@haystackeditor/cli 0.15.31 → 0.16.0

package/dist/utils/git.js

@@ -3,10 +3,11 @@
  *
  * Provides functions for git operations: branch management, push, remote parsing.
  */
-import { execFileSync, execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
+import { isHeadlessToken } from './auth.js';
 // Re-export findGitRoot from hooks for consistency
 export { findGitRoot } from './hooks.js';
 // ============================================================================
@@ -17,7 +18,7 @@ export { findGitRoot } from './hooks.js';
  */
 export function getCurrentBranch() {
     try {
-        return execSync('git rev-parse --abbrev-ref HEAD', {
+        return execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         }).trim();
@@ -33,17 +34,25 @@ export function getCurrentBranch() {
  */
 export function getDefaultBranch() {
     try {
-        // Try to get from remote HEAD
-        const remoteHead = execSync('git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null || echo ""', {
-            encoding: 'utf-8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
+        // Try to get from remote HEAD. `git symbolic-ref` exits non-zero when
+        // origin/HEAD is unset, which is normal for many clones; treat that as
+        // "no remote HEAD" and move on to the branch listing below.
+        let remoteHead = '';
+        try {
+            remoteHead = execFileSync('git', ['symbolic-ref', 'refs/remotes/origin/HEAD'], {
+                encoding: 'utf-8',
+                stdio: ['pipe', 'pipe', 'pipe'],
+            }).trim();
+        }
+        catch {
+            remoteHead = '';
+        }
         if (remoteHead) {
             // refs/remotes/origin/main -> main
             return remoteHead.replace('refs/remotes/origin/', '');
         }
         // Fallback: check if main or master exists
-        const branches = execSync('git branch -r', {
+        const branches = execFileSync('git', ['branch', '-r'], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         });
@@ -62,7 +71,7 @@ export function getDefaultBranch() {
  */
 export function hasUncommittedChanges() {
     try {
-        const status = execSync('git status --porcelain', {
+        const status = execFileSync('git', ['status', '--porcelain'], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         }).trim();
@@ -76,17 +85,24 @@ export function hasUncommittedChanges() {
  * Check if current branch has unpushed commits
  */
 export function hasUnpushedCommits() {
+    let currentBranch;
     try {
-        const currentBranch = getCurrentBranch();
-        const unpushed = execSync(`git log origin/${currentBranch}..HEAD --oneline 2>/dev/null || echo ""`, {
+        currentBranch = getCurrentBranch();
+    }
+    catch {
+        // Branch may not have an upstream, assume there are commits to push
+        return true;
+    }
+    try {
+        const unpushed = execFileSync('git', ['log', '--oneline', '--end-of-options', `origin/${currentBranch}..HEAD`], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         }).trim();
         return unpushed.length > 0;
     }
     catch {
-        // Branch may not have an upstream, assume there are commits to push
-        return true;
+        // No origin/<branch> yet: same result the old `|| echo ""` produced.
+        return false;
     }
 }
 /**
@@ -106,7 +122,7 @@ export function getBranchInfo() {
  */
 export function createBranch(branchName) {
     try {
-        execSync(`git checkout -b "${branchName}"`, {
+        execFileSync('git', ['checkout', '-b', branchName], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         });
@@ -124,7 +140,7 @@ export function createBranch(branchName) {
  */
 export function branchExists(branchName) {
     try {
-        execSync(`git rev-parse --verify "${branchName}" 2>/dev/null`, {
+        execFileSync('git', ['rev-parse', '--verify', '--quiet', '--end-of-options', branchName], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         });
@@ -139,7 +155,7 @@ export function branchExists(branchName) {
  */
 export function remoteBranchExists(remoteName, branchName) {
     try {
-        execSync(`git ls-remote --heads ${remoteName} ${branchName}`, {
+        execFileSync('git', ['ls-remote', '--heads', '--', remoteName, branchName], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         });
@@ -153,8 +169,14 @@ export function remoteBranchExists(remoteName, branchName) {
  * Checkout an existing branch
  */
 export function checkoutBranch(branchName) {
+    // `git checkout` does not honour `--end-of-options` (git 2.39 reads it as a
+    // pathspec), so a leading dash is refused here and the trailing `--` keeps
+    // the name from being read as a path. Git never creates a ref starting with '-'.
+    if (branchName.startsWith('-')) {
+        throw new Error(`Failed to checkout branch: invalid branch name "${branchName}"`);
+    }
     try {
-        execSync(`git checkout "${branchName}"`, {
+        execFileSync('git', ['checkout', branchName, '--'], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         });
@@ -164,6 +186,8 @@ export function checkoutBranch(branchName) {
         throw new Error(`Failed to checkout branch: ${message}`);
     }
 }
+/** One-line failure for a push attempted with a Haystack headless token. */
+export const HEADLESS_PUSH_ERROR = 'Pushing a branch needs a GitHub credential, and a Haystack headless token (hsk_live_) cannot push: run `haystack login`, then retry.';
 /**
  * Push current branch to remote with upstream tracking.
  *
@@ -178,11 +202,15 @@ export function checkoutBranch(branchName) {
  */
