looply-cli 0.0.0-stage → 0.2.0

package/dist/trusted-git.js

@@ -0,0 +1,920 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.repoConfigTrouble = repoConfigTrouble;
+exports.resolveGitLayout = resolveGitLayout;
+exports.repoConfigPaths = repoConfigPaths;
+exports.repoConfigTroubleAt = repoConfigTroubleAt;
+exports.worktreeMetadata = worktreeMetadata;
+exports.repoRootTroubleAt = repoRootTroubleAt;
+exports.noHooksDir = noHooksDir;
+exports.gitBinary = gitBinary;
+exports.trustedGitArgs = trustedGitArgs;
+exports.trustedGitEnv = trustedGitEnv;
+exports.mainWorktreeRoot = mainWorktreeRoot;
+exports.isCheckoutRoot = isCheckoutRoot;
+exports.repoIdentityPath = repoIdentityPath;
+exports.linkedRepoCommonDir = linkedRepoCommonDir;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
+/**
+ * THE REPOSITORY IS UNTRUSTED INPUT TO A TRUSTED PROCESS.
+ *
+ * `GitDriver` runs as the daemon. The repository it operates on is written by
+ * the coding agent, and git executes programs named by configuration — so a
+ * round that writes eight lines into `.git/config` gets arbitrary code running
+ * under the daemon's identity, with the daemon's environment and whatever
+ * credentials are ambient to the account.
+ *
+ * This is not hypothetical and it is not only hooks. Measured against the exact
+ * verbs `GitDriver` issues, EIGHT mechanisms execute:
+ *
+ *   filter.<any>.clean      → `add -A`, `add -N`
+ *   filter.<any>.smudge     → `checkout --`, `reset --hard`
+ *   diff.<any>.textconv     → `diff HEAD`
+ *   diff.external           → `diff HEAD`
+ *   core.fsmonitor          → `status`
+ *   core.hooksPath / hooks  → `commit`
+ *
+ * Only `core.pager` did not fire, and only because stdio is a pipe rather than
+ * a terminal — which is a property of how we spawn, not a property of git.
+ *
+ * TWO MECHANISMS, BECAUSE ONE IS NOT ENOUGH.
+ *
+ * `core.hooksPath` has a fixed name, so it can simply be overridden on the
+ * command line, where it beats anything the repository says. Filters cannot:
+ * `filter.<ANY NAME>.clean` is an unbounded family and no list of `-c`
+ * overrides can enumerate it. So the second mechanism is refusal — the config
+ * is read as a plain file and the operation is declined before git is invoked
+ * at all.
+ *
+ * SCOPED TO THE REPOSITORY'S OWN CONFIG, deliberately. System and global config
+ * belong to the person, not to the round: this machine's system config defines
+ * `filter.lfs.clean`, and refusing that would break every repository with Git
+ * LFS installed while protecting nothing.
+ */
+/**
+ * Config keys that can name a program for git to run.
+ *
+ * Patterns, not names — `filter\..*\.clean` covers a filter called anything at
+ * all, which is the whole point. Each entry either fired in the audit or names
+ * a documented execution path of the same shape.
+ */
+const EXECUTABLE_KEYS = [
+    /^filter\..*\.(clean|smudge|process)$/,
+    /^diff\..*\.(textconv|command)$/,
+    /^diff\.external$/,
+    /^merge\..*\.driver$/,
+    /^core\.(fsmonitor|hookspath|pager|editor|sshcommand)$/,
+    /^sequence\.editor$/,
+    /^pager\./,
+    /^alias\./,
+    // An include pulls in another file wholesale, so it can reintroduce every
+    // key above from somewhere this check never looked.
+    /^include\.path$/,
+    /^includeif\./,
+    // `ext::` transports name a command to run. No remote is used today; this is
+    // here so that adding one later cannot quietly open the door.
+    /^protocol\..*\.command$/,
+    /^credential\./,
+];
+/**
+ * Config keys that move the working tree out from under the caller.
+ *
+ * A DIFFERENT HAZARD FROM THE LIST ABOVE, which is why it is a different list
+ * and a different sentence: `core.worktree` names no program, so nothing here
+ * gets code execution. It makes `git rev-parse --show-toplevel` — and every
+ * verb `GitDriver` issues — operate somewhere the caller never named.
+ *
+ * ⚠️ MEASURED. With `core.worktree` pointing at a sibling directory,
+ * `GitDriver.discard()` ran `reset --hard` and `clean -fd` against that
+ * directory: a file holding uncommitted work was overwritten and another was
+ * deleted, while `repoRootTroubleAt` — whose whole promise is "the tree is the
+ * one the caller named" — returned null, because it compares against the
+ * directory holding `.git` and git does not.
+ *
+ * `GIT_WORK_TREE` and `GIT_DIR` do the same thing from the ENVIRONMENT rather
+ * than from the repository's config. They are handled where they belong, in
+ * `trustedGitEnv` below, which builds the `GIT_` namespace up instead of
+ * inheriting it — a config key is refused, an environment variable is dropped.
+ */
+const REDIRECTING_KEYS = [/^core\.worktree$/];
+/**
+ * One section header, and whatever follows it ON THE SAME LINE.
+ *
+ * 🔴 BOTH HALVES WERE EXPLOITABLE, and both were measured rather than imagined.
+ *
+ *   `[filter "ev"] clean = sh evil`   git resolves `filter.ev.clean`. The old
+ *                                     parser `continue`d after a header and
+ *                                     never looked at the rest of the line, so
+ *                                     it reported nothing.
