@gajae-code/coding-agent 0.18.8 → 0.18.10

package/src/task/isolation-dir.ts

@@ -0,0 +1,143 @@
+import { randomBytes } from "node:crypto";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+
+const ALLOCATION_ATTEMPTS = 8;
+
+type PathApi = Pick<typeof path, "dirname" | "isAbsolute" | "relative" | "resolve" | "sep">;
+
+function isErrno(error: unknown, code: string): boolean {
+	return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+
+function defaultToken(): string {
+	return randomBytes(9).toString("hex");
+}
+
+/**
+ * Parent directory of `mergedDir`, but only when it is a single entry inside
+ * `worktreeRoot`. Root, empty, nested, and escaped paths are refused so
+ * cleanup cannot delete the worktree root or another session's tree by
+ * walking up.
+ */
+export function resolveIsolationRemovalTarget(
+	mergedDir: string,
+	worktreeRoot: string,
+	pathApi: PathApi = path,
+): string {
+	if (mergedDir.length === 0) {
+		throw new Error("Refusing to remove an isolation directory for an empty merged path.");
+	}
+	if (worktreeRoot.length === 0) {
+		throw new Error("Refusing to remove an isolation directory without a worktree root.");
+	}
+	const baseDir = pathApi.resolve(pathApi.dirname(mergedDir));
+	const root = pathApi.resolve(worktreeRoot);
+	const relative = pathApi.relative(root, baseDir);
+	if (
+		relative.length === 0 ||
+		relative === "." ||
+		relative.startsWith("..") ||
+		pathApi.isAbsolute(relative) ||
+		relative.includes(pathApi.sep) ||
+		relative.includes("/") ||
+		relative.includes("\\")
+	) {
+		throw new Error("Refusing to remove an isolation directory that is not a single worktree entry.");
+	}
+	return baseDir;
+}
+
+/**
+ * Create an exclusive directory next to `canonicalBaseDir`. Never removes
+ * `canonicalBaseDir` or any path that already exists.
+ */
+export async function allocateDisjointIsolationDir(
+	canonicalBaseDir: string,
+	tokenFactory: () => string = defaultToken,
+): Promise<string> {
+	const parent = path.dirname(canonicalBaseDir);
+	const stem = path.basename(canonicalBaseDir);
+	if (stem.length === 0 || stem === "." || stem === ".." || stem.includes("/") || stem.includes("\\")) {
+		throw new Error("Isolation directory name is not a single path segment.");
+	}
+	await fs.mkdir(parent, { recursive: true, mode: 0o700 });
+
+	for (let attempt = 0; attempt < ALLOCATION_ATTEMPTS; attempt++) {
+		const token = tokenFactory();
+		if (!/^[0-9a-f]+$/i.test(token)) {
+			throw new Error("Isolation directory token is not hexadecimal.");
+		}
+		const name = `${stem}-${token}`;
+		const baseDir = path.join(parent, name);
+		const relative = path.relative(parent, baseDir);
+		if (relative !== name || path.isAbsolute(relative)) {
+			throw new Error("Isolation directory escaped its parent.");
+		}
+		try {
+			await fs.mkdir(baseDir, { mode: 0o700 });
+			return baseDir;
+		} catch (error) {
+			if (isErrno(error, "EEXIST")) continue;
+			if (isErrno(error, "EPERM")) {
+				try {
+					await fs.lstat(baseDir);
+					continue;
+				} catch (statError) {
+					if (!isErrno(statError, "ENOENT")) throw statError;
+				}
+			}
+			throw error;
+		}
+	}
+
+	throw new Error("Failed to allocate a disjoint task isolation directory.");
+}
+
+/**
+ * Confirm native teardown may see `mergedDir`.
+ *
+ * `isoStop` deletes that path. The parent entry and `merged` itself must
+ * already be real directories, because native removal follows symlinks.
+ * A missing parent means there is nothing to stop. This does not close a
+ * replacement that happens after the lstat returns.
+ */
+export async function assertIsolationTeardownTarget(mergedDir: string, worktreeRoot: string): Promise<"stop" | "skip"> {
+	const baseDir = resolveIsolationRemovalTarget(mergedDir, worktreeRoot);
+	let baseInfo: { isSymbolicLink(): boolean };
+	try {
+		baseInfo = await fs.lstat(baseDir);
+	} catch (error) {
+		if (isErrno(error, "ENOENT")) return "skip";
+		throw error;
+	}
+	if (baseInfo.isSymbolicLink()) {
+		throw new Error("Refusing to remove a symlinked isolation directory.");
+	}
+	try {
+		const mergedInfo = await fs.lstat(mergedDir);
+		if (mergedInfo.isSymbolicLink()) {
+			throw new Error("Refusing to tear down a symlinked isolation merged directory.");
+		}
+	} catch (error) {
+		if (isErrno(error, "ENOENT")) return "stop";
+		throw error;
+	}
+	return "stop";
+}
+
+/** Remove the isolation directory that owns `mergedDir`. Missing directories are ignored. */
+export async function removeIsolationDirectory(mergedDir: string, worktreeRoot: string): Promise<void> {
+	const baseDir = resolveIsolationRemovalTarget(mergedDir, worktreeRoot);
+	let info: { isSymbolicLink(): boolean };
+	try {
+		info = await fs.lstat(baseDir);
+	} catch (error) {
+		if (isErrno(error, "ENOENT")) return;
+		throw error;
+	}
+	if (info.isSymbolicLink()) {
+		throw new Error("Refusing to remove a symlinked isolation directory.");
+	}
+	await fs.rm(baseDir, { recursive: true, force: true });
+}

