@letrquan/book 0.3.0 → 0.4.0-beta.0

package/dist/{chunk-SOW4WRQP.js → chunk-WV3O5PGX.js}

@@ -1,9 +1,9 @@
 import {
   updateWorkspaceTrust
-} from "./chunk-VPNLCMVR.js";
+} from "./chunk-HFB74CLM.js";
 import {
   HOOK_EVENTS
-} from "./chunk-X4NJT436.js";
+} from "./chunk-REASC2QG.js";
 
 // src/hook-approvals.ts
 import { createHash } from "crypto";
@@ -81,4 +81,4 @@ export {
   describeDeclaredHook,
   persistProjectHookChoice
 };
-//# sourceMappingURL=chunk-SOW4WRQP.js.map
+//# sourceMappingURL=chunk-WV3O5PGX.js.map

package/dist/{chunk-JTPOI3KU.js → chunk-XJRJVXJR.js}

@@ -1,10 +1,10 @@
+import {
+  createDebugLogger
+} from "./chunk-OJBMDM5H.js";
 import {
   isOutside,
   resolveWorkspacePath
-} from "./chunk-X66I2NQO.js";
-import {
-  createDebugLogger
-} from "./chunk-62QL5QUP.js";
+} from "./chunk-YIL6HTJX.js";
 
 // src/sandbox.ts
 import {
@@ -20,7 +20,7 @@ import {
   realpathSync,
   statSync
 } from "fs";
-import { delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "path";
+import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "path";
 import { homedir, platform } from "os";
 
 // src/tools/glob-regex.ts
@@ -28,8 +28,8 @@ import { posix, win32 } from "path";
 import picomatch from "picomatch";
 import { convertPathToPattern } from "tinyglobby";
 function globToRegex(pattern) {
-  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*|\*/g, ".*");
-  return new RegExp("^" + escaped + "$");
+  const source = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*|\*|\?/g, (wildcard) => wildcard === "?" ? "." : ".*");
+  return new RegExp("^" + source + "$");
 }
 var log = createDebugLogger("tools:glob");
 var MAX_GLOB_PATTERN_LENGTH = 1e4;
@@ -332,9 +332,11 @@ function unsandboxedRefusalMessage(reason) {
   ].join(" ");
 }
 function sandboxPolicySummary(settings, state) {
+  const gitDirectories = settings.filesystem.allowGitWrites ? "writable; hooks, config and pointer files read-only (sandbox.filesystem.allowGitWrites=true)" : "read-only (sandbox.filesystem.allowGitWrites=false)";
   return {
     unsandboxedCommands: settings.allowUnsandboxedCommands ? "allowed (sandbox.allowUnsandboxedCommands=true)" : "refused (sandbox.allowUnsandboxedCommands=false)",
-    autoAllowBash: !settings.autoAllowBashIfSandboxed ? "off \u2014 every Bash call goes through the normal permission path (sandbox.autoAllowBashIfSandboxed=false)" : !state.sandboxActive ? "inert \u2014 no command is sandboxed here, so nothing is auto-allowed (sandbox.autoAllowBashIfSandboxed=true)" : state.adjudicationConfigured ? "inert \u2014 permissions.deny/ask rules are configured, so every Bash call still goes through the normal permission path (sandbox.autoAllowBashIfSandboxed=true)" : "on for genuinely sandboxed commands (sandbox.autoAllowBashIfSandboxed=true)"
+    autoAllowBash: !settings.autoAllowBashIfSandboxed ? "off \u2014 every Bash call goes through the normal permission path (sandbox.autoAllowBashIfSandboxed=false)" : !state.sandboxActive ? "inert \u2014 no command is sandboxed here, so nothing is auto-allowed (sandbox.autoAllowBashIfSandboxed=true)" : state.adjudicationConfigured ? "inert \u2014 permissions.deny/ask rules are configured, so every Bash call still goes through the normal permission path (sandbox.autoAllowBashIfSandboxed=true)" : "on for genuinely sandboxed commands (sandbox.autoAllowBashIfSandboxed=true)",
+    gitDirectories
   };
 }
 var MAX_CONTROL_FILE_BYTES = 4096;
@@ -352,7 +354,7 @@ function entryKind(path) {
   }
 }
 var realSandboxHost = {
-  path: { resolve, join, relative, isAbsolute, sep, dirname },
+  path: { resolve, join, relative, isAbsolute, sep, dirname, basename },
   exists: existsSync,
   // A path that vanished between the probe and the spawn is absent as far as the
   // mount list is concerned. `statSync` throws for it, and a throw here would
@@ -448,31 +450,76 @@ function canonicalPath(path, host) {
 function insideWorkspace(candidate, workspaceRoot, host) {
