Merge pull request #10051 from Kilo-Org/chore/bump-simple-git-3.36.0

chore(deps): bump simple-git to 3.36.0

.changeset/bump-simple-git-3-36.md

@@ -0,0 +1,6 @@
+---
+"@kilocode/cli": patch
+"kilo-code": patch
+---
+
+Harden git operations against malicious repositories and environment variables by upgrading the underlying git library.

bun.lock

@@ -255,7 +255,7 @@
         "marked": "catalog:",
         "openai": "^4.85.4",
         "quick-lru": "^7.0.0",
-        "simple-git": "3.35.2",
+        "simple-git": "3.36.0",
         "solid-js": "^1.9.11",
         "uri-js": "^4.4.1",
         "virtua": "catalog:",
@@ -395,7 +395,7 @@
         "ripgrep": "0.3.1",
         "rotating-file-stream": "3.2.9",
         "semver": "^7.6.3",
-        "simple-git": "3.35.2",
+        "simple-git": "3.36.0",
         "solid-js": "catalog:",
         "strip-ansi": "7.1.2",
         "tree-sitter-bash": "0.25.0",
@@ -4067,7 +4067,7 @@
 
     "simple-get": ["simple-get@4.0.1", "", { "dependencies": { "decompress-response": "^6.0.0", "once": "^1.3.1", "simple-concat": "^1.0.0" } }, "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA=="],
 
-    "simple-git": ["simple-git@3.35.2", "", { "dependencies": { "@kwsites/file-exists": "^1.1.1", "@kwsites/promise-deferred": "^1.1.1", "@simple-git/args-pathspec": "^1.0.2", "@simple-git/argv-parser": "^1.0.3", "debug": "^4.4.0" } }, "sha512-ZMjl06lzTm1EScxEGuM6+mEX+NQd14h/B3x0vWU+YOXAMF8sicyi1K4cjTfj5is+35ChJEHDl1EjypzYFWH2FA=="],
+    "simple-git": ["simple-git@3.36.0", "", { "dependencies": { "@kwsites/file-exists": "^1.1.1", "@kwsites/promise-deferred": "^1.1.1", "@simple-git/args-pathspec": "^1.0.3", "@simple-git/argv-parser": "^1.1.0", "debug": "^4.4.0" } }, "sha512-cGQjLjK8bxJw4QuYT7gxHw3/IouVESbhahSsHrX97MzCL1gu2u7oy38W6L2ZIGECEfIBG4BabsWDPjBxJENv9Q=="],
 
     "simple-xml-to-json": ["simple-xml-to-json@1.2.7", "", {}, "sha512-mz9VXphOxQWX3eQ/uXCtm6upltoN0DLx8Zb5T4TFC4FHB7S9FDPGre8CfLWqPWQQH/GrQYd2AXhhVM5LDpYx6Q=="],
 

packages/kilo-vscode/package.json

@@ -950,7 +950,7 @@
     "marked": "catalog:",
     "openai": "^4.85.4",
     "quick-lru": "^7.0.0",
-    "simple-git": "3.35.2",
+    "simple-git": "3.36.0",
     "solid-js": "^1.9.11",
     "uri-js": "^4.4.1",
     "virtua": "catalog:",

packages/kilo-vscode/src/agent-manager/GitOps.ts

@@ -42,6 +42,14 @@ export interface ExecResult {
   stderr: string
 }
 
+/**
+ * Fixed SSH command injected by {@link nonInteractiveEnv} when the user has
+ * not already configured their own. Exported so callers can check whether a
+ * `GIT_SSH_COMMAND` originated from Kilo (safe) or was inherited from the
+ * parent process (untrusted).
+ */
+export const KILO_NON_INTERACTIVE_SSH_COMMAND = "ssh -o BatchMode=yes"
+
 /**
  * Build environment variables that prevent git and SSH from opening interactive
  * prompts. Used for background operations (e.g. periodic fetch) so users with
@@ -57,11 +65,20 @@ export function nonInteractiveEnv(): NodeJS.ProcessEnv {
     GIT_TERMINAL_PROMPT: "0",
   }
   if (!process.env.GIT_SSH_COMMAND) {
-    env.GIT_SSH_COMMAND = "ssh -o BatchMode=yes"
+    env.GIT_SSH_COMMAND = KILO_NON_INTERACTIVE_SSH_COMMAND
   }
   return env
 }
 
+/**
+ * True when `env.GIT_SSH_COMMAND` is the fixed value Kilo sets, rather than
+ * an inherited one from the parent process. Use this to decide whether it's
+ * safe to pass `allowUnsafeSshCommand: true` to simple-git.
+ */
+export function isKiloOwnedSshCommand(env: NodeJS.ProcessEnv): boolean {
+  return env.GIT_SSH_COMMAND === KILO_NON_INTERACTIVE_SSH_COMMAND
+}
+
 export class GitOps {
   private readonly log: (...args: unknown[]) => void
   private readonly runGit: (args: string[], cwd: string) => Promise<string>

packages/kilo-vscode/src/agent-manager/WorktreeManager.ts

@@ -11,7 +11,7 @@ import * as fs from "fs"
 import { randomUUID } from "crypto"
 import simpleGit, { type SimpleGit } from "simple-git"
 import { generateBranchName, sanitizeBranchName } from "./branch-name"
-import { type GitOps, nonInteractiveEnv } from "./GitOps"
+import { type GitOps, isKiloOwnedSshCommand, nonInteractiveEnv } from "./GitOps"
 import { execWithShellEnv } from "./shell-env"
 import { markNoIndex } from "../util/spotlight"
 import {
@@ -691,7 +691,13 @@ export class WorktreeManager {
       // Use non-interactive env to prevent SSH passphrase popups.
       onProgress?.("fetching", `Fetching ${remote}/${branch}...`)
       try {
-        await simpleGit(this.root).env(nonInteractiveEnv()).fetch(remote, branch)
+        // Only opt into simple-git's allowUnsafeSshCommand when the SSH command
+        // is the fixed value Kilo injects — never for an inherited one, which
+        // could be attacker-controlled.
+        const env = nonInteractiveEnv()
+        await simpleGit(this.root, { unsafe: { allowUnsafeSshCommand: isKiloOwnedSshCommand(env) } })
+          .env(env)
+          .fetch(remote, branch)
         WorktreeManager.fetchCache.set(cacheKey, Date.now())
         if (await this.refExistsLocally(`${remote}/${branch}`)) {
           return {

packages/opencode/package.json

@@ -173,7 +173,7 @@
     "ripgrep": "0.3.1",
     "rotating-file-stream": "3.2.9",
     "semver": "^7.6.3",
-    "simple-git": "3.35.2",
+    "simple-git": "3.36.0",
     "solid-js": "catalog:",
     "strip-ansi": "7.1.2",
     "tree-sitter-bash": "0.25.0",