thunderbird-patch-review

Simple email patch review tool for Thunderbird

implementation.js (24999B)

 // Privileged WebExtension Experiment behind Apply series, Browse... and
 // Open editor. It ships inside the .xpi, so installing the extension is the
 // whole install — there is no separate native messaging host.
 //
 // This file runs with full chrome privileges in Thunderbird's parent
 // process; everything privileged the add-on does lives here. It sticks to
 // long-stable platform APIs — Subprocess to run git and the editor,
 // nsIFilePicker for the directory chooser, IOUtils/PathUtils for the patch
 // workspace — and the fallbacks below cover the differences between
 // Thunderbird 115 and current.
 
 "use strict";
 
 /* globals ExtensionAPI, Services, IOUtils, PathUtils, AppConstants, ChromeUtils, Cc, Ci */
 
 // Platform modules moved from .jsm to .sys.mjs across the supported
 // Thunderbird range; try the ESM spelling first.
 function importModule(name) {
   try {
     return ChromeUtils.importESModule(`resource://gre/modules/${name}.sys.mjs`);
   } catch (e) {
     return ChromeUtils.import(`resource://gre/modules/${name}.jsm`);
   }
 }
 
 const { Subprocess } = importModule("Subprocess");
 
 /** Run a command to completion, stderr folded into stdout. */
 async function run(command, args) {
   const proc = await Subprocess.call({
     command,
     arguments: args,
     stderr: "stdout",
   });
   let output = "";
   let chunk;
   while ((chunk = await proc.stdout.readString())) {
     output += chunk;
   }
   const { exitCode } = await proc.wait();
   return { exitCode, output };
 }
 
 // Return a path to a freshly created empty directory git can be pointed at
 // via `-c core.hooksPath=<path>` to silence every hook for a single
 // invocation. git am fires applypatch-msg, pre-applypatch and
 // post-applypatch; `git worktree add` fires post-checkout.
 //
 // The Apply button is a deliberate human act, so the user's own hooks run
 // there as part of a normal apply — their workflow expects them. The
 // "Apply without hooks" dropdown item (apply()'s noHooks arg) instead
 // points git at an empty hooks dir, for applying untrusted content where
 // even a deliberate apply shouldn't run user code on the patch text. The
 // automated check() probe always suppresses (no human act at all).
 //
 // core.hooksPath is read per invocation (the -c value is never written to
 // the user's config), and an empty existing dir has no hook files for git
 // to find, on every platform. A purely nonexistent path would also work on
 // POSIX but is less portable (Windows treats `/dev/null`-style paths
 // oddly), so we make a real empty directory instead. Callers remove it in
 // their finally.
 async function emptyHooksDir() {
   const dir = PathUtils.join(
     PathUtils.tempDir,
     `patch-review.hooks.${Date.now()}.${Math.floor(Math.random() * 1e9)}`
   );
   await IOUtils.makeDirectory(dir, { permissions: 0o700 });
   return dir;
 }
 
 // Detect a `git am` already in progress in the user's repository: an
 // unfinished am leaves a rebase-apply/ directory inside the git dir, and
 // a fresh `git am` exits non-zero on it ("a previous am session is in
 // progress"). apply()'s abort path would then tear that session down,
 // discarding the user's in-progress conflict resolution; the guard before
 // apply() refuses instead. Resolve the git dir absolutely so a linked
 // worktree's own per-worktree git dir is checked (the path --git-path
 // rebase-apply would return for the worktree, not the common .git).
 // --absolute-git-dir lands in git 2.31 (2021); fall back to relative
 // --git-dir (absolute for linked worktrees, ".git" for the main repo) on
 // older builds, joined against repo. Returns the rebase-apply path if a
 // session is in progress, else null.
 async function amInProgress(git, repo) {
   let gd = await run(git, ["-C", repo, "rev-parse", "--absolute-git-dir"]);
   if (gd.exitCode !== 0 || !gd.output.trim()) {
     gd = await run(git, ["-C", repo, "rev-parse", "--git-dir"]);
     if (gd.exitCode !== 0) return null;
   }
   let dir = gd.output.trim();
   if (!dir) return null;
   if (!PathUtils.isAbsolute(dir)) dir = PathUtils.join(repo, dir);
   const ra = PathUtils.join(dir, "rebase-apply");
   return (await IOUtils.exists(ra)) ? ra : null;
 }
 
 async function findGit() {
   try {
     return await Subprocess.pathSearch("git", Subprocess.getEnvironment());
   } catch (e) {
     // Thunderbird launched from a desktop entry or .app bundle may see a
     // minimal PATH; try the usual install locations before giving up.
     for (const candidate of ["/usr/local/bin/git", "/opt/homebrew/bin/git", "/usr/bin/git"]) {
       if (await IOUtils.exists(candidate)) {
         return candidate;
       }
     }
     throw new Error("git not found in PATH");
   }
 }
 
