@vicoa/cli 1.3.10 → 1.3.11-linux-x64

package/bin/_internal/integrations/github/claude-code-action/src/github/utils/sanitizer.ts

@@ -0,0 +1,100 @@
+export function stripInvisibleCharacters(content: string): string {
+  content = content.replace(/[\u200B\u200C\u200D\uFEFF]/g, "");
+  content = content.replace(
+    /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g,
+    "",
+  );
+  content = content.replace(/\u00AD/g, "");
+  content = content.replace(/[\u202A-\u202E\u2066-\u2069]/g, "");
+  return content;
+}
+
+export function stripMarkdownImageAltText(content: string): string {
+  return content.replace(/!\[[^\]]*\]\(/g, "![](");
+}
+
+export function stripMarkdownLinkTitles(content: string): string {
+  content = content.replace(/(\[[^\]]*\]\([^)]+)\s+"[^"]*"/g, "$1");
+  content = content.replace(/(\[[^\]]*\]\([^)]+)\s+'[^']*'/g, "$1");
+  return content;
+}
+
+export function stripHiddenAttributes(content: string): string {
+  content = content.replace(/\salt\s*=\s*["'][^"']*["']/gi, "");
+  content = content.replace(/\salt\s*=\s*[^\s>]+/gi, "");
+  content = content.replace(/\stitle\s*=\s*["'][^"']*["']/gi, "");
+  content = content.replace(/\stitle\s*=\s*[^\s>]+/gi, "");
+  content = content.replace(/\saria-label\s*=\s*["'][^"']*["']/gi, "");
+  content = content.replace(/\saria-label\s*=\s*[^\s>]+/gi, "");
+  content = content.replace(/\sdata-[a-zA-Z0-9-]+\s*=\s*["'][^"']*["']/gi, "");
+  content = content.replace(/\sdata-[a-zA-Z0-9-]+\s*=\s*[^\s>]+/gi, "");
+  content = content.replace(/\splaceholder\s*=\s*["'][^"']*["']/gi, "");
+  content = content.replace(/\splaceholder\s*=\s*[^\s>]+/gi, "");
+  return content;
+}
+
+export function normalizeHtmlEntities(content: string): string {
+  content = content.replace(/&#(\d+);/g, (_, dec) => {
+    const num = parseInt(dec, 10);
+    if (num >= 32 && num <= 126) {
+      return String.fromCharCode(num);
+    }
+    return "";
+  });
+  content = content.replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => {
+    const num = parseInt(hex, 16);
+    if (num >= 32 && num <= 126) {
+      return String.fromCharCode(num);
+    }
+    return "";
+  });
+  return content;
+}
+
+export function sanitizeContent(content: string): string {
+  content = stripHtmlComments(content);
+  content = stripInvisibleCharacters(content);
+  content = stripMarkdownImageAltText(content);
+  content = stripMarkdownLinkTitles(content);
+  content = stripHiddenAttributes(content);
+  content = normalizeHtmlEntities(content);
+  content = redactGitHubTokens(content);
+  return content;
+}
+
+export function redactGitHubTokens(content: string): string {
+  // GitHub Personal Access Tokens (classic): ghp_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX (40 chars)
+  content = content.replace(
+    /\bghp_[A-Za-z0-9]{36}\b/g,
+    "[REDACTED_GITHUB_TOKEN]",
+  );
+
+  // GitHub OAuth tokens: gho_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX (40 chars)
+  content = content.replace(
+    /\bgho_[A-Za-z0-9]{36}\b/g,
+    "[REDACTED_GITHUB_TOKEN]",
+  );
+
+  // GitHub installation tokens: ghs_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX (40 chars)
+  content = content.replace(
+    /\bghs_[A-Za-z0-9]{36}\b/g,
+    "[REDACTED_GITHUB_TOKEN]",
+  );
+
+  // GitHub refresh tokens: ghr_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX (40 chars)
+  content = content.replace(
+    /\bghr_[A-Za-z0-9]{36}\b/g,
+    "[REDACTED_GITHUB_TOKEN]",
+  );
+
+  // GitHub fine-grained personal access tokens: github_pat_XXXXXXXXXX (up to 255 chars)
+  content = content.replace(
+    /\bgithub_pat_[A-Za-z0-9_]{11,221}\b/g,
+    "[REDACTED_GITHUB_TOKEN]",
+  );
+
+  return content;
+}
+
+export const stripHtmlComments = (content: string) =>
+  content.replace(/<!--[\s\S]*?-->/g, "");

