@cleocode/git-shim 2026.5.20 → 2026.5.23
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/audit-log.d.ts +4 -3
- package/dist/audit-log.d.ts.map +1 -1
- package/dist/audit-log.js.map +1 -1
- package/dist/boundary.d.ts +12 -4
- package/dist/boundary.d.ts.map +1 -1
- package/dist/boundary.js +1 -0
- package/dist/boundary.js.map +1 -1
- package/dist/index.d.ts +3 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +3 -2
- package/dist/index.js.map +1 -1
- package/dist/isolation-boundary.d.ts +41 -2
- package/dist/isolation-boundary.d.ts.map +1 -1
- package/dist/isolation-boundary.js +59 -3
- package/dist/isolation-boundary.js.map +1 -1
- package/package.json +2 -2
package/dist/audit-log.d.ts
CHANGED
|
@@ -15,10 +15,11 @@ export interface AuditRecord {
|
|
|
15
15
|
/** What happened. */
|
|
16
16
|
outcome: AuditOutcome;
|
|
17
17
|
/**
|
|
18
|
-
* Boundary letter (a-d), "denylist" for legacy denylist hits,
|
|
19
|
-
* "isolation" for the T1761 cwd-outside-worktree check
|
|
18
|
+
* Boundary letter (a-d), "denylist" for legacy denylist hits,
|
|
19
|
+
* "isolation" for the T1761 cwd-outside-worktree check, or
|
|
20
|
+
* "absolute-path" for the T1852 absolute-path enforcement layer.
|
|
20
21
|
*/
|
|
21
|
-
boundary: 'a' | 'b' | 'c' | 'd' | 'denylist' | 'isolation';
|
|
22
|
+
boundary: 'a' | 'b' | 'c' | 'd' | 'denylist' | 'isolation' | 'absolute-path';
|
|
22
23
|
/** CLEO error code, when blocked. */
|
|
23
24
|
code: string;
|
|
24
25
|
/** Git subcommand. */
|
package/dist/audit-log.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../src/audit-log.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,oBAAoB,GAAG,4BAA4B,CAAC;AAE3F;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,8BAA8B;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,qBAAqB;IACrB,OAAO,EAAE,YAAY,CAAC;IACtB
|
|
1
|
+
{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../src/audit-log.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,oBAAoB,GAAG,4BAA4B,CAAC;AAE3F;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,8BAA8B;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,qBAAqB;IACrB,OAAO,EAAE,YAAY,CAAC;IACtB;;;;OAIG;IACH,QAAQ,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,UAAU,GAAG,WAAW,GAAG,eAAe,CAAC;IAC7E,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4DAA4D;IAC5D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,uCAAuC;IACvC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAK5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAmB1D"}
|
package/dist/audit-log.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../src/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../src/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA2C1C;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACpD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnF,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAmB;IAClD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IACD,8CAA8C;IAC9C,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,MAAM,CAAC,QAAQ,SAAS,MAAM,CAAC,IAAI,IAAI,CAC3E,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oCAAoC,MAAM,CAAC,QAAQ,QAAQ,MAAM,CAAC,OAAO,IAAI,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC"}
|
package/dist/boundary.d.ts
CHANGED
|
@@ -6,14 +6,22 @@
|
|
|
6
6
|
* @task T1591
|
|
7
7
|
*/
|
|
8
8
|
export interface BoundaryViolation {
|
|
9
|
-
/**
|
|
10
|
-
|
|
9
|
+
/**
|
|
10
|
+
* CLEO error code.
|
|
11
|
+
*
|
|
12
|
+
* `E_GIT_BOUNDARY_*` codes are emitted by the T1591 L2 fence predicates and
|
|
13
|
+
* the T1761 cwd-isolation check. `E_BOUNDARY_VIOLATION` is emitted by the
|
|
14
|
+
* T1852 absolute-path enforcement layer that closes the T1763 bypass vector
|
|
15
|
+
* (Edit/Write SDK tool calls with absolute paths outside the worktree).
