dsh-config-manager 0.2.3 → 0.3.0

package/src/sync/git/git-transport.test.ts

@@ -11,7 +11,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { execFile } from 'node:child_process';
 
-import { clearInspectFactsCache, GitTransport, GitTransportError } from './git-transport.ts';
+import { clearInspectFactsCache, defaultGitExec, GitTransport, GitTransportError } from './git-transport.ts';
 import type { GitExecFn, GitExecResult, GitTransportOptions } from './git-transport.ts';
 import { encryptSectionsPayload } from '../snapshot-crypto.ts';
 import { computeSnapshotMeta, DEFAULT_SYNC_TIMEOUT_MS, isEncryptedSections, SyncTransportError } from '../transport.ts';
@@ -119,6 +119,29 @@ function joinedArgs(calls: CallRecord[], needle: string): string[] {
   return calls.filter((c) => c.args.join(' ').includes(needle)).map((c) => c.args.join(' '));
 }
 
+/** 去掉 argv 前置的协议护栏（-c protocol.*.allow=never），用于断言「业务参数」本身 */
+function stripProtocolGuards(joined: string): string {
+  return joined.replace(/^(?:-c protocol\.[a-z]+\.allow=never )+/, '');
+}
+
+/** 单条调用是否带某个 -c 配置（必须成对出现） */
+function hasGitConfig(args: string[], kv: string): boolean {
+  const i = args.indexOf(kv);
+  return i > 0 && args[i - 1] === '-c';
+}
+
+/**
+ * 拉取命令判定（issue #122）：fetch 与 origin 之间现在会插 `--no-tags`/`--filter=blob:none`，
+ * 所以不能再按 'fetch origin' 子串匹配。
+ */
+function isFetchArgs(args: string[]): boolean {
+  return args.includes('fetch') && args.includes('origin');
+}
+
+function fetchCalls(calls: CallRecord[]): string[] {
+  return calls.filter((c) => isFetchArgs(c.args)).map((c) => c.args.join(' '));
+}
+
 /** 构造加密快照（sections 为 EncryptedSections 密文载荷；含文件分区以覆盖字节往返）。 */
 async function encryptedSnapshot(overrides: Partial<SyncSnapshot> = {}): Promise<SyncSnapshot> {
   const base = sampleSnapshot();
@@ -896,7 +919,7 @@ function pullScriptedExec(calls: CallRecord[], pullResults: GitExecResult[]): Gi
     const joined = args.join(' ');
     if (joined.includes('rev-parse') && joined.includes('--abbrev-ref')) return { stdout: 'main', stderr: '', code: 0 };
     if (joined.includes('rev-parse')) return { stdout: 'sha', stderr: '', code: 0 };
-    if (joined.includes('fetch origin')) {
+    if (isFetchArgs(args)) {
       const r = pullResults[Math.min(i, pullResults.length - 1)]!;
       i += 1;
       return r;
@@ -916,7 +939,7 @@ test('t24：幂等读（list）遇瞬时网络故障 → 指数退避重试后
     workDir: dir, exec, retry: { attempts: 3, baseDelayMs: 1, sleep: async () => {} },
   }));
   assert.deepEqual(await transport.list(), [], '重试后应成功（空远端）');
-  assert.equal(joinedArgs(calls, 'fetch origin').length, 2, '第一次瞬时失败 → 重试一次即成功');
+  assert.equal(fetchCalls(calls).length, 2, '第一次瞬时失败 → 重试一次即成功');
 });
 
 test('t24：重试耗尽后上抛带分类的错误（network / retryable=true），尝试次数 = attempts', async (t) => {
@@ -933,7 +956,7 @@ test('t24：重试耗尽后上抛带分类的错误（network / retryable=true
     assert.equal(err.retryable, true);
     return true;
   });
