dsh-oc-tui 0.2.0 → 0.3.0

package/lib/dsh-version.js

@@ -0,0 +1,161 @@
+// Whether this build may run on the dsh that started it.
+//
+// The plugin already declares a supported range in package.json (`engines.dsh`)
+// and dsh's own profile preflight reads it: a host outside that range has this
+// bundle's rows *disabled* before they mount, which is why an in-app message
+// used to be impossible to show. Two gaps are left, and both are what this
+// module closes:
+//
+//   * an exempted host (`dsh plugin allow-version`) loads anyway and then fails
+//     somewhere deep — a model switch, a settings write — instead of saying why;
+//   * a version *inside* the range can still be incompatible, because the range
+//     is a promise about a whole line of releases: 0.2.2-rc.1 sat inside
+//     `>=0.1.1-rc.2 <0.3.0-0` and broke every model switch, because it moved the
+//     route to `agent.model.select()` and made the old waterfall throw.
+//
+// So the manifest carries what was actually run (`dshSupport.tested`) beside the
+// range, and a boot on anything with no evidence refuses to start. The refusal
+// is the point: a half-working interface is worse than one page naming the
+// version to install.
+//
+// Everything here is pure and injectable — no terminal, no settings, no boot —
+// so the verdict can be exercised without a host.
+
+import { readFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { compareVersions, detectDshInstall } from './updates.js'
+
+const MANIFEST = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'))
+
+// `v0.2.1` and `0.2.1 ` are the same version; an empty or non-string input is
+// "unknown", never "matches".
+export function normalizeDshVersion(value) {
+  if (typeof value !== 'string') return null
+  const trimmed = value.trim().replace(/^v/i, '')
+  return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(trimmed) ? trimmed : null
+}
+
+// The one range syntax this plugin's manifest uses: space-separated comparators
+// are ANDed, `||` separates alternatives. `^`, `~` and `x` wildcards are
+// deliberately rejected instead of half-supported — a manifest typo must fail
+// here, where a test can see it, rather than quietly widen what we accept.
+const COMPARATOR = /^(>=|<=|>|<|=)?\s*v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/
+
+export function parseDshRange(range) {
+  if (typeof range !== 'string' || range.trim() === '') return null
+  const alternatives = []
+  for (const part of range.split('||')) {
+    const comparators = []
+    for (const token of part.trim().split(/\s+/).filter(Boolean)) {
+      const match = COMPARATOR.exec(token)
+      if (!match) return null
+      comparators.push({ op: match[1] ?? '=', version: match[2] })
+    }
+    if (comparators.length === 0) return null
+    alternatives.push(comparators)
+  }
+  return alternatives.length === 0 ? null : alternatives
+}
+
+// true / false, or null when either side cannot be understood — the caller must
+// distinguish "does not match" from "cannot tell", because only the first one
+// justifies refusing to start.
+export function satisfiesDshRange(version, range) {
+  const alternatives = parseDshRange(range)
+  const actual = normalizeDshVersion(version)
+  if (!alternatives || !actual) return null
+  return alternatives.some((comparators) => comparators.every(({ op, version: bound }) => {
+    const order = compareVersions(actual, bound)
+    switch (op) {
+      case '>=': return order >= 0
+      case '>': return order > 0
+      case '<=': return order <= 0
+      case '<': return order < 0
+      default: return order === 0
+    }
+  }))
+}
+
+// What this build declares: the hard range dsh itself enforces, the version to
+// point a user at, and the ones this build was actually run against.
+export function dshSupport(manifest = MANIFEST) {
+  const declared = manifest?.dshSupport ?? {}
+  const range = typeof manifest?.engines?.dsh === 'string' ? manifest.engines.dsh : ''
+  const verified = Array.isArray(declared.tested) ? declared.tested.map(normalizeDshVersion).filter(Boolean) : []
+  return {
+    range,
+    recommended: normalizeDshVersion(declared.recommended) ?? verified.at(-1) ?? '',
+    tested: verified,
+  }
+}
+
+// The verdict for one running version.
+//
+//   ok          — declared by the range *and* actually run against
+//   unverified  — inside the declared range, but this build never saw it
+//   unsupported — outside the declared range (dsh normally disables us here)
+//   unknown     — the version could not be read, so there is nothing to judge
+//
+// `unknown` never refuses: bricking a distribution we cannot introspect would be
+// a bug in this module, not a fact about the host.
