feat(daemon): add POST /git/raw endpoint with allowlist validation

[guitavano]

Summary

• Adds POST /git/raw endpoint that exposes git.raw() with safety guardrails
• Allowlist of permitted subcommands: checkout, branch, stash, tag, log, show, diff, merge, cherry-pick, format-patch, describe, shortlog, rev-parse, rev-list, ls-files, ls-tree, cat-file
• Blocklist of dangerous flags regardless of subcommand: --force, -f, --hard, --global, --system, --exec
• Returns 400 with a descriptive message on validation failure
• Exports GitRawAPI type from daemon/mod.ts

Motivation

Reduces the need to add a dedicated endpoint for every new git operation. AI agents and admin tools can now run safe, non-destructive git commands without requiring daemon changes.

Test plan

• POST /git/raw { args: ["branch", "-a"] } → returns list of branches
• POST /git/raw { args: ["log", "--oneline", "-5"] } → returns recent commits
• POST /git/raw { args: ["push"] } → returns 400 (not in allowlist)
• POST /git/raw { args: ["checkout", "-f", "main"] } → returns 400 (blocked flag)
• POST /git/raw { args: ["config", "--global", "user.email", "x"] } → returns 400

Made with Cursor

---

Summary by cubic

Adds POST /git/raw to expose a safe subset of git.raw() via the daemon. Lets agents and tools run non-destructive git commands without adding new endpoints.

• New Features
  • Endpoint: POST /git/raw (body: { args: string[] }); responds with { result: string }.
  • Allowlist: checkout, branch, stash, tag, log, show, diff, merge, cherry-pick, format-patch, describe, shortlog, rev-parse, rev-list, ls-files, ls-tree, cat-file.
  • Blocked flags: --force, -f, --hard, --global, --system, --exec.
  • Returns 400 with a clear message on validation failure; exports GitRawAPI from daemon/mod.ts.

^{Written for commit 0bca69b. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c0a399ac-8248-496d-a599-2d0b34f567a8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/git-raw-endpoint

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Tagging Options

Should a new tag be published when this PR is merged?

• 👍 for Patch 1.194.2 update
• 🎉 for Minor 1.195.0 update
• 🚀 for Major 2.0.0 update

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="daemon/git.ts">

<violation number="1" location="daemon/git.ts:384">
P1: Blocked-flag check is bypassable via combined short flags (`-fb`) and `--flag=value` syntax (`--exec=cmd`). The exact-match `Set.has()` only catches flags written in isolation. For example, `["checkout", "-fb", "main"]` passes validation but git still interprets `-f`.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}