@fungi.computer/truffle 0.2.2 → 0.3.0

package/dist/private-local-sandbox-policy.js

@@ -1,6 +1,6 @@
 import { isUtf8 } from "node:buffer";
 import { spawnSync } from "node:child_process";
-import { accessSync, constants, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { accessSync, constants, lstatSync, mkdirSync, realpathSync, statSync, } from "node:fs";
 import { userInfo } from "node:os";
 import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep, } from "node:path";
 import { z } from "zod";
@@ -20,16 +20,125 @@ export function resolveAgentFolder(project, folder) {
     const within = relative(root, absolute);
     if (isAbsolute(within) || within === ".." || within.startsWith(`..${sep}`))
         throw new Error("Agent folder resolves outside the project");
+    if (within === ".fungi" || within.startsWith(`.fungi${sep}`))
+        throw new Error("Agent folder cannot be inside protected project .fungi");
     if (!lstatSync(absolute).isDirectory())
         throw new Error("Agent folder must be a directory");
     return { folder: within.split(sep).join("/") || ".", absolute };
 }
+function existingDirectory(path) {
+    if (!isAbsolute(path))
+        return [];
+    try {
+        return statSync(path).isDirectory() ? [realpathSync(path)] : [];
+    }
+    catch (cause) {
+        if (unreadableEntry(cause))
+            return [];
+        throw cause;
+    }
+}
+function covers(root, path) {
+    return within(root, path);
+}
+export function linuxSandboxProfile(policy, mode, temporaryDirectory, host, 
+/** Pass the real passwd home in production; fixtures supply their own. */
+osHome, platform = "linux") {
+    const home = host.HOME ?? osHome;
+    if (!isAbsolute(home))
+        throw new Error("Sandbox HOME must be absolute");
+    if (!isAbsolute(osHome))
+        throw new Error("Sandbox OS home must be absolute");
+    const cache = host.XDG_CACHE_HOME ?? join(home, ".cache");
+    const data = host.XDG_DATA_HOME ?? join(home, ".local", "share");
+    const cargo = host.CARGO_HOME ?? join(home, ".cargo");
+    const caches = [
+        cache,
+        join(home, ".npm"),
+        join(host.PNPM_HOME ?? join(data, "pnpm"), "store"),
+        join(home, ".bun", "install", "cache"),
+        join(cargo, "registry"),
+        join(cargo, "git"),
+        host.GOMODCACHE ?? join(home, "go", "pkg", "mod"),
+        host.GOCACHE ?? join(cache, "go-build"),
+    ];
+    const socket = host.SSH_AUTH_SOCK;
+    const selectedSocket = socket &&
+        isAbsolute(socket) &&
+        statSync(socket, { throwIfNoEntry: false })?.isSocket()
+        ? socket
+        : undefined;
+    const writableCaches = [...new Set(caches.flatMap(existingDirectory))].filter((path) => !covers(path, join(home, ".cargo", "bin")) &&
+        !covers(path, join(home, ".local", "bin")));
+    const fungiCache = canonicalPath(join(cache, "fungi"));
+    const protectedFungiCache = mode === "workspace" &&
+        writableCaches.some((path) => covers(path, fungiCache))
+        ? fungiCache
+        : undefined;
+    // A previous service can leave fallback Agent temp behind even when this
+    // Agent has moved to XDG_RUNTIME_DIR. Never expose either host candidate.
+    const fallbackTemporaryBases = [
+        ...new Set([home, osHome]
+            .map((root) => join(root, ".cache", "fungi", "tmp"))
+            .flatMap(existingDirectory)),
+    ];
+    return {
+        ...policy,
+        readOnly: protectedFungiCache === undefined
+            ? policy.readOnly
+            : [...policy.readOnly, protectedFungiCache],
+        mode,
+        temporaryDirectory,
+        fungiCache: protectedFungiCache,
+        writable: mode === "workspace"
+            ? [...new Set([policy.writableRoot, ...writableCaches])]
+            : [],
+        hidden: [
+            join(home, ".config", "fungi"),
+            join(home, ".fungi", "service"),
+            // Linux mounts a private tmpfs over siblings after re-binding our temp.
