limn-review 0.1.123

package/dist/conflict/parse.js

@@ -0,0 +1,142 @@
+/**
+ * The `git merge-tree --write-tree -z` output parser.
+ *
+ * THE SHAPE. Three NUL-delimited sections:
+ *
+ *   1. the written tree oid, one record;
+ *   2. zero or more stage records `<mode> SP <oid> SP <stage> TAB <path>`, terminated by ONE
+ *      EMPTY record — absent entirely on a clean merge, where the whole output is 41 bytes
+ *      (the oid plus its NUL) and section 2 never begins;
+ *   3. zero or more informational records, each `<n> NUL <path₁…ₙ> NUL <type> NUL <message>`.
+ *
+ * ⚠ SECTION 3 IS FIELD-DRIVEN OFF `<n>`, NEVER LINE-DRIVEN. Messages contain newlines, and
+ * `<n>` is the only thing that says how many of the following records are paths.
+ *
+ * ⚠ A NON-ZERO EXIT WITH EMPTY STDOUT IS AN ERROR; a non-zero exit with a leading tree oid is
+ * conflicts. `merge-tree` exits 1 both when it finds conflicts and when it is handed a
+ * revision it cannot resolve, and 128 on unrelated histories. Branching on the code alone
+ * turns "not something we can merge" into a model with no files in it.
+ */
+export class MergeTreeParseError extends Error {
+    constructor(message) {
+        super(`merge-tree output: ${message}`);
+        this.name = 'MergeTreeParseError';
+    }
+}
+const OID_RE = /^[0-9a-f]{40,64}$/;
+/**
+ * Parse the raw bytes. Throws `MergeTreeParseError` on anything it cannot account for —
+ * a truncated or garbled buffer must never become a half model, because a half model reads
+ * on screen as "these are all your conflicts".
+ */
+export function parseMergeTree(stdout) {
+    if (stdout.length === 0)
+        throw new MergeTreeParseError('empty');
+    // Decoding here is safe in a way it is NOT anywhere else in this pipeline: this buffer
+    // holds oids, modes and git's own English messages, plus paths. No file CONTENT ever
+    // passes through it — blobs come from `cat-file` and go through the strict UTF-8 gate.
+    //
+    // The output always ends with a NUL, so the split leaves one trailing empty element that
+    // is a delimiter artefact rather than a record.
+    const raw = stdout.toString('utf8').split('\0');
+    if (raw[raw.length - 1] === '')
+        raw.pop();
+    const treeOid = raw[0];
+    if (treeOid === undefined || !OID_RE.test(treeOid)) {
+        throw new MergeTreeParseError(`expected a tree oid, got ${JSON.stringify(treeOid ?? null)}`);
+    }
+    const stages = [];
+    let i = 1;
+    // Section 2 exists only when the merge conflicted. On a clean merge the buffer ends here.
+    let sawStageTerminator = raw.length === 1;
+    for (; i < raw.length; i++) {
+        const rec = raw[i];
+        if (rec === '') {
+            sawStageTerminator = true;
+            i++;
+            break;
+        }
+        stages.push(parseStage(rec));
+    }
+    if (!sawStageTerminator) {
+        throw new MergeTreeParseError('stage section is not terminated');
+    }
+    const messages = [];
+    while (i < raw.length) {
+        const countRec = raw[i];
+        // Some git versions emit a trailing empty record after the last message.
+        if (countRec === '') {
+            i++;
+            continue;
+        }
+        const count = Number(countRec);
+        if (!Number.isInteger(count) || count < 1 || count > 64) {
+            throw new MergeTreeParseError(`bad path count ${JSON.stringify(countRec)}`);
+        }
+        // paths at i+1 … i+count, then the type, then the message.
