test / unit + widget + golden + a11y (push) Failing after 31s
test / integration_test (xvfb) (push) Has been skipped
test / bundle smoke (xvfb 5s) (push) Has been skipped
test / daemon subprocess + web WASM smoke (push) Has been skipped
test / dart doc (lib API) (push) Failing after 1m0s
Three security fixes the consultant flagged:
* git.checkout, git.push now reject branch/remote arguments starting
with `-` via a top-level validateGitRef helper. `git push` also
gets a `--` option terminator; checkout can't use `--` without
changing semantics (it would be parsed as a pathspec), so the
validator is the only line of defence there.
* files.read caps responses at 10 MB so a single call can't OOM the
UI on a multi-gigabyte log.
* git.log caps `count` at 1000; git.diff / git.stage cap paths at
256. Excess is a userError rather than burning subprocess time.
The bigger typed-schema framework (item 1 in T-104) is split out as
T-120 since it needs design discussion alongside T-99.
Co-Authored-By: Claude <noreply@anthropic.com>
Drop the workspaceRoot parameter from resolveToolchainPaths /
Toolchain.resolvePaths entirely. The old code resolved
\`<workspaceRoot>/native/dugite/bin/git\` as the git binary before
falling back to PATH — a malicious repo could commit an executable
at that path and clide would run it on the first auto-fired
git.status (which fires automatically on workspace open).
Dugite now resolves against trusted locations only:
1. CLIDE_DUGITE_DIR env var (dev override).
2. <exe-parent>/dugite/bin/git (production bundle).
3. <exe-parent>/lib/dugite/bin/git (alternate bundle layout).
Test plants `native/dugite/bin/git` in a temp workspace and asserts
the resolved git path is NOT inside the workspace.
Callers updated (8 sites): main.dart, backend_entry.dart twice,
test_app.dart three times (compute now wraps a no-arg call), plus
five test fixtures. backend.dart's now-vestigial hintRoot left in
the struct for cleanup under T-99.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`lib/kernel/src/toolchain.dart` is a `ChangeNotifier`, so it pulls in
`package:flutter/foundation.dart`. `GitClient` and `PqlClient` imported
it for the resolved binary paths, which leaked Flutter through the
`package:clide/clide.dart` barrel — breaking `dart test` on every core
subsystem suite (`ci/test_core.sh`), since pure Dart can't compile
Flutter packages.
Split the Flutter-free pieces into `toolchain_paths.dart`: `ResolvedPaths`,
`resolveToolchainPaths`, and a new read-only `ToolchainView` interface
with a `ToolchainView.resolved()` const factory. `Toolchain` now
implements `ToolchainView`; the clients depend on the interface. Core
test setups that built a `Toolchain` just to call `applyResolved`
switch to the factory.
Co-Authored-By: Claude <noreply@anthropic.com>
test / unit + widget + golden + a11y (push) Failing after 30s
test / integration_test (xvfb) (push) Has been skipped
test / bundle smoke (xvfb 5s) (push) Has been skipped
test / daemon subprocess + web WASM smoke (push) Has been skipped
test / dart doc (lib API) (push) Failing after 1m1s
Closes out the three remaining files in src/git/ following the
client.dart batch:
operations.dart (25 new tests):
- GitException.toString
- GitLogEntry.toJson (body present + absent)
- gitStage / gitUnstage / gitStashPop / gitPush / gitPull error
paths (no remote, empty stash, bogus path)
- gitUnstage with empty paths (unstage everything)
- gitStageHunk + gitUnstageHunk via _applyPatch
- _applyPatch surfaces stderr in GitException on a bad patch
- gitBranches happy + non-repo
- gitCheckout happy + unknown-branch error
- gitPull + gitPush round-trip against a local bare remote
- gitLog / gitCurrentBranch / gitBranches non-repo fallbacks
- gitDiscard with empty list short-circuit
- gitBin resolver
diff.dart (7 new tests):
- gitDiff with paths argument and non-repo fallback
- GitHunk.toPatch round-tripping header + every DiffLineKind
- GitDiff.toJson with / without oldPath
- parseDiffOutput edge cases: pre-diff garbage skipped, "\ No newline"
marker captured as a header line, malformed @@ header skipped via
_parseHunk null return
status.dart (4 new tests):
- branch.upstream + branch.ab populated from a local bare remote
- non-git directory returns an empty branchless status
- rename in porcelain output captures the original path
- parsePorcelainV1 short-part / empty-part / empty-input edge cases
Coverage: src/git/diff.dart 106/124 -> 124/124 (100%);
src/git/operations.dart 88/155 -> 148/155 (95% — remaining 7 lines
are gitPull/gitPush variants that need credentials, and the
gitBranches non-zero stderr path);
src/git/status.dart 86/98 -> 95/98 (97% — remaining 3 are the
ProcessException-during-call catch branches, only reachable if git
crashes mid-call).
Total coverage 76.04% -> 77.05%; floor bumped to 77.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
test / unit + widget + golden + a11y (push) Failing after 29s
test / integration_test (xvfb) (push) Has been skipped
test / bundle smoke (xvfb 5s) (push) Has been skipped
test / daemon subprocess + web WASM smoke (push) Has been skipped
test / dart doc (lib API) (push) Failing after 1m0s
23 integration tests in test/git/client_test.dart driving a real git
binary against per-test sandbox repos. Covers every GitClient public
method that wasn't already exercised through the daemon command
suite:
- Queries: status (clean + with upstream tracking ahead/behind),
diff with explicit paths, log, currentBranch, branches (with the
current-marker check), repoRoot (in-repo + non-repo paths).
- Mutations: unstage with paths, commit-returns-hash, discard,
discard with empty list, stash + stashPop with includeUntracked,
checkout, stageHunk + unstageHunk via _applyPatch.
- Error surface: mutations throw GitException on non-zero exit,
_applyPatch surfaces stderr from a bad patch, bad git binary path
→ ProcessException → GitException, queries return empty fallbacks
on a non-git workDir.
- parseLog standalone parser: empty input, short-record skip, full
record with body, 5-field record without body.
Coverage: src/git/client.dart 76/141 -> 124/141 (88%). The remaining
17 lines are the pull / push paths (would need a real remote with
matching credentials — out of scope) and the status GitException
catch branches that require an in-flight git process failure mid-call.
Total coverage 75.42% -> 76.04%; floor bumped to 76.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Shell-outs to git for status (porcelain v1/v2), unified-diff
parsing, and operations (stage, unstage, hunk-apply, discard,
commit, stash, log, pull, push). IPC verbs git.* registered on
the daemon dispatcher with git.changed event emission on
mutations. 42 new core tests.
Co-Authored-By: Claude <noreply@anthropic.com>
jpmschweitzerandClaude