second-read 0.1.1 → 0.1.2

package/README.md

@@ -127,11 +127,13 @@ second-read shim install     # writes a gh shim, and says which folder to put ah
   `SECOND_READ_ALLOWLIST_REVIEWED="<id>"`. An id covers only that change, so a later one is refused again.
 - **The `gh` shim** checks `--title`, `--body`, `--body-file` and a body read from stdin, for `gh issue` and
   `gh pr` `create`, `edit` and `comment`, and `gh pr review`. It also checks the `--comment` that `close` and
-  `reopen` leave, and the `--subject` and body of `gh pr merge`'s merge commit. It checks a release's title,
-  notes and tag, a gist's description and the files it uploads, stdin included, with the name each is uploaded
-  under, a label's name and description, and a repository's name and description, on `gh repo rename` too. A name
-  is checked as a branch name is, and only the new one, so a leaked name can be renamed away. Then it runs the real
-  `gh` with the same arguments and input. Every other command, `gh api` included, passes straight through.
+  `reopen` leave, and the `--subject`, body and `--author-email` of `gh pr merge`'s merge commit. It checks a
+  release's title, notes and tag, and the file name and any label of each asset `gh release create` or
+  `gh release upload` sends, a gist's description and the files it uploads, stdin included, with the name
+  each is uploaded under, a label's name and description, and a repository's name and description, on
+  `gh repo rename` too. A name is checked as a branch name is, and only the new one, so a leaked name can be renamed
+  away. Then it runs the real `gh` with the same arguments and input. Every other command, `gh api` included, passes
+  straight through.
 
 Each guard refuses on a finding, and also when the check itself fails. A hook that was already in place is set aside
 and still runs after the check; `second-read hooks uninstall` removes only second-read's hooks and puts it back. The
@@ -183,7 +185,8 @@ A body can come from a heredoc (`--body "$(cat <<'EOF' … EOF)"`), a here-strin
 `printf` piped in. A file the same command writes first, as in `cat > body.md <<'EOF'`, is read from the command,
 since the hook runs before it does. Posts inside `$(…)` and backticks are checked too. A body the shell fills in
 only when the command runs, such as `--body "$BODY"` or what `xargs` adds, can't be read beforehand, so the call is
-denied. Put the text in the command, or in a file and pass its path.
+denied. So is a release asset given as a glob, such as `dist/*.tgz`, whose files may not be there yet. Put the text
+in the command, or in a file and pass its path, and name each asset.
 
 The plugin never approves a call. A clean post goes on to Claude Code's usual permission check. Its deny holds in
 `bypassPermissions` mode too: a session run with `--permission-mode bypassPermissions` on Claude Code 2.1.302 had

package/dist/claude.js

@@ -148,8 +148,15 @@ function ghPosts(args, stdin, dir, written) {
     const post = parseGh(args);
     if (!post)
         return [];
+    // gh expands a glob among a release's assets only when it runs, past files the command may make first.
     return [
-        ...postNames(post).map(([where, text]) => ({ where, kind: post.kind, text, cwd: dir, name: true })),
+        ...postNames(post, (pattern) => [unknown(pattern)]).map(([where, text]) => ({
+            where,
+            kind: post.kind,
+            text,
+            cwd: dir,
+            name: true,
+        })),
         ...postTexts(post, reader(stdin, dir, written)).map(([where, text]) => ({ where, kind: post.kind, text, cwd: dir })),
     ];
 }

