Module git 

Hardened git invocation.

Every git call Mermaid makes on a user’s behalf runs through this builder, so the hardening is uniform instead of re-derived per call site:

• No repo-provided hooks (core.hooksPath pointed at a nonexistent path). A checkpoint, a worktree, or a plugin fetch must never execute code the repo happens to carry. A missing hooks dir means git runs no hooks — including on Windows git, where /dev/null is not a device but is still an absent path.
• No external transports (protocol.ext.allow=never). ext:: URLs hand git a shell command to run; a submodule or remote carrying one is remote code execution.
• No credential prompts (GIT_TERMINAL_PROMPT=0). A fetch against a private remote fails fast instead of blocking a background task on a terminal read nobody is watching.
• A fixed committer identity, so a commit works on a machine with no user.email configured and never attributes Mermaid’s bookkeeping to the user.

Callers pick how much output they need: GitCommand::run discards it, GitCommand::success reports the exit status as a bool (for the --quiet predicates), GitCommand::output returns trimmed stdout, and GitCommand::output_bytes returns it raw — git diff --binary emits base85 payloads and diff context lifted verbatim out of files that need not be UTF-8.

Structs

GitCommand

A git invocation with Mermaid’s hardening already applied.

Functions

git

Start a hardened git invocation in dir. The common shape.

is_work_tree

Whether dir sits inside a git work tree. False when git is missing entirely, which is the same practical answer for every caller here.