@young1lin/dsh-ui-gitworkbench 0.1.3 → 0.1.5

package/src/fs-remove.ts

@@ -0,0 +1,76 @@
+/**
+ * The one filesystem delete in this plugin, and the checks it carries.
+ *
+ * `discard-ops.ts` plans a delete when git has no copy of a file to restore
+ * from — untracked, or added-but-never-committed. git will not carry that out:
+ * `git clean` refuses paths it cannot index, which on Windows includes every
+ * reserved device name (`nul`, `con`, `aux`, `com1`, and the same names with
+ * any extension). So the removal goes through the filesystem, where git's own
+ * refusal to leave the repository does not apply — hence the checks here
+ * rather than a bare `rm`.
+ *
+ * Lives outside `index.ts` so vitest can load it: the class there needs the
+ * dsh runtime, and the property worth testing is "what does this delete, and
+ * what does it refuse" — a question about paths and the disk, not about RPC.
+ *
+ * @module @young1lin/dsh-ui-gitworkbench/fs-remove
+ */
+
+import { rm } from 'node:fs/promises'
+import { resolve, sep } from 'node:path'
+
+import { isSafeRelativePath } from './discard-ops.js'
+
+/**
+ * Resolve a repo-relative path against the worktree root, refusing to leave it.
+ *
+ * The second lock rather than the only one: {@link isSafeRelativePath} already
+ * rejected traversal spellings when the plan was made. This re-checks the
+ * RESOLVED path, which is the form the filesystem acts on, so a path that
+ * survives the first check by being spelled unusually still has to land inside
+ * the root to be acted on.
+ *
+ * @param root - the worktree directory, absolute.
+ * @param relative - repo-relative path from a plan step.
+ * @returns the absolute path to act on.
+ * @throws if the path is not a safe relative path, resolves outside the root,
+ *         or IS the root.
+ */
+export function resolveInside(root: string, relative: string): string {
+  if (!isSafeRelativePath(relative)) {
+    throw new Error(`unsafe path to delete: ${JSON.stringify(relative)}`)
+  }
+  const base = resolve(root)
+  const target = resolve(base, relative)
+  if (target === base) throw new Error('refusing to delete the worktree root')
+  if (!target.startsWith(base + sep)) {
+    throw new Error(`refusing to delete outside the worktree: ${JSON.stringify(relative)}`)
+  }
+  return target
+}
+
+/**
+ * Remove one entry from the worktree, having proven it is inside it.
+ *
+ * `recursive` is not a widening of the blast radius: `resolveInside` has
+ * already pinned the target to one path git named, and git names a DIRECTORY
+ * whenever it will not look inside one — an untracked nested repository is
+ * reported as `sub/`, with no per-file lines even under
+ * `--untracked-files=all`. Without `recursive` that row is the only one in the
+ * drawer whose roll-back fails, and it fails as `EISDIR`, which says nothing
+ * to the person who clicked it.
+ *
+ * `force` makes an absent entry a success: the reader asked for it to be gone,
+ * and it is.
+ *
+ * A symlinked directory inside the worktree could still point outward; that is
+ * a repository someone already has write access to, and resolving link targets
+ * per segment on every delete would cost a stat per segment for a case git
+ * itself does not defend against.
+ *
+ * @param root - the worktree directory, absolute.
+ * @param relative - repo-relative path from a plan step.
+ */
+export async function removePathInside(root: string, relative: string): Promise<void> {
+  await rm(resolveInside(root, relative), { recursive: true, force: true })
+}

package/src/git-log.ts

@@ -14,6 +14,20 @@ export interface GitCommit {
   readonly subject: string
   readonly when: string
   readonly body: string
+  /**
+   * Author name (`%an`) — who wrote the change. The history filter matches it.
+   */
+  readonly authorName: string
+  /**
+   * Committer name (`%cn`) — who applied it. Equals the author in most repos;
+   * differs on rebases, cherry-picks and patches applied by a maintainer.
+   */
+  readonly committerName: string
+  /**
+   * Committer date as strict ISO 8601 (`%cI`) — the exact moment, same clock
+   * `when` summarizes. Rendered client-side in the viewer's own timezone.
+   */
+  readonly dateIso: string
   /**
    * Abbreviated parent hashes, in git's order — first parent first. This is the
    * DAG: the commit graph is drawn from nothing else. Empty for a root commit.
@@ -27,13 +41,14 @@ export interface GitCommit {
 }
 
