@wrongstack/tools 0.8.5 → 0.8.6

package/dist/pack.js

@@ -1,7 +1,7 @@
 import { spawn, execFileSync, spawnSync } from 'node:child_process';
 import { buildChildEnv, stripAnsi, detectNewlineStyle, normalizeToLf, toStyle, atomicWrite, unifiedDiff, compileGlob, loadPlan, emptyPlan, clearPlan, savePlan, getPlanTemplate, addPlanItem, deriveTodosFromPlanItem, removePlanItem, setPlanItemStatus, formatPlan } from '@wrongstack/core';
 import * as path from 'node:path';
-import { dirname } from 'node:path';
+import { resolve, sep, dirname } from 'node:path';
 import * as os from 'node:os';
 import * as fs11 from 'node:fs/promises';
 import { stat } from 'node:fs/promises';
@@ -66,8 +66,8 @@ async function* spawnStream(opts) {
   let spawnFailed = false;
   for (; ; ) {
     while (queue.length === 0) {
-      await new Promise((resolve6) => {
-        waiter = resolve6;
+      await new Promise((resolve7) => {
+        waiter = resolve7;
       });
     }
     const chunk = queue.shift();
@@ -742,10 +742,10 @@ var bashTool = {
         queue.push(c);
       }
     };
-    const next = () => new Promise((resolve6) => {
+    const next = () => new Promise((resolve7) => {
       const c = queue.shift();
-      if (c) resolve6(c);
-      else resolveNext = resolve6;
+      if (c) resolve7(c);
+      else resolveNext = resolve7;
     });
     let lastFlush = Date.now();
     const flush = () => {
@@ -2970,7 +2970,7 @@ function findGitDir(cwd) {
   return null;
 }
 function runGit(args, cwd, signal) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
     const child = spawn("git", args, { cwd, signal, env: buildChildEnv(), stdio: ["ignore", "pipe", "pipe"] });
@@ -2980,8 +2980,8 @@ function runGit(args, cwd, signal) {
     child.stderr?.on("data", (c) => {
       stderr += c.toString();
     });
-    child.on("close", (code) => resolve6({ stdout, stderr, exitCode: code ?? 0 }));
-    child.on("error", (e) => resolve6({ stdout: "", stderr: e.message, exitCode: 1 }));
+    child.on("close", (code) => resolve7({ stdout, stderr, exitCode: code ?? 0 }));
+    child.on("error", (e) => resolve7({ stdout: "", stderr: e.message, exitCode: 1 }));
   });
 }
 async function fileDiff(input, ctx, signal) {
@@ -3469,7 +3469,7 @@ var execTool = {
   }
 };
 function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
     let killed = false;
@@ -3503,7 +3503,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
       const durationMs = Date.now() - startedAt;
       const exitCode = killed ? 124 : code ?? 1;
       registry.afterCall(durationMs, exitCode !== 0);
-      resolve6({
+      resolve7({
         command: cmd,
         args,
         stdout: stdout.slice(0, MAX_OUTPUT2),
@@ -3517,7 +3517,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
       clearTimeout(timer);
       if (typeof pid === "number") registry.unregister(pid);
       registry.afterCall(Date.now() - startedAt, true);
-      resolve6({
+      resolve7({
         command: cmd,
         args,
         stdout: stdout.slice(0, MAX_OUTPUT2),
@@ -4038,6 +4038,10 @@ var gitTool = {
         truncated: false
       };
     }
+    if (input.command === "worktree") {
+      const guard = validateWorktreeInput(input, ctx.projectRoot);
+      if (guard) return guard;
+    }
     const gitDir = findGitDir2(ctx.cwd, ctx.projectRoot);
     if (!gitDir) {
       return {
@@ -4052,13 +4056,34 @@ var gitTool = {
     return await runGit2(args, gitDir, opts.signal);
   }
 };
+function validateWorktreeInput(input, projectRoot) {
+  const reject = (stderr) => ({
+    command: "worktree",
+    stdout: "",
+    stderr,
+    exitCode: 1,
+    truncated: false
+  });
+  if (input.branch?.startsWith("-")) return reject(`unsafe branch name: ${input.branch}`);
+  if (input.worktreePath?.startsWith("-")) {
+    return reject(`unsafe worktree path: ${input.worktreePath}`);
+  }
+  if ((input.worktreeAction === "add" || input.worktreeAction === "remove") && input.worktreePath) {
+    const root = resolve(projectRoot);
+    const abs = resolve(root, input.worktreePath);
+    if (abs !== root && !abs.startsWith(root + sep)) {
+      return reject(`unsafe worktree path (escapes project root): ${input.worktreePath}`);
+    }
+  }
+  return null;
+}
 function findGitDir2(cwd, projectRoot) {
   const root = projectRoot;
   let dir = cwd;
   for (let i = 0; i < 20; i++) {
     try {
       const stat11 = statSync(`${dir}/.git`);
-      if (stat11.isDirectory()) return dir;
+      if (stat11.isDirectory() || stat11.isFile()) return dir;
     } catch {
     }
     if (dir === root) break;
@@ -4114,14 +4139,14 @@ function buildArgs(input) {
       switch (input.worktreeAction) {
         case "list":
           return ["worktree", "list"];
