@event4u/agent-config 9.8.0 → 9.10.0

package/src/scripts/_lib/retrieval_sanitize.ts

@@ -3,8 +3,8 @@
  * (road-to-retrieval-substrate-hardening B6).
  *
  * Corpus content — especially user-ingested knowledge chunks under
- * `agents/memory/knowledge/` — flows into the agent context via `retrieve_v1`
- * / `memory_get_v1`. An attacker (or a compromised ingested source) can embed
+ * `agents/memory/knowledge/` — flows into the agent context on the retrieval
+ * read surfaces. An attacker (or a compromised ingested source) can embed
  * hidden-instruction vectors (bidi controls, zero-width chars, Unicode Tag
  * block) or control-char noise that the model may act on — the untrusted-input
  * / lethal-trifecta injection surface. This floor strips those vectors from
@@ -15,12 +15,49 @@
  * layer + unbounded length; visible content is the agent's to read as data.
  * Codepoint classes are shared with `lint_hidden_unicode` (one source of truth
  * for what counts as a hidden-instruction vector).
+ *
+ * WHERE IT ACTUALLY RUNS — measured end-to-end, not asserted. Keep this list
+ * honest: an earlier version of this header named surfaces by intent, and the
+ * legacy-envelope gap below went unnoticed for exactly that reason. Every
+ * claim here is backed by a probe row in
+ * `agents/evidence/reports/sanitize-floor-wiring.md`:
+ *
+ *   - `retrieve_v1()`     — yes (`memory_lookup.ts` calls `sanitize_entry`)
+ *   - `memory_get_v1()`   — yes (same)
+ *   - MCP `memory_lookup` / `memory_get` tools — inherited from the two above
+ *   - `retrieve()` / `retrieve_with_meta()` — yes, since the S0.0 wiring fix;
+ *     before it they emitted every vector intact, and so did the CLI default
+ *     (`--envelope legacy`), which is the path the rules document
+ *   - inter-agent channels (`ai_team` / `ai_council` model replies) — the
+ *     inbound parse choke point only; the subagent boundary itself is a HOST
+ *     primitive this package cannot reach (see the report, § S0.0b)
+ *
+ * Anything not on that list is uncovered. Do not widen the list without a
+ * probe row to back it.
  */
 import { _classify } from '../lint_hidden_unicode.js';
+import { TOKEN_RE, classifyToken } from './confusables.js';
 
 /** Hard per-field length cap — bounds a runaway/adversarial body. */
 export const MAX_FIELD_CHARS = 8192;
 
+/**
+ * Invisible fillers — render as blank but are not whitespace, so they sit in
+ * neither the zero-width nor the bidi set and survived the original floor
+ * (measured: `agents/evidence/reports/encoding-channel-coverage.md` row 18).
+ *
+ * These are the ONLY channel Phase 1 chose to strip rather than flag: invisible
+ * by nature, with no legitimate role in this corpus, so folding them into the
+ * existing invisible set carries no corruption risk. Every other uncovered
+ * channel is a flag, because rewriting visible text can corrupt legitimate
+ * content.
+ */
+const _INVISIBLE_FILLERS: ReadonlySet<number> = new Set([
+    0x3164, // HANGUL FILLER
+    0x115f, // HANGUL CHOSEONG FILLER
+    0x1160, // HANGUL JUNGSEONG FILLER
+]);
+
 /** True for a C0/C1 control char that is NOT a benign whitespace (\t, \n). */
 function _isStrippableControl(cp: number): boolean {
     if (cp === 0x09 || cp === 0x0a) return false; // keep tab + newline
@@ -42,11 +79,138 @@ export function sanitize_text(s: string): string {
         if (cp === undefined) continue;
         if (_classify(cp) !== null) continue; // hidden-instruction vector → drop
         if (_isStrippableControl(cp)) continue; // control-char noise → drop
+        if (_INVISIBLE_FILLERS.has(cp)) continue; // blank-but-not-whitespace → drop
         out += ch;
     }
     return out.length > MAX_FIELD_CHARS ? out.slice(0, MAX_FIELD_CHARS) : out;
 }
 
+// ---------------------------------------------------------------------------
+// Visible-layer scanner — FLAG ONLY, never rewrites
+// ---------------------------------------------------------------------------
+//
+// `sanitize_text` strips the invisible layer. This reports the VISIBLE layer,
+// which the floor deliberately does not touch: folding a confusable to a Latin
+// skeleton, or NFKC-normalising a math-alphanumeric run, corrupts any body that
+// legitimately contains mixed script, CJK punctuation, or a ligature. Phase 1
+// measured each channel and chose flag-not-rewrite for every one of these:
+// `agents/evidence/reports/encoding-channel-coverage.md` § Disposition.
+//
+// Deterministic and pure: no model call, no network, no I/O. Safe to run in CI
+// and on a request path.
+//
+// Not scanned, deliberately, with the reason recorded so it is not mistaken for
+// an oversight:
+//   - confusable whitespace (NBSP, figure space) — pervasive in real prose
+//   - HTML/XML entities — decoding them would CREATE the payload
+//   - nested multibase (base64) — legitimate throughout this repo; semantic,
+//     not structural
+//   - structured-data key ordering — not a codepoint channel at all, and
+//     reordering keys would break the byte-identical v1 envelope contract
+//   - word-order permutation — carrier text with legitimate word order is
+//     indistinguishable from permuted text without semantics
+
+/** Codepoint thresholds — a run is the signal; a single occurrence is not. */
+const _VS_RUN_MIN = 3;
+const _COMBINING_RUN_MIN = 5;
+
+export interface EncodingFinding {
+    /** Stable channel id, matching the frozen corpus labels. */
+    readonly channel: string;
+    /** Why it fired, with the concrete evidence (codepoint or token). */
+    readonly detail: string;
+}
+
+function _isVariationSelector(cp: number): boolean {
+    return (cp >= 0xfe00 && cp <= 0xfe0f) || (cp >= 0xe0100 && cp <= 0xe01ef);
+}
+
+function _isCombiningMark(cp: number): boolean {
+    return cp >= 0x0300 && cp <= 0x036f;
+}
+
+/**
+ * Report visible-layer encoding signals in a string. Never mutates it.
+ *
+ * The confusable signature is NOT reimplemented here — it is the shared
+ * `classifyToken` from `_lib/confusables.ts`, the single definition this
+ * package's authoring-time linter also uses, so the two surfaces cannot drift
+ * apart on what counts as a homoglyph.
+ */
+export function scan_encoding_findings(s: string): EncodingFinding[] {
+    const out: EncodingFinding[] = [];
+
+    // Longest run of variation selectors / combining marks anywhere in the
+    // string. A run is what distinguishes steganography from legitimate use:
+    // U+FE0F is the emoji presentation selector and diacritics are normal in
+    // many languages, so a single occurrence is never the signal.
+    let vsRun = 0;
+    let vsMax = 0;
+    let cmRun = 0;
+    let cmMax = 0;
+    let hasMathAlnum = false;
+    let hasFullwidth = false;
+    for (const ch of s) {
+        const cp = ch.codePointAt(0);
+        if (cp === undefined) continue;
+        if (_isVariationSelector(cp)) {
+            vsRun += 1;
+            vsMax = Math.max(vsMax, vsRun);
+        } else {
+            vsRun = 0;
+        }
+        if (_isCombiningMark(cp)) {
+            cmRun += 1;
+            cmMax = Math.max(cmMax, cmRun);
+        } else {
+            cmRun = 0;
+        }
+        if (cp >= 0x1d400 && cp <= 0x1d7ff) hasMathAlnum = true;
+        if (cp >= 0xff01 && cp <= 0xff5e) hasFullwidth = true;
+    }
+    if (vsMax >= _VS_RUN_MIN) {
+        out.push({
+            channel: 'variation-selector-run',
+            detail: `variation-selector run x${vsMax} (steganography signature)`,
+        });
+    }
+    if (cmMax >= _COMBINING_RUN_MIN) {
+        out.push({
+            channel: 'combining-mark-run',
+            detail: `combining-mark run x${cmMax} on one base character`,
+        });
+    }
+    if (hasMathAlnum) {
+        out.push({
+            channel: 'math-alphanumeric',
+            detail: 'Mathematical Alphanumeric Symbols used as letters (U+1D400–1D7FF)',
+        });
+    }
+    if (hasFullwidth) {
+        out.push({
+            channel: 'fullwidth-forms',
+            detail: 'Halfwidth/Fullwidth Forms used as ASCII letters (U+FF01–FF5E)',
+        });
+    }
+
+    // Mixed-script confusable tokens — shared signature, one table in the tree.
+    for (const m of s.matchAll(TOKEN_RE)) {
+        const verdict = classifyToken(m[0]);
+        if (verdict !== null) {
+            const script = verdict.startsWith('latin+greek') ? 'greek' : 'cyrillic';
+            out.push({ channel: `confusable-${script}`, detail: `${m[0]} — ${verdict}` });
+        }
+    }
+
+    // Punycode / IDN in a text-expected field. Flagged, never rewritten:
+    // `xn--` labels are valid DNS and rewriting one would break a real link.
+    for (const m of s.matchAll(/\bxn--[a-z0-9-]+/gi)) {
+        out.push({ channel: 'punycode-idn', detail: `punycode label ${m[0]}` });
+    }
+
+    return out;
+}
+
 /**
  * Return a shallow copy of a retrieval entry with every string value (and
  * one level of string-array values) sanitized. Non-string values pass through