|
|
16
|
+
*/
|
|
17
|
+
code: 'E_GIT_BOUNDARY_WORKTREE_PATH' | 'E_GIT_BOUNDARY_COMMIT_TASK_ID' | 'E_GIT_BOUNDARY_MERGE_FORBIDDEN' | 'E_GIT_BOUNDARY_CHERRY_PICK_TASK_BRANCH' | 'E_GIT_BOUNDARY_CWD_OUTSIDE_WORKTREE' | 'E_BOUNDARY_VIOLATION';
|
|
11
18
|
/**
|
|
12
19
|
* Which boundary fired — kept in audit log for grouping.
|
|
13
20
|
* Letters a-d are T1591 fence predicates; "isolation" is the T1761
|
|
14
|
-
* cwd-outside-worktree check that fires before all others
|
|
21
|
+
* cwd-outside-worktree check that fires before all others; "absolute-path"
|
|
22
|
+
* is the T1852 Edit/Write absolute-path check.
|
|
15
23
|
*/
|
|
16
|
-
boundary: 'a' | 'b' | 'c' | 'd' | 'isolation';
|
|
24
|
+
boundary: 'a' | 'b' | 'c' | 'd' | 'isolation' | 'absolute-path';
|
|
17
25
|
/** Short human-readable summary of the violation. */
|
|
18
26
|
message: string;
|
|
19
27
|
/** Suggested operator action (always includes the override path). */
|
package/dist/boundary.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"boundary.d.ts","sourceRoot":"","sources":["../src/boundary.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"boundary.d.ts","sourceRoot":"","sources":["../src/boundary.ts"],"names":[],"mappings":"AAwBA;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;OAOG;IACH,IAAI,EACA,8BAA8B,GAC9B,+BAA+B,GAC/B,gCAAgC,GAChC,wCAAwC,GACxC,qCAAqC,GACrC,sBAAsB,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,WAAW,GAAG,eAAe,CAAC;IAChE,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAQD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,iBAAiB,GAAG,IAAI,CAyB1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAoB3E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,CAE3E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,GAC5B,iBAAiB,GAAG,IAAI,CAgC1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,GAAG,EAAE;IAAE,sBAAsB,CAAC,EAAE,MAAM,CAAA;CAAE,GACvC,iBAAiB,GAAG,IAAI,CAoB1B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,iBAAiB,GAAG,IAAI,CAoB9F"}
|
package/dist/boundary.js
CHANGED
package/dist/boundary.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"boundary.js","sourceRoot":"","sources":["../src/boundary.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"boundary.js","sourceRoot":"","sources":["../src/boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAwC1D,6EAA6E;AAC7E,MAAM,eAAe,GAAG,UAAU,CAAC;AAEnC,gEAAgE;AAChE,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAE3C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAA2B,EAC3B,GAAW,EACX,YAAoB;IAEpB,uDAAuD;IACvD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,cAAc;QACjD,6EAA6E;QAC7E,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QACvD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAElC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,8BAA8B;gBACpC,QAAQ,EAAE,GAAG;gBACb,OAAO,EAAE,2BAA2B,GAAG,sCAAsC,YAAY,GAAG;gBAC5F,WAAW,EACT,sGAAsG;gBACxG,OAAO,EAAE;oBACP,cAAc,EAAE,GAAG;oBACnB,aAAa,EAAE,QAAQ;oBACvB,aAAa,EAAE,YAAY;iBAC5B;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAA2B;IAC/D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA2B;IAChE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA2B,EAC3B,cAA6B;IAE7B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,yCAAyC;IACjF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAElC,