[Security] Git hooks can run arbitrary code

[grassplatypus]

fsmonitor hooks can be run in DSH.

grass@87e83bddb1f7:~/work/acme-api$ cat .git/index-refresh
#!/bin/sh
date -u +%FT%TZ >> /tmp/acme-index-refresh.log
exit 1

grass@87e83bddb1f7:~/work/acme-api$ dsh --profile headless "say hello"
Hello! 👋

I'm ready to help you with your project in `/home/grass/work/acme-api`. I can assist with:

- **Code development** - writing, editing, and reviewing code
- **File operations** - reading, creating, and modifying files
- **Build & testing** - running commands, checking outputs
- **Analysis** - searching files, finding patterns
- **Delegation** - breaking down complex tasks across subagents

What would you like me to help you with?
grass@87e83bddb1f7:~/work/acme-api$ cat /tmp/acme-index-refresh.log
2026-10-09T03:51:02Z
2026-10-09T03:51:02Z
2026-10-09T03:51:02Z
2026-10-09T03:51:02Z

Checked on 0.2.0-rc2

[argszero]

Confirmed here independently, with measurements — and the harness's own git calls are the ones that will honor it.

Reproduction (this machine, git 2.50.1). Scratch repo, git config core.fsmonitor "$(pwd)/.git/index-refresh" where the hook appends a line and exits 1, and every command run under env -i PATH=… GIT_CONFIG_COUNT=0 GIT_TERMINAL_PROMPT=0 GIT_OPTIONAL_LOCKS=0 LC_ALL=C — i.e. the exact environment the harness's git runner uses:

command	hook invocations
git rev-parse --show-toplevel --absolute-git-dir --git-path objects	0
git add --all --ignore-errors	2
git write-tree	2
git ls-files -z --stage	2
git check-ignore -z --stdin	2
git --version (control)	0
git -c core.fsmonitor=false add --all	0

Two invocations per command is git's fsmonitor version probe plus the token request. So the hook is asked on any index/content command, not only on something like git status, and one -c overrides it completely.

Where the harness runs git. packages/deliverables/workspace-changes/src/git.ts:59 spawns [executable, ...args] with

env: { GIT_CONFIG_COUNT: '0', GIT_TERMINAL_PROMPT: '0', GIT_OPTIONAL_LOCKS: '0', LC_ALL: 'C' }

The environment is scrubbed, but the argv carries no -c core.fsmonitor=false, so a repository-local core.fsmonitor — which arrives with a clone, the exact threat model the boot bootstrap already assumes — is honored.

The repository already treats this as something to disable on its own git calls. scripts/change-scope.ts:62:

spawnSync('git', ['-C', cwd, '-c', 'core.fsmonitor=false', ...args], { … })

and packages/boot/app-boot/src/index.ts refuses GIT_CONFIG_GLOBAL, GIT_CONFIG_SYSTEM, GIT_CONFIG_COUNT, GIT_SSH*, GIT_EXTERNAL_DIFF coming from a clone-supplied environment file, with the stated rationale that "the invoking directory's file — which arrives with a clone — keeps refusing them." .git/config is the remaining channel of the same trust boundary. The same class also applies to the plugin-install path, packages/boot/plugin-manager/src/github-connection.ts:44 (git -c credential.helper= ls-remote …), which likewise inherits ambient repository config.

Suggested minimal fix (one line per call site, matching the in-tree precedent above): pass -c core.fsmonitor=false on every harness-issued git invocation — GitRunner.run() covers the workspace-snapshot path, plus the ls-remote call. If the intent is broader, the same seam is the place to decide a policy for repository-local config generally.

One thing I could not reproduce, and it would make the report stronger. You saw four invocations within one second during dsh --profile headless "say hello". As shipped, the headless profile does not load the workspace-changes plugin (it is in the web-app bundle), and the only runtime git callers in the tree are that plugin and the plugin-install path — so if your run genuinely had no tool call, it would be useful to know which profile/plugins ran git. The hook can name its caller: echo "$(date -u +%FT%TZ) ppid=$PPID args=$(ps -o args= -p $PPID)" >> log. That single line settles whether it is the workspace snapshot path (which I can then point at precisely) or something else in your installation.

[grassplatypus]

I launched with clean DSH web environment again, attached with openrouter API key. There aren't any 3rd party plugins installed in WSL.

The hook:

#!/bin/sh
printf "%s cmd=%s
" "$(date -u +%FT%TZ)" "$(tr "" " " < /proc/$PPID/cmdline)" >> ~/.cache/acme-build/ran.log
exit 1

grassplatypus@GrassDesktop ~/w/a/.git [1]> cat /home/grassplatypus/.cache/acme-build
/ran.log
2026-10-09T05:51:03Z cmd=/usr/bin/gitadd--all--ignore-errors
2026-10-09T05:51:03Z cmd=/usr/bin/gitadd--all--ignore-errors
2026-10-09T05:51:04Z cmd=/usr/bin/gitwrite-tree
2026-10-09T05:51:04Z cmd=/usr/bin/gitwrite-tree
2026-10-09T05:52:30Z cmd=/usr/bin/gitadd--all--ignore-errors
2026-10-09T05:52:30Z cmd=/usr/bin/gitadd--all--ignore-errors
2026-10-09T05:52:30Z cmd=/usr/bin/gitwrite-tree
2026-10-09T05:52:30Z cmd=/usr/bin/gitwrite-tree

Read-only mode and just shell, agent loop, subagent, and web search plugins were enabled. Again, I told the LLM just "hi".