package/src/scripts/_lib/rtk_allowlist.ts

@@ -0,0 +1,44 @@
+/**
+ * rtk allowlist for worker tool loops (road-to-lean-agent-init Phase 4).
+ *
+ * Wraps ONLY the command class with a MEASURED ~55% output saving —
+ * `internal/bench/rtk-savings/RESULTS.md` is the single source of the
+ * numbers (referenced, never duplicated here). The ~0%-savings class stays
+ * unwrapped: wrap overhead without return. Congruence with RESULTS.md is
+ * enforced by `tests/scripts/_lib_rtk_allowlist.test.ts`, which parses the
+ * results table and asserts every allowlisted pattern measured ≥ the
+ * threshold and every excluded pattern measured below it.
+ */
+
+/** A worker wraps a command with rtk only when its saving measured ≥ this. */
+export const RTK_WRAP_THRESHOLD_PCT = 50;
+
+/**
+ * Command patterns in the measured high-savings class. Matched against the
+ * command a worker is about to run; first match wins.
+ */
+export const RTK_WRAP_ALLOWLIST: ReadonlyArray<{ pattern: RegExp; benchCommand: string }> = [
+    { pattern: /^git status\b/, benchCommand: 'git status' },
+    // Full-format git log (NOT --oneline — that class measured ~0%).
+    { pattern: /^git log(?!.*--oneline)\b/, benchCommand: 'git log -10' },
+    { pattern: /^ls -la?\b/, benchCommand: 'ls -la src/scripts' },
+];
+
+/**
+ * Measured-near-zero class — never wrapped (documented so nobody "helpfully"
+ * adds them back without a new measurement).
+ */
+export const RTK_NO_WRAP: ReadonlyArray<{ pattern: RegExp; benchCommand: string }> = [
+    { pattern: /^git log .*--oneline\b/, benchCommand: 'git log --oneline -50' },
+    { pattern: /^git diff .*--stat\b/, benchCommand: 'git diff --stat HEAD~5..HEAD' },
+    { pattern: /^git branch\b/, benchCommand: 'git branch -a' },
+    { pattern: /^npm ls\b/, benchCommand: 'npm ls --depth=0' },
+    { pattern: /^git show .*--stat\b/, benchCommand: 'git show --stat HEAD' },
+];
+
+/** Should a worker wrap this command with rtk? Deterministic, measured-class only. */
+export function shouldWrapWithRtk(command: string): boolean {
+    const cmd = command.trim();
+    if (RTK_NO_WRAP.some((e) => e.pattern.test(cmd))) return false;
+    return RTK_WRAP_ALLOWLIST.some((e) => e.pattern.test(cmd));
+}

