The split tools ran oxfmt in the checkout they rewrite. oxfmt looks up
its configuration from that directory and from the formatted files'
directories, and runs an oxfmt.config.ts it finds there, so a branch that
rehome-split rewrites could run code with the maintainer's permissions.
The tools now format through format.mjs, which passes the tools
checkout's .oxfmtrc.jsonc with --config and disables the nested lookup,
so no configuration file of the rewritten checkout is read or run. With
no files to format it does nothing, where oxfmt would format the whole
directory.
The split-tools tests cover split-methods and move-state on a checkout
whose root and src directory commit an oxfmt.config.ts that records it
ran.
A branch can commit the file a state group writes (or that the config
creates from a template) as a symlink. The split tools resolve every path
they read or write through confine.mjs, so move-state refuses such a file
instead of appending the state through the link. The test covers that
path: the group file is listed under create, exists as a link to a file
outside the checkout, and the tool exits with an error and leaves the
outside file unchanged.
Chris Tate