+            // Seatbelt's path denial would also hide the Agent's own fallback temp.
+            ...(platform === "linux" ? fallbackTemporaryBases : []),
+        ],
+        sshAgentSocket: mode === "workspace" ? selectedSocket : undefined,
+        sshAgentMask: mode === "read-only" ? selectedSocket : undefined,
+    };
+}
+/** Private persistent Agent temp, not the staging directory or host /tmp. */
+export function agentSandboxTemporaryDirectory(agentId, project) {
+    if (!/^[a-zA-Z0-9_-]+$/.test(agentId))
+        throw new Error("Invalid Local Agent ID for temporary directory");
+    const home = userInfo().homedir;
+    const runtime = process.env.XDG_RUNTIME_DIR;
+    const base = runtime && isAbsolute(runtime)
+        ? join(runtime, "fungi", "tmp")
+        : join(home, ".cache", "fungi", "tmp");
+    const projectRoot = realpathSync(project);
+    if ([resolve(base), canonicalPath(base)].some((path) => within(projectRoot, path) || inGitAdministration(path)))
+        throw new Error("Agent temporary directory cannot live in the Agent project or Git administration");
+    mkdirSync(base, { recursive: true, mode: 0o700 });
+    const directory = join(base, agentId);
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    if (within(projectRoot, realpathSync(directory)))
+        throw new Error("Agent temporary directory resolved into the Agent project");
+    const metadata = lstatSync(directory);
+    if (!metadata.isDirectory() ||
+        metadata.isSymbolicLink() ||
+        metadata.uid !== process.getuid?.() ||
+        (metadata.mode & 0o077) !== 0)
+        throw new Error("Local Agent temporary directory must be private");
+    return realpathSync(directory);
+}
 export class UnsafeNativePayload extends Error {
     name = "UnsafeNativePayload";
 }
 export class UnsafeHostCode extends Error {
     name = "UnsafeHostCode";
 }
+/** A symlinked Git marker cannot be protected by a bind on its logical name. */
+export class UnsafeGitMarker extends Error {
+    name = "UnsafeGitMarker";
+}
 function within(root, path) {
     const remainder = relative(root, path);
     return (!isAbsolute(remainder) &&
@@ -103,93 +212,6 @@ export function assertHostOwnedNativeFile(project, path) {
     if ([logical, actual].some((candidate) => within(project, candidate) || gitAdmin(candidate)))
         throw new UnsafeNativePayload("Packaged native payload is inside the Agent project or a Git-admin folder; reinstall Fungi outside the project.");
 }
-function sweepErrorCode(cause) {
-    if (!(cause instanceof Error) || !("code" in cause))
-        return undefined;
-    switch (cause.code) {
-        case "ENOENT":
-        case "ESRCH":
-        case "EPERM":
-            return cause.code;
-        default:
-            return undefined;
-    }
-}
-const probeNativeRunLiveness = (pid) => {
-    process.kill(pid, 0);
-};
-/** Reclamation may fail independently of private-run admission. */
-function sweepPrivateNativeRuns(root, uid, probe) {
-    try {
-        for (const name of readdirSync(root)) {
-            const match = /^run-([1-9]\d*)-([A-Za-z0-9]{6})$/.exec(name);
-            if (match === null)
-                continue;
-            const stale = join(root, name);
-            try {
-                const entry = lstatSync(stale);
-                if (!entry.isDirectory() ||
-                    entry.uid !== uid ||
-                    (entry.mode & 0o077) !== 0)
-                    continue;
-                try {
-                    probe(Number(match[1]));
-                }
-                catch (cause) {
-                    if (sweepErrorCode(cause) === "ESRCH")
-                        rmSync(stale, { recursive: true, force: true });
-                    else if (sweepErrorCode(cause) !== "EPERM")
-                        throw cause;
-                }
-            }
-            catch (cause) {
-                if (sweepErrorCode(cause) !== "ENOENT")
-                    console.warn("Native stale-run sweep could not inspect entry", cause);
-            }
-        }
-    }
-    catch (cause) {
-        console.warn("Native stale-run sweep could not list runs", cause);
-    }
-}
-/** New private inode, never a link or bind of an installed payload. */
-export function privateNativeDirectory(project, probe = probeNativeRunLiveness) {
