@cosmicdrift/kumiko-guards 0.1.0 → 0.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-guards",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "AST-based security guards for Kumiko repos: direct-fs/fetch, tenant escalation, admin-API, escape hatches and related checks, run over a shared ts-morph project.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/src/_lib/git-env.ts

@@ -0,0 +1,22 @@
+/**
+ * Spawned git calls get an allowlisted environment, never `...process.env`.
+ * A caller running as a pre-push hook would otherwise inherit `GIT_DIR`/
+ * `GIT_WORK_TREE` from git, which git prefers over `cwd` — so an inherited
+ * environment would answer for the hook's repo instead of the path being
+ * asked about. `HOME` stays in, so the global config is still read.
+ *
+ * An allowlist (not a blocklist) so a future git env var neither of us has
+ * thought of yet is excluded by construction, not by omission.
+ */
+export const GIT_ENV_KEYS = ["PATH", "HOME", "TMPDIR", "TMP", "TEMP", "USER", "LOGNAME"] as const;
+
+export function gitEnv(
+  env: Readonly<Record<string, string | undefined>> = process.env,
+): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const key of GIT_ENV_KEYS) {
+    const value = env[key];
+    if (value !== undefined) out[key] = value;
+  }
+  return out;
+}

package/src/_lib/roots.ts

@@ -18,6 +18,7 @@ import {
   RepoManifestError,
   type RepoManifestSource,
 } from "@cosmicdrift/kumiko-repo-manifest";
+import { gitEnv } from "./git-env";
 
 export type { RepoKind } from "@cosmicdrift/kumiko-repo-manifest";
 
@@ -69,24 +70,6 @@ function manifestAt(dir: string): LoadedRepoManifest | undefined {
   return result;
 }
 
-/**
- * Spawned git calls get an allowlisted environment, never `...process.env`.
- * A caller running as a pre-push hook would otherwise inherit `GIT_DIR`/
- * `GIT_WORK_TREE` from git, which git prefers over `cwd` — so an inherited
- * environment would answer for the hook's repo instead of the path being
- * asked about. `HOME` stays in, so the global config is still read.
- */
-const GIT_ENV_KEYS = ["PATH", "HOME", "TMPDIR", "TMP", "TEMP", "USER", "LOGNAME"] as const;
-
-function gitEnv(): Record<string, string> {
-  const env: Record<string, string> = {};
-  for (const key of GIT_ENV_KEYS) {
-    const value = process.env[key];
-    if (value !== undefined) env[key] = value;
-  }
-  return env;
-}
-
 function git(from: string, args: readonly string[]): string | undefined {
   if (!existsSync(from)) return undefined;
   try {

package/src/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.1.1",
+    "type": "fix",
+    "title": "Spawned git calls no longer inherit GIT_DIR/GIT_WORK_TREE",
+    "detail": "Guards that shell out to git now pass an allowlisted environment. Running inside a Husky pre-push hook, an inherited GIT_DIR pointed git at the hook's repo instead of the path being checked, so a guard could read and write the wrong repository."
+  }
+]