fix(sdk): bind workbench Git to a trusted executable

sdk/typescript/README.md

@@ -506,9 +506,10 @@ These container settings are distinct from standalone CLI flags and
 interactive discovery's `GH_HOST`.
 
 Variables such as `CODEX_SECURITY_SCAN_ID`, `CODEX_SECURITY_SCAN_DIR`,
-`CODEX_SECURITY_PLUGIN_ROOT`, `CODEX_SECURITY_CONFIG_PATH`, and
-`CODEX_SECURITY_TARGET_PATHS_FILE` are generated by an active scan. They are
-internal runtime data, not supported user configuration.
+`CODEX_SECURITY_PLUGIN_ROOT`, `CODEX_SECURITY_CONFIG_PATH`,
+`CODEX_SECURITY_GIT`, and `CODEX_SECURITY_TARGET_PATHS_FILE` are generated by
+an active scan. They are internal runtime data, not supported user
+configuration.
 
 Use `--provider openrouter` to send inference through OpenRouter. Set
 `OPENROUTER_API_KEY` and specify a supported model with `--model`.

sdk/typescript/_bundled_plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-security",
-  "version": "0.1.22",
+  "version": "0.1.29",
   "description": "Codex Security workflows for security scans, analysis, and investigation.",
   "author": {
     "name": "OpenAI"

sdk/typescript/_bundled_plugin/.mcp.json

@@ -33,6 +33,7 @@
         "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",
         "PYTHON",
         "PYTHONUTF8",
+        "CODEX_SECURITY_GIT",
         "CODEX_SECURITY_KNOWLEDGE_BASE",
         "CODEX_SECURITY_DEEP_SCAN_CONFIG_PATH",
         "CODEX_SECURITY_SCAN_ROOT",

sdk/typescript/_bundled_plugin/scripts/generate_in_scope_files.py

@@ -10,6 +10,10 @@
 import tempfile
 from pathlib import Path
 
+# Some plugin hosts launch Python with safe-path isolation enabled.
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from workbench_target import git_blob_bytes, git_command
+
 
 class InventoryError(ValueError):
     """Raised when the repository, scope, or inventory cannot be used safely."""
@@ -127,20 +131,18 @@ def generate_in_scope_files(repository: Path, scope: str, output: Path) -> int:
 
 
 def committed_changed_paths(repository: Path, base: str, head: str) -> list[tuple[Path, str]]:
-    result = subprocess.run(
-        [
-            "git",
-            "-C",
-            str(repository),
-            "diff",
-            "--raw",
-            "-z",
-            "--diff-filter=ACMRD",
-            f"{base}..{head}",
-        ],
-        capture_output=True,
-        check=True,
+    result = git_command(
+        repository,
+        "diff",
+        "--no-ext-diff",
+        "--no-textconv",
+        "--raw",
+        "-z",
+        "--diff-filter=ACMRD",
+        f"{base}..{head}",
+        text=False,
     )
+    result.check_returncode()
     fields = result.stdout.split(b"\0")
     changed: list[tuple[Path, str]] = []
     index = 0
@@ -166,16 +168,13 @@ def generate_diff_in_scope_files(
     output: Path,
 ) -> int:
     """Reuse the existing diff selection without generating previews or duplicate worklists."""
-    sys.path.insert(0, str(Path(__file__).resolve().parent))
     from generate_rank_input import git_changed_paths, path_is_excluded
     from rank_preview import (
         DEFAULT_PREVIEW_BYTES,
         TEXT_CODE_EXTENSIONS,
         is_binary_sample,
         preview_for,
     )
-    from workbench_target import git_blob_bytes
-
     rows: list[bytes] = []
     try:
         changed = (

sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py

@@ -43,7 +43,7 @@
     preview_for,
     preview_for_bytes,
 )
-from workbench_target import git_blob_bytes, git_directory_snapshot_paths
+from workbench_target import git_blob_bytes, git_command, git_directory_snapshot_paths
 
