eve-hub 0.16.24 → 0.16.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve-hub",
-  "version": "0.16.24",
+  "version": "0.16.25",
   "license": "Apache-2.0",
   "description": "Bot-side code shared by every hub agent: registry tools, the roster hook, the eve channel, the host sandbox and browser, and model helpers.",
   "type": "module",

package/prepare.mjs

@@ -77,17 +77,36 @@ const broker: GitHubLeaseBroker = async (sandbox, rules) => {
 // \`-R\` or \`gh repo clone|view|fork\` target differs from the declared repository, nor a \`git\`
 // remote outside it, so this does. \`authorize\` can't read the sandbox, so a remote name such as
 // \`origin\` can't be resolved: authenticated git names the declared repository's URL itself.
+// \`repository\` may be null: eve's tool text tells bots to omit it for \`gh api user\`,
+// \`gh repo list\` and \`gh search\`, and a user token isn't narrowed by it anyway.
 const GIT_REMOTE_COMMANDS = ["fetch", "ls-remote", "pull", "push"];
+const GIT_GLOBAL_VALUE_OPTIONS = ["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--config-env"];
+const GIT_REMOTE_VALUE_OPTIONS = ["--depth", "--deepen", "--shallow-since", "--shallow-exclude", "--upload-pack", "--receive-pack", "--exec", "--refmap", "--negotiation-tip", "-o", "--push-option", "--server-option", "-j", "--jobs", "--filter", "--recurse-submodules-default"];
 const targets = (argv: readonly string[]) => [
   ...argv.flatMap((a, i) => (a === "--repo" || a === "-R" ? [argv[i + 1] ?? ""] : a.startsWith("--repo=") ? [a.slice(7)] : [])),
   ...(argv[0] === "gh" && argv[1] === "repo" && ["clone", "view", "fork"].includes(argv[2] ?? "") && argv[3] && !argv[3].startsWith("-") ? [argv[3]] : []),
 ];
 const GITHUB_URL = /^(?:https:\\/\\/github\\.com\\/|git@github\\.com:|ssh:\\/\\/git@github\\.com\\/)/i;
 const canonical = (repo: string) => repo.toLowerCase().replace(GITHUB_URL, "").replace(/\\/$/, "").replace(/\\.git$/, "");
+const operands = (args: readonly string[], valued: readonly string[]) => {
+  const found: string[] = [];
+  for (let i = 0; i < args.length; i++) {
+    if (valued.includes(args[i])) i++;
+    else if (!args[i].startsWith("-")) found.push(args[i]);
+  }
+  return found;
+};
+const gitRemote = (argv: readonly string[]) => {
+  let i = 1;
+  while (argv[i]?.startsWith("-")) i += GIT_GLOBAL_VALUE_OPTIONS.includes(argv[i]) ? 2 : 1;
+  const remote = operands(argv.slice(i + 1), GIT_REMOTE_VALUE_OPTIONS)[0] ?? "";
+  return GIT_REMOTE_COMMANDS.includes(argv[i] ?? "") && GITHUB_URL.test(remote) ? [remote] : null;
+};
 const commandTargets = (argv: readonly string[]) =>
-  argv[0] === "git" ? (GIT_REMOTE_COMMANDS.includes(argv[1] ?? "") && GITHUB_URL.test(argv[2] ?? "") ? [argv[2]] : null)
+  argv[0] === "git" ? gitRemote(argv)
   : argv[0] === "gh-signed-commit" ? (targets(argv).length ? targets(argv) : null)
   : targets(argv);
+const inOrg = (repo: string) => canonical(repo).startsWith(\`\${ORG}/\`);
 
 export default git({
   github: {
@@ -95,7 +114,8 @@ export default git({
     broker,
     authorize: ({ argv, repository }) => {
       const found = commandTargets(argv);
-      return repository !== null && canonical(repository).startsWith(\`\${ORG}/\`) && found !== null && found.every((t) => canonical(t) === canonical(repository));
+      if (found === null || !found.every(inOrg)) return false;
+      return repository === null || (inOrg(repository) && found.every((t) => canonical(t) === canonical(repository)));
     },
     principalType: "user",
   },