@bookedsolid/rea 0.21.1 → 0.23.0

package/dist/hooks/push-gate/base.js

@@ -55,9 +55,7 @@ export function resolveBaseRef(git, options = {}) {
         // some-other-branch` invocations, where the local checkout's HEAD is a
         // different branch entirely and the resulting diff would compare the
         // wrong commits.
-        const headRef = options.headRef !== undefined && options.headRef.length > 0
-            ? options.headRef
-            : 'HEAD';
+        const headRef = options.headRef !== undefined && options.headRef.length > 0 ? options.headRef : 'HEAD';
         const requested = options.lastNCommits;
         const tryDepth = (k) => git.tryRevParse(['--verify', '--quiet', `${headRef}~${k}^{commit}`]).trim();
         // Fast path: requested depth resolves directly.
@@ -164,9 +162,7 @@ export function resolveBaseRef(git, options = {}) {
     //    tracking ref (typically `refs/remotes/origin/<branch>`). Returns
     //    empty on branches without an upstream — which is normal for a brand
     //    new feature branch; fall through.
-    const upstream = git
-        .tryRevParse(['--abbrev-ref', '--symbolic-full-name', '@{upstream}'])
-        .trim();
+    const upstream = git.tryRevParse(['--abbrev-ref', '--symbolic-full-name', '@{upstream}']).trim();
     if (upstream.length > 0) {
         return { ref: upstream, source: 'upstream' };
     }

package/dist/hooks/push-gate/codex-runner.js

@@ -190,7 +190,9 @@ export async function runCodexReview(options) {
         '--json',
         '--ephemeral',
     ];
-    const args = options.prompt !== undefined && options.prompt.length > 0 ? [...baseArgs, options.prompt] : baseArgs;
+    const args = options.prompt !== undefined && options.prompt.length > 0
+        ? [...baseArgs, options.prompt]
+        : baseArgs;
     // 0.16.3 helix-016.1 #1 fix: pre-flight probe for the codex CLI before
     // we hand control to the long-running review subprocess. The original
     // try/catch around `spawner(...)` only caught synchronous ENOENT; on

package/dist/hooks/push-gate/index.js

@@ -31,7 +31,7 @@ import { resolveBaseRef } from './base.js';
 import { createRealGitExecutor, runCodexReview, CodexNotInstalledError, CodexProtocolError, CodexSubprocessError, CodexTimeoutError, IRON_GATE_DEFAULT_MODEL, IRON_GATE_DEFAULT_REASONING, } from './codex-runner.js';
 import { summarizeReview } from './findings.js';
 import { renderBanner, writeLastReview } from './report.js';
-import { isFlip, lookupVerdict, writeVerdict, } from './verdict-cache.js';
+import { isFlip, lookupVerdict, writeVerdict } from './verdict-cache.js';
 /**
  * Parse the raw pre-push stdin text into refspecs. Each line is four
  * whitespace-separated fields. Blank lines and malformed lines are
@@ -266,7 +266,9 @@ export async function runPushGate(deps) {
     }
     if (headSha.length === 0) {
         stderr('PUSH BLOCKED: could not resolve HEAD SHA. Is this a valid git repo?\n');
-        await safeAppend(appendAuditFn, deps.baseDir, EVT_ERROR, fullPolicy, { kind: 'head-sha-missing' });
+        await safeAppend(appendAuditFn, deps.baseDir, EVT_ERROR, fullPolicy, {
+            kind: 'head-sha-missing',
+        });
         return { status: 'error', exitCode: 2, summary: 'head-sha-missing' };
     }
     // 4b. Auto-narrow probe (J / 0.13.0). When the resolved base is far
@@ -317,8 +319,7 @@ export async function runPushGate(deps) {
         baseFromPushedRemoteTip;
     if (autoNarrowEligible) {
         originalCommitCount = git.revListCount(base.ref, headSha);
-        if (originalCommitCount !== null &&
-            originalCommitCount > policy.auto_narrow_threshold) {
+        if (originalCommitCount !== null && originalCommitCount > policy.auto_narrow_threshold) {
             const fallbackWindow = PUSH_GATE_DEFAULT_LAST_N_COMMITS_FALLBACK;
             const narrowed = resolveBaseRef(git, {
                 lastNCommits: fallbackWindow,
@@ -361,8 +362,8 @@ export async function runPushGate(deps) {
     const cacheLookup = policy.cache_ttl_ms > 0 ? lookupVerdict(deps.baseDir, headSha) : { hit: false };
     if (cacheLookup.hit && cacheLookup.entry !== undefined) {
         const cached = cacheLookup.entry;
-        const cachedBlocked = cached.verdict === 'blocking'
-            || (cached.verdict === 'concerns' && policy.concerns_blocks && !isConcernsOverrideSet(env));
+        const cachedBlocked = cached.verdict === 'blocking' ||
+            (cached.verdict === 'concerns' && policy.concerns_blocks && !isConcernsOverrideSet(env));
         // 0.19.1 P3-3 (code-reviewer): emit EVT_CACHE_HIT (forensic detail
         // for the cache layer specifically) AND EVT_REVIEWED (the canonical
         // verdict event with `cache_hit: true` metadata). Operators
@@ -421,10 +422,8 @@ export async function runPushGate(deps) {
                 : {}),
         });
         const summary = summarizeReview(codexResult.reviewText);
-        const blocked = summary.verdict === 'blocking'
-            || (summary.verdict === 'concerns'
-                && policy.concerns_blocks
-                && !isConcernsOverrideSet(env));
+        const blocked = summary.verdict === 'blocking' ||
+            (summary.verdict === 'concerns' && policy.concerns_blocks && !isConcernsOverrideSet(env));
         const lastReviewPath = path.join(deps.baseDir, '.rea', 'last-review.json');
         const payload = writeLastReviewFn({
             baseDir: deps.baseDir,

