Bind Git worktree helpers to a trusted executable

codex-rs/git-utils/src/git_config.rs

@@ -0,0 +1,31 @@
+use std::path::Component;
+use std::path::Path;
+
+pub(crate) fn path_is_within(path: &Path, root: &Path) -> bool {
+    let mut path_components = path.components();
+    for root_component in root.components() {
+        let Some(path_component) = path_components.next() else {
+            return false;
+        };
+        if !components_equal(path_component, root_component) {
+            return false;
+        }
+    }
+    true
+}
+
+#[cfg(windows)]
+fn components_equal(left: Component<'_>, right: Component<'_>) -> bool {
+    left.as_os_str()
+        .to_string_lossy()
+        .eq_ignore_ascii_case(&right.as_os_str().to_string_lossy())
+}
+
+#[cfg(not(windows))]
+fn components_equal(left: Component<'_>, right: Component<'_>) -> bool {
+    left == right
+}
+
+#[cfg(test)]
+#[path = "git_config_tests.rs"]
+mod tests;