codiedev 0.9.29 → 0.9.31

package/assets/git-refs.mjs

@@ -0,0 +1,208 @@
+// Git-ref resolution and header construction for the Codiedev OpenCode
+// plugin. These live OUTSIDE opencode-plugin.mjs on purpose: opencode
+// treats EVERY export of a plugin module as a plugin factory, so exporting
+// helpers there breaks harness startup. See openCodePluginGitRefs.test.ts.
+
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, isAbsolute } from "node:path";
+
+const skillUseBySession = new Map();
+
+/**
+ * The directory the agent last WROTE to. Reading refs from the plugin's cwd is
+ * only right when `codie` was launched where the work lands. A dev who launches
+ * in their primary checkout while the agent edits a sibling git worktree would
+ * otherwise report the launch checkout's branch forever — the shape seen on
+ * `secscan`, whose merged PRs came from `feat/live-security-operations` and
+ * `worktree-landing-page-login` while the session recorded only `main`.
+ *
+ * Writes are the signal, not reads: an agent reads all over the tree, but the
+ * code it writes is what becomes the PR.
+ *
+ * Keyed by session, like skillUseBySession: one OpenCode process hosts many
+ * sessions (TUI `/new`, `task` subagents, `opencode serve`). A single global
+ * slot would let a write in session B retarget session A's headers, and both
+ * dirs pass the trust check when they share an origin, so the guard would not
+ * catch it.
+ */
+export const workDirBySession = new Map();
+const WRITE_TOOLS = new Set(["write", "edit", "patch"]);
+
+export function trackWorkPath(tool, args, sessionID, state = workDirBySession) {
+  if (!WRITE_TOOLS.has(tool)) return;
+  const filePath = args?.filePath ?? args?.file_path;
+  // Relative paths are resolved against a cwd we may not share, so they are
+  // not usable anchors.
+  if (typeof filePath !== "string" || !isAbsolute(filePath)) return;
+  state.set(sessionID, dirname(filePath));
+}
+
+/**
+ * `tool.execute.before` fires BEFORE the write lands, so a file created in a
+ * new subdirectory names a directory that does not exist yet. Running git
+ * there fails, and caching that failure would revert to the launch cwd for the
+ * whole TTL — most of a task, for an agent scaffolding several directories.
+ * Walk up to the nearest directory that does exist.
+ */
+function nearestExistingDir(dir, exists = existsSync) {
+  let current = dir;
+  for (let hops = 0; current && hops < 40; hops += 1) {
+    if (exists(current)) return current;
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+  return null;
+}
+
+/**
+ * Canonicalize a git remote to bare `host/path` so the two sides of the trust
+ * check compare equal.
+ *
+ * They arrive from DIFFERENT inputs: the live side is the raw output of
+ * `git remote get-url origin`, while CODIEDEV_REPO_URL has already been through
+ * `safeRepoUrl()` in codie.ts, which strips userinfo. Canonicalizing to one
+ * shape — no scheme, no userinfo, scp-colon folded to a slash — is what makes
+ * `git@host:org/repo.git` and `host:org/repo.git` land on the same string.
+ *
+ * An earlier version rewrote ssh→https instead, which matched only when BOTH
+ * sides were raw. It silently failed for every ssh-cloned checkout, i.e. most
+ * enterprise ones.
+ */
+function normalizeRemote(url) {
+  let value = String(url || "").trim().toLowerCase();
+  if (!value) return "";
+  value = value.replace(/^[a-z][a-z0-9+.-]*:\/\//, ""); // scheme://
+  value = value.replace(/^[^@/]+@/, ""); // git@ , user:token@
+  value = value.replace(/^([^/:]+):(?!\d)/, "$1/"); // scp-style host:path, keep :port
+  value = value.replace(/\/+$/, ""); // trailing slash BEFORE .git, or "repo.git/" survives
+  value = value.replace(/\.git$/, "");
+  return value.replace(/\/+$/, "");
+}
+
+/**
+ * Git refs are re-read live per request, not taken from the launch-time
+ * environment. bin/codie.js samples CODIEDEV_BRANCH / CODIEDEV_HEAD_SHA once
+ * and freezes them for the whole session, so a dev who starts on main and
+ * moves to a feature branch reported `main` until they quit. Gateway sessions
+ * then branch-matched nothing, because a merged PR's sourceBranch is always
+ * the feature branch. The env vars survive only as a fallback for when git
+ * cannot be read at all.
+ */
+const GIT_TTL_MS = 5_000;
+const gitCache = {};
+
+function clean(value, max) {
