Problem
Worktree handoff capture rejects valid UTF-8 text containing the literal replacement character � (U+FFFD). boundedGit currently decodes stdout to a string and rejects any occurrence of that character; nulPaths repeats the same heuristic.
Main f6b49ae59605b1276b8267f2886d22c03f01533c, Node 22.22.3 / Git 2.54 on Windows. All reproduction data is synthetic.
Reproduction
- Create a normal temporary Git repository and a child worktree via
createWorktree.
- Change a tracked text line to contain a literal U+FFFD, or create an untracked/ignored filename containing it.
- Call the real
prepareWorktreeHandoff owner.
Actual: valid text is reported as invalid UTF-8 and no handoff is captured. Both patch-content and file-inventory cases fail on main. This does not demonstrate data deletion: existing fail-closed handling preserves the checkout.
Expected: validate the raw Git output bytes with a strict decoder. Preserve valid U+FFFD content and names exactly; continue refusing genuinely malformed byte sequences before publishing the artifact.
Scope: byte validation in this handoff owner only; no cleanup policy, patch format, inventory semantics, arbitrary binary-text support or configuration changes.
Problem
Worktree handoff capture rejects valid UTF-8 text containing the literal replacement character
�(U+FFFD).boundedGitcurrently decodes stdout to a string and rejects any occurrence of that character;nulPathsrepeats the same heuristic.Main
f6b49ae59605b1276b8267f2886d22c03f01533c, Node 22.22.3 / Git 2.54 on Windows. All reproduction data is synthetic.Reproduction
createWorktree.prepareWorktreeHandoffowner.Actual: valid text is reported as invalid UTF-8 and no handoff is captured. Both patch-content and file-inventory cases fail on main. This does not demonstrate data deletion: existing fail-closed handling preserves the checkout.
Expected: validate the raw Git output bytes with a strict decoder. Preserve valid U+FFFD content and names exactly; continue refusing genuinely malformed byte sequences before publishing the artifact.
Scope: byte validation in this handoff owner only; no cleanup policy, patch format, inventory semantics, arbitrary binary-text support or configuration changes.