git-watchtower 2.1.13 → 2.1.15

package/bin/git-watchtower.js

@@ -881,6 +881,50 @@ let errorToastTimeout = null;
 // Shape: { type: 'switch', branch: string } | { type: 'pull' } | null
 let pendingDirtyOperation = null;
 
+/**
+ * Setter for pendingDirtyOperation that refuses to overwrite an
+ * already-pending operation. Returns true if the assignment succeeded,
+ * false if a different operation was already pending and the caller
+ * should skip its follow-up (e.g. the showStashConfirm modal).
+ *
+ * Why this matters: process.stdin's 'data' listener is async, so two
+ * near-simultaneous keypresses spawn concurrent handler bodies. If the
+ * user presses Enter (switch) and then 'p' (pull) within the ~100 ms
+ * it takes hasUncommittedChanges to await, both bodies reach the
+ * dirty-repo branch and the second one's pendingDirtyOperation
+ * silently clobbers the first. The user then sees a stash-confirm
+ * modal labeled "pull" even though they pressed Enter, and the
+ * original switch intent is lost. Refusing the overwrite preserves
+ * the first user action and surfaces the conflict via the activity
+ * log rather than dropping intent on the floor.
+ *
+ * Note: the check + assignment here is synchronous, so JavaScript's
+ * single-threaded event loop guarantees no interleaving — two callers
+ * will see consistent state.
+ *
+ * @param {{type: 'switch', branch: string} | {type: 'pull'} | null} op
+ * @returns {boolean} true if assigned, false if refused (already pending)
+ */
+function setPendingDirtyOp(op) {
+  if (op !== null && pendingDirtyOperation !== null) {
+    addLog(
+      `Another operation already pending (${pendingDirtyOperation.type}) — resolve the stash dialog first`,
+      'warning',
+    );
+    return false;
+  }
+  pendingDirtyOperation = op;
+  return true;
+}
+
+/**
+ * Clear pendingDirtyOperation. Symmetric with setPendingDirtyOp so all
+ * mutations route through the same surface.
+ */
+function clearPendingDirtyOp() {
+  pendingDirtyOperation = null;
+}
+
 // Cached environment info (populated once at startup, doesn't change during session)
 let cachedEnv = null; // { hasGh, hasGlab, ghAuthed, glabAuthed, webUrlBase, platform }
 
@@ -1524,8 +1568,9 @@ async function switchToBranch(branchName, recordHistory = true) {
     const isDirty = await hasUncommittedChanges();
     if (isDirty) {
       addLog(`Cannot switch: uncommitted changes in working directory`, 'error');
-      pendingDirtyOperation = { type: 'switch', branch: branchName };
-      showStashConfirm(`switch to ${branchName}`);
+      if (setPendingDirtyOp({ type: 'switch', branch: branchName })) {
+        showStashConfirm(`switch to ${branchName}`);
+      }
       telemetry.capture('dirty_repo_encountered');
       return { success: false, reason: 'dirty' };
     }
@@ -1563,7 +1608,7 @@ async function switchToBranch(branchName, recordHistory = true) {
     addLog(`Switched to ${safeBranchName}`, 'success');
     telemetry.capture('branch_switched');
     branchSwitchCount++;
-    pendingDirtyOperation = null;
+    clearPendingDirtyOp();
 
     // Restart server if configured (command mode)
     if (SERVER_MODE === 'command' && RESTART_ON_SWITCH && serverProcess) {
@@ -1583,8 +1628,9 @@ async function switchToBranch(branchName, recordHistory = true) {
       );
     } else if (errMsg.includes('local changes') || errMsg.includes('overwritten')) {
       addLog(`Cannot switch: local changes would be overwritten`, 'error');
-      pendingDirtyOperation = { type: 'switch', branch: branchName };
-      showStashConfirm(`switch to ${branchName}`);
+      if (setPendingDirtyOp({ type: 'switch', branch: branchName })) {
+        showStashConfirm(`switch to ${branchName}`);
+      }
     } else {
       addLog(`Failed to switch: ${errMsg}`, 'error');
       showErrorToast(
@@ -1618,8 +1664,9 @@ async function undoLastSwitch() {
 
     if (await hasUncommittedChanges()) {
       addLog('Cannot undo: uncommitted changes in working directory', 'error');
-      pendingDirtyOperation = { type: 'switch', branch: lastSwitch.from };
-      showStashConfirm(`undo to detached HEAD ${hash}`);
+      if (setPendingDirtyOp({ type: 'switch', branch: lastSwitch.from })) {
+        showStashConfirm(`undo to detached HEAD ${hash}`);
+      }
       return { success: false, reason: 'dirty' };
     }
 
