@impeccable/reviews 0.1.9 → 0.1.11

package/dist/playbook/public-preview-request.js

@@ -0,0 +1,96 @@
+import { lookup } from 'node:dns/promises';
+import { request } from 'node:https';
+import { BlockList, isIP } from 'node:net';
+const blockedV4 = new BlockList();
+for (const [address, prefix] of [
+    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8],
+    ['169.254.0.0', 16], ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.0.2.0', 24],
+    ['192.88.99.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15], ['198.51.100.0', 24],
+    ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4],
+])
+    blockedV4.addSubnet(address, prefix, 'ipv4');
+const publicV6 = new BlockList();
+publicV6.addSubnet('2000::', 3, 'ipv6');
+const blockedV6 = new BlockList();
+// Conservatively exclude special-purpose, transition and documentation prefixes.
+for (const [address, prefix] of [
+    ['2001::', 23], ['2001:db8::', 32], ['2002::', 16], ['3fff::', 20],
+])
+    blockedV6.addSubnet(address, prefix, 'ipv6');
+export function isPlatformPreview(target) {
+    return target.protocol === 'https:' && !target.username && !target.password && !target.port
+        && !/[?#]/.test(target.href)
+        && /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+(?:vercel|netlify)\.app$/.test(target.hostname);
+}
+function isPublicAddress(value) {
+    if (!value || typeof value.address !== 'string' || value.address.includes('%'))
+        return false;
+    const family = isIP(value.address);
+    if (family !== value.family)
+        return false;
+    if (family === 4)
+        return !blockedV4.check(value.address, 'ipv4');
+    return family === 6 && publicV6.check(value.address, 'ipv6') && !blockedV6.check(value.address, 'ipv6');
+}
+/** Resolve once, validate every answer, then connect only to the pinned public addresses. */
+export async function publicPreviewRequest(target, signal, dependencies = {}) {
+    try {
+        if (!isPlatformPreview(target))
+            throw new Error();
+        signal.throwIfAborted();
+        let abortDns = () => { };
+        const aborted = new Promise((_resolve, reject) => {
+            abortDns = () => reject(new Error());
+            signal.addEventListener('abort', abortDns, { once: true });
+        });
+        const addresses = await Promise.race([
+            (dependencies.lookup ?? lookup)(target.hostname, { all: true, verbatim: true }), aborted,
+        ]).finally(() => signal.removeEventListener('abort', abortDns));
+        signal.throwIfAborted();
+        if (!Array.isArray(addresses) || !addresses.length || !addresses.every(isPublicAddress))
+            throw new Error();
+        const pinned = addresses.map(({ address, family }) => ({ address, family }));
+        return await new Promise((resolve, reject) => {
+            const options = {
+                method: 'GET', headers: { accept: 'text/html' }, signal,
+                agent: false, autoSelectFamily: true, rejectUnauthorized: true,
+                lookup(hostname, options, callback) {
+                    if (hostname !== target.hostname)
+                        return callback(new Error('Preview request failed'), '');
+                    if (options.all)
+                        callback(null, pinned.map((address) => ({ ...address })));
+                    else
+                        callback(null, pinned[0].address, pinned[0].family);
+                },
+            };
+            const req = (dependencies.request ?? request)(target, options, (response) => {
+                response.once('error', () => { });
+                try {
+                    const status = response.statusCode;
+                    const headers = new Headers();
+                    for (const name of ['location', 'x-vercel-error']) {
+                        const value = response.headers[name];
+                        if (typeof value === 'string')
+                            headers.set(name, value);
+                    }
+                    if (!status)
+                        reject(new Error());
+                    else
+                        resolve({ status, headers, body: null });
+                }
+                catch {
+                    reject(new Error());
+                }
+                finally {
+                    response.destroy();
+                }
+            });
+            req.once('error', () => reject(new Error()));
+            req.once('upgrade', (_response, socket) => { socket.destroy(); reject(new Error()); });
+            req.end();
+        });
+    }
+    catch {
+        throw new Error('Preview request failed');
+    }
+}

package/dist/playbook/publication-wait.js

@@ -0,0 +1,46 @@
+import { setTimeout as sleep } from 'node:timers/promises';
+const INTERVAL_MS = 30_000;
+const DEADLINE_MS = 8 * 60_000;
+/** One publication deadline per setup PR, including time spent checking the preview. */
+export function createPublicationWait(dependencies = {}) {
