@rudderhq/agent-runtime-utils 0.2.0-canary.2 → 0.2.0-canary.21

package/dist/git-identity.d.ts

@@ -0,0 +1,31 @@
+export type GitIdentitySource = "environment" | "repository" | "rudder_confirmed" | "global";
+export type GitIdentity = {
+    name: string;
+    email: string;
+    source: GitIdentitySource;
+};
+export type GitIdentityPreparationResult = {
+    identity: GitIdentity | null;
+    configTarget: string;
+    configuredUseConfigOnly: boolean;
+    warnings: string[];
+};
+type LogFn = (stream: "stdout" | "stderr", chunk: string) => Promise<void>;
+export declare function isUnsafeGitIdentityEmail(email: string | null | undefined): boolean;
+export declare function applyGitIdentityPreparationEnv(env: Record<string, string>, preparation: GitIdentityPreparationResult): void;
+export declare function normalizeConfirmedRudderGitIdentity(input: unknown): GitIdentity | null;
+export declare function ensureGitIdentityFileConfig(input: {
+    cwd: string;
+    home: string;
+    sourceEnv?: NodeJS.ProcessEnv;
+    onLog?: LogFn | null;
+    confirmedIdentity?: GitIdentity | null;
+}): Promise<GitIdentityPreparationResult>;
+export declare function ensureGitRepositoryIdentityConfig(input: {
+    cwd: string;
+    sourceEnv?: NodeJS.ProcessEnv;
+    onLog?: LogFn | null;
+    confirmedIdentity?: GitIdentity | null;
+}): Promise<GitIdentityPreparationResult>;
+export {};
+//# sourceMappingURL=git-identity.d.ts.map

package/dist/git-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-identity.d.ts","sourceRoot":"","sources":["../src/git-identity.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,YAAY,GAAG,kBAAkB,GAAG,QAAQ,CAAC;AAE7F,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,iBAAiB,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,uBAAuB,EAAE,OAAO,CAAC;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAgBF,KAAK,KAAK,GAAG,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAkB3E,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAKlF;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,WAAW,EAAE,4BAA4B,GACxC,IAAI,CAWN;AAyBD,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAStF;AAsID,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC9B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;IACrB,iBAAiB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACxC,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAgDxC;AAED,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC9B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;IACrB,iBAAiB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACxC,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAoCxC"}

package/dist/git-identity.js

@@ -0,0 +1,250 @@
+import { spawn } from "node:child_process";
+import fs from "node:fs/promises";
+import path from "node:path";
+const GIT_IDENTITY_ENV_KEYS = [
+    "GIT_AUTHOR_NAME",
+    "GIT_AUTHOR_EMAIL",
+    "GIT_COMMITTER_NAME",
+    "GIT_COMMITTER_EMAIL",
+];
+const LOCAL_EMAIL_RE = /@[^@\s<>]+\.local$/i;
+const EMAIL_RE = /^[^@\s<>]+@[^@\s<>]+\.[^@\s<>]+$/;
+function normalizeEnv(env) {
+    return Object.fromEntries(Object.entries(env ?? process.env).filter((entry) => typeof entry[1] === "string"));
+}
+function nonEmpty(value) {
+    const normalized = value?.trim() ?? "";
+    return normalized.length > 0 ? normalized : null;
+}
+export function isUnsafeGitIdentityEmail(email) {
+    const normalized = nonEmpty(email);
+    if (!normalized)
+        return true;
+    if (!EMAIL_RE.test(normalized))
+        return true;
+    return LOCAL_EMAIL_RE.test(normalized);
+}
+export function applyGitIdentityPreparationEnv(env, preparation) {
+    env.GIT_CONFIG_GLOBAL = preparation.configTarget;
+    if (!preparation.identity) {
+        for (const key of GIT_IDENTITY_ENV_KEYS)
+            env[key] = "";
+        return;
+    }
+    env.GIT_AUTHOR_NAME = preparation.identity.name;
+    env.GIT_AUTHOR_EMAIL = preparation.identity.email;
+    env.GIT_COMMITTER_NAME = preparation.identity.name;
+    env.GIT_COMMITTER_EMAIL = preparation.identity.email;
+}
+function buildIdentity(name, email, source) {
+    const normalizedName = nonEmpty(name);
+    const normalizedEmail = nonEmpty(email);
+    if (!normalizedName || !normalizedEmail)
+        return null;
+    if (isUnsafeGitIdentityEmail(normalizedEmail))
+        return null;
+    return {
+        name: normalizedName,
+        email: normalizedEmail,
+        source,
+    };
+}
+function identityFromEnv(env) {
+    return (buildIdentity(env.GIT_AUTHOR_NAME, env.GIT_AUTHOR_EMAIL, "environment") ??
