gitpane 1.0.0__py3-none-any.whl

gitpane/worktree/staged_reset.py

@@ -0,0 +1,447 @@
+"""Calculate side-specific file resets, each proven to preserve the other side before any publication."""
+
+from __future__ import annotations
+
+import os
+import shutil
+import stat
+from dataclasses import dataclass
+from difflib import SequenceMatcher
+from enum import Enum
+from typing import TYPE_CHECKING
+
+from gitpane.config import GIT_MUTATION_TIMEOUT_MS, MUTATION_IDLE_TIMEOUT_MS
+from gitpane.history.repository_value import FileStatus
+from gitpane.process.process_runner import LOCAL_WRITE_PROFILE
+from gitpane.tool.system_tool import worktree_filename
+from gitpane.worktree.command_sequence import FileTask, GitCommand, GitCommandError
+from gitpane.worktree.partial_patch import byte_lines, filtered_line_slices, line_slices
+from gitpane.worktree.worktree_file import PRIVATE_DIRECTORY_MODE, SINGLE_LINK_COUNT, FileImage, capture_image, materialize_blob, stat_identity
+from gitpane.worktree.worktree_snapshot import StagingSide, read_index
+
+if TYPE_CHECKING:
+    from collections.abc import Generator
+
+    from gitpane.history.repository_value import RepositoryContext
+    from gitpane.worktree.worktree_snapshot import LocalEntry, WorktreeSnapshot
+
+
+FILEMODE_SETTING_KEY = b"core.filemode"
+SYMLINKS_SETTING_KEY = b"core.symlinks"
+ENABLED_SETTING_VALUE = b"true"
+DISABLED_SETTING_VALUE = b"false"
+# Git writes a split index with a literal "link" extension signature. A false match in object or path bytes only
+# costs one harmless expansion of the private copy, while a missed one would publish an index sharing foreign data.
+SPLIT_INDEX_EXTENSION_SIGNATURE = b"link"
+# Refusals of the Reset of a rename whose original path already leads to a file.
+RENAME_ORIGIN_OCCUPIED_MESSAGE = "The rename's original path is occupied; Reset will not overwrite that file"
+OTHER_HARD_LINKS_MESSAGE = "This file has other hard links; Reset will not replace it"
+
+
+def may_carry_split_index(index_content: bytes | None) -> bool:
+    """Tell whether a private index copy must be flattened before Git rewrites it, without parsing Git's binary format."""
+    return index_content is not None and SPLIT_INDEX_EXTENSION_SIGNATURE in index_content
+
+
+@dataclass(frozen=True)
+class ResetFilePolicy:
+    """Hold the two repository settings that decide how Reset restores links and executable bits.
+
+    Only an explicit false disables a feature, which is what Git itself does when a key is absent.
+    """
+
+    symlinks: bool = True
+    filemode: bool = True
+
+
+def parse_reset_file_policy(output: bytes) -> ResetFilePolicy:
+    """Decode the grouped NUL records of both settings by key name.
+
+    Records of different keys may come in any order; for repeated definitions of one key the later record wins, which
+    is the order in which Git applies its configuration files. Anything but a normalized boolean is refused rather
+    than guessed, because a wrong guess would publish the wrong file kind or executable bit.
+    """
+    if output and not output.endswith(b"\0"):
+        raise ValueError("Git returned an incomplete core.filemode or core.symlinks setting; Reset refused")
+    enabled_by_key: dict[bytes, bool] = {}
+    records = output.removesuffix(b"\0").split(b"\0") if output else []
+    for record in records:
+        key, separator, value = record.partition(b"\n")
+        if not separator or key not in (FILEMODE_SETTING_KEY, SYMLINKS_SETTING_KEY) or value not in (ENABLED_SETTING_VALUE, DISABLED_SETTING_VALUE):
+            raise ValueError("Git returned an unexpected core.filemode or core.symlinks setting; Reset refused")
+        enabled_by_key[key] = value == ENABLED_SETTING_VALUE
+    default = ResetFilePolicy()
+    return ResetFilePolicy(symlinks=enabled_by_key.get(SYMLINKS_SETTING_KEY, default.symlinks), filemode=enabled_by_key.get(FILEMODE_SETTING_KEY, default.filemode))
+
+
+def read_reset_file_policy() -> Generator[GitCommand, bytes, ResetFilePolicy]:
+    """Read both settings with one Git command for a whole Reset, instead of once per file."""
