From c69a496c866f9be8650226d013e9d3c1c2524649 Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Fri, 6 Nov 2026 09:58:57 +0000 Subject: [PATCH] fix(hub): never lazy-fetch a missing object in the worktree scan MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Agents write the repos the tree view scans. A repo with remote..promisor=true and a ref to a missing object made for-each-ref fetch it, and that fetch ran the repo's remote..uploadpack through sh inside the hub container. The scan's git env now sets GIT_NO_LAZY_FETCH=1 (the image ships git 2.47, which honours it); the new test proves no uploadpack runs. 🎯 Fix: 95 % 💥 Break: 1 % 💸 Cost: – ⏱️ Time: – 🛡️ Security: 100 % 🏆 Score: 94 🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 % ``` /home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub ``` Co-Authored-By: Claude Opus 5.5 --- hub/kvb_hub/tree.py | 2 +- tests/test_hub_tree.py | 19 +++++++++++++++++++ 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/hub/kvb_hub/tree.py b/hub/kvb_hub/tree.py index bcfa6b6..8bc3b84 100644 --- a/hub/kvb_hub/tree.py +++ b/hub/kvb_hub/tree.py @@ -18,7 +18,7 @@ GIT_TIMEOUT = 10 def git(cwd: Path, args: list[str], home: Path) -> str | None: - env = {"PATH": SAFE_PATH, "HOME": str(home), "GIT_CONFIG_NOSYSTEM": "1", "GIT_OPTIONAL_LOCKS": "0", "GIT_TERMINAL_PROMPT": "0", "LC_ALL": "C"} + env = {"PATH": SAFE_PATH, "HOME": str(home), "GIT_CONFIG_NOSYSTEM": "1", "GIT_NO_LAZY_FETCH": "1", "GIT_OPTIONAL_LOCKS": "0", "GIT_TERMINAL_PROMPT": "0", "LC_ALL": "C"} try: done = subprocess.run( ["git", "-c", "safe.directory=*", "-c", "core.fsmonitor=false", "-C", str(cwd), *args], diff --git a/tests/test_hub_tree.py b/tests/test_hub_tree.py index cacb22f..d9cafd9 100644 --- a/tests/test_hub_tree.py +++ b/tests/test_hub_tree.py @@ -67,6 +67,25 @@ class TestHubTree(HubCase): self.assertEqual(dirty, {"github.com/me/trap": False, "github.com/me/filtered": None}) self.assertFalse(marker.exists()) + def test_tree_never_fetches_a_missing_object(self): + marker = self.outside / "fetched" + origin = self.outside / "lazy.git" + self.git(self.outside, "init", "--quiet", "--bare", "--initial-branch=main", str(origin)) + repo = self.repos / "github.com" / "me" / "lazy" + repo.mkdir(parents=True) + self.git(repo, "init", "--quiet", "--initial-branch=main") + (repo / "a.txt").write_text("a", encoding="utf-8") + self.git(repo, "add", "a.txt") + self.git(repo, "commit", "--quiet", "-m", "a") + self.git(repo, "remote", "add", "origin", str(origin)) + self.git(repo, "push", "--quiet", "-u", "origin", "main") + self.git(repo, "config", "remote.origin.promisor", "true") + self.git(repo, "config", "remote.origin.uploadpack", f"touch {marker}; git-upload-pack") + (repo / ".git" / "refs" / "remotes" / "origin" / "main").write_text("1" * 40 + "\n", encoding="utf-8") + status, _, body = self.get("/api/tree") + self.assertEqual(status, 200, body) + self.assertFalse(marker.exists()) + if __name__ == "__main__": unittest.main()