+        if (i + count + 2 > raw.length - 1) {
+            throw new MergeTreeParseError('truncated message record');
+        }
+        const paths = [];
+        for (let k = 0; k < count; k++) {
+            const p = raw[i + 1 + k];
+            if (p === undefined)
+                throw new MergeTreeParseError('truncated message paths');
+            paths.push(p);
+        }
+        const type = raw[i + 1 + count];
+        const message = raw[i + 2 + count];
+        if (type === undefined || message === undefined) {
+            throw new MergeTreeParseError('truncated message record');
+        }
+        messages.push({ paths, type, message });
+        i += count + 3;
+    }
+    return { treeOid, stages, messages };
+}
+function parseStage(rec) {
+    const tab = rec.indexOf('\t');
+    if (tab < 0)
+        throw new MergeTreeParseError(`stage record has no TAB: ${rec.slice(0, 80)}`);
+    const head = rec.slice(0, tab);
+    const path = rec.slice(tab + 1);
+    const bits = head.split(' ');
+    const mode = bits[0];
+    const oid = bits[1];
+    const stageText = bits[2];
+    if (bits.length !== 3 || mode === undefined || oid === undefined || stageText === undefined) {
+        throw new MergeTreeParseError(`stage record is not "<mode> <oid> <stage>": ${head}`);
+    }
+    if (!/^[0-7]{6}$/.test(mode))
+        throw new MergeTreeParseError(`bad mode ${mode}`);
+    if (!OID_RE.test(oid))
+        throw new MergeTreeParseError(`bad oid ${oid}`);
+    if (stageText !== '1' && stageText !== '2' && stageText !== '3') {
+        throw new MergeTreeParseError(`bad stage ${stageText}`);
+    }
+    if (path.length === 0)
+        throw new MergeTreeParseError('empty stage path');
+    return { mode, oid, stage: Number(stageText), path };
+}
+/**
+ * Undo merge-tree's collision mangling: when a directory is in the way of a file, git records
+ * the file at `<path>~<committish>` and says so in a `CONFLICT (file/directory)` message.
+ *
+ * ⚠ ONLY the two committishes we passed are stripped. A real filename containing `~` —
+ * `we~ird.txt` is a legal path and appeared in the fixture — must survive untouched, so this
+ * matches the suffix against the shas rather than against `~.*`.
+ */
+export function stripMangledSuffix(path, committishes) {
+    const tilde = path.lastIndexOf('~');
+    if (tilde <= 0)
+        return path;
+    const suffix = path.slice(tilde + 1);
+    for (const c of committishes) {
+        // git abbreviates in some messages, so an unambiguous prefix counts — but only of a real
+        // sha we handed it, never of arbitrary text.
+        if (suffix.length >= 7 && (c === suffix || c.startsWith(suffix)))
+            return path.slice(0, tilde);
+    }
+    return path;
+}
+//# sourceMappingURL=parse.js.map

package/dist/conflict/seam.js

@@ -0,0 +1,136 @@
+import { and, eq } from 'drizzle-orm';
+import { config } from '../config.js';
+import { db, schema } from '../db/client.js';
+import { getPrWriteContext, WRITE_PERMISSIONS } from '../db/queries.js';
+import { getSession, storeSuggestion } from './session.js';
+import { conflictFences, hunkRegionChars, validateConflictSuggestion, HUNK_CONTEXT_LINES, HUNK_CONTEXT_LINE_CHARS, } from './suggestion.js';
+/** Clip one context line. Safe in a way clipping the region is not — context is read-only in the
+ *  prompt and never spliced back, and check 6 compares against exactly these strings. */
+const clip = (line) => line.length > HUNK_CONTEXT_LINE_CHARS ? `${line.slice(0, HUNK_CONTEXT_LINE_CHARS)}…` : line;
+/**
+ * The lines either side of a region, walked out across its neighbours.
+ *
+ * ⚠ ANCESTOR TEXT, NOT THE CENTRE PANE. The centre is whatever the reader has decided so far,
+ * which moves while they work and is different in two tabs; the ancestor is the one text both
+ * branches agree existed. Nothing here is hashed, so this choice costs nothing but a clearer
+ * prompt — and it is what makes "the context bytes are byte-identical by construction" true.
+ */
+function contextAround(file, at) {
+    const before = [];
+    for (let i = at - 1; i >= 0 && before.length < HUNK_CONTEXT_LINES; i -= 1) {
+        const region = file.regions[i];
+        if (!region)
+            break;
+        for (let j = region.base.length - 1; j >= 0 && before.length < HUNK_CONTEXT_LINES; j -= 1) {
+            before.unshift(clip(region.base[j] ?? ''));
+        }
+    }
+    const after = [];
+    for (let i = at + 1; i < file.regions.length && after.length < HUNK_CONTEXT_LINES; i += 1) {
+        const region = file.regions[i];
+        if (!region)
+            break;
+        for (let j = 0; j < region.base.length && after.length < HUNK_CONTEXT_LINES; j += 1) {
+            after.push(clip(region.base[j] ?? ''));
+        }
+    }
+    return { before, after };
+}
+/** The PR's repo, for the plugin's memo key and its usage-ledger row. Tenanted on
+ *  `pull_requests.account_id`, the denormalised anchor column. */
+async function repoIdFor(accountId, prId) {
+    const { pullRequests } = schema;
+    const rows = await db
+        .select({ repoId: pullRequests.repoId })
+        .from(pullRequests)
+        .where(and(eq(pullRequests.id, prId), eq(pullRequests.accountId, accountId)))
+        .limit(1)
+        .execute();
+    return rows[0]?.repoId ?? null;
+}
+export function makeConflictSeam() {
+    return {
+        fences: conflictFences,
+        validateSuggestion: validateConflictSuggestion,
+        async loadHunk(accountId, ref) {
+            // ---- ownership ----------------------------------------------------------------------
+            // 404 for another tenant's id AND for a reader without push access: one answer, so this
+            // route is not an existence oracle either.
