feat(cli,container): add git safe directory check, mount CLI, deeper volume scan, rebuild messaging

- Increase doctor volume detection depth from 4 to 8 to catch nested projects
- Add git safe directory doctor check with immediate fix (no rebuild needed)
- Auto-detect and register all git repos as safe.directory on container startup
- Add `codeforge mount add <path>` command for manual volume registration
- Extract shared mounts.json utilities to dedicated module
- Standardize rebuild messaging with specific VS Code and CLI instructions
- Add rebuildType field to FixAction for normal vs full rebuild guidance

Author: AnExiledDev

cli/src/commands/doctor/checks/git.ts

@@ -0,0 +1,115 @@
+import { dirname } from "node:path";
+import type { CheckResult } from "../types.js";
+import { spawn } from "../util.js";
+
+export async function checkGitSafeDirectories(
+	workspaceRoot: string,
+): Promise<CheckResult> {
+	// Find all git repos (directories) and worktrees (files with gitdir:)
+	const [dirResult, fileResult] = await Promise.all([
+		spawn("find", [
+			workspaceRoot,
+			"-maxdepth",
+			"6",
+			"-name",
+			".git",
+			"-type",
+			"d",
+		]),
+		spawn("find", [
+			workspaceRoot,
+			"-maxdepth",
+			"6",
+			"-name",
+			".git",
+			"-type",
+			"f",
+		]),
+	]);
+
+	const gitPaths = [
+		...(dirResult.exitCode === 0 && dirResult.stdout
+			? dirResult.stdout.split("\n").filter(Boolean)
+			: []),
+		...(fileResult.exitCode === 0 && fileResult.stdout
+			? fileResult.stdout.split("\n").filter(Boolean)
+			: []),
+	];
+
+	if (gitPaths.length === 0) {
+		return {
+			name: "Git safe directories",
+			category: "git",
+			status: "pass",
+			message: "no git repositories found",
+		};
+	}
+
+	// Get project roots from .git paths
+	const projectDirs = [...new Set(gitPaths.map((p) => dirname(p)))];
+
+	// Get current safe.directory entries
+	const { stdout: safeOutput } = await spawn("git", [
+		"config",
+		"--global",
+		"--get-all",
+		"safe.directory",
+	]);
+
+	const safeDirs = new Set(
+		safeOutput ? safeOutput.split("\n").filter(Boolean) : [],
+	);
+
+	// Find project dirs not in the safe list
+	const missing = projectDirs.filter((dir) => !safeDirs.has(dir));
+
+	if (missing.length === 0) {
+		return {
+			name: "Git safe directories",
+			category: "git",
+			status: "pass",
+			message: `all ${projectDirs.length} project${projectDirs.length !== 1 ? "s" : ""} registered`,
+		};
+	}
+
+	return {
+		name: "Git safe directories",
+		category: "git",
+		status: "warn",
+		message: `${missing.length} project${missing.length !== 1 ? "s" : ""} missing safe.directory`,
+		hint: "Run codeforge doctor --fix --only git",
+		fix: {
+			label: `Add ${missing.length} safe.directory entr${missing.length !== 1 ? "ies" : "y"}`,
+			detail: `Registers ${missing.length} project director${missing.length !== 1 ? "ies" : "y"} as git safe directories to prevent "dubious ownership" errors (CVE-2022-24765). Takes effect immediately.`,
+			impact: `${missing.length} git config change${missing.length !== 1 ? "s" : ""}`,
+			requiresRebuild: false,
+			apply: async () => {
+				const added: string[] = [];
+				for (const dir of missing) {
+					const { exitCode } = await spawn("git", [
+						"config",
+						"--global",
+						"--add",
+						"safe.directory",
+						dir,
+					]);
+					if (exitCode === 0) {
+						added.push(dir);
+					}
+				}
+
+				if (added.length === 0) {
+					return {
+						applied: false,
+						message: "Failed to add any safe.directory entries",
+					};
+				}
+
+				return {
+					applied: true,
+					message: `Added ${added.length} safe.directory entr${added.length !== 1 ? "ies" : "y"}: ${added.join(", ")}`,
+				};
+			},
+		},
+	};
+}

cli/src/commands/doctor/checks/volumes.ts

@@ -1,6 +1,8 @@
 import { existsSync } from "node:fs";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir } from "node:fs/promises";
 import { basename, dirname, join, relative } from "node:path";
+import { readMountsJson, writeMountsJson } from "../mounts.js";
+import type { MountEntry } from "../mounts.js";
 import type { CheckResult } from "../types.js";
 import { SLOW_FS_TYPES, spawn } from "../util.js";
 