+ *   `[filter "]"]`                    the old `^\[([^\]]+)\]` stopped at the
+ *                                     FIRST `]`, which is inside the quotes.
+ *                                     Section became `filter`, the key became
+ *                                     `filter.clean`, and no pattern matched.
+ *
+ * Each produced a marker file on disk through `add -A`. So the closing bracket
+ * is now found by a scanner that knows about quoting and backslash escapes, and
+ * the remainder of the line is parsed as a variable.
+ */
+function parseHeader(line) {
+    let inQuote = false;
+    let end = -1;
+    for (let i = 1; i < line.length; i++) {
+        const c = line[i];
+        if (inQuote) {
+            if (c === '\\') {
+                i += 1;
+                continue;
+            }
+            if (c === '"')
+                inQuote = false;
+            continue;
+        }
+        if (c === '"') {
+            inQuote = true;
+            continue;
+        }
+        if (c === ']') {
+            end = i;
+            break;
+        }
+    }
+    if (end === -1)
+        return null;
+    const inner = line.slice(1, end);
+    const rest = line.slice(end + 1);
+    // `[filter "ev"]`, `[core]`, and the legacy `[filter.ev]` all arrive here. The
+    // quoted subsection keeps its case in git but the section and key do not, and
+    // every pattern below ignores the subsection's spelling anyway.
+    const m = /^\s*([^\s"]+)\s*(?:"((?:[^"\\]|\\.)*)")?\s*$/.exec(inner);
+    if (m === null)
+        return null;
+    const base = m[1].toLowerCase();
+    const sub = m[2];
+    return {
+        section: sub === undefined ? base : `${base}.${sub.replace(/\\(.)/g, '$1')}`,
+        rest,
+    };
+}
+/**
+ * Every `section.subsection.key` this text defines, lowercased as git names it.
+ *
+ * `malformed` is not a detail: a header this cannot parse is one whose keys
+ * cannot be attributed to any section, and silently dropping them is the shape
+ * of every hole above. The caller refuses instead.
+ */
+function dottedKeys(text) {
+    const out = [];
+    let section = '';
+    let malformed = false;
+    for (const raw of text.split(/\r?\n/)) {
+        let line = raw.trim();
+        if (line.length === 0 || line.startsWith('#') || line.startsWith(';'))
+            continue;
+        if (line.startsWith('[')) {
+            const header = parseHeader(line);
+            if (header === null) {
+                // Git would reject the file outright. We cannot know what section the
+                // lines below belong to, so we must not guess — and must not proceed.
+                malformed = true;
+                section = '';
+                continue;
+            }
+            section = header.section;
+            line = header.rest.trim();
+            if (line.length === 0 || line.startsWith('#') || line.startsWith(';'))
+                continue;
+        }
+        if (section.length === 0)
+            continue;
+        // At most one variable per line: git reads a variable's value to the end of
+        // the line, so anything after `=` is the value and never another key.
+        const eq = line.indexOf('=');
+        const key = (eq === -1 ? line : line.slice(0, eq)).trim().toLowerCase();
+        if (key.length === 0)
+            continue;
+        out.push(`${section}.${key}`);
+    }
+    return { keys: out, malformed };
+}
+/**
+ * The first executable key this config defines, in words, or null if none.
+ *
+ * Takes the text rather than a path so the rule is testable without a
+ * repository, and so the caller decides what an unreadable config means.
+ */
+function repoConfigTrouble(text) {
+    const { keys, malformed } = dottedKeys(text);
+    for (const key of keys) {
+        if (EXECUTABLE_KEYS.some((p) => p.test(key))) {
+            return `this repository's git config sets ${key}, which names a program for git to run`;
+        }
+        if (REDIRECTING_KEYS.some((p) => p.test(key))) {
+            return `this repository's git config sets ${key}, which points git at a different working tree`;
+        }
+    }
+    if (malformed) {
+        return `this repository's git config has a section header this cannot parse, so it could not be checked`;
+    }
+    return null;
+}
+/** `code` off an fs error without asserting the error's shape. */
+function errCode(e) {
+    return typeof e === 'object' && e !== null && 'code' in e ? String(e.code) : 'unknown';
+}
+/**
+ * Whether `dir` is really a git directory, by git's own test.
+ *
+ * 🔴 THE HOLE THIS CLOSES WAS BOTH CHECKS AT ONCE, and it was demonstrated.
+ * Accepting any directory *named* `.git` meant that
+ *
+ *     mkdir -p sub/.git          # empty, and the agent may create it
+ *
+ * made `resolveGitLayout(sub)` answer `{root: sub}`. Git ignores such a decoy
+ * and keeps walking — `git -C sub rev-parse --absolute-git-dir` still names the
+ * real repository above, and `git -C sub config --get filter.ev.clean` still
+ * resolved the malicious program. But looply's checks did not:
+ * `repoConfigTroubleAt(sub)` returned null, so the config was never examined,
+ * and `repoRootTroubleAt(sub)` returned null, so `reset --hard` issued from
+ * `sub` reset the whole repository above it and overwrote uncommitted work.
+ *
+ * So the markers are required, and a directory that lacks them is walked PAST
+ * rather than stopped at — which is exactly what git does, and which lands on
+ * the real repository whose config then gets read.
+ *
+ * `commondir` is the linked-worktree case: `<common>/worktrees/<name>` holds
+ * `HEAD` and `commondir` but has neither `objects` nor `refs` of its own.
