hologit 0.50.2 → 0.50.3

package/holo-tree/src/tree.rs

@@ -324,57 +324,49 @@ impl MutableTree {
 
     /// Navigate to a subtree, creating intermediate empty trees as needed.
     ///
-    /// **Marks all ancestors dirty** when any new node is created, matching
-    /// the JS `getSubtreeStack(path, create=true)` behavior.
+    /// This is the **mutating** navigator: callers reach for it to change the
+    /// destination (write a child, insert a gitlink, …). So every node along
+    /// the path — root included — is marked dirty, because each one's
+    /// serialized form will change once `write()` propagates the mutation back
+    /// up. (The earlier behavior only marked the path dirty when a *new* node
+    /// was created, which silently dropped writes into an already-existing
+    /// directory: the leaf was dirtied but its clean ancestors short-circuited
+    /// in `write()`.)
     pub fn get_or_create_subtree(
         &mut self,
         repo: &gix::Repository,
         path: &str,
     ) -> Result<&mut MutableTree> {
         if path == "." || path.is_empty() {
-            return Ok(self);
-        }
-
-        let parts: Vec<&str> = path.split('/').collect();
-
-        // First pass: detect whether any node needs to be created.
-        let mut needs_create = false;
-        {
-            let mut check = &mut *self;
-            for part in &parts {
-                check.ensure_children(repo)?;
-                if !check.children.as_ref().unwrap().contains_key(*part) {
-                    needs_create = true;
-                    break;
-                }
-                match check.children.as_mut().unwrap().get_mut(*part) {
-                    Some(Child::Tree(ref mut t)) => check = t,
-                    _ => break,
-                }
-            }
-        }
-
-        if needs_create {
+            // Destination is the root itself. Mark dirty and load its children
+            // so a mutating caller (e.g. write_child_bytes for a repo-root file
+            // like "a.toml", whose dir is ".") can insert alongside existing
+            // entries — rather than panic on `children.as_mut().unwrap()` when
+            // the root was lazily loaded from a ref. Same postcondition as the
+            // deep-path return below.
             self.dirty = true;
+            self.ensure_children(repo)?;
+            return Ok(self);
         }
 
-        // Second pass: create missing nodes.
+        self.dirty = true;
         let mut cur = self;
-        for part in parts {
+        for part in path.split('/') {
             cur.ensure_children(repo)?;
-            let children = cur.children.as_mut().unwrap();
-
-            let child = children.entry(part.to_string()).or_insert_with(|| {
-                let mut t = MutableTree::empty();
-                t.dirty = true;
-                Child::Tree(t)
-            });
+            let child = cur
+                .children
+                .as_mut()
+                .unwrap()
+                .entry(part.to_string())
+                .or_insert_with(|| {
+                    let mut t = MutableTree::empty();
+                    t.dirty = true;
+                    Child::Tree(t)
+                });
 
             cur = match child {
                 Child::Tree(ref mut t) => {
-                    if needs_create {
-                        t.dirty = true;
-                    }
+                    t.dirty = true;
                     t
                 }
                 _ => {
@@ -385,6 +377,14 @@ impl MutableTree {
                 }
             };
         }
+        // Postcondition: the returned node has its children loaded. Navigation
+        // above only ensures children on nodes it descends *through*; a final
+        // node that already exists in the parent tree is lazily loaded
+        // (`children: None`). Callers that mutate the returned node (e.g.
+        // `write_child_bytes`) rely on `children` being `Some` — and loading
+        // here is also what preserves existing siblings when writing into an
+        // existing directory.
+        cur.ensure_children(repo)?;
         Ok(cur)
     }
 
