
-        return fail('Mirror repository is read-only');
-    const args = isPull ? ['upload-pack', repoDir] : ['receive-pack', repoDir];
-    const env = {};
-    if (!isPull) {
-        const user = db.getUserByID(identity.userID);
-        Object.assign(env, {
-            GOGS_AUTH_USER_ID: String(user?.id ?? 0),
-            GOGS_AUTH_USER_NAME: String(user?.name ?? ''),
-            GOGS_AUTH_USER_EMAIL: String(user?.email ?? ''),
-            GOGS_REPO_OWNER_NAME: owner.name,
-            GOGS_REPO_ID: String(repo.id),
-            GOGS_REPO_NAME: String(repo.name),
-            GOGS_REPO_CUSTOM_HOOKS_PATH: path.join(repoDir, 'custom_hooks'),
-        });
-    }
-    const child = spawn('git', args, { env: { ...process.env, ...env } });
-    child.stdout.on('data', (d) => io.write(d));
-    child.stderr.on('data', (d) => io.write(Buffer.from(`remote: ${d.toString()}`)));
-    io.onStdin((data) => child.stdin.write(data));
-    child.on('close', (code) => io.close(code ?? 0));
-    child.on('error', () => io.close(1));
-}
-/** git-lfs-authenticate <path> <download|upload> → JSON auth response on stdout. */
-export async function serveLFSAuthenticate(argStr, identity, io) {
-    const parts = argStr.trim().split(/\s+/);
-    const repoFullName = parts[0];
-    const operation = parts[1] ?? 'download';
-    if (!['download', 'upload'].includes(operation)) {
-        io.write(Buffer.from(`lfs-authenticate: invalid operation: ${operation}\n`));
-        io.close(1);
-        return;
-    }
-    const resolved = resolveRepo(repoFullName);
-    if (!resolved) {
-        io.write(Buffer.from('Repository does not exist\n'));
-        io.close(1);
-        return;
-    }
-    const { owner, repo } = resolved;
-    const mode = db.accessMode(identity.userID, repo);
-    const need = operation === 'upload' ? db.AccessMode.WRITE : db.AccessMode.READ;
-    if (!(operation === 'download' && !repo.is_private && !conf.requireSigninView) && mode < need) {
-        io.write(Buffer.from('Access denied\n'));
-        io.close(1);
-        return;
-    }
-    const { mintLFSToken } = await import('../lfsx.js');
-    const { token, expiresAt } = mintLFSToken(identity.userID, repo.id);
-    const href = `${conf.externalURL}${owner.name}/${repo.name}.git/info/lfs/objects/batch`;
-    io.write(Buffer.from(JSON.stringify({
-        href,
-        header: { Authorization: `RemoteAuth ${token}` },
-        'expires_in': 86400,
-        'expires_at': new Date(expiresAt * 1000).toISOString(),
-    }) + '\n'));
-    io.close(0);
-}
-/** git-lfs-transfer <path> <download|upload> — pure SSH LFS transfer protocol (lfs-transfer-1). */
-export async function serveLFSTransfer(argStr, identity, io) {
-    await runLFSTransfer(argStr, identity, io);
-}
-/** Top-level dispatch: parse and run one SSH command. */
-export function dispatchSSHCommand(command, identity, io) {
-    const [verb, args] = parseSSHCmd(command);
-    if (!verb) {
-        io.close(1);
-        return;
-    }
-    switch (verb) {
-        case 'git-upload-pack':
-        case 'git-receive-pack':
-            serveGit(verb, args, identity, io);
-            return;
-        case 'git-lfs-authenticate':
-            serveLFSAuthenticate(args, identity, io).catch((e) => {
-                console.error('[lfs-auth] error:', e);
-                io.close(1);
-            });
-            return;
-        case 'git-lfs-transfer':
-            serveLFSTransfer(args, identity, io).catch((e) => {
-                console.error('[lfs-transfer] error:', e);
-                io.close(1);
-            });
-            return;
-        default:
-            io.write(Buffer.from(`Serv: unknown command: ${verb}\n`));
-            io.close(1);
-    }
-}
-//# sourceMappingURL=dispatch.js.map