diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 811c0491..b39936d1 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -370,7 +370,7 @@ graph TD | `lib/lane-services.js` | (A2) `ensureDatabase`/`dropDatabase` call the profile's `db-create`/`db-drop` hooks — AgentHub stays stack-agnostic on purpose. A state-dir marker file tracks whether a slot's database was already created, since a plain `createdb` can't be re-run safely and AgentHub can't assume the hook is idempotent; this is also how `upLane` knows to seed only a freshly-created database. `dropDatabase` asserts the lane is `managed` and that the name being dropped is one this lane's own slot actually derives (itself or its `_test` sibling) before spawning anything | | `lib/lane-features.js` | (B) Per-feature state and archive. `activateFeature` archives the lane's current active feature (if different) and restores the target's saved stage onto the live `lanes` row — the row stays the one live view every other reader already uses. `canonicalizeSlug` is a DELIBERATELY separate rule from `worktree.js:slugify` (drops a leading `feat/`, keeps `[A-Za-z0-9._-]`, does not lowercase) — the two must never be conflated. `clearLane` (`lib/lanes.js`) archives the active feature (if any) before resetting; a lane that never activated one is unaffected | | `lib/git-diff.js` | (#34/#35) Reads a lane's code changes as structured hunks for the Workspace Changes panel — `work` (HEAD vs the working tree, untracked files included), `branch` (`...HEAD`) or `commit` (one sha), at a caller-chosen `context` (default 3, clamped to 5000, which is how the viewer expands a diff towards the whole file). Also the four reads behind History, the whole-file view, quick-open and the file explorer: `listCommits`, `readFileAt` (the `work` revision is realpath-confined to the lane; anything else goes through `git show`), `listPaths` and `listTree` (both `git ls-files`, so `.gitignore` is honoured without a skip-list). Read-only, argv-only through `worktree.js:git()`. An untracked file's patch is SYNTHESIZED from the file itself rather than fetched with `git diff --no-index`, which exits non-zero on a difference and would read as a failure. Three caps (300 files, 200 KB per file, 1 MB per full read) keep a lane mid-build from shipping megabytes of patch into a browser; a cap that bit sets `truncated` | -| `lib/git-ops.js` | (#34) The git WRITES a lane offers: `fetch`, `pull`, `push`, `stage`, `unstage`, `discard`, `stage-hunk`/`discard-hunk` (one hunk, matched by its `@@` line against a fresh diff; `discard-hunk` needs `confirm:true`), `commit` (everything, or `only:"staged"`), `switch`, `branch-create` (never switches) and `branch-delete` (`-d`, refusing `main`/`master`/`development`/`develop`, the current branch and one another worktree holds). A caller-supplied path is validated against `git status` before it reaches an argv, so only a path git already reports as changed is reachable; `discard` — the one irreversible action — additionally requires `confirm: true`. Deliberately the boring half of git — no merge, rebase, reset or stash, because a dashboard button is the wrong place to start an operation whose recovery needs a terminal (`reset` stays behind worktree.js's three-check destroy guard). `pull` is ALWAYS `--ff-only` and `switch` refuses a dirty tree, so neither can invent a merge commit or a conflict underneath a running agent; `push` pushes `HEAD`, never a branch name from the request. Network actions carry a 60s timeout | +| `lib/git-ops.js` | (#34) The git WRITES a lane offers: `fetch`, `pull`, `push`, `stage`, `unstage`, `discard`, `stage-hunk`/`discard-hunk` (one hunk, matched by its `@@` line against a fresh diff; `discard-hunk` needs `confirm:true`), `commit` (everything, or `only:"staged"`), `switch`, `branch-create` (never switches) and `branch-delete` (`-d`, refusing `main`/`master`/`development`/`develop`, the current branch and one another worktree holds), `publish` (`remote add origin -- ` + `push -u origin HEAD`, only when the repo has NO remote and a commit; the one write whose destination comes from the request, so the URL is allowlisted by `validateRemoteUrl` — `https://` without userinfo, `ssh://`, scp-like `user@host:path` — and `origin` is removed again when the push fails), and `merge`/`resolve`/`merge-commit`/`merge-abort` (issue #45: a named branch into a clean repo-root lane, conflicts resolved per file, abort behind `confirm:true`). A caller-supplied path is validated against `git status` before it reaches an argv, so only a path git already reports as changed is reachable; `discard` — the one irreversible action — additionally requires `confirm: true`. No rebase, reset or stash, because a dashboard button is the wrong place to start an operation whose recovery needs a terminal (`reset` stays behind worktree.js's three-check destroy guard). `pull` is ALWAYS `--ff-only` and `switch` refuses a dirty tree, so neither can invent a merge commit or a conflict underneath a running agent; `push` pushes `HEAD`, never a branch name from the request. Network actions carry a 60s timeout | | `lib/proof.js` | (C) Proof gallery: lists/serves/deletes QC screenshots grouped by feature slug (Task B's `lane_features`) and phase, under `/.playwright-mcp/proof///`. Every path is resolved, realpath'd, and containment-checked before touching `fs` — the entire security surface. `ensureProofLink` ports Shipyard's `ensure_proof_link` (converge a stray clone-root `proof/` onto the canonical dir); never auto-invoked, exposed only as `agenthub lanes proof-link` | | `lib/named-lock.js` | (D) Cross-lane named locks — the OTHER axis from `lib/lane-lock.js`'s per-lane, in-process serialization, deliberately a separate module. `mkdir` is the atomicity primitive (EEXIST decides "already held" in one syscall, never check-then-create). `LOCK_MAX_HOLD` (default 2700s) breaks a stale holder on the next acquire, floored at 300s so the floor — not the configurable default — is the actual safety property: nothing can force-break a live holder by setting the env var low. Single-shot only; the CLI's `agenthub lock acquire` owns the polling loop, keeping the server side non-orchestrating like every other lane primitive | diff --git a/CLAUDE.md b/CLAUDE.md index 4ac44183..d09271f3 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -37,7 +37,7 @@ A **lane** is a durable unit of parallel agent work — one working directory, m - **Never `rm -rf` a lane.** Destructive lane operations (`reset`, `remove`, `purge`) go through `server/lib/worktree.js`/`server/lib/lanes.js`, never a raw filesystem delete — that's what keeps the three-check destroy guard and the DB bookkeeping in lockstep. - **Never build a git command as a shell string.** Lane git operations use `execFile("git", [...args])` with an explicit argument array (see `server/lib/worktree.js`'s `git()` helper), never a concatenated/interpolated string passed to a shell. - **A lane's AI Router profile is a lane fact too, and it never travels alone.** `lanes.router_profile` (nullable; null means the same as `native`) is written ONLY by `setRouterProfile`, called beside the disk write in `POST /api/lanes/:id/router/apply` — never through `PATCHABLE`. The column and the lane's own config must move together, or the row claims a router the lane's `settings.local.json` has never heard of. What is written comes from the lane row, never the request: a **claude** lane gets eight `env` keys merged into `/.claude/settings.local.json` (`.local` because the value carries an API key; every other key in that file is preserved and a non-JSON file is refused, not rewritten), a **codex** lane gets `$CODEX_HOME/.config.toml` — the layer `codex -p ` loads — because Codex has NO project-level config, and its base `config.toml` is never touched. Key material never leaves the server: profiles live at `/agenthub-routers/` (0700/0600), `GET /api/ai-routers` reports only `hasKey`, and there is deliberately no route that returns one profile in full. **`POST /api/ai-routers/test` sends a stored key ONLY to the endpoint it was stored against** — a blank `apiKey` falls back to the profile named by `name`, but only while the submitted `baseUrl` still equals the saved one, else `EBADKEY`. Relax that and the route becomes a way to make the server POST a saved key to any URL a browser names. **Re-pointing a lane is allowed and is not a PATCH:** the lane card's AI Router select calls `POST /api/lanes/:id/router/apply` (column + disk together, same rule as above), never `PATCH /api/lanes/:id`. **Codex's key reaches the pane through tmux's `-e` argv and is never typed into it** — `tmux.sendCommand` takes over an idle pane with `respawn-pane` for exactly this reason; a `KEY='sk-…' codex …` line typed with `send-keys` would be rendered to every attached browser, kept in the scrollback and appended to the user's shell history. Do not reintroduce a typed command line there. **And attaching COPIES a profile**, so the store stops being the single source of truth the moment a lane exists: `PATCH`/`DELETE /api/ai-routers/:name` must push through to the lanes naming it (`reapplyToLanes`/`detachFromLanes`), or a rotated key silently never reaches the lane still using the revoked one. See `server/lib/ai-routers.js`, `server/lib/router-apply.js`. -- **The dashboard's git writes are these sixteen, and the guards are IN `git-ops.js`, not in the UI.** `POST /api/lanes/:id/git/:action` offers `fetch`, `pull`, `push`, `stage`, `unstage`, `discard`, `stage-hunk`, `discard-hunk`, `commit`, `switch`, `branch-create`, `branch-delete`, `merge`, `resolve`, `merge-commit`, `merge-abort` — nothing else. **A path in the body is never a path**: `resolvePaths` accepts only what `git status` is reporting as changed right now, which is the whole authorization story for the per-file actions (no `..