@kevin5251984/guild 0.2.19 → 0.2.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kevin5251984/guild",
-  "version": "0.2.19",
+  "version": "0.2.21",
   "type": "module",
   "license": "MIT",
   "description": "A local guild of adventurers. npx @kevin5251984/guild web",
@@ -31,7 +31,7 @@
   "scripts": {
     "dev": "tsx src/cli.ts",
     "start": "node ./bin/guildd.mjs",
-    "build": "tsc -p tsconfig.json",
+    "build": "node --check ./bin/guildd.mjs",
     "test": "tsx --test test/*.test.ts",
     "prepack": "node ./scripts/vendor-protocol.mjs prepack",
     "postpack": "node ./scripts/vendor-protocol.mjs postpack"

package/src/cli.ts

@@ -1,4 +1,3 @@
-import { readFileSync } from "node:fs";
 import { execFile } from "node:child_process";
 import { startGuildDaemon } from "./start.ts";
 import {
@@ -6,6 +5,7 @@ import {
   parseGuildCli,
   shouldOpenBrowser,
 } from "./cli-args.ts";
+import { guildVersion } from "./version.ts";
 
 const opts = parseGuildCli(process.argv);
 if (opts.error) {
@@ -15,10 +15,7 @@ if (opts.error) {
 } else if (opts.help) {
   process.stdout.write(guildCliHelp());
 } else if (opts.version) {
-  const pkg = JSON.parse(
-    readFileSync(new URL("../package.json", import.meta.url), "utf8"),
-  ) as { version: string };
-  process.stdout.write(`${pkg.version}\n`);
+  process.stdout.write(`${guildVersion()}\n`);
 } else {
   if (opts.port !== undefined) process.env.GUILD_PORT = String(opts.port);
   const started = startGuildDaemon();

package/src/db.ts

@@ -25,7 +25,14 @@ import type { TrajectoryDraft, TrajectoryEvent } from "./trajectory.ts";
 export const GUILD_DB_FILE = "guild.sqlite";
 /** Per-room hot window in SQLite. Older rows spill to rooms/<id>/trajectory.jsonl. */
 export const TRAJECTORY_HOT_CAP = 1000;
-const SCHEMA_VERSION = "2";
+/** Bump when this guildd writes a shape an older guildd cannot read. */
+export const SCHEMA_VERSION = "2";
+
+/** Numeric view of a `meta.schema` value. Missing/garbage = 0 (migrate). */
+function schemaVersionOf(raw: unknown): number {
+  const value = Number(typeof raw === "string" ? raw.trim() : raw);
+  return Number.isFinite(value) ? value : 0;
+}
 const WAREHOUSE_TAIL = 1024 * 1024;
 
 const SCHEMA = `
@@ -281,7 +288,24 @@ export class GuildDb {
   constructor(readonly path: string) {
     mkdirSync(dirname(path), { recursive: true });
     this.sqlite = new DatabaseSync(path, { timeout: 5000 });
-    this.sqlite.exec(SCHEMA);
+    try {
+      this.sqlite.exec(SCHEMA);
+      // Refuse to open a DB written by a newer guildd: the ALTERs below and the
+      // version upsert would silently migrate the file back down.
+      const row = this.sqlite
+        .prepare("SELECT value FROM meta WHERE key = 'schema'")
+        .get() as { value?: unknown } | undefined;
+      const stored = schemaVersionOf(row?.value);
+      const current = schemaVersionOf(SCHEMA_VERSION);
+      if (stored > current) {
+        throw new Error(
+          `guild.sqlite schema ${stored} is newer than this guildd (${current}); upgrade guildd`,
+        );
+      }
+    } catch (error) {
+      this.close();
+      throw error;
+    }
     try {
       this.sqlite.exec("ALTER TABLE messages ADD COLUMN steer_bot_id TEXT");
     } catch {
@@ -302,13 +326,22 @@ export class GuildDb {
     } catch {
       /* column already exists on fresh schema */
     }
-    this.sqlite.prepare(
-      "INSERT INTO meta (key, value) VALUES ('schema', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value",
-    ).run(SCHEMA_VERSION);
+    try {
+      this.sqlite.prepare(
+        "INSERT INTO meta (key, value) VALUES ('schema', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value",
+      ).run(SCHEMA_VERSION);
+    } catch (error) {
+      this.close();
+      throw error;
+    }
   }
 
   close(): void {
-    this.sqlite.close();
+    try {
+      this.sqlite.close();
+    } catch {
+      /* already closed */
+    }
   }
 
