picoclaw/pkg/tools/gitpush.go

package tools

import (
	"context"
	"fmt"
	"os/exec"
	"regexp"
	"strings"
	"time"

	"github.com/sipeed/picoclaw/pkg/git"
)

// worktreeInfoKey is the context key for passing WorktreeInfo to tools.

type worktreeInfoKey struct{}

// WithWorktreeInfo returns a context carrying the active WorktreeInfo.

func WithWorktreeInfo(ctx context.Context, wt *git.WorktreeInfo) context.Context {
	return context.WithValue(ctx, worktreeInfoKey{}, wt)
}

// WorktreeInfoFromCtx extracts the WorktreeInfo from context, or nil.

func WorktreeInfoFromCtx(ctx context.Context) *git.WorktreeInfo {
	if v, ok := ctx.Value(worktreeInfoKey{}).(*git.WorktreeInfo); ok {
		return v
	}

	return nil
}

// protectedBranches are branch names that can never be pushed to.

var protectedBranches = regexp.MustCompile(`^(main|master|develop|release/.*)$`)

// GitPushTool implements safe git push restricted to worktree branches.

//

// Safety invariants:

//   - Only works inside a worktree (WorktreeInfo must be in context)

//   - Pushes only the worktree's branch — no arbitrary branch targets

//   - Protected branches (main, master, develop, release/*) are blocked

//   - Force push is never allowed

//   - Auto-commits uncommitted changes before pushing

type GitPushTool struct{}

// NewGitPushTool creates a GitPushTool.

func NewGitPushTool() *GitPushTool {
	return &GitPushTool{}
}

func (t *GitPushTool) Name() string { return "git_push" }

func (t *GitPushTool) Description() string {
	return "Push the current worktree branch to origin. Only works inside a git worktree. " +

		"Auto-commits uncommitted changes before pushing. " +

		"Protected branches (main, master, develop) cannot be pushed to. Force push is not allowed."
}

func (t *GitPushTool) Parameters() map[string]any {
	return map[string]any{
		"type": "object",

		"properties": map[string]any{
			"commit_message": map[string]any{
				"type": "string",

				"description": "Commit message for uncommitted changes. If omitted, uncommitted changes are auto-committed with a default message.",
			},
		},

		"required": []string{},
	}
}

func (t *GitPushTool) Execute(ctx context.Context, args map[string]any) *ToolResult {
	wt := WorktreeInfoFromCtx(ctx)

	if wt == nil {
		return ErrorResult(

			"git_push requires an active worktree.\n" +

				"This tool can only be used during worktree-based sessions " +

				"(e.g., heartbeat tasks or plan executing phase).\n" +

				"The worktree provides the branch name and isolation boundary — " +

				"without it, git_push cannot determine which branch to push.")
	}

	branch := wt.Branch

	if branch == "" {
		return ErrorResult(

			"worktree has no branch name.\n" +

				"The WorktreeInfo was set but Branch is empty. " +

				"This is an internal error — the worktree may not have been created correctly.")
	}

	// Block protected branches

	if protectedBranches.MatchString(branch) {
		return ErrorResult(fmt.Sprintf(

			"cannot push to protected branch %q.\n"+

				"Protected branches (main, master, develop, release/*) are blocked to prevent "+

				"accidental overwrites. Work should be done on feature branches created by worktrees.",

			branch))
	}

	// Auto-commit uncommitted changes

	if git.HasUncommittedChanges(wt.Path) {
		commitMsg := "auto: save before push"

		if msg, ok := args["commit_message"].(string); ok && msg != "" {
			commitMsg = msg
		}

		if err := git.AutoCommit(wt.Path, commitMsg); err != nil {
			return ErrorResult(fmt.Sprintf(

				"auto-commit failed before push: %v\n"+

					"git_push auto-commits uncommitted changes before pushing. "+

					"The commit failed, so no push was attempted. "+

					"Check if the worktree at %q is in a valid state (e.g., no merge conflicts).",

				err, wt.Path))
		}
	}

	// Check there are commits to push

	ahead := git.CommitsAhead(wt.RepoRoot, wt.BaseBranch, branch)

	if ahead == 0 {
		return NewToolResult(fmt.Sprintf(

			"Nothing to push: branch %q has no commits ahead of %s.\n"+

				"The branch is identical to the base. Make changes and commit before pushing.",

			branch, wt.BaseBranch))
	}

	// Push with -u (set upstream tracking)

	pushCtx, cancel := context.WithTimeout(ctx, 2*time.Minute)

	defer cancel()

	cmd := exec.CommandContext(pushCtx, "git", "push", "-u", "origin", branch)

	cmd.Dir = wt.Path

	out, err := cmd.CombinedOutput()

	output := strings.TrimSpace(string(out))

	if err != nil {
		return ErrorResult(fmt.Sprintf(

			"git push failed for branch %q: %s\n%s\n"+

				"Possible causes: network error, authentication failure, or remote rejected the push. "+

				"If the remote branch has diverged, resolve the divergence in the worktree first — "+

				"force push is not available.",

			branch, err, output))
	}

	return NewToolResult(fmt.Sprintf("Pushed branch %q to origin (%d commit(s) ahead of %s)\n%s",

		branch, ahead, wt.BaseBranch, output))
}