Skip to content

Conversation

@0xMink
Copy link
Contributor

@0xMink 0xMink commented Feb 9, 2026

Closes #11340

Summary

Fixes three correctness issues in ShadowCheckpointService.getNestedGitRepository():

  • False negatives: Only searched for **/.git/HEAD, missing submodule/worktree .git pointer files (which contain gitdir:).
  • False positives: --follow allowed ripgrep to traverse symlinks outside the workspace boundary.
  • Brittle matching: Replaces includes() / startsWith() heuristics with path.basename() / path.dirname() and path.resolve().

Test plan

  • Existing test: nested .git/HEAD directory detection still works
  • Existing test: no nested repos allows init
  • New: submodule-style .git file triggers detection
  • New: stray .git file without gitdir: prefix is ignored
  • New: root .git/HEAD is excluded
  • New: root .git match is excluded
  • New: --follow flag is not present in ripgrep args
  • New: unreadable .git file is skipped gracefully
  • All 37 tests passing

…files

- Remove --follow flag to prevent symlink traversal outside workspace
- Add **/.git glob to detect submodule/worktree .git pointer files
- Validate .git files contain gitdir: prefix before treating as repo marker
- Use path.basename/path.dirname for classification instead of string matching
- Use path.resolve for root exclusion (handles absolute/relative paths)
- Add 6 new test cases covering submodule detection, stray .git files,
  root exclusion, --follow removal, and unreadable file handling

Closes RooCodeInc#11340
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working size:L This PR changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] Checkpoints nested-repo detection misses submodule/worktree .git files and can false-positive via symlink follow

1 participant