 // Verify repo is a git worktree and return a short description for the
 // toolbar. The name is the top-level dir basename (what the user picked);
 // the branch is the checked-out branch or detached short SHA.
 async function describeRepo(git, repo) {
   if (!repo) {
     throw new Error("no repository path given");
   }
   const check = await run(git, ["-C", repo, "rev-parse", "--is-inside-work-tree"]);
   if (check.exitCode !== 0) {
     throw new Error(`not a git repository: ${repo}`);
   }
   const showToplevel = await run(git, ["-C", repo, "rev-parse", "--show-toplevel"]);
   const toplevel = showToplevel.output.trim();
   const name = toplevel ? toplevel.replace(/[\\/]+$/, "").split(/[\\/]/).pop() : repo;
   let branch = await run(git, ["-C", repo, "symbolic-ref", "--short", "HEAD"]);
   if (branch.exitCode !== 0) {
     // Detached HEAD: fall back to the short commit hash.
     branch = await run(git, ["-C", repo, "rev-parse", "--short", "HEAD"]);
   }
   return { ok: true, repo: toplevel || repo, name, branch: branch.output.trim() };
 }
 
 async function ping() {
   const git = await findGit();
   const version = await run(git, ["--version"]);
   return { ok: true, git, version: version.output.trim() };
 }
 
 async function describe(repo) {
   const git = await findGit();
   return describeRepo(git, repo);
 }
 
 async function apply(repo, strategy, patches, noHooks) {
   const git = await findGit();
   await describeRepo(git, repo);
   if (!patches.length) {
     throw new Error("no patches in request");
   }
 
   // Refuse before touching the repo if a previous `git am` is mid-series
   // here: a fresh `git am` would fail immediately ("a previous am session
   // is in progress") and the abort below would then reset the user's
   // branch and discard their ongoing conflict resolution — exactly the
   // session this add-on did not start. Surface git's own diagnostic
   // location and leave the working tree untouched, so the user resolves it
   // themselves (git am --continue / --skip / --abort) and applies again.
   const inProgress = await amInProgress(git, repo);
   if (inProgress) {
     return {
       ok: false,
       output:
         "A previous `git am` session is already in progress in this repository\n" +
         `        (${inProgress}).\n` +
         "Resolve it yourself — git am --continue, --skip, or --abort — then\n" +
         "apply again. This add-on will not run git am --abort against a\n" +
         "session it did not start, so your in-progress resolution is left\n" +
         "untouched.\n",
     };
   }
 
   const work = PathUtils.join(
     PathUtils.tempDir,
     `patch-review.${Date.now()}.${Math.floor(Math.random() * 1e9)}`
   );
   await IOUtils.makeDirectory(work, { permissions: 0o700 });
   // Hooks: the Apply button is a deliberate human act, so the user's own
   // hooks run as part of a normal apply (their workflow expects them).
   // "Apply without hooks" (noHooks) instead points git at an empty hooks
   // dir for both am and its rollback, for applying untrusted content
   // where even a deliberate apply shouldn't run user code on the patch.
   // The automated check() probe always suppresses; apply() defaults to
   // running hooks. The -c value is per-invocation only, never written to
   // the user's config, so their hooks are intact for normal git use.
   const hooks = noHooks ? await emptyHooksDir() : null;
   try {
     const hp = hooks ? ["-c", `core.hooksPath=${hooks}`] : [];
     const args = ["-C", repo, "-c", "advice.mergeConflict=false", "-c", "advice.amWorkDir=false", ...hp, "am"];
     if (strategy !== "am") {
       args.push("--3way");
     }
     for (const [i, patch] of patches.entries()) {
       const file = PathUtils.join(work, `${String(i + 1).padStart(4, "0")}.patch`);
       await IOUtils.writeUTF8(file, patch);
       args.push(file);
     }
     const am = await run(git, args);
     if (am.exitCode === 0) {
       return { ok: true, output: am.output };
     }
     const abort = await run(git, ["-C", repo, "-c", "advice.mergeConflict=false", "-c", "advice.amWorkDir=false", ...hp, "am", "--abort"]);
     return {
       ok: false,
       output:
         am.output +
         abort.output +
         "(git am --abort ran; the repository is back to its previous state)\n",
     };
   } finally {
     IOUtils.remove(work, { recursive: true }).catch(() => {});
     if (hooks) IOUtils.remove(hooks, { recursive: true }).catch(() => {});
   }
 }
 
