chamba 0.3.1 → 0.4.0

package/dist/lib/safe-rm.js

@@ -0,0 +1,26 @@
+// =========================================================================================================================================
+// src/lib/safe-rm.ts - Safe wrapper around rmSync
+// All deletions in chamba go through safeRmSync. A biome lint rule (noRestrictedImports) bans
+// importing rmSync from node:fs everywhere else, enforcing this as the single deletion point.
+// =========================================================================================================================================
+// biome-ignore lint/style/noRestrictedImports: safeRmSync is the only approved user of rmSync
+import { rmSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { basename, join, resolve, sep } from "node:path";
+import { CHAMBA_DIR, CHAMBA_YAML, CONTAINER_NAME_PREFIX } from "./constants.js";
+const CHAMBA_HOME = resolve(join(homedir(), CHAMBA_DIR));
+const TEST_TMP_PREFIX = join(tmpdir(), `${CONTAINER_NAME_PREFIX}test-`);
+/**
+ * Safe wrapper around rmSync. Throws if the path is outside a chamba-owned location:
+ *   - ~/.chamba/            (workspace caches, agents, shadows, global config)
+ *   - A file named chamba.yaml  (workspace config file in any user workspace root)
+ *   - <tmpdir>/chamba-test-*   (test temp directories)
+ */
+export function safeRmSync(path, options) {
+    const r = resolve(path);
+    const ok = r === CHAMBA_HOME || r.startsWith(CHAMBA_HOME + sep) || basename(r) === CHAMBA_YAML || r.startsWith(TEST_TMP_PREFIX);
+    if (!ok) {
+        throw new Error(`safeRmSync: refusing to delete '${r}' - must be under ~/.chamba/, named chamba.yaml, or a test temp dir`);
+    }
+    rmSync(r, options);
+}

package/dist/lib/sessions.js

@@ -0,0 +1,34 @@
+// =========================================================================================================================================
+// src/lib/sessions.ts - Host-side detection of live interactive container sessions.
+// dev.ts connects each session with `docker exec -it ... <container> bash --login`. The host-side exec
+// client process is the proxy for one live session: it dies on clean exit, closed terminal, or kill, but
+// survives a sleep-freeze. Orphaned in-container shells (host side gone, PTY left open by dockerd) have no
+// host client and are correctly ignored - which is why counting on the host, not inside the container, is
+// the reliable signal for "last session closed".
+// =========================================================================================================================================
+import { spawnSync } from "node:child_process";
+// The interactive session shell, as argv. Single source of truth: both the connect command and the
+// detector's match needle derive from this, so they cannot drift apart.
+export const CONTAINER_LOGIN_SHELL = ["bash", "--login"];
+// --- Connect -----------------------------------------------------------------------------------------------------------------------------
+// Build the `docker exec` argv that opens an interactive session in `containerName` at `workdir`.
+// dev.ts spawns exactly this; sessionMatchNeedle matches against it, so detection stays in lockstep.
+export function loginShellExecArgs(workdir, containerName) {
+    return ["exec", "-it", "-w", workdir, containerName, ...CONTAINER_LOGIN_SHELL];
+}
+// --- Detection ---------------------------------------------------------------------------------------------------------------------------
+// The substring identifying one container's session client in a host `pgrep -f` scan: the container name
+// followed by the login shell args (e.g. "chamba-orot-io bash --login"). Specific enough to exclude other
+// `docker exec <c> ...` shapes. Container ids are kebab-case (schema-constrained), so there are no regex
+// metacharacters to escape.
+export function sessionMatchNeedle(containerName) {
+    return `${containerName} ${CONTAINER_LOGIN_SHELL.join(" ")}`;
+}
+// Count live interactive sessions to a single container by scanning HOST processes for the exec client.
+// `pgrep -f` (portable across macOS/BSD and Linux; `-c` is Linux-only) excludes its own PID. A missing or
+// errored pgrep yields no stdout -> 0, preserving the old "errored -> 0" safety. At a clean exit the just-
+// left client is already reaped before this runs, so the last exit reaches 0.
+export function containerSessionCount(containerName) {
+    const r = spawnSync("pgrep", ["-f", sessionMatchNeedle(containerName)], { encoding: "utf8", stdio: "pipe" });
+    return (r.stdout ?? "").split("\n").filter(Boolean).length;
+}

