@blogic-cz/agent-tools 1.6.17 → 1.6.19

package/src/credential-guard/passive-jq.ts

@@ -0,0 +1,159 @@
+/** Closed admission grammar, not an evaluator. Unknown syntax never acquires a proof. */
+export function isPassiveJqFilter(filter: string): boolean {
+  if (filter.length > 65_536) return false;
+  if (new TextEncoder().encode(filter).byteLength > 65_536) return false;
+  const tokens: string[] = [];
+  const lexer =
+    /\s+|"(?:[^"\\\x00-\x1f]|\\(?:["\\/bfnrt]|u[0-9a-fA-F]{4}))*"|(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?|[A-Za-z_][A-Za-z0-9_]*|\/\/|==|!=|<=|>=|[.{}[\]():,?|+*/%<>-]/y; // eslint-disable-line eslint/no-control-regex -- JSON strings exclude literal control bytes.
+  let offset = 0;
+  while (offset < filter.length) {
+    lexer.lastIndex = offset;
+    const match = lexer.exec(filter);
+    if (!match) return false;
+    offset = lexer.lastIndex;
+    if (!/^\s/.test(match[0])) tokens.push(match[0]);
+    if (tokens.length > 4096) return false;
+  }
+  let position = 0;
+  const take = (token: string): boolean => {
+    if (tokens[position] !== token) return false;
+    position++;
+    return true;
+  };
+  const identifier = (token: string | undefined): boolean =>
+    /^[A-Za-z_][A-Za-z0-9_]*$/.test(token ?? "");
+  const string = (token: string | undefined): boolean => token?.startsWith('"') === true;
+  const number = (token: string | undefined): boolean => /^[0-9]/.test(token ?? "");
+  const noArgs = new Set([
+    "length",
+    "keys",
+    "keys_unsorted",
+    "type",
+    "values",
+    "empty",
+    "add",
+    "min",
+    "max",
+    "sort",
+    "unique",
+    "flatten",
+    "not",
+    "reverse",
+    "to_entries",
+    "from_entries",
+  ]);
+  const oneArg = new Set([
+    "map",
+    "map_values",
+    "select",
+    "contains",
+    "has",
+    "sort_by",
+    "group_by",
+    "unique_by",
+    "any",
+    "all",
+    "join",
+  ]);
+  const operators = new Set([
+    "|",
+    "//",
+    "==",
+    "!=",
+    "<",
+    ">",
+    "<=",
+    ">=",
+    "+",
+    "-",
+    "*",
+    "/",
+    "%",
+    "and",
+    "or",
+  ]);
+  const expression = (depth: number, commas = false): boolean => {
+    if (depth > 64 || !term(depth)) return false;
+    const nextOperator = () =>
+      operators.has(tokens[position] ?? "") || (commas && tokens[position] === ",");
+    while (nextOperator()) {
+      position++;
+      if (!term(depth)) return false;
+    }
+    return true;
+  };
+  const term = (depth: number): boolean => {
+    if (take("-")) return number(tokens[position]) && (position++, true);
+    if (take(".")) {
+      if (identifier(tokens[position]) || string(tokens[position])) position++;
+    } else if (take("(")) {
+      if (!expression(depth + 1, true) || !take(")")) return false;
+    } else if (take("[")) {
+      if (!take("]") && (!expression(depth + 1, true) || !take("]"))) return false;
+    } else if (take("{")) {
+      if (!take("}")) {
+        do {
+          const key = tokens[position];
+          if (!identifier(key) && !string(key)) return false;
+          position++;
+          if (take(":")) {
+            if (!expression(depth + 1)) return false;
+          } else if (!identifier(key)) return false;
+        } while (take(","));
+        if (!take("}")) return false;
+      }
+    } else {
+      const token = tokens[position];
+      if (string(token) || number(token) || ["true", "false", "null"].includes(token ?? ""))
+        position++;
+      else if (noArgs.has(token ?? "")) position++;
+      else if (oneArg.has(token ?? "")) {
+        position++;
+        if (!take("(") || !expression(depth + 1) || !take(")")) return false;
+      } else return false;
+    }
+    while (true) {
+      if (take("?")) continue;
+      if (take(".")) {
+        if (!identifier(tokens[position]) && !string(tokens[position])) return false;
+        position++;
+      } else if (take("[")) {
+        if (!take("]")) {
+          if (take("-")) {
+            if (!number(tokens[position])) return false;
+            position++;
+          } else if (string(tokens[position]) || number(tokens[position])) position++;
+          else return false;
+          if (!take("]")) return false;
+        }
+      } else break;
+    }
+    return true;
+  };
+  return expression(0, true) && position === tokens.length;
+}
+
+/** Only known formatting/input flags and one literal program, followed by file operands. */
+export function passiveJqProgramIndex(argv: string[]): number | undefined {
+  if (argv[0]?.split("/").at(-1) !== "jq") return undefined;
+  const longOptions = new Set([
+    "--raw-output",
+    "--raw-input",
+    "--compact-output",
+    "--slurp",
+    "--monochrome-output",
+    "--color-output",
+    "--null-input",
+    "--exit-status",
+    "--ascii-output",
+    "--join-output",
+    "--sort-keys",
+    "--unbuffered",
+    "--tab",
+  ]);
+  let index = 1;
+  while (/^-[rRcMsScneaj]+$/.test(argv[index] ?? "") || longOptions.has(argv[index] ?? "")) index++;
+  if (argv[index] === "--") index++;
+  if (argv.slice(index + 1).some((arg) => arg.startsWith("-") && arg !== "-")) return undefined;
+  return isPassiveJqFilter(argv[index] ?? "") ? index : undefined;
+}