+            const owned = await getPrWriteContext(ref.prId, accountId);
+            if (!owned || !WRITE_PERMISSIONS.has(owned.viewerPermission ?? '')) {
+                return { ok: false, error: 'not_found' };
+            }
+            // ---- the session and its pins ---------------------------------------------------------
+            const rec = getSession(accountId, ref.prId, ref.sessionId);
+            const model = rec?.model ?? null;
+            if (!rec || !model || rec.status !== 'ready') {
+                return { ok: false, error: 'session_expired' };
+            }
+            // ---- the file and the region ----------------------------------------------------------
+            const file = model.files.find((f) => f.index === ref.fileIndex) ?? null;
+            if (!file || file.unsupported !== null)
+                return { ok: false, error: 'unknown_region' };
+            const at = file.regions.findIndex((r) => r.id === ref.regionId);
+            const region = at >= 0 ? file.regions[at] : undefined;
+            if (!region)
+                return { ok: false, error: 'unknown_region' };
+            // Only a CONTESTED region is worth a model: everything else has a deterministic answer the
+            // buttons already offer, and paying for a suggestion on one would be paying for a coin toss
+            // between two identical outcomes.
+            if (region.kind !== 'conflict')
+                return { ok: false, error: 'not_conflict' };
+            // ---- text-ness -------------------------------------------------------------------------
+            // Every side decoded STRICTLY as UTF-8 at model build (`not_text` is a file-level refusal
+            // there), so this is the belt to that braces — a NUL reaching a prompt would be a fact
+            // about our own decoder, not about the model.
+            const sides = [region.base, region.ours, region.theirs];
+            if (sides.some((side) => side.some((l) => l.includes('\0')))) {
+                return { ok: false, error: 'not_text' };
+            }
+            // ---- size ------------------------------------------------------------------------------
+            // ⚠ REFUSE, NEVER TRUNCATE. A truncated region spliced back deletes code the model never
+            // saw, and the reader would have no way to tell.
+            if (hunkRegionChars(region.base, region.ours, region.theirs) > config.conflictSuggestMaxChars) {
+                return { ok: false, error: 'too_large' };
+            }
+            // ---- the content pin --------------------------------------------------------------------
+            // `regionId` is the ADDRESS and `fingerprint` is the CONTENT. Checked last because it is the
+            // one refusal that means "reopen", not "this hunk is not for us".
+            if (region.fingerprint !== ref.fingerprint)
+                return { ok: false, error: 'moved' };
+            const repoId = await repoIdFor(accountId, ref.prId);
+            if (repoId == null)
+                return { ok: false, error: 'not_found' };
+            const { before, after } = contextAround(file, at);
+            return {
+                ok: true,
+                hunk: {
+                    repoId,
+                    path: file.path,
+                    headRef: model.headRef,
+                    baseRef: model.baseRef,
+                    base: region.base,
+                    ours: region.ours,
+                    theirs: region.theirs,
+                    contextBefore: before,
+                    contextAfter: after,
+                    // Fold rule 4: a suggestion sits where the OURS side's text was, so it inherits the
+                    // ours terminator — the same rule `disjoint_merge` follows in `land.ts`.
+                    endsWithNewline: file.terminators.ours,
+                },
+            };
+        },
+        storeSuggestion(accountId, ref, lines, endsWithNewline) {
+            const rec = getSession(accountId, ref.prId, ref.sessionId);
+            if (!rec)
+                return null;
+            return storeSuggestion(rec, {
+                fileIndex: ref.fileIndex,
+                regionId: ref.regionId,
+                lines,
+                endsWithNewline,
+            });
+        },
+    };
+}
+//# sourceMappingURL=seam.js.map