+ */
+function looksLikeGitDir(dir) {
+    try {
+        if (!(0, node_fs_1.statSync)((0, node_path_1.join)(dir, 'HEAD')).isFile())
+            return false;
+    }
+    catch {
+        return false;
+    }
+    if ((0, node_fs_1.existsSync)((0, node_path_1.join)(dir, 'commondir')))
+        return true;
+    return (0, node_fs_1.existsSync)((0, node_path_1.join)(dir, 'objects')) && (0, node_fs_1.existsSync)((0, node_path_1.join)(dir, 'refs'));
+}
+/** The `gitdir:` line of a linked worktree's `.git` file, resolved against it. */
+function gitdirPointer(text, from) {
+    // Git's `read_gitfile_gently` strips trailing NEWLINES, not trailing spaces —
+    // so a pointer ending in a space names a directory whose name ends in a space,
+    // and trimming it here would resolve to a different one.
+    const m = /^gitdir:[ \t]*(.*?)[\r\n]*$/.exec(text.replace(/[\r\n]+$/, ''));
+    if (m === null)
+        return null;
+    const p = m[1];
+    if (p.length === 0)
+        return null;
+    return (0, node_path_1.isAbsolute)(p) ? p : (0, node_path_1.resolve)(from, p);
+}
+/**
+ * Find the repository governing `cwd`, the way git does: look for a `.git`
+ * entry here, then in each parent, to the filesystem root.
+ *
+ * WALKING UP IS DELIBERATE. Run from a subdirectory, the old check looked at
+ * `<subdir>/.git`, found nothing, and returned "no trouble" — while every git
+ * command it was guarding still ran against the repository above. That was a
+ * second way to reach the same fail-open, and it did not need a worktree.
+ */
+function resolveGitLayout(cwd) {
+    const lexical = walkForLayout((0, node_path_1.resolve)(cwd));
+    if (lexical.kind !== 'none')
+        return lexical;
+    /**
+     * ⚠️ AND AGAIN PHYSICALLY, because this walk is lexical and git's is not.
+     *
+     * `dirname` is string arithmetic: it climbs out of a junction or symlink by
+     * name and never reaches the directory the link actually points into. Driven
+     * with a cwd inside a Windows junction, `git rev-parse --show-toplevel` named
+     * the real repository while this answered `none` — and `none` means "no
+     * repository here", which is the silent allow. Node reports an unresolved
+     * cwd for exactly this case: `process.cwd()` inside a junction returns the
+     * junction path under cmd.exe and PowerShell.
+     *
+     * Only on the `none` path, so the ordinary checkout pays one `resolve` and
+     * nothing else.
+     */
+    const real = realOrResolved(cwd);
+    return real === (0, node_path_1.resolve)(cwd) ? lexical : walkForLayout(real);
+}
+function walkForLayout(start) {
+    let dir = start;
+    for (;;) {
+        const dotGit = (0, node_path_1.join)(dir, '.git');
+        let st;
+        try {
+            st = (0, node_fs_1.statSync)(dotGit);
+        }
+        catch (e) {
+            const code = errCode(e);
+            // Not here. ENOTDIR means some component of this path is a file rather
+            // than a directory, which on Windows usually surfaces as ENOENT anyway;
+            // either way the answer is the same as an absence — keep climbing, and
+            // let the repository above be found. (An earlier comment here claimed
+            // this STOPPED the walk. It never did, and stopping would be wrong.)
+            if (code === 'ENOENT' || code === 'ENOTDIR') {
+                const up = (0, node_path_1.dirname)(dir);
+                if (up === dir)
+                    return { kind: 'none' };
+                dir = up;
+                continue;
+            }
+            // Present but unstattable — a permission wall, not an absence.
+            return { kind: 'fault', because: `${dotGit} could not be read (${code})` };
+        }
+        let gitDir;
+        if (st.isDirectory()) {
+            if (!looksLikeGitDir(dotGit)) {
+                // A directory called `.git` that is not one. Git walks past it; so do
+                // we, or the repository that actually governs this cwd is never read.
+                const up = (0, node_path_1.dirname)(dir);
+                if (up === dir)
+                    return { kind: 'none' };
+                dir = up;
+                continue;
+            }
+            gitDir = dotGit;
+        }
+        else if (st.isFile()) {
+            let text;
+            try {
+                text = (0, node_fs_1.readFileSync)(dotGit, 'utf8');
+            }
+            catch (e) {
+                return { kind: 'fault', because: `${dotGit} names a git directory but could not be read (${errCode(e)})` };
+            }
+            const p = gitdirPointer(text, dir);
+            if (p === null) {
+                return { kind: 'fault', because: `${dotGit} is a file that does not name a git directory` };
+            }
+            // Normalised so that a forward-slashed pointer and a backslashed
+            // `commonDir` cannot become two spellings of one path in a caller that
+            // compares them as strings.
+            gitDir = (0, node_path_1.normalize)(p);
+        }
+        else {
+            return { kind: 'fault', because: `${dotGit} is neither a file nor a directory` };
+        }
+        try {
+            if (!(0, node_fs_1.statSync)(gitDir).isDirectory()) {
+                return { kind: 'fault', because: `${gitDir} is not a git directory` };
+            }
+        }
+        catch (e) {
+            return { kind: 'fault', because: `${gitDir} could not be read (${errCode(e)})` };
+        }
+        // A FAULT HERE, not a walk-past. A `.git` FILE that names something which
+        // is not a git directory is corruption or misdirection, not the ordinary
+        // "there is no repository in this folder" that a bare directory means.
