From 3e5b7df998f35494aac568489e4c8f2f401f6b71 Mon Sep 17 00:00:00 2001 From: Scott Werner Date: Fri, 11 Sep 2026 09:33:18 -0600 Subject: [PATCH] Disable fsmonitor during native Git workflow checkout The hardened -c list for CLI-owned Git acquisition disabled hooks, LFS filters, submodules, and maintenance but omitted core.fsmonitor, so a user's global fsmonitor hook (or the builtin daemon) still ran during the temporary checkout. Match the sandbox's hardening and cover it in the hooks/filters test. Co-Authored-By: Claude Fable 5.1 --- .../src/commands/run/remote_workflow.rs | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/lib/apps/fabro-cli/src/commands/run/remote_workflow.rs b/lib/apps/fabro-cli/src/commands/run/remote_workflow.rs index 8e9005abc..64d51d907 100644 --- a/lib/apps/fabro-cli/src/commands/run/remote_workflow.rs +++ b/lib/apps/fabro-cli/src/commands/run/remote_workflow.rs @@ -70,6 +70,8 @@ impl NativeGit { "-c", "core.hooksPath=/dev/null", "-c", + "core.fsmonitor=false", + "-c", "filter.lfs.smudge=", "-c", "filter.lfs.process=", @@ -574,9 +576,26 @@ mod tests { std::fs::Permissions::from_mode(0o755), ) .unwrap(); + // The fsmonitor hook runs during checkout even with hooksPath disabled. + std::fs::write( + hooks.join("fsmonitor"), + format!( + "#!/bin/sh\ntouch '{}'\nprintf 'token\\0/\\0'\n", + sentinel.display() + ), + ) + .unwrap(); + std::fs::set_permissions( + hooks.join("fsmonitor"), + std::fs::Permissions::from_mode(0o755), + ) + .unwrap(); config .set_str("core.hooksPath", hooks.to_str().unwrap()) .unwrap(); + config + .set_str("core.fsmonitor", hooks.join("fsmonitor").to_str().unwrap()) + .unwrap(); config .set_str( "filter.fixture.smudge",