limn-review 0.1.123

package/dist/coding/git-ops.js

@@ -0,0 +1,321 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { and, eq } from 'drizzle-orm';
+import { getAccessToken, getAccountById } from '../auth/account.js';
+import { cleanupCloneCache, prepWorktree, prepWorktreeAtRef, removeWorktreeLocked, } from '../review/clone-manager.js';
+import { createPullRequest, fetchPrHeadInfo, } from '../github/mutations.js';
+import { ghRestGetFor, ghRestGetText } from '../github/client.js';
+import { db, schema } from '../db/client.js';
+import { settlePrAfterWrite } from '../sync/resync-after-write.js';
+import { syncOnePr } from '../sync/sync-one-pr.js';
+import { applyPatchToWorktree, codedError, commitAll, pushRef, } from './git.js';
+import { assertSafeTargetPath, resolveContainedTargetPath } from './safe-path.js';
+/**
+ * The names a push for this PR must never land on: the repo's default branch and the PR's
+ * base ref, read from the LOCAL DB (no GitHub call).
+ *
+ * Returns [] when the push target repo is NOT the watched repo — a fork PR pushes to the
+ * FORK, where `main` is the contributor's own branch and protecting it would refuse a
+ * legitimate push.
+ */
+export async function protectedRefsFor(accountId, owner, name, prNumber, pushOwner, pushName) {
+    if (pushOwner.toLowerCase() !== owner.toLowerCase() ||
+        pushName.toLowerCase() !== name.toLowerCase()) {
+        return [];
+    }
+    const { repos, pullRequests } = schema;
+    const [repoRow] = await db
+        .select({ id: repos.id, defaultBranch: repos.defaultBranch })
+        .from(repos)
+        .where(and(eq(repos.accountId, accountId), eq(repos.owner, owner), eq(repos.name, name)))
+        .execute();
+    if (!repoRow)
+        return [];
+    const [prRow] = await db
+        .select({ baseRefName: pullRequests.baseRefName })
+        .from(pullRequests)
+        .where(and(eq(pullRequests.repoId, repoRow.id), eq(pullRequests.number, prNumber)))
+        .execute();
+    const names = [repoRow.defaultBranch, prRow?.baseRefName];
+    return [...new Set(names.filter((n) => Boolean(n)))];
+}
+// The local repo id for (account, owner/name), or null. Account-scoped: an owner/name another
+// tenant tracks resolves only to THIS account's row.
+async function localRepoId(accountId, owner, name) {
+    const { repos } = schema;
+    const [repoRow] = await db
+        .select({ id: repos.id })
+        .from(repos)
+        .where(and(eq(repos.accountId, accountId), eq(repos.owner, owner), eq(repos.name, name)))
+        .execute();
+    return repoRow?.id ?? null;
+}
+// After a push onto an EXISTING PR's head: settle-and-verify that PR against the pushed commit.
+// The PR number resolves ONLY within (accountId, repoId) — numbers are unique per repo. Never
+// throws: the push has already landed.
+async function settlePushedPr(accountId, owner, name, prNumber, commitSha) {
+    try {
+        const repoId = await localRepoId(accountId, owner, name);
+        if (repoId == null)
+            return;
+        const { pullRequests } = schema;
+        const [prRow] = await db
+            .select({ id: pullRequests.id })
+            .from(pullRequests)
+            .where(and(eq(pullRequests.accountId, accountId), eq(pullRequests.repoId, repoId), eq(pullRequests.number, prNumber)))
+            .execute();
+        if (!prRow)
+            return;
+        await settlePrAfterWrite({
+            accountId,
+            prId: prRow.id,
+            log: quietLogger,
+            expect: { headSha: commitSha },
+        });
+    }
+    catch {
+        /* the push is real; a failed confirmation only delays what the SPA sees */
+    }
+}
+// After a push that OPENED a new PR in (owner/name): targeted-sync it. Never throws.