+        if (!looksLikeGitDir(gitDir)) {
+            return { kind: 'fault', because: `${gitDir} does not look like a git directory` };
+        }
+        // `commondir` is absent in an ordinary checkout and present in a linked
+        // worktree, where it is usually the relative `../..`.
+        let commonDir = gitDir;
+        try {
+            // `strbuf_rtrim`-style: git strips trailing newlines here, not spaces.
+            const raw = (0, node_fs_1.readFileSync)((0, node_path_1.join)(gitDir, 'commondir'), 'utf8').replace(/[\r\n]+$/, '');
+            if (raw.length === 0) {
+                return { kind: 'fault', because: `${(0, node_path_1.join)(gitDir, 'commondir')} is empty` };
+            }
+            commonDir = (0, node_path_1.normalize)((0, node_path_1.isAbsolute)(raw) ? raw : (0, node_path_1.resolve)(gitDir, raw));
+        }
+        catch (e) {
+            const code = errCode(e);
+            if (code !== 'ENOENT') {
+                return { kind: 'fault', because: `${(0, node_path_1.join)(gitDir, 'commondir')} could not be read (${code})` };
+            }
+        }
+        return { kind: 'ok', root: dir, gitDir, commonDir };
+    }
+}
+/**
+ * Every config file that governs this repository, most-shared first.
+ *
+ * `config.worktree` is read only when `extensions.worktreeConfig` is set, but
+ * it is scanned unconditionally: a file that git might read is a file this
+ * check must not skip, and scanning one git ignores costs a refusal nobody
+ * could have exploited anyway.
+ */
+function repoConfigPaths(layout) {
+    const paths = [(0, node_path_1.join)(layout.commonDir, 'config')];
+    const perWorktree = (0, node_path_1.join)(layout.gitDir, 'config.worktree');
+    if (!paths.includes(perWorktree))
+        paths.push(perWorktree);
+    return paths;
+}
+/**
+ * Judge the config of the repository governing `cwd`, in words, or null.
+ *
+ * A missing repository is not a fault and neither is a missing config file — a
+ * config that does not exist defines nothing. A repository whose metadata or
+ * config cannot be READ is a refusal: the whole mechanism is "decline before
+ * git runs", and declining is the only answer that stays sound when the file
+ * the decision rests on is unavailable.
+ */
+function repoConfigTroubleAt(cwd) {
+    const layout = resolveGitLayout(cwd);
+    if (layout.kind === 'none') {
+        // No repository, here or above. Git will produce its own error if one was
+        // expected, and there is no config to have been subverted.
+        return null;
+    }
+    if (layout.kind === 'fault') {
+        return `this repository's git metadata could not be read, so its config could not be checked — ${layout.because}`;
+    }
+    for (const path of repoConfigPaths(layout)) {
+        let text;
+        try {
+            text = (0, node_fs_1.readFileSync)(path, 'utf8');
+        }
+        catch (e) {
+            const code = errCode(e);
+            if (code === 'ENOENT')
+                continue;
+            return `this repository's git config at ${path} could not be read (${code}), so it could not be checked`;
+        }
+        const trouble = repoConfigTrouble(text);
+        if (trouble !== null)
+            return trouble;
+    }
+    return null;
+}
+/**
+ * The metadata directories of the worktree AT `dir`, or null when `dir` is not
+ * itself one.
+ *
+ * ⚠️ DELIBERATELY NOT THE ENCLOSING REPOSITORY, and the difference is the whole
+ * reason this is a separate function. {@link resolveGitLayout} walks up, which
+ * is the right answer to "whose config could execute when git runs here" — a
+ * command issued in a subdirectory is still governed by the repository above.
+ * It is the WRONG answer to "what does this grant own": a directory that merely
+ * SITS INSIDE a repository is not that repository's worktree, and protecting an
+ * ancestor's metadata would describe a boundary the container does not have.
+ *
+ * Caught by `agent-contained.spec.ts`, which passes a `projectDir` that is not
+ * a repository and pins the protected list at three entries.
+ */
+function worktreeMetadata(dir) {
+    const layout = resolveGitLayout(dir);
+    if (layout.kind !== 'ok')
+        return null;
+    if (realOrResolved(layout.root) !== realOrResolved(dir))
+        return null;
+    return { gitDir: layout.gitDir, commonDir: layout.commonDir };
+}
+/** `realpathSync` where it works, the resolved path where it does not. */
+function realOrResolved(p) {
+    try {
+        return (0, node_fs_1.realpathSync)(p);
+    }
+    catch {
+        return (0, node_path_1.resolve)(p);
+    }
+}
+/**
+ * Whether `cwd` is the root of the repository it belongs to, in words, or null.
+ *
+ * THE CHECK THAT NEVER EXISTED. `looply` derives three things from `cwd` — the
+ * project identity, `.looply/state`, and the tree every git verb operates on —
+ * and nothing established that `cwd` was a repository at all, let alone its
+ * root. Started one directory down, the run wrote its state into a subdirectory
+ * while committing, discarding and resetting the whole repository above it: a
+ * `reset --hard` scoped to a tree the person never named.
+ *
+ * A worktree layout makes it reachable by accident rather than by mistake,
+ * which is why it lands here rather than after the first worktree exists.
+ */
+function repoRootTroubleAt(cwd) {
+    const layout = resolveGitLayout(cwd);
+    if (layout.kind === 'none') {
+        // Unchanged from before this check existed: git says what it thinks of a
+        // directory that is not a repository, in its own words.
