dsh-git-branch-manage 1.0.8 → 1.0.9

package/lib/index.js

@@ -11,6 +11,7 @@ import { childProcessExec } from './git.js';
 import { ACCEL_DEFAULT_URL, accelerateUrlError } from './normalize.js';
 import { handleCredentials, handleCredentialsDelete, handleCredentialsOAuthPoll, handleCredentialsOAuthStart, handleCredentialsSave, handleRemote, handleRemotes, handleAiCommitMessage, handleChanges, handleCommit, handleCommitFiles, handleCreateBranch, handleCreateTag, handleCreateWorktree, handleDeleteBranch, handleEnsureDirectory, handleFetch, handleGroupWorktrees, handleInspectWorktree, handleLog, handlePathExists, handlePurgeDirectory, handlePushTag, handleRemoveWorktree, handleRenameBranch, handleStage, handleStatus, handleSwitch, handleUpdate, handlePush, handleWorktreesAll, } from './routes.js';
 import { validateRootDir } from './settings.js';
+import { gitNetworkTool } from './network-tool.js';
 import { gitCredentialsTool } from './tool.js';
 import { ROUTE_AI_COMMIT_MESSAGE, ROUTE_BRANCH, ROUTE_BRANCH_DELETE, ROUTE_BRANCH_RENAME, ROUTE_CHANGES, ROUTE_COMMIT, ROUTE_COMMIT_FILES, ROUTE_CREDENTIALS, ROUTE_CREDENTIALS_DELETE, ROUTE_CREDENTIALS_OAUTH_POLL, ROUTE_CREDENTIALS_OAUTH_START, ROUTE_CREDENTIALS_SAVE, ROUTE_ENSURE_DIRECTORY, ROUTE_EXISTS, ROUTE_FETCH, ROUTE_GROUP, ROUTE_INSPECT, ROUTE_LOG, ROUTE_PUSH, ROUTE_PURGE, ROUTE_REMOTE, ROUTE_REMOTES, ROUTE_REMOVE, ROUTE_STAGE, ROUTE_STATUS, ROUTE_SWITCH, ROUTE_TAG, ROUTE_TAG_PUSH, ROUTE_UPDATE, ROUTE_WORKTREE, ROUTE_WORKTREES_ALL } from './wire.js';
 export const name = 'dsh-git-branch';
@@ -163,6 +164,13 @@ export function apply(ctx, config = {}) {
     ctx.inject(['tools'], (toolsCtx) => {
         const tools = toolsCtx.tools;
         toolsCtx.effect(() => tools.register(gitCredentialsTool({ home: () => homedir(), envHome: () => process.env.DSH_HOME })), 'git-worktree: git_credentials tool');
+        // The panel routes are the only other place that injects the stored
+        // credentials; a model running `git push` through the shell would go out
+        // as the machine's helper account instead. This tool runs one network
+        // subcommand with the same `-c http.<url>.extraHeader` prefix, so the
+        // session can authenticate as the configured account without the secret
+        // ever entering the conversation.
+        toolsCtx.effect(() => tools.register(gitNetworkTool({ home: () => homedir(), envHome: () => process.env.DSH_HOME })), 'git-worktree: git_network tool');
     });
     ctx.inject(['webServer'], (webCtx) => {
         /** Send one outcome as JSON; no-store because repo facts are point-in-time. */

package/lib/network-tool.d.ts

@@ -0,0 +1,111 @@
+/**
+ * The model-facing `git_network` tool (host half).
+ *
+ * The credentials panel stores one token per remote host, but the panel's own
+ * fetch / pull / push routes are the only places that inject it (`-c
+ * http.<url>.extraHeader=…`). A model running `git push` through the shell
+ * therefore authenticates as whatever the machine's credential helper holds —
+ * often a different account, which is exactly the complaint this tool closes:
+ * it runs ONE git network command with the same `authConfigArgs` the routes
+ * use, so the session pushes as the account the user configured, and the
+ * secret never enters the conversation.
