@young1lin/dsh-ui-gitworkbench 0.1.2 → 0.1.4

package/src/index.ts

@@ -42,9 +42,9 @@
  * @module @young1lin/dsh-ui-gitworkbench
  */
 import { randomBytes } from 'node:crypto'
-import { mkdir, readFile, realpath, rename, writeFile } from 'node:fs/promises'
+import { mkdir, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
-import { join } from 'node:path'
+import { join, resolve, sep } from 'node:path'
 import type { Readable } from 'node:stream'
 import type { Context } from '@deepseek-ai/cordis'
 import { defineTool, type ToolRunContext } from '@deepseek-ai/dsh-tools'
@@ -59,7 +59,13 @@ import {
   type GitFile, type GitFileStatus, type MutableGitFile,
   type OpFailure, type PullMode, type Tracking,
 } from './git-ops.js'
+import {
+  planFromStatus,
+  type DiscardEffect, type DiscardPlan,
+} from './discard-ops.js'
 import { LOG_FORMAT, parseLog, type GitCommit } from './git-log.js'
+import { emptyLogFilter, logFilterArgs, type LogFilter } from './log-filter.js'
+import { parseShortlog, type AuthorEntry } from './shortlog.js'
 import {
   isBlankEntry, loadStyle, sanitizeEntry, stylePath,
   type StyleEntry, type StyleFile,
@@ -71,6 +77,7 @@ import {
 
 export type { WorktreeBinding, WorktreeOpResult }
 export type { GitFile, GitFileStatus }
+export type { DiscardEffect }
 export type { StyleEntry }
 
 /** Cap the bundled unified diff so a huge change cannot blow the RPC response. */
@@ -90,6 +97,12 @@ const HISTORY_COMMITS = 20
 const HISTORY_PAGE = 30
 /** Upper bound on a caller-supplied page size. */
 const HISTORY_PAGE_MAX = 200
+/** Author roster cap: the busiest 500 — enough for any real project's people,
+ *  and a list a popup can scroll without choking. */
+const SHORTLOG_CAP = 500
+/** Path list cap for the picker: a monorepo can outrun any popup; past this
+ *  the tree is cut and the truncation reported, never silent. */
+const TREE_PATH_CAP = 50_000
 /**
  * Most branch names sent to the browser. `worktreeStatus` is polled, so an
  * unbounded list would repeat on the wire every few seconds; the picker reports
@@ -524,16 +537,23 @@ export class GitWorkbenchService extends TypertRemoteService {
    * @param ref - ref to walk; empty means the worktree's own HEAD.
    * @param skip - commits to skip, counting back from the ref.
    * @param limit - page size; out-of-range values fall back to the default page.
+   * @param filter - history filter compiled into git log arguments (IDEA-style
+   *   pushdown: matching runs over ALL history, not the loaded pages). Absent
+   *   from older clients — treated as "no filter".
    * @param signal - abort signal.
    * @returns the page, and whether the log continues past it.
    */
   @Remote('commits')
-  async commits(worktreePath: string, ref: string, skip: number, limit: number, signal: AbortSignal): Promise<{ commits: GitCommit[]; hasMore: boolean }> {
+  async commits(worktreePath: string, ref: string, skip: number, limit: number, filter: LogFilter, signal: AbortSignal): Promise<{ commits: GitCommit[]; hasMore: boolean; error?: string }> {
     const cwd = typeof worktreePath === 'string' && worktreePath.length > 0 ? worktreePath : process.cwd()
-    const target = typeof ref === 'string' && ref.length > 0 ? ref : 'HEAD'
-    if (!isRefName(target)) return { commits: [], hasMore: false }
+    // '--all' is the ALL-BRANCHES sentinel (a ref cannot begin with a dash, so
+    // it collides with nothing): "who did what" must not require knowing which
+    // branch holds it — IDEA's All branches, same idea.
+    const target = ref === '--all' ? '--all' : (typeof ref === 'string' && ref.length > 0 ? ref : 'HEAD')
+    if (target !== '--all' && !isRefName(target)) return { commits: [], hasMore: false }
     const from = Number.isInteger(skip) && skip >= 0 ? skip : 0
     const size = Number.isInteger(limit) && limit > 0 && limit <= HISTORY_PAGE_MAX ? limit : HISTORY_PAGE
+    const effective = filter ?? emptyLogFilter()
     // Reading one row beyond the page answers "is there more" without a second
     // traversal of the log.
     //
@@ -543,15 +563,67 @@ export class GitWorkbenchService extends TypertRemoteService {
     // a dozen unrelated rows, and closes far from where it started. Topological
     // order keeps a branch's commits contiguous — it is what `git log --graph`
     // turns on for itself, for the same reason.
+    //
+    // Filter args go LAST: their segment ends with `--` + pathspecs, and
+    // nothing after that separator may be parsed as a flag.
     const log = await this.git(
       cwd,
-      ['log', target, '--topo-order', `--skip=${from}`, `-${size + 1}`, `--pretty=format:${LOG_FORMAT}`],
+      ['log', target, '--topo-order', `--skip=${from}`, `-${size + 1}`, `--pretty=format:${LOG_FORMAT}`, ...logFilterArgs(effective)],
       signal,
     )
+    // A bad filter (unparsable regex, invalid date) dies here, and an empty
+    // page is indistinguishable from "no match" unless the failure speaks —
+    // §6.13: the exit code + stderr tail is the only honest answer.
+    if (log.exitCode !== 0) {
+      const detail = log.stderr.length > 0 ? `: ${log.stderr.slice(-160)}` : ''
+      return { commits: [], hasMore: false, error: `git log failed (exit ${log.exitCode})${detail}` }
+    }
     const page = parseLog(log.stdout)
     return { commits: page.slice(0, size), hasMore: page.length > size }
   }
 