 EXCLUDED_DIRS = {
     ".cache",
@@ -626,20 +626,18 @@ def bind_repo_scopes(args: argparse.Namespace) -> None:
 
 
 def run_git_changed_paths(repo: Path, diff_args: list[str]) -> list[tuple[Path, str]]:
-    result = subprocess.run(
-        [
-            "git",
-            "-C",
-            str(repo),
-            "diff",
-            "--name-status",
-            "-z",
-            "--diff-filter=ACMRD",
-            *diff_args,
-        ],
-        check=True,
-        capture_output=True,
+    result = git_command(
+        repo,
+        "diff",
+        "--no-ext-diff",
+        "--no-textconv",
+        "--name-status",
+        "-z",
+        "--diff-filter=ACMRD",
+        *diff_args,
+        text=False,
     )
+    result.check_returncode()
     fields = result.stdout.split(b"\0")
     if fields and not fields[-1]:
         fields.pop()
@@ -663,11 +661,15 @@ def git_changed_paths(repo: Path, base: str, head: str, mode: str) -> list[tuple
     if mode == "local-patch":
         unstaged = run_git_changed_paths(repo, [base])
         staged = run_git_changed_paths(repo, ["--cached", base])
-        untracked = subprocess.run(
-            ["git", "-C", str(repo), "ls-files", "--others", "--exclude-standard", "-z"],
-            capture_output=True,
-            check=True,
+        untracked = git_command(
+            repo,
+            "ls-files",
+            "--others",
+            "--exclude-standard",
+            "-z",
+            text=False,
         )
+        untracked.check_returncode()
         combined = dict(staged)
         combined.update(unstaged)
         combined.update(

sdk/typescript/_bundled_plugin/scripts/workbench_constants.py

@@ -1,6 +1,9 @@
 """Shared constants for the Codex Security workbench."""
 
 import argparse
+import os
+import sys
+from pathlib import Path
 
 MODES = ("diff", "standard", "deep")
 DIFF_TARGET_KINDS = ("working_tree", "commit", "range")
@@ -70,6 +73,59 @@
 EMPTY_GIT_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904"
 
 
+def _protected_repository_root(target: Path) -> Path:
+    root = target.resolve()
+    if root.is_file():
+        root = root.parent
+    protected = root
+    for ancestor in (root, *root.parents):
+        try:
+            (ancestor / ".git").lstat()
+        except FileNotFoundError:
+            continue
+        protected = ancestor
+    return protected
+
+
+def trusted_git_executable(protected_root: Path) -> str | None:
+    """Return the host-selected Git executable without searching ``PATH``."""
+    configured = os.environ.get("CODEX_SECURITY_GIT")
+    if not configured:
+        return None
+
+    candidate = Path(configured)
+    if not candidate.is_absolute():
+        raise SystemExit("CODEX_SECURITY_GIT must name an absolute trusted executable.")
+
+    try:
+        invocation = Path(os.path.abspath(candidate))
+        canonical = candidate.resolve(strict=True)
+        repository = _protected_repository_root(protected_root)
+    except (OSError, RuntimeError):
+        return None
+
+    windows = sys.platform == "win32"
+    native_windows_suffixes = {".exe", ".com"}
+    if (
+        not canonical.is_file()
+        or not os.access(canonical, os.F_OK if windows else os.X_OK)
+        or (
+            windows
+            and (
+                candidate.suffix.lower() not in native_windows_suffixes
+                or canonical.suffix.lower() in {".bat", ".cmd"}
+            )
+        )
+    ):
+        return None
+    if any(
+        path == repository or repository in path.parents
+        for path in (invocation, canonical)
+    ):
+        raise SystemExit("CODEX_SECURITY_GIT must stay outside the protected repository.")
+    return str(invocation)
+
+
 def main() -> None:
     argparse.ArgumentParser(description=__doc__).parse_args()
 

sdk/typescript/_bundled_plugin/scripts/workbench_target.py

@@ -16,7 +16,7 @@
 # Some plugin hosts launch Python with safe-path isolation enabled.
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 from filesystem_identity import stored_filesystem_identity_matches
-from workbench_constants import GIT_REPOSITORY_ENVIRONMENT
+from workbench_constants import GIT_REPOSITORY_ENVIRONMENT, trusted_git_executable
 