+ *
+ * It is deliberately narrower than a shell wrapper: a fixed subcommand
+ * allow-list (fetch / pull / push / ls-remote), no force/delete refspecs, no
+ * `--upload-pack` / `--receive-pack` / `-c` options, and an absolute
+ * `repoPath` as cwd. Those exclusions are about blast radius, not about
+ * authentication: the tool exists to let a session reach the network with the
+ * configured credential, not to become a general command runner.
+ *
+ * @module dsh-git-branch/network-tool
+ */
+import { type CredentialStore, type GitCredential } from './credentials.js';
+import { type Exec } from './git.js';
+/** Model-facing tool name. */
+export declare const GIT_NETWORK_TOOL_NAME = "git_network";
+/** The only git subcommands this tool will run. */
+export declare const GIT_NETWORK_SUBCOMMANDS: readonly ["fetch", "pull", "push", "ls-remote"];
+/** Upper bound on the argument vector (the panel's own commands need far fewer). */
+export declare const GIT_NETWORK_MAX_ARGS = 32;
+/** The arguments this tool accepts. */
+export interface GitNetworkArgs {
+    /** Absolute directory inside the target repository; the command's cwd. */
+    readonly repoPath?: string;
+    /** Git arguments, subcommand first (`['push', 'origin', 'main']`). */
+    readonly args?: readonly string[];
+}
+/** A validated request, ready to run. */
+export interface GitNetworkRequest {
+    readonly repoPath: string;
+    readonly args: readonly string[];
+}
+/** The canonical value `execute` returns. */
+export interface GitNetworkValue {
+    /** Directory the command ran in (echoed for the transcript). */
+    readonly repoPath: string;
+    /** The git subcommand that ran. */
+    readonly subcommand: string;
+    /** git's exit status; a non-zero status is a normal result, not an error. */
+    readonly exitCode: number;
+    /** Standard output, secret-redacted and length-capped. */
+    readonly stdout: string;
+    /** Standard error, secret-redacted and length-capped. */
+    readonly stderr: string;
+    /** Hosts a credential was injected for (injected in full on every call). */
+    readonly authenticatedHosts: readonly string[];
+    /** Whether either stream was cut at the length cap. */
+    readonly truncated: boolean;
+    /** Why the credential store could not be read; the command then ran bare. */
+    readonly credentialsError?: string;
+}
+/** Host-side seams the tool reads through. */
+export interface GitNetworkToolDeps {
+    /** User home directory seam. */
+    readonly home: () => string;
+    /** `$DSH_HOME` seam (blank/undefined = unset). */
+    readonly envHome: () => string | undefined;
+    /** Store seam; the fs-backed store at the resolved path when absent. */
+    readonly store?: CredentialStore;
+    /** Process seam; the real `git` over node:child_process when absent. */
+    readonly exec?: Exec;
+}
+/** A tool definition as `ctx.tools.register` accepts it. */
+export interface GitNetworkTool {
+    readonly name: string;
+    readonly description: string;
+    readonly parameters: Record<string, unknown>;
+    readonly output: {
+        readonly schema: Record<string, unknown>;
+        readonly render: (args: GitNetworkArgs, value: GitNetworkValue) => readonly {
+            readonly type: 'text';
+            readonly text: string;
+        }[];
+    };
+    readonly execute: (args: GitNetworkArgs, exec?: {
+        readonly signal?: AbortSignal;
+    }) => Promise<GitNetworkValue>;
+}
+/**
+ * Why a request cannot run (undefined = fine). Pure and exhaustive so the
+ * tests can pin every rejection without spawning git.
+ * @param repoPath - the requested cwd (validated as an absolute path).
+ * @param args - the requested git argument vector (subcommand first).
+ */
+export declare function gitNetworkRequestIssue(repoPath: unknown, args: unknown): string | undefined;
+/**
+ * Remove stored secrets — raw and in the Basic header's base64 form — from
+ * git's own diagnostics. git does not echo the Authorization header, but the
+ * redaction also covers a remote URL that embeds the token, and costs one
+ * pass per stored host.
+ * @param text - one captured stream.
+ * @param entries - the credentials that were injected.