+export function evaluateDshSupport(actual, support = dshSupport()) {
+  const version = normalizeDshVersion(actual)
+  const base = { version, ...support }
+  if (!version) return { verdict: 'unknown', ...base }
+  const inRange = satisfiesDshRange(version, support.range)
+  if (inRange === null) return { verdict: 'unknown', ...base }
+  if (!inRange) return { verdict: 'unsupported', ...base }
+  if (support.tested.length > 0 && !support.tested.includes(version)) return { verdict: 'unverified', ...base }
+  return { verdict: 'ok', ...base }
+}
+
+// The version of the harness this process is running under.
+//
+// Three sources, most authoritative first:
+//
+//   1. `@deepseek-ai/dsh-app-boot/package.json` resolved from the process entry.
+//      That package is what the host itself reads as its runtime version
+//      (`getDshRuntimeVersion()` in dsh-app-boot) and it is versioned in lockstep
+//      with the CLI, so this answers exactly what a user means by "the dsh
+//      version".
+//   2. `@deepseek-ai/dsh/package.json` from the same base, for a host that ships
+//      the CLI without app-boot.
+//   3. the `dsh` on PATH, for a host started some other way (a desktop bundle, an
+//      SDK runner) — right whenever the process was launched by the CLI that PATH
+//      names.
+//
+// Nothing found means "unknown", and the gate lets it through.
+export function runningDshVersion({ entry = process.argv[1], resolve = resolveFromEntry, detect = detectDshInstall } = {}) {
+  if (typeof entry === 'string' && entry !== '') {
+    for (const spec of ['@deepseek-ai/dsh-app-boot/package.json', '@deepseek-ai/dsh/package.json']) {
+      const manifest = resolve(entry, spec)
+      const version = normalizeDshVersion(manifest?.version)
+      if (version) return { version, source: spec }
+    }
+  }
+  let install
+  try { install = detect() } catch { install = null }
+  const version = install?.found ? normalizeDshVersion(install.version) : null
+  if (version) return { version, source: 'path' }
+  return { version: null, source: 'unknown' }
+}
+
+function resolveFromEntry(entry, spec) {
+  try {
+    return JSON.parse(readFileSync(createRequire(entry).resolve(spec), 'utf8'))
+  } catch {
+    return null
+  }
+}
+
+// The boot gate: one call that answers "may this build start?" with everything a
+// blocking page needs. `DSH_TUI_IGNORE_DSH_VERSION` is the escape hatch for a
+// maintainer testing against a host that is not published or not yet verified.
+export function dshBootGate({ env = process.env, support = dshSupport(), probe = runningDshVersion } = {}) {
+  const override = String(env?.DSH_TUI_IGNORE_DSH_VERSION ?? '').trim()
+  if (override !== '' && override !== '0') return null
+  const { version, source } = probe()
+  const result = evaluateDshSupport(version, support)
+  if (result.verdict === 'ok' || result.verdict === 'unknown') return null
+  return { ...result, source }
+}

package/lib/git-branch.js

@@ -1,157 +1,157 @@
-// Git branch switching for the TUI's empty page: listing local and remote
-// branches, checking one out, and pulling updates. Everything shells out to
-// the `git` on PATH through an argument array (no shell is involved), and
-// every entry point is fenced to a real worktree first, so a workspace that
-// is not a repository — or a machine with no git at all — reports that
-// instead of half-applying anything.
-import { spawn } from 'node:child_process'
-import { resolve } from 'node:path'
-import { t } from './i18n.js'
-
-// A network operation can hang on an unreachable host long past the point
-// where the user has stopped watching the window, so every spawn carries a
-// bound; a kill resolves as a failure rather than leaving the promise open.
-const GIT_TIMEOUT_MS = 120_000
-
-// GIT_TERMINAL_PROMPT=0 turns a credential prompt into an immediate error:
-// the pipes below already keep git off the terminal, and this makes the
-// promise reject instead of blocking on input that can never arrive.
-function git(cwd, args) {
-  return new Promise((resolvePromise) => {
-    const child = spawn('git', args, {
-      cwd,
-      windowsHide: true,
-      stdio: ['ignore', 'pipe', 'pipe'],
-      env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
-    })
-    const stdout = []
-    const stderr = []
-    let settled = false
-    const finish = (result) => {
-      if (settled) return
-      settled = true
-      resolvePromise(result)
-    }
-    const timer = setTimeout(() => {
-      child.kill()
-      finish({ ok: false, spawned: true, stdout: '', stderr: t('git.timedOut') })
-    }, GIT_TIMEOUT_MS)
-    child.stdout?.on('data', (chunk) => { stdout.push(chunk) })
-    child.stderr?.on('data', (chunk) => { stderr.push(chunk) })
-    child.on('error', (error) => {
-      clearTimeout(timer)
-      // A spawn failure (git not on PATH) is not the same as git saying no:
-      // `spawned: false` lets callers tell the two apart.