 // Map each path a patch series touches to its FINAL post-series state,
 // taken from the right side of the last `index <old>..<new>` line that
 // carried the path. Last-write-wins across the multi-patch mbox (a
 // sequel that re-touches a file overrides the earlier patch's target).
 //
 // Returns a Map<path, { blob: "<hex>" } | { deleted: true }>. Returns
 // null when the input had no parseable path or when a path git rendered
 // quoted was seen (paths with spaces or other special chars aren't
 // handled — bail so the caller falls through to the git am worktree
 // instead of silently misclassifying).
 //
 // We extract the path from `+++ b/path`/`--- a/path` rather than the
 // `diff --git a/path b/path` header, so a future rename (a/old b/new)
 // maps the target to the new name and the old name is recorded deleted.
 function collectFinalBlobs(text) {
   const finals = new Map();
   // Mail transport commonly delivers CRLF (Thunderbird's getRaw does); a
   // trailing \r would defeat the $-anchored path regexes below, since in
   // JS `.` matches neither \r nor \n. A path genuinely ending in \r is
   // git-quoted and hits the quoted-path bail, so stripping is safe.
   const lines = text.split("\n").map((l) => (l.endsWith("\r") ? l.slice(0, -1) : l));
   let block = null;
   let unsupported = false;
   const flush = (b) => {
     if (!b || !b.targetPath) return;
     if (b.isDelete) {
       finals.set(b.targetPath, { deleted: true });
     } else if (b.targetBlob) {
       finals.set(b.targetPath, { blob: b.targetBlob });
     }
   };
   for (const line of lines) {
     if (line.startsWith("diff --git ")) {
       flush(block);
       block = { targetPath: null, srcPath: null, targetBlob: null, isDelete: false };
       continue;
     }
     if (!block) continue;
     if (line.startsWith("deleted file mode ")) { block.isDelete = true; continue; }
     if (line === "+++ /dev/null") { block.isDelete = true; continue; }
     // git quotes paths with spaces or other special chars, either as
     // `+++ "b/path with space"` or `+++ b/"path with space"` (and the
     // analogous forms for ---). We don't unquote; bail so the caller
     // falls through to git am instead of misclassifying.
     const linePath = line.replace(/^(?:\+\+\+ (?:b\/)?|--- (?:a\/)?)/, "").replace(/^\/dev\/null$/, "");
     if ((line.startsWith("+++") || line.startsWith("---")) && linePath.startsWith('"')) {
       unsupported = true;
       break;
     }
     let m;
     if ((m = /^index ([0-9a-f]+)\.\.([0-9a-f]+)/.exec(line))) {
       block.targetBlob = m[2];
       continue;
     }
     if ((m = /^--- a\/(.+)$/.exec(line))) {
       block.srcPath = m[1];
       if (block.targetPath == null) block.targetPath = m[1];
       continue;
     }
     if ((m = /^\+\+\+ b\/(.+)$/.exec(line))) {
       const newPath = m[1];
       // The post-patch path differs from the source => a rename. The
       // source vanishes; the target takes the (likely unchanged) blob.
       if (block.srcPath && block.srcPath !== newPath) {
         finals.set(block.srcPath, { deleted: true });
       }
       block.targetPath = newPath;
       block.isDelete = false;
       continue;
     }
   }
   flush(block);
   if (unsupported) return null;
   return finals.size ? finals : null;
 }
 
