dsh-coding-sidebar 1.0.8 → 1.0.10

package/src/fs-operations.ts

@@ -1,5 +1,6 @@
 /**
- * Workspace-safe file mutations for the sidebar (the upload route today).
+ * Workspace-safe file mutations for the sidebar: the upload route plus the
+ * file tree's rename and delete.
  *
  * Every write is confined to the real session workspace: the upload
  * directory is resolved absolute and its target is checked through existing
@@ -9,14 +10,21 @@
  * to a uniquely named temp sibling
  * and are renamed into place, so a failed, aborted, or oversized upload never
  * leaves a partial file at the target path.
+ *
+ * The tree's rename/delete (below) are link-aware: existence and containment
+ * are verified against the fully resolved target (a symlink pointing outside
+ * the workspace is refused), but the operation itself addresses the lexical
+ * row path — renaming or deleting a symlink row renames/unlinks the LINK,
+ * never its target, matching what the tree row visually names (VS Code
+ * semantics). Containment is always enforced (no fence toggle on this fork).
  */
 import { randomUUID } from 'node:crypto'
 import { once } from 'node:events'
 import { createWriteStream } from 'node:fs'
-import { mkdir, rename, rm, stat } from 'node:fs/promises'
-import { basename, dirname, join } from 'node:path'
+import { access, lstat, mkdir, realpath, rename, rm, stat, unlink } from 'node:fs/promises'
+import { basename, dirname, isAbsolute, join } from 'node:path'
 import type { SidebarHttpRequest } from './context-types.ts'
-import { requireAbsolute } from './fs-tree.ts'
+import { isWithin, requireAbsolute } from './fs-tree.ts'
 import { ensureWorkspacePath, ensureWorkspaceWritePath } from './path-security.ts'
 import { SidebarError } from './wire.ts'
 
@@ -93,3 +101,117 @@ export async function writeWorkspaceUpload(input: WorkspaceUploadInput): Promise
     throw error
   }
 }
+
+/** Resolve a tree-row path against the session workspace (absolute rows pass through). */
+function resolveRowPath(cwd: string, target: string): string {
+  return isAbsolute(target) ? target : join(cwd, target)
+}
+
+/** Resolve one existing entry for a link-aware mutation: the lexical row path
+ * plus its fully resolved real target (containment-checked). Resolution
+ * failures become fs-errors, mirroring path-security's semantics. */
+async function resolveEntry(
+  cwd: string,
+  target: string,
+): Promise<{ absolute: string; real: string; realCwd: string }> {
+  const absolute = requireAbsolute(resolveRowPath(cwd, target))
+  let real: string
+  let realCwd: string
+  try {
+    ;[realCwd, real] = await Promise.all([realpath(cwd), realpath(absolute)])
+  } catch (error) {
+    throw new SidebarError('fs-error', `cannot resolve "${target}": ${error instanceof Error ? error.message : String(error)}`, 400)
+  }
+  if (!isWithin(realCwd, real)) {
+    throw new SidebarError('forbidden', `path "${target}" is outside workspace`, 403)
+  }
+  return { absolute, real, realCwd }
+}
+
+/** Whether a path exists (ENOENT → false; other failures propagate). */
+async function pathExists(target: string): Promise<boolean> {
+  try {
+    await access(target)
+    return true
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false
+    throw error
+  }
+}
+
+/** Inputs of one tree-row rename. */
+export interface WorkspaceRenameInput {
+  /** The session workspace root; the renamed entry must stay inside it. */
+  cwd: string
+  /** Absolute path of the row as the tree displays it (may be a symlink). */
+  path: string
+  /** The new base name (single segment — rename never moves across directories). */
+  name: string
+}
+
+/**
+ * Rename one tree row within its directory: `path` → `<parent>/<name>`.
+ * The new name must be a single path segment (this is rename, not move);
+ * an existing destination is refused (POSIX rename would clobber it
+ * silently); the workspace root itself is never renamable; a symlink row
+ * renames the link, not its target. A no-op rename (same name) succeeds
+ * without touching the filesystem.
+ *
+ * @throws SidebarError with a wire code for shape, containment, existence
+ * and root failures.
+ */
+export async function renameWorkspaceEntry(input: WorkspaceRenameInput): Promise<{ path: string }> {
+  const { cwd, path, name } = input
+  if (name === '' || name === '.' || name === '..' || name.includes('/') || name.includes('\\')) {
+    throw new SidebarError('bad-request', 'name must be a single path segment', 400)
+  }
+  const { absolute, real, realCwd } = await resolveEntry(cwd, path)
+  if (real === realCwd) {
+    throw new SidebarError('fs-error', 'cannot rename the workspace root', 400)
+  }
+  if (basename(absolute) === name) return { path: absolute }
+  const destination = join(dirname(absolute), name)
+  const safeDestination = await ensureWorkspaceWritePath(cwd, destination)
+  if (await pathExists(safeDestination)) {
+    throw new SidebarError('fs-error', `"${name}" already exists`, 409)
+  }
+  try {
+    await rename(absolute, safeDestination)
+  } catch (error) {
+    throw new SidebarError('fs-error', `cannot rename "${path}" to "${name}": ${error instanceof Error ? error.message : String(error)}`, 400)
+  }
+  return { path: safeDestination }
+}
+
+/** Inputs of one tree-row delete. */
+export interface WorkspaceRemoveInput {
+  /** The session workspace root; the removed entry must stay inside it. */
+  cwd: string
+  /** Absolute path of the row as the tree displays it (may be a symlink). */
+  path: string
+}
+
+/**
+ * Delete one tree row permanently (there is no trash on the host): files are
+ * unlinked, directories removed recursively, a symlink row unlinks the LINK
+ * only (lstat decides, so a link to a directory does not recurse into its
+ * target). The workspace root itself is never removable.
+ *
+ * @throws SidebarError with a wire code for containment, existence and
+ * root failures.
+ */
+export async function removeWorkspaceEntry(input: WorkspaceRemoveInput): Promise<{ path: string }> {
+  const { cwd, path } = input
+  const { absolute, real, realCwd } = await resolveEntry(cwd, path)
+  if (real === realCwd) {
+    throw new SidebarError('fs-error', 'cannot remove the workspace root', 400)
+  }
+  try {
+    const info = await lstat(absolute)
+    if (info.isDirectory()) await rm(absolute, { recursive: true })
+    else await unlink(absolute)
+  } catch (error) {
+    throw new SidebarError('fs-error', `cannot remove "${path}": ${error instanceof Error ? error.message : String(error)}`, 400)
+  }
+  return { path: absolute }
+}