 export function pushBranch(remoteName, branchName, auth) {
     if (auth) {
+        if (isHeadlessToken(auth.token)) {
+            // Never hand a Haystack token to github.com as a git password.
+            throw new Error(HEADLESS_PUSH_ERROR);
+        }
         pushBranchWithToken(remoteName, branchName, auth.token);
         return;
     }
     try {
-        execSync(`git push -u ${remoteName} "${branchName}"`, {
+        execFileSync('git', ['push', '-u', '--end-of-options', remoteName, branchName], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         });
@@ -214,14 +242,17 @@ function pushBranchWithToken(remoteName, branchName, token) {
         // means the user's configured url/pushurl/credential-helper settings
         // are untouched — sidesteps precedence and multi-value edge cases
         // around `remote.<name>.url` vs `remote.<name>.pushurl`.
-        execSync(`git -c credential.helper= push "${pushUrl}" "HEAD:refs/heads/${branchName}"`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], env: authedEnv });
+        execFileSync('git', ['-c', 'credential.helper=', 'push', '--end-of-options', pushUrl, `HEAD:refs/heads/${branchName}`], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], env: authedEnv });
         // Pushing to a raw URL doesn't update refs/remotes/<name>/<branch>. Seed
         // it from the server's authoritative state with a targeted fetch — this
         // reflects any server-side rewrite or hook side effects, not a fabricated
         // pre-push SHA. Then set upstream tracking to the named remote.
         try {
-            execSync(`git -c credential.helper= fetch "${pushUrl}" "refs/heads/${branchName}:refs/remotes/${remoteName}/${branchName}"`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], env: authedEnv });
-            execSync(`git branch --set-upstream-to=${remoteName}/${branchName} "${branchName}"`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+            execFileSync('git', [
+                '-c', 'credential.helper=', 'fetch', '--end-of-options', pushUrl,
+                `refs/heads/${branchName}:refs/remotes/${remoteName}/${branchName}`,
+            ], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], env: authedEnv });
+            execFileSync('git', ['branch', `--set-upstream-to=${remoteName}/${branchName}`, '--end-of-options', branchName], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
         }
         catch (err) {
             // Non-fatal: push succeeded; upstream tracking is a convenience.
@@ -272,7 +303,7 @@ export class UnsupportedRemoteUrlError extends Error {
  */
 export function parseRemoteUrl(remoteName = 'origin') {
     try {
-        const url = execSync(`git remote get-url ${remoteName}`, {
+        const url = execFileSync('git', ['remote', 'get-url', '--', remoteName], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         }).trim();
@@ -320,7 +351,7 @@ export function parseRemoteUrl(remoteName = 'origin') {
  */
 export function getLastCommitMessage() {
     try {
-        return execSync('git log -1 --format=%s', {
+        return execFileSync('git', ['log', '-1', '--format=%s'], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         }).trim();
@@ -336,7 +367,7 @@ export function getLastCommitMessage() {
  */
 export function getLastCommitSha() {
     try {
-        return execSync('git rev-parse --short HEAD', {
+        return execFileSync('git', ['rev-parse', '--short', 'HEAD'], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         }).trim();
@@ -352,13 +383,13 @@ export function getLastCommitSha() {
 export function getCommitMessagesSinceBase(baseBranch) {
     try {
         // Use origin/<base> to compare against remote base branch
-        const mergeBase = execSync(`git merge-base origin/${baseBranch} HEAD`, {
+        const mergeBase = execFileSync('git', ['merge-base', '--end-of-options', `origin/${baseBranch}`, 'HEAD'], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         }).trim();
         if (!mergeBase)
             return '';
-        return execSync(`git log ${mergeBase}..HEAD --format=%B --reverse`, {
+        return execFileSync('git', ['log', '--format=%B', '--reverse', '--end-of-options', `${mergeBase}..HEAD`], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         }).trim();
@@ -366,7 +397,7 @@ export function getCommitMessagesSinceBase(baseBranch) {
     catch {
         // Fallback: try just the last commit's full message
         try {
-            return execSync('git log -1 --format=%B', {
+            return execFileSync('git', ['log', '-1', '--format=%B'], {
                 encoding: 'utf-8',
                 stdio: ['pipe', 'pipe', 'pipe'],
             }).trim();
@@ -461,7 +492,7 @@ export function resolveDiffBaseRef(baseBranch, options = {}) {
     // if <base> was rewound on the remote).
     let fetched = false;
     try {
-        execFileSync('git', ['fetch', 'origin', `+refs/heads/${baseBranch}:${remoteRef}`], {
+        execFileSync('git', ['fetch', '--end-of-options', 'origin', `+refs/heads/${baseBranch}:${remoteRef}`], {
             ...gitCommandOptions(options),
             env: options.timeoutMs
                 ? { ...process.env, GIT_TERMINAL_PROMPT: '0' }
@@ -496,7 +527,7 @@ export function resolveDiffBaseRef(baseBranch, options = {}) {
  */
 export function getCommitsAhead(baseBranch) {
     try {
-        const output = execSync(`git rev-list --count ${baseBranch}..HEAD`, {
+        const output = execFileSync('git', ['rev-list', '--count', '--end-of-options', `${baseBranch}..HEAD`], {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
         }).trim();