IAAI,cAAc,EAAE,CAAC;QACnB,oEAAoE;QACpE,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,cAAc,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,IAAI,EAAE,+BAA+B;gBACrC,QAAQ,EAAE,GAAG;gBACb,OAAO,EAAE,iCAAiC,OAAO,sBAAsB,cAAc,GAAG;gBACxF,WAAW,EAAE,YAAY,cAAc,gCAAgC,cAAc,iDAAiD;gBACtI,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE;aACvD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iFAAiF;IACjF,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,iCAAiC,OAAO,iCAAiC;YAClF,WAAW,EACT,8FAA8F;YAChG,OAAO,EAAE,EAAE,OAAO,EAAE;SACrB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAA2B,EAC3B,GAAwC;IAExC,uDAAuD;IACvD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,sBAAsB,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAEpD,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,sEAAsE;QAC/E,WAAW,EACT,iJAAiJ;QACnJ,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;SACrB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAA2B;IAClE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,kEAAkE;QAClE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,IAAI,EAAE,wCAAwC;oBAC9C,QAAQ,EAAE,GAAG;oBACb,OAAO,EAAE,yCAAyC,OAAO,gEAAgE;oBACzH,WAAW,EACT,0GAA0G;oBAC5G,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE;iBACpD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* @cleocode/git-shim — Harness-agnostic git fence (T1118 + T1591 + T1761).
|
|
2
|
+
* @cleocode/git-shim — Harness-agnostic git fence (T1118 + T1591 + T1761 + T1852).
|
|
3
3
|
*
|
|
4
4
|
* Re-exports the denylist + boundary predicates so other packages can inspect
|
|
5
5
|
* the shim's enforcement without executing the binary. The shim binary itself
|
|
@@ -10,6 +10,7 @@
|
|
|
10
10
|
* @task T1121
|
|
11
11
|
* @task T1591
|
|
12
12
|
* @task T1761
|
|
13
|
+
* @task T1852
|
|
13
14
|
* @packageDocumentation
|
|
14
15
|
*/
|
|
15
16
|
export type { AuditOutcome, AuditRecord } from './audit-log.js';
|
|
@@ -17,7 +18,7 @@ export { resolveAuditLogPath, writeAuditRecord } from './audit-log.js';
|
|
|
17
18
|
export type { BoundaryViolation } from './boundary.js';
|
|
18
19
|
export { commitHasInlineMessage, extractCommitMessages, validateAddPaths, validateCherryPickSource, validateCommitSubject, validateMergeAllowed, } from './boundary.js';
|
|
19
20
|
export { findDeniedOp, GIT_OP_DENYLIST, RESTRICTED_ROLES } from './denylist.js';
|
|
20
|
-
export { evaluateIsolationBoundary, isCwdInsideWorktree, MUTATION_SUBCOMMANDS, } from './isolation-boundary.js';
|
|
21
|
+
export { enforceAbsolutePathBoundary, evaluateIsolationBoundary, isCwdInsideWorktree, MUTATION_SUBCOMMANDS, } from './isolation-boundary.js';
|
|
21
22
|
export { extractTaskIdFromWorktreePath, isInsideWorktreesRoot, isPathInsideWorktree, resolveActiveWorktree, resolveCleoWorktreesRoot, resolveProjectWorktreeRoot, } from './worktree-path.js';
|
|
22
23
|
/**
|
|
23
24
|
* Install the shim symlink so that `git` resolves to this shim when
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvE,YAAY,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiC/F"}
|
package/dist/index.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* @cleocode/git-shim — Harness-agnostic git fence (T1118 + T1591 + T1761).
|
|
2
|
+
* @cleocode/git-shim — Harness-agnostic git fence (T1118 + T1591 + T1761 + T1852).
