mirror of
https://github.com/esengine/DeepSeek-Reasonix.git
synced 2026-11-11 10:01:27 -10:00
esengine
ec866730e0
Every git invocation the host makes goes through gitcmd, and each one must leave the programs a repository's own configuration names unexecuted: filter and merge drivers, textconv and external diff, fsmonitor, hooks, signature verifiers, submodule-boundary programs and lazy-fetch transport. Driver neutralization now covers every subcommand, not diff alone, and takes driver names from git itself rather than from a separate reading of .git/config. - Fixed keys are overridden with -c: core.fsmonitor (empty, not "false", which git before 2.35.2 reads as a hook name), core.hooksPath, log.showSignature, merge.verifySignatures, diff.submodule, gc.auto and maintenance.auto and safe.bareRepository=explicit; submodule.recurse=false for checkout, switch, restore, reset, merge and read-tree (host branch switches and merges never update submodules, whatever the user's global submodule.recurse), and elsewhere only where the repository's own config sets it. GIT_NO_LAZY_FETCH=1 stops a missing object becoming a fetch through the repository's remote (git 2.44+); a historical patch that fails for that reason returns gitcmd.ErrObjectNotLocal, decided by git's own --missing=print listing. - diff, log and show carry --no-ext-diff and --no-textconv; status and diff carry --ignore-submodules=dirty. The subcommand is found past global options, so a call passing -C inside args is hardened too. - Filter and merge drivers defined at local or worktree scope are listed by git itself before each invocation (includes followed) and overridden empty; user and system scope stay live; a name -c cannot address fails closed (ErrRepositoryDrivers). - worktree add uses --no-checkout and populates through gitcmd inside the new worktree, so a conditional include keyed on the new gitdir or branch is seen by the driver listing there rather than run by the add's checkout. The reset takes the worktree-mutation timeout, and a failed reset removes both the worktree and the branch the add created. worktree remove uses --force after the existing hardened clean-tree check, so git does not run status inside the linked worktree with its config. - Launcher ls-remote runs Detached with gitcmd's environment (only PATH is taken from the launcher's declared env), requires an https://, ssh:// or git:// remote (case-insensitive; http:// and local paths are refused), and passes the remote and ref past -- so a leading-dash value is an operand. - worktree git calls with extra environment keep gitcmd's environment. - Repository identity is resolved once, when a session opens: boot runs gitcmd.Open (rev-parse --absolute-git-dir --git-common-dir --show-toplevel) before any command, the controller carries the resulting gitcmd.Repo, and a rebuild of the same workspace passes it on. Every later host call runs through the Repo with GIT_DIR, GIT_COMMON_DIR and GIT_WORK_TREE set, so a nested .git, a commondir file, a rewritten .git file or a damaged HEAD written afterwards cannot substitute another repository or its config; a damaged HEAD fails closed. Threaded through the TUI status line, cli review (resolved once before the review agent runs), the desktop changes panel, change detail, history, commit detail, branch list/checkout/create and tab branch label (the tab session's identity; a tab with no session yet resolves at display), worktree Inspect/Create/RollbackCreate, and the whole merge-back flow: the source and worktree identities are recorded in the merge metadata at creation (the worktree's resolved right after worktree add) in metadata.repo.json beside metadata.json, whose shape older builds decode strictly and so is unchanged; every inspect, auto-commit, merge and cleanup call runs against them, and a worktree without that file resolves them from the roots. InspectMerge finds the allocation root from the managed layout instead of asking git in the worktree. - Repo.Verify applies Open's test to a stored identity; the identities read from metadata.repo.json are verified before the merge flow uses them. - Auto-commit staging uses gitcmd Repo.StageAll: gitlinks present as directories and untracked nested repositories are excluded with :(exclude,literal) pathspecs, because add -A checks a submodule by running git inside it under its own config. A gitlink keeps the commit the index records; an untracked nested repository leaves the worktree unverifiable and the auto-commit refuses. The worktree state token no longer runs git inside a changed nested repository. - Open accepts only a git dir belonging to the work tree that holds the directory: the work tree's own .git (sharing no other common dir) or a linked worktree's admin dir under <common>/worktrees whose gitdir file names that work tree's .git. A .git file or core.worktree pointing at another checkout is ErrNotRepository. Submodule checkouts and --separate-git-dir repositories opened directly are therefore treated as not version-controlled. Regression tests use real git with payload scripts: the gitcmd config-key matrix (signatures, lazy fetch, submodule boundary), the worktree call sites (conditional includes on Create, linked-worktree config on RollbackCreate), the status readout, the launcher's non-URL remote rejection, identity pinning after a nested .git, a commondir file and a damaged HEAD (config origin and filter marker), Open refusing another checkout's git dir (.git file, core.worktree, foreign admin dir), StageAll with nested repositories named like pathspec magic or globs, metadata.json read by a strict older decoder, merge-back without the identity file, StageAll and merge-back auto-commit past a gitlink with its own filter, merge-back after the worktree's .git file is pointed at another git dir, the status line and desktop changes panel of a workspace that later gains its own .git, and a global submodule.recurse=true against host checkout and reset. The list-then-run race is left to a follow-up that denies sandboxed writes to .git config and hooks.