windows-development-sandbox 1.4.1 → 1.4.3

package/dist/runtime/gitguard.js

@@ -1,7 +1,9 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 
-// src/guest/gitguard.ts
+// src/guest/entries/gitguard.ts
 import { spawnSync } from "node:child_process";
+
+// src/guest/git/decision.ts
 var READ_ONLY = /* @__PURE__ */ new Set([
   "status",
   "log",
@@ -41,10 +43,18 @@ var READ_ONLY = /* @__PURE__ */ new Set([
 ]);
 var listingOnly = (flags, listFlags) => (rest) => rest.every((a) => flags.test(a)) || rest.some((a) => listFlags.test(a)) && rest.every((a) => flags.test(a) || !a.startsWith("-"));
 var LISTING = {
-  branch: listingOnly(/^(-a|-r|-v|-vv|--all|--remotes|--list|-l|--show-current|--verbose|--no-color|--color(=.*)?|--contains|--no-contains|--merged|--no-merged|--sort=.*|--format=.*)$/, /^(--list|-l|--contains|--no-contains|--merged|--no-merged)$/),
-  tag: listingOnly(/^(-l|--list|-n\d*|--contains|--no-contains|--merged|--no-merged|--points-at|--sort=.*|--format=.*)$/, /^(-l|--list|--contains|--no-contains|--merged|--no-merged|--points-at)$/),
+  branch: listingOnly(
+    /^(-a|-r|-v|-vv|--all|--remotes|--list|-l|--show-current|--verbose|--no-color|--color(=.*)?|--contains|--no-contains|--merged|--no-merged|--sort=.*|--format=.*)$/,
+    /^(--list|-l|--contains|--no-contains|--merged|--no-merged)$/
+  ),
+  tag: listingOnly(
+    /^(-l|--list|-n\d*|--contains|--no-contains|--merged|--no-merged|--points-at|--sort=.*|--format=.*)$/,
+    /^(-l|--list|--contains|--no-contains|--merged|--no-merged|--points-at)$/
+  ),
   remote: (rest) => rest.length === 0 || ["-v", "--verbose", "show", "get-url"].includes(rest[0]),
-  config: (rest) => rest.some((a) => /^(--get|--get-all|--get-regexp|--list|-l|--show-origin|--show-scope|--name-only)$/.test(a)) && !rest.some((a) => /^(--add|--unset|--unset-all|--replace-all|--rename-section|--remove-section|-e|--edit)$/.test(a)),
+  config: (rest) => rest.some((a) => /^(--get|--get-all|--get-regexp|--list|-l|--show-origin|--show-scope|--name-only)$/.test(a)) && !rest.some(
+    (a) => /^(--add|--unset|--unset-all|--replace-all|--rename-section|--remove-section|-e|--edit)$/.test(a)
+  ),
   stash: (rest) => ["list", "show"].includes(rest[0] ?? ""),
   worktree: (rest) => rest[0] === "list",
   submodule: (rest) => rest.length === 0 || rest[0] === "status" || rest[0] === "summary",
@@ -54,16 +64,27 @@ var WITH_VALUE = /* @__PURE__ */ new Set(["-C", "--namespace"]);
 var FORBIDDEN_GLOBAL = /^(-c|--config-env|--exec-path|--git-dir|--work-tree|--super-prefix)(=|$)/;
 var gitDecision = (args, access) => {
   if (access === "full") return { allow: true };
-  if (access !== "readonly") return { allow: false, reason: "git is disabled in this sandbox (provisioning.git.access = " + (access || "none") + ")." };
+  if (access !== "readonly")
+    return {
+      allow: false,
+      reason: "git is disabled in this sandbox (provisioning.git.access = " + (access || "none") + ")."
+    };
   let i = 0;
   while (i < args.length && args[i].startsWith("-")) {
-    if (FORBIDDEN_GLOBAL.test(args[i])) return { allow: false, reason: "git " + args[i] + " is not allowed: git is read-only in this sandbox." };
+    if (FORBIDDEN_GLOBAL.test(args[i]))
+      return { allow: false, reason: "git " + args[i] + " is not allowed: git is read-only in this sandbox." };
     i += WITH_VALUE.has(args[i]) ? 2 : 1;
   }
   const [command, ...rest] = args.slice(i);
-  if (command === void 0 || command === "--version" || READ_ONLY.has(command) || (LISTING[command]?.(rest) ?? false)) return { allow: true };
-  return { allow: false, reason: "git " + command + " is blocked: git is read-only in this sandbox (provisioning.git.access = readonly). Reading (status, log, diff, show, blame) is allowed." };
+  if (command === void 0 || command === "--version" || READ_ONLY.has(command) || (LISTING[command]?.(rest) ?? false))
+    return { allow: true };
+  return {
+    allow: false,
+    reason: "git " + command + " is blocked: git is read-only in this sandbox (provisioning.git.access = readonly). Reading (status, log, diff, show, blame) is allowed."
+  };
 };
+
+// src/guest/entries/gitguard.ts
 if (process.argv[1]?.toLowerCase().endsWith("gitguard.js")) {
   const args = process.argv.slice(2);
   const decision = gitDecision(args, process.env.AGENT_GIT_ACCESS ?? "none");
@@ -79,6 +100,3 @@ if (process.argv[1]?.toLowerCase().endsWith("gitguard.js")) {
   const result = spawnSync(real, args, { stdio: "inherit", windowsHide: true });
   process.exit(result.status ?? 1);
 }
-export {
-  gitDecision
-};