Hawthorn 1e679bcb47 fix(agents): harden git commands against pager-based code execution
Git commands (log, diff, show) can execute arbitrary code via:
- core.pager set in repo-local .git/config
- diff.external pointing to an attacker-controlled binary
- filter drivers in .gitattributes

Mitigation: require --no-pager flag, recommend -c core.pager=cat
to disable pager-driven execution. Moved git commands from the
unqualified allowlist to a hardened allowlist with explicit flags.
2026-06-10 18:30:22 +05:30
..
2026-05-12 22:22:57 -04:00