test: a suite member creates /tmp/.git and breaks the find --no-require-git contract

[akougkas]

Problem

tests/contracts/tool-hardening.test.ts ("find passes --no-require-git only outside a git repo") fails intermittently under npm run test and passes in isolation. The cause is a stray empty /tmp/.git directory that appears during a full suite run. isInsideGitRepo in src/tools/ignore-policy.ts:45 walks up from the scratch directory and, once it reaches /tmp, finds that .git and drops --no-require-git.

Expected: no test creates a .git at the system temp root, and the suite is order-independent.

Reproduce

Observed on 2026-08-24 on WSL2 with fd 10.3.0:

1. rmdir /tmp/.git (it was an empty directory owned by the test user, mtime 11:49, then again 12:06, both during suite runs).
2. node --import tsx --import ./tests/harness/tmp-root.ts --test tests/contracts/tool-hardening.test.ts passes 51/51 and does not recreate it.
3. Running each describe block of that file separately never recreates it.
4. A concurrent full npm run test in a sibling worktree recreated it at 12:06.

So the creator is a test elsewhere in the suite, likely one that spawns a child with a scrubbed environment (no CLIO_CODER_TEST_TMP_ROOT / TMPDIR) and then creates join(tmpdir(), ".git"), or a product path exercised by a test that writes .git at os.tmpdir().

Evidence

• src/tools/ignore-policy.ts:45 (isInsideGitRepo walks to the filesystem root).
• tests/contracts/tool-hardening.test.ts:356.
• tests/harness/tmp-root.ts repoints TMPDIR for the runner and its children, but only when the child inherits the environment.

Acceptance criteria

• The creating test is identified and no longer writes outside its scratch root, or the harness refuses a .git at the system temp root and names the test that made it.
• npm run test passes with no /tmp/.git present before or after the run, twice in a row.
• tool-hardening "find passes --no-require-git only outside a git repo" is order-independent.

Links

Noticed while integrating v0.3.7 wave 1; unrelated to the /btw and dispatch-intent briefs.

[akougkas]

Root cause, corrected: no test creates /tmp/.git. The Codex CLI sandbox does. Its bwrap invocation on this machine includes

--bind /tmp /tmp --perms 555 --tmpfs /tmp/.git --remount-ro /tmp/.git

and bwrap creates the mountpoint on the host /tmp before mounting the tmpfs, so an empty /tmp/.git owned by the operator appears every time a Codex pane runs a sandboxed command, and it survives the sandbox exiting. Every timestamp I recorded lines up with a Codex command in a sibling worktree.

Consequences:

• isInsideGitRepo (src/tools/ignore-policy.ts:45) walks up to /tmp, sees the directory, and drops --no-require-git for any scratch path under /tmp. Inside a Codex sandbox that is the real state of the filesystem, so find/grep under /tmp honor ignore files differently there than elsewhere.
• The tool-hardening assertion at tests/contracts/tool-hardening.test.ts:356 fails whenever a Codex pane has run anything since the last rmdir /tmp/.git.

Reclassifying: environment interaction, not suite hygiene. Options if this is worth fixing in-repo: stop the ancestor walk at the system temp root, or treat an empty .git directory (no HEAD) as not a repository, which is what git rev-parse does. Leaving open at low priority.

[akougkas]

Investigated on 2026-08-28 across 28 full npm run test runs. The creator was not identified. Recording what was ruled out, since it narrows the search considerably for whoever picks this up next.

The git binary is off the hook, and this rules out the whole class the ticket points at. The stray marker is an empty directory. git init populates HEAD, config, objects/, and refs/ before it returns. An empty .git is a bare mkdir. So every git init, git clone, and git worktree call site is excluded regardless of its arguments or cwd, and the ticket's "likely one that spawns a child with a scrubbed environment and then creates join(tmpdir(), '.git')" is only half right: the mkdir half stands, the git-invocation half does not.

Live instrumentation never fired. The whole node:fs creator set, fs.promises, and every node:child_process entry point were wrapped and republished through syncBuiltinESMExports() so that import { mkdirSync } from "node:fs" resolves to the wrapper. The technique was verified to catch all three import forms before being trusted. Across 4932 tests and many runs it did not fire once, at either /tmp/.git or <runRoot>/.git.

The static surface is clean, confirmed independently twice: nothing in src/, tests/, or scripts/ joins a temp root with .git.

The diagnosis in the ticket is exactly right. With /tmp/.git planted by hand, tool-hardening goes 50/51 with precisely the reported failure: outside a repo fd must honor ignore files via --no-require-git. So src/tools/ignore-policy.ts:45 is confirmed as the mechanism.

One thing the ticket missed: the parent walk also passes through the run root, so <runRoot>/.git is an equally poisonous level. It vanishes with the root at process exit, which is likely why it was never seen. Both levels are now guarded.

Closed via the second half of acceptance criterion 1, the harness guard, since the creator could not be named. If it recurs, the guard now names the caller with a stack, so the next occurrence identifies itself.

[akougkas]

Merged on v0.3.8. Closed via the second half of acceptance criterion 1, the harness guard, since the creator could not be named. Verified with npm run ci on the integrated branch: 4968/4968.