package/bin/_internal/integrations/github/claude-code-action/src/github/validation/actor.ts

@@ -0,0 +1,64 @@
+#!/usr/bin/env bun
+
+/**
+ * Check if the action trigger is from a human actor
+ * Prevents automated tools or bots from triggering Claude
+ */
+
+import type { Octokit } from "@octokit/rest";
+import type { ParsedGitHubContext } from "../context";
+
+export async function checkHumanActor(
+  octokit: Octokit,
+  githubContext: ParsedGitHubContext,
+) {
+  // Fetch user information from GitHub API
+  const { data: userData } = await octokit.users.getByUsername({
+    username: githubContext.actor,
+  });
+
+  const actorType = userData.type;
+
+  console.log(`Actor type: ${actorType}`);
+
+  // Check bot permissions if actor is not a User
+  if (actorType !== "User") {
+    const allowedBots = githubContext.inputs.allowedBots;
+
+    // Check if all bots are allowed
+    if (allowedBots.trim() === "*") {
+      console.log(
+        `All bots are allowed, skipping human actor check for: ${githubContext.actor}`,
+      );
+      return;
+    }
+
+    // Parse allowed bots list
+    const allowedBotsList = allowedBots
+      .split(",")
+      .map((bot) =>
+        bot
+          .trim()
+          .toLowerCase()
+          .replace(/\[bot\]$/, ""),
+      )
+      .filter((bot) => bot.length > 0);
+
+    const botName = githubContext.actor.toLowerCase().replace(/\[bot\]$/, "");
+
+    // Check if specific bot is allowed
+    if (allowedBotsList.includes(botName)) {
+      console.log(
+        `Bot ${botName} is in allowed list, skipping human actor check`,
+      );
+      return;
+    }
+
+    // Bot not allowed
+    throw new Error(
+      `Workflow initiated by non-human actor: ${botName} (type: ${actorType}). Add bot to allowed_bots list or use '*' to allow all bots.`,
+    );
+  }
+
+  console.log(`Verified human actor: ${githubContext.actor}`);
+}

package/bin/_internal/integrations/github/claude-code-action/src/github/validation/permissions.ts

@@ -0,0 +1,47 @@
+import * as core from "@actions/core";
+import type { ParsedGitHubContext } from "../context";
+import type { Octokit } from "@octokit/rest";
+
+/**
+ * Check if the actor has write permissions to the repository
+ * @param octokit - The Octokit REST client
+ * @param context - The GitHub context
+ * @returns true if the actor has write permissions, false otherwise
+ */
+export async function checkWritePermissions(
+  octokit: Octokit,
+  context: ParsedGitHubContext,
+): Promise<boolean> {
+  const { repository, actor } = context;
+
+  try {
+    core.info(`Checking permissions for actor: ${actor}`);
+
+    // Check if the actor is a GitHub App (bot user)
+    if (actor.endsWith("[bot]")) {
+      core.info(`Actor is a GitHub App: ${actor}`);
+      return true;
+    }
+
+    // Check permissions directly using the permission endpoint
+    const response = await octokit.repos.getCollaboratorPermissionLevel({
+      owner: repository.owner,
+      repo: repository.repo,
+      username: actor,
+    });
+
+    const permissionLevel = response.data.permission;
+    core.info(`Permission level retrieved: ${permissionLevel}`);
+
+    if (permissionLevel === "admin" || permissionLevel === "write") {
+      core.info(`Actor has write access: ${permissionLevel}`);
+      return true;
+    } else {
+      core.warning(`Actor has insufficient permissions: ${permissionLevel}`);
+      return false;
+    }
+  } catch (error) {
+    core.error(`Failed to check permissions: ${error}`);
+    throw new Error(`Failed to check permissions for ${actor}: ${error}`);
+  }
+}

package/bin/_internal/integrations/github/claude-code-action/src/github/validation/trigger.ts

