edsger 0.46.0 → 0.48.0

package/dist/workspace/__tests__/workspace-manager.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Unit tests for the pure helpers inside workspace-manager.
+ *
+ * syncRepoToRef / cloneFeatureRepo shell out to git and are exercised
+ * end-to-end; only the validator is cheap to unit-test here.
+ */
+export {};

package/dist/workspace/__tests__/workspace-manager.test.js

@@ -0,0 +1,52 @@
+/**
+ * Unit tests for the pure helpers inside workspace-manager.
+ *
+ * syncRepoToRef / cloneFeatureRepo shell out to git and are exercised
+ * end-to-end; only the validator is cheap to unit-test here.
+ */
+import assert from 'node:assert';
+import { describe, it } from 'node:test';
+import { isSafeGitRef } from '../workspace-manager.js';
+void describe('isSafeGitRef', () => {
+    void it('accepts common release / branch names', () => {
+        assert.strictEqual(isSafeGitRef('main'), true);
+        assert.strictEqual(isSafeGitRef('develop'), true);
+        assert.strictEqual(isSafeGitRef('v1.2.3'), true);
+        assert.strictEqual(isSafeGitRef('2024.01.15'), true);
+        assert.strictEqual(isSafeGitRef('release/2.0'), true);
+        assert.strictEqual(isSafeGitRef('v1.0.0-rc.1'), true);
+        assert.strictEqual(isSafeGitRef('v2@stable'), true);
+        assert.strictEqual(isSafeGitRef('feature/user-auth_v2'), true);
+    });
+    void it('rejects empty / overlong input', () => {
+        assert.strictEqual(isSafeGitRef(''), false);
+        assert.strictEqual(isSafeGitRef('x'.repeat(101)), false);
+    });
+    void it('rejects whitespace', () => {
+        assert.strictEqual(isSafeGitRef('v 1.0'), false);
+        assert.strictEqual(isSafeGitRef('main\n'), false);
+        assert.strictEqual(isSafeGitRef('\tmain'), false);
+    });
+    void it('rejects shell metacharacters', () => {
+        assert.strictEqual(isSafeGitRef('v1;rm -rf /'), false);
+        assert.strictEqual(isSafeGitRef('v1$PATH'), false);
+        assert.strictEqual(isSafeGitRef('v1`id`'), false);
+        assert.strictEqual(isSafeGitRef('v1|less'), false);
+        assert.strictEqual(isSafeGitRef('v1>out'), false);
+        assert.strictEqual(isSafeGitRef('v1*'), false);
+    });
+    void it('rejects refs that would confuse git itself', () => {
+        assert.strictEqual(isSafeGitRef('.hidden'), false);
+        assert.strictEqual(isSafeGitRef('-foo'), false);
+        assert.strictEqual(isSafeGitRef('v2..rc'), false);
+        assert.strictEqual(isSafeGitRef('HEAD@{1}'), false);
+    });
+    void it('rejects non-string input defensively', () => {
+        // @ts-expect-error testing runtime guard
+        assert.strictEqual(isSafeGitRef(null), false);
+        // @ts-expect-error testing runtime guard
+        assert.strictEqual(isSafeGitRef(undefined), false);
+        // @ts-expect-error testing runtime guard
+        assert.strictEqual(isSafeGitRef(123), false);
+    });
+});

package/dist/workspace/workspace-manager.js

@@ -174,8 +174,16 @@ export function syncRepoToRef(repoPath, ref, token) {
         throw new Error(`Unsafe branch ref: ${JSON.stringify(ref.branch)}`);
     }
     const creds = buildCredentialArgs(token);
+    // Timeouts so a hung proxy / credential prompt can't wedge the CLI
+    // forever. Network op gets more headroom than local ones.
+    const NET_TIMEOUT_MS = 120_000;
+    const LOCAL_TIMEOUT_MS = 30_000;
     try {
-        execFileSync('git', [...creds, 'fetch', 'origin', '--tags', '--prune'], { cwd: repoPath, stdio: 'pipe' });
+        execFileSync('git', [...creds, 'fetch', 'origin', '--tags', '--prune'], {
+            cwd: repoPath,
+            stdio: 'pipe',
+            timeout: NET_TIMEOUT_MS,
+        });
     }
     catch {
         logWarning('git fetch failed during sync; working tree may be stale');
@@ -186,20 +194,25 @@ export function syncRepoToRef(repoPath, ref, token) {
         execFileSync('git', ['reset', '--hard', 'HEAD'], {
             cwd: repoPath,
             stdio: 'pipe',
+            timeout: LOCAL_TIMEOUT_MS,
+        });
+        execFileSync('git', ['clean', '-fd'], {
+            cwd: repoPath,
+            stdio: 'pipe',
+            timeout: LOCAL_TIMEOUT_MS,
         });
-        execFileSync('git', ['clean', '-fd'], { cwd: repoPath, stdio: 'pipe' });
     }
     catch {
         // Non-fatal; subsequent checkout will surface any real issue.
     }
     try {
         if (ref.tag) {
-            execFileSync('git', ['-c', 'advice.detachedHead=false', 'checkout', `refs/tags/${ref.tag}`], { cwd: repoPath, stdio: 'pipe' });
+            execFileSync('git', ['-c', 'advice.detachedHead=false', 'checkout', `refs/tags/${ref.tag}`], { cwd: repoPath, stdio: 'pipe', timeout: LOCAL_TIMEOUT_MS });
             logInfo(`Checked out tag ${ref.tag}`);
         }
         else if (ref.branch) {
             // Create-or-reset local branch to origin tip.
-            execFileSync('git', ['checkout', '-B', ref.branch, `origin/${ref.branch}`], { cwd: repoPath, stdio: 'pipe' });
+            execFileSync('git', ['checkout', '-B', ref.branch, `origin/${ref.branch}`], { cwd: repoPath, stdio: 'pipe', timeout: LOCAL_TIMEOUT_MS });
             logInfo(`Checked out branch ${ref.branch} at origin/${ref.branch}`);
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edsger",
-  "version": "0.46.0",
+  "version": "0.48.0",
   "type": "module",
   "bin": {
     "edsger": "dist/index.js"

package/.env.local

@@ -1,12 +0,0 @@
-OPENAI_API_KEY=
-TRIGGER_SECRET_KEY=
-RECALL_AI_API_KEY=
-RECALL_WEBHOOK_SECRET=
-NEXT_PUBLIC_APP_URL=
-RESEND_API_KEY=
-EMAIL_FROM=
-GITHUB_APP_ID=
-GITHUB_APP_PRIVATE_KEY=
-GITHUB_APP_SLUG=
-DEEPGRAM_API_KEY=
-DEEPGRAM_PROJECT_ID=