+    try:
+        # Exit code 1 means neither key is defined anywhere, so both keep Git's default.
+        output = yield GitCommand(["config", "--bool", "--null", "--get-regexp", r"^core\.(filemode|symlinks)$"], accepted_codes=(0, 1))
+    except GitCommandError as error:
+        raise ValueError("Git cannot read core.filemode or core.symlinks as a boolean; Reset refused") from error
+    return parse_reset_file_policy(output)
+
+
+@dataclass(frozen=True)
+class FileChange:
+    """Keep one exact destination's before and after images for confirmation and recovery."""
+
+    path: bytes
+    before: FileImage
+    after: FileImage
+    original_path: bytes | None = None
+
+
+@dataclass(frozen=True)
+class ResetCandidate:
+    """Bind a confirmed result to its source capture and owned recovery files."""
+
+    operation_id: str
+    snapshot: WorktreeSnapshot
+    side: StagingSide
+    changes: tuple[FileChange, ...]
+    before_entries: bytes
+    after_entries: bytes
+    index_content: bytes | None
+    operation_dir: str
+    record_by_name: dict[str, object]
+    explanation: str
+    operation: str = "Reset"
+
+
+@dataclass(frozen=True)
+class Edit:
+    """Represent a replacement at exact base and resulting line coordinates."""
+
+    start: int
+    end: int
+    result_start: int
+    result_end: int
+
+
+class ResetSource(Enum):
+    """Where a line of a staged Reset's result comes from: HEAD's version, or the working file that keeps its own edits."""
+
+    HEAD = "head"
+    WORKING = "working"
+
+
+def compare_lines(base: list[bytes], result: list[bytes]) -> tuple[list[Edit], dict[int, int]]:
+    """Extract base intervals and unchanged-line correspondence without text decoding."""
+    edits: list[Edit] = []
+    result_index_by_base_index: dict[int, int] = {}
+    for kind, start, end, result_start, result_end in SequenceMatcher(None, base, result, autojunk=False).get_opcodes():
+        if kind != "equal":
+            edits.append(Edit(start, end, result_start, result_end))
+            continue
+        for offset in range(end - start):
+            result_index_by_base_index[start + offset] = result_start + offset
+    return edits, result_index_by_base_index
+
+
+def independent_result(index: bytes, head: bytes, working: bytes) -> tuple[bytes, tuple[tuple[ResetSource, int], ...]]:
+    """Replay disjoint changes only when neither shared intervals nor repeated anchors can relocate B."""
+    index_lines, head_lines, working_lines = byte_lines(index), byte_lines(head), byte_lines(working)
+    if head != index and working != index:
+        seen_line_set: set[bytes] = set()
+        for line in index_lines:
+            if line in seen_line_set:
+                raise ValueError("Repeated context makes the staged and unstaged correspondence ambiguous")
+            seen_line_set.add(line)
+    undo_edits, _head_index_by_base_index = compare_lines(index_lines, head_lines)
+    working_edits, working_index_by_base_index = compare_lines(index_lines, working_lines)
+    if undo_edits and working_edits:
+        for undo in undo_edits:
+            for edit in working_edits:
+                overlap = max(undo.start, edit.start) < min(undo.end, edit.end)
+                insertion = (undo.start == undo.end and edit.start <= undo.start <= edit.end) or (edit.start == edit.end and undo.start <= edit.start <= undo.end)
+                if overlap or insertion:
+                    raise ValueError("Staged and unstaged changes overlap or share an insertion boundary; Reset cannot preserve them independently")
+    changes: list[tuple[Edit, ResetSource]] = []
+    for edit in undo_edits:
+        changes.append((edit, ResetSource.HEAD))
+    for edit in working_edits:
+        changes.append((edit, ResetSource.WORKING))
+    changes.sort(key=lambda item: item[0].start)
+    result_lines: list[bytes] = []
+    sources: list[tuple[ResetSource, int]] = []
+    position = 0
+    for edit, source in changes:
+        while position < edit.start:
+            result_index = working_index_by_base_index[position]
+            result_lines.append(working_lines[result_index])
+            sources.append((ResetSource.WORKING, result_index))
+            position += 1
+        source_lines = head_lines if source == ResetSource.HEAD else working_lines
+        for result_index in range(edit.result_start, edit.result_end):
+            result_lines.append(source_lines[result_index])
+            sources.append((source, result_index))
+        position = edit.end
+    while position < len(index_lines):
+        result_index = working_index_by_base_index[position]
+        result_lines.append(working_lines[result_index])
+        sources.append((ResetSource.WORKING, result_index))
+        position += 1
+    return b"".join(result_lines), tuple(sources)
+
+
+def verify_canonical(content: bytes, expected: bytes, path: bytes) -> Generator[GitCommand, bytes]:
+    """Require Git to map the published raw bytes back to the independently computed blob."""
