fix(plugin): exclude nested Git metadata from scan inventories

plugins/codex-security/mcp-app/tests/test_artifact_inventory.mjs

@@ -33,6 +33,7 @@ const inventory = await import(
 try {
   await testSchemasAreBoundAndExact();
   await testPrepareUsesTheExistingStandardGenerator();
+  await testPrepareExcludesGitMetadata();
   await testPrepareUsesOnlyAuthoritativeDiffChanges();
   await testPrepareIncludesStagedAndUnstagedChanges();
   await testWorkerReadsItsOwnBoundInventory();
@@ -147,6 +148,49 @@ async function testPrepareUsesTheExistingStandardGenerator() {
   );
 }
 
+async function testPrepareExcludesGitMetadata() {
+  const fixture = await createFixture("nested repositories");
+  for (const [name, source] of [
+    [".git/config", "[core]\n"],
+    ["vendor/lib/.git/HEAD", "ref: refs/heads/main\n"],
+    ["vendor/lib/.git/hooks/example.py", "pass\n"],
+    ["vendor/lib/handler.py", "pass\n"],
+    ["vendor/worktree/.git", "gitdir: ../../.git/worktrees/example\n"],
+    ["vendor/worktree/handler.py", "pass\n"],
+    [".gitignore", "*.skip\n"],
+    [".github/workflows/check.yml", "name: example\n"],
+    ["src/widget.git", "example\n"],
+  ]) {
+    await writeRepositoryFile(fixture.repoRoot, name, source);
+  }
+
+  assert.deepEqual(
+    await inventory.prepareCodexSecurityReviewItems(fixture.scan),
+    { reviewItemsTotal: 5 },
+  );
+  assert.deepEqual(await inventory.listCodexSecurityReviewItems(fixture.scan), {
+    items: [
+      { path: "./.github/workflows/check.yml" },
+      { path: "./.gitignore" },
+      { path: "./src/widget.git" },
+      { path: "./vendor/lib/handler.py" },
+      { path: "./vendor/worktree/handler.py" },
+    ],
+  });
+
+  const metadataScope = { ...fixture.scan, scope: "vendor/lib/.git/hooks" };
+  assert.deepEqual(
+    await inventory.prepareCodexSecurityReviewItems(metadataScope),
+    { reviewItemsTotal: 0 },
+  );
+  assert.deepEqual(
+    await inventory.listCodexSecurityReviewItems(metadataScope),
+    {
+      items: [],
+    },
+  );
+}
+
 async function testPrepareUsesOnlyAuthoritativeDiffChanges() {
   const fixture = await createFixture("selected committed changes");
   await initializeRepository(fixture.repoRoot);
@@ -456,7 +500,9 @@ async function standardInventory(repository, scope) {
       "--files",
       "--hidden",
       "--glob",
-      "!.git/**",
+      "!**/.git",
+      "--glob",
+      "!**/.git/**",
       "--path-separator=/",
       "--",
       scope,

plugins/codex-security/scripts/generate_in_scope_files.py

@@ -94,8 +94,11 @@ def generate_in_scope_files(repository: Path, scope: str, output: Path) -> int:
         "--hidden",
         "--path-separator",
         "/",
+        # Prune Git metadata and its contents even when the scope starts inside .git.
         "--glob",
-        "!.git/**",
+        "!**/.git",
+        "--glob",
+        "!**/.git/**",
         "--",
         scope,
     ]

plugins/codex-security/scripts/generate_rank_input.py

@@ -542,8 +542,11 @@ def make_repo_scope_input(args: argparse.Namespace) -> None:
                     "--hidden",
                     "--no-require-git",
                     "--null",
+                    # Also exclude descendants when the scope starts inside .git.
                     "--glob",
-                    "!.git/**",
+                    "!**/.git",
+                    "--glob",
+                    "!**/.git/**",
                     "--",
                     str(scope_path.relative_to(repo)),
                 ]