-    const uid = process.getuid?.();
-    if (uid === undefined)
-        throw new UnsafeNativePayload("Host native staging requires a POSIX user identity.");
-    const runtime = process.env.XDG_RUNTIME_DIR;
-    const base = runtime ?? join(userInfo().homedir, ".local", "state");
-    if (runtime !== undefined) {
-        if (!isAbsolute(runtime))
-            throw new UnsafeNativePayload("XDG_RUNTIME_DIR must be absolute.");
-        const directory = lstatSync(runtime, { throwIfNoEntry: false });
-        if (directory === undefined ||
-            !directory.isDirectory() ||
-            directory.uid !== uid ||
-            (directory.mode & 0o077) !== 0)
-            throw new UnsafeNativePayload("XDG_RUNTIME_DIR must be a private directory owned by this user.");
-    }
-    const root = join(base, "fungi", "native");
-    const resolvedProject = realpathSync(project);
-    if (within(resolvedProject, resolve(root)) || inGitAdministration(root))
-        throw new UnsafeNativePayload("Host native staging cannot live inside the Agent project or Git administration.");
-    mkdirSync(root, { recursive: true, mode: 0o700 });
-    const actual = realpathSync(root);
-    if (within(resolvedProject, actual) || inGitAdministration(actual))
-        throw new UnsafeNativePayload("Host native staging resolves inside the Agent project or Git administration.");
-    const metadata = lstatSync(actual);
-    if (!metadata.isDirectory() ||
-        metadata.uid !== uid ||
-        (metadata.mode & 0o077) !== 0)
-        throw new UnsafeNativePayload("Host native staging root must be private and owned by this user.");
-    sweepPrivateNativeRuns(actual, uid, probe);
-    return mkdtempSync(join(actual, `run-${String(process.pid)}-`));
-}
-export function stageNativeBytes(directory, label, bytes) {
-    const target = join(mkdtempSync(join(directory, "payload-")), label);
-    writeFileSync(target, bytes, { flag: "wx", mode: 0o500 });
-    return target;
-}
 /** Missing reserved names resolve through their nearest existing ancestor. */
 function canonicalPath(path) {
     if (lstatSync(path, { throwIfNoEntry: false }) !== undefined)
@@ -207,31 +229,28 @@ export function protectedSandboxPaths(paths) {
         })),
     ];
 }
-// A project tree is untrusted input. Refuse incomplete discovery rather than
-// silently protecting only a prefix or allowing a bare command to bypass it.
-// Bound directory traversal, not ordinary dependency-file payloads.
-const maximumDiscoveryDirectories = 100_000;
-const discoveryDirectoryLimit = z
-    .number()
-    .int()
-    .min(1)
-    .max(maximumDiscoveryDirectories);
-// Each work tree costs four short Git processes; bound the process count too.
-const maximumGitWorkTrees = 256;
-const maximumGitOutputBytes = 256 * 1024 * 1024;
+// One bounded host Git query per writable folder, regardless of repository size.
+const maximumGitOutputBytes = 16 * 1024;
 const gitTimeoutMilliseconds = 30_000;
 /** Host Git from absolute PATH entries; never a binary the Agent can write. */
-function hostGit(project) {
-    for (const directory of (process.env.PATH ?? "").split(":")) {
+function hostGit(project, path, strictPath) {
+    for (const directory of path.split(":")) {
         if (!isAbsolute(directory))
             continue;
         const candidate = join(directory, "git");
         try {
             accessSync(candidate, constants.X_OK);
             const actual = realpathSync(candidate);
-            if (statSync(actual).isFile() &&
-                ![candidate, actual].some((path) => within(project, path) || inGitAdministration(path)))
-                return candidate;
+            if (!statSync(actual).isFile())
+                continue;
+            // A grant must inspect the first executable on its command PATH. For
+            // sandbox discovery, keep looking for a trusted Git instead.
+            if ([candidate, actual].some((location) => within(project, location) || inGitAdministration(location))) {
+                if (strictPath)
+                    return undefined;
+                continue;
+            }
+            return candidate;
         }
         catch (cause) {
             // No usable Git on this PATH entry; any other fault refuses discovery.