`, no absolute path, no untouched file). `discard`, `discard-hunk` and `merge-abort` are the irreversible actions and all refuse to run without `confirm: true`; do not add another destructive action without the same gate. `branch-create` never switches (the reason to create one from a lane is a sibling worktree, not moving a working agent's HEAD) and `branch-delete` is `-d`, never `-D`, refusing `main`/`master`/`development`/`develop`, the current branch and one another worktree holds. `pull` is ALWAYS `--ff-only` and `switch` refuses a dirty tree, so neither can invent a merge commit or a conflict underneath a running agent; `push` pushes `HEAD`, never a branch name from the request; `commit` passes its message as one argv element. **The lane is the boundary, not the repo**: a subdir lane's reads and writes stay under its own cwd, and no read may return a `settings.local.json` (`ESECRET`) — do not add a git read that skips `lanePath`/`isSecret`. **A merge is the one history-joining action, and only because its recovery is a button too** (`merge-abort`): it starts only by name, on a clean tree, from a lane at the repo ROOT (`ESUBDIR` — a merge is repo-wide and a subdir lane could not resolve a conflict outside itself), one at a time (`pull`/`switch`/`merge`/hunk actions answer `EMERGING` meanwhile); the ref is looked up in `refs/heads`+`refs/remotes`, never passed through; a conflicted file is resolved only through `resolve` (ours/theirs, or `done` once no conflict marker is left — `stage` refuses a conflicted file that still has markers, `EMARKERS`), and `merge-commit` refuses while anything is unmerged (`ECONFLICTS`). Do not add rebase, reset or stash here: a dashboard click is the wrong place to start an operation whose recovery needs a terminal, and `reset` already lives behind `worktree.js`'s three-check destroy guard. A button that looks disabled in `LaneGitBar` is a courtesy; the refusal that matters is the server's. Reads (`/git`, `/git/changes`, `/git/log`, `/git/file`, `/git/ls`, `/git/tree`, `/git/branches`) stay unguarded like `/git` always was, and resolve their repo from the LANE ROW — `GET /api/lanes/branches` is the only one that takes a path from the request, because its lane does not exist yet. +- **The dashboard's git writes are these seventeen, and the guards are IN `git-ops.js`, not in the UI.** `POST /api/lanes/:id/git/:action` offers `fetch`, `pull`, `push`, `stage`, `unstage`, `discard`, `stage-hunk`, `discard-hunk`, `commit`, `switch`, `branch-create`, `branch-delete`, `publish`, `merge`, `resolve`, `merge-commit`, `merge-abort` — nothing else. **`publish` is the ONE write that takes a destination from the request** (`{url}`), so it can only give a remote to a repo that has NONE: it refuses before the first commit (`ENOCOMMITS`) and whenever `git remote` prints anything (`EREMOTEEXISTS` — it never re-points a remote, so it cannot redirect a repo that already publishes somewhere), the name is always `origin`, the URL passes `validateRemoteUrl`'s allowlist (`https://` with NO userinfo, `ssh://`, scp-like `user@host:path` — never a local path, `file://`, `ext::`, `fd::`, `git://`, `http://` or anything starting with `-`), it runs `remote add origin -- ` then the same `push -u origin HEAD` as `push`, and a failed push removes `origin` again. That is still weaker than the AI-router "a key goes only to its stored endpoint" rule — a browser on the dashboard's origin can publish a remote-less repo to any allowlisted host — so do not widen the allowlist or let it touch a repo that already has a remote. **A path in the body is never a path**: `resolvePaths` accepts only what `git status` is reporting as changed right now, which is the whole authorization story for the per-file actions (no `..`, no absolute path, no untouched file). `discard`, `discard-hunk` and `merge-abort` are the irreversible actions and all refuse to run without `confirm: true`; do not add another destructive action without the same gate. `branch-create` never switches (the reason to create one from a lane is a sibling worktree, not moving a working agent's HEAD) and `branch-delete` is `-d`, never `-D`, refusing `main`/`master`/`development`/`develop`, the current branch and one another worktree holds. `pull` is ALWAYS `--ff-only` and `switch` refuses a dirty tree, so neither can invent a merge commit or a conflict underneath a running agent; `push` pushes `HEAD`, never a branch name from the request; `commit` passes its message as one argv element. **The lane is the boundary, not the repo**: a subdir lane's reads and writes stay under its own cwd, and no read may return a `settings.local.json` (`ESECRET`) — do not add a git read that skips `lanePath`/`isSecret`. **A merge is the one history-joining action, and only because its recovery is a button too** (`merge-abort`): it starts only by name, on a clean tree, from a lane at the repo ROOT (`ESUBDIR` — a merge is repo-wide and a subdir lane could not resolve a conflict outside itself), one at a time (`pull`/`switch`/`merge`/hunk actions answer `EMERGING` meanwhile); the ref is looked up in `refs/heads`+`refs/remotes`, never passed through; a conflicted file is resolved only through `resolve` (ours/theirs, or `done` once no conflict marker is left — `stage` refuses a conflicted file that still has markers, `EMARKERS`), and `merge-commit` refuses while anything is unmerged (`ECONFLICTS`). Do not add rebase, reset or stash here: a dashboard click is the wrong place to start an operation whose recovery needs a terminal, and `reset` already lives behind `worktree.js`'s three-check destroy guard. A button that looks disabled in `LaneGitBar` is a courtesy; the refusal that matters is the server's. Reads (`/git`, `/git/changes`, `/git/log`, `/git/file`, `/git/ls`, `/git/tree`, `/git/branches`) stay unguarded like `/git` always was, and resolve their repo from the LANE ROW — `GET /api/lanes/branches` is the only one that takes a path from the request, because its lane does not exist yet. - **AgentHub's git credentials are its OWN store, shared by every user of the install, and git is given ONLY that store when it holds a login for the host.** `server/lib/git-credentials.js` keeps one record per `protocol + host` under `/agenthub-git-credentials/` (0700/0600) and no route ever returns a password (`hasToken` only). `gitConfigFor` runs a network action with `-c credential.helper= -c credential.helper=` whenever AgentHub holds a login for a repo remote's host or the request carries one — the machine's helpers are left out on purpose: a stale token there would win over the typed one, and git's post-success `store` would copy a use-once token into the OS user's helper. The secret travels in the helper's env or the store file, never argv. A typed credential is accepted only for one of the repo's OWN remote hosts (`EBADHOST`), so a login is never sent to a server it was not typed for, and it is saved only after git SUCCEEDED and `remember` is set. Do not add a route that returns a stored password or a path that forwards one to a host other than its own. - **A lane's `tool` is a lane fact, immutable, and never read from a request.** `lanes.tool` (`claude` | `codex`, default `claude`) is set by `createLane` only — it is deliberately absent from `PATCHABLE`, so no PATCH can flip the CLI under a live pane. Every spawn path (`POST /api/lanes/:id/start`, `POST /api/run`) takes the tool from the lane row and ignores whatever the body says; the run panel's Codex-only fields (`sandbox`, `approval`, `resumeLast`) are validated against the fixed allowlists in `server/lib/pty-run.js` before they reach an argv, and the bypass flags (`--dangerously-bypass-approvals-and-sandbox`, `--dangerously-bypass-hook-trust`) are never emitted. `GET /api/run/binary?tool=` resolves the probed binary name from that same allowlist — the query string reaches `which`. - **A lane's card position is a viewer preference; its name is a lane fact.** The Workspace strip's drag/Alt-arrow order lives in `localStorage` (`agenthub.workspace.laneOrder`, `client/src/lib/laneOrderStorage.ts`) and writes NOTHING server-side — `GET /api/lanes` and `agenthub lanes` stay in id order, so no `sort_order` column, no reorder route, no websocket message. Renaming is the opposite: it is `PATCH /api/lanes/:id` with `{title}`, the one lane column a user now types into directly, so `updateLane` normalizes it (`normalizeTitle`: trim, 200-char cap, `null` ⇒ `""`, because clearing is legitimate — every render is `lane.title || lane.cwd`). The rule is the column-wide one, not a special case for the field the UI exposes: `bindable` rejects any non-scalar patch value with `EBADFIELD` (`links` excepted — it is stored as JSON), and the route answers 400 for that AND for the `SQLITE_CONSTRAINT` family, rather than handing better-sqlite3 a datatype throw and reporting 500 on plain bad input. diff --git a/client/src/components/lanes/AddLaneModal.tsx b/client/src/components/lanes/AddLaneModal.tsx index 85ebf096..218cfd96 100644 --- a/client/src/components/lanes/AddLaneModal.tsx +++ b/client/src/components/lanes/AddLaneModal.tsx @@ -379,7 +379,7 @@ export function AddLaneModal({ !done && (!sourceRepo.trim() || (mode === "worktree" && - (!title.trim() || !branches || (branchMode === "existing" && !branch.trim())))); + (!title.trim() || !branches?.length || (branchMode === "existing" && !branch.trim())))); /** branch name -> the worktree directory already holding it. git allows one * checkout per branch, so these are the branches this form cannot use. */ @@ -553,7 +553,18 @@ export function AddLaneModal({ {t("addLaneBaseLabel")} {branches.length === 0 ? ( -