package/src/task/worktree.ts

@@ -5,8 +5,9 @@ import * as path from "node:path";
 
 import type * as natives from "@gajae-code/natives";
 
-import { getWorktreeDir, hashPath, logger, Snowflake } from "@gajae-code/utils";
+import { getWorktreeDir, getWorktreesDir, hashPath, logger, Snowflake } from "@gajae-code/utils";
 import * as git from "../utils/git";
+import { allocateDisjointIsolationDir, assertIsolationTeardownTarget, removeIsolationDirectory } from "./isolation-dir";
 
 let nativeWorktreeBindings: typeof import("@gajae-code/natives") | undefined;
 
@@ -401,8 +402,13 @@ export async function ensureIsolation(
 	preferred?: IsoBackendKind,
 ): Promise<IsolationHandle> {
 	const repoRoot = await getRepoRoot(baseCwd);
-	const baseDir = getWorktreeDir(`${id}-${hashPath(repoRoot)}`);
+	// Task ids are allocated inside one session, so `<id>-<repo hash>` is shared
+	// by every fresh session's first task. Never remove that canonical directory.
+	// Each attempt gets an exclusive sibling and only that sibling is removed.
+	const canonicalBaseDir = getWorktreeDir(`${id}-${hashPath(repoRoot)}`);
+	const baseDir = await allocateDisjointIsolationDir(canonicalBaseDir);
 	const mergedDir = path.join(baseDir, "merged");
+	const worktreeRoot = getWorktreesDir();
 	const natives = nativeWorktree();
 
 	const resolution = natives.isoResolve(preferred ?? null);
@@ -410,7 +416,7 @@ export async function ensureIsolation(
 	let fallbackReason = resolution.reason ?? null;
 
 	for (const candidate of candidates) {
-		await fs.rm(baseDir, { recursive: true, force: true });
+		await removeIsolationDirectory(mergedDir, worktreeRoot);
 		try {
 			await natives.isoStart(candidate, repoRoot, mergedDir);
 			return {
@@ -420,7 +426,7 @@ export async function ensureIsolation(
 				fallbackReason,
 			};
 		} catch (err) {
-			await fs.rm(baseDir, { recursive: true, force: true });
+			await removeIsolationDirectory(mergedDir, worktreeRoot);
 			const message = errorMessage(err);
 			if (!natives.isoIsUnavailableError(message)) {
 				throw err;
@@ -434,6 +440,11 @@ export async function ensureIsolation(
 
 /** Tear down a handle returned by {@link ensureIsolation}. */
 export async function cleanupIsolation(handle: IsolationHandle): Promise<void> {
+	const worktreeRoot = getWorktreesDir();
+	// Native isoStop removes `mergedDir` and follows symlinks. Refuse a
+	// symlink that is already present before that call.
+	const teardown = await assertIsolationTeardownTarget(handle.mergedDir, worktreeRoot);
+	if (teardown === "skip") return;
 	const natives = nativeWorktree();
 	try {
 		try {
@@ -446,9 +457,7 @@ export async function cleanupIsolation(handle: IsolationHandle): Promise<void> {
 			});
 		}
 	} finally {
-		// baseDir is the parent of the merged directory
-		const baseDir = path.dirname(handle.mergedDir);
-		await fs.rm(baseDir, { recursive: true, force: true });
+		await removeIsolationDirectory(handle.mergedDir, worktreeRoot);
 	}
 }
 

