Verify Git plugin SHA checkouts

Evidence record

OpenAI Codex pull request documenting the root cause and fix: Git can interpret a requested SHA as a branch name, so Codex now resolves HEAD after checkout and rejects plugin materialization unless it exactly matches the requested commit.

Read the original source ↗

Claim-level citations (3)

• supportsPlugin4Shell let pinned AI-agent plugins resolve to different attacker-controlled code: AIR reports Claude Code fixed in 2.1.179 and Codex fixed in 0.146.0; OpenAI's public Codex change verifies resolved HEAD after checkout and rejects a mismatch.

  Merged July 22 PR: resolve HEAD after checkout and reject if it differs from requested SHA

• supportsPlugin4Shell let pinned AI-agent plugins resolve to different attacker-controlled code: The common integrity failure is that the client requests a pinned commit but does not verify that the final checked-out HEAD equals the commit identity the marketplace approved.

  Why and What changed: Git can interpret the requested SHA as a branch name; resolve HEAD and reject mismatches

• supportsPlugin4Shell let pinned AI-agent plugins resolve to different attacker-controlled code: For Claude Code, Codex and GitHub Copilot, AIR demonstrated a variant where a default branch named exactly like the pinned 40-hex commit can win Git name resolution on hosts that permit such branch names.

  Regression test using a default branch named after another commit's SHA