+  const text = typeof value === "string" ? value.trim() : "";
+  return text ? text.slice(0, max) : "";
+}
+
+/** Returns trimmed stdout, or null when git could not be read. */
+function runGit(args, cwd) {
+  try {
+    return execFileSync("git", args, {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 1_000,
+      ...(cwd ? { cwd } : {}),
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * A write directory is only trusted when it belongs to the SAME repo the
+ * session is attributed to. Without that check, one stray edit into an
+ * unrelated checkout would publish that repo's branch name to the gateway.
+ * With no configured repo url there is nothing to check against, so we stay on
+ * cwd rather than trust a path.
+ */
+function trustedDir(dir, env, run, cache, at, ttlMs, exists = existsSync) {
+  if (!dir) return null;
+  const want = normalizeRemote(env.CODIEDEV_REPO_URL);
+  if (!want) return null;
+  const probe = nearestExistingDir(dir, exists);
+  if (!probe) return null;
+  const key = `trust:${probe}`;
+  const slot = cache[key];
+  if (slot && at - slot.at < ttlMs) return slot.ok ? probe : null;
+  let ok = false;
+  try {
+    ok = normalizeRemote(run(["remote", "get-url", "origin"], probe)) === want;
+  } catch {
+    ok = false;
+  }
+  cache[key] = { at, ok };
+  return ok ? probe : null;
+}
+
+export function resolveGitRefs({
+  env = process.env,
+  run = runGit,
+  cache = gitCache,
+  now = Date.now,
+  ttlMs = GIT_TTL_MS,
+  dir = null,
+  exists = existsSync,
+} = {}) {
+  const at = now();
+  const target = trustedDir(dir, env, run, cache, at, ttlMs, exists);
+  // Keyed per directory: moving between worktrees must be visible at once, not
+  // after the TTL of whichever directory was resolved first.
+  const key = `refs:${target ?? ""}`;
+  const slot = cache[key];
+  // One git pair per directory per TTL keeps this flat however fast the agent
+  // loops. Failures are cached too, so a pathological git costs one attempt
+  // per TTL rather than one per request.
+  if (slot && at - slot.at < ttlMs) return slot.refs;
+
+  let branch = null;
+  let sha = null;
+  try {
+    branch = run(["branch", "--show-current"], target ?? undefined);
+    sha = run(["rev-parse", "HEAD"], target ?? undefined);
+  } catch {
+    branch = null;
+    sha = null;
+  }
+
+  // A successful read wins even when it is empty: on a detached HEAD "no
+  // branch" is the true answer, and falling back to env would put the stale
+  // launch-time branch straight back.
+  //
+  // The fallback is ALL-OR-NOTHING. Mixing a live branch with an env sha (or
+  // the reverse) describes a commit that never existed on that branch — if
+  // `rev-parse` alone times out on a lock, the request would claim
+  // `feat/x` + `<launch sha of main>` and the server would attribute the
+  // session to a commit it never touched. That is worse than no sha at all.
+  const branchOk = typeof branch === "string";
+  const shaOk = typeof sha === "string" && sha !== "";
+  const refs = branchOk && shaOk
+    ? { branch: clean(branch, 200), sha: clean(sha, 40) }
+    : { branch: clean(env.CODIEDEV_BRANCH, 200), sha: clean(env.CODIEDEV_HEAD_SHA, 40) };
+  cache[key] = { at, refs };
+  return refs;
+}
+
+/**
+ * The complete set of headers this plugin may add — a closed allowlist. No
+ * prompt, message, code, diff, or tool output ever appears here.
+ */
+export function buildAttributionHeaders({ sessionID, env = process.env, refs, skills = [] }) {
+  const headers = {};
+  const session = clean(sessionID, 200);
+  if (session) headers["X-Codiedev-Session-Id"] = session;
+  const repo = clean(env.CODIEDEV_REPO_URL, 2048);
+  if (repo) headers["X-Codiedev-Repo-Url"] = repo;
+  const branch = clean(refs?.branch, 200);
+  if (branch) headers["X-Codiedev-Branch"] = branch;
+  const sha = clean(refs?.sha, 40);
+  if (/^[0-9a-f]{7,40}$/i.test(sha)) headers["X-Codiedev-Head-Sha"] = sha;
+  const user = clean(env.CODIEDEV_USER, 200);
+  if (user) headers["X-Codiedev-User"] = user;
+  const skillList = clean(skills.join(","), 4096);
+  if (skillList) headers["X-Codiedev-Skills-Used"] = skillList;
+  return headers;
+}

package/assets/opencode-plugin.mjs

@@ -3,12 +3,14 @@
 // output. It only attaches stable session/git identifiers and explicit skill
 // names to inference requests handled by the company gateway.
 
