agents-gitflow-guard 0.0.14 → 0.0.16

package/README.md

@@ -42,7 +42,7 @@ You define your own branches —
 # installs the latest release
 dsh plugin --profile web add agents-gitflow-guard
 # ...or pin an exact known-good version (recommended; also bypasses stale registry caches)
-dsh plugin --profile web add agents-gitflow-guard@0.0.14
+dsh plugin --profile web add agents-gitflow-guard@0.0.16
 ```
 
 > **Version gotcha**: a bare `add` resolves whatever `latest` is at install time — on machines behind a stale npm/pnpm registry cache or mirror it may install an old version. If the installed version looks wrong, pin it explicitly. The peer-dependency *warning* pnpm may print is expected: DSH supplies `@deepseek-ai/cordis` / `@deepseek-ai/dsh-tools` through its shared profile module fallback at startup (the plugin works normally).
@@ -132,7 +132,7 @@ Nobody has to remember the rules — the rules are enforced.
 - **Role-driven, fully configurable**: `integration` is the only required role; `preview` / `production` / `archive` are optional arrays of branch names or regexes, each with its own update rules (`pr` / `flexible`, `mergeBy`).
 - **Merge-by-user where it matters**: production & archive merges stay in your hands — the plugin blocks the agent from clicking merge, so your action *is* the confirmation.
 - **Works with any naming**: branch names are mapped by your config, never hard-coded (see [Configuration](#configuration-reference)).
-- **Fully audited**: every deny is appended to an audit log under your user state directory (`~/.local/state/gitflow-guard/`, `%LOCALAPPDATA%\gitflow-guard` on Windows) — outside the repository, never committed, and outside the agent's writable sandbox.
+- **Fully audited**: every deny is appended to an audit log under your user state directory (`~/.local/state/gitflow-guard/`, `%LOCALAPPDATA%\gitflow-guard` on Windows) — outside the repository, never committed, outside the agent's writable sandbox, and shared across all linked worktrees of one repository.
 - **Platform-agnostic core**: pure local git; optionally consults `gh` (GitHub) or `glab` (GitLab) for PR/MR target resolution, and works fine without them.
 
 ---
@@ -312,7 +312,7 @@ The PR/MR target is resolved via `gh pr view` (GitHub) or `glab mr view` (GitLab
 **From the npm registry** — the standard path, already covered in [Quick Start](#quick-start--30-seconds-to-a-guarded-repo):
 
 ```bash
-dsh plugin --profile web add agents-gitflow-guard@0.0.14    # pin recommended, see note above
+dsh plugin --profile web add agents-gitflow-guard@0.0.16    # pin recommended, see note above
 ```
 
 Then restart DSH. Upgrades are the same command, followed by another restart.

package/README.zh.md

@@ -41,7 +41,7 @@
 # 安装最新版
 dsh plugin --profile web add agents-gitflow-guard
 # ...或锁定已知良好版本(推荐; 同时绕开 registry 陈旧缓存)
-dsh plugin --profile web add agents-gitflow-guard@0.0.14
+dsh plugin --profile web add agents-gitflow-guard@0.0.16
 ```
 
