@abhaydesu/git-pilot 1.3.0 → 1.3.1

package/README.md

@@ -85,8 +85,17 @@ Check the installed version with `git pilot --version`, or see all commands with
 | --- | --- | --- |
 | `GIT_PILOT_API_URL` | `https://git-pilot-api.vercel.app` | Base URL of the backend API. Set it to use a self-hosted or local instance, e.g. `GIT_PILOT_API_URL=http://localhost:3000 git pilot run "show status"`. |
 
+`GIT_PILOT_API_URL` must use `https` (plain `http` is accepted only for `localhost`), because your staged diffs are sent to that server.
+
 Very large staged diffs (over ~800,000 characters) are not sent in full. Git Pilot sends the list of changed files instead and uses your intent to write the message.
 
+### ◾ Privacy and Security
+
+* `git pilot commit` sends your **staged diff** (and intent) to the Git Pilot API, which forwards it to Google's Gemini API. `run` sends your request text, `undo` your last 15 reflog lines, and `branch` your description. **Don't stage secrets or code you can't share** when using `commit`.
+* Suggested commands are validated locally before you are even asked to confirm: only `git` with a known subcommand (`add`, `commit`, `push`, ...), no shell operators, no leading global options (`git -c ...`), and no options that run other programs (`--upload-pack`, `--exec`, ...).
+* Commands run without a shell, and only after you confirm.
+* To report a vulnerability, please open a private security advisory on the GitHub repository rather than a public issue.
+
 ### ◾ Development
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abhaydesu/git-pilot",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "AI-powered Git assistant: commit messages, natural-language git commands, undo suggestions and branch names.",
   "main": "src/cli.js",
   "scripts": {
@@ -25,7 +25,7 @@
   "license": "MIT",
   "preferGlobal": true,
   "dependencies": {
-    "axios": "^1.12.2",
+    "axios": "^1.20.0",
     "chalk": "^5.6.2",
     "commander": "^14.0.1",
     "execa": "^9.6.0",

package/src/commands/branch.js

@@ -1,5 +1,5 @@
 import chalk from "chalk";
-import { callApi } from "../lib/api.js";
+import { callApi, requireString } from "../lib/api.js";
 import * as git from "../lib/git.js";
 import {
   spin,
@@ -14,7 +14,7 @@ import {
 export async function branchCommand(description) {
   const spinner = spin("Generating a conventional branch name...");
   try {
-    const { branchName } = await callApi("pilot-branch", { description });
+    const branchName = requireString(await callApi("pilot-branch", { description }), "branchName");
     spinner.succeed();
 
     showBlock("Suggested Branch Name", branchName);

package/src/commands/commit.js

@@ -1,4 +1,4 @@
-import { callApi, MAX_DIFF_CHARS } from "../lib/api.js";
+import { callApi, fitsInRequest, requireString } from "../lib/api.js";
 import * as git from "../lib/git.js";
 import {
   spin,
@@ -23,11 +23,13 @@ export async function commitCommand(intent) {
       return;
     }
 
-    const diffToSend =
-      diff.length > MAX_DIFF_CHARS ? OVERSIZED_PREFIX + (await git.getStagedSummary()) : diff;
+    let payload = { intent, diff };
+    if (!fitsInRequest(payload, diff)) {
+      payload = { intent, diff: OVERSIZED_PREFIX + (await git.getStagedSummary()) };
+    }
 
     spinner.text = "Generating commit message...";
-    const { message } = await callApi("pilot-commit", { intent, diff: diffToSend });
+    const message = requireString(await callApi("pilot-commit", payload), "message");
     spinner.succeed();
 
     showBlock("Suggested Message", message);

package/src/commands/run.js

@@ -1,12 +1,12 @@
 import chalk from "chalk";
-import { callApi } from "../lib/api.js";
+import { callApi, requireString } from "../lib/api.js";
 import { parseGitCommand, runGit } from "../lib/exec.js";
 import { spin, showBlock, confirm, success, aborted, handleError } from "../lib/ui.js";
 
 export async function runCommand(request) {
   const spinner = spin("Fetching the right command...");
   try {
-    const { command } = await callApi("pilot-run", { request });
+    const command = requireString(await callApi("pilot-run", { request }), "command");
 
     if (command.startsWith("Error:")) {
       spinner.fail(command);

package/src/commands/undo.js

@@ -1,5 +1,5 @@
 import chalk from "chalk";
-import { callApi } from "../lib/api.js";
+import { callApi, requireString } from "../lib/api.js";
 import { parseGitCommand, runGit } from "../lib/exec.js";
 import * as git from "../lib/git.js";
 import { spin, showBlock, confirm, success, aborted, handleError } from "../lib/ui.js";
@@ -10,7 +10,8 @@ export async function undoCommand() {
     const reflog = await git.getReflog();
 
     spinner.text = "Suggesting an undo command...";
-    const { command, explanation } = await callApi("pilot-undo", { reflog });
+    const data = await callApi("pilot-undo", { reflog });
+    const command = data?.command ?? null;
 
     if (!command) {
       spinner.warn("Couldn't determine a safe action to undo.");
@@ -18,10 +19,10 @@ export async function undoCommand() {
     }
     spinner.succeed();
 
