@cleocode/git-shim 2026.9.8 → 2026.9.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"shim.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/shim.test.ts"],"names":[],"mappings":""}
|
|
@@ -0,0 +1,239 @@
|
|
|
1
|
+
import { spawn } from 'node:child_process';
|
|
2
|
+
import { chmodSync, copyFileSync, linkSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync, } from 'node:fs';
|
|
3
|
+
import { tmpdir } from 'node:os';
|
|
4
|
+
import { dirname, join, resolve } from 'node:path';
|
|
5
|
+
import { fileURLToPath } from 'node:url';
|
|
6
|
+
import { buildSync } from 'esbuild';
|
|
7
|
+
import { afterAll, beforeAll, describe, expect, it } from 'vitest';
|
|
8
|
+
const repo = resolve(dirname(fileURLToPath(import.meta.url)), '../../../..');
|
|
9
|
+
let root;
|
|
10
|
+
let shim;
|
|
11
|
+
let sentry;
|
|
12
|
+
beforeAll(() => {
|
|
13
|
+
root = mkdtempSync(join(tmpdir(), 'cleo-git-identity-'));
|
|
14
|
+
shim = join(root, 'package', 'dist', 'shim.mjs');
|
|
15
|
+
buildSync({
|
|
16
|
+
entryPoints: [join(repo, 'packages/git-shim/src/shim.ts')],
|
|
17
|
+
outfile: shim,
|
|
18
|
+
bundle: true,
|
|
19
|
+
platform: 'node',
|
|
20
|
+
format: 'esm',
|
|
21
|
+
alias: {
|
|
22
|
+
'@cleocode/paths': join(repo, 'packages/paths/src/index.ts'),
|
|
23
|
+
'@cleocode/contracts': join(repo, 'packages/contracts/src/index.ts'),
|
|
24
|
+
},
|
|
25
|
+
});
|
|
26
|
+
chmodSync(shim, 0o755);
|
|
27
|
+
sentry = join(root, 'sentry.mjs');
|
|
28
|
+
// Independent safety control: even defective source can launch at most five
|
|
29
|
+
// successive Node children. No tested production guard is trusted for cleanup.
|
|
30
|
+
writeFileSync(sentry, "const n=Number(process.env.SHIM_TEST_DEPTH??'0')+1;" +
|
|
31
|
+
"process.env.SHIM_TEST_DEPTH=String(n);if(n>5){process.stderr.write('RECURSION_SENTRY');process.exit(88);}");
|
|
32
|
+
});
|
|
33
|
+
afterAll(() => rmSync(root, { recursive: true, force: true }));
|
|
34
|
+
function fixture() {
|
|
35
|
+
const directory = mkdtempSync(join(root, 'case-'));
|
|
36
|
+
mkdirSync(join(directory, 'bin'));
|
|
37
|
+
symlinkSync(process.execPath, join(directory, 'bin', 'node'));
|
|
38
|
+
return directory;
|
|
39
|
+
}
|
|
40
|
+
function realGit(directory) {
|
|
41
|
+
const binary = join(directory, 'git');
|
|
42
|
+
writeFileSync(binary, '#!/bin/sh\nprintf "REAL_GIT:%s\\n" "$*"\n');
|
|
43
|
+
chmodSync(binary, 0o755);
|
|
44
|
+
return binary;
|
|
45
|
+
}
|
|
46
|
+
async function invoke(directory, entry, path, args = ['--version'], extra = {}) {
|
|
47
|
+
const child = spawn(entry, args, {
|
|
48
|
+
cwd: directory,
|
|
49
|
+
detached: true,
|
|
50
|
+
env: {
|
|
51
|
+
HOME: directory,
|
|
52
|
+
XDG_DATA_HOME: directory,
|
|
53
|
+
PATH: [...path, join(directory, 'bin')].join(':'),
|
|
54
|
+
NODE_OPTIONS: `--import=${sentry} --max-old-space-size=128`,
|
|
55
|
+
CLEO_AUDIT_LOG_PATH: join(directory, 'audit.jsonl'),
|
|
56
|
+
...extra,
|
|
57
|
+
},
|
|
58
|
+
stdio: ['ignore', 'pipe', 'pipe'],
|
|
59
|
+
});
|
|
60
|
+
let stdout = '';
|
|
61
|
+
let stderr = '';
|
|
62
|
+
let timedOut = false;
|
|
63
|
+
const killOwned = () => {
|
|
64
|
+
if (!child.pid)
|
|
65
|
+
return;
|
|
66
|
+
try {
|
|
67
|
+
process.kill(-child.pid, 'SIGKILL');
|
|
68
|
+
}
|
|
69
|
+
catch (error) {
|
|
70
|
+