   importLegacyFiles(dataDir: string): void {

package/src/generate.ts

@@ -350,9 +350,9 @@ When work belongs to someone else, put @handle at the start of a line with a wri
 - Done when
 - Constraints / out of scope
 - Files or evidence
-Each line-start @handle on this quest starts that seat. A markdown numbered list that names a teammate (1. @design) also starts them, even if the handle is wrapped in backticks. Mentions that are only commentary in a sentence do not dispatch.
-Do not @all unless the human did. Do not recruit extra people; the human staffs the roster (max ${CHANNEL_ROSTER_CAP} on a quest).
-You may @handle any staffed teammate whose job is the next step, even if the human only named you this turn. That is how the hall continues. Do not dump the same work on every seat. If two seats must run in order, only @ the seat that can start now — a numbered list that names later seats starts them this turn too. Do not write a plan and stop.
+Each line-start @handle of a bot already on this quest starts that seat this turn. A markdown numbered list item that leads with a teammate (1. @design) also starts them, even if the handle is wrapped in backticks. Mentions that are only commentary in a sentence do not dispatch.
+Do not @all unless the human did. Do not recruit extra people; the human staffs the roster with 加入 (max ${CHANNEL_ROSTER_CAP} on a quest). @handle never adds a seat.
+You may @handle any staffed teammate whose job is the next step, even if the human only named you this turn. That is how the hall continues. Do not @handle a bot who is not on this quest. Do not dump the same work on every seat. If two seats must run in order, only @ the seat that can start now. Later seats stay in prose (四席完成後由 @infra, 通過後 @marketing, 最後 @infra) — those do not start this turn. After the first wave reports, @handle the next seat with a spec. Do not write a plan and stop.
 Stay quiet: no status theater, no "I'll start now." Speak when you finish, block, or need a decision. Money, sends, and destructive actions wait for the human.
 
 Harness this turn (Memory → Plan → Skills → Act):

package/src/handlers.ts

@@ -43,6 +43,7 @@ import {
   listGuildMcp,
   listHostMcp,
   listMcpToolRefs,
+  publicMcpServer,
   removeGuildMcp,
   upsertGuildMcp,
 } from "./mcp.ts";
@@ -92,12 +93,13 @@ export function listLibrary(store: GuildStore, kind: LibraryKind) {
   return store.listLibrary(kind);
 }
 
+/** HTTP surfaces never carry `launch.env` values; see `publicMcpServer`. */
 export function listMcpServers(store: GuildStore) {
-  return listGuildMcp(store.dataDir);
+  return listGuildMcp(store.dataDir).map(publicMcpServer);
 }
 
 export function listHostMcpServers() {
-  return listHostMcp();
+  return listHostMcp().map(publicMcpServer);
 }
 
 export function createMcpServer(
@@ -112,13 +114,15 @@ export function createMcpServer(
   },
 ) {
   try {
-    return upsertGuildMcp(store.dataDir, input.name, {
-      command: input.command || "",
-      args: input.args || [],
-      env: input.env,
-      cwd: input.cwd,
-      url: input.url,
-    });
+    return publicMcpServer(
+      upsertGuildMcp(store.dataDir, input.name, {
+        command: input.command || "",
+        args: input.args || [],
+        env: input.env,
+        cwd: input.cwd,
+        url: input.url,
+      }),
+    );
   } catch (error) {
     throw new StoreError(
       400,
@@ -129,7 +133,7 @@ export function createMcpServer(
 
 export function importMcpServer(store: GuildStore, hostId: string) {
   try {
-    return importHostMcp(store.dataDir, hostId);
+    return publicMcpServer(importHostMcp(store.dataDir, hostId));
   } catch (error) {
     throw new StoreError(
       404,
@@ -518,6 +522,7 @@ export function workspace(store: GuildStore) {
         startedAt: turn.startedAt || "",
         thinking: turn.thinking,
         steps: turn.steps,
+        ...(turn.paused ? { paused: true } : {}),
       },
     ];
   });
@@ -753,32 +758,14 @@ function askedText(
   return `附件：\n${legend}\n\n${asked}`;
 }
 
