jeffryandClaude Opus 5
fb96b2f90b
Closes the last unexercised assumption with a throwaway token: partial clone over HTTPS with a token against a private repository, list through the tool, the short-form raw URL redirecting to a resolved branch under auth, and a conditional request returning 304 across that redirect. A private repository can adopt from another private one, by name or by URL, and check works off the lock afterwards. Fixes what would have shipped as noise. The warning fired whenever a fetch needed a credential, which in a private repository adopting from a private repository is every time and legitimate. add now resolves origin and makes one anonymous request to learn whether this repository is public, so the warning fires when the source is private and the destination is not. The limit is stated in the message rather than implied away: the signal tells public from not-public and nothing finer, so two repositories private to different people is the case that genuinely widens access and the one this cannot see. No origin means cannot tell, which warns — cannot tell must never read as not public. Notes when an adopted document did not come from .loom/published/, without refusing. What is not exported is not hidden, but a lock against it records a dependency on something that was never a contract. And records the framing that settles all of this: the tool is a mast, not a lock. It grants no access, everything it does is possible with copy and paste, and the locks mean nothing outside the tool and the discipline of the agreement — so it makes the wrong thing deliberate rather than impossible. What it adds over a paste is not restriction but provenance. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris
35 lines
1.4 KiB
Go
35 lines
1.4 KiB
Go
package external
|
|
|
|
import "testing"
|
|
|
|
func TestSplitRemote(t *testing.T) {
|
|
for _, tc := range []struct {
|
|
remote, host, ownerRepo string
|
|
ok bool
|
|
}{
|
|
{"ssh://git@git.hypertheory-labs.dev:2222/loom/loom-cli.git", "git.hypertheory-labs.dev", "loom/loom-cli", true},
|
|
{"ssh://git@git.hypertheory-labs.dev/loom/loom-cli.git", "git.hypertheory-labs.dev", "loom/loom-cli", true},
|
|
{"git@github.com:octocat/Hello-World.git", "github.com", "octocat/Hello-World", true},
|
|
{"https://gitlab.com/gitlab-org/gitlab-svgs.git", "gitlab.com", "gitlab-org/gitlab-svgs", true},
|
|
{"https://gitlab.com/gitlab-org/gitlab-svgs", "gitlab.com", "gitlab-org/gitlab-svgs", true},
|
|
// A nested group is not owner/repo, and guessing would produce a URL
|
|
// that answers about the wrong repository.
|
|
{"https://gitlab.com/group/sub/project.git", "", "", false},
|
|
{"/srv/git/bare.git", "", "", false},
|
|
{"", "", "", false},
|
|
} {
|
|
host, or, ok := splitRemote(tc.remote)
|
|
if ok != tc.ok || host != tc.host || or != tc.ownerRepo {
|
|
t.Errorf("splitRemote(%q) = (%q, %q, %v), want (%q, %q, %v)",
|
|
tc.remote, host, or, ok, tc.host, tc.ownerRepo, tc.ok)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestSelfVisibilityUnknownOutsideARepo(t *testing.T) {
|
|
// Failing open matters: "cannot tell" must not read as "not public".
|
|
if _, known := selfVisibility(t.TempDir()); known {
|
|
t.Error("selfVisibility in a non-repository reported a known answer")
|
|
}
|
|
}
|