@goodandready/dsh-goal 0.2.22 → 0.2.24

package/lib/engine-git-branch.js

@@ -7,11 +7,11 @@ import { getSafeCwd } from './goal-engine-constants.js';
  * @param {string} workspaceRoot
  * @returns {boolean}
  */
-export function isGitRepository(workspaceRoot) {
+export function isGitRepository(workspaceRoot, allowedRoots = []) {
   if (!workspaceRoot || typeof workspaceRoot !== 'string') return false;
   try {
-    const safePath = getSafeCwd(workspaceRoot);
-    if (!fs.existsSync(safePath)) return false;
+    const safePath = getSafeCwd(workspaceRoot, allowedRoots);
+    if (!safePath || !fs.existsSync(safePath)) return false;
     execFileSync('git', ['rev-parse', '--is-inside-work-tree'], {
       cwd: safePath,
       stdio: ['ignore', 'pipe', 'ignore'],
@@ -61,9 +61,9 @@ export function sanitizeBranchSlug(title) {
  * @param {string} cwd 
  * @returns {string} branch name or 'HEAD'
  */
-export function getCurrentGitBranch(cwd = process.cwd()) {
-  const safeCwd = getSafeCwd(cwd);
-  if (!isGitRepository(safeCwd)) return 'main';
+export function getCurrentGitBranch(cwd = process.cwd(), allowedRoots = []) {
+  const safeCwd = getSafeCwd(cwd, allowedRoots);
+  if (!safeCwd || !isGitRepository(safeCwd, allowedRoots)) return 'main';
   try {
     return execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], {
       cwd: safeCwd,
@@ -81,10 +81,10 @@ export function getCurrentGitBranch(cwd = process.cwd()) {
  * @param {string} branchName 
  * @returns {boolean} success
  */
-export function createGoalBranch(cwd = process.cwd(), branchName) {
+export function createGoalBranch(cwd = process.cwd(), branchName, allowedRoots = []) {
   if (!isValidGitRef(branchName)) return false;
-  const safeCwd = getSafeCwd(cwd);
-  if (!isGitRepository(safeCwd)) return false;
+  const safeCwd = getSafeCwd(cwd, allowedRoots);
+  if (!safeCwd || !isGitRepository(safeCwd, allowedRoots)) return false;
   try {
     execFileSync('git', ['checkout', '-b', branchName], {
       cwd: safeCwd,
@@ -104,12 +104,12 @@ export function createGoalBranch(cwd = process.cwd(), branchName) {
  * @param {string} targetBranch 
  * @returns {boolean} success
  */
-export function mergeGoalBranch(cwd = process.cwd(), branchName, targetBranch = 'main') {
+export function mergeGoalBranch(cwd = process.cwd(), branchName, targetBranch = 'main', allowedRoots = []) {
   if (!isValidGitRef(branchName) || !isValidGitRef(targetBranch)) return false;
-  const safeCwd = getSafeCwd(cwd);
-  if (!isGitRepository(safeCwd)) return false;
+  const safeCwd = getSafeCwd(cwd, allowedRoots);
+  if (!safeCwd || !isGitRepository(safeCwd, allowedRoots)) return false;
   try {
-    execFileSync('git', ['checkout', '--', targetBranch], {
+    execFileSync('git', ['checkout', targetBranch], {
       cwd: safeCwd,
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'pipe'],
@@ -132,12 +132,12 @@ export function mergeGoalBranch(cwd = process.cwd(), branchName, targetBranch =
  * @param {string} targetBranch 
  * @returns {boolean} success
  */
-export function discardGoalBranch(cwd = process.cwd(), branchName, targetBranch = 'main') {
+export function discardGoalBranch(cwd = process.cwd(), branchName, targetBranch = 'main', allowedRoots = []) {
   if (!isValidGitRef(branchName) || !isValidGitRef(targetBranch)) return false;
-  const safeCwd = getSafeCwd(cwd);
-  if (!isGitRepository(safeCwd)) return false;
+  const safeCwd = getSafeCwd(cwd, allowedRoots);
+  if (!safeCwd || !isGitRepository(safeCwd, allowedRoots)) return false;
   try {
-    execFileSync('git', ['checkout', '--', targetBranch], {
+    execFileSync('git', ['checkout', targetBranch], {
       cwd: safeCwd,
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'pipe'],

package/lib/routes.js

@@ -18,7 +18,7 @@ export function isLoopback(value) {
   );
 }
 
-export function isTrustedCaller(req) {
+export function isTrustedCaller(req, authToken = process.env.DSH_GOAL_AUTH_TOKEN) {
   if (!req) return false;
   const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || "";
   const site = req.headers?.["sec-fetch-site"];
@@ -26,6 +26,19 @@ export function isTrustedCaller(req) {
   // 1. Cross-site and same-site browser requests are rejected
   if (site === "cross-site" || site === "same-site") return false;
 
+  // Optional authorization token check (supports x-dsh-auth-token or Authorization: Bearer <token>)
+  if (authToken) {
+    const headerVal = req.headers?.["x-dsh-auth-token"] || req.headers?.authorization;
+    const cleanHeader = headerVal ? String(headerVal).replace(/^Bearer\s+/i, "").trim() : "";
+    if (cleanHeader === authToken) {
+      return true;
+    }
+    // When authToken is explicitly configured, non-loopback callers without valid token are rejected
+    if (!isLoopback(remote)) {
+      return false;
+    }
+  }
+
   // 2. Same-origin browser UI requests (operator UI on LAN or localhost)
   if (site === "same-origin") {
     const host = String(req.headers?.host || "").toLowerCase();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-goal",
-  "version": "0.2.22",
+  "version": "0.2.24",
   "description": "Core Goal Addon (Token Budget, Milestones, Git Snapshots & Retrospective Reports) for DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",
@@ -19,7 +19,8 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "NODE_ENV=test node --test test/*.test.mjs"
+    "build:client": "node scripts/build-client.mjs",
+    "test": "node scripts/build-client.mjs --check && NODE_ENV=test node --test test/*.test.mjs"
   },
   "keywords": [
     "dsh",