-const skillUseBySession = new Map();
+import {
+  buildAttributionHeaders,
+  resolveGitRefs,
+  trackWorkPath,
+  workDirBySession,
+} from "./git-refs.mjs";
 
-function clean(value, max) {
-  const text = typeof value === "string" ? value.trim() : "";
-  return text ? text.slice(0, max) : "";
-}
+const skillUseBySession = new Map();
 
 function addSkill(sessionID, value) {
   const skill = clean(value, 160).replace(/^\//, "").replace(/\.md$/i, "");
@@ -29,26 +31,34 @@ export const CodiedevMetadata = async () => ({
     if (!builtIns.has(input.command)) addSkill(input.sessionID, input.command);
   },
   "tool.execute.before": async (input, output) => {
+    // Follow where the agent writes so refs come from the tree that becomes
+    // the PR. Only the path's DIRECTORY is kept, and only to run git in it —
+    // no path ever leaves this process.
+    trackWorkPath(input.tool, output.args, input.sessionID);
     if (input.tool !== "skill") return;
     addSkill(input.sessionID, output.args?.name || output.args?.skill || output.args?.key);
   },
   "chat.headers": async (input, output) => {
-    output.headers["X-Codiedev-Session-Id"] = clean(input.sessionID, 200);
-    const repo = clean(process.env.CODIEDEV_REPO_URL, 2048);
-    const branch = clean(process.env.CODIEDEV_BRANCH, 200);
-    const sha = clean(process.env.CODIEDEV_HEAD_SHA, 40);
-    const user = clean(process.env.CODIEDEV_USER, 200);
-    const skills = [...(skillUseBySession.get(input.sessionID) || [])].join(",");
-    if (repo) output.headers["X-Codiedev-Repo-Url"] = repo;
-    if (branch) output.headers["X-Codiedev-Branch"] = branch;
-    if (/^[0-9a-f]{7,40}$/i.test(sha)) output.headers["X-Codiedev-Head-Sha"] = sha;
-    if (user) output.headers["X-Codiedev-User"] = user;
-    if (skills) output.headers["X-Codiedev-Skills-Used"] = skills;
+    Object.assign(
+      output.headers,
+      buildAttributionHeaders({
+        sessionID: input.sessionID,
+        env: process.env,
+        refs: resolveGitRefs({ dir: workDirBySession.get(input.sessionID) ?? null }),
+        skills: [...(skillUseBySession.get(input.sessionID) || [])],
+      }),
+    );
   },
   event: async ({ event }) => {
     if (event?.type === "session.deleted") {
       const sessionID = event.properties?.info?.id || event.properties?.sessionID;
-      if (sessionID) skillUseBySession.delete(sessionID);
+      if (sessionID) {
+        skillUseBySession.delete(sessionID);
+        // Drop the work dir with it, or a fresh session in the primary
+        // checkout keeps reporting the deleted session's worktree branch
+        // until its own first write.
+        workDirBySession.delete(sessionID);
+      }
     }
   },
 });

package/dist/commands/reverseTicket.d.ts

@@ -1 +1,2 @@
+export declare function isSafeRef(ref: string): boolean;
 export declare function runReverseTicket(args: string[]): Promise<void>;