{t("addLaneNoBranches")}

+ // No commit, nothing to fork: the server refuses this with + // EEMPTYREPO, so the one way forward is offered instead. +
+

{t("addLaneNoBranches")}

+ +
) : ( setUrl(e.target.value)} + onKeyDown={(e) => { + if (e.key === "Enter" && url.trim()) void run("publish", { url: url.trim() }); + }} + // The server decides which URLs are acceptable (https without a + // token, ssh, user@host:path); this only names the two usual ones. + placeholder={t("gitBar.publishUrl")} + aria-label={t("gitBar.publishUrl")} + className="min-w-0 flex-1 rounded border border-border-light bg-surface-0 px-2 py-0.5 font-mono text-[11px] text-fg-primary placeholder:text-fg-muted focus:border-accent focus:outline-none" + /> + } + busy={busy === "publish"} + disabled={!url.trim()} + title={t("gitBar.publishHint")} + onClick={() => void run("publish", { url: url.trim() })} + /> + + )} + {login && (
{ expect(screen.getByRole("button", { name: "Add lane" })).toBeDisabled(); }); + it("refuses a worktree of a repo with no commits and steers to Repo mode", async () => { + vi.mocked(api.lanes.branches).mockResolvedValue({ + branches: [], + current: "main", + worktrees: [], + }); + renderModal(); + const user = userEvent.setup(); + + const repoField = screen.getByLabelText("Source repository"); + await focusField(user, repoField); + await user.type(repoField, "/Users/tester/projects/empty"); + expect(await screen.findByText(/commit first, then publish/i)).toBeInTheDocument(); + await user.type(screen.getByLabelText("Title"), "demo"); + // There is nothing to branch from, so the worktree cannot be created. + expect(screen.getByRole("button", { name: "Add lane" })).toBeDisabled(); + + await user.click(screen.getByRole("button", { name: "Use as a Repo lane" })); + expect(screen.getByRole("button", { name: "Repo" })).toHaveAttribute("aria-pressed", "true"); + expect(screen.getByRole("button", { name: "Add lane" })).toBeEnabled(); + }); + it("submits through the worktree provisioning endpoint, with the typed branch name", async () => { vi.mocked(api.lanes.branches).mockResolvedValue({ branches: ["main"], diff --git a/client/src/components/lanes/__tests__/LaneGitBar.test.tsx b/client/src/components/lanes/__tests__/LaneGitBar.test.tsx index 54cdf8fb..6dbf7ed5 100644 --- a/client/src/components/lanes/__tests__/LaneGitBar.test.tsx +++ b/client/src/components/lanes/__tests__/LaneGitBar.test.tsx @@ -1,7 +1,8 @@ /** * @file LaneGitBar.test.tsx * @description Pins the lane git action row: the ahead/behind readout, which - * buttons a repo with no remote may press, that it offers no commit (the + * buttons a repo with no remote may press (and that it may publish to a typed URL), + * what an unborn repo and a branch with no upstream show, that it offers no commit (the * Changes panel's staged-only box owns that), that a dirty tree blocks the branch switch client-side (the server * refuses it too), and that a failed action shows git's own words rather than * a generic sentence. @@ -24,6 +25,7 @@ function facts(over: Partial> = {}): available: true, branch: "feat/thing", head: "9b3e74a", + unborn: false, subject: "wip", dirty: 2, untracked: 1, @@ -79,6 +81,65 @@ describe("LaneGitBar", () => { expect(screen.queryByRole("button", { name: /Commit/ })).toBeNull(); }); + it("shows an unborn repo's branch and asks for a first commit instead of a push", () => { + render( + + ); + expect(screen.getByTestId("lane-git-bar")).toHaveTextContent("no commits yet"); + expect(screen.getByText(/Commit first, then publish/)).toBeInTheDocument(); + expect(screen.queryByRole("button", { name: /Fetch|Pull|Push|Publish/ })).toBeNull(); + }); + + it("publishes a repo with no remote to a typed URL", async () => { + const user = userEvent.setup(); + const onChanged = vi.fn(); + render( + + ); + + await user.click(screen.getByRole("button", { name: "Publish…" })); + await user.type(screen.getByLabelText(/Remote URL/), "git@host:owner/repo.git"); + await user.click(screen.getByRole("button", { name: "Publish" })); + + await waitFor(() => + expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "publish", { + url: "git@host:owner/repo.git", + }) + ); + expect(onChanged).toHaveBeenCalled(); + }); + + it("calls a first push of a branch with no upstream 'Publish branch'", async () => { + const user = userEvent.setup(); + render( + + ); + expect(screen.queryByRole("button", { name: /^Push$/ })).toBeNull(); + await user.click(screen.getByRole("button", { name: "Publish branch" })); + await waitFor(() => expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "push", {})); + }); + it("loads the branch list on demand and refuses to switch while dirty", async () => { const user = userEvent.setup(); render(); diff --git a/client/src/i18n/locales/en/lanes.json b/client/src/i18n/locales/en/lanes.json index 7525e646..1a0320c8 100644 --- a/client/src/i18n/locales/en/lanes.json +++ b/client/src/i18n/locales/en/lanes.json @@ -32,7 +32,8 @@ "addLaneBranchModeExisting": "Existing branch", "addLaneBranchModeNew": "New branch", "addLaneBranchPlaceholder": "Automatic — named from the title", - "addLaneNoBranches": "This repo has no commits yet — the worktree will start empty.", + "addLaneNoBranches": "This repo has no commits yet, so a worktree has nothing to branch from. Add it as a Repo lane: commit first, then publish it from the Changes panel.", + "addLaneNoBranchesUseRepo": "Use as a Repo lane", "addLaneNoFreeBranches": "Every branch in this repo is already checked out in a worktree. Create a new branch instead.", "addLaneExists": "This folder already has a lane: #{{id}} {{title}}. It is selected; pick another folder to add a new one.", "addLaneNotARepo": "Not a git repository (or no read access) yet.", @@ -181,7 +182,14 @@ "gitBar.newLane": "New lane here", "gitBar.newLaneHeld": "Already checked out at {{path}} — git allows one worktree per branch", "gitBar.newLaneHint": "Open Add lane for a sibling worktree on the selected branch", + "gitBar.noCommits": "no commits yet", "gitBar.noUpstream": "not pushed", + "gitBar.publish": "Publish…", + "gitBar.publishApply": "Publish", + "gitBar.publishBranch": "Publish branch", + "gitBar.publishBranchHint": "git push -u origin HEAD — this branch has no upstream yet", + "gitBar.publishHint": "Add a remote named origin and push this branch to it (git remote add origin + git push -u origin HEAD)", + "gitBar.publishUrl": "Remote URL: https://host/owner/repo.git or git@host:owner/repo.git", "gitBar.pull": "Pull", "gitBar.pullHint": "git pull --ff-only — refuses instead of merging when the branch has diverged", "gitBar.push": "Push", @@ -192,6 +200,7 @@ "gitBar.switchDirty": "Commit or discard the uncommitted changes first", "gitBar.switchHint": "Switch this worktree to another local branch", "gitBar.switchLabel": "Switch branch…", + "gitBar.unbornHint": "Commit first, then publish this repo to a remote.", "kind.adopted": "adopted", "kind.managed": "managed", "laneDetail.hide": "Hide details", diff --git a/client/src/i18n/locales/vi/lanes.json b/client/src/i18n/locales/vi/lanes.json index 4a75e387..21db6c8e 100644 --- a/client/src/i18n/locales/vi/lanes.json +++ b/client/src/i18n/locales/vi/lanes.json @@ -32,7 +32,8 @@ "addLaneBranchModeExisting": "Nhánh có sẵn", "addLaneBranchModeNew": "Nhánh mới", "addLaneBranchPlaceholder": "Tự động — đặt theo tiêu đề", - "addLaneNoBranches": "Repo này chưa có commit nào — worktree sẽ bắt đầu trống.", + "addLaneNoBranches": "Repo này chưa có commit nào nên worktree không có gì để rẽ nhánh. Hãy thêm nó thành lane Repo: commit trước, rồi publish từ bảng Changes.", + "addLaneNoBranchesUseRepo": "Dùng làm lane Repo", "addLaneNoFreeBranches": "Mọi nhánh của repo này đều đang nằm trong một worktree. Hãy tạo nhánh mới.", "addLaneExists": "Thư mục này đã có lane: #{{id}} {{title}}. Lane đó đã được chọn; hãy chọn thư mục khác để thêm lane mới.", "addLaneNotARepo": "Chưa phải repo git (hoặc không có quyền đọc).", @@ -181,7 +182,14 @@ "gitBar.newLane": "Tạo lane mới", "gitBar.newLaneHeld": "Nhánh đã được checkout tại {{path}} — git chỉ cho một worktree trên mỗi nhánh", "gitBar.newLaneHint": "Mở Add lane để tạo worktree anh em trên nhánh đang chọn", + "gitBar.noCommits": "chưa có commit", "gitBar.noUpstream": "chưa push", + "gitBar.publish": "Publish…", + "gitBar.publishApply": "Publish", + "gitBar.publishBranch": "Publish nhánh", + "gitBar.publishBranchHint": "git push -u origin HEAD — nhánh này chưa có upstream", + "gitBar.publishHint": "Thêm remote tên origin rồi push nhánh này lên đó (git remote add origin + git push -u origin HEAD)", + "gitBar.publishUrl": "URL remote: https://host/owner/repo.git hoặc git@host:owner/repo.git", "gitBar.pull": "Pull", "gitBar.pullHint": "git pull --ff-only — nhánh đã rẽ nhánh thì báo lỗi chứ không merge", "gitBar.push": "Push", @@ -192,6 +200,7 @@ "gitBar.switchDirty": "Hãy commit hoặc bỏ các thay đổi chưa commit trước", "gitBar.switchHint": "Đổi worktree này sang nhánh local khác", "gitBar.switchLabel": "Đổi nhánh…", + "gitBar.unbornHint": "Hãy commit trước, rồi publish repo này lên remote.", "kind.adopted": "đã nhận", "kind.managed": "được quản lý", "laneDetail.hide": "Ẩn chi tiết", diff --git a/client/src/lib/api.ts b/client/src/lib/api.ts index 3f5c402e..52f20b46 100644 --- a/client/src/lib/api.ts +++ b/client/src/lib/api.ts @@ -2533,12 +2533,13 @@ export const api = { * POST /api/lanes/:id/git/:action — one git write on the lane's worktree. * @param id The lane id. * @param action `fetch`, `pull` (always --ff-only), `push`, `stage`, - * `unstage`, `discard`, `commit`, `switch`, `branch-create` or - * `branch-delete`. + * `unstage`, `discard`, `commit`, `switch`, `branch-create`, + * `branch-delete` or `publish`. * @param body `{message, only}` for commit; `{branch, create}` for