+        buildIdentity(env.GIT_COMMITTER_NAME, env.GIT_COMMITTER_EMAIL, "environment"));
+}
+export function normalizeConfirmedRudderGitIdentity(input) {
+    if (!input || typeof input !== "object")
+        return null;
+    const record = input;
+    if (record.confirmed === false)
+        return null;
+    return buildIdentity(typeof record.name === "string" ? record.name : null, typeof record.email === "string" ? record.email : null, "rudder_confirmed");
+}
+async function runGit(args, opts = {}) {
+    const env = normalizeEnv(opts.env);
+    return await new Promise((resolve) => {
+        const child = spawn("git", args, {
+            cwd: opts.cwd ?? process.cwd(),
+            env,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout?.on("data", (chunk) => {
+            stdout += String(chunk);
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderr += String(chunk);
+        });
+        child.on("error", (error) => {
+            resolve({ code: null, stdout, stderr, error });
+        });
+        child.on("close", (code) => {
+            resolve({ code, stdout, stderr, error: null });
+        });
+    });
+}
+async function readGitConfigValue(args, key, opts = {}) {
+    const result = await runGit([...args, "--get", key], opts);
+    if (result.code !== 0)
+        return null;
+    return nonEmpty(result.stdout);
+}
+async function readIdentityFromGitConfig(args, source, opts = {}) {
+    const [name, email] = await Promise.all([
+        readGitConfigValue(args, "user.name", opts),
+        readGitConfigValue(args, "user.email", opts),
+    ]);
+    return buildIdentity(name, email, source);
+}
+async function setGitConfigValue(args, key, value, opts) {
+    const result = await runGit([...args, key, value], opts);
+    if (result.code === 0)
+        return;
+    const details = [result.stderr.trim(), result.stdout.trim(), result.error?.message]
+        .filter(Boolean)
+        .join("\n");
+    throw new Error(details || `git config ${key} failed`);
+}
+async function unsetGitConfigValue(args, key, opts) {
+    await runGit([...args, "--unset-all", key], opts);
+}
+async function existingGitConfigPaths(candidates) {
+    const seen = new Set();
+    const existing = [];
+    for (const candidate of candidates) {
+        const normalized = nonEmpty(candidate);
+        if (!normalized)
+            continue;
+        const resolved = path.resolve(normalized);
+        if (seen.has(resolved))
+            continue;
+        const stat = await fs.stat(resolved).catch(() => null);
+        if (!stat?.isFile())
+            continue;
+        seen.add(resolved);
+        existing.push(resolved);
+    }
+    return existing;
+}
+async function resolveHostGlobalGitConfigIncludes(sourceEnv, targetConfigPath) {
+    const home = nonEmpty(sourceEnv.HOME);
+    const xdgConfigHome = nonEmpty(sourceEnv.XDG_CONFIG_HOME);
+    const candidates = [
+        nonEmpty(sourceEnv.GIT_CONFIG_GLOBAL) ?? "",
+        home ? path.join(home, ".gitconfig") : "",
+        xdgConfigHome ? path.join(xdgConfigHome, "git", "config") : "",
+        home ? path.join(home, ".config", "git", "config") : "",
+    ].filter(Boolean);
+    const target = path.resolve(targetConfigPath);
+    return (await existingGitConfigPaths(candidates)).filter((candidate) => candidate !== target);
+}
+function renderGitConfigIncludes(includePaths) {
+    if (includePaths.length === 0)
+        return [];
+    return ["[include]", ...includePaths.map((includePath) => `\tpath = ${includePath}`), ""];
+}
+async function writeGitConfigSeed(configPath, includePaths) {
+    await fs.mkdir(path.dirname(configPath), { recursive: true });
+    const lines = renderGitConfigIncludes(includePaths);
+    await fs.writeFile(configPath, lines.length > 0 ? `${lines.join("\n")}\n` : "", "utf8");
+}
+async function writeFallbackGitConfigFile(configPath, identity, includePaths = []) {
+    const lines = [...renderGitConfigIncludes(includePaths), "[user]", "\tuseConfigOnly = true"];
+    if (identity) {
+        lines.push(`\tname = ${identity.name}`);
+        lines.push(`\temail = ${identity.email}`);
+    }
+    await fs.mkdir(path.dirname(configPath), { recursive: true });
+    await fs.writeFile(configPath, `${lines.join("\n")}\n`, "utf8");
+}
+async function resolveBestGitIdentity(input) {
+    return (identityFromEnv(input.sourceEnv) ??
