git_operations: every `diff` fails — `-c diff.external=` makes git execute an empty program

[YellowSnnowmann]

What

git_operations' diff operation fails for every repository on main:

Git command failed: error: cannot run : No such file or directory
fatal: external diff died, stopping at <file>

Root cause

hardened_git injects every entry of NEUTRALISED_CONFIG as a -c override (src/openhuman/tools/impl/filesystem/git_operations_config.rs), and one of them is:

"diff.external=",

The intent is to neutralise a repository-set external diff driver. But git -c diff.external= does not disable the driver — it sets it to the empty string, and git then tries to execute that empty string. Reproducible on a bare repo with no config of its own:

$ git init -q . && echo a > f.txt && git add f.txt && git commit -qm init && echo b >> f.txt

$ git -c diff.external= diff -- f.txt
error: cannot run : No such file or directory
fatal: external diff died, stopping at f.txt

$ git -c diff.external= diff --no-ext-diff -- f.txt
diff --git a/f.txt b/f.txt
...                      # correct output

Every other entry in that list happens to name a program that exists or a key git treats as inert (core.pager=cat, core.editor=false, sequence.editor=false); diff.external is the one where an empty value means "run the empty program" rather than "none".

Impact

GitOperationsTool builds its diff through hardened_git (git_operations.rs, git_args = vec!["diff", "--unified=3"]), so the agent's diff operation is broken for all users, not only in tests. log/show are affected wherever they produce a patch.

How it surfaced

The raw-coverage test tools_network_channels_raw_coverage_e2e::git_operations_cover_read_write_markdown_and_safety_rejections fails on it. It is not caught on every PR because the coverage lane derives which raw-coverage modules to run from the changed paths, so it only runs when something under src/openhuman/tools/impl/filesystem/ is in the diff. It failed on #5955 purely because that PR merged main.

Fix

diff.external cannot be neutralised by a -c value — there is no value meaning "none". Drop it from NEUTRALISED_CONFIG and pass --no-ext-diff on the subcommands that honour an external diff driver (diff, and log/show when they produce a patch). GIT_EXTERNAL_DIFF is already cleared by suppress_ambient_git_config, so the env half of the hole is closed.

Acceptance criteria

• git_operations diff succeeds on a repository with no external diff driver configured
• A repository-set diff.external naming a program is still not executed (the hardening's actual goal), with a regression test that sets one and asserts it does not run
• tools_network_channels_raw_coverage_e2e::git_operations_cover_read_write_markdown_and_safety_rejections passes
• Any other NEUTRALISED_CONFIG entry whose empty value is command-valued is audited the same way

[YellowSnnowmann]

The fix is going in via #5955 rather than its own PR — #5988 is closed.

It surfaced there (the coverage lane runs tools_network_channels_raw_coverage_e2e for that PR's changed paths, which is what exposed this), and carrying it in the same PR keeps the repair next to the failure that found it.

Same commit and same tests as the closed PR:

• an_ordinary_repository_still_produces_a_diff — the regression itself
• a_repository_naming_an_external_diff_driver_never_gets_it_run — the hardening property still holds, with the planted driver proven to run before it is planted, so a pass means refusal rather than an inert fixture
• diff_external_is_not_neutralised_by_a_config_override — pins that the entry is never re-added
• tools_network_channels_raw_coverage_e2e::git_operations_cover_read_write_markdown_and_safety_rejections — the CI test that exposed this, confirmed passing against the fix

This issue stays open until #5955 merges.

[YellowSnnowmann]

Superseded on main — closing the loop.

30ba798fe fix(git_operations): suppress an external diff with --no-ext-diff, not an empty config landed independently, with 34fe8e90d fix(git-tool): suppress textconv on git_diff, not just external diff on top. That pair is strictly better than the fix I had prepared: same --no-ext-diff correction, plus --no-textconv for diff.<driver>.textconv, which --no-ext-diff does not cover and which I had missed.

So the change I merged into #5955 is redundant. Resolving that merge conflict took main's version wholesale, and #5955's diff no longer touches git_operations at all.

This issue can be closed as fixed by those commits, not by anything of mine.