-      finish({ ok: false, spawned: false, stdout: '', stderr: error.message })
-    })
-    child.on('close', (code) => {
-      clearTimeout(timer)
-      finish({
-        ok: code === 0,
-        spawned: true,
-        stdout: Buffer.concat(stdout).toString('utf8'),
-        stderr: Buffer.concat(stderr).toString('utf8'),
-      })
-    })
-  })
-}
-
-function lines(text) {
-  return String(text ?? '')
-    .split(/\r?\n/)
-    .map((line) => line.trim())
-    .filter((line) => line !== '')
-}
-
-// The first line of git's output, which is where its errors put the reason
-// ("error: pathspec ... did not match"). Later lines are hints and blank
-// padding that would only crowd a one-line report.
-function firstLine(text) {
-  return lines(text)[0] ?? ''
-}
-
-// The last line of the combined output: fetch's "Fetching origin" and pull's
-// "From ..." lead, while the line that answers "did anything change" —
-// "Already up to date.", the fast-forward diffstat — comes last.
-function lastLine(text) {
-  const all = lines(text)
-  return all.length > 0 ? all[all.length - 1].slice(0, 72) : ''
-}
-
-// The worktree root, or a throw that says why there is none. Every public
-// function starts here. `--show-toplevel` is one spawn that answers both
-// questions: it prints the root inside a worktree (an unborn one included)
-// and fails inside a bare repository or outside any repository at all.
-async function worktreeRoot(cwd) {
-  const root = await git(resolve(cwd), ['rev-parse', '--show-toplevel'])
-  if (!root.spawned) throw new Error(t('git.gitMissing'))
-  if (!root.ok || root.stdout.trim() === '') throw new Error(t('git.notRepo'))
-  return root.stdout.trim()
-}
-
-// Local branches (the current one included, in git's own alphabetical order)
-// and remote-tracking branches. `refs/remotes/*​/HEAD` is a symbolic ref that
-// names no branch of its own, so it is filtered out rather than offered as a
-// checkout target.
-export async function listGitBranches(cwd) {
-  const root = await worktreeRoot(cwd)
-  const [local, remote, head] = await Promise.all([
-    git(root, ['for-each-ref', '--format=%(refname:short)', 'refs/heads']),
-    git(root, ['for-each-ref', '--format=%(refname:short)', 'refs/remotes']),
-    // symbolic-ref exits non-zero on a detached or unborn HEAD, which is the
-    // honest "no current branch" answer the window renders as (detached).
-    git(root, ['symbolic-ref', '--quiet', '--short', 'HEAD']),
-  ])
-  for (const result of [local, remote, head]) {
-    if (!result.ok) throw new Error(firstLine(result.stderr) || t('git.listFailed', { error: '' }))
-  }
-  return {
-    root,
-    current: head.stdout.trim(),
-    local: lines(local.stdout),
-    remote: lines(remote.stdout).filter((name) => !/\/HEAD$/.test(name)),
-  }
-}
-
-// Check out a branch. A remote-tracking ref is switched through the local
-// branch git's own DWIM would create for it (`origin/feature` -> `feature`),
-// unless a local branch of that name already exists — then that one wins, so
-// the user never lands on a second branch tracking the same upstream.