+        (await readIdentityFromGitConfig(["config", "--local"], "repository", {
+            cwd: input.cwd,
+            env: input.sourceEnv,
+        })) ??
+        input.confirmedIdentity ??
+        (await readIdentityFromGitConfig(["config", "--global"], "global", {
+            cwd: input.cwd,
+            env: input.sourceEnv,
+        })));
+}
+export async function ensureGitIdentityFileConfig(input) {
+    const sourceEnv = normalizeEnv(input.sourceEnv);
+    const home = path.resolve(input.home);
+    const gitConfigPath = path.join(home, ".gitconfig");
+    await fs.mkdir(home, { recursive: true });
+    const configArgs = ["config", "--file", gitConfigPath];
+    const identity = await resolveBestGitIdentity({
+        cwd: input.cwd,
+        sourceEnv,
+        confirmedIdentity: input.confirmedIdentity,
+    });
+    const includePaths = identity
+        ? await resolveHostGlobalGitConfigIncludes(sourceEnv, gitConfigPath)
+        : [];
+    const warnings = [];
+    try {
+        await writeGitConfigSeed(gitConfigPath, includePaths);
+        await setGitConfigValue(configArgs, "user.useConfigOnly", "true", { cwd: input.cwd, env: sourceEnv });
+        if (identity) {
+            await setGitConfigValue(configArgs, "user.name", identity.name, { cwd: input.cwd, env: sourceEnv });
+            await setGitConfigValue(configArgs, "user.email", identity.email, { cwd: input.cwd, env: sourceEnv });
+        }
+        else {
+            await unsetGitConfigValue(configArgs, "user.name", { cwd: input.cwd, env: sourceEnv });
+            await unsetGitConfigValue(configArgs, "user.email", { cwd: input.cwd, env: sourceEnv });
+        }
+    }
+    catch (error) {
+        warnings.push(error instanceof Error ? error.message : String(error));
+        await writeFallbackGitConfigFile(gitConfigPath, identity, includePaths);
+    }
+    if (input.onLog) {
+        const detail = identity
+            ? `using ${identity.source} Git identity ${identity.name} <${identity.email}>`
+            : "without a usable Git identity; commits will fail until user.name and user.email are configured";
+        await input.onLog("stdout", `[rudder] Prepared isolated Git config at ${gitConfigPath} with user.useConfigOnly=true (${detail}).\n`);
+    }
+    return {
+        identity,
+        configTarget: gitConfigPath,
+        configuredUseConfigOnly: true,
+        warnings,
+    };
+}
+export async function ensureGitRepositoryIdentityConfig(input) {
+    const sourceEnv = normalizeEnv(input.sourceEnv);
+    const cwd = path.resolve(input.cwd);
+    const configArgs = ["config", "--local"];
+    const identity = await resolveBestGitIdentity({
+        cwd,
+        sourceEnv,
+        confirmedIdentity: input.confirmedIdentity,
+    });
+    const warnings = [];
+    await setGitConfigValue(configArgs, "user.useConfigOnly", "true", { cwd, env: sourceEnv });
+    if (identity) {
+        await setGitConfigValue(configArgs, "user.name", identity.name, { cwd, env: sourceEnv });
+        await setGitConfigValue(configArgs, "user.email", identity.email, { cwd, env: sourceEnv });
+    }
+    else {
+        await unsetGitConfigValue(configArgs, "user.name", { cwd, env: sourceEnv });
+        await unsetGitConfigValue(configArgs, "user.email", { cwd, env: sourceEnv });
+    }
+    if (input.onLog) {
+        const detail = identity
+            ? `using ${identity.source} Git identity ${identity.name} <${identity.email}>`
+            : "without a usable Git identity; commits will fail until user.name and user.email are configured";
+        await input.onLog("stdout", `[rudder] Prepared repository Git config in ${cwd} with user.useConfigOnly=true (${detail}).\n`);
+    }
+    return {
+        identity,
+        configTarget: cwd,
+        configuredUseConfigOnly: true,
+        warnings,
+    };
+}
+//# sourceMappingURL=git-identity.js.map

