@youweichen/pi-harness 0.0.0-stage → 1.0.0

package/dist/server/scm.js

@@ -0,0 +1,459 @@
+/**
+ * Read-only git queries backing the source-control panel.
+ *
+ * Replaces the old hidden-PTY + text-scraping approach: every query is a
+ * plain `execFile("git", …)` — no shell, no prompts, no echo, no sentinel
+ * parsing. Output is parsed into structured JSON on the server; the client
+ * just renders it.
+ */
+import { execFile } from "node:child_process";
+import { lstat, open, realpath, stat } from "node:fs/promises";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { promisify } from "node:util";
+import { decodeText, looksLikeText } from "./text-sniff.js";
+const exec = promisify(execFile);
+/** Per-command timeout / output cap — a stuck repo must not hang the panel. */
+const GIT_TIMEOUT_MS = 15_000;
+const MAX_GIT_OUTPUT = 16 * 1024 * 1024;
+const MAX_UNTRACKED_PREVIEW_BYTES = 512 * 1024;
+/** Untracked files shown in the whole-scope diff; the rest are only counted. */
+const MAX_DIFF_UNTRACKED_FILES = 500;
+class GitOutputTooLarge extends Error {
+}
+/** Run one git command; throws Error with a readable message on failure. */
+async function git(cwd, args) {
+    try {
+        const command = exec("git", ["-c", "core.quotepath=false", ...args], {
+            cwd,
+            timeout: GIT_TIMEOUT_MS,
+            maxBuffer: MAX_GIT_OUTPUT,
+            windowsHide: true,
+        });
+        command.child.stdin?.end();
+        const { stdout } = await command;
+        return stdout;
+    }
+    catch (err) {
+        const e = err;
+        if (e.code === "ENOENT")
+            throw new Error("未找到 git 命令——请确认已安装 Git 并在 PATH 中");
+        if (e.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER")
+            throw new GitOutputTooLarge("git 输出超过 16 MiB");
+        if (e.killed)
+            throw new Error("git 命令超时");
+        const detail = (e.stderr ?? e.message ?? "").trim().split("\n")[0];
+        throw new Error(detail || "git 命令失败");
+    }
+}
+/** Absolute path of the repo's git dir (handles worktrees/submodules), or
+ *  null when cwd isn't inside a repository. */
+export async function gitDirOf(cwd) {
+    try {
+        const { stdout } = await exec("git", ["rev-parse", "--absolute-git-dir"], {
+            cwd,
+            timeout: 5_000,
+            windowsHide: true,
+        });
+        return stdout.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+/** True when the error is "this directory isn't a git repository". */
+export function isNotRepoError(err) {
+    return /not a git repository/i.test(err instanceof Error ? err.message : String(err));
+}
+/* ------------------------------------------------------------------ */
+/* parsers                                                             */
+/* ------------------------------------------------------------------ */
+/** Undo git's C-style quoting for unusual file names ("a\tb" → a<TAB>b).
+ *  core.quotepath=false already handles non-ASCII; this covers control chars. */
+function unquotePath(s) {
+    if (!s.startsWith('"'))
+        return s;
+    const inner = s.endsWith('"') ? s.slice(1, -1) : s.slice(1);
+    return inner.replace(/\\(.)/g, (_m, c) => {
+        switch (c) {
+            case "n": return "\n";
+            case "t": return "\t";
+            case "r": return "\r";
+            case "b": return "\b";
+            case "a": return "\a";
+            case "f": return "\f";
+            case "v": return "\v";
+            case "\\": return "\\";
+            case '"': return '"';
+            default: return c;
+        }
+    });
+}
+function parseStatusHeader(rest) {
+    const out = {
+        branch: "HEAD",
+        detached: false,
+        upstream: null,
+        ahead: 0,
+        behind: 0,
+        upstreamGone: false,
+    };
+    let branchPart = rest;
+    let flags = "";
+    const bi = rest.indexOf(" [");
+    if (bi >= 0) {
+        branchPart = rest.slice(0, bi);
+        flags = rest.slice(bi + 2);
+        if (flags.endsWith("]"))
+            flags = flags.slice(0, -1);
+    }
+    if (branchPart === "HEAD (no branch)" || branchPart === "HEAD") {
+        out.detached = true;
+    }
+    else {
+        if (branchPart.startsWith("No commits yet on "))
+            branchPart = branchPart.slice("No commits yet on ".length);
+        const up = branchPart.indexOf("...");
+        if (up >= 0) {
+            out.branch = branchPart.slice(0, up);
+            out.upstream = branchPart.slice(up + 3);
+        }
+        else {
+            out.branch = branchPart;
+        }
+    }
+    if (flags) {
+        for (const part of flags.split(",")) {
+            const p = part.trim();
+            const m = p.match(/^(ahead|behind) (\d+)$/);
+            if (m) {
+                if (m[1] === "ahead")
+                    out.ahead = Number(m[2]);
+                else