-/** @handle of a bot not in this channel adds them, then they can reply. */
+/** Roster is staffed in the members panel. @handle never pulls a new seat. */
 export function inviteMentionedBots(
   store: GuildStore,
   roomId: string,
-  userMessage: { author?: string; body: string; mentions?: string[] },
+  _userMessage?: { author?: string; body: string; mentions?: string[] },
 ): string[] {
   const room = store.getRoom(roomId);
-  if (!room) return [];
-  if (room.kind !== "channel") return room.memberIds;
-  if (isBroadcastMention(userMessage.body)) return room.memberIds;
-  const ids = messageMentionIds(
-    {
-      author: userMessage.author || "you",
-      body: userMessage.body,
-      mentions: userMessage.mentions,
-    },
-    store.listBots(),
-  );
-  let memberIds = room.memberIds;
-  for (const id of ids) {
-    if (memberIds.includes(id)) continue;
-    if (!store.getBot(id)) continue;
-    store.addMember(roomId, id);
-    memberIds = [...memberIds, id];
-  }
-  return memberIds;
+  return room?.memberIds ?? [];
 }
 
 export function channelMarkdownForRoom(
@@ -1010,6 +997,7 @@ function publicLiveTurn(live: LiveTurn): LiveTurn {
     thinking: live.thinking,
     steps: live.steps,
     startedAt: live.startedAt,
+    ...(live.paused ? { paused: true } : {}),
   };
 }
 
@@ -1099,6 +1087,84 @@ export function abortLiveTurn(
   return { ok: true };
 }
 
+export function pauseLiveTurn(
+  store: GuildStore,
+  roomId: string,
+  botId?: string,
+) {
+  if (!store.getRoom(roomId)) throw new StoreError(404, "room not found");
+  const live = botId
+    ? store.getLiveBotTurn(roomId, botId)
+    : store.getLiveTurn(roomId);
+  if (live?.paused) return { ok: true, paused: true as const };
+  const had = store.pauseTurn(roomId, botId);
+  if (!live && !had) throw new StoreError(409, "no live turn");
+  return { ok: true, paused: true as const };
+}
+
+function resumeSteer(live: LiveTurn): string {
+  const lines = [
+    "Paused mid-turn so the user could switch models. Continue from here. Do not redo finished tools unless you need a different result.",
+  ];
+  const thinking = (live.thinking || "").trim();
+  if (thinking) lines.push(`Thinking so far:\n${thinking.slice(0, 6000)}`);
+  const tools = (live.traces || []).filter((tr) => tr.name && tr.name !== "think");
+  if (tools.length) {
+    lines.push(
+      "Tools already run:\n" +
+        tools
+          .slice(-20)
+          .map((tr) => {
+            const bit = String(tr.text || "")
+              .replace(/\s+/g, " ")
+              .trim()
+              .slice(0, 400);
+            return `- ${tr.name}${bit ? `: ${bit}` : ""}`;
+          })
+          .join("\n"),
+    );
+  }
+  return lines.join("\n\n");
+}
+
+export async function continueLiveTurn(
+  store: GuildStore,
+  roomId: string,
+  botId: string,
+  env: NodeJS.ProcessEnv = process.env,
+  extras: HandlerExtras = {},
+) {
+  if (!store.getRoom(roomId)) throw new StoreError(404, "room not found");
+  const id = botId.trim();
+  if (!id) throw new StoreError(400, "botId is required");
+  const live = store.getLiveBotTurn(roomId, id);
+  if (!live?.paused) throw new StoreError(409, "no paused turn");
+  const messages = store.listMessages(roomId);
+  let userIndex = messages.length - 1;
+  while (userIndex >= 0 && messages[userIndex].author !== "you") userIndex -= 1;
+  if (userIndex < 0) throw new StoreError(400, "no user message to continue");
+  const userMessage = messages[userIndex];
+  const asked = live.asked?.trim() || userMessage.body.trim();
+  if (!asked) throw new StoreError(409, "nothing to continue");
+  const history = messages.slice(0, userIndex).map(toHistoryItem);
+  const parent = parentMessage(messages.slice(0, userIndex), userMessage.replyTo);
+  const room = store.getRoom(roomId);
+  store.setLiveTurn(roomId, { ...live, paused: false });
+  store.pushSteer(roomId, resumeSteer(live), id);
+  const replies = await generateReplies(
+    store,
+    roomId,
+    room?.memberIds ?? [id],
+    { ...userMessage, body: asked },
+    history,
+    id,
+    env,
+    parent,
+    extras,
+  );
+  return { replies };
+}
+
 function isAbortError(err: unknown): boolean {
   return Boolean(
     err &&
@@ -1180,17 +1246,22 @@ async function generateReplies(
     turnAsked: string,
     turnHistory: HistoryItem[],
   ) => {
-    if (!memberIds.includes(botId) && !onlyBotId) return;
+    if (!memberIds.includes(botId)) return;
     if (signal.aborted) return;
     const prev = store.getLiveBotTurn(roomId, botId);
+    if (!prev || prev.paused) return;
     const startedAt = prev?.startedAt || new Date().toISOString();
     store.dropLastFailedReply(roomId, botId);
     store.setLiveTurn(roomId, {
       botId,
       thinking: prev?.thinking || "",
       steps: prev?.steps || [],
+      traces: prev?.traces,
+      asked: turnAsked,
       startedAt,
+      paused: false,
     });
+    const botSignal = store.armBotTurn(roomId, botId, signal);
     let generated;
     try {
       generated = await (extras.turn ?? chatReply)({
@@ -1203,10 +1274,11 @@ async function generateReplies(
           userMessage.body,
         ),
         env,
-        signal,
+        signal: botSignal,
         mcpTools,
         onProgress: (update) => {
           const prev = store.getLiveBotTurn(roomId, botId);
+          if (prev?.paused) return;
           const next = toLiveTurn(botId, update);
           const handoff = (prev?.steps || []).find((step) => step.name === "handoff");
           const pendingSteers = store.peekSteers(roomId, botId).map((text) => ({
@@ -1223,14 +1295,16 @@ async function generateReplies(
           );
           store.setLiveTurn(roomId, {
             ...next,
+            asked: prev?.asked || turnAsked,
             startedAt: prev?.startedAt || startedAt,
+            paused: false,
             steps: [...(handoff ? [handoff] : []), ...keptSteer, ...rest].slice(0, 5),
           });
         },
         pullSteers: () => store.drainSteers(roomId, botId),
       });
     } catch (err) {
-      if (isAbortError(err) || signal.aborted) return;
+      if (isAbortError(err) || botSignal.aborted || signal.aborted) return;
       throw err;
     }
     const usage = { ...(generated.usage || {}), startedAt };
@@ -1418,13 +1492,17 @@ function plantLiveTurns(
   const startedAt = new Date().toISOString();
   for (const botId of botIds) {
     if (!botId) continue;
-    if (!memberIds.includes(botId) && !onlyBotId) continue;
+    if (!memberIds.includes(botId)) continue;
     store.dropLastFailedReply(roomId, botId);
+    const prev = store.getLiveBotTurn(roomId, botId);
     store.setLiveTurn(roomId, {
       botId,
-      thinking: "",
-      steps: [],
-      startedAt,
+      thinking: prev?.thinking || "",
+      steps: prev?.steps || [],
+      traces: prev?.traces,
+      asked: prev?.asked,
+      startedAt: prev?.startedAt || startedAt,
+      paused: false,
     });
   }
   return startedAt;
@@ -1482,18 +1560,13 @@ function hasExplicitSummon(
 }
 