package/dist/git-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-identity.js","sourceRoot":"","sources":["../src/git-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAiB7B,MAAM,qBAAqB,GAAG;IAC5B,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;IACpB,qBAAqB;CACb,CAAC;AAWX,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAC7C,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAEpD,SAAS,YAAY,CAAC,GAAkC;IACtD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CACvC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CACnE,CACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAgC;IAChD,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvC,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAgC;IACvE,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,GAA2B,EAC3B,WAAyC;IAEzC,GAAG,CAAC,iBAAiB,GAAG,WAAW,CAAC,YAAY,CAAC;IACjD,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,qBAAqB;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QACvD,OAAO;IACT,CAAC;IAED,GAAG,CAAC,eAAe,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;IAChD,GAAG,CAAC,gBAAgB,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC;IAClD,GAAG,CAAC,kBAAkB,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;IACnD,GAAG,CAAC,mBAAmB,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC;AACvD,CAAC;AAED,SAAS,aAAa,CACpB,IAA+B,EAC/B,KAAgC,EAChC,MAAyB;IAEzB,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,cAAc,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,wBAAwB,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,eAAe;QACtB,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAsB;IAC7C,OAAO,CACL,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC;QACvE,aAAa,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAC9E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,KAAc;IAChE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,MAAM,GAAG,KAAiE,CAAC;IACjF,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,aAAa,CAClB,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EACpD,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EACtD,kBAAkB,CACnB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,IAAc,EACd,OAAyD,EAAE;IAE3D,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,MAAM,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YAC9B,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACjC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACjC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAAc,EACd,GAAW,EACX,OAAyD,EAAE;IAE3D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,IAAc,EACd,MAAyB,EACzB,OAAyD,EAAE;IAE3D,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACtC,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC;QAC3C,kBAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC;KAC7C,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAc,EAAE,GAAW,EAAE,KAAa,EAAE,IAAsD;IACjI,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAC9B,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC;SAChF,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,cAAc,GAAG,SAAS,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAc,EAAE,GAAW,EAAE,IAAsD;IACpH,MAAM,MAAM,CAAC,CAAC,GAAG,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,UAAoB;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QACjC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE;YAAE,SAAS;QAC9B,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,kCAAkC,CAAC,SAA4B,EAAE,gBAAwB;IACtG,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG;QACjB,QAAQ,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE;QAC3C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE;QACzC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;QAC9D,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;KACxD,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,uBAAuB,CAAC,YAAsB;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,CAAC,WAAW,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,YAAY,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,UAAkB,EAAE,YAAsB;IAC1E,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AAC1F,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,UAAkB,EAAE,QAA4B,EAAE,eAAyB,EAAE;IACrH,MAAM,KAAK,GAAG,CAAC,GAAG,uBAAuB,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,wBAAwB,CAAC,CAAC;IAC7F,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,YAAY,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,KAIrC;IACC,OAAO,CACL,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC;QAChC,CAAC,MAAM,yBAAyB,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE;YACpE,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,SAAS;SACrB,CAAC,CAAC;QACH,KAAK,CAAC,iBAAiB;QACvB,CAAC,MAAM,yBAAyB,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE;YACjE,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,SAAS;SACrB,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAMjD;IACC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1C,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC;QAC5C,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,SAAS;QACT,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,QAAQ;QAC3B,CAAC,CAAC,MAAM,kCAAkC,CAAC,SAAS,EAAE,aAAa,CAAC;QACpE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QACtD,MAAM,iBAAiB,CAAC,UAAU,EAAE,oBAAoB,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QACtG,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,iBAAiB,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;YACpG,MAAM,iBAAiB,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QACxG,CAAC;aAAM,CAAC;YACN,MAAM,mBAAmB,CAAC,UAAU,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;YACvF,MAAM,mBAAmB,CAAC,UAAU,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,MAAM,0BAA0B,CAAC,aAAa,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,QAAQ;YACrB,CAAC,CAAC,SAAS,QAAQ,CAAC,MAAM,iBAAiB,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,GAAG;YAC9E,CAAC,CAAC,gGAAgG,CAAC;QACrG,MAAM,KAAK,CAAC,KAAK,CACf,QAAQ,EACR,4CAA4C,aAAa,kCAAkC,MAAM,MAAM,CACxG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,aAAa;QAC3B,uBAAuB,EAAE,IAAI;QAC7B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAKvD;IACC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC;QAC5C,GAAG;QACH,SAAS;QACT,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IACH,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,iBAAiB,CAAC,UAAU,EAAE,oBAAoB,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3F,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,iBAAiB,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QACzF,MAAM,iBAAiB,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7F,CAAC;SAAM,CAAC;QACN,MAAM,mBAAmB,CAAC,UAAU,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5E,MAAM,mBAAmB,CAAC,UAAU,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,QAAQ;YACrB,CAAC,CAAC,SAAS,QAAQ,CAAC,MAAM,iBAAiB,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,GAAG;YAC9E,CAAC,CAAC,gGAAgG,CAAC;QACrG,MAAM,KAAK,CAAC,KAAK,CACf,QAAQ,EACR,8CAA8C,GAAG,kCAAkC,MAAM,MAAM,CAChG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,GAAG;QACjB,uBAAuB,EAAE,IAAI;QAC7B,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/git-identity.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=git-identity.test.d.ts.map

package/dist/git-identity.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-identity.test.d.ts","sourceRoot":"","sources":["../src/git-identity.test.ts"],"names":[],"mappings":""}

package/dist/git-identity.test.js

@@ -0,0 +1,347 @@
+import { execFile } from "node:child_process";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import { describe, expect, it } from "vitest";
+import { applyGitIdentityPreparationEnv, ensureGitIdentityFileConfig, ensureGitRepositoryIdentityConfig, isUnsafeGitIdentityEmail, normalizeConfirmedRudderGitIdentity, } from "./git-identity.js";
+const execFileAsync = promisify(execFile);
+function baseGitTestEnv(env) {
+    const base = { ...process.env };
+    for (const key of [
+        "GIT_AUTHOR_NAME",
+        "GIT_AUTHOR_EMAIL",
+        "GIT_COMMITTER_NAME",
+        "GIT_COMMITTER_EMAIL",
+        "GIT_CONFIG_GLOBAL",
+        "XDG_CONFIG_HOME",
+    ]) {
+        delete base[key];
+    }
+    return {
+        ...base,
+        ...env,
+    };
+}
+async function runGit(cwd, args, env) {
+    return execFileAsync("git", args, {
+        cwd,
+        env: baseGitTestEnv(env),
+    });
+}
+async function createRepoWithoutStoredIdentity(root) {
+    const repo = path.join(root, "repo");
+    await fs.mkdir(repo, { recursive: true });
+    await runGit(repo, ["init"]);
+    await fs.writeFile(path.join(repo, "README.md"), "hello\n", "utf8");
+    await runGit(repo, ["add", "README.md"]);
+    await runGit(repo, [
+        "-c",
+        "user.name=Setup User",
+        "-c",
+        "user.email=setup@example.com",
+        "commit",
+        "-m",
+        "Initial commit",
+    ]);
+    await runGit(repo, ["checkout", "-B", "main"]);
+    return repo;
+}
+async function gitAuthorIdent(cwd, env) {
+    return execFileAsync("git", ["var", "GIT_AUTHOR_IDENT"], {