|
|
3
3
|
*
|
|
4
4
|
* Re-exports the denylist + boundary predicates so other packages can inspect
|
|
5
5
|
* the shim's enforcement without executing the binary. The shim binary itself
|
|
@@ -10,12 +10,13 @@
|
|
|
10
10
|
* @task T1121
|
|
11
11
|
* @task T1591
|
|
12
12
|
* @task T1761
|
|
13
|
+
* @task T1852
|
|
13
14
|
* @packageDocumentation
|
|
14
15
|
*/
|
|
15
16
|
export { resolveAuditLogPath, writeAuditRecord } from './audit-log.js';
|
|
16
17
|
export { commitHasInlineMessage, extractCommitMessages, validateAddPaths, validateCherryPickSource, validateCommitSubject, validateMergeAllowed, } from './boundary.js';
|
|
17
18
|
export { findDeniedOp, GIT_OP_DENYLIST, RESTRICTED_ROLES } from './denylist.js';
|
|
18
|
-
export { evaluateIsolationBoundary, isCwdInsideWorktree, MUTATION_SUBCOMMANDS, } from './isolation-boundary.js';
|
|
19
|
+
export { enforceAbsolutePathBoundary, evaluateIsolationBoundary, isCwdInsideWorktree, MUTATION_SUBCOMMANDS, } from './isolation-boundary.js';
|
|
19
20
|
export { extractTaskIdFromWorktreePath, isInsideWorktreesRoot, isPathInsideWorktree, resolveActiveWorktree, resolveCleoWorktreesRoot, resolveProjectWorktreeRoot, } from './worktree-path.js';
|
|
20
21
|
/**
|
|
21
22
|
* Install the shim symlink so that `git` resolves to this shim when
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvE,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,WAAmB;IAC3E,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEtC,qDAAqD;IACrD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;YAC3D,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,UAAU,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACnC,wCAAwC;QACxC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC"}
|
|
@@ -7,16 +7,26 @@
|
|
|
7
7
|
* somehow drifts to the main project root, any mutation subcommand is blocked
|
|
8
8
|
* with exit code 77 and a structured `cwd-outside-worktree` error.
|
|
9
9
|
*
|
|
10
|
+
* Also exposes `enforceAbsolutePathBoundary` (T1852), which closes the T1763
|
|
11
|
+
* bypass vector: worker agents using Edit/Write SDK tool calls with absolute
|
|
12
|
+
* paths outside their worktree. This check operates at the SDK tool interception
|
|
13
|
+
* level rather than the git binary level, enforcing path rules from a
|
|
14
|
+
* {@link BoundaryContract} produced by `provisionIsolatedShell`.
|
|
15
|
+
*
|
|
10
16
|
* Design:
|
|
11
17
|
* - Reads env keys via `ISOLATION_ENV_KEYS` from `@cleocode/contracts` —
|
|
12
18
|
* the single source of truth — so the key names are never duplicated here.
|
|
13
19
|
* - Pure functions: no I/O, no spawning, easy to unit-test.
|
|
14
|
-
* - Only `CLEO_AGENT_ROLE=worker` (exact match) triggers the check —
|
|
15
|
-
* subagent / orchestrator are not subject to this isolation constraint.
|
|
20
|
+
* - Only `CLEO_AGENT_ROLE=worker` (exact match) triggers the cwd check —
|
|
21
|
+
* lead / subagent / orchestrator are not subject to this isolation constraint.
|
|
22
|
+
* - `enforceAbsolutePathBoundary` respects the `deniedOutsideWorktree` flag
|
|
23
|
+
* from the contract — callers with `false` (orchestrator opt-out) pass through.
|
|
16
24
|
*
|
|
17
25
|
* @task T1761
|
|
26
|
+
* @task T1852
|
|
18
27
|
* @adr ADR-055
|
|
19
28
|
*/
|
|
29
|
+
import { type BoundaryContract } from '@cleocode/contracts';
|
|
20
30
|
import type { BoundaryViolation } from './boundary.js';
|
|
21
31
|
/**
|
|
22
32
|
* Mutation subcommands that write to the git index or create commits.