package/src/tools/ast-edit-write-path.ts

@@ -0,0 +1,68 @@
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+
+const MAX_ANCESTOR_WALK = 64;
+
+function isInside(root: string, target: string): boolean {
+	const relative = path.relative(root, target);
+	return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+
+/**
+ * Path the native writer will mutate: realpath of an existing file, or realpath
+ * of the nearest existing ancestor plus the missing tail.
+ */
+export async function canonicalizeAstEditWritePath(absolutePath: string): Promise<string> {
+	const suffix: string[] = [];
+	let current = path.resolve(absolutePath);
+	for (let depth = 0; depth < MAX_ANCESTOR_WALK; depth++) {
+		try {
+			const real = await fs.realpath(current);
+			return suffix.length === 0 ? real : path.join(real, ...suffix.toReversed());
+		} catch {
+			const parent = path.dirname(current);
+			if (parent === current) break;
+			suffix.push(path.basename(current));
+			current = parent;
+		}
+	}
+	return path.resolve(absolutePath);
+}
+
+/**
+ * Preview paths as the workflow guard must see them.
+ *
+ * The guard compares lexically against the session cwd. A raw realpath misses
+ * `.gjc/**` when that cwd is not already canonical (`/var` vs `/private/var`,
+ * or a symlinked workspace), so an in-workspace real path is reattached to `cwd`.
+ */
+export async function resolveAstEditPreviewWritePaths(
+	cwd: string,
+	previewedPaths: readonly string[],
+): Promise<string[]> {
+	const resolvedCwd = path.resolve(cwd);
+	let realCwd = resolvedCwd;
+	try {
+		realCwd = await fs.realpath(resolvedCwd);
+	} catch {
+		// Missing cwd has no canonical spelling; keep the lexical root.
+	}
+	const resolved: string[] = [];
+	for (const previewed of previewedPaths) {
+		const lexical = path.resolve(resolvedCwd, previewed);
+		const real = await canonicalizeAstEditWritePath(lexical);
+		const relative = path.relative(realCwd, real);
+		const canonical =
+			isInside(realCwd, real) && relative !== ""
+				? path.resolve(resolvedCwd, relative)
+				: isInside(realCwd, real)
+					? resolvedCwd
+					: real;
+		// The guard matches `.gjc` lexically. Keep the preview spelling so a
+		// symlinked `.gjc` directory is still recognized, and add the canonical
+		// spelling so `src` → `.gjc` is recognized too.
+		resolved.push(previewed);
+		if (path.resolve(canonical) !== lexical) resolved.push(canonical);
+	}
+	return resolved;
+}

package/src/tools/ast-edit.ts

@@ -13,11 +13,13 @@ import { assertWorkflowMutationRawPathsAllowed } from "../skill-state/workflow-m
 import { Ellipsis, fileHyperlink, renderStatusLine, renderTreeList, truncateToWidth } from "../tui";
 import { resolveFileDisplayMode } from "../utils/file-display-mode";
 import type { ToolSession } from ".";
+import { resolveAstEditPreviewWritePaths } from "./ast-edit-write-path";
+import { assertEditableFile } from "./auto-generated-guard";
 import { createFileRecorder, formatResultPath } from "./file-recorder";
 import { formatGroupedFiles } from "./grouped-file-output";
 import type { OutputMeta } from "./output-meta";
 import { resolveToolSearchScope } from "./path-utils";
-import { enforcePlanModeWrite } from "./plan-mode-guard";
+import { enforcePlanModeWrite, resolvePlanPath } from "./plan-mode-guard";
 import {
 	appendParseErrorsBulletList,
 	capParseErrors,
@@ -344,8 +346,11 @@ export class AstEditTool implements AgentTool<typeof astEditSchema, AstEditToolD
 						await assertWorkflowMutationRawPathsAllowed({
 							cwd: this.session.cwd,
 							sessionId: this.session.getSessionId?.() ?? undefined,
-							rawPaths: previewedFiles,
+							rawPaths: await resolveAstEditPreviewWritePaths(this.session.cwd, previewedFiles),
 						});
+						for (const filePath of previewedFiles) {
+							await assertEditableFile(resolvePlanPath(this.session, filePath), filePath, this.session.settings);
+						}
 						const applyResult = await runAstEditOnce(multiTargets, resolvedSearchPath, globFilter, {
 							rewrites: normalizedRewrites,
 							dryRun: false,