+    expected_oid = yield GitCommand(["hash-object", "--no-filters", "--stdin"], stdin=expected)
+    actual_oid = yield GitCommand(["hash-object", "--path=" + os.fsdecode(path), "--stdin"], stdin=content,
+                                  timeout_ms=GIT_MUTATION_TIMEOUT_MS, idle_timeout_ms=MUTATION_IDLE_TIMEOUT_MS, profile=LOCAL_WRITE_PROFILE)
+    if expected_oid != actual_oid:
+        raise ValueError("Git conversion cannot preserve the unstaged bytes in the Reset result")
+
+
+def merge_content(index: bytes, head: bytes, working: bytes, raw: FileImage, restored: FileImage, path: bytes,
+                  operation_dir: str, mode: str, destination_path: bytes) -> Generator[GitCommand | FileTask, bytes, bytes]:
+    """Cross-check Git's merge with interval replay and preserve original unmodified raw slices."""
+    if index == head:
+        yield from verify_canonical(raw.read(), working, destination_path)
+        return raw.read()
+    if working == index:
+        return restored.read()
+    if any(b"\0" in content for content in (index, head, working)):
+        raise ValueError("Binary staged and unstaged changes cannot be separated safely")
+    expected, sources = yield FileTask(lambda: independent_result(index, head, working))
+    filenames: list[str] = []
+    for basename, content in (("merge-working", working), ("merge-index", index), ("merge-head", head)):
+        filename = os.path.join(operation_dir, basename)
+        with open(filename, "wb") as stream:
+            stream.write(content)
+        filenames.append(filename)
+    try:
+        merged = yield GitCommand(["merge-file", "-p", "--", *filenames], timeout_ms=GIT_MUTATION_TIMEOUT_MS, idle_timeout_ms=MUTATION_IDLE_TIMEOUT_MS)
+    except GitCommandError as error:
+        raise ValueError("Git could not merge the staged Reset without conflicts; no working bytes were changed") from error
+    if merged != expected:
+        raise ValueError("Git's merged result differs from the independently preserved unstaged changes")
+    attributes = yield GitCommand(["check-attr", "-z", "filter", "working-tree-encoding", "--stdin"], stdin=path + b"\0")
+    attribute_by_name: dict[bytes, bytes] = {}
+    fields = iter(attributes.removesuffix(b"\0").split(b"\0"))
+    for _path in fields:
+        name, value = next(fields), next(fields)
+        attribute_by_name[name] = value
+    encoding_value = attribute_by_name.get(b"working-tree-encoding", b"unspecified")
+    encoding = "" if encoding_value in (b"unspecified", b"unset") else encoding_value.decode("ascii")
+    if attribute_by_name.get(b"filter", b"unspecified") not in (b"unspecified", b"unset"):
+        working_oid = (yield GitCommand(["hash-object", "-w", "--no-filters", "--stdin"], stdin=working, profile=LOCAL_WRITE_PROFILE)).strip().decode("ascii")
+        materialized = yield from materialize_blob(working_oid, path, mode, os.path.join(operation_dir, "materialized-working"))
+        head_slices = yield from filtered_line_slices(head, restored.read(), restored.read(), path)
+        working_slices = yield from filtered_line_slices(working, raw.read(), materialized.read(), path)
+    else:
+        head_slices = line_slices(head, restored.read(), encoding)
+        working_slices = line_slices(working, raw.read(), encoding)
+    raw_lines: list[bytes] = []
+    for source, line_index in sources:
+        line = head_slices.lines[line_index] if source == ResetSource.HEAD else working_slices.lines[line_index]
+        if source == ResetSource.HEAD and head_slices.codec and working_slices.codec and head_slices.codec != working_slices.codec:
+            line = line.decode(head_slices.codec).encode(working_slices.codec)
+        raw_lines.append(line)
+    candidate = working_slices.prefix + b"".join(raw_lines)
+    yield from verify_canonical(candidate, expected, destination_path)
+    return candidate
+
+
+def index_records(output: bytes) -> dict[bytes, bytes]:
+    """Validate NUL index records before comparing selected and unrelated entries."""
