@young1lin/dsh-ui-gitworkbench 0.1.15 → 0.1.17

package/lib/path-lock.js

@@ -0,0 +1,54 @@
+/**
+ * The one place a client-supplied path becomes an absolute path on disk.
+ *
+ * git needs no such lock: whatever pathspec it is handed, it will not read or
+ * write outside the repository, which is why `isSafePathArg` only has to keep
+ * a path from being mistaken for an option. The moment a path leaves git and
+ * reaches `readFile`, `stat` or `readdir`, that backstop is gone — `join(root,
+ * '../../../etc/passwd')` is just a path, and the browser is the least trusted
+ * source of paths this plugin has.
+ *
+ * So every filesystem call in the host resolves through here, and the RPCs
+ * that do it are pinned by `host-rooted-paths.test.ts` so a new one cannot
+ * quietly join a client string onto the root instead.
+ *
+ * What this does NOT defend against, deliberately and for the same reason
+ * `fs-remove.ts` says so: `resolve` is lexical, so a SYMLINK inside the
+ * worktree that points outward still resolves inside and is followed. Closing
+ * that means a `realpath` per segment on every read of every file, for a case
+ * git itself does not defend against and that presupposes write access to the
+ * repository the reader already opened.
+ *
+ * @module @young1lin/dsh-ui-gitworkbench/path-lock
+ */
+import { resolve, sep } from 'node:path';
+import { isSafeRelativePath } from './discard-ops.js';
+/**
+ * Resolve a repo-relative path against the worktree root, refusing to leave it.
+ *
+ * Two locks, not one. {@link isSafeRelativePath} rejects the traversal
+ * SPELLINGS — absolute paths, drive letters, UNC prefixes, NUL bytes, any `..`
+ * segment including one buried mid-path. The `startsWith` below re-checks the
+ * RESOLVED path, which is the form the filesystem acts on, so a path that
+ * survives the first check by being spelled unusually still has to land inside
+ * the root to be acted on.
+ *
+ * @param root - the worktree directory, absolute.
+ * @param relative - repo-relative path from the client or from git's output.
+ * @returns the absolute path to act on.
+ * @throws if the path is not a safe relative path, resolves outside the root,
+ *         or IS the root.
+ */
+export function resolveInside(root, relative) {
+    if (!isSafeRelativePath(relative)) {
+        throw new Error(`unsafe path argument: ${JSON.stringify(relative)}`);
+    }
+    const base = resolve(root);
+    const target = resolve(base, relative);
+    if (target === base)
+        throw new Error('refusing to act on the worktree root itself');
+    if (!target.startsWith(base + sep)) {
+        throw new Error(`path escapes the worktree: ${JSON.stringify(relative)}`);
+    }
+    return target;
+}