package/src/tools/browser/cdp-url.ts

@@ -0,0 +1,18 @@
+const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+
+/** Require an http(s) CDP URL whose host is loopback. */
+export function assertLoopbackCdpUrl(cdpUrl: string): string {
+	let parsed: URL;
+	try {
+		parsed = new URL(cdpUrl);
+	} catch {
+		throw new Error(`Refusing non-loopback CDP endpoint: ${cdpUrl}`);
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+		throw new Error(`Refusing non-loopback CDP endpoint: ${cdpUrl}`);
+	}
+	if (!LOOPBACK_HOSTS.has(parsed.hostname.toLowerCase())) {
+		throw new Error(`Refusing non-loopback CDP endpoint: ${cdpUrl}`);
+	}
+	return cdpUrl;
+}

package/src/tools/browser.ts

@@ -6,6 +6,7 @@ import * as z from "zod/v4";
 import browserDescription from "../prompts/tools/browser.md" with { type: "text" };
 import type { ToolSession } from "../sdk";
 import { type BrowserActionStep, compileActionSteps } from "./browser/actions";
+import { assertLoopbackCdpUrl } from "./browser/cdp-url";
 import { isChromeProfileExecutableForLaunch, isEdgeExecutable, resolveSystemChromeForProfile } from "./browser/launch";
 import { chromeUserDataRoots, type DiscoveryEnv, defaultDiscoveryEnv } from "./browser/profile-discovery";
 import { acquireBrowser, type BrowserHandle, type BrowserKind, type BrowserKindTag } from "./browser/registry";
@@ -245,7 +246,13 @@ async function resolveBrowserKind(
 ): Promise<BrowserKind> {
 	const app = params.app;
 	if (app?.cdp_url) {
-		return { kind: "connected", cdpUrl: app.cdp_url.replace(/\/+$/, "") };
+		const cdpUrl = app.cdp_url.replace(/\/+$/, "");
+		try {
+			assertLoopbackCdpUrl(cdpUrl);
+		} catch (error) {
+			throw new ToolError(error instanceof Error ? error.message : String(error));
+		}
+		return { kind: "connected", cdpUrl };
 	}
 	if (app?.browser === "chrome") {
 		return resolveChromeProfileKind(app, session, signal, discoveryEnv);

package/src/tools/gh.ts

@@ -8,10 +8,12 @@ import { getWorktreeDir, hashPath, isEnoent, prompt, untilAborted } from "@gajae
 import * as z from "zod/v4";
 import type { Settings } from "../config/settings";
 import githubDescription from "../prompts/tools/github.md" with { type: "text" };
+import { assertWorkflowMutationAllowed } from "../skill-state/workflow-mutation-guard";
 import * as git from "../utils/git";
 import type { ToolSession } from ".";
 import { formatShortSha } from "./gh-format";
 import { type CacheStatus, getOrFetchView, resolveGithubCacheAuthKey } from "./github-cache";
+import { githubMutationTool, isGithubReadOnlyOp } from "./github-side-effect";
 import type { OutputMeta } from "./output-meta";
 import { ToolError, throwIfAborted } from "./tool-errors";
 import { toolResult } from "./tool-result";
@@ -2591,6 +2593,14 @@ export class GithubTool implements AgentTool<typeof githubSchema, GhToolDetails>
 		_context?: AgentToolContext,
 	): Promise<AgentToolResult<GhToolDetails>> {
 		return untilAborted(signal, async () => {
+			if (!isGithubReadOnlyOp(params.op)) {
+				await assertWorkflowMutationAllowed({
+					cwd: this.session.cwd,
+					sessionId: this.session.getSessionId?.() ?? undefined,
+					tool: githubMutationTool,
+					args: params,
+				});
+			}
 			switch (params.op) {
 				case "repo_view":
 					return executeRepoView(this.session, params, signal);