   return !isOutside(canonicalPath(workspaceRoot, host), canonicalPath(candidate, host), host.path);
 }
+function workspaceComponents(path, workspaceRoot, host) {
+  const root = host.path.resolve(workspaceRoot);
+  const resolved = host.path.resolve(path);
+  const rel = host.path.relative(root, resolved);
+  if (isOutside(root, resolved, host.path) || !rel || rel === ".." || rel.startsWith(".." + host.path.sep))
+    return [];
+  const segments = rel.split(host.path.sep).filter(Boolean);
+  const components = [];
+  let current = root;
+  for (const segment of segments) {
+    current = host.path.join(current, segment);
+    components.push(current);
+  }
+  return components;
+}
+function looksLikeGitDir(dir, host) {
+  if (!host.isDirectory(dir)) return false;
+  const head = host.path.join(dir, "HEAD");
+  if (!host.exists(head)) return false;
+  const objects = host.path.join(dir, "objects");
+  if (host.isDirectory(objects)) return true;
+  const commondir = host.path.join(dir, "commondir");
+  if (host.exists(commondir)) return true;
+  return false;
+}
 function workspaceGitDirs(workspaceRoot, host) {
   const root = host.path.resolve(workspaceRoot);
+  const canonicalRoot = canonicalPath(root, host);
   const found = [];
+  const pointerPaths = [];
+  const refusals = [];
+  const dotGit = host.path.join(root, ".git");
   const add = (candidate, workTree) => {
     const dir = host.path.resolve(candidate);
     if (found.some((entry) => entry.dir === dir)) return;
     if (!host.isDirectory(dir) || !insideWorkspace(dir, root, host)) return;
+    if (dir !== dotGit && !looksLikeGitDir(dir, host)) return;
+    if (canonicalPath(dir, host) === canonicalRoot) {
+      if (!refusals.some((r) => r.path === dir)) {
+        refusals.push({ path: dir, reason: "workspace-root-is-git-dir" });
+      }
+      return;
+    }
     found.push({ dir, workTree: host.path.resolve(workTree) });
   };
-  const dotGit = host.path.join(root, ".git");
-  if (!host.exists(dotGit)) return found;
+  if (!host.exists(dotGit)) return { gitDirs: found, pointerPaths, refusals };
   if (host.isDirectory(dotGit)) {
     add(dotGit, root);
   } else {
     const target = /^gitdir:\s*(.+)$/m.exec(host.readFile(dotGit) ?? "")?.[1]?.trim();
-    if (!target) return found;
-    add(host.path.isAbsolute(target) ? target : host.path.join(root, target), root);
+    if (!target) return { gitDirs: found, pointerPaths, refusals };
+    const resolvedTarget = host.path.isAbsolute(target) ? target : host.path.join(root, target);
+    pointerPaths.push(resolvedTarget);
+    add(resolvedTarget, root);
   }
   for (let index = 0; index < found.length; index++) {
     const { dir, workTree } = found[index];
     const common = host.readFile(host.path.join(dir, "commondir"))?.trim();
-    if (common) add(host.path.isAbsolute(common) ? common : host.path.join(dir, common), workTree);
+    if (common) {
+      const resolvedCommon = host.path.isAbsolute(common) ? common : host.path.join(dir, common);
+      pointerPaths.push(resolvedCommon);
+      add(resolvedCommon, workTree);
+    }
     for (const name of host.readDir(host.path.join(dir, "worktrees"))) {
       const linked = host.path.join(dir, "worktrees", name);
       const workTreeGitdir = host.readFile(host.path.join(linked, "gitdir"))?.trim();
+      if (workTreeGitdir) {
+        const resolvedGitdir = host.path.isAbsolute(workTreeGitdir) ? workTreeGitdir : host.path.join(linked, workTreeGitdir);
+        pointerPaths.push(resolvedGitdir);
+      }
       add(linked, workTreeGitdir ? host.path.dirname(workTreeGitdir) : root);
     }
     const addModules = (modulesRoot, prefix, depth) => {
@@ -494,9 +541,11 @@ function workspaceGitDirs(workspaceRoot, host) {
     if (host.isDirectory(pointer)) continue;
     const target = /^gitdir:\s*(.+)$/m.exec(host.readFile(pointer) ?? "")?.[1]?.trim();
     if (!target) continue;
-    add(host.path.isAbsolute(target) ? target : host.path.join(workTree, target), workTree);
