How safe.bareRepository Affects Bare Repository Git Operations in no-mistakes

When safe.bareRepository=explicit is set, no-mistakes forces all Git subprocess calls to use explicit --git-dir flags, disabling current-working-directory discovery and preventing accidental operations on the wrong bare repository.

The no-mistakes repository orchestrates complex CI workflows through agent-driven pipelines that execute Git commands in isolated "gate" directories. To prevent the daemon from inadvertently discovering and acting on an incorrect repository via the current working directory, the codebase implements a strict safety mechanism using the safe.bareRepository configuration for bare repository Git operations. This guard ensures that when agents set safe.bareRepository=explicit, every Git operation targets the correct repository through explicit path resolution rather than implicit cwd traversal.

How safe.bareRepository Disables cwd Discovery

When agent harnesses initialize the CLI environment with safe.bareRepository=explicit, the system fundamentally alters Git’s default behavior. Normally, Git attempts to discover repositories by traversing parent directories from the current working directory. In bare repositories, this is particularly hazardous because the daemon process may start from a directory that resolves to ".", which Git could interpret as a normal worktree rather than a bare repository root.

By setting this flag, no-mistakes prevents any implicit discovery of repositories through the filesystem. Instead, the internal Git helper must explicitly specify the repository path using the --git-dir argument for every operation. This eliminates ambiguity about which repository is being modified, ensuring that fetching, pushing, and ref updates occur only on the intended bare repository.

Implementation in internal/git/git.go

The core enforcement logic resides in internal/git/git.go. The Run function acts as the centralized gateway for all Git subprocesses, automatically injecting the --git-dir flag when the safety configuration is active.

// internal/git/git.go
// When safe.bareRepository=explicit forbids cwd discovery,
// every call goes through git.Run which adds --git-dir automatically.
func Run(ctx context.Context, args ...string) error {
    // The helper constructs the command with explicit git-dir
    // based on the repository configuration, bypassing cwd inference.
    // ...
}

This implementation ensures that even if a subprocess changes its working directory, the Git operation remains anchored to the correct repository path. The guard is applied uniformly across all platforms through internal/shellenv.ConfigureShellCommand, which configures the shell environment for Windows, macOS, and Linux agents to respect the same safety contract.

Security and Correctness in Agent Pipelines

Agent-driven pipelines in no-mistakes frequently operate in isolated directories where multiple repositories may exist in proximity. Without the safe.bareRepository guard, a daemon could silently misbehave by:

• Reading refs from an incorrect repository
• Corrupting unrelated worktrees
• Leaking data across project boundaries

By forcing explicit --git-dir usage, the configuration eliminates these risks. The daemon cannot accidentally act on a different repository because it never relies on the current directory to resolve the Git directory. This is critical for bare repositories, which lack a visible .git subdirectory and can be easily mistaken for standard directories during path resolution.

Testing the Safety Guard

The test suite validates this behavior through explicit environment configuration using GIT_CONFIG_KEY_0.

Unit Tests in git_test.go

The internal/git/git_test.go file contains TestInitUnderSafeBareRepositoryExplicit, which verifies that initialization succeeds only when the helper correctly handles the safety flag:

// internal/git/git_test.go
func TestInitUnderSafeBareRepositoryExplicit(t *testing.T) {
    t.Setenv("GIT_CONFIG_KEY_0", "safe.bareRepository")
    // Verifies that git init behaves correctly when cwd discovery is disabled
    // and explicit git-dir paths are required.
}

Integration in gate_test.go

The internal/gate/gate_test.go file validates the integration with gate initialization through TestGateInitWithSafeBareRepository:

// internal/gate/gate_test.go
func TestGateInitWithSafeBareRepository(t *testing.T) {
    t.Setenv("GIT_CONFIG_KEY_0", "safe.bareRepository")
    // Ensures gate initialization respects the safe bare repository setting
    // and fails safely on misconfiguration.
}

These tests guarantee that the safe.bareRepository=explicit setting is respected throughout the initialization and operation lifecycle.

Design Documentation

The architectural rationale for this safety mechanism is documented in AGENTS.md under the section Git on Bare Gate Repos (safe.bareRepository). This documentation outlines the security implications of cwd-based discovery and specifies the contract that agent harnesses must follow when configuring the environment for bare repository operations.

Summary

• Explicit resolution: safe.bareRepository=explicit forces all Git operations to use --git-dir flags, preventing cwd-based repository discovery.
• Centralized enforcement: The Run function in internal/git/git.go implements the guard, ensuring consistent behavior across all Git subprocesses.
• Cross-platform safety: internal/shellenv.ConfigureShellCommand applies the configuration uniformly across Windows, macOS, and Linux.
• Test coverage: TestInitUnderSafeBareRepositoryExplicit and TestGateInitWithSafeBareRepository verify correct behavior under the safety flag.
• Security: The guard prevents silent misbehavior, data leakage, and repository corruption in agent-driven pipelines.

Frequently Asked Questions

What happens if safe.bareRepository is not set to explicit?

If the variable is not set to explicit, Git will attempt to discover repositories by traversing the current working directory and its parents. In no-mistakes, this could cause the daemon to accidentally target the wrong bare repository, leading to potential data corruption or unauthorized access to refs in multi-repository environments.

How does no-mistakes automatically inject the --git-dir flag?

The Run function in internal/git/git.go detects the active safety configuration and prepends the --git-dir=<path> argument to all Git commands. This ensures that regardless of the subprocess's current working directory, the Git operation targets the explicitly configured repository path.

Why is cwd-based discovery particularly risky for bare repositories?

Bare repositories do not contain a .git subdirectory to distinguish them from regular folders. When a process starts from a directory resolving to ".", Git might confuse the bare repository root with a worktree, causing operations to read or write to the wrong location. The safe.bareRepository guard eliminates this ambiguity by requiring explicit paths.

Where is the safe.bareRepository configuration documented?

The configuration is documented in the AGENTS.md file within the no-mistakes repository, specifically in the section titled Git on Bare Gate Repos (safe.bareRepository). This documentation details the security implications and the required setup for agent harnesses driving the CLI.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}