-  assert.equal(joinedArgs(calls, 'fetch origin').length, 3, 'attempts=3 → 恰好 3 次尝试');
+  assert.equal(fetchCalls(calls).length, 3, 'attempts=3 → 恰好 3 次尝试');
 });
 
 test('t24：不可重试错误（仓库不存在 / 鉴权失败）→ 只尝试一次且分类正确', async (t) => {
@@ -954,7 +977,7 @@ test('t24：不可重试错误（仓库不存在 / 鉴权失败）→ 只尝试
       assert.equal(err.retryable, false, '不可重试: ' + stderr);
       return true;
     });
-    assert.equal(joinedArgs(calls, 'fetch origin').length, 1, '不可重试错误不得重试: ' + stderr);
+    assert.equal(fetchCalls(calls).length, 1, '不可重试错误不得重试: ' + stderr);
   }
 });
 
@@ -965,10 +988,13 @@ test('远端同步命令序列：显式 refspec fetch + merge --ff-only，绝不
     workDir: dir, exec: pullScriptedExec(calls, [{ stdout: '', stderr: '', code: 0 }]),
   }));
   await transport.list();
-  const joined = calls.map((c) => c.args.join(' '));
+  // SEC-12：每条 argv 前都挂协议护栏，断言业务参数前先剥掉
+  const joined = calls.map((c) => stripProtocolGuards(c.args.join(' ')));
   assert.ok(!joined.some((j) => /^pull(\s|$)/.test(j)), '不得再执行 git pull: ' + joined.join(' | '));
   // 网络命令前面会挂 credential helper 的 -c 参数，所以按「末尾 3 个参数」判命令本身
-  const fetched = calls.some((c) => c.args.slice(-3).join(' ') === 'fetch origin +refs/heads/main:refs/remotes/origin/main');
+  // issue #122：fetch 与 origin 之间还会插 `--no-tags`（partial clone 时另有 `--filter=blob:none`），
+  // 所以按「含 fetch / 含 origin / 末尾是显式 refspec」判定，而不是钉死参数个数
+  const fetched = calls.some((c) => isFetchArgs(c.args) && c.args.at(-1) === '+refs/heads/main:refs/remotes/origin/main');
   assert.ok(fetched, '必须显式 refspec fetch: ' + joined.join(' | '));
   assert.ok(joined.includes('merge --ff-only origin/main'), '必须显式远端分支快进合并: ' + joined.join(' | '));
 });
@@ -981,7 +1007,7 @@ test('远端还没有同名分支（空仓库 / 分支被改名）→ 与「无
     const joined = args.join(' ');
     if (joined.includes('--abbrev-ref')) return { stdout: 'main', stderr: '', code: 0 };
     if (joined.includes('rev-parse')) return { stdout: 'sha', stderr: '', code: 0 };
-    if (joined.includes('fetch origin')) {
+    if (isFetchArgs(args)) {
       return { stdout: '', stderr: "fatal: couldn't find remote ref refs/heads/main", code: 128 };
     }
     return { stdout: '', stderr: '', code: 0 };
@@ -991,6 +1017,168 @@ test('远端还没有同名分支（空仓库 / 分支被改名）→ 与「无
   assert.equal(calls.filter((c) => c.args.includes('merge')).length, 0, '没 fetch 到东西就不该 merge');
 });
 
+/* ---------------- issue #122：远端仓库远大于同步内容时不许卡死 ---------------- */
+
+const SHA_A = 'a'.repeat(40);
+const SHA_B = 'b'.repeat(40);
+
+test('issue #122：远端 sha 与本地跟踪引用一致且已合并 → 整轮零 fetch、零 merge（只花一次 ls-remote）', async (t) => {
+  const dir = await makeGitWorkDir(t);
+  const calls: CallRecord[] = [];
+  const exec: GitExecFn = async (_cmd, args) => {
+    calls.push({ cmd: 'git', args });
+    const joined = args.join(' ');
+    if (joined.includes('--abbrev-ref')) return { stdout: 'main', stderr: '', code: 0 };
+    if (joined.includes('ls-remote')) return { stdout: `${SHA_A}\trefs/heads/main\n`, stderr: '', code: 0 };