@@ -248,303 +267,134 @@ function gitEnvironment() {
             environment[name] = value;
     return { ...environment, GIT_OPTIONAL_LOCKS: "0", GIT_TERMINAL_PROMPT: "0" };
 }
-/** Missing, non-directory or looping entries; never other faults. */
-function absentEntry(cause) {
+/** Missing, denied or looping PATH entry; never a reason to grant a Git path. */
+function unreadableEntry(cause) {
     if (!(cause instanceof Error) || !("code" in cause))
         return false;
     switch (cause.code) {
         case "ENOENT":
         case "ENOTDIR":
         case "ELOOP":
+        case "EACCES":
+        case "EISDIR":
             return true;
         default:
             return false;
     }
 }
-/**
- * Absent or permission-denied. Only for choices where denial is safe (skip a
- * PATH entry, protect more); never where it would drop protection, since an
- * Agent can `chmod 000` a directory inside its folder.
- */
-function unreadableEntry(cause) {
-    return (absentEntry(cause) ||
-        (cause instanceof Error && "code" in cause && cause.code === "EACCES"));
-}
-// `git ls-files --stage`: <mode> SP <object> SP <stage> TAB <path>.
-const stagedEntry = /^([0-7]{6}) [0-9a-f]{40,64} [0-3]\t(.+)$/su;
-/**
- * Git's own names for one work tree: its administration directories, the
- * nested repositories it reports (gitlinks, untracked repositories, registered
- * worktrees) and bare-repository candidates among its non-ignored files.
- * Ignored payload is never listed. Undefined when Git cannot answer, so the
- * caller falls back to the complete budgeted walk.
- */
-function gitWorkTreeView(git, workTree) {
-    const run = (args, separator) => {
-        // Repository configuration may be Agent-authored: no fsmonitor command,
-        // no Agent-forged untracked cache, no pager, no index writes.
-        const result = spawnSync(git, [
-            "--no-pager",
-            "-c",
-            "core.fsmonitor=false",
-            "-c",
-            "core.untrackedCache=false",
-            ...args,
-        ], {
-            cwd: workTree,
-            env: gitEnvironment(),
-            maxBuffer: maximumGitOutputBytes,
-            timeout: gitTimeoutMilliseconds,
-            stdio: ["ignore", "pipe", "ignore"],
-        });
-        if (result.error !== undefined || result.status !== 0)
-            return undefined;
-        // Raw bytes: a name that is not UTF-8 cannot be protected by a string
-        // path, so the whole view is refused instead of silently dropping it.
-        const records = [];
-        for (let start = 0; start < result.stdout.length;) {
-            const end = result.stdout.indexOf(separator, start);
-            const stop = end === -1 ? result.stdout.length : end;
-            const record = result.stdout.subarray(start, stop);
-            if (!isUtf8(record))
-                return undefined;
-            records.push(record.toString("utf8"));
-            start = stop + 1;
-        }
-        return records;
-    };
-    // Newline-separated; a path containing a newline fails the count check.
-    const location = run([
+/** Git owns the representation of the selected folder's worktree and common dir. */
+export function gitDirectories(project, root, path) {
+    const git = hostGit(project, path ?? process.env.PATH ?? "", path !== undefined);
+    if (git === undefined)
+        return undefined;
+    // Configuration may be Agent-authored: no fsmonitor process, untracked
+    // cache, pager, inherited GIT_* override, or index write on the host.
+    const result = spawnSync(git, [
+        "--no-pager",
+        "-c",
+        "core.fsmonitor=false",
+        "-c",
+        "core.untrackedCache=false",
+        "-C",
+        root,
         "rev-parse",
-        "--is-inside-work-tree",
         "--absolute-git-dir",
         "--git-common-dir",
-    ], 10);
-    if (location?.length !== 3)
+    ], {
+        cwd: root,
+        env: gitEnvironment(),
+        maxBuffer: maximumGitOutputBytes,
+        timeout: gitTimeoutMilliseconds,
+        stdio: ["ignore", "pipe", "ignore"],
+    });
+    if (result.error !== undefined ||
+        result.status !== 0 ||
+        !isUtf8(result.stdout))
         return undefined;
-    const [inside, gitDirectory = "", commonDirectory = ""] = location;
-    if (inside !== "true")
+    // A newline in a reported path is ambiguous in rev-parse's line protocol;
+    // do not turn any partial answer into an external writable grant.
