Files
Garry TanandOpenAI Codex 4a3c6a8a3c v1.87.0.0 feat: add verified CSO audits and replayable repair bundles (#2852)
* feat(cso): add verified audits and replayable repair bundles

* fix(cso): harden qualification and setup boundaries

* fix(cso): assemble security canaries at runtime

* fix(cso): bound release proof and maintenance work

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): require complete evaluation reports

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): replay expired snapshots from supplied source

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* test(cso): synchronize DNS cancellation assertion

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore(ship): exempt repository owner from liveness proof

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* test(cso): make recheck retention overlap deterministic

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: bump version and changelog (v1.85.0.0)

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): pass native release gates

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: move release to v1.86.0.0

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): resolve rechecks by finding

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: move release to v1.87.0.0

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): pass macOS and Windows release gates

Normalize BSD wc output, compare Windows paths by filesystem identity, preserve portable snapshot race coverage, and narrow POSIX-only Windows fixtures.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): harden native verification gates

* fix(cso): refine Windows native diagnostics

* test(cso): isolate Windows Git startup failure

* test(cso): stabilize Windows native diagnostics

* fix(cso): support hardened Git on Windows

* fix(cso): close final verification gaps

* test(cso): bound cold Docker fixture setup

* fix(cso): restore cross-platform free-suite gates

---------

Co-authored-by: OpenAI Codex <noreply@openai.com>
2026-09-14 15:14:58 -07:00

50 lines
2.4 KiB
TypeScript

/** Decode the two Git path tokens in a `diff --git` header. */
function token(source:string,offset:number):{value:string;next:number}|undefined{
if(source[offset]!=='"'){
const end=source.indexOf(' ',offset),next=end<0?source.length:end;
if(next===offset)return;
return{value:source.slice(offset,next),next};
}
const bytes:number[]=[];let at=offset+1;
const append=(value:string)=>bytes.push(...new TextEncoder().encode(value));
while(at<source.length){
const value=source[at++];
if(value==='"')return{value:new TextDecoder('utf-8',{fatal:true}).decode(Uint8Array.from(bytes)),next:at};
if(value!=='\\'){append(value);continue;}
if(at>=source.length)return;
const escaped=source[at++],mapped:{[key:string]:string}={a:'\x07',b:'\b',f:'\f',n:'\n',r:'\r',t:'\t',v:'\v','\\':'\\','"':'"'};
if(mapped[escaped]!==undefined){append(mapped[escaped]);continue;}
if(/[0-7]/.test(escaped)&&/^[0-7]{2}/.test(source.slice(at,at+2))){bytes.push(Number.parseInt(escaped+source.slice(at,at+2),8));at+=2;continue;}
return;
}
}
export function gitDiffHeaderPaths(line:string):[string,string]|undefined{
const prefix='diff --git ';if(!line.startsWith(prefix))return;
try{
const left=token(line,prefix.length);if(!left||line[left.next]!==' ')return;
const right=token(line,left.next+1);if(!right||right.next!==line.length)return;
return[left.value,right.value];
}catch{return;}
}
/** Return only exact path hunks, keeping one commit preamble per matching commit. */
export function historyForPath(raw:string,path:string):string|undefined{
const expected=new Set([`a/${path}`,`b/${path}`]),output:string[]=[],lines=raw.split('\n');
let preamble:string[]=[],section:string[]|undefined,include=false,preambleEmitted=false;
const flush=()=>{
if(section&&include){if(!preambleEmitted){output.push(...preamble);preambleEmitted=true;}output.push(...section);}
section=undefined;include=false;
};
for(const line of lines){
if(line.startsWith('commit ')){flush();preamble=[line];preambleEmitted=false;continue;}
if(line.startsWith('diff --git ')){
flush();section=[line];const paths=gitDiffHeaderPaths(line);include=Boolean(paths&&(expected.has(paths[0])||expected.has(paths[1])));continue;
}
if(section)section.push(line);else preamble.push(line);
}
flush();
while(output.at(-1)==='')output.pop();
return output.length?output.join('\n'):undefined;
}