 function includeFollowBot(
-  store: GuildStore,
-  roomId: string,
+  _store: GuildStore,
+  _roomId: string,
   memberIds: string[],
   follow?: string,
 ): string[] {
   if (!follow || memberIds.includes(follow)) return memberIds;
-  try {
-    store.addMember(roomId, follow);
-    return [...memberIds, follow];
-  } catch {
-    return memberIds;
-  }
+  return memberIds;
 }
 
 function inviteAssignee(
@@ -1504,12 +1577,10 @@ function inviteAssignee(
   const room = store.getRoom(roomId);
   if (!room) return [];
   if (room.kind !== "channel") return room.memberIds;
-  if (room.memberIds.includes(assigneeId)) return room.memberIds;
   if (!store.getBot(assigneeId)) {
     throw new StoreError(400, "assignee does not exist");
   }
-  store.addMember(roomId, assigneeId);
-  return [...room.memberIds, assigneeId];
+  return room.memberIds;
 }
 
 export async function postUserMessage(
@@ -1730,4 +1801,9 @@ export async function retryMessage(
 
 export { StoreError, localGenerate };
 
-export { publicModels, mergeModelsFile, refreshOpenCodeFreeCatalog } from "./llm.ts";
+export {
+  publicModels,
+  mergeModelsFile,
+  refreshOpenCodeFreeCatalog,
+  refreshReasoningCatalog,
+} from "./llm.ts";

package/src/harness.ts

@@ -171,9 +171,10 @@ export function gateTool(
     };
   }
 
+  // No explicit workspace means the guild checkout, never all of $HOME.
   const workspace = input.workspace?.trim()
     ? resolveToolPath(input.workspace)
-    : HOME;
+    : defaultWorkspace();
 
   if (name.startsWith("mcp__")) {
     return {
@@ -182,9 +183,20 @@ export function gateTool(
     };
   }
 
