feat(passthrough): per-verb passthrough builder + -C hoist rewriter (from git_passthrough) #101

New issue

Closed

opened 2026-06-07 04:07:45 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-06-07 04:07:45 +00:00

Owner

Extraction candidate from the coily cmd/coily/ generic-code audit (2026-06-06). Source pinned at coily commit c7c17cb (canonical: forgejo.coilysiren.me/coilyco-bridge/coily). cli-guard is mid-refactor, so the "suggested home" below is the pre-refactor package layout - land this in whatever the post-refactor equivalent is, not necessarily the named package. The durable principle: the classifiers / argv-transforms are generic and move; the policy decisions and message copy stay in coily.

Source: cmd/coily/git_passthrough.go - builds the coily git <verb> thin-passthrough set over passthrough.Command, with gitVerbRewriter that prepends the git subcommand and hoists a leading -C <path>.

What it does: fronts a multi-verb binary (git) as per-verb audited passthroughs, so the group name can also host hardened subcommands (e.g. the git commit of cli-guard#93). The -C-hoist rewriter is the reusable nugget.

Generic core (lift this): the -C-hoisting rewriter (gitVerbRewriter) and the per-verb-passthrough builder convenience over the existing passthrough primitive.

Consumer seams to parameterize: the "git."+verb audit-verb prefix and the coily git-flavored usage strings. No paths/orgs/SSM involved.

Suggested home (pre-refactor): extend passthrough.

Done when:

generic logic lives in cli-guard with zero coily/Kai/Forgejo identifiers or defaults
behavior-covered tests (table tests where the source has them)
godoc-current.txt regenerated (scripts/check-godoc-current.sh --update)
coily migrated onto the extracted API, its local copy deleted, make test green both sides
closes this issue

Related: pairs with cli-guard#93 (the hardened git commit that replaces the thin passthrough for that one verb).

> Extraction candidate from the coily `cmd/coily/` generic-code audit (2026-06-06). Source pinned at coily commit `c7c17cb` (canonical: `forgejo.coilysiren.me/coilyco-bridge/coily`). **cli-guard is mid-refactor**, so the "suggested home" below is the pre-refactor package layout - land this in whatever the post-refactor equivalent is, not necessarily the named package. The durable principle: **the classifiers / argv-transforms are generic and move; the policy decisions and message copy stay in coily.** **Source:** `cmd/coily/git_passthrough.go` - builds the `coily git <verb>` thin-passthrough set over `passthrough.Command`, with `gitVerbRewriter` that prepends the git subcommand and hoists a leading `-C <path>`. **What it does:** fronts a multi-verb binary (git) as per-verb audited passthroughs, so the group name can also host hardened subcommands (e.g. the `git commit` of cli-guard#93). The `-C`-hoist rewriter is the reusable nugget. **Generic core (lift this):** the `-C`-hoisting rewriter (`gitVerbRewriter`) and the per-verb-passthrough builder convenience over the existing `passthrough` primitive. **Consumer seams to parameterize:** the `"git."+verb` audit-verb prefix and the `coily git`-flavored usage strings. No paths/orgs/SSM involved. **Suggested home (pre-refactor):** extend `passthrough`. **Done when:** - [ ] generic logic lives in cli-guard with zero coily/Kai/Forgejo identifiers or defaults - [ ] behavior-covered tests (table tests where the source has them) - [ ] `godoc-current.txt` regenerated (`scripts/check-godoc-current.sh --update`) - [ ] coily migrated onto the extracted API, its local copy deleted, `make test` green both sides - [ ] `closes` this issue **Related:** pairs with cli-guard#93 (the hardened `git commit` that replaces the thin passthrough for that one verb).

coilysiren referenced this issue

2026-06-10 18:16:01 +00:00

execverb: KDL exec dialect (wrap+exec transport) for passthrough/remote-exec verbs #130

coilysiren added the

label

2026-06-17 07:05:14 +00:00

coilysiren commented

2026-06-17 08:23:20 +00:00

Author

Owner

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: burndown-2026-06.

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: `burndown-2026-06`.

coilysiren

2026-06-17 08:23:21 +00:00