package/lib/worktree.js

@@ -138,9 +138,142 @@ export function isRefName(ref) {
         && !ref.includes('..')
         && REF_CHARS.test(ref);
 }
+/**
+ * The extra rules an ENTER branch must satisfy beyond {@link isRefName}.
+ *
+ * isRefName guards untrusted refs that reach git as positional arguments
+ * (leading `-`, `..`, alien characters). A branch worktreeEnter CREATES has
+ * two more classes of trouble: spellings check-ref-format refuses that
+ * REF_CHARS happens to pass (a leading or trailing dot, a `.lock` ending),
+ * and `head` — a legal ref on Linux that collides with HEAD on the
+ * case-insensitive filesystems the host runs on.
+ */
+function isEnterBranch(branch) {
+    return isRefName(branch)
+        && !branch.startsWith('.')
+        && !branch.endsWith('.')
+        && !branch.endsWith('.lock')
+        && branch.toLowerCase() !== 'head';
+}
+/**
+ * Decide the branch a worktreeEnter call lands on.
+ *
+ * The worktree NAME is the identity knob — the directory under
+ * `.agents/worktrees/` — and doubles as the branch by default (the old
+ * contract, kept for callers that pass no branchName). branchName splits the
+ * two for the one thing the name can never express: a SLASH branch
+ * (`feature/foo` is a legal ref and an impossible Windows directory).
+ *
+ * Reuse keeps the registered worktree's own branch, request or no request;
+ * an explicit branchName it displaces is reported as branchOverridden so the
+ * hint can say so — refusing there would break enter's idempotency (the same
+ * call re-issued must rebind, not explode).
+ *
+ * An illegal branchName is REFUSED, never substituted: the worktree name may
+ * be auto-generated because a directory label is arbitrary, but a branch is
+ * semantic — silently renaming it lands work on the wrong branch.
+ * @param wtName - sanitized worktree name (the default branch).
+ * @param branchName - caller-requested branch, or undefined for the default.
+ * @param existingBranch - the registered worktree's own branch when the
+ * target directory already holds one, else undefined.
+ * @returns the branch to create or keep, plus whether an explicit request
+ * was set aside — or the refusal error.
+ */
+export function resolveEnterBranch(wtName, branchName, existingBranch) {
+    if (branchName !== undefined && !isEnterBranch(branchName)) {
+        return { ok: false, error: 'branchName is not a valid branch name' };
+    }
+    if (existingBranch !== undefined) {
+        return { ok: true, branch: existingBranch, branchOverridden: branchName !== undefined && branchName !== existingBranch };
+    }
+    return { ok: true, branch: branchName ?? wtName, branchOverridden: false };
+}
 export function worktreeDir(repoRoot, name) {
     return `${repoRoot.replace(/\/+$/, '')}/.agents/worktrees/${name}`;
 }
+/**
+ * Deepest ancestor chain walked before the lookup gives up. Real delegation
+ * nests two or three levels; the cap exists so a corrupt lineage (a cycle the
+ * guard below somehow missed, a pathologically deep chain) costs a bounded
+ * number of lookups instead of walking forever.
+ */
+const LINEAGE_HOP_CAP = 8;
+/**
+ * Resolve the binding a session effectively works under: its own, else the
+ * nearest ancestor's.
+ *
+ * A subagent session never gets a binding of its own — `worktree_enter` is
+ * called by the session that wants the worktree — but it works wherever its
+ * parent conversation works: the standing prompt, the chip, and `worktree_exit`'s
+ * diagnostics all answer "which worktree is THIS session in" through here. The
+ * walk is re-resolved on every read, so a session exiting its worktree changes
+ * only its own binding: descendants lend the next bound ancestor up the chain
+ * on their next read (possibly none — the common case — possibly a grandparent's,
+ * which is still the conversation tree they work in) and nothing dangles.
+ *
+ * Own wins over inherited on purpose: a session that enters a worktree of its
+ * own is deliberately somewhere else than its parent.
+ * @param sessionId - the session whose effective binding is wanted.
+ * @param parentOf - session id → parent session id, as `agent/session-start`
+ * delivered it (subagent headers name their parent).
+ * @param bindingOf - binding lookup (the bindings file, or the prompt mirror).
+ * @returns the effective binding, or undefined when neither the session nor any
+ * ancestor (within the hop cap) is bound.
+ */
+export function resolveEffectiveBinding(sessionId, parentOf, bindingOf) {
+    const own = bindingOf(sessionId);
+    if (own !== undefined)
+        return { binding: own, inherited: false };
+    const seen = new Set([sessionId]);
+    let ancestor = parentOf.get(sessionId);
+    for (let hops = 0; ancestor !== undefined && hops < LINEAGE_HOP_CAP; hops += 1) {
+        if (seen.has(ancestor))
+            return undefined;
+        seen.add(ancestor);
+        const binding = bindingOf(ancestor);
+        if (binding !== undefined)
+            return { binding, inherited: true };
+        ancestor = parentOf.get(ancestor);
+    }
+    return undefined;
+}
+/**
+ * The session's parent edge, read off a dsh session header: the id of the
+ * session this one was delegated by, or undefined for a top-level session (or
+ * a malformed empty value). Both `parentOf` feeds — the `agent/session-start`
+ * listener and the prompt-time self-heal — go through here, so their input
+ * guards cannot drift apart.
+ */
+export function lineageEdgeOf(header) {
+    const parent = header?.parentSession;
+    return typeof parent === 'string' && parent.length > 0 ? parent : undefined;
+}
+/**
+ * The standing notice for a session's effective binding — the text the
+ * `worktree:binding` prompt context returns. Both variants carry the same two
+ * operational rules; what differs is who holds the binding, and the inherited
+ * variant must NOT offer `worktree_exit` (the caller cannot unbind a parent's
+ * binding — the exit would fail, and the model should not be told to try).
+ * @param name - worktree name (also the directory under `.agents/worktrees/`).
+ * @param branch - branch checked out there, when known.
+ * @param inherited - whether an ancestor, not this session, holds the binding.
+ */
+export function bindingNotice(name, branch, inherited) {
+    const rel = `.agents/worktrees/${name}`;
+    const branchNote = branch === undefined ? '' : ` (branch ${branch})`;
+    const opening = inherited
+        ? `This session works in git worktree "${name}"${branchNote}, entered by its parent session.`
+        : `This session is bound to git worktree "${name}"${branchNote}.`;
+    const closing = inherited
+        ? 'A path without that prefix acts on the MAIN worktree, not the worktree this conversation works in. '
+            + '(The binding belongs to the parent session; worktree_exit here would not unbind it.)'
+        : 'A path without that prefix acts on the MAIN worktree, not the bound one. Call worktree_exit to unbind.';
+    return `${opening}\n`
+        + 'The session working directory is still the repository root, so the binding is a convention you must apply yourself:\n'
+        + `- shell commands: pass workdir "${rel}"\n`
+        + `- file tools: prefix every path with ${rel}/\n`
+        + closing;
+}
 export function parseWorktreeList(porcelain) {
     const out = [];
     let path = '';

package/lib/write-checked.js

@@ -31,7 +31,7 @@
  */
 import { randomBytes } from 'node:crypto';
 import { renameWithRetry } from './atomic-json.js';
-import { resolveInside } from './fs-remove.js';
+import { resolveInside } from './path-lock.js';
 import { decodesAsUtf8, isSafePathArg } from './git-ops.js';
 /**
  * Run one checked write end to end. Never throws: every failure, including an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@young1lin/dsh-ui-gitworkbench",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Out-of-tree dsh web UI plugin: a session-header git workbench chip opening a drawer with the file tree, per-file diff, history, compare, staging, commit, and sync (fetch/pull/push).",
   "type": "module",
   "main": "lib/index.js",

