Files
orca/src/shared/git-push-target-validation.ts
T
Neil 77f23b013f refactor(shared): drop the shared/types barrel and import from the real modules (#14447)
#14397 split `shared/types.ts` into 46 per-domain modules but kept the path as
a re-export barrel so the import sites did not have to change. This removes
the barrel: every consumer now imports from the module that actually declares
the type, and `src/shared/types.ts` is deleted.

Barrels hide where a type lives, make every consumer look like it depends on
the whole domain, and let an unrelated edit invalidate a module that ~2,000
files transitively import.

2,323 import declarations across 2,321 files. Rewritten mechanically: each
specifier was resolved to an absolute path via the TypeScript AST and
recomputed, rather than string-substituted, so alias forms (`@/../../shared/
types`) and per-specifier `type` modifiers survive.

Four cases the mechanical pass had to handle, each found by a gate rather than
by reading the diff:

- Modules inside `src/shared` import the barrel as `./types`, not
  `shared/types`. A pre-filter on the latter string skipped 176 of them and
  left imports dangling at a deleted file, which surfaced as confusing
  `Property 'x' is optional in type 'Repo' but required in Pick<Repo, ...>`
  errors rather than "module not found".
- The barrel RENAMED one type on the way through
  (`WorkspaceSource as WorkspaceCreateTelemetrySource`), so the original name
  in the owning module has to be re-aliased at each consumer.
- Three test files put `;(globalThis as ...)` on the line after the import.
  TypeScript parses that `;` as the import statement's terminator, so
  replacing through `statement.getEnd()` deletes it and breaks ASI. The
  rewrite now stops at the module specifier.
- A file that already imported directly from a module got a SECOND import
  from it, because the barrel re-exported those same names — which trips
  `import/no-duplicates` under `--deny-warnings`. A post-pass merges
  declarations sharing a specifier and type-only-ness; the `import type` plus
  `import` pair from one module is left alone, since that form is allowed.

Splitting one barrel import into several genuinely adds lines, which pushed
`terminal-layout-pty-ownership.ts` to 301 counted lines: its 107-character
import must wrap, and neither local type collapses onto one line (101 and 116
characters). Rather than contort a type declaration to fit a line budget,
`collectLeafIds` and `pruneLeaves` move to `terminal-pane-layout-tree.ts` —
they are pure structural operations on the layout tree and independent of PTY
ownership. `visible-worktrees.ts` similarly loses its own mini-barrel
re-export of `isDefaultBranchWorkspace`, with the four real consumers
repointed at the declaring module. No `max-lines` bypass added.

Verified: cold `tsc --noEmit` green on node, cli, and web (buildinfo deleted
first — these projects are `composite: true` and reuse stale caches); the full
`pnpm lint` green, not just bare oxlint — the narrower local check is what let
the duplicate imports reach CI; max-lines ratchet OK at 344.
2026-08-13 22:48:24 -07:00

49 lines
1.8 KiB
TypeScript

import type { GitPushTarget } from './worktree/types'
const SAFE_REMOTE_NAME_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]*$/
const GITHUB_CLONE_URL = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\.git$/
const GITHUB_SSH_URL = /^git@github\.com:[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\.git$/
function assertString(value: unknown, name: string): asserts value is string {
if (typeof value !== 'string') {
throw new Error(`Invalid PR push target ${name}.`)
}
}
function isSafeRemoteName(remoteName: string): boolean {
if (remoteName.length === 0 || remoteName.length > 100) {
return false
}
return remoteName.split('/').every((segment) => {
// Git accepts slash-separated remote names; each segment still needs to be
// a concrete name so persisted push targets cannot smuggle path traversal.
return (
segment !== '' &&
segment !== '.' &&
segment !== '..' &&
SAFE_REMOTE_NAME_SEGMENT.test(segment)
)
})
}
export function assertGitPushTargetShape(target: unknown): asserts target is GitPushTarget {
if (typeof target !== 'object' || target === null) {
throw new Error('Invalid PR push target.')
}
const candidate = target as Record<string, unknown>
assertString(candidate.remoteName, 'remote name')
assertString(candidate.branchName, 'branch name')
if (!isSafeRemoteName(candidate.remoteName)) {
throw new Error(`Invalid git remote name: ${candidate.remoteName}`)
}
if (!candidate.branchName || candidate.branchName.startsWith('-')) {
throw new Error(`Invalid git branch name: ${candidate.branchName}`)
}
if (candidate.remoteUrl !== undefined) {
assertString(candidate.remoteUrl, 'remote URL')
if (!(GITHUB_CLONE_URL.test(candidate.remoteUrl) || GITHUB_SSH_URL.test(candidate.remoteUrl))) {
throw new Error('Invalid PR push target remote URL.')
}
}
}