@tested/cli 0.1.3 → 0.1.5

package/README.md

@@ -25,7 +25,7 @@ CI uses the composite Action (`tested-hq/cli/action@main`). It installs `@tested
 ```yaml
 - uses: tested-hq/cli/action@main
   with:
-    version: 0.1.3
+    version: 0.1.5
     token: ${{ secrets.TESTED_TOKEN }}
 ```
 
@@ -51,7 +51,7 @@ tested push --pr <n>    # needs TESTED_TOKEN
 |---------|--------|
 | Ingest token | Prefer `TESTED_TOKEN` / `TESTED_INGEST_TOKEN` / `TESTED_TOKEN_FILE` (mode `0600`). Avoid `--token` on shared hosts — it appears on process argv (`ps`). |
 | Safe run args | In CI, non-interactive shells, or when `TESTED_SAFE_RUN=1`, `tested run` rejects `--watch` / `--watchAll` and `--config` paths outside the repo root. |
-| API URL | Ingest posts only to `https://` (or `http://localhost`). Redirects with Bearer token are refused. |
+| API URL | Ingest posts only to `https://app.tested.dev` / `*.tested.dev` (or `http://localhost`). Other HTTPS hosts need `TESTED_ALLOW_CUSTOM_API_URL=1`. Redirects with Bearer token are refused. |
 | MCP hosts | For always-on agent hosts, set `TESTED_ALLOWED_CWDS` (see `@tested/mcp`) so tools cannot target arbitrary directories. |
 
 ## Agent loop
@@ -133,7 +133,7 @@ If `thresholds` is missing from `.tested.yaml`, `tested check` prints a notice o
 ```yaml
 - uses: tested-hq/cli/action@main
   with:
-    version: 0.1.3
+    version: 0.1.5
     push: true
     pr-number: ${{ github.event.pull_request.number }}
     token: ${{ secrets.TESTED_TOKEN }}
@@ -167,8 +167,8 @@ $ tested push
 | `TESTED_TOKEN` / `TESTED_INGEST_TOKEN` / `TESTED_TOKEN_FILE` | Ingest auth (**preferred** — not on argv) |
 | `--token` | Ingest auth (works; warns on TTY; visible in `ps`) |
 | `--pr` / `GITHUB_PR_NUMBER` / `PR_NUMBER` | PR number (required) |
-| `--url` / `TESTED_API_URL` | API base (default `https://app.tested.dev`) |
-| `--owner` / `--name` | Repo identity (default: parse `origin` remote) |
+| `--url` / `TESTED_API_URL` | API base (default `https://app.tested.dev`; other hosts need `TESTED_ALLOW_CUSTOM_API_URL=1`) |
+| `--owner` / `--name` | Repo identity (default: `GITHUB_REPOSITORY`, else `origin` remote) |
 | `--pr-title`, `--author`, `--base-ref`, `--head-ref` | PR metadata overrides |
 | `--base` | Git base for the coverage diff (same as `tested diff --base`) |
 | `--run-url` | Optional CI run URL |
@@ -185,7 +185,7 @@ non-interactive mode / when `TESTED_SAFE_RUN=1`:
 Typical CI step after `tested check`:
 