+    if (joined.includes('rev-parse')) return { stdout: SHA_A, stderr: '', code: 0 };
+    return { stdout: '', stderr: '', code: 0 };
+  };
+  const transport = new GitTransport(makeOptions({ workDir: dir, exec }));
+  assert.deepEqual(await transport.list(), []);
+  const trace = calls.map((c) => c.args.join(' ')).join(' | ');
+  assert.equal(fetchCalls(calls).length, 0, '稳态不得发 fetch: ' + trace);
+  assert.equal(calls.filter((c) => c.args.includes('merge')).length, 0, '稳态不得 merge: ' + trace);
+  assert.equal(joinedArgs(calls, 'ls-remote').length, 1, '稳态只允许一次 ls-remote: ' + trace);
+});
+
+test('issue #122：refs 已是最新但 HEAD 落后（上次 merge 没跑完）→ 跳过 fetch、仍本地 merge', async (t) => {
+  const dir = await makeGitWorkDir(t);
+  const calls: CallRecord[] = [];
+  const exec: GitExecFn = async (_cmd, args) => {
+    calls.push({ cmd: 'git', args });
+    const joined = args.join(' ');
+    if (joined.includes('--abbrev-ref')) return { stdout: 'main', stderr: '', code: 0 };
+    if (joined.includes('ls-remote')) return { stdout: `${SHA_A}\trefs/heads/main\n`, stderr: '', code: 0 };
+    // 远端跟踪引用已指向远端最新，但 HEAD 还停在旧提交
+    if (joined.includes('refs/remotes/origin/main')) return { stdout: SHA_A, stderr: '', code: 0 };
+    if (joined.includes('rev-parse')) return { stdout: SHA_B, stderr: '', code: 0 };
+    return { stdout: '', stderr: '', code: 0 };
+  };
+  const transport = new GitTransport(makeOptions({ workDir: dir, exec }));
+  assert.deepEqual(await transport.list(), []);
+  assert.equal(fetchCalls(calls).length, 0, '没有新对象可拉 → 不 fetch');
+  assert.equal(joinedArgs(calls, 'merge --ff-only origin/main').length, 1, '本地没合并完 → 必须继续 merge');
+});
+
+test('issue #122：远端有新提交 → 正常 fetch + merge，fetch 带 --no-tags（同步仓库不需要 tag）', async (t) => {
+  const dir = await makeGitWorkDir(t);
+  const calls: CallRecord[] = [];
+  const exec: GitExecFn = async (_cmd, args) => {
+    calls.push({ cmd: 'git', args });
+    const joined = args.join(' ');
+    if (joined.includes('--abbrev-ref')) return { stdout: 'main', stderr: '', code: 0 };
+    if (joined.includes('ls-remote')) return { stdout: `${SHA_A}\trefs/heads/main\n`, stderr: '', code: 0 };
+    if (joined.includes('refs/remotes/origin/main')) return { stdout: SHA_B, stderr: '', code: 0 };
+    if (joined.includes('rev-parse')) return { stdout: SHA_B, stderr: '', code: 0 };
+    return { stdout: '', stderr: '', code: 0 };
+  };
+  const transport = new GitTransport(makeOptions({ workDir: dir, exec }));
+  assert.deepEqual(await transport.list(), []);
+  const fetches = fetchCalls(calls);
+  assert.equal(fetches.length, 1, '远端有新提交 → 必须 fetch: ' + calls.map((c) => c.args.join(' ')).join(' | '));
+  assert.ok(fetches[0]!.includes('--no-tags'), 'fetch 必须带 --no-tags: ' + fetches[0]!);
+  assert.ok(!fetches[0]!.includes('--filter='), '非 partial clone 不得加 blob 过滤: ' + fetches[0]!);
+  assert.equal(joinedArgs(calls, 'merge --ff-only origin/main').length, 1, 'fetch 之后必须 ff 合并');
