#!/bin/sh
set -eu

# /app/bin/git — runs the host's git instead of a bundled one.
#
# The Freedesktop runtime ships no git, and the bundled Codex agent shells out
# to `git` for status, diffs, branches and commits while working in a directory
# the user granted. Those directories are bound at their real host paths, so the
# host's git operates on exactly the same files, with the user's own
# ~/.gitconfig, credential helper and SSH keys.
#
# This is what --talk-name=org.freedesktop.Flatpak buys, and it is a real
# widening of the sandbox: git runs hooks, aliases, pagers and core.sshCommand,
# so anything reached through here executes on the host. Declared in
# flatpark.yml's policy.dangerous_permissions and documented in the metainfo.
#
# Drop the sandbox-only environment before crossing over: LD_PRELOAD and
# ZYPAK_LD_PRELOAD name /app paths that do not exist on the host, and the XDG
# variables point into ~/.var/app/com.openai.ChatGPT, which would send the
# host's git looking for its configuration inside the sandbox's data directory.
unset LD_PRELOAD ZYPAK_LD_PRELOAD CHATGPT_FAKE_PID
unset XDG_CONFIG_HOME XDG_DATA_HOME XDG_CACHE_HOME XDG_STATE_HOME

exec flatpak-spawn --host git "$@"
