@xia-sc/dsh-git 0.5.3 → 0.6.1

package/lib/index.js

@@ -49,7 +49,6 @@
  * `/api` transport — loopback or a configured trusted authority, same-origin.
  */
 import { execFile } from "node:child_process";
-import { randomUUID } from "node:crypto";
 import { isAbsolute } from "node:path";
 
 /** Stable Cordis plugin name. */
@@ -95,6 +94,12 @@ const LLM_STAT_MAX_CHARS = 2000;
 const LLM_MAX_TOKENS = 8192;
 /** Accepted `generateMessage` modes. */
 const GENERATE_MODES = ["staged", "unstaged", "all"];
+/**
+ * Longest session id this plugin will forward to the LLM service. Real ids are
+ * short branded strings; the cap only keeps a hostile caller from stuffing
+ * arbitrary text into a request header.
+ */
+const SESSION_ID_MAX_CHARS = 200;
 /** Default mode: the only one whose content is what `commit` will actually record. */
 const GENERATE_MODE_DEFAULT = "staged";
 
@@ -682,8 +687,10 @@ function endpointFromPath(pathname) {
 
 /**
  * Read a request body with a hard byte cap.
- * Uses the classic data/end/error events rather than async iteration: the
- * IncomingMessage async iterator is not a stable path in this runtime.
+ * Deliberately uses the classic data/end/error events rather than async
+ * iteration: the host's own bridge does `for await (const chunk of req)`, and
+ * keeping this reader on the event API means one dependency fewer on an
+ * IncomingMessage behaviour this plugin cannot pin.
  * @param req - node:http request.
  * @param maxBytes - cap; exceeding it resolves to undefined.
  * @returns the utf8 body, or undefined on overrun/error/abort.
@@ -1038,17 +1045,21 @@ async function resolveLlmRoute(ctx, rawProvider, rawModel) {
  * Hand-built rather than imported from `@deepseek-ai/dsh-llm`: this package
  * deliberately declares no `@deepseek-ai/*` runtime imports, because a plugin
  * installed with pnpm `link:` resolves them from its own real source path,
- * where no host tree exists. The shape must stay exactly this: a fresh id, the
- * `user` role, one text block, and a plugin source.
+ * where no host tree exists.
+ *
+ * The shape is the host's documented hand-built one-shot input
+ * (`RequestUserInput`): the `user` role plus one text block, and deliberately
+ * **no `id` and no `source`**. dsh >= 0.1.7 retired the catch-all `plugin`
+ * source kind — `MessageSourceMap` has no such member ("each producer declares
+ * its own `kind` in its own module; there is no shared catch-all `plugin`
+ * kind", `dsh-llm/lib/types/message.d.ts`), and Session format v4 refuses
+ * `{kind:"plugin"}` outright (`dsh-session-format-v3-to-v4`). A one-shot
+ * request needs no durable identity: only `provider`/`model`/`messages`/… are
+ * read off {@link GenerateOptions}.
  * @param text - model-facing prompt body.
  */
 function generationMessage(text) {
-	return Object.freeze({
-		id: randomUUID(),
-		role: "user",
-		content: Object.freeze([Object.freeze({ type: "text", text })]),
-		source: Object.freeze({ kind: "plugin", plugin: name })
-	});
+	return { role: "user", content: [{ type: "text", text }] };
 }
 