plugins/codex-security/tests/test_generate_in_scope_files.py

@@ -3,7 +3,7 @@
 import os
 import subprocess
 import sys
-from pathlib import Path
+from pathlib import Path, PurePosixPath
 
 import pytest
 
@@ -73,7 +73,18 @@ def run_inventory(
 
 def standard_inventory(repository: Path, scope: str) -> bytes:
     files = subprocess.run(
-        ["rg", "--files", "--hidden", "--glob", "!.git/**", "--path-separator=/", "--", scope],
+        [
+            "rg",
+            "--files",
+            "--hidden",
+            "--glob",
+            "!**/.git",
+            "--glob",
+            "!**/.git/**",
+            "--path-separator=/",
+            "--",
+            scope,
+        ],
         cwd=repository,
         capture_output=True,
         check=False,
@@ -148,6 +159,71 @@ def test_inventory_keeps_ignored_tracked_files_without_ignored_untracked_files(
     assert "./app/ignored.skip" not in paths
 
 
+@pytest.mark.parametrize(
+    ("scope", "expected"),
+    [(".", "./vendor/lib/handler.py"), ("vendor", "vendor/lib/handler.py")],
+)
+def test_inventory_excludes_git_metadata_from_a_nested_repository(
+    tmp_path: Path, scope: str, expected: str
+) -> None:
+    repository = make_repository(tmp_path)
+    write_file(repository, "vendor/lib/handler.py")
+    write_file(repository, "vendor/lib/.git/HEAD", b"ref: refs/heads/main\n")
+    write_file(repository, "vendor/lib/.git/config", b"[core]\n\tbare = false\n")
+    write_file(repository, "vendor/lib/.git/objects/ab/cdef", b"blob")
+    output = tmp_path / "in_scope_files.txt"
+
+    result = run_inventory(repository, scope, output)
+
+    assert result.returncode == 0, result.stderr
+    paths = output.read_text(encoding="utf-8").splitlines()
+    assert expected in paths
+    assert all(".git" not in PurePosixPath(path).parts for path in paths)
+
+
+@pytest.mark.parametrize(
+    "scope",
+    [
+        ".git",
+        "./.git",
+        ".git/hooks",
+        "vendor/lib/.git",
+        "./vendor/lib/.git",
+        "vendor/lib/.git/hooks",
+    ],
+)
+def test_inventory_excludes_metadata_when_scoped_inside_a_git_directory(
+    tmp_path: Path, scope: str
+) -> None:
+    repository = make_repository(tmp_path)
+    for prefix in (".git", "vendor/lib/.git"):
+        write_file(repository, f"{prefix}/hooks/example.py")
+    output = tmp_path / "in_scope_files.txt"
+
+    result = run_inventory(repository, scope, output)
+
+    assert result.returncode == 0, result.stderr
+    assert output.read_bytes() == b""
+
+
+@pytest.mark.parametrize("nested", [False, True])
+def test_inventory_excludes_the_git_file_of_a_linked_worktree(tmp_path: Path, nested: bool) -> None:
+    repository = make_repository(tmp_path)
+    git(repository, "add", ".")
+    git(repository, "commit", "-qm", "base")
+    worktree = repository / "vendor" / "lib" if nested else tmp_path / "worktree"
+    git(repository, "worktree", "add", "-q", str(worktree), "HEAD")
+    output = tmp_path / "in_scope_files.txt"
+
+    result = run_inventory(repository if nested else worktree, ".", output)
+
+    assert result.returncode == 0, result.stderr
+    paths = output.read_text(encoding="utf-8").splitlines()
+    prefix = "./vendor/lib" if nested else "."
+    assert f"{prefix}/app/routes.py" in paths
+    assert all(".git" not in PurePosixPath(path).parts for path in paths)
+
+
 @pytest.mark.skipif(os.name == "nt", reason="Windows does not allow CR/LF in filenames")
 @pytest.mark.parametrize("separator", ["\n", "\r", "\r\n"])
 @pytest.mark.parametrize("ignored_tracked", [False, True])