+ */
+export declare function redactSecrets(text: string, entries: readonly GitCredential[]): string;
+/** Compose the model-facing text of one result. */
+export declare function renderGitNetwork(value: GitNetworkValue): string;
+/**
+ * Build the `git_network` tool definition.
+ * @param deps - host seams (home/env, an optional store and an optional exec).
+ * @returns a definition ready for `ctx.tools.register`.
+ */
+export declare function gitNetworkTool(deps: GitNetworkToolDeps): GitNetworkTool;

package/lib/network-tool.js

@@ -0,0 +1,246 @@
+/**
+ * The model-facing `git_network` tool (host half).
+ *
+ * The credentials panel stores one token per remote host, but the panel's own
+ * fetch / pull / push routes are the only places that inject it (`-c
+ * http.<url>.extraHeader=…`). A model running `git push` through the shell
+ * therefore authenticates as whatever the machine's credential helper holds —
+ * often a different account, which is exactly the complaint this tool closes:
+ * it runs ONE git network command with the same `authConfigArgs` the routes
+ * use, so the session pushes as the account the user configured, and the
+ * secret never enters the conversation.
+ *
+ * It is deliberately narrower than a shell wrapper: a fixed subcommand
+ * allow-list (fetch / pull / push / ls-remote), no force/delete refspecs, no
+ * `--upload-pack` / `--receive-pack` / `-c` options, and an absolute
+ * `repoPath` as cwd. Those exclusions are about blast radius, not about
+ * authentication: the tool exists to let a session reach the network with the
+ * configured credential, not to become a general command runner.
+ *
+ * @module dsh-git-branch/network-tool
+ */
+import { isAbsolute } from 'node:path';
+import { authConfigArgs, basicUsername, createCredentialStore, credentialFilePath, } from './credentials.js';
+import { childProcessExec, NETWORK_TIMEOUT_MS } from './git.js';
+/** Model-facing tool name. */
+export const GIT_NETWORK_TOOL_NAME = 'git_network';
+/** The only git subcommands this tool will run. */
+export const GIT_NETWORK_SUBCOMMANDS = ['fetch', 'pull', 'push', 'ls-remote'];
+/** Upper bound on the argument vector (the panel's own commands need far fewer). */
+export const GIT_NETWORK_MAX_ARGS = 32;
+/** Upper bound on one argument token. */
+const MAX_TOKEN_LENGTH = 512;
+/** Output kept from each stream, in characters; git diagnostics are short. */
+const MAX_OUTPUT_CHARS = 64 * 1024;
+/**
+ * Global options that would either replace the injected credential, point
+ * git at another repository, or load another config. They belong BEFORE the
+ * subcommand in git's own grammar, so the allow-list below already rejects
+ * them; this set is defence in depth for arguments passed after it.
+ */
+const BLOCKED_FLAGS = new Set([
+    '-c',
+    '--config-env',
+    '--exec-path',
+    '--git-dir',
+    '--work-tree',
+    '--namespace',
+    '--bare',
+    '--no-replace-objects',
+]);
+/** Same defence for flags that take a value with `=`. */
+const BLOCKED_PREFIXES = ['--config-env=', '--upload-pack', '--receive-pack', '--exec='];
+/** `push` is the one subcommand where these change the remote irreversibly. */
+const PUSH_BLOCKED_FLAGS = new Set([
+    '-f',
+    '--force',
+    '--force-with-lease',
+    '--force-if-includes',
+    '--mirror',
+    '--delete',
+    '-d',
+    '--prune',
+]);
+/**
+ * Why a request cannot run (undefined = fine). Pure and exhaustive so the
+ * tests can pin every rejection without spawning git.
+ * @param repoPath - the requested cwd (validated as an absolute path).
+ * @param args - the requested git argument vector (subcommand first).