package/src/git.ts

@@ -9,8 +9,8 @@
  * Commits use the user's git global identity untouched (never sets
  * user.name/user.email).
  */
-import { readdir } from 'node:fs/promises'
-import { join } from 'node:path'
+import { readdir, readFile } from 'node:fs/promises'
+import { isAbsolute, join } from 'node:path'
 import { spawn } from 'node:child_process'
 import { resolve } from 'node:path'
 
@@ -439,6 +439,43 @@ export async function show(cwd: string, rev: string, path: string, selected?: st
   }
 }
 
+/**
+ * Both sides' full file contents for a diff-fold expansion. `path` is
+ * repo-relative. The sides resolve per diff kind: a commit reads
+ * `<hash>^` vs `<hash>`; a staged change reads HEAD vs the index (`:`);
+ * an unstaged change reads HEAD vs the working tree file on disk (a side
+ * that does not exist — untracked, deleted, binary-refused — comes back
+ * null and the client degrades the fold to a static marker).
+ */
+export async function foldContents(
+  cwd: string,
+  path: string,
+  opts: { staged?: boolean; hash?: string } = {},
+  selected?: string,
+): Promise<{ old: string | null; new: string | null }> {
+  const root = await repoRoot(cwd, selected)
+  if (opts.hash !== undefined) {
+    const [old, neu] = await Promise.all([
+      show(root, `${opts.hash}^`, path, selected),
+      show(root, opts.hash, path, selected),
+    ])
+    return { old, new: neu }
+  }
+  if (opts.staged === true) {
+    // `git show :<path>` reads the index (stage 0) — the staged side.
+    const [old, neu] = await Promise.all([
+      show(root, 'HEAD', path, selected),
+      show(root, ':', path, selected),
+    ])
+    return { old, new: neu }
+  }
+  const [old, neu] = await Promise.all([
+    show(root, 'HEAD', path, selected),
+    readFile(isAbsolute(path) ? path : join(root, path), 'utf8').catch(() => null),
+  ])
+  return { old, new: neu }
+}
+
 /** Full patch text of one commit (`git show` with the commit header suppressed).
  *  Merge commits show their diff against the first parent (`-m --first-parent`
  *  is a no-op for regular commits), so a history click always has content. */