+});
+
+test('issue #122：partial clone 的 fetch 保持 --filter=blob:none（不因过滤丢失后续 checkout 需要的 blob）', async (t) => {
+  const dir = await makeGitWorkDir(t);
+  const calls: CallRecord[] = [];
+  const exec: GitExecFn = async (_cmd, args) => {
+    calls.push({ cmd: 'git', args });
+    const joined = args.join(' ');
+    if (joined.includes('remote.origin.promisor')) return { stdout: 'true\n', stderr: '', code: 0 };
+    if (joined.includes('--abbrev-ref')) return { stdout: 'main', stderr: '', code: 0 };
+    if (joined.includes('ls-remote')) return { stdout: `${SHA_A}\trefs/heads/main\n`, stderr: '', code: 0 };
+    if (joined.includes('refs/remotes/origin/main')) return { stdout: SHA_B, stderr: '', code: 0 };
+    if (joined.includes('rev-parse')) return { stdout: SHA_B, stderr: '', code: 0 };
+    return { stdout: '', stderr: '', code: 0 };
+  };
+  const transport = new GitTransport(makeOptions({ workDir: dir, exec }));
+  assert.deepEqual(await transport.list(), []);
+  const fetches = fetchCalls(calls);
+  assert.equal(fetches.length, 1);
+  assert.ok(fetches[0]!.includes('--filter=blob:none'), 'partial clone 必须保持 blob 过滤: ' + fetches[0]!);
+});
+
+test('issue #122：网络子命令一律带低速上限，本地子命令不带', async (t) => {
+  const dir = await makeGitWorkDir(t);
+  const calls: CallRecord[] = [];
+  const transport = new GitTransport(makeOptions({ workDir: dir, exec: pullScriptedExec(calls, [{ stdout: '', stderr: '', code: 0 }]) }));
+  await transport.list();
+  const net = calls.filter((c) => ['clone', 'fetch', 'push', 'ls-remote'].some((sub) => c.args.includes(sub)));
+  assert.ok(net.length > 0, '至少应有 ls-remote/fetch: ' + calls.map((c) => c.args.join(' ')).join(' | '));
+  for (const c of net) {
+    const j = c.args.join(' ');
+    assert.ok(j.includes('http.lowSpeedLimit=1000') && j.includes('http.lowSpeedTime=30'), '网络命令必须带低速上限: ' + j);
+  }
+  const local = calls.filter((c) => c.args.includes('rev-parse'));
+  assert.ok(local.length > 0);
+  for (const c of local) assert.ok(!c.args.join(' ').includes('lowSpeedLimit'), '本地命令不该带 http 配置: ' + c.args.join(' '));
+});
+
+test('issue #122：首次 clone 走 partial clone + sparse-checkout，只 materialize 三个同步目录', async (t) => {
+  const dir = await makeTempDir(t); // 空目录 → 走 clone
+  const calls: CallRecord[] = [];
+  const transport = new GitTransport(makeOptions({ workDir: dir, exec: mockExec(calls) }));
+  await transport.list();
+  const clone = calls.find((c) => c.args.includes('clone'));
+  assert.ok(clone !== undefined, '应触发 clone: ' + calls.map((c) => c.args.join(' ')).join(' | '));
+  assert.ok(clone.args.includes('--filter=blob:none'), 'clone 必须 partial（只取 commit+tree）: ' + clone.args.join(' '));
+  assert.ok(clone.args.includes('--no-checkout'), 'clone 先不落地文件: ' + clone.args.join(' '));
+  assert.equal(joinedArgs(calls, 'clone').length, 1, '不允许多 clone 一次');
+  const sparse = calls.find((c) => c.args.includes('sparse-checkout'));
