d83c1dd982
* feat(diff): use stored base_branch for diff stats + per-task compare picker
Task-card additions/deletions and the Changes panel were computed against a
hardcoded origin/main → master priority list inside agentctl. For tasks
branched off a release/staging branch this inflated the counts by every
commit since the actual fork point, and the Changes panel grouped unrelated
files alongside the task's real work.
This wires the per-repo task_repositories.base_branch end-to-end into the
agentctl WorkspaceTracker so each repo's diff stats resolve against the
recorded base instead of the integration-branch fallback. A picker on the
Changes panel branch hover card lets the user change the base mid-task; the
new value is persisted via PATCH /tasks/:id/repositories/:repo_id, pushed
live to the running agentctl instance, and the session's cached
base_commit_sha is cleared so the commits panel + cumulative diff refetch
against the new base without a session restart.
Falls back to the existing origin/main → master list for legacy tasks
(empty base_branch) and to the branch tip when no merge-base exists with
HEAD (unrelated histories — local rebase backups, etc.) so the stats and
commits panels stay anchored on the same SHA in every failure mode.
* fix(agentctl): sanitize user-controlled base_branch refs before git exec
CodeQL flagged the picker's user-controlled base_branch payload reaching
exec.Command("git", ..., baseBranch) inside workspace_git_cmd.go as a
command-built-from-user-controlled-source vulnerability. A malicious caller
could smuggle a leading-"-" argument like "-upload-pack=..." that git
itself reinterprets as a flag, even though exec.Command keeps args
separate from the shell.
Adds an IsSafeGitRef sanitizer at every boundary the value crosses on its
way to git: the service write path, the agentctl HTTP handlers
(/workspace/base-branches, /git/log, /git/cumulative-diff), and
WorkspaceTracker.SetBaseBranch itself. Unsafe values are rejected at the
service tier and silently downgraded to the no-override fallback inside
agentctl so a misbehaving caller can't half-break the tracker.
* fix(diff): address PR review blockers and CI lint
- Split UpdateRepositoryBaseBranch into validate/load/apply helpers to drop
cyclomatic complexity below the cyclop limit that gated Run Backend Tests.
- Replace direct m.cfg.BaseBranches reads/writes with getBaseBranches /
setBaseBranches under a dedicated RWMutex. UpdateBaseBranches used to
write under repoTrackersMu while rescan + lazy-subpath callers read under
workspaceTrackersMu, leaving an unsynchronized data race on the map.
- Drop the false 'PR target is auto-wired' claim from the MCP tool
description — GitOperator.CreatePR takes baseBranch as an explicit arg
and never reads the tracker's value.
- Picker no-op guard now compares against currentBase instead of storedBase
so selecting the displayed fallback (legacy task before any picker
change) is treated as no-op instead of triggering a spurious save.
- HTTP handler now maps non-validation service errors to 500 instead of
400, classifying via the existing isValidationError helper plus the new
unsafe-git-ref message.
* fix(diff): regex-based ref sanitiser at every git subprocess sink
CodeQL kept flagging workspace_git_cmd.go:43 even after SetBaseBranch
rejected unsafe values — the taint tracker doesn't follow sanitised stores
through struct fields, so it still saw user input flowing into
exec.Command("git", ..., baseBranch).
Switches IsSafeGitRef to a single regex check (a pattern CodeQL recognises
as a sanitiser barrier) and adds SanitizeGitRef calls inline at every
agentctl call site that splices a user-controlled ref into a git arg:
- workspace_git_status.resolveStoredRef (before the rev-parse probes)
- workspace_git_status.computeBaseCommit (before merge-base/rev-parse)
- workspace_git_status.getAheadBehindCounts (before rev-list)
- agentctl/server/api/git.go runGitLogForRepo + handleGitCumulativeDiff
(before computeMergeBase/GetRevParse on the HTTP TargetBranch)
Behaviour is unchanged for valid refs — only narrows the allowlist (now
[A-Za-z0-9_./-]) so the sanitiser barrier is recognisable to static
analysis. SetBaseBranch's field-store sanitiser stays as defence in depth.
* fix(diff): transform sanitiser at every map read for CodeQL taint flow
CodeQL still flagged workspace_git_cmd.go:43 because:
- handleSetBaseBranches used an IsSafeGitRef bool guard before a verbatim
map[k] = v copy. CodeQL recognises regex-transforming sanitisers but not
bool-guarded passthroughs.
