@goodandready/dsh-github-ops 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.3.1
+
+### Fixed
+- **Cordis Context CWD Guard & SCM Route Exception Shield** (#70, #76): Added `safeCwd(ctx)` helper across routes and tools to prevent `Error: cannot get property "cwd" without inject` when accessing undeclared context properties in Cordis 8+ / DSH 0.2 runtimes. Wrapped SCM HTTP route handler in top-level error handling.
+
 ## 0.3.0
 
 ### Features

package/lib/index.js

@@ -63,6 +63,14 @@ function makeGitRunner() {
   }
 }
 
+export function safeCwd(ctx) {
+  try {
+    return (typeof ctx?.cwd === 'string' && ctx.cwd) || process.cwd()
+  } catch {
+    return process.cwd()
+  }
+}
+
 export const name = 'dsh-github-ops'
 export const inject = ['tools', 'credentials', 'settings']
 
@@ -279,7 +287,7 @@ export function apply(ctx, rawConfig) {
     const fallback = cfg.defaultRepository || ''
     let remoteUrl = ''
     if (!(explicit && explicit.includes('/')) && !fallback) {
-      const cwd = (typeof ctx.cwd === 'string' && ctx.cwd) || process.cwd()
+      const cwd = safeCwd(ctx)
       const git = makeGitRunner()
       const origin = await git(['remote', 'get-url', 'origin'], { cwd })
       if (origin.code === 0) remoteUrl = origin.stdout.trim()
@@ -375,7 +383,7 @@ export function apply(ctx, rawConfig) {
     },
   }
 
-  const deps = { tool, asRepo, client, liveConfig, reviewRules, auth: authSeam, defaultCwd: () => (typeof ctx.cwd === 'string' && ctx.cwd) || process.cwd() }
+  const deps = { tool, asRepo, client, liveConfig, reviewRules, auth: authSeam, defaultCwd: () => safeCwd(ctx) }
   registerCoreTools(deps)
   registerCollabTools(deps)
   registerOpsTools(deps)
@@ -384,7 +392,7 @@ export function apply(ctx, rawConfig) {
   registerMirrorTools({
     tool,
     git: makeGitRunner(),
-    defaultCwd: () => (typeof ctx.cwd === 'string' && ctx.cwd) || process.cwd(),
+    defaultCwd: () => safeCwd(ctx),
   })
 
   // Background reviews: the host registry when the composition has one, our own records
@@ -454,7 +462,7 @@ export function apply(ctx, rawConfig) {
     try {
       const git = makeGitRunner()
       const readGitState = async () => {
-        const cwd = (typeof ctx.cwd === 'string' && ctx.cwd) || process.cwd()
+        const cwd = safeCwd(ctx)
         const branch = await git(['rev-parse', '--abbrev-ref', 'HEAD'], { cwd })
         const remote = await git(['remote', 'get-url', 'origin'], { cwd })
         const resolved = remote.code === 0

package/lib/routes.js

@@ -31,6 +31,14 @@ export const PANEL_PATH = '/dsh-github-ops/panel'
  * @param deps - resolveToken, client, liveConfig, describeError, makeGitRunner and cacheStats,
  *               injected so this module stays free of the host's own composition.
  */
+function safeCwd(ctx) {
+  try {
+    return (typeof ctx?.cwd === 'string' && ctx.cwd) || process.cwd()
+  } catch {
+    return process.cwd()
+  }
+}
+
 export function registerRoutes(ctx, deps = {}) {
   const {
     resolveToken = async () => ({ value: '', source: '', guidance: '' }),
@@ -93,6 +101,7 @@ export function registerRoutes(ctx, deps = {}) {
         kind: 'exact',
         path: SCM_PATH,
         handler: async (req, res) => {
+          try {
           if (req.method !== 'GET' && req.method !== 'POST') return sendJson(res, 405, { error: 'method not allowed' })
           if (req.method === 'POST') {
             if (!isTrustedWriteRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
@@ -107,7 +116,7 @@ export function registerRoutes(ctx, deps = {}) {
           // The tab may look at another directory than the session workspace; the value is
           // validated, must exist and must be a directory.
           const requested = validateCwd(url.searchParams.get('cwd') || '')
-          let cwd = (typeof ctx.cwd === 'string' && ctx.cwd) || process.cwd()
+          let cwd = safeCwd(ctx)
           if (requested) {
             if (!existsSync(requested) || !statSync(requested).isDirectory()) {
               return sendJson(res, 400, { error: `not a directory: ${requested}` })
@@ -224,6 +233,9 @@ export function registerRoutes(ctx, deps = {}) {
             worktrees: parseWorktrees(worktreesAnswer.code === 0 ? worktreesAnswer.stdout : ''),
             merge,
           }))
+          } catch (err) {
+            return sendJson(res, 500, { ok: false, error: String((err && err.message) || err) })
+          }
         },
       })
       if (typeof wctx.effect === 'function') wctx.effect(register, 'dsh-github-ops: scm route')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-github-ops",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "GitHub operations for DeepSeek Harness: releases, tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror publication.",
   "license": "MIT",
   "type": "module",