Summary

The TypeScript target and bulk-scan paths deliberately resolve Git through resolveTrustedExecutable, but bundled Python workbench helpers invoke git by name from their inherited PATH.

Relevant code:

• workbench_target.py lines 43-68
• generate_rank_input.py lines 490-505
• workbench environment construction

resolvePluginPython safely resolves the Python interpreter, but returns only the executable path. The sanitized environment produced while resolving it is not retained. Workbench execution later receives the normal scan environment, and Python calls commands beginning with "git".

Why this matters

If the effective PATH contains a repository-controlled directory, such as a checkout-local node_modules/.bin, workbench registration, target inspection, snapshot calculation, or ranking preparation can execute a repository-provided Git shim with the scanning user's permissions.

This bypasses the same trust boundary already enforced and regression-tested in targets.ts and multiscan.ts. A shim can also return fabricated repository metadata, affecting target identity and integrity calculations.

Expected behavior

Every host-side Git invocation should use one trusted, absolute executable selected outside the protected repository root, together with the sanitized environment associated with that selection.

Actual behavior

The workbench and ranking helpers search inherited PATH independently.

Suggested direction

Resolve Git once with resolveTrustedExecutable, pass the absolute path and sanitized Git environment into workbench commands, and make Python helpers require that path. Add regression coverage using a repository-local Git shim and assert it is never executed.

Found by static audit of upstream main at 9c7634b.