if (!(error instanceof Error) || !('code' in error) || error.code !== 'ESRCH')
|
|
71
|
+
throw error;
|
|
72
|
+
}
|
|
73
|
+
};
|
|
74
|
+
const timeout = setTimeout(() => {
|
|
75
|
+
timedOut = true;
|
|
76
|
+
killOwned();
|
|
77
|
+
}, 4000);
|
|
78
|
+
child.stdout.on('data', (chunk) => {
|
|
79
|
+
stdout += chunk.toString();
|
|
80
|
+
if (stdout.length > 32768)
|
|
81
|
+
killOwned();
|
|
82
|
+
});
|
|
83
|
+
child.stderr.on('data', (chunk) => {
|
|
84
|
+
stderr += chunk.toString();
|
|
85
|
+
if (stderr.length > 32768)
|
|
86
|
+
killOwned();
|
|
87
|
+
});
|
|
88
|
+
try {
|
|
89
|
+
const status = await new Promise((resolveStatus, reject) => {
|
|
90
|
+
child.once('error', reject);
|
|
91
|
+
child.once('close', resolveStatus);
|
|
92
|
+
});
|
|
93
|
+
expect(timedOut).toBe(false);
|
|
94
|
+
return [status, stdout, stderr];
|
|
95
|
+
}
|
|
96
|
+
finally {
|
|
97
|
+
clearTimeout(timeout);
|
|
98
|
+
killOwned();
|
|
99
|
+
}
|
|
100
|
+
}
|
|
101
|
+
describe('installed executable identity', () => {
|
|
102
|
+
it('skips the npm .bin symlink and delegates to a later executable', async () => {
|
|
103
|
+
const dir = fixture();
|
|
104
|
+
const bin = join(dir, 'node_modules', '.bin');
|
|
105
|
+
mkdirSync(bin, { recursive: true });
|
|
106
|
+
symlinkSync(shim, join(bin, 'git'));
|
|
107
|
+
realGit(dir);
|
|
108
|
+
expect(await invoke(dir, join(bin, 'git'), [bin, dir])).toEqual([
|
|
109
|
+
0,
|
|
110
|
+
'REAL_GIT:--version\n',
|
|
111
|
+
'',
|
|
112
|
+
]);
|
|
113
|
+
});
|
|
114
|
+
it('skips a hardlink of the executing shim', async () => {
|
|
115
|
+
const dir = fixture();
|
|
116
|
+
linkSync(shim, join(dir, 'bin', 'git'));
|
|
117
|
+
realGit(dir);
|
|
118
|
+
expect(await invoke(dir, shim, [join(dir, 'bin'), dir])).toEqual([
|
|
119
|
+
0,
|
|
120
|
+
'REAL_GIT:--version\n',
|
|
121
|
+
'',
|
|
122
|
+
]);
|
|
123
|
+
});
|
|
124
|
+
it.each(['symlink', 'hardlink'])('rejects explicit self via %s', async (kind) => {
|
|
125
|
+
const dir = fixture();
|
|
126
|
+
const alias = join(dir, 'self');
|
|
127
|
+
if (kind === 'symlink')
|
|
128
|
+
symlinkSync(shim, alias);
|
|
129
|
+
else
|
|
130
|
+
linkSync(shim, alias);
|
|
131
|
+
const [status, stdout, stderr] = await invoke(dir, shim, [], ['--version'], {
|
|
132
|
+
CLEO_REAL_GIT_PATH: alias,
|
|
133
|
+
});
|
|
134
|
+
expect(status).toBe(1);
|
|
135
|
+
expect(stdout).toBe('');
|
|
136
|
+
expect(stderr).toContain('CLEO_REAL_GIT_PATH');
|
|
137
|
+
expect(stderr).not.toContain('RECURSION_SENTRY');
|
|
138
|
+
});
|
|
139
|
+
it('carries identities through two different shim copies without bouncing', async () => {
|
|
140
|
+
const dir = fixture();
|
|
141
|
+
const second = join(dir, 'second');
|
|
142
|
+
mkdirSync(second);
|
|
143
|
+
copyFileSync(shim, join(second, 'git'));
|
|
144
|
+
chmodSync(join(second, 'git'), 0o755);
|
|
145
|
+
symlinkSync(shim, join(dir, 'bin', 'git'));
|
|
146
|
+
realGit(dir);
|
|
147
|
+
expect(await invoke(dir, shim, [second, join(dir, 'bin'), dir])).toEqual([
|
|
148
|
+
0,
|
|
149
|
+
'REAL_GIT:--version\n',
|
|
150
|
+
'',
|
|
151
|
+
]);
|
|
152
|
+
});
|
|
153
|
+
it('rejects a two-copy explicit override loop without exhausting the sentry', async () => {
|
|
154
|
+
const dir = fixture();
|
|
155
|
+
const second = join(dir, 'second.mjs');
|
|
156
|
+
copyFileSync(shim, second);
|
|
157
|
+