+    record_by_path: dict[bytes, bytes] = {}
+    if output and not output.endswith(b"\0"):
+        raise ValueError("Incomplete candidate index entries")
+    for record in output.split(b"\0"):
+        if not record:
+            continue
+        metadata, separator, path = record.partition(b"\t")
+        if not separator or not metadata.endswith(b" 0") or path in record_by_path:
+            raise ValueError("Conflicted or malformed candidate index entry")
+        record_by_path[path] = record
+    return record_by_path
+
+
+def reset_executable_mode(mode: int, git_mode: str) -> int:
+    """Restore Git executability while retaining local read/write and special permission bits."""
+    if bool(mode & stat.S_IXUSR) == (git_mode == "100755"):
+        return mode
+    executable_mask = stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH
+    mode &= ~executable_mask
+    if git_mode == "100755":
+        read_mask = stat.S_IRUSR | stat.S_IRGRP | stat.S_IROTH
+        read_to_execute_shift = 2
+        mode |= (mode & read_mask) >> read_to_execute_shift
+    return mode
+
+
+def capture_rename_origin(context: RepositoryContext, path: bytes) -> tuple[FileImage, int]:
+    """Capture a rename's original path with its link count, so Reset can tell one entry seen twice from a second file.
+
+    The count is read from the same file the image describes. On Linux and macOS a link added or removed while reading
+    also moves the file's change time, so a moved identity refuses instead of trusting a stale count. On Windows that
+    time is the creation time and does not move, so the count read here is the only check; that is enough, because
+    replacing the directory entry never rewrites the bytes of another link.
+    """
+    image = capture_image(context, path, allow_missing_parents=True)
+    if not image.exists:
+        return image, 0
+    metadata = os.lstat(worktree_filename(context, path))
+    if stat_identity(metadata) != image.identity:
+        raise ValueError("Working file changed while reading")
+    return image, metadata.st_nlink
+
+
+def directory_lists_name(context: RepositoryContext, path: bytes) -> bool:
+    """Tell whether the working folder holds a directory entry spelled exactly like ``path``.
+
+    A disk that ignores letter case or Unicode form finds a renamed file under its old spelling too, but lists it only
+    under the spelling the entry has; a disk that keeps spellings apart lists a second link under its own spelling.
+    """
+    parent_dir, basename = os.path.split(worktree_filename(context, path))
+    with os.scandir(parent_dir) as iterator:
+        for entry in iterator:
+            if entry.name == basename:
+                return True
+    return False
+
+
+def calculate_file(snapshot: WorktreeSnapshot, entry: LocalEntry, record: bytes | None, file_dir: str, symlinks: bool, *, filemode: bool = True) -> Generator:
+    """Handle absence, renames and file metadata separately from the content-preservation proof.
+
+    Both settings are read once by the caller for the whole operation; filemode keeps Git's default when omitted.
