Skip to content

fix: allow optional HEAD ref through the git-gate#11

Merged
Trifunovich merged 2 commits into
mainfrom
fix/gate-accept-diff-head
Jul 14, 2026
Merged

fix: allow optional HEAD ref through the git-gate#11
Trifunovich merged 2 commits into
mainfrom
fix/gate-accept-diff-head

Conversation

@Trifunovich

Copy link
Copy Markdown
Contributor

Problem

After the diff view switched to git diff HEAD / git diff --numstat HEAD (commit b764919, to show staged new/deleted files), gated machines started rendering a "Git error — Remote gate refused command" page on the diff view.

Root cause: the forced-command SSH gate (gate/git-gate.sh, gate/git-gate.ps1) only permits an exact set of command shapes and never had the ref-bearing diff forms added when the app change shipped. The gate rejected git … diff HEAD with difflab: command not permitted, which classify_error maps to GATE_REJECTED → "Remote gate refused command".

Status/batch-status use status --short (unchanged), so the machine list kept working and only the diff view broke. Local targets bypass the gate entirely, which is why it wasn't caught before deployment.

Fix

  • Accept an optional trailing HEAD on both diff and diff --numstat shapes in both gate scripts, and pass it through to git unchanged.
  • Ref-less forms still work (older app builds); any other ref stays rejected.
  • Added gate tests: diff, diff HEAD, numstat HEAD, legacy ref-less, arbitrary-ref rejection, and an end-to-end pass-through proving a staged-only file appears under diff HEAD but not plain diff.

Full suite: 227 passed.

Deployment note

The gate script is installed on each enrolled machine (/usr/local/lib/difflab/git-gate.sh, C:\ProgramData\difflab\git-gate.ps1). Merging this does not fix already-deployed machines — the updated gate script must be reinstalled on each enrolled host for the diff view to recover there.

The <dialog> element injected into each diff file section had height: 92vh
but no explicit display: none for browsers without full <dialog> support.
In those browsers the hidden dialog rendered as a 92vh-tall block, creating
a massive empty black region below the diff content.

Add display: none to .file-dialog and an explicit dialog[open] override to
restore visibility when showModal() is called.
The diff view switched to `git diff HEAD` / `git diff --numstat HEAD` so
staged new and deleted files show up, but the forced-command SSH gate only
permitted the ref-less diff forms. On gated (remote) machines every diff
request was refused with "difflab: command not permitted", which the app
surfaces as "Remote gate refused command". Status and batch-status were
unaffected, so only the diff view broke.

Accept an optional trailing HEAD on both diff shapes in git-gate.sh and
git-gate.ps1 and pass it through to git unchanged. The ref-less forms still
work for older app builds, and any other ref is still rejected.

Add gate tests covering diff, diff HEAD, numstat HEAD, the legacy ref-less
form, arbitrary-ref rejection, and end-to-end pass-through proving a staged
file appears under `diff HEAD` but not plain `diff`.
@Trifunovich Trifunovich merged commit 1e00d37 into main Jul 14, 2026
1 check passed
@Trifunovich Trifunovich deleted the fix/gate-accept-diff-head branch July 14, 2026 05:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant