dsh-remote-vs 0.9.3 → 0.11.0

package/src/git-ops.ts

@@ -114,6 +114,23 @@ export function assertRemoteUrl(url: string): string {
   return url
 }
 
+/**
+ * Assert a push refspec (`HEAD:refs/for/master`, `+refs/heads/x:refs/heads/y`).
+ *
+ * The charset is the union git accepts on the two sides of the optional colon,
+ * plus the force marker and the `{}`/`~`/`^`/`*` revision syntax. `assertRef`
+ * cannot be reused: it deliberately rejects `:`, and the whole point of a
+ * custom refspec is the destination side (Gerrit's `refs/for/<branch>`).
+ */
+export function assertPushRefspec(refspec: string): string {
+  if (typeof refspec !== 'string' || refspec === '' || refspec.length > 256) throw new Error(`invalid push refspec: ${refspec}`)
+  if (!/^\+?[A-Za-z0-9][A-Za-z0-9._/@~^*{}-]*(?::[A-Za-z0-9][A-Za-z0-9._/@~^*{}-]*)?$/.test(refspec)) {
+    throw new Error(`invalid push refspec: ${refspec}`)
+  }
+  if (refspec.includes('..') || refspec.includes('@{')) throw new Error(`invalid push refspec: ${refspec}`)
+  return refspec
+}
+
 // -------------------------------------------------------- read builders
 
 /** Resolve the enclosing repository root (fails outside a work tree). */
@@ -241,9 +258,43 @@ export function diffCommand(workdir: string, request: DiffRequest = {}): string
   return capped(parts.join(' '))
 }
 
-/** Files touched by one commit (`--name-status`, no patch body). */
+/**
+ * Files touched by one commit (`--name-status`, no patch body).
+ *
+ * `--first-parent` is what makes a MERGE commit show anything: plain
+ * `git show --name-status <merge>` prints no file rows at all (measured), so
+ * the pane said "这个提交没有改动文件" for every merge. With it, the diff is
+ * against the first parent — the merge's own contribution — and non-merge
+ * commits are byte-for-byte unchanged.
+ */
 export function commitFilesCommand(workdir: string, ref: string): string {
-  return capped(`${git(workdir)} show --no-color --format= --name-status ${assertRef(ref)} --`)
+  return capped(`${git(workdir)} show --no-color --format= --name-status --first-parent ${assertRef(ref)} --`)
+}
+
+/**
+ * Whole patch of one commit, with the commit header stripped (`--format=`), so
+ * the output starts at the first `diff --git` line and parses as a plain
+ * unified diff. Capped like every read-only builder: a commit that rewrites a
+ * generated file would otherwise ship megabytes for one sidebar pane.
+ * `--first-parent` makes merge commits readable (see `commitFilesCommand`).
+ */
+export function commitPatchCommand(workdir: string, ref: string): string {
+  return capped(`${git(workdir)} show --no-color --no-ext-diff --format= --patch --first-parent ${assertRef(ref)} --`)
+}
+
+/**
+ * One changed file's patch inside a commit, with rename detection
+ * (`-M`) across BOTH sides of the path.
+ *
+ * The plain `git diff <hash>^ -- <newPath>` the editor drill-down used to run
+ * is wrong for a rename: the old path never matches, so a 100% rename renders
+ * as an all-added file. Passing both paths to `git show -M` lets git report
+ * the rename the commit actually recorded. Restricted to `paths` so a giant
+ * commit still ships one file.
+ */
+export function commitFileDiffCommand(workdir: string, ref: string, paths: readonly string[]): string {
+  const specs = paths.map(path => shQuote(assertRepoPath(path))).join(' ')
+  return capped(`${git(workdir)} show --no-color --no-ext-diff --format= --patch -M ${assertRef(ref)} -- ${specs}`)
 }
 
 /** One file's content at a revision (`rev` may also be `:0` for the index). */
@@ -339,19 +390,41 @@ export function publishBranchCommand(workdir: string, branch: string, remote: st
   return statusOk(`${git(workdir)} push --set-upstream ${shQuote(assertRemoteName(remote))} ${shQuote(assertBranchName(branch))}`)
 }
 
-/** Fetch every remote, pruning deleted tracking refs. */
+/**
+ * Fetch every remote, pruning deleted tracking refs.
+ *
+ * NOTE: the four NETWORK verbs deliberately do NOT use `statusOk()`. That
+ * wrapper buffers git's output in temp files and cats them back only after the
+ * command exits, which made the live-output panel sit on "waiting…" for the
+ * whole run and then dump everything at once (measured: a 59 s push produced
+ * 0.2 s of output after completion). No pipe is involved here, so the shell
+ * returns git's own exit status directly, and `--progress` forces the progress
+ * lines even though the remote side is not a TTY.
+ */
 export function fetchCommand(workdir: string): string {
-  return statusOk(`${git(workdir)} fetch --all --prune`)
+  return `${git(workdir)} fetch --all --prune --progress`
 }
 
