fix(sdk): just update runs its programs without the GIT_* variables of its caller #444

Outside the plan: Pascal assigned this card on 2026-11-03, through the grooming of Epic 16. Its pull request says that it is outside the plan.

Problem

just update starts git, uv, and Copier through updateRun and updateOutput in sdk/extensionrepo/update.go (lines 243-254). These commands have no Env, so each program gets the full environment of the caller. Copier also starts git. Under a git hook or git rebase --exec, the caller has GIT_DIR, GIT_INDEX_FILE, or GIT_WORK_TREE. Then git can read or write the wrong repository.

The analyzer callerenv (sdk/analysis/callerenv/callerenv.go lines 33-37) checks three exact package paths only. It does not check packages under those paths.

Goal

The programs of just update never get the GIT_* variables of the caller, and callerenv checks every package under the paths that it owns.

Acceptance rules

1. updateRun and updateOutput give each command an explicit environment. One function builds it from the caller's environment and removes each GIT_* variable. callerenv names that function as the allowed reader.
2. callerenv matches an owned path when the package path is equal to it, or starts with it followed by /. sdk/extensiontestx does not match sdk/extensiontest.
3. sdk/extensiontest/guard/guard_linux.go line 137 and sdk/extensiontest/fake/main.go line 64 read the environment on purpose. The owners map allows each of them by exact package and function, with a comment that gives the reason.
4. No SSA analyzer is added.

Examples

• Success: a test sets GIT_DIR and GIT_INDEX_FILE to a second repository, then runs the update. The second repository does not change, and the update changes the right repository. A stub program in place of Copier sees no GIT_* variable.
• Failure: the second repository gets a new commit, index, or ref, or the stub sees a GIT_* variable.

Check

These tests pass in just check:

• The poisoned GIT_* test of the update, with the stub of Copier
• A callerenv test where a call to os.Environ in a package under an owned path fails
• A callerenv test where a package with a similar prefix is not matched
• A callerenv test where the two allowed readers pass, and another function in the same package fails

by Opus-5.5 via Claude Code