dsh-git-changes 0.0.0-stage → 0.1.0

package/lib/host/session.js

@@ -0,0 +1,84 @@
+/** Live-session lookups, working-directory access, and the latest turn announcement. */
+
+/**
+ * @typedef {object} LiveSession
+ * @property {{ id: string, cwd?: string }} header
+ * @property {number} seq
+ * @property {() => readonly any[]} ownEvents
+ */
+
+/**
+ * Look up a live Host session without throwing on unknown ids.
+ * @param {{ sessions: { get(id: string): unknown } }} ctx host context
+ * @param {string} sessionId session identity
+ * @returns {LiveSession | undefined}
+ */
+export function liveSession(ctx, sessionId) {
+  if (typeof sessionId !== 'string' || sessionId.length === 0 || sessionId.length > 256) return undefined
+  try {
+    return /** @type {LiveSession | undefined} */ (ctx.sessions.get(sessionId))
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * The session's working directory, when it has one.
+ * @param {LiveSession | undefined} session live session
+ * @returns {string | undefined}
+ */
+export function cwdOf(session) {
+  const cwd = session?.header?.cwd
+  return typeof cwd === 'string' && cwd.length > 0 ? cwd : undefined
+}
+
+/**
+ * Scan a live session's own events backwards for its latest `workspace/changes`
+ * announcement. Used only as a fallback when the live tracker missed one.
+ * @param {LiveSession} session live session
+ * @returns {any | undefined} the event record
+ */
+export function lastChangesEvent(session) {
+  let events
+  try {
+    events = session.ownEvents()
+  } catch {
+    return undefined
+  }
+  if (!Array.isArray(events)) return undefined
+  for (let index = events.length - 1; index >= 0; index -= 1) {
+    const event = events[index]
+    if (event?.type !== 'workspace/changes') continue
+    if (Number.isSafeInteger(event.data?.turn) && event.data.turn >= 1) return event
+  }
+  return undefined
+}
+
+/**
+ * Track the latest `workspace/changes` event per live session, so the review
+ * routes do not rescan long session logs on every request.
+ * @param {object} ctx host context
+ * @returns {WeakMap<object, any>} session → event record
+ */
+export function createChangesTracker(ctx) {
+  const latest = new WeakMap()
+  try {
+    const dispose = ctx.on('session/event', (session, event) => {
+      if (event?.type !== 'workspace/changes') return
+      if (!Number.isSafeInteger(event.data?.turn) || event.data.turn < 1) return
+      latest.set(session, event)
+    })
+    if (typeof dispose === 'function') {
+      ctx.effect(() => () => {
+        try {
+          dispose()
+        } catch {
+          /* the connection may already be torn down */
+        }
+      }, 'dsh-git-changes: workspace/changes tracker')
+    }
+  } catch {
+    /* A missing event bridge only costs a rescan. */
+  }
+  return latest
+}

