3ca84487c5
GitSpawn class (Sep 2026): a repo's .git/config can set core.fsmonitor to a command that executes on any git index refresh, silently and as the user. Ollie never spawns git in its own plumbing (repo detection is os.Stat), but model-run git inside a malicious repo would fire it. - exec: force core.fsmonitor=false via GIT_CONFIG_* in sandboxed tool env - turn: wrap repo AGENTS.md in <context> markers (untrusted data, filtered by KDE chat rendering) - AGENTS.md: document the no-git-in-plumbing invariant (lesson 16) |
||
|---|---|---|
| .. | ||
| internal | ||
| test | ||
| .gitignore | ||
| main.go | ||
| p9.go | ||