+                    out.behind = Number(m[2]);
+            }
+            else if (p === "gone") {
+                out.upstreamGone = true;
+            }
+        }
+    }
+    return out;
+}
+function parseStatusFiles(text) {
+    const out = [];
+    for (const rawLine of text.split("\n")) {
+        const line = rawLine.trimEnd();
+        if (!line || line.startsWith("## "))
+            continue;
+        if (line.length >= 3) {
+            let path = line.slice(3);
+            const arrow = path.indexOf(" -> "); // rename: "R  old -> new"
+            if (arrow >= 0)
+                path = path.slice(arrow + 4);
+            out.push({ path: unquotePath(path), x: line[0], y: line[1] });
+        }
+    }
+    return out;
+}
+function parseBranches(text) {
+    const out = [];
+    for (const line of text.split("\n")) {
+        const parts = line.split("\t");
+        if (parts.length < 2)
+            continue;
+        const ref = parts[0];
+        const isHead = parts[1] === "*";
+        if (ref.startsWith("refs/heads/")) {
+            out.push({ name: ref.slice("refs/heads/".length), current: isHead });
+        }
+        else if (ref.startsWith("refs/remotes/")) {
+            const short = ref.slice("refs/remotes/".length);
+            // Skip the "origin/HEAD -> origin/main" symlink.
+            if (short.endsWith("/HEAD"))
+                continue;
+            const slash = short.indexOf("/");
+            out.push({
+                name: short,
+                current: false,
+                remote: slash > 0 ? short.slice(0, slash) : true,
+            });
+        }
+    }
+    return out;
+}
+/** Parse `git log --graph --pretty=format:%H%x09…` preserving graph prefixes. */
+function parseCommitHistory(text) {
+    const out = [];
+    for (const line of text.split("\n")) {
+        const tab = line.indexOf("\t");
+        if (tab < 0)
+            continue; // connector-only graph line
+        const prefixAndHash = line.slice(0, tab);
+        const match = prefixAndHash.match(/([0-9a-f]{7,40})$/i);
+        if (!match || match.index === undefined)
+            continue;
+        const fields = line.slice(tab + 1).split("\t");
+        // An empty decoration field removes the final tab — four fields is a
+        // valid undecorated commit.
+        if (fields.length < 4)
+            continue;
+        out.push({
+            hash: match[1],
+            shortHash: fields[0],
+            author: fields[1],
+            date: fields[2],
+            subject: fields[3],
+            decorations: fields[4] ?? "",
+            graph: prefixAndHash.slice(0, match.index),
+        });
+    }
+    return out;
+}
+/** Parse `git diff --numstat` output: "12\t3\tpath" → { path: [add, del] }. */
+function parseNumStat(text) {
+    const stats = {};
+    for (const line of text.split("\n")) {
+        if (!line.trim())
+            continue;
+        const tab1 = line.indexOf("\t");
+        const tab2 = tab1 < 0 ? -1 : line.indexOf("\t", tab1 + 1);
+        if (tab2 < 0)
+            continue;
+        let add = Number(line.slice(0, tab1));
+        let del = Number(line.slice(tab1 + 1, tab2));
+        if (!Number.isFinite(add))
+            add = 0; // binary file → "-"
+        if (!Number.isFinite(del))
+            del = 0;
+        const path = unquotePath(line.slice(tab2 + 1).trim());
+        const prev = stats[path];
+        stats[path] = [
+            (prev?.[0] ?? 0) + add,
+            (prev?.[1] ?? 0) + del,
+        ];
+    }
+    return stats;
+}
+/* ------------------------------------------------------------------ */
+/* queries                                                             */
+/* ------------------------------------------------------------------ */
+const HISTORY_ARGS = [
+    "log",
+    "--all",
+    "--graph",
+    "--decorate=short",
+    "--date=short",
+    "--pretty=format:%H%x09%h%x09%an%x09%ad%x09%s%x09%D",
+    "-n",
+    "120",
+];
+/** Commit graph for the history tab — fetched lazily so the common
+ *  "changes" view never pays for it on huge repos. */
+export async function scmHistory(cwd) {
+    return parseCommitHistory(await git(cwd, HISTORY_ARGS));
+}
+/** Status refresh payload (status + branches + numstat) — parallel. */
+export async function scmStatus(cwd) {
+    const [statusText, branchText, statText, cachedStatText] = await Promise.all([
+        git(cwd, ["status", "--porcelain=v1", "-b", "--find-renames"]),
+        git(cwd, [
+            "for-each-ref",
+            "refs/heads",
+            "refs/remotes",
+            "--format=%(refname)%09%(HEAD)",
+        ]),
+        git(cwd, ["diff", "--numstat"]),
+        git(cwd, ["diff", "--cached", "--numstat"]),
+    ]);
+    const header = parseStatusHeader(statusText.split("\n").find((l) => l.startsWith("## "))?.slice(3) ?? "");
+    // Worktree + staged line counts, merged per path.