 // Match the per-path target blobs against `git ls-tree HEAD -- <paths>`.
 // Returns true if every path in `finals` is already at its expected blob
 // in HEAD (or absent for deletes). False otherwise. Calls git once with
 // every path in one ls-tree to keep the spawn count down.
 async function blobsMatchHead(git, repo, finals) {
   const paths = [...finals.keys()];
   const ls = await run(git, ["-C", repo, "ls-tree", "HEAD", "--", ...paths]);
   // ls-tree prints rows like `<mode> blob <hash>\t<path>`; paths absent
   // from HEAD print no row at all.
   const byPath = new Map();
   for (const row of ls.output.split("\n")) {
     if (!row) continue;
     const m = /^(\S+) (\S+) ([0-9a-f]+)\t(.+)$/.exec(row);
     if (m) byPath.set(m[4], m[3]);
   }
   for (const [path, info] of finals) {
     if (info.deleted) {
       if (byPath.has(path)) return false;
     } else {
       const actual = byPath.get(path);
       if (!actual) return false;
       // git format-patch truncates blob hashes (default 7 hex). The
       // ls-tree output is full-length, so a prefix-equal either way marks
       // the same blob.
       const expected = info.blob;
       if (
         actual !== expected &&
         !actual.startsWith(expected) &&
         !expected.startsWith(actual)
       ) {
         return false;
       }
     }
   }
   return true;
 }
 
 // Classify a patch series against a repository without writing anything
 // to the user's working tree. apply() runs `git am`, so the most honest
 // precheck is to run `git am` too and read what it would do — without
 // dirtying the user's repo, by adding a throwaway --detach worktree at
 // HEAD and force-removing it afterwards. (The user's branch is never
 // touched; we never run am in the user's own worktree.)
 //
 // Three stages:
 //   1. Cheap `git apply --check` against the working tree fast-paths the
 //      common "cleanly applicable" and "exactly already applied" cases
 //      without paying for a worktree checkout.
 //   2. --check couldn't decide, but the series' END STATE per touched
 //      path already sits in HEAD. Patches committed with slightly tweaked
 //      intermediate content (a doubled-letter typo, mail-relay-mangled
 //      blank-context whitespace that the actual commit cleaned up mid-
 //      series) won't patch-id-match — but the FINAL tree state per file
 //      agrees. This catches the common "patchset already applied with
 //      minor diff divergence" case without a worktree checkout.
 //   3. Failing the above, run `git am` itself in a fresh --detach worktree
 //      to read am's own tri-state.
 //
 // git am backs the tri-state with stable signals (stage 3):
 //   exit 0  + "Patch already applied" / "No changes"  -> "applied"
 //   exit 0  (only "Applying: <subject>")              -> "applicable"
 //   exit 128 (context mismatch, merge conflict, dirty-index refusal) -> "conflict"
 async function check(repo, strategy, patches) {
   const git = await findGit();
   await describeRepo(git, repo);
   if (!patches.length) {
     throw new Error("no patches in request");
   }
 
   // Stage 0: dirty working tree. git am refuses to start on a tree with
   // staged or unstaged tracked changes (untracked files don't block it),
   // so any Apply would fail before the patches are even read — regardless
   // of whether the series would otherwise apply. Surface it up front as a
   // distinct "dirty" state so the UI can warn in yellow rather than let
   // the user click Apply into a refusal. Mirror git's
   // require_clean_work_tree: diff-index --quiet HEAD catches both staged
   // and unstaged tracked changes in one call (exit 0 clean, 1 dirty, 128
   // bad/absent HEAD); --ignore-submodules matches am's own check. The 128
   // case falls through to the normal stages, which will report the real
   // problem. A short `status -s` listing is folded into `output` for the
   // tooltip so the user can see what's keeping the tree dirty.
   const dirty = await run(git, ["-C", repo, "diff-index", "--quiet", "--ignore-submodules", "HEAD"]);
   if (dirty.exitCode === 1) {
     const why = await run(git, ["-C", repo, "status", "-s", "--untracked-files=no"]);
     return {
       ok: true,
       status: "dirty",
       output: why.output.trim() || "the working tree has staged or unstaged changes",
     };
   }
 
