Implement git command handler and improve subshell normalization

Adds a specialized handler for git to normalize common flags (message,
author, count) and stash references. Also improves general shell
normalization for herestrings, line continuations, and recursive
subshell processing.

Author: micthiesen

README.md

@@ -83,7 +83,8 @@ about specific commands where positional arguments have known semantics:
 
 ### Subshell safety
 
-Handlers preserve `$(...)` verbatim. `echo hello` and `echo $(rm -rf /)`
+Subshell expressions like `$(...)` are recursively normalized but never
+collapsed to a data placeholder. `echo hello` and `echo $(rm -rf /)`
 always produce different shapes. This is enforced by tests on every handler.
 
 ## Use as a library

handler.go

@@ -8,6 +8,7 @@ var redirectConsumeNext = map[string]bool{
 	">": true, ">>": true, "<": true,
 	"&>": true, "&>>": true,
 	"2>": true, "2>>": true, "1>": true,
+	"<<<": true,
 }
 
 var redirectStandalone = map[string]bool{
@@ -29,7 +30,11 @@ func splitRedirects(tokens []string) (args, redirects []string) {
 
 		if redirectConsumeNext[tok] {
 			if i+1 < len(tokens) {
-				redirects = append(redirects, tok, "<path>")
+				placeholder := "<path>"
+				if tok == "<<<" {
+					placeholder = "<str>"
+				}
+				redirects = append(redirects, tok, placeholder)
 				i += 2
 			} else {
 				redirects = append(redirects, tok)

handler_git.go

@@ -0,0 +1,219 @@
+package shellshape
+
+import (
+	"regexp"
+	"strings"
+)
+
+func init() {
+	Register("git", handleGit, HandlerOptions{HasSubcommands: true})
+}
+
+var stashRefRE = regexp.MustCompile(`^stash@\{\d+\}$`)
+
+// handleGit handles git subcommand arguments.
+// Since git is in subcommandExecutables, the subcommand (commit, push, log, etc.)
+// is already consumed before this handler is called.
+//
+// Message flags (-m, --message) collapse their argument to <str>.
+// Value flags (--author, --format, --since, --onto, etc.) collapse to <val>.
+// Numeric flags (-n, --depth, -U) collapse to N.
+// Path flags (-C, -f, --pathspec-from-file) collapse to <path>.
+// Global config flags (-c key=value) collapse to <val>.
+// Boolean flags are kept verbatim.
+// Stash references (stash@{N}) normalize the index to N.
+// Remaining positionals use classifyToken.
+func handleGit(subcommand string, tokens []string) []string {
+	args, redirects := splitRedirects(tokens)
+
+	// Long flags that can appear with = and should collapse the value.
+	eqValFlags := map[string]bool{
+		"--pretty": true,
+		"--format": true,
+	}
+
+	// Flags whose next token is a message string.
+	msgFlags := map[string]bool{
+		"-m": true, "--message": true,
+	}
+
+	// Flags whose next token is a generic value.
+	valFlags := map[string]bool{
+		"--author": true,
+		"--date":   true,
+		"--format": true,
+		"--pretty": true,
+		"--since":  true, "--after": true,
+		"--until": true, "--before": true,
+		"--grep":            true,
+		"--diff-filter":     true,
+		"--onto":            true,
+		"--set-upstream-to": true,
+		"--strategy":        true, "-s": true,
+		"--strategy-option": true, "-X": true,
+		"--remote":  true,
+		"-c":        true,
+		"--cleanup": true,
+		"-C":        true,
+		"--fixup":   true,
+		"--squash":  true,
+		"--trailer": true,
+		"--output":  true, "-o": true,
+	}
+
+	// Flags whose next token is a number.
+	numericFlags := map[string]bool{
+		"-n": true, "--max-count": true,