-        case "add":
-          return [
-            "worktree",
-            "add",
-            ...input.newBranch ? ["-b"] : [],
-            ...input.branch ? [input.branch] : [],
-            input.worktreePath ?? ""
-          ].filter(Boolean);
+        case "add": {
+          if (!input.worktreePath) return ["worktree", "list"];
+          const add = ["worktree", "add"];
+          if (input.newBranch && input.branch) add.push("-b", input.branch);
+          add.push(input.worktreePath);
+          if (!input.newBranch && input.branch) add.push(input.branch);
+          return add;
+        }
         case "remove":
           return [
             "worktree",
@@ -4139,7 +4164,7 @@ function buildArgs(input) {
   }
 }
 function runGit2(args, cwd, signal) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
     const child = spawn("git", args, {
@@ -4159,7 +4184,7 @@ function runGit2(args, cwd, signal) {
       }
     });
     child.on("error", (err) => {
-      resolve6({
+      resolve7({
         command: args[0],
         stdout,
         stderr: err.message,
@@ -4168,7 +4193,7 @@ function runGit2(args, cwd, signal) {
       });
     });
     child.on("close", (code) => {
-      resolve6({
+      resolve7({
         command: args[0],
         stdout: stdout.slice(0, MAX_OUTPUT3),
         stderr: stderr.slice(0, MAX_OUTPUT3),
@@ -4354,13 +4379,13 @@ var grepTool = {
   }
 };
 async function detectRg(signal) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     try {
       const p = spawn("rg", ["--version"], { env: buildChildEnv(), stdio: "ignore", signal });
-      p.on("error", () => resolve6(false));
-      p.on("close", (code) => resolve6(code === 0));
+      p.on("error", () => resolve7(false));
+      p.on("close", (code) => resolve7(code === 0));
     } catch {
-      resolve6(false);
+      resolve7(false);
     }
   });
 }
@@ -4967,7 +4992,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
     };
   }
   args.push("--timestamps", service);
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
     const MAX = 2e5;
@@ -4983,7 +5008,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve6(result);
+      resolve7(result);
     };
     const child = spawn("docker", args, { cwd, signal, env: buildChildEnv(), stdio: ["ignore", "pipe", "pipe"] });
     const timer = setTimeout(() => {
@@ -5134,7 +5159,7 @@ async function detectManager2(cwd) {
   return "npm";
 }
 function runOutdated(manager, args, cwd, signal) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
     const MAX = 1e5;
@@ -5147,10 +5172,10 @@ function runOutdated(manager, args, cwd, signal) {
     });
     child.on("close", (code) => {
       const result = parseOutdatedOutput(stdout, code ?? 0);
-      resolve6(result);
+      resolve7(result);
     });
     child.on("error", (e) => {
-      resolve6({
+      resolve7({
         exit_code: 1,
         packages: [],
         total: 0,
@@ -5280,7 +5305,7 @@ function stripPathComponents(p, strip) {
   return parts.slice(strip).join("/");
 }
 function runPatch(args, cwd, signal) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
     const env = { ...buildChildEnv(), LANG: "C", LC_ALL: "C" };
@@ -5291,8 +5316,8 @@ function runPatch(args, cwd, signal) {
     child.stderr?.on("data", (c) => {
       stderr += c.toString();
     });
-    child.on("close", (code) => resolve6({ exitCode: code ?? 1, stdout, stderr }));
-    child.on("error", (e) => resolve6({ exitCode: 1, stdout: "", stderr: e.message }));
+    child.on("close", (code) => resolve7({ exitCode: code ?? 1, stdout, stderr }));
+    child.on("error", (e) => resolve7({ exitCode: 1, stdout: "", stderr: e.message }));
   });
 }
 function extractPatchedFiles(output) {
@@ -5635,13 +5660,13 @@ async function globFiles(pattern, base, extraGlob) {
   return await globNative(pattern, base, extraGlob);
 }
 function checkRg() {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     try {
       const p = spawn("rg", ["--version"], { env: buildChildEnv(), stdio: "ignore" });
-      p.on("error", () => resolve6(false));
-      p.on("close", (code) => resolve6(code === 0));
+      p.on("error", () => resolve7(false));
+      p.on("close", (code) => resolve7(code === 0));
     } catch {
-      resolve6(false);
+      resolve7(false);
     }
   });
 }
@@ -5653,10 +5678,10 @@ function spawnRgFind(pattern, base) {
     buf += chunk.toString();
   });
   return {
-    promise: new Promise((resolve6, reject) => {
+    promise: new Promise((resolve7, reject) => {
       child.on("error", reject);
       child.on("close", () => {
-        resolve6(buf.split("\n").filter(Boolean));
+        resolve7(buf.split("\n").filter(Boolean));
       });
     })
   };