[senamakel]

main has been red since #51 merged (CI runs on 3da6fc3 and 171b244). That merge brought in three separate defects:

• Ubuntu Jail: resolve_local_jail_grants read the process's XDG_CONFIG_HOME, and GitHub's Ubuntu image sets it. So discovered_git_config_links_cannot_be_replaced_through_writable_parents, duplicate_git_config_targets_keep_each_discovered_alias_read_only and git_ignore_patterns_cannot_add_config_include_grants looked for git config outside the temp home. The resolver body now lives in a crate-private resolve_local_jail_grants_in(home, xdg_config_home, cfg, protected). The public resolve_local_jail_grants reads the environment once and delegates to it. The grant tests call it through a resolve_hermetic helper with XDG unset.
• macOS / Windows Jail: absolute_xdg_config_home_replaces_home_config_root compared granted (canonicalized) paths against the raw temp path (/var vs /private/var, \\?\ on Windows). It now canonicalizes the expected path.
• Rust (clippy): map(..).unwrap_or_else(..) on an Option at git_config.rs:25 is now map_or_else.

No behaviour change: the public resolver still honours XDG_CONFIG_HOME exactly as #51 intended.

Verification

• Reproduced the Ubuntu failures locally with XDG_CONFIG_HOME=/tmp/nonexistent-xdg cargo test -p tinybox-jail --all-features --lib: 3 failed before the fix, 171 pass after, and they also pass with XDG unset.
• cargo clippy --all-targets --all-features -- -D warnings and cargo fmt --all --check are clean.
• The macOS/Windows canonicalization fix is verified by CI on this PR, since those platforms can't run on this host.

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 4 billable files and costs up to $1.00.}

Or wait 55 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 89956720-d858-481c-b85d-9197992ea27e

---

📥 Commits

Reviewing files that changed from the base of the PR and between 171b244 and 55a4efb.

---

📒 Files selected for processing (4)

• crates/tinybox-jail/src/grants/git_config.rs
• crates/tinybox-jail/src/grants/git_config_tests.rs
• crates/tinybox-jail/src/grants/mod.rs
• crates/tinybox-jail/src/grants/mod_tests.rs

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T19:57:42.544499Z	55a4efb	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 5 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Ready for maintainer review
Priority: none
Reviewed head: 55a4efbd71ea
Updated: 2026-10-12T08:28:29Z

Review snapshot

Change surface	Files	Review signal	Count
Production	2	Active findings	0
Tests	2	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

How this fits together

flowchart LR
  n0["...xdg_config_home_replaces_home_config_root<br/>changed"]:::changed
  n1["resolve_local_jail_grants<br/>changed"]:::changed
  n2["...s_preserve_logical_parent_component_pairs<br/>changed"]:::changed
  n3["..._be_promoted_through_writable_descendants<br/>changed"]:::changed
  n4["...ocations_under_aliased_parent_directories<br/>changed"]:::changed
  n5["tempdir"]:::impacted
  n6["resolve_hermetic"]:::impacted
  n7["Result"]:::impacted
  n8["Error"]:::impacted
  n9["error"]:::impacted
  n10["LocalGrantConfig"]:::impacted
  n0 -->|calls| n5
  n0 -->|tests| n5
  n0 -->|uses| n7
  n0 -->|uses| n8
  n0 -->|uses| n9
  n1 -->|uses| n7
  n2 -->|calls| n5
  n2 -->|tests| n5
  n2 -->|uses| n7
  n2 -->|uses| n8
  n2 -->|uses| n9
  n2 -->|uses| n10
  n3 -->|calls| n5
  n3 -->|tests| n5
  n3 -->|calls| n6
  n3 -->|tests| n6
  n3 -->|uses| n7
  n3 -->|uses| n8
  n3 -->|uses| n9
  n3 -->|uses| n10
  n4 -->|calls| n5
  n4 -->|tests| n5
  n4 -->|calls| n6
  n4 -->|tests| n6
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff

Loading

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change routes `XDG_CONFIG_HOME` through a new hermetic `resolve_local_jail_grants_in` entry point (same behavior as before for production callers), tidies `add_gitconfig_at`, and switches the tests to the hermetic variant. The test-side canonicalization additions in git_config_tests.rs only make assertions stricter, and all touched fixtures exist on disk before those assertions, so the change looks sound. _The code index is behind this pull request (indexed at `7649277cfad8`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change refactors `XDG_CONFIG_HOME` handling so git-config discovery takes the value as a parameter (`resolve_local_jail_grants_in` / `add_gitconfig_at`), and the unit tests now inject `None` so a runner's own environment cannot move the config root under test. The production path still reads the real environment in `resolve_local_jail_grants`, relative/empty XDG values still fall back to `$HOME/.config` via `xdg_root`, and no new input, network, or privileged path is introduced. The test-only canonicalization changes are correct, since the builder stores canonicalized read-only grants. I found no defect introduced by this pull request. _The code index is behind this pull request (indexed at `7649277cfad8`), so retrieved context may be out of date._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The diff replaces the environment-reading `add_gitconfig` with `add_gitconfig_at(home, xdg)` plumbed through a new hermetic `resolve_local_jail_grants_in`, and rewrites the git_config tests to canonicalize before comparing. The behavioural surface of the public `resolve_local_jail_grants` is unchanged (it still reads `XDG_CONFIG_HOME` and delegates), and the test-side change fixes an assertion that compared a canonicalized grant against an unc%anonicalized path. The only untested branch is the equivalence of the new wrapper with its predecessor, which is a trivial two-line delegation, so no test finding is warranted. _The code index is behind this pull request (indexed at `7649277cfad8`), so retrieved context may be out of date._

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change extracts the XDG environment read out of the grant resolver into a crate-private `resolve_local_jail_grants_in` and routes the public API through it, converts the grant tests to that hermetic entry point (plus canonicalizing the expected paths in the XDG test), and swaps `map(..).unwrap_or_else(..)` for `map_or_else`. The description matches the diff, which contains no behaviour change to the public resolver and no unrelated work. _The code index is behind this pull request (indexed at `7649277cfad8`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.002697
• Tokens: 306210 input · 19746 output · 37888 cached · 328 embedding

Head	State	Pass summary
55a4efbd71ea	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-12T08:28:29Z)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0027 · 306,210 in / 19,746 out · 37,888 cached (12%) · ladder/vectors-oai3, deepseek-v4.1-flash · 328 embedded
critique:    $0.0007 · 98,850 in  / 9,515 out  · 22,784 cached (23%) · deepseek-v4.1-flash
security:    $0.0009 · 122,459 in / 3,285 out  · 7,552 cached (6%)   · deepseek-v4.1-flash
tests:       $0.0004 · 40,815 in  / 2,782 out  · 2,944 cached (7%)   · deepseek-v4.1-flash
description: $0.0006 · 36,735 in  / 3,244 out  · 4,608 cached (13%)  · deepseek-v4.1-flash