switch; * `{branch, base}` for branch-create; `{paths}` for stage/unstage; * `{paths, confirm: true}` for discard — which is irreversible, so the - * server refuses it without that flag. + * server refuses it without that flag; `{url}` for publish (a repo with + * no remote yet: adds `origin` and pushes HEAD with an upstream). * @returns `{action, ok, output}` — `output` is git's own text, shown as-is. */ gitAction: ( @@ -2556,11 +2557,13 @@ export const api = { | "discard-hunk" | "branch-create" | "branch-delete" + | "publish" | "merge" | "resolve" | "merge-commit" | "merge-abort", body: { + url?: string; message?: string; only?: "staged"; branch?: string; diff --git a/client/src/lib/types.ts b/client/src/lib/types.ts index dbb8e027..455ffee7 100644 --- a/client/src/lib/types.ts +++ b/client/src/lib/types.ts @@ -2584,9 +2584,11 @@ export type LaneGitFacts = available: true; /** Branch name, or the literal `HEAD` for a detached checkout. */ branch: string; - /** Short commit hash of HEAD. */ - head: string; - /** Subject line of the HEAD commit. */ + /** Short commit hash of HEAD; null in a repo with no commit yet. */ + head: string | null; + /** True when the repo has no commit yet (a fresh `git init`). */ + unborn?: boolean; + /** Subject line of the HEAD commit; "" when unborn. */ subject: string; /** Tracked files with uncommitted changes. */ dirty: number; diff --git a/docs/API.md b/docs/API.md index e2d75383..58cd6e26 100644 --- a/docs/API.md +++ b/docs/API.md @@ -224,7 +224,10 @@ existing `lane_update` message when the lane becomes `idle` or `failed`. runs will spawn. Immutable once the lane is created; an attempt to update it on an existing lane returns `400 EBADTOOL`. -`sourceRepo` must exist, be absolute, and be a git repository. When `base` is +`sourceRepo` must exist, be absolute, and be a git repository with at least +one commit — a repo with no commits has nothing to branch from and is refused +with `400 EEMPTYREPO` before any lane row is created (adopt it as a Repo lane +with `POST /api/lanes/ensure` instead, commit, then `publish`). When `base` is omitted, it defaults to the `LANE_BASE_BRANCH` env var, or `main` when that is also unset. The feature branch is named `` (prefix defaults to `feat/`). `title` (or an optional `slug`) determines the @@ -380,6 +383,7 @@ What the lane's directory looks like to git right now: "available": true, "branch": "feat/rename-metric", "head": "9b3e74a", + "unborn": false, "subject": "free-text rule mode in the form", "dirty": 2, "untracked": 1, @@ -399,6 +403,9 @@ What the lane's directory looks like to git right now: not count its siblings' files (the same scoping as `/git/changes`). - A `cwd` that is missing, is not a git repository, or makes git fail returns `{"available": false}` with HTTP **200** — a normal state, not a fault. +- A repo with **no commit yet** (a fresh `git init`) is available too: it + reports `unborn: true`, `head: null`, `subject: ""` and the branch the first + commit will land on. - `files` names the files the counts came from, **capped at 20** (the counts themselves are never capped). `status` is the two-character `git status --porcelain` code; `path` is the new path for a rename. @@ -585,6 +592,7 @@ cannot collide on `index.lock`. | `switch` | `git switch [-c] ` | `{"branch": "...", "create": false}` | | `branch-create` | `git branch []` — never switches | `{"branch": "...", "base": "..."}` | | `branch-delete` | `git branch -d ` | `{"branch": "..."}` | +| `publish` | `git remote add origin -- ` then `git push -u origin HEAD` — only when the repo has NO remote | `{"url": "https://host/owner/repo.git"}` | | `merge` | `git merge --no-edit ` — a local or remote-tracking branch that exists | `{"branch": "origin/main"}` | | `resolve` | a conflicted file: `checkout --ours\|--theirs` + `add`, or `add` once hand-edited (`done`) | `{"path": "...", "side": "ours\|theirs\|done"}` | | `merge-commit` | `git commit --no-edit` — concludes the merge | — | @@ -635,9 +643,20 @@ cannot collide on `index.lock`. working agent is not. `branch-delete` is `-d`, never `-D`, and refuses `main`/`master`/`development`/`develop` (`400 EPROTECTED`), the current branch and a branch another worktree holds (`400 EBRANCHBUSY`). +- `publish` is the one write whose **destination comes from the request**, so + it only ever gives a remote to a repo that has none: `400 ENOCOMMITS` before + the first commit, `400 EREMOTEEXISTS` once any remote exists (it never + re-points one), and the name is always `origin`. The URL is allowlisted — + `https://` with no userinfo (a token in the URL would land in `.git/config`), + `ssh://` and scp-like `user@host:path`; a local path, `file://`, `ext::`, + `fd::`, `git://`, `http://` and anything starting with `-` are + `400 EBADURL`. If the push fails, `origin` is removed again, so a typo or a + missing credential can simply be retried. The response adds + `"remote": "origin"`. - Bad input is **400** (`EBADACTION`, `EBADMESSAGE`, `EBADBRANCH`, `EBADPATH`, `ECONFIRM`, `EUNTRACKED`, `EPROTECTED`, `ENOBRANCH`, `EBRANCHEXISTS`, `EBRANCHBUSY`, - `EDIRTY`, `ENOCHANGES`, `ESTAGEDOUTSIDE`, `ENOREMOTE`); git itself exiting + `EDIRTY`, `ENOCHANGES`, `ESTAGEDOUTSIDE`, `ENOREMOTE`, `EBADURL`, `EREMOTEEXISTS`, + `ENOCOMMITS`); git itself exiting non-zero (a rejected push, a diverged pull) is **409 `EGIT`** with git's own `stderr` appended to `error.message` — a rejection reads better in git's words. Anything else (git not installed, a @@ -647,7 +666,7 @@ cannot collide on `index.lock`. `400 ESTAGEDOUTSIDE` while the index holds a change outside that directory: `git commit` takes the whole index whatever the cwd, and scoping it with a pathspec would commit the working-tree copy (unstaged edits included). -- Network actions (`fetch`/`pull`/`push`) are killed after 60s so an unreachable +- Network actions (`fetch`/`pull`/`push`/`publish`) are killed after 60s so an unreachable remote fails instead of holding the request open. - **A remote that wants a login** (issue #45) is **409 `EGITAUTH`**, not `EGIT`: the dashboard's git has no terminal to prompt in. The error carries diff --git a/docs/LANES.md b/docs/LANES.md index c68fced4..fbc30046 100644 --- a/docs/LANES.md +++ b/docs/LANES.md @@ -524,6 +524,8 @@ curl http://localhost:4820/api/lanes/5/git top of the Changes panel opens this list as a panel: one row per file, its status letter colour-coded, the directory truncated before the filename ever is, and each row's `+N −M` aligned on the right under a total. +- A repo with no commit yet is **not** unavailable: it reports `unborn: true`, + `head: null`, an empty `subject` and the branch its first commit will land on. - An unknown lane id is a `404`. This is **not** folded into `GET /api/lanes` on purpose: it shells out to git @@ -547,7 +549,8 @@ the Changes panel carries the per-repo git **writes** the dashboard offers (`POS | --- | --- | --- | | **Fetch** | `git fetch --all --prune` | the repo has no remote | | **Pull** | `git pull --ff-only` | the branch has diverged (it reports, never merges) | -| **Push** | `git push -u origin HEAD` | the remote rejects it | +| **Push** (labelled **Publish branch** while the branch has no upstream) | `git push -u origin HEAD` | the remote rejects it | +| **Publish…** (only when the repo has NO remote) | `git remote add origin -- `, then `git push -u origin HEAD`; `origin` is removed again if the push fails | the repo has no commit yet, already has a remote, or the URL is not `https://` (no `user:token@`), `ssh://` or `user@host:path` | | **Branch** | `git switch …` | the tree is dirty, or another worktree holds that branch | | **Create** | `git branch ` — never switches | the branch already exists | | **Delete** | `git branch -d ` | it is protected (`main`, `master`, `development`, `develop`), current, held by another worktree, or has unmerged commits | @@ -578,6 +581,21 @@ one hidden in the git bar. There is no **Commit** here: committing is the overview's staged-only box below, the one commit path, and it only ever takes what was staged. +**Publish…** is the one button whose destination the user types, so the server +keeps it narrow: it only gives a remote to a repo that has none (it never +re-points one), always names it `origin`, and accepts only `https://` without +credentials in the URL, `ssh://` and scp-like `git@host:owner/repo.git` — never +a local path, `file://`, `ext::` or `http://`. Credentials come from the +machine's own credential helper, ssh agent or AgentHub's own git login store +(the login form below), exactly as for **Push**. + +A repo with **no commits yet** (a fresh `git init`) still gets the header: its +branch, "no commits yet", and a hint to commit first — the network and branch +buttons are hidden because there is nothing to push, fetch into or branch from. +The commit box below makes the first commit, and **Publish…** appears once it +exists. **Add lane** in Worktree mode refuses such a repo (`400 EEMPTYREPO`, +nothing to fork a worktree from) and offers **Use as a Repo lane** instead. + A failed action prints git's own `stderr` verbatim — `! [rejected] … (non-fast-forward)` says more than any sentence the dashboard could write. @@ -1538,7 +1556,7 @@ Terminate the running session. If the lane has no live run, this is a no-op (no curl -X POST http://localhost:4820/api/lanes/5/stop ``` -### git: fetch / pull / push / stage / unstage / discard / commit / switch / branch-create / branch-delete +### git: fetch / pull / push / stage / unstage / discard / commit / switch / branch-create / branch-delete / publish The git writes the Changes panel and its action row offer. See "Acting on a lane's working copy" above for what each one refuses and why. @@ -1558,6 +1576,11 @@ curl -X POST