flagrm 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -7,6 +7,22 @@ contain breaking changes.
 
 ## [Unreleased]
 
+## [0.4.1] - 2026-10-12
+
+### Security
+
+- Replaced `fast-glob` with `tinyglobby`, which drops the vulnerable `braces`
+  dependency (GHSA-vfj7-8cjw-p6xm) from installs.
+- The Stop hook no longer lets a removal finish unverified when the config's
+  `exclude` (or anything else it scans) changed since the baseline: widening
+  `exclude` used to hide the removal's edits from the hook.
+- A `git.sha` in `baseline.json` that isn't a commit id is refused, and no
+  revision starting with `-` reaches git, where `--output=<file>` would have
+  written a file.
+- SECURITY.md says what flagrm guarantees and what the Stop hook doesn't:
+  it guards against finishing a removal by accident, not an agent working
+  around it.
+
 ## [0.4.0] - 2026-10-11
 
 ### Added
@@ -271,6 +287,7 @@ removes the flag through the `flagrm-remove` skill, and flagrm checks the result
   `doctor` warns about an incremental `dotnet build`, which hides existing
   warnings from the dead-code comparison.
 
+[0.4.1]: https://github.com/dino-cosic/flagrm/releases/tag/v0.4.1
 [0.4.0]: https://github.com/dino-cosic/flagrm/releases/tag/v0.4.0
 [0.3.0]: https://github.com/dino-cosic/flagrm/releases/tag/v0.3.0
 [0.2.1]: https://github.com/dino-cosic/flagrm/releases/tag/v0.2.1

package/README.md

@@ -104,7 +104,10 @@ of these reasons is a warning, for the agent to explain in its notes.
    removal is in progress and not verified. In progress means a file git
    tracks changed on top of the baseline commit (untracked files and
    flagrm's own setup files don't count, so a removal paused on a question to
-   the user doesn't block), or the last verify used `--skip`.
+   the user doesn't block), the config changed in what it scans or ignores
+   (such as `exclude`), or the last verify used `--skip`. It guards against
+   finishing by accident, not an agent working around it: see
+   [SECURITY.md](SECURITY.md#what-it-doesnt-guarantee).
 4. **`/flagrm-verify <flag>`** checks a removal later: runs
    `flagrm verify <flag> --md` and adds notes and a commit message.
 

package/dist/core/baseline.js

@@ -2,12 +2,12 @@ import { spawn, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
-import fg from "fast-glob";
 import { changeFilter } from "./change-filter.js";
 import { configSnapshot, projectCommands } from "./config-snapshot.js";
 import { environmentProblem } from "./environment.js";
 import { changedFilesSince } from "./git.js";
 import { buildInventory } from "./inventory.js";
+import { globAbsolute } from "./scan.js";
 import { withScopeFiles } from "./scope-files.js";
 import { JSON_SCHEMA_VERSION, READABLE_BASELINE_VERSIONS, } from "./types.js";
 import { readJson, relativePath } from "./util.js";
@@ -80,8 +80,15 @@ export function readBaseline(root, flag) {
         throw new UsageError(`${file} was written by schema version ${baseline.schemaVersion}; this flagrm expects ${JSON_SCHEMA_VERSION}. ` +
             `Re-run \`flagrm baseline ${flag} --force\` on the code as it was before the removal.`);
     }
+    const sha = baseline.git?.sha;
+    if (sha != null && !COMMIT_ID.test(sha)) {
+        throw new UsageError(`${file} has git.sha "${sha}", which is not a git commit id. ` +
+            `Re-run \`flagrm baseline ${flag} --force\` on the code as it was before the removal.`);
+    }
     return { baseline, file };
 }
+/** A full SHA-1 or SHA-256 commit id, as `git rev-parse HEAD` prints it. */
+const COMMIT_ID = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
 /**
  * Run one shell command inside a project, streaming its output to `logFile`
  * (no buffer limit, stdout and stderr interleaved as printed). A command that
@@ -312,9 +319,7 @@ export function editsSince(root, sha, testResults = [], ignore = changeFilter())
 }
 /** The files (relative to `root`) matching absolute paths or globs, such as `testResults` patterns. */
 export function matchingFiles(root, patterns) {
-    return new Set(patterns.flatMap((pattern) => fg
-        .sync(path.sep === "\\" ? pattern.replace(/\\/g, "/") : pattern, { absolute: true, dot: true })
-        .map((file) => relativePath(root, file))));
+    return new Set(patterns.flatMap((pattern) => globAbsolute(pattern).map((file) => relativePath(root, file))));
 }
 /**
  * `baseline --force` starts over only before the removal began: the working