package/dist/utils/github-api.js

@@ -3,7 +3,7 @@
  *
  * Provides functions for creating PRs, managing labels, etc.
  */
-import { resolveAuthContext } from './auth.js';
+import { isHeadlessToken, resolveAuthContext } from './auth.js';
 import { trackError } from './telemetry.js';
 const GITHUB_API_BASE = 'https://api.github.com';
 // OAuth App Policy fallback. Orgs can restrict our OAuth app, which makes the
@@ -22,6 +22,13 @@ const GITHUB_PROXY_BASE = 'https://haystackeditor.com/api/github';
  * `x-ratelimit-remaining: 0` and the proxy can't help with those, so we don't
  * retry them.
  */
+/**
+ * REST base URL for a token. Haystack headless tokens (hsk_live_*) only work
+ * through the Haystack proxy and must never reach api.github.com.
+ */
+export function githubRestBaseFor(token) {
+    return isHeadlessToken(token) ? GITHUB_PROXY_BASE : GITHUB_API_BASE;
+}
 function isOAuthPolicyForbidden(response) {
     return response.status === 403 && response.headers.get('x-ratelimit-remaining') !== '0';
 }
@@ -75,6 +82,12 @@ async function githubApiRequest(method, path, token, body) {
         },
         body: body ? JSON.stringify(body) : undefined,
     };
+    // A Haystack headless token (hsk_live_*) is not a GitHub credential: sending
+    // it to api.github.com would leak it to GitHub and fail anyway. Only the
+    // Haystack proxy understands it (it resolves an App installation token).
+    if (isHeadlessToken(token)) {
+        return fetch(`${GITHUB_PROXY_BASE}${path}`, init);
+    }
     const direct = await fetch(`${GITHUB_API_BASE}${path}`, init);
     if (!isOAuthPolicyForbidden(direct))
         return direct;