 /**
- * Pretty format: RS, hash, when, subject, parents, refs, body.
+ * Pretty format: RS, hash, when, subject, parents, refs, author, committer,
+ * ISO date, body.
  *
  * `body` stays last because it is the only field that may contain newlines;
- * anything after it would have to survive them. Parents (`%p`) and refs (`%D`)
- * are single-line by construction.
+ * anything after it would have to survive them. Parents (`%p`), refs (`%D`),
+ * names (`%an`, `%cn`) and the ISO date (`%cI`) are single-line by construction.
  */
-export const LOG_FORMAT = '%x1e%h%x1f%cr%x1f%s%x1f%p%x1f%D%x1f%b'
+export const LOG_FORMAT = '%x1e%h%x1f%cr%x1f%s%x1f%p%x1f%D%x1f%an%x1f%cn%x1f%cI%x1f%b'
 
 /**
  * Split `%D` into plain ref names.
@@ -76,8 +91,11 @@ export function parseLog(stdout: string): GitCommit[] {
     const subject = (parts[2] ?? '').replace(/\n+$/g, '')
     const parents = (parts[3] ?? '').trim().split(/\s+/).filter(part => part.length > 0)
     const refs = parseRefs(parts[4] ?? '')
-    const body = (parts[5] ?? '').replace(/^\n+/, '').replace(/\n+$/g, '')
-    if (hash.length > 0) out.push({ hash, subject, when, body, parents, refs })
+    const authorName = parts[5] ?? ''
+    const committerName = parts[6] ?? ''
+    const dateIso = parts[7] ?? ''
+    const body = (parts[8] ?? '').replace(/^\n+/, '').replace(/\n+$/g, '')
+    if (hash.length > 0) out.push({ hash, subject, when, body, authorName, committerName, dateIso, parents, refs })
   }
   return out
 }

package/src/git-ops.ts

@@ -13,8 +13,12 @@
  *     of that. A file may legitimately be named `-f`, and passed positionally
  *     it becomes an option instead of a path.
  *   - Nothing here builds a destructive command. There is no `--force`, no
- *     `reset --hard`, no `clean`. Losing committed work needs a confirmation
- *     design of its own, not a button that happens to be adjacent to Push.
+ *     `reset --hard`, no `clean`. The one action that does lose work — rolling
+ *     one file back — lives in `discard-ops.ts` instead, behind the
+ *     confirmation design this rule demanded: git's own reading of the file
+ *     rather than the client's claim, `git restore` scoped to a single
+ *     pathspec as the whole vocabulary, and a dialog that names the
+ *     consequence. It is deliberately not a button adjacent to Push.
  *
  * @module
  */
@@ -341,16 +345,44 @@ export function parseNumstat(stdout: string): Map<string, NumstatEntry> {
   return out
 }
 
+/** One porcelain line, split into the parts a caller can act on. */
+export interface StatusLine {
+  /** The two status columns, e.g. ` M`, `??`, `R `. */
+  readonly xy: string
+  /** The path git reports the file under NOW — the rename target, if renamed. */
+  readonly path: string
+  /** For a rename, the path HEAD still knows the file by; '' otherwise. */
+  readonly previousPath: string
+  readonly renamed: boolean
+}
+
+/**
+ * Split one `git status --porcelain=v1` line.
+ *
+ * Exported because more than the file list needs it: `discard-ops` plans from
+ * the RAW XY pair, which {@link parseStatus} folds away into a
+ * {@link GitFileStatus}. Sharing this keeps the quoting and `old -> new`
+ * handling in one place — a second implementation of it is how a path with a
+ * non-ASCII name ends up being acted on unescaped.
+ * @param line - one output line, branch header and blanks included.
+ * @returns the split, or null for a line that names no file.
+ */
+export function parseStatusLine(line: string): StatusLine | null {
+  if (line.length === 0 || line.startsWith('##')) return null
+  if (line.length < 3) return null
+  const { path, previousPath, renamed } = parsePath(line.slice(3))
+  if (path.length === 0) return null
+  return { xy: line.slice(0, 2), path, previousPath, renamed }
+}
+
 /** Parse porcelain lines into a MUTABLE file list — untracked entries get their
  * counts filled in by the synthesis pass afterwards. */
 export function parseStatus(stdout: string, numstat: Map<string, NumstatEntry>): MutableGitFile[] {
   const files: MutableGitFile[] = []
   for (const line of stdout.split('\n')) {
-    if (line.length === 0 || line.startsWith('##')) continue
-    if (line.length < 3) continue
-    const xy = line.slice(0, 2)
-    const { path, previousPath, renamed } = parsePath(line.slice(3))
-    if (path.length === 0) continue
+    const parsed = parseStatusLine(line)
+    if (parsed === null) continue
+    const { xy, path, previousPath, renamed } = parsed
     const counts = numstat.get(path) ?? { added: 0, deleted: 0, binary: false }
     const { staged, unstaged } = stageStateOf(xy)
     const base: MutableGitFile = {