 /** Pull the current branch (merge, no editor prompt). */
 export function pullCommand(workdir: string): string {
-  return statusOk(`${git(workdir)} pull --no-edit`)
+  return `${git(workdir)} pull --no-edit --progress`
 }
 
 /** Push the current branch. */
 export function pushCommand(workdir: string): string {
-  return statusOk(`${git(workdir)} push`)
+  return `${git(workdir)} push --progress`
+}
+
+/**
+ * Push to an explicit remote with an explicit refspec.
+ *
+ * This is the Gerrit shape (`git push origin HEAD:refs/for/master`): the plain
+ * `git push` above only ever talks to the branch's upstream, so a review
+ * workflow had to drop into a terminal. The remote is explicit because a
+ * refspec says nothing about which remote it belongs to.
+ */
+export function pushRefspecCommand(workdir: string, remote: string, refspec: string): string {
+  return `${git(workdir)} push --progress ${shQuote(assertRemoteName(remote))} ${shQuote(assertPushRefspec(refspec))}`
 }
 
 /** Stash the working tree (optionally including untracked files). */
@@ -659,7 +732,10 @@ export function parseCommitFiles(stdout: string): GitCommitFile[] {
     if (tab < 0) continue
     const status = line.slice(0, tab).trim()
     const rest = line.slice(tab + 1)
-    if (!/^[A-Z]\d*$/.test(status)) continue
+    // `R100`/`C75` carry a score, and a combined diff spells statuses like `MM`.
+    // Both must survive: rejecting `MM` made a conflict-resolved merge look like
+    // it changed nothing.
+    if (!/^[A-Z][A-Z0-9]*$/.test(status)) continue
     const renamed = status.startsWith('R') || status.startsWith('C')
     if (renamed) {
       const parts = rest.split('\t')

package/src/index.ts

@@ -69,6 +69,11 @@ export interface Config {
   /**
    * P2 transparent-routing kill-switch: off = pure local passthrough;
    * shadow = log remote decisions but execute locally; enforce = route.
+   *
+   * The DEFAULT is `enforce`: the plugin exists to execute remote workspaces
+   * remotely, and a fresh profile that silently kept executing locally was the
+   * most common "why is nothing remote" report. `off`/`shadow` stay available as
+   * explicit opt-outs for debugging and for hosts that must stay local.
    */
   routingMode?: RoutingMode
   /** Per-command timeout for git work on a remote host (ms). */
@@ -107,7 +112,7 @@ export interface ResolvedConfig {
 export const Config = z.object({
   announceToAgent: z.boolean().default(false).volatile(),
   enabled: z.boolean().default(true).volatile(),
-  routingMode: z.union(['off', 'shadow', 'enforce'] as const).default('off').volatile(),
+  routingMode: z.union(['off', 'shadow', 'enforce'] as const).default('enforce').volatile(),
   gitTimeoutMs: z.number().step(1).min(MIN_TIMEOUT_MS).max(MAX_TIMEOUT_MS)
     .default(DEFAULT_GIT_TIMEOUT_MS).volatile(),
   readTimeoutMs: z.number().step(1).min(MIN_TIMEOUT_MS).max(MAX_TIMEOUT_MS)
@@ -171,7 +176,10 @@ export function apply(ctx: Context, config?: ResolvedConfig): void {
   const worlds = new RemoteWorlds(ctx, {
     store,
     pool,
-    mode: () => readField(config?.routingMode, 'off' as RoutingMode),
+    // Keep the runtime fallback equal to the schema default: a Host that hands
+    // the plugin a config object without this field must behave like a fresh
+    // profile, not like the old opt-in (`off`) behaviour.
+    mode: () => readField(config?.routingMode, 'enforce' as RoutingMode),
   })
   ctx.provide('remoteWorlds', worlds)
   ctx.effect(() => () => { pool.dispose() }, 'dsh-remote-vs: pool')

package/src/pool.ts

@@ -8,6 +8,7 @@
  */
 import { createHash } from 'node:crypto'
 import { readFileSync } from 'node:fs'
+import { StringDecoder } from 'node:string_decoder'
 import { Client, type ClientChannel, type SFTPWrapper } from 'ssh2'
 import type { RemoteStore } from './store.ts'
 import type { RemoteExecResult, RemoteHostEntry } from './protocol.ts'
@@ -99,6 +100,15 @@ interface Pooled {
 
