fix(core): normalize git environment and resolve workspace state mismatch - #28792

Code Review

This pull request implements robust security mitigations against Remote Code Execution (RCE) vulnerabilities by securing Git command execution. It introduces a getSafeGitEnv utility to sanitize environment variables and enforce safe Git configuration overrides (disabling hooks, custom SSH commands, credential helpers, etc.) across all Git invocations. Furthermore, the PolicyEngine is updated to prevent automatic execution of Git commands in untrusted workspaces, forcing user confirmation instead. Workspace trust evaluation has also been consolidated and thoroughly tested. I have reviewed the changes and have no additional feedback to provide.

_{Note: Security Review did not run due to the size of the PR.}

Code Review

This pull request introduces security hardening for Git command execution within untrusted workspaces. It implements getSafeGitEnv to sanitize Git environment variables and enforce safe default configurations across GitService, WorktreeService, GrepTool, and shell executions, while updating the PolicyEngine to restrict Git commands in untrusted folders. The review feedback highlights two important issues: first, the containsGitCommand helper uses a loose regular expression that can cause false positives on arguments or URLs containing 'git', which should be refined to target only the actual executable; second, a potential TypeScript compilation error exists in grep.ts due to a type mismatch between the string | undefined record returned by getSafeGitEnv() and the strict Record<string, string> expected by ShellExecutionConfig.

_{Note: Security Review did not run due to the size of the PR.}

Code Review

This pull request enhances security by introducing a safe Git environment (getSafeGitEnv) that neutralizes global/system Git configurations and overrides dangerous Git settings (such as hooks, fsmonitor, and sshCommand) to prevent arbitrary code execution in untrusted workspaces. It also updates the PolicyEngine to force user confirmation (ASK_USER) for Git commands executed in untrusted folders, and updates workspace trust configuration to use GEMINI_CLI_TRUST_WORKSPACE. A critical security review comment points out that the containsGitCommand helper in PolicyEngine can be bypassed using shell operators (e.g., &&, ||, ;) because it only checks a limited set of hardcoded predecessors, and suggests expanding the allowed predecessors to include common shell operators and separators.

_{Note: Security Review did not run due to the size of the PR.}

Code Review

This pull request introduces a safe Git environment configuration (getSafeGitEnv) to neutralize potentially dangerous Git settings across several services and tools, and updates the policy engine to prompt the user (ASK_USER) when Git commands are evaluated in untrusted workspaces. The code review highlights two critical security issues in the policy engine: first, the containsGitCommand check can be bypassed by prefixing commands with environment variable assignments; second, the heuristic check unconditionally returns ASK_USER for Git commands in untrusted workspaces, which could inappropriately upgrade an existing DENY decision.

_{Note: Security Review did not run due to the size of the PR.}

Code Review

This pull request introduces comprehensive security enhancements to mitigate Remote Code Execution (RCE) vulnerabilities associated with Git execution. It implements a getSafeGitEnv utility that sanitizes the environment by stripping untrusted GIT_CONFIG_* variables, neutralizing global and system Git configurations, and overriding potentially dangerous settings like core.hooksPath and core.sshCommand. Furthermore, the PolicyEngine is updated to detect Git commands and enforce user confirmation (ASK_USER) in untrusted workspaces, while workspace trust detection is standardized across packages using the GEMINI_CLI_TRUST_WORKSPACE environment variable. I have no additional feedback to provide as there are no review comments.