chmodSync(second, 0o755);
|
|
158
|
+
const [status, , stderr] = await invoke(dir, shim, [], ['--version'], {
|
|
159
|
+
CLEO_REAL_GIT_PATH: second,
|
|
160
|
+
});
|
|
161
|
+
expect(status).toBe(1);
|
|
162
|
+
expect(stderr).toContain('CLEO_REAL_GIT_PATH');
|
|
163
|
+
expect(stderr).not.toContain('RECURSION_SENTRY');
|
|
164
|
+
});
|
|
165
|
+
it.each(['file', 'directory'])('skips a non-executable %s PATH candidate', async (kind) => {
|
|
166
|
+
const dir = fixture();
|
|
167
|
+
const candidate = join(dir, 'bin', 'git');
|
|
168
|
+
if (kind === 'file')
|
|
169
|
+
writeFileSync(candidate, 'not executable', { mode: 0o644 });
|
|
170
|
+
else
|
|
171
|
+
mkdirSync(candidate);
|
|
172
|
+
realGit(dir);
|
|
173
|
+
expect(await invoke(dir, shim, [join(dir, 'bin'), dir])).toEqual([
|
|
174
|
+
0,
|
|
175
|
+
'REAL_GIT:--version\n',
|
|
176
|
+
'',
|
|
177
|
+
]);
|
|
178
|
+
});
|
|
179
|
+
it('rejects an invalid explicit executable instead of silently selecting another', async () => {
|
|
180
|
+
const dir = fixture();
|
|
181
|
+
const invalid = join(dir, 'invalid');
|
|
182
|
+
writeFileSync(invalid, 'not executable', { mode: 0o644 });
|
|
183
|
+
realGit(dir);
|
|
184
|
+
const [status, stdout, stderr] = await invoke(dir, shim, [dir], ['--version'], {
|
|
185
|
+
CLEO_REAL_GIT_PATH: invalid,
|
|
186
|
+
});
|
|
187
|
+
expect(status).toBe(1);
|
|
188
|
+
expect(stdout).toBe('');
|
|
189
|
+
expect(stderr).toContain('CLEO_REAL_GIT_PATH');
|
|
190
|
+
});
|
|
191
|
+
it.each([
|
|
192
|
+
'invalid',
|
|
193
|
+
Array.from({ length: 16 }, () => '1:2').join(';'),
|
|
194
|
+
])('refuses malformed or exhausted delegation history', async (chain) => {
|
|
195
|
+
const dir = fixture();
|
|
196
|
+
realGit(dir);
|
|
197
|
+
const [status, stdout, stderr] = await invoke(dir, shim, [dir], ['--version'], {
|
|
198
|
+
CLEO_GIT_SHIM_CHAIN: chain,
|
|
199
|
+
CLEO_GIT_SHIM_PARENT_PID: String(process.pid),
|
|
200
|
+
});
|
|
201
|
+
expect(status).toBe(1);
|
|
202
|
+
expect(stdout).toBe('');
|
|
203
|
+
expect(stderr).toContain('delegation chain');
|
|
204
|
+
});
|
|
205
|
+
it('retains a valid explicit Git override', async () => {
|
|
206
|
+
const dir = fixture();
|
|
207
|
+
expect(await invoke(dir, shim, [], ['--version'], { CLEO_REAL_GIT_PATH: realGit(dir) })).toEqual([0, 'REAL_GIT:--version\n', '']);
|
|
208
|
+
});
|
|
209
|
+
it('allows a real Git hook to invoke Git again across the executable boundary', async () => {
|
|
210
|
+
const dir = fixture();
|
|
211
|
+
const git = realGit(dir);
|
|
212
|
+
writeFileSync(git, '#!/bin/sh\nif [ "$1" = hook ]; then "$SHIM_TEST_ENTRY" --version; else printf "REAL_GIT:%s\\n" "$*"; fi\n');
|
|
213
|
+
symlinkSync(shim, join(dir, 'bin', 'git'));
|
|
214
|
+
expect(await invoke(dir, shim, [join(dir, 'bin'), dir], ['hook'], {
|
|
215
|
+
SHIM_TEST_ENTRY: shim,
|
|
216
|
+
})).toEqual([0, 'REAL_GIT:--version\n', '']);
|
|
217
|
+
});
|
|
218
|
+
it('uses identity protection on no-argument and allowed worker passthrough paths', async () => {
|
|
219
|
+
const dir = fixture();
|
|
220
|
+
symlinkSync(shim, join(dir, 'bin', 'git'));
|
|
221
|
+
realGit(dir);
|
|
222
|
+
expect(await invoke(dir, shim, [join(dir, 'bin'), dir], [])).toEqual([0, 'REAL_GIT:\n', '']);
|
|
223
|
+
expect(await invoke(dir, shim, [join(dir, 'bin'), dir], ['status'], {
|
|
224
|
+