package/lib/host/util.js

@@ -0,0 +1,107 @@
+/** JSON response and query-coordinate helpers for the read-only review routes. */
+
+/**
+ * Build a no-store JSON response.
+ * @param {unknown} body serializable payload
+ * @param {number} [status] HTTP status
+ * @returns {Response}
+ */
+export function jsonResponse(body, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' },
+  })
+}
+
+/**
+ * Build the SPEC error envelope.
+ * @param {string} code stable machine code
+ * @param {string} message human readable message
+ * @param {number} status HTTP status
+ * @returns {Response}
+ */
+export function failure(code, message, status) {
+  return jsonResponse({ error: { code, message } }, status)
+}
+
+/**
+ * Parse a non-negative safe-integer query coordinate.
+ * @param {string | number | null} value query string or JSON numeric coordinate
+ * @returns {number | undefined}
+ */
+export function coordinate(value) {
+  if (typeof value === 'number') return Number.isSafeInteger(value) && value >= 0 ? value : undefined
+  if (typeof value !== 'string' || !/^\d+$/.test(value)) return undefined
+  const parsed = Number(value)
+  return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : undefined
+}
+
+/**
+ * Read a bounded opaque identifier query value.
+ * @param {string | null} value raw query value
+ * @param {number} [maxLength] length bound
+ * @returns {string | undefined}
+ */
+export function identifier(value, maxLength = 256) {
+  if (typeof value !== 'string') return undefined
+  if (value.length === 0 || value.length > maxLength) return undefined
+  return value
+}
+
+/**
+ * Reject relative workspace paths that could escape the workspace or confuse the
+ * filesystem provider: empty segments, `.`/`..`, drive letters, control chars.
+ * @param {string} value workspace-relative path using either separator
+ * @returns {boolean} whether the path is a safe non-empty relative path
+ */
+export function safeRelativePath(value) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > 4096) return false
+  if (/[\u0000-\u001f\u007f]/.test(value)) return false
+  if (/^[a-zA-Z]:/.test(value) || value.startsWith('/') || value.startsWith('\\')) return false
+  const segments = value.split(/[\\/]+/)
+  if (segments.length === 0) return false
+  for (const segment of segments) {
+    if (segment === '' || segment === '.' || segment === '..') return false
+  }
+  return true
+}
+
+/**
+ * Validate a browser-supplied git revision expression (no spaces, no leading dash).
+ * @param {unknown} value raw query value
+ * @returns {string | undefined} trimmed revision expression, or undefined when unsafe
+ */
+export function safeRevision(value) {
+  if (typeof value !== 'string') return undefined
+  const trimmed = value.trim()
+  if (trimmed.length === 0 || trimmed.length > 200) return undefined
+  if (/[\u0000-\u0020\u007f]/.test(trimmed)) return undefined
+  if (trimmed.startsWith('-')) return undefined
+  if (!/^[A-Za-z0-9_./~^@{}:+-]+$/.test(trimmed)) return undefined
+  return trimmed
+}
+
+/**
+ * Strip the internal recorder fields the browser should not depend on.
+ * @param {object} summary WorkspaceChangesSummary
+ * @returns {{turn:number,total:number,added:number,deleted:number,files:Array<object>}}
+ */
+export function publicSummary(summary) {
+  const files = Array.isArray(summary?.files)
+    ? summary.files.map((file) => ({
+        path: String(file.path),
+        display: String(file.display ?? file.path),
+        added: Number(file.added) || 0,
+        deleted: Number(file.deleted) || 0,
+        ...(file.binary === true ? { binary: true } : {}),
+        ...(file.oversized === true ? { oversized: true } : {}),
+      }))
+    : []
+  return {
+    turn: Number(summary?.turn) || 0,
+    total: Number(summary?.total ?? files.length) || 0,
+    added: Number(summary?.added) || 0,
+    deleted: Number(summary?.deleted) || 0,
+    files,
+  }
+}

package/lib/index.js

@@ -0,0 +1,33 @@
+/**
+ * dsh-git-changes — Host half.
+ *
+ * Review data plane for the right-sidebar "代码审查" tab:
+ *  - /api/git-changes.* authenticated JSON routes: turn snapshots from the
+ *    builtin workspace-changes recorder, workspace file reads/directory
+ *    listings from workspaceFiles, git status/diff through the subprocess
+ *    capability, and a bounded workspace index/search;
+ *  - four git write routes (stage / unstage / commit / push) that only touch
+ *    the repository index and commits — they never rewrite files, never run
+ *    arbitrary commands and never force push;
+ *  - an authenticated prefix route serving the vendored Monaco AMD assets.
+ *
+ * Parts of the git-changes rendering approach are adapted from the MIT
+ * licensed `dsh-vscode-mode` reference implementation
+ * (https://github.com/Lenonss/DSH_VsCodeMode, © 2026 LiuZiLong / ddj).
+ */
+import { registerApiRoutes } from './host/routes.js'
+import { registerVendorRoute } from './host/assets.js'
+
+export const name = 'dsh-git-changes'
+
+/** Hard dependencies: every one is a shipped Host service in DSH 0.2.x. */
+export const inject = ['connection', 'webServer', 'workspaceFiles', 'workspaceChanges', 'sessions', 'subprocess']
+
+/**
+ * Register the review data plane and the static Monaco route.
+ * @param {import('./host/context.d.ts').HostContext} ctx host plugin context
+ */
+export function apply(ctx) {
+  registerApiRoutes(ctx)
+  registerVendorRoute(ctx)
+}

package/licenses/dsh-vscode-mode-LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 LiuZiLong
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/licenses/vscode-theme-seti-LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) Microsoft Corporation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/licenses/vscode-theme-seti-ThirdPartyNotices.txt