@@ -0,0 +1,148 @@
+#!/usr/bin/env bun
+
+import * as core from "@actions/core";
+import {
+  isIssuesEvent,
+  isIssuesAssignedEvent,
+  isIssueCommentEvent,
+  isPullRequestEvent,
+  isPullRequestReviewEvent,
+  isPullRequestReviewCommentEvent,
+} from "../context";
+import type { ParsedGitHubContext } from "../context";
+
+export function checkContainsTrigger(context: ParsedGitHubContext): boolean {
+  const {
+    inputs: { assigneeTrigger, labelTrigger, triggerPhrase, prompt },
+  } = context;
+
+  // If prompt is provided, always trigger
+  if (prompt) {
+    console.log(`Prompt provided, triggering action`);
+    return true;
+  }
+
+  // Check for assignee trigger
+  if (isIssuesAssignedEvent(context)) {
+    // Remove @ symbol from assignee_trigger if present
+    let triggerUser = assigneeTrigger.replace(/^@/, "");
+    const assigneeUsername = context.payload.assignee?.login || "";
+
+    if (triggerUser && assigneeUsername === triggerUser) {
+      console.log(`Issue assigned to trigger user '${triggerUser}'`);
+      return true;
+    }
+  }
+
+  // Check for label trigger
+  if (isIssuesEvent(context) && context.eventAction === "labeled") {
+    const labelName = (context.payload as any).label?.name || "";
+
+    if (labelTrigger && labelName === labelTrigger) {
+      console.log(`Issue labeled with trigger label '${labelTrigger}'`);
+      return true;
+    }
+  }
+
+  // Check for issue body and title trigger on issue creation
+  if (isIssuesEvent(context) && context.eventAction === "opened") {
+    const issueBody = context.payload.issue.body || "";
+    const issueTitle = context.payload.issue.title || "";
+    // Check for exact match with word boundaries or punctuation
+    const regex = new RegExp(
+      `(^|\\s)${escapeRegExp(triggerPhrase)}([\\s.,!?;:]|$)`,
+    );
+
+    // Check in body
+    if (regex.test(issueBody)) {
+      console.log(
+        `Issue body contains exact trigger phrase '${triggerPhrase}'`,
+      );
+      return true;
+    }
+
+    // Check in title
+    if (regex.test(issueTitle)) {
+      console.log(
+        `Issue title contains exact trigger phrase '${triggerPhrase}'`,
+      );
+      return true;
+    }
+  }
+
+  // Check for pull request body and title trigger
+  if (isPullRequestEvent(context)) {
+    const prBody = context.payload.pull_request.body || "";
+    const prTitle = context.payload.pull_request.title || "";
+    // Check for exact match with word boundaries or punctuation
+    const regex = new RegExp(
+      `(^|\\s)${escapeRegExp(triggerPhrase)}([\\s.,!?;:]|$)`,
+    );
+
+    // Check in body
+    if (regex.test(prBody)) {
+      console.log(
+        `Pull request body contains exact trigger phrase '${triggerPhrase}'`,
+      );
+      return true;
+    }
+
+    // Check in title
+    if (regex.test(prTitle)) {
+      console.log(
+        `Pull request title contains exact trigger phrase '${triggerPhrase}'`,
+      );
+      return true;
+    }
+  }
+
+  // Check for pull request review body trigger
+  if (
+    isPullRequestReviewEvent(context) &&
+    (context.eventAction === "submitted" || context.eventAction === "edited")
+  ) {
+    const reviewBody = context.payload.review.body || "";
+    // Check for exact match with word boundaries or punctuation
+    const regex = new RegExp(
+      `(^|\\s)${escapeRegExp(triggerPhrase)}([\\s.,!?;:]|$)`,
+    );
+    if (regex.test(reviewBody)) {
+      console.log(
+        `Pull request review contains exact trigger phrase '${triggerPhrase}'`,
+      );
+      return true;
+    }
+  }
+
+  // Check for comment trigger
+  if (
+    isIssueCommentEvent(context) ||
+    isPullRequestReviewCommentEvent(context)
+  ) {
+    const commentBody = isIssueCommentEvent(context)
+      ? context.payload.comment.body
+      : context.payload.comment.body;
+    // Check for exact match with word boundaries or punctuation
+    const regex = new RegExp(
+      `(^|\\s)${escapeRegExp(triggerPhrase)}([\\s.,!?;:]|$)`,
+    );
+    if (regex.test(commentBody)) {
+      console.log(`Comment contains exact trigger phrase '${triggerPhrase}'`);
+      return true;
+    }
+  }
+
+  console.log(`No trigger was met for ${triggerPhrase}`);
+
+  return false;
+}
+
+export function escapeRegExp(string: string) {
+  return string.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+export async function checkTriggerAction(context: ParsedGitHubContext) {
+  const containsTrigger = checkContainsTrigger(context);
+  core.setOutput("contains_trigger", containsTrigger.toString());
+  return containsTrigger;
+}