@@ -507,6 +507,68 @@ impl MutableTree {
         Ok(blob_id)
     }
 
+    /// Place an already-written blob at a deep path by its hash, without reading
+    /// its bytes.
+    ///
+    /// Unlike [`write_child_bytes`](Self::write_child_bytes), which takes blob
+    /// *content* and writes (re-hashes) it, this grafts a blob that already
+    /// exists in the ODB. A consumer that holds a content-addressed blob hash —
+    /// because it wrote the blob earlier, or received the hash from elsewhere —
+    /// can place it without handing over the bytes again. `mode` is the git entry
+    /// mode for the blob: `0o100644` (regular), `0o100755` (executable), or
+    /// `0o120000` (symlink).
+    ///
+    /// The object is validated to exist and be a blob via an object *header*
+    /// lookup, which does not decode the blob payload — so placing a large
+    /// attachment stays independent of its byte size rather than paying a full
+    /// ODB read + re-hash.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if `hash` does not exist in the ODB or is not a blob, if
+    /// `mode` is not a valid blob mode, or if an intermediate path component
+    /// exists but is not a tree (same footgun guard as
+    /// [`write_child_bytes`](Self::write_child_bytes)).
+    pub fn write_child_hash(
+        &mut self,
+        repo: &gix::Repository,
+        path: &str,
+        hash: ObjectId,
+        mode: u16,
+    ) -> Result<()> {
+        if !matches!(mode, 0o100644 | 0o100755 | 0o120000) {
+            return Err(Error::Git(format!(
+                "invalid blob mode {mode:o} for {path}: expected 100644, 100755, or 120000"
+            )));
+        }
+
+        // Validate existence + kind from the object header, without decoding the
+        // blob — that byte-read is exactly what a place-by-hash caller wants to
+        // skip.
+        let header = repo
+            .find_header(hash)
+            .map_err(|e| Error::Git(e.to_string()))?;
+        if header.kind() != gix::object::Kind::Blob {
+            return Err(Error::Git(format!(
+                "object {hash} is not a blob (found {:?})",
+                header.kind()
+            )));
+        }
+
+        let (dir, name) = match path.rsplit_once('/') {
+            Some((d, f)) => (d, f),
+            None => (".", path),
+        };
+
+        let tree = self.get_or_create_subtree(repo, dir)?;
+        tree.children
+            .as_mut()
+            .unwrap()
+            .insert(name.to_string(), Child::Blob { mode, hash });
+        tree.dirty = true;
+        Ok(())
+    }
+
     /// Delete a child at a deep slash-separated path (not just a direct child).
     pub fn delete_child_deep(
         &mut self,
@@ -518,10 +580,67 @@ impl MutableTree {
             None => return self.delete_child(repo, path),
         };
 
-        match self.get_subtree(repo, dir)? {
-            Some(tree) => tree.delete_child(repo, name),
-            None => Ok(false),
+        // Mark the path to `dir` dirty as we descend: removing a descendant
+        // changes every ancestor's serialized form, so all must be rewritten by
+        // write(). The previous read-only `get_subtree` navigation dirtied only
+        // the leaf dir, so a clean root short-circuited in write() and the
+        // deletion was silently dropped. (If the path doesn't fully exist there
+        // is nothing to delete; the few nodes dirtied along the way re-serialize
+        // to identical hashes, so over-dirtying on a miss is harmless.)
+        self.dirty = true;
+        let mut cur = self;
+        for part in dir.split('/') {
+            if part.is_empty() || part == "." {
+                continue;
+            }
+            cur.ensure_children(repo)?;
+            match cur.children.as_mut().unwrap().get_mut(part) {
+                Some(Child::Tree(t)) => {
+                    t.dirty = true;
+                    cur = t;
+                }
+                _ => return Ok(false),
+            }
+        }
+        cur.delete_child(repo, name)
+    }
+
+    /// Clear all children under a deep `path`, replacing the subtree there
+    /// with the empty tree and marking the ancestor chain dirty.
+    ///
+    /// This is an **O(1)** clear: it does not load the cleared subtree's own
+    /// contents from the ODB — only the ancestor trees needed to navigate to
+    /// its parent. Intermediate trees along `path` are created if absent; since
+    /// an empty subtree is pruned on `write()`, clearing a path that doesn't
+    /// exist is a no-op in the written result.
+    ///
+    /// `path == "."` (or empty) clears the root tree itself.
+    pub fn clear_children(&mut self, repo: &gix::Repository, path: &str) -> Result<()> {
+        if path == "." || path.is_empty() {
+            self.children = Some(BTreeMap::new());
+            self.hash = empty_tree_id();
+            self.dirty = true;
+            return Ok(());
         }
+
+        let (dir, name) = match path.rsplit_once('/') {
+            Some((d, f)) => (d, f),
+            None => (".", path),
+        };
+
+        // get_or_create_subtree marks the whole navigated path (root included)
+        // dirty, which is exactly what we need: every ancestor's serialized
+        // form changes once the cleared subtree is pruned on write().
+        let parent = self.get_or_create_subtree(repo, dir)?;
+        let mut empty = MutableTree::empty();
+        empty.dirty = true;
+        parent
+            .children
+            .as_mut()
+            .unwrap()
+            .insert(name.to_string(), Child::Tree(empty));
+        parent.dirty = true;
+        Ok(())
     }
 
