refactor(tooling): share repository Git adapters

evals/triage-finding/sastbench/scripts/hydrate-sastbench-repos.js

@@ -74,11 +74,11 @@ function buildHydrationPlan(records, { cacheRoot = DEFAULT_CACHE_ROOT, targetRoo
   }));
 }
 
-function runGit(args, cwd) {
+function runGit(args, cwd, stderr = "pipe") {
   return childProcess.execFileSync("git", args, {
     cwd,
     encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"],
+    stdio: ["ignore", "pipe", stderr],
   });
 }
 
@@ -178,6 +178,7 @@ if (require.main === module) {
 }
 
 module.exports = {
+  runGit,
   DEFAULT_CACHE_ROOT,
   parseArgs,
   repositoryCacheId,

evals/triage-finding/scripts/hydrate-calibration-repos.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 "use strict";
 
-const childProcess = require("node:child_process");
+const { runGit } = require("../sastbench/scripts/hydrate-sastbench-repos");
 const fs = require("node:fs");
 const path = require("node:path");
 
@@ -67,21 +67,9 @@ function plannedJobs(dataset, args) {
   return jobs;
 }
 
-function runGit(args, cwd) {
-  childProcess.execFileSync("git", args, {
-    cwd,
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"],
-  });
-}
-
 function gitOutput(args, cwd) {
   try {
-    return childProcess.execFileSync("git", args, {
-      cwd,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-    }).trim();
+    return runGit(args, cwd, "ignore").trim();
   } catch {
     return null;
   }

plugins/codex-security/mcp-app/scripts/git.d.mts

@@ -0,0 +1,6 @@
+import type { ExecFileSyncOptions } from "node:child_process";
+
+export function gitText(
+  args: readonly string[],
+  options?: Omit<ExecFileSyncOptions, "encoding">,
+): string;

plugins/codex-security/mcp-app/scripts/git.mjs

@@ -0,0 +1,5 @@
+import { execFileSync } from "node:child_process";
+
+export function gitText(args, options) {
+  return execFileSync("git", args, { ...options, encoding: "utf8" });
+}

plugins/codex-security/mcp-app/tests/test_compact_artifact_server.mjs

@@ -1,3 +1,4 @@
+import { gitText } from "../scripts/git.mjs";
 import { readOnlyParentSandboxState } from "./sandbox-state.mjs";
 import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
@@ -65,8 +66,7 @@ async function testCompactDiffScanCompletion(bundle, runtimeLabel) {
     mkdir(scanRoot, { recursive: true }),
   ]);
   const git = (...arguments_) =>
-    execFileSync(
-      "git",
+    gitText(
       [
         "-c",
         "user.name=Fixture",

plugins/codex-security/mcp-app/tests/test_mcp_app_smoke.mjs

@@ -1,3 +1,4 @@
+import { gitText } from "../scripts/git.mjs";
 import { assertNoError } from "./assertions.mjs";
 import { readOnlyParentSandboxState } from "./sandbox-state.mjs";
 import assert from "node:assert/strict";
@@ -161,9 +162,7 @@ execFileSync("git", [
   "-qm",
   "fixture",
 ]);
-const gitBase = execFileSync("git", ["-C", gitTarget, "rev-parse", "HEAD"], {
-  encoding: "utf8",
-}).trim();
+const gitBase = gitText(["-C", gitTarget, "rev-parse", "HEAD"]).trim();
 await writeFile(path.join(gitTarget, "fixture.txt"), "fixture\nupdated\n");
 execFileSync("git", ["-C", gitTarget, "add", "fixture.txt"]);
 execFileSync("git", [
@@ -177,9 +176,7 @@ execFileSync("git", [
   "-qm",
   "update fixture",
 ]);
-const gitHead = execFileSync("git", ["-C", gitTarget, "rev-parse", "HEAD"], {
-  encoding: "utf8",
-}).trim();
+const gitHead = gitText(["-C", gitTarget, "rev-parse", "HEAD"]).trim();
 
 function startTestServer({
   args = [serverPath, "--stdio"],

sdk/typescript/scripts/release-pr.mjs

@@ -1,3 +1,4 @@
+import { gitText } from "../../../plugins/codex-security/mcp-app/scripts/git.mjs";
 import { execFileSync } from "node:child_process";
 import { hash } from "node:crypto";
 import { setTimeout as delay } from "node:timers/promises";
@@ -223,11 +224,7 @@ export function createReleasePlan(history, previous = null) {
 
 export function createGitRepository(directory) {
   const git = (...args) =>
-    execFileSync("git", args, {
-      cwd: directory,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"],
-    });
+    gitText(args, { cwd: directory, stdio: ["pipe", "pipe", "pipe"] });
   return {
     git,
     ensureCommit(sha) {

sdk/typescript/tests-ts/git-fixture.ts

@@ -1,15 +1,14 @@
-import { execFileSync } from "node:child_process";
+import { gitText } from "./support/shell.js";
 
 export function git(repository: string, ...args: string[]): string {
-  return execFileSync(
-    "git",
+  return gitText(
     [
       "-c",
       "user.name=Fixture",
       "-c",
       "user.email=fixture@example.com",
       ...args,
     ],
-    { cwd: repository, encoding: "utf8" },
+    { cwd: repository },
   ).trim();
 }

sdk/typescript/tests-ts/release-pr.test.ts

@@ -1,4 +1,4 @@
-import { execFileSync } from "node:child_process";
+import { gitText } from "./support/shell.js";
 import { mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -219,10 +219,9 @@ class Fixture {
       if (content === null) {
         this.git("update-index", "--force-remove", "--", path);
       } else {
-        const blob = execFileSync("git", ["hash-object", "-w", "--stdin"], {
+        const blob = gitText(["hash-object", "-w", "--stdin"], {
           cwd: this.directory,
           input: content,
-          encoding: "utf8",
           stdio: ["pipe", "pipe", "pipe"],
         }).trim();
         this.git("update-index", "--add", "--cacheinfo", "100644", blob, path);

sdk/typescript/tests-ts/support/shell.ts

@@ -1,3 +1,4 @@
+export { gitText } from "../../../../plugins/codex-security/mcp-app/scripts/git.mjs";
 import { execFile } from "node:child_process";
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";