Skip to content

v1.0.2 — Auto Remote Setup & Security Hardening

Choose a tag to compare

View all tags
@dris1153 dris1153 released this 29 Mar 03:56
· 7 commits to main since this release
v1.0.2
c6d8f78
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

Scripts now auto-configure the upstream remote when UPSTREAM_URL is set in .env — no manual git remote add needed. Security audit fixed shell injection and incomplete input validation.

New Features

Auto Remote Setup

  • New ensureRemote() in git-utils.js — automatically runs git remote add upstream <url> if remote doesn't exist and UPSTREAM_URL is configured
  • Both upstream-status.js and conflict-preview.js use it before any operation
  • If neither remote nor URL is configured, provides clear guidance on what to set up
  • Does not touch origin — git push still goes to your fork

Cherry-pick Conflict Preview

  • New previewCherryPickConflicts() analyzes a specific commit against locally modified files
  • Usage: node conflict-preview.js --strategy cherry-pick --commit <hash>
  • Reports which files in the target commit overlap with local changes

Security Fixes

  • Shell injection eliminated — execSync replaced with execFileSync + args array across all git calls
  • Input validation — validateArg() regex on all user-facing args (remote, branch, commit, since)
  • NaN guard — --limit falls back to default on invalid input

Bug Fixes

  • Truncated merge-base regression — previewRebaseConflicts now uses full hash internally, truncates only for display
  • Silent fetch failures — fetchRemote() returns boolean, callers surface warnings in both text and JSON output
  • Missing test in npm test — git-utils.test.js added to package.json test script
  • fetchWarning in JSON — conflict-preview.js now includes fetchWarning in JSON output (matching upstream-status.js)

Configuration

New .env variable:

# URL of the original repo (auto-creates remote if not configured)
UPSTREAM_URL=https://github.com/original-author/original-repo.git

Setup flow:

origin   → your fork (unchanged, git push still works)
upstream → original repo (auto-created from UPSTREAM_URL)

Tests

  • 26 tests, all passing (was 25)
  • Added cherry-pick strategy test with real git repos

v1.0.0 — Upstream Sync Skill for Claude Code

What's New

A Claude Code agent skill that automates syncing forked/cloned open source repositories with upstream changes.

Core Scripts

  • upstream-status.js — Detects upstream remote, fetches latest commits, lists new changes with diffstat and ahead/behind counts
  • conflict-preview.js — Dry-run merge/rebase conflict detection with file-level risk categorization (HIGH/LOW) and actionable recommendations (SAFE_TO_MERGE, MERGE_WITH_MANUAL_RESOLUTION, CONSIDER_CHERRY_PICK)
  • git-utils.js — Shared utilities with git wrapper, .env cascade loading

Integration Strategies

  • Merge — Full branch integration with conflict analysis
  • Rebase — Linear history with local commit replay count estimation

Reference Guides

  • 5-phase sync workflow (setup, review, analyze, integrate, verify)
  • Upstream commit review methodology with decision matrix
  • Conflict resolution strategies prioritized by dependency order

Quality

  • 25 integration tests using real temporary git repos (zero mocks)
  • Zero runtime dependencies — Node.js >= 18 only
  • Cross-platform support (Linux/macOS/Windows)

Documentation

  • Full README with installation (copy/symlink), CLI usage examples, sample outputs, and real-world scenarios
Assets 2
Loading