package/dist/core/change-filter.js

@@ -42,7 +42,7 @@ export function changeFilter(config) {
     };
 }
 /**
- * Matches `exclude` the way scanning's fast-glob `ignore` does: a pattern
+ * Matches `exclude` the way scanning's tinyglobby `ignore` does: a pattern
  * that matches a directory (`graphify-out`, `graphify-out/`) excludes
  * everything under it, so test the path and each of its parent directories.
  * `covers` reads the same way.

package/dist/core/config-snapshot.js

@@ -142,6 +142,23 @@ export function configChanges(before, now) {
     }
     return changes;
 }
+/**
+ * Whether the config file under `root` changed since `before` in what is
+ * scanned or ignored (`exclude`, globs, paths), not just in its commands.
+ * False when `before` recorded no config file.
+ */
+export function scanConfigChanged(before, root) {
+    if (!before?.file)
+        return false;
+    let text;
+    try {
+        text = fs.readFileSync(path.join(root, before.file.path), "utf8");
+    }
+    catch {
+        return true;
+    }
+    return withoutCommands(before.file.text) !== withoutCommands(text);
+}
 const quote = (text) => (text === undefined ? "(none)" : `\`${text}\``);
 function changedFiles(a, b) {
     const hashes = new Map(a.map((f) => [f.path, f.sha256]));

package/dist/core/detect.js

@@ -5,7 +5,7 @@
  * saves the user from editing a template, and they check the result.
  */
 import path from "node:path";
-import fg from "fast-glob";
+import { globSync } from "tinyglobby";
 import { detectTestRunner } from "./test-runner.js";
 const IGNORE = ["**/node_modules/**", "**/.git/**", "**/bin/**", "**/obj/**", "**/dist/**"];
 const depth = (file) => file.split("/").length;
@@ -32,7 +32,7 @@ function commonDir(files) {
     return common.join("/") || ".";
 }
 export function detectProjects(cwd) {
-    const find = (pattern) => fg.sync(pattern, { cwd, deep: 4, ignore: IGNORE });
+    const find = (pattern) => globSync(pattern, { expandDirectories: false, cwd, deep: 3, ignore: IGNORE });
     const found = [];
     for (const marker of topmost(find("**/angular.json"))) {
         const dir = path.posix.dirname(marker);