- lookupBaseBranch returned m.cfg.BaseBranches[k] verbatim. Even though
the map was sanitised on write, taint flow across map stores + field
stores loses the sanitised state in the analyser.
Switches both sites to the transforming SanitizeGitRef helper so every
read produces a freshly-sanitised value before it flows to a downstream
git argument. Behaviour is unchanged for valid refs.
* fix(diff): regex transformer sanitiser + guard live push from empty map
CodeQL still flagged the previous SanitizeGitRef because it returned the
input string unchanged on success — an identity passthrough that the taint
tracker doesn't recognise as a sanitiser barrier.
Switches to safeGitRefPattern.FindString so the output comes from the
regex match (not the parameter). IsSafeGitRef now wraps SanitizeGitRef so
the predicate and the transformer share one allowlist.
Also addresses two Claude review blockers:
- collectTaskBaseBranches returns a nil/empty map when the task has no
recorded base_branches; pushing that to agentctl wipes every tracker's
override. Now skipped — the DB row is the source of truth for the next
session launch.
- applyBaseBranchSideEffects now runs on context.WithoutCancel so an HTTP
/ WS request cancel after the task_repositories UPDATE commits can't
leave session.base_commit_sha stale + the live agentctl tracker map
un-pushed, drifting from the persisted row.
* fix(diff): share securityutil.IsValidBranchName + harden error classification
CodeQL still flagged the picker's regex sanitiser as taint passthrough.
Refactors SanitizeGitRef / isSafeBaseBranchRef to delegate to the existing
securityutil.IsValidBranchName helper that agentctl's Rebase / Merge /
RenameBranch already use without being flagged. The shared allowlist also
fixes a Claude review blocker: 'feature/@2024' used to pass the service
validator but get dropped by the agentctl-side check at push time,
silently wiping every tracker's override.
Plus the two error-classification blockers Claude raised on the previous
HEAD:
- WS handler (task_ws_handlers.go wsUpdateTaskRepository) now distinguishes
validation errors (surfaced verbatim) from internal faults (opaque
500-style message). HTTP path already did this via the existing
isValidationError helper.
- MCP handler (handlers.handleUpdateRepositoryBaseBranch) gets the same
treatment via a new isValidationError local to the mcp/handlers
package so raw service error strings stop leaking across the MCP
boundary.
* fix(diff): inline securityutil.IsValidBranchName at every git subprocess sink
CodeQL's interprocedural taint tracking wasn't recognising SanitizeGitRef
as a sanitiser even after it delegated to securityutil.IsValidBranchName
— the wrapper helper + map/field hops between source and sink kept the
flow tainted in the analyser.
Inlines the IsValidBranchName allowlist check (already used inline by
Rebase/Merge in git.go without being flagged) at every call site that
splices a user-controlled ref into a git subprocess argument:
- workspace_git_status.resolveStoredRef (before rev-parse --verify)
- workspace_git_status.computeBaseCommit (before merge-base / rev-parse)
- workspace_git_status.getAheadBehindCounts (before rev-list)
- agentctl/server/api/git.go runGitLogForRepo + handleGitCumulativeDiff
- agentctl/server/api/workspace_base_branches.go handleSetBaseBranches
Behaviour unchanged: same allowlist as Rebase / Merge / RenameBranch
already use. SanitizeGitRef / IsSafeGitRef survive as defence-in-depth
helpers for callers that want a one-line check; they delegate to the same
securityutil helper so the rules stay aligned.
* fix(diff): inline regexp.MatchString at every git subprocess sink
CodeQL still flagged workspace_git_cmd.go:43 even with the inline
securityutil.IsValidBranchName helper — the taint tracker apparently does
not follow into helper functions for the go/command-injection rule on
this path.
Hoists the regex to package-scope vars (safeBranchRefPattern in both
process and api packages) and calls regexp.MatchString directly at each
sink site. Behaviour is identical to securityutil.IsValidBranchName; only
the call form changes.
* fix(diff): SHA-shape allowlist on BaseCommit before downstream git diff
CodeQL still flagged workspace_git_cmd.go:43 because update.BaseCommit
is the OUTPUT of an earlier merge-base / rev-parse call whose argument
list contained a user-controlled branch ref — the analyser treats that
command's output as still tainted even when the input ref was sanitised.
