mirror of
https://github.com/garrytan/gstack.git
synced 2026-10-31 22:14:25 +01:00
* fix(land-and-deploy): never merge over red, pending or missing CI (#2995) /land-and-deploy gated only on required checks, so a repo with none (every GitHub Free private repo, any repo without branch protection) skipped the CI wait and could merge over red CI. The verdict now comes from bin/gstack-ci-gate, a tested helper bound to the head SHA: all checks by default, cancel/unknown buckets fail, NO_CHECKS needs explicit per-head approval, and both merge commands (including --auto) run only after a PASS for the same SHA they pin with --match-head-commit. Co-authored-by: harshitgavita-07 <harshit.gavita@gmail.com> * fix(slug): give nested-group projects their own state bucket and verify checkpoint identity (#3003, #2901) gstack-slug kept only the last two remote path segments, so customer-a/product/repo and customer-b/product/repo shared one bucket and /context-restore could present another project's checkpoint. - One canonical-remote rule (bash + TS, golden vectors) used by all six resolvers: lowercased host, no userinfo/port/.git, Azure DevOps and Bitbucket Server normalized. 3+ segment remotes get <last-two>-<16 hex>; two-segment remotes (all of GitHub) are unchanged. - Versioned sticky cache (v2:) keeps cache hits git-free. - context-save stamps the credential-free remote and root; context-restore only treats this project's checkpoints as latest, reports foreign/unverified ones first, and treats a different root with the same remote (Conductor handoff) as information. - gstack-slug --adopt-legacy copies only files the user confirms. - question-preference-hook reads the same versioned cache, so never-ask preferences fire; unknown identity asks instead of auto-deciding. * fix(gbrain): brain context loads, managed sync works, memory sync stops duplicating (#2883, #2985, #2922) - brain-context-load called 'gbrain list_pages' (an MCP tool name), so every skill's brain context was 0 bytes. It now uses 'gbrain list' with gbrain's real filter flags, and prints one line when queries fail. - The code-stage sync always passes --no-pull (managed gbrain >= 0.51 refuses without it); a gbrain that rejects the flag fails with an upgrade message and is never retried without it. stderr is streamed with a bounded tail and quoted in failure summaries. - /sync-gbrain gains --sources (and GSTACK_MEMORY_INGEST_SOURCES); by default it skips types already synced through a federated curated source, so curated pages stop being re-duplicated. Co-authored-by: Vitor Cepeda Lopes <vitor@vitorcepedalopes.com> Co-authored-by: harshitgavita-07 <harshit.gavita@gmail.com> * fix(codex,cso): clean Codex reviews stop failing; semgrep and trivy SARIF results import (#2769, #3011) - Codex review gate is PASS / FAIL / UNVERIFIED. Untagged output (what a clean 'codex review --base' prints) is UNVERIFIED, not FAIL, and never a false PASS; P2/P3-only output passes. - import-sarif resolves semgrep's undeclared %SRCROOT% and trivy's ROOTPATH (including git-URL targets) through explicit, captured mappings; declared bases must sit inside the source root or the run's checkout, URIs are percent-decoded, and rejected results are counted with rule, base and path instead of silently dropped. * fix: version strings are not IPs, failed update checks are not 'up to date', private security reporting (#2856, #2786, #2984) - The pre-push redact hook exempts a root VERSION file that is only a version string and the version token in CHANGELOG release headings; the engine allowlist is untouched. - gstack-update-check caches an unreadable remote as CHECK_FAILED with a short TTL instead of UP_TO_DATE; /gstack-upgrade never reports 'latest' after a failed check. - SECURITY.md points reporters at GitHub private vulnerability reporting. - pr-title-sync (pull_request_target, write token) pins actions/checkout to a reviewed SHA. * fix(autoplan): publication guard accepts real Claude Code journals (#3007, #3009, #2968, #2977, #2986, #3006) The guard required a session journal to start with a user message, but Claude Code starts it with SessionStart hook attachments (and a forked compacted session starts with a compact_boundary), so every phase was denied for anyone with a SessionStart hook. Windows path spellings (C:/, /c/, drive case) were rejected too. - Reader accepts the captured startup, compact, clear and fork shapes (claude 2.1.284 fixture), computes root uniqueness over every candidate, and returns typed reason codes instead of one string. - Hard denials (competing root, foreign cwd, sidechain, agent, cycle, malformed, identity) say what happened and how to run the reviews by hand; unflushed journals still retry. - A well-formed, stable journal whose root shape is unrecognized now warns ('phase publication was NOT verified') and continues, without overriding Claude Code's own permission check; no bypass switch. - Windows paths fold before validation, so '..' is still rejected. - Periodic drift canary runs the reader on fresh journals from the pinned claude. Co-authored-by: Charles M Berg <77517285+CharlesBerg85@users.noreply.github.com> Co-authored-by: laurenbdaniels-coder <264343335+laurenbdaniels-coder@users.noreply.github.com> Co-authored-by: Jordan Mayer <176445995+maydaycyber@users.noreply.github.com> Co-authored-by: elmesery-dev <elmesery.dev@gmail.com> * v1.91.13.0: severe bug fix wave release notes, stale gbrain verbs in docs * test: seed the versioned slug cache in the memory-injection deny case (#2901) The preference hook now resolves the project bucket from gstack-slug's v2 slug-cache entry instead of basename(cwd); this fixture still wrote preferences under the basename bucket without the entry the skill preamble always writes first. * fix: full-suite follow-ups for the fix wave - gstack-slug's --help heredoc is over 512B, so it gets the BASH_COMPAT=50 pipe-deadlock guard like the other bins. - Refresh the codex/factory ship goldens for the plan-gates slug change. - The periodic lane gains the autoplan journal drift canary (107 paid files); raise the eval-slices cap to 25 so every slice still starts at once until its recorded duration lets the planner pack it. * fix(plan-eng-review): clearer Step 0 sequencing, write routes and section outputs The workflow judge scored plan-eng-review's instructions at actionability 3.67 (bar 4) on text unchanged from main. Resolve the ambiguities it named together, without changing any gate or output: Step 0 names the Read's order and keeps one STOP; the pending-call, read-only, forbidden-write and failed-save rules become one Write routes block; header/label limits and grid checks are concrete; Performance gets a checklist; each section has a stated output shape; Lake Score is defined. Same total length (parity cap). --------- Co-authored-by: harshitgavita-07 <harshit.gavita@gmail.com> Co-authored-by: Vitor Cepeda Lopes <vitor@vitorcepedalopes.com> Co-authored-by: Charles M Berg <77517285+CharlesBerg85@users.noreply.github.com> Co-authored-by: laurenbdaniels-coder <264343335+laurenbdaniels-coder@users.noreply.github.com> Co-authored-by: Jordan Mayer <176445995+maydaycyber@users.noreply.github.com> Co-authored-by: elmesery-dev <elmesery.dev@gmail.com>
110 lines
4.3 KiB
TypeScript
110 lines
4.3 KiB
TypeScript
/**
|
|
* remote-identity — the one TypeScript owner of git-remote project identity
|
|
* (twin of bin/gstack-remote-identity.sh; test/remote-identity-vectors.test.ts
|
|
* runs both against test/fixtures/remote-identity-vectors.json).
|
|
*
|
|
* canonicalRemote: one spelling per repository whichever way it was cloned
|
|
* (#3003). Hosted remotes become "<host>/<seg>/…" with the host lowercased
|
|
* (ASCII only, locale-independent), userinfo, credentials and port dropped,
|
|
* one trailing ".git" and stray slashes removed, and host-specific
|
|
* normalization applied before segments are counted (Azure DevOps "v3/" and
|
|
* "_git", *.visualstudio.com → dev.azure.com/<org>/…, Bitbucket Server "scm/").
|
|
* Local remotes keep their path as identity.
|
|
*
|
|
* remoteSlug: hosted remotes with 3+ segments file under
|
|
* "<last-two>-<16 hex of sha256(canonical)>"; everything else keeps the legacy
|
|
* last-two parse byte-for-byte, so no 2-segment (GitHub) bucket moves.