http://localhost:4820/api/lanes/5/git/commit \ curl -X POST http://localhost:4820/api/lanes/5/git/discard \ -H "Content-Type: application/json" \ -d '{"paths": ["src/scratch.ts"], "confirm": true}' + +# A repo with commits but no remote: add `origin` and push HEAD to it +curl -X POST http://localhost:4820/api/lanes/5/git/publish \ + -H "Content-Type: application/json" \ + -d '{"url": "git@github.com:owner/repo.git"}' ``` ### clear diff --git a/openapi.yaml b/openapi.yaml index 7675d8c5..73ddbbc9 100644 --- a/openapi.yaml +++ b/openapi.yaml @@ -10718,7 +10718,7 @@ paths: type: object additionalProperties: true '400': - description: sourceRepo is relative, missing, or not a git repository. + description: 'EBADSOURCEREPO: sourceRepo is relative, missing, or not a git repository. EEMPTYREPO: it has no commits, so there is nothing to branch a worktree from (no lane row is created).' content: application/json: schema: @@ -10807,7 +10807,7 @@ paths: type: integer responses: '200': - description: available:true with {branch, head, subject, dirty, untracked, files}, or available:false alone. files names the files behind those counts as {path, status, added, deleted} records, capped at 20; the counts themselves are never capped. status is the two-character `git status --porcelain` code and path is the new path for a rename; added/deleted come from one `git diff --numstat HEAD` and are null where git has no delta to report (untracked, binary, renamed, or no commit to diff against). + description: available:true with {branch, head, unborn, subject, dirty, untracked, files, hasRemote, upstream, ahead, behind}, or available:false alone. A repo with no commit yet is available with unborn:true, head:null and subject:"". files names the files behind those counts as {path, status, added, deleted} records, capped at 20; the counts themselves are never capped. status is the two-character `git status --porcelain` code and path is the new path for a rename; added/deleted come from one `git diff --numstat HEAD` and are null where git has no delta to report (untracked, binary, renamed, or no commit to diff against). '404': description: Lane not found. /api/lanes/{id}/runtime: @@ -11188,7 +11188,7 @@ paths: tags: - Lanes summary: One git write on the lane's working copy - description: 'fetch (--all --prune), pull (ALWAYS --ff-only — a diverged branch is reported, never merged), push (-u HEAD, so only the branch the lane is on; remote = the branch''s upstream remote, else the only remote, else origin, else 400 ENOREMOTE), stage/unstage (per file), discard (per file; irreversible, so it REQUIRES confirm:true), stage-hunk / discard-hunk (ONE hunk of a tracked file''s `git diff HEAD`, named by its `@@` line and re-read server-side at the given context — the applied patch is always git''s own text, never one from the request; discard-hunk REQUIRES confirm:true; 400 EUNTRACKED for an untracked file, 409 EHUNKGONE when the hunk is no longer in the diff), commit (git add -A then commit -m , or only:"staged" to take the index as it stands), switch (git switch, -c to create; refuses a dirty tree so an agent''s half-finished work is never carried onto another branch), and branch-create / branch-delete (create never switches; delete is `git branch -d`, refuses main/master/development/develop, the current branch and one held by another worktree). A path in the body must be one `git status` is reporting as changed, so no path outside the lane is reachable. Guarded and serialized per git index (the lane lock keyed on the worktree''s git dir, so two lanes sharing one index cannot collide on index.lock). Deliberately no merge, rebase, reset or stash: reset stays behind the destroy guard on POST /api/lanes/{id}/reset. Network actions are killed after 60s.' + description: 'fetch (--all --prune), pull (ALWAYS --ff-only — a diverged branch is reported, never merged), push (-u HEAD, so only the branch the lane is on; remote = the branch''s upstream remote, else the only remote, else origin, else 400 ENOREMOTE), stage/unstage (per file; staging a conflicted file that still has conflict markers is 400 EMARKERS), discard (per file; irreversible, so it REQUIRES confirm:true), stage-hunk / discard-hunk (ONE hunk of a tracked file''s `git diff HEAD`, named by its `@@` line and re-read server-side at the given context — the applied patch is always git''s own text, never one from the request; discard-hunk REQUIRES confirm:true; 400 EUNTRACKED for an untracked file, 409 EHUNKGONE when the hunk is no longer in the diff), commit (git add -A then commit -m , or only:"staged" to take the index as it stands), switch (git switch, -c to create; refuses a dirty tree so an agent''s half-finished work is never carried onto another branch), branch-create / branch-delete (create never switches; delete is `git branch -d`, refuses main/master/development/develop, the current branch and one held by another worktree), publish (the ONE write whose destination comes from the request: `git remote add origin -- ` then `git push -u origin HEAD`, only in a repo with a commit and NO remote — it never re-points one; the url must be https:// without userinfo, ssh:// or scp-like user@host:path, and origin is removed again if the push fails), and merge / resolve / merge-commit / merge-abort (issue #45: merge a local or remote-tracking branch that exists — clean tree and a repo-root lane only, 400 ESUBDIR otherwise — answering conflicts:[paths] when it stops on conflicts; resolve {path, side: ours|theirs|done} a conflicted path, done refusing leftover markers with 400 EMARKERS; merge-commit is 409 ECONFLICTS while anything is unmerged; merge-abort REQUIRES confirm:true; pull/switch/merge/hunk actions are 409 EMERGING mid-merge). fetch/pull/push/publish needing a login answer 409 EGITAUTH with auth:{protocol,host,username,rejected}; resend with credentials:{protocol,host,username,password,remember} (a repo remote''s host only, else 400 EBADHOST). A path in the body must be one `git status` is reporting as changed, so no path outside the lane is reachable. Guarded and serialized per git index (the lane lock keyed on the worktree''s git dir, so two lanes sharing one index cannot collide on index.lock). Deliberately no rebase, reset or stash: reset stays behind the destroy guard on POST /api/lanes/{id}/reset. Network actions are killed after 60s.' operationId: runLaneGitAction parameters: - name: id @@ -11214,6 +11214,7 @@ paths: - switch - branch-create - branch-delete + - publish requestBody: required: false content: @@ -11221,6 +11222,9 @@ paths: schema: type: object properties: + url: + type: string + description: publish only; https:// (no userinfo), ssh:// or user@host:path, max 1024 chars. message: type: string description: commit only; required, max 4000 chars. @@ -11257,13 +11261,13 @@ paths: description: discard and discard-hunk; the call is refused without it. responses: '200': - description: '{action, ok:true, output} — git''s own stdout+stderr.' + description: '{action, ok:true, output} — git''s own stdout+stderr; publish adds remote:"origin".' '400': - description: EBADACTION, EBADMESSAGE, EBADBRANCH, EBADPATH, ECONFIRM, EPROTECTED, ENOBRANCH, EBRANCHEXISTS, EBRANCHBUSY, EDIRTY, ENOCHANGES, ESTAGEDOUTSIDE or ENOREMOTE. + description: EBADACTION, EBADMESSAGE, EBADBRANCH, EBADPATH, ECONFIRM, EPROTECTED, ENOBRANCH, EBRANCHEXISTS, EBRANCHBUSY, EDIRTY, ENOCHANGES, ESTAGEDOUTSIDE, ENOREMOTE, EUNTRACKED, EBADURL, EREMOTEEXISTS, ENOCOMMITS, EBADHOST, EBADCRED, ESUBDIR, EBADSIDE or EMARKERS. '404': description: Lane not found. '409': - description: EGIT — git ran and refused (a rejected push, a credential failure, a diverged --ff-only pull); its stderr is appended to error.message. + description: EGIT — git ran and refused (a rejected push, a diverged --ff-only pull); its stderr is appended to error.message. EGITAUTH — the remote wants a login (carries auth). EHUNKGONE, EMERGING, ENOMERGE, ECONFLICTS. '500': description: Unexpected server-side failure. /api/lanes/{id}/{action}: diff --git a/server/README.md b/server/README.md index 532cc2ec..b05b0be9 100644 --- a/server/README.md +++ b/server/README.md @@ -524,7 +524,7 @@ Request body shape: | `POST` | `/api/lanes/:id/down` | Same-origin guarded stack teardown: recorded pid trees, then a port backstop only when a pid file existed. | | `POST` | `/api/lanes/:id/hook/:name` | Same-origin guarded profile-hook run; `:name` must be in the fixed hook allowlist and `args` is passed as argv. Returns `202`. | | `GET` | `/api/lanes/:id/logs/:svc` | Tail a hook or service log, `realpath`-confined to the lane's log directory. | -| `GET` | `/api/lanes/:id/git` | Working-copy facts: branch, head, subject, uncommitted counts and files, plus `hasRemote`/`upstream`/`ahead`/`behind` (null counts when the branch has no upstream). `{available:false}` with `200` for a cwd git cannot read. | +| `GET` | `/api/lanes/:id/git` | Working-copy facts: branch, head, subject, uncommitted counts and files, plus `hasRemote`/`upstream`/`ahead`/`behind` (null counts when the branch has no upstream), and `unborn` (`true` with `head: null` in a repo with no commit yet). `{available:false}` with `200` for a cwd git cannot read. | | `GET` | `/api/lanes/:id/git/changes?range=work\|branch\|commit[&sha=][&path=][&full=1][&context=]` | The lane's code changes for the Changes panel: a file summary, one file's hunks (`path`), or every file's hunks (`full=1`); `range=commit&sha=` is one commit, `context=` (default 3, max 5000) widens each hunk. Capped at 300 files / 200 KB per file / 1 MB per full read. `400 ENOBASE`, `ENOFILECHANGE`, `EBADRANGE` or `EBADREV`. | | `GET` | `/api/lanes/:id/git/log?limit=&file=` | The lane's recent commits (newest first, limit max 200), optionally only