   // Stage 1: cheap --check against the working tree — fast-path the common
   // "cleanly applicable" and "exactly already applied" cases without
   // paying for a worktree checkout. The probe holds the mboxes
   // concatenated: separate per-file args are each checked against the
   // *original* tree independently, so a sequel whose context depends on an
   // earlier patch fails spuriously; concatenated, git parses the file as a
   // series and the contexts line up, just as am does.
   const probe = PathUtils.join(
     PathUtils.tempDir,
     `patch-review.check.${Date.now()}.${Math.floor(Math.random() * 1e9)}.patch`
   );
   // Unlike git am (whose mailinfo strips mail-transport CRLF), git apply
   // takes the probe bytes literally, and a \r on every context line
   // matches nothing. Fold transport CRLF to LF; a genuine content \r in
   // a CRLF-file patch arrives as \r\r\n and keeps its single \r.
   await IOUtils.writeUTF8(probe, patches.join("\n").replace(/\r\n/g, "\n"));
   let fwd;
   try {
     fwd = await run(git, ["-C", repo, "-c", "advice.mergeConflict=false", "-c", "advice.amWorkDir=false", "apply", "--check", probe]);
     if (fwd.exitCode === 0) {
       return { ok: true, status: "applicable", output: fwd.output };
     }
     const rev = await run(git, ["-C", repo, "-c", "advice.mergeConflict=false", "-c", "advice.amWorkDir=false", "apply", "--check", "--reverse", probe]);
     if (rev.exitCode === 0) {
       return { ok: true, status: "applied", output: fwd.output };
     }
   } finally {
     IOUtils.remove(probe).catch(() => {});
   }
 
   // Stage 1.5: end-state check. --check refused in both directions — but
   // if every path the series touches is already at its final post-patch
   // blob in HEAD (or absent, for deletes), the series has effectively
   // landed. git am would still flag a conflict (it can't recreate a file
   // that's already there, can't delete a file that's already gone); the
   // button would glow red. Compare blob hashes instead — they line up.
   //
   // collectFinalBlobs returns null when it can't parse all the paths
   // (e.g. git quotes paths with spaces), which falls through cleanly.
   const finals = collectFinalBlobs(patches.join("\n"));
   if (finals) {
     const headMatch = await blobsMatchHead(git, repo, finals);
     if (headMatch) {
       return {
         ok: true,
         status: "applied",
         output: "Series end-state matches HEAD (every touched file is at its target blob).",
       };
     }
   }
 
   // Stage 2: --check couldn't decide. Run git am for real in a fresh
   // --detach worktree, mirroring apply()'s strategy (am or am3). apply()
   // runs git am with the same arguments on the same patches, so the probe
   // predicts the Apply button's outcome exactly, including the --3way
   // reconstruction --check skipped. The user's branch is never touched
   // (--detach forks off HEAD; am runs in the temporary worktree only) and
   // the worktree is force-removed afterwards.
   const work = PathUtils.join(
     PathUtils.tempDir,
     `patch-review.am.${Date.now()}.${Math.floor(Math.random() * 1e9)}`
   );
   // Empty hooks dir, created before the worktree so post-checkout fires
   // nothing on the checkout, and reused for the am run and its abort so
   // applypatch-msg/pre-applypatch/post-applypatch fire nothing either.
   const hooks = await emptyHooksDir();
   const hp = ["-c", `core.hooksPath=${hooks}`];
   const make = await run(git, ["-C", repo, "-c", "advice.mergeConflict=false", "-c", "advice.amWorkDir=false", ...hp, "worktree", "add", "--detach", work]);
   if (make.exitCode !== 0) {
     // Rare (bare repo, no worktree support, …). Don't trust --check's
     // partial answer here — report "conflict" so the user clicks Apply
     // and reads am's own error, instead of guessing.
     IOUtils.remove(hooks, { recursive: true }).catch(() => {});
     return { ok: true, status: "conflict", output: fwd.output + make.output };
   }
   try {
     const file = PathUtils.join(work, "series.mbox");
     await IOUtils.writeUTF8(file, patches.join("\n"));
     const args = ["-C", work, "-c", "advice.mergeConflict=false", "-c", "advice.amWorkDir=false", ...hp, "am"];
     if (strategy !== "am") {
       args.push("--3way");
     }
     args.push(file);
     const am = await run(git, args);
     if (am.exitCode === 0) {
       if (/Patch already applied|No changes --/.test(am.output)) {
         return { ok: true, status: "applied", output: am.output };
       }
       return { ok: true, status: "applicable", output: am.output };
     }
     // am stopped mid-series (context mismatch, merge conflict, dirty
     // tree). Roll the worktree back so its state isn't left dangling, then
     // report conflict with am's diagnostic — it names the file and hunk.
     await run(git, ["-C", work, "-c", "advice.mergeConflict=false", "-c", "advice.amWorkDir=false", ...hp, "am", "--abort"]);
     return { ok: true, status: "conflict", output: am.output };
   } finally {
     // --force drops the worktree even if am left its working tree dirty.
     await run(git, ["-C", repo, "-c", "advice.mergeConflict=false", "-c", "advice.amWorkDir=false", "worktree", "remove", "--force", work]);
     IOUtils.remove(work, { recursive: true }).catch(() => {});
     IOUtils.remove(hooks, { recursive: true }).catch(() => {});
   }
 }
 