package/dist/policy/loader.js

@@ -63,7 +63,10 @@ const ReviewPolicySchema = z
     // (NUL, NL, CR, escape sequences) through the `-c model="<value>"`
     // injection point. Accepts published codex model names; rejects
     // re-quote / TOML-escape edge cases.
-    codex_model: z.string().regex(/^[a-zA-Z0-9._-]{1,64}$/).optional(),
+    codex_model: z
+        .string()
+        .regex(/^[a-zA-Z0-9._-]{1,64}$/)
+        .optional(),
     /**
      * Codex reasoning effort knob (0.13.4+). Pinned via
      * `-c model_reasoning_effort="<level>"` on every invocation. Only

package/dist/registry/tofu-gate.js

@@ -23,8 +23,8 @@
  */
 import { Tier, InvocationStatus } from '../policy/types.js';
 import { appendAuditRecord } from '../audit/append.js';
-import { loadFingerprintStore, saveFingerprintStore, } from './fingerprints-store.js';
-import { classifyServers, updateStore, } from './tofu.js';
+import { loadFingerprintStore, saveFingerprintStore } from './fingerprints-store.js';
+import { classifyServers, updateStore } from './tofu.js';
 import { createLogger } from '../gateway/log.js';
 const TOFU_TOOL_NAME = 'rea.tofu';
 const TOFU_SERVER_NAME = 'rea';