package/dist/gh.js

@@ -1,7 +1,9 @@
-import { accessSync, closeSync, constants, openSync, readSync, realpathSync, statSync } from "node:fs";
+import { accessSync, closeSync, constants, openSync, readdirSync, readSync, realpathSync, statSync } from "node:fs";
 import { basename, delimiter, join, resolve } from "node:path";
 import { KIND_NAMES } from "./checks.js";
 import { shQuote } from "./git.js";
+import { escapeRegExp } from "./normalize.js";
+import { UNKNOWN } from "./shell.js";
 export const SHIM_MARKER = "# Added by second-read: the gh shim.";
 const TEXT_FLAGS = {
     "--title": "title",
@@ -13,7 +15,7 @@ const TEXT_FLAGS = {
 };
 // Closing or reopening with a comment posts the comment.
 const COMMENT_FLAGS = { "--comment": "body", "-c": "body" };
-// A merge commit's message: its subject and body.
+// A merge commit's message, its subject and body, and its author's address.
 const MERGE_FLAGS = {
     "--subject": "title",
     "-t": "title",
@@ -21,6 +23,8 @@ const MERGE_FLAGS = {
     "-b": "body",
     "--body-file": "bodyFile",
     "-F": "bodyFile",
+    "--author-email": "email",
+    "-A": "email",
 };
 const RELEASE_FLAGS = {
     "--title": "title",
@@ -49,12 +53,24 @@ const release = (posting) => ({
     nameName: "tag",
     ...posting,
 });
+// Each asset is "<file>#<label>" or "<file>", and is uploaded under its file's name, which is in its download URL
+// even when a label is shown on the release page. One that starts with "#" has no label, and one the shell fills in
+// is read whole, to be refused unread.
+const assets = (post, args) => {
+    for (const arg of args) {
+        post.assets.push(arg);
+        const at = arg.includes(UNKNOWN) ? -1 : arg.indexOf("#");
+        if (at > 0)
+            post.labels.push(arg.slice(at + 1));
+    }
+};
 // gh release create [<tag>] [<asset>...]
 const releaseCreate = release({
     valued: ["--discussion-category", "--notes-start-tag", "--target"],
-    args: (post, [tag]) => {
+    args: (post, [tag, ...files]) => {
         if (tag !== undefined)
             post.names.push(tag);
+        assets(post, files);
     },
 });
 // A repository's name, from gh repo create [<name>] or gh repo rename [<new name>].
@@ -136,7 +152,7 @@ const POSTS = {
         merge: {
             kind: "commit",
             flags: MERGE_FLAGS,
-            valued: ["--author-email", "-A", "--match-head-commit"],
+            valued: ["--match-head-commit"],
             noun: "this merge commit",
             titleName: "subject",
         },
@@ -146,6 +162,8 @@ const POSTS = {
         new: releaseCreate,
         // The tag it's given now is checked, not the one it had, so a release's tag can be renamed.
         edit: release({ flags: { ...RELEASE_FLAGS, "--tag": "name" } }),
+        // gh release upload <tag> <asset>...: the release is already there, under its tag.
+        upload: release({ flags: {}, valued: [], args: (post, [, ...files]) => assets(post, files) }),
     },
     gist: {
         create: gistCreate,
@@ -211,6 +229,9 @@ export function parseGh(args) {
         body: [],
         bodyFiles: [],
         names: [],
+        emails: [],
+        labels: [],
+        assets: [],
     };
     const takesValue = (flag) => flag in posting.flags || posting.valued.includes(flag) || flag === "-R" || flag === "--repo";
     // The arguments, the command words first.
@@ -253,6 +274,8 @@ export function parseGh(args) {
             post.bodyFiles.push(value);
         else if (field === "name")
             post.names.push(value);
+        else if (field === "email")
+            post.emails.push(value);
         else
             post[field].push(value);
     }
@@ -284,11 +307,76 @@ export function postTexts(post, read) {
             f === "-" ? `the ${post.fileName} of ${noun}` : `the ${post.fileName} of ${noun}, from ${f}`,
             read(f),
         ]),
+        ...post.emails.map((t) => [`the author email of ${noun}`, t]),
+        ...post.labels.map((t) => [`the label of an asset of ${noun}`, t]),
     ];
 }
-// Each name a posting gh command gives, with where it goes. A name is checked as a branch name is.
-export function postNames(post) {
-    return post.names.map((n) => [`the ${post.nameName} of ${post.noun}`, n]);
+// Each name a posting gh command gives, with where it goes. A name is checked as a branch name is. gh expands an
+// asset with no "#" as a glob, and `glob` gives the names of the files it matches.
+export function postNames(post, glob) {
+    const files = post.assets.flatMap((a) => {
+        if (a.includes(UNKNOWN))
+            return [a];
+        const at = a.indexOf("#");
+        if (at > 0)
+            return [basename(a.slice(0, at))];
+        return at < 0 && GLOB_META.test(a) ? glob(a) : [basename(a)];
+    });
+    return [
+        ...post.names.map((n) => [`the ${post.nameName} of ${post.noun}`, n]),
+        ...files.map((n) => [`the file name of an asset of ${post.noun}`, n]),
+    ];
+}
+// The characters Go's filepath.Glob reads as a pattern, outside Windows.
+const GLOB_META = /[*?[\\]/;
+// The names of the files a pattern matches, read as Go's filepath.Glob reads it, which gh runs on an asset. "*"
+// matches any run of characters but "/", "?" one, and "\" makes the next character plain; a dot file is matched too.
+// A class in brackets is read as any one character, so a pattern never takes in fewer files than gh uploads.
+export function globNames(pattern, cwd) {
+    let paths = [pattern.startsWith("/") ? "/" : ""];
+    for (const segment of pattern.split("/")) {
+        if (segment === "")
+            continue;
+        if (!GLOB_META.test(segment)) {
+            paths = paths.map((p) => join(p, segment));
+            continue;
+        }
+        const re = globSegment(segment);
+        paths = paths.flatMap((p) => {
+            try {
+                return readdirSync(resolve(cwd, p || ".")).filter((name) => re.test(name)).map((name) => join(p, name));
+            }
+            catch {
+                return [];
+            }
+        });
+    }
+    return paths.map((p) => basename(p));
+}
+function globSegment(segment) {
+    let source = "";
+    for (let i = 0; i < segment.length; i++) {
+        const c = segment[i];
+        if (c === "*")
+            source += ".*";
+        else if (c === "?")
+            source += ".";
+        else if (c === "\\")
+            source += escapeRegExp(segment[++i] ?? "\\");
+        else if (c === "[") {
+            // A class ends at the first "]" past its first character, which may be "]" itself.
+            let j = segment[i + 1] === "^" ? i + 2 : i + 1;
+            for (let first = true; j < segment.length && (first || segment[j] !== "]"); j++, first = false) {
+                if (segment[j] === "\\")
+                    j++;
+            }
+            source += ".";
+            i = j;
+        }
+        else
+            source += escapeRegExp(c);
+    }
+    return new RegExp(`^${source}$`, "su");
 }
 export function shimScript(command) {
     return `#!/bin/sh