+        cwd,
+        env: baseGitTestEnv(env),
+    });
+}
+describe("git identity guard", () => {
+    it("rejects local-host fallback emails as unsafe identities", () => {
+        expect(isUnsafeGitIdentityEmail("zeeland@ZeelanddeMacBook-Pro.local")).toBe(true);
+        expect(isUnsafeGitIdentityEmail("72488598+Undertone0809@users.noreply.github.com")).toBe(false);
+    });
+    it("seeds isolated HOME Git config from repository identity", async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), "rudder-git-identity-repo-"));
+        try {
+            const repo = await createRepoWithoutStoredIdentity(root);
+            const isolatedHome = path.join(root, "agent-home");
+            await runGit(repo, ["config", "user.name", "Rudder Agent"]);
+            await runGit(repo, ["config", "user.email", "rudder-agent@example.com"]);
+            const result = await ensureGitIdentityFileConfig({
+                cwd: repo,
+                home: isolatedHome,
+                sourceEnv: baseGitTestEnv({
+                    HOME: path.join(root, "empty-home"),
+                    GIT_CONFIG_NOSYSTEM: "1",
+                }),
+            });
+            expect(result.identity).toMatchObject({
+                name: "Rudder Agent",
+                email: "rudder-agent@example.com",
+                source: "repository",
+            });
+            await expect(fs.readFile(path.join(isolatedHome, ".gitconfig"), "utf8")).resolves.toContain("useConfigOnly = true");
+            const ident = await gitAuthorIdent(repo, {
+                HOME: isolatedHome,
+                GIT_CONFIG_NOSYSTEM: "1",
+            });
+            expect(ident.stdout).toContain("Rudder Agent <rudder-agent@example.com>");
+            expect(ident.stdout).not.toContain(".local");
+        }
+        finally {
+            await fs.rm(root, { recursive: true, force: true });
+        }
+    });
+    it("includes host global Git config when a safe identity is resolved", async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), "rudder-git-identity-include-"));
+        try {
+            const repo = await createRepoWithoutStoredIdentity(root);
+            const hostHome = path.join(root, "host-home");
+            const isolatedHome = path.join(root, "agent-home");
+            await fs.mkdir(hostHome, { recursive: true });
+            await fs.writeFile(path.join(hostHome, ".gitconfig"), [
+                "[user]",
+                "\tname = Host Operator",
+                "\temail = operator@example.com",
+                "[credential]",
+                "\thelper = store",
+            ].join("\n") + "\n", "utf8");
+            const result = await ensureGitIdentityFileConfig({
+                cwd: repo,
+                home: isolatedHome,
+                sourceEnv: baseGitTestEnv({
+                    HOME: hostHome,
+                    GIT_CONFIG_NOSYSTEM: "1",
+                }),
+            });
+            expect(result.identity).toMatchObject({
+                name: "Host Operator",
+                email: "operator@example.com",
+                source: "global",
+            });
+            await expect(runGit(repo, [
+                "config",
+                "--get",
+                "credential.helper",
+            ], {
+                HOME: isolatedHome,
+                GIT_CONFIG_GLOBAL: path.join(isolatedHome, ".gitconfig"),
+                GIT_CONFIG_NOSYSTEM: "1",
+            })).resolves.toMatchObject({ stdout: "store\n" });
+            await expect(runGit(repo, [
+                "config",
+                "--get",
+                "user.email",
+            ], {
+                HOME: isolatedHome,
+                GIT_CONFIG_GLOBAL: path.join(isolatedHome, ".gitconfig"),
+                GIT_CONFIG_NOSYSTEM: "1",
+            })).resolves.toMatchObject({ stdout: "operator@example.com\n" });
+        }
+        finally {
+            await fs.rm(root, { recursive: true, force: true });
+        }
+    });
+    it("prevents Git fallback commits when isolated HOME has no usable identity", async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), "rudder-git-identity-missing-"));
+        try {
+            const repo = await createRepoWithoutStoredIdentity(root);