CLEO_AGENT_ROLE: 'worker',
|
|
225
|
+
})).toEqual([0, 'REAL_GIT:status\n', '']);
|
|
226
|
+
});
|
|
227
|
+
it('retains worker policy and audit before delegation', async () => {
|
|
228
|
+
const dir = fixture();
|
|
229
|
+
realGit(dir);
|
|
230
|
+
const [status, stdout, stderr] = await invoke(dir, shim, [dir], ['checkout', 'main'], {
|
|
231
|
+
CLEO_AGENT_ROLE: 'worker',
|
|
232
|
+
});
|
|
233
|
+
expect(status).toBe(77);
|
|
234
|
+
expect(stdout).toBe('');
|
|
235
|
+
expect(stderr).toContain('BLOCKED');
|
|
236
|
+
expect(readFileSync(join(dir, 'audit.jsonl'), 'utf8')).toContain('blocked');
|
|
237
|
+
});
|
|
238
|
+
});
|
|
239
|
+
//# sourceMappingURL=shim.test.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"shim.test.js","sourceRoot":"","sources":["../../src/__tests__/shim.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EACL,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,WAAW,EACX,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEnE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;AAC7E,IAAI,IAAY,CAAC;AACjB,IAAI,IAAY,CAAC;AACjB,IAAI,MAAc,CAAC;AAEnB,SAAS,CAAC,GAAG,EAAE;IACb,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACzD,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACjD,SAAS,CAAC;QACR,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;QAC1D,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,KAAK;QACb,KAAK,EAAE;YACL,iBAAiB,EAAE,IAAI,CAAC,IAAI,EAAE,6BAA6B,CAAC;YAC5D,qBAAqB,EAAE,IAAI,CAAC,IAAI,EAAE,iCAAiC,CAAC;SACrE;KACF,CAAC,CAAC;IACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAClC,4EAA4E;IAC5E,+EAA+E;IAC/E,aAAa,CACX,MAAM,EACN,qDAAqD;QACnD,2GAA2G,CAC9G,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAE/D,SAAS,OAAO;IACd,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IAClC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,OAAO,CAAC,SAAiB;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACtC,aAAa,CAAC,MAAM,EAAE,2CAA2C,CAAC,CAAC;IACnE,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,SAAiB,EACjB,KAAa,EACb,IAAc,EACd,IAAI,GAAG,CAAC,WAAW,CAAC,EACpB,QAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/B,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,IAAI;QACd,GAAG,EAAE;YACH,IAAI,EAAE,SAAS;YACf,aAAa,EAAE,SAAS;YACxB,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACjD,YAAY,EAAE,YAAY,MAAM,2BAA2B;YAC3D,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;YACnD,GAAG,KAAK;SACT;QACD,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,IAAI,CAAC,KAAK,CAAC,GAAG;YAAE,OAAO;QACvB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,KAAK,CAAC;QAC7F,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;QAC9B,QAAQ,GAAG,IAAI,CAAC;QAChB,SAAS,EAAE,CAAC;IACd,CAAC,EAAE,IAAI,CAAC,CAAC;IACT,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK;YAAE,SAAS,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK;YAAE,SAAS,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;YACxE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,SAAS,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QAC9C,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,MAAM,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9D,CAAC;YACD,sBAAsB;YACtB,EAAE;SACH,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,MAAM,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC/D,CAAC;YACD,sBAAsB;YACtB,EAAE;SACH,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