@@ -9,6 +11,7 @@ interface VolumeCandidate {
 	contextFiles: string[];
 }
 
+
 const VOLUME_CANDIDATES: VolumeCandidate[] = [
 	{ pattern: "node_modules", contextFiles: ["package.json"] },
 	{
@@ -34,18 +37,6 @@ const VOLUME_CANDIDATES: VolumeCandidate[] = [
 
 const CANDIDATE_NAMES = VOLUME_CANDIDATES.map((c) => c.pattern);
 
-interface MountsJson {
-	version: number;
-	volumes: MountEntry[];
-}
-
-interface MountEntry {
-	path: string;
-	source: "auto" | "user";
-	signal: string;
-	added: string;
-}
-
 function hasContextFile(
 	dirPath: string,
 	contextFiles: string[],
@@ -77,19 +68,6 @@ function todayIso(): string {
 	return new Date().toISOString().slice(0, 10);
 }
 
-async function readMountsJson(filePath: string): Promise<MountsJson> {
-	try {
-		const raw = await readFile(filePath, "utf-8");
-		const parsed = JSON.parse(raw) as MountsJson;
-		if (parsed.version === 1 && Array.isArray(parsed.volumes)) {
-			return parsed;
-		}
-	} catch {
-		// file doesn't exist or is invalid
-	}
-	return { version: 1, volumes: [] };
-}
-
 function sanitizeName(name: string): string {
 	return name.replace(/[^a-zA-Z0-9-]/g, "-").replace(/^-+|-+$/g, "");
 }
@@ -104,7 +82,7 @@ export async function checkVolumeCandidates(
 	const { stdout, exitCode } = await spawn("find", [
 		workspaceRoot,
 		"-maxdepth",
-		"4",
+		"8",
 		"-type",
 		"d",
 		"(",
@@ -161,6 +139,7 @@ export async function checkVolumeCandidates(
 				detail: `Registers ${relPath} in .codeforge/mounts.json so CodeForge can mount it as a Docker volume instead of a bind mount, significantly improving I/O performance.`,
 				impact: "requires rebuild",
 				requiresRebuild: true,
+				rebuildType: "normal",
 				apply: async (): Promise<{
 					applied: boolean;
 					message: string;
@@ -193,11 +172,7 @@ export async function checkVolumeCandidates(
 						mounts.volumes.push(entry);
 					}
 
-					await writeFile(
-						mountsPath,
-						JSON.stringify(mounts, null, "\t") + "\n",
-						"utf-8",
-					);
+					await writeMountsJson(mountsPath, mounts);
 
 					// Check if Docker Compose infrastructure exists
 					const composeExists = existsSync(

cli/src/commands/doctor/fix.ts

@@ -18,6 +18,7 @@ interface FixOptions {
 const CATEGORY_LABELS: Record<CheckCategory, string> = {
 	auth: "Authentication",
 	environment: "Environment",
+	git: "Git",
 	volumes: "Volumes",
 	wsl: "WSL",
 };
@@ -26,6 +27,7 @@ const categoryMap: Record<string, CheckCategory> = {
 	auth: "auth",
 	env: "environment",
 	environment: "environment",
+	git: "git",
 	volumes: "volumes",
 	wsl: "wsl",
 };
@@ -79,9 +81,24 @@ async function applyFixes(fixes: CheckResult[]): Promise<void> {
 		}
 	}
 
-	const needsRebuild = fixes.some((f) => f.fix!.requiresRebuild);
-	if (needsRebuild) {
-		log.warn("Some changes require a container rebuild to take effect.");
+	const rebuildFixes = fixes.filter((f) => f.fix!.requiresRebuild);
+	if (rebuildFixes.length > 0) {
+		const needsFull = rebuildFixes.some(
+			(f) => f.fix!.rebuildType === "full",
+		);
+		if (needsFull) {
+			log.warn(
+				"Some changes require a full container rebuild (no cache) to take effect.\n" +
+					"  From VS Code: Ctrl+Shift+P → 'Dev Containers: Rebuild Without Cache'\n" +
+					"  From host terminal: codeforge container rebuild --no-cache",
+			);
+		} else {
+			log.warn(
+				"Some changes require a container rebuild to take effect.\n" +
+					"  From VS Code: Ctrl+Shift+P → 'Dev Containers: Rebuild Container'\n" +
+					"  From host terminal: codeforge container rebuild",
+			);
+		}
 	}
 }
 