 ```yaml
-- run: pnpm exec tested push --pr "${{ github.event.pull_request.number }}"
+- run: pnpm exec tested push --pr "${{ github.event.pull_request.number }}" --base "${{ github.event.pull_request.base.sha }}"
   env:
     TESTED_TOKEN: ${{ secrets.TESTED_TOKEN }}
 ```

package/dist/td.js

@@ -965,7 +965,24 @@ async function computeDiff(opts) {
 
 // src/commands/push.ts
 var DEFAULT_API_BASE = "https://app.tested.dev";
+var DEFAULT_API_HOST = "app.tested.dev";
 var LOCAL_HTTP_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+var SAFE_GITHUB_REPOSITORY_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+function isAllowedApiHost(hostname) {
+  const host = hostname.toLowerCase();
+  return host === "tested.dev" || host === DEFAULT_API_HOST || host.endsWith(".tested.dev");
+}
+function isLocalDevHost(hostname) {
+  const host = hostname.toLowerCase();
+  return LOCAL_HTTP_HOSTS.has(host) || host.endsWith(".localhost");
+}
+function parseGitHubRepository(repo) {
+  const raw = repo?.trim();
+  if (!raw || !SAFE_GITHUB_REPOSITORY_RE.test(raw)) return null;
+  const [owner, name] = raw.split("/");
+  if (!owner || !name) return null;
+  return { owner, name };
+}
 var tokenArgvWarned = false;
 function readTokenFile(filePath, opts) {
   const read = opts?.readFileSyncFn ?? readFileSync2;
@@ -1022,7 +1039,7 @@ function resolveToken(opts) {
   }
   return null;
 }
-function assertSafeApiBase(raw) {
+function assertSafeApiBase(raw, opts = {}) {
   const trimmed = raw.trim();
   if (!trimmed) {
     throw new Error("API URL must not be empty");
@@ -1039,9 +1056,14 @@ function assertSafeApiBase(raw) {
     throw new Error("API URL must not embed credentials");
   }
   const host = u.hostname.toLowerCase();
-  const isLocalHttpHost = LOCAL_HTTP_HOSTS.has(host) || host.endsWith(".localhost");
+  const local = isLocalDevHost(host);
   if (u.protocol === "https:") {
-  } else if (u.protocol === "http:" && isLocalHttpHost) {
+    if (!local && !isAllowedApiHost(host) && !opts.allowCustom) {
+      throw new Error(
+        `API URL host "${u.hostname}" is not allowed. Ingest tokens are sent to this host. Use https://app.tested.dev, or set TESTED_ALLOW_CUSTOM_API_URL=1 for a private endpoint.`
+      );
+    }
+  } else if (u.protocol === "http:" && local) {
   } else {
     throw new Error(
       `API URL must use https:// (http:// allowed only for localhost). Got ${u.protocol}//${u.host}`
@@ -1051,12 +1073,16 @@ function assertSafeApiBase(raw) {
   const pathPart = !path || path === "/" ? "" : path;
   return `${u.origin}${pathPart}`;
 }
+function allowCustomApiUrl(env) {
+  const raw = env.TESTED_ALLOW_CUSTOM_API_URL;
+  return raw === "1" || raw === "true";
+}
 function resolveApiBase(opts) {
   const env = opts.env ?? process.env;
   const flag = opts.flag?.trim();
   const fromEnv = env.TESTED_API_URL?.trim();
   const raw = flag || fromEnv || DEFAULT_API_BASE;
-  return assertSafeApiBase(raw);
+  return assertSafeApiBase(raw, { allowCustom: allowCustomApiUrl(env) });
 }
 function redactGitRemote(url) {
   const scrubbed = url.replace(/\/\/([^/@\s]+)@/g, "//***@");
@@ -1403,6 +1429,13 @@ async function executePush(cli, deps) {
   }
   let owner = cli.owner;
   let name = cli.name;
+  if (!owner || !name) {
+    const fromActions = parseGitHubRepository(env.GITHUB_REPOSITORY);
+    if (fromActions) {
+      owner = owner ?? fromActions.owner;
+      name = name ?? fromActions.name;
+    }
+  }
   if (!owner || !name) {
     let origin;
     try {
@@ -1767,7 +1800,8 @@ async function runDoctor(deps) {
   const rawApi = env.TESTED_API_URL;
   if (rawApi !== void 0 && rawApi !== "") {
     try {
-      const normalized = assertSafe(rawApi);
+      const allowCustom = env.TESTED_ALLOW_CUSTOM_API_URL === "1" || env.TESTED_ALLOW_CUSTOM_API_URL === "true";
+      const normalized = assertSafe(rawApi, { allowCustom });
       checks.push({
         id: "api_url",
         label: "API URL",
@@ -1881,7 +1915,7 @@ import pc3 from "picocolors";
 // package.json
 var package_default = {
   name: "@tested/cli",
-  version: "0.1.3",
+  version: "0.1.5",
   description: "Coverage your agent can use. CLI for patch + project coverage with agent-readable JSON output.",
   license: "MIT",
   homepage: "https://tested.dev",