package/src/index.ts

@@ -59,7 +59,14 @@ import {
   type GitFile, type GitFileStatus, type MutableGitFile,
   type OpFailure, type PullMode, type Tracking,
 } from './git-ops.js'
+import {
+  planFromStatus,
+  type DiscardEffect, type DiscardPlan,
+} from './discard-ops.js'
+import { removePathInside } from './fs-remove.js'
 import { LOG_FORMAT, parseLog, type GitCommit } from './git-log.js'
+import { emptyLogFilter, logFilterArgs, type LogFilter } from './log-filter.js'
+import { parseShortlog, type AuthorEntry } from './shortlog.js'
 import {
   isBlankEntry, loadStyle, sanitizeEntry, stylePath,
   type StyleEntry, type StyleFile,
@@ -71,6 +78,7 @@ import {
 
 export type { WorktreeBinding, WorktreeOpResult }
 export type { GitFile, GitFileStatus }
+export type { DiscardEffect }
 export type { StyleEntry }
 
 /** Cap the bundled unified diff so a huge change cannot blow the RPC response. */
@@ -90,6 +98,12 @@ const HISTORY_COMMITS = 20
 const HISTORY_PAGE = 30
 /** Upper bound on a caller-supplied page size. */
 const HISTORY_PAGE_MAX = 200
+/** Author roster cap: the busiest 500 — enough for any real project's people,
+ *  and a list a popup can scroll without choking. */
+const SHORTLOG_CAP = 500
+/** Path list cap for the picker: a monorepo can outrun any popup; past this
+ *  the tree is cut and the truncation reported, never silent. */
+const TREE_PATH_CAP = 50_000
 /**
  * Most branch names sent to the browser. `worktreeStatus` is polled, so an
  * unbounded list would repeat on the wire every few seconds; the picker reports
@@ -524,16 +538,23 @@ export class GitWorkbenchService extends TypertRemoteService {
    * @param ref - ref to walk; empty means the worktree's own HEAD.
    * @param skip - commits to skip, counting back from the ref.
    * @param limit - page size; out-of-range values fall back to the default page.
+   * @param filter - history filter compiled into git log arguments (IDEA-style
+   *   pushdown: matching runs over ALL history, not the loaded pages). Absent
+   *   from older clients — treated as "no filter".
    * @param signal - abort signal.
    * @returns the page, and whether the log continues past it.
    */
   @Remote('commits')
-  async commits(worktreePath: string, ref: string, skip: number, limit: number, signal: AbortSignal): Promise<{ commits: GitCommit[]; hasMore: boolean }> {
+  async commits(worktreePath: string, ref: string, skip: number, limit: number, filter: LogFilter, signal: AbortSignal): Promise<{ commits: GitCommit[]; hasMore: boolean; error?: string }> {
     const cwd = typeof worktreePath === 'string' && worktreePath.length > 0 ? worktreePath : process.cwd()
-    const target = typeof ref === 'string' && ref.length > 0 ? ref : 'HEAD'
-    if (!isRefName(target)) return { commits: [], hasMore: false }
+    // '--all' is the ALL-BRANCHES sentinel (a ref cannot begin with a dash, so
+    // it collides with nothing): "who did what" must not require knowing which
+    // branch holds it — IDEA's All branches, same idea.
+    const target = ref === '--all' ? '--all' : (typeof ref === 'string' && ref.length > 0 ? ref : 'HEAD')
+    if (target !== '--all' && !isRefName(target)) return { commits: [], hasMore: false }
     const from = Number.isInteger(skip) && skip >= 0 ? skip : 0
     const size = Number.isInteger(limit) && limit > 0 && limit <= HISTORY_PAGE_MAX ? limit : HISTORY_PAGE
+    const effective = filter ?? emptyLogFilter()
     // Reading one row beyond the page answers "is there more" without a second
     // traversal of the log.
     //
@@ -543,15 +564,67 @@ export class GitWorkbenchService extends TypertRemoteService {
     // a dozen unrelated rows, and closes far from where it started. Topological
     // order keeps a branch's commits contiguous — it is what `git log --graph`