package/src/client/ChromeGlyph.tsx

@@ -16,6 +16,11 @@ const CHROME_GLYPH = {
   // and at 14px the only thing telling them apart is the arrow count.
   refresh: 'M8 3a5 5 0 1 0 4.546 2.914.5.5 0 0 1 .908-.417A6 6 0 1 1 8 2v1z M8 4.466V.534a.25.25 0 0 1 .41-.192l2.36 1.966c.12.1.12.284 0 .384L8.41 4.658A.25.25 0 0 1 8 4.466z',
   close: 'M2.146 2.854a.5.5 0 1 1 .708-.708L8 7.293l5.146-5.147a.5.5 0 0 1 .708.708L8.707 8l5.147 5.146a.5.5 0 0 1-.708.708L8 8.707l-5.146 5.147a.5.5 0 0 1-.708-.708L7.293 8 2.146 2.854Z',
+  // Drawn here rather than borrowed: Bootstrap has no wrap glyph, and the
+  // three text rules with a return arrow are what every editor spells this
+  // with. Same 16 viewBox and single fill as the rest, so the row still reads
+  // as one set.
+  wrap: 'M1 3.5a.5.5 0 0 1 .5-.5h13a.5.5 0 0 1 0 1h-13a.5.5 0 0 1-.5-.5zM1 7.5a.5.5 0 0 1 .5-.5h11a2.5 2.5 0 0 1 0 5h-2.293l1.147 1.146a.5.5 0 0 1-.708.708l-2-2a.5.5 0 0 1 0-.708l2-2a.5.5 0 0 1 .708.708L10.207 11H12.5a1.5 1.5 0 0 0 0-3h-11a.5.5 0 0 1-.5-.5zM1 12.5a.5.5 0 0 1 .5-.5h4a.5.5 0 0 1 0 1h-4a.5.5 0 0 1-.5-.5z',
 } as const
 
 export function ChromeGlyph({ of }: { of: keyof typeof CHROME_GLYPH }): ReactNode {

package/src/client/CodeEditor.tsx

@@ -66,6 +66,9 @@ const paintFacet = Facet.define<PaintFn | null, PaintFn | null>({
   combine: values => values.length > 0 ? values[0]! : null,
 })
 const paintCompartment = new Compartment()
+/** Soft wrap, in and out without rebuilding the view — the caret, the undo
+ *  stack and the selection all survive the toggle. */
+const wrapCompartment = new Compartment()
 
 /**
  * How long after the last keystroke the editor recomputes what it paints.
@@ -422,7 +425,7 @@ const paneTheme = EditorView.theme({
   ...SEARCH_PANEL_THEME,
 })
 
-export function CodeEditor({ value, original, onChange, paint, indent, ariaLabel, onSave, blame, notCommitted, readOnly, onBlameClick }: {
+export function CodeEditor({ value, original, onChange, paint, indent, ariaLabel, onSave, blame, notCommitted, readOnly, onBlameClick, wrap }: {
   /** The pane's buffer. The view is written to only when this really differs. */
   value: string
   /** The other side's whole text — the index side, for the unstaged layer this
@@ -450,6 +453,11 @@ export function CodeEditor({ value, original, onChange, paint, indent, ariaLabel
   readOnly?: boolean
   /** A click in the blame gutter, with the 1-based line number. */
   onBlameClick?: (line: number) => void
+  /** Soft wrap. CodeMirror owns variable line heights natively — its height
+   *  oracle measures wrapped lines and its own viewport walk stays correct —
+   *  so this is the whole change here, unlike the diff panes, whose windowing
+   *  assumes a fixed row height. */
+  wrap?: boolean
 }): ReactNode {
   /**
    * Editable, and SAID to be editable, from one boolean.
@@ -486,6 +494,7 @@ export function CodeEditor({ value, original, onChange, paint, indent, ariaLabel
       searchCount,
       highlightActiveLine(),
       paintCompartment.of(paintFacet.of(paint)),
+      wrapCompartment.of(wrap === true ? EditorView.lineWrapping : []),
       painter,
       blameField,
       blameCompartment.of([]),
@@ -565,5 +574,14 @@ export function CodeEditor({ value, original, onChange, paint, indent, ariaLabel
     current.dispatch({ effects: paintCompartment.reconfigure(paintFacet.of(paint)) })
   }, [paint])
 
+  // Wrap in or out. Through the compartment rather than a rebuild: the reader
+  // toggles this to look at the line they are already on, and a rebuilt view
+  // would drop the caret and the undo stack to show it to them.
+  useEffect(() => {
+    const current = view.current
+    if (current === null) return
+    current.dispatch({ effects: wrapCompartment.reconfigure(wrap === true ? EditorView.lineWrapping : []) })
+  }, [wrap])
+
   return <div ref={host} className={css.cmHost} data-editable={editable ? '' : undefined} />
 }