+  assert.ok(sparse !== undefined, '必须设置 sparse-checkout');
+  assert.equal(
+    stripProtocolGuards(sparse.args.join(' ')),
+    'sparse-checkout set --cone snapshots snapshots-encrypted blobs',
+    'sparse 面必须与同步目录同源: ' + sparse.args.join(' '),
+  );
+  assert.equal(calls.filter((c) => c.args.includes('checkout')).length, 1, 'sparse 之后必须 checkout 一次');
+});
+
+test('issue #122：老 git 不认 --filter → 回落全量 clone（绝不因优化失败）', async (t) => {
+  const dir = await makeTempDir(t);
+  const calls: CallRecord[] = [];
+  const exec: GitExecFn = async (_cmd, args) => {
+    calls.push({ cmd: 'git', args });
+    if (args.includes('--filter=blob:none')) {
+      return { stdout: '', stderr: "error: unknown option `filter=blob:none'", code: 129 };
+    }
+    return { stdout: '', stderr: '', code: 0 };
+  };
+  const transport = new GitTransport(makeOptions({ workDir: dir, exec }));
+  await transport.list();
+  const clones = calls.filter((c) => c.args.includes('clone'));
+  assert.equal(clones.length, 2, '必须先试 partial、再回落全量: ' + clones.map((c) => c.args.join(' ')).join(' | '));
+  assert.ok(!clones[1]!.args.includes('--filter=blob:none'), '回落那次不得带 --filter');
+  assert.equal(calls.filter((c) => c.args.includes('sparse-checkout')).length, 0, '回落路径不做 sparse');
+});
+
+test('issue #122：超时 kill 整棵进程树，且有界收尾（孙进程不再继续跑）', async (t) => {
+  const dir = await makeTempDir(t);
+  const marker = path.join(dir, 'grandchild-alive.txt');
+  // 父进程拉起孙进程后常驻；孙进程 1.5 s 后写标记文件 —— 只杀父进程时它会照写
+  await fs.writeFile(path.join(dir, 'grandchild.cjs'), [
+    "setTimeout(() => { require('node:fs').writeFileSync(process.argv[2], 'alive'); }, 1500);",
+    '',
+  ].join('\n'));
+  await fs.writeFile(path.join(dir, 'parent.cjs'), [
+    "const { spawn } = require('node:child_process');",
+    "spawn(process.execPath, [require('node:path').join(__dirname, 'grandchild.cjs'), process.argv[2]], { stdio: 'ignore' });",
+    'setInterval(() => {}, 1000);',
+    '',
+  ].join('\n'));
+  const started = Date.now();
+  const res = await defaultGitExec(process.execPath, [path.join(dir, 'parent.cjs'), marker], { timeoutMs: 200 });
+  const elapsed = Date.now() - started;
+  assert.notEqual(res.code, 0, '超时必须是非零退出');
+  assert.match(res.stderr, /timed out after 200ms/, '超时文案必须让分类器判 timeout（瞬时、可重试）');
+  assert.ok(elapsed < 4000, `超时收尾必须有界（实际 ${String(elapsed)}ms）`);
+  await new Promise((resolve) => setTimeout(resolve, 2500));
+  await assert.rejects(fs.stat(marker), '孙进程必须被一起杀掉（否则它会继续写文件/继续下 pack）');
+});
+
 test('并发驱动同一工作副本（两个 transport 实例）→ git 调用被工作副本锁串行化', async (t) => {
   const dir = await makeGitWorkDir(t);
   let active = 0;
@@ -1149,10 +1337,10 @@ test('issue #79：已有工作副本且 origin 与 repoUrl 不一致 → set-url
     exec: probeExec(calls, 'ssh://git@old.example:2222/owner/repo.git'),
   }));
   await transport.list();
-  assert.deepEqual(joinedArgs(calls, 'remote set-url'), [
-    `remote set-url origin ${target}`,
-    `remote set-url --push origin ${target}`,