+        return null;
+    }
+    if (layout.kind === 'fault') {
+        return `this repository's git metadata could not be read — ${layout.because}`;
+    }
+    if (realOrResolved(layout.root) !== realOrResolved(cwd)) {
+        /**
+         * ⚠️ NEVER "run from `<root>` instead", which is what this said first.
+         *
+         * `<root>` may be nothing to do with the person's project. A plain folder
+         * under a dotfiles or monorepo checkout — a very ordinary thing to have on
+         * a Desktop — resolves to that enclosing repository, and following the
+         * advice would point looply at a tree it may then commit to, discard and
+         * `reset --hard`: precisely the harm this refusal exists to prevent.
+         *
+         * So the two cases are told apart, and only the one that IS a subdirectory
+         * of the intended project gets a destination.
+         */
+        const here = (0, node_path_1.resolve)(cwd);
+        if ((0, node_fs_1.existsSync)((0, node_path_1.join)(here, '.git'))) {
+            return (`this is not the root of its git repository — ${here} holds git metadata that git does not ` +
+                `recognise, while ${layout.root} is the repository that governs it`);
+        }
+        return (`this is not the root of a git repository — ${here} sits inside ${layout.root}. ` +
+            `If ${layout.root} is the project you mean, start looply there; if it is not, ` +
+            `initialise a repository here first`);
+    }
+    return null;
+}
+/**
+ * An empty directory to point `core.hooksPath` at.
+ *
+ * Created rather than merely named: a path that does not exist would also work
+ * today, but an empty directory we make is one the repository cannot fill by
+ * simply creating what git was told to look for.
+ *
+ * 🔴 AND IT IS EMPTIED EVERY TIME, WHICH IT WAS NOT.
+ *
+ * This was one machine-global `%TEMP%\looply-no-hooks`, created once and never
+ * looked at again — passed as `core.hooksPath` on EVERY trusted git call of
+ * every workspace of every project on the machine. `mkdirSync` is recursive and
+ * idempotent, so the first caller made it and every later caller trusted it
+ * without ever asking what was inside.
+ *
+ * `%TEMP%` is world-writable on Windows. Anything that can write there could
+ * drop a `pre-commit` into that directory and have it executed by the very
+ * mechanism that exists to guarantee no repository hook ever runs — with the
+ * daemon's own privileges, uncontained. Not a workspace-isolation problem: a
+ * one-line hole in the hook defence itself, which nothing would have noticed
+ * because the directory is invisible and the flag reads as already handled.
+ *
+ * ⚠️ SO IT IS CHECKED, NOT ASSUMED. Anything sitting in it is removed before
+ * the path is handed to git. Sweeping is cheap — the directory is empty in
+ * every ordinary case — and a sweep that fails still leaves git pointed at a
+ * directory whose contents this call has at least tried to control.
+ */
+function noHooksDir() {
+    const dir = (0, node_path_1.join)((0, node_os_1.tmpdir)(), 'looply-no-hooks');
+    try {
+        (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+    }
+    catch {
+        // Already there, or a filesystem that will fail the same way when git
+        // looks. Either way git finds no hooks, which is the point.
+    }
+    try {
+        for (const name of (0, node_fs_1.readdirSync)(dir)) {
+            (0, node_fs_1.rmSync)((0, node_path_1.join)(dir, name), { recursive: true, force: true });
+        }
+    }
+    catch {
+        // Unreadable or unwritable. Git will find whatever is there; nothing here
+        // can do better, and failing a run over a temp directory would be worse.
+    }
+    return dir;
+}
+let cachedGitBinary;
+/**
+ * The absolute path of the `git` this machine will run, resolved from PATH only.
+ *
+ * 🔴 A BARE `spawn('git', …, {cwd})` LETS THE REPOSITORY SUPPLY THE BINARY.
+ *
+ * On Windows the process creation path searches the WORKING DIRECTORY BEFORE
+ * PATH. `cwd` here is the project root, and `untrustedGrants` hands the
+ * contained agent `{ path: projectDir, write: true }` — so a `git.exe` the agent
+ * writes runs OUTSIDE the container, as the daemon, on `status`, `add -A`,
+ * `diff HEAD`, `commit`, `reset --hard`, `clean -fd` and `push`. Measured:
+ * `spawnSync('git', ['--version'], { cwd: <dir with a planted git.exe> })`
+ * executed the plant; the same call from another directory ran real git.
+ *
+ * That defeats everything else in this file at once — the config check, the
+ * root check, the rebuilt `GIT_` namespace, the `GIT_DIR` pin, `core.hooksPath`
+ * and `commit.gpgsign=false` — because none of them constrains a program that
+ * is not git. `exec-domains.ts` already makes exactly this argument for the
+ * runtime mirror ("untrusted code that could replace `node.exe` would be
+ * untrusted code choosing what every later gate runs"); it simply had never
+ * been applied to git.
+ *
+ * Resolved once and cached: PATH does not change under a running daemon, and a
+ * per-call PATH walk on every git verb would be a needless cost.
+ */
+function gitBinary() {
+    if (cachedGitBinary !== undefined)
+        return cachedGitBinary;
+    const win = process.platform === 'win32';
+    const exts = win ? (process.env['PATHEXT'] ?? '.EXE').split(';') : [''];
+    // PATH ONLY. The cwd is deliberately not searched — it is the thing being
+    // defended against.
