[MikeMcQuaid]

• Preserve user Git configuration and download permissions to avoid breaking private repository authentication.
• Run one bounded Git configuration query in brew doctor without executing credential helpers or contacting remotes.
• Match Git diagnostics against sandbox rules to identify restricted paths without printing raw configuration or error output.
• Share the download environment and sandbox policy without creating a download strategy instance for the diagnostic.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Codex with GPT 6 Astra at Extra High effort, with local review and testing.

---

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6b110fea-eba4-46b2-a963-ab79f81f175a

📥 Commits

Reviewing files that changed from the base of the PR and between 2954a74 and c1fb292.

📒 Files selected for processing: 3

• Library/Homebrew/diagnostic.rb
• Library/Homebrew/test/diagnostic/git_config_spec.rb
• docs/FAQ.md

🚧 Files skipped from review as they are similar to previous changes: 1

• docs/FAQ.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • Git downloads now handle configuration and supporting files in restricted locations more reliably, while keeping sandbox access limited.
  • brew doctor can identify Git configuration loading errors and restricted paths that may affect downloads. The check does not run credential helpers or verify authentication, and its error output avoids exposing configuration contents.
• Documentation
  • Updated the FAQ with guidance on sandboxed Git download failures and the scope and limitations of the new diagnostic.

Adds a sandboxed Git configuration check to diagnostics. The check reports failures and matching denied-read paths. Git download environment handling and sandbox network rules are updated. The FAQ documents restricted configuration cases and check limits.

Changes: Sandboxed Git configuration

Layer / File(s)	Summary
Git sandbox environment and network rule Library/Homebrew/sandbox.rb, Library/Homebrew/download_strategy/git_download_strategy.rb	The sandbox permits network access under the Git home-read exception. Git download handling uses a shared environment and removes the broad fetch credential access override.
Configuration probe and reporting Library/Homebrew/sandbox.rb, Library/Homebrew/diagnostic.rb, Library/Homebrew/test/diagnostic/git_config_spec.rb, Library/Homebrew/test/sandbox_shared_spec.rb, docs/FAQ.md	The sandbox exposes literal denied-read paths. The diagnostic check probes Git configuration and reports warnings and matching restricted paths. Tests cover check outcomes and path filtering. The FAQ describes restricted-configuration cases and check limits.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to c1fb2

No concrete issue remains that would prevent merging after normal checks.

Pre-merge checks: 4

Check name	Status	Explanation
Description check		The description clearly explains the Git configuration diagnostic, sandbox permissions, security limits, tests, and intended preservation of private repository authentication.
Title check		The title is concise and accurately describes the main change: warning about Git configuration failures caused by sandbox restrictions.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 34dd115a-3296-45bd-95db-cf75fa262fc2

📥 Commits

Reviewing files that changed from the base of the PR and between 9811f64 and 2954a74.

📒 Files selected for processing: 6

• Library/Homebrew/diagnostic.rb
• Library/Homebrew/download_strategy/git_download_strategy.rb
• Library/Homebrew/sandbox.rb
• Library/Homebrew/test/diagnostic/git_config_spec.rb
• Library/Homebrew/test/sandbox_shared_spec.rb
• docs/FAQ.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.