fix(git): upgrade just-git to 1.10.0

[Hazzng]

Why

just-git 1.10.0 includes the four upstream fixes carried by #256. Use the published release rather than vendoring its bundled JavaScript. This PR supersedes #256.

What changed

• Upgrade just-git to ^1.10.0 and resolve the lockfile to 1.10.0.
• Preserve all eight regression tests from fix(git): patch just-git 1.9.1 with mode, ls-tree and --summary fixes #256 for mode changes, ls-tree, and --summary.
• Refresh stale wrapper comments and add a patch changeset.

Scope

• Covers the released git fixes through the existing sandbox wrapper.
• Keeps wrapper mode repair unchanged. Main has no just-git patch to remove.

Blast Radius

The upgrade affects sandbox git commands. Existing unit, integration, HTTP/MCP, and live SDK checks pass with the published package.

Verification

• pnpm check passed, including 2,313 core tests, 154 TypeScript SDK tests, and 174 Python SDK tests. The eight preserved regressions also passed directly.
• pnpm verify:local passed with 265 integration tests, 92 HTTP/MCP contract checks, and 102 live SDK checks.
• pnpm lint:fix passed. pnpm security:audit passed its high-severity threshold and reports one existing moderate sprintf-js advisory, GHSA-hp3w-g68c-fv3c.

---

Summary by cubic

Upgrades just-git from ^1.9.1 to ^1.10.0 to pick up upstream fixes for mode-only changes, ls-tree, and --summary output instead of vendoring the fix bundle from #256.

• Supersedes fix(git): patch just-git 1.9.1 with mode, ls-tree and --summary fixes #256 and preserves its eight regression tests in src/api/tests/unit/git-command.regressions.test.ts.
• Refreshes wrapper comments in src/api/commands/git-command.ts; wrapper mode repair and index-mode handling are unchanged.
• Adds a patch changeset for sql-fs-api.

Verification

• pnpm check passed: 2,313 core tests, 154 TypeScript SDK tests, 174 Python SDK tests, plus the eight new regressions.
• pnpm verify:local passed: 265 integration tests, 92 HTTP/MCP contract checks, 102 live SDK checks.
• pnpm lint:fix and pnpm security:audit passed; audit reports one existing moderate sprintf-js advisory.

^{Written for commit 679a06c. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 19487177-7f29-4d83-9d4f-f13ba7a0296b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

No issues found across 5 files

_{You’re at about 90% of the monthly reviewed-line limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.}

<sub>Tip: Get a Slack DM when cubic finishes reviewing your PRs. Connect Slack

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>