fix: reject remote-helper overrides skipped by -u

[EndBug]

Summary

matchGitArgs() treated -u as always consuming the next argv token. That is only true for git tag -u <key-id>. For git fetch (--update-head-ok) and git push (--set-upstream) it is a flag, so a following --upl= / --upload-pack token was never denylisted. simple-git’s own guard is a literal /--(upload|receive)-pack/ match and does not catch that abbreviation.

This change:

• Rejects remote-helper overrides (--upload-pack, --receive-pack, --exec, and unique abbreviations) on every token, including values after -m / --message
• Stops treating -u as a global value option, so it cannot skip the next token on fetch/push
• Keeps -m "-F" / --message "-F" as allowed message values
• Keeps git tag -u <key-id> (separate tokens) working

Tests

• Unit: -u --upl=evil, -u --upload-pack=evil, -m --upl=evil, and --message --exec=evil throw; v1.0.0 -u ABCDEF still parses
• Integration: dirty tree with fetch: '-u --upl=evil' fails the action with not allowed and does not commit
• npm test (unit + integration + lint) passed on the pre-commit hook after rebuilding lib/

  

Summary by CodeRabbit

• Bug Fixes

  • Strengthened Git argument validation to reject blocked remote-helper override options in all positions, including after -u, -m, and --message.
  • Correctly handles valid -u arguments without allowing unsafe options to be hidden as values.

• Documentation

  • Clarified Git argument validation behavior in the documentation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 127226d8-c6f9-4add-b0df-81a28409a30e

📥 Commits

Reviewing files that changed from the base of the PR and between d229871 and 5df9d06.

📒 Files selected for processing (5)

• README.md
• lib/index.js
• src/util.ts
• test/integration/action.test.ts
• test/util.test.ts

---

📝 Walkthrough

Walkthrough

matchGitArgs now rejects remote-helper overrides in every token, including values after -u, -m, and --message. Tests cover valid -u values and integration-level fetch rejection. The README documents the updated rule.

Changes

Remote-helper validation

Layer / File(s)	Summary
Validate every parsed token src/util.ts	matchGitArgs checks remote-helper options before skipping value tokens. -u is excluded from generic value-taking short options.
Cover accepted and rejected arguments test/util.test.ts, test/integration/action.test.ts, README.md	Tests cover valid -u values and blocked options after -u, -m, and --message. The integration test verifies that fetch rejects the blocked argument without changing HEAD or creating a commit. The README documents the rule.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 5df9d

This localized change tightens remote-helper argument rejection while preserving supported tag and message behavior; no actionable merge-blocking risk remains after normal checks and review.

Possibly related PRs

• EndBug/add-and-commit#754: Extends the earlier matchGitArgs remote-helper rejection behavior to values after -u, -m, and --message.
• EndBug/add-and-commit#760: Modifies matchGitArgs and related tests for a different argument-validation case.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main fix: rejecting remote-helper overrides that appear after -u.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/fix-u-denylist-bypass-2fdd

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}