@rightkit/git 0.1.0

package/test-support.mjs

@@ -0,0 +1,33 @@
+// Shared fixtures for sync/drift/uninstall tests. Not a *.test.mjs file, so
+// `node --test *.test.mjs` never picks it up as a test suite on its own.
+
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+
+export function makeTempRepo(manifest, { packageJson } = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "right-git-test-"));
+  if (manifest) fs.writeFileSync(path.join(dir, ".rightgit.json"), `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+  fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify(packageJson || { name: "widgets" }), "utf8");
+  return dir;
+}
+
+function ghDeps(visibility) {
+  return {
+    execFile: async (cmd) => {
+      if (cmd === "gh") return { stdout: JSON.stringify({ visibility }) };
+      throw new Error(`unexpected exec: ${cmd}`);
+    },
+  };
+}
+
+export const PUBLIC_DEPS = ghDeps("PUBLIC");
+export const PRIVATE_DEPS = ghDeps("PRIVATE");
+
+export const SAMPLE_MANIFEST = {
+  schemaVersion: 1,
+  lanes: ["ci", "package-smoke"],
+  matrix: { os: ["ubuntu-latest"], node: ["22.13"] },
+  packageManager: "pnpm@11.18.0",
+  templateVersion: "1.0.0",
+};

package/uninstall.mjs

@@ -0,0 +1,36 @@
+// Remove every right-git-managed file from a repo, leaving zero managed
+// files (invariant I5). No visibility check — uninstall must always be
+// possible, including from a repo that flipped private after install.
+//
+// F6 fix: `.rightgit.json` is itself a file `install` writes, so it counts
+// as a managed file. The old implementation removed only marker-bearing
+// workflow files and never the manifest, so it leaked `.rightgit.json` —
+// including after an install that failed partway (install writes the
+// manifest *before* running sync, so a sync failure still leaves the
+// manifest on disk with zero workflow files to key off of). Uninstall must
+// remove the manifest unconditionally on presence, independent of whether
+// any workflow files exist.
+
+import fs from "node:fs";
+import path from "node:path";
+import { listManagedFiles } from "./sync.mjs";
+import { MANIFEST_FILENAME } from "./manifest.mjs";
+
+/** Returns { ok, removed: string[] }. Never throws. */
+export function uninstallCommand(repoPath) {
+  const dir = path.join(repoPath, ".github", "workflows");
+  const managed = listManagedFiles(repoPath);
+  const removed = [];
+  for (const filename of managed) {
+    fs.rmSync(path.join(dir, filename), { force: true });
+    removed.push(filename);
+  }
+
+  const manifestPath = path.join(repoPath, MANIFEST_FILENAME);
+  if (fs.existsSync(manifestPath)) {
+    fs.rmSync(manifestPath, { force: true });
+    removed.push(MANIFEST_FILENAME);
+  }
+
+  return { ok: true, removed };
+}

