git-watchtower 2.3.11 → 2.3.13

package/bin/git-watchtower.js

@@ -63,6 +63,7 @@ const readline = require('readline');
 // Casino mode - Vegas-style feedback effects
 const casino = require('../src/casino');
 const casinoSounds = require('../src/casino/sounds');
+const { sumPollChurn } = require('../src/casino/poll-churn');
 
 // Gitignore utilities for file watcher
 const { loadGitignorePatterns, shouldIgnoreFile } = require('../src/utils/gitignore');
@@ -1995,8 +1996,13 @@ async function pollGitChanges() {
     // Keep deleted branches in the list (don't remove them)
     const pollFilteredBranches = allBranches;
 
-    // Detect updates on other branches (for flash notification)
+    // Detect updates on other branches (for flash notification).
+    // We also capture each updated branch's pre-update commit so the casino
+    // win calculation can compute REAL line churn via git diff, instead of
+    // the old `notifyBranches.length * 100` placeholder that surfaced as
+    // inflated dashboard numbers.
     const updatedBranches = [];
+    const updatedBranchPrevCommits = new Map();
     const currentBranchName = store.get('currentBranch');
     const activeBranchNames = new Set();
     for (const branch of pollFilteredBranches) {
@@ -2007,6 +2013,7 @@ async function pollGitChanges() {
       const prevCommit = previousBranchStates.get(branch.name);
       if (prevCommit && prevCommit !== branch.commit && branch.name !== currentBranchName) {
         updatedBranches.push(branch);
+        updatedBranchPrevCommits.set(branch.name, prevCommit);
         branch.justUpdated = true;
       }
       previousBranchStates.set(branch.name, branch.commit);
@@ -2041,14 +2048,25 @@ async function pollGitChanges() {
       showFlash(names);
       playSound();
 
-      // Casino mode: trigger win effect based on number of updated branches
+      // Casino mode: trigger win effect based on REAL line churn from
+      // each updated branch's prev → new commit. New branches (no prev
+      // commit) contribute 0 — the win still fires from the slot animation
+      // path, but no fake volume is added to totalLinesAdded.
       if (casinoOn) {
-        // Estimate line changes: more branches = bigger "win"
-        // Each branch update counts as ~100 lines (placeholder until we calculate actual diff)
-        const estimatedLines = notifyBranches.length * 100;
-        const winLevel = casino.getWinLevel(estimatedLines);
+        const churn = await sumPollChurn(
+          updatedBranches,
+          updatedBranchPrevCommits,
+          getDiffStats
+        );
+        const totalLines = churn.added + churn.deleted;
+        // getWinLevel(0) returns null and would skip the slot result label
+        // and the sound. Use max(1, totalLines) so a no-line update (e.g.
+        // a tag-only commit, an empty merge) still registers as a "small"
+        // win — the user did get a notification, after all.
+        const winLines = Math.max(1, totalLines);
+        const winLevel = casino.getWinLevel(winLines);
         casino.stopSlotReels(true, render, winLevel);  // Win - matching symbols + flash + label
-        casino.triggerWin(estimatedLines, 0, render);
+        casino.triggerWin(churn.added, churn.deleted, render);
         if (winLevel) {
           casinoSounds.playForWinLevel(winLevel.key);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-watchtower",
-  "version": "2.3.11",
+  "version": "2.3.13",
   "description": "Terminal-based Git branch monitor with activity sparklines and optional dev server with live reload",
   "main": "bin/git-watchtower.js",
   "bin": {

package/src/casino/index.js

@@ -110,6 +110,13 @@ function disable() {
   // up to ~15 frames × 120 ms = 1.8 s after disable, and lossMessage stayed
   // set so isLossAnimating() reported true into the next session.
   resetLossState();
+  // Drop the marquee render callback so a stale closure to the previous
+  // session's render() doesn't survive across enable/disable cycles. In
+  // production this is mostly hygiene (bin/git-watchtower.js wires the
+  // callback exactly once at startup against a singleton render fn), but
+  // tests that re-use the casino module saw the previous test's callback
+  // persist into the next setRenderCallback assignment.
+  marqueeCallback = null;
 }
 