|
|
@@ -67,4 +77,33 @@ export declare function isCwdInsideWorktree(cwd: string, worktreeRoot: string):
|
|
|
67
77
|
* @task T1761
|
|
68
78
|
*/
|
|
69
79
|
export declare function evaluateIsolationBoundary(subcommand: string): BoundaryViolation | null;
|
|
80
|
+
/**
|
|
81
|
+
* Enforce the absolute-path isolation boundary for Edit/Write SDK tool operations.
|
|
82
|
+
*
|
|
83
|
+
* Closes the T1763 bypass vector: a worker agent that uses Edit/Write with an
|
|
84
|
+
* absolute path pointing outside its worktree (e.g. into `/mnt/projects/...`)
|
|
85
|
+
* could circumvent the git-shim, which only intercepts `git` binary calls.
|
|
86
|
+
* This function enforces the `absolutePathRules` from the agent's
|
|
87
|
+
* {@link BoundaryContract} — the same contract produced by `provisionIsolatedShell`
|
|
88
|
+
* and consumed by the SDK tool interception layer.
|
|
89
|
+
*
|
|
90
|
+
* This check is ADDITIVE — it does not replace or modify the T1761 cwd boundary
|
|
91
|
+
* check ({@link evaluateIsolationBoundary}), which remains unchanged.
|
|
92
|
+
*
|
|
93
|
+
* Implementation delegates to `validateAbsolutePath` from `@cleocode/contracts`,
|
|
94
|
+
* which is the canonical pure-function enforcement point for this rule. The
|
|
95
|
+
* wrapper maps the result to a {@link BoundaryViolation} so callers consume a
|
|
96
|
+
* uniform type across all shim enforcement layers.
|
|
97
|
+
*
|
|
98
|
+
* @param absolutePath - The absolute path supplied to the Edit or Write operation.
|
|
99
|
+
* @param contract - The boundary contract for the current agent session, produced
|
|
100
|
+
* by `provisionIsolatedShell`. When `contract.absolutePathRules.deniedOutsideWorktree`
|
|
101
|
+
* is `false`, the call always returns `null` (orchestrator opt-out).
|
|
102
|
+
* @returns A {@link BoundaryViolation} when the path is outside the permitted
|
|
103
|
+
* boundary, or `null` when the path is allowed.
|
|
104
|
+
*
|
|
105
|
+
* @task T1852
|
|
106
|
+
* @see {@link validateAbsolutePath} in `@cleocode/contracts` (canonical enforcer)
|
|
107
|
+
*/
|
|
108
|
+
export declare function enforceAbsolutePathBoundary(absolutePath: string, contract: BoundaryContract): BoundaryViolation | null;
|
|
70
109
|
//# sourceMappingURL=isolation-boundary.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"isolation-boundary.d.ts","sourceRoot":"","sources":["../src/isolation-boundary.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"isolation-boundary.d.ts","sourceRoot":"","sources":["../src/isolation-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EACL,KAAK,gBAAgB,EAGtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAQnD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAI9E;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CA4BtF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,2BAA2B,CACzC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,gBAAgB,GACzB,iBAAiB,GAAG,IAAI,CAmB1B"}
|
|
@@ -7,18 +7,27 @@
|
|
|
7
7
|
* somehow drifts to the main project root, any mutation subcommand is blocked
|
|
8
8
|
* with exit code 77 and a structured `cwd-outside-worktree` error.
|
|
9
9
|
*
|
|
10
|
+
* Also exposes `enforceAbsolutePathBoundary` (T1852), which closes the T1763
|
|
11
|
+
* bypass vector: worker agents using Edit/Write SDK tool calls with absolute
|
|
12
|
+
* paths outside their worktree. This check operates at the SDK tool interception
|
|
13
|
+
* level rather than the git binary level, enforcing path rules from a
|
|
14
|
+
* {@link BoundaryContract} produced by `provisionIsolatedShell`.
