@young1lin/dsh-ui-gitworkbench 0.1.14 → 0.1.16

package/lib/path-lock.js

@@ -0,0 +1,54 @@
+/**
+ * The one place a client-supplied path becomes an absolute path on disk.
+ *
+ * git needs no such lock: whatever pathspec it is handed, it will not read or
+ * write outside the repository, which is why `isSafePathArg` only has to keep
+ * a path from being mistaken for an option. The moment a path leaves git and
+ * reaches `readFile`, `stat` or `readdir`, that backstop is gone — `join(root,
+ * '../../../etc/passwd')` is just a path, and the browser is the least trusted
+ * source of paths this plugin has.
+ *
+ * So every filesystem call in the host resolves through here, and the RPCs
+ * that do it are pinned by `host-rooted-paths.test.ts` so a new one cannot
+ * quietly join a client string onto the root instead.
+ *
+ * What this does NOT defend against, deliberately and for the same reason
+ * `fs-remove.ts` says so: `resolve` is lexical, so a SYMLINK inside the
+ * worktree that points outward still resolves inside and is followed. Closing
+ * that means a `realpath` per segment on every read of every file, for a case
+ * git itself does not defend against and that presupposes write access to the
+ * repository the reader already opened.
+ *
+ * @module @young1lin/dsh-ui-gitworkbench/path-lock
+ */
+import { resolve, sep } from 'node:path';
+import { isSafeRelativePath } from './discard-ops.js';
+/**
+ * Resolve a repo-relative path against the worktree root, refusing to leave it.
+ *
+ * Two locks, not one. {@link isSafeRelativePath} rejects the traversal
+ * SPELLINGS — absolute paths, drive letters, UNC prefixes, NUL bytes, any `..`
+ * segment including one buried mid-path. The `startsWith` below re-checks the
+ * RESOLVED path, which is the form the filesystem acts on, so a path that
+ * survives the first check by being spelled unusually still has to land inside
+ * the root to be acted on.
+ *
+ * @param root - the worktree directory, absolute.
+ * @param relative - repo-relative path from the client or from git's output.
+ * @returns the absolute path to act on.
+ * @throws if the path is not a safe relative path, resolves outside the root,
+ *         or IS the root.
+ */
+export function resolveInside(root, relative) {
+    if (!isSafeRelativePath(relative)) {
+        throw new Error(`unsafe path argument: ${JSON.stringify(relative)}`);
+    }
+    const base = resolve(root);
+    const target = resolve(base, relative);
+    if (target === base)
+        throw new Error('refusing to act on the worktree root itself');
+    if (!target.startsWith(base + sep)) {
+        throw new Error(`path escapes the worktree: ${JSON.stringify(relative)}`);
+    }
+    return target;
+}