package/dist/core/git.js

@@ -13,6 +13,8 @@ function git(cwd, ...args) {
     const result = spawnSync("git", args, { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
     return { ok: result.status === 0, stdout: result.stdout ?? "" };
 }
+/** Whether git reads `rev` as a revision: one starting with `-` (`--output=<file>`) would be an option. */
+const isRevision = (rev) => rev !== "" && !rev.startsWith("-");
 /** NUL-separated paths (`-z`), which git never quotes or escapes, whatever the file name. */
 const paths = (text) => text.split("\0").filter(Boolean);
 /** Untracked (and not ignored) files under `cwd`. */
@@ -60,6 +62,8 @@ export function blobIds(cwd, files) {
  * diff plus untracked files), without the ones `ignore` names.
  */
 export function changedFilesSince(cwd, sha, ignore) {
+    if (!isRevision(sha))
+        return undefined;
     const diff = git(cwd, "diff", "-z", "--name-only", "--no-renames", "--relative", sha, ...PATHSPEC);
     if (!diff.ok)
         return undefined;
@@ -72,6 +76,8 @@ export function changedFilesSince(cwd, sha, ignore) {
  * Undefined when git can't tell.
  */
 export function trackedChangesSince(cwd, sha, ignore) {
+    if (!isRevision(sha))
+        return undefined;
     const diff = git(cwd, "diff", "-z", "--name-only", "--no-renames", "--relative", sha, ...PATHSPEC);
     if (!diff.ok)
         return undefined;
@@ -80,6 +86,8 @@ export function trackedChangesSince(cwd, sha, ignore) {
 }
 /** A file's content at `sha`, or undefined when it did not exist there. */
 export function fileAt(cwd, sha, relativePath) {
+    if (!isRevision(sha))
+        return undefined;
     const result = git(cwd, "show", `${sha}:./${relativePath.split(path.sep).join("/")}`);
     return result.ok ? result.stdout : undefined;
 }
@@ -156,6 +164,8 @@ function dropIgnored(cwd, index, ignore) {
 }
 /** The tree id of `cwd` at commit `sha`. */
 export function treeAt(cwd, sha) {
+    if (!isRevision(sha))
+        return undefined;
     const prefix = repoPrefix(cwd);
     if (prefix === undefined)
         return undefined;
@@ -169,5 +179,5 @@ export function headSha(cwd) {
 }
 /** Whether `sha` is HEAD or one of its ancestors. */
 export function isAncestor(cwd, sha) {
-    return git(cwd, "merge-base", "--is-ancestor", sha, "HEAD").ok;
+    return isRevision(sha) && git(cwd, "merge-base", "--is-ancestor", sha, "HEAD").ok;
 }

package/dist/core/hook.js

@@ -8,6 +8,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { changeFilterAt } from "./change-filter.js";
 import { findConfigRoot } from "./config.js";
+import { scanConfigChanged } from "./config-snapshot.js";
 import { headSha, trackedChangesSince, treeFingerprint } from "./git.js";
 import { readJson } from "./util.js";
 /** The hook's stdin: only a JSON object counts, and only fields of the expected type are kept. */
@@ -38,7 +39,8 @@ export function hookRoot(cwd) {
  * matches the current tree. In progress means HEAD is still the baseline
  * commit and a file git tracks changed, other than flagrm's setup files and
  * paths matching `exclude` (a removal paused on a question to the user, or a
- * stray test result file, doesn't count), or the last verify skipped checks.
+ * stray test result file, doesn't count), the config changed in what it
+ * scans or ignores, or the last verify skipped checks.
  * The fingerprint leaves out the same paths, as verify's does. Once HEAD moves (a
  * commit, a branch switch, a merge), that removal is no longer guarded.
  */
@@ -61,7 +63,7 @@ export function stopDecision(root, input) {
             return { block: false };
         const ignore = changeFilterAt(root);
         const edited = (trackedChangesSince(root, head, ignore) ?? []).length > 0;
-        const started = active.filter((flagDir) => edited || lastVerifySkipped(flagDir));
+        const started = active.filter((flagDir) => edited || lastVerifySkipped(flagDir) || configChanged(flagDir, root));
         if (started.length === 0)
             return { block: false };
         const current = treeFingerprint(root, ignore);
@@ -74,6 +76,15 @@ export function stopDecision(root, input) {
         return { block: false };
     }
 }
+/**
+ * Whether the config changed since the baseline (or `--accept config`) in what
+ * is scanned or ignored: widening `exclude` would otherwise hide the removal's
+ * edits from the hook. A verify passing on this tree shows the change and allows.
+ */
+function configChanged(flagDir, root) {
+    const baseline = readJson(path.join(flagDir, "baseline.json"));
+    return scanConfigChanged(baseline?.acceptedConfig ?? baseline?.config, root);
+}
 function lastVerifySkipped(flagDir) {
     const skipped = readJson(path.join(flagDir, "verify.json"))?.skipped;
     return Array.isArray(skipped) && skipped.length > 0;