package/hooks/_lib/cmd-segments.sh

@@ -87,14 +87,29 @@
 # correct. We only need the mask to suppress matching; the captured
 # payload is read off the original string.
 #
-# Limitation: ONE level of unwrapping. A wrapper inside a wrapper
-# (`bash -c "bash -c 'innermost'"`) emits only the second-level payload
-# (`bash -c 'innermost'`), not the third-level. This is enough for
-# every consumer-reported bypass; deeper nesting can be added later
-# without changing the contract.
+# 0.21.2 helix-022 #3: recurse to fixed point with depth bound 8.
+# Pre-fix the function did exactly ONE level of unwrap, so
+# `bash -lc "bash -lc 'printf x > .rea/HALT'"` emitted the
+# middle wrapper as a segment but NEVER the inner `printf x > ...`.
+# Now each extracted payload is re-fed through the unwrap until
+# either no payload is found (fixed point) or depth 8 is reached.
+# Depth limit prevents pathological inputs; on overflow the helper
+# emits a stderr advisory but does not refuse — caller falls back
+# to logical-form-only enforcement of the partial unwrap.
 _rea_unwrap_nested_shells() {
+  _rea_unwrap_at_depth "$1" 0
+}
+
+_rea_unwrap_at_depth() {
   local cmd="$1"
+  local depth="$2"
+  local max_depth=8
   printf '%s\n' "$cmd"
+  if [[ $depth -ge $max_depth ]]; then
+    printf 'rea: nested-shell unwrap depth limit (%d) reached on payload %.80s...\n' \
+      "$max_depth" "$cmd" >&2
+    return 0
+  fi
   # Build a mask where in-quote `"` `'` `;` `&` `|` characters are
   # replaced with multi-byte sentinels so the wrapper regex below
   # cannot match wrapper syntax that lives inside outer quoted prose.
@@ -172,7 +187,10 @@ _rea_unwrap_nested_shells() {
   # masked form; payload extraction reads the raw form using the same
   # offsets. Because the mask is byte-for-byte width-preserving, the
   # same RSTART/RLENGTH applies to both.
-  printf '' | awk -v raw="$cmd" -v masked="$masked" '
+  #
+  # 0.21.2: capture payloads to a local var; iterate to recurse.
+  local _unwrap_payloads
+  _unwrap_payloads=$(printf '' | awk -v raw="$cmd" -v masked="$masked" '
     BEGIN {
       # Wrapper-prefix regex: shell-name + optional flag tokens + -c-style flag.
       # Each flag token is `-` followed by 1+ letters and trailing space.
@@ -263,7 +281,14 @@ _rea_unwrap_nested_shells() {
     }
     # Empty action with no input rules — explicitly drive the loop from
     # END so awk does not require any input records.
-    END {}'
+    END {}')
+  # Recurse on each extracted payload with depth+1.
+  if [[ -n "$_unwrap_payloads" ]]; then
+    while IFS= read -r _unwrap_p; do
+      [[ -z "$_unwrap_p" ]] && continue
+      _rea_unwrap_at_depth "$_unwrap_p" $((depth + 1))
+    done <<< "$_unwrap_payloads"
+  fi
 }
 