+    const now = dependencies.now ?? (() => performance.now());
+    const pause = dependencies.sleep ?? ((ms, signal) => sleep(ms, undefined, { signal }));
+    const starts = new Map();
+    return {
+        begin(pr) {
+            if (!starts.has(pr))
+                starts.set(pr, now());
+        },
+        remainingMs(pr) {
+            const start = starts.get(pr);
+            return start === undefined ? null : Math.max(0, DEADLINE_MS - (now() - start));
+        },
+        async wait(pr, signal) {
+            const start = starts.get(pr);
+            if (start === undefined)
+                return null;
+            const result = (status) => {
+                const elapsed = Math.max(0, now() - start);
+                return {
+                    status,
+                    waited_seconds: Math.floor(elapsed / 1000),
+                    remaining_seconds: Math.ceil(Math.max(0, DEADLINE_MS - elapsed) / 1000),
+                };
+            };
+            if (signal?.aborted)
+                return result('cancelled');
+            const remaining = DEADLINE_MS - (now() - start);
+            if (remaining <= 0)
+                return result('timed-out');
+            try {
+                await pause(Math.min(INTERVAL_MS, remaining), signal);
+            }
+            catch {
+                return result('cancelled');
+            }
+            if (signal?.aborted)
+                return result('cancelled');
+            return result(now() - start >= DEADLINE_MS ? 'timed-out' : 'retry');
+        },
+    };
+}

package/dist/playbook/vercel-protection.js

@@ -0,0 +1,121 @@
+import { execFile } from 'node:child_process';
+import { constants } from 'node:fs';
+import { lstat, open, realpath } from 'node:fs/promises';
+import { join } from 'node:path';
+const METADATA_LIMIT = 16 * 1024;
+const OUTPUT_LIMIT = 2 * 1024 * 1024;
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value : undefined;
+}
+/** Only the root's small project-link metadata is read; CLI authentication stays with the CLI. */
+async function linkedProject(cwd) {
+    try {
+        const root = await realpath(cwd);
+        const directory = join(root, '.vercel');
+        const directoryStat = await lstat(directory);
+        if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink() || await realpath(directory) !== directory)
+            return;
+        const path = join(directory, 'project.json');
+        if (!(await lstat(path)).isFile())
+            return;
+        const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const stat = await file.stat();
+            const currentDirectory = await lstat(directory);
+            const currentFile = await lstat(path);
+            if (!stat.isFile() || stat.size > METADATA_LIMIT
+                || currentDirectory.dev !== directoryStat.dev || currentDirectory.ino !== directoryStat.ino
+                || currentFile.isSymbolicLink() || currentFile.dev !== stat.dev || currentFile.ino !== stat.ino
+                || await realpath(path) !== path)
+                return;
+            const buffer = Buffer.alloc(METADATA_LIMIT + 1);
+            const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
+            if (bytesRead > METADATA_LIMIT)
+                return;
+            const metadata = record(JSON.parse(buffer.toString('utf8', 0, bytesRead)));
+            if (typeof metadata?.projectId !== 'string' || !/^prj_[A-Za-z0-9]{1,128}$/.test(metadata.projectId)
+                || typeof metadata.orgId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(metadata.orgId))
+                return;
+            return { root, projectId: metadata.projectId, orgId: metadata.orgId };
+        }
+        finally {
+            await file.close();
+        }
+    }
+    catch {
+        return;
+    }
+}
+/** Reuse one existing default automation bypass in memory, without exposing project responses or keys. */
+export async function useExistingVercelBypass(input, dependencies) {
+    const { signal } = dependencies;
+    if (signal?.aborted)
+        return { status: 'cancelled' };
+    if (!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(input.owner)
+        || !/^[a-zA-Z0-9_.-]{1,100}$/.test(input.repo) || input.repo === '.' || input.repo === '..') {
+        return { status: 'project-mismatch' };
+    }
+    const linked = await linkedProject(input.cwd);
+    if (signal?.aborted)
+        return { status: 'cancelled' };
+    if (!linked)
+        return { status: 'not-linked' };
+    const runVercel = dependencies.runVercel ?? ((args) => new Promise((resolve, reject) => {
+        const child = execFile('vercel', args, {
+            cwd: linked.root, encoding: 'utf8', timeout: 30_000, maxBuffer: OUTPUT_LIMIT, signal,
+        }, (error, stdout) => error ? reject(new Error('Vercel project lookup failed.')) : resolve(stdout));
+        child.stdin?.end();
+    }));
+    // teamId selects the linked team. Legacy personal projects omit it and still require accountId to match.