@@ -107,7 +124,7 @@ export async function runFixMode(
 		const cat = categoryMap[options.only];
 		if (!cat) {
 			console.error(
-				`Unknown category: ${options.only}. Valid: auth, env, volumes, wsl`,
+				`Unknown category: ${options.only}. Valid: auth, env, git, volumes, wsl`,
 			);
 			process.exit(1);
 		}

cli/src/commands/doctor/format.ts

@@ -31,6 +31,7 @@ export function formatText(report: DoctorReport, useColor: boolean): string {
 	const categoryConfig: { key: CheckCategory; label: string }[] = [
 		{ key: "auth", label: "Authentication" },
 		{ key: "environment", label: "Environment" },
+		{ key: "git", label: "Git" },
 		{ key: "volumes", label: "Volumes" },
 		{ key: "wsl", label: "WSL" },
 	];

cli/src/commands/doctor/index.ts

@@ -6,6 +6,7 @@ import {
 	checkTmpdir,
 	checkWorkspaceFs,
 } from "./checks/environment.js";
+import { checkGitSafeDirectories } from "./checks/git.js";
 import { checkVolumeCandidates } from "./checks/volumes.js";
 import { checkDefenderExclusions, checkWslConfig } from "./checks/wsl.js";
 import { runFixMode } from "./fix.js";
@@ -21,7 +22,7 @@ export function registerDoctorCommand(parent: Command): void {
 		.option("--fix", "Enter interactive fix mode")
 		.option("-y, --yes", "Skip TUI prompts, apply all fixes")
 		.option("--dry-run", "Show what --fix would change without applying")
-		.option("--only <category>", "Filter fixes: auth, env, volumes, wsl")
+		.option("--only <category>", "Filter fixes: auth, env, git, volumes, wsl")
 		.action(async (options) => {
 			const workspaceRoot = process.env.WORKSPACE_ROOT || "/workspaces";
 
@@ -41,12 +42,14 @@ export function registerDoctorCommand(parent: Command): void {
 				(c) => c.name === "Workspace filesystem" && c.status === "warn",
 			);
 
-			// Run volume + WSL checks (WSL checks return null when not WSL)
-			const [volumeChecks, wslConfigCheck, defenderCheck] = await Promise.all([
-				checkVolumeCandidates(workspaceRoot),
-				checkWslConfig(isWsl),
-				checkDefenderExclusions(isWsl),
-			]);
+			// Run git + volume + WSL checks (WSL checks return null when not WSL)
+			const [gitCheck, volumeChecks, wslConfigCheck, defenderCheck] =
+				await Promise.all([
+					checkGitSafeDirectories(workspaceRoot),
+					checkVolumeCandidates(workspaceRoot),
+					checkWslConfig(isWsl),
+					checkDefenderExclusions(isWsl),
+				]);
 
 			// Assemble all checks, filtering out nulls from WSL checks
 			const wslChecks = [wslConfigCheck, defenderCheck].filter(
@@ -56,6 +59,7 @@ export function registerDoctorCommand(parent: Command): void {
 			const checks: CheckResult[] = [
 				...authChecks,
 				...envChecks,
+				gitCheck,
 				...volumeChecks,
 				...wslChecks,
 			];

cli/src/commands/doctor/mounts.ts

@@ -0,0 +1,33 @@
+import { readFile, writeFile } from "node:fs/promises";
+
+export interface MountsJson {
+	version: number;
+	volumes: MountEntry[];
+}
+
+export interface MountEntry {
+	path: string;
+	source: "auto" | "user";
+	signal: string;
+	added: string;
+}
+
+export async function readMountsJson(filePath: string): Promise<MountsJson> {
+	try {
+		const raw = await readFile(filePath, "utf-8");
+		const parsed = JSON.parse(raw) as MountsJson;
+		if (parsed.version === 1 && Array.isArray(parsed.volumes)) {
+			return parsed;
+		}
+	} catch {
+		// file doesn't exist or is invalid
+	}
+	return { version: 1, volumes: [] };
+}
+
+export async function writeMountsJson(
+	filePath: string,
+	data: MountsJson,
+): Promise<void> {
+	await writeFile(filePath, JSON.stringify(data, null, "\t") + "\n", "utf-8");
+}

cli/src/commands/doctor/types.ts

@@ -1,4 +1,4 @@
-export type CheckCategory = "auth" | "environment" | "volumes" | "wsl";
+export type CheckCategory = "auth" | "environment" | "git" | "volumes" | "wsl";
 
 export interface FixResult {
 	applied: boolean;
@@ -11,6 +11,7 @@ export interface FixAction {
 	detail: string; // full explanation
 	impact: string; // "1 env var change" or "requires rebuild"
 	requiresRebuild: boolean;
+	rebuildType?: "normal" | "full"; // "normal" = recreate container, "full" = rebuild image (no cache)
 	apply: () => Promise<FixResult>;
 }