     /// Recursively collect all blobs into a flat map.

package/holo-tree/tests/clear_children.rs

@@ -0,0 +1,95 @@
+//! Tests for `MutableTree::clear_children` — the O(1) subtree clear that
+//! gitsheets uses to wipe a sheet directory before a full rewrite.
+
+mod helpers;
+
+use helpers::Sandbox;
+use holo_tree::MutableTree;
+
+fn list_tree(repo: &gix::Repository, hash: gix::ObjectId) -> Vec<String> {
+    let mut tree = MutableTree::new(hash);
+    let mut out = Vec::new();
+    for (path, _) in tree.get_blob_map(repo).unwrap() {
+        out.push(path);
+    }
+    out.sort();
+    out
+}
+
+#[test]
+fn clears_a_deep_subtree_but_preserves_siblings() {
+    let sb = Sandbox::new();
+    let base = sb.write_tree(&[
+        ("data/widgets/1.toml", "id = 1\n"),
+        ("data/widgets/2.toml", "id = 2\n"),
+        ("data/gadgets/9.toml", "id = 9\n"),
+        ("README.md", "hi\n"),
+    ]);
+
+    let mut tree = MutableTree::new(base);
+    tree.clear_children(&sb.repo, "data/widgets").unwrap();
+    let hash = tree.write(&sb.repo).unwrap();
+
+    assert_ne!(hash, base, "clearing a populated subtree must change the hash");
+    assert_eq!(
+        list_tree(&sb.repo, hash),
+        vec![
+            "README.md".to_string(),
+            "data/gadgets/9.toml".to_string(),
+        ],
+        "only the widgets/ subtree should be gone",
+    );
+}
+
+#[test]
+fn cleared_subtree_can_be_repopulated_in_the_same_pass() {
+    let sb = Sandbox::new();
+    let base = sb.write_tree(&[
+        ("data/widgets/old-a.toml", "id = 1\n"),
+        ("data/widgets/old-b.toml", "id = 2\n"),
+    ]);
+
+    let mut tree = MutableTree::new(base);
+    tree.clear_children(&sb.repo, "data/widgets").unwrap();
+    tree.write_child(&sb.repo, "data/widgets/new.toml", "id = 3\n")
+        .unwrap();
+    let hash = tree.write(&sb.repo).unwrap();
+
+    assert_eq!(
+        list_tree(&sb.repo, hash),
+        vec!["data/widgets/new.toml".to_string()],
+        "old entries cleared, new entry present",
+    );
+}
+
+#[test]
+fn clearing_the_root_yields_the_empty_tree() {
+    let sb = Sandbox::new();
+    let base = sb.write_tree(&[("a.toml", "1\n"), ("b/c.toml", "2\n")]);
+
+    let mut tree = MutableTree::new(base);
+    tree.clear_children(&sb.repo, ".").unwrap();
+    let hash = tree.write(&sb.repo).unwrap();
+
+    assert_eq!(
+        hash,
+        holo_tree::tree::empty_tree_id(),
+        "clearing the root must produce git's empty tree",
+    );
+}
+
+#[test]
+fn clearing_a_missing_path_is_a_noop_on_write() {
+    let sb = Sandbox::new();
+    let base = sb.write_tree(&[("data/widgets/1.toml", "id = 1\n")]);
+
+    let mut tree = MutableTree::new(base);
+    // Path doesn't exist yet; an empty subtree is pruned on write().
+    tree.clear_children(&sb.repo, "data/never").unwrap();
+    let hash = tree.write(&sb.repo).unwrap();
+
+    assert_eq!(
+        hash, base,
+        "clearing a non-existent subtree must not change the written tree",
+    );
+}