+async function syncNewPrInRepo(accountId, owner, name, prNumber) {
+    try {
+        const repoId = await localRepoId(accountId, owner, name);
+        if (repoId == null)
+            return;
+        await syncOnePr(repoId, prNumber, quietLogger, { waitForInFlight: true });
+    }
+    catch {
+        /* the PR is real; the next walk picks it up */
+    }
+}
+// The implementation behind ctx.coding.applyAndPush. STATELESS: it re-preps a fresh
+// worktree at the patch's exact base commit and `git apply`s the stored patch, so a
+// fix survives a restart and works on ephemeral cloud disk. Owns the head-moved guard
+// (existing-branch only) and does all git writes (the agent never can).
+export async function applyAndPush(args) {
+    const { accountId, owner, name, prNumber, baseSha, patch, commitMessage, target } = args;
+    const token = await getAccessToken(accountId);
+    const account = await getAccountById(accountId);
+    const authorName = account?.displayName || account?.githubLogin || 'pierre-review';
+    const authorEmail = account?.githubLogin
+        ? `${account.githubLogin}@users.noreply.github.com`
+        : 'pierre-review@users.noreply.github.com';
+    // Head-moved / un-pushable-fork guard applies ONLY to the existing-branch path
+    // (pushing onto the PR's own head). A new branch is self-contained off baseSha and
+    // is immune to the head having advanced.
+    //
+    // Whether the PR's head branch lives in THIS repo — read here, used by the post-push settle
+    // below. ⚠ A FORK PR's head lives in the fork, but the push below goes to `owner/name` (the
+    // base repo), so for a fork it writes a same-named branch the PR does not track. That is a
+    // latent defect of this path (the conflict resolver pushes to `headRepoFullName` instead) and
+    // it is NOT changed here; the settle is simply skipped for it, because the PR's head can
+    // never become the pushed commit and the ladder would run to exhaustion for nothing.
+    let pushedToPrHeadRepo = false;
+    if (target.kind === 'existing') {
+        const info = await fetchPrHeadInfo(token, owner, name, prNumber);
+        pushedToPrHeadRepo =
+            !info.isFork &&
+                info.headRepoFullName.toLowerCase() === `${owner}/${name}`.toLowerCase();
+        if (info.headSha !== baseSha) {
+            throw codedError('HEAD_MOVED', `the PR head advanced (now ${info.headSha.slice(0, 7)}, fix was built on ${baseSha.slice(0, 7)})`);
+        }
+        if (info.isFork && !info.maintainerCanModify) {
+            throw codedError('PUSH_DENIED', 'the PR head is a fork this account cannot push to — push to a new branch instead');
+        }
+    }
+    else {
+        // NEW branch, never force: a live ref under this name means someone (an earlier fix run,
+        // a person) already owns it — refuse rather than clobber. commitFilesAndOpenPr has always
+        // done this; this path used to discover the collision as a push rejection instead.
+        const existing = await ghRestGetText(token, `/repos/${owner}/${name}/git/ref/heads/${target.branch}`);
+        if (existing.ok) {
+            throw codedError('BRANCH_EXISTS', `branch ${target.branch} already exists on ${owner}/${name}`);
+        }
+    }
+    const protect = await protectedRefsFor(accountId, owner, name, prNumber, owner, name);
+    let repoCloneDir = null;
+    let worktreePath = null;
+    try {
+        ({ repoCloneDir, worktreePath } = await prepWorktree(owner, name, prNumber, baseSha, token));
+        await applyPatchToWorktree(worktreePath, patch);
+        const commitSha = await commitAll(worktreePath, {
+            message: commitMessage,
+            authorName,
+            authorEmail,
+        });
+        const push = { worktree: worktreePath, owner, name, token, committish: 'HEAD', protect };
+        if (target.kind === 'existing') {
+            await pushRef({ ...push, remoteBranch: target.headRef });
+            // ── The push LANDED: nothing below may throw (a retry would double-push). ──────────
+            // Settle-and-verify against the pushed commit (sync/resync-after-write.ts), so the stored
+            // head and conflict/CI verdict catch up; when they move, persistPr raises the SPA change
+            // signal and the SPA's post-write poll window refetches. Only when the pushed repo IS the
+            // PR's head repo — see `pushedToPrHeadRepo` above.
