@link-assistant/hive-mind 1.37.2 → 1.37.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @link-assistant/hive-mind
 
+## 1.37.3
+
+### Patch Changes
+
+- 7bc72fa: add early --base-branch/--target-branch validation in telegram bot to reject URLs and invalid branch names before spawning solve/hive processes (Issue #1482)
+
 ## 1.37.2
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "1.37.2",
+  "version": "1.37.3",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",

package/src/solve.branch.lib.mjs

@@ -187,6 +187,24 @@ export function validateBranchName(branchName) {
   return { valid: true };
 }
 
+// Issue #1482: Validate --base-branch/--target-branch values in an args array
+// Used by telegram-bot.mjs for early validation before spawning processes
+export function validateBranchInArgs(args) {
+  const branchFlags = ['--base-branch', '-b', '--target-branch', '-tb'];
+  for (let i = 0; i < args.length; i++) {
+    for (const flag of branchFlags) {
+      if (args[i] === flag && i + 1 < args.length) {
+        const v = validateBranchName(args[i + 1]);
+        if (!v.valid) return `Invalid ${flag} value: ${v.reason}`;
+      } else if (args[i].startsWith(flag + '=')) {
+        const v = validateBranchName(args[i].substring(flag.length + 1));
+        if (!v.valid) return `Invalid ${flag} value: ${v.reason}`;
+      }
+    }
+  }
+  return null;
+}
+
 export async function createOrCheckoutBranch({ isContinueMode, prBranch, issueNumber, tempDir, defaultBranch, argv, log, formatAligned, $, crypto, owner, repo, prNumber }) {
   // Create a branch for the issue or checkout existing PR branch
   let branchName;

package/src/telegram-bot.mjs

@@ -48,6 +48,7 @@ const { createYargsConfig: createSolveYargsConfig, detectMalformedFlags } = awai
 const { createYargsConfig: createHiveYargsConfig } = await import('./hive.config.lib.mjs');
 const { parseGitHubUrl } = await import('./github.lib.mjs');
 const { validateModelName, buildModelOptionDescription } = await import('./models/index.mjs');
+const { validateBranchInArgs } = await import('./solve.branch.lib.mjs');
 const { formatUsageMessage, getAllCachedLimits } = await import('./limits.lib.mjs');
 const { getVersionInfo, formatVersionMessage } = await import('./version-info.lib.mjs');
 const { escapeMarkdown, escapeMarkdownV2, cleanNonPrintableChars, makeSpecialCharsVisible } = await import('./telegram-markdown.lib.mjs');
@@ -203,6 +204,9 @@ if (solveEnabled && solveOverrides.length > 0) {
           throw new Error(msg);
         });
       await testYargs.parse(testArgs);
+      // Issue #1482: Validate --base-branch in overrides early
+      const overrideBranchError = validateBranchInArgs(solveOverrides);
+      if (overrideBranchError) throw new Error(overrideBranchError);
       console.log('✅ Solve overrides validated successfully');
     } finally {
       // Restore stderr
@@ -243,6 +247,11 @@ if (hiveEnabled && hiveOverrides.length > 0) {
           throw new Error(msg);
         });
       await testYargs.parse(testArgs);
+      // Issue #1482: Validate --base-branch/--target-branch in overrides early
+      const overrideBranchError = validateBranchInArgs(hiveOverrides);
+      if (overrideBranchError) {
+        throw new Error(overrideBranchError);
+      }
       console.log('✅ Hive overrides validated successfully');
     } finally {
       // Restore stderr
@@ -957,6 +966,12 @@ async function handleSolveCommand(ctx) {
     await ctx.reply(`❌ ${modelError}`, { parse_mode: 'Markdown', reply_to_message_id: ctx.message.message_id });
     return;
   }
+  // Issue #1482: Validate --base-branch early to reject URLs and invalid branch names
+  const branchError = validateBranchInArgs(args);
+  if (branchError) {
+    await ctx.reply(`❌ ${branchError}`, { parse_mode: 'Markdown', reply_to_message_id: ctx.message.message_id });
+    return;
+  }
   // Issue #1092: Detect malformed flag patterns like "-- model" (space after --)
   const { malformed, errors: malformedErrors } = detectMalformedFlags(args);
   if (malformed.length > 0) {
@@ -1137,6 +1152,12 @@ async function handleHiveCommand(ctx) {
     await ctx.reply(`❌ ${hiveModelError}`, { parse_mode: 'Markdown', reply_to_message_id: ctx.message.message_id });
     return;
   }
+  // Issue #1482: Validate branch flags early to reject URLs and invalid branch names
+  const hiveBranchError = validateBranchInArgs(args);
+  if (hiveBranchError) {
+    await ctx.reply(`❌ ${hiveBranchError}`, { parse_mode: 'Markdown', reply_to_message_id: ctx.message.message_id });
+    return;
+  }
 
   // Validate merged arguments using hive's yargs config
   try {