@minimalcorp/tsunagi 0.1.34 → 0.1.35

package/dist/server/lib/worktree-manager.js

@@ -15,9 +15,23 @@ const NON_INTERACTIVE_GIT_ENV = {
     GIT_TERMINAL_PROMPT: '0',
     GIT_SSH_COMMAND: 'ssh -o BatchMode=yes',
 };
+/**
+ * simple-git は env に任意コマンドを実行しうる変数が含まれていると spawn を拒否する
+ * (`Use of "GIT_SSH_COMMAND" is not permitted without enabling allowUnsafeSshCommand`)。
+ * 親プロセスから継承した GIT_* / EDITOR 等はサーバーのgit操作には不要なため除去し、
+ * 意図して設定する GIT_SSH_COMMAND のみ allowUnsafeSshCommand で許可する。
+ */
+const BLOCKED_INHERITED_ENV = /^(GIT_|SSH_ASKPASS$|EDITOR$|PAGER$|PREFIX$)/i;
+function nonInteractiveGitEnv() {
+    const inherited = Object.entries(process.env).filter(([key, value]) => value !== undefined && !BLOCKED_INHERITED_ENV.test(key));
+    return { ...Object.fromEntries(inherited), ...NON_INTERACTIVE_GIT_ENV };
+}
 function nonInteractiveGit(baseDir) {
-    const git = baseDir ? simpleGit(baseDir) : simpleGit();
-    return git.env({ ...process.env, ...NON_INTERACTIVE_GIT_ENV });
+    const git = simpleGit({
+        ...(baseDir ? { baseDir } : {}),
+        unsafe: { allowUnsafeSshCommand: true },
+    });
+    return git.env(nonInteractiveGitEnv());
 }
 // bare repositoryのパスを取得
 function getBareRepoPath(owner, repo) {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@minimalcorp/tsunagi",
-  "version": "0.1.34",
+  "version": "0.1.35",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@minimalcorp/tsunagi",
-      "version": "0.1.34",
+      "version": "0.1.35",
       "license": "SEE LICENSE IN LICENSE",
       "os": [
         "darwin",
@@ -84,9 +84,9 @@
       }
     },
     "node_modules/@fastify/ajv-compiler/node_modules/fast-uri": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.1.5.tgz",
-      "integrity": "sha512-vZeoMRB4epNr7QfdHxel7te/RcX16CxyXI07JCCTFWZA2s4v1azGNESRj+2EoaHSaWFL/Z3GmKT2jF6A202jLg==",
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.2.1.tgz",
+      "integrity": "sha512-TmHQgewjHtMq1E5QKA0tOE0yeYGQs25KZC/ziJpubRtWI15W92e6vPFydWOeZBVROSHBYw/QhD9d5OefdD6LDg==",
       "funding": [
         {
           "type": "github",
@@ -1189,9 +1189,9 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "26.6.1",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.1.tgz",
-      "integrity": "sha512-VqGJBMCtdhqkBUCcBLvywI0NJ+KLuVzgNnlBUNFOQjqVxzo2lxLUNg1DSey8+u2u6ktswSAxg+s68QLzWHNOuA==",
+      "version": "26.6.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz",
+      "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==",
       "license": "MIT",
       "dependencies": {
         "undici-types": "~8.9.0"
@@ -2264,9 +2264,9 @@
       }
     },
     "node_modules/fast-json-stringify/node_modules/fast-uri": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.1.5.tgz",
-      "integrity": "sha512-vZeoMRB4epNr7QfdHxel7te/RcX16CxyXI07JCCTFWZA2s4v1azGNESRj+2EoaHSaWFL/Z3GmKT2jF6A202jLg==",
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.2.1.tgz",
+      "integrity": "sha512-TmHQgewjHtMq1E5QKA0tOE0yeYGQs25KZC/ziJpubRtWI15W92e6vPFydWOeZBVROSHBYw/QhD9d5OefdD6LDg==",
       "funding": [
         {
           "type": "github",
@@ -2305,9 +2305,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/fastify": {
-      "version": "5.12.4",
-      "resolved": "https://registry.npmjs.org/fastify/-/fastify-5.12.4.tgz",
-      "integrity": "sha512-zATD676fP6tBMsn+jQ7Q5/cO/Qo+149TXH0dUqUKel+1/hcZxwIbnflqtPa9EjlrvpY8eCZcL3M1UYrMc31Y7g==",
+      "version": "5.12.5",
+      "resolved": "https://registry.npmjs.org/fastify/-/fastify-5.12.5.tgz",
+      "integrity": "sha512-OB2k1dlxs5/NAABqeKV2FUHkSD2BbENsCak8yULVcymn3fHIPDVa9TI3SDnJSWYSllZmSYuZXy2gTnsT+Sut1A==",
       "funding": [
         {
           "type": "github",
@@ -2705,9 +2705,9 @@
       }
     },
     "node_modules/js-base64": {
-      "version": "3.9.3",
-      "resolved": "https://registry.npmjs.org/js-base64/-/js-base64-3.9.3.tgz",
-      "integrity": "sha512-uwYQp+VJ38FVvtim6qNbit6e9uT6dwWQ4Y1+H9TxhW5hcHjpHwoxlR0nMpqUmIFOmu4VqMxwdJA88gIVuZJQ/g==",
+      "version": "3.9.4",
+      "resolved": "https://registry.npmjs.org/js-base64/-/js-base64-3.9.4.tgz",
+      "integrity": "sha512-PtOMXpEGuP0RRiRXsjzHzl44dMHxSu2CPvAhinupR1tBa88me+1DPqsobl7eupn5UukjLkln1ZnAOAOXOrYG0Q==",
       "license": "BSD-3-Clause"
     },
     "node_modules/json-schema-ref-resolver": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minimalcorp/tsunagi",
-  "version": "0.1.34",
+  "version": "0.1.35",
   "description": "Multi-repo GitHub project management with Claude AI integration, designed for visualizing and controlling AI-driven development locally.",
   "keywords": [
     "tsunagi",