package/holo-tree/tests/helpers/mod.rs

@@ -85,6 +85,31 @@ impl Sandbox {
         self.repo.write_object(&commit).unwrap().detach()
     }
 
+    /// Enable reflog writes on this repo's local config (`core.logAllRefUpdates`).
+    ///
+    /// A bare repo defaults this off, so ref updates write no reflog — but a
+    /// normal checkout / CI runner has it on. Tests that need to exercise the
+    /// reflog path (see #476) turn it on to match that environment. Writes the
+    /// repo's own config file, so it's honored even by an `isolated()` handle
+    /// (which drops ambient global/system/env config but keeps local config).
+    pub fn enable_reflogs(&self) {
+        use std::io::Write;
+        let config_path = self.dir.path().join("config");
+        let mut f = std::fs::OpenOptions::new()
+            .append(true)
+            .open(&config_path)
+            .expect("open repo config");
+        writeln!(f, "[core]\n\tlogAllRefUpdates = true").expect("write config");
+    }
+
+    /// Reopen this repo with `isolated()` options — no environment, global, or
+    /// system git config (so no ambient `user.name` / `user.email`), while the
+    /// repo's own local config still applies.
+    pub fn open_isolated(&self) -> gix::Repository {
+        gix::open_opts(self.dir.path(), gix::open::Options::isolated())
+            .expect("reopen sandbox repo with isolated config")
+    }
+
     /// Create a ref pointing to an object.
     pub fn set_ref(&self, name: &str, target: ObjectId) {
         self.repo