package/uninstall.test.mjs

@@ -0,0 +1,77 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { syncCommand } from "./sync.mjs";
+import { installCommand } from "./install.mjs";
+import { uninstallCommand } from "./uninstall.mjs";
+import { listManagedFiles } from "./sync.mjs";
+import { MANIFEST_FILENAME } from "./manifest.mjs";
+import { makeTempRepo, PUBLIC_DEPS, SAMPLE_MANIFEST } from "./test-support.mjs";
+
+test("uninstall removes every managed file, leaving zero behind — including the manifest (F6/I5)", async () => {
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  await syncCommand(dir, { deps: PUBLIC_DEPS });
+  assert.equal(listManagedFiles(dir).length, 2);
+
+  const result = uninstallCommand(dir);
+  assert.equal(result.ok, true);
+  // 2 workflow files + the manifest itself: I5 requires *zero* managed
+  // files left behind, and .rightgit.json is a file `install` wrote.
+  assert.equal(result.removed.length, 3);
+  assert.ok(result.removed.includes(MANIFEST_FILENAME));
+  assert.deepEqual(listManagedFiles(dir), []);
+  assert.equal(fs.existsSync(path.join(dir, ".github", "workflows", "ci.yml")), false);
+  assert.equal(fs.existsSync(path.join(dir, ".github", "workflows", "package-smoke.yml")), false);
+  assert.equal(fs.existsSync(path.join(dir, MANIFEST_FILENAME)), false);
+});
+
+// F6 regression: install writes .rightgit.json *before* running sync (see
+// install.mjs), so a repo whose visibility check flips or errors between
+// that write and sync's own visibility re-check is left with an orphaned
+// manifest and zero (or partial) workflow files. The old uninstallCommand
+// only ever looked at marker-bearing workflow files, so it reported success
+// while leaving the manifest behind. Reproduces the QA report's
+// "interruptedInstall" probe.
+test("F6: uninstall removes the manifest left behind by an install interrupted after the visibility check", async () => {
+  const dir = makeTempRepo(null);
+  let calls = 0;
+  const flakyDeps = {
+    execFile: async (cmd) => {
+      calls += 1;
+      if (cmd === "gh" && calls === 1) return { stdout: JSON.stringify({ visibility: "PUBLIC" }) };
+      if (cmd === "gh") throw new Error("gh: rate limited");
+      throw new Error(`unexpected exec: ${cmd}`);
+    },
+  };
+
+  const installResult = await installCommand(dir, { lanes: ["ci"] }, flakyDeps);
+  assert.equal(installResult.ok, false);
+  assert.equal(installResult.stage, "synced");
+  assert.ok(fs.existsSync(path.join(dir, MANIFEST_FILENAME)), "setup: interrupted install must still leave the manifest on disk");
+
+  const uninstallResult = uninstallCommand(dir);
+  assert.equal(uninstallResult.ok, true);
+  assert.ok(uninstallResult.removed.includes(MANIFEST_FILENAME));
+  assert.equal(fs.existsSync(path.join(dir, MANIFEST_FILENAME)), false, "F6: manifest must not survive uninstall after an interrupted install");
+});
+
+test("uninstall never touches an unmanaged file in the same directory", async () => {
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  await syncCommand(dir, { deps: PUBLIC_DEPS });
+  const handWritten = path.join(dir, ".github", "workflows", "hand-written.yml");
+  fs.writeFileSync(handWritten, "name: hand-written\n", "utf8");
+
+  uninstallCommand(dir);
+  assert.ok(fs.existsSync(handWritten), "uninstall deleted a file it does not manage");
+});
+
+test("uninstall on a repo with no managed files is a no-op, not an error", () => {
+  // makeTempRepo(null): no manifest, no workflow files — genuinely zero
+  // managed state (makeTempRepo(SAMPLE_MANIFEST) would itself write
+  // .rightgit.json, which is now correctly treated as managed per F6).
+  const dir = makeTempRepo(null);
+  const result = uninstallCommand(dir);
+  assert.equal(result.ok, true);
+  assert.deepEqual(result.removed, []);
+});