 > **版本坑**: 裸 `add` 装的是安装时刻的 `latest`——在 npm/pnpm 注册表缓存或镜像陈旧的机器上可能拿到旧版本。看到版本不对就锁版本。pnpm 打印的 peer 依赖 *警告* 属预期: DSH 启动时经共享模块回退提供 `@deepseek-ai/cordis` / `@deepseek-ai/dsh-tools`(插件正常工作)。
@@ -129,7 +129,7 @@ AI 编码 agent 在你的仓库里工作。它通过系统提示词、项目智
 - **角色驱动、完全可配**:`integration` 是唯一必填;`preview` / `production` / `archive` 是可选数组(精确名或正则),每个角色独立 `update`(`pr` / `flexible`)与 `mergeBy`。
 - **在关键处保留人的操作权**:生产与归档合并始终在你手上——插件阻止 agent 点击合并,于是你的动作*就是*确认。
 - **任何命名都行**:分支名全由配置映射,绝无硬编码(见[配置参考](#配置参考))。
-- **全程审计**:每次拦截都追加到用户级状态目录(macOS/Linux `~/.local/state/gitflow-guard/`,Windows `%LOCALAPPDATA%\gitflow-guard`)下的审计日志——在仓库外、绝不进版本库,且位于 agent 可写沙箱之外。
+- **全程审计**:每次拦截都追加到用户级状态目录(macOS/Linux `~/.local/state/gitflow-guard/`,Windows `%LOCALAPPDATA%\gitflow-guard`)下的审计日志——在仓库外、绝不进版本库、位于 agent 可写沙箱之外,且同一仓库的所有 worktree 共享一份日志。
 - **平台无关核心**:纯本地 git;可选调用 `gh`(GitHub)或 `glab`(GitLab)做 PR/MR 目标解析,没有它们照样工作。
 
 ---
@@ -308,7 +308,7 @@ PR/MR 目标通过 `gh pr view`(GitHub)或 `glab mr view`(GitLab)解析;没有
 **从 npm registry**——标准路径,已在[快速开始](#快速开始30-秒用上)覆盖:
 
 ```bash
-dsh plugin --profile web add agents-gitflow-guard@0.0.14    # 建议锁版本, 见上文提示
+dsh plugin --profile web add agents-gitflow-guard@0.0.16    # 建议锁版本, 见上文提示
 ```
 
 然后重启 DSH。升级用同一命令,再重启一次。

package/lib/cli.mjs

@@ -1,4 +1,4 @@
-import { _ as classify, c as currentBranch, d as loadConfig, f as roleMatches, g as resolveLocale, i as formatDeny, l as findRepoRoot, m as makeT, o as stateDir, r as evaluateCommand, u as gitRunner } from "./src-C1CZM7Q4.mjs";
+import { _ as classify, c as currentBranch, d as loadConfig, f as roleMatches, g as resolveLocale, i as formatDeny, l as findRepoRoot, m as makeT, o as stateDir, r as evaluateCommand, u as gitRunner } from "./src-p6q9dCIr.mjs";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 //#region src/platform.ts
@@ -129,7 +129,7 @@ async function main(argv, opts = {}) {
 	}
 	try {
 		if (cmd === "status") return await status(flags, runner);
-		if (cmd === "audit") return await audit(flags);
+		if (cmd === "audit") return await audit(flags, runner);
 		if (cmd === "check") return await check(flags);
 		const t = makeT(await resolveFrameworkLocale(flags, runner));
 		console.error(`${t("cli.unknownCommand", { cmd: cmd ?? "" })}\n\n${t("usage.text")}`);
@@ -192,7 +192,7 @@ async function status(flags, runner) {
 	for (const b of localBranches) console.log(`  ${b} → ${classifyBranch(b)}`);
 	return 0;
 }
-async function audit(flags) {
+async function audit(flags, runner) {
 	const repoRoot = await resolveRepo(flags, gitRunner);
 	if (!repoRoot) {
 		console.error(makeT(resolveLocale(flags.locale))("cli.cannotLocate"));
@@ -202,7 +202,7 @@ async function audit(flags) {
 	const t = makeT(cliLocale(flags, config?.locale));
 	const lines = flags.lines != null && Number.isFinite(flags.lines) && flags.lines > 0 ? Math.floor(flags.lines) : 20;
 	try {
-		const all = (await readFile(join(stateDir(repoRoot), "audit.jsonl"), "utf8")).split("\n").filter(Boolean);
+		const all = (await readFile(join(await stateDir(repoRoot, gitRunner), "audit.jsonl"), "utf8")).split("\n").filter(Boolean);
 		for (const line of all.slice(-lines)) try {
 			const e = JSON.parse(line);
 			console.log(`  ${new Date(e.time).toISOString()} ${e.event} ${e.role ?? ""}${e.command ? ` | ${e.command.slice(0, 80)}` : ""}${e.reason ? ` | ${e.reason.slice(0, 60)}` : ""}`);

