fix(query): avoid spawning git for memory provenance

[BunsDev]

Motivation

• Prevent unprompted execution of an OS-resolved git binary from the background session-memory task to eliminate PATH-based code-execution risk when processing attacker-controlled workspaces.

Description

• Remove Command::new("git") usage from session-memory provenance collection and stop spawning executables from the workspace context.
• Add filesystem-based helpers: find_git_dir, read_origin_remote_url, and read_head_commit to locate .git (including gitdir: files), read remote "origin" from config, and read/validate HEAD without invoking an external git process.
• Update build_session_memory_provenance to use these helpers and preserve population of source_repo, source_commit, and source_actor when available.
• Add targeted unit tests builds_session_memory_provenance_without_executing_git_from_path and reads_git_metadata_from_gitdir_file to cover regular .git layouts and gitdir: indirection.

Testing

• Ran git diff --check which passed on the modified file.
• Ran cargo fmt --all which completed successfully.
• Attempted targeted tests with cargo test --package claurst-query <test> and offline runs, but full cargo test / cargo check / cargo clippy could not be completed in this environment due to a dependency fetch failure for https://github.com/OpenCoven/coven-runtimes (proxy/404/revision lookup), so workspace-wide Rust verification is blocked; the added unit tests are present and intended to pass when dependencies are available.
• Committed the change with message fix(query): avoid spawning git for memory provenance.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Jul 27, 2026 12:30pm

[Copilot]

Pull request overview

This PR hardens session-memory provenance collection in claurst-query by removing PATH-resolved git process execution and replacing it with filesystem-based .git metadata reads, reducing code-execution risk in attacker-controlled workspaces.

Changes:

• Replaced Command::new("git") provenance collection with find_git_dir, read_origin_remote_url, and read_head_commit.
• Updated build_session_memory_provenance to populate source_repo / source_commit from .git files when available.
• Added unit tests for basic .git directory layouts and gitdir: indirection.

Comments suppressed due to low confidence (2)

src-rust/crates/query/src/lib.rs:165

• read_head_commit assumes the ref target exists as a loose ref under <git_dir>/refs/... and only accepts 40-hex SHA-1. In common setups refs are packed (packed-refs) and/or worktrees store refs in the commondir, so provenance will often miss source_commit even though it’s available.

fn read_head_commit(git_dir: &Path) -> Option<String> {
    let head = fs::read_to_string(git_dir.join("HEAD")).ok()?;
    let head = head.trim();
    let commit = if let Some(reference) = head.strip_prefix("ref:") {
        fs::read_to_string(git_dir.join(reference.trim())).ok()?
    } else {
        head.to_string()
    };
    let commit = commit.trim();
    if commit.len() == 40 && commit.chars().all(|ch| ch.is_ascii_hexdigit()) {
        Some(commit.to_string())
    } else {
        None
    }
}

src-rust/crates/query/src/lib.rs:2812

• Creating a workspace/git file doesn’t affect PATH resolution and doesn’t help validate the test’s intent; it’s currently dead/ misleading setup.

        std::fs::write(workspace.join("git"), "not executed").unwrap();

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.