     // turns on for itself, for the same reason.
+    //
+    // Filter args go LAST: their segment ends with `--` + pathspecs, and
+    // nothing after that separator may be parsed as a flag.
     const log = await this.git(
       cwd,
-      ['log', target, '--topo-order', `--skip=${from}`, `-${size + 1}`, `--pretty=format:${LOG_FORMAT}`],
+      ['log', target, '--topo-order', `--skip=${from}`, `-${size + 1}`, `--pretty=format:${LOG_FORMAT}`, ...logFilterArgs(effective)],
       signal,
     )
+    // A bad filter (unparsable regex, invalid date) dies here, and an empty
+    // page is indistinguishable from "no match" unless the failure speaks —
+    // §6.13: the exit code + stderr tail is the only honest answer.
+    if (log.exitCode !== 0) {
+      const detail = log.stderr.length > 0 ? `: ${log.stderr.slice(-160)}` : ''
+      return { commits: [], hasMore: false, error: `git log failed (exit ${log.exitCode})${detail}` }
+    }
     const page = parseLog(log.stdout)
     return { commits: page.slice(0, size), hasMore: page.length > size }
   }
 
+  /**
+   * Every author with commits reachable from a ref, busiest first — the
+   * history filter popup's user picker.
+   *
+   * The roster walks the SAME ref the history list walks (`git shortlog -sne
+   * <ref>`), not `--all`: a picker entry is a promise that ticking it yields
+   * commits in the list below. `--all` once listed authors whose commits live
+   * only on other refs — visible in the menu, invisible to every search.
+   * @param worktreePath - worktree whose object store resolves the ref; empty falls back to the host cwd.
+   * @param ref - ref whose history the roster counts; empty means HEAD.
+   * @param signal - abort signal.
+   */
+  @Remote('authors')
+  async authors(worktreePath: string, ref: string, signal: AbortSignal): Promise<{ authors: AuthorEntry[]; truncated: boolean }> {
+    const cwd = typeof worktreePath === 'string' && worktreePath.length > 0 ? worktreePath : process.cwd()
+    // Same '--all' sentinel as `commits`: when the list walks every ref, the
+    // roster counts every ref — the picker and the list stay one claim.
+    const target = ref === '--all' ? '--all' : (typeof ref === 'string' && ref.length > 0 ? ref : 'HEAD')
+    if (target !== '--all' && !isRefName(target)) return { authors: [], truncated: false }
+    const res = await this.git(cwd, ['shortlog', '-sne', target], signal)
+    return parseShortlog(res.stdout, SHORTLOG_CAP)
+  }
+
+  /**
+   * Every file path on HEAD — the filter popup's path picker, aggregated into
+   * a directory tree client-side.
+   *
+   * `-z` is load-bearing: NUL-separated output is UNQUOTED, while the default
+   * would render non-ASCII names as quoted octal escapes under
+   * `core.quotepath` and hand the picker garbage.
+   * @param worktreePath - worktree whose HEAD is listed; empty falls back to the host cwd.
+   * @param signal - abort signal.
+   */
+  @Remote('repoTree')
+  async repoTree(worktreePath: string, signal: AbortSignal): Promise<{ paths: string[]; truncated: boolean }> {
+    const cwd = typeof worktreePath === 'string' && worktreePath.length > 0 ? worktreePath : process.cwd()
+    const res = await this.git(cwd, ['ls-tree', '-r', '-z', '--name-only', 'HEAD'], signal)
+    const all = res.stdout.split('\0').filter(path => path.length > 0)
+    const truncated = all.length > TREE_PATH_CAP
+    return { paths: truncated ? all.slice(0, TREE_PATH_CAP) : all, truncated }
+  }
+
   /**
    * Compare two refs, in the same {@link WorkbenchStats} shape as every other view.
    *
@@ -882,6 +955,120 @@ export class GitWorkbenchService extends TypertRemoteService {
     return this.writeOp(worktreePath, () => unstageArgv(asPathList(paths)), signal)
   }
 