those touching one path. | | `GET` | `/api/lanes/:id/git/file?path=&rev=` | One file's whole content at `work` (realpath-confined to the lane), `HEAD` or a commit-ish. 1 MB cap. `400 EBADPATH`/`EBADREV`/`ENOFILE`. | @@ -535,7 +535,7 @@ Request body shape: | `GET` | `/api/git-credentials` | AgentHub's own git logins (one per host, shared by every user), `hasToken` only — never a password. | | `POST` | `/api/git-credentials` | Same-origin guarded save/replace: `{protocol, host, username, password}`. `400 EBADHOST`/`EBADCRED`. | | `DELETE` | `/api/git-credentials/:protocol/:host` | Same-origin guarded delete. `404 ENOTFOUND`. | -| `POST` | `/api/lanes/:id/git/:action` | Same-origin guarded git write, serialized under the lane lock: `fetch`, `pull` (always `--ff-only`), `push` (`-u origin HEAD`), `stage`/`unstage`/`discard` (per file; a path must be one git reports changed, and `discard` needs `confirm:true`), `stage-hunk`/`discard-hunk` (one hunk by its `@@` line, re-read fresh — `409 EHUNKGONE` when it moved; `discard-hunk` needs `confirm:true`), `commit` (`add -A` + `-m`, or `only:"staged"`), `switch` (refuses a dirty tree), `branch-create` (never switches) and `branch-delete` (`-d`, refuses protected/current/busy branches). `merge` (clean tree, repo-root lane, a ref that exists; conflicts come back as `conflicts[]`), `resolve` (`side: ours|theirs|done`, conflicted paths only, `done` refuses leftover markers), `merge-commit`, `merge-abort` (`confirm:true`); `EMERGING` blocks pull/switch/merge/hunk actions mid-merge. No rebase/reset/stash by design. A remote wanting a login is `409 EGITAUTH` with `auth: {protocol, host, username, rejected}`; resend with `credentials: {protocol, host, username, password, remember}` (a repo remote's host only, else `400 EBADHOST`; saved only after git succeeds and `remember` is set). | +| `POST` | `/api/lanes/:id/git/:action` | Same-origin guarded git write, serialized under the lane lock: `fetch`, `pull` (always `--ff-only`), `push` (`-u origin HEAD`), `stage`/`unstage`/`discard` (per file; a path must be one git reports changed, and `discard` needs `confirm:true`), `stage-hunk`/`discard-hunk` (one hunk by its `@@` line, re-read fresh — `409 EHUNKGONE` when it moved; `discard-hunk` needs `confirm:true`), `commit` (`add -A` + `-m`, or `only:"staged"`), `switch` (refuses a dirty tree), `branch-create` (never switches) `branch-delete` (`-d`, refuses protected/current/busy branches) and `publish` (`{url}`: `remote add origin` + `push -u origin HEAD`, only when the repo has no remote; URL allowlisted to https-without-userinfo/ssh/scp-like; remote rolled back on a failed push). `merge` (clean tree, repo-root lane, a ref that exists; conflicts come back as `conflicts[]`), `resolve` (`side: ours|theirs|done`, conflicted paths only, `done` refuses leftover markers), `merge-commit`, `merge-abort` (`confirm:true`); `EMERGING` blocks pull/switch/merge/hunk actions mid-merge. No rebase/reset/stash by design. A remote wanting a login is `409 EGITAUTH` with `auth: {protocol, host, username, rejected}`; resend with `credentials: {protocol, host, username, password, remember}` (a repo remote's host only, else `400 EBADHOST`; saved only after git succeeds and `remember` is set). | The route accepts `{ sourceRepo, title, base?, slug? }`. `sourceRepo` must be an existing absolute git repository. The response lane starts as diff --git a/server/__tests__/git-diff-ops.test.js b/server/__tests__/git-diff-ops.test.js index 83d524be..07939c09 100644 --- a/server/__tests__/git-diff-ops.test.js +++ b/server/__tests__/git-diff-ops.test.js @@ -23,7 +23,7 @@ const { parseUnifiedDiff, readFileAt, } = require("../lib/git-diff"); -const { runGitAction } = require("../lib/git-ops"); +const { runGitAction, validateRemoteUrl } = require("../lib/git-ops"); const { gitFacts } = require("../lib/worktree"); const ROOT = fs.mkdtempSync(path.join(os.tmpdir(), "agenthub-gitdiff-")); @@ -660,3 +660,131 @@ describe("runGitAction — one hunk at a time", () => { ); }); }); + +describe("an unborn repo and `publish`", () => { + const EMPTY = path.join(ROOT, "empty"); + const URL_OK = "https://example.test/owner/r.git"; + + /** A `git init`ed repo with no commit and no remote. */ + function unborn() { + fs.rmSync(EMPTY, { recursive: true, force: true }); + g(ROOT, "init", "-q", "-b", "main", EMPTY); + g(EMPTY, "config", "user.email", "t@h"); + g(EMPTY, "config", "user.name", "t"); + } + + function firstCommit() { + write(EMPTY, "x.txt", "x\n"); + gc(EMPTY, "add", "-A"); + gc(EMPTY, "commit", "-qm", "first"); + } + + beforeEach(() => { + freshFixture(); + unborn(); + }); + + it("reports an unborn repo instead of failing to read it", async () => { + write(EMPTY, "x.txt", "x\n"); + const facts = await gitFacts(EMPTY); + assert.equal(facts.unborn, true); + assert.equal(facts.head, null); + assert.equal(facts.branch, "main"); + assert.equal(facts.subject, ""); + assert.equal(facts.untracked, 1); + assert.equal(facts.hasRemote, false); + assert.equal((await gitFacts(LANE)).unborn, false); + }); + + it("makes the first commit of an unborn repo", async () => { + write(EMPTY, "x.txt", "x\n"); + const out = await runGitAction(EMPTY, "commit", { message: "first" }); + assert.equal(out.ok, true); + assert.equal((await gitFacts(EMPTY)).unborn, false); + }); + + it("refuses to publish before the first commit", async () => { + await assert.rejects(() => runGitAction(EMPTY, "publish", { url: URL_OK }), { + code: "ENOCOMMITS", + }); + }); + + it("refuses to publish a repo that already has a remote", async () => { + await assert.rejects(() => runGitAction(LANE, "publish", { url: URL_OK }), { + code: "EREMOTEEXISTS", + }); + assert.equal(g(LANE, "remote", "get-url", "origin").trim(), ORIGIN); + }); + + it("refuses every URL outside https-without-userinfo, ssh:// and scp-like", async () => { + firstCommit(); + for (const url of [ + ORIGIN, // a local path + "/tmp/x", + "../sibling.git", + "file:///tmp/x.git", + "ext::sh -c id", + "ext::sh", + "fd::3", + "git://host/r.git", + "http://host/r.git", + "-oProxyCommand=x", + "--upload-pack=x", + "https://u:p@host/r.git", + "https://token@host/r.git", + "https://host/r .git", + "https://host/r.git\n", + "ssh://-oProxyCommand=x/r.git", + "-git@host:r.git", + "", + 42, + undefined, + ]) { + await assert.rejects( + () => runGitAction(EMPTY, "publish", { url }), + { code: "EBADURL" }, + `accepted ${JSON.stringify(url)}` + ); + } + assert.equal(g(EMPTY, "remote").trim(), ""); + }); + + it("accepts https, ssh:// and scp-like URLs", () => { + for (const url of [ + URL_OK, + "https://host:8443/owner/r", + "ssh://git@host:2222/owner/r.git", + "ssh://host/r.git", + "git@github.com:owner/r.git", + ]) { + assert.equal(validateRemoteUrl(url), url); + } + }); + + it("adds origin and pushes HEAD with an upstream", async () => { + firstCommit(); + const bare = path.join(ROOT, "published.git"); + g(ROOT, "init", "-q", "--bare", bare); + // Repo-local insteadOf maps the https URL onto the bare fixture, so the + // real https branch of the allowlist is exercised without a network. + g(EMPTY, "config", `url.${bare}.insteadOf`, URL_OK); + + const out = await runGitAction(EMPTY, "publish", { url: URL_OK }); + assert.equal(out.ok, true); + assert.equal(out.remote, "origin"); + // `remote add origin -- ` stores the URL itself, not "--". + assert.equal(g(EMPTY, "config", "remote.origin.url").trim(), URL_OK); + assert.equal(g(bare, "rev-parse", "main").trim(), g(EMPTY, "rev-parse", "HEAD").trim()); + const facts = await gitFacts(EMPTY); + assert.equal(facts.upstream, "origin/main"); + assert.equal(facts.ahead, 0); + }); + + it("removes the remote again when the push fails", async () => { + firstCommit(); + g(EMPTY, "config", `url.${path.join(ROOT, "nowhere.git")}.insteadOf`, URL_OK); + + await assert.rejects(() => runGitAction(EMPTY, "publish", { url: URL_OK })); + assert.equal(g(EMPTY, "remote").trim(), ""); + }); +}); diff --git a/server/__tests__/lane-lifecycle.test.js b/server/__tests__/lane-lifecycle.test.js index d36c65ba..4440ef1f 100644 --- a/server/__tests__/lane-lifecycle.test.js +++ b/server/__tests__/lane-lifecycle.test.js @@ -486,14 +486,20 @@ describe("managed worktree provisioning", () => { }); it("marks the lane failed with git's message when provisioning fails", async () => { - const emptyRepo = path.join(ROOT, "empty-repo"); - fs.mkdirSync(emptyRepo, { recursive: true }); - g(emptyRepo, "init", "-b", "main"); + // A branch named `feat` makes `feat/` impossible to create — a git + // failure the route cannot see coming. (An unborn repo used to serve here; + // the route now refuses that one up front with EEMPTYREPO.) + const clashRepo = path.join(ROOT, "clash-repo"); + fs.mkdirSync(clashRepo, { recursive: true }); + g(clashRepo, "init", "-b", "main"); + g(clashRepo, "-c", "user.email=t@h", "-c", "user.name=t", "commit", "--allow-empty", "-m", "i"); + g(clashRepo, "branch", "feat"); const created = await request("POST", "/api/lanes/worktree", { - sourceRepo: emptyRepo, - title: "Unborn Repo", + sourceRepo: clashRepo, + title: "Ref Clash", base: "main", + branch: "feat/clash", }); assert.equal(created.status, 202); diff --git a/server/__tests__/lanes-api.test.js b/server/__tests__/lanes-api.test.js index a75ab846..33499f54 100644 --- a/server/__tests__/lanes-api.test.js +++ b/server/__tests__/lanes-api.test.js @@ -1554,6 +1554,11 @@ describe("/api/lanes tool tests", () => { const fs = require("fs"); fs.mkdirSync(sourceRepo, { recursive: true }); require("child_process").execSync("git init", { cwd: sourceRepo }); + // A worktree needs a commit to branch from (an unborn repo is EEMPTYREPO). + require("child_process").execSync( + "git -c user.email=t@h -c user.name=t commit -q --allow-empty -m init", + { cwd: