Jeremy Rose 7ada37a15e Reject implicitly discovered bare Git repositories (#36924) ...

## Why

A repository can contain a tracked directory that Git implicitly treats as a bare
repository. Its configuration may select helpers such as `core.fsmonitor`, causing
Codex Git operations in that directory to execute repository-controlled code.

## What changed

- Pass `-c safe.bareRepository=explicit` to Codex-managed Git commands so they
  reject implicitly discovered bare repositories.
- Continue to support repositories explicitly selected with `--git-dir` or
  `GIT_DIR`.

## Testing

Add a regression test that clones a repository containing a tracked embedded Git
repository and verifies that guarded Git inspection rejects it without running
its configured filesystem monitor.

GitOrigin-RevId: 344b5bc1e0ffa94f2a1b788488aa653222da10f3

2026-08-04 16:53:33 +00:00

..

command_migration

Migrate plugin commands into skills on install (#33411)

2026-07-15 19:51:37 +00:00

marketplace_add

Reject implicitly discovered bare Git repositories (#36924)

2026-08-04 16:53:33 +00:00

marketplace_upgrade

Reject implicitly discovered bare Git repositories (#36924)

2026-08-04 16:53:33 +00:00

remote

Implement remote plugin search (#36409)

2026-08-01 00:17:45 +00:00

startup_sync

Honor system proxy settings for remote plugins (#34509)

2026-07-21 10:05:06 +00:00

agent_plugin_manifest_tests.rs

Support portable Agent Plugins throughout installation (#36544)

2026-08-02 02:29:45 +00:00

agent_plugin_manifest.rs

Support Agent Plugins manifests (#35105)

2026-07-24 05:59:16 +00:00

app_mcp_routing_tests.rs

[codex] Centralize plugin auth capability filtering (#27902)

2026-06-16 00:13:27 +00:00

app_mcp_routing.rs

auth: move domain mode below app wire types (#29721)

2026-06-24 03:10:20 +00:00

command_migration_tests.rs

Migrate plugin commands into skills on install (#33411)

2026-07-15 19:51:37 +00:00

command_migration.rs

Migrate plugin commands into skills on install (#33411)

2026-07-15 19:51:37 +00:00

discoverable_tests.rs

Respect system proxies during plugin startup sync (#34506)

2026-07-21 09:46:00 +00:00

discoverable.rs

[codex] Cache plugin metadata for tool suggestions (#27812)

2026-06-18 12:25:07 -07:00

http_client_selector.rs

Respect system proxies during plugin startup sync (#34506)

2026-07-21 09:46:00 +00:00

installed_marketplaces.rs

[plugins] Enforce marketplace source policy at runtime (#29691)

2026-06-27 15:22:05 -07:00

lib.rs

Propagate remote plugin IDs to skill metadata (#35261)

2026-07-24 23:36:11 +00:00

loader_tests.rs

Propagate remote plugin IDs to skill metadata (#35261)

2026-07-24 23:36:11 +00:00

loader.rs

Reject implicitly discovered bare Git repositories (#36924)

2026-08-04 16:53:33 +00:00

manager_tests.rs

Move the host skills service into the skills extension (#36921)

2026-08-04 16:28:46 +00:00

manager.rs

Route curated plugins by authentication mode (#35671)

2026-07-27 21:17:42 +00:00

manifest.rs

Support Agent Plugins manifests (#35105)

2026-07-24 05:59:16 +00:00

marketplace_add.rs

[plugins] Enforce marketplace source admission requirements (#29753)

2026-06-23 20:13:11 -07:00

marketplace_policy_tests.rs

[plugins] Enforce marketplace source policy at runtime (#29691)

2026-06-27 15:22:05 -07:00

marketplace_policy.rs

[plugins] Enforce marketplace source policy at runtime (#29691)

2026-06-27 15:22:05 -07:00

marketplace_remove.rs

Move marketplace add/remove and startup sync out of core. (#19099)

2026-04-23 11:27:17 -07:00

marketplace_tests.rs

Support portable Agent Plugins throughout installation (#36544)

2026-08-02 02:29:45 +00:00

marketplace_upgrade_tests.rs

config: own layer provenance types (#29722)

2026-06-24 04:03:04 +00:00

marketplace_upgrade.rs

[plugins] Enforce marketplace source admission requirements (#29753)

2026-06-23 20:13:11 -07:00

marketplace.rs

Add Cursor support to setup import (#33426)

2026-07-15 21:03:49 +00:00

npm_source_tests.rs

[codex] Support npm marketplace plugin sources (#29375)

2026-06-26 17:24:46 -04:00

npm_source.rs

[codex] Support npm marketplace plugin sources (#29375)

2026-06-26 17:24:46 -04:00

plugin_bundle_archive_tests.rs

Support portable Agent Plugins throughout installation (#36544)

2026-08-02 02:29:45 +00:00

plugin_bundle_archive.rs

Support portable Agent Plugins throughout installation (#36544)

2026-08-02 02:29:45 +00:00

provider_tests.rs

Support portable Agent Plugins throughout installation (#36544)

2026-08-02 02:29:45 +00:00

provider.rs

Instrument environment and plugin resolution paths (#33223)

2026-07-15 03:27:16 +00:00

remote_bundle.rs

Support portable Agent Plugins throughout installation (#36544)

2026-08-02 02:29:45 +00:00

remote_legacy.rs

Honor system proxy settings for remote plugins (#34509)

2026-07-21 10:05:06 +00:00

remote_plugin_id_resolver.rs

Propagate remote plugin IDs to skill metadata (#35261)

2026-07-24 23:36:11 +00:00

remote_tests.rs

Expose plugin installation timestamps in app-server summaries (#35859)

2026-07-29 01:16:29 +00:00

remote.rs

Implement remote plugin search (#36409)

2026-08-01 00:17:45 +00:00

script_attribution_tests.rs

Propagate remote plugin IDs to skill metadata (#35261)

2026-07-24 23:36:11 +00:00

script_attribution.rs

Attribute command executions to trusted plugin scripts (#35020)

2026-07-23 22:31:53 +00:00

startup_sync_tests.rs

Reject implicitly discovered bare Git repositories (#36924)

2026-08-04 16:53:33 +00:00

startup_sync.rs

Reject implicitly discovered bare Git repositories (#36924)

2026-08-04 16:53:33 +00:00

store_tests.rs

Support portable Agent Plugins throughout installation (#36544)

2026-08-02 02:29:45 +00:00

store.rs

Support portable Agent Plugins throughout installation (#36544)

2026-08-02 02:29:45 +00:00

test_support.rs

Use the API plugin marketplace for Amazon Bedrock (#34931)

2026-07-23 11:32:47 +00:00

toggles.rs

…

tool_suggest_metadata.rs

Propagate remote plugin IDs to skill metadata (#35261)

2026-07-24 23:36:11 +00:00