Repository navigation
fix(container-gateway-hook): derive the checkout root without repository config - #1804
Merged
potiuk merged 2 commits intoOct 25, 2026
Merged
Conversation
…ory config A .git directory planted in a sandbox-writable checkout could set core.worktree to a parent directory: git then reports a toplevel that still contains the session cwd (so the existing containment check passes) but keys the worktree records differently, so the main checkout's record is never consulted and its grants are skipped. The hook now also finds the root the way the filesystem shows it, the nearest directory holding a .git, refuses when git's toplevel differs, and refuses whenever core.worktree is set. The new test fails against the previous hook. Generated-by: Claude (Opus 5.5)
github-actions
Bot
added
family:setup
potiuk
enabled auto-merge (squash)
October 25, 2026 00:16
…iscover a bare repo Review follow-up, defense in depth. The root checks ran only when a .git was found on the way up. Now core.worktree refuses whether or not one is, a repository git finds with no .git on the way up refuses, and every git call runs with safe.bareRepository=explicit, so HEAD / config / objects planted in a project without .git are never treated as a repository. The new test is a regression guard: git already declined a toplevel from inside such a directory, so it did not reproduce as a bypass on the previous hook. Generated-by: Claude (Opus 5.5)
potiuk
added a commit
that referenced
this pull request
Oct 25, 2026
Ships the fixes merged since 0.9.0.dev202610241347 to marketplace installs: the container-gateway hook hardening (#1784, #1789, #1790, #1793, #1804), host-only uv state (#1785), session-start cleanup of the stale uv grant (#1788), the trusted session-start interpreter (#1791), the sandboxed prek home (#1792) and per-machine gateway hook registration (#1797). Generated-by: Claude (Opus 5.5)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A
.gitdirectory planted in a sandbox-writable checkout could setcore.worktreeto a parent directory. git then reports a toplevel that still contains the session's working directory, so the existing containment check passes. But the worktree records are then keyed by a different path, so the main checkout's record is never consulted and its settings are skipped.The hook now also finds the root the way the filesystem shows it: the nearest directory holding a
.git, read without any repository config. It refuses when git's toplevel differs, and whenevercore.worktreeis set. The new test plants exactly that.gitdirectory; it fails against the previous hook and passes with this change.🤖 Generated with Claude Code