package/dist/main.js

@@ -4,7 +4,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { check, checkTerms, KIND_NAMES, KINDS, } from "./checks.js";
 import { configDir, exemptMatcher, findRepoConfig, loadRepoConfig, loadUserConfig, mergeRules, USER_FILE, USER_FILE_TEMPLATE, } from "./config.js";
 import { bashPosts, firstUnknown, isGithubTool, mcpPosts } from "./claude.js";
-import { findRealGh, isShim, parseGh, postNames, postTexts, shimScript } from "./gh.js";
+import { findRealGh, globNames, isShim, parseGh, postNames, postTexts, shimScript } from "./gh.js";
 import { allowlistChanges, commitMessage, exitStatus, HOOKS, hooksDir, hooksInWorkTree, installHooks, installManaged, isManagedDir, pushRange, readPushed, refreshManaged, runPrevious, uninstallHooks, uninstallManaged, } from "./git.js";
 import { UNKNOWN } from "./shell.js";
 export const EXIT = { clean: 0, findings: 1, failed: 2 };
@@ -341,7 +341,10 @@ async function runShim(io, args) {
         const stdin = input?.toString("utf8") ?? "";
         const texts = postTexts(post, (file) => (file === "-" ? stdin : readFileSync(resolve(io.cwd, file), "utf8")));
         const sections = [
-            ...postNames(post).map(([where, name]) => ({ where, findings: checkName(name, identity, rules) })),
+            ...postNames(post, (pattern) => globNames(pattern, io.cwd)).map(([where, name]) => ({
+                where,
+                findings: checkName(name, identity, rules),
+            })),
             ...texts.map(([where, text]) => ({ where, findings: check(text, { identity, rules, kind: post.kind }) })),
         ].filter((s) => s.findings.length > 0);
         if (sections.length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "second-read",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "A privacy check on agent-written commits, issues, PRs and comments, for any coding agent.",
   "license": "MIT",
   "type": "module",