package/dist/utils/haystack-api.js

@@ -13,10 +13,13 @@ export function haystackApiUrl(path) {
  */
 export class HaystackApiError extends Error {
     status;
-    constructor(status, message) {
+    /** The server's stable `error` code when the body carried one. */
+    code;
+    constructor(status, message, code = null) {
         super(message);
         this.name = 'HaystackApiError';
         this.status = status;
+        this.code = code;
     }
     get isAuthError() {
         return this.status === 401 || this.status === 403;
@@ -29,7 +32,17 @@ function headers(token, extra) {
     result.set('User-Agent', 'Haystack-CLI');
     return result;
 }
-/** Extract the server's own message if the body is JSON; truncate raw bodies. */
+/**
+ * The server returns this `error` code (HTTP 403) when the authenticated
+ * account has no paid subscription, so the CLI can say so instead of
+ * reporting a missing resource or a repository permission problem.
+ */
+export const SUBSCRIPTION_REQUIRED_CODE = 'subscription_required';
+export const SUBSCRIPTION_REQUIRED_MESSAGE = 'This account has no active Haystack subscription. See https://haystack.sh/pricing or email akshay@haystack.sh to get access.';
+/**
+ * Extract the server's own message (and its `error` code) if the body is
+ * JSON; truncate raw bodies.
+ */
 async function serverMessage(response) {
     let text;
     try {
@@ -39,17 +52,20 @@ async function serverMessage(response) {
         // A transport failure while reading the error body is itself signal —
         // say so instead of reporting it as "no detail" (the status-based
         // classification in classifyHttpError stands either way).
-        return `error body unreadable: ${err instanceof Error ? err.message : String(err)}`;
+        return { detail: `error body unreadable: ${err instanceof Error ? err.message : String(err)}`, code: null };
     }
     if (!text)
-        return null;
+        return { detail: null, code: null };
     try {
         const parsed = JSON.parse(text);
-        return parsed.message ?? parsed.error ?? null;
+        return {
+            detail: parsed.message ?? parsed.error ?? null,
+            code: typeof parsed.error === 'string' ? parsed.error : null,
+        };
     }
     catch {
         // Not JSON (HTML error page, plain text) — never dump a full raw body.
-        return text.slice(0, 200);
+        return { detail: text.slice(0, 200), code: null };
     }
 }
 /**
@@ -57,8 +73,11 @@ async function serverMessage(response) {
  * class it failed with, and the next command to run.
  */
 export async function classifyHttpError(response, context) {
-    const detail = await serverMessage(response);
+    const { detail, code } = await serverMessage(response);
     const suffix = detail ? ` (${detail})` : '';
+    if (response.status === 403 && code === SUBSCRIPTION_REQUIRED_CODE) {
+        return new HaystackApiError(403, SUBSCRIPTION_REQUIRED_MESSAGE, code);
+    }
     if (response.status === 401) {
         return new HaystackApiError(401, `${context}: authentication failed${suffix}. Run \`haystack login\` to re-authenticate.`);
     }