package/src/scripts/_lib/scan_scope.ts

@@ -0,0 +1,115 @@
+/**
+ * Scan-scope assertions — "a gate that read nothing did not pass".
+ *
+ * WHY THIS EXISTS (audit 2026-07-29, `agents/settings/contexts/gates-that-cannot-fail.md`):
+ * ADR-051 moved the source container and a later commit deleted `packages/`.
+ * Fourteen `lint_*`/`check_*` gates kept a hardcoded literal path, and every
+ * one of them treats a missing directory as "nothing to check" — so they exit 0
+ * and print a green checkmark while scanning zero files. Their own output said
+ * so (`0 file(s) scanned`, `0 name(s) checked`, `0 declarer(s)`); nothing ever
+ * asserted on the number.
+ *
+ * Two shapes cover the whole class:
+ *
+ * - **Corpus gates** walk a root and check N units → {@link assertScanned}.
+ *   Zero units is a failure unless the gate declares a justified `allowEmpty`.
+ * - **Watch-list gates** (diff-based, no corpus to count) name specific files
+ *   they guard → {@link assertWatchlistResolves}. A watch list that resolves to
+ *   nothing on disk means the guard is watching phantoms.
+ *
+ * Both throw {@link DeadScopeError}; callers map it to a non-zero exit. The
+ * point is that the failure is LOUD and names the root, so the next path
+ * migration cannot silently disarm a gate again.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+/** Raised when a gate's scope is empty — it cannot have checked anything. */
+export class DeadScopeError extends Error {
+    readonly gate: string;
+
+    constructor(gate: string, message: string) {
+        super(message);
+        this.name = 'DeadScopeError';
+        this.gate = gate;
+    }
+}
+
+export interface ScannedOptions {
+    /** Gate name, for the error message (e.g. `lint_namespace`). */
+    gate: string;
+    /** How many units the gate actually examined. */
+    scanned: number;
+    /** Plural noun for the unit — `file(s)`, `name(s)`, `declarer(s)`. */
+    units: string;
+    /** The root(s) the gate walked, repo-relative, for the error message. */
+    roots: readonly string[];
+    /**
+     * Justification for legitimately scanning zero. Supply ONLY when an empty
+     * corpus is a real, expected state (an optional consumer surface that may
+     * genuinely be absent) — never to silence a moved root. The string is the
+     * reason and is printed, so it is reviewable in a diff.
+     */
+    allowEmpty?: string;
+}
+
+/**
+ * Assert a corpus gate examined at least one unit.
+ *
+ * @throws {DeadScopeError} when `scanned === 0` and no `allowEmpty` reason is given.
+ */
+export function assertScanned(opts: ScannedOptions): void {
+    if (opts.scanned > 0) {
+        return;
+    }
+    if (opts.allowEmpty !== undefined && opts.allowEmpty.trim() !== '') {
+        return;
+    }
+    const roots = opts.roots.length > 0 ? opts.roots.join(', ') : '(no root declared)';
+    throw new DeadScopeError(
+        opts.gate,
+        `${opts.gate}: scanned 0 ${opts.units} under ${roots} — the scan scope is ` +
+            'dead or the root moved. A gate that read nothing has not passed. ' +
+            'Repoint the root (prefer the shared resolver in _lib/agent_src.ts), ' +
+            'or declare a justified `allowEmpty` reason if an empty corpus is genuinely expected.',
+    );
+}
+
+export interface WatchlistOptions {
+    /** Gate name, for the error message. */
+    gate: string;
+    /** Repo-relative candidate paths the gate guards. */
+    candidates: readonly string[];
+    /** Absolute repo root the candidates resolve against. */
+    repoRoot: string;
+}
+
+/**
+ * Assert a watch-list gate's targets exist on disk, and return the ones that do.
+ *
+ * A diff-based guard has no corpus to count: it compares changed paths against
+ * a fixed list. If that list resolves to nothing, the guard reports "clean"
+ * forever — the exact shape of the `check_safety_floor_untouched` defect, which
+ * announced `4 rules guarded` while guarding none.
+ *
+ * @returns the subset of `candidates` that exist.
+ * @throws {DeadScopeError} when none of them exist.
+ */
+export function assertWatchlistResolves(opts: WatchlistOptions): string[] {
+    const resolved = opts.candidates.filter((rel) => {
+        try {
+            return fs.statSync(path.join(opts.repoRoot, rel)).isFile();
+        } catch {
+            return false;
+        }
+    });
+    if (resolved.length === 0) {
+        throw new DeadScopeError(
+            opts.gate,
+            `${opts.gate}: none of its ${opts.candidates.length} guarded path(s) exist ` +
+                `under ${opts.repoRoot} — the guard is watching phantoms and can never fire. ` +
+                `Checked: ${opts.candidates.join(', ')}`,
+        );
+    }
+    return resolved;
+}

package/src/scripts/_lib/secret_detector.test.ts

@@ -33,6 +33,11 @@ const EXPECTED_KIND: Readonly<Record<string, string>> = {
     jwt: 'jwt',
     dburl: 'db-connection-uri',
     assignment: 'generic-assignment',
+    // adversarial-corpus additions (road-to-feedback-9.8.0-followups Phase 3)
+    'github-fine-grained': 'github-pat',
+    'env-db-password': 'generic-assignment',
+    'env-api-key': 'generic-assignment',
+    'dburl-mysql': 'db-connection-uri',
 };
 