+    const route = `/v9/projects/${linked.projectId}${linked.orgId.startsWith('team_') ? `?teamId=${linked.orgId}` : ''}`;
+    let selected;
+    try {
+        const stdout = await runVercel(['api', route, '--method', 'GET', '--raw', '--non-interactive'], signal);
+        if (signal?.aborted)
+            return { status: 'cancelled' };
+        if (Buffer.byteLength(stdout, 'utf8') > OUTPUT_LIMIT)
+            return { status: 'unavailable' };
+        const project = record(JSON.parse(stdout));
+        const link = record(project?.link);
+        if (project?.id !== linked.projectId || project.accountId !== linked.orgId
+            || !link || !['github', 'github-limited'].includes(String(link.type))
+            || typeof link.org !== 'string' || link.org.toLowerCase() !== input.owner.toLowerCase()
+            || typeof link.repo !== 'string' || link.repo.toLowerCase() !== input.repo.toLowerCase()) {
+            return { status: 'project-mismatch' };
+        }
+        const bypasses = record(project.protectionBypass);
+        if (!bypasses || Object.keys(bypasses).length > 128)
+            return { status: 'unavailable' };
+        const candidates = [];
+        for (const [value, metadata] of Object.entries(bypasses)) {
+            const bypass = record(metadata);
+            if (bypass?.scope !== 'automation-bypass')
+                continue;
+            if (!/^[A-Za-z0-9]{32}$/.test(value)
+                || (bypass.isEnvVar !== undefined && typeof bypass.isEnvVar !== 'boolean'))
+                return { status: 'unavailable' };
+            // An omitted isEnvVar is the legacy default. Explicit false keys must never be chosen implicitly.
+            if (bypass.isEnvVar !== false)
+                candidates.push(value);
+        }
+        if (candidates.length > 1)
+            return { status: 'ambiguous' };
+        if (candidates.length === 0)
+            return { status: 'unavailable' };
+        selected = candidates[0];
+        dependencies.rememberSecret(selected);
+    }
+    catch {
+        return { status: signal?.aborted ? 'cancelled' : 'unavailable' };
+    }
+    if (signal?.aborted)
+        return { status: 'cancelled' };
+    try {
+        const status = await dependencies.save(selected);
+        return { status: ['saved', 'save-failed', 'partial-save', 'cancelled'].includes(status) ? status : 'save-failed' };
+    }
+    catch {
+        return { status: signal?.aborted ? 'cancelled' : 'save-failed' };
+    }
+}

package/dist/sandbox.js

@@ -122,7 +122,8 @@ function moved(env, gitConfigs, kept) {
 }
 /**
  * What a command in the sandbox reads and writes: it reads what the person can but the credential folders, where their
- * environment moved them, and the files git's global settings come from (`gitConfigs`), and writes
+ * environment moved them, and the files git's global settings come from and the credential helper programs its system
+ * settings name (`gitConfigs`), and writes
  * in the checkout, its git folders (a worktree's are outside it), the run's scratch folder and the package caches, but
  * never where git reads settings or programs from, nor a .git below the checkout's top. Bubblewrap takes no pattern in
  * a write rule, and puts a file in place of a denied path that is not there: on Linux the names git reads as nothing
@@ -145,7 +146,7 @@ export function sandboxPolicy(o) {
     };
 }
 /**
- * The global git settings a command in the sandbox keeps: the person's name and email, what shapes how git reads the
+ * The git settings, global and system, a command in the sandbox keeps: the person's name and email, what shapes how git reads the
  * checkout (line endings, case, excludes, attributes, and the content filters, which git add runs: of their commands only
  * LFS's, see LFS_COMMAND, and every filter's `required`) and safe.directory. Nothing that carries or names a sign-in (http's
  * headers, proxy, cookies and certificates, url rewrites, credential helpers, sendemail's and imap's passwords, includes),
@@ -158,27 +159,46 @@ const KEPT_SETTINGS = /^(?:user\.(?:name|email)|init\.defaultbranch|core\.(?:aut
  * filtered rather than stage it unfiltered.