+    """
+    path = entry.path
+    if "160000" in (entry.old_mode, entry.new_mode):
+        raise ValueError("Reset cannot change submodule working files; use the submodule's own checkout controls")
+    before = yield FileTask(lambda: capture_image(snapshot.context, path, allow_missing_parents=True))
+    index_mode, index_oid = "000000", ""
+    if record is not None:
+        raw_mode, raw_oid, _stage = record.partition(b"\t")[0].split(b" ")
+        index_mode, index_oid = raw_mode.decode("ascii"), raw_oid.decode("ascii")
+    if entry.side == StagingSide.UNSTAGED and not index_oid:
+        raise ValueError("This file has no index version; use Delete file explicitly for untracked files")
+    target_oid = index_oid if entry.side == StagingSide.UNSTAGED else entry.old_blob_oid
+    target_mode = index_mode if entry.side == StagingSide.UNSTAGED else entry.old_mode
+    destination_path = entry.old_path if entry.side == StagingSide.STAGED and entry.status == FileStatus.RENAMED else path
+    if target_mode not in ("000000", "100644", "100755", "120000") or index_mode not in ("000000", "100644", "100755", "120000"):
+        raise ValueError("This Git file mode cannot be reset safely")
+    restored = FileImage(False, 0)
+    if target_oid and target_mode != "000000":
+        restored = yield from materialize_blob(target_oid, destination_path, target_mode, os.path.join(file_dir, "materialized-source"), symlinks)
+    if entry.side == StagingSide.UNSTAGED:
+        mode = restored.mode
+        if before.exists and stat.S_IFMT(before.mode) == stat.S_IFMT(mode):
+            mode = before.mode
+            if stat.S_ISREG(mode) and index_mode in ("100644", "100755") and filemode:
+                mode = reset_executable_mode(mode, index_mode)
+        return (FileChange(path, before, FileImage(restored.exists, mode, restored.read())),)
+    index = (yield GitCommand(["cat-file", "blob", index_oid])) if index_oid else None
+    working = None
+    if before.exists:
+        if stat.S_ISLNK(before.mode) or index_mode == "120000":
+            working = before.read()
+        else:
+            working_oid = (yield GitCommand(["hash-object", "-w", "--path=" + os.fsdecode(path), "--stdin"], stdin=before.read(),
+                                           timeout_ms=GIT_MUTATION_TIMEOUT_MS, idle_timeout_ms=MUTATION_IDLE_TIMEOUT_MS, profile=LOCAL_WRITE_PROFILE)).strip().decode("ascii")
+            working = yield GitCommand(["cat-file", "blob", working_oid])
+    if index is None:
+        if before.exists:
+            raise ValueError("A file recreated after staged deletion collides with the version to restore")
+        return (FileChange(path, before, restored),)
+    if not restored.exists:
+        if working is not None and working != index:
+            raise ValueError("An added file's unstaged changes cannot be separated from its staged content")
+        return (FileChange(path, before, FileImage(False, 0)),)
+    head = yield GitCommand(["cat-file", "blob", target_oid])
+    if working is None:
+        if head != index:
+            raise ValueError("Unstaged deletion overlaps the staged content; Reset cannot preserve both")
+        after = FileImage(False, 0)
+    else:
+        type_changed = stat.S_ISLNK(before.mode) != (index_mode == "120000" and symlinks)
+        if type_changed or ("120000" in (index_mode, target_mode) and working != index and head != index):
+            raise ValueError("The staged and unstaged file types or link targets cannot be separated safely")
+        regular_mode_changed = index_mode != target_mode and index_mode in ("100644", "100755") and target_mode in ("100644", "100755")
+        if regular_mode_changed and filemode and bool(before.mode & stat.S_IXUSR) != (index_mode == "100755"):
+            raise ValueError("Staged and unstaged executable mode changes overlap")
+        content = yield from merge_content(index, head, working, before, restored, path, file_dir, target_mode, destination_path)
+        mode = before.mode if index_mode == target_mode else restored.mode
+        if regular_mode_changed:
+            mode = reset_executable_mode(before.mode, target_mode)
+        after = FileImage(True, mode, content)
+    if destination_path == path:
+        return (FileChange(path, before, after),)
+    old_image, old_link_count = yield FileTask(lambda: capture_rename_origin(snapshot.context, destination_path))
+    same_identity = old_image.exists and before.exists and old_image.identity == before.identity
+    if same_identity and old_link_count != SINGLE_LINK_COUNT:
+        # When nothing is listed under the original spelling, the extra links live under unrelated names: the refusal
+        # stays, but it names those links rather than an original path that nothing occupies.
+        origin_listed = yield FileTask(lambda: directory_lists_name(snapshot.context, destination_path))
+        if not origin_listed:
+            raise ValueError(OTHER_HARD_LINKS_MESSAGE)
+    same_file = same_identity and old_link_count == SINGLE_LINK_COUNT
+    if old_image.exists and not same_file:
+        raise ValueError(RENAME_ORIGIN_OCCUPIED_MESSAGE)
+    if same_file:
+        # Both names lead to the same file and that file has a single link, so they are one directory entry that a
+        # filesystem ignoring letter case or Unicode form finds under both spellings (a case-only rename on macOS or
+        # Windows). A private candidate replaces that entry under its original name. A file with two links is a real
+        # second file under the other name and keeps the refusal above.