+  if (name === "read" || name === "list") {
+    const raw = typeof args.path === "string" ? args.path : "";
+    if (name === "list" && !raw.trim()) return null;
+    const target = resolveToolPath(raw, workspace);
+    if (!pathInsideWorkspace(target, workspace)) {
+      return {
+        text: `sandbox=workspace_write refused ${name} outside workspace: ${target}`,
+        isError: true,
+      };
+    }
+    return null;
+  }
+
   if (
-    name === "read" ||
-    name === "list" ||
     name === "skill" ||
     name === "spawn" ||
     name === "read_spawn"
@@ -224,7 +236,11 @@ export function gateTool(
     };
   }
 
-  return null;
+  // browser (CDP into the user's Chrome profile) and anything unnamed: refuse.
+  return {
+    text: `sandbox=workspace_write refused ${name}; use full_access`,
+    isError: true,
+  };
 }
 
 export type LoopCall = {

package/src/host-browse.ts

@@ -3,10 +3,11 @@ import {
   existsSync,
   readdirSync,
   readFileSync,
+  realpathSync,
   statSync,
 } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { StoreError } from "./store.ts";
 
@@ -31,6 +32,117 @@ function resolveUserPath(input: string): string {
   return resolve(HOME, trimmed);
 }
 
+/** Guild data dirs: `~/.guild` plus an explicit `GUILD_HOME` if set. */
+function guildHomes(): string[] {
+  const homes = [join(HOME, ".guild")];
+  const extra = process.env.GUILD_HOME?.trim();
+  if (extra) homes.push(resolveUserPath(extra));
+  return homes;
+}
+
+const SSH_DIR = join(HOME, ".ssh");
+/** Files whose *contents* are credentials, wherever the guild home lives. */
+const SECRET_GUILD_FILES = new Set(["oauth.json", "models.json", "mcp.json"]);
+/** Credential dotfiles that live directly in `$HOME`. */
+const SECRET_HOME_FILES = new Set([
+  ".claude.json",
+  ".netrc",
+  "_netrc",
+  ".npmrc",
+  ".yarnrc.yml",
+  ".git-credentials",
+  ".env",
+  ".env.local",
+  ".env.production",
+  ".pgpass",
+  ".pypirc",
+  ".my.cnf",
+  "credentials.json",
+]);
+/** `$HOME` folders that are credential stores: the folder and everything below. */
+const SECRET_HOME_DIRS = [
+  ".aws",
+  ".docker",
+  ".gnupg",
+  ".claude",
+  ".codex",
+  ".cursor",
+  ".kube",
+  ".azure",
+  join(".config", "gcloud"),
+  join(".config", "gh"),
+  join("Library", "Keychains"),
+].map((relative) => join(HOME, relative));
+const SSH_KEY_NAME = /^(id_rsa|id_dsa|id_ecdsa|id_ed25519|id_xmss)$/i;
+const SECRET_SUFFIXES = [
+  ".pem",
+  ".p12",
+  ".pfx",
+  ".key",
+  ".p8",
+  ".jks",
+  ".keystore",
+];
+
+function under(path: string, dir: string): boolean {
+  const prefix = dir.endsWith(sep) ? dir : `${dir}${sep}`;
+  return path === dir || path.startsWith(prefix);
+}
+
+/** Longest existing ancestor resolved through symlinks, tail re-joined. */
+function canonicalPath(target: string): string {
+  let abs = resolve(target);
+  const tail: string[] = [];
+  for (;;) {
+    try {
+      const real = realpathSync(abs);
+      return tail.length ? resolve(real, ...tail) : real;
+    } catch {
+      const parent = dirname(abs);
+      if (parent === abs) return tail.length ? resolve(abs, ...tail) : abs;
+      tail.unshift(basename(abs));
+      abs = parent;
+    }
+  }
+}
+
+function isSecretPath(abs: string): boolean {
+  const name = basename(abs);
+  const lower = name.toLowerCase();
+  const publicKey = lower.endsWith(".pub");
+  for (const home of guildHomes()) {
+    if (under(abs, join(home, "browser-profile"))) return true;
+    if (under(abs, home) && SECRET_GUILD_FILES.has(lower)) return true;
+  }
+  if (dirname(abs) === HOME && SECRET_HOME_FILES.has(lower)) return true;
+  if (name === ".env" || name.startsWith(".env.")) return true;
+  if (lower === "credentials.json" || lower === "service-account.json") {
+    return true;
+  }
+  if (SECRET_HOME_DIRS.some((dir) => under(abs, dir))) return true;
+  if (under(abs, SSH_DIR) && abs !== SSH_DIR && !publicKey) return true;
+  if (SSH_KEY_NAME.test(name)) return true;
+  if (!publicKey && SECRET_SUFFIXES.some((suffix) => lower.endsWith(suffix))) {
+    return true;
+  }
+  return false;
+}
+
+/**
+ * The attach picker browses `$HOME` on purpose, so /host/* is not confined to a
+ * workspace. Secrets still have to stay shut: OAuth tokens, model keys, the MCP
+ * store, the cloned browser profile, private keys, and the usual credential
+ * dotfiles / folders (`.aws`, `.claude`, `.codex`, `.npmrc`, `.netrc`, …).
+ * This is a denylist over the picker, not a chroot: non-secret `$HOME` and
+ * system files such as `/etc/passwd` stay readable.
+ */
+export function assertHostPathAllowed(target: string): void {
+  const abs = isAbsolute(target) ? resolve(target) : resolveUserPath(target);
+  if (isSecretPath(canonicalPath(abs))) {
+    throw new StoreError(403, "host path refused");
+  }
+}
+
 function parentOf(path: string): string | null {
   const parent = dirname(path);
   if (parent === path) return null;
@@ -52,6 +164,7 @@ export function hostList(rawPath: string): {
 } {
   try {
     const target = resolveUserPath(rawPath);
+    assertHostPathAllowed(target);
     const st = statSync(target);
     if (!st.isDirectory()) throw new StoreError(400, "not a directory");
     const entries = readdirSync(target, { withFileTypes: true })
@@ -94,6 +207,7 @@ export function hostRead(rawPath: string): {
 } {
   try {
     const target = resolveUserPath(rawPath);
+    assertHostPathAllowed(target);
     const st = statSync(target);
     if (!st.isFile()) throw new StoreError(400, "not a file");
     const raw = readFileSync(target);
@@ -146,6 +260,7 @@ function walkTree(
 export function hostTree(rawPath: string): { path: string; text: string } {
   try {
     const target = resolveUserPath(rawPath);
+    assertHostPathAllowed(target);
     const st = statSync(target);
     if (!st.isDirectory()) throw new StoreError(400, "not a directory");
     const lines = [target];
@@ -158,6 +273,25 @@ export function hostTree(rawPath: string): { path: string; text: string } {
   }
 }
 
