Repository navigation

fix(env): refuse machine-local writes git could collect; no-follow legacy dotenv reads (HACK-2165) - #762

Merged

roodboi merged 9 commits into

nextfrom

claude/hack-2165-env-local-write-guards

Nov 13, 2026

Merged

fix(env): refuse machine-local writes git could collect; no-follow legacy dotenv reads (HACK-2165)#762
roodboi merged 9 commits into
nextfrom
claude/hack-2165-env-local-write-guards

Commits on Nov 13, 2026
- fix(env): refuse machine-local writes that git could collect (HACK-2165)
  
  roodboi
  and
  claude
  committed
  e9c1246
- fix(env): read legacy dotenv files without following links (HACK-2165)
  
  roodboi
  and
  claude
  committed
  bee7837
- fix(env): catch case-variant tracked layers; no-follow reads in doctor and migration checks (HACK-2165)
  
  roodboi
  and
  claude
  committed
  a19c030
- test(env): make the case-variant refusal test portable to case-insensitive disks (HACK-2165)
  
  roodboi
  and
  claude
  committed
  860cef5
- fix(env): bind machine-local checks to the file replaced or read; legacy and alias gaps (HACK-2165)
  
  roodboi
  and
  claude
  committed
  f5d5029
- refactor(fs): pick the atomic write destination in a helper (HACK-2165)
  
  roodboi
  and
  claude
  committed
  73b242a
- test(env): route the legacy privacy test's git through the hermetic fixture env (HACK-2165)
  
  roodboi
  and
  claude
  committed
  c5c9c0e
- Merge origin/next into claude/hack-2165-env-local-write-guards
  
  roodboi
  and
  claude
  committed
  723ee60
- fix(env): give the case-insensitive tracking probe the filtered child environment (HACK-2165)
  
  roodboi
  and
  claude
  committed
  44a47a2