+  /**
+   * Every author with commits reachable from a ref, busiest first — the
+   * history filter popup's user picker.
+   *
+   * The roster walks the SAME ref the history list walks (`git shortlog -sne
+   * <ref>`), not `--all`: a picker entry is a promise that ticking it yields
+   * commits in the list below. `--all` once listed authors whose commits live
+   * only on other refs — visible in the menu, invisible to every search.
+   * @param worktreePath - worktree whose object store resolves the ref; empty falls back to the host cwd.
+   * @param ref - ref whose history the roster counts; empty means HEAD.
+   * @param signal - abort signal.
+   */
+  @Remote('authors')
+  async authors(worktreePath: string, ref: string, signal: AbortSignal): Promise<{ authors: AuthorEntry[]; truncated: boolean }> {
+    const cwd = typeof worktreePath === 'string' && worktreePath.length > 0 ? worktreePath : process.cwd()
+    // Same '--all' sentinel as `commits`: when the list walks every ref, the
+    // roster counts every ref — the picker and the list stay one claim.
+    const target = ref === '--all' ? '--all' : (typeof ref === 'string' && ref.length > 0 ? ref : 'HEAD')
+    if (target !== '--all' && !isRefName(target)) return { authors: [], truncated: false }
+    const res = await this.git(cwd, ['shortlog', '-sne', target], signal)
+    return parseShortlog(res.stdout, SHORTLOG_CAP)
+  }
+
+  /**
+   * Every file path on HEAD — the filter popup's path picker, aggregated into
+   * a directory tree client-side.
+   *
+   * `-z` is load-bearing: NUL-separated output is UNQUOTED, while the default
+   * would render non-ASCII names as quoted octal escapes under
+   * `core.quotepath` and hand the picker garbage.
+   * @param worktreePath - worktree whose HEAD is listed; empty falls back to the host cwd.
+   * @param signal - abort signal.
+   */
+  @Remote('repoTree')
+  async repoTree(worktreePath: string, signal: AbortSignal): Promise<{ paths: string[]; truncated: boolean }> {
+    const cwd = typeof worktreePath === 'string' && worktreePath.length > 0 ? worktreePath : process.cwd()
+    const res = await this.git(cwd, ['ls-tree', '-r', '-z', '--name-only', 'HEAD'], signal)
+    const all = res.stdout.split('\0').filter(path => path.length > 0)
+    const truncated = all.length > TREE_PATH_CAP
+    return { paths: truncated ? all.slice(0, TREE_PATH_CAP) : all, truncated }
+  }
+
   /**
    * Compare two refs, in the same {@link WorkbenchStats} shape as every other view.
    *
@@ -882,6 +954,143 @@ export class GitWorkbenchService extends TypertRemoteService {
     return this.writeOp(worktreePath, () => unstageArgv(asPathList(paths)), signal)
   }
 