+/**
+ * Git runs inside the user's tree: ignore their global/system config (hooks,
+ * fsmonitor, credential helpers) and never prompt on a TTY-less daemon.
+ */
+const GIT_GUARD = [
+  "-c",
+  "core.fsmonitor=false",
+  "-c",
+  "core.untrackedCache=false",
+  "--no-optional-locks",
+] as const;
+
+const GIT_ENV: NodeJS.ProcessEnv = {
+  ...process.env,
+  GIT_CONFIG_GLOBAL: "/dev/null",
+  GIT_CONFIG_NOSYSTEM: "1",
+  GIT_TERMINAL_PROMPT: "0",
+};
+
 function findGitRoot(start: string): string | null {
   let dir = start;
   for (let i = 0; i < 12; i += 1) {
@@ -176,14 +310,25 @@ export async function hostGit(rawPath: string): Promise<{
 }> {
   try {
     const start = resolveUserPath(rawPath);
+    assertHostPathAllowed(start);
     const base = statSync(start).isDirectory() ? start : dirname(start);
     const root = findGitRoot(base);
     if (!root) throw new StoreError(404, "not a git repository");
-    const opts = { cwd: root, timeout: 8_000, maxBuffer: GIT_CAP * 2 };
-    const status = await execFileAsync("git", ["status", "-sb"], opts);
+    assertHostPathAllowed(root);
+    const opts = {
+      cwd: root,
+      timeout: 8_000,
+      maxBuffer: GIT_CAP * 2,
+      env: GIT_ENV,
+    };
+    const status = await execFileAsync("git", [...GIT_GUARD, "status", "-sb"], opts);
     let diff = "";
     try {
-      const out = await execFileAsync("git", ["diff", "--stat", "HEAD"], opts);
+      const out = await execFileAsync(
+        "git",
+        [...GIT_GUARD, "diff", "--stat", "HEAD"],
+        opts,
+      );
       diff = String(out.stdout || "");
     } catch {
       diff = "";