-  ], 'fetch 与 push 地址都必须跟随（否则推送仍走旧地址）');
+  assert.deepEqual(joinedArgs(calls, 'remote set-url').map(stripProtocolGuards), [
+    `remote set-url origin -- ${target}`,
+    `remote set-url --push origin -- ${target}`,
+  ], 'fetch 与 push 地址都必须跟随（否则推送仍走旧地址）；repoUrl 恒由 -- 结束选项解析');
 });
 
 test('issue #79：origin 已一致 → 一条写命令都不发（幂等，只有只读探针）', async (t) => {
@@ -1171,7 +1359,7 @@ test('issue #79：无 origin（读不出来）→ remote add origin，否则 pus
   const target = 'ssh://git@fresh.example:2222/owner/repo.git';
   const transport = new GitTransport(makeOptions({ repoUrl: target, workDir: dir, exec: probeExec(calls, null) }));
   await transport.list();
-  assert.deepEqual(joinedArgs(calls, 'remote add origin'), [`remote add origin ${target}`]);
+  assert.deepEqual(joinedArgs(calls, 'remote add origin').map(stripProtocolGuards), [`remote add origin -- ${target}`]);
 });
 
 test('issue #79：origin 读得出但为空串 → 视为读不到，不改写（不拿不确定的读取覆盖配置）', async (t) => {
@@ -1194,7 +1382,7 @@ test('issue #79：Host key verification failed → 可操作指纹指引（含 h
     calls.push({ cmd: 'git', args });
     const joined = args.join(' ');
     if (joined.includes('remote get-url')) return { stdout: repoUrl, stderr: '', code: 0 };
-    if (joined.includes('fetch origin')) {
+    if (isFetchArgs(args)) {
       return { stdout: '', stderr: 'Host key verification failed.\nfatal: Could not read from remote repository.', code: 128 };
     }
     return { stdout: 'sha', stderr: '', code: 0 };
@@ -1540,3 +1728,152 @@ test('只读自检有界：锁被活进程持有时报「工作副本忙」，
 });
 
 
+
+/* ------------------------------------------------------------------------------------------------
+ * SEC-12 / SEC-03：repoUrl 不得被 git 当成命令行选项，也不得借协议开关读到本机任意仓库
+ *
+ * 事实：repoUrl 原样进 argv。于是「--upload-pack=touch /tmp/pwn」「-c core.pager=…」这类取值会被
+ * git 当成**选项**执行；「file:///…」则让 git 用本地文件协议去读任意本机仓库（sync 通道本该只碰
+ * 同步内容）。三道防线：构造期白名单（方案/主机/首字符）→ argv 恒带协议护栏 → repoUrl 前恒有 --。
+ * ---------------------------------------------------------------------------------------------- */
+test('SEC-12：以 - 开头 / 非网络方案 / 私网环回地址的 repoUrl → 构造期直接拒绝（一条 git 都不 spawn）', async (t) => {
+  const dir = await makeTempDir(t);
+  for (const repoUrl of [
+    '--upload-pack=touch /tmp/pwned',
+    '-c core.pager=touch /tmp/pwned',
+    'file:///c:/repos/x.git',
+    'ext::sh -c touch% /tmp/pwned',
+    'ftp://git.example.com/r.git',
+    'git://git.example.com/r.git',
+    'https://127.0.0.1:8443/r.git',
+    'https://[::1]/r.git',
+    'https://169.254.169.254/latest/meta-data/',
+    'https://10.1.2.3/r.git',
+    'https://172.20.0.1/r.git',
+    'https://192.168.0.9/r.git',
+  ]) {
+    const calls: CallRecord[] = [];
+    assert.throws(
+      () => new GitTransport(makeOptions({ repoUrl, workDir: dir, exec: mockExec(calls) })),
+      (err: unknown) => {
+        assert.ok(err instanceof GitTransportError, '必须是 GitTransportError: ' + repoUrl);
+        assert.match(err.message, /repoUrl/, '错误必须点明 repoUrl');
