JATMNandClaude Opus 5.5 30637193a6 fix(node): resolve issue ids from git refnames, not request input (#526) ...

* fix(node): resolve issue ids from git refnames, not request input

resolve_issue_id answered an exact match by echoing the request-path id
back to callers, so get_issue and close_issue spliced caller input into
`git cat-file blob refs/gitlawb/issues/<id>`. #521 restricted the input
to [A-Za-z0-9-], but the value handed to git was still the request
string (CodeQL rust/command-line-injection #83).

Resolve exact and prefix lookups through one for-each-ref listing and
return the refname git reports. An exact refname still wins over longer
ids that share it as a prefix; unique-prefix, ambiguous, not-found, and
revision-syntax behavior is unchanged.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* fix(node): keep a dangling exact issue ref from winning over longer ids

for-each-ref lists a ref even when its blob is missing, so the exact-id
precedence added in the previous commit picked a dangling exact ref over a
readable longer sibling: resolve_issue_id returned the dangling id where
main reported an ambiguous prefix, get_issue then returned None, and
close_issue hit its expect().

Let the exact id win only when `git cat-file -e` finds its object, run on
git's own refname so no request input returns to the argv. Otherwise fall
through to the unchanged prefix rules, matching main for every layout.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: Claude Opus 5.5 <[email protected]>

2026-11-06 03:04:20 +00:00

..

src

fix(node): resolve issue ids from git refnames, not request input (#526)

2026-11-06 03:04:20 +00:00

tests

fix(node): fence a repo publish on the write attempt that owns it (#285)

2026-11-04 21:38:41 +00:00

Cargo.toml

chore: rebrand user-facing gitlawb references to Twigpine (#520)

2026-11-04 21:58:29 +00:00