 # Split $1 on shell command separators. Emits one segment per line on

package/hooks/_lib/interpreter-scanner.sh

@@ -0,0 +1,71 @@
+# shellcheck shell=bash
+# hooks/_lib/interpreter-scanner.sh — extract write-operation targets
+# from interpreter `-e` / `--eval` invocations.
+#
+# 0.21.2 helix-022 #2: shared between blocked-paths-bash-gate.sh and
+# protected-paths-bash-gate.sh. Pre-fix the protected gate had no
+# interpreter scanner — `node -e "fs.writeFileSync('.rea/HALT','x')"`
+# bypassed the protected-path check while the soft blocked-paths gate
+# (which had its own copy of the scanner) caught equivalent writes
+# against soft-list paths.
+#
+# Coverage:
+#   node -e | --eval | -p | --print   (also fs.writeFile / appendFile
+#                                       / createWriteStream variants)
+#   python | python2 | python3 -c     (open(...,'w'), pathlib.write_*)
+#   ruby -e                            (File.write, IO.write)
+#   perl -e                            (open + print, syswrite)
+#
+# Returns: stdout — one path per line, raw (post-quote-strip but no
+# normalization). Caller passes each through their own _normalize_target
+# / _check_token / rea_path_is_protected pipeline.
+
+# Extract write targets from an interpreter -e / --eval invocation.
+# Usage: rea_interpreter_write_targets "$segment"
+#        Returns each path on a separate line on stdout.
+#        No output means no interpreter-write-shape was detected.
+rea_interpreter_write_targets() {
+  local segment="$1"
+
+  # Node — fs.writeFileSync / fs.writeFile / fs.appendFileSync /
+  #        fs.appendFile / fs.createWriteStream
+  if [[ "$segment" =~ (^|[[:space:]])node[[:space:]]+(-e|--eval|-p|--print)[[:space:]]+ ]]; then
+    printf '%s' "$segment" \
+      | grep -oE "fs\.(writeFileSync|writeFile|appendFileSync|appendFile|createWriteStream)\([[:space:]]*[\"'][^\"']+[\"']" \
+      | sed -E "s/.*\([[:space:]]*[\"']([^\"']+)[\"'].*/\\1/" \
+      || true
+  fi
+
+  # Python — open(PATH, 'w'|'wb'|'a'|'ab'|'w+'|'r+'|'x'|'xb') |
+  #          pathlib.Path(PATH).write_text|.write_bytes
+  if [[ "$segment" =~ (^|[[:space:]])python[23]?[[:space:]]+(-c) ]]; then
+    # open(...,'w'-style)
+    printf '%s' "$segment" \
+      | grep -oE "open\([[:space:]]*[\"'][^\"']+[\"'][[:space:]]*,[[:space:]]*[\"'](w|wb|a|ab|w\+|r\+|x|xb)[\"']" \
+      | sed -E "s/open\([[:space:]]*[\"']([^\"']+)[\"'].*/\\1/" \
+      || true
+    # pathlib write_text / write_bytes
+    printf '%s' "$segment" \
+      | grep -oE "Path\([[:space:]]*[\"'][^\"']+[\"'][[:space:]]*\)\.(write_text|write_bytes)" \
+      | sed -E "s/Path\([[:space:]]*[\"']([^\"']+)[\"'].*/\\1/" \
+      || true
+  fi
+
+  # Ruby — File.write(PATH, ...) | IO.write(PATH, ...)
+  if [[ "$segment" =~ (^|[[:space:]])ruby[[:space:]]+(-e) ]]; then
+    printf '%s' "$segment" \
+      | grep -oE "(File|IO)\.write\([[:space:]]*[\"'][^\"']+[\"']" \
+      | sed -E "s/.*\([[:space:]]*[\"']([^\"']+)[\"'].*/\\1/" \
+      || true
+  fi
+
+  # Perl — open(FH, '>file') | open(FH, '>>file') | sysopen(... O_WRONLY)
+  # Conservative: capture the literal `>file` / `>>file` form, which is
+  # the common shell-style spelling Perl accepts in 2-arg open.
+  if [[ "$segment" =~ (^|[[:space:]])perl[[:space:]]+(-e) ]]; then
+    printf '%s' "$segment" \
+      | grep -oE "open\([[:space:]]*[A-Z_]+,[[:space:]]*[\"']>{1,2}[^\"']+[\"']" \
+      | sed -E "s/.*[\"']>+([^\"']+)[\"'].*/\\1/" \
+      || true
+  fi
+}

package/hooks/_lib/path-normalize.sh

@@ -58,9 +58,36 @@ resolve_parent_realpath() {
   local parent_dir
   parent_dir=$(dirname -- "$target_path")
   if [[ ! -d "$parent_dir" ]]; then
-    # Parent doesn't exist yet — caller should treat as "no realpath
-    # available" and fall back to logical-path checks. Return empty.
-    printf ''
+    # 0.21.2 helix-022 #1: parent doesn't exist on disk — but a
+    # SYMLINK along the path might. Walk up to the nearest existing
+    # ancestor, resolve THAT, then append the unresolved tail. Pre-fix
+    # this returned empty for any path whose terminal directory is
+    # created mid-segment (`mkdir -p linkroot/.husky/sub` followed by
+    # a redirect into `.husky/sub/X`); the caller fell back to logical-
+    # path-only enforcement, restoring the symlink-walk bypass.
+    local walk="$parent_dir"
+    local tail=""
+    while [[ -n "$walk" && "$walk" != "/" && "$walk" != "." && ! -d "$walk" ]]; do
+      tail="$(basename -- "$walk")${tail:+/$tail}"
+      walk="$(dirname -- "$walk")"
+    done
+    if [[ -z "$walk" || "$walk" == "/" ]]; then
+      # Walked all the way up; no existing ancestor inside the project.
+      # Caller still has the logical-path check; return empty.
+      printf ''
+      return 0
+    fi
+    local resolved_walk
+    resolved_walk=$(cd -P -- "$walk" 2>/dev/null && pwd -P 2>/dev/null) || resolved_walk=""
+    if [[ -z "$resolved_walk" ]]; then
+      printf ''
+      return 0
+    fi
+    if [[ -n "$tail" ]]; then
+      printf '%s/%s' "$resolved_walk" "$tail"
+    else
+      printf '%s' "$resolved_walk"
+    fi
     return 0
   fi
   # `cd -P` follows symlinks; `pwd -P` prints the resolved physical