package/bin/_internal/integrations/github/claude-code-action/src/mcp/github-actions-server.ts

@@ -0,0 +1,279 @@
+#!/usr/bin/env node
+
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { GITHUB_API_URL } from "../github/api/config";
+import { mkdir, writeFile } from "fs/promises";
+import { Octokit } from "@octokit/rest";
+
+const REPO_OWNER = process.env.REPO_OWNER;
+const REPO_NAME = process.env.REPO_NAME;
+const PR_NUMBER = process.env.PR_NUMBER;
+const GITHUB_TOKEN = process.env.GITHUB_TOKEN;
+const RUNNER_TEMP = process.env.RUNNER_TEMP || "/tmp";
+
+if (!REPO_OWNER || !REPO_NAME || !PR_NUMBER || !GITHUB_TOKEN) {
+  console.error(
+    "[GitHub CI Server] Error: REPO_OWNER, REPO_NAME, PR_NUMBER, and GITHUB_TOKEN environment variables are required",
+  );
+  process.exit(1);
+}
+
+const server = new McpServer({
+  name: "GitHub CI Server",
+  version: "0.0.1",
+});
+
+console.error("[GitHub CI Server] MCP Server instance created");
+
+server.tool(
+  "get_ci_status",
+  "Get CI status summary for this PR",
+  {
+    status: z
+      .enum([
+        "completed",
+        "action_required",
+        "cancelled",
+        "failure",
+        "neutral",
+        "skipped",
+        "stale",
+        "success",
+        "timed_out",
+        "in_progress",
+        "queued",
+        "requested",
+        "waiting",
+        "pending",
+      ])
+      .optional()
+      .describe("Filter workflow runs by status"),
+  },
+  async ({ status }) => {
+    try {
+      const client = new Octokit({
+        auth: GITHUB_TOKEN,
+        baseUrl: GITHUB_API_URL,
+      });
+
+      // Get the PR to find the head SHA
+      const { data: prData } = await client.pulls.get({
+        owner: REPO_OWNER!,
+        repo: REPO_NAME!,
+        pull_number: parseInt(PR_NUMBER!, 10),
+      });
+      const headSha = prData.head.sha;
+
+      const { data: runsData } = await client.actions.listWorkflowRunsForRepo({
+        owner: REPO_OWNER!,
+        repo: REPO_NAME!,
+        head_sha: headSha,
+        ...(status && { status }),
+      });
+
+      // Process runs to create summary
+      const runs = runsData.workflow_runs || [];
+      const summary = {
+        total_runs: runs.length,
+        failed: 0,
+        passed: 0,
+        pending: 0,
+      };
+
+      const processedRuns = runs.map((run: any) => {
+        // Update summary counts
+        if (run.status === "completed") {
+          if (run.conclusion === "success") {
+            summary.passed++;
+          } else if (run.conclusion === "failure") {
+            summary.failed++;
+          }
+        } else {
+          summary.pending++;
+        }
+
+        return {
+          id: run.id,
+          name: run.name,
+          status: run.status,
+          conclusion: run.conclusion,
+          html_url: run.html_url,
+          created_at: run.created_at,
+        };
+      });
+
+      const result = {
+        summary,
+        runs: processedRuns,
+      };
+
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(result, null, 2),