+        assert.ok(err.message.includes('[REPO_URL]'), '错误消息里的地址必须脱敏');
+        assert.ok(!err.message.includes('169.254.169.254'), '不得把危险地址原样回显');
+        return true;
+      },
+    );
+    assert.equal(calls.length, 0, '构造期拦截，不得先 spawn 再失败: ' + repoUrl);
+  }
+
+  // 本机路径仍是 git 通道既有的合法目标（real-git 集成测试就靠它），不得被白名单误伤
+  const local = new GitTransport(makeOptions({ repoUrl: path.join(dir, 'remote.git'), workDir: dir, exec: mockExec([]) }));
+  assert.ok(local);
+});
+
+test('SEC-12：协议护栏 —— 网络地址恒禁 ext + file；本机路径只禁 ext（否则本地仓老用法失效）', async (t) => {
+  const net = await makeTempDir(t);
+  const netCalls: CallRecord[] = [];
+  const netTransport = new GitTransport(makeOptions({ workDir: net, exec: mockExec(netCalls) }));
+  await netTransport.list();
+  assert.ok(netCalls.length > 0, '应有 git 调用');
+  for (const c of netCalls) {
+    assert.ok(hasGitConfig(c.args, 'protocol.ext.allow=never'), '每条 git 都必须禁 ext 兜底（ext:: 可执行任意命令）: ' + c.args.join(' '));
+    assert.ok(hasGitConfig(c.args, 'protocol.file.allow=never'), '网络地址还须禁 file（防被改写成 file:// 后读本机仓）: ' + c.args.join(' '));
+  }
+
+  const localDir = await makeTempDir(t);
+  const localCalls: CallRecord[] = [];
+  const localTransport = new GitTransport(makeOptions({
+    repoUrl: path.join(localDir, 'remote.git'), workDir: localDir, exec: mockExec(localCalls),
+  }));
+  await localTransport.list();
+  assert.ok(localCalls.length > 0, '应有 git 调用');
+  for (const c of localCalls) {
+    assert.ok(hasGitConfig(c.args, 'protocol.ext.allow=never'), 'ext 护栏对任何地址都开: ' + c.args.join(' '));
+    assert.ok(!hasGitConfig(c.args, 'protocol.file.allow=never'), '本机路径不得禁 file（否则 clone 本地仓直接失败）: ' + c.args.join(' '));
+  }
+});
+
+test('SEC-12：repoUrl 恒由 -- 与选项分开（clone / ls-remote / remote add）', async (t) => {
+  const dir = await makeTempDir(t);
+  const calls: CallRecord[] = [];
+  const transport = new GitTransport(makeOptions({ workDir: dir, exec: mockExec(calls) }));
+  await transport.list();
+
+  const urlArgIndex = (args: string[]): number => args.indexOf('https://github.com/example/private-config.git');
+  const withUrl = calls.filter((c) => urlArgIndex(c.args) >= 0);
+  assert.ok(withUrl.length > 0, '应有带 repoUrl 的调用: ' + calls.map((c) => c.args.join(' ')).join(' | '));
+  for (const c of withUrl) {
+    const i = urlArgIndex(c.args);
+    assert.equal(c.args[i - 1], '--', 'repoUrl 前必须有 -- 结束选项解析: ' + c.args.join(' '));
+  }
+
+  // remote add 同样受约束（工作副本已存在但 origin 读不到）
+  const wd = await makeGitWorkDir(t);
+  const remotes: CallRecord[] = [];
+  const t2 = new GitTransport(makeOptions({ workDir: wd, exec: probeExec(remotes, null) }));
+  await t2.list();
+  const add = remotes.filter((c) => c.args.includes('add'));
+  assert.equal(add.length, 1, '应 remote add: ' + remotes.map((c) => c.args.join(' ')).join(' | '));
+  const ai = add[0]!.args.indexOf('https://github.com/example/private-config.git');
+  assert.equal(add[0]!.args[ai - 1], '--', 'remote add 的 repoUrl 前必须有 --');