package/dist/utils/hooks.js

@@ -6,6 +6,7 @@ import { existsSync } from 'fs';
 import * as path from 'path';
 import { execSync } from 'child_process';
 import { fileURLToPath } from 'url';
+import { assertNoSymlinkOnPath } from './safe-write.js';
 // ============================================================================
 // Constants
 // ============================================================================
@@ -48,22 +49,54 @@ export function getAssetsDir() {
 export async function copyHookFiles(hooksDir) {
     const assetsDir = getAssetsDir();
     const scriptsDir = path.join(assetsDir, 'scripts');
+    // Every destination is checked against the repository root: copyFile and
+    // chmod follow symlinks, so a committed `hooks/pre-commit -> ~/.zshrc`
+    // would otherwise be overwritten and made executable.
+    const repoRoot = path.dirname(hooksDir);
     // Ensure hooks directory exists
+    assertNoSymlinkOnPath(repoRoot, hooksDir);
     await fs.mkdir(hooksDir, { recursive: true });
     // Copy shell scripts (strip .sh extension, set executable)
     for (const hook of HOOK_SCRIPTS) {
         const src = path.join(scriptsDir, `${hook}.sh`);
         const dest = path.join(hooksDir, hook);
+        assertNoSymlinkOnPath(repoRoot, dest);
         await fs.copyFile(src, dest);
         await fs.chmod(dest, 0o755);
     }
     // Copy agent-context module
-    await copyDirRecursive(path.join(assetsDir, 'agent-context'), path.join(hooksDir, 'agent-context'));
+    await copyDirRecursive(repoRoot, path.join(assetsDir, 'agent-context'), path.join(hooksDir, 'agent-context'));
     // Copy truncation-checker module
-    await copyDirRecursive(path.join(assetsDir, 'truncation-checker'), path.join(hooksDir, 'truncation-checker'));
+    await copyDirRecursive(repoRoot, path.join(assetsDir, 'truncation-checker'), path.join(hooksDir, 'truncation-checker'));
     // Copy hooks package.json
-    await fs.copyFile(path.join(assetsDir, 'package.json'), path.join(hooksDir, 'package.json'));
-    await fs.copyFile(path.join(assetsDir, 'package-lock.json'), path.join(hooksDir, 'package-lock.json'));
+    for (const manifest of ['package.json', 'package-lock.json']) {
+        const dest = path.join(hooksDir, manifest);
+        assertNoSymlinkOnPath(repoRoot, dest);
+        await fs.copyFile(path.join(assetsDir, manifest), dest);
+    }
+}
+/** Every file `copyHookFiles` writes: its bundled source and its path inside hooks/. */
+export async function listHookInstallFiles() {
+    const assetsDir = getAssetsDir();
+    const files = HOOK_SCRIPTS.map(hook => ({
+        src: path.join(assetsDir, 'scripts', `${hook}.sh`),
+        rel: hook,
+    }));
+    const walk = async (dir, rel) => {
+        for (const entry of await fs.readdir(dir, { withFileTypes: true })) {
+            const childRel = path.posix.join(rel, entry.name);
+            if (entry.isDirectory())
+                await walk(path.join(dir, entry.name), childRel);
+            else
+                files.push({ src: path.join(dir, entry.name), rel: childRel });
+        }
+    };
+    await walk(path.join(assetsDir, 'agent-context'), 'agent-context');
+    await walk(path.join(assetsDir, 'truncation-checker'), 'truncation-checker');
+    for (const manifest of ['package.json', 'package-lock.json']) {
+        files.push({ src: path.join(assetsDir, manifest), rel: manifest });
+    }
+    return files;
 }
 /** Install npm dependencies in the hooks directory */
 export async function installHookDeps(hooksDir) {
@@ -76,6 +109,8 @@ export async function installHookDeps(hooksDir) {
 /** Copy LLM rules template if none exists */
 export async function copyLlmRulesTemplate(repoRoot) {
     const dest = path.join(repoRoot, 'LLM_RULES.md');
+    // existsSync follows symlinks, so a dangling link reads as absent.
+    assertNoSymlinkOnPath(repoRoot, dest);
     if (existsSync(dest))
         return false;
     const src = path.join(getAssetsDir(), 'llm-rules-template.md');
@@ -85,16 +120,18 @@ export async function copyLlmRulesTemplate(repoRoot) {
 // ============================================================================
 // Helpers
 // ============================================================================
-async function copyDirRecursive(src, dest) {
+async function copyDirRecursive(repoRoot, src, dest) {
+    assertNoSymlinkOnPath(repoRoot, dest);
     await fs.mkdir(dest, { recursive: true });
     const entries = await fs.readdir(src, { withFileTypes: true });
     for (const entry of entries) {
         const srcPath = path.join(src, entry.name);
         const destPath = path.join(dest, entry.name);
         if (entry.isDirectory()) {
-            await copyDirRecursive(srcPath, destPath);
+            await copyDirRecursive(repoRoot, srcPath, destPath);
         }
         else {
+            assertNoSymlinkOnPath(repoRoot, destPath);
             await fs.copyFile(srcPath, destPath);
         }
     }