@@ -0,0 +1,32 @@
+
+THIRD-PARTY SOFTWARE NOTICES AND INFORMATION
+For Microsoft vscode-theme-seti
+
+This file is based on or incorporates material from the projects listed below ("Third Party OSS"). The original copyright
+notice and the license under which Microsoft received such Third Party OSS, are set forth below. Such licenses and notice
+are provided for informational purposes only. Microsoft licenses the Third Party OSS to you under the licensing terms for
+the Microsoft product or service. Microsoft reserves all other rights not expressly granted under this agreement, whether
+by implication, estoppel or otherwise.†
+
+1.       Seti UI - A subtle dark colored UI theme for Atom. (https://github.com/jesseweed/seti-ui)
+
+Copyright (c) 2014 Jesse Weed
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Code Review Panel",
+    "description": "Cursor-style read-only code review: full source files with inline line-level diffs in a right-sidebar tab, with Agent turn, uncommitted and arbitrary git-version (historical commit) baselines, plus a workspace file tree, editor tabs, quick open and VS Code-style navigation; opens from the composer pill above the chat input."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "代码审查面板",
+    "description": "Cursor 式只读代码审查：在右侧栏独立标签页里查看完整源码与行级内联差异，支持 Agent 本轮、Git 未提交与任意 Git 版本（历史提交）对比，配合工作区文件树、标签页、Quick Open 与 VS Code 风格快捷键；可从聊天输入框上方的「本轮修改」入口打开。"
+  }
+}

package/package.json

@@ -1,6 +1,66 @@
 {
   "name": "dsh-git-changes",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "type": "module",
+  "license": "MIT",
+  "description": "Cursor-style Git changes panel for the DSH right sidebar: staged/unstaged trees, stage/unstage, commit & push, inline or side-by-side diffs, AI commit messages, blame, commit graph and full-source review.",
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "git",
+    "diff",
+    "code-review",
+    "source-control",
+    "staged-changes",
+    "commit",
+    "push",
+    "blame",
+    "monaco"
+  ],
+  "main": "./lib/index.js",
+  "scripts": {
+    "build": "node scripts/build-client.mjs",
+    "test": "node scripts/build-client.mjs && node --check lib/client.js && node scripts/smoke-client.mjs && node scripts/smoke-host.mjs && node scripts/test-client-state.mjs && node scripts/test-shortcuts.mjs && node scripts/test-git.mjs && node scripts/test-lsp.mjs && node scripts/test-git-extras.mjs && node scripts/check-hooks.mjs",
+    "verify": "node scripts/verify.mjs",
+    "test:client": "node scripts/test-client-state.mjs",
+    "test:git": "node scripts/test-git.mjs",
+    "test:shortcuts": "node scripts/test-shortcuts.mjs",
+    "prepack": "node scripts/build-client.mjs",
+    "test:lsp:real": "node scripts/test-lsp.mjs --real"
+  },
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js",
+    "./locale/*.json": "./locale/*.json",
+    "./icon": "./icon.svg",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "src",
+    "assets",
+    "cordis.patch.yml",
+    "locale/*.json",
+    "icon.svg",
+    "README.md",
+    "LICENSE",
+    "THIRD_PARTY_NOTICES.md",
+    "licenses",
+    "docs/images"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-conversation",
+        "@deepseek-ai/dsh-client-ui-sidebar-right"
+      ]
+    }
+  },
+  "author": "dsh-git-changes contributors"
 }