package/lib/index.d.mts

@@ -60,13 +60,14 @@ interface AuditEntry {
 declare function userStateRoot(): string;
 /**
  * 仓库运行时状态目录(审计流水等), 键为「仓库名-真实路径哈希」。
- * 刻意放在仓库外、且在 agent 文件沙箱(workspace-write)可写区之外:
- * 凡 agent 可写之处的状态都可能被 agent 伪造而自我授权, 存仓库外才堵住这条路;
- * 附带收益: 重克隆/移动 .git 不丢历史。
+ * 键由 git 权威解析(rev-parse --git-common-dir): linked worktree 与主仓库共用
+ * 同一状态目录(≤0.0.13 共享语义), 且天然规避 Windows 8.3 短名/大小写差异;
+ * git 查询不可用时回退 fs realpath。刻意放在仓库外、且在 agent 文件沙箱
+ * (workspace-write)可写区之外 —— 凡 agent 可写之处的状态都可能被伪造而自我授权。
  */
-declare function stateDir(repoRoot: string): string;
+declare function stateDir(repoRoot: string, runner?: Runner): Promise<string>;
 /** 审计留痕; 失败不阻断门禁 */
-declare function appendAudit(repoRoot: string, entry: AuditEntry): Promise<void>;
+declare function appendAudit(repoRoot: string, entry: AuditEntry, runner?: Runner): Promise<void>;
 /** 解析一条命令: 分类 → git 事实 → 门禁 → allow/deny */
 declare function evaluateCommand(command: string, opts: EvaluateOptions): Promise<EvaluateResult>;
 declare function formatDeny(locale: Locale, why: string, next: string): string;

package/lib/index.mjs

@@ -1,2 +1,2 @@
-import { a as name, h as registerLocale, i as formatDeny, n as apply, o as stateDir, p as MESSAGE_KEYS, r as evaluateCommand, s as userStateRoot, t as appendAudit } from "./src-C1CZM7Q4.mjs";
+import { a as name, h as registerLocale, i as formatDeny, n as apply, o as stateDir, p as MESSAGE_KEYS, r as evaluateCommand, s as userStateRoot, t as appendAudit } from "./src-p6q9dCIr.mjs";
 export { MESSAGE_KEYS, appendAudit, apply, evaluateCommand, formatDeny, name, registerLocale, stateDir, userStateRoot };