+            // ⚠ NOT AWAITED. The caller records the push (the plugin's `markFixPushed`) only AFTER this
+            // returns, and awaiting the settle's ~7s inline wait widened "pushed on GitHub but not
+            // recorded here" from milliseconds to seconds — a restart in that window left the fix row
+            // unmarked. `settlePushedPr` never rejects.
+            if (pushedToPrHeadRepo) {
+                void settlePushedPr(accountId, owner, name, prNumber, commitSha);
+            }
+            return { pushedBranch: target.headRef, commitSha };
+        }
+        // New branch → push then open a PR against the base.
+        await pushRef({ ...push, remoteBranch: target.branch });
+        const pr = await createPullRequest(token, {
+            owner,
+            name,
+            head: target.branch,
+            base: target.base,
+            title: target.title,
+            body: target.body,
+        });
+        // The new PR exists on GitHub: sync it so it becomes local. ⚠ NOT AWAITED, for the same
+        // reason as above: the caller records the new PR's number and URL only after this returns.
+        // The sync's first sighting raises the SPA change signal. `syncNewPrInRepo` never rejects.
+        void syncNewPrInRepo(accountId, owner, name, pr.number);
+        return {
+            pushedBranch: target.branch,
+            commitSha,
+            prNumber: pr.number,
+            prUrl: pr.url,
+        };
+    }
+    finally {
+        if (repoCloneDir && worktreePath) {
+            await removeWorktreeLocked(owner, name, repoCloneDir, worktreePath).catch(() => { });
+        }
+        if (repoCloneDir) {
+            setImmediate(() => {
+                try {
+                    cleanupCloneCache();
+                }
+                catch {
+                    /* advisory cleanup — never surface */
+                }
+            });
+        }
+    }
+}
+// ── commitFilesAndOpenPr — the advisor's config-PR primitive ────────────────────────────────
+// The implementation behind ctx.coding.commitFilesAndOpenPr: worktree at the repo's DEFAULT
+// branch → write LITERAL file contents (the adapter merged them against the fetched originals
+// upstream — this function writes bytes, it never merges) → commit → push a NEW branch (a
+// plain push, never force; an existing branch is a refusal, not an overwrite) → open the PR →
+// the syncOnePr visibility tail. After GitHub 201s the PR, nothing here may throw — a failed
+// confirming sync is `visible: false`, and the caller's copy contract ("it'll show up here
+// shortly", never a retry) does the rest.
+// The OAuth token has no `workflow` scope, so a push touching .github/workflows/* is rejected
+// by GitHub AFTER the branch exists — refuse outright instead of half-failing. (The general
+// path rules live in safe-path.ts; this one is about a token, not a filesystem.)
+function assertNotWorkflowPath(path) {
+    const norm = path.replace(/\\/g, '/');
+    if (norm === '.github/workflows' || norm.startsWith('.github/workflows/')) {
+        throw codedError('PUSH_DENIED', `refusing to write ${path}: workflow files need the \`workflow\` OAuth scope, which this token does not carry`);
+    }
+}
+const quietLogger = {
+    info: () => { },
+    warn: (m, ...a) => console.warn(m, ...a),
+    error: (m, ...a) => console.error(m, ...a),
+};
+export async function commitFilesAndOpenPr(args) {
+    const { accountId, owner, name, files, branch, title, body } = args;
+    if (files.length === 0)
+        throw codedError('APPLY_FAILED', 'no files to commit');
+    for (const f of files) {
+        assertSafeTargetPath(f.path);
+        assertNotWorkflowPath(f.path);
+    }
+    // ⚠ STAYS HERE. This is a naming convention on a branch the ADVISOR INVENTS, not a push
+    // guard — hoisting it into pushRef would refuse real GitHub head refs (`feature/#123`,
+    // `user's-branch`, `a+b`, `ünicode/x`). The push guard is assertPushTarget in git.ts.