package/dist/tested.js

@@ -965,7 +965,24 @@ async function computeDiff(opts) {
 
 // src/commands/push.ts
 var DEFAULT_API_BASE = "https://app.tested.dev";
+var DEFAULT_API_HOST = "app.tested.dev";
 var LOCAL_HTTP_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+var SAFE_GITHUB_REPOSITORY_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+function isAllowedApiHost(hostname) {
+  const host = hostname.toLowerCase();
+  return host === "tested.dev" || host === DEFAULT_API_HOST || host.endsWith(".tested.dev");
+}
+function isLocalDevHost(hostname) {
+  const host = hostname.toLowerCase();
+  return LOCAL_HTTP_HOSTS.has(host) || host.endsWith(".localhost");
+}
+function parseGitHubRepository(repo) {
+  const raw = repo?.trim();
+  if (!raw || !SAFE_GITHUB_REPOSITORY_RE.test(raw)) return null;
+  const [owner, name] = raw.split("/");
+  if (!owner || !name) return null;
+  return { owner, name };
+}
 var tokenArgvWarned = false;
 function readTokenFile(filePath, opts) {
   const read = opts?.readFileSyncFn ?? readFileSync2;
@@ -1022,7 +1039,7 @@ function resolveToken(opts) {
   }
   return null;
 }
-function assertSafeApiBase(raw) {
+function assertSafeApiBase(raw, opts = {}) {
   const trimmed = raw.trim();
   if (!trimmed) {
     throw new Error("API URL must not be empty");
@@ -1039,9 +1056,14 @@ function assertSafeApiBase(raw) {
     throw new Error("API URL must not embed credentials");
   }
   const host = u.hostname.toLowerCase();
-  const isLocalHttpHost = LOCAL_HTTP_HOSTS.has(host) || host.endsWith(".localhost");
+  const local = isLocalDevHost(host);
   if (u.protocol === "https:") {
-  } else if (u.protocol === "http:" && isLocalHttpHost) {
+    if (!local && !isAllowedApiHost(host) && !opts.allowCustom) {
+      throw new Error(
+        `API URL host "${u.hostname}" is not allowed. Ingest tokens are sent to this host. Use https://app.tested.dev, or set TESTED_ALLOW_CUSTOM_API_URL=1 for a private endpoint.`
+      );
+    }
+  } else if (u.protocol === "http:" && local) {
   } else {
     throw new Error(
       `API URL must use https:// (http:// allowed only for localhost). Got ${u.protocol}//${u.host}`
@@ -1051,12 +1073,16 @@ function assertSafeApiBase(raw) {
   const pathPart = !path || path === "/" ? "" : path;
   return `${u.origin}${pathPart}`;
 }
+function allowCustomApiUrl(env) {
+  const raw = env.TESTED_ALLOW_CUSTOM_API_URL;
+  return raw === "1" || raw === "true";
+}
 function resolveApiBase(opts) {
   const env = opts.env ?? process.env;
   const flag = opts.flag?.trim();
   const fromEnv = env.TESTED_API_URL?.trim();
   const raw = flag || fromEnv || DEFAULT_API_BASE;
-  return assertSafeApiBase(raw);
+  return assertSafeApiBase(raw, { allowCustom: allowCustomApiUrl(env) });
 }
 function redactGitRemote(url) {
   const scrubbed = url.replace(/\/\/([^/@\s]+)@/g, "//***@");
@@ -1403,6 +1429,13 @@ async function executePush(cli, deps) {
   }
   let owner = cli.owner;
   let name = cli.name;
+  if (!owner || !name) {
+    const fromActions = parseGitHubRepository(env.GITHUB_REPOSITORY);
+    if (fromActions) {
+      owner = owner ?? fromActions.owner;
+      name = name ?? fromActions.name;
+    }
+  }
   if (!owner || !name) {
     let origin;
     try {
@@ -1767,7 +1800,8 @@ async function runDoctor(deps) {
   const rawApi = env.TESTED_API_URL;
   if (rawApi !== void 0 && rawApi !== "") {
     try {
-      const normalized = assertSafe(rawApi);
+      const allowCustom = env.TESTED_ALLOW_CUSTOM_API_URL === "1" || env.TESTED_ALLOW_CUSTOM_API_URL === "true";
+      const normalized = assertSafe(rawApi, { allowCustom });
       checks.push({
         id: "api_url",
         label: "API URL",
@@ -1881,7 +1915,7 @@ import pc3 from "picocolors";
 // package.json
 var package_default = {
   name: "@tested/cli",
-  version: "0.1.3",
+  version: "0.1.5",
   description: "Coverage your agent can use. CLI for patch + project coverage with agent-readable JSON output.",
   license: "MIT",
   homepage: "https://tested.dev",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tested/cli",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Coverage your agent can use. CLI for patch + project coverage with agent-readable JSON output.",
   "license": "MIT",
   "homepage": "https://tested.dev",