+		"--depth": true, "--deepen": true,
+		"-U": true, "--unified": true,
+		"-j": true, "--jobs": true,
+		"--skip":   true,
+		"--abbrev": true,
+	}
+
+	// Flags whose next token is a path.
+	pathFlags := map[string]bool{
+		"-f": true, "--file": true,
+		"--pathspec-from-file": true,
+		"--work-tree":          true,
+		"--git-dir":            true,
+		"--template":           true,
+	}
+
+	// Fused short flags where -m is combined with other flags (e.g., -am).
+	// When we see -am, we know -m consumes the next token as a message.
+	isFusedMsgFlag := func(tok string) bool {
+		if len(tok) < 3 || tok[0] != '-' || tok[1] == '-' {
+			return false
+		}
+		// -am, -sm, etc. — ends with 'm'
+		return tok[len(tok)-1] == 'm'
+	}
+
+	var result []string
+	configKeysSeen := 0
+	i := 0
+	for i < len(args) {
+		tok := args[i]
+
+		if isSubshellToken(tok) {
+			result = append(result, tok)
+			i++
+			continue
+		}
+
+		// Stash references: stash@{0}, stash@{2} → stash@{N}
+		if stashRefRE.MatchString(tok) {
+			result = append(result, "stash@{N}")
+			i++
+			continue
+		}
+
+		if msgFlags[tok] {
+			result = append(result, tok)
+			i++
+			if i < len(args) {
+				if isSubshellToken(args[i]) {
+					result = append(result, args[i])
+				} else {
+					result = append(result, "<str>")
+				}
+				i++
+			}
+			continue
+		}
+
+		// Fused message flags like -am
+		if isFusedMsgFlag(tok) {
+			result = append(result, tok)
+			i++
+			if i < len(args) {
+				if isSubshellToken(args[i]) {
+					result = append(result, args[i])
+				} else {
+					result = append(result, "<str>")
+				}
+				i++
+			}
+			continue
+		}
+
+		if valFlags[tok] {
+			result = append(result, tok)
+			i++
+			if i < len(args) {
+				if isSubshellToken(args[i]) {
+					result = append(result, args[i])
+				} else {
+					result = append(result, "<val>")
+				}
+				i++
+			}
+			continue
+		}
+
+		if numericFlags[tok] {
+			result = append(result, tok)
+			i++
+			if i < len(args) {
+				if isSubshellToken(args[i]) {
+					result = append(result, args[i])
+				} else {
+					result = append(result, "N")
+				}
+				i++
+			}
+			continue
+		}
+
+		if pathFlags[tok] {
+			result = append(result, tok)
+			i++
+			if i < len(args) {
+				if isSubshellToken(args[i]) {
+					result = append(result, args[i])
+				} else {
+					result = append(result, "<path>")
+				}
+				i++
+			}
+			continue
+		}
+
+		// Handle --flag=value forms for known flags.
+		// Use classifyToken for consistent treatment with the generic path.
+		if strings.HasPrefix(tok, "--") && strings.Contains(tok, "=") {
+			eqIdx := strings.Index(tok, "=")
+			flagName := tok[:eqIdx]
+			if eqValFlags[flagName] || valFlags[flagName] || msgFlags[flagName] || pathFlags[flagName] || numericFlags[flagName] {
+				result = append(result, flagName+"=<val>")
+				i++
+				continue
+			}
+		}
+
+		if isFlagToken(tok) {
+			result = append(result, tok)
+			i++
+			continue
+		}
+
+		// Config subcommand: second positional (after the key) is a value.
+		if subcommand == "config" && configKeysSeen > 0 {
+			result = append(result, "<val>")
+			i++
+			continue
+		}
+
+		// Positional: classify generically
+		classified := classifyToken(tok)
+		if subcommand == "config" && classified == "<dotted-id>" {
+			configKeysSeen++
+		}
+		result = append(result, classified)
+		i++
+	}
+
+	result = append(result, redirects...)
+	return result
+}