package/dist/lib/shadows.js

@@ -0,0 +1,174 @@
+// =========================================================================================================================================
+// src/lib/shadows.ts - Gitignore-style shadow path expansion and sync
+// Expands patterns like "node_modules", ".env*" into concrete paths, then syncs shadow directories.
+// =========================================================================================================================================
+import { spawnSync } from "node:child_process";
+import { existsSync, lstatSync, mkdirSync, readdirSync, writeFileSync } from "node:fs";
+import { dirname, join, relative } from "node:path";
+import fg from "fast-glob";
+import { CONTAINER_WORKSPACE, SHADOWS_DIR } from "./constants.js";
+import { safeRmSync } from "./safe-rm.js";
+/**
+ * Expand gitignore-style patterns into concrete relative paths.
+ *
+ * Patterns without a directory separator are treated as recursive (prepended with **/)
+ * following gitignore convention. Patterns with a / are matched relative to the workspace root.
+ * Matched directories are not recursed into (e.g. node_modules matches once, not its children).
+ *
+ * Paths that git tracks (or whose descendants git tracks) are dropped from the result and
+ * reported in skippedTracked. Shadowing tracked content is a no-op (agents can `git show` it)
+ * and breaks `git stash`/`pop` workflows.
+ */
+export function expandShadowPatterns(patterns, workspaceRoot) {
+    if (patterns.length === 0)
+        return { paths: [], skippedTracked: [] };
+    // Convert gitignore-style patterns to fast-glob patterns
+    const globPatterns = patterns.map((p) => (p.includes("/") ? p : `**/${p}`));
+    // Build ignore list: skip .git and contents of any matched directory
+    const ignorePatterns = ["**/.git", ...globPatterns.map((p) => `${p}/**/*`)];
+    const results = fg.sync(globPatterns, {
+        cwd: workspaceRoot,
+        onlyFiles: false,
+        dot: true,
+        ignore: ignorePatterns,
+    });
+    const expanded = removeNestedPaths(results.sort());
+    const { kept, dropped } = filterGitTrackedPaths(expanded, workspaceRoot);
+    return { paths: kept, skippedTracked: dropped };
+}
+// --- Hit counting (for menu UX) ----------------------------------------------------------------------------------------------------------
+/** Count how many paths a pattern would match in the workspace (post git-tracked filter). */
+export function countPatternHits(pattern, workspaceRoot) {
+    return expandShadowPatterns([pattern], workspaceRoot).paths.length;
+}
+// --- Git-tracked filtering ---------------------------------------------------------------------------------------------------------------
+/**
+ * Partition expanded shadow paths into those safe to shadow and those tracked by git.
+ * A path is dropped if it equals a tracked file, or (for directories) any tracked file
+ * lives anywhere beneath it. Returns the input unchanged when no .git is present.
+ */
+function filterGitTrackedPaths(paths, workspaceRoot) {
+    if (paths.length === 0)
+        return { kept: [], dropped: [] };
+    // .git may be a file (worktrees) or a directory; existsSync handles both
+    if (!existsSync(join(workspaceRoot, ".git")))
+        return { kept: paths, dropped: [] };
+    // Pass shadow paths as pathspecs so git enumerates only tracked files within them.
+    // Output then scales with shadow scope (typically tiny), not the size of the repo index.
+    const result = spawnSync("git", ["-C", workspaceRoot, "ls-files", "-z", "--", ...paths], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    if (result.status !== 0)
+        return { kept: paths, dropped: [] };
+    const matched = result.stdout.split("\0").filter((s) => s.length > 0);
+    if (matched.length === 0)
+        return { kept: paths, dropped: [] };
+    const matchedSet = new Set(matched);
+    const kept = [];
+    const dropped = [];
+    for (const p of paths) {
+        const prefix = `${p}/`;
+        if (matchedSet.has(p) || matched.some((f) => f.startsWith(prefix))) {
+            dropped.push(p);
+        }
+        else {
+            kept.push(p);
+        }
+    }
+    return { kept, dropped };
+}