+    const locations = result.stdout.toString("utf8").split("\n");
+    if (locations.length !== 3 || locations[2] !== "")
         return undefined;
-    const staged = run(["ls-files", "-z", "--stage"], 0);
-    const others = run(["ls-files", "-z", "--others", "--exclude-standard"], 0);
-    const worktrees = run(["worktree", "list", "--porcelain", "-z"], 0);
-    if (staged === undefined || others === undefined || worktrees === undefined)
+    const [gitDir, commonDir] = locations;
+    if (gitDir === undefined || !isAbsolute(gitDir) || !commonDir)
         return undefined;
-    const repositories = [];
-    const bare = [];
-    const files = (path) => {
-        if (basename(path) === "HEAD")
-            bare.push(dirname(resolve(workTree, path)));
-    };
-    for (const record of staged) {
-        if (record === "")
-            continue;
-        const entry = stagedEntry.exec(record);
-        if (entry === null)
-            return undefined;
-        const [, mode = "", path = ""] = entry;
-        if (mode === "160000")
-            repositories.push(resolve(workTree, path));
-        else
-            files(path);
-    }
-    for (const path of others) {
-        if (path === "")
-            continue;
-        // Git reports a nested repository as its directory with a trailing slash.
-        if (path.endsWith("/"))
-            repositories.push(resolve(workTree, path));
-        else
-            files(path);
-    }
-    for (const field of worktrees)
-        if (field.startsWith("worktree "))
-            repositories.push(field.slice(9));
-    return {
-        administration: [gitDirectory, resolve(workTree, commonDirectory)],
-        repositories,
-        bare,
-    };
-}
-/** Git's commondir rule, compared only; never a grant or a walk. */
-function sharesCommonDirectory(gitDirectory) {
     try {
-        const target = readFileSync(join(gitDirectory, "commondir"), "utf8").replace(/[\r\n]+$/u, "");
-        return (target !== "" &&
-            realpathSync(resolve(gitDirectory, target)) !== realpathSync(gitDirectory));
+        const worktree = realpathSync(gitDir);
+        const common = realpathSync(resolve(root, commonDir));
+        if (!statSync(worktree).isDirectory() || !statSync(common).isDirectory())
+            return undefined;
+        return { common, worktree };
     }
     catch (cause) {
-        // Unreadable or dangling: protect it as its own common directory.
         if (unreadableEntry(cause))
-            return false;
+            return undefined;
         throw cause;
     }
 }
-/**
- * Discovery follows Git. Inside a work tree, Git names its administration and
- * nested repositories; ignored payload (dependency stores, tool output) is
- * not searched. Outside any work tree, or when Git cannot answer, a complete
- * walk with the directory budget finds repositories. Git administration is
- * always walked completely and never pruned.
- */
-function gitProtection(project, root, directoryLimit) {
-    const pending = [
-        { path: root, kind: "work-tree" },
-    ];
-    const readOnly = [];
-    const immovable = [];
-    const named = new Set();
-    const executable = hostGit(project);
-    let discoveredDirectories = 1; // The writable root itself.
-    let workTrees = 0;
-    const queue = (path, kind) => {
-        discoveredDirectories += 1;
-        if (discoveredDirectories > directoryLimit)
-            throw new Error(`Sandbox Git discovery exceeds ${String(directoryLimit)} directories`);
-        pending.push({ path, kind });
-    };
-    // Git-reported names are data: accept only real directories reached without
-    // a symlink, inside the writable root, once. Never bind or prepare outside.
-    const contained = (path) => {
-        if (path === root || !within(root, path))
-            return false;
-        try {
-            return realpathSync(path) === path && lstatSync(path).isDirectory();
-        }
-        catch (cause) {
-            // A reported name that no longer exists names nothing to protect. A
-            // denied one may hide a repository: rethrow EACCES so discovery refuses.