+        return (FileChange(destination_path, old_image, after, path),)
+    return (FileChange(path, before, FileImage(False, 0)), FileChange(destination_path, old_image, after))
+
+
+def calculate_reset(snapshot: WorktreeSnapshot, entries: tuple[LocalEntry, ...], operation_dir: str) -> Generator:
+    """Compute all selected images and a private index, leaving live Git and files untouched.
+
+    The captured index entries stand for the first listing of the private copy, since that copy is proven byte for
+    byte identical to the captured index; only a capture without entries lists the copy again. The final listing
+    always runs, because it is the proof that nothing outside the selection changed.
+    """
+    if not snapshot.fresh or snapshot.context.is_bare or not entries:
+        raise ValueError("Choose files from a complete current working tree read")
+    side = next(iter(entries)).side
+    if side not in (StagingSide.STAGED, StagingSide.UNSTAGED) or any(entry not in snapshot.entries or entry.side != side or entry.skip_worktree for entry in entries):
+        raise ValueError("Choose current files on the same side; skip-worktree files cannot be reset")
+    if any(entry.conflict_stages for entry in snapshot.entries):
+        raise ValueError("Resolve all conflicts before Reset")
+    candidate_filename = os.path.join(operation_dir, "candidate-index")
+    environment_by_name = {"GIT_INDEX_FILE": candidate_filename}
+    if snapshot.index_content is None:
+        yield GitCommand(["read-tree", "--empty"], environment_by_name=environment_by_name, profile=LOCAL_WRITE_PROFILE)
+    else:
+        shutil.copy2(snapshot.index_filename, candidate_filename)
+        if read_index(candidate_filename) != snapshot.index_content:
+            raise ValueError("The index changed while preparing Reset")
+    if may_carry_split_index(snapshot.index_content):
+        yield GitCommand(["update-index", "--no-split-index"], environment_by_name=environment_by_name, profile=LOCAL_WRITE_PROFILE)
+    before_entries = snapshot.index_entries
+    if before_entries is None:
+        before_entries = yield GitCommand(["ls-files", "--stage", "-z"], environment_by_name=environment_by_name)
+    record_by_path = index_records(before_entries)
+    changes: list[FileChange] = []
+    policy = yield from read_reset_file_policy()
+    for number, entry in enumerate(entries):
+        path = entry.path
+        file_dir = os.path.join(operation_dir, str(number))
+        os.mkdir(file_dir, PRIVATE_DIRECTORY_MODE)
+        changes.extend((yield from calculate_file(snapshot, entry, record_by_path.get(path), file_dir, policy.symlinks, filemode=policy.filemode)))
+    changed_path_set: set[bytes] = set()
+    for change in changes:
+        if change.path in changed_path_set:
+            raise ValueError("Selected structural changes share a destination; choose an unambiguous batch")
+        changed_path_set.add(change.path)
+    paths = tuple(dict.fromkeys(path for entry in entries for path in entry.paths))
+    if side == StagingSide.STAGED:
+        if snapshot.head_oid:
+            yield GitCommand(["restore", "--staged", "--source=" + snapshot.head_oid, "--pathspec-from-file=-", "--pathspec-file-nul"],
+                             stdin=b"\0".join(paths) + b"\0", environment_by_name=environment_by_name, profile=LOCAL_WRITE_PROFILE)
+        else:
+            yield GitCommand(["update-index", "--force-remove", "-z", "--stdin"], stdin=b"\0".join(paths) + b"\0", environment_by_name=environment_by_name, profile=LOCAL_WRITE_PROFILE)
+    after_entries = yield GitCommand(["ls-files", "--stage", "-z"], environment_by_name=environment_by_name)
+    after_record_by_path = index_records(after_entries)
+    path_set = set(paths)
+    for path in set(record_by_path) | set(after_record_by_path):
+        if path not in path_set and record_by_path.get(path) != after_record_by_path.get(path):
+            raise ValueError("Reset candidate changed an unrelated index entry")
+    return tuple(changes), before_entries, after_entries, read_index(candidate_filename) if side == StagingSide.STAGED else snapshot.index_content