package/src/client/00-const.js

@@ -0,0 +1,79 @@
+/* dsh-git-changes client half — shared constants (no imports/exports). */
+
+/** Locale namespace owned by this plugin. */
+const NS = 'dsh-git-changes'
+/** Tab type identity; also the keyed body-slot key (must equal the definition id). */
+const TAB_ID = 'dsh-git-changes'
+/** Tab kind discriminator. */
+const TAB_KIND = 'git-changes'
+/** Commit graph section in the changes panel; hidden on request (flip to true to restore). */
+const SHOW_COMMIT_GRAPH = false
+/** Resource-address prefix of this plugin's review pages. */
+const ADDRESS_PREFIX = 'dsh-resource://git-changes/session/'
+/** Builtin file-preview resource prefix (used for non-code handoff). */
+const FILE_ADDRESS_PREFIX = 'dsh-resource://file/session/'
+/** Builtin hunk-review resource prefix (reused, never re-registered). */
+const CHANGES_REVIEW_PREFIX = 'dsh-resource://changes-review/session/'
+/** Vendor AMD root (absolute application path; served by the Host plugin). */
+const VENDOR_BASE = '/dsh-git-changes/monaco/vs'
+/** Document-relative authenticated JSON routes (Host registers them under /api/). */
+const ROUTES = {
+  latest: 'api/git-changes.latest',
+  summary: 'api/git-changes.summary',
+  diff: 'api/git-changes.diff',
+  file: 'api/git-changes.file',
+  tree: 'api/git-changes.tree',
+  config: 'api/git-changes.config',
+  gitStatus: 'api/git-changes.git-status',
+  gitFile: 'api/git-changes.git-file',
+  gitRevisions: 'api/git-changes.git-revisions',
+  gitCompare: 'api/git-changes.git-compare',
+  files: 'api/git-changes.files',
+  search: 'api/git-changes.search',
+  lsp: 'api/git-changes.lsp',
+  gitDiff: 'api/git-changes.git-diff',
+  stage: 'api/git-changes.stage',
+  unstage: 'api/git-changes.unstage',
+  commit: 'api/git-changes.commit',
+  push: 'api/git-changes.push',
+  discard: 'api/git-changes.discard',
+  blame: 'api/git-changes.blame',
+  log: 'api/git-changes.log',
+  generateMessage: 'api/git-changes.generate-message',
+}
+/** Maximum diff lines drawn by the code area (matches the builtin review policy). */
+const MAX_RENDER_LINES = 5000
+/** Default widths (CSS px) of the in-page workspace tree. */
+const TREE_WIDTH_DEFAULT = 230
+const TREE_WIDTH_MIN = 160
+const TREE_WIDTH_MAX = 300
+/** Below this page width the tree becomes an overlay drawer. */
+const NARROW_WIDTH = 560
+
+/** Extension → Monaco language id. */
+const LANG_BY_EXT = {
+  js: 'javascript', jsx: 'javascript', mjs: 'javascript', cjs: 'javascript',
+  ts: 'typescript', tsx: 'typescript', mts: 'typescript', cts: 'typescript',
+  json: 'json', jsonc: 'jsonc', json5: 'json', md: 'markdown', markdown: 'markdown', mdx: 'markdown',
+  css: 'css', scss: 'scss', less: 'less', html: 'html', htm: 'html', vue: 'html', svelte: 'html', xml: 'xml',
+  svg: 'xml', yaml: 'yaml', yml: 'yaml', toml: 'ini', ini: 'ini', cfg: 'ini', conf: 'ini', env: 'ini',
+  py: 'python', pyi: 'python', sh: 'shell', bash: 'shell', zsh: 'shell', ps1: 'powershell', psm1: 'powershell',
+  bat: 'bat', cmd: 'bat', lua: 'lua', java: 'java', c: 'c', h: 'c', cpp: 'cpp', cc: 'cpp', cxx: 'cpp',
+  hpp: 'cpp', hh: 'cpp', cs: 'csharp', go: 'go', rs: 'rust', rb: 'ruby', php: 'php', sql: 'sql',
+  swift: 'swift', kt: 'kotlin', kts: 'kotlin', dart: 'dart', ex: 'plaintext', exs: 'plaintext',
+  dockerfile: 'dockerfile', graphql: 'graphql', gql: 'graphql', proto: 'proto', r: 'r', jl: 'julia',
+  pl: 'perl', pm: 'perl', scala: 'scala', groovy: 'java', gradle: 'java', vim: 'plaintext',
+}
+
+/** Extensions rendered by the code viewer; everything else is handed to DSH preview. */
+const CODE_EXT = new Set(Object.keys(LANG_BY_EXT))
+
+/** Files without an extension that are still code. */
+const CODE_BASENAMES = new Set([
+  'dockerfile', 'makefile', 'cmakelists.txt', 'jenkinsfile', 'procfile', 'gemfile', 'rakefile',
+  'cargo.lock', 'go.sum', 'justfile', 'vagrantfile', '.gitignore', '.gitattributes', '.editorconfig',
+  '.npmrc', '.nvmrc', '.prettierrc', '.eslintrc', '.babelrc', '.dockerignore',
+])
+
+/** A short label per diff mode. */
+const MODES = ['turn', 'git', 'code']