  */
 const LFS_COMMAND = /^git(?:-| +)lfs +(?:clean|smudge|filter-process)(?: +--skip)?(?: +(?:-- +)?%f)?$/;
-/** git's `-z --show-origin` listing, setting by setting: the file it came from, its key, and its value when it has one. */
+/** git's `-z --show-scope --show-origin` listing, setting by setting: its scope, the file it came from, its key, and its value when it has one. */
 function* settings(listing) {
     const parts = listing.split('\0');
-    for (let i = 0; i + 1 < parts.length; i += 2) {
-        const origin = parts[i], entry = parts[i + 1];
+    for (let i = 0; i + 2 < parts.length; i += 3) {
+        const scope = parts[i], origin = parts[i + 1], entry = parts[i + 2];
         const at = entry.indexOf('\n');
-        yield { file: origin.startsWith('file:') ? origin.slice('file:'.length) : undefined, key: at < 0 ? entry : entry.slice(0, at), value: at < 0 ? undefined : entry.slice(at + 1) };
+        yield { scope, file: origin.startsWith('file:') ? origin.slice('file:'.length) : undefined, key: at < 0 ? entry : entry.slice(0, at), value: at < 0 ? undefined : entry.slice(at + 1) };
     }
 }
 /**
- * The person's global git settings scrubbed for the sandbox, from git's own `-z --show-origin` listing of them (`file:path`,
- * NUL, the key, a newline and the value, NUL, per setting; the includes that hold for this checkout already read in): the
- * text of a config file that holds the kept settings, and the files they came from, for the deny list.
+ * The scopes outside the checkout, whose settings the sandbox's copy takes: the system config and the global one. Apple's
+ * git reads the config bundled with it (under Xcode or the Command Line Tools, `usr/share/git-core/gitconfig`, which names
+ * the osxkeychain credential helper) under no scope git has a name for, so `--show-scope` says `unknown`; GIT_CONFIG_NOSYSTEM
+ * turns that file off with /etc/gitconfig. The checkout's own settings (local, worktree) git in the sandbox reads as they
+ * are, and the command's own (`-c`, GIT_CONFIG_PARAMETERS) it gets in its environment.
+ */
+const OUTSIDE_SCOPES = new Set(['system', 'unknown', 'global']);
+/**
+ * The person's git settings scrubbed for the sandbox, from git's own `-z --show-scope --show-origin` listing of every scope
+ * (the scope, NUL, `file:path`, NUL, the key, a newline and the value, NUL, per setting; the includes that hold for this
+ * checkout already read in): the text of a config file that holds the kept settings of the system and global scopes, in
+ * git's order, so a global setting still wins over the system one, and the global files they came from, for the deny list.
+ * The system files (Apple git's under Xcode or the Command Line Tools, /etc/gitconfig) hold no sign-in of the person's and
+ * GIT_CONFIG_NOSYSTEM keeps git in the sandbox from reading them, so they are not denied; the checkout's own settings git
+ * reads from the checkout, which the copy does not repeat.