Adds an inline 40-hex SHA-shape allowlist check in enrichWithBranchDiff
right before `git diff --numstat <update.BaseCommit>` so the sanitiser
barrier sits in the same function as the next subprocess call. Behaviour
is unchanged: merge-base / rev-parse already produce SHA-shaped output.
* fix(diff): async tracker refresh + tighten init spread order
Two CodeRabbit/Claude review fixes:
- UpdateBaseBranches stamps each tracker's new baseBranch synchronously
then runs RefreshGitStatus on a background goroutine instead of inside
the picker-save HTTP handler. Per-tracker git subprocesses can each
take ~3-5 calls; serialising them on the request goroutine made the
PATCH response wait for every refresh to finish. The picker UI re-fetches
via the existing WS stream once Refresh emits, so the handler doesn't
need to block.
- updateTaskRepositoryBaseBranch now spreads options.init BEFORE the
required method/body fields so an upstream caller's init overrides
can't replace the PATCH method or the base_branch payload. Matches
the convention deleteTask / moveTask already follow.
* fix(diff): narrow mcp isValidationError + opaque 500 + post-sanitize log count
Three final Claude review threads on the latest commit:
- mcp/handlers isValidationError drops the broad 'invalid' substring so
DB / IO errors whose messages happen to contain 'invalid' don't
misclassify as ErrorCodeValidation.
- task_http_handlers httpUpdateTaskRepository now logs the raw service
error server-side and returns an opaque 'failed to update task
repository' on the 500 path. Stops potential DB / IO detail leakage
through the HTTP boundary.
- workspace_base_branches debug log reports accepted + rejected counts
(post-sanitisation) instead of the pre-filter total so the metric
actually reflects what hit UpdateBaseBranches.
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
445 lines
15 KiB
Go
445 lines
15 KiB
Go
package process
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"strings"
|
|
)
|
|
|
|
// GitLogResult represents the result of a git log operation.
|
|
type GitLogResult struct {
|
|
Success bool `json:"success"`
|
|
Commits []*GitCommitInfo `json:"commits"`
|
|
Error string `json:"error,omitempty"`
|
|
// PerRepoErrors lists per-repo failures during a multi-repo log fan-out.
|
|
// Empty/nil for single-repo responses or when every repo succeeded. The
|
|
// merged response keeps Success=true as long as at least one repo
|
|
// succeeded; callers inspect this slice to surface partial failures.
|
|
PerRepoErrors []GitLogRepoError `json:"per_repo_errors,omitempty"`
|
|
}
|
|
|
|
// GitLogRepoError describes a single per-repo failure from a multi-repo log
|
|
// fan-out. It is omitted from the response entirely for single-repo responses.
|
|
type GitLogRepoError struct {
|
|
RepositoryName string `json:"repository_name"`
|
|
Error string `json:"error"`
|
|
}
|
|
|
|
// GitCommitInfo represents a single commit in the log.
|
|
// Field names match GitCommitData and SessionCommit for frontend consistency.
|
|
type GitCommitInfo struct {
|
|
CommitSHA string `json:"commit_sha"`
|
|
ParentSHA string `json:"parent_sha"`
|
|
CommitMessage string `json:"commit_message"`
|
|
AuthorName string `json:"author_name"`
|
|
AuthorEmail string `json:"author_email"`
|
|
CommittedAt string `json:"committed_at"`
|
|
FilesChanged int `json:"files_changed"`
|
|
Insertions int `json:"insertions"`
|
|
Deletions int `json:"deletions"`
|
|
// Pushed is true when the commit is reachable from the branch's upstream
|
|
// tracking ref (i.e. present on the remote). Sourced from git itself —
|
|
// not from any PR API — so it stays correct when no PR exists yet, after
|
|
// rebases, and across multi-repo workspaces.
|
|
Pushed bool `json:"pushed"`
|
|
// RepositoryName tags commits returned from a multi-repo log fan-out.
|
|
// Empty for single-repo workspaces. Set by the API layer after the call.
|
|
RepositoryName string `json:"repository_name,omitempty"`
|
|
}
|
|
|
|
// CumulativeDiffResult represents the cumulative diff from base commit to HEAD.