,8BAA8B,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC9E,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS;YAAE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;;YAC5C,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE;YAC1E,kBAAkB,EAAE,KAAK;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACnC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACxC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACtC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,MAAM,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACvE,CAAC;YACD,sBAAsB;YACtB,EAAE;SACH,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACvC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3B,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,MAAM,EAAE,AAAD,EAAG,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE;YACpE,kBAAkB,EAAE,MAAM;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,0CAA0C,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACxF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,MAAM;YAAE,aAAa,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;;YAC5E,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,MAAM,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC/D,CAAC;YACD,sBAAsB;YACtB,EAAE;SACH,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrC,aAAa,CAAC,OAAO,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE;YAC7E,kBAAkB,EAAE,OAAO;SAC5B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,SAAS;QACT,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;KAClD,CAAC,CAAC,mDAAmD,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACtE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE;YAC7E,mBAAmB,EAAE,KAAK;YAC1B,wBAAwB,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,CACJ,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CACjF,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACzB,aAAa,CACX,GAAG,EACH,2GAA2G,CAC5G,CAAC;QACF,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3C,MAAM,CACJ,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE;YACzD,eAAe,EAAE,IAAI;SACtB,CAAC,CACH,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,MAAM,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7F,MAAM,CACJ,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE;YAC3D,eAAe,EAAE,QAAQ;SAC1B,CAAC,CACH,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE;YACpF,eAAe,EAAE,QAAQ;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
package/dist/shim.js
CHANGED
|
@@ -35,8 +35,9 @@
|
|
|
35
35
|
* @task T1761
|
|
36
36
|
*/
|
|
37
37
|
import { spawnSync } from 'node:child_process';
|
|
38
|
-
import {
|
|
39
|
-
import { join } from 'node:path';
|
|
38
|
+
import { accessSync, constants, realpathSync, statSync } from 'node:fs';
|
|
39
|
+
import { delimiter, join } from 'node:path';
|
|
40
|
+
import { fileURLToPath } from 'node:url';
|
|
40
41
|
import { writeAuditRecord } from './audit-log.js';
|
|
41
42
|
import { validateAddPaths, validateCherryPickSource, validateCommitSubject, validateMergeAllowed, } from './boundary.js';
|
|
42
43
|
import { findDeniedOp, RESTRICTED_ROLES } from './denylist.js';
|
|
@@ -56,32 +57,79 @@ function getAgentRole() {
|
|
|
56
57
|
return RESTRICTED_ROLES.has(role) ? role : null;
|
|
57
58
|
}
|
|
58
59
|
/**
|
|
59
|
-
*
|
|
60
|
+
* Identify a file independently of symlink spelling and hardlink aliases.