 /**
@@ -1057,18 +1068,27 @@ function generationMessage(text) {
  * @param prompt - `{ system, body }` from {@link generationPrompt}.
  * @param route - `{ provider, model }` from {@link resolveLlmRoute}.
  * @param signal - cancellation (browser abort plus the server ceiling).
+ * @param sessionId - the caller's session, when it has one. Forwarded as
+ *   `GenerateOptions.sessionId`; adapters that need session affinity (they
+ *   receive it only when it is present — see `dsh-llm-pi-ai`'s options mapping)
+ *   reject an unidentified request outright, so an AI draft from the panel must
+ *   carry one.
  * @returns the trimmed message.
  * @throws on a terminal stream failure, an output cap hit before any text
  *   existed (`llm-truncated`), or genuinely empty output (`llm-empty`).
  */
-async function requestCommitMessage(ctx, prompt, route, signal) {
+async function requestCommitMessage(ctx, prompt, route, signal, sessionId = undefined) {
 	const options = {
 		provider: route.provider,
 		model: route.model,
 		messages: [generationMessage(prompt.body)],
 		system: prompt.system,
 		maxTokens: LLM_MAX_TOKENS,
-		signal
+		signal,
+		// Session-labelled routes (an "opencode go"-style gateway is the local
+		// example) answer 400 when the request carries no session identity, and
+		// the host's pi-ai adapter forwards this field only when it is present.
+		...(sessionId === undefined ? {} : { sessionId })
 	};
 	// Final text comes from the assembled blocks; the delta map is a fallback for
 	// an adapter that emits text without a closing `block-end`.
@@ -1108,13 +1128,20 @@ async function requestCommitMessage(ctx, prompt, route, signal) {
  * @param rawMode - `staged`, `unstaged`, or `all`.
  * @param rawProvider - caller's provider route (optional).
  * @param rawModel - caller's model id (optional).
+ * @param rawSessionId - caller's session id (optional; see
+ *   {@link requestCommitMessage} for why a session-scoped caller must send it).
  * @param signal - transport cancellation.
  */
-async function gitGenerateMessage(ctx, rawCwd, rawMode, rawProvider, rawModel, signal) {
+async function gitGenerateMessage(ctx, rawCwd, rawMode, rawProvider, rawModel, rawSessionId, signal) {
 	if (!validCwd(rawCwd)) return fail("invalid-cwd", "a valid absolute working directory is required");
 	if (rawMode !== undefined && rawMode !== null && !GENERATE_MODES.includes(rawMode)) {
 		return fail("invalid-mode", `mode must be one of ${GENERATE_MODES.join(", ")}`);
 	}
+	if (rawSessionId !== undefined && rawSessionId !== null
+		&& (typeof rawSessionId !== "string" || rawSessionId === "" || rawSessionId.length > SESSION_ID_MAX_CHARS)) {
+		return fail("invalid-session", "sessionId must be a non-empty string when present");
+	}
+	const sessionId = typeof rawSessionId === "string" ? rawSessionId : undefined;
 	const mode = rawMode ?? GENERATE_MODE_DEFAULT;
 	const changes = await readChangesForMode(rawCwd, mode, signal);
 	if (changes.ok !== true) return changes;
@@ -1138,10 +1165,16 @@ async function gitGenerateMessage(ctx, rawCwd, rawMode, rawProvider, rawModel, s
 	const combined = signal === undefined ? timeout : AbortSignal.any([signal, timeout]);
 	if (combined.aborted) return fail("cancelled", "generation was cancelled", { mode });
 	try {
-		const message = await requestCommitMessage(ctx, prompt, route, combined);
+		const message = await requestCommitMessage(ctx, prompt, route, combined, sessionId);
 		return ok({ message, mode, provider: route.provider, model: route.model });
 	} catch (error) {
-		return fail(error.pluginCode ?? "llm-failed", error instanceof Error ? error.message : String(error), { mode });
+		// The route rides along so the panel can name the provider that failed:
+		// a route-level gateway rejection otherwise reads as a plugin bug.
+		return fail(error.pluginCode ?? "llm-failed", error instanceof Error ? error.message : String(error), {
+			mode,
+			provider: route.provider,
+			model: route.model
+		});
 	}
 }
 