-export async function switchGitBranch(cwd, ref, { remote = false } = {}) {
-  const root = await worktreeRoot(cwd)
-  let target = ref
-  if (remote) {
-    const slash = ref.indexOf('/')
-    const local = slash < 0 ? ref : ref.slice(slash + 1)
-    const locals = await git(root, ['for-each-ref', '--format=%(refname:short)', 'refs/heads'])
-    if (!locals.spawned) throw new Error(t('git.gitMissing'))
-    if (!locals.ok) throw new Error(firstLine(locals.stderr))
-    const localNames = lines(locals.stdout)
-    if (!localNames.includes(local)) {
-      const created = await git(root, ['checkout', '-b', local, '--track', ref])
-      if (!created.spawned) throw new Error(t('git.gitMissing'))
-      if (!created.ok) throw new Error(firstLine(created.stderr) || t('git.switchFailed', { branch: ref, error: '' }))
-      return { branch: local, root }
-    }
-    target = local
-  }
-  const result = await git(root, ['checkout', target])
-  if (!result.spawned) throw new Error(t('git.gitMissing'))
-  if (!result.ok) throw new Error(firstLine(result.stderr) || t('git.switchFailed', { branch: target, error: '' }))
-  return { branch: target, root }
-}
-
-// Manual pull: refresh every remote-tracking ref, then fast-forward the
-// current branch. `--ff-only` is deliberate — a TUI has no way to resolve a
-// merge conflict, so a diverged branch must fail with git's own explanation
-// rather than stop halfway with conflict markers in the worktree.
-export async function pullGitUpdates(cwd) {
-  const root = await worktreeRoot(cwd)
-  const fetched = await git(root, ['fetch', '--all', '--prune'])
-  if (!fetched.spawned) throw new Error(t('git.gitMissing'))
-  if (!fetched.ok) throw new Error(firstLine(fetched.stderr) || t('git.pullFailed', { error: '' }))
-  const pulled = await git(root, ['pull', '--ff-only'])
-  if (!pulled.spawned) throw new Error(t('git.gitMissing'))
-  if (!pulled.ok) throw new Error(firstLine(pulled.stderr) || t('git.pullFailed', { error: '' }))
-  return { summary: lastLine(fetched.stderr + '\n' + fetched.stdout + '\n' + pulled.stdout + '\n' + pulled.stderr) }
-}
+// Git branch switching for the TUI's empty page: listing local and remote
+// branches, checking one out, and pulling updates. Everything shells out to
+// the `git` on PATH through an argument array (no shell is involved), and
+// every entry point is fenced to a real worktree first, so a workspace that
+// is not a repository — or a machine with no git at all — reports that
+// instead of half-applying anything.
+import { spawn } from 'node:child_process'
+import { resolve } from 'node:path'
+import { t } from './i18n.js'
+
+// A network operation can hang on an unreachable host long past the point
+// where the user has stopped watching the window, so every spawn carries a
+// bound; a kill resolves as a failure rather than leaving the promise open.
+const GIT_TIMEOUT_MS = 120_000
+
+// GIT_TERMINAL_PROMPT=0 turns a credential prompt into an immediate error:
+// the pipes below already keep git off the terminal, and this makes the
+// promise reject instead of blocking on input that can never arrive.
+function git(cwd, args) {
+  return new Promise((resolvePromise) => {
+    const child = spawn('git', args, {
+      cwd,
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+    })
+    const stdout = []
+    const stderr = []
+    let settled = false
+    const finish = (result) => {
+      if (settled) return
+      settled = true
+      resolvePromise(result)
+    }
+    const timer = setTimeout(() => {
+      child.kill()
+      finish({ ok: false, spawned: true, stdout: '', stderr: t('git.timedOut') })
+    }, GIT_TIMEOUT_MS)
+    child.stdout?.on('data', (chunk) => { stdout.push(chunk) })
+    child.stderr?.on('data', (chunk) => { stderr.push(chunk) })
+    child.on('error', (error) => {
+      clearTimeout(timer)
+      // A spawn failure (git not on PATH) is not the same as git saying no:
+      // `spawned: false` lets callers tell the two apart.
+      finish({ ok: false, spawned: false, stdout: '', stderr: error.message })
+    })
+    child.on('close', (code) => {
+      clearTimeout(timer)
+      finish({
+        ok: code === 0,
+        spawned: true,
+        stdout: Buffer.concat(stdout).toString('utf8'),
+        stderr: Buffer.concat(stderr).toString('utf8'),
+      })
+    })
+  })
+}
+
+function lines(text) {
+  return String(text ?? '')
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter((line) => line !== '')
+}
+
+// The first line of git's output, which is where its errors put the reason
+// ("error: pathspec ... did not match"). Later lines are hints and blank
+// padding that would only crowd a one-line report.
+function firstLine(text) {
+  return lines(text)[0] ?? ''
+}
+
+// The last line of the combined output: fetch's "Fetching origin" and pull's
+// "From ..." lead, while the line that answers "did anything change" —
+// "Already up to date.", the fast-forward diffstat — comes last.