package/lib/repo-root.js

@@ -0,0 +1,60 @@
+/**
+ * Where the drawer runs git: at the repository ROOT, not at the directory the
+ * session happened to open.
+ *
+ * Every path the drawer carries — the tree's entries, the diff's pathspecs,
+ * the editor's save target — is REPOSITORY-RELATIVE, because that is what
+ * `git status --porcelain` and `git diff --numstat` print wherever they run.
+ * Pathspecs and `:path` revisions are the opposite: git resolves them against
+ * the process cwd. The two coincide only when the session opened the root
+ * itself. A session opened at a subdirectory (a monorepo's `server/`, say)
+ * gets a drawer that LISTS the right files and then quietly fails to do
+ * anything with them: `git diff HEAD -- server/main.go` run from `server/`
+ * looks for `server/server/main.go`, matches nothing, and exits 0 with empty
+ * output — a changed file that opens to a blank pane, a stage tick that dies
+ * with "pathspec did not match", a blame that cannot find the path in HEAD.
+ *
+ * Resolving the root once and running everything there makes every
+ * repository-relative spelling correct by construction, whatever directory the
+ * session opened. The resolve is a real git spawn per RPC entry — folded into
+ * the parallel batch where a poll pays for it — and deliberately NOT cached:
+ * re-resolving per call is what lets `git init` run inside a subdirectory
+ * mid-session and be picked up by the next poll, and a cache would trade that
+ * for a spawn that already runs concurrently with the reads it precedes.
+ *
+ * Pure and git-injected (the `write-checked` pattern) so vitest can pin both
+ * halves: the resolution itself, and the git behaviors the whole arrangement
+ * rests on.
+ *
+ * @module @young1lin/dsh-ui-gitworkbench/repo-root
+ */
+/**
+ * The repository root of a directory, or null when git knows none.
+ *
+ * `--show-toplevel` is the discovery git itself uses, so what it returns is by
+ * definition where the porcelain paths of commands run in that directory are
+ * rooted — including a linked worktree's own root when the directory sits in
+ * one. Output is normalized to forward slashes so `join()` behaves the same on
+ * every platform (git for Windows already prints them that way).
+ * @param git - how to run git.
+ * @param cwd - any directory inside the repository.
+ */
+export async function resolveRepoRoot(git, cwd) {
+    const out = await git(cwd, ['rev-parse', '--show-toplevel']);
+    if (out.exitCode !== 0)
+        return null;
+    return out.stdout.trim().replace(/\\/g, '/') || null;
+}
+/**
+ * The directory to run git in for a session's workspace: its repository root,
+ * or the directory itself when it is not inside a repository.
+ *
+ * The fallback keeps the failure honest: outside a repository the caller's own
+ * git run fails exactly as it did before this module existed, and that error —
+ * not a resolution error — is what the reader should see.
+ * @param git - how to run git.
+ * @param cwd - the directory the session opened.
+ */
+export async function rootedDir(git, cwd) {
+    return (await resolveRepoRoot(git, cwd)) ?? cwd;
+}

package/lib/worktree.js

@@ -141,6 +141,89 @@ export function isRefName(ref) {
 export function worktreeDir(repoRoot, name) {
     return `${repoRoot.replace(/\/+$/, '')}/.agents/worktrees/${name}`;
 }
+/**
+ * Deepest ancestor chain walked before the lookup gives up. Real delegation
+ * nests two or three levels; the cap exists so a corrupt lineage (a cycle the
+ * guard below somehow missed, a pathologically deep chain) costs a bounded
+ * number of lookups instead of walking forever.
+ */
+const LINEAGE_HOP_CAP = 8;
+/**
+ * Resolve the binding a session effectively works under: its own, else the
+ * nearest ancestor's.
+ *
+ * A subagent session never gets a binding of its own — `worktree_enter` is
+ * called by the session that wants the worktree — but it works wherever its
+ * parent conversation works: the standing prompt, the chip, and `worktree_exit`'s
+ * diagnostics all answer "which worktree is THIS session in" through here. The
+ * walk is re-resolved on every read, so a session exiting its worktree changes
+ * only its own binding: descendants lend the next bound ancestor up the chain
+ * on their next read (possibly none — the common case — possibly a grandparent's,
+ * which is still the conversation tree they work in) and nothing dangles.
+ *
+ * Own wins over inherited on purpose: a session that enters a worktree of its
+ * own is deliberately somewhere else than its parent.
+ * @param sessionId - the session whose effective binding is wanted.
+ * @param parentOf - session id → parent session id, as `agent/session-start`
+ * delivered it (subagent headers name their parent).
+ * @param bindingOf - binding lookup (the bindings file, or the prompt mirror).
+ * @returns the effective binding, or undefined when neither the session nor any
+ * ancestor (within the hop cap) is bound.
+ */
+export function resolveEffectiveBinding(sessionId, parentOf, bindingOf) {
+    const own = bindingOf(sessionId);
+    if (own !== undefined)
+        return { binding: own, inherited: false };
+    const seen = new Set([sessionId]);
+    let ancestor = parentOf.get(sessionId);
+    for (let hops = 0; ancestor !== undefined && hops < LINEAGE_HOP_CAP; hops += 1) {
+        if (seen.has(ancestor))
+            return undefined;
+        seen.add(ancestor);
+        const binding = bindingOf(ancestor);
+        if (binding !== undefined)
+            return { binding, inherited: true };
+        ancestor = parentOf.get(ancestor);
+    }
+    return undefined;
+}
+/**
+ * The session's parent edge, read off a dsh session header: the id of the
+ * session this one was delegated by, or undefined for a top-level session (or
+ * a malformed empty value). Both `parentOf` feeds — the `agent/session-start`
+ * listener and the prompt-time self-heal — go through here, so their input
+ * guards cannot drift apart.
+ */
+export function lineageEdgeOf(header) {
+    const parent = header?.parentSession;
+    return typeof parent === 'string' && parent.length > 0 ? parent : undefined;
+}
+/**
+ * The standing notice for a session's effective binding — the text the
+ * `worktree:binding` prompt context returns. Both variants carry the same two
+ * operational rules; what differs is who holds the binding, and the inherited
+ * variant must NOT offer `worktree_exit` (the caller cannot unbind a parent's
+ * binding — the exit would fail, and the model should not be told to try).
+ * @param name - worktree name (also the directory under `.agents/worktrees/`).
+ * @param branch - branch checked out there, when known.
+ * @param inherited - whether an ancestor, not this session, holds the binding.
+ */
+export function bindingNotice(name, branch, inherited) {
+    const rel = `.agents/worktrees/${name}`;
+    const branchNote = branch === undefined ? '' : ` (branch ${branch})`;
+    const opening = inherited
+        ? `This session works in git worktree "${name}"${branchNote}, entered by its parent session.`
+        : `This session is bound to git worktree "${name}"${branchNote}.`;
+    const closing = inherited
+        ? 'A path without that prefix acts on the MAIN worktree, not the worktree this conversation works in. '
+            + '(The binding belongs to the parent session; worktree_exit here would not unbind it.)'
+        : 'A path without that prefix acts on the MAIN worktree, not the bound one. Call worktree_exit to unbind.';
+    return `${opening}\n`
+        + 'The session working directory is still the repository root, so the binding is a convention you must apply yourself:\n'
+        + `- shell commands: pass workdir "${rel}"\n`
+        + `- file tools: prefix every path with ${rel}/\n`
+        + closing;
+}
 export function parseWorktreeList(porcelain) {
     const out = [];
     let path = '';