+    for (const dir of (process.env['PATH'] ?? '').split(win ? ';' : ':')) {
+        const d = dir.trim().replace(/^"|"$/g, '');
+        if (d.length === 0)
+            continue;
+        for (const ext of exts) {
+            const candidate = (0, node_path_1.join)(d, `git${ext.toLowerCase()}`);
+            try {
+                if ((0, node_fs_1.statSync)(candidate).isFile()) {
+                    cachedGitBinary = candidate;
+                    return candidate;
+                }
+            }
+            catch {
+                // Not here; keep walking.
+            }
+        }
+    }
+    cachedGitBinary = null;
+    return null;
+}
+/**
+ * Arguments every trusted git invocation carries, before the caller's own.
+ *
+ * `-c` beats repository config, so this is enforcement rather than a request:
+ * the repository cannot override it back.
+ */
+function trustedGitArgs() {
+    return [
+        '-c',
+        `core.hooksPath=${noHooksDir()}`,
+        /**
+         * SIGNING IS NOT AN ATTACK, SO IT IS NOT REFUSED — IT IS TURNED OFF HERE.
+         *
+         * A person who signs their commits has `commit.gpgsign = true` and a
+         * `gpg.program` in their GLOBAL config, and refusing their repository over
+         * it would be absurd. But `git commit` then spawns that program under the
+         * daemon, which is the same execution this file exists to prevent — and it
+         * is not hypothetical: with signing on, `commit` failed with "gpg failed to
+         * sign the data" after the named program ran.
+         *
+         * `-c` is the same scoped override `core.hooksPath` above uses: it applies
+         * to this invocation only and mutates nothing of the person's. Verified to
+         * beat both a global-config `commit.gpgsign` and one injected through
+         * `GIT_CONFIG_COUNT`, in gpg and ssh signing formats alike.
+         *
+         * `push.gpgSign` is here for a second reason as well as the first: with it
+         * set, looply's push FAILS outright — "the receiving end does not support
+         * --signed push" — so this is a correctness fix, not only a safety one.
+         */
+        '-c',
+        'commit.gpgsign=false',
+        '-c',
+        'push.gpgSign=false',
+    ];
+}
+/**
+ * The environment for a trusted git invocation.
+ *
+ * 🔴 THE `GIT_` NAMESPACE IS THE ENTIRE REDIRECT SURFACE, so it is the one
+ * namespace built up rather than inherited — exactly the principle
+ * `exec-domains.ts` already states for contained children, applied here to a
+ * single prefix instead of a whole environment.
+ *
+ * Spreading `process.env` handed every one of these to git, and each was
+ * demonstrated against looply's own verbs on a clean repository:
+ *
+ *   GIT_DIR, GIT_WORK_TREE, GIT_COMMON_DIR   operate on a DIFFERENT repository
+ *                                            while both Phase 0 checks — which
+ *                                            read the cwd — return null.
+ *                                            `GIT_WORK_TREE` alone is the worst:
+ *                                            git keeps this repository's gitdir
+ *                                            and index and relocates the TREE,
+ *                                            which is what turns `discard()`'s
+ *                                            `reset --hard` + `clean -fd` into
+ *                                            data loss somewhere else.
+ *   GIT_CONFIG_COUNT/KEY/VALUE,              inject config, so
+ *   GIT_CONFIG_PARAMETERS,                   `filter.<any>.clean` fires on
+ *   GIT_CONFIG_GLOBAL, GIT_CONFIG_SYSTEM     `status`, `add -A`, `diff HEAD`
+ *                                            and `commit`. The repository's own
+ *                                            config is clean throughout.
+ *   GIT_EXTERNAL_DIFF                        fires on `diff HEAD`.
+ *   GIT_INDEX_FILE                           `add -A` writes a foreign index, so
+ *                                            the round's own commit carries none
+ *                                            of its work. Git EXPORTS this to
+ *                                            hooks, so it needs no attacker.
+ *   GIT_OBJECT_DIRECTORY                     writes this repository's blobs into
+ *                                            a directory somebody else named.
+ *   GIT_NAMESPACE                            the push lands at
+ *                                            `refs/namespaces/<ns>/...` while
+ *                                            `ls-remote` — under the same
+ *                                            namespace — reports it present at
+ *                                            the real ref. The write and its
+ *                                            verification lie consistently.
+ *   GIT_TRACE, GIT_TRACE2*                   an arbitrary file create-and-append
+ *                                            primitive, as the daemon.
+ *   GIT_LITERAL_PATHSPECS                    breaks the `:(exclude).looply`
+ *                                            argument — fails closed, but only
+ *                                            by luck.
+ *
+ * ⚠️ THE `GIT_` PREFIX IS DROPPED EXCEPT FOR `AMBIENT_GIT_KEPT` below, and both
+ * halves of that are deliberate. PATH, HOME, APPDATA, SSH_AUTH_SOCK,
+ * SSH_ASKPASS, GCM_*, LANG and the lowercase proxy variables are the person's
+ * machine, not the round's input. Most of what an ordinary setup depends on —
+ * the credential helper, LFS filters, identity in a config file — lives in
+ * FILES; the exceptions that live in the environment are named in
+ * `AMBIENT_GIT_KEPT`, because dropping them broke a CI commit outright. A rule
+ * of "refuse if any GIT_* is set" would refuse an ordinary developer session,
+ * which already carries `GIT_EDITOR`, `GIT_ASKPASS` and `GIT_TERMINAL_PROMPT`
+ * from its surrounding tooling.