-    const args = parseGitCommand(command);
+    const args = parseGitCommand(requireString(data, "command"));
 
     showBlock("Suggested Undo Command", command);
-    console.log(chalk.yellow(explanation));
+    console.log(chalk.yellow(String(data?.explanation ?? "")));
 
     if (!(await confirm("Execute this undo command?"))) {
       return aborted("Execution aborted by user.");

package/src/lib/api.js

@@ -2,20 +2,53 @@ import axios from "axios";
 
 export const DEFAULT_API_URL = "https://git-pilot-api.vercel.app";
 
-// The API rejects request bodies over 1 MB; keep the diff safely below that.
+// The API rejects request bodies over 1 MB (bytes, after JSON encoding) and diffs over
+// 800,000 characters.
 export const MAX_DIFF_CHARS = 800_000;
+const MAX_BODY_BYTES = 1_000_000;
 
-export const apiBaseUrl = () =>
-  (process.env.GIT_PILOT_API_URL || DEFAULT_API_URL).replace(/\/+$/, "");
+/** True if `body` (containing `diff`) is small enough for the API to accept. */
+export const fitsInRequest = (body, diff) =>
+  diff.length <= MAX_DIFF_CHARS && Buffer.byteLength(JSON.stringify(body)) <= MAX_BODY_BYTES;
+
+const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+
+export function apiBaseUrl() {
+  const raw = (process.env.GIT_PILOT_API_URL || DEFAULT_API_URL).replace(/\/+$/, "");
+
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new Error(`GIT_PILOT_API_URL is not a valid URL: ${raw}`);
+  }
+  // Your staged diffs are sent to this server, so never over plain http except locally.
+  const plainHttpOk = url.protocol === "http:" && LOCAL_HOSTS.has(url.hostname);
+  if (url.protocol !== "https:" && !plainHttpOk) {
+    throw new Error("GIT_PILOT_API_URL must use https (plain http is only allowed for localhost).");
+  }
+  return raw;
+}
 
 /** POSTs `body` to `/api/<endpoint>` and returns the parsed response data. */
 export async function callApi(endpoint, body) {
   const { data } = await axios.post(`${apiBaseUrl()}/api/${endpoint}`, body, {
     timeout: 30_000,
+    maxRedirects: 0, // the API never redirects a POST; don't follow one to somewhere else
+    maxContentLength: 1_000_000,
   });
   return data;
 }
 
+/** Returns `data[field]` if it is a non-empty string; otherwise throws a clear error. */
+export function requireString(data, field) {
+  const value = data?.[field];
+  if (typeof value !== "string" || value === "") {
+    throw new Error(`Unexpected response from the API (missing "${field}").`);
+  }
+  return value;
+}
+
 /** Human-readable message for an axios/network/other error. */
 export function describeError(error) {
   if (error.response) {

package/src/lib/exec.js

@@ -3,6 +3,55 @@ import { execa } from "execa";
 
 export class UnsafeCommandError extends Error {}
 
+// Mirrors the API's allowlist. The CLI re-checks it because the API (or a custom
+// GIT_PILOT_API_URL) is an untrusted source of commands. This also rejects leading
+// global options such as `git -c core.sshCommand=... fetch`.
+const ALLOWED_SUBCOMMANDS = new Set([
+  "add",
+  "branch",
+  "checkout",
+  "cherry-pick",
+  "clone",
+  "commit",
+  "diff",
+  "fetch",
+  "log",
+  "merge",
+  "pull",
+  "push",
+  "rebase",
+  "reflog",
+  "reset",
+  "restore",
+  "revert",
+  "show",
+  "stash",
+  "status",
+  "switch",
+  "tag",
+]);
+
+// Options that make git run another program or write to an arbitrary path.
+const FORBIDDEN_OPTION = /^--(upload-pack|receive-pack|exec|exec-path|output)(=|$)/;
+
+function assertSafeArgs(args) {
+  const [subcommand, ...rest] = args;
+  if (!ALLOWED_SUBCOMMANDS.has(subcommand)) {
+    throw new UnsafeCommandError(`"${subcommand}" is not an allowed git subcommand.`);
+  }
+
+  for (const arg of rest) {
+    if (arg === "--") break; // everything after is a path, not an option
+    if (
+      FORBIDDEN_OPTION.test(arg) ||
+      (subcommand === "rebase" && arg.startsWith("-x")) || // -x = --exec
+      (subcommand === "clone" && arg.startsWith("-u")) // -u = --upload-pack
+    ) {
+      throw new UnsafeCommandError(`The option "${arg}" is not allowed.`);
+    }
+  }
+}
+
 /**
  * Turns a suggested command string into an argv array for `git`, or throws.
  * Only plain `git <args...>` is accepted: quoting is honored, but shell
@@ -27,7 +76,9 @@ export function parseGitCommand(command) {
   if (tokens[0] !== "git" || tokens.length < 2) {
     throw new UnsafeCommandError("Only git commands can be executed.");
   }
-  return tokens.slice(1);
+  const args = tokens.slice(1);
+  assertSafeArgs(args);
+  return args;
 }
 
 /** Runs `git <args>` with the terminal attached. */