sourceRepo } + ); const res = await request("POST", "/api/lanes/worktree", { sourceRepo, @@ -1574,6 +1579,24 @@ describe("/api/lanes tool tests", () => { } }); + it("POST /api/lanes/worktree refuses a repo with no commits, creating no row", async () => { + const sourceRepo = require("path").join( + require("os").tmpdir(), + `agenthub-worktree-empty-${Date.now()}` + ); + const fs = require("fs"); + fs.mkdirSync(sourceRepo, { recursive: true }); + require("child_process").execSync("git init -q", { cwd: sourceRepo }); + const before = (await request("GET", "/api/lanes")).body.lanes.length; + + const res = await request("POST", "/api/lanes/worktree", { sourceRepo, slug: "empty" }); + + assert.equal(res.status, 400); + assert.equal(res.body.error.code, "EEMPTYREPO"); + assert.equal((await request("GET", "/api/lanes")).body.lanes.length, before); + fs.rmSync(sourceRepo, { recursive: true, force: true }); + }); + it("POST /api/lanes/worktree defaults to 'claude' tool when tool is not specified", async () => { const sourceRepo = require("path").join( require("os").tmpdir(), @@ -1582,6 +1605,11 @@ describe("/api/lanes tool tests", () => { const fs = require("fs"); fs.mkdirSync(sourceRepo, { recursive: true }); require("child_process").execSync("git init", { cwd: sourceRepo }); + // A worktree needs a commit to branch from (an unborn repo is EEMPTYREPO). + require("child_process").execSync( + "git -c user.email=t@h -c user.name=t commit -q --allow-empty -m init", + { cwd: sourceRepo } + ); const res = await request("POST", "/api/lanes/worktree", { sourceRepo, diff --git a/server/__tests__/lanes-cli.test.js b/server/__tests__/lanes-cli.test.js index a52efbd9..7b6b2854 100644 --- a/server/__tests__/lanes-cli.test.js +++ b/server/__tests__/lanes-cli.test.js @@ -458,9 +458,17 @@ describe("agenthub lanes add", () => { }); it("reports the failure notes, not success, when provisioning fails", async () => { - const emptyRepo = fs.mkdtempSync(path.join(os.tmpdir(), "agenthub-cli-unborn-repo-")); + // A branch named `feat` makes the default `feat/` impossible to + // create, so provisioning fails inside git (an unborn repo is now refused + // up front with EEMPTYREPO and never reaches provisioning). + const emptyRepo = fs.mkdtempSync(path.join(os.tmpdir(), "agenthub-cli-clash-repo-")); try { await git(["init", "-b", "main"], emptyRepo); + await git( + ["-c", "user.email=t@h", "-c", "user.name=t", "commit", "--allow-empty", "-m", "i"], + emptyRepo + ); + await git(["branch", "feat"], emptyRepo); const r = await cli( ["lanes", "add", "--repo", emptyRepo, "--title", "CLI Unborn"], emptyRepo diff --git a/server/lib/git-ops.js b/server/lib/git-ops.js index b4d411ac..cac74e17 100644 --- a/server/lib/git-ops.js +++ b/server/lib/git-ops.js @@ -1,13 +1,14 @@ /** * @file The git WRITES the dashboard offers on a lane: fetch, pull, push, * stage/unstage a file, commit, discard a file, switch branch, create or - * delete a branch, and merge a branch with its conflict resolution (issue - * #45: merge, resolve ours/theirs/hand-edited, merge-commit, merge-abort). - * There is no rebase, no reset and no stash, because a dashboard button is - * the wrong place to start an operation whose recovery needs a terminal - * (`reset` stays where it was: behind the three-check destroy guard in - * worktree.js). A merge is the exception because its recovery is ONE button - * here too — `merge-abort` puts the branch back where it was. + * delete a branch, publish a repo that has no remote yet, and merge a branch + * with its conflict resolution (issue #45: merge, resolve ours/theirs/ + * hand-edited, merge-commit, merge-abort). There is no rebase, no reset and + * no stash, because a dashboard button is the wrong place to start an + * operation whose recovery needs a terminal (`reset` stays where it was: + * behind the three-check destroy guard in worktree.js). A merge is the + * exception because its recovery is ONE button here too — `merge-abort` puts + * the branch back where it was. * * Four rules hold for every action: * - argv only, via worktree.js's `git()` — never a shell string. @@ -28,6 +29,11 @@ * of, so each demands an explicit `confirm: true` in the body. Do not add * another destructive action without the same gate. * + * `publish` is the ONE action whose destination comes from the request (a + * remote URL), so it is gated differently: only when `git remote` prints + * nothing, always named `origin`, the URL allowlisted by `validateRemoteUrl`, + * and the remote removed again if the push fails. + * * Network actions carry a timeout: a lane pointed at an unreachable remote * should fail in half a minute, not hold an HTTP request open. * @author Nguyễn Ngọc Trí Vĩ @@ -66,6 +72,7 @@ const ACTIONS = new Set([ "discard-hunk", "branch-create", "branch-delete", + "publish", "merge", "resolve", "merge-commit", @@ -78,6 +85,12 @@ const BLOCKED_WHILE_MERGING = new Set(["pull", "switch", "merge", "stage-hunk", /** A line git writes to open or close a conflict block. */ const MARKER_RE = /^(<{7} |>{7} |={7}$)/m; +/** A remote URL is at most this long — a forge URL, not a payload. */ +const MAX_URL_LEN = 1024; +/** `user@host:path`, git's scp-like ssh form. Nothing may start with `-`. */ +const SCP_LIKE = + /^[A-Za-z0-9._][A-Za-z0-9._-]*@[A-Za-z0-9][A-Za-z0-9.-]*:[A-Za-z0-9._~/][A-Za-z0-9._~/-]*$/; + /** Branches this module refuses to delete, whatever the request says. */ const PROTECTED = new Set(["main", "master", "development", "develop"]); @@ -87,6 +100,36 @@ function bad(code, message) { return err; } +/** + * The destination `publish` may push to, or an EBADURL throw. + * + * An allowlist, because this is the one write whose destination comes from + * the request: `https://` with NO userinfo (a token typed into the URL would + * land in .git/config in plain text), `ssh://`, and scp-like `user@host:path`. + * Everything else is refused — a local path or `file://` (a push into some + * other directory on this machine), `ext::` (git runs it as a command), + * `fd::`, `git://` and `http://` (unauthenticated / cleartext), and anything + * starting with `-` that could be read as an option. + */ +function validateRemoteUrl(url) { + const refuse = () => bad("EBADURL", "url must be https://, ssh:// or user@host:path"); + if (typeof url !== "string" || !url || url.length > MAX_URL_LEN) throw refuse(); + // eslint-disable-next-line no-control-regex + if (/[\s\x00-\x1f\x7f]/.test(url) || url.startsWith("-")) throw refuse(); + if (SCP_LIKE.test(url)) return url; + let parsed; + try { + parsed = new URL(url); + } catch { + throw refuse(); + } + const { protocol, username, password, hostname } = parsed; + if (!hostname || hostname.startsWith("-") || password) throw refuse(); + if (protocol === "https:" && !username) return url; + if (protocol === "ssh:" && !username.startsWith("-")) return url; + throw refuse(); +} + /** Whether the working tree has anything uncommitted (tracked or not). */ async function isDirty(dir) { const { dirty, untracked } = await statusCounts(dir); @@ -253,6 +296,28 @@ async function runGitAction(dir, action, body = {}) { return done(action, await networkGit(dir, ["push", "-u", remote, "HEAD"], body)); } + if (action === "publish") { + // Gives a remote to a repo that has NONE, then does what `push` does. It + // never re-points an existing remote, so it cannot redirect a repo that + // already publishes somewhere, and the remote name is fixed like `push`'s. + if (!(await hasHead(dir))) throw bad("ENOCOMMITS", "make the first commit before publishing"); + if ((await git(dir, ["remote"])).stdout.trim()) { + throw bad("EREMOTEEXISTS", "this repo already has a remote"); + } + const url = validateRemoteUrl(body.url); + await git(dir, ["remote", "add", "origin", "--", url]); + let result; + try { + result = await networkGit(dir, ["push", "-u", "origin", "HEAD"], body); + } catch (err) { + // A remote left behind by a failed push (a typo, a missing credential) + // would trip EREMOTEEXISTS forever and need a terminal to undo. + await git(dir, ["remote", "remove", "origin"]).catch(() => {}); + throw err; + } + return { ...done(action, result), remote: "origin" }; + } + if (action === "stage") { const paths = await resolvePaths(dir, body); // Staging a conflicted file marks it resolved: not while git's markers @@ -551,4 +616,4 @@ function done(action, result, branch) { return { action, ok: true, output, ...