Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions src/praisonai-agents/praisonaiagents/tools/github_tools.py
Original file line number Diff line number Diff line change
Expand Up @@ -7,14 +7,24 @@
@tool
def github_create_branch(branch_name: str) -> str:
"""Create and checkout a new git branch.


Args:
branch_name: The name of the branch to create and checkout.
"""
try:
# Check if we are in a git repository
subprocess.run(["git", "rev-parse", "--is-inside-work-tree"], check=True, capture_output=True)
# Validate branch name to prevent misinterpretation as git options or invalid refs
try:
subprocess.run(
["git", "check-ref-format", "--branch", branch_name],
check=True, capture_output=True, text=True
)
except subprocess.CalledProcessError as e:
return f"Error: invalid branch name '{branch_name}': {e.stderr.strip() if e.stderr else 'branch name is not a valid git ref'}"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major | ⚡ Quick win

Add remediation hint to the error message.

The error message returned on validation failure lacks a remediation hint explaining how to fix the invalid branch name. As per coding guidelines, error messages must include remediation hints to improve debugging and user experience.

Consider adding guidance such as valid branch naming rules or a reference to git documentation.

📝 Suggested improvement
         except subprocess.CalledProcessError as e:
-            return f"Error: invalid branch name '{branch_name}': {e.stderr.strip() if e.stderr else 'branch name is not a valid git ref'}"
+            git_error = e.stderr.strip() if e.stderr else 'branch name is not a valid git ref'
+            return f"Error: invalid branch name '{branch_name}': {git_error}. Branch names must be valid git refs (avoid special characters, leading slashes, or dots)."

As per coding guidelines, error messages must include remediation hints and propagate context for debugging.

🧰 Tools
🪛 ast-grep (0.43.0)

[error] 24-24: Command coming from incoming request
Context: subprocess.run(["git", "checkout", "-B", branch_name], check=True, capture_output=True, text=True)
Note: [CWE-20].

(subprocess-from-request)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/praisonai-agents/praisonaiagents/tools/github_tools.py` at line 24, The
error message for invalid branch name validation in the branch name validation
block lacks a remediation hint to help users fix the issue. Enhance the error
message by appending guidance about valid branch naming conventions (such as
what characters are allowed, restrictions on branch names, or a reference to git
naming guidelines) to help users understand how to provide a valid branch name
instead of just reporting that it is invalid.

Source: Coding guidelines

Comment on lines +19 to +25

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 --branch flag resolves shorthands instead of just validating

git check-ref-format --branch <name> is designed to resolve shorthand notation like @{-1} (previous branch) — if @{-1} is passed, the command exits 0 (success) because it resolves to a real branch name. The raw string is then forwarded unchanged to git checkout -B @{-1}, where git again resolves the shorthand and resets the previously checked-out branch to the current HEAD, silently overwriting it. The function then returns a success message with the literal string @{-1}.

To strictly validate the literal branch name, use git check-ref-format refs/heads/<branch_name> instead, which rejects shorthands and any characters illegal in a branch ref.

Suggested change
try:
subprocess.run(
["git", "check-ref-format", "--branch", branch_name],
check=True, capture_output=True, text=True
)
except subprocess.CalledProcessError as e:
return f"Error: invalid branch name '{branch_name}': {e.stderr.strip() if e.stderr else 'branch name is not a valid git ref'}"
# Validate branch name to prevent misinterpretation as git options or invalid refs
try:
subprocess.run(
["git", "check-ref-format", f"refs/heads/{branch_name}"],
check=True, capture_output=True, text=True
)
except subprocess.CalledProcessError as e:
return f"Error: invalid branch name '{branch_name}': {e.stderr.strip() if e.stderr else 'branch name is not a valid git ref'}"

subprocess.run(["git", "checkout", "-B", branch_name], check=True, capture_output=True, text=True)
Comment thread
coderabbitai[bot] marked this conversation as resolved.
logger.debug(f"Branch '{branch_name}' checked out successfully.")
logger.debug(f"Successfully checked out branch '{branch_name}'")
return f"Successfully created and checked out branch '{branch_name}'"
except subprocess.CalledProcessError as e:
Expand Down
Loading