package/src/tools/github-side-effect.ts

@@ -0,0 +1,112 @@
+/**
+ * Classify `github` tool operations for the approval gate and the planning
+ * mutation guard. Read-only ops stay available. Every other op, including a
+ * missing or unrecognized one, is a side effect and fails closed.
+ */
+import type { AgentTool } from "@gajae-code/agent-core";
+
+/** Name-only tool the planning guard uses when `GithubTool.execute` checks itself. */
+export const githubMutationTool = {
+	name: "github",
+	label: "GitHub",
+	description: "github",
+	parameters: {},
+	execute: async () => ({ content: [] }),
+} as AgentTool;
+
+const GITHUB_READ_ONLY_OPS = new Set([
+	"repo_view",
+	"search_issues",
+	"search_prs",
+	"search_code",
+	"search_commits",
+	"search_repos",
+	"run_watch",
+]);
+
+const GITHUB_SIDE_EFFECT_OPS = new Set(["pr_create", "pr_checkout", "pr_push"]);
+
+const TITLE_MAX = 160;
+
+function recordOf(args: unknown): Record<string, unknown> | undefined {
+	if (!args || typeof args !== "object" || Array.isArray(args)) return undefined;
+	return args as Record<string, unknown>;
+}
+
+function stringField(record: Record<string, unknown> | undefined, key: string): string | undefined {
+	const value = record?.[key];
+	if (typeof value !== "string") return undefined;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : undefined;
+}
+
+function clip(value: string): string {
+	const cleaned = value
+		.replace(/[\u0000-\u001f\u007f]/g, " ")
+		.replace(/\s+/g, " ")
+		.trim();
+	if (cleaned.length <= TITLE_MAX) return cleaned;
+	return `${cleaned.slice(0, TITLE_MAX - 1)}…`;
+}
+
+function formatPr(value: unknown): string {
+	if (typeof value === "string" && value.trim()) return value.trim();
+	if (!Array.isArray(value)) return "the current pull request";
+	const parts = value.filter((item): item is string => typeof item === "string" && item.trim().length > 0);
+	return parts.length > 0 ? parts.join(", ") : "the current pull request";
+}
+
+export function githubOp(args: unknown): string | undefined {
+	const op = recordOf(args)?.op;
+	return typeof op === "string" ? op : undefined;
+}
+
+/** True only for a known read-only github op. Missing and unknown ops are not read-only. */
+export function isGithubReadOnlyArgs(args: unknown): boolean {
+	const op = githubOp(args);
+	return op !== undefined && GITHUB_READ_ONLY_OPS.has(op);
+}
+
+export function isGithubReadOnlyOp(op: string): boolean {
+	return GITHUB_READ_ONLY_OPS.has(op);
+}
+
+/**
+ * Approval summary for a side-effect github call. The PR body is omitted so a
+ * token pasted into `body` is not copied into the permission title.
+ */
+export function describeGithubSideEffect(args: unknown): string {
+	const record = recordOf(args);
+	const op = githubOp(args) ?? "";
+	if (op === "pr_push") {
+		const branch = stringField(record, "branch") ?? "the current branch";
+		const lease = record?.forceWithLease === true ? " with --force-with-lease" : "";
+		return clip(`Push ${branch} to its pull request branch${lease} using stored git credentials`);
+	}
+	if (op === "pr_checkout") {
+		const force = record?.force === true ? " and reset the local branch" : "";
+		return clip(
+			`Check out ${formatPr(record?.pr)} into ~/.gjc/wt, write branch git config, and may add a remote${force}`,
+		);
+	}
+	if (op === "pr_create") {
+		const repo = stringField(record, "repo") ?? "the current repository";
+		const head = stringField(record, "head") ?? "the current branch";
+		const base = stringField(record, "base") ?? "the default base";
+		return clip(`Create a pull request on ${repo} from ${head} into ${base} with gh`);
+	}
+	return "Run a github operation that is not read-only";
+}
+
+export function githubPermissionIntent(
+	args: unknown,
+): { toolName: string; title: string; cacheKey: string } | undefined {
+	if (isGithubReadOnlyArgs(args)) return undefined;
+	const op = githubOp(args);
+	const cacheOp = op && GITHUB_SIDE_EFFECT_OPS.has(op) ? op : "unspecified";
+	return {
+		toolName: "github",
+		title: describeGithubSideEffect(args),
+		cacheKey: `github:${cacheOp}`,
+	};
+}

package/src/tools/monitor-mutation.ts

@@ -0,0 +1,27 @@
+import type { AgentTool } from "@gajae-code/agent-core";
+import { assertWorkflowMutationAllowed } from "../skill-state/workflow-mutation-guard";
+
+const bashShapedTool = {
+	name: "bash",
+	label: "bash",
+	description: "bash",
+	parameters: {},
+	execute: async () => ({ content: [] }),
+} as AgentTool;
+
+/**
+ * Judge a monitor command with the same mutation rules as bash. Monitor is a
+ * background shell, so a planning-phase mutation must fail before the job starts.
+ */
+export async function assertMonitorMutationAllowed(input: {
+	cwd: string;
+	sessionId?: string;
+	command: string;
+}): Promise<void> {
+	await assertWorkflowMutationAllowed({
+		cwd: input.cwd,
+		sessionId: input.sessionId,
+		tool: bashShapedTool,
+		args: { command: input.command },
+	});
+}

package/src/tools/monitor.ts

@@ -7,6 +7,7 @@ import { truncateTail } from "../session/streaming-output";
 import { lookupOwnedRegistration } from "../session/terminal-abort";
 import { BashTool } from "./bash";
 import type { ToolSession } from "./index";
+import { assertMonitorMutationAllowed } from "./monitor-mutation";
 import { ToolError } from "./tool-errors";
 import { TOOL_TIMEOUTS } from "./tool-timeouts";
 
@@ -137,6 +138,12 @@ export class MonitorTool implements AgentTool<typeof monitorSchema, MonitorToolD
 			throw new ToolError("Async execution is disabled; the monitor tool is unavailable in this session.");
 		}
 
+		await assertMonitorMutationAllowed({
+			cwd: this.session.cwd,
+			sessionId: this.session.getSessionId?.() ?? undefined,
+			command: params.command,
+		});
+
 		const persistent = params.persistent ?? false;
 		const label = buildMonitorLabel(params);
 		const ownerId = this.session.getAgentId?.() ?? undefined;

package/src/tools/python.ts

@@ -297,6 +297,13 @@ export function createSessionPythonTool(input: SessionPythonToolInput): AgentToo
 					signal?.removeEventListener("abort", abortFromCaller);
 					contextGeneration.abortControllers.delete(abortController);
 				});
+			const settled = execution.then(
+				() => {},
+				() => {},
+			);
+			contextGeneration.completions.add(settled);
+			void settled.then(() => contextGeneration.completions.delete(settled));
+
 			let completion: Promise<AgentToolResult>;
 			try {
 				completion = input.trackEvalExecution ? input.trackEvalExecution(execution, abortController) : execution;
@@ -308,12 +315,6 @@ export function createSessionPythonTool(input: SessionPythonToolInput): AgentToo
 				void execution.catch(() => {});
 				throw error;
 			}
-			const settled = completion.then(
-				() => {},
-				() => {},
-			);
-			contextGeneration.completions.add(settled);
-			void settled.then(() => contextGeneration.completions.delete(settled));
 			return await completion;
 		},
 	};

package/src/utils/external-editor.ts

@@ -6,11 +6,12 @@ import { spawn } from "node:child_process";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
-import { $env, Snowflake } from "@gajae-code/utils";
+import { $pickCredentialEnv, Snowflake } from "@gajae-code/utils";
 
 /** Returns the user's preferred editor command, or undefined if not configured. */
 export function getEditorCommand(): string | undefined {
-	return $env.VISUAL || $env.EDITOR || undefined;
+	// The editor is executed, so a repository `.env` must not be able to choose it.
+	return $pickCredentialEnv("VISUAL", "EDITOR");
 }
 
 export interface OpenInEditorOptions {

package/src/web/insane/url-guard.ts

@@ -74,7 +74,7 @@ function isBlockedHostname(hostname: string): boolean {
 function isPrivateIPv4(address: string): boolean {
 	const parts = address.split(".").map(part => Number.parseInt(part, 10));
 	if (parts.length !== 4 || parts.some(part => !Number.isInteger(part) || part < 0 || part > 255)) return true;
-	const [a, b] = parts;
+	const [a, b, c] = parts;
 	return (
 		a === 0 || // unspecified / "this network"
 		a === 10 || // RFC1918
@@ -83,6 +83,7 @@ function isPrivateIPv4(address: string): boolean {
 		(a === 169 && b === 254) || // link-local
 		(a === 172 && b >= 16 && b <= 31) || // RFC1918
 		(a === 192 && b === 0) || // 192.0.0/24 & 192.0.2/24 (documentation/reserved)
+		(a === 192 && b === 88 && c === 99) || // 192.88.99.0/24 deprecated 6to4 anycast; 192.88.99.2/32 is not globally reachable
 		(a === 192 && b === 168) || // RFC1918
 		(a === 198 && (b === 18 || b === 19)) || // benchmarking 198.18/15
 		(a === 198 && b === 51) || // 198.51.100/24 documentation