Module clone 

Bounded, SSRF-guarded local clone cache for remote repositories.

A repo URL is shallow-fetched (--depth 1) into <data>/cache/repos/<host>/<owner>/<repo>/<ref> and reused while fresh, so the agent can read a remote project like a local one without re-cloning on every call. The clone URL is validated through crate::core::web::url_guard (https-only, blocks private/loopback), and every git call is time-bounded.

Constants

DEFAULT_CLONE_TIMEOUT_SECS

Default wall-clock timeout for a clone/fetch.

Functions

ensure_repo

Ensure a fresh local checkout of repo exists and return its path.

repo_cache_dir

Cache directory for a repo+ref, with every path segment sanitized so a hostile owner/repo/ref cannot escape the cache root.