@@ -1187,7 +1220,7 @@ async function dispatch(ctx, endpoint, payload, signal) {
 		case "log":
 			return gitLog(args.cwd, args.count, signal);
 		case "generateMessage":
-			return gitGenerateMessage(ctx, args.cwd, args.mode, args.provider, args.model, signal);
+			return gitGenerateMessage(ctx, args.cwd, args.mode, args.provider, args.model, args.sessionId, signal);
 		default:
 			return fail("unknown-endpoint", `unknown git endpoint ${JSON.stringify(endpoint)}`);
 	}
@@ -1203,8 +1236,10 @@ function apply(ctx) {
 	// The channel runs git against caller-supplied absolute paths, so it must
 	// never mount unfenced: the connection service's Host/Origin + browser-cookie
 	// check is the only gate. `requestRejection` is the >= 0.1.5-rc.1 form of that
-	// check; an older host without it fails loudly instead of serving an open
-	// channel.
+	// check. An older host without it still gets no channel (this throws), but
+	// note the throw is *stderr-only* for the operator: dsh-app-boot treats
+	// non-required rows as optional, so this row is skipped with a warning rather
+	// than failing the boot. Never downgrade the guard to a pass-through.
 	const connection = ctx.get("connection");
 	if (connection === undefined || typeof connection.requestRejection !== "function") {
 		throw new Error(`${name}: this plugin requires dsh >= 0.1.5-rc.1 (connection.requestRejection is unavailable, so /dsh-git-rpc could not be fenced)`);
@@ -1213,7 +1248,15 @@ function apply(ctx) {
 		kind: "prefix",
 		path: RPC_CHANNEL,
 		handler: async (req, res) => {
-			const pathname = String(req.url ?? "/").split("?")[0];
+			// The host's own router matches on `new URL(req.url, "http://x").pathname`,
+			// so an absolute-form request target (a proxy in front of dsh web) must
+			// resolve here too. Origin-form targets are kept verbatim: `endpointFromPath`
+			// is the stricter reader (it rejects `.`/`..`/empty segments and anything
+			// outside the client's own segment pattern), and routing the raw target
+			// through the URL parser first would silently normalize a traversal
+			// attempt into a different endpoint instead of refusing it.
+			const rawTarget = String(req.url ?? "/");
+			const pathname = rawTarget.startsWith("/") ? rawTarget : new URL(rawTarget, "http://x").pathname;
 			const endpoint = endpointFromPath(pathname);
 			if (endpoint === undefined) {
 				sendEnvelope(res, 404, rpcError("invalid-request", "not-found", "not found", {}));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xia-sc/dsh-git",
-  "version": "0.5.3",
+  "version": "0.6.1",
   "description": "Complete Git management for the DeepSeek Harness Web GUI: branch switch, new-branch-from-base, fetch, pull, stage-all, commit (with AI-drafted message), push, status, and a click-to-open diff viewer (staged/unstaged, resizable) — as a collapsible floating panel that follows the current session's workspace.",
   "type": "module",
   "main": "lib/index.js",
@@ -39,7 +39,7 @@
     "access": "public"
   },
   "scripts": {
-    "test": "node test/smoke.mjs && node test/host-mount.mjs && node test/generate.mjs && node test/render.mjs",
+    "test": "node test/smoke.mjs && node test/host-mount.mjs && node test/slot-mount.mjs && node test/generate.mjs && node test/render.mjs",
     "test:commit": "node test/commit.mjs",
     "test:diff": "node test/diff.mjs",
     "prepublishOnly": "npm test"
@@ -51,9 +51,12 @@
     "client": {
       "platform": "web",
       "inject": [
+        "@deepseek-ai/dsh-client-connection",
         "@deepseek-ai/dsh-client-locale",
         "@deepseek-ai/dsh-client-ui-conversation",
-        "@deepseek-ai/dsh-client-ui-layout"
+        "@deepseek-ai/dsh-client-ui-layout",
+        "@deepseek-ai/dsh-client-ui-renderer",
+        "@deepseek-ai/dsh-client-ui-session"
       ]
     }
   },