+    if (!/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(branch) || branch.includes('..')) {
+        throw codedError('APPLY_FAILED', `invalid branch name: ${branch}`);
+    }
+    const token = await getAccessToken(accountId);
+    const account = await getAccountById(accountId);
+    const authorName = account?.displayName || account?.githubLogin || 'pierre-review';
+    const authorEmail = account?.githubLogin
+        ? `${account.githubLogin}@users.noreply.github.com`
+        : 'pierre-review@users.noreply.github.com';
+    // NEW branch, never force: a live ref under this name means someone (possibly an earlier
+    // advisor run) already owns it — refuse rather than clobber or confuse two PRs.
+    const existing = await ghRestGetText(token, `/repos/${owner}/${name}/git/ref/heads/${branch}`);
+    if (existing.ok) {
+        throw codedError('BRANCH_EXISTS', `branch ${branch} already exists on ${owner}/${name}`);
+    }
+    // The DEFAULT branch is the base: the config that governs FUTURE reviews is the default
+    // branch's copy (repo grain — a head-branch config affects only that PR's reviews).
+    const repoMeta = await ghRestGetFor(token, `/repos/${owner}/${name}`);
+    const base = repoMeta.default_branch;
+    if (!base)
+        throw codedError('TRUNK_FETCH_FAILED', `no default branch for ${owner}/${name}`);
+    let repoCloneDir = null;
+    let worktreePath = null;
+    try {
+        ({ repoCloneDir, worktreePath } = await prepWorktreeAtRef(owner, name, base, token));
+        for (const f of files) {
+            // Containment is re-checked HERE, against the real checkout: a committed symlink is a
+            // real directory entry and the lexical pass above cannot see one.
+            const target = resolveContainedTargetPath(worktreePath, f.path);
+            await mkdir(dirname(target), { recursive: true });
+            await writeFile(target, f.content, 'utf8');
+        }
+        await commitAll(worktreePath, { message: title, authorName, authorEmail });
+        // The base here is the repo's DEFAULT branch, so it is exactly what must be protected.
+        await pushRef({
+            worktree: worktreePath,
+            owner,
+            name,
+            token,
+            committish: 'HEAD',
+            remoteBranch: branch,
+            protect: [base],
+        });
+        const pr = await createPullRequest(token, { owner, name, head: branch, base, title, body });
+        // ── After this point the PR EXISTS on GitHub: nothing below may throw. ──────────────
+        // Visibility tail (the resync-after-write contract): targeted-sync the new PR so the
+        // SPA's next read of the local DB sees it, and CONFIRM with a SELECT rather than trust
+        // the sync's return value.
+        let visible = false;
+        try {
+            const { repos, pullRequests } = schema;
+            const [repoRow] = await db
+                .select({ id: repos.id })
+                .from(repos)
+                .where(and(eq(repos.accountId, accountId), eq(repos.owner, owner), eq(repos.name, name)))
+                .execute();
+            if (repoRow) {
+                await syncOnePr(repoRow.id, pr.number, quietLogger, { waitForInFlight: true });
+                const [prRow] = await db
+                    .select({ id: pullRequests.id })
+                    .from(pullRequests)
+                    .where(and(eq(pullRequests.repoId, repoRow.id), eq(pullRequests.number, pr.number)))
+                    .execute();
+                visible = Boolean(prRow);
+            }
+        }
+        catch {
+            /* the PR is real; a failed confirmation is visible:false, never an error */
+        }
+        return { prNumber: pr.number, url: pr.url, visible };
+    }
+    finally {
+        if (repoCloneDir && worktreePath) {
+            await removeWorktreeLocked(owner, name, repoCloneDir, worktreePath).catch(() => { });
+        }
+        if (repoCloneDir) {
+            setImmediate(() => {
+                try {
+                    cleanupCloneCache();
+                }
+                catch {
+                    /* advisory cleanup — never surface */
+                }
+            });
+        }
+    }
+}
+//# sourceMappingURL=git-ops.js.map

package/dist/coding/git.js

@@ -0,0 +1,184 @@
+import { execFile } from 'node:child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+// Low-level git helpers for the AI-Fix write path. Args are ALWAYS an array (never a
+// shell string), so there's no interpolation/injection surface — the same discipline
+// as clone-manager.ts. A tokenized push URL is passed per-op and never persisted.