package/dist/core/run-cache.js

@@ -6,7 +6,7 @@
  */
 import fs from "node:fs";
 import path from "node:path";
-import fg from "fast-glob";
+import { globSync } from "tinyglobby";
 import { flagDir, matchingFiles, runChecks } from "./baseline.js";
 import { changeFilter } from "./change-filter.js";
 import { configSnapshot, projectCommands } from "./config-snapshot.js";
@@ -69,7 +69,12 @@ export function saveRuns(root, flag, projects, key, runs, createdAt = new Date()
 }
 /** Forget every saved set, of any flag, for this tree: a fresh run on it failed, so they may hide a flaky test or a changed machine. */
 export function dropRuns(root, key) {
-    for (const file of fg.sync(".flagrm/*/verify/runs.json", { cwd: root, absolute: true, dot: true })) {
+    for (const file of globSync(".flagrm/*/verify/runs.json", {
+        expandDirectories: false,
+        cwd: root,
+        absolute: true,
+        dot: true,
+    })) {
         if (readJson(file)?.key === key)
             fs.rmSync(file, { force: true });
     }
@@ -81,7 +86,12 @@ export function findRuns(root, projects, key, needed) {
     const commands = JSON.stringify(configSnapshot(projects).projects);
     const version = packageVersion();
     let best;
-    for (const file of fg.sync(".flagrm/*/verify/runs.json", { cwd: root, absolute: true, dot: true })) {
+    for (const file of globSync(".flagrm/*/verify/runs.json", {
+        expandDirectories: false,
+        cwd: root,
+        absolute: true,
+        dot: true,
+    })) {
         const saved = readJson(file);
         if (!saved || !Array.isArray(saved.runs) || typeof saved.createdAt !== "string")
             continue;

package/dist/core/scan.js

@@ -1,5 +1,6 @@
+import fs from "node:fs";
 import path from "node:path";
-import fg from "fast-glob";
+import { globSync, isDynamicPattern } from "tinyglobby";
 export const BACKEND_GLOBS = [
     "**/*.cs",
     "**/*.cshtml",
@@ -19,11 +20,37 @@ export const IGNORE_GLOBS = [
     "**/.angular/**",
     "**/.git/**",
 ];
-/** Absolute paths with the platform's separators (fast-glob returns `/` on Windows too), so they match `path.join`. */
+/**
+ * Files matching an absolute path or glob, such as a `testResults` pattern,
+ * as absolute paths with `/`. The leading directories that exist are taken
+ * literally and become the glob's `cwd`, so a repository path containing
+ * glob characters (`/work/p[x]/TestResults/*.trx`) still matches.
+ */
+export function globAbsolute(pattern) {
+    const segments = (path.sep === "\\" ? pattern.replace(/\\/g, "/") : pattern).split("/");
+    let base = segments[0] === "" ? "/" : `${segments[0]}/`;
+    let i = 1;
+    for (; i < segments.length - 1; i++) {
+        const dir = path.posix.join(base, segments[i]);
+        if (isDynamicPattern(segments[i]) && !isDirectory(dir))
+            break;
+        base = dir;
+    }
+    return globSync(segments.slice(i).join("/"), { expandDirectories: false, cwd: base, absolute: true, dot: true });
+}
+function isDirectory(dir) {
+    try {
+        return fs.statSync(dir).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/** Absolute paths with the platform's separators (tinyglobby returns `/` on Windows too), so they match `path.join`. */
 export function listProjectFiles(root, globs, overrides) {
     const patterns = [...globs, ...(overrides?.include ?? [])];
     const ignore = [...IGNORE_GLOBS, ...(overrides?.exclude ?? [])];
-    return fg.sync(patterns, { cwd: root, ignore, absolute: true, dot: false }).map((file) => path.normalize(file));
+    return globSync(patterns, { expandDirectories: false, cwd: root, ignore, absolute: true, dot: false }).map((file) => path.normalize(file));
 }
 export function escapeRegExp(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");