 function isReal(f: SecretFinding): boolean {

package/src/scripts/_lib/secret_detector.ts

@@ -66,6 +66,9 @@ const RULES: readonly Rule[] = [
     { rule: 'aws-access-key', kind: 'aws-access-key', regex: /AKIA[0-9A-Z]{16}/g },
     { rule: 'google-api-key', kind: 'google-api-key', regex: /AIza[0-9A-Za-z_-]{35}/g },
     { rule: 'github-pat', kind: 'github-pat', regex: /ghp_[0-9A-Za-z]{36}/g },
+    // Fine-grained PATs (github_pat_…) were a measured detector gap: the
+    // 2026-07-28 adversarial corpus pass flagged them as missed positives.
+    { rule: 'github-fine-grained-pat', kind: 'github-pat', regex: /github_pat_[0-9A-Za-z_]{22,}/g },
     {
         rule: 'jwt',
         kind: 'jwt',
@@ -282,6 +285,12 @@ export function scanText(text: string, opts: ScanOptions = {}): SecretFinding[]
                 if (UUID.test(token)) {
                     continue; // benign identifier
                 }
+                if (/^sha(?:256|384|512)-/.test(token)) {
+                    // SRI / npm-lockfile integrity digest (`sha512-<base64>`) —
+                    // a hash, not a credential. Measured FP class on the
+                    // 2026-07-28 adversarial corpus pass.
+                    continue;
+                }
                 const entropy = shannonEntropy(token);
                 const isHex = IS_HEX.test(token);
                 if (isHex && HASH_HEX_LENGTHS.has(token.length)) {