+  /**
+   * What discarding this file WOULD do, without doing it.
+   *
+   * The confirmation has to state the real consequence, and only git knows it:
+   * the drawer's own file list is a poll old, and the difference between "this
+   * goes back to its committed content" and "this file leaves the disk and
+   * cannot come back" is exactly the difference the reader is being asked
+   * about. So the dialog is built from this, read fresh, rather than from the
+   * row that was clicked.
+   * @param worktreePath - directory to run in.
+   * @param path - repository-relative path, as the drawer lists it.
+   * @param signal - abort signal.
+   * @returns the effect and whether it is irreversible; `effect` is absent when
+   *          git reports nothing to discard for that path.
+   */
+  @Remote('discardPlan')
+  async discardPlan(worktreePath: string, path: string, signal: AbortSignal): Promise<{
+    effect?: DiscardEffect
+    irreversible?: boolean
+    previousPath?: string
+    error?: string
+  }> {
+    let plan: DiscardPlan | null
+    try {
+      plan = await this.planDiscard(worktreePath, path, signal)
+    } catch (error) {
+      return { error: error instanceof Error ? error.message : String(error) }
+    }
+    if (plan === null) return {}
+    // JSON-safe: an absent previousPath is an omitted key, never `undefined`.
+    return plan.previousPath !== undefined
+      ? { effect: plan.effect, irreversible: plan.irreversible, previousPath: plan.previousPath }
+      : { effect: plan.effect, irreversible: plan.irreversible }
+  }
+
+  /**
+   * Take one file back to its committed state — IntelliJ's Rollback.
+   *
+   * One path per call, never a list. Discarding is the only thing the drawer
+   * does that cannot be undone, and a batch entry point is the shape that
+   * turns one mistaken click into a lost afternoon; a caller that wants two
+   * files asks twice, and gets asked twice.
+   *
+   * The plan is re-derived here from a fresh `git status`, so a client that
+   * mislabels a tracked file as untracked cannot talk the host into deleting
+   * it. `expectedEffect` is what the reader was shown and agreed to: if the
+   * file changed underneath the dialog — staged, edited, reverted by someone
+   * else — the freshly derived effect no longer matches and nothing is done.
+   * @param worktreePath - directory to run in.
+   * @param path - repository-relative path, as the drawer lists it.
+   * @param expectedEffect - the effect the confirmation stated; blank skips
+   *                         the agreement check, which only the reversible
+   *                         `recover` path takes (it shows no dialog).
+   * @param signal - abort signal.
+   * @returns the operation result, with the effect actually carried out.
+   */
+  @Remote('discardFile')
+  async discardFile(worktreePath: string, path: string, expectedEffect: string | undefined, signal: AbortSignal): Promise<GitOpResult & { effect?: DiscardEffect }> {
+    let plan: DiscardPlan | null
+    try {
+      plan = await this.planDiscard(worktreePath, path, signal)
+    } catch (error) {
+      return { ok: false, failure: 'unknown', error: error instanceof Error ? error.message : String(error) }
+    }
+    // Nothing to discard is not a failure: the row was stale, and the tree the
+    // client refreshes onto will simply no longer carry it.
+    if (plan === null) return { ok: true }
+    if (typeof expectedEffect === 'string' && expectedEffect.length > 0 && expectedEffect !== plan.effect) {
+      return {
+        ok: false,
+        failure: 'unknown',
+        error: `this file changed since you were asked (now: ${plan.effect}); nothing was done`,
+      }
+    }
+
+    const cwd = this.cwdOf(worktreePath)
+    for (const step of plan.steps) {
+      if (step.kind === 'git') {
+        const result = await this.git(cwd, step.argv, signal)
+        const failure = classifyFailure(result.exitCode, result.stderr, result.stdout)
+        if (failure !== null) {
+          return { ok: false, failure, error: (result.stderr || result.stdout).trim().slice(-1000) }
+        }
+        continue
+      }
+      try {
+        await this.removeInside(cwd, step.path)
+      } catch (error) {
+        return { ok: false, failure: 'unknown', error: error instanceof Error ? error.message : String(error) }
+      }
+    }
+    return { ok: true, effect: plan.effect }
+  }
+
+  /**
+   * Read the worktree's status and plan for one path.
+   *
+   * The status is the WHOLE tree's, deliberately: git pairs a deletion with an
+   * addition to see a rename, and a pathspec that admits only one of the pair
+   * reports `D` plus `??` instead — which plans as "restore one, DELETE the
+   * other" where the truth is "undo the rename".
+   */
+  private async planDiscard(worktreePath: string, path: string, signal: AbortSignal): Promise<DiscardPlan | null> {
+    if (typeof path !== 'string' || !isSafePathArg(path)) {
+      throw new Error(`unsafe path argument: ${JSON.stringify(path)}`)
+    }
+    const cwd = this.cwdOf(worktreePath)
+    const status = await this.git(cwd, ['status', '--porcelain=v1', '--untracked-files=all'], signal)
+    if (status.exitCode !== 0) {
+      throw new Error((status.stderr || status.stdout).trim().slice(-1000) || 'git status failed')
+    }
+    return planFromStatus(status.stdout, path)
+  }
+
+  /**
+   * Delete one file, having proven it is inside the worktree.
+   *
+   * `isSafeRelativePath` already rejected traversal in the plan, so this is the
+   * second lock rather than the only one: it re-checks the RESOLVED path,
+   * which is the form the filesystem actually acts on. `force` makes an absent
+   * file a success — the reader asked for it to be gone, and it is.
+   *
+   * A symlinked directory inside the worktree could still point outward; that
+   * is a repository someone already has write access to, and resolving link
+   * targets on every delete would cost a stat per segment for a case git
+   * itself does not defend against.
+   */
+  private async removeInside(cwd: string, relative: string): Promise<void> {
+    const root = resolve(cwd)
+    const target = resolve(root, relative)
+    if (target !== root && !target.startsWith(root + sep)) {
+      throw new Error(`refusing to delete outside the worktree: ${JSON.stringify(relative)}`)
+    }
+    if (target === root) throw new Error('refusing to delete the worktree root')
+    await rm(target, { force: true })
+  }
+
   /**
    * Commit what is in the index.
    * @param worktreePath - directory to run in.