package/lib/write-checked.js

@@ -31,7 +31,7 @@
  */
 import { randomBytes } from 'node:crypto';
 import { renameWithRetry } from './atomic-json.js';
-import { resolveInside } from './fs-remove.js';
+import { resolveInside } from './path-lock.js';
 import { decodesAsUtf8, isSafePathArg } from './git-ops.js';
 /**
  * Run one checked write end to end. Never throws: every failure, including an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@young1lin/dsh-ui-gitworkbench",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "description": "Out-of-tree dsh web UI plugin: a session-header git workbench chip opening a drawer with the file tree, per-file diff, history, compare, staging, commit, and sync (fetch/pull/push).",
   "type": "module",
   "main": "lib/index.js",
@@ -66,10 +66,10 @@
   "packageManager": "pnpm@10.20.0",
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1-rc.1",
-    "@deepseek-ai/dsh-client-runtime": "^0.1.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.0-rc.2",
-    "@deepseek-ai/dsh-tools": "^0.1.0-rc.2",
-    "@deepseek-ai/dsh-typert-protocol": "^0.1.0-rc.2",
+    "@deepseek-ai/dsh-client-runtime": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-tools": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-typert-protocol": "^0.1.1-rc.2",
     "react": "^18.2.0"
   },
   "peerDependenciesMeta": {