package/holo-tree/tests/repo_ops.rs

@@ -0,0 +1,130 @@
+//! Tests for repo-level helpers used by the napi binding / gitsheets:
+//! `resolve_ref` and the compare-and-swap variant of `update_ref`.
+
+mod helpers;
+
+use helpers::Sandbox;
+use holo_tree::repo::{resolve_ref, update_ref};
+
+/// Build two distinct commits (A then B, B child of A) on an empty tree.
+fn two_commits(sb: &Sandbox) -> (gix::ObjectId, gix::ObjectId) {
+    let tree_a = sb.write_tree(&[("a.toml", "id = 1\n")]);
+    let a = sb.commit(tree_a, None, "a");
+    let tree_b = sb.write_tree(&[("b.toml", "id = 2\n")]);
+    let b = sb.commit(tree_b, Some(a), "b");
+    (a, b)
+}
+
+#[test]
+fn resolve_ref_returns_commit_hash_for_a_branch() {
+    let sb = Sandbox::new();
+    let (a, _) = two_commits(&sb);
+    sb.set_ref("refs/heads/work", a);
+
+    assert_eq!(resolve_ref(&sb.repo, "refs/heads/work").unwrap(), Some(a));
+    // A bare object id resolves to itself.
+    assert_eq!(resolve_ref(&sb.repo, &a.to_string()).unwrap(), Some(a));
+}
+
+#[test]
+fn resolve_ref_returns_none_for_unknown_ref() {
+    let sb = Sandbox::new();
+    let (a, _) = two_commits(&sb);
+    sb.set_ref("refs/heads/work", a);
+
+    assert_eq!(resolve_ref(&sb.repo, "refs/heads/nope").unwrap(), None);
+    assert_eq!(resolve_ref(&sb.repo, "does-not-exist").unwrap(), None);
+}
+
+#[test]
+fn update_ref_cas_succeeds_when_expected_matches() {
+    let sb = Sandbox::new();
+    let (a, b) = two_commits(&sb);
+    sb.set_ref("refs/heads/work", a);
+
+    update_ref(&sb.repo, "refs/heads/work", b, Some(a)).unwrap();
+    assert_eq!(resolve_ref(&sb.repo, "refs/heads/work").unwrap(), Some(b));
+}
+
+#[test]
+fn update_ref_cas_fails_when_expected_does_not_match() {
+    let sb = Sandbox::new();
+    let (a, b) = two_commits(&sb);
+    sb.set_ref("refs/heads/work", b); // ref is at B...
+
+    // ...but we claim it should be at A — the swap must be rejected.
+    let err = update_ref(&sb.repo, "refs/heads/work", a, Some(a)).unwrap_err();
+    assert!(
+        matches!(err, holo_tree::Error::Git(_)),
+        "CAS mismatch should surface as a git error, got {err:?}",
+    );
+    // Ref is unchanged.
+    assert_eq!(resolve_ref(&sb.repo, "refs/heads/work").unwrap(), Some(b));
+}
+
+#[test]
+fn update_ref_without_expected_forces() {
+    let sb = Sandbox::new();
+    let (a, b) = two_commits(&sb);
+    sb.set_ref("refs/heads/work", a);
+
+    // No expected_old → unconditional set, even though current != target's parent.
+    update_ref(&sb.repo, "refs/heads/work", b, None).unwrap();
+    assert_eq!(resolve_ref(&sb.repo, "refs/heads/work").unwrap(), Some(b));
+}
+
+/// The reflog identity must come from the committer of the commit the ref now
+/// points at — not from ambient git config. The sandbox commits are stamped
+/// "Test <test@test>", so that is what the reflog entry must record, regardless
+/// of whatever `user.name` / `user.email` the machine running the test has.
+#[test]
+fn update_ref_reflog_identity_comes_from_commit_committer() {
+    let sb = Sandbox::new();
+    let (a, _) = two_commits(&sb);
+    sb.enable_reflogs();
+    let repo = sb.open_isolated();
+
+    update_ref(&repo, "refs/heads/work", a, None).unwrap();
+
+    let reference = repo.find_reference("refs/heads/work").unwrap();
+    let mut platform = reference.log_iter();
+    let iter = platform
+        .all()
+        .unwrap()
+        .expect("update_ref should have written a reflog");
+
+    let mut last = None;
+    for line in iter {
+        let line = line.unwrap();
+        last = Some((
+            line.signature.name.to_string(),
+            line.signature.email.to_string(),
+        ));
+    }
+    let (name, email) = last.expect("reflog should have at least one entry");
+    assert_eq!(name, "Test", "reflog name should be the commit's committer");
+    assert_eq!(
+        email, "test@test",
+        "reflog email should be the commit's committer"
+    );
+}
+
+/// Regression for #476: a ref update on a fully-specified commit must not depend
+/// on ambient git config. We reopen the sandbox repo with `isolated()` options —
+/// which ignore environment and global/system git config, so no `user.name` /
+/// `user.email` is visible — and confirm `update_ref` still succeeds. gix's
+/// convenience `reference()` fails here with "The reflog could not be created or
+/// updated"; deriving the reflog identity from the commit's committer fixes it.
+#[test]
+fn update_ref_succeeds_without_ambient_git_identity() {
+    let sb = Sandbox::new();
+    let (a, b) = two_commits(&sb);
+    sb.set_ref("refs/heads/work", a);
+    // Reproduce a CI checkout: reflogs on (so the reflog identity is actually
+    // needed) but no ambient git identity available.
+    sb.enable_reflogs();
+    let isolated = sb.open_isolated();
+
+    update_ref(&isolated, "refs/heads/work", b, Some(a)).unwrap();
+    assert_eq!(resolve_ref(&isolated, "refs/heads/work").unwrap(), Some(b));
+}