gitwise-cli 0.34.1__tar.gz → 0.34.2__tar.gz

{gitwise_cli-0.34.1 → gitwise_cli-0.34.2}/CHANGELOG.md

@@ -3,6 +3,12 @@
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.34.2 (2026-07-22)
+
+### Fix
+
+- **security**: enforce subprocess safety invariants
+
 ## v0.34.1 (2026-07-22)
 
 ### Fix

{gitwise_cli-0.34.1 → gitwise_cli-0.34.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitwise-cli
-Version: 0.34.1
+Version: 0.34.2
 Summary: Python CLI for optimizing git workflows and Claude Code integration
 Project-URL: Homepage, https://github.com/drzioner/gitwise
 Project-URL: Repository, https://github.com/drzioner/gitwise

{gitwise_cli-0.34.1 → gitwise_cli-0.34.2}/gitwise/__init__.py

@@ -1,6 +1,6 @@
 """gitwise -- CLI for optimizing git workflows and coding-agent integration."""
 
-__version__ = "0.34.1"
+__version__ = "0.34.2"
 
 
 def get_version() -> str:

{gitwise_cli-0.34.1 → gitwise_cli-0.34.2}/gitwise/audit.py

@@ -8,6 +8,7 @@ from pathlib import Path
 from typing import Any
 
 from gitwise.git import (
+    _get_timeout,
     gpg_status,
     has_commit_graph,
     has_remote,
@@ -112,13 +113,18 @@ def _run_git_sizer(cwd: Path) -> dict | None:
     """Run ``git-sizer`` if available and return its JSON output, or None."""
     if not shutil.which("git-sizer"):
         return None
-    r = subprocess.run(
-        ["git-sizer", "--threshold=2", "--json"],
-        cwd=cwd,
-        capture_output=True,
-        text=True,
-        check=False,
-    )
+    try:
+        r = subprocess.run(
+            ["git-sizer", "--threshold=2", "--json"],
+            cwd=cwd,
+            capture_output=True,
+            text=True,
+            check=False,
+            timeout=_get_timeout("git-sizer"),
+        )
+    except subprocess.TimeoutExpired:
+        debug("git-sizer timed out")
+        return None
     if r.returncode not in (0, 1):
         return None
     import json

{gitwise_cli-0.34.1 → gitwise_cli-0.34.2}/gitwise/conflicts.py

@@ -4,7 +4,7 @@ import subprocess
 import tempfile
 from pathlib import Path
 
-from gitwise.git import require_root
+from gitwise.git import _GIT_ENV, require_root
 from gitwise.git import run as git_run
 from gitwise.i18n import t
 from gitwise.output import (
@@ -27,6 +27,7 @@ def _git_bytes(args: list[str], *, cwd: Path) -> tuple[int, bytes, bytes]:
         ["git", *args],
         cwd=cwd,
         capture_output=True,
+        env=_GIT_ENV,
         timeout=120,
     )
     return r.returncode, r.stdout, r.stderr

{gitwise_cli-0.34.1 → gitwise_cli-0.34.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gitwise-cli"
-version = "0.34.1"
+version = "0.34.2"
 description = "Python CLI for optimizing git workflows and Claude Code integration"
 readme = "README.md"
 license = "MIT"

{gitwise_cli-0.34.1 → gitwise_cli-0.34.2}/tests/test_audit.py

@@ -4,6 +4,7 @@ import json
 import os
 import platform
 import subprocess
+import sys
 import time
 
 from conftest import run_gitwise as _run
@@ -101,3 +102,34 @@ def test_audit_quick_skips_large_blobs(tmp_git_repo_with_large_blob):
     large = [f for f in data["data"]["findings"] if f["type"] == "large_blobs"]
     assert len(large) == 0  # --quick skips blob search
     assert data["data"]["summary"]["large_blobs"] == 0
+
+
+def test_audit_git_sizer_timeout_returns_json(tmp_git_repo, tmp_path):
+    bin_dir = tmp_path / "bin"
+    bin_dir.mkdir()
+    script = bin_dir / "slow_git_sizer.py"
+    script.write_text('import time\ntime.sleep(8)\nprint("{}")\n')
+
+    if os.name == "nt":
+        executable = bin_dir / "git-sizer.cmd"
+        executable.write_text(f'@"{sys.executable}" "{script}" %*\n')
+    else:
+        executable = bin_dir / "git-sizer"
+        executable.write_text(f"#!{sys.executable}\n{script.read_text()}")
+        executable.chmod(0o755)
+
+    start = time.monotonic()
+    result = _run(
+        "audit",
+        "--json",
+        cwd=tmp_git_repo,
+        env={
+            "GITWISE_GIT_TIMEOUT": "1",
+            "PATH": f"{bin_dir}{os.pathsep}{os.environ['PATH']}",
+        },
+    )
+    elapsed = time.monotonic() - start
+
+    assert result.returncode in (0, 1)
+    assert json.loads(result.stdout)["command"] == "audit"
+    assert elapsed < 6

{gitwise_cli-0.34.1 → gitwise_cli-0.34.2}/tests/test_conflicts.py

@@ -86,6 +86,22 @@ def test_conflicts_union_json_envelope(tmp_git_repo):
     assert env["data"]["resolved"] >= 1
 
 
+def test_conflicts_union_scrubs_injected_git_config(tmp_git_repo):
+    _setup_text_conflict(tmp_git_repo)
+
+    r = run_gitwise(
+        "conflicts",
+        "--union",
+        "--json",
+        cwd=tmp_git_repo,
+        env={"GIT_CONFIG_COUNT": "invalid"},
+    )
+
+    assert r.returncode == 0
+    env = json.loads(r.stdout)
+    assert env["data"]["resolved"] >= 1
+
+
 def test_conflicts_dry_run_does_not_touch_tree(tmp_git_repo):
     """--dry-run reports the plan but leaves conflict markers in place."""
     _setup_text_conflict(tmp_git_repo)