+    const resolvedTarget = host.path.isAbsolute(target) ? target : host.path.join(workTree, target);
+    pointerPaths.push(resolvedTarget);
+    add(resolvedTarget, workTree);
   }
-  return found;
+  return { gitDirs: found, pointerPaths, refusals };
 }
 function parseConfigValue(raw) {
   const text = raw.trim();
@@ -569,12 +618,23 @@ function describeControlPathRefusal(refusal) {
   if (refusal.reason === "oversized-git-config") {
     return `Refused to run this command in the sandbox: ${refusal.path} is larger than the ${MAX_GIT_CONFIG_BYTES / 1024 / 1024} MiB read limit for a git config file, so the core.hooksPath it may declare cannot be found and the hooks directory it names cannot be made read-only. Trim the config, or run this command without the sandbox.`;
   }
+  if (refusal.reason === "workspace-root-is-git-dir") {
+    return `Refused to run this command in the sandbox: ${refusal.path} is the workspace root and a git directory, so the sandbox cannot make it read-only without making the whole workspace read-only. Run this command without the sandbox.`;
+  }
   return `Refused to run this command in the sandbox: ${refusal.path} is a symlink, and the sandbox cannot protect a symlinked control path. The link itself sits in the writable workspace, so a command could remove it, put a directory or file in its place, and write the settings, hooks or repository config the host then reads through it. Replace the symlink with the file or directory it names, or run this command without the sandbox.`;
 }
-function protectedWorkspacePaths(workspaceRoot, host = realSandboxHost) {
+function protectedWorkspacePaths(workspaceRoot, host = realSandboxHost, options = {}) {
   const root = host.path.resolve(workspaceRoot);
-  const result = { pinnedDirectories: [], mounts: [], refusals: [] };
+  const canonicalRoot = canonicalPath(root, host);
+  const allowGitWrites = options.allowGitWrites ?? false;
+  const result = {
+    pinnedDirectories: [],
+    mounts: [],
+    refusals: [],
+    gitDirControlMounts: []
+  };
   const seen = /* @__PURE__ */ new Set();
+  const safeDenyDirs = (options.denyDirectories ?? []).filter((d) => host.isDirectory(d)).map((d) => canonicalPath(d, host));
   const target = (path, kind) => {
     const resolved = host.path.resolve(path);
     if (seen.has(resolved)) return null;
@@ -584,7 +644,12 @@ function protectedWorkspacePaths(workspaceRoot, host = realSandboxHost) {
     };
     const first = host.entryKind(resolved);
     if (first === "symlink") {
-      if (!result.refusals.some((entry) => entry.path === resolved)) {
+      const parentCanonical = canonicalPath(host.path.dirname(resolved), host);
+      const symlinkLivePath = host.path.join(parentCanonical, host.path.basename(resolved));
+      const isSafe = safeDenyDirs.some(
+        (dir) => !isOutside(dir, symlinkLivePath, host.path) && dir !== symlinkLivePath
+      );
+      if (!isSafe && !result.refusals.some((entry) => entry.path === resolved)) {
         result.refusals.push({ path: resolved, reason: "symlinked-control-path" });
       }
       return null;
@@ -609,12 +674,34 @@ function protectedWorkspacePaths(workspaceRoot, host = realSandboxHost) {
     const mount = target(path, "hidden-file");
     if (mount) result.mounts.push(mount);
   };
+  const { gitDirs, pointerPaths, refusals: gitDirRefusals } = workspaceGitDirs(root, host);
+  result.refusals.push(...gitDirRefusals);
+  const boundCanonical = [];
+  const gitDirMounts = /* @__PURE__ */ new Set();
+  if (!allowGitWrites) {
+    const canonicalDirs = [...new Set(gitDirs.map((gitDir) => canonicalPath(gitDir.dir, host)))];
+    canonicalDirs.sort(
+      (left, right) => left.split(host.path.sep).length - right.split(host.path.sep).length
+    );
+    for (const canonicalDir of canonicalDirs) {
+      if (boundCanonical.some((outer) => !isOutside(outer, canonicalDir, host.path))) continue;
+      if (!host.exists(canonicalDir)) continue;
+      boundCanonical.push(canonicalDir);
+      const rel = host.path.relative(canonicalRoot, canonicalDir);