-            if (absentEntry(cause))
-                return false;
-            throw cause;
-        }
-    };
-    const name = (path, kind) => {
-        const key = `${kind}\0${path}`;
-        if (named.has(key) || !contained(path))
-            return;
-        named.add(key);
-        queue(path, kind);
-    };
-    const inspect = (path) => lstatSync(path, { throwIfNoEntry: false });
-    /** False when Git cannot answer; the caller walks the directory instead. */
-    const askGit = (workTree) => {
-        workTrees += 1;
-        if (workTrees > maximumGitWorkTrees)
-            throw new Error(`Sandbox Git discovery exceeds ${String(maximumGitWorkTrees)} work trees`);
-        const view = executable === undefined
-            ? undefined
-            : gitWorkTreeView(executable, workTree);
-        if (view === undefined)
-            return false;
-        const marker = inspect(join(workTree, ".git"));
-        if (marker?.isDirectory())
-            name(join(workTree, ".git"), "git");
-        else if (marker !== undefined)
-            readOnly.push(join(workTree, ".git")); // Never parse a Git pointer.
-        for (const path of view.administration)
-            name(path, "git");
-        // Validate each Git-reported name before inspecting anything under it.
-        for (const path of view.repositories) {
-            if (!contained(path))
-                continue;
-            const nested = inspect(join(path, ".git"));
-            if (nested?.isDirectory())
-                name(path, "work-tree");
-            else if (nested !== undefined)
-                readOnly.push(join(path, ".git"));
-        }
-        for (const path of view.bare)
-            if (contained(path) &&
-                inspect(join(path, "HEAD"))?.isFile() &&
-                (inspect(join(path, "objects"))?.isDirectory() ||
-                    inspect(join(path, "commondir"))?.isFile()))
-                name(path, "git");
-        return true;
-    };
-    for (let directory = pending.pop(); directory !== undefined; directory = pending.pop()) {
-        if (directory.kind === "work-tree") {
-            if (!askGit(directory.path))
-                pending.push({ path: directory.path, kind: "walk" });
-            continue;
-        }
-        const entries = readdirSync(directory.path, { withFileTypes: true });
-        const has = (name) => entries.some((entry) => entry.name === name);
-        const git = directory.kind === "git" ||
-            basename(directory.path) === ".git" ||
-            (has("HEAD") && (has("objects") || has("commondir"))) ||
-            (directory.kind === "modules" &&
-                (has("HEAD") || has("config") || has("hooks")));
-        // Outside administration, a directory holding a `.git` directory is a
-        // work tree whose contents Git names. A `walk` is the selected root
-        // outside any work tree, or a work tree Git could not answer for.
-        if (directory.kind === "tree" &&
-            !git &&
-            entries.some((entry) => entry.name === ".git" && entry.isDirectory()) &&
-            askGit(directory.path))
-            continue;
-        // A nested Git-file checkout is a repository boundary, not another copy of
-        // the selected project's payload to walk. The normal root scan owns common
-        // administration; never follow the pointer. Never prune the selected root or
-        // directories already recognized as Git administration.
-        if (directory.path !== root &&
-            !git &&
-            entries.some((entry) => entry.name === ".git" && entry.isFile())) {
-            readOnly.push(join(directory.path, ".git"));
-            continue;
-        }
-        if (git) {
-            immovable.push(directory.path);
-            // A read-only commondir naming another directory makes hooks and config
-            // common paths that Git never reads here; protect them only where this
-            // directory is its own common directory (bwrap caps its argv at 9,000).
-            if (!has("commondir") || !sharesCommonDirectory(directory.path))
-                readOnly.push(join(directory.path, "hooks"), join(directory.path, "config"));
-            readOnly.push(join(directory.path, "config.worktree"), 
-            // Redirects config and hooks to another common directory.
-            join(directory.path, "commondir"));
-        }
-        for (const entry of entries) {
-            const path = join(directory.path, entry.name);
-            if (entry.name === ".git" && !entry.isDirectory())
-                readOnly.push(path); // Never parse a Git pointer or grant an external dir.
-            if (!entry.isDirectory())
-                continue; // No symlink cycles or outside walks.
