fix(core): keep GIT_CONFIG_* environment triplets internally consistent - #28938

Summary

Prevents sanitized GIT_CONFIG_* environments from becoming unparsable by Git when redaction removes one half of a numbered key/value pair. It also ensures ShellExecutionService does not restore sensitive Git configuration values after sanitization.

Git treats incomplete numbered configuration as fatal:

error: missing config value GIT_CONFIG_VALUE_0
fatal: unable to parse command-line config

Details

Root cause

sanitizeEnvironment() performs value-first secret detection. If a credential-bearing GIT_CONFIG_VALUE_n is removed while GIT_CONFIG_KEY_n and GIT_CONFIG_COUNT remain, Git sees an incomplete slot and refuses to run.

A second path in ShellExecutionService parsed inherited GIT_CONFIG_COUNT values without strict validation. A non-numeric value produced GIT_CONFIG_KEY_NaN, GIT_CONFIG_VALUE_NaN, and GIT_CONFIG_COUNT=NaN, which Git rejects as a bogus count.

Finally, ShellExecutionService restored raw GIT_CONFIG_* variables from sourceEnv after sanitization. Built-in sandbox managers sanitize again, but relying on that left the ShellExecutionService -> SandboxManager boundary unsafe for pass-through or custom managers.

Fix

• Rebuild numbered Git configuration slots from complete key/value pairs that survive redaction.
• Preserve original slot order so Git's last-value-wins behavior is unchanged.
• Renumber surviving slots contiguously and restate GIT_CONFIG_COUNT.
• Treat non-numeric inherited counts as unusable before appending security overrides.
• Do not restore raw Git configuration values after sanitization.
• Leave non-numbered controls such as GIT_CONFIG_GLOBAL, GIT_CONFIG_SYSTEM, and GIT_CONFIG_NOSYSTEM unchanged.

Security impact

This strengthens the sanitization boundary. Credential-bearing values remain removed before any sandbox manager receives the environment, while safe surviving pairs remain usable and contiguous.

Related Issues

• Related to bug: GIT_CONFIG_COUNT parsing produces NaN when env var contains invalid value #23351, which reported the non-numeric GIT_CONFIG_COUNT path.
• Related to Git command execution fails with cannot spawn : No such file or directory due to empty diff.external configuration #28928, which has the same total Git outage symptom but a separate diff.external root cause addressed by fix(core): drop unsafe diff.external override (#28928) #28930.

How to Validate

npx vitest run \
  packages/core/src/services/environmentSanitization.test.ts \
  packages/core/src/services/shellExecutionService.test.ts

Test Files  2 passed (2)
Tests       112 passed (112)

Additional checks:

npx prettier --check \
  packages/core/src/services/shellExecutionService.ts \
  packages/core/src/services/shellExecutionService.test.ts

npx eslint \
  packages/core/src/services/shellExecutionService.ts \
  packages/core/src/services/shellExecutionService.test.ts \
  --max-warnings 0

npx tsc --noEmit -p packages/core/tsconfig.json

Regression coverage includes:

• Redacted value or key removes the entire numbered pair.
• Surviving pairs are renumbered contiguously without changing precedence.
• Non-numeric and over-declared counts are repaired.
• Slots beyond the declared count are discarded.
• Strict GitHub sanitization preserves triplet consistency.
• Intact and redaction-disabled environments retain their existing behavior.
• A pass-through sandbox manager never receives a redacted credential.
• Every declared numbered slot has both a key and a value.

Pre-Merge Checklist

• Updated relevant documentation and README (not needed; internal environment-hardening fix)
• Added/updated tests
• Noted breaking changes (none)
• Validated on required platforms/methods:
  • MacOS
    • npm run
    • npx
    • Docker
    • Podman
    • Seatbelt
  • Windows
    • npm run
    • npx
    • Docker
  • Linux
    • npm run
    • npx
    • Docker

Validated locally on Windows with the exact Vitest, Prettier, ESLint, and TypeScript commands above.