 export interface ExecOptions {
   timeoutMs?: number
+  /**
+   * Live sink for the command's output (the streaming network verbs). Called
+   * with already-decoded text so a multi-byte character split across ssh2
+   * chunks is never mangled; the accumulated `stdout`/`stderr` on the result
+   * keep the same bytes.
+   */
+  onData?: (stream: 'out' | 'err', text: string) => void
+  /** Receives the cancel handle once the run is under way (see `cancel`). */
+  onCancel?: (cancel: () => void) => void
   /**
    * Internal: send the line exactly as given — no session wrapper, and no group
    * kill when it times out. Only the two commands the pool sends on its own
@@ -291,6 +301,37 @@ export class RemotePool {
         let stream: ClientChannel | undefined
         let out = ''
         let err = ''
+        /** Set by the cancel handle: closed + group-killed, reported as error. */
+        let cancelled = false
+        const outDecoder = new StringDecoder('utf8')
+        const errDecoder = new StringDecoder('utf8')
+        /** Wrapper marker never reaches the live log (see the data handler). */
+        let pendingForward = ''
+        const forward = (kind: 'out' | 'err', text: string): void => {
+          if (text !== '' && opts.onData !== undefined) opts.onData(kind, text)
+        }
+        /**
+         * Cancel the run: close our channel and kill the remote process group.
+         *
+         * `finish` reports it as an error rather than a timeout — "the user
+         * stopped it" and "the budget ran out" are different stories, and the
+         * UI must not blame the host for the former.
+         */
+        const cancel = (): void => {
+          if (settled) return
+          cancelled = true
+          try {
+            stream?.close()
+          } catch {
+            // Already gone.
+          }
+          if (pgid !== undefined) terminateGroup()
+          // No session wrapper means no process group to signal: say so, like the
+          // timeout path does, instead of a silent "cancelled" with git still up.
+          else if (!session) warnOnce()
+          finish({ success: false, exitCode: null, timedOut: false, stdout: out, stderr: err, error: 'cancelled by user' })
+        }
+        opts.onCancel?.(cancel)
         conn.exec(session ? sessionLine(command) : command, (execError, channel) => {
           if (execError !== undefined && execError !== null) {
             finish({ success: false, exitCode: null, timedOut: false, stdout: '', stderr: '', error: execError.message })
@@ -318,11 +359,38 @@ export class RemotePool {
             // we send ourselves is not.
             if ((code !== null && code !== undefined) || (signalName !== null && signalName !== undefined)) exited = true
             if (timedOut && session && pgid === undefined) warnOnce()
+            // A channel can close before the marker is parsed (or in the middle
+            // of a single-line command's output): flush the held-back text so the
+            // live log does not lose its tail. A partial marker line itself is
+            // bookkeeping and stays hidden.
+            if (pendingForward !== '') {
+              const newline = pendingForward.indexOf('\n')
+              const visible = markerPending
+                ? pendingForward.startsWith(PGID_MARKER)
+                  ? (newline < 0 ? '' : pendingForward.slice(newline + 1))
+                  : pendingForward
+                : pendingForward
+              pendingForward = ''
+              forward('out', visible)
+            }
+            // Flush a decoder-held partial character before the final result.
+            const tailOut = outDecoder.end()
+            const tailErr = errDecoder.end()
+            if (tailOut !== '') { out = appendCapped(out, tailOut); forward('out', tailOut) }
+            if (tailErr !== '') { err = appendCapped(err, tailErr); forward('err', tailErr) }
             finish({ success: code === 0, exitCode: code, timedOut: false, stdout: out, stderr: err })
           })
           channel.on('data', (chunk: Buffer) => {
-            out = appendCapped(out, chunk.toString('utf8'))
-            if (pgid !== undefined || !markerPending) return
+            const text = outDecoder.write(chunk)
+            out = appendCapped(out, text)
+            if (pgid !== undefined || !markerPending) {
+              forward('out', text)
+              return
+            }
+            // The wrapper's group-marker line is bookkeeping, not command
+            // output: hold output until the marker is resolved, then forward
+            // only what the command itself printed.
+            pendingForward += text
             const marker = takePgid(out)
             if (marker.pgid !== undefined) {
               pgid = marker.pgid
@@ -331,13 +399,25 @@ export class RemotePool {
               // Only reachable when the timeout fired before this channel was
               // open: the group had no id then, so kill it now that it has one.
               if (timedOut) terminateGroup()
-            } else if (out.includes('\n')) {
+              if (cancelled) terminateGroup()
+              const newline = pendingForward.indexOf('\n')
+              const visible = newline < 0 ? '' : pendingForward.slice(newline + 1)
+              pendingForward = ''
+              forward('out', visible)
+              return
+            }
+            if (out.includes('\n') || pendingForward.length > 8192) {
               // The first line is the command's own output, not our marker.
               markerPending = false
+              const visible = pendingForward
+              pendingForward = ''
+              forward('out', visible)
             }
           })
           channel.stderr.on('data', (chunk: Buffer) => {
-            err = appendCapped(err, chunk.toString('utf8'))
+            const text = errDecoder.write(chunk)
+            err = appendCapped(err, text)
+            forward('err', text)
           })
         })
       })