+    const merged = {};
+    for (const [path, pair] of Object.entries(parseNumStat(statText))) {
+        merged[path] = pair;
+    }
+    for (const [path, pair] of Object.entries(parseNumStat(cachedStatText))) {
+        const prev = merged[path];
+        merged[path] = [(prev?.[0] ?? 0) + pair[0], (prev?.[1] ?? 0) + pair[1]];
+    }
+    const branches = parseBranches(branchText);
+    const base = (await git(cwd, ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"]).catch(() => "")).trim() || ["main", "master", "develop"].find(name => branches.some(branch => branch.name === name)) || "HEAD";
+    return {
+        base,
+        notRepo: false,
+        branch: header.branch,
+        detached: header.detached,
+        upstream: header.upstream,
+        ahead: header.ahead,
+        behind: header.behind,
+        upstreamGone: header.upstreamGone,
+        files: parseStatusFiles(statusText),
+        branches,
+        stats: merged,
+    };
+}
+/** Staged + worktree diffs, or a bounded preview for an untracked file. */
+export async function scmFileDiff(cwd, path) {
+    const [staged, worktree] = await Promise.all([
+        git(cwd, ["diff", "--cached", "--no-color", "--no-ext-diff", "--", path]).catch(() => ""),
+        git(cwd, ["diff", "--no-color", "--no-ext-diff", "--", path]).catch(() => ""),
+    ]);
+    if (staged || worktree)
+        return { staged, worktree };
+    const others = await git(cwd, ["ls-files", "--others", "--exclude-standard", "--", path]);
+    if (!others.trim())
+        return { staged, worktree };
+    const abs = resolve(cwd, path);
+    const root = await realpath(cwd);
+    const target = await realpath(abs);
+    const rel = relative(root, target);
+    if (isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`))
+        throw new Error("路径超出工作区");
+    const info = await stat(target);
+    if (!info.isFile()) {
+        return { staged, worktree, untracked: true, untrackedKind: "directory" };
+    }
+    const handle = await open(target, "r");
+    try {
+        const buf = Buffer.alloc(Math.min(info.size, MAX_UNTRACKED_PREVIEW_BYTES));
+        const { bytesRead } = await handle.read(buf, 0, buf.length, 0);
+        const data = buf.subarray(0, bytesRead);
+        const isText = looksLikeText(data);
+        return {
+            staged,
+            worktree,
+            untracked: true,
+            untrackedKind: isText ? "text" : "binary",
+            untrackedText: isText ? decodeText(data) : undefined,
+            untrackedTruncated: bytesRead < info.size,
+        };
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Full patch of one commit (`git show`). */
+export async function scmCommitDetail(cwd, hash) {
+    return git(cwd, [
+        "show",
+        "--no-color",
+        "--no-ext-diff",
+        "--find-renames",
+        "--format=fuller",
+        "--stat",
+        "--patch",
+        hash,
+    ]);
+}
+/** Footer metadata only. symbolic-ref also works before the first commit. */
+export async function scmCurrentBranch(cwd) {
+    try {
+        return { branch: (await git(cwd, ["symbolic-ref", "--quiet", "--short", "HEAD"])).trim(), detached: false };
+    }
+    catch {
+        try {
+            return { branch: (await git(cwd, ["rev-parse", "--short", "HEAD"])).trim(), detached: true };
+        }
+        catch {
+            return { branch: null, detached: false, notRepo: (await gitDirOf(cwd)) === null };
+        }
+    }
+}
+/** Untracked file as a unified "new file" patch. Each file is read directly: the
+ * listing already proved it untracked, so no git process is needed per file.