+  /**
+   * What discarding this file WOULD do, without doing it.
+   *
+   * The confirmation has to state the real consequence, and only git knows it:
+   * the drawer's own file list is a poll old, and the difference between "this
+   * goes back to its committed content" and "this file leaves the disk and
+   * cannot come back" is exactly the difference the reader is being asked
+   * about. So the dialog is built from this, read fresh, rather than from the
+   * row that was clicked.
+   * @param worktreePath - directory to run in.
+   * @param path - repository-relative path, as the drawer lists it.
+   * @param signal - abort signal.
+   * @returns the effect and whether it is irreversible; `effect` is absent when
+   *          git reports nothing to discard for that path.
+   */
+  @Remote('discardPlan')
+  async discardPlan(worktreePath: string, path: string, signal: AbortSignal): Promise<{
+    effect?: DiscardEffect
+    irreversible?: boolean
+    previousPath?: string
+    error?: string
+  }> {
+    let plan: DiscardPlan | null
+    try {
+      plan = await this.planDiscard(worktreePath, path, signal)
+    } catch (error) {
+      return { error: error instanceof Error ? error.message : String(error) }
+    }
+    if (plan === null) return {}
+    // JSON-safe: an absent previousPath is an omitted key, never `undefined`.
+    return plan.previousPath !== undefined
+      ? { effect: plan.effect, irreversible: plan.irreversible, previousPath: plan.previousPath }
+      : { effect: plan.effect, irreversible: plan.irreversible }
+  }
+
+  /**
+   * Take one file back to its committed state — IntelliJ's Rollback.
+   *
+   * One path per call, never a list. Discarding is the only thing the drawer
+   * does that cannot be undone, and a batch entry point is the shape that
+   * turns one mistaken click into a lost afternoon; a caller that wants two
+   * files asks twice, and gets asked twice.
+   *
+   * The plan is re-derived here from a fresh `git status`, so a client that
+   * mislabels a tracked file as untracked cannot talk the host into deleting
+   * it. `expectedEffect` is what the reader was shown and agreed to: if the
+   * file changed underneath the dialog — staged, edited, reverted by someone
+   * else — the freshly derived effect no longer matches and nothing is done.
+   * @param worktreePath - directory to run in.
+   * @param path - repository-relative path, as the drawer lists it.
+   * @param expectedEffect - the effect the confirmation stated; blank skips
+   *                         the agreement check, which only the reversible
+   *                         `recover` path takes (it shows no dialog).
+   * @param signal - abort signal.
+   * @returns the operation result, with the effect actually carried out.
+   */
+  @Remote('discardFile')
+  async discardFile(worktreePath: string, path: string, expectedEffect: string | undefined, signal: AbortSignal): Promise<GitOpResult & { effect?: DiscardEffect }> {
+    let plan: DiscardPlan | null
+    try {
+      plan = await this.planDiscard(worktreePath, path, signal)
+    } catch (error) {
+      return { ok: false, failure: 'unknown', error: error instanceof Error ? error.message : String(error) }
+    }
+    // Nothing to discard is not a failure: the row was stale, and the tree the
+    // client refreshes onto will simply no longer carry it.
+    if (plan === null) return { ok: true }
+    if (typeof expectedEffect === 'string' && expectedEffect.length > 0 && expectedEffect !== plan.effect) {
+      return {
+        ok: false,
+        failure: 'unknown',
+        error: `this file changed since you were asked (now: ${plan.effect}); nothing was done`,
+      }
+    }
+
+    const cwd = this.cwdOf(worktreePath)
+    for (const step of plan.steps) {
+      if (step.kind === 'git') {
+        const result = await this.git(cwd, step.argv, signal)
+        const failure = classifyFailure(result.exitCode, result.stderr, result.stdout)
+        if (failure !== null) {
+          return { ok: false, failure, error: (result.stderr || result.stdout).trim().slice(-1000) }
+        }
+        continue
+      }
+      try {
+        await removePathInside(cwd, step.path)
+      } catch (error) {
+        return { ok: false, failure: 'unknown', error: error instanceof Error ? error.message : String(error) }
+      }
+    }
+    return { ok: true, effect: plan.effect }
+  }
+
+  /**
+   * Read the worktree's status and plan for one path.
+   *
+   * The status is the WHOLE tree's, deliberately: git pairs a deletion with an
+   * addition to see a rename, and a pathspec that admits only one of the pair
+   * reports `D` plus `??` instead — which plans as "restore one, DELETE the
+   * other" where the truth is "undo the rename".
+   */
+  private async planDiscard(worktreePath: string, path: string, signal: AbortSignal): Promise<DiscardPlan | null> {
+    if (typeof path !== 'string' || !isSafePathArg(path)) {
+      throw new Error(`unsafe path argument: ${JSON.stringify(path)}`)
+    }
+    const cwd = this.cwdOf(worktreePath)
+    const status = await this.git(cwd, ['status', '--porcelain=v1', '--untracked-files=all'], signal)
+    if (status.exitCode !== 0) {
+      throw new Error((status.stderr || status.stdout).trim().slice(-1000) || 'git status failed')
+    }
+    return planFromStatus(status.stdout, path)
+  }
+
   /**
    * Commit what is in the index.
    * @param worktreePath - directory to run in.