 
 def git_output(
@@ -134,19 +134,25 @@ def git_command(
     for name in GIT_REPOSITORY_ENVIRONMENT:
         environment.pop(name, None)
     environment["GIT_LITERAL_PATHSPECS"] = "1"
+    executable = trusted_git_executable(target)
     # Repository-local config is untrusted; fsmonitor may name an executable hook.
     command = [
-        "git",
+        executable or "git",
         "-c",
         "core.fsmonitor=false",
         "-c",
+        f"core.hooksPath={os.devnull}",
+        "-c",
         "i18n.logOutputEncoding=UTF-8",
         "-C",
         str(target),
     ]
     if git_dir is not None and work_tree is not None:
         command.extend(["--git-dir", str(git_dir), "--work-tree", str(work_tree)])
     full_command = [*command, *args]
+    if executable is None:
+        empty_output = "" if text else b""
+        return subprocess.CompletedProcess(full_command, 127, empty_output, empty_output)
     try:
         return subprocess.run(
             full_command,

sdk/typescript/src/api.ts

@@ -113,7 +113,7 @@ import {
   importAmbientAuth,
   prepareCodexSecurityCredentialHome,
   preserveCodexSecurityPluginRegistration,
-  pluginExecutionEnvironment,
+  pluginExecutionEnvironmentWithGit,
   planOutputArchive,
   prepareOutputDir,
   preparePersistentOutputRoot,
@@ -134,6 +134,7 @@ import {
   enclosingGitWorktreeRoot,
   normalizeRepository,
   normalizeTarget,
+  outermostGitMarkerRoot,
   repositoryRevision,
   resolveRepositoryPath,
   type NormalizedTarget,
@@ -143,6 +144,10 @@ import {
   validateCommittedDiffCheckout,
   validateMode,
 } from "./targets.js";
+import {
+  inspectTrustedExecutable,
+  type InspectedExecutable,
+} from "./trusted-executable.js";
 
 interface CodexThreadLike {
   readonly id: string | null;
@@ -547,6 +552,28 @@ export class CodexSecurity {
         python,
       } = session;
       releaseCredentialHome = session.releaseCredentialHome;
+      const pluginEnvironment = selectedScanEnvironment(
+        runtime.environment,
+        options.auth,
+        modelProvider,
+      );
+      const gitProtectedRoot = await outermostGitMarkerRoot(repo, signal);
+      let git = await inspectTrustedExecutable(
+        "git",
+        pluginEnvironment,
+        gitProtectedRoot,
+      );
+      for (const source of knowledgeBase?.sources ?? []) {
+        const sourceDirectory = (await lstat(source)).isDirectory()
+          ? source
+          : dirname(source);
+        git = await inspectTrustedExecutable(
+          "git",
+          git.environment,
+          await outermostGitMarkerRoot(sourceDirectory, signal),
+        );
+      }
+      checkOpen();
       const deepScanConfigPath =
         mode === "deep"
           ? runtime.deepScanConfigPath ??
@@ -765,13 +792,10 @@ export class CodexSecurity {
         python,
         pluginRoot: runtime.plugin.pluginRoot,
         environment: {
-          ...selectedScanEnvironment(
-            runtime.environment,
-            options.auth,
-            modelProvider,
-          ),
+          ...pluginEnvironment,
           CODEX_SECURITY_STATE_DIR: stateDirectory,
         },
+        git,
         signal,
         failureMessage: "Could not save the Codex Security scan",
       };
@@ -975,6 +999,7 @@ export class CodexSecurity {
         session,
         runtimePaths,
         options.auth,
+        git,
       );
       const thread = codex.startThread({
         workingDirectory: scanDir,
@@ -1646,6 +1671,7 @@ export class CodexSecurity {
     session: PreparedSession,
     runtimePaths: Record<string, string>,
     auth: ScanAuthMode = "auto",
+    git: InspectedExecutable,
   ): { codex: CodexClientLike; environment: ProcessEnvironment } {
     const {
       runtime,
@@ -1656,11 +1682,12 @@ export class CodexSecurity {
       sessionConfig,
     } = session;
     const environment = {
-      ...pluginExecutionEnvironment(
+      ...pluginExecutionEnvironmentWithGit(
         python,
         withoutCodexHome(
           selectedScanEnvironment(runtime.environment, auth, modelProvider),
         ),
+        git,
       ),
       ...(externalProvider === null
         ? {}