@@ -6,3 +6,4 @@ dist/
 .codeboost-local/
 playwright-report/
 test-results/
+.vitest/
@@ -6,7 +6,7 @@ import { randomUUID } from 'node:crypto';
 import { Store } from '../runner/store.ts';
 import type { ReviewConfig } from '../runner/review.ts';
 import type { Plan } from '../core/plan.ts';
-import { isolatedGitEnvironment } from './git-environment.ts';
+import { HARDENED_GIT_OPTIONS, hardenedGitEnvironment } from './git-environment.ts';
 /** Disposable fixture only. Never runs against the user's working repository. */
 export function createDemo(directory: string): ReviewConfig {
   const requested = resolve(directory), temporary = resolve(tmpdir());
@@ -35,7 +35,7 @@ export function createDemo(directory: string): ReviewConfig {
   }
   if (existsSync(root)) throw new Error('Demo directory exists without a configuration. Choose a new empty path.');
   mkdirSync(root, { recursive: true }); const repository = join(root, 'retry-service'); mkdirSync(repository);
-  const git = (...args: string[]) => execFileSync('git', ['-c','core.hooksPath=/dev/null',...args], { cwd: repository, env: isolatedGitEnvironment(), encoding: 'utf8', stdio: ['ignore','pipe','pipe'] }).trim();
+  const git = (...args: string[]) => execFileSync('git', [...HARDENED_GIT_OPTIONS,...args], { cwd: repository, env: hardenedGitEnvironment(), encoding: 'utf8', stdio: ['ignore','pipe','pipe'] }).trim();
   git('init','-b','main'); git('config','user.name','Codeboost Demo'); git('config','user.email','demo@example.invalid'); git('config','commit.gpgsign','false');
   const write = (path: string, text: string | Buffer) => writeFileSync(join(repository,path),text);
   const commit = (message: string) => { git('add','-A');git('commit','-m',message);return git('rev-parse','HEAD'); };
 
@@ -1,9 +1,11 @@
-/** Git environment names are case-insensitive on Windows. */
-export function isolatedGitEnvironment(): NodeJS.ProcessEnv {
-  return {
-    ...Object.fromEntries(Object.entries(process.env).filter(([key]) => !/^GIT_/i.test(key))),
-    GIT_CONFIG_NOSYSTEM: '1',
-    GIT_CONFIG_GLOBAL: '/dev/null',
-    GIT_TERMINAL_PROMPT: '0',
-  };
+/** Options for the repository's hardened Git invocation: no pager, replace objects, hooks or network protocols. */
+export const HARDENED_GIT_OPTIONS = ['--no-pager', '--no-replace-objects', '-c', 'core.hooksPath=/dev/null', '-c', 'protocol.allow=never'];
+
+/**
+ * An allowlisted Git environment: PATH plus settings that disable user and system config, prompts and lazy fetch.
+ * Nothing else is inherited, because Git also reads variables outside the GIT_ namespace, such as HOME and
+ * XDG_CONFIG_HOME for the user's ignore and attributes files.
+ */
+export function hardenedGitEnvironment(): NodeJS.ProcessEnv {
+  return { PATH: process.env.PATH ?? '', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null', GIT_TERMINAL_PROMPT: '0', GIT_NO_LAZY_FETCH: '1' };
 }
@@ -1,4 +1,4 @@
-import { isolatedGitEnvironment } from './git-environment.ts';
+import { HARDENED_GIT_OPTIONS, hardenedGitEnvironment } from './git-environment.ts';
 import { execFileSync } from 'node:child_process';
 import { existsSync, mkdirSync, writeFileSync, appendFileSync, lstatSync, readFileSync, realpathSync } from 'node:fs';
 import { resolve, join, dirname, basename, relative, isAbsolute } from 'node:path';
@@ -42,8 +42,8 @@ export function plant(config: ReviewConfig, destination: string, input: PlantInp
   const declared=candidates[randomInt(candidates.length)]!;
   const owned=history.commits.map((commit,index)=>({index,owner:owners.get(commit.sha)})).filter(entry=>entry.owner&&plan!.items.some(item=>item.id===entry.owner));
   const outside=owned[randomInt(owned.length)]!;
-  const env=isolatedGitEnvironment();
-  const gitRaw=(cwd:string,...args:string[])=>execFileSync('git',['-c','core.hooksPath=/dev/null','-c','commit.gpgsign=false',...args],{cwd,env,encoding:'utf8',stdio:['ignore','pipe','pipe'],timeout:30000,maxBuffer:32*1024*1024});
+  const env=hardenedGitEnvironment();
+  const gitRaw=(cwd:string,...args:string[])=>execFileSync('git',[...HARDENED_GIT_OPTIONS,'-c','commit.gpgsign=false',...args],{cwd,env,encoding:'utf8',stdio:['ignore','pipe','pipe'],timeout:30000,maxBuffer:32*1024*1024});
   const git=(cwd:string,...args:string[])=>gitRaw(cwd,...args).trim();
   // Refuse existing paths, symlink targets, and unsupported declared-file transitions before creating output.
   for(const sha of [snapshot.base,...history.commits.map(commit=>commit.sha)]){
@@ -54,7 +54,7 @@ export function plant(config: ReviewConfig, destination: string, input: PlantInp
     if(!/^100(?:644|755) blob /.test(git(config.repository,'ls-tree',commit.sha,'--',declared.path)))throw new Error('Declared plant needs a regular file retained through the remaining history.');
   }
   mkdirSync(root,{recursive:true});const repository=join(root,'repository');
-  git(root,'clone','--no-local','--no-checkout',resolve(config.repository),repository);
+  git(root,'-c','protocol.file.allow=always','clone','--no-local','--no-checkout',resolve(config.repository),repository);
   git(repository,'config','user.name','Codeboost Experiment');git(repository,'config','user.email','experiment@example.invalid');
   git(repository,'checkout','-b','review-experiment',snapshot.base);
   const baseEntries:BaseEntry[]=git(repository,'ls-tree','-rz',snapshot.base).split('\0').filter(Boolean).map(record=>{
 