-            let kind = "tree";
-            if (git && entry.name === "modules")
-                kind = "modules";
-            else if (git && entry.name === "worktrees")
-                kind = "worktrees";
-            else if (!git && directory.kind === "modules")
-                kind = "modules";
-            else if (!git && directory.kind === "worktrees")
-                kind = "git";
-            queue(path, kind);
-        }
+/** Remote names from the protected common config only, never a racy worktree path. */
+export function protectedGitRemoteNames(project, common, path) {
+    const git = hostGit(project, path, true);
+    if (git === undefined)
+        return undefined;
+    const config = join(common, "config");
+    const entry = lstatSync(config, { throwIfNoEntry: false });
+    if (entry === undefined || !entry.isFile() || entry.nlink !== 1)
+        return undefined;
+    // --file plus --no-includes excludes global and Agent-writable included
+    // config. Git, not a handwritten config reader, decodes its own format.
+    const result = spawnSync(git, [
+        "config",
+        "--no-includes",
+        "--file",
+        config,
+        "--null",
+        "--name-only",
+        "--get-regexp",
+        "^remote\\..*\\.url$",
+    ], {
+        cwd: project,
+        env: gitEnvironment(),
+        maxBuffer: maximumGitOutputBytes,
+        timeout: gitTimeoutMilliseconds,
+        stdio: ["ignore", "pipe", "ignore"],
+    });
+    if (result.error !== undefined || !isUtf8(result.stdout))
+        return undefined;
+    if (result.status === 1 && result.stdout.length === 0)
+        return new Set();
+    if (result.status !== 0 || result.stdout.at(-1) !== 0)
+        return undefined;
+    const names = new Set();
+    for (const key of result.stdout.toString("utf8").slice(0, -1).split("\0")) {
+        const name = /^remote\.([A-Za-z][A-Za-z0-9_.-]*)\.url$/u.exec(key)?.[1];
+        if (name !== undefined)
+            names.add(name);
     }
-    return {
-        readOnly: [...new Set(readOnly)],
-        immovable: [...new Set(immovable)],
-    };
+    return names;
 }
-/**
- * Recompute for every command: the previous command may have initialized Git.
- * An internal caller may tighten the directory budget, never widen the ceiling.
- */
-export function sandboxPolicy(project, folder, directoryLimit = maximumDiscoveryDirectories) {
-    const limit = discoveryDirectoryLimit.parse(directoryLimit);
+/** Recompute for each command: the prior command may have initialized Git. */
+export function sandboxPolicy(project, folder) {
     const root = realpathSync(project);
     const writableRoot = realpathSync(folder);
-    const within = relative(root, writableRoot);
-    if (isAbsolute(within) || within === ".." || within.startsWith(`..${sep}`))
+    const remainder = relative(root, writableRoot);
+    if (isAbsolute(remainder) ||
+        remainder === ".." ||
+        remainder.startsWith(`..${sep}`))
         throw new Error("Sandbox folder resolves outside the project.");
     if (!lstatSync(writableRoot).isDirectory())
         throw new Error("Sandbox folder must be a directory.");
-    const git = gitProtection(root, writableRoot, limit);
-    return {
-        projectRoot: root,
-        writableRoot,
-        readOnly: [join(writableRoot, ".fungi"), ...git.readOnly],
-        immovable: git.immovable,
-    };
+    // Do not create a marker on the host for an absent .git.
+    const marker = join(writableRoot, ".git");
+    const readOnly = [join(writableRoot, ".fungi")];
+    const markerEntry = lstatSync(marker, { throwIfNoEntry: false });
+    if (markerEntry === undefined)
+        return { projectRoot: root, writableRoot, readOnly };
+    if (markerEntry.isSymbolicLink())
+        throw new UnsafeGitMarker(`Agent folder ${marker} is a symlink. Remove the .git symlink or select a different Agent folder before running sandboxed commands.`);
+    readOnly.push(marker);
+    const git = gitDirectories(root, writableRoot);
+    if (git !== undefined)
+        readOnly.push(git.worktree, git.common);
+    return { projectRoot: root, writableRoot, readOnly: [...new Set(readOnly)] };
 }