threadlines 0.2.17 → 0.2.19

package/dist/commands/check.js

@@ -227,6 +227,14 @@ async function checkCommand(options) {
         console.error(chalk_1.default.bold('ℹ️ No changes detected.'));
         process.exit(0);
     }
+    // Safety limit: prevent expensive API calls on large diffs
+    const MAX_CHANGED_FILES = 20;
+    if (gitDiff.changedFiles.length > MAX_CHANGED_FILES) {
+        console.error(chalk_1.default.red(`❌ Too many changed files: ${gitDiff.changedFiles.length} (max: ${MAX_CHANGED_FILES})`));
+        console.error(chalk_1.default.gray('   This limit prevents expensive API calls on large diffs.'));
+        console.error(chalk_1.default.gray('   Consider reviewing smaller batches of changes.'));
+        process.exit(1);
+    }
     // Check for zero diff (files changed but no actual code changes)
     if (!gitDiff.diff || gitDiff.diff.trim() === '') {
         console.log(chalk_1.default.blue('ℹ️  No code changes detected. Diff contains zero lines added or removed.'));

package/dist/git/diff.js

@@ -26,6 +26,21 @@ const child_process_1 = require("child_process");
  * @param repoRoot - Path to the repository root
  * @returns Repository URL (e.g., "https://github.com/user/repo.git")
  */
+/**
+ * Sanitize a git remote URL by removing embedded credentials.
+ *
+ * CI environments often embed tokens in the remote URL for authentication:
+ * - GitLab CI: https://gitlab-ci-token:TOKEN@gitlab.com/user/repo
+ * - GitHub Actions: https://x-access-token:TOKEN@github.com/user/repo
+ *
+ * This function strips credentials to prevent token exposure in logs/UI.
+ */
+function sanitizeRepoUrl(url) {
+    // Handle HTTPS URLs with credentials: https://user:pass@host/path
+    // The regex matches: protocol://anything@host/path and removes "anything@"
+    const sanitized = url.replace(/^(https?:\/\/)([^@]+@)/, '$1');
+    return sanitized;
+}
 async function getRepoUrl(repoRoot) {
     try {
         const url = (0, child_process_1.execSync)('git remote get-url origin', {
@@ -35,7 +50,8 @@ async function getRepoUrl(repoRoot) {
         if (!url) {
             throw new Error('Empty URL returned');
         }
-        return url;
+        // Remove embedded credentials (CI tokens) from the URL
+        return sanitizeRepoUrl(url);
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "threadlines",
-  "version": "0.2.17",
+  "version": "0.2.19",
   "description": "Threadlines CLI - AI-powered linter based on your natural language documentation",
   "main": "dist/index.js",
   "bin": {