  */
 export function scrubGitConfig(listing) {
     const quoted = (text) => `"${text.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n').replace(/\t/g, '\\t')}"`;
     const files = new Set();
+    const helpers = new Set();
     const sections = new Map();
-    for (const { file, key, value } of settings(listing)) {
-        if (file)
+    for (const { scope, file, key, value } of settings(listing)) {
+        if (!OUTSIDE_SCOPES.has(scope))
+            continue;
+        if (file && scope === 'global')
             files.add(file);
+        // A system config's helper by its bare name (`osxkeychain`, `libsecret`): the program git-credential-<name> on git's exec path, which no sandboxed command is to run.
+        const named = scope !== 'global' && /^credential(?:\..+)?\.helper$/i.test(key) ? /^([^\s!/]+)(?:\s|$)/.exec(value ?? '')?.[1] : undefined;
+        if (named)
+            helpers.add(named);
         if (!KEPT_SETTINGS.test(key) || (/^filter\..+\.(?:clean|smudge|process)$/i.test(key) && !LFS_COMMAND.test(value ?? '')))
             continue;
         const section = key.slice(0, key.indexOf('.')), name = key.slice(key.lastIndexOf('.') + 1);
@@ -188,19 +208,23 @@ export function scrubGitConfig(listing) {
         lines.push(value === undefined ? `\t${name}` : `\t${name} = ${quoted(value)}`);
         sections.set(header, lines);
     }
-    return { text: [...sections].map(([header, lines]) => `${[header, ...lines].join('\n')}\n`).join(''), files: [...files] };
+    return { text: [...sections].map(([header, lines]) => `${[header, ...lines].join('\n')}\n`).join(''), files: [...files], helpers: [...helpers] };
 }
+/** Where Apple's gits keep their programs, git-credential-osxkeychain among them: the one xcode-select names answers `git --exec-path`, the other stays, and a script could run either. */
+const APPLE_GIT_CORE = ['/Applications/Xcode.app/Contents/Developer/usr/libexec/git-core', '/Library/Developer/CommandLineTools/usr/libexec/git-core'];
 /** A setting that names a file git includes: include.path, and includeIf.<condition>.path, whose condition may not hold for this checkout. */
 const INCLUDE = /^include(?:if\..*)?\.path$/i;
 /**
  * Every file the settings in a listing include, whether the include holds for this checkout or not, since a token sits as
  * readily behind an includeIf for another one: `~/` from the home folder, a relative path from the including file's folder,
- * an absolute path as it is, and never another user's `~user/`, which only git resolves.
+ * an absolute path as it is, and never another user's `~user/`, which only git resolves. Of one scope's settings only when
+ * `scope` is given: a listing of every scope carries the checkout's own includes too, which git in the sandbox reads as
+ * they are, so they are not for the deny list.
  */
-export function gitIncludes(listing, home) {
+export function gitIncludes(listing, home, scope) {
     const named = new Set();
-    for (const { file, key, value } of settings(listing)) {
-        if (!INCLUDE.test(key) || value === undefined)
+    for (const { scope: own, file, key, value } of settings(listing)) {
+        if ((scope !== undefined && own !== scope) || !INCLUDE.test(key) || value === undefined)
             continue;
         if (value.startsWith('~/'))
             named.add(join(home, value.slice(2)));
@@ -212,46 +236,55 @@ export function gitIncludes(listing, home) {
     return [...named];
 }
 /**
- * The scrubbed copy of the person's global git settings, read as the person from the checkout (an includeIf for it holds)
- * and written where no sandboxed command writes, and the files the settings came from or include, held or not, each read
- * for what it includes in turn. Without a global config git says so and exits 128, and the copy is empty: git in the
- * sandbox then reads the checkout's own settings only. A global config or an include that holds for this checkout that git
- * cannot read otherwise (a bad line, a file it may not open) stops the run, with git's words: what it includes in turn
- * would stay readable, unknown to the deny list. One held for another checkout only is named in the debug log and stays
- * denied, and the run goes on, though what it includes in turn stays unknown.