package/src/log-filter.ts

@@ -0,0 +1,87 @@
+/**
+ * The history filter, compiled into `git log` arguments.
+ *
+ * This is the pushdown half of the IDEA-style filter: matching runs inside
+ * `git log` over ALL history, not client-side over the loaded pages — the
+ * loaded-pages blind spot is the reason this module exists. Everything here is
+ * pure so the argument matrix is testable without spawning git.
+ *
+ * DIALECT RULE: whenever any pattern is emitted, the flags are `-i -E` and
+ * every literal input is escaped for POSIX ERE. Mixing `--fixed-strings` with
+ * `-E` is not possible (one overrides the other for EVERY pattern on the
+ * command line), so a single dialect keeps users literal no matter what the
+ * text criterion's regex toggle says; regex text alone is passed raw.
+ *
+ * Dates pass through verbatim: approxidate ("2 weeks ago") is git's language,
+ * and reimplementing even a slice of it client-side is how the dual-semantics
+ * bug farm starts. An invalid date is git's error to raise, surfaced by the
+ * host's usual exit-code + stderr format.
+ *
+ * @module @young1lin/dsh-ui-gitworkbench/log-filter
+ */
+
+/** One history query, as the client sends it. JSON-safe: strings and booleans only. */
+export interface LogFilter {
+  /** Author names, matched case-insensitively as literal substrings. Multiple = OR (git semantics, IDEA parity). */
+  readonly users: readonly string[]
+  /** Commit-message pattern. Empty string means no text criterion. */
+  readonly text: string
+  /** Interpret {@link text} as an ERE instead of a literal substring. */
+  readonly textRegex: boolean
+  /** Pathspecs, multiple = union (a commit touching ANY of them matches). */
+  readonly paths: readonly string[]
+  /** Inclusive lower bound, approxidate text. Empty means unbounded. */
+  readonly after: string
+  /** Exclusive upper bound, approxidate text. Empty means unbounded. */
+  readonly before: string
+}
+
+/** The filter that filters nothing — also the default when a client sends none. */
+export function emptyLogFilter(): LogFilter {
+  return { users: [], text: '', textRegex: false, paths: [], after: '', before: '' }
+}
+
+/** POSIX ERE metacharacters, escaped so each matches itself. */
+function escapeEre(literal: string): string {
+  return literal.replace(/[\\.[\]*+?(){}|^$-]/g, '\\$&')
+}
+
+const DAY_RE = /^\d{4}-\d{2}-\d{2}$/
+
+/**
+ * Expand a bare calendar day into an explicit moment. Git's approxidate
+ * parses `--since=2026-08-18` against an implementation-defined timezone,
+ * which on Windows silently excludes that very day's commits; `T00:00:00`
+ * pins it to local midnight (a picker day means the whole day, so `before`
+ * gets the day's last second instead).
+ */
+function expandDay(bound: string, endOfDay: boolean): string {
+  if (!DAY_RE.test(bound)) return bound
+  return endOfDay ? `${bound}T23:59:59` : `${bound}T00:00:00`
+}
+
+/**
+ * Compile a filter into the argument segment inserted after the log command's
+ * own flags. Pathspecs come last behind a bare `--`, so the CALLER must place
+ * this segment at the end of the argument list.
+ * @param filter - the query; blank entries are dropped, not turned into empty
+ *   patterns (an empty `--author=` would match nothing).
+ */
+export function logFilterArgs(filter: LogFilter): string[] {
+  const users = filter.users.map(user => user.trim()).filter(user => user.length > 0)
+  const paths = filter.paths.map(path => path.trim()).filter(path => path.length > 0)
+  const text = filter.text.trim()
+  const after = filter.after.trim()
+  const before = filter.before.trim()
+
+  const args: string[] = []
+  if (users.length > 0 || text.length > 0) {
+    args.push('-i', '-E')
+    for (const user of users) args.push(`--author=${escapeEre(user)}`)
+    if (text.length > 0) args.push(`--grep=${filter.textRegex ? text : escapeEre(text)}`)
+  }
+  if (after.length > 0) args.push(`--since=${expandDay(after, false)}`)
+  if (before.length > 0) args.push(`--until=${expandDay(before, true)}`)
+  if (paths.length > 0) args.push('--', ...paths)
+  return args
+}