package/lib/{src-C1CZM7Q4.mjs → src-p6q9dCIr.mjs}

@@ -1021,6 +1021,15 @@ async function findRepoRoot(runner, cwd) {
 	const r = await runner.run(["rev-parse", "--show-toplevel"], cwd);
 	return r.code === 0 ? r.stdout.trim() || null : null;
 }
+/** 共享 .git 目录(git 权威绝对路径): linked worktree 返回主仓库 .git, 主仓库返回自身 .git; 查询失败返回 null */
+async function commonGitDir(runner, cwd) {
+	const r = await runner.run([
+		"rev-parse",
+		"--path-format=absolute",
+		"--git-common-dir"
+	], cwd);
+	return r.code === 0 ? r.stdout.trim() || null : null;
+}
 async function currentBranch(runner, cwd) {
 	const r = await runner.run(["branch", "--show-current"], cwd);
 	return r.code === 0 ? r.stdout.trim() || null : null;
@@ -1129,30 +1138,37 @@ function userStateRoot() {
 	const xdg = process.env.XDG_STATE_HOME?.trim();
 	return join(xdg || join(homedir(), ".local", "state"), "gitflow-guard");
 }
-function canonicalRepoRoot(repoRoot) {
+/** fs 兜底规范化(仅当 git 查询不可用时使用; Windows 8.3 短名等以 git 输出为准) */
+function safeRealpath(p) {
 	try {
-		return realpathSync(repoRoot);
+		return realpathSync(p);
 	} catch {
-		return repoRoot;
+		return p;
 	}
 }
 /**
 * 仓库运行时状态目录(审计流水等), 键为「仓库名-真实路径哈希」。
-* 刻意放在仓库外、且在 agent 文件沙箱(workspace-write)可写区之外:
-* 凡 agent 可写之处的状态都可能被 agent 伪造而自我授权, 存仓库外才堵住这条路;
-* 附带收益: 重克隆/移动 .git 不丢历史。
+* 键由 git 权威解析(rev-parse --git-common-dir): linked worktree 与主仓库共用
+* 同一状态目录(≤0.0.13 共享语义), 且天然规避 Windows 8.3 短名/大小写差异;
+* git 查询不可用时回退 fs realpath。刻意放在仓库外、且在 agent 文件沙箱
+* (workspace-write)可写区之外 —— 凡 agent 可写之处的状态都可能被伪造而自我授权。
 */
-function stateDir(repoRoot) {
-	const real = canonicalRepoRoot(repoRoot);
-	const hash = createHash("sha256").update(real).digest("hex").slice(0, 12);
-	const name = basename(real).replace(/[^\w.-]+/g, "-") || "repo";
+async function stateDir(repoRoot, runner = gitRunner) {
+	let key = safeRealpath(repoRoot);
+	try {
+		const common = await commonGitDir(runner, repoRoot);
+		if (common) key = common.replace(/[/\\]\.git[/\\]?$/, "") || common;
+	} catch {}
+	const hash = createHash("sha256").update(key).digest("hex").slice(0, 12);
+	const name = basename(key).replace(/[^\w.-]+/g, "-") || "repo";
 	return join(userStateRoot(), "repos", `${name}-${hash}`);
 }
 /** 审计留痕; 失败不阻断门禁 */
-async function appendAudit(repoRoot, entry) {
+async function appendAudit(repoRoot, entry, runner = gitRunner) {
 	try {
-		await mkdir(stateDir(repoRoot), { recursive: true });
-		await appendFile(join(stateDir(repoRoot), "audit.jsonl"), `${JSON.stringify(entry)}\n`, "utf8");
+		const dir = await stateDir(repoRoot, runner);
+		await mkdir(dir, { recursive: true });
+		await appendFile(join(dir, "audit.jsonl"), `${JSON.stringify(entry)}\n`, "utf8");
 	} catch {}
 }
 /** 解析一条命令: 分类 → git 事实 → 门禁 → allow/deny */
@@ -1191,7 +1207,7 @@ async function evaluateCommand(command, opts) {
 				event: "deny",
 				command,
 				reason: decision.reason
-			});
+			}, env.runner);
 			return {
 				outcome: "deny",
 				reason: {
@@ -1222,7 +1238,7 @@ async function logCiReference(seg, env) {
 		event: "ci",
 		command: seg.pr ?? void 0,
 		role: state
-	});
+	}, env.runner);
 }
 /** 按段预取 git 事实(异步 I/O 全部前置, 门禁保持纯函数) */
 async function factsFor(seg, env) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agents-gitflow-guard",
-  "version": "0.0.14",
+  "version": "0.0.16",
   "description": "A configurable branch-role guard for AI coding agents (DSH / Claude Code / Codex / OpenCode / Antigravity) — integration/preview/production/archive, each with its own update rules",
   "license": "MIT",
   "type": "module",
@@ -27,6 +27,7 @@
   "keywords": [
     "dsh",
     "deepseek-harness",
+    "dsh-plugin",
     "claude-code",
     "codex",
     "opencode",
@@ -60,7 +61,9 @@
     "prepack": "npm run build",
     "test": "vitest run",
     "typecheck": "tsc --noEmit",
-    "verify:matrix": "npm run build && node scripts/verify-matrix.mjs"
+    "verify:matrix": "npm run build && node scripts/verify-matrix.mjs",
+    "check:pins": "node scripts/check-version-pins.mjs",
+    "prepublishOnly": "npm run check:pins"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",