package/visibility-gate.test.mjs

@@ -0,0 +1,141 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { assertPublic, resolveVisibility, parseOwnerRepo } from "./policy/visibility-gate.mjs";
+
+function ghExecFile(visibility) {
+  return async (cmd, cmdArgs) => {
+    if (cmd === "gh") return { stdout: JSON.stringify({ visibility }) };
+    throw new Error(`unexpected exec: ${cmd} ${cmdArgs.join(" ")}`);
+  };
+}
+
+function failingGhExecFile(remoteUrl) {
+  return async (cmd, cmdArgs) => {
+    if (cmd === "gh") throw new Error("gh: command not found");
+    if (cmd === "git" && cmdArgs[0] === "remote") return { stdout: `${remoteUrl}\n` };
+    throw new Error(`unexpected exec: ${cmd} ${cmdArgs.join(" ")}`);
+  };
+}
+
+test("assertPublic allows a repo gh reports as public", async () => {
+  const result = await assertPublic("/repo", { execFile: ghExecFile("PUBLIC") });
+  assert.equal(result.allowed, true);
+  assert.equal(result.visibility, "public");
+});
+
+test("assertPublic refuses a repo gh reports as private — no override", async () => {
+  const result = await assertPublic("/repo", { execFile: ghExecFile("PRIVATE") });
+  assert.equal(result.allowed, false);
+  assert.equal(result.visibility, "private");
+  assert.match(result.reason, /public repos only/);
+});
+
+test("assertPublic refuses a repo gh reports as internal", async () => {
+  const result = await assertPublic("/repo", { execFile: ghExecFile("INTERNAL") });
+  assert.equal(result.allowed, false);
+  assert.equal(result.visibility, "internal");
+});
+
+test("assertPublic falls back to git-remote + API when gh is unavailable, and allows a confirmed-public repo", async () => {
+  const execFile = failingGhExecFile("https://github.com/acme/widgets.git");
+  const fetchFn = async () => ({ ok: true, json: async () => ({ private: false }) });
+  const result = await assertPublic("/repo", { execFile, fetch: fetchFn });
+  assert.equal(result.allowed, true);
+  assert.equal(result.source, "git-remote-api");
+});
+
+test("assertPublic fails closed to 'unknown' when neither gh nor the API can confirm public", async () => {
+  const execFile = failingGhExecFile("https://github.com/acme/widgets.git");
+  const fetchFn = async () => ({ ok: false, status: 404 });
+  const result = await assertPublic("/repo", { execFile, fetch: fetchFn });
+  assert.equal(result.allowed, false);
+  assert.equal(result.visibility, "unknown");
+  assert.match(result.reason, /fail closed/);
+});
+
+test("assertPublic never throws even when every network path errors", async () => {
+  const execFile = async () => {
+    throw new Error("no network");
+  };
+  const result = await assertPublic("/repo", { execFile, fetch: async () => { throw new Error("no network"); } });
+  assert.equal(result.allowed, false);
+  assert.equal(result.visibility, "unknown");
+});
+
+test("resolveVisibility never throws and returns a typed result on total failure", async () => {
+  const execFile = async () => {
+    throw new Error("boom");
+  };
+  const result = await resolveVisibility("/repo", { execFile });
+  assert.equal(result.source, "error");
+  assert.equal(result.visibility, "unknown");
+  assert.ok(typeof result.error === "string");
+});
+
+test("parseOwnerRepo handles https and ssh remote forms", () => {
+  assert.deepEqual(parseOwnerRepo("https://github.com/acme/widgets.git"), { owner: "acme", repo: "widgets" });
+  assert.deepEqual(parseOwnerRepo("git@github.com:acme/widgets.git"), { owner: "acme", repo: "widgets" });
+  assert.equal(parseOwnerRepo("not-a-github-url"), null);
+});
+
+// F16 regression: the old repo-name group excluded '.' from its character
+// class, so it could never reach the end-of-string anchor for a dotted repo
+// name — the whole match failed and a legitimate public repo could not be
+// identified through the gh-unavailable fallback. Reproduces the QA report's
+// exact probe input.
+test("F16: parseOwnerRepo identifies a valid GitHub repo whose name contains dots", () => {
+  assert.deepEqual(parseOwnerRepo("https://github.com/owner/repo.with.dot.git"), {
+    owner: "owner",
+    repo: "repo.with.dot",
+  });
+  assert.deepEqual(parseOwnerRepo("git@github.com:owner/repo.with.dot.git"), {
+    owner: "owner",
+    repo: "repo.with.dot",
+  });
+});
+
+// F16 non-regression: an unconfigured enterprise GitHub host must still fail
+// closed to null (the unauthenticated-API fallback only ever targets
+// api.github.com, so this parse never reaches an enterprise instance).
+test("F16: parseOwnerRepo still fails closed for an unconfigured enterprise GitHub host", () => {
+  assert.equal(parseOwnerRepo("https://github.example.com/owner/repo.git"), null);
+});
+
+// Canonicalization hygiene regression: uppercase host, embedded userinfo
+// (credentials), and a non-standard port are all *genuinely* github.com —
+// DNS is case-insensitive, userinfo is just embedded credentials, and the
+// API query ignores the port. These are not lookalike hosts, so they must
+// still resolve to the real owner/repo rather than fail closed. The WHATWG
+// URL parser already lowercases hostnames and separates userinfo/port from
+// host — parseOwnerRepo's `url.hostname` comparison relies on exactly that,
+// so this locks the behavior in against any future regression that starts
+// comparing against the raw authority string instead of `url.hostname`.
+test("canonicalization: parseOwnerRepo accepts uppercase github.com host", () => {
+  assert.deepEqual(parseOwnerRepo("https://GITHUB.COM/owner/repo"), { owner: "owner", repo: "repo" });
+  assert.deepEqual(parseOwnerRepo("https://GitHub.com/owner/repo.git"), { owner: "owner", repo: "repo" });
+});
+
+test("canonicalization: parseOwnerRepo accepts a github.com remote with embedded userinfo", () => {
+  assert.deepEqual(parseOwnerRepo("https://attacker@github.com/victim/repo"), {
+    owner: "victim",
+    repo: "repo",
+  });
+});
+
+test("canonicalization: parseOwnerRepo accepts a github.com remote on a non-standard port", () => {
+  assert.deepEqual(parseOwnerRepo("https://github.com:8443/owner/repo"), { owner: "owner", repo: "repo" });
+});
+
+// Lookalike-family non-regression (N1): every one of these has a host that
+// is NOT github.com — they must keep failing closed to null. Re-asserted
+// here alongside the canonicalization-hygiene cases above so the two
+// concerns (accept real github.com in any authority shape, reject anything
+// that merely contains the substring "github.com") are tested side by side.
+test("N1 lookalikes: parseOwnerRepo still rejects every non-github.com host", () => {
+  assert.equal(parseOwnerRepo("https://notgithub.com/owner/repo"), null);
+  assert.equal(parseOwnerRepo("https://github.com.evil.io/owner/repo"), null);
+  assert.equal(parseOwnerRepo("https://mygithub.com/owner/repo"), null);
+  assert.equal(parseOwnerRepo("https://github.com@evil.io/owner/repo"), null);
+  assert.equal(parseOwnerRepo("https://github.como/owner/repo"), null);
+  assert.equal(parseOwnerRepo("https://github.example.com/owner/repo"), null);
+});