+/** An Error carrying a `.code` the push route maps to an HTTP status. */
+export function codedError(code, message) {
+    const err = new Error(message);
+    err.code = code;
+    return err;
+}
+async function git(args, cwd) {
+    return execFileAsync('git', args, {
+        cwd,
+        timeout: 120_000,
+        maxBuffer: 128 * 1024 * 1024,
+    });
+}
+/**
+ * Stage everything (including NEW and deleted files) and capture the change as a
+ * binary-safe unified diff against HEAD, plus the changed-file list. `git add -A`
+ * before `git diff --cached` is what makes newly-created files round-trip — a plain
+ * `git diff` silently omits untracked files. `--binary` round-trips assets too.
+ */
+export async function captureWorktreeDiff(worktree) {
+    await git(['add', '-A'], worktree);
+    const { stdout: patch } = await git(['diff', '--cached', '--binary'], worktree);
+    const { stdout: names } = await git(['diff', '--cached', '--name-only'], worktree);
+    const filesChanged = names
+        .split('\n')
+        .map((s) => s.trim())
+        .filter(Boolean);
+    return { patch, filesChanged };
+}
+/**
+ * Apply a stored unified-diff patch onto the worktree (checked out at the patch's
+ * exact base commit). `--3way` is a safety net if the tree isn't byte-identical.
+ * Throws a coded 'APPLY_FAILED' error if the patch doesn't apply.
+ */
+export async function applyPatchToWorktree(worktree, patch) {
+    const tmp = mkdtempSync(join(tmpdir(), 'pierre-fix-'));
+    const patchFile = join(tmp, 'fix.patch');
+    try {
+        writeFileSync(patchFile, patch, 'utf-8');
+        await git(['apply', '--3way', patchFile], worktree);
+    }
+    catch (err) {
+        throw codedError('APPLY_FAILED', `patch did not apply cleanly: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    finally {
+        try {
+            rmSync(tmp, { recursive: true, force: true });
+        }
+        catch {
+            /* advisory */
+        }
+    }
+}
+/**
+ * Stage everything and create a single commit with the given author identity. Returns
+ * the new commit SHA. `--no-verify` skips any inherited hooks (the fix is machine-made
+ * and pre-reviewed by the user). Uses `-c user.*` so we never touch global git config.
+ */
+export async function commitAll(worktree, opts) {
+    await git(['add', '-A'], worktree);
+    await git([
+        '-c',
+        `user.name=${opts.authorName}`,
+        '-c',
+        `user.email=${opts.authorEmail}`,
+        'commit',
+        '--no-verify',
+        '-m',
+        opts.message,
+    ], worktree);
+    const { stdout } = await git(['rev-parse', 'HEAD'], worktree);
+    return stdout.trim();
+}
+// ── The push guard ──────────────────────────────────────────────────────────────────────
+// Everything that writes a ref on GitHub goes through pushRef / pushForceWithLease, and both
+// go through assertPushTarget FIRST. The branch name reaching them is not always ours: it can
+// be a PR's own head ref, and in the resolver it can be a name the user typed.
+//
+// ⚠ THE AUTHORITY IS `git check-ref-format`, NOT A REGEX. git-ops.ts's
+// `/^[A-Za-z0-9][A-Za-z0-9._/-]*$/` is a stricter NAMING CONVENTION on branches the advisor
+// INVENTS; it is not a general push guard and must not be hoisted here. `feature/#123`,
+// `user's-branch`, `a+b` and `ünicode/x` are all valid GitHub head refs that regex rejects,
+// and pushRef is already called with real head refs.
+/**
+ * Names git's own format check accepts but that must never be a push target: they are
+ * pseudo-refs or a leading-dash argument git would read as an option. Compared
+ * case-INSENSITIVELY — on a case-folding filesystem `head` and `HEAD` are the same file.
