styleproof 4.4.1 → 4.4.2

package/CHANGELOG.md

@@ -7,6 +7,14 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+### Fixed
+
+- **Map-store uploads from Git hooks no longer inherit the caller repository's
+  Git location variables.** A cold `styleproof-maps` upload could otherwise run
+  its temporary `git init` against the consumer repository, set
+  `core.bare=true`, and reject the push after a successful capture. StyleProof
+  now isolates every child Git process from hook-exported repository paths.
+
 ## [4.4.1] - 2026-07-13
 
 ### Changed

package/dist/map-store.js

@@ -16,6 +16,19 @@ export const MAP_MANIFEST = 'styleproof-manifest.json';
  *  has exited — no browser — so it reads the build back from here. Not a surface map. */
 export const BROWSER_BUILD_SIDECAR = 'styleproof-browser.json';
 const GENERATED_DIRTY_ALLOWLIST = new Set(['next-env.d.ts']);
+const GIT_REPOSITORY_ENVIRONMENT_VARIABLES = [
+    'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+    'GIT_COMMON_DIR',
+    'GIT_DIR',
+    'GIT_GRAFT_FILE',
+    'GIT_INDEX_FILE',
+    'GIT_INTERNAL_SUPER_PREFIX',
+    'GIT_OBJECT_DIRECTORY',
+    'GIT_PREFIX',
+    'GIT_REPLACE_REF_BASE',
+    'GIT_SHALLOW_FILE',
+    'GIT_WORK_TREE',
+];
 /** Bundle files that sit alongside the maps but are NOT surfaces (manifest, coverage
  *  ledger, and any future sidecar). Every place that enumerates surface maps must skip
  *  these, or a sidecar reads as a phantom "new surface". */
@@ -30,8 +43,14 @@ export function isMapFile(name) {
 }
 export class MapStoreError extends Error {
 }
+function gitProcessEnvironment() {
+    const environment = { ...process.env };
+    for (const variableName of GIT_REPOSITORY_ENVIRONMENT_VARIABLES)
+        delete environment[variableName];
+    return environment;
+}
 function runGit(cwd, args, maxBuffer = 1 << 28) {
-    return spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer });
+    return spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer, env: gitProcessEnvironment() });
 }
 function gitOutput(cwd, args) {
     const r = runGit(cwd, args);
@@ -385,6 +404,7 @@ function checkoutMapStore(cwd, remote, branch) {
         const clone = spawnSync('git', ['clone', '-q', '--depth', '1', '--branch', branch, remoteUrl, tmp], {
             encoding: 'utf8',
             maxBuffer: 1 << 20,
+            env: gitProcessEnvironment(),
         });
         if (clone.status !== 0) {
             fs.rmSync(tmp, { recursive: true, force: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "styleproof",
-  "version": "4.4.1",
+  "version": "4.4.2",
   "description": "Catch every CSS change before it ships — review PRs and certify refactors by the browser's computed styles, not pixels. Works with any styling system.",
   "keywords": [
     "playwright",