git-watchtower 2.3.20 → 2.3.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-watchtower",
-  "version": "2.3.20",
+  "version": "2.3.22",
   "description": "Terminal-based Git branch monitor with activity sparklines and optional dev server with live reload",
   "main": "bin/git-watchtower.js",
   "bin": {

package/src/casino/index.js

@@ -6,7 +6,7 @@
  * like hitting the jackpot.
  */
 
-const { ansi, box } = require('../ui/ansi');
+const { ansi, box, visibleLength } = require('../ui/ansi');
 const sounds = require('./sounds');
 
 // ============================================================================
@@ -537,7 +537,13 @@ function getWinDisplay(width) {
   const label = currentWinLevel.label;
   const color = flashOn ? currentWinLevel.color : ansi.dim + currentWinLevel.color;
 
-  const padding = Math.max(0, Math.floor((width - label.length) / 2));
+  // Use visibleLength so multi-codepoint emoji clusters (ZWJ family,
+  // flag emoji, variation selectors) are counted by display columns
+  // rather than UTF-16 code units. The current WIN_LEVELS labels happen
+  // to use 2-codepoint emoji whose .length matches column width, but a
+  // future label with a flag or family emoji would otherwise center
+  // off by one or more columns per glyph.
+  const padding = Math.max(0, Math.floor((width - visibleLength(label)) / 2));
 
   return color + ' '.repeat(padding) + label + ' '.repeat(padding) + ansi.reset;
 }
@@ -615,7 +621,10 @@ function getLossDisplay(width) {
   const display = `${symbols}${lossMessage}${symbols}`;
   const color = flashOn ? ansi.bgRed + ansi.white : ansi.bgBlack + ansi.red;
 
-  const padding = Math.max(0, Math.floor((width - display.length) / 2));
+  // Same reasoning as getWinDisplay: count terminal columns, not UTF-16
+  // code units. Untrusted lossMessage strings can also contain wide
+  // characters (e.g. CJK in error messages from a localised git build).
+  const padding = Math.max(0, Math.floor((width - visibleLength(display)) / 2));
 
   return color + ' '.repeat(padding) + display + ' '.repeat(padding) + ansi.reset;
 }

package/src/state/store.js

@@ -209,15 +209,47 @@ class Store {
   }
 
   /**
-   * Get a copy of the current state
+   * Get a snapshot of the current state.
+   *
+   * The top-level object is a shallow copy (so adding/removing top-level
+   * keys on the returned object does not mutate the store). Map values
+   * (sparklineCache, branchPrStatusMap, aheadBehindCache) are also
+   * shallow-cloned so that consumers — most importantly the web
+   * dashboard's getSerializableState — can iterate or mutate the
+   * snapshot without the store's live data shifting underneath them.
+   *
+   * If you need the live, by-reference Map for in-place mutation
+   * followed by setState() (the polling cache-prune pattern), use
+   * `get(key)` instead.
+   *
    * @returns {State}
    */
   getState() {
-    return { ...this.state };
+    const snapshot = { ...this.state };
+    if (snapshot.sparklineCache instanceof Map) {
+      snapshot.sparklineCache = new Map(snapshot.sparklineCache);
+    }
+    if (snapshot.branchPrStatusMap instanceof Map) {
+      snapshot.branchPrStatusMap = new Map(snapshot.branchPrStatusMap);
+    }
+    if (snapshot.aheadBehindCache instanceof Map) {
+      snapshot.aheadBehindCache = new Map(snapshot.aheadBehindCache);
+    }
+    return snapshot;
   }
 
   /**
-   * Get a specific state value
+   * Get a specific state value by-reference.
+   *
+   * IMPORTANT: returns the live value, not a copy. For Map values
+   * (sparklineCache, branchPrStatusMap, aheadBehindCache) this is
+   * deliberate — the polling layer mutates these in place and then
+   * calls setState({key: sameMap}) to notify subscribers. Code that
+   * doesn't intend to mutate should treat the result as read-only,
+   * or copy it first (e.g. `new Map(store.get('sparklineCache'))`).
+   *
+   * For an isolation-safe snapshot, prefer `getState()`.
+   *
    * @template {keyof State} K
    * @param {K} key - State key
    * @returns {State[K]}