+ * The scrubbed copy of the person's git settings, system and global, read as the person from the checkout (an includeIf
+ * for it holds): the system scope from a listing of every scope with the global config turned off, since git lists the
+ * system config Apple's git reads under no scope's name only without a scope flag, and `--system` names /etc/gitconfig
+ * alone; the global scope from its own listing, which dies on a global config git may not open where the listing of every
+ * scope would skip it. Written where no sandboxed command writes; and the global files the settings came from or include,
+ * held or not, each read for what it includes in turn. Without a global config git says so and exits 128, and the copy
+ * holds the system settings alone, if any: git in the sandbox then reads the checkout's own settings besides. A config or
+ * an include that holds for this checkout that git cannot read otherwise (a bad line, a file it may not open) stops the
+ * run, with git's words: what it includes in turn would stay readable, unknown to the deny list. One held for another
+ * checkout only is named in the debug log and stays denied, and the run goes on, though what it includes in turn stays
+ * unknown. Also the credential helper programs the system config names, where they are (git's exec path, Apple's two), for
+ * the deny list: GIT_CONFIG_NOSYSTEM keeps git in the sandbox from naming them, and a script that unsets it, or runs one by
+ * its path, finds the program unreadable, so no keychain is asked (the denied keychain folder would answer it nothing anyway).
  */
 function scrubbedGitConfig(root, home, log) {
     const env = gitEnvironment({ ...process.env, HOME: home });
-    const list = (args, unread) => {
+    const list = (args, o = {}) => {
         try {
-            return execFileSync('git', ['config', ...args, '-z', '--list', '--show-origin'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 16 * 1024 * 1024, env });
+            return execFileSync('git', ['config', ...args, '-z', '--list', '--show-scope', '--show-origin'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 16 * 1024 * 1024, env: { ...env, ...o.env } });
         }
         catch (err) {
             const said = String(err.stderr ?? err.message).trim().split('\n').pop() ?? '';
             if (/unable to read config file .*: No such file or directory/.test(said))
                 return '';
-            if (unread) {
-                unread(said);
+            if (o.unread) {
+                o.unread(said);
                 return '';
             }
-            throw new UserError(`Impeccable keeps your global git settings and the files they include out of the sandbox, and git could not read them (${said}). Fix that file, or the setting that includes it, and run impeccable-reviews again.`, { event: 'setup_command_check_failed', outcome: 'sandbox_failed' });
+            throw new UserError(`Impeccable keeps your git settings and the files they include out of the sandbox, and git could not read them (${said}). Fix that file, or the setting that includes it, and run impeccable-reviews again.`, { event: 'setup_command_check_failed', outcome: 'sandbox_failed' });
         }
     };
-    const listing = list(['--global', '--includes']);
-    const { text, files } = scrubGitConfig(listing);
+    // The system scope first, so a global setting wins over the system one in the copy as it does for git.
+    const listing = list(['--includes'], { env: { GIT_CONFIG_GLOBAL: '/dev/null' } }) + list(['--global', '--includes']);
+    const { text, files, helpers } = scrubGitConfig(listing);
     const seen = new Set(files);
-    const includes = gitIncludes(listing, home);
+    const includes = gitIncludes(listing, home, 'global');
     for (const file of includes) {
         if (seen.has(file))
             continue;
         seen.add(file);
         // The listing above read every include that holds for this checkout and stopped on one git cannot read, so one that
         // fails here holds for another checkout only.
-        includes.push(...gitIncludes(list(['--file', file, '--no-includes'], (said) => log.write('git include not read', { file, said })), home));
+        includes.push(...gitIncludes(list(['--file', file, '--no-includes'], { unread: (said) => log.write('git include not read', { file, said }) }), home));
     }
     const path = join(ownFolder(), `gitconfig-${randomBytes(6).toString('hex')}`);
     writeFileSync(path, text, { mode: 0o600 });
-    return { path, files: [...seen] };
+    const execPath = execFileSync('git', ['--exec-path'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env }).trim();
+    const programs = helpers.flatMap((name) => [...new Set([execPath, ...APPLE_GIT_CORE])].map((dir) => join(dir, `git-credential-${name}`))).filter(present);
+    return { path, files: [...seen], helpers: programs };
 }
 /** Whether `path` is there, a dangling symlink too. */
 function present(path) {
@@ -379,12 +412,23 @@ export function allowedDomains(s) {
         names.push(...(HOST_APIS[agreed] ?? []));
     return [...new Set(names)];
 }
+/**
+ * Nothing that asks for a password, a passphrase or a host's key, on the terminal, in a window or in Git Credential Manager's:
+ * the fence's own reads of the remote run with it, and so does every command in the sandbox, where a `git ls-remote` of a
+ * repository git has no sign-in for would otherwise wait on a prompt in the person's terminal, where the screen is drawing.
