fix(sandbox): validate requested branch name before shelling out in clone

[pedrofrxncx]

Source

A bug found by reading packages/sandbox/daemon/setup/clone.ts while looking at recent churn in packages/sandbox/daemon/git/checkout-branch.ts (#4472, #4470 hardened the sibling checkout path against the same class of issue).

The bug

spawnClone builds sh -c git commands (ls-remote, clone --branch, checkout -B) by interpolating the config-supplied git.repository.branch directly into the command string, with no validation. Git allows shell metacharacters (;, $(…), backticks, …) in ref names, so a branch value like x;touch pwned runs touch pwned as a second shell command the moment spawnClone does its first ls-remote probe — during the very first clone of a sandbox.

The same interpolation for the remote-controlled default branch (base, read from ls-remote --symref output) was already guarded by a hand-rolled isSafeRefName allowlist in this file, and the analogous requested-branch value in the sibling checkout path (git/checkout-branch.ts) was already hardened in #4472/#4470 — this fixes the one remaining unguarded call site, and folds the two independent ref-name allowlists (clone.ts's isSafeRefName and git/ref-name.ts's assertValidRemoteBranchName) into the single validator in git/ref-name.ts.

Regression test

packages/sandbox/daemon/setup/clone.test.ts — "rejects a malicious requested branch instead of shelling it out" passes a branch of x;touch <marker> into spawnClone and asserts the marker file is never created and spawnClone returns a non-zero code instead of running the injected command.

To verify

bun test packages/sandbox/daemon/setup/clone.test.ts
bun test packages/sandbox/daemon/git/ref-name.test.ts

Checks run locally

• bun run fmt
• bunx tsc --noEmit in packages/sandbox
• bun test packages/sandbox/daemon/setup/clone.test.ts (10 pass)
• bun test packages/sandbox/daemon/git/ref-name.test.ts (2 pass)
• bun test packages/sandbox/daemon/git/checkout-branch.test.ts (5 pass, unaffected by the shared validator change)

Full CI will run the rest of the suite.

---

Summary by cubic

Validate config‑supplied branch names in the sandbox clone path before building sh -c git commands. This prevents command injection via git.repository.branch and unifies ref-name validation in git/ref-name.ts.

• Bug Fixes

  • spawnClone rejects invalid/malicious branch names with isValidRemoteBranchName and exits non‑zero.
  • Use the same validator when inspecting the remote default branch (base) to avoid unsafe interpolation.
  • Added a regression test to ensure injected shell payloads (e.g., x;touch <file>) never execute.

• Refactors

  • Replaced local isSafeRefName with shared isValidRemoteBranchName/assertValidRemoteBranchName in git/ref-name.ts.
  • Expanded validator tests and edge cases (e.g., reject a//b).

^{Written for commit c94c649. Summary will update on new commits.}