package/src/index.ts

@@ -30,7 +30,8 @@ import {
   type SidebarPrefs,
 } from './config.ts'
 import { parentOf, requireAbsolute, listDirectory, rootLabel } from './fs-tree.ts'
-import { writeWorkspaceUpload } from './fs-operations.ts'
+import { removeWorkspaceEntry, renameWorkspaceEntry, writeWorkspaceUpload } from './fs-operations.ts'
+import { sessionFileOps } from './changes-ops.ts'
 import { ensureWorkspacePath, ensureWorkspaceWritePath } from './path-security.ts'
 import { searchFiles } from './fs-search.ts'
 import { extractFrameAncestors } from './browser-probe.ts'
@@ -351,6 +352,26 @@ function buildApi(
       }
       return { ok: true }
     },
+    // The tree row's rename: single-segment name, destination-existence and
+    // workspace-root refusals, link-aware (renames the row, not its target).
+    // fs-operations.ts owns the containment and shape rules.
+    'fs.rename': async (payload) => {
+      const { cwd } = await cwdOf(payload)
+      return renameWorkspaceEntry({
+        cwd,
+        path: requireString(payload, 'path'),
+        name: requireString(payload, 'name'),
+      })
+    },
+    // The tree row's delete (permanent — the host has no trash): recursive
+    // for directories, unlinks a symlink row without touching its target.
+    'fs.remove': async (payload) => {
+      const { cwd } = await cwdOf(payload)
+      return removeWorkspaceEntry({
+        cwd,
+        path: requireString(payload, 'path'),
+      })
+    },
     'git.worktrees': async (payload) => {
       const { cwd } = await gitCwdOf(payload)
       const selected = selectedRepoOf(payload)
@@ -438,6 +459,19 @@ function buildApi(
       const rev = requireString(payload, 'rev')
       return { content: await git.show(cwd, rev, path, repoRoot) }
     },
+    // Diff-fold expansion data: both sides' full file contents so the client
+    // can materialize the hidden context rows a -U3 hunk gap omitted. The
+    // sides resolve per diff kind (commit hash / staged / unstaged) inside
+    // git.foldContents; a missing side is null and the client degrades.
+    'git.fold-contents': async (payload) => {
+      const { cwd } = await gitCwdOf(payload)
+      const repoRoot = selectedRepoOf(payload)
+      const record = payload as { path?: unknown; staged?: unknown; hash?: unknown }
+      const path = await resolveGitPath(cwd, requireString(record, 'path'), repoRoot)
+      const staged = record.staged === true
+      const hash = typeof record.hash === 'string' ? record.hash : undefined
+      return await git.foldContents(cwd, path, { staged, hash }, repoRoot)
+    },
     // Release a terminal immediately. The WebSocket close frame already does
     // this while the socket is open; this route covers the tab-close that
     // happens while the socket is down (reconnect loop), so a closed tab can
@@ -459,6 +493,15 @@ function buildApi(
       agentPtyRegistry?.close(uuid)
       return { ok: true }
     },
+    // The sidebar wait banner's skip button: abort every active
+    // terminal_wait_for on one agent terminal. Idempotent — 0 when nothing
+    // is waiting (a stale banner racing a wait that already resolved).
+    // Degraded mode (node-pty unavailable) has no registry and no waits: an
+    // honest ok.
+    'agent-pty.skip-wait': (payload) => {
+      const uuid = requireString(payload, 'uuid')
+      return { ok: true, skipped: agentPtyRegistry?.skipWait(uuid) ?? 0 }
+    },
     // Terminal dependency status (issue #140): after a WS close 1011 with
     // reason `pty-deps-missing` the client fetches the full repair details
     // here — the close reason itself is capped at 123 bytes, too small for
@@ -472,6 +515,18 @@ function buildApi(
     // exists. Kill is fenced to the owning session by the jobs registry.
     'jobs.output': (payload) => jobsApi.output(payload),
     'jobs.kill': (payload) => jobsApi.kill(payload),
+    // The session lens: file operations the model performed in this session,
+    // parsed from the session's own event log (read-only replay — the
+    // model's job_output cursor is never touched). Cold sessions degrade to
+    // an empty list (only live sessions have an in-memory log on this host).
+    'changes.ops': async (payload) => {
+      const sessionId = requireString(payload, 'sessionId')
+      const stored = ctx.sessions.get(sessionId)
+      const events = stored?.snapshotEvents !== undefined
+        ? stored.snapshotEvents() as unknown as Parameters<typeof sessionFileOps>[0]
+        : []
+      return { ops: sessionFileOps(events) }
+    },
     // Subagent live previews: one batch request per refresh; the route folds
     // the newest text/tool activity of every running child in the tree.
     'subagents.live': (payload) => subagentLiveApi.live(payload),