git: remote add accepts a local path outside the workspace jail #393

Found in review of #391. This bug predates #391 and was not introduced by it.

git remote add x /outside/repo validates the URL with checkRemoteURL but never runs checkLocalGitPath on it (internal/tool/git.go, remote()). A later git fetch x checks only the remote's name. x isn't a local path, so the check passes, and git then reads the configured path outside the jail.

The approval note does show → /outside/repo, which helps. Still, reads from outside the jail break the rule that "no path outside it is reachable by ANY tool".

Fix: run checkLocalGitPath on the URL in remote add / set-url.

🤖 Generated with Claude Code