package/src/shortlog.ts

@@ -0,0 +1,46 @@
+/**
+ * Author roster from `git shortlog -sne`, for the filter popup's user picker.
+ *
+ * The REF the roster walks is the caller's choice (the host passes the same
+ * ref the history list walks, or `--all` in All-branches mode); shortlog
+ * already did the aggregation, and this module only parses its fixed shape
+ * (`<count>  <name> <<email>>`), sorts by activity and applies the cap — with
+ * the cap VISIBLE, because a filter popup that silently lost the long tail of
+ * occasional committers would be quietly wrong about who exists.
+ *
+ * @module @young1lin/dsh-ui-gitworkbench/shortlog
+ */
+
+/** One author as the picker shows them. JSON-safe; count is a plain number. */
+export interface AuthorEntry {
+  readonly name: string
+  readonly email: string
+  /** Commits in the walked ref set — the picker's sort key. */
+  readonly count: number
+}
+
+/**
+ * Parse shortlog output into busiest-first authors, capped.
+ * @param stdout - `git shortlog -sne <ref>` output (the ref is the caller's choice).
+ * @param limit - how many authors to keep; the busier half survives.
+ * @returns the roster and whether it was cut short.
+ */
+export function parseShortlog(stdout: string, limit: number): { authors: AuthorEntry[]; truncated: boolean } {
+  const authors: AuthorEntry[] = []
+  for (const line of stdout.split('\n')) {
+    const match = /^\s*(\d+)\s+(.+)$/.exec(line)
+    if (match === null) continue
+    const count = Number(match[1])
+    const who = match[2]!
+    // The email is the LAST <...> on the line; a name may legally contain
+    // anything else.
+    const emailMatch = /<([^>]*)>\s*$/.exec(who)
+    if (emailMatch === null) continue
+    const name = who.slice(0, emailMatch.index).trim()
+    if (name.length === 0) continue
+    authors.push({ name, email: emailMatch[1]!, count })
+  }
+  authors.sort((a, b) => b.count - a.count)
+  const truncated = authors.length > limit
+  return { authors: truncated ? authors.slice(0, limit) : authors, truncated }
+}