scriptoriumadmin/fabro
1
0
Fork 0
mirror of https://github.com/fabro-sh/fabro.git synced 2026-09-11 22:53:00 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Disable fsmonitor during native Git workflow checkout

Browse source 
The hardened -c list for CLI-owned Git acquisition disabled hooks, LFS
filters, submodules, and maintenance but omitted core.fsmonitor, so a
user's global fsmonitor hook (or the builtin daemon) still ran during the
temporary checkout. Match the sandbox's hardening and cover it in the
hooks/filters test.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Scott Werner 2026-09-11 09:33:18 -06:00
parent 6e8a6c29df
commit 3e5b7df998
1 changed files with 19 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
lib/apps/fabro-cli/src/commands/run/remote_workflow.rs
View file

@ -70,6 +70,8 @@ impl NativeGit {
"-c",
"core.hooksPath=/dev/null",
"-c",
"core.fsmonitor=false",
"-c",
"filter.lfs.smudge=",
"-c",
"filter.lfs.process=",
@ -574,9 +576,26 @@ mod tests {
std::fs::Permissions::from_mode(0o755),
)
.unwrap();
// The fsmonitor hook runs during checkout even with hooksPath disabled.
std::fs::write(
hooks.join("fsmonitor"),
format!(
"#!/bin/sh\ntouch '{}'\nprintf 'token\\0/\\0'\n",
sentinel.display()
),
)
.unwrap();
std::fs::set_permissions(
hooks.join("fsmonitor"),
std::fs::Permissions::from_mode(0o755),
)
.unwrap();
config
.set_str("core.hooksPath", hooks.to_str().unwrap())
.unwrap();
config
.set_str("core.fsmonitor", hooks.join("fsmonitor").to_str().unwrap())
.unwrap();
config
.set_str(
"filter.fixture.smudge",