+});
+
+/* ------------------------------------------------------------------------------------------------
+ * RV1-F8：错误消息与返回体不得回显真 repoUrl
+ *
+ * 事实：构造期已用 `[REPO_URL]` 占位符，但 `repoHost()` 的 catch、`cmdFailed` 的 `{args}`（argv 里
+ * 原样带着 repoUrl）、以及 `inspectWorkDir()` 回传的 origin/pushUrl 仍可能把 `user:token@` 带出去 ——
+ * 这些字符串会进日志、进 GET /sync/status 响应、进用户贴出来的 issue 截图。
+ * 口径：错误/日志一律占位符（mask），返回体保留 host/path 但剥掉 userinfo。
+ * ---------------------------------------------------------------------------------------------- */
+test('RV1-F8：错误文本与工作副本自检返回体都不含 userinfo（token 一条都不许出）', async (t) => {
+  const secret = 'ghp_leaktoken0123456789';
+  const secretUrl = 'ssh://user:' + secret + '@git.example.com/u/r.git';
+
+  // ① exec 抛错 → cmdFailed 的 {args} 含 repoUrl 原文，必须经 mask
+  const dir = await makeTempDir(t);
+  const throwing: GitExecFn = async (_cmd, args): Promise<GitExecResult> => {
+    if (args.includes('ls-remote')) throw new Error('spawn git ENOENT: ' + args.join(' '));
+    return { stdout: '', stderr: '', code: 0 };
+  };
+  const transport = new GitTransport(makeOptions({ repoUrl: secretUrl, workDir: dir, exec: throwing }));
+  let raised: unknown = null;
+  try {
+    await transport.checkIsPrivate();
+  } catch (err) {
+    raised = err;
+  }
+  assert.ok(raised instanceof GitTransportError, '必须归一为 GitTransportError');
+  const msg1 = (raised as GitTransportError).message;
+  assert.ok(msg1.includes('[REPO_URL]'), '回显必须走占位符: ' + msg1);
+  assert.ok(!msg1.includes(secret), 'argv 里的地址含 token —— 错误文本不得回显: ' + msg1);
+  assert.ok(!msg1.includes('user:'), '不得回显 userinfo 片段: ' + msg1);
+
+  // ② 工作副本自检的 origin / pushUrl 会进 GET /sync/status 响应 → 只剥 userinfo，保留 host/path
+  const wd = await makeGitWorkDir(t);
+  const calls: CallRecord[] = [];
+  const inspector = new GitTransport(makeOptions({ repoUrl: secretUrl, workDir: wd, exec: probeExec(calls, secretUrl) }));
+  const facts = await inspector.inspectWorkDir();
+  assert.equal(facts.origin, 'ssh://git.example.com/u/r.git', 'origin 必须剥掉 userinfo: ' + String(facts.origin));
+  assert.equal(facts.pushUrl, 'ssh://git.example.com/u/r.git', 'pushUrl 同样剥掉 userinfo: ' + String(facts.pushUrl));
+  assert.ok(!JSON.stringify(facts).includes(secret), 'facts 里任何字段都不得残留 token');
+  assert.equal(facts.match, true, '匹配判定用原文比对，不受脱敏影响');
+
+  // ③ 地址解析不出主机时（本机路径走 repoHost），错误里也只是占位符
+  const localDir = await makeTempDir(t);
+  const localTransport = new GitTransport(makeOptions({
+    repoUrl: path.join(localDir, 'remote.git'), workDir: localDir, exec: mockExec([]),
+  }));
+  let hostErr: unknown = null;
+  try {
+    // 私有可见性探测会走 buildCredentialArgs → repoHost()；本机路径 new URL() 必失败
+    await localTransport.checkIsPrivate();
+  } catch (err) {
+    hostErr = err;
+  }
+  if (hostErr instanceof GitTransportError) {
+    assert.ok(!hostErr.message.includes(localDir), '本机路径同样不得原样回显: ' + hostErr.message);
+  }
+});