AgentHub/server/lib/git-exclude.js

/**
 * @file Keeps files AgentHub writes into a lane's directory out of git, through
 * the one `info/exclude` git actually reads for that lane. That is the COMMON
 * git dir's, not the lane's own: a linked worktree — every managed lane — has a
 * private `.git/worktrees/<name>/`, and git never reads an exclude file there.
 * A lane that is a subdirectory of its repo has no `.git` of its own at all.
 *
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

const fs = require("node:fs");
const path = require("node:path");

// Hook variables that would point git at ANOTHER repo (the one whose hook, or
// shell, started us) — the same set `worktree.js`'s git() scrubs. With
// GIT_DIR set, `rev-parse` would name that repo and the entry land there.
const REPO_VARS = [
  "GIT_DIR",
  "GIT_WORK_TREE",
  "GIT_INDEX_FILE",
  "GIT_COMMON_DIR",
  "GIT_OBJECT_DIRECTORY",
  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
  "GIT_PREFIX",
  "GIT_NAMESPACE",
];

/**
 * Idempotently exclude `relPaths` (relative to `laneDir`), each anchored to the
 * lane's own path so the entry hides nothing outside it. Best effort: a lane
 * that is not a repo, or a git dir that cannot be written, is left alone —
 * never a reason to fail the write that needed the exclude.
 *
 * @param {string} laneDir
 * @param {string[]} relPaths e.g. [".mcp.json", ".claude/.cc-config-backups/"]
 */
function excludeFromGit(laneDir, relPaths) {
  const runAs = require("./run-as");
  try {
    const env = { ...process.env };
    for (const name of REPO_VARS) delete env[name];
    // As the folder's member under S3 (git refuses another uid's repository).
    const [commonDir, prefix = ""] = String(
      runAs.execIn(laneDir, "git", ["rev-parse", "--git-common-dir", "--show-prefix"], {
        env,
        encoding: "utf8",
        stdio: ["ignore", "pipe", "ignore"],
      })
    ).split("\n");
    // Under S3 the member's git printed this path (a `.git` file or a
    // `commondir` can name any directory): it must resolve inside the lane
    // owner's own files, or the dashboard would read and write wherever the
    // member pointed it — as the host, outside the users root.
    const common = fs.realpathSync(path.resolve(laneDir, commonDir));
    if (!runAs.sameOwner(path.resolve(laneDir), common)) return;
    const lines = relPaths.map((rel) => `/${prefix}${rel}`);
    const excludePath = path.join(common, "info", "exclude");
    // readFileSafe: a member's FIFO or link to another account's file is refused.
    let existing = fs.existsSync(excludePath) ? runAs.readFileSafe(excludePath, "utf8") : "";
    const present = new Set(existing.split("\n"));
    const missing = lines.filter((line) => !present.has(line));
    if (missing.length === 0) return;
    if (existing && !existing.endsWith("\n")) existing += "\n";
    // `info/` exists in every repo git made; under S3 only its member may write it.
    if (!runAs.accountForPath(excludePath)) {
      fs.mkdirSync(path.dirname(excludePath), { recursive: true });
    }
    runAs.writeFileAs(excludePath, `${existing}${missing.join("\n")}\n`);
  } catch {
    /* not a repo, or unwritable — see above */
  }
}

/**
 * The same, anchored at the REPOSITORY root rather than `dir` — for paths a
 * tool creates at the root whatever subdirectory it was started in (Claude
 * Code's `.claude/worktrees/`). Best effort, like `excludeFromGit`. The root
 * the (member's) git names must be the same account's as `dir`.
 */
function excludeFromRepoRoot(dir, relPaths) {
  const runAs = require("./run-as");
  try {
    const env = { ...process.env };
    for (const name of REPO_VARS) delete env[name];
    const root = String(
      runAs.execIn(dir, "git", ["rev-parse", "--show-toplevel"], {
        env,
        encoding: "utf8",
        stdio: ["ignore", "pipe", "ignore"],
      })
    ).trim();
    if (!root) return;
    const real = fs.realpathSync(root);
    if (runAs.sameOwner(path.resolve(dir), real)) excludeFromGit(real, relPaths);
  } catch {
    /* not a repo */
  }
}

module.exports = { excludeFromGit, excludeFromRepoRoot };