Function scrubBareGitRepoFiles

src/utils/sandbox/sandbox-adapter.ts:404–414

* Delete bare-repo files planted at cwd during a sandboxed command, before * Claude's unsandboxed git calls can see them. See the SECURITY block above * bareGitRepoFiles. anthropics/claude-code#29316.

()

 * bareGitRepoFiles. anthropics/claude-code#29316.
 */
function scrubBareGitRepoFiles(): void {
  for (const p of bareGitRepoScrubPaths) {
    try {
      // eslint-disable-next-line custom-rules/no-sync-fs -- cleanupAfterCommand must be sync (Shell.ts:367)
      rmSync(p, { recursive: true })
      logForDebugging(`[Sandbox] scrubbed planted bare-repo file: ${p}`)
    } catch {
      // ENOENT is the expected common case — nothing was planted
    }
  }
}

/**
 * Detect if cwd is a git worktree and resolve the main repo path.