|
|
60
61
|
*
|
|
61
|
-
*
|
|
62
|
-
*
|
|
63
|
-
|
|
64
|
-
|
|
62
|
+
* @param path - Canonical file path.
|
|
63
|
+
* @returns Stable device/inode identity for this delegation chain.
|
|
64
|
+
*/
|
|
65
|
+
function fileIdentity(path) {
|
|
66
|
+
const stat = statSync(path, { bigint: true });
|
|
67
|
+
return `${stat.dev}:${stat.ino}`;
|
|
68
|
+
}
|
|
69
|
+
/**
|
|
70
|
+
* Resolve executable Git while excluding this shim and prior delegating copies.
|
|
71
|
+
*
|
|
72
|
+
* Explicit overrides must be valid; PATH and conventional fallback candidates
|
|
73
|
+
* are checked in order. Directory names never establish executable identity.
|
|
74
|
+
* The bounded chain is propagated to children so distinct shim copies cannot
|
|
75
|
+
* delegate indefinitely. Continuity requires the immediately delegating parent;
|
|
76
|
+
* Git hooks invoking Git again start a fresh chain after the real Git boundary.
|
|
77
|
+
* This is recursion protection, not a trust boundary.
|
|
65
78
|
*
|
|
66
79
|
* @returns Absolute path to real git, or null if not found.
|
|
67
80
|
*/
|
|
68
81
|
function resolveRealGit() {
|
|
82
|
+
const inherited = process.env['CLEO_GIT_SHIM_PARENT_PID'] === String(process.ppid)
|
|
83
|
+
? (process.env['CLEO_GIT_SHIM_CHAIN'] ?? '')
|
|
84
|
+
: '';
|
|
85
|
+
const chain = inherited ? inherited.split(';') : [];
|
|
86
|
+
if (chain.length >= 16 || chain.some((identity) => !/^\d+:\d+$/.test(identity))) {
|
|
87
|
+
process.stderr.write('[git-shim] ERROR: invalid or exhausted executable delegation chain\n');
|
|
88
|
+
return null;
|
|
89
|
+
}
|
|
90
|
+
const self = realpathSync(fileURLToPath(import.meta.url));
|
|
91
|
+
const identity = fileIdentity(self);
|
|
92
|
+
if (chain.includes(identity)) {
|
|
93
|
+
process.stderr.write('[git-shim] ERROR: recursive executable delegation refused\n');
|
|
94
|
+
return null;
|
|
95
|
+
}
|
|
96
|
+
chain.push(identity);
|
|
97
|
+
const excluded = new Set(chain);
|
|
98
|
+
const candidatePath = (path) => {
|
|
99
|
+
try {
|
|
100
|
+
const canonical = realpathSync(path);
|
|
101
|
+
if (canonical === self || excluded.has(fileIdentity(canonical)))
|
|
102
|
+
return null;
|
|
103
|
+
if (!statSync(canonical).isFile())
|
|
104
|
+
return null;
|
|
105
|
+
accessSync(canonical, constants.X_OK);
|
|
106
|
+
return canonical;
|
|
107
|
+
}
|
|
108
|
+
catch {
|
|
109
|
+
// Missing, inaccessible, and non-executable PATH entries are not Git.
