Scope gh CLI through the git broker instead of disabling it

[nananek]

Summary

• PR Add repo-scoped git credential broker for the sandbox #4 disabled gh entirely inside the sandbox (its API calls hit api.github.com over TLS and can't be repo-scoped by inspecting traffic), which meant a sandboxed Claude session could never delegate PR/issue workflows -- only plain git push to allow-listed repos.
• This rewires gh instead of disabling it: invocations inside the sandbox are relayed to the same host-side git-broker used for git HTTPS/SSH credentials. The broker executes a safelisted subset of gh subcommands for real, using the host's own gh auth, after checking every repo the invocation could target against the same allow-list already computed for git.
• Allowed: pr (create/view/list/edit/comment/merge/close/reopen/ready/review/checks/diff/status/checkout), issue (create/view/list/edit/comment/close/reopen/status), release (create/view/list/edit/delete/upload/download/delete-asset), workflow (run/view/list/enable/disable), repo view.
• Refused (default-deny, not on the safelist): gh api (arbitrary API endpoint, not repo-scoped at all), gh auth/secret/variable/ssh-key/gpg-key (credential/secret management), gh repo clone/fork/create/delete/rename (target repo is a bare positional argument with subcommand-specific parsing -- not implemented).
• Target repo resolution now checks every repo an invocation could resolve to, not just one: explicit --repo/-R, any URL-shaped positional argument (pr view <pr-url>, etc.), a bare owner/repo positional for repo view, or -- only when none of those are present -- the session cwd's own origin remote.
• The sandboxed process never sees a gh token: the real gh binary runs on the host, inside the broker, with no TTY attached, so only non-interactive usage (flags/stdin, no editor prompts) works through this bridge.

Bugs found and fixed during review (before merge)

1. allowHalfOpen: net.createServer defaults to allowHalfOpen: false. The credential-request path responds synchronously (same tick), so this never mattered before. The new gh-exec path is async (spawns and awaits a real gh child process), and without allowHalfOpen: true the socket's write side was silently auto-closed by Node as soon as it saw the client's half-close -- every gh-exec response was discarded before it could be sent. Fixed by passing { allowHalfOpen: true } to createServer.
2. Bundled short flags (e.g. -wR owner/repo, pflag/Cobra shorthand for -w -R owner/repo): the broker's own parsing only recognized a bare -R, so a bundled -wR was invisible to it and it would validate the (allow-listed) cwd repo while the real gh binary -- parsing the same argv with its complete grammar -- acted on the bundled flag's actual (unchecked) target. Fixed by refusing any short-dash token that could plausibly be bundling multiple flags, rather than trying to reimplement gh's full shorthand grammar.
3. Positional URLs: pr view/checkout/diff/merge/close/edit etc. accept <number>|<url>|<branch>; when given a URL, gh resolves the repo from it, ignoring --repo/cwd entirely. gh pr merge <url-to-unrelated-repo> previously sailed through as "no --repo given, use cwd's repo" while actually merging a PR in a completely different, unchecked repo -- and this is the ordinary way to act on a pasted PR link, not an obscure edge case. Fixed by scanning argv for URL-shaped (and, for repo view, bare owner/repo-shaped) tokens and requiring every one found to be allow-listed too.

Also in this PR: unit tests + CI

The repo had no CI and no unit tests (only a Playwright e2e suite). Given this code is security-load-bearing and review already found real bugs in it by hand, added:

• server/ws/gitAllowlist.test.js, server/ws/ghAllowlist.test.js, server/ws/git-broker.test.js (real end-to-end socket protocol test, including a regression test for the allowHalfOpen bug above) using Node's built-in test runner (node --test, no new dependency). Run via npm test.
• .github/workflows/ci.yml: one job runs npm test plus a node --check syntax pass over all of server/; a second job runs the existing Playwright e2e suite. Both on push/PR to master.

Test plan

• npm test -- 63 assertions across the three new test files, all passing
• pr view with no --repo, resolved from the session cwd's origin remote, allowed and executed for a repo in the allow-list
• gh api /user refused (subcommand-not-allowed)
• pr view --repo <unrelated> refused (not-allowlisted) -- an explicit --repo doesn't bypass the check
• pr view -wR <unrelated> 5 (bundled flag) refused (ambiguous-flags)
• pr merge <url-to-unrelated-repo> refused (not-allowlisted) even though cwd itself is allow-listed
• pr view <url-to-the-allow-listed-repo>/pull/N allowed (URL correctly truncated to owner/repo, ignoring the /pull/N suffix)
• gh repo clone <anything> refused (subcommand-not-allowed)

Known limitations (documented in README)

• Same as the git broker generally: not a hard boundary against a deliberately-bypassing process, and not a hard boundary at all when docker: true (default) -- a container started via docker run inside the sandbox doesn't inherit the gh/ssh wrapper binds and can mount the forwarded ssh-agent socket directly.
• gh commands relayed through the broker must be non-interactive; editor/prompt-based flows (e.g. gh pr create with no flags) don't work.
• gh repo clone/fork/create/delete/rename remain unsupported.
• Bundled short flags (e.g. -wR) are refused outright rather than parsed; use long-form or separate flags instead.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YNFA5BLgmig7RswZypScjX