+      const bindPath = rel ? host.path.resolve(root, rel) : root;
+      const mount = { path: bindPath, kind: "directory", present: true };
+      gitDirMounts.add(mount);
+      result.mounts.push(mount);
+    }
+  }
   addDirectory(host.path.join(root, ".book"));
   addMaskedFile(host.path.join(root, ".book", "settings.local.json"));
   addFile(host.path.join(root, ".bookrc.json"));
   const dotGit = host.path.join(root, ".git");
   if (host.entryKind(dotGit) === "directory") {
-    result.pinnedDirectories.push(dotGit);
+    if (allowGitWrites) {
+      result.pinnedDirectories.push(dotGit);
+    }
   } else {
     addFile(dotGit);
   }
@@ -641,7 +728,7 @@ function protectedWorkspacePaths(workspaceRoot, host = realSandboxHost) {
       readConfig(target2, workTree, depth + 1);
     }
   };
-  for (const gitDir of workspaceGitDirs(root, host)) {
+  for (const gitDir of gitDirs) {
     addDirectory(host.path.join(gitDir.dir, "hooks"));
     for (const name of ["config", "config.worktree", "commondir", "gitdir"]) {
       addFile(host.path.join(gitDir.dir, name));
@@ -652,6 +739,78 @@ function protectedWorkspacePaths(workspaceRoot, host = realSandboxHost) {
       readConfig(host.path.join(gitDir.dir, name), gitDir.workTree, 0);
     }
   }
+  const presentReadOnlyDirs = result.mounts.filter((mount) => mount.kind === "directory" && mount.present).map((mount) => canonicalPath(mount.path, host));
+  const filteredMounts = [];
+  const gitDirControlMounts = [];
+  for (const mount of result.mounts) {
+    if (mount.kind === "hidden-file") {
+      filteredMounts.push(mount);
+      continue;
+    }
+    const mountCanonical = canonicalPath(mount.path, host);
+    const strictlyInsidePresentReadOnlyDir = presentReadOnlyDirs.some(
+      (dir) => !isOutside(dir, mountCanonical, host.path) && dir !== mountCanonical
+    );
+    if (strictlyInsidePresentReadOnlyDir) {
+      if (!allowGitWrites) {
+        const strictlyInsideBoundGitDir = boundCanonical.some(
+          (dir) => !isOutside(dir, mountCanonical, host.path) && dir !== mountCanonical
+        );
+        if (strictlyInsideBoundGitDir) {
+          gitDirControlMounts.push(mount);
+        }
+      }
+    } else {
+      filteredMounts.push(mount);
+    }
+  }
+  result.mounts = filteredMounts;
+  result.gitDirControlMounts = gitDirControlMounts;
+  if (!allowGitWrites) {
+    for (const mount of result.mounts) {
+      const mountCanonical = canonicalPath(mount.path, host);
+      if (isOutside(canonicalRoot, mountCanonical, host.path) || mountCanonical === canonicalRoot) {
+        continue;
+      }
+      const isInsidePresentReadOnly = presentReadOnlyDirs.some(
+        (dir) => !isOutside(dir, mountCanonical, host.path) && dir !== mountCanonical
+      );
+      if (isInsidePresentReadOnly) continue;
+      const ancestors = workspaceComponents(mount.path, root, host).slice(0, -1);
+      for (const anc of ancestors) {
+        if (!host.isDirectory(anc)) continue;
+        const ancCanonical = canonicalPath(anc, host);
+        if (presentReadOnlyDirs.some((dir) => !isOutside(dir, ancCanonical, host.path))) continue;
+        if (!result.pinnedDirectories.includes(anc)) {
+          result.pinnedDirectories.push(anc);
+        }
+      }
+    }
+  }
+  const safeDirs = [...presentReadOnlyDirs, ...safeDenyDirs];
+  const candidatesToCheck = /* @__PURE__ */ new Set([
+    ...gitDirs.map((g) => g.dir),
+    ...pointerPaths,
+    ...result.mounts.map((m) => m.path),
+    ...result.gitDirControlMounts.map((m) => m.path)
+  ]);
+  const checkedComponents = /* @__PURE__ */ new Set();
+  for (const cand of candidatesToCheck) {
+    for (const comp of workspaceComponents(cand, root, host)) {
+      if (checkedComponents.has(comp)) continue;
+      checkedComponents.add(comp);
+      if (host.entryKind(comp) === "symlink") {
+        const parentCanonical = canonicalPath(host.path.dirname(comp), host);
+        const symlinkLivePath = host.path.join(parentCanonical, host.path.basename(comp));
