Bind Git worktree helpers to a trusted executable

codex-rs/git-utils/src/safe_git.rs

@@ -0,0 +1,30 @@
+use std::process::Command;
+
+pub(crate) const DISABLED_HOOKS_PATH: &str = if cfg!(windows) { "NUL" } else { "/dev/null" };
+
+const ISOLATED_GIT_ENVIRONMENT: [&str; 11] = [
+    "GIT_DIR",
+    "GIT_WORK_TREE",
+    "GIT_COMMON_DIR",
+    "GIT_INDEX_FILE",
+    "GIT_PREFIX",
+    "GIT_LITERAL_PATHSPECS",
+    "GIT_GLOB_PATHSPECS",
+    "GIT_NOGLOB_PATHSPECS",
+    "GIT_ICASE_PATHSPECS",
+    "GIT_EXEC_PATH",
+    // Legacy `GIT_CONFIG` affects `git config` but not ordinary worktree
+    // commands, so inheriting it can make a safety probe inspect different
+    // configuration than the command it guards.
+    "GIT_CONFIG",
+];
+
+/// Keep internal worktree operations bound to their explicit cwd and pathspec
+/// semantics instead of inheriting repository, index, or pathspec selectors.
+/// Deliberately leave Git config channels intact: callers may rely on normal
+/// system/global configuration, and executable helpers are probed separately.
+pub(crate) fn isolate_git_command_environment(command: &mut Command) {
+    for name in ISOLATED_GIT_ENVIRONMENT {
+        command.env_remove(name);
+    }
+}