package/src/scripts/_lib/secret_detector_adversarial.test.ts

@@ -0,0 +1,116 @@
+// Adversarial precision/recall measurement for the secret detector
+// (road-to-feedback-9.8.0-followups Phase 3). Runs the REAL scanText over
+// the committed fixture corpus plus runtime-constructed multiline cases
+// (assembled from parts so nothing key-shaped beyond the existing corpus
+// convention lands in the tree), computes precision / recall / FP-rate, and
+// publishes the rates to internal/reports/secret-scanner-adversarial.json.
+//
+// Hard floor: recall = 100% on positives, FP-rate = 0% on negative controls.
+// A genuine detector miss must NOT be papered over by weakening a fixture —
+// it gets a known_gap entry excluded from the hard assertion and REPORTED.
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, expect, it } from 'vitest';
+
+import { scanText, type SecretFinding } from './secret_detector.js';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const FIXTURES = path.join(HERE, 'fixtures', 'secret-detector');
+const REPO = path.resolve(HERE, '..', '..', '..');
+const REPORT = path.join(REPO, 'internal', 'reports', 'secret-scanner-adversarial.json');
+
+/** Measured, documented gaps — excluded from the hard floor, published. */
+const KNOWN_GAPS: string[] = [];
+
+const isReal = (f: SecretFinding): boolean => f.confidence === 'high' || f.confidence === 'medium';
+
+interface Case { id: string; text: string; expect_hit: boolean }
+
+function corpusCases(): Case[] {
+    const cases: Case[] = [];
+    for (const [file, expectHit] of [['positives.txt', true], ['negatives.txt', false]] as const) {
+        const lines = fs.readFileSync(path.join(FIXTURES, file), 'utf-8').split('\n');
+        lines.forEach((line, i) => {
+            if (line.trim().length === 0 || line.startsWith('#')) return;
+            const value = expectHit ? (line.split('|')[1] ?? line) : line;
+            cases.push({ id: `${file}:${i + 1}`, text: value, expect_hit: expectHit });
+        });
+    }
+    return cases;
+}
+
+/** Multiline / wrapped positives assembled at runtime. */
+function constructedCases(): Case[] {
+    // A fake PEM body: base64-ish filler between real BEGIN/END framing.
+    const pem = [
+        ['-----BEGIN', 'RSA PRIVATE KEY-----'].join(' '),
+        'MIIEpAIBAAKCAQEA7fakebodyfakebodyfakebodyfakebodyfakebody12345678',
+        'q7fakebodyfakebodyfakebodyfakebodyfakebodyfakebodyfakebody901234',
+        ['-----END', 'RSA PRIVATE KEY-----'].join(' '),
+    ].join('\n');
+    // A base64-WRAPPED credential next to a keyword: the wrapped payload is a
+    // fake AWS key; the wrapper alone must still trip entropy+keyword.
+    const wrapped = `api_key = "${Buffer.from('AKIA' + '1234567890ABCDEF').toString('base64')}"`;
+    // .env multiline block (several assignments in one scan call).
+    const envBlock = ['APP_ENV=production', 'DB_PASSWORD=q7Xp2Vr9kLm4Nt8wYz3BdF6h', 'MAIL_FROM=noreply@example.com'].join('\n');
+    return [
+        { id: 'constructed:pem-multiline', text: pem, expect_hit: true },
+        { id: 'constructed:base64-wrapped-key', text: wrapped, expect_hit: true },
+        { id: 'constructed:env-block', text: envBlock, expect_hit: true },
+        // Negative: random base64 with NO credential keyword nearby.
+        { id: 'constructed:naked-base64-no-keyword-short', text: 'blob dGhpcyBpcyBmaWxsZXI=', expect_hit: false },
+    ];
+}
+
+describe('secret detector — adversarial corpus measurement', () => {
+    const cases = [...corpusCases(), ...constructedCases()];
+    const rows = cases.map((c) => {
+        const real = scanText(c.text).filter(isReal);
+        return { ...c, hit: real.length > 0, kinds: [...new Set(real.map((f) => f.kind))] };
+    });
+
+    const positives = rows.filter((r) => r.expect_hit);
+    const negatives = rows.filter((r) => !r.expect_hit);
+    const detected = positives.filter((r) => r.hit);
+    const missed = positives.filter((r) => !r.hit).map((r) => r.id);
+    const falsePositives = negatives.filter((r) => r.hit).map((r) => r.id);
+    const recall = positives.length > 0 ? detected.length / positives.length : 1;
+    const fpRate = negatives.length > 0 ? falsePositives.length / negatives.length : 0;
+    const precision =
+        detected.length + falsePositives.length > 0
+            ? detected.length / (detected.length + falsePositives.length)
+            : 1;
+
+    it('publishes the measured rates', () => {
+        const report = {
+            _doc:
+                'Adversarial fixture measurement of the secret detector (scanText). ' +
+                'Regenerated by src/scripts/_lib/secret_detector_adversarial.test.ts on every run; ' +
+                'hard floor asserted there (recall 100% / FP 0% outside known_gaps).',
+            generated: new Date().toISOString().slice(0, 10),
+            corpus_size: rows.length,
+            positives: positives.length,
+            negatives: negatives.length,
+            detected: detected.length,
+            missed,
+            false_positives: falsePositives,
+            known_gaps: KNOWN_GAPS,
+            precision: +precision.toFixed(3),
+            recall: +recall.toFixed(3),
+            fp_rate: +fpRate.toFixed(3),
+        };
+        fs.mkdirSync(path.dirname(REPORT), { recursive: true });
+        fs.writeFileSync(REPORT, `${JSON.stringify(report, null, 2)}\n`);
+        expect(fs.existsSync(REPORT)).toBe(true);
+    });
+
+    it('recall floor: every positive outside known_gaps is detected', () => {
+        const hardMisses = missed.filter((id) => !KNOWN_GAPS.includes(id));
+        expect(hardMisses, `detector missed: ${hardMisses.join(', ')}`).toHaveLength(0);
+    });
+
+    it('FP floor: no negative control fires high/medium', () => {
+        expect(falsePositives, `false positives: ${falsePositives.join(', ')}`).toHaveLength(0);
+    });
+});

package/src/scripts/_lib/spawn_env.ts

@@ -54,6 +54,13 @@ const DENY_EXACT: ReadonlySet<string> = new Set([
     // attacker-controlled object stores; the GIT_CONFIG* family is handled by
     // prefix below (it is a general arbitrary-config-injection primitive).
     'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+    // git path-redirection: GIT_DIR / GIT_INDEX_FILE / GIT_NAMESPACE point a
+    // child's git at an attacker-controlled repo, index file, or ref namespace
+    // — ordinary git ops then read and write attacker state (low severity,
+    // same family as GIT_ALTERNATE_OBJECT_DIRECTORIES above).
+    'GIT_DIR',
+    'GIT_INDEX_FILE',
+    'GIT_NAMESPACE',
     // resolver hijack: HOSTALIASES remaps hostnames via an attacker file,
     // redirecting any network fetch the child performs (CWE-427-adjacent).
     'HOSTALIASES',