package/src/gh-tool/pr/commands.ts

@@ -747,6 +747,10 @@ export const prMergeCommand = Command.make(
       Flag.withDefault(DEFAULT_DELETE_BRANCH),
     ),
     format: formatOption,
+    matchHeadCommit: Flag.String("match-head-commit").pipe(
+      Flag.withDescription("Require the PR head to match this full reviewed commit SHA"),
+      Flag.optional,
+    ),
     pr: Flag.Int("pr").pipe(Flag.withDescription("PR number to merge")),
     repo: repoOption,
     strategy: Flag.Literals("strategy", MERGE_STRATEGIES).pipe(
@@ -754,13 +758,14 @@ export const prMergeCommand = Command.make(
       Flag.withDefault(DEFAULT_MERGE_STRATEGY),
     ),
   },
-  ({ confirm, deleteBranch, format, pr, repo, strategy }) =>
+  ({ confirm, deleteBranch, format, matchHeadCommit, pr, repo, strategy }) =>
     withRepo(
       repo,
       Effect.gen(function* () {
         const result = yield* mergePR({
           confirm,
           deleteBranch,
+          matchHeadCommit: Option.getOrUndefined(matchHeadCommit),
           pr,
           strategy,
         });

package/src/gh-tool/pr/core.ts

@@ -43,6 +43,8 @@ const STABLE_SNAPSHOT_ATTEMPTS = 3;
 const GITHUB_ACTIONS_RUN_ID_RE = /github\.com\/[^/]+\/[^/]+\/actions\/runs\/(\d+)/;
 const MERGE_SHA_POLL_INTERVAL_MS = 1000;
 const MERGE_SHA_WAIT_SECONDS = 5;
+const isFullCommitSha = (value: unknown): value is string =>
+  typeof value === "string" && value.length === 40 && /^[0-9a-f]+$/i.test(value);
 
 const validatePRTitle = Effect.fn("pr.validatePRTitle")(function* (title: string) {
   const gh = yield* GitHubService;
@@ -930,16 +932,54 @@ export const mergePR = Effect.fn("pr.mergePR")(function* (opts: {
   strategy: MergeStrategy;
   deleteBranch: boolean;
   confirm: boolean;
+  matchHeadCommit?: string;
 }) {
   const gh = yield* GitHubService;
+  const matchHeadCommit = opts.matchHeadCommit;
 
