Read-only git over a bound folder slot. This is NOT a second permission: it
rides the same slot binding as fs.external.* and can only reach bytes
fs.external.readText could already read (spec §7.8). Git runs host-side
with neutralized arguments, so there is no shell, no config injection, and no
stage/commit/restore/stash lane on this surface.
A slot does not have to be a repository toplevel. If the bound directory sits
inside a larger repository the host filters everything by the slot, so you
never see a file — or a commit — from outside what the user picked, and you
never see the repository's absolute location or its internal offset.
Read-only git over a bound folder slot. This is NOT a second permission: it rides the same slot binding as
fs.external.*and can only reach bytesfs.external.readTextcould already read (spec §7.8). Git runs host-side with neutralized arguments, so there is no shell, no config injection, and no stage/commit/restore/stash lane on this surface.A slot does not have to be a repository toplevel. If the bound directory sits inside a larger repository the host filters everything by the slot, so you never see a file — or a commit — from outside what the user picked, and you never see the repository's absolute location or its internal offset.