|
|
15
|
+
*
|
|
10
16
|
* Design:
|
|
11
17
|
* - Reads env keys via `ISOLATION_ENV_KEYS` from `@cleocode/contracts` —
|
|
12
18
|
* the single source of truth — so the key names are never duplicated here.
|
|
13
19
|
* - Pure functions: no I/O, no spawning, easy to unit-test.
|
|
14
|
-
* - Only `CLEO_AGENT_ROLE=worker` (exact match) triggers the check —
|
|
15
|
-
* subagent / orchestrator are not subject to this isolation constraint.
|
|
20
|
+
* - Only `CLEO_AGENT_ROLE=worker` (exact match) triggers the cwd check —
|
|
21
|
+
* lead / subagent / orchestrator are not subject to this isolation constraint.
|
|
22
|
+
* - `enforceAbsolutePathBoundary` respects the `deniedOutsideWorktree` flag
|
|
23
|
+
* from the contract — callers with `false` (orchestrator opt-out) pass through.
|
|
16
24
|
*
|
|
17
25
|
* @task T1761
|
|
26
|
+
* @task T1852
|
|
18
27
|
* @adr ADR-055
|
|
19
28
|
*/
|
|
20
29
|
import { resolve } from 'node:path';
|
|
21
|
-
import { ISOLATION_ENV_KEYS } from '@cleocode/contracts';
|
|
30
|
+
import { ISOLATION_ENV_KEYS, validateAbsolutePath, } from '@cleocode/contracts';
|
|
22
31
|
/**
|
|
23
32
|
* Mutation subcommands that write to the git index or create commits.
|
|
24
33
|
*
|
|
@@ -106,4 +115,51 @@ export function evaluateIsolationBoundary(subcommand) {
|
|
|
106
115
|
},
|
|
107
116
|
};
|
|
108
117
|
}
|
|
118
|
+
/**
|
|
119
|
+
* Enforce the absolute-path isolation boundary for Edit/Write SDK tool operations.
|
|
120
|
+
*
|
|
121
|
+
* Closes the T1763 bypass vector: a worker agent that uses Edit/Write with an
|
|
122
|
+
* absolute path pointing outside its worktree (e.g. into `/mnt/projects/...`)
|
|
123
|
+
* could circumvent the git-shim, which only intercepts `git` binary calls.
|
|
124
|
+
* This function enforces the `absolutePathRules` from the agent's
|
|
125
|
+
* {@link BoundaryContract} — the same contract produced by `provisionIsolatedShell`
|
|
126
|
+
* and consumed by the SDK tool interception layer.
|
|
127
|
+
*
|
|
128
|
+
* This check is ADDITIVE — it does not replace or modify the T1761 cwd boundary
|
|
129
|
+
* check ({@link evaluateIsolationBoundary}), which remains unchanged.
|
|
130
|
+
*
|
|
131
|
+
* Implementation delegates to `validateAbsolutePath` from `@cleocode/contracts`,
|
|
132
|
+
* which is the canonical pure-function enforcement point for this rule. The
|
|
133
|
+
* wrapper maps the result to a {@link BoundaryViolation} so callers consume a
|
|
134
|
+
* uniform type across all shim enforcement layers.
|
|
135
|
+
*
|
|
136
|
+
* @param absolutePath - The absolute path supplied to the Edit or Write operation.
|
|
137
|
+
* @param contract - The boundary contract for the current agent session, produced
|
|
138
|
+
* by `provisionIsolatedShell`. When `contract.absolutePathRules.deniedOutsideWorktree`
|
|
139
|
+
* is `false`, the call always returns `null` (orchestrator opt-out).
|
|
140
|
+
* @returns A {@link BoundaryViolation} when the path is outside the permitted
|
|
141
|
+
* boundary, or `null` when the path is allowed.