|
|
type CumulativeDiffResult struct {
|
|
Success bool `json:"success"`
|
|
BaseCommit string `json:"base_commit"`
|
|
HeadCommit string `json:"head_commit"`
|
|
TotalCommits int `json:"total_commits"`
|
|
Files map[string]interface{} `json:"files"`
|
|
Error string `json:"error,omitempty"`
|
|
}
|
|
|
|
// Field and record separators for git log parsing.
|
|
// Using non-printable ASCII separators to avoid collision with commit message content.
|
|
const (
|
|
fieldSep = "\x1f" // Unit Separator (ASCII 31)
|
|
recordSep = "\x1e" // Record Separator (ASCII 30)
|
|
)
|
|
|
|
// GetLog returns commits from baseCommit (exclusive) to HEAD (inclusive).
|
|
// If baseCommit is empty, returns recent commits (limited by limit parameter).
|
|
// Stats (files changed, insertions, deletions) are fetched in-band via --shortstat
|
|
// to avoid an N+1 git-show call per commit.
|
|
func (g *GitOperator) GetLog(ctx context.Context, baseCommit string, limit int) (*GitLogResult, error) {
|
|
result := &GitLogResult{
|
|
Commits: make([]*GitCommitInfo, 0),
|
|
}
|
|
|
|
// Build the git log command with non-printable separators and --shortstat.
|
|
// The record separator (%x1e) is placed BEFORE the fields so that --shortstat
|
|
// output (appended after the format) stays within the same record:
|
|
// \x1e<fields>\n <stat summary>\n\x1e<fields>\n <stat summary>\n...
|
|
// Splitting on recordSep groups each commit's fields + stats together.
|
|
args := []string{"log", "--format=%x1e%H%x1f%P%x1f%an%x1f%ae%x1f%s%x1f%aI", "--shortstat"}
|
|
|
|
switch {
|
|
case baseCommit != "":
|
|
// --first-parent only on the divergence-range path: when the branch
|
|
// has merged main back in, plain `git log <base>..HEAD` walks both
|
|
// parents of the merge and surfaces commits brought in via main as
|
|
// if they were the branch's own work. Following only the first parent
|
|
// keeps the branch's line plus its merge commits and excludes the
|
|
// merged-in side. We deliberately don't apply this to the open-ended
|
|
// "recent N commits" path so future history-view callers (activity
|
|
// widgets, etc.) keep getting the full graph.
|
|
args = append(args, "--first-parent", baseCommit+"..HEAD")
|
|
case limit > 0:
|
|
args = append(args, fmt.Sprintf("-n%d", limit))
|
|
default:
|
|
// Default to last 50 commits if no base and no limit
|
|
args = append(args, "-n50")
|
|
}
|
|
|
|
output, err := g.runGitCommand(ctx, args...)
|
|
if err != nil {
|
|
result.Error = fmt.Sprintf("failed to get git log: %s", err.Error())
|
|
return result, nil
|
|
}
|
|
|
|
output = strings.TrimSpace(output)
|
|
if output == "" {
|
|
result.Success = true
|
|
return result, nil
|
|
}
|
|
|
|
// Split by record separator. The first element is empty (separator is at the start).
|
|
records := strings.Split(output, recordSep)
|
|
for _, record := range records {
|
|
record = strings.TrimSpace(record)
|
|
if record == "" {
|
|
continue
|
|
}
|
|
|
|
// The record may contain a trailing shortstat line after the commit fields.
|
|
// Split on newline: first line has the fields, remaining lines may have the stat summary.