handler_git_test.go

@@ -0,0 +1,147 @@
+package shellshape
+
+import "testing"
+
+func TestGit(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		// commit
+		{"commit with message", "git commit -m 'fix login bug'", "git commit -m <str>"},
+		{"commit with long message flag", "git commit --message 'update readme'", "git commit --message <str>"},
+		{"commit with author", "git commit --author 'John Doe <john@example.com>'", "git commit --author <val>"},
+		{"commit amend no edit", "git commit --amend --no-edit", "git commit --amend --no-edit"},
+		{"commit specific files", "git commit -m 'fix' src/main.go src/util.go", "git commit -m <str> <path>+"},
+		{"commit all with message", "git commit -am 'quick fix'", "git commit -am <str>"},
+
+		// add
+		{"add single file", "git add src/main.go", "git add <path>"},
+		{"add multiple files", "git add file1.js file2.js file3.js", "git add <path>+"},
+		{"add all", "git add -A", "git add -A"},
+		{"add patch", "git add -p src/main.go", "git add -p <path>"},
+
+		// push / pull / fetch
+		{"push simple", "git push", "git push"},
+		{"push remote branch", "git push origin main", "git push origin main"},
+		{"push force", "git push --force-with-lease origin feature/foo", "git push --force-with-lease origin <path>"},
+		{"pull", "git pull origin main", "git pull origin main"},
+		{"pull rebase", "git pull --rebase", "git pull --rebase"},
+		{"fetch", "git fetch --all", "git fetch --all"},
+		{"fetch prune", "git fetch --prune origin", "git fetch --prune origin"},
+
+		// log
+		{"log simple", "git log --oneline", "git log --oneline"},
+		{"log with count", "git log -n 10 --oneline", "git log -n N --oneline"},
+		{"log with format", "git log --format '%H %s'", "git log --format <val>"},
+		{"log with pretty", "git log --pretty=oneline", "git log --pretty=<val>"},
+		{"log with author filter", "git log --author john", "git log --author <val>"},
+		{"log since", "git log --since '2024-01-01'", "git log --since <val>"},
+
+		// diff
+		{"diff simple", "git diff", "git diff"},
+		{"diff staged", "git diff --staged", "git diff --staged"},
+		{"diff with file", "git diff HEAD src/main.go", "git diff HEAD <path>"},
+		{"diff rev range", "git diff main...feature", "git diff <range>"},
+		{"diff context lines", "git diff -U 5", "git diff -U N"},
+
+		// clone
+		{"clone https", "git clone https://github.com/user/repo.git", "git clone <https-uri>"},
+		{"clone ssh", "git clone git@github.com:user/repo.git", "git clone <git-uri>"},
+		{"clone with dir", "git clone https://github.com/user/repo.git mydir", "git clone <https-uri> mydir"},
+		{"clone depth", "git clone --depth 1 https://github.com/user/repo.git", "git clone --depth N <https-uri>"},
+
+		// checkout / switch / branch
+		{"checkout branch", "git checkout main", "git checkout main"},
+		{"checkout new branch", "git checkout -b new-feature", "git checkout -b new-feature"},
+		{"switch branch", "git switch main", "git switch main"},
+		{"branch list", "git branch", "git branch"},
+		{"branch delete", "git branch -d old-branch", "git branch -d old-branch"},
+
+		// rebase / merge / reset
+		{"rebase onto", "git rebase --onto main feature", "git rebase --onto <val> feature"},
+		{"rebase interactive", "git rebase -i HEAD~3", "git rebase -i <rev>"},
+		{"merge branch", "git merge feature-branch", "git merge feature-branch"},
+		{"reset soft", "git reset --soft HEAD~1", "git reset --soft <rev>"},
+		{"reset file", "git reset HEAD src/main.go", "git reset HEAD <path>"},
+
+		// stash
+		{"stash push", "git stash push -m 'work in progress'", "git stash push -m <str>"},
+		{"stash pop", "git stash pop", "git stash pop"},
+		{"stash drop index", "git stash drop stash@{2}", "git stash drop stash@{N}"},
+
+		// tag
+		{"tag annotated", "git tag -a v1.0.0 -m 'release 1.0'", "git tag -a v1.0.0 -m <str>"},
+		{"tag delete", "git tag -d v1.0.0", "git tag -d v1.0.0"},
+
+		// remote
+		{"remote add", "git remote add origin git@github.com:user/repo.git", "git remote add origin <git-uri>"},
+		{"remote remove", "git remote remove upstream", "git remote remove upstream"},
+
+		// config
+		{"config set", "git config user.name 'John Doe'", "git config <dotted-id> <val>"},
+		{"config get", "git config --global user.email", "git config --global <dotted-id>"},
+
+		// show
+		{"show commit", "git show abc1234", "git show <hash>"},
+		{"show head", "git show HEAD", "git show HEAD"},
+
+		// cherry-pick / revert
+		{"cherry-pick", "git cherry-pick abc1234def", "git cherry-pick <hash>"},
+		{"revert", "git revert HEAD~2", "git revert <rev>"},
+
+		// rm
+		{"rm file", "git rm src/old.go", "git rm <path>"},
+		{"rm cached", "git rm --cached secrets.env", "git rm --cached <path>"},
+
+		// global flags
+		{"global -C flag", "git -C /path/to/repo status", "git -C <path> status"},
+
+		// redirects
+		{"log with redirect", "git log --oneline > output.txt", "git log --oneline > <path>"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := Normalize(tt.input)
+			if got != tt.want {
+				t.Errorf("Normalize(%q) = %q, want %q", tt.input, got, tt.want)
+			}
+		})
+	}
+
+	// COLLISION TESTS
+	t.Run("different commit messages collide", func(t *testing.T) {
+		a := Normalize("git commit -m 'fix login bug'")
+		b := Normalize("git commit -m 'update readme section'")
+		if a != b {
+			t.Errorf("expected %q == %q", a, b)
+		}
+	})
+
+	t.Run("different clone URLs collide", func(t *testing.T) {
+		a := Normalize("git clone https://github.com/user/repo1.git")
+		b := Normalize("git clone https://github.com/other/repo2.git")
+		if a != b {
+			t.Errorf("expected %q == %q", a, b)
+		}
+	})
+
+	t.Run("different file paths in add collide", func(t *testing.T) {
+		a := Normalize("git add src/main.go")
+		b := Normalize("git add lib/util.ts")
+		if a != b {
+			t.Errorf("expected %q == %q", a, b)
+		}
+	})
+
+	// SAFETY TEST
+	t.Run("subshell not collapsed", func(t *testing.T) {
+		benign := Normalize("git add literal-arg")
+		subshell := Normalize("git add $(dangerous-command)")
+		if benign == subshell {
+			t.Error("subshell must produce different shape than literal")
+		}
+	})
+}