+ *
+ * ⚠️ SO THE HONEST CLAIM IS NARROWER STILL, and the first version of this
+ * comment overstated it. Ambient environment cannot redirect a looply git
+ * operation, and cannot inject configuration THROUGH THE `GIT_` NAMESPACE. It
+ * can still inject configuration by other means: `XDG_CONFIG_HOME` and `HOME`
+ * survive verbatim, and git reads `$XDG_CONFIG_HOME/git/config` and
+ * `$HOME/.gitconfig`, neither of which `repoConfigPaths` scans. That is
+ * deliberate, and it is the same carve-out the header already makes for system
+ * and global config: those files are the person's, and refusing them would
+ * break every machine with Git LFS. It is also unreachable from repository
+ * content — no production file assigns `process.env` — which is the threat this
+ * file exists to stop. And it is NOT "the child can name no program":
+ * `SSH_ASKPASS` and its relatives survive as ambient machine configuration.
+ *
+ * ⚠️ AND `GIT_CONFIG_NOSYSTEM` IS DELIBERATELY NOT SET. `exec-domains.ts` sets
+ * it for the UNTRUSTED gate on purpose; setting it here would drop the system
+ * config that carries `filter.lfs.*` and `credential.helper` — the breakage the
+ * header of this file already refuses to cause.
+ */
+/**
+ * `GIT_` variables that are NOT redirection or injection primitives, and that an
+ * ordinary developer or CI system legitimately sets.
+ *
+ * 🔴 DROPPING THE WHOLE NAMESPACE BROKE COMMITS. `GitDriver.commit` runs a bare
+ * `git commit -m` with no `--author`, so with these gone the only identity path
+ * is a config file — and a CI runner that supplies identity through the
+ * environment gets `Author identity unknown`, exit 128. Measured: the same
+ * commit in the same repository succeeded with them and failed without. The
+ * resulting `GitError` is thrown outside every try in `runRound`, so it ended
+ * the whole run, after the paid model turn and after a passing gate.
+ *
+ * Each entry earns its place by NOT being able to move the operation: an author
+ * name is a string on a commit object. `GIT_SSH_COMMAND` and `GIT_SSH` do name a
+ * program, but only for the two network verbs, they are how deploy keys and
+ * non-default ports are configured on every CI system, and their config
+ * equivalent `core.sshCommand` is already refused when it comes from the
+ * REPOSITORY — which is the threat this file is about. Ambient is the person's
+ * machine.
+ */
+const AMBIENT_GIT_KEPT = [
+    /^GIT_(AUTHOR|COMMITTER)_(NAME|EMAIL|DATE)$/i,
+    /^GIT_SSH(_COMMAND)?$/i,
+    /^GIT_LFS_/i,
+];
+function trustedGitEnv(base, cwd) {
+    /**
+     * Built as a plain record and cast once at the end, deliberately.
+     * `NodeJS.ProcessEnv` is widened by `expo-modules-core` to REQUIRE `NODE_ENV`
+     * under the test tsconfig, so an empty literal of that type does not compile
+     * there even though it compiles for this package alone.
+     */
+    const out = {};
+    for (const [k, v] of Object.entries(base)) {
+        if (!/^GIT_/i.test(k) || AMBIENT_GIT_KEPT.some((p) => p.test(k)))
+            out[k] = v;
+    }
+    // Never block a daemon on a credential prompt nobody can answer.
+    out['GIT_TERMINAL_PROMPT'] = '0';
+    /**
+     * PINNED, so that the repository this file CHECKED and the repository git
+     * OPERATES ON are the same one by construction.
+     *
+     * Only when the layout resolved: on `fault` the caller's two checks refuse
+     * before this matters, and on `none` nothing is pinned so git produces its own
+     * error exactly as before. The pair comes from `resolveGitLayout`, which was
+     * verified against `git rev-parse --absolute-git-dir --show-toplevel` in both
+     * an ordinary checkout and a linked worktree.
+     *
+     * ⚠️ THIS DISABLES GIT'S OWN DISCOVERY for looply's commands, which is safe
+     * only because `repoRootTroubleAt` already guarantees the cwd is the
+     * repository root. Relax that check and this becomes load-bearing in a way it
+     * is not today.
+     */
+    if (cwd !== undefined) {
+        const layout = resolveGitLayout(cwd);
+        if (layout.kind === 'ok') {
+            out['GIT_DIR'] = layout.gitDir;
+            out['GIT_WORK_TREE'] = layout.root;
+        }
+    }
+    return out;
+}
+/**
+ * THE MAIN WORKTREE'S ROOT — the directory a project's shared state belongs to.
+ *
+ * 🔴 A LINKED WORKTREE IS THE SAME PROJECT, and almost nothing in looply knew
+ * that. Project identity, the loop-safety history, the single-use exemption
+ * ledger, the human's control file and the ledger the daemon uploads are all
+ * derived from the working directory — so running in a worktree silently
+ * produced a DIFFERENT project with a fresh safety history, unspent exemptions,
+ * a control file nobody writes and events nobody uploads.
+ *
+ * The main worktree is where the common dir lives: for `<root>/.git` the answer
+ * is `<root>`. A linked worktree's common dir is that same `<root>/.git`, so it
+ * resolves to the same place — which is the whole point.
+ *
+ * ⚠️ NULL, NOT A GUESS, when there is no repository or its metadata cannot be
+ * read. The caller then keeps whatever it does today, so a non-repository
+ * directory behaves exactly as it did before this existed.
+ *
+ * ⚠️ A BARE OR SEPARATE-GITDIR REPOSITORY HAS NO MAIN WORKTREE ROOT. When the
+ * common dir is not named `.git`, this returns null rather than inventing a
+ * parent directory that may hold nothing at all.