 async function pickDir(start) {
   const win = Services.wm.getMostRecentWindow(null);
   if (!win) {
     throw new Error("no window to attach the directory chooser to");
   }
   const picker = Cc["@mozilla.org/filepicker;1"].createInstance(Ci.nsIFilePicker);
   // nsIFilePicker.init took a window before Thunderbird ~125 and takes a
   // BrowsingContext after; whichever the running version rejects, throws.
   try {
     picker.init(win.browsingContext, "Choose repository", Ci.nsIFilePicker.modeGetFolder);
   } catch (e) {
     picker.init(win, "Choose repository", Ci.nsIFilePicker.modeGetFolder);
   }
   if (start) {
     try {
       const dir = Cc["@mozilla.org/file/local;1"].createInstance(Ci.nsIFile);
       dir.initWithPath(start);
       if (dir.exists() && dir.isDirectory()) {
         picker.displayDirectory = dir;
       }
     } catch (e) {
       // Not a usable start path; the picker opens at its default.
     }
   }
   const rv = await new Promise((resolve) => picker.open(resolve));
   if (rv !== Ci.nsIFilePicker.returnOK || !picker.file) {
     return { ok: true, output: "", cancelled: true };
   }
   return { ok: true, output: picker.file.path };
 }
 
 async function openEditor(repo, editor, files) {
   const git = await findGit();
   await describeRepo(git, repo);
   const env = Subprocess.getEnvironment();
   let command = (editor || "").trim() || (env.EDITOR || "").trim();
   if (!command) {
     // Nothing configured anywhere: open the repository directory instead.
     command = { macosx: "open", win: "start" }[AppConstants.platform] || "xdg-open";
     files = ["."];
   }
 
   if (AppConstants.platform === "win") {
     const line = [command, ...files.map((f) => `"${f}"`)].join(" ");
     await Subprocess.call({
       command: env.ComSpec || "C:\\Windows\\System32\\cmd.exe",
       arguments: ["/s", "/c", line],
       workdir: repo,
       stderr: "ignore",
     });
   } else {
     // The command may carry flags ("code -n"); let sh split it and append
     // the files. Output goes to /dev/null so a chatty editor can never
     // fill the pipe, and the editor is not waited on.
     await Subprocess.call({
       command: "/bin/sh",
       arguments: ["-c", `exec ${command} "$@" >/dev/null 2>&1`, "patch-review-edit", ...files],
       workdir: repo,
       stderr: "ignore",
     });
   }
   return { ok: true, output: `launched: ${command}` };
 }
 
 /** Errors become {ok: false, error} so callers get one uniform shape. */
 async function guarded(fn) {
   try {
     return await fn();
   } catch (e) {
     return { ok: false, error: e.message || String(e) };
   }
 }
 
 var patchHost = class extends ExtensionAPI {
   getAPI() {
     return {
       patchHost: {
         ping: () => guarded(ping),
         describe: (repo) => guarded(() => describe(repo)),
         apply: (repo, strategy, patches, noHooks) => guarded(() => apply(repo, strategy, patches, noHooks)),
         check: (repo, strategy, patches) => guarded(() => check(repo, strategy, patches)),
         pickDir: (start) => guarded(() => pickDir(start)),
         openEditor: (repo, editor, files) => guarded(() => openEditor(repo, editor, files)),
       },
     };
   }
 };