feat: enhance OAuth flow validation and improve security checks; add credential read blocking and git operation safeguards

src/tool/git_operator.rs

@@ -38,11 +38,14 @@ impl Tool for GitOperator {
 
     /// Run `git <operation> [args...]` and return its combined output.
     ///
-    /// Flow: extract `operation` + `args` → spawn `git <operation> <args>` → trim and
-    ///       join stdout/stderr.
+    /// Flow: extract `operation` + `args` → gate through `shell_filter::git`
+    /// to block destructive operations → spawn `git <operation> <args>` →
+    /// trim and join stdout/stderr.
     ///
-    /// Why: no allowlist here — the model may run any git subcommand; destructive
-    /// operations are blocked upstream by `shell_filter::git`, not by this tool.
+    /// Why: reconstructing the command string for the shell filter prevents
+    /// the model (or a subagent) from running destructive git operations
+    /// that would otherwise bypass the filter by going through this tool
+    /// instead of the `bash` tool.
     ///
     /// Return: trimmed combined output on success; error including exit code and
     /// stderr on failure.
@@ -59,6 +62,12 @@ impl Tool for GitOperator {
                     .collect()
             })
             .ok_or_else(|| anyhow!("missing required argument: args"))?;
+        // Gate through the destructive git filter — same filter used by
+        // the `bash` tool, so destructive operations are blocked regardless
+        // of which tool the model uses.
+        let cmd_for_filter = format!("git {} {}", operation, arg_list.join(" "));
+        crate::tool::shell_filter::git::check_git_destructive(&cmd_for_filter)
+            .map_err(|e| anyhow!("blocked: {}", e))?;
         let output = Command::new("git")
             .arg(&operation)
             .args(&arg_list)