-  const info = yield* gh.runGhJson<PRViewJsonResult>([
-    "pr",
-    "view",
-    String(opts.pr),
-    "--json",
-    "number,url,title,headRefName,baseRefName,state,isDraft,mergeable",
-  ]);
+  if (matchHeadCommit !== undefined && !isFullCommitSha(matchHeadCommit)) {
+    return yield* new GitHubMergeError({
+      message: "--match-head-commit must be a full 40-character hexadecimal commit SHA",
+      reason: "unknown",
+      hint: "Provide the complete reviewed head commit SHA before retrying.",
+      nextCommand: `agent-tools-gh pr view --pr ${opts.pr}`,
+    });
+  }
+
+  const info = yield* gh
+    .runGhJson<PRViewJsonResult & { headRefOid?: unknown }>([
+      "pr",
+      "view",
+      String(opts.pr),
+      "--json",
+      "number,url,title,headRefName,baseRefName,state,isDraft,mergeable" +
+        (matchHeadCommit !== undefined ? ",headRefOid" : ""),
+    ])
+    .pipe(
+      Effect.mapError((error) =>
+        matchHeadCommit === undefined
+          ? error
+          : new GitHubMergeError({
+              message: `Could not verify the head commit of PR #${opts.pr}: ${error.message}`,
+              reason: "unknown",
+              hint: "The merge is refused while the head is unknown. Re-read the PR and verify its reviewed head before retrying.",
+              nextCommand: `agent-tools-gh pr view --pr ${opts.pr}`,
+            }),
+      ),
+    );
+
+  if (
+    matchHeadCommit !== undefined &&
+    (!isFullCommitSha(info?.headRefOid) ||
+      info.headRefOid.toLowerCase() !== matchHeadCommit.toLowerCase())
+  ) {
+    return yield* new GitHubMergeError({
+      message: `PR #${opts.pr} head does not match the reviewed commit ${matchHeadCommit}`,
+      reason: "unknown",
+      hint: "The head is missing, invalid, or changed. Re-read the PR and review its current head before retrying with that SHA.",
+      nextCommand: `agent-tools-gh pr view --pr ${opts.pr}`,
+    });
+  }
 
   const repo = opts.deleteBranch ? yield* gh.getRepoInfo() : null;
 
@@ -1120,6 +1160,9 @@ export const mergePR = Effect.fn("pr.mergePR")(function* (opts: {
   });
 
   const mergeArgs = ["pr", "merge", String(opts.pr), `--${opts.strategy}`];
+  if (matchHeadCommit !== undefined) {
+    mergeArgs.push("--match-head-commit", matchHeadCommit);
+  }
 
   const shaFromAsyncMerge = yield* gh
     .runGh(mergeArgs)
@@ -1127,7 +1170,16 @@ export const mergePR = Effect.fn("pr.mergePR")(function* (opts: {
       Effect.map(() => null),
       Effect.catchTag("GitHubCommandError", (error) =>
         ASYNC_MERGE_REQUIRED_RE.test(error.stderr)
-          ? mergeViaAsyncApi({ pr: opts.pr, strategy: opts.strategy })
+          ? matchHeadCommit !== undefined
+            ? Effect.fail(
+                new GitHubMergeError({
+                  message: `PR #${opts.pr} requires an asynchronous merge that cannot enforce --match-head-commit`,
+                  reason: "unknown",
+                  hint: "The asynchronous fallback was refused because its exact-head condition is unsupported. Keep the reviewed SHA requirement and use a merge path that enforces it after reviewing the current head.",
+                  nextCommand: `agent-tools-gh pr view --pr ${opts.pr}`,
+                }),
+              )
+            : mergeViaAsyncApi({ pr: opts.pr, strategy: opts.strategy })
           : Effect.fail(error),
       ),
     )