# How safe.bareRepository Affects Bare Repository Git Operations in no-mistakes

> Learn how safe.bareRepository=explicit enhances Git safety in no-mistakes by forcing explicit --git-dir flags and preventing accidental bare repository operations.

- Repository: [Kun Chen/no-mistakes](https://github.com/kunchenguid/no-mistakes)
- Tags: deep-dive
- Published: 2026-07-12

---

**When `safe.bareRepository=explicit` is set, no-mistakes forces all Git subprocess calls to use explicit `--git-dir` flags, disabling current-working-directory discovery and preventing accidental operations on the wrong bare repository.**

The `no-mistakes` repository orchestrates complex CI workflows through agent-driven pipelines that execute Git commands in isolated "gate" directories. To prevent the daemon from inadvertently discovering and acting on an incorrect repository via the current working directory, the codebase implements a strict safety mechanism using the `safe.bareRepository` configuration for bare repository Git operations. This guard ensures that when agents set `safe.bareRepository=explicit`, every Git operation targets the correct repository through explicit path resolution rather than implicit cwd traversal.

## How safe.bareRepository Disables cwd Discovery

When agent harnesses initialize the CLI environment with `safe.bareRepository=explicit`, the system fundamentally alters Git’s default behavior. Normally, Git attempts to discover repositories by traversing parent directories from the current working directory. In bare repositories, this is particularly hazardous because the daemon process may start from a directory that resolves to ".", which Git could interpret as a normal worktree rather than a bare repository root.

By setting this flag, `no-mistakes` **prevents any implicit discovery** of repositories through the filesystem. Instead, the internal Git helper must explicitly specify the repository path using the `--git-dir` argument for every operation. This eliminates ambiguity about which repository is being modified, ensuring that fetching, pushing, and ref updates occur only on the intended bare repository.

## Implementation in internal/git/git.go

The core enforcement logic resides in [`internal/git/git.go`](https://github.com/kunchenguid/no-mistakes/blob/main/internal/git/git.go). The `Run` function acts as the centralized gateway for all Git subprocesses, automatically injecting the `--git-dir` flag when the safety configuration is active.

```go
// internal/git/git.go
// When safe.bareRepository=explicit forbids cwd discovery,
// every call goes through git.Run which adds --git-dir automatically.
func Run(ctx context.Context, args ...string) error {
    // The helper constructs the command with explicit git-dir
    // based on the repository configuration, bypassing cwd inference.
    // ...
}

```

This implementation ensures that even if a subprocess changes its working directory, the Git operation remains anchored to the correct repository path. The guard is applied uniformly across all platforms through `internal/shellenv.ConfigureShellCommand`, which configures the shell environment for Windows, macOS, and Linux agents to respect the same safety contract.

## Security and Correctness in Agent Pipelines

Agent-driven pipelines in `no-mistakes` frequently operate in isolated directories where multiple repositories may exist in proximity. Without the `safe.bareRepository` guard, a daemon could silently misbehave by:

- Reading refs from an incorrect repository
- Corrupting unrelated worktrees
- Leaking data across project boundaries

By forcing **explicit `--git-dir` usage**, the configuration eliminates these risks. The daemon cannot accidentally act on a different repository because it never relies on the current directory to resolve the Git directory. This is critical for bare repositories, which lack a visible `.git` subdirectory and can be easily mistaken for standard directories during path resolution.

## Testing the Safety Guard

The test suite validates this behavior through explicit environment configuration using `GIT_CONFIG_KEY_0`.

### Unit Tests in git_test.go

The [`internal/git/git_test.go`](https://github.com/kunchenguid/no-mistakes/blob/main/internal/git/git_test.go) file contains `TestInitUnderSafeBareRepositoryExplicit`, which verifies that initialization succeeds only when the helper correctly handles the safety flag:

```go
// internal/git/git_test.go
func TestInitUnderSafeBareRepositoryExplicit(t *testing.T) {
    t.Setenv("GIT_CONFIG_KEY_0", "safe.bareRepository")
    // Verifies that git init behaves correctly when cwd discovery is disabled
    // and explicit git-dir paths are required.
}

```

### Integration in gate_test.go

The [`internal/gate/gate_test.go`](https://github.com/kunchenguid/no-mistakes/blob/main/internal/gate/gate_test.go) file validates the integration with gate initialization through `TestGateInitWithSafeBareRepository`:

```go
// internal/gate/gate_test.go
func TestGateInitWithSafeBareRepository(t *testing.T) {
    t.Setenv("GIT_CONFIG_KEY_0", "safe.bareRepository")
    // Ensures gate initialization respects the safe bare repository setting
    // and fails safely on misconfiguration.
}

```

These tests guarantee that the `safe.bareRepository=explicit` setting is respected throughout the initialization and operation lifecycle.

## Design Documentation

The architectural rationale for this safety mechanism is documented in [`AGENTS.md`](https://github.com/kunchenguid/no-mistakes/blob/main/AGENTS.md) under the section *Git on Bare Gate Repos (`safe.bareRepository`)*. This documentation outlines the security implications of cwd-based discovery and specifies the contract that agent harnesses must follow when configuring the environment for bare repository operations.

## Summary

- **Explicit resolution**: `safe.bareRepository=explicit` forces all Git operations to use `--git-dir` flags, preventing cwd-based repository discovery.
- **Centralized enforcement**: The `Run` function in [`internal/git/git.go`](https://github.com/kunchenguid/no-mistakes/blob/main/internal/git/git.go) implements the guard, ensuring consistent behavior across all Git subprocesses.
- **Cross-platform safety**: `internal/shellenv.ConfigureShellCommand` applies the configuration uniformly across Windows, macOS, and Linux.
- **Test coverage**: `TestInitUnderSafeBareRepositoryExplicit` and `TestGateInitWithSafeBareRepository` verify correct behavior under the safety flag.
- **Security**: The guard prevents silent misbehavior, data leakage, and repository corruption in agent-driven pipelines.

## Frequently Asked Questions

### What happens if safe.bareRepository is not set to explicit?

If the variable is not set to `explicit`, Git will attempt to discover repositories by traversing the current working directory and its parents. In `no-mistakes`, this could cause the daemon to accidentally target the wrong bare repository, leading to potential data corruption or unauthorized access to refs in multi-repository environments.

### How does no-mistakes automatically inject the --git-dir flag?

The `Run` function in [`internal/git/git.go`](https://github.com/kunchenguid/no-mistakes/blob/main/internal/git/git.go) detects the active safety configuration and prepends the `--git-dir=<path>` argument to all Git commands. This ensures that regardless of the subprocess's current working directory, the Git operation targets the explicitly configured repository path.

### Why is cwd-based discovery particularly risky for bare repositories?

Bare repositories do not contain a `.git` subdirectory to distinguish them from regular folders. When a process starts from a directory resolving to ".", Git might confuse the bare repository root with a worktree, causing operations to read or write to the wrong location. The `safe.bareRepository` guard eliminates this ambiguity by requiring explicit paths.

### Where is the safe.bareRepository configuration documented?

The configuration is documented in the [`AGENTS.md`](https://github.com/kunchenguid/no-mistakes/blob/main/AGENTS.md) file within the `no-mistakes` repository, specifically in the section titled *Git on Bare Gate Repos (`safe.bareRepository`)*. This documentation details the security implications and the required setup for agent harnesses driving the CLI.