|
|
lines := strings.SplitN(record, "\n", 2)
|
|
fieldLine := strings.TrimSpace(lines[0])
|
|
|
|
parts := strings.Split(fieldLine, fieldSep)
|
|
if len(parts) < 6 {
|
|
continue
|
|
}
|
|
|
|
sha := parts[0]
|
|
parentSHA := parts[1]
|
|
if idx := strings.Index(parentSHA, " "); idx > 0 {
|
|
parentSHA = parentSHA[:idx]
|
|
}
|
|
|
|
// Parse inline shortstat if present
|
|
var filesChanged, insertions, deletions int
|
|
if len(lines) > 1 {
|
|
statLine := strings.TrimSpace(lines[1])
|
|
if statLine != "" {
|
|
filesChanged, insertions, deletions = parseStatSummary(statLine)
|
|
}
|
|
}
|
|
|
|
result.Commits = append(result.Commits, &GitCommitInfo{
|
|
CommitSHA: sha,
|
|
ParentSHA: parentSHA,
|
|
AuthorName: parts[2],
|
|
AuthorEmail: parts[3],
|
|
CommitMessage: parts[4],
|
|
CommittedAt: parts[5],
|
|
FilesChanged: filesChanged,
|
|
Insertions: insertions,
|
|
Deletions: deletions,
|
|
})
|
|
}
|
|
|
|
g.markPushedCommits(ctx, result.Commits)
|
|
|
|
result.Success = true
|
|
return result, nil
|
|
}
|
|
|
|
// markPushedCommits sets Pushed on each commit by looking up which commits in
|
|
// HEAD's history are NOT reachable from the upstream tracking ref. A commit is
|
|
// pushed iff it is not in that "ahead" set. When the branch has no upstream
|
|
// (never been pushed) or the lookup fails, all commits stay Pushed=false — the
|
|
// safer default than falsely claiming a commit is on the remote.
|
|
func (g *GitOperator) markPushedCommits(ctx context.Context, commits []*GitCommitInfo) {
|
|
if len(commits) == 0 {
|
|
return
|
|
}
|
|
upstream := g.getUpstreamRef(ctx)
|
|
if upstream == "" {
|
|
return
|
|
}
|
|
// Resolve to a SHA so we can pass it to rev-list as `^<sha>`. The caret
|
|
// prefix means the arg doesn't match LooksLikeCommitSHA; it falls through
|
|
// to the non-branch catch-all in runGitCommand, which passes it unchanged.
|
|
// Safe: upstreamSHA is local rev-parse output, not user input.
|
|
upstreamSHA, err := g.runGitCommand(ctx, "rev-parse", upstream)
|
|
if err != nil {
|
|
return
|
|
}
|
|
upstreamSHA = strings.TrimSpace(upstreamSHA)
|
|
if upstreamSHA == "" {
|
|
return
|
|
}
|
|
// Cap the walk to the number of commits we're marking. Without this, a
|
|
// branch with many local-only commits would walk unbounded history per
|
|
// GetLog call. rev-list walks newest-first the same way GetLog does, so
|
|
// the N most recent unpushed SHAs cover the N commits in our result.
|
|
output, err := g.runGitCommand(ctx, "rev-list",
|
|
fmt.Sprintf("-n%d", len(commits)), "HEAD", "^"+upstreamSHA)
|
|
if err != nil {
|
|
return
|
|
}
|
|
unpushed := make(map[string]struct{})
|
|
for _, line := range strings.Split(strings.TrimSpace(output), "\n") {
|
|
sha := strings.TrimSpace(line)
|
|
if sha != "" {
|
|
unpushed[sha] = struct{}{}
|
|
}
|
|
}
|
|
for _, c := range commits {
|
|
if _, isUnpushed := unpushed[c.CommitSHA]; !isUnpushed {
|
|
c.Pushed = true
|
|
}
|
|
}
|
|
}
|
|
|
|
// GetCumulativeDiff returns the cumulative diff from baseCommit to the working tree
|
|
// (including uncommitted/unstaged changes).
|
|
func (g *GitOperator) GetCumulativeDiff(ctx context.Context, baseCommit string) (*CumulativeDiffResult, error) {
|
|
result := &CumulativeDiffResult{
|
|
Files: make(map[string]interface{}),
|
|
}
|
|
|
|
if baseCommit == "" {
|
|
result.Error = "base_commit is required"
|
|
return result, nil
|
|
}
|
|
|
|
result.BaseCommit = baseCommit
|
|
|
|
// Get current HEAD
|
|
headOutput, err := g.runGitCommand(ctx, "rev-parse", "HEAD")
|
|
if err != nil {
|
|
result.Error = fmt.Sprintf("failed to get HEAD: %s", err.Error())
|
|
return result, nil
|
|
}
|
|
result.HeadCommit = strings.TrimSpace(headOutput)
|
|
|
|
// Count commits between base and HEAD
|
|
countOutput, err := g.runGitCommand(ctx, "rev-list", "--count", baseCommit+"..HEAD")
|
|
if err == nil {
|
|
_, _ = fmt.Sscanf(strings.TrimSpace(countOutput), "%d", &result.TotalCommits)
|
|
}
|
|
|
|
// Get the cumulative diff (base → working tree, includes uncommitted changes)
|
|
diffOutput, err := g.runGitCommand(ctx, "diff", baseCommit)
|
|
if err != nil {
|
|
result.Error = fmt.Sprintf("failed to get diff: %s", err.Error())
|
|
return result, nil
|
|
}
|
|
|
|
// Parse the diff output into files
|
|
result.Files = g.parseCommitDiff(diffOutput)
|
|
|
|
result.Success = true
|
|
return result, nil
|
|
}
|
|
|
|
// CommitDiffResult represents the result of getting a commit's diff.