+ */
+export function gitNetworkRequestIssue(repoPath, args) {
+    if (typeof repoPath !== 'string' || repoPath.trim() === '')
+        return '"repoPath" must be a non-empty string';
+    if (!isAbsolute(repoPath))
+        return '"repoPath" must be an absolute path';
+    if (!Array.isArray(args) || args.length === 0)
+        return '"args" must be a non-empty array of git arguments';
+    if (args.length > GIT_NETWORK_MAX_ARGS)
+        return `"args" may hold at most ${String(GIT_NETWORK_MAX_ARGS)} items`;
+    const tokens = [];
+    for (const item of args) {
+        if (typeof item !== 'string')
+            return '"args" must contain only strings';
+        if (item === '' || item.includes('\0'))
+            return '"args" must not contain empty or NUL tokens';
+        if (item.length > MAX_TOKEN_LENGTH)
+            return `one argument exceeds ${String(MAX_TOKEN_LENGTH)} characters`;
+        tokens.push(item);
+    }
+    const subcommand = tokens[0];
+    if (subcommand === undefined)
+        return '"args" must name a git subcommand first';
+    if (!GIT_NETWORK_SUBCOMMANDS.includes(subcommand)) {
+        return `"${subcommand}" is not permitted here; use one of ${GIT_NETWORK_SUBCOMMANDS.join(', ')}`;
+    }
+    for (const token of tokens.slice(1)) {
+        if (BLOCKED_FLAGS.has(token))
+            return `"${token}" is not permitted by this tool`;
+        const blocked = BLOCKED_PREFIXES.find(prefix => token.startsWith(prefix));
+        if (blocked !== undefined)
+            return `"${blocked}…" is not permitted by this tool`;
+        if (subcommand === 'push') {
+            if (PUSH_BLOCKED_FLAGS.has(token))
+                return `"${token}" is not permitted: this tool never forces or deletes on the remote`;
+            if (token.startsWith('+') || token.startsWith(':')) {
+                return 'force/delete refspecs ("+" or ":") are not permitted: this tool never forces or deletes on the remote';
+            }
+        }
+    }
+    return undefined;
+}
+/** Validate one raw request or throw the reason as a plain Error. */
+function requestOf(args) {
+    const issue = gitNetworkRequestIssue(args.repoPath, args.args);
+    if (issue !== undefined)
+        throw new Error(issue);
+    return { repoPath: args.repoPath, args: [...args.args] };
+}
+/** Cut one stream at the cap; `truncated` reports whether anything was lost. */
+function cap(text) {
+    return text.length <= MAX_OUTPUT_CHARS
+        ? { text, truncated: false }
+        : { text: text.slice(0, MAX_OUTPUT_CHARS), truncated: true };
+}
+/**
+ * Remove stored secrets — raw and in the Basic header's base64 form — from
+ * git's own diagnostics. git does not echo the Authorization header, but the
+ * redaction also covers a remote URL that embeds the token, and costs one
+ * pass per stored host.
+ * @param text - one captured stream.
+ * @param entries - the credentials that were injected.
+ */
+export function redactSecrets(text, entries) {
+    let out = text;
+    for (const entry of entries) {
+        if (entry.secret !== '')
+            out = out.split(entry.secret).join('****');
+        const basic = Buffer.from(`${basicUsername(entry)}:${entry.secret}`, 'utf8').toString('base64');
+        out = out.split(basic).join('****');
+    }
+    return out;
+}
+/** Compose the model-facing text of one result. */
+export function renderGitNetwork(value) {
+    const hosts = value.authenticatedHosts.length === 0 ? 'none' : value.authenticatedHosts.join(', ');
+    const lines = [
+        `git ${value.subcommand} (exit ${String(value.exitCode)}) in ${value.repoPath}`,
+        `credentials injected for: ${hosts}`,
+    ];
+    if (value.credentialsError !== undefined)
+        lines.push(`credentials unavailable: ${value.credentialsError}`);
+    if (value.stdout.trim() !== '')
+        lines.push('--- stdout ---', value.stdout.trimEnd());
+    if (value.stderr.trim() !== '')
+        lines.push('--- stderr ---', value.stderr.trimEnd());
+    if (value.truncated)
+        lines.push('(output truncated at the length cap)');
+    return lines.join('\n');
+}
+/**
+ * Build the `git_network` tool definition.
+ * @param deps - host seams (home/env, an optional store and an optional exec).