package/src/protocol.ts

@@ -10,6 +10,8 @@ export const REMOTE_API = {
   test: '/api/dsh-remote/test',
   keygen: '/api/dsh-remote/keygen',
   exec: '/api/dsh-remote/exec',
+  /** Streaming exec (server-sent events) for the long network verbs. */
+  execStream: '/api/dsh-remote/exec-stream',
   files: '/api/dsh-remote/files',
   /** Streaming binary upload: raw request body, host and path in the query. */
   upload: '/api/dsh-remote/upload',
@@ -216,6 +218,18 @@ export interface RemoteExecResult {
   error?: string | undefined
 }
 
+/**
+ * One server-sent event of the streaming exec route.
+ *
+ * Used by the long network verbs (fetch / pull / push / sync) so the live git
+ * output can be shown while the command is still running; the unary exec route
+ * keeps serving everything that only needs the result.
+ */
+export type ExecStreamEvent =
+  | { t: 'out'; d: string }
+  | { t: 'err'; d: string }
+  | { t: 'exit'; success: boolean; exitCode: number | null; timedOut: boolean; durationMs: number; error?: string }
+
 /** Client -> server terminal frames (JSON text). */
 export type TerminalClientFrame =
   | { t: 'in'; d: string }

package/src/routes.ts

@@ -12,7 +12,7 @@ import type { Context } from '@deepseek-ai/cordis'
 import type { WebRoute, WebUpgradeRoute } from '@deepseek-ai/dsh-host-webserver'
 import { readJsonBody, writeJson } from './http.ts'
 import { isLoopbackRequest } from './loopback.ts'
-import { REMOTE_API, type ImportReport, type RemoteTimeouts } from './protocol.ts'
+import { REMOTE_API, type ExecStreamEvent, type ImportReport, type RemoteTimeouts } from './protocol.ts'
 import type { HostPayload, RemoteStore } from './store.ts'
 import type { RemotePool } from './pool.ts'
 import type { RemoteWorlds } from './p2/worlds.ts'
@@ -302,6 +302,140 @@ export function makeRoutes(deps: RemoteRoutesDeps): { routes: WebRoute[]; upgrad
         writeJson(res, 200, await pool.exec(body.alias, body.command, timeoutMs === undefined ? {} : { timeoutMs }))
       },
     },
+    // ----------------------------------------------------- exec (streaming)
+    {
+      kind: 'exact',
+      path: REMOTE_API.execStream,
+      handler: async (req, res) => {
+        if (!isLoopbackRequest(req)) {
+          writeJson(res, 403, { error: 'forbidden: loopback-only' })
+          return
+        }
+        if (req.method !== 'POST') {
+          writeJson(res, 405, { error: `method not allowed: ${req.method}` })
+          return
+        }
+        const body = (await readJsonBody(req, { objectOnly: true })) as {
+          alias?: unknown
+          command?: unknown
+          timeoutMs?: unknown
+        } | null
+        if (body === null || typeof body.alias !== 'string' || typeof body.command !== 'string' || body.command === '') {
+          writeJson(res, 400, { error: 'alias and a non-empty command are required' })
+          return
+        }
+        const timeoutMs = clampExecTimeout(body.timeoutMs)
+        res.writeHead(200, {
+          'Content-Type': 'text/event-stream; charset=utf-8',
+          'Cache-Control': 'no-cache, no-transform',
+          Connection: 'keep-alive',
+          // A reverse proxy must not buffer an event stream into uselessness.
+          'X-Accel-Buffering': 'no',
+        })
+        /** No more events to the client (finished, or the socket broke). */
+        let outputClosed = false
+        /** `res.end` already called. */
+        let ended = false
+        /** The client asked to stop: kill the remote even if the read is still opening. */
+        let cancelRequested = false
+        /** The cancel handle was invoked (only once). */
+        let cancelSent = false
+        let cancel: (() => void) | undefined
+        /** Server-side forward cap: the client shows a scrolling tail anyway. */
+        let sent = 0
+        const FORWARD_CAP = 4 * 1024 * 1024
+        /**
+         * Stop the remote process group exactly once.
+         *
+         * The disconnect may happen while `pool.exec` is still acquiring the
+         * channel (slot queue, setsid probe, connect) — the handle does not exist
+         * yet then, so the request is latched and fired the moment `onCancel`
+         * arrives; otherwise a push would finish unseen and uncancellable.
