fix(runtime): allow bounded Apple Git startup

docs/windows-test-inventory.md

@@ -17,9 +17,9 @@ Locations intentionally omit line numbers so unrelated edits do not invalidate t
 |---|---:|
 | windows-backend-gap | 27 |
 | portable-candidate | 56 |
-| platform-contract | 48 |
+| platform-contract | 49 |
 
-Total Windows-excluded declarations: **131**
+Total Windows-excluded declarations: **132**
 
 ## Inventory
 
@@ -86,6 +86,7 @@ Total Windows-excluded declarations: **131**
 | platform-contract | `packages/runtime/src/__tests__/filesystem-worker-process-runner.test.ts` filesystem worker rejects boundedly when a detached descendant retains stdout | `process.platform === 'win32' ? 'POSIX detached process-group semantics required' : false` |
 | platform-contract | `packages/runtime/src/__tests__/filesystem-worker-smoke.test.ts` macOS filesystem worker smoke | `process.platform !== 'darwin'` |
 | platform-contract | `packages/runtime/src/__tests__/glob-search.test.ts` both Glob paths report permission failures and recover after permissions are restored | `process.platform === 'win32' \|\| process.getuid?.() === 0` |
+| platform-contract | `packages/runtime/src/__tests__/macos-command-paths.test.ts` Apple signer validation | `process.platform !== 'darwin'` |
 | portable-candidate | `packages/runtime/src/__tests__/node-pty-write-lifecycle.test.ts` does not carry queued Unix PTY writes past native exit | `process.platform === 'win32' ? 'Unix PTY file-descriptor lifecycle only' : false` |
 | platform-contract | `packages/runtime/src/__tests__/owned-child-process.test.ts` POSIX cancellation delivers SIGTERM exactly once to the owned command | `process.platform === 'win32' ? 'POSIX detached process-group semantics required' : false` |
 | platform-contract | `packages/runtime/src/__tests__/owned-child-process.test.ts` supervisor mirrors a command that dies from ${signal} | `process.platform === 'win32' ? 'POSIX detached process-group semantics required' : false` |

packages/runtime/src/__tests__/builtin-tools.test.ts

@@ -1534,6 +1534,71 @@ describe('builtin Bash streaming output', () => {
     }
   });
 
+  test('does not turn Git config references into host-discovered sandbox grants', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'maka-bash-no-git-config-scan-'));
+    try {
+      const config = join(root, 'outside.config');
+      await writeFile(config, `[include]\n\tpath = ${join(root, 'included.config')}\n`);
+      let input: Parameters<ShellRunLauncher['runForegroundBash']>[0] | undefined;
+      const shellRuns: ShellRunLauncher = {
+        async runForegroundBash(value) {
+          input = value;
+          return {
+            kind: 'terminal',
+            cwd: value.cwd,
+            cmd: value.command,
+            status: 'completed',
+            exitCode: 0,
+            output: {
+              mode: 'pipes',
+              stdout: '',
+              stderr: '',
+              stdoutTruncated: false,
+              stderrTruncated: false,
+              redacted: false,
+            },
+          };
+        },
+        async runBackgroundBash() {
+          throw new Error('not used');
+        },
+      };
+      const bash = buildBuiltinTools({
+        shellRuns,
+        shellEnvironment: { GIT_CONFIG_GLOBAL: config },
+        permissionProfile: createWorkspaceWritePermissionProfile(),
+        sandboxManager: new SandboxManager([new MacosSeatbeltBackend()]),
+        sandboxPlatform: 'darwin',
+      }).find((candidate) => candidate.name === 'Bash');
+      if (!bash) throw new Error('Bash tool missing');
+
+      await bash.impl(
+        { command: '/usr/bin/git status --short' },
+        {
+          sessionId: 'session-1',
+          turnId: 'turn-1',
+          toolCallId: 'tool-1',
+          cwd: root,
+          permissionMode: 'ask',
+          abortSignal: new AbortController().signal,
+          emitOutput: () => {},
+        },
+      );
+
+      assert.ok(input?.argv);
+      assert.equal(
+        input.argv.some((argument) => argument.includes(config)),
+        false,
+      );
+      assert.equal(
+        input.argv.some((argument) => argument.includes('RUNTIME_READABLE_FILE')),
+        false,
+      );
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
   test('Read treats runtime background task refs as whole resources', async () => {
     const calls: unknown[] = [];
     const runtimeResources = {