+            const isolatedHome = path.join(root, "agent-home");
+            const result = await ensureGitIdentityFileConfig({
+                cwd: repo,
+                home: isolatedHome,
+                sourceEnv: baseGitTestEnv({
+                    HOME: path.join(root, "empty-home"),
+                    GIT_CONFIG_NOSYSTEM: "1",
+                }),
+            });
+            expect(result.identity).toBeNull();
+            await expect(gitAuthorIdent(repo, {
+                HOME: isolatedHome,
+                GIT_CONFIG_NOSYSTEM: "1",
+            })).rejects.toMatchObject({
+                stderr: expect.not.stringContaining(".local"),
+            });
+            await expect(execFileAsync("git", ["commit", "--allow-empty", "-m", "agent commit"], {
+                cwd: repo,
+                env: baseGitTestEnv({
+                    HOME: isolatedHome,
+                    GIT_CONFIG_NOSYSTEM: "1",
+                }),
+            })).rejects.toMatchObject({
+                stderr: expect.stringContaining("auto-detection is disabled"),
+            });
+            const count = await runGit(repo, ["rev-list", "--count", "HEAD"]);
+            expect(count.stdout.trim()).toBe("1");
+        }
+        finally {
+            await fs.rm(root, { recursive: true, force: true });
+        }
+    });
+    it("does not reuse stale managed HOME Git identity when current sources are missing", async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), "rudder-git-identity-stale-managed-"));
+        try {
+            const repo = await createRepoWithoutStoredIdentity(root);
+            const isolatedHome = path.join(root, "agent-home");
+            await fs.mkdir(isolatedHome, { recursive: true });
+            await fs.writeFile(path.join(isolatedHome, ".gitconfig"), [
+                "[user]",
+                "\tname = Old Operator",
+                "\temail = old@example.com",
+                "\tuseConfigOnly = true",
+            ].join("\n") + "\n", "utf8");
+            const result = await ensureGitIdentityFileConfig({
+                cwd: repo,
+                home: isolatedHome,
+                sourceEnv: baseGitTestEnv({
+                    HOME: path.join(root, "empty-home"),
+                    GIT_CONFIG_NOSYSTEM: "1",
+                }),
+            });
+            expect(result.identity).toBeNull();
+            const managedConfig = await fs.readFile(path.join(isolatedHome, ".gitconfig"), "utf8");
+            expect(managedConfig).toContain("useConfigOnly = true");
+            expect(managedConfig).not.toContain("old@example.com");
+            await expect(gitAuthorIdent(repo, {
+                HOME: isolatedHome,
+                GIT_CONFIG_NOSYSTEM: "1",
+            })).rejects.toMatchObject({
+                stderr: expect.not.stringContaining("old@example.com"),
+            });
+        }
+        finally {
+            await fs.rm(root, { recursive: true, force: true });
+        }
+    });
+    it("applies an isolated Git config and blanks unsafe inherited identity env when identity is missing", async () => {
+        const env = {
+            GIT_AUTHOR_NAME: "Host User",
+            GIT_AUTHOR_EMAIL: "host@machine.local",
+            GIT_COMMITTER_NAME: "Host User",
+            GIT_COMMITTER_EMAIL: "host@machine.local",
+        };
+        applyGitIdentityPreparationEnv(env, {
+            identity: null,
+            configTarget: "/tmp/rudder-agent-home/.gitconfig",
+            configuredUseConfigOnly: true,
+            warnings: [],
+        });
+        expect(env).toMatchObject({
+            GIT_CONFIG_GLOBAL: "/tmp/rudder-agent-home/.gitconfig",
+            GIT_AUTHOR_NAME: "",
+            GIT_AUTHOR_EMAIL: "",
+            GIT_COMMITTER_NAME: "",
+            GIT_COMMITTER_EMAIL: "",
+        });
+    });
+    it("applies isolated Git config and confirmed identity env when identity is available", async () => {
+        const env = {};
+        applyGitIdentityPreparationEnv(env, {
+            identity: {
+                name: "Rudder Operator",
+                email: "operator@example.com",
+                source: "global",
+            },
+            configTarget: "/tmp/rudder-agent-home/.gitconfig",
+            configuredUseConfigOnly: true,