+         */
+        const abortRemote = (): void => {
+          cancelRequested = true
+          if (cancel === undefined || cancelSent) return
+          cancelSent = true
+          cancel()
+        }
+        const send = (event: ExecStreamEvent): void => {
+          if (outputClosed) return
+          try {
+            res.write(`data: ${JSON.stringify(event)}\n\n`)
+          } catch {
+            // A broken socket means the client is gone: stop the remote git too.
+            outputClosed = true
+            abortRemote()
+          }
+        }
+        const heartbeat = setInterval(() => {
+          if (outputClosed) return
+          try {
+            // SSE comment: keeps an idle connection alive without inventing data.
+            res.write(': ping\n\n')
+          } catch {
+            outputClosed = true
+            abortRemote()
+          }
+        }, 15_000)
+        heartbeat.unref?.()
+        const stop = (): void => {
+          if (ended) return
+          ended = true
+          outputClosed = true
+          clearInterval(heartbeat)
+          try {
+            res.end()
+          } catch {
+            // Already gone.
+          }
+        }
+        res.on('close', () => {
+          // Client aborted (tab closed / cancel button / broken socket): stop the
+          // remote git, not just our socket. Fires after a normal end too, where
+          // it is a no-op because the run already settled.
+          abortRemote()
+          stop()
+        })
+        try {
+          const result = await pool.exec(body.alias, body.command, {
+            ...(timeoutMs === undefined ? {} : { timeoutMs }),
+            onData: (stream, text) => {
+              if (outputClosed || sent >= FORWARD_CAP) return
+              sent += Buffer.byteLength(text, 'utf8')
+              send({ t: stream, d: text })
+            },
+            onCancel: (handle) => {
+              cancel = handle
+              if (cancelRequested && !cancelSent) {
+                cancelSent = true
+                handle()
+              }
+            },
+          })
+          if (outputClosed) return
+          send({
+            t: 'exit',
+            success: result.success,
+            exitCode: result.exitCode,
+            timedOut: result.timedOut,
+            durationMs: result.durationMs,
+            ...(result.error === undefined ? {} : { error: result.error }),
+          })
+        } catch (error) {
+          send({
+            t: 'exit',
+            success: false,
+            exitCode: null,
+            timedOut: false,
+            durationMs: 0,
+            error: error instanceof Error ? error.message : String(error),
+          })
+        } finally {
+          stop()
+        }
+      },
+    },
     // ------------------------------------------------------------- files
     {
       kind: 'exact',

package/src/timeouts.ts

@@ -21,8 +21,14 @@ import type { RemoteTimeouts } from './protocol.ts'
 /** Smallest accepted timeout: below this, local work would start failing. */
 export const MIN_TIMEOUT_MS = 1_000
 
-/** Largest accepted timeout — the exec route clamps to the same ceiling. */
-export const MAX_TIMEOUT_MS = 600_000
+/**
+ * Largest accepted timeout — the exec route clamps to the same ceiling.
+ *
+ * Raised from 10 to 30 minutes when the SCM push gained a live output panel:
+ * a Gerrit push on a large repo waits for server-side hooks and can outlast
+ * the old ceiling with nothing wrong on either side.
+ */
+export const MAX_TIMEOUT_MS = 1_800_000
 
 /**
  * Default for one git command (status/log/branches/diff over exec).
@@ -34,6 +40,16 @@ export const MAX_TIMEOUT_MS = 600_000
  */
 export const DEFAULT_GIT_TIMEOUT_MS = 300_000
 
+/**
+ * Floor for the NETWORK verbs (fetch / pull / push / sync).
+ *
+ * These wait on the far end's hooks and pack transfer, not on this machine, so
+ * their budget starts at 20 minutes and grows with `gitTimeoutMs × 2` up to
+ * `MAX_TIMEOUT_MS`. The old formula started at 5 minutes and capped at 10, which
+ * killed healthy Gerrit pushes.
+ */
+export const DEFAULT_NETWORK_TIMEOUT_MS = 1_200_000
+
 /** Default for one SFTP file read (editor, diff sides, document preview). */
 export const DEFAULT_READ_TIMEOUT_MS = 120_000