Add allod patch subcommand #78

Merged

vnprc merged 3 commits from agent/allod-patch into master

2026-06-30 22:59:19 +01:00

allod-agent commented

2026-06-30 22:45:49 +01:00

Member

Closes allod/tools#77

Adds allod patch with fetch, apply, and receive subcommands for transferring committed changes between environments as git format-patch artifacts.

Changes

allod: New patch namespace with fetch/apply/receive commands
docs/allod-patch.md: Usage documentation
tests/allod-patch.sh: 148 tests covering CLI routing, fetch, apply, and receive

Security

All SSH invocations use static remote command text
Dynamic values passed as base64-encoded stdin, never interpolated into shell commands
Remote tmpdir path validated against /tmp/allod-patch.XXXXXXXXXX pattern

Test plan

148 patch tests pass alongside 79 existing change tests
SSH mock validates static command text invariant
Covers: clean/dirty worktree, merge commits, empty ranges, manifest integrity, repo mismatch, base commit validation, conflict handling, push success/failure, receive cleanup

Closes allod/tools#77 Adds `allod patch` with `fetch`, `apply`, and `receive` subcommands for transferring committed changes between environments as `git format-patch` artifacts. ## Changes - `allod`: New `patch` namespace with fetch/apply/receive commands - `docs/allod-patch.md`: Usage documentation - `tests/allod-patch.sh`: 148 tests covering CLI routing, fetch, apply, and receive ## Security - All SSH invocations use static remote command text - Dynamic values passed as base64-encoded stdin, never interpolated into shell commands - Remote tmpdir path validated against `/tmp/allod-patch.XXXXXXXXXX` pattern ## Test plan - 148 patch tests pass alongside 79 existing change tests - SSH mock validates static command text invariant - Covers: clean/dirty worktree, merge commits, empty ranges, manifest integrity, repo mismatch, base commit validation, conflict handling, push success/failure, receive cleanup

allod-agent added 2 commits

2026-06-30 22:45:50 +01:00

Add allod patch subcommand for transferring patches between environments 69765f6430

Add allod-patch documentation and tests e2e685e9f3

allod-agent added 1 commit

2026-06-30 22:50:05 +01:00

Add missing test coverage from review: control-char filenames, tmpdir validation, unwritable parent ba0158c2c8

allod-agent commented

2026-06-30 22:50:23 +01:00

Author

Member

Review findings:

Missing test: control-character filenames — is_safe_patch_name rejects control chars but had no dedicated test. Added.
Missing test: remote tmpdir validation edge cases — Empty, relative, wrong-prefix, and traversal tmpdir paths from the generate step are security-relevant validation paths. Added via new bad_tmpdir_* mock SSH mode.
Missing test: --output with unwritable parent — Dev plan specified this case. Added.
resolve_git_repo uses workspace_is_repo_root — This means patch apply rejects repos outside the allod workspace model. Intentional given the tool's scope, but worth noting.
No security vulnerabilities found. SSH command surface is correctly static with base64 stdin transport.

All findings addressed in ba0158c. 159 patch tests + 79 change tests pass.

Review findings: 1. **Missing test: control-character filenames** — `is_safe_patch_name` rejects control chars but had no dedicated test. Added. 2. **Missing test: remote tmpdir validation edge cases** — Empty, relative, wrong-prefix, and traversal tmpdir paths from the generate step are security-relevant validation paths. Added via new `bad_tmpdir_*` mock SSH mode. 3. **Missing test: `--output` with unwritable parent** — Dev plan specified this case. Added. 4. **`resolve_git_repo` uses `workspace_is_repo_root`** — This means `patch apply` rejects repos outside the allod workspace model. Intentional given the tool's scope, but worth noting. 5. No security vulnerabilities found. SSH command surface is correctly static with base64 stdin transport. All findings addressed in ba0158c. 159 patch tests + 79 change tests pass.