@@ -1632,7 +1679,7 @@ async function undoLastSwitch() {
       });
       addLog(`Undone: detached HEAD at ${hash}`, 'success');
       branchSwitchCount++;
-      pendingDirtyOperation = null;
+      clearPendingDirtyOp();
       notifyClients();
       return { success: true };
     } catch (e) {
@@ -1699,7 +1746,7 @@ async function pullCurrentBranch() {
       }
       addLog(`Pulled ${REMOTE_NAME}/${branch}${summary}`, 'success');
     }
-    pendingDirtyOperation = null;
+    clearPendingDirtyOp();
     notifyClients();
     return { success: true };
   } catch (e) {
@@ -1707,8 +1754,9 @@ async function pullCurrentBranch() {
     addLog(`Pull failed: ${errMsg}`, 'error');
 
     if (errMsg.includes('local changes') || errMsg.includes('overwritten') || errMsg.includes('uncommitted changes')) {
-      pendingDirtyOperation = { type: 'pull' };
-      showStashConfirm('pull');
+      if (setPendingDirtyOp({ type: 'pull' })) {
+        showStashConfirm('pull');
+      }
     } else if (isMergeConflict(errMsg)) {
       store.setState({ hasMergeConflict: true });
       showErrorToast(
@@ -1747,7 +1795,7 @@ async function stashAndRetry() {
     return;
   }
 
-  pendingDirtyOperation = null;
+  clearPendingDirtyOp();
   hideErrorToast();
   hideStashConfirm();
 
@@ -2830,7 +2878,7 @@ function setupKeyboardInput() {
           await stashAndRetry();
         } else {
           addLog('Stash cancelled — handle changes manually', 'info');
-          pendingDirtyOperation = null;
+          clearPendingDirtyOp();
         }
         return;
       }
@@ -2844,7 +2892,7 @@ function setupKeyboardInput() {
       if (key === '\u001b') { // Escape — cancel
         hideStashConfirm();
         addLog('Stash cancelled — handle changes manually', 'info');
-        pendingDirtyOperation = null;
+        clearPendingDirtyOp();
         render();
         return;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-watchtower",
-  "version": "2.1.13",
+  "version": "2.1.15",
   "description": "Terminal-based Git branch monitor with activity sparklines and optional dev server with live reload",
   "main": "bin/git-watchtower.js",
   "bin": {

package/src/server/coordinator.js

@@ -34,6 +34,18 @@ const WATCHTOWER_DIR = path.join(os.homedir(), '.watchtower');
  */
 const MAX_IPC_BUFFER = 1024 * 1024;
 
+/**
+ * How long the coordinator gives an accepted connection to send a
+ * `register` frame before destroying the socket. Legitimate workers
+ * send register immediately on connect (sub-100 ms in practice), so
+ * 5 s is generous. Without this, a peer that opens a connection and
+ * sits idle without registering consumes one of the
+ * MAX_WORKER_CONNECTIONS slots indefinitely — so a runaway peer that
+ * never sends data could lock out legitimate workers even though it
+ * is below the connection cap.
+ */
+const WORKER_REGISTER_TIMEOUT_MS = 5000;
+
 /**
  * Maximum number of concurrent worker connections the coordinator will
  * accept. The legitimate ceiling is "one git-watchtower instance per
@@ -379,6 +391,21 @@ class Coordinator {
     let workerId = null;
     let buffer = '';
 
+    // Drop the socket if the peer doesn't complete the register handshake
+    // in time. Cleared by setWorkerId on a successful 'register' frame
+    // and on close/error to avoid acting on a destroyed socket.
+    const registerTimer = setTimeout(() => {
+      if (!workerId) {
+        socket.destroy();
+      }
+    }, WORKER_REGISTER_TIMEOUT_MS);
+    if (registerTimer.unref) registerTimer.unref();
+
+    const setWorkerId = (id) => {
+      workerId = id;
+      clearTimeout(registerTimer);
+    };
+
     socket.on('data', (data) => {
       buffer += data.toString();
       if (buffer.length > MAX_IPC_BUFFER) {
@@ -392,7 +419,7 @@ class Coordinator {
         if (line.trim()) {
           try {
             const msg = JSON.parse(line);
-            this._handleWorkerMessage(socket, msg, (id) => { workerId = id; }, () => workerId);
+            this._handleWorkerMessage(socket, msg, setWorkerId, () => workerId);
           } catch (e) {
             // Both sides of this socket are our own code, so a JSON-parse
             // failure indicates a protocol/version bug worth diagnosing.
@@ -404,6 +431,7 @@ class Coordinator {
     });
 
     socket.on('close', () => {
+      clearTimeout(registerTimer);
       if (workerId) {
         this.projects.delete(workerId);
         this.workerSockets.delete(workerId);
@@ -412,6 +440,7 @@ class Coordinator {
     });
 
     socket.on('error', () => {
+      clearTimeout(registerTimer);
       if (workerId) {
         this.projects.delete(workerId);
         this.workerSockets.delete(workerId);
@@ -741,4 +770,5 @@ module.exports = {
   SOCKET_PATH,
   MAX_IPC_BUFFER,
   MAX_WORKER_CONNECTIONS,
+  WORKER_REGISTER_TIMEOUT_MS,
 };