package/src/client/ChromeGlyph.tsx

@@ -16,6 +16,11 @@ const CHROME_GLYPH = {
   // and at 14px the only thing telling them apart is the arrow count.
   refresh: 'M8 3a5 5 0 1 0 4.546 2.914.5.5 0 0 1 .908-.417A6 6 0 1 1 8 2v1z M8 4.466V.534a.25.25 0 0 1 .41-.192l2.36 1.966c.12.1.12.284 0 .384L8.41 4.658A.25.25 0 0 1 8 4.466z',
   close: 'M2.146 2.854a.5.5 0 1 1 .708-.708L8 7.293l5.146-5.147a.5.5 0 0 1 .708.708L8.707 8l5.147 5.146a.5.5 0 0 1-.708.708L8 8.707l-5.146 5.147a.5.5 0 0 1-.708-.708L7.293 8 2.146 2.854Z',
+  // Drawn here rather than borrowed: Bootstrap has no wrap glyph, and the
+  // three text rules with a return arrow are what every editor spells this
+  // with. Same 16 viewBox and single fill as the rest, so the row still reads
+  // as one set.
+  wrap: 'M1 3.5a.5.5 0 0 1 .5-.5h13a.5.5 0 0 1 0 1h-13a.5.5 0 0 1-.5-.5zM1 7.5a.5.5 0 0 1 .5-.5h11a2.5 2.5 0 0 1 0 5h-2.293l1.147 1.146a.5.5 0 0 1-.708.708l-2-2a.5.5 0 0 1 0-.708l2-2a.5.5 0 0 1 .708.708L10.207 11H12.5a1.5 1.5 0 0 0 0-3h-11a.5.5 0 0 1-.5-.5zM1 12.5a.5.5 0 0 1 .5-.5h4a.5.5 0 0 1 0 1h-4a.5.5 0 0 1-.5-.5z',
 } as const
 
 export function ChromeGlyph({ of }: { of: keyof typeof CHROME_GLYPH }): ReactNode {

package/src/client/CodeEditor.tsx

@@ -66,6 +66,9 @@ const paintFacet = Facet.define<PaintFn | null, PaintFn | null>({
   combine: values => values.length > 0 ? values[0]! : null,
 })
 const paintCompartment = new Compartment()
+/** Soft wrap, in and out without rebuilding the view — the caret, the undo
+ *  stack and the selection all survive the toggle. */
+const wrapCompartment = new Compartment()
 
 /**
  * How long after the last keystroke the editor recomputes what it paints.
@@ -422,7 +425,7 @@ const paneTheme = EditorView.theme({
   ...SEARCH_PANEL_THEME,
 })
 
-export function CodeEditor({ value, original, onChange, paint, indent, ariaLabel, onSave, blame, notCommitted, readOnly, onBlameClick }: {
+export function CodeEditor({ value, original, onChange, paint, indent, ariaLabel, onSave, blame, notCommitted, readOnly, onBlameClick, wrap }: {
   /** The pane's buffer. The view is written to only when this really differs. */
   value: string
   /** The other side's whole text — the index side, for the unstaged layer this
@@ -450,6 +453,11 @@ export function CodeEditor({ value, original, onChange, paint, indent, ariaLabel
   readOnly?: boolean
   /** A click in the blame gutter, with the 1-based line number. */
   onBlameClick?: (line: number) => void
+  /** Soft wrap. CodeMirror owns variable line heights natively — its height
+   *  oracle measures wrapped lines and its own viewport walk stays correct —
+   *  so this is the whole change here, unlike the diff panes, whose windowing
+   *  assumes a fixed row height. */
+  wrap?: boolean
 }): ReactNode {
   /**
    * Editable, and SAID to be editable, from one boolean.
@@ -486,6 +494,7 @@ export function CodeEditor({ value, original, onChange, paint, indent, ariaLabel
       searchCount,
       highlightActiveLine(),
       paintCompartment.of(paintFacet.of(paint)),
+      wrapCompartment.of(wrap === true ? EditorView.lineWrapping : []),
       painter,
       blameField,
       blameCompartment.of([]),
@@ -565,5 +574,14 @@ export function CodeEditor({ value, original, onChange, paint, indent, ariaLabel
     current.dispatch({ effects: paintCompartment.reconfigure(paintFacet.of(paint)) })
   }, [paint])
 
+  // Wrap in or out. Through the compartment rather than a rebuild: the reader
+  // toggles this to look at the line they are already on, and a rebuilt view
+  // would drop the caret and the undo stack to show it to them.
+  useEffect(() => {
+    const current = view.current
+    if (current === null) return
+    current.dispatch({ effects: wrapCompartment.reconfigure(wrap === true ? EditorView.lineWrapping : []) })
+  }, [wrap])
+
   return <div ref={host} className={css.cmHost} data-editable={editable ? '' : undefined} />
 }