+ */
+const RESERVED_REF_NAMES = new Set([
+    'HEAD',
+    'FETCH_HEAD',
+    'ORIG_HEAD',
+    'MERGE_HEAD',
+    'CHERRY_PICK_HEAD',
+    'REVERT_HEAD',
+    'BISECT_HEAD',
+    'AUTO_MERGE',
+]);
+/**
+ * Refuse a push target before any process is spawned: a malformed ref name, a reserved
+ * pseudo-ref, or a protected branch. Throws a coded 'PUSH_DENIED'.
+ * ⚠ Runs BEFORE the push, deliberately — a refusal that arrives as "git push failed" reads
+ * as a network or permission problem and sends the reader looking in the wrong place.
+ */
+export async function assertPushTarget(remoteBranch, protect) {
+    const deny = (why) => {
+        throw codedError('PUSH_DENIED', `refusing to push to '${remoteBranch}': ${why}`);
+    };
+    if (!remoteBranch)
+        deny('the branch name is empty');
+    // check-ref-format accepts a leading `-`, which git would then read as an option, and it
+    // has nothing to say about the double / trailing slashes some git versions tolerate.
+    if (remoteBranch.startsWith('-'))
+        deny('a branch name may not start with a dash');
+    if (remoteBranch.startsWith('/') || remoteBranch.endsWith('/')) {
+        deny('a branch name may not start or end with a slash');
+    }
+    if (remoteBranch.includes('//'))
+        deny('a branch name may not contain an empty component');
+    if (RESERVED_REF_NAMES.has(remoteBranch.toUpperCase())) {
+        deny(`${remoteBranch} is one of git's own ref names`);
+    }
+    try {
+        await execFileAsync('git', ['check-ref-format', `refs/heads/${remoteBranch}`], {
+            timeout: 10_000,
+            maxBuffer: 1024 * 1024,
+        });
+    }
+    catch {
+        deny('git does not accept it as a branch name');
+    }
+    const lowered = remoteBranch.toLowerCase();
+    if (protect.some((p) => p.toLowerCase() === lowered)) {
+        deny('it is a protected branch for this pull request');
+    }
+}
+/** The tokenized push URL. Built per op and never persisted (clone-manager owns the same rule). */
+function pushUrl(owner, name, token) {
+    return `https://x-access-token:${token}@github.com/${owner}/${name}.git`;
+}
+/**
+ * Push a local committish to a remote branch via an explicit tokenized URL (never the
+ * clone's persisted remote). Throws a coded 'PUSH_DENIED' error on failure (no write
+ * access, protected branch, non-fast-forward on an existing branch).
+ */
+export async function pushRef(t) {
+    await assertPushTarget(t.remoteBranch, t.protect);
+    try {
+        await git(['push', pushUrl(t.owner, t.name, t.token), `${t.committish}:refs/heads/${t.remoteBranch}`], t.worktree);
+    }
+    catch (err) {
+        throw codedError('PUSH_DENIED', `git push failed (write access / protected branch?): ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/**
+ * Force-push with a lease: the push aborts unless the remote branch is still at `leaseSha`,
+ * so a concurrent push is never blown away.
+ * ⚠ This is the DANGEROUS half and it lived in merge.ts, below every guard. It is here so
+ * that "a force push goes through assertPushTarget" is true by construction.
+ */
+export async function pushForceWithLease(t) {
+    await assertPushTarget(t.remoteBranch, t.protect);
+    try {
+        await git([
+            'push',
+            `--force-with-lease=refs/heads/${t.remoteBranch}:${t.leaseSha}`,
+            pushUrl(t.owner, t.name, t.token),
+            `${t.committish}:refs/heads/${t.remoteBranch}`,
+        ], t.worktree);
+    }
+    catch (err) {
+        throw codedError('PUSH_DENIED', `force-with-lease push failed (branch moved since / protected / no write): ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+//# sourceMappingURL=git.js.map