+function lastLine(text) {
+  const all = lines(text)
+  return all.length > 0 ? all[all.length - 1].slice(0, 72) : ''
+}
+
+// The worktree root, or a throw that says why there is none. Every public
+// function starts here. `--show-toplevel` is one spawn that answers both
+// questions: it prints the root inside a worktree (an unborn one included)
+// and fails inside a bare repository or outside any repository at all.
+async function worktreeRoot(cwd) {
+  const root = await git(resolve(cwd), ['rev-parse', '--show-toplevel'])
+  if (!root.spawned) throw new Error(t('git.gitMissing'))
+  if (!root.ok || root.stdout.trim() === '') throw new Error(t('git.notRepo'))
+  return root.stdout.trim()
+}
+
+// Local branches (the current one included, in git's own alphabetical order)
+// and remote-tracking branches. `refs/remotes/*​/HEAD` is a symbolic ref that
+// names no branch of its own, so it is filtered out rather than offered as a
+// checkout target.
+export async function listGitBranches(cwd) {
+  const root = await worktreeRoot(cwd)
+  const [local, remote, head] = await Promise.all([
+    git(root, ['for-each-ref', '--format=%(refname:short)', 'refs/heads']),
+    git(root, ['for-each-ref', '--format=%(refname:short)', 'refs/remotes']),
+    // symbolic-ref exits non-zero on a detached or unborn HEAD, which is the
+    // honest "no current branch" answer the window renders as (detached).
+    git(root, ['symbolic-ref', '--quiet', '--short', 'HEAD']),
+  ])
+  for (const result of [local, remote, head]) {
+    if (!result.ok) throw new Error(firstLine(result.stderr) || t('git.listFailed', { error: '' }))
+  }
+  return {
+    root,
+    current: head.stdout.trim(),
+    local: lines(local.stdout),
+    remote: lines(remote.stdout).filter((name) => !/\/HEAD$/.test(name)),
+  }
+}
+
+// Check out a branch. A remote-tracking ref is switched through the local
+// branch git's own DWIM would create for it (`origin/feature` -> `feature`),
+// unless a local branch of that name already exists — then that one wins, so
+// the user never lands on a second branch tracking the same upstream.
+export async function switchGitBranch(cwd, ref, { remote = false } = {}) {
+  const root = await worktreeRoot(cwd)
+  let target = ref
+  if (remote) {
+    const slash = ref.indexOf('/')
+    const local = slash < 0 ? ref : ref.slice(slash + 1)
+    const locals = await git(root, ['for-each-ref', '--format=%(refname:short)', 'refs/heads'])
+    if (!locals.spawned) throw new Error(t('git.gitMissing'))
+    if (!locals.ok) throw new Error(firstLine(locals.stderr))
+    const localNames = lines(locals.stdout)
+    if (!localNames.includes(local)) {
+      const created = await git(root, ['checkout', '-b', local, '--track', ref])
+      if (!created.spawned) throw new Error(t('git.gitMissing'))
+      if (!created.ok) throw new Error(firstLine(created.stderr) || t('git.switchFailed', { branch: ref, error: '' }))
+      return { branch: local, root }
+    }
+    target = local
+  }
+  const result = await git(root, ['checkout', target])
+  if (!result.spawned) throw new Error(t('git.gitMissing'))
+  if (!result.ok) throw new Error(firstLine(result.stderr) || t('git.switchFailed', { branch: target, error: '' }))
+  return { branch: target, root }
+}
+
+// Manual pull: refresh every remote-tracking ref, then fast-forward the
+// current branch. `--ff-only` is deliberate — a TUI has no way to resolve a
+// merge conflict, so a diverged branch must fail with git's own explanation
+// rather than stop halfway with conflict markers in the worktree.
+export async function pullGitUpdates(cwd) {
+  const root = await worktreeRoot(cwd)
+  const fetched = await git(root, ['fetch', '--all', '--prune'])
+  if (!fetched.spawned) throw new Error(t('git.gitMissing'))
+  if (!fetched.ok) throw new Error(firstLine(fetched.stderr) || t('git.pullFailed', { error: '' }))
+  const pulled = await git(root, ['pull', '--ff-only'])
+  if (!pulled.spawned) throw new Error(t('git.gitMissing'))
+  if (!pulled.ok) throw new Error(firstLine(pulled.stderr) || t('git.pullFailed', { error: '' }))
+  return { summary: lastLine(fetched.stderr + '\n' + fetched.stdout + '\n' + pulled.stdout + '\n' + pulled.stderr) }
+}