package/dist/core/scope.js

@@ -8,7 +8,7 @@
 import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
-import fg from "fast-glob";
+import { globSync } from "tinyglobby";
 import YAML from "yaml";
 import { sdkProblem, solutionSetup } from "../adapters/dotnet/setup.js";
 import { projectCommands } from "./config-snapshot.js";
@@ -81,8 +81,8 @@ function solutionFor(ctx, commands) {
             return { note: `can't read ${arg}` };
         }
     }
-    const found = fg.sync("*.{sln,slnx}", { cwd: ctx.root, absolute: true });
-    // fast-glob returns forward slashes, also on Windows.
+    const found = globSync("*.{sln,slnx}", { expandDirectories: false, cwd: ctx.root, absolute: true });
+    // tinyglobby returns forward slashes, also on Windows.
     if (found.length === 1)
         return { solution: path.normalize(found[0]) };
     return { note: found.length ? "several solutions: name one in build/test" : "no solution file found" };

package/dist/core/test-runner.js

@@ -6,7 +6,7 @@
  */
 import fs from "node:fs";
 import path from "node:path";
-import fg from "fast-glob";
+import { globSync } from "tinyglobby";
 import { readJson, relativePath } from "./util.js";
 /** The test target of the first `angular.json` project that has one. */
 function angularTestTarget(root) {
@@ -22,7 +22,7 @@ function dependencies(root) {
     const pkg = readJson(path.join(root, "package.json"));
     return new Set([...Object.keys(pkg?.dependencies ?? {}), ...Object.keys(pkg?.devDependencies ?? {})]);
 }
-const hasFile = (root, pattern) => fg.sync(pattern, { cwd: root, deep: 1 }).length > 0;
+const hasFile = (root, pattern) => globSync(pattern, { expandDirectories: false, cwd: root, deep: 1 }).length > 0;
 function karma(root, options) {
     const conf = path.resolve(root, typeof options.karmaConfig === "string" ? options.karmaConfig : "karma.conf.js");
     let text;

package/dist/core/verify/test-results.js

@@ -7,7 +7,7 @@
  */
 import fs from "node:fs";
 import path from "node:path";
-import fg from "fast-glob";
+import { globAbsolute } from "../scan.js";
 function attributes(tag) {
     const out = {};
     for (const m of tag.matchAll(/([\w:-]+)\s*=\s*(?:"([^"]*)"|'([^']*)')/g))
@@ -200,8 +200,7 @@ export function hasTestNames(results) {
 export function collectTestResults(pattern, since, claimed = new Map()) {
     // Filesystem timestamps can be coarser than Date.now().
     const cutoff = since - 2000;
-    const files = fg
-        .sync(path.sep === "\\" ? pattern.replace(/\\/g, "/") : pattern, { absolute: true, dot: true })
+    const files = globAbsolute(pattern)
         .map((file) => ({ file, mtime: fs.statSync(file).mtimeMs }))
         .filter(({ file, mtime }) => mtime >= cutoff && claimed.get(file) !== mtime)
         .sort((a, b) => a.file.localeCompare(b.file));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flagrm",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Guardrails for removing feature flags with AI coding agents (Claude Code, Copilot, Codex): skills, a baseline, a verify gate and a Stop hook.",
   "type": "module",
   "license": "Apache-2.0",
@@ -53,17 +53,17 @@
   ],
   "dependencies": {
     "commander": "^13.1.0",
-    "fast-glob": "^3.3.3",
     "picocolors": "^1.1.1",
     "picomatch": "^4.0.7",
+    "tinyglobby": "^0.2.17",
     "typescript": "^5.7.0",
     "yaml": "^2.7.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.10",
+    "@biomejs/biome": "2.5.15",
     "@types/node": "^22.13.0",
     "@types/picomatch": "^4.0.3",
     "tsx": "^4.19.0",
-    "vitest": "^3.0.0"
+    "vitest": "^4.1.11"
   }
 }