+ */
+export const NO_PROMPT = { GIT_TERMINAL_PROMPT: '0', GCM_INTERACTIVE: 'never', GIT_ASKPASS: '', SSH_ASKPASS_REQUIRE: 'never' };
 /**
  * What a command in the sandbox also gets: Node's fetch through the sandbox's proxy; no browser downloads, which land in
- * caches it does not write, from hosts it does not reach; and no git hooks installed by husky, which writes the git config
- * the sandbox keeps.
+ * caches it does not write, from hosts it does not reach; no git hooks installed by husky, which writes the git config
+ * the sandbox keeps; no prompt for a sign-in; and no system git config, which the sandbox lets git read (Apple's sits
+ * under Xcode or the Command Line Tools, not in a denied folder) and which names the osxkeychain credential helper there,
+ * so that git in the sandbox has no credential helper at all, as it has none from the global config: it asks for no
+ * sign-in rather than fail in a helper. What keeps the sign-in from a script is the denied keychain folder, which holds
+ * for a script that unsets this variable too (the login keychain, where git's helper and gh keep their items, is a file
+ * the asking process opens, so the helper and `security` find no item); this variable takes the asking away. The kept settings come through the scrubbed copy.
  */
-const INSIDE = { NODE_USE_ENV_PROXY: '1', CYPRESS_INSTALL_BINARY: '0', PUPPETEER_SKIP_DOWNLOAD: '1', PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1', HUSKY: '0' };
+const INSIDE = { NODE_USE_ENV_PROXY: '1', CYPRESS_INSTALL_BINARY: '0', PUPPETEER_SKIP_DOWNLOAD: '1', PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1', HUSKY: '0', GIT_CONFIG_NOSYSTEM: '1', ...NO_PROMPT };
 /** And, for the agent's shell, npm's cache and corepack's package managers in the run's scratch folder: what a sandboxed install fetched stays with the run, and ~/.npm, which the person's npm and npx read from, is never written. */
 const scratchCaches = (scratch) => ({ npm_config_cache: join(scratch, 'npm-cache'), COREPACK_HOME: join(scratch, 'corepack'), COREPACK_ENABLE_DOWNLOAD_PROMPT: '0' });
 /**
@@ -468,7 +512,7 @@ export async function startSandbox(o) {
         }
     })();
     const global = scrubbedGitConfig(git.root, home, o.log);
-    const policy = sandboxPolicy({ git, scratch: realpathSync(o.scratch), home, platform, worktrees, gitConfigs: global.files });
+    const policy = sandboxPolicy({ git, scratch: realpathSync(o.scratch), home, platform, worktrees, gitConfigs: [...global.files, ...global.helpers] });
     const files = checkoutFiles(git.root);
     const sources = { host: o.host, files, read: (path) => readText(join(git.root, path)), npmrc: readText(join(home, '.npmrc')) };
     let domains = allowedDomains({ ...sources, hosts: o.hosts() });
@@ -562,7 +606,7 @@ export async function startSandbox(o) {
             const wrapped = await SandboxManager.wrapWithSandbox(command, undefined, undefined, options.signal);
             running++;
             try {
-                // Git in the sandbox reads the scrubbed copy of the global settings: the person's own are denied, and git dies on a global config it cannot read.
+                // Git in the sandbox reads the scrubbed copy of the system and global settings: the person's own global files are denied, the system ones turned off (INSIDE), and git dies on a global config it cannot read.
                 return await exec(wrapped, cwd, { ...options, env: { ...(options.env ?? process.env), ...INSIDE, ...scratchCaches(o.scratch), ...pnpmEnvironment(home, platform), GIT_CONFIG_GLOBAL: global.path } });
             }
             finally {