+            warnings: [],
+        });
+        expect(env).toMatchObject({
+            GIT_CONFIG_GLOBAL: "/tmp/rudder-agent-home/.gitconfig",
+            GIT_AUTHOR_NAME: "Rudder Operator",
+            GIT_AUTHOR_EMAIL: "operator@example.com",
+            GIT_COMMITTER_NAME: "Rudder Operator",
+            GIT_COMMITTER_EMAIL: "operator@example.com",
+        });
+    });
+    it("configures repository useConfigOnly without inventing a fallback identity", async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), "rudder-git-identity-worktree-"));
+        try {
+            const repo = await createRepoWithoutStoredIdentity(root);
+            const result = await ensureGitRepositoryIdentityConfig({
+                cwd: repo,
+                sourceEnv: baseGitTestEnv({
+                    HOME: path.join(root, "empty-home"),
+                    GIT_CONFIG_NOSYSTEM: "1",
+                }),
+            });
+            expect(result.identity).toBeNull();
+            await expect(runGit(repo, ["config", "--local", "--get", "user.useConfigOnly"])).resolves.toMatchObject({
+                stdout: "true\n",
+            });
+            await expect(gitAuthorIdent(repo, {
+                HOME: path.join(root, "empty-home"),
+                GIT_CONFIG_NOSYSTEM: "1",
+            })).rejects.toMatchObject({
+                stderr: expect.not.stringContaining(".local"),
+            });
+        }
+        finally {
+            await fs.rm(root, { recursive: true, force: true });
+        }
+    });
+    it("normalizes only safe confirmed Rudder identities", () => {
+        expect(normalizeConfirmedRudderGitIdentity({
+            name: "  Rudder Operator  ",
+            email: " operator@example.com ",
+            confirmed: true,
+        })).toEqual({
+            name: "Rudder Operator",
+            email: "operator@example.com",
+            source: "rudder_confirmed",
+        });
+        expect(normalizeConfirmedRudderGitIdentity({
+            name: "Host User",
+            email: "host@machine.local",
+            confirmed: true,
+        })).toBeNull();
+        expect(normalizeConfirmedRudderGitIdentity({
+            name: "Host User",
+            email: "host@example.com",
+            confirmed: false,
+        })).toBeNull();
+    });
+    it("prefers confirmed Rudder identity over host global identity for isolated config", async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), "rudder-git-identity-confirmed-"));
+        try {
+            const repo = await createRepoWithoutStoredIdentity(root);
+            const hostHome = path.join(root, "host-home");
+            const isolatedHome = path.join(root, "agent-home");
+            await fs.mkdir(hostHome, { recursive: true });
+            await fs.writeFile(path.join(hostHome, ".gitconfig"), [
+                "[user]",
+                "\tname = Host Operator",
+                "\temail = host@example.com",
+            ].join("\n") + "\n", "utf8");
+            const result = await ensureGitIdentityFileConfig({
+                cwd: repo,
+                home: isolatedHome,
+                sourceEnv: baseGitTestEnv({
+                    HOME: hostHome,
+                    GIT_CONFIG_NOSYSTEM: "1",
+                }),
+                confirmedIdentity: normalizeConfirmedRudderGitIdentity({
+                    name: "Confirmed Operator",
+                    email: "confirmed@example.com",
+                    confirmed: true,
+                }),
+            });
+            expect(result.identity).toMatchObject({
+                name: "Confirmed Operator",
+                email: "confirmed@example.com",
+                source: "rudder_confirmed",
+            });
+            await expect(runGit(repo, [
+                "config",
+                "--get",
+                "user.email",
+            ], {
+                HOME: isolatedHome,
+                GIT_CONFIG_GLOBAL: path.join(isolatedHome, ".gitconfig"),
+                GIT_CONFIG_NOSYSTEM: "1",
+            })).resolves.toMatchObject({ stdout: "confirmed@example.com\n" });
+        }
+        finally {
+            await fs.rm(root, { recursive: true, force: true });
+        }
+    });
+});
+//# sourceMappingURL=git-identity.test.js.map