git-watchtower 2.3.18 → 2.3.20

package/bin/git-watchtower.js

@@ -1881,18 +1881,24 @@ async function pollGitChanges() {
   // Skip if a poll is already in progress (don't queue)
   if (pollMutex.isLocked()) return;
   const pollToken = await pollMutex.acquire();
-  store.setState({ isPolling: true, pollingStatus: 'fetching' });
 
-  // Casino mode: start slot reels spinning (no sound - too annoying)
-  if (store.get('casinoModeEnabled')) {
-    casino.startSlotReels(render);
-  }
+  // Everything past acquire() must be wrapped so the finally releases
+  // the token. The previous shape kept the setState / casino.startSlotReels
+  // / render() calls outside the try, so a throw from any of them (e.g. a
+  // store middleware error, a casino interval-setup failure) leaked the
+  // mutex permanently and stalled every subsequent poll cycle.
+  try {
+    store.setState({ isPolling: true, pollingStatus: 'fetching' });
 
-  render();
+    // Casino mode: start slot reels spinning (no sound - too annoying)
+    if (store.get('casinoModeEnabled')) {
+      casino.startSlotReels(render);
+    }
 
-  const fetchStartTime = Date.now();
+    render();
+
+    const fetchStartTime = Date.now();
 
-  try {
     const newCurrentBranch = await getCurrentBranch();
     const prevCurrentBranch = store.get('currentBranch');
 
@@ -2004,12 +2010,10 @@ async function pollGitChanges() {
     const updatedBranches = [];
     const updatedBranchPrevCommits = new Map();
     const currentBranchName = store.get('currentBranch');
-    const activeBranchNames = new Set();
     for (const branch of pollFilteredBranches) {
       // Clear previous cycle's flag so only freshly-updated branches are highlighted
       branch.justUpdated = false;
       if (branch.isDeleted) continue;
-      activeBranchNames.add(branch.name);
       const prevCommit = previousBranchStates.get(branch.name);
       if (prevCommit && prevCommit !== branch.commit && branch.name !== currentBranchName) {
         updatedBranches.push(branch);
@@ -2019,17 +2023,13 @@ async function pollGitChanges() {
       previousBranchStates.set(branch.name, branch.commit);
     }
 
-    // Remove stale entries from caches for branches
-    // that no longer exist in the current poll results
-    const staleCaches = [previousBranchStates, prInfoCache, store.get('sparklineCache'), store.get('aheadBehindCache')];
-    for (const cache of staleCaches) {
-      if (!cache) continue;
-      for (const name of cache.keys()) {
-        if (!activeBranchNames.has(name)) {
-          cache.delete(name);
-        }
-      }
-    }
+    // (No second prune pass here — pruneStaleEntries above already prunes
+    // these four caches against fetchedBranchNames with a 30 s deleted-
+    // branch grace period. The previous extra loop pruned against the
+    // active-only set instead, which excluded isDeleted entries and so
+    // wiped a recently-deleted branch's sparkline / PR status / ahead-
+    // behind data IMMEDIATELY — contradicting the retention window the
+    // first prune was specifically designed to provide.)
 
     // Flash and sound for updates or new branches
     const casinoOn = store.get('casinoModeEnabled');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-watchtower",
-  "version": "2.3.18",
+  "version": "2.3.20",
   "description": "Terminal-based Git branch monitor with activity sparklines and optional dev server with live reload",
   "main": "bin/git-watchtower.js",
   "bin": {

package/src/ui/ansi.js

@@ -296,8 +296,15 @@ const NON_SGR_CSI_RE = /\x1b\[[\x30-\x3f]*[\x20-\x2f]*[\x40-\x6c\x6e-\x7e]/g;
 
 // Match OSC sequences: ESC ] ... terminator (BEL or ESC \). These set
 // terminal title, hyperlinks, etc. — all undesirable in untrusted input.
+// The trailing `|$` alternation also matches an UNTERMINATED OSC tail
+// (`\x1b]0;evil-text` with no \x07 / \x1b\\ before EOF). Without it,
+// the literal payload survived sanitisation as visible text — ESC_RE
+// stripped the leading `\x1b]` since `]` is in the `\\-_` range, but
+// "0;evil-text" remained. Per ECMA-48, an unterminated OSC at EOF is
+// effectively an open control string, so dropping it entirely is the
+// safe default.
 // eslint-disable-next-line no-control-regex
-const OSC_RE = /\x1b\][\s\S]*?(?:\x07|\x1b\\)/g;
+const OSC_RE = /\x1b\][\s\S]*?(?:\x07|\x1b\\|$)/g;
 
 // Match other 2-byte ESC sequences (Fe codes 0x40-0x5F) excluding CSI ([)
 // and OSC (]) which are handled separately above.