+ * Symlinks are not followed and unreadable files become binary entries, so one
+ * odd file never fails the whole view. */
+async function untrackedPatch(root, path) {
+    const a = JSON.stringify(`a/${path}`), b = JSON.stringify(`b/${path}`);
+    const header = `diff --git ${a} ${b}\nnew file mode 100644\n--- /dev/null\n+++ ${b}\n`;
+    const binary = `${header}Binary files /dev/null and ${b} differ\n`;
+    try {
+        const absolute = resolve(root, path);
+        const rel = relative(root, absolute);
+        if (isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`))
+            return binary;
+        const info = await lstat(absolute);
+        if (!info.isFile())
+            return binary;
+        const handle = await open(absolute, "r");
+        try {
+            const buf = Buffer.alloc(Math.min(info.size, MAX_UNTRACKED_PREVIEW_BYTES));
+            const { bytesRead } = await handle.read(buf, 0, buf.length, 0);
+            const data = buf.subarray(0, bytesRead);
+            if (!looksLikeText(data))
+                return binary;
+            const lines = decodeText(data).replace(/\n$/, "").split("\n");
+            let text = header;
+            if (bytesRead > 0)
+                text += `@@ -0,0 +1,${lines.length} @@\n${lines.map(line => `+${line}`).join("\n")}\n`;
+            if (bytesRead < info.size)
+                text += "\\ Preview truncated\n";
+            return text;
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        return binary;
+    }
+}
+/** Whole-scope patches for the changes panel. Resolve refs before constructing
+ * revision expressions: user input can never become an option or pathspec. */
+export async function scmDiff(cwd, options) {
+    const commit = async (ref) => (await git(cwd, ["rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`])).trim();
+    // Full-file context lets the panel unfold unchanged lines. Large files can
+    // exceed the output cap that way; fall back to normal context instead of failing.
+    const diff = async (range) => {
+        const args = (context) => ["diff", "--no-color", "--no-ext-diff", "--no-textconv", "--find-renames", "--relative", `--unified=${context}`, ...range, "--", "."];
+        try {
+            return { text: await git(cwd, args("100000")), reducedContext: false };
+        }
+        catch (error) {
+            if (!(error instanceof GitOutputTooLarge))
+                throw error;
+        }
+        try {
+            return { text: await git(cwd, args("3")), reducedContext: true };
+        }
+        catch (error) {
+            if (error instanceof GitOutputTooLarge)
+                throw new Error("Diff exceeds 16 MiB; narrow the changes before retrying");
+            throw error;
+        }
+    };
+    if (options.scope === "branch") {
+        let base = options.base;
+        if (!base) {
+            base = (await git(cwd, ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"]).catch(() => "")).trim();
+            if (!base)
+                for (const candidate of ["main", "master", "develop", "HEAD"]) {
+                    if (await commit(candidate).catch(() => "")) {
+                        base = candidate;
+                        break;
+                    }
+                }
+        }
+        if (!base || base.length > 1024 || base.includes("\0"))
+            throw new Error("Invalid base branch");
+        const [baseHash, head] = await Promise.all([commit(base), commit("HEAD")]);
+        const result = await diff([`${baseHash}...${head}`]);
+        return { text: result.text, base, ...(result.reducedContext ? { reducedContext: true } : {}) };
+    }
+    if (options.scope !== "work")
+        throw new Error("Invalid diff scope");
+    const head = await commit("HEAD").catch(async () => (await git(cwd, ["hash-object", "-t", "tree", "--stdin"])).trim());
+    // Git recognizes the empty tree without writing an object, including SHA-256 repos.
+    const result = await diff([head]);
+    const parts = [result.text];
+    let bytes = Buffer.byteLength(result.text, "utf8");
+    const paths = (await git(cwd, ["ls-files", "--others", "--exclude-standard", "-z", "--", "."])).split("\0").filter(Boolean);
+    const root = await realpath(cwd);
+    const shown = paths.slice(0, MAX_DIFF_UNTRACKED_FILES);
+    for (const path of shown) {
+        const patch = await untrackedPatch(root, path);
+        bytes += Buffer.byteLength(patch, "utf8");
+        if (bytes > MAX_GIT_OUTPUT)
+            throw new Error("Diff exceeds 16 MiB; narrow the changes before retrying");
+        parts.push(patch);
+    }
+    return { text: parts.join(""), ...(paths.length > shown.length ? { omittedUntracked: paths.length - shown.length } : {}), ...(result.reducedContext ? { reducedContext: true } : {}) };
+}

package/dist/server/security-headers.js

@@ -0,0 +1,24 @@
+/**
+ * Baseline response headers for every route.
+ *
+ * The UI can drive an agent that runs commands, so a foreign page must not be
+ * able to frame it (clickjacking on confirm buttons). Same-origin framing stays
+ * allowed because the Wiki previews PDFs in a same-origin iframe. X-Frame-Options
+ * is set as well because /api/wiki-media replaces the Content-Security-Policy
+ * header with its own `sandbox`.
+ *
+ * No `script-src` policy here: it needs a full pass over pdf.js, mermaid, KaTeX
+ * and plugin bundles before it can be enforced without breaking features.
+ */
+export const SECURITY_HEADERS = {
+    "Content-Security-Policy": "frame-ancestors 'self'",
+    "X-Frame-Options": "SAMEORIGIN",
+    "X-Content-Type-Options": "nosniff",
+    // The first navigation may carry ?token=; never leak the URL to external links.
+    "Referrer-Policy": "no-referrer",
+};
+export function securityHeaders(_req, res, next) {
+    for (const [name, value] of Object.entries(SECURITY_HEADERS))
+        res.setHeader(name, value);
+    next();
+}