+          },
+        ],
+      };
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Error: ${errorMessage}`,
+          },
+        ],
+        error: errorMessage,
+        isError: true,
+      };
+    }
+  },
+);
+
+server.tool(
+  "get_workflow_run_details",
+  "Get job and step details for a workflow run",
+  {
+    run_id: z.number().describe("The workflow run ID"),
+  },
+  async ({ run_id }) => {
+    try {
+      const client = new Octokit({
+        auth: GITHUB_TOKEN,
+        baseUrl: GITHUB_API_URL,
+      });
+
+      // Get jobs for this workflow run
+      const { data: jobsData } = await client.actions.listJobsForWorkflowRun({
+        owner: REPO_OWNER!,
+        repo: REPO_NAME!,
+        run_id,
+      });
+
+      const processedJobs = jobsData.jobs.map((job: any) => {
+        // Extract failed steps
+        const failedSteps = (job.steps || [])
+          .filter((step: any) => step.conclusion === "failure")
+          .map((step: any) => ({
+            name: step.name,
+            number: step.number,
+          }));
+
+        return {
+          id: job.id,
+          name: job.name,
+          conclusion: job.conclusion,
+          html_url: job.html_url,
+          failed_steps: failedSteps,
+        };
+      });
+
+      const result = {
+        jobs: processedJobs,
+      };
+
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(result, null, 2),
+          },
+        ],
+      };
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Error: ${errorMessage}`,
+          },
+        ],
+        error: errorMessage,
+        isError: true,
+      };
+    }
+  },
+);
+
+server.tool(
+  "download_job_log",
+  "Download job logs to disk",
+  {
+    job_id: z.number().describe("The job ID"),
+  },
+  async ({ job_id }) => {
+    try {
+      const client = new Octokit({
+        auth: GITHUB_TOKEN,
+        baseUrl: GITHUB_API_URL,
+      });
+
+      const response = await client.actions.downloadJobLogsForWorkflowRun({
+        owner: REPO_OWNER!,
+        repo: REPO_NAME!,
+        job_id,
+      });
+
+      const logsText = response.data as unknown as string;
+
+      const logsDir = `${RUNNER_TEMP}/github-ci-logs`;
+      await mkdir(logsDir, { recursive: true });
+
+      const logPath = `${logsDir}/job-${job_id}.log`;
+      await writeFile(logPath, logsText, "utf-8");
+
+      const result = {
+        path: logPath,
+        size_bytes: Buffer.byteLength(logsText, "utf-8"),
+      };
+
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(result, null, 2),
+          },
+        ],
+      };
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Error: ${errorMessage}`,
+          },
+        ],
+        error: errorMessage,
+        isError: true,
+      };
+    }
+  },
+);
+
+async function runServer() {
+  try {
+    const transport = new StdioServerTransport();
+
+    await server.connect(transport);
+
+    process.on("exit", () => {
+      server.close();
+    });
+  } catch (error) {
+    throw error;
+  }
+}
+
+runServer().catch(() => {
+  process.exit(1);
+});