|
|
type CommitDiffResult struct {
|
|
Success bool `json:"success"`
|
|
CommitSHA string `json:"commit_sha"`
|
|
Message string `json:"message"`
|
|
Author string `json:"author"`
|
|
Date string `json:"date"`
|
|
Files map[string]interface{} `json:"files"` // FileInfo objects with diff content
|
|
FilesChanged int `json:"files_changed"`
|
|
Insertions int `json:"insertions"`
|
|
Deletions int `json:"deletions"`
|
|
Error string `json:"error,omitempty"`
|
|
}
|
|
|
|
// isHexChar reports whether r is a valid hexadecimal digit (0-9, a-f, A-F).
|
|
func isHexChar(r rune) bool {
|
|
return (r >= '0' && r <= '9') || (r >= 'a' && r <= 'f') || (r >= 'A' && r <= 'F')
|
|
}
|
|
|
|
// validateCommitSHA validates a commit SHA.
|
|
// Returns an error message if invalid, empty string if valid.
|
|
func validateCommitSHA(sha string) string {
|
|
if sha == "" {
|
|
return "commit SHA is required"
|
|
}
|
|
|
|
// Must be between 4 and 40 hex characters
|
|
if len(sha) < 4 || len(sha) > 40 {
|
|
return "commit SHA must be between 4 and 40 characters"
|
|
}
|
|
|
|
for _, r := range sha {
|
|
if !isHexChar(r) {
|
|
return "commit SHA contains invalid characters"
|
|
}
|
|
}
|
|
return ""
|
|
}
|
|
|
|
// sumFileDiffStats sums additions and deletions from a file diff map.
|
|
func sumFileDiffStats(files map[string]interface{}) (insertions, deletions int) {
|
|
for _, f := range files {
|
|
fi, ok := f.(map[string]interface{})
|
|
if !ok {
|
|
continue
|
|
}
|
|
if additions, ok := fi["additions"].(int); ok {
|
|
insertions += additions
|
|
}
|
|
if dels, ok := fi["deletions"].(int); ok {
|
|
deletions += dels
|
|
}
|
|
}
|
|
return insertions, deletions
|
|
}
|
|
|
|
// ShowCommit gets the diff for a specific commit using git show.
|
|
func (g *GitOperator) ShowCommit(ctx context.Context, commitSHA string) (*CommitDiffResult, error) {
|
|
result := &CommitDiffResult{
|
|
CommitSHA: commitSHA,
|
|
}
|
|
|
|
// Validate commit SHA (basic validation - alphanumeric only)
|
|
if errMsg := validateCommitSHA(commitSHA); errMsg != "" {
|
|
result.Error = errMsg
|
|
return result, nil
|
|
}
|
|
|
|
// Get commit metadata
|
|
formatOutput, err := g.runGitCommand(ctx, "show", "--no-patch", "--format=%H%n%s%n%an <%ae>%n%aI", commitSHA)
|
|
if err != nil {
|
|
result.Error = fmt.Sprintf("failed to get commit info: %s", err.Error())
|
|
return result, nil
|
|
}
|
|
|
|
lines := strings.Split(strings.TrimSpace(formatOutput), "\n")
|
|
if len(lines) >= 4 {
|
|
result.CommitSHA = lines[0]
|
|
result.Message = lines[1]
|
|
result.Author = lines[2]
|
|
result.Date = lines[3]
|
|
}
|
|
|
|
// Get the diff with stats
|
|
diffOutput, err := g.runGitCommand(ctx, "show", "--format=", "--stat", "--numstat", "-p", commitSHA)
|
|
if err != nil {
|
|
result.Error = fmt.Sprintf("failed to get commit diff: %s", err.Error())
|
|
return result, nil
|
|
}
|
|
|
|
// Parse the diff output into files
|
|
result.Files = g.parseCommitDiff(diffOutput)
|
|
result.FilesChanged = len(result.Files)
|
|
result.Insertions, result.Deletions = sumFileDiffStats(result.Files)
|
|
|
|
result.Success = true
|
|