package/dist/commands/reverseTicket.js

@@ -1,9 +1,47 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSafeRef = isSafeRef;
 exports.runReverseTicket = runReverseTicket;
 const child_process_1 = require("child_process");
 const shared_1 = require("./shared");
 const prUrl_1 = require("../prUrl");
+/**
+ * Run a binary with an explicit argv, never a shell.
+ *
+ * The `gh`/`glab` API paths are built from an owner/repo parsed out of a URL the
+ * caller pastes in. `parsePrOrMrUrl` only bounds those segments to "no slash",
+ * so they can still carry `$(…)`, backticks or `;` — which a `shell: true`
+ * invocation would execute. Passing argv directly means the shell never sees
+ * them at all.
+ */
+function runArgv(bin, argv, opts = {}) {
+    const res = (0, child_process_1.spawnSync)(bin, argv, {
+        stdio: ["pipe", "pipe", "pipe"],
+        encoding: "utf8",
+        maxBuffer: opts.maxBuffer ?? 50 * 1024 * 1024,
+        shell: false,
+    });
+    if (res.error)
+        throw res.error;
+    if (res.status !== 0) {
+        throw new Error(`${bin} ${argv.join(" ")} failed (exit ${res.status}): ${(res.stderr || "").trim().slice(0, 500)}`);
+    }
+    return res.stdout ?? "";
+}
+// Git ref names legally contain `$()`, `;`, `|` and backticks, all of which
+// break out of the `shell: true` git calls in branch mode below. A ref supplied
+// via `--base` is caller-controlled, so bound it to the safe subset before it
+// reaches a command line. Mirrors `validate_ref` in modal/runner.py.
+const SAFE_REF_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$/;
+function isSafeRef(ref) {
+    if (!ref || ref.startsWith("-"))
+        return false;
+    if (ref.includes("..") || ref.includes("@{"))
+        return false;
+    if (ref.endsWith("/") || ref.endsWith("."))
+        return false;
+    return SAFE_REF_RE.test(ref);
+}
 async function fetchPrOrMrBundle(parsed, rawUrl, noTruncate) {
     console.log(`Fetching ${parsed.provider === "gitlab" ? "MR" : "PR"} ${parsed.owner}/${parsed.repo}#${parsed.number}…`);
     if (parsed.provider === "github") {
@@ -86,7 +124,7 @@ async function fetchPrOrMrBundle(parsed, rawUrl, noTruncate) {
 }
 function checkCli(bin) {
     try {
-        (0, child_process_1.execSync)(`${bin} --version`, { stdio: ["pipe", "pipe", "pipe"] });
+        runArgv(bin, ["--version"], { maxBuffer: 1024 * 1024 });
         return true;
     }
     catch {
@@ -94,28 +132,22 @@ function checkCli(bin) {
     }
 }
 function ghApi(path) {
-    const out = (0, child_process_1.execSync)(`gh api "${path}"`, {
-        stdio: ["pipe", "pipe", "pipe"],
-        maxBuffer: 50 * 1024 * 1024,
-    }).toString("utf8");
-    return JSON.parse(out);
+    return JSON.parse(runArgv("gh", ["api", path]));
 }
 function ghRaw(path) {
-    return (0, child_process_1.execSync)(`gh api -H "Accept: application/vnd.github.v3.diff" "${path}"`, {
-        stdio: ["pipe", "pipe", "pipe"],
-        maxBuffer: 50 * 1024 * 1024,
-    }).toString("utf8");
+    return runArgv("gh", [
+        "api",
+        "-H",
+        "Accept: application/vnd.github.v3.diff",
+        path,
+    ]);
 }
 // glab api takes a project path (URL-encoded) or numeric id and a sub-path.
 // For self-hosted GitLab, glab respects `GITLAB_HOST` env if the user has
 // configured glab against their internal instance.
 function glabApi(projectPath, subpath) {
     const encoded = encodeURIComponent(projectPath);
-    const out = (0, child_process_1.execSync)(`glab api "projects/${encoded}/${subpath}"`, {
-        stdio: ["pipe", "pipe", "pipe"],
-        maxBuffer: 50 * 1024 * 1024,
-    }).toString("utf8");
-    return JSON.parse(out);
+    return JSON.parse(runArgv("glab", ["api", `projects/${encoded}/${subpath}`]));
 }
 function parseArgs(args) {
     let prUrl;
@@ -258,6 +290,12 @@ async function runBranchMode(opts) {
         console.error("Not inside a git repository. Run this from a checked-out repo.");
         process.exit(1);
     }
+    // `--base` lands unquoted on a `git` command line below, so reject anything
+    // outside the safe-ref subset instead of letting the shell interpret it.
+    if (opts.explicitBase !== undefined && !isSafeRef(opts.explicitBase)) {
+        console.error(`Invalid --base ref: ${JSON.stringify(opts.explicitBase)}. Expected a plain branch or tag name.`);
+        process.exit(1);
+    }
     // Resolve base ref — explicit, then origin/main, then origin/master.
     const candidates = opts.explicitBase
         ? [opts.explicitBase]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.29",
+  "version": "0.9.31",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",