João Salavisa
6ceda6ae4e
* fix(local-executor): preserve commits in changes panel after refresh
For a local executor on a feature branch, the create-task dialog sent
the chip's branch as base_branch with empty checkout_branch. agentctl
then recomputed merge-base(HEAD, origin/<branch>) on every changes-panel
refresh; for a never-pushed branch that collapsed to HEAD and the panel
went empty. Repository creation also pinned default_branch to .git/HEAD,
permanently anchoring the repo's integration ref to whatever feature
branch the user happened to be on at first task-create time.
The frontend now splits the chip into base_branch=default_branch +
checkout_branch=working_branch (skipping the split when fresh-branch is
on, where the chip semantically means "fork from"). The backend probes
origin/HEAD then origin/main → main → master (new common/gitref
package) to pick a repo's integration branch, and resolveRepoInput no
longer falls back to BaseBranch when default_branch is missing.
Covered by 9 unit tests on the helper, 6 Go tests on the probe order,
and 7 e2e tests across plain creation, the fork toggle, and the
validate-path probe.
* fix: address PR review feedback
- gitref: preserve slashes in HEAD-fallback branch names (TrimPrefix
refs/heads/ instead of Split + last component); branches like
"feature/my-feature" no longer collapse to "my-feature" and poison
the stored default_branch.
- gitref: drop the broken packed-refs symref scan in readOriginHEAD;
the loose refs/remotes/origin/HEAD check + pickFirstExistingBranch
candidates already cover every realistic clone.
- service.resolveRepoInput: validate repoInput.LocalPath via
resolveAllowedLocalPath() before probing — closes 8 CodeQL
path-injection alerts.
- buildRepositoriesPayload: fall through to the legacy non-split shape
when default_branch is unknown for the row (legacy repos with unset
default_branch). Synthesizing base_branch=rowBranch was reproducing
the very bug this PR fixes.
* fix(gitref): explicit traversal guard at I/O boundary for CodeQL
Move the path validation from service.resolveAllowedLocalPath (which
CodeQL's taint analysis doesn't recognize as a sanitizer) into a
guardRepoPath check at gitref.DefaultBranch's entry. The new check
rejects relative paths and any '..' segments before any os.Stat /
os.ReadFile call sees the value, which CodeQL recognizes as a
go/path-injection sanitizer.
The upstream allowlist check stays in place — this is a belt-and-
suspenders second barrier at the actual I/O boundary, and it also
makes the gitref package safe for any future callers (migrations,
tests) without requiring them to thread a Service in.
* fix: address review feedback on hardening + e2e race
- gitref.guardRepoPath: check the RAW input for '..' segments before
filepath.Clean. Clean resolves '..' away from absolute paths
("/allowed/../etc" -> "/etc"), so iterating the cleaned path was a
silent no-op for the very inputs we wanted to reject. Split on both
'/' and the OS separator. Updated the test with three traversal
cases.
- gitref_test.go: switch from strings.EqualFold to strict equality —
git branch names are case-sensitive, "Main" should not pass for
"main".
- e2e: replace waitForRequest with waitForResponse in
local-executor-branch-split.spec.ts. waitForRequest resolves on send
(before the server has persisted the task), so the followup
apiClient.getTask call could race the write on slow CI. The two
tests that need the request body keep access via
(await waitForResponse).request().
* fix(ws): forward CheckoutBranch in wsUpdateTask
The PR fix added CheckoutBranch forwarding to wsCreateTask but missed
the same conversion loop in wsUpdateTask. Any task-update payload with
a repositories array would silently zero out checkout_branch and
re-introduce the merge-base collapse on refresh — same root cause this
PR fixes, in the update path.
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
68 lines
2.2 KiB
Go
68 lines
2.2 KiB
Go
package gitref
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
// TestDefaultBranch_RejectsRelativePath — guardRepoPath refuses relative
|
|
// paths so callers can't sneak `repos/..` past the I/O boundary even if
|
|
// the upstream allowlist check is bypassed.
|
|
func TestDefaultBranch_RejectsRelativePath(t *testing.T) {
|
|
if _, err := DefaultBranch("repos/foo"); err == nil {
|
|
t.Fatal("expected error for relative path")
|
|
}
|
|
}
|
|
|
|
// TestDefaultBranch_RejectsTraversal — explicit guard against ".."
|
|
// segments in the RAW input. We must check before filepath.Clean: Clean
|
|
// resolves '..' away from absolute paths (`/allowed/../etc` → `/etc`) and
|
|
// would silently let a traversal attempt through.
|
|
func TestDefaultBranch_RejectsTraversal(t *testing.T) {
|
|
cases := []string{
|
|
"/tmp/../etc",
|
|
"/foo/bar/../../etc",
|
|
"/a/b/..",
|
|
}
|
|
for _, p := range cases {
|
|
if _, err := DefaultBranch(p); err == nil {
|
|
t.Errorf("expected error for path %q (contains '..')", p)
|
|
}
|
|
}
|
|
}
|
|
|
|
// TestDefaultBranch_RejectsEmpty — guardRepoPath errors on empty input
|
|
// rather than letting filepath.Join silently turn it into ".git".
|
|
func TestDefaultBranch_RejectsEmpty(t *testing.T) {
|
|
if _, err := DefaultBranch(""); err == nil {
|
|
t.Fatal("expected error for empty path")
|
|
}
|
|
}
|
|
|
|
// TestDefaultBranch_AcceptsAbsolutePathToValidRepo — sanity check that
|
|
// the guard doesn't reject legitimate absolute paths. We seed a minimal
|
|
// .git directory with a HEAD on main and assert the probe finds it.
|
|
func TestDefaultBranch_AcceptsAbsolutePathToValidRepo(t *testing.T) {
|
|
repoPath := t.TempDir()
|
|
if !filepath.IsAbs(repoPath) {
|
|
t.Fatalf("t.TempDir() returned non-absolute path: %q", repoPath)
|
|
}
|
|
gitDir := filepath.Join(repoPath, ".git")
|
|
if err := os.MkdirAll(gitDir, 0o755); err != nil {
|
|
t.Fatalf("mkdir git: %v", err)
|
|
}
|
|
if err := os.WriteFile(filepath.Join(gitDir, "HEAD"), []byte("ref: refs/heads/main\n"), 0o644); err != nil {
|
|
t.Fatalf("write HEAD: %v", err)
|
|
}
|
|
branch, err := DefaultBranch(repoPath)
|
|
if err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
// Git branch names are case-sensitive — assert exact equality, not
|
|
// EqualFold. A function that returns "Main" or "MAIN" should fail.
|
|
if branch != "main" {
|
|
t.Fatalf("expected main, got %q", branch)
|
|
}
|
|
}
|