+// --- Shadow sync -------------------------------------------------------------------------------------------------------------------------
+/**
+ * Ensures the shadows/ directory matches the given expanded paths.
+ * - Creates missing shadow entries (empty dir or empty file, matching source path type)
+ * - If `freshPaths` is provided, those entries are deleted and recreated (clean slate)
+ * - Removes shadow entries not in the expanded set
+ * - Cleans up empty parent directories
+ */
+export function ensureShadowsInSync(workspaceDir, expandedPaths, workspaceRoot, freshPaths) {
+    const expected = new Set(expandedPaths);
+    const shadowsDir = join(workspaceDir, SHADOWS_DIR);
+    // Create shadows/ root if needed
+    mkdirSync(shadowsDir, { recursive: true });
+    // Remove stale entries
+    removeStaleEntries(shadowsDir, shadowsDir, expected);
+    // Create or refresh expected entries
+    for (const relPath of expected) {
+        const sourcePath = join(workspaceRoot, relPath);
+        const shadowPath = join(shadowsDir, relPath);
+        if (freshPaths?.has(relPath) && existsSync(shadowPath)) {
+            safeRmSync(shadowPath, { recursive: true, force: true });
+        }
+        if (!existsSync(shadowPath)) {
+            createShadowEntry(sourcePath, shadowPath);
+        }
+    }
+}
+// --- Mount args --------------------------------------------------------------------------------------------------------------------------
+/** Build -v args for shadow mounts from expanded paths. */
+export function buildShadowMountArgs(workspaceDir, expandedPaths) {
+    const args = [];
+    for (const relPath of expandedPaths) {
+        args.push("-v", `${join(workspaceDir, SHADOWS_DIR, relPath)}:${CONTAINER_WORKSPACE}/${relPath}`);
+    }
+    return args;
+}
+// --- Helpers -----------------------------------------------------------------------------------------------------------------------------
+function createShadowEntry(sourcePath, shadowPath) {
+    if (existsSync(sourcePath) && !lstatSync(sourcePath).isDirectory()) {
+        mkdirSync(dirname(shadowPath), { recursive: true });
+        writeFileSync(shadowPath, "");
+    }
+    else {
+        mkdirSync(shadowPath, { recursive: true });
+    }
+}
+/**
+ * Walk the shadows/ tree and remove any entry whose relative path is not in the expected set.
+ * After removing leaf entries, prunes empty parent directories.
+ */
+function removeStaleEntries(baseDir, currentDir, expected) {
+    if (!existsSync(currentDir))
+        return;
+    for (const entry of readdirSync(currentDir, { withFileTypes: true })) {
+        const fullPath = join(currentDir, entry.name);
+        const rel = relative(baseDir, fullPath);
+        if (expected.has(rel)) {
+            // This path is expected - keep it
+            continue;
+        }
+        if (entry.isDirectory()) {
+            // Check if any expected path is nested under this directory
+            const hasExpectedChild = [...expected].some((p) => isDescendantOf(p, rel));
+            if (hasExpectedChild) {
+                // Recurse into the directory to clean stale children
+                removeStaleEntries(baseDir, fullPath, expected);
+            }
+            else {
+                // No expected paths under here - remove entirely
+                safeRmSync(fullPath, { recursive: true, force: true });
+            }
+        }
+        else {
+            // Stale file - remove
+            safeRmSync(fullPath, { force: true });
+        }
+    }
+    // Prune if this directory is now empty (and is not the shadows root)
+    if (currentDir !== baseDir && readdirSync(currentDir).length === 0) {
+        safeRmSync(currentDir, { recursive: true, force: true });
+    }
+}
+/**
+ * Drop paths that descend from another path in the input (keeps only the outermost path per subtree),
+ * so nested matches (e.g. node_modules inside a shadowed .next dir) don't become redundant bind mounts.
+ */
+function removeNestedPaths(paths) {
+    const unique = [...new Set(paths)];
+    return unique.filter((p) => !unique.some((a) => a !== p && isDescendantOf(p, a)));
+}
+// Expects forward-slash paths (fast-glob output and shadows/ relative paths on POSIX).
+function isDescendantOf(child, ancestor) {
+    return child.startsWith(`${ancestor}/`);
+}