|
|
142
|
+
*
|
|
143
|
+
* @task T1852
|
|
144
|
+
* @see {@link validateAbsolutePath} in `@cleocode/contracts` (canonical enforcer)
|
|
145
|
+
*/
|
|
146
|
+
export function enforceAbsolutePathBoundary(absolutePath, contract) {
|
|
147
|
+
const result = validateAbsolutePath(absolutePath, contract);
|
|
148
|
+
if (result.allowed)
|
|
149
|
+
return null;
|
|
150
|
+
return {
|
|
151
|
+
code: 'E_BOUNDARY_VIOLATION',
|
|
152
|
+
boundary: 'absolute-path',
|
|
153
|
+
message: result.message,
|
|
154
|
+
remediation: 'Use a path within your assigned worktree. ' +
|
|
155
|
+
'To allow additional write targets, add the prefix to AbsolutePathRules.allowedPrefixes ' +
|
|
156
|
+
'when provisioning the isolated shell. ' +
|
|
157
|
+
'Emergency bypass: set CLEO_ALLOW_GIT=1 (audited).',
|
|
158
|
+
context: {
|
|
159
|
+
attempted_path: absolutePath,
|
|
160
|
+
worktree_root: contract.worktreeRoot,
|
|
161
|
+
allowed_prefixes: contract.absolutePathRules.allowedPrefixes.join(', '),
|
|
162
|
+
},
|
|
163
|
+
};
|
|
164
|
+
}
|
|
109
165
|
//# sourceMappingURL=isolation-boundary.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"isolation-boundary.js","sourceRoot":"","sources":["../src/isolation-boundary.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"isolation-boundary.js","sourceRoot":"","sources":["../src/isolation-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAEL,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAG7B;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAC/D,KAAK;IACL,QAAQ;IACR,IAAI;IACJ,IAAI;IACJ,SAAS;IACT,OAAO;IACP,IAAI;CACL,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,YAAoB;IACnE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3C,OAAO,WAAW,KAAK,YAAY,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,6DAA6D;IAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/B,6DAA6D;IAC7D,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,IAAI,mBAAmB,CAAC,GAAG,EAAE,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAExD,OAAO;QACL,IAAI,EAAE,qCAAqC;QAC3C,QAAQ,EAAE,WAAW;QACrB,OAAO,EACL,OAAO,UAAU,mBAAmB,GAAG,qCAAqC;YAC5E,IAAI,YAAY,4BAA4B;QAC9C,WAAW,EACT,4DAA4D;YAC5D,mEAAmE;QACrE,OAAO,EAAE;YACP,GAAG;YACH,aAAa,EAAE,YAAY;YAC3B,IAAI,EAAE,QAAQ;SACf;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,2BAA2B,CACzC,YAAoB,EACpB,QAA0B;IAE1B,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAEhC,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,eAAe;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EACT,4CAA4C;YAC5C,yFAAyF;YACzF,wCAAwC;YACxC,mDAAmD;QACrD,OAAO,EAAE;YACP,cAAc,EAAE,YAAY;YAC5B,aAAa,EAAE,QAAQ,CAAC,YAAY;YACpC,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;SACxE;KACF,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cleocode/git-shim",
|
|
3
|
-
"version": "2026.5.
|
|
3
|
+
"version": "2026.5.23",
|
|
4
4
|
"private": false,
|
|
5
5
|
"type": "module",
|
|
6
6
|
"description": "Harness-agnostic git shim for CLEO agent branch-protection (T1118)",
|
|
@@ -32,7 +32,7 @@
|
|
|
32
32
|
"author": "CLEO Code <hello@cleocode.dev>",
|
|
33
33
|
"license": "MIT",
|
|
34
34
|
"dependencies": {
|
|
35
|
-
"@cleocode/contracts": "2026.5.
|
|
35
|
+
"@cleocode/contracts": "2026.5.23"
|
|
36
36
|
},
|
|
37
37
|
"devDependencies": {
|
|
38
38
|
"@types/node": "^24.3.0",
|