package/src/log-filter.ts

@@ -0,0 +1,87 @@
+/**
+ * The history filter, compiled into `git log` arguments.
+ *
+ * This is the pushdown half of the IDEA-style filter: matching runs inside
+ * `git log` over ALL history, not client-side over the loaded pages — the
+ * loaded-pages blind spot is the reason this module exists. Everything here is
+ * pure so the argument matrix is testable without spawning git.
+ *
+ * DIALECT RULE: whenever any pattern is emitted, the flags are `-i -E` and
+ * every literal input is escaped for POSIX ERE. Mixing `--fixed-strings` with
+ * `-E` is not possible (one overrides the other for EVERY pattern on the
+ * command line), so a single dialect keeps users literal no matter what the
+ * text criterion's regex toggle says; regex text alone is passed raw.
+ *
+ * Dates pass through verbatim: approxidate ("2 weeks ago") is git's language,
+ * and reimplementing even a slice of it client-side is how the dual-semantics
+ * bug farm starts. An invalid date is git's error to raise, surfaced by the
+ * host's usual exit-code + stderr format.
+ *
+ * @module @young1lin/dsh-ui-gitworkbench/log-filter
+ */
+
+/** One history query, as the client sends it. JSON-safe: strings and booleans only. */
+export interface LogFilter {
+  /** Author names, matched case-insensitively as literal substrings. Multiple = OR (git semantics, IDEA parity). */
+  readonly users: readonly string[]
+  /** Commit-message pattern. Empty string means no text criterion. */
+  readonly text: string
+  /** Interpret {@link text} as an ERE instead of a literal substring. */
+  readonly textRegex: boolean
+  /** Pathspecs, multiple = union (a commit touching ANY of them matches). */
+  readonly paths: readonly string[]
+  /** Inclusive lower bound, approxidate text. Empty means unbounded. */
+  readonly after: string
+  /** Exclusive upper bound, approxidate text. Empty means unbounded. */
+  readonly before: string
+}
+
+/** The filter that filters nothing — also the default when a client sends none. */
+export function emptyLogFilter(): LogFilter {
+  return { users: [], text: '', textRegex: false, paths: [], after: '', before: '' }
+}
+
+/** POSIX ERE metacharacters, escaped so each matches itself. */
+function escapeEre(literal: string): string {
+  return literal.replace(/[\\.[\]*+?(){}|^$-]/g, '\\$&')
+}
+
+const DAY_RE = /^\d{4}-\d{2}-\d{2}$/
+
+/**
+ * Expand a bare calendar day into an explicit moment. Git's approxidate
+ * parses `--since=2026-08-18` against an implementation-defined timezone,
+ * which on Windows silently excludes that very day's commits; `T00:00:00`
+ * pins it to local midnight (a picker day means the whole day, so `before`
+ * gets the day's last second instead).
+ */
+function expandDay(bound: string, endOfDay: boolean): string {
+  if (!DAY_RE.test(bound)) return bound
+  return endOfDay ? `${bound}T23:59:59` : `${bound}T00:00:00`
+}
+
+/**
+ * Compile a filter into the argument segment inserted after the log command's
+ * own flags. Pathspecs come last behind a bare `--`, so the CALLER must place