 /**

package/src/casino/poll-churn.js

@@ -0,0 +1,53 @@
+/**
+ * Casino mode "win" line-count aggregation.
+ *
+ * The polling loop used to fake the line-change total as
+ * `notifyBranches.length * 100` — a placeholder that surfaced as inflated
+ * (and incorrect) numbers in the dashboard's "+lines" / netWinnings
+ * displays. This module sums the REAL diff between each updated branch's
+ * previous commit and its new commit so the casino stats track actual
+ * code churn.
+ *
+ * @module casino/poll-churn
+ */
+
+/**
+ * Sum the diff churn across a list of updated branches by running the
+ * caller-supplied diff function on each (prev → new) pair in parallel.
+ * Branches missing a prev commit (e.g. brand-new branches) contribute 0,
+ * so a notification still fires but no fake line count is invented.
+ *
+ * @param {Array<{name: string, commit: string}>} updatedBranches
+ * @param {Map<string, string>} prevCommits - map of branch.name → previous commit hash
+ * @param {(from: string, to: string) => Promise<{added: number, deleted: number}>} diffFn
+ * @returns {Promise<{added: number, deleted: number}>}
+ */
+async function sumPollChurn(updatedBranches, prevCommits, diffFn) {
+  if (!updatedBranches || updatedBranches.length === 0) {
+    return { added: 0, deleted: 0 };
+  }
+  const results = await Promise.all(
+    updatedBranches.map(async (branch) => {
+      const prev = prevCommits ? prevCommits.get(branch.name) : null;
+      if (!prev || !branch.commit) return { added: 0, deleted: 0 };
+      try {
+        const r = await diffFn(prev, branch.commit);
+        return {
+          added: Number.isFinite(r && r.added) ? r.added : 0,
+          deleted: Number.isFinite(r && r.deleted) ? r.deleted : 0,
+        };
+      } catch (e) {
+        // diffFn already returns { added: 0, deleted: 0 } on git failure
+        // (see src/git/commands.js#getDiffStats), but guard against a
+        // throwing test stub or future caller passing a stricter fn.
+        return { added: 0, deleted: 0 };
+      }
+    })
+  );
+  return results.reduce(
+    (acc, d) => ({ added: acc.added + d.added, deleted: acc.deleted + d.deleted }),
+    { added: 0, deleted: 0 }
+  );
+}
+
+module.exports = { sumPollChurn };

package/src/server/web.js

@@ -46,6 +46,36 @@ const SSE_KEEPALIVE_INTERVAL = 15000;
  */
 const MAX_STALLED_PUSHES = 60;
 
+/**
+ * Content-Security-Policy header for the dashboard HTML.
+ *
+ * The dashboard uses inline <script> and inline <style> blocks (the whole
+ * UI is bundled at build time), and makes XHR / EventSource calls to
+ * /api/... on the same origin. No external resources are loaded.
+ *
+ * `default-src 'none'` denies everything not explicitly allowed.
+ * `script-src` / `style-src` need 'unsafe-inline' for the bundled blocks.
+ * `connect-src 'self'` lets XHR + SSE hit /api/... .
+ * `base-uri 'none'` blocks <base> injection from rewriting URLs.
+ * `form-action 'none'` blocks any rogue form posts.
+ * `frame-ancestors 'none'` blocks embedding (defense vs. clickjacking).
+ *
+ * Defense-in-depth — the dashboard already escapes user-supplied content
+ * everywhere we render it, but a future regression that forgets escHtml
+ * is mitigated here.
+ */
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'none'",
+  "script-src 'self' 'unsafe-inline'",
+  "style-src 'self' 'unsafe-inline'",
+  "connect-src 'self'",
+  "img-src 'self' data:",
+  "font-src 'self'",
+  "base-uri 'none'",
+  "form-action 'none'",
+  "frame-ancestors 'none'",
+].join('; ');
+
 /**
  * Actions the web dashboard is allowed to POST to /api/action. Every entry
  * here MUST be matched by a `case` in `handleWebAction` in bin/git-watchtower.js
@@ -474,7 +504,12 @@ class WebDashboardServer {
 
     // Routes
     if (pathname === '/' && req.method === 'GET') {
-      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+      res.writeHead(200, {
+        'Content-Type': 'text/html; charset=utf-8',
+        'Content-Security-Policy': CONTENT_SECURITY_POLICY,
+        'X-Content-Type-Options': 'nosniff',
+        'Referrer-Policy': 'no-referrer',
+      });
       res.end(this._cachedHtml);
       return;
     }
@@ -673,4 +708,5 @@ module.exports = {
   STATE_PUSH_INTERVAL,
   MAX_STALLED_PUSHES,
   ALLOWED_ACTIONS,
+  CONTENT_SECURITY_POLICY,
 };