return result, nil
|
|
}
|
|
|
|
// parseCommitDiff parses git show output into file info map
|
|
func (g *GitOperator) parseCommitDiff(output string) map[string]interface{} {
|
|
files := make(map[string]interface{})
|
|
|
|
// Split by "diff --git" to get individual file diffs
|
|
parts := strings.Split(output, "diff --git ")
|
|
if len(parts) <= 1 {
|
|
return files
|
|
}
|
|
|
|
for _, part := range parts[1:] {
|
|
if part == "" {
|
|
continue
|
|
}
|
|
|
|
// Re-add the "diff --git " prefix
|
|
diffContent := "diff --git " + part
|
|
|
|
// Extract file path from the diff header
|
|
// Format: diff --git a/path/to/file b/path/to/file
|
|
lines := strings.SplitN(diffContent, "\n", 2)
|
|
if len(lines) == 0 {
|
|
continue
|
|
}
|
|
|
|
header := lines[0]
|
|
// Extract path from "diff --git a/<path> b/<path>".
|
|
// We cannot split by space because paths may contain spaces.
|
|
// Instead, strip the known prefix and find the " b/" separator.
|
|
pathsPart := strings.TrimPrefix(header, "diff --git ")
|
|
bIdx := strings.Index(pathsPart, " b/")
|
|
if bIdx == -1 {
|
|
continue
|
|
}
|
|
filePath := pathsPart[bIdx+3:]
|
|
|
|
// Determine file status from diff content
|
|
status := fileStatusModified
|
|
switch {
|
|
case strings.Contains(diffContent, "new file mode"):
|
|
status = "added"
|
|
case strings.Contains(diffContent, "deleted file mode"):
|
|
status = fileStatusDeleted
|
|
case strings.Contains(diffContent, "rename from"):
|
|
status = "renamed"
|
|
}
|
|
|
|
// Count additions and deletions
|
|
additions := 0
|
|
deletions := 0
|
|
for _, line := range strings.Split(diffContent, "\n") {
|
|
if strings.HasPrefix(line, "+") && !strings.HasPrefix(line, "+++") {
|
|
additions++
|
|
} else if strings.HasPrefix(line, "-") && !strings.HasPrefix(line, "---") {
|
|
deletions++
|
|
}
|
|
}
|
|
|
|
files[filePath] = map[string]interface{}{
|
|
"status": status,
|
|
"staged": false,
|
|
"additions": additions,
|
|
"deletions": deletions,
|
|
"diff": diffContent,
|
|
}
|
|
}
|
|
|
|
return files
|
|
}
|
|
|
|
// GetMergeBase returns the merge-base commit SHA between two refs (e.g., HEAD and origin/main).
|
|
// This is used to determine the common ancestor for filtering commits.
|
|
func (g *GitOperator) GetMergeBase(ctx context.Context, ref1, ref2 string) (string, error) {
|
|
output, err := g.runGitCommand(ctx, "merge-base", ref1, ref2)
|
|
if err != nil {
|
|
return "", fmt.Errorf("failed to compute merge-base: %w", err)
|
|
}
|
|
return strings.TrimSpace(output), nil
|
|
}
|
|
|
|
// GetRevParse resolves a ref name to its commit SHA. Returns the empty
|
|
// string when the ref doesn't exist; used as a no-common-ancestor fallback
|
|
// for the commits panel so a base branch with unrelated history still
|
|
// produces a stable anchor for `git log <tip>..HEAD`.
|
|
func (g *GitOperator) GetRevParse(ctx context.Context, ref string) (string, error) {
|
|
output, err := g.runGitCommand(ctx, "rev-parse", ref)
|
|
if err != nil {
|
|
return "", fmt.Errorf("failed to rev-parse %q: %w", ref, err)
|
|
}
|
|
return strings.TrimSpace(output), nil
|
|
}
|