|
|
*/
|
|
import { createHash } from "crypto";
|
|
|
|
export interface CanonicalRemote {
|
|
canonical: string;
|
|
hosted: boolean;
|
|
segments: string[];
|
|
}
|
|
|
|
const SLUG_ALPHABET = /[^a-zA-Z0-9._-]/g;
|
|
|
|
function asciiLower(s: string): string {
|
|
return s.replace(/[A-Z]/g, (c) => String.fromCharCode(c.charCodeAt(0) + 32));
|
|
}
|
|
|
|
function stripTrailingSlashes(s: string, keepRoot: boolean): string {
|
|
let out = s;
|
|
while ((keepRoot ? out.length > 1 : out.length > 0) && out.endsWith("/")) out = out.slice(0, -1);
|
|
return out;
|
|
}
|
|
|
|
export function canonicalRemote(rawUrl: string): CanonicalRemote {
|
|
const url = rawUrl.replace(/[\r\n]/g, "");
|
|
if (!url) return { canonical: "", hosted: false, segments: [] };
|
|
let host = "";
|
|
let path = "";
|
|
let hosted = false;
|
|
const schemeMatch = url.match(/^([A-Za-z][A-Za-z0-9+.-]*):\/\/(.*)$/);
|
|
const scpMatch = url.match(/^([^/:]+):(.*)$/);
|
|
if (schemeMatch) {
|
|
const rest = schemeMatch[2];
|
|
if (asciiLower(schemeMatch[1]) !== "file") {
|
|
const slash = rest.indexOf("/");
|
|
let auth = slash === -1 ? rest : rest.slice(0, slash);
|
|
path = slash === -1 ? "" : rest.slice(slash + 1);
|
|
auth = auth.slice(auth.lastIndexOf("@") + 1);
|
|
const v6 = auth.match(/^(\[[^\]]*\])/);
|
|
host = v6 ? v6[1] : auth.split(":")[0];
|
|
hosted = true;
|
|
} else {
|
|
path = rest;
|
|
}
|
|
} else if (scpMatch && !/^[A-Za-z]:([/\\]|$)/.test(url)) {
|
|
host = scpMatch[1].slice(scpMatch[1].lastIndexOf("@") + 1);
|
|
path = scpMatch[2];
|
|
hosted = true;
|
|
} else {
|
|
path = url;
|
|
}
|
|
|
|
if (!hosted) {
|
|
let p = stripTrailingSlashes(path, true);
|
|
if (p.endsWith(".git")) p = p.slice(0, -4);
|
|
p = stripTrailingSlashes(p, true);
|
|
return { canonical: p, hosted: false, segments: [] };
|
|
}
|
|
|
|
host = asciiLower(host);
|
|
path = stripTrailingSlashes(path, false);
|
|
if (path.endsWith(".git")) path = path.slice(0, -4);
|
|
let segments = path.split("/").filter((s) => s !== "");
|
|
|
|
if (host === "ssh.dev.azure.com" || host === "vs-ssh.visualstudio.com") {
|
|
if (segments[0] === "v3") segments = segments.slice(1);
|
|
host = "dev.azure.com";
|
|
} else if (host !== "dev.azure.com" && host.endsWith(".visualstudio.com")) {
|
|
if (segments[0] === "DefaultCollection") segments = segments.slice(1);
|
|
segments = [host.split(".")[0], ...segments];
|
|
host = "dev.azure.com";
|
|
} else if (host !== "dev.azure.com" && segments.length >= 3 && segments[0] === "scm") {
|
|
segments = segments.slice(1);
|
|
}
|
|
if (host === "dev.azure.com") segments = segments.filter((s) => s !== "_git");
|
|
|
|
return { canonical: [host, ...segments].join("/"), hosted: true, segments };
|
|
}
|
|
|
|
/** The pre-#3003 parse, byte-identical to bin/gstack-remote-identity.sh's gstack_legacy_remote_slug. */
|
|
export function legacyRemoteSlug(url: string): string {
|
|
const stripped = url.endsWith(".git") ? url.slice(0, -4) : url;
|
|
const m = stripped.match(/[:/]([^/]+)\/([^/]+)$/);
|
|
const slug = (m ? `${m[1]}-${m[2]}` : stripped).replace(SLUG_ALPHABET, "");
|
|
return slug === "." || slug === ".." ? "" : slug;
|
|
}
|
|
|
|
/** Project slug for a remote URL ("" when degenerate). */
|
|
export function remoteSlug(url: string): string {
|
|
const id = canonicalRemote(url);
|
|
const n = id.segments.length;
|
|
if (!id.hosted || n < 3) return legacyRemoteSlug(url);
|
|
const digest = createHash("sha256").update(id.canonical).digest("hex").slice(0, 16);
|
|
return `${id.segments[n - 2]}-${id.segments[n - 1]}-${digest}`.replace(SLUG_ALPHABET, "");
|
|
}
|