package/dist/utils/prompter.js

@@ -17,7 +17,7 @@
  * redirects `console.*` to stderr so stdout carries only NDJSON.
  */
 import chalk from 'chalk';
-import inquirer from 'inquirer';
+import { Separator, checkbox, confirm } from '@inquirer/prompts';
 import * as readline from 'node:readline';
 import { readFileSync } from 'node:fs';
 function isSeparator(c) {
@@ -44,6 +44,27 @@ export function loadAnswersFile(path) {
 // ---------------------------------------------------------------------------
 // TTY (human) prompter
 // ---------------------------------------------------------------------------
+/**
+ * Await an @inquirer/prompts prompt, keeping the Ctrl+C behaviour the CLI had
+ * under inquirer 9: that version answered Ctrl+C by re-sending SIGINT to the
+ * process (which terminates it) and never settled the prompt. @inquirer/prompts
+ * instead rejects with an ExitPromptError, which would surface as an uncaught
+ * error with a stack trace, so translate it back.
+ */
+export async function runPrompt(prompt) {
+    try {
+        return await prompt;
+    }
+    catch (err) {
+        if (err instanceof Error && err.name === 'ExitPromptError') {
+            process.kill(process.pid, 'SIGINT');
+            console.log('');
+            return new Promise(() => { });
+        }
+        throw err;
+    }
+}
+// ---------------------------------------------------------------------------
 class TtyPrompter {
     answers;
     interactive = true;
@@ -56,19 +77,13 @@ class TtyPrompter {
     async confirm(q) {
         if (q.id in this.answers)
             return toBool(this.answers[q.id]);
-        const { value } = await inquirer.prompt([
-            { type: 'confirm', name: 'value', message: q.message, default: q.default ?? true },
-        ]);
-        return value;
+        return runPrompt(confirm({ message: q.message, default: q.default ?? true }));
     }
     async multiselect(q) {
         if (q.id in this.answers)
             return asArray(this.answers[q.id], q.id);
-        const choices = q.choices.map((c) => isSeparator(c) ? new inquirer.Separator(c.separator) : { name: c.name, value: c.value, checked: c.checked });
-        const { value } = await inquirer.prompt([
-            { type: 'checkbox', name: 'value', message: q.message, choices: choices, pageSize: 20 },
-        ]);
-        return value;
+        const choices = q.choices.map((c) => isSeparator(c) ? new Separator(c.separator) : { name: c.name, value: c.value, checked: c.checked });
+        return runPrompt(checkbox({ message: q.message, choices, pageSize: 20 }));
     }
     async action(q) {
         if (this.answers[q.id] === 'skip')

package/dist/utils/safe-write.js

@@ -0,0 +1,31 @@
+import { lstatSync } from 'fs';
+import { isAbsolute, join, relative, sep } from 'path';
+/**
+ * Refuses a write whose target, or any directory between `root` and it, is a
+ * symlink. A repository can commit `AGENTS.md -> ~/.zshrc`; following it would
+ * make an install command edit a file outside the repository. Mirrors the
+ * per-component checks in `skills.ts`. Missing components are fine: the caller
+ * creates them, and a component that does not exist cannot be a symlink.
+ */
+export function assertNoSymlinkOnPath(root, target) {
+    const rel = relative(root, target);
+    if (rel === '' || rel.startsWith('..') || isAbsolute(rel)) {
+        throw new Error(`Refusing to write ${target}: it is not inside ${root}.`);
+    }
+    let current = root;
+    for (const component of rel.split(sep)) {
+        current = join(current, component);
+        let isSymlink;
+        try {
+            isSymlink = lstatSync(current).isSymbolicLink();
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return;
+            throw error;
+        }
+        if (isSymlink) {
+            throw new Error(`Refusing to write ${target}: ${current} is a symlink.`);
+        }
+    }
+}