+        const isSafe = safeDirs.some(
+          (dir) => !isOutside(dir, symlinkLivePath, host.path) && dir !== symlinkLivePath
+        );
+        if (!isSafe && !result.refusals.some((r) => r.path === comp)) {
+          result.refusals.push({ path: comp, reason: "symlinked-control-path" });
+        }
+      }
+    }
+  }
   return result;
 }
 function mountProtected(args, mount, host) {
@@ -670,7 +829,7 @@ function mountProtected(args, mount, host) {
   }
   args.push("--tmpfs", target, "--remount-ro", target);
 }
-function buildSandboxExecution(bwrapPath, command, workspaceRoot, settings, host = realSandboxHost) {
+function buildSandboxExecution(bwrapPath, command, workspaceRoot, settings, host = realSandboxHost, protectedPaths) {
   const args = [];
   args.push("--unshare-pid", "--unshare-ipc", "--unshare-uts", "--die-with-parent");
   args.push("--proc", "/proc");
@@ -680,26 +839,46 @@ function buildSandboxExecution(bwrapPath, command, workspaceRoot, settings, host
   }
   args.push("--tmpfs", "/tmp");
   bindIfPresent(args, "--bind", workspaceRoot, host);
-  const protectedPaths = protectedWorkspacePaths(workspaceRoot, host);
+  const paths = protectedPaths ?? protectedWorkspacePaths(workspaceRoot, host, {
+    allowGitWrites: settings.filesystem.allowGitWrites,
+    denyDirectories: [...settings.filesystem.denyWrite, ...settings.filesystem.denyRead].map(
+      (p) => expandPath(p, host)
+    )
+  });
   const isProtectedArea = (path) => {
     const canonical = canonicalPath(expandPath(path, host), host);
-    return protectedPaths.mounts.some(
+    return paths.mounts.some(
       (mount) => !isOutside(canonicalPath(mount.path, host), canonical, host.path)
     );
   };
-  for (const dir of protectedPaths.pinnedDirectories) {
+  for (const dir of paths.pinnedDirectories) {
     args.push("--bind", host.path.resolve(dir), host.path.resolve(dir));
   }
   for (const path of settings.filesystem.allowWrite) {
     if (isProtectedArea(path)) continue;
     bindIfPresent(args, "--bind", path, host);
   }
-  for (const mount of protectedPaths.mounts) mountProtected(args, mount, host);
+  for (const mount of paths.mounts) mountProtected(args, mount, host);
+  const deferredOptInCanonicals = [];
   for (const path of settings.filesystem.allowWrite) {
     if (!isProtectedArea(path)) continue;
-    bindIfPresent(args, "--bind", path, host);
+    const target = expandPath(path, host);
+    if (host.exists(target)) {
+      args.push("--bind", target, target);
+      deferredOptInCanonicals.push(canonicalPath(target, host));
+    }
+  }
+  for (const mount of paths.gitDirControlMounts) {
+    const mountCanonical = canonicalPath(mount.path, host);
+    const strictlyBelowDeferredOptIn = deferredOptInCanonicals.some(
+      (optIn) => !isOutside(optIn, mountCanonical, host.path) && optIn !== mountCanonical
+    );
+    const explicitlyOptedIn = deferredOptInCanonicals.includes(mountCanonical);
+    if (strictlyBelowDeferredOptIn && !explicitlyOptedIn) {
+      mountProtected(args, mount, host);
+    }
   }
-  for (const mount of protectedPaths.mounts) {
+  for (const mount of paths.mounts) {
     if (mount.kind === "hidden-file") mountProtected(args, mount, host);
   }
   for (const path of settings.filesystem.denyWrite) bindIfPresent(args, "--ro-bind", path, host);
@@ -730,25 +909,62 @@ function decideSandboxExecution(ctx, command, workdir) {
   } catch (error) {
     return { sandboxed: false, error: error instanceof Error ? error.message : String(error) };
   }
+  let protectedPaths;
   if (sandbox) {
-    const refusal = protectedWorkspacePaths(ctx.workspaceRoot).refusals[0];
+    const denyDirectories = [
+      ...ctx.sandbox.filesystem.denyWrite,
+      ...ctx.sandbox.filesystem.denyRead
+    ].map((p) => expandPath(p, realSandboxHost));
+    protectedPaths = protectedWorkspacePaths(ctx.workspaceRoot, realSandboxHost, {
+      allowGitWrites: ctx.sandbox.filesystem.allowGitWrites,