+ */
+function mainWorktreeRoot(cwd) {
+    const layout = resolveGitLayout(cwd);
+    if (layout.kind !== 'ok')
+        return null;
+    const common = (0, node_path_1.resolve)(layout.commonDir);
+    if ((0, node_path_1.basename)(common).toLowerCase() !== '.git')
+        return null;
+    return (0, node_path_1.dirname)(common);
+}
+/**
+ * WHAT ALL THE WORKTREES OF ONE REPOSITORY SHARE, when no main worktree exists.
+ *
+ * 🔴 `mainWorktreeRoot` RETURNING NULL WAS TREATED AS "NO SHARING NEEDED", and
+ * those are different statements. A repository can have several worktrees and no
+ * main one — `git clone --bare` then `git worktree add` twice is the ordinary
+ * way to get there — and for those, "no main root" was silently answered by
+ * putting the project's state inside each checkout. That is exactly the split
+ * the project/execution divide exists to prevent: a fresh loop-safety history
+ * per checkout, and one single-use exemption spendable once per checkout.
+ *
+ * The common dir is the identity every worktree of a repository agrees on, so it
+ * is what the shared location is keyed by.
+ *
+ * ⚠️ SEPARATE-GIT-DIR AND SUBMODULE LAYOUTS DO NOT REACH HERE. Both set
+ * `core.worktree`, which `repoConfigTrouble` refuses by name before any of this
+ * runs. The case this actually serves is the bare repository with linked
+ * worktrees, which nothing refuses and which was silently mis-scoped.
+ *
+ * ⚠️ NULL FOR AN ORDINARY CHECKOUT — `gitDir === commonDir` — even though one
+ * exists. There is a single worktree there, so the execution's own directory IS
+ * the project's, and answering anything else would move state that is correct
+ * where it sits.
+ */
+/**
+ * THE PATH THAT IDENTIFIES A REPOSITORY, whichever of its checkouts you are in.
+ *
+ * 🔴 PROJECT IDENTITY WAS THE CWD, AND A WORKTREE IS NOT A NEW PROJECT. Both
+ * `repoPathHash` (the server's project key) and `projectKeyFor` (the project
+ * memory key) hashed the directory the command happened to run in. So
+ * `looply run --in <workspace>` registered a SECOND project on the server for
+ * the same repository, uploaded its events there, and read an empty project
+ * memory — while the person watching saw one project stop producing evidence.
+ *
+ * ⚠️ AN ORDINARY CHECKOUT HASHES TO EXACTLY WHAT IT ALWAYS DID. The main
+ * worktree root of a normal repository IS its root, so every existing key,
+ * every cached `projects` entry in the machine store and every server-side
+ * project survives untouched. Only a linked worktree's answer changes, and it
+ * changes from "a project of its own" to "the project it was cut from".
+ *
+ * ⚠️ AND A NON-REPOSITORY IS UNCHANGED TOO — no layout, no answer, the path
+ * comes back as given. Tests that pass invented directories keep working, which
+ * is deliberate: this must not require a repository to be callable.
+ */
+/**
+ * Whether this directory IS a checkout's root — ordinary or linked.
+ *
+ * `resolveGitLayout` walks up, so every directory inside a repository has a
+ * layout. This is the question that separates `<repo>` from `<repo>/packages/a`,
+ * and it is the one both the project's identity and the project's state have to
+ * agree on or one of them is lying about what a project is.
+ */
+function isCheckoutRoot(cwd) {
+    const layout = resolveGitLayout(cwd);
+    return layout.kind === 'ok' && (0, node_path_1.resolve)(layout.root) === (0, node_path_1.resolve)(cwd);
+}
+function repoIdentityPath(cwd) {
+    const here = (0, node_path_1.resolve)(cwd);
+    const layout = resolveGitLayout(here);
+    if (layout.kind !== 'ok')
+        return here;
+    /**
+     * ⚠️ A SUBDIRECTORY RESOLVES TO ITS REPOSITORY, and that is deliberate — but
+     * it was briefly changed to the opposite, so the reasoning is recorded here.
+     *
+     * `resolveGitLayout` walks up, so `<repo>/packages/a` answers `<repo>`. An
+     * adversarial pass called that a compatibility break: two directories that had
+     * always been two projects, merged onto one key.
+     *
+     * MEASURED, AND THE PREMISE IS FALSE. Looply cannot run outside a checkout
+     * root — `repoRootTroubleAt` refuses every git verb from a subdirectory, and
+     * the config is read from `<cwd>/.looply/config.yaml`, which a subdirectory
+     * does not have. So no subdirectory has ever registered a server project,
+     * filed a project memory, or held state; there is nothing there to merge.
+     *
+     * Requiring the root instead broke the one thing subdirectories ARE used for:
+     * a person typing `looply stop` or `looply runs` from inside their tree.
+     * Those commands are not guarded by the root check, and with the narrowing
+     * they addressed `<subdir>/.looply/state` — so the brake silently wrote a file
+     * no run would ever read, and reported "no run is going" while one was.
+     * Measured on the shipped build before it was reverted.
+     */
+    return mainWorktreeRoot(here) ?? linkedRepoCommonDir(here) ?? here;
+}
+function linkedRepoCommonDir(cwd) {
+    const layout = resolveGitLayout(cwd);
+    if (layout.kind !== 'ok')
+        return null;
+    const common = (0, node_path_1.resolve)(layout.commonDir);
+    if ((0, node_path_1.resolve)(layout.gitDir) === common)
+        return null;
+    return common;
+}
+//# sourceMappingURL=trusted-git.js.map