(branch ? { branch } : {}) }; } -module.exports = { runGitAction, ACTIONS, PROTECTED, NETWORK_TIMEOUT_MS }; +module.exports = { runGitAction, validateRemoteUrl, ACTIONS, PROTECTED, NETWORK_TIMEOUT_MS }; diff --git a/server/lib/worktree.js b/server/lib/worktree.js index b777d965..e18a3dcc 100644 --- a/server/lib/worktree.js +++ b/server/lib/worktree.js @@ -641,9 +641,14 @@ async function statusCounts(dir) { } } - // Get short commit hash - const headResult = await git(dir, ["rev-parse", "--short", "HEAD"]); - const head = headResult.stdout.trim(); + // Short commit hash — null in a repo with no commit yet (an unborn HEAD), + // which is a normal state for a fresh `git init`, not an unreadable repo. + let head = null; + try { + head = (await git(dir, ["rev-parse", "--short", "HEAD"])).stdout.trim() || null; + } catch { + /* unborn */ + } return { dirty, untracked, head, files }; } @@ -690,7 +695,8 @@ async function laneFiles(dir) { /** * What a lane's working copy looks like right now: which branch it is on, the - * short HEAD, that commit's subject, and how much is uncommitted. + * short HEAD, that commit's subject, and how much is uncommitted. A repo with + * no commit yet reports `unborn: true`, `head: null` and an empty subject. * * Read-only and cheap, but it is five subprocesses, which is why it lives * behind its own endpoint rather than inside the polled `GET /api/lanes` @@ -700,11 +706,16 @@ async function laneFiles(dir) { async function gitFacts(dir) { const { head } = await statusCounts(dir); const { dirty, untracked, files } = await laneFiles(dir); - const branch = (await git(dir, ["rev-parse", "--abbrev-ref", "HEAD"])).stdout.trim(); - const subject = (await git(dir, ["log", "-1", "--format=%s"])).stdout.trim(); + // An unborn HEAD has no commit to abbreviate or log, but it does name the + // branch the first commit will land on — symbolic-ref reads that. + const branch = head + ? (await git(dir, ["rev-parse", "--abbrev-ref", "HEAD"])).stdout.trim() + : (await git(dir, ["symbolic-ref", "--short", "HEAD"])).stdout.trim(); + const subject = head ? (await git(dir, ["log", "-1", "--format=%s"])).stdout.trim() : ""; return { branch, head, + unborn: !head, subject, dirty, untracked, diff --git a/server/openapi-extra/lanes.js b/server/openapi-extra/lanes.js index 223b76a1..ae7cd2d8 100644 --- a/server/openapi-extra/lanes.js +++ b/server/openapi-extra/lanes.js @@ -199,7 +199,8 @@ const paths = { }, }, 400: { - description: "sourceRepo is relative, missing, or not a git repository.", + description: + "EBADSOURCEREPO: sourceRepo is relative, missing, or not a git repository. EEMPTYREPO: it has no commits, so there is nothing to branch a worktree from (no lane row is created).", content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } }, }, @@ -279,7 +280,7 @@ const paths = { responses: { 200: { description: - "available:true with {branch, head, subject, dirty, untracked, files}, or available:false alone. files names the files behind those counts as {path, status, added, deleted} records, capped at 20; the counts themselves are never capped. status is the two-character `git status --porcelain` code and path is the new path for a rename; added/deleted come from one `git diff --numstat HEAD` and are null where git has no delta to report (untracked, binary, renamed, or no commit to diff against).", + 'available:true with {branch, head, unborn, subject, dirty, untracked, files, hasRemote, upstream, ahead, behind}, or available:false alone. A repo with no commit yet is available with unborn:true, head:null and subject:"". files names the files behind those counts as {path, status, added, deleted} records, capped at 20; the counts themselves are never capped. status is the two-character `git status --porcelain` code and path is the new path for a rename; added/deleted come from one `git diff --numstat HEAD` and are null where git has no delta to report (untracked, binary, renamed, or no commit to diff against).', }, 404: { description: "Lane not found." }, }, @@ -618,7 +619,7 @@ const paths = { tags: ["Lanes"], summary: "One git write on the lane's working copy", description: - "fetch (--all --prune), pull (ALWAYS --ff-only — a diverged branch is reported, never merged), push (-u HEAD, so only the branch the lane is on; remote = the branch's upstream remote, else the only remote, else origin, else 400 ENOREMOTE), stage/unstage (per file), discard (per file; irreversible, so it REQUIRES confirm:true), stage-hunk / discard-hunk (ONE hunk of a tracked file's `git diff HEAD`, named by its `@@` line and re-read server-side at the given context — the applied patch is always git's own text, never one from the request; discard-hunk REQUIRES confirm:true; 400 EUNTRACKED for an untracked file, 409 EHUNKGONE when the hunk is no longer in the diff), commit (git add -A then commit -m , or only:\"staged\" to take the index as it stands), switch (git switch, -c to create; refuses a dirty tree so an agent's half-finished work is never carried onto another branch), and branch-create / branch-delete (create never switches; delete is `git branch -d`, refuses main/master/development/develop, the current branch and one held by another worktree). A path in the body must be one `git status` is reporting as changed, so no path outside the lane is reachable. Guarded and serialized per git index (the lane lock keyed on the worktree's git dir, so two lanes sharing one index cannot collide on index.lock). Deliberately no merge, rebase, reset or stash: reset stays behind the destroy guard on POST /api/lanes/{id}/reset. Network actions are killed after 60s.", + "fetch (--all --prune), pull (ALWAYS --ff-only — a diverged branch is reported, never merged), push (-u HEAD, so only the branch the lane is on; remote = the branch's upstream remote, else the only remote, else origin, else 400 ENOREMOTE), stage/unstage (per file; staging a conflicted file that still has conflict markers is 400 EMARKERS), discard (per file; irreversible, so it REQUIRES confirm:true), stage-hunk / discard-hunk (ONE hunk of a tracked file's `git diff HEAD`, named by its `@@` line and re-read server-side at the given context — the applied patch is always git's own text, never one from the request; discard-hunk REQUIRES confirm:true; 400 EUNTRACKED for an untracked file, 409 EHUNKGONE when the hunk is no longer in the diff), commit (git add -A then commit -m , or only:\"staged\" to take the index as it stands), switch (git switch, -c to create; refuses a dirty tree so an agent's half-finished work is never carried onto another branch), branch-create / branch-delete (create never switches; delete is `git branch -d`, refuses main/master/development/develop, the current branch and one held by another worktree), publish (the ONE write whose destination comes from the request: `git remote add origin -- ` then `git push -u origin HEAD`, only in a repo with a commit and NO remote — it never re-points one; the url must be https:// without userinfo, ssh:// or scp-like user@host:path, and origin is removed again if the push fails), and merge / resolve / merge-commit / merge-abort (issue #45: merge a local or remote-tracking branch that exists — clean tree and a repo-root lane only, 400 ESUBDIR otherwise — answering conflicts:[paths] when it stops on conflicts; resolve {path, side: ours|theirs|done} a conflicted path, done refusing leftover markers with 400 EMARKERS; merge-commit is 409 ECONFLICTS while anything is unmerged; merge-abort REQUIRES confirm:true; pull/switch/merge/hunk actions are 409 EMERGING mid-merge). fetch/pull/push/publish needing a login answer 409 EGITAUTH with auth:{protocol,host,username,rejected}; resend with credentials:{protocol,host,username,password,remember} (a repo remote's host only, else 400 EBADHOST). A path in the body must be one `git status` is reporting as changed, so no path outside the lane is reachable. Guarded and serialized per git index (the lane lock keyed on the worktree's git dir, so two lanes sharing one index cannot collide on index.lock). Deliberately no rebase, reset or stash: reset stays behind the destroy guard on POST /api/lanes/{id}/reset. Network actions are killed after 60s.", operationId: "runLaneGitAction", parameters: [ { name: "id", in: "path", required: true, schema: { type: "integer" } }, @@ -641,6 +642,7 @@ const paths = { "switch", "branch-create", "branch-delete", + "publish", ], }, }, @@ -652,6 +654,11 @@ const paths = { schema: { type: "object", properties: { + url: { + type: "string", + description: + "publish only; https:// (no userinfo), ssh:// or user@host:path, max 1024 chars.", + }, message: { type: "string", description: "commit only; required, max 4000 chars." }, only: { type: "string", @@ -693,15 +700,18 @@ const paths = { }, }, responses: { - 200: { description: "{action, ok:true, output} — git's own stdout+stderr." }, + 200: { + description: + '{action, ok:true, output} — git\'s own stdout+stderr; publish adds remote:"origin".', + }, 400: { description: - "EBADACTION, EBADMESSAGE, EBADBRANCH, EBADPATH, ECONFIRM, EPROTECTED, ENOBRANCH, EBRANCHEXISTS, EBRANCHBUSY, EDIRTY, ENOCHANGES, ESTAGEDOUTSIDE or ENOREMOTE.", + "EBADACTION, EBADMESSAGE, EBADBRANCH, EBADPATH, ECONFIRM, EPROTECTED, ENOBRANCH, EBRANCHEXISTS, EBRANCHBUSY, EDIRTY, ENOCHANGES, ESTAGEDOUTSIDE, ENOREMOTE, EUNTRACKED, EBADURL, EREMOTEEXISTS, ENOCOMMITS, EBADHOST, EBADCRED, ESUBDIR, EBADSIDE or EMARKERS.", }, 404: { description: "Lane not found." }, 409: { description: - "EGIT — git ran and refused (a rejected push, a credential failure, a diverged --ff-only pull); its stderr is appended to error.message.", + "EGIT — git ran and refused (a rejected push, a diverged --ff-only pull); its stderr is appended to error.message. EGITAUTH — the remote wants a login (carries auth). EHUNKGONE, EMERGING, ENOMERGE, ECONFLICTS.", }, 500: { description: "Unexpected server-side failure." }, }, diff --git a/server/routes/lanes.js b/server/routes/lanes.js index e31a4f64..97f4c495 100644 --- a/server/routes/lanes.js +++ b/server/routes/lanes.js @@ -978,6 +978,9 @@ router.post("/:id/git/:action", sameOriginGuard, async (req, res) => { "ESUBDIR", "EBADSIDE", "EMARKERS", + "EBADURL", + "EREMOTEEXISTS", + "ENOCOMMITS", ]; // A numeric code is git's own exit status (execFile reports one that way): // git ran and refused — a rejected push, a failed credential, a diverged @@ -1054,6 +1057,24 @@ router.post("/worktree", sameOriginGuard, async (req, res) => { }); } + // A repo with no commit has nothing a worktree could branch from: git would + // fail later, in the background job, and leave a `failed` row behind. Refuse + // it here instead — that repo is a Repo lane until its first commit. + if (!(await listBranches(sourceRepo)).branches.length) { + const unborn = await git(sourceRepo, ["rev-parse", "--verify", "HEAD"]).then( + () => false, + () => true + ); + if (unborn) { + return res.status(400).json({ + error: { + code: "EEMPTYREPO", + message: "sourceRepo has no commits yet — add it as a Repo lane and commit first", + }, + }); + } + } + let slug; try { slug = slugify(body.slug || body.title);