+      denyDirectories
+    });
+    const refusal = protectedPaths.refusals[0];
     if (refusal) return { sandboxed: false, error: describeControlPathRefusal(refusal) };
   }
-  const exec = sandbox?.wrap(command, ctx.workspaceRoot);
-  if (exec) return { sandboxed: true, exec };
+  const exec = sandbox?.wrap(command, ctx.workspaceRoot, protectedPaths);
+  if (exec) {
+    return {
+      sandboxed: true,
+      exec,
+      gitDirReadOnly: !ctx.sandbox.filesystem.allowGitWrites
+    };
+  }
   if (ctx.sandbox.failIfUnavailable) {
     return { sandboxed: false, error: "Sandbox unavailable and failIfUnavailable is set" };
   }
   return unsandboxed("unavailable");
 }
-function withGitConfigReadOnlyNotice(text, output, sandboxed, command = "") {
-  if (!sandboxed || !/could not (?:write|lock) config file/.test(output)) return text;
-  if (writesAGlobalConfig(command)) return text;
+function withGitConfigReadOnlyNotice(text, output, sandboxed, command = "", gitDirReadOnly) {
+  if (!sandboxed) return text;
+  const isConfigFileFailure = /could not (?:write|lock) config file/.test(output);
+  if (isConfigFileFailure) {
+    if (writesAGlobalConfig(command)) return text;
+    return gitDirReadOnly ? withReadOnlyGitDirNote(text) : withLegacyGitConfigNote(text);
+  }
+  if (gitDirReadOnly) {
+    const linesWithRo = output.split("\n").filter((line) => /\bRead-only file system\b/i.test(line));
+    const runsGit = /(?:^|[;&|(\s])git\b/.test(command);
+    const hasDotGitSegment = linesWithRo.some(
+      (line) => /(?:^|[/\s'"`])\.git(?=[/\\s'":`]|[\r\n]|$)/.test(line)
+    );
+    const roFailure = linesWithRo.length > 0 && (runsGit || hasDotGitSegment);
+    if (roFailure) {
+      return withReadOnlyGitDirNote(text);
+    }
+  }
+  return text;
+}
+function withLegacyGitConfigNote(text) {
   return `${text}
 Note: .git/config is read-only inside the sandbox, so git cannot update repository configuration there. Run this command outside the sandbox.`;
 }
+function withReadOnlyGitDirNote(text) {
+  return `${text}
+Note: the repository's git directory is read-only inside the sandbox (sandbox.filesystem.allowGitWrites is off), so git cannot write to it here. Do not retry the command or change sandbox settings yourself; tell the user it has to run outside the sandbox: they can run it, or allow it in their own ~/.book/settings.json, where sandbox.excludedCommands runs matching commands unsandboxed while sandbox.allowUnsandboxedCommands is true and sandbox.filesystem.allowGitWrites lets sandboxed git write again; workspace settings cannot enable either.`;
+}
 function writesAGlobalConfig(command) {
-  return /^\s*(?:\S+\s+)*git\s+config\b[^|;&]*\s--(?:global|system)\b/.test(command);
+  return /(?:^|[;&|(\s])git\s+[^|;&]*\bconfig\b[^|;&]*\s--(?:global|system)\b/.test(command);
 }
 function createSandbox(settings) {
   if (!settings.enabled) return null;
@@ -786,13 +1002,21 @@ function createSandbox(settings) {
     );
   }
   return {
-    wrap(command, workspaceRoot) {
-      return buildSandboxExecution(bwrap, command, workspaceRoot, settings);
+    wrap(command, workspaceRoot, protectedPaths) {
+      return buildSandboxExecution(
+        bwrap,
+        command,
+        workspaceRoot,
+        settings,
+        realSandboxHost,
+        protectedPaths
+      );
     },
     describe() {
       return [
         `bubblewrap (${bwrap})`,
         hasDomainPolicy(settings) ? "network disabled" : "host network shared",
+        settings.filesystem.allowGitWrites ? "git directories writable (hooks, config and pointer files read-only)" : "git directories read-only",
         `${settings.filesystem.allowWrite.length} extra writable path(s)`,
         `${settings.filesystem.denyWrite.length} read-only path(s)`,
         `${settings.filesystem.denyRead.length} masked path(s)`,
@@ -823,4 +1047,4 @@ export {
   withGitConfigReadOnlyNotice,
   createSandbox
 };
-//# sourceMappingURL=chunk-JTPOI3KU.js.map
+//# sourceMappingURL=chunk-XJRJVXJR.js.map