the rendered meta flake pins each agent config by forge URL at its forge main

hive-c0re/src/lifecycle/git.rs

@@ -128,6 +128,42 @@ pub async fn git_rev_parse(dir: &Path, refname: &str) -> Result<String> {
     Ok(String::from_utf8_lossy(&out.stdout).trim().to_owned())
 }
 
+/// The contents of `path` at commit `rev` in `dir`, `None` when `rev` has no
+/// such file. Reads the object database, not the working tree.
+pub async fn git_show_file(dir: &Path, rev: &str, path: &str) -> Result<Option<String>> {
+    let spec = format!("{rev}:{path}");
+    let listed = git_command()
+        .current_dir(dir)
+        .args(["ls-tree", "--name-only", rev, "--", path])
+        .output()
+        .await
+        .with_context(|| format!("git ls-tree {spec} in {}", dir.display()))?;
+    if !listed.status.success() {
+        bail!(
+            "git ls-tree {spec} failed ({}): {}",
+            listed.status,
+            String::from_utf8_lossy(&listed.stderr).trim()
+        );
+    }
+    if listed.stdout.iter().all(u8::is_ascii_whitespace) {
+        return Ok(None);
+    }
+    let shown = git_command()
+        .current_dir(dir)
+        .args(["show", &spec])
+        .output()
+        .await
+        .with_context(|| format!("git show {spec} in {}", dir.display()))?;
+    if !shown.status.success() {
+        bail!(
+            "git show {spec} failed ({}): {}",
+            shown.status,
+            String::from_utf8_lossy(&shown.stderr).trim()
+        );
+    }
+    Ok(Some(String::from_utf8_lossy(&shown.stdout).into_owned()))
+}
+
 /// Plant a lightweight tag at `target`. Errors if the tag already
 /// exists — we want loud failures on id reuse, not silent
 /// overwrites.