@@ -1,4 +1,5 @@
 import { execFileSync } from 'node:child_process';
+import { fixtureGit } from './fixtures/git.ts';
 import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
@@ -21,8 +22,7 @@ import type { ProcessGroup } from '../agents/process-group.ts';
 // The asynchronous clone (#51 item 5): every Git call runs in its own process group, and an abort settles only after
 // that group has exited and the partial clone is gone.
 const roots: string[] = [];
-const git = (cwd: string, ...args: string[]) => execFileSync('git', ['-c', 'core.hooksPath=/dev/null', ...args],
-  { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+const git = fixtureGit;
 function fixture() {
   const root = mkdtempSync(join(tmpdir(), 'clone-async-')); roots.push(root);
   const source = join(root, 'source'), parent = join(root, 'tasks');
 
@@ -1,4 +1,5 @@
 import { execFileSync } from 'node:child_process';
+import { fixtureGit } from './fixtures/git.ts';
 import { mkdtempSync, mkdirSync, readFileSync, readdirSync, rmSync, lstatSync, symlinkSync, writeFileSync, renameSync, opendirSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
@@ -15,8 +16,7 @@ vi.mock('node:child_process', async importOriginal => {
 });
 
 const roots: string[] = [];
-const git = (cwd: string, ...args: string[]) => execFileSync('git', ['-c', 'core.hooksPath=/dev/null', ...args],
-  { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+const git = fixtureGit;
 function fixture() {
   const root = mkdtempSync(join(tmpdir(), 'clone-test-')); roots.push(root);
   const source = join(root, 'source'), parent = join(root, 'tasks');
 
@@ -1,4 +1,5 @@
 import { execFileSync, spawnSync } from 'node:child_process';
+import { fixtureGit } from './fixtures/git.ts';
 import { createHash, randomBytes, randomUUID } from 'node:crypto';
 import { chmodSync, existsSync, mkdtempSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -30,8 +31,7 @@ const containers = new Set<string>();
 const profiles: Awaited<ReturnType<typeof createContainerProfile>>[] = [];
 let imageId = '';
 const vendorNetworks: VendorNetwork[] = [];
-const git = (cwd: string, ...args: string[]) => execFileSync('git', ['-c', 'core.hooksPath=/dev/null', ...args],
-  { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+const git = fixtureGit;
 const docker = (...args: string[]) => execFileSync('docker', args, {
   encoding: 'utf8', timeout: 60_000, stdio: ['ignore', 'pipe', 'pipe'],
 }).trim();
 
@@ -1,4 +1,4 @@
-import { execFileSync } from 'node:child_process';
+import { fixtureGit } from './fixtures/git.ts';
 import { randomBytes } from 'node:crypto';
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -10,8 +10,7 @@ import { QuestionWorker } from '../runner/question-agent.ts';
 // the vendor CLI in the "questions" phase. Runs with the other Docker suites, one file at a time.
 const roots: string[] = [];
 afterAll(() => { for (const root of roots) rmSync(root, { recursive: true, force: true }); });
-const git = (cwd: string, ...args: string[]) => execFileSync('git', ['-c', 'core.hooksPath=/dev/null', ...args],
-  { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+const git = fixtureGit;
 
 function repository(secret: string) {
   const root = mkdtempSync(join(tmpdir(), 'question-container-')); roots.push(root);
 
@@ -1,4 +1,4 @@
-import { execFileSync } from 'node:child_process';
+import { fixtureGit } from './fixtures/git.ts';
 import { randomUUID } from 'node:crypto';
 import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -128,8 +128,7 @@ if (a === 'rm' || (a === 'volume' && b === 'rm')) {
 console.error('fake docker: unsupported ' + args.join(' ')); process.exit(2);
 `;
 
-const git = (cwd: string, ...args: string[]) => execFileSync('git', ['-c', 'core.hooksPath=/dev/null', ...args],
-  { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+const git = fixtureGit;
 const clone = () => {
   const source = join(root, `source-${randomUUID()}`), parent = join(root, `staging-${randomUUID()}`);
   mkdirSync(source); mkdirSync(parent);
 
@@ -1,5 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { execFileSync, spawnSync } from 'node:child_process';
+import { fixtureGit } from './fixtures/git.ts';
 import { chmodSync, mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
@@ -23,8 +24,7 @@ const testOwner = (attemptId = 'fixture') => ({ runnerOwner: TEST_RUNNER_OWNER,
 const roots: string[] = [], profiles: ContainerProfile[] = [];
 const allocations: ReturnType<typeof prepareTaskFilesystems>[] = [];
 let imageId = '';
-const git = (cwd: string, ...args: string[]) => execFileSync('git', ['-c', 'core.hooksPath=/dev/null', ...args],
-  { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+const git = fixtureGit;
 
 function fixture() {
   const root = mkdtempSync(join(tmpdir(), 'agent-supervisor-')); roots.push(root);