+ * @returns a definition ready for `ctx.tools.register`.
+ */
+export function gitNetworkTool(deps) {
+    const storeOf = () => deps.store ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
+    const exec = deps.exec ?? childProcessExec;
+    return {
+        name: GIT_NETWORK_TOOL_NAME,
+        description: 'Run ONE git network command (fetch, pull, push or ls-remote) inside a repository with the '
+            + 'plugin\'s stored Git credentials injected, so the command authenticates as the account configured in the '
+            + 'Git credential panel instead of whatever the machine\'s git credential helper happens to hold. Use it when '
+            + 'you must push/fetch/pull yourself; a plain shell `git push` does NOT see these credentials. Pass the git '
+            + 'arguments subcommand-first, for example ["push"], ["fetch", "--all", "--prune"] or '
+            + '["push", "origin", "main"]. Force/delete refspecs, --force/--delete/--mirror/--prune and '
+            + '--upload-pack/--receive-pack style options are rejected by design. The secret itself never appears in the '
+            + 'result: only exit status, redacted stdout/stderr and the hosts that were authenticated.',
+        parameters: {
+            type: 'object',
+            properties: {
+                repoPath: {
+                    type: 'string',
+                    description: 'Absolute path to any directory inside the target repository; the command runs with this as cwd.',
+                },
+                args: {
+                    type: 'array',
+                    items: { type: 'string' },
+                    description: 'Git arguments with the subcommand first. Permitted subcommands: fetch, pull, push, ls-remote.',
+                },
+            },
+            required: ['repoPath', 'args'],
+            additionalProperties: false,
+        },
+        output: {
+            schema: {
+                type: 'object',
+                properties: {
+                    repoPath: { type: 'string' },
+                    subcommand: { type: 'string' },
+                    exitCode: { type: 'integer' },
+                    stdout: { type: 'string' },
+                    stderr: { type: 'string' },
+                    authenticatedHosts: { type: 'array', items: { type: 'string' } },
+                    truncated: { type: 'boolean' },
+                    credentialsError: { type: 'string' },
+                },
+                required: ['repoPath', 'subcommand', 'exitCode', 'stdout', 'stderr', 'authenticatedHosts', 'truncated'],
+            },
+            render: (_args, value) => [
+                { type: 'text', text: renderGitNetwork(value) },
+            ],
+        },
+        async execute(raw) {
+            const request = requestOf(raw ?? {});
+            let entries = [];
+            let credentialsError;
+            try {
+                entries = await storeOf().load();
+            }
+            catch (error) {
+                // A damaged credential file must not make the tool unusable: run the
+                // command bare and report why, exactly like the routes do.
+                credentialsError = error instanceof Error ? error.message : String(error);
+            }
+            const hosts = [...new Set(entries.map(entry => entry.host))].sort();
+            const result = await exec('git', [...authConfigArgs(entries), ...request.args], {
+                cwd: request.repoPath,
+                timeoutMs: NETWORK_TIMEOUT_MS,
+            });
+            const stdout = cap(redactSecrets(result.stdout, entries));
+            const stderrSource = result.stderr.trim() === '' && result.errorMessage !== undefined
+                ? result.errorMessage
+                : result.stderr;
+            const stderr = cap(redactSecrets(stderrSource, entries));
+            return {
+                repoPath: request.repoPath,
+                subcommand: request.args[0] ?? '',
+                exitCode: result.code,
+                stdout: stdout.text,
+                stderr: stderr.text,
+                authenticatedHosts: hosts,
+                truncated: stdout.truncated || stderr.truncated,
+                ...(credentialsError === undefined ? {} : { credentialsError }),
+            };
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-git-branch-manage",
-  "version": "1.0.8",
+  "version": "1.0.9",
   "description": "提供 git 分支与 worktree 管理：输入框工具栏显示当前分支、可原地切换；支持 IDEA 风格分支选择器、远程分支检出、右键操作菜单（新建/重命名/删除/复制）、推送与更新当前分支，以及把分支隔离到独立 worktree 工作区，并管理其创建与删除。",
   "keywords": [
     "dsh",