|
|
110
|
+
return null;
|
|
111
|
+
}
|
|
112
|
+
};
|
|
113
|
+
process.env['CLEO_GIT_SHIM_CHAIN'] = chain.join(';');
|
|
114
|
+
process.env['CLEO_GIT_SHIM_PARENT_PID'] = String(process.pid);
|
|
69
115
|
const override = process.env['CLEO_REAL_GIT_PATH'];
|
|
70
|
-
if (override
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
116
|
+
if (override) {
|
|
117
|
+
const candidate = candidatePath(override);
|
|
118
|
+
if (!candidate)
|
|
119
|
+
process.stderr.write('[git-shim] ERROR: CLEO_REAL_GIT_PATH must name an executable outside the shim delegation chain\n');
|
|
120
|
+
return candidate;
|
|
121
|
+
}
|
|
122
|
+
const pathDirs = (process.env['PATH'] ?? '').split(delimiter);
|
|
74
123
|
for (const dir of pathDirs) {
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
const candidate = join(dir, 'git');
|
|
78
|
-
if (existsSync(candidate))
|
|
124
|
+
const candidate = candidatePath(join(dir, 'git'));
|
|
125
|
+
if (candidate)
|
|
79
126
|
return candidate;
|
|
80
127
|
}
|
|
81
128
|
const fallbacks = ['/usr/bin/git', '/usr/local/bin/git', '/opt/homebrew/bin/git'];
|
|
82
129
|
for (const fb of fallbacks) {
|
|
83
|
-
|
|
84
|
-
|
|
130
|
+
const candidate = candidatePath(fb);
|
|
131
|
+
if (candidate)
|
|
132
|
+
return candidate;
|
|
85
133
|
}
|
|
86
134
|
return null;
|
|
87
135
|
}
|
package/dist/shim.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"shim.js","sourceRoot":"","sources":["../src/shim.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"shim.js","sourceRoot":"","sources":["../src/shim.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAoB,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAEL,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;GAIG;AACH,SAAS,YAAY;IACnB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,cAAc;IACrB,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9D,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAiB,EAAE;QACpD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,SAAS,KAAK,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7E,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC/C,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACtC,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kGAAkG,CACnG,CAAC;QACJ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAE9D,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAClD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;IAClC,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,cAAc,EAAE,oBAAoB,EAAE,uBAAuB,CAAC,CAAC;IAClF,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe,EAAE,OAA+B;IACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CAAC;QAChB,UAAU,EAAE,IAAI;QAChB,IAAI;QACJ,OAAO;QACP,GAAG,OAAO;KACX,CAAC,IAAI,CACP,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,OAAO,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,SAA4B,EAAE,UAAkB;IAC7E,gBAAgB,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE;QAClD,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,UAAU;QACV,GAAG,SAAS,CAAC,OAAO;KACrB,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,SAAS,CAAC,WAAW,IAAI,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,UAAkB,EAAE,IAAc;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE1C,6EAA6E;IAC7E,IAAI,UAAU,KAAK,KAAK,IAAI,MAAM,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,oDAAoD;IACpD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/C,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,wDAAwD;IACxD,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE;YACnC,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,0DAA0D;IAC1D,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CACvB,OAA+B,EAC/B,QAAiC,EACjC,IAAY,EACZ,UAAkB,EAClB,IAAc,EACd,OAA+B;IAE/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO;QACL,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,OAAO;QACP,QAAQ;QACR,IAAI;QACJ,UAAU;QACV,IAAI;QACJ,GAAG;QACH,aAAa,EAAE,MAAM,EAAE,YAAY,IAAI,IAAI;QAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI;QAC/B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI;QAC5C,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,IAAI;IACX,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3B,0EAA0E;IAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAE5B,gEAAgE;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,GAAG,CAAC;IACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,GAAG,CAAC;IAEvD,8EAA8E;IAC9E,2EAA2E;IAC3E,EAAE;IACF,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,mEAAmE;IACnE,8EAA8E;IAC9E,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACjE,IAAI,kBAAkB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,qBAAqB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;QACtD,gBAAgB,CACd,gBAAgB,CACd,SAAS,EACT,WAAW,EACX,kBAAkB,CAAC,IAAI,EACvB,UAAU,EACV,aAAa,EACb,kBAAkB,CAAC,OAAO,CAC3B,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,kBAAkB,IAAI,QAAQ,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mEAAmE;YACjE,IAAI,kBAAkB,CAAC,IAAI,cAAc,UAAU,WAAW,IAAI,8BAA8B,CACnG,CAAC;QACF,gBAAgB,CACd,gBAAgB,CACd,oBAAoB,EACpB,WAAW,EACX,kBAAkB,CAAC,IAAI,EACvB,UAAU,EACV,aAAa,EACb,kBAAkB,CAAC,OAAO,CAC3B,CACF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,kDAAkD;IAClD,8EAA8E;IAC9E,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACvD,IAAI,MAAM,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,WAAW,CAAC;QACtE,gBAAgB,CACd,kBAAkB,EAClB,OAAO,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,6BAA6B,IAAI,MAAM,MAAM,CAAC,MAAM,EAAE,EAC9G;YACE,UAAU;YACV,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,IAAI;YACJ,aAAa,EAAE,YAAY;SAC5B,CACF,CAAC;QACF,gBAAgB,CACd,gBAAgB,CAAC,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa,EAAE;YACrF,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CACH,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,MAAM,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uBAAuB,cAAc,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gBAAgB,KAAK;YACrF,8BAA8B,UAAU,WAAW,IAAI,8BAA8B,CACxF,CAAC;QACF,gBAAgB,CACd,gBAAgB,CACd,oBAAoB,EACpB,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CACnD,CACF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,4CAA4C;IAC5C,8EAA8E;IAC9E,MAAM,SAAS,GAAG,kBAAkB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAChE,IAAI,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3B,qBAAqB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC7C,gBAAgB,CACd,gBAAgB,CACd,SAAS,EACT,SAAS,CAAC,QAAQ,EAClB,SAAS,CAAC,IAAI,EACd,UAAU,EACV,aAAa,EACb,SAAS,CAAC,OAAO,CAClB,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,SAAS,CAAC,QAAQ,GAAG;YAC7E,IAAI,SAAS,CAAC,IAAI,cAAc,UAAU,WAAW,IAAI,8BAA8B,CAC1F,CAAC;QACF,gBAAgB,CACd,gBAAgB,CACd,oBAAoB,EACpB,SAAS,CAAC,QAAQ,EAClB,SAAS,CAAC,IAAI,EACd,UAAU,EACV,aAAa,EACb,SAAS,CAAC,OAAO,CAClB,CACF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,4BAA4B;IAC5B,8EAA8E;IAC9E,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,IAAI,EAAE,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cleocode/git-shim",
|
|
3
|
-
"version": "2026.9.
|
|
3
|
+
"version": "2026.9.9",
|
|
4
4
|
"private": false,
|
|
5
5
|
"type": "module",
|
|
6
6
|
"description": "Harness-agnostic git shim for CLEO agent branch-protection (T1118)",
|
|
@@ -32,8 +32,8 @@
|
|
|
32
32
|
"author": "CLEO Code <hello@cleocode.dev>",
|
|
33
33
|
"license": "MIT",
|
|
34
34
|
"dependencies": {
|
|
35
|
-
"@cleocode/
|
|
36
|
-
"@cleocode/
|
|
35
|
+
"@cleocode/paths": "2026.9.9",
|
|
36
|
+
"@cleocode/contracts": "2026.9.9"
|
|
37
37
|
},
|
|
38
38
|
"devDependencies": {
|
|
39
39
|
"@types/node": "^24.3.0",
|