+ * this segment at the end of the argument list.
+ * @param filter - the query; blank entries are dropped, not turned into empty
+ *   patterns (an empty `--author=` would match nothing).
+ */
+export function logFilterArgs(filter: LogFilter): string[] {
+  const users = filter.users.map(user => user.trim()).filter(user => user.length > 0)
+  const paths = filter.paths.map(path => path.trim()).filter(path => path.length > 0)
+  const text = filter.text.trim()
+  const after = filter.after.trim()
+  const before = filter.before.trim()
+
+  const args: string[] = []
+  if (users.length > 0 || text.length > 0) {
+    args.push('-i', '-E')
+    for (const user of users) args.push(`--author=${escapeEre(user)}`)
+    if (text.length > 0) args.push(`--grep=${filter.textRegex ? text : escapeEre(text)}`)
+  }
+  if (after.length > 0) args.push(`--since=${expandDay(after, false)}`)
+  if (before.length > 0) args.push(`--until=${expandDay(before, true)}`)
+  if (paths.length > 0) args.push('--', ...paths)
+  return args
+}

package/src/shortlog.ts

@@ -0,0 +1,46 @@
+/**
+ * Author roster from `git shortlog -sne`, for the filter popup's user picker.
+ *
+ * The REF the roster walks is the caller's choice (the host passes the same
+ * ref the history list walks, or `--all` in All-branches mode); shortlog
+ * already did the aggregation, and this module only parses its fixed shape
+ * (`<count>  <name> <<email>>`), sorts by activity and applies the cap — with
+ * the cap VISIBLE, because a filter popup that silently lost the long tail of
+ * occasional committers would be quietly wrong about who exists.
+ *
+ * @module @young1lin/dsh-ui-gitworkbench/shortlog
+ */
+
+/** One author as the picker shows them. JSON-safe; count is a plain number. */
+export interface AuthorEntry {
+  readonly name: string
+  readonly email: string
+  /** Commits in the walked ref set — the picker's sort key. */
+  readonly count: number
+}
+
+/**
+ * Parse shortlog output into busiest-first authors, capped.
+ * @param stdout - `git shortlog -sne <ref>` output (the ref is the caller's choice).
+ * @param limit - how many authors to keep; the busier half survives.
+ * @returns the roster and whether it was cut short.
+ */
+export function parseShortlog(stdout: string, limit: number): { authors: AuthorEntry[]; truncated: boolean } {
+  const authors: AuthorEntry[] = []
+  for (const line of stdout.split('\n')) {
+    const match = /^\s*(\d+)\s+(.+)$/.exec(line)
+    if (match === null) continue
+    const count = Number(match[1])
+    const who = match[2]!
+    // The email is the LAST <...> on the line; a name may legally contain
+    // anything else.
+    const emailMatch = /<([^>]*)>\s*$/.exec(who)
+    if (emailMatch === null) continue
+    const name = who.slice(0, emailMatch.index).trim()
+    if (name.length === 0) continue
+    authors.push({ name, email: emailMatch[1]!, count })
+  }
+  authors.sort((a, b) => b.count - a.count)
+  const truncated = authors.length > limit
+  return { authors: truncated ? authors.slice(0, limit) : authors, truncated }
+}