package/dist/utils/secret-paths.js

@@ -0,0 +1,115 @@
+import { scanForSecrets } from './secrets.js';
+/**
+ * File names that conventionally hold credentials. The precompute upload
+ * withholds these regardless of content, because a scanner cannot recognise
+ * every secret format (a raw key file has no telltale prefix).
+ */
+const EXACT_NAMES = new Set([
+    '.env',
+    'credentials.json',
+    '.npmrc',
+    '.pypirc',
+    '.netrc',
+]);
+// Committed templates are how teams document which variables a service needs.
+const ENV_TEMPLATES = new Set(['.env.example', '.env.sample']);
+const SUFFIXES = ['.pem', '.key', '.p12', '.pfx', '.keystore', '.tfvars'];
+const PREFIXES = ['id_rsa', 'id_ed25519', 'secrets.'];
+/** True when a repository-relative path names a conventionally secret-bearing file. */
+export function isSecretBearingPath(path) {
+    const segments = path.split('/').filter(segment => segment.length > 0);
+    if (segments.length === 0)
+        return false;
+    for (let index = 0; index + 1 < segments.length; index += 1) {
+        if (segments[index] === '.haystack' && segments[index + 1] === 'secrets')
+            return true;
+    }
+    const name = segments[segments.length - 1].toLowerCase();
+    if (EXACT_NAMES.has(name))
+        return true;
+    if (name.startsWith('.env.'))
+        return !ENV_TEMPLATES.has(name);
+    if (SUFFIXES.some(suffix => name.endsWith(suffix)))
+        return true;
+    if (PREFIXES.some(prefix => name.startsWith(prefix)))
+        return true;
+    return name.startsWith('service-account') && name.endsWith('.json');
+}
+const GIT_ESCAPES = {
+    a: 7, b: 8, t: 9, n: 10, v: 11, f: 12, r: 13, '"': 34, '\\': 92,
+};
+/** Reverses git's C-style path quoting (named escapes and octal bytes). */
+function unquoteGitPath(quoted) {
+    const bytes = [];
+    for (let index = 0; index < quoted.length; index += 1) {
+        const character = quoted[index];
+        if (character !== '\\') {
+            bytes.push(...Buffer.from(character, 'utf8'));
+            continue;
+        }
+        const next = quoted[index + 1];
+        const octal = quoted.slice(index + 1, index + 4);
+        if (next !== undefined && next in GIT_ESCAPES) {
+            bytes.push(GIT_ESCAPES[next]);
+            index += 1;
+        }
+        else if (/^[0-7]{3}$/.test(octal)) {
+            bytes.push(Number.parseInt(octal, 8));
+            index += 3;
+        }
+        else {
+            throw new Error('Unrecognised escape in a git path.');
+        }
+    }
+    return Buffer.from(bytes).toString('utf8');
+}
+/** Path named by a `diff --git a/P b/P` header produced with --no-renames. */
+export function pathFromDiffHeader(header) {
+    const prefix = 'diff --git ';
+    if (!header.startsWith(prefix))
+        throw new Error('Not a diff header.');
+    const rest = header.slice(prefix.length);
+    // Without renames both sides name the same path, so the header is symmetric.
+    const side = rest.slice(0, (rest.length - 1) / 2);
+    const quoted = side.startsWith('"');
+    const other = quoted ? `"b/${side.slice(3)}` : `b/${side.slice(2)}`;
+    if (rest !== `${side} ${other}` || !side.startsWith(quoted ? '"a/' : 'a/')) {
+        throw new Error('Unexpected diff header.');
+    }
+    return quoted ? unquoteGitPath(side.slice(1, -1)).slice(2) : side.slice(2);
+}
+/**
+ * Scans only the lines a `git diff --no-renames` patch adds and returns, per
+ * file, the name of the first high-severity secret pattern found. The matched
+ * value never leaves this function.
+ */
+export function findSecretsInPatch(patch) {
+    const hits = new Map();
+    let currentPath;
+    let inHunk = false;
+    let added = [];
+    const flush = () => {
+        if (currentPath === undefined || added.length === 0)
+            return;
+        const finding = scanForSecrets(added.join('\n'), currentPath)
+            .find(item => item.severity === 'high');
+        if (finding && !hits.has(currentPath))
+            hits.set(currentPath, finding.pattern);
+    };
+    for (const line of patch.split('\n')) {
+        if (line.startsWith('diff --git ')) {
+            flush();
+            currentPath = pathFromDiffHeader(line);
+            inHunk = false;
+            added = [];
+        }
+        else if (line.startsWith('@@')) {
+            inHunk = true;
+        }
+        else if (inHunk && line.startsWith('+')) {
+            added.push(line.slice(1));
+        }
+    }
+    flush();
+    return hits;
+}