@sentry/junior-github 0.162.0 → 0.163.0

package/dist/index.js

@@ -730,12 +730,28 @@ import {
   pluginToolOutputSchema
 } from "@sentry/junior-plugin-api";
 import { z } from "zod";
-var RESERVED_SANDBOX_DIRECTORIES = /* @__PURE__ */ new Set([".junior", "data", "skills"]);
+
+// src/sandbox-paths.ts
+var RESERVED_SANDBOX_DIRECTORIES = /* @__PURE__ */ new Set([
+  ".junior",
+  "data",
+  "skills"
+]);
+function isReservedSandboxDirectory(path) {
+  return RESERVED_SANDBOX_DIRECTORIES.has(path.toLowerCase());
+}
+
+// src/tools/clone-repository.ts
 var inputSchema = z.object({
   repo: z.string().describe('Repository in "owner/name" format.'),
-  directory: z.string().regex(/^[A-Za-z0-9._-]+$/).refine((value) => value !== "." && value !== "..", {
-    message: "Directory must be a single directory name."
-  }).describe("Optional destination directory under the sandbox root.").optional()
+  directory: z.string().regex(/^(?:[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*)$/).refine(
+    (value) => !value.split("/").some((part) => part === "." || part === ".."),
+    {
+      message: "Directory must be a relative path without . or .. segments."
+    }
+  ).describe(
+    "Optional destination directory under the sandbox root. Defaults to repos/{name}."
+  ).optional()
 }).strict();
 var cloneSchema = z.object({
   path: z.string(),
@@ -753,7 +769,7 @@ function parseRepo(value) {
   return { owner: parts[0], name: parts[1] };
 }
 function defaultDirectory(repoName) {
-  return RESERVED_SANDBOX_DIRECTORIES.has(repoName) ? `${repoName}-repo` : repoName;
+  return `repos/${repoName}`;
 }
 function commandSignal(signal, timeoutMs) {
   const timeout = AbortSignal.timeout(timeoutMs);
@@ -802,7 +818,27 @@ function createGitHubCloneRepositoryTool(ctx) {
     async execute(input, options) {
       const repo = parseRepo(input.repo);
       const directory = input.directory ?? defaultDirectory(repo.name);
+      const rootSegment = directory.split("/")[0] ?? directory;
+      if (isReservedSandboxDirectory(rootSegment)) {
+        throw new PluginToolInputError(
+          `Directory conflicts with a reserved sandbox path: ${directory}`
+        );
+      }
       const path = `${ctx.sandbox.root}/${directory}`;
+      const parentDirectory = directory.includes("/") ? directory.slice(0, directory.lastIndexOf("/")) : void 0;
+      if (parentDirectory) {
+        const mkdir = await ctx.sandbox.run({
+          cmd: "mkdir",
+          args: ["-p", "--", `${ctx.sandbox.root}/${parentDirectory}`],
+          cwd: ctx.sandbox.root,
+          signal: commandSignal(options.signal, 3e4)
+        });
+        if (mkdir.exitCode !== 0) {
+          throw new PluginToolInputError(
+            `Failed to create clone parent directory: ${parentDirectory}`
+          );
+        }
+      }
       const exists = await ctx.sandbox.run({
         cmd: "bash",
         args: ["-c", `test -e "$1"`, "bash", path],
@@ -4911,6 +4947,63 @@ function linkifyGitHubReferences(text2) {
   }).join("\n");
 }
 
+// src/workspace-prepare.ts
+async function prepareWorkspace(ctx) {
+  const repos = ctx.repos.map((entry) => {
+    const [owner, name, ...rest] = entry.repo.split("/");
+    if (!owner || !name || rest.length > 0) {
+      throw new Error(`Invalid GitHub repository: ${entry.repo}`);
+    }
+    const segments = entry.path.split("/");
+    if (segments.length === 0 || segments.some(
+      (part) => !part || part === "." || part === ".." || !/^[A-Za-z0-9._-]+$/.test(part)
+    ) || isReservedSandboxDirectory(segments[0])) {
+      throw new Error(`Invalid workspace checkout path: ${entry.path}`);
+    }
+    return { owner, name, path: entry.path, repo: entry.repo };
+  });
+  const paths = /* @__PURE__ */ new Set();
+  for (const entry of repos) {
+    const key = entry.path.toLowerCase();
+    if (paths.has(key)) {
+      throw new Error(`Workspace checkout path collision: ${entry.path}`);
+    }
+    paths.add(key);
+  }
+  for (const { owner, name, path, repo } of repos) {
+    const parent = path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : void 0;
+    if (parent) {
+      const mkdir = await ctx.sandbox.run({
+        cmd: "mkdir",
+        args: ["-p", "--", parent],
+        cwd: ctx.sandbox.root
+      });
+      if (mkdir.exitCode !== 0) {
+        throw new Error(
+          `GitHub workspace checkout parent failed for ${repo}: ${mkdir.stderr.trim() || `exit ${mkdir.exitCode}`}`
+        );
+      }
+    }
+    const result = await ctx.sandbox.run({
+      cmd: "git",
+      args: [
+        "clone",
+        "--quiet",
+        "--depth=1",
+        "--",
+        `https://github.com/${owner}/${name}.git`,
+        path
+      ],
+      cwd: ctx.sandbox.root
+    });
+    if (result.exitCode !== 0) {
+      throw new Error(
+        `GitHub workspace clone failed for ${repo}: ${result.stderr.trim() || `exit ${result.exitCode}`}`
+      );
+    }
+  }
+}
+
 // src/plugin.ts
 function githubSmartHttpAccess(upstreamUrl) {
   const pathname = upstreamUrl.pathname.toLowerCase();
@@ -5453,6 +5546,7 @@ function githubPlugin(options = {}) {
       tools(ctx) {
         return createGitHubTools(ctx);
       },
+      workspacePrepare: prepareWorkspace,
       async sandboxPrepare(ctx) {
         const hooksPath = `${ctx.sandbox.juniorRoot}/git-hooks`;
         await ctx.sandbox.writeFile({

package/dist/sandbox-paths.d.ts

@@ -0,0 +1,4 @@
+/** Sandbox root directories reserved for Junior runtime material. */
+export declare const RESERVED_SANDBOX_DIRECTORIES: Set<string>;
+/** True when a checkout path collides with a reserved sandbox root (case-insensitive). */
+export declare function isReservedSandboxDirectory(path: string): boolean;

package/dist/workspace-prepare.d.ts

@@ -0,0 +1,3 @@
+import type { WorkspacePrepareHookContext } from "@sentry/junior-plugin-api";
+/** Clone GitHub repositories into their host-selected Workspace paths. */
+export declare function prepareWorkspace(ctx: WorkspacePrepareHookContext): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.162.0",
+  "version": "0.163.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -31,7 +31,7 @@
     "@sinclair/typebox": "^0.34.49",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@sentry/junior-plugin-api": "0.162.0"
+    "@sentry/junior-plugin-api": "0.163.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",