fix(index): check repository ownership before commit hooks

Port PR #2306's regression against direct `git commit` and `git hook`
invocations. Before this fix, `Repo`'s automatic `GIT_DIR` binding made
Git treat the repository as explicitly selected: `IndexFile.commit()`
ran its pre-commit hook even when ordinary Git rejected dubious
ownership. The regression fails on both backends without the fix.

Retain the original discovery location and run `git rev-parse --git-dir`
before executing any commit hook, removing only the automatically bound
environment values. Remembering discovery supports external
`core.worktree` locations while matching `safe.directory` on ordinary,
bare, linked and separate-directory repositories. Explicit environment
or command-line repository selections retain Git's behavior, including
relative paths and consumption of one-shot options after failures.
Validate NUL arguments before starting either process.

The fixture tests verify rejection without hook side effects, Git's
safe-directory exemptions, and explicit repository-selection behavior.
Update the native-backend coverage test and GIX-23 documentation to
require two CLI processes per valid hook request, including missing
hooks. No independent ownership policy or native hook implementation
is introduced.

Validation: before the final option-preservation refinements, the full
index, repository and backend modules passed (CLI: 236 tests, 106 skips;
Gix: 338 tests, 4 skips; each with 19 passing subtests). Final focused
hook coverage passes with CLI (12 tests, 2 skips) and Gix (14 tests),
each with 9 passing subtests. A separate review independently reran the
ownership and repository-selection regressions on both backends.
`ruff check`, targeted `mypy`, fixture `bash -n` and `git diff --check`
pass. Windows and Linux were not run locally.

Author: codex

doc/gix-backend.md

@@ -906,7 +906,7 @@ identify the historical fixture where needed.
 | GIX-20 | Bug; missing API | `Target.Symbolic(name)` validates full names but rejects standalone names accepted by `git check-ref-format --allow-onelevel`. Four of 430 audited calls differed: `refs` twice, `hellothere`, and `valid_one_level_refname`. Further probes include digits, punctuation and Unicode (`1`, `A1`, `HEAD_1`, `A-B`, `A.B`, `Ä`). | Expose Git-compatible partial/one-level name validation, or correct the native restriction where appropriate. This is a binding/behavior shortcoming to revisit upstream; standalone names rejected natively retain CLI validation. |
 | GIX-21 | Bug; missing API | `Repository.committer()` preserves a process identity of ` Name. ` / ` email@example.invalid ` while `git var GIT_COMMITTER_IDENT` returns `Name.` / `email@example.invalid`. Native snapshot overrides for name, email and date work, but modifying the retained snapshot would leak per-command identity across threads. GixPython 0.1.0 has no general independent repository clone: Python copying fails and internal `RepoHandle::clone()` shares its `Arc` state. | Expose Git-compatible identity cleanup and a cheap independent native clone with isolated config, including per-command removal semantics. Reopening isolates state but repeats setup; `with_object_memory()` changes object-write behavior and is not a general clone. Keep `_checked_signature` validation and CLI fallback for cleanup/overrides. Never clean identity fields in Python or mutate shared snapshots/process environment to handle a command. |
 | GIX-22 | Missing API | The native Git directory is sufficient for the two fixed metadata leaves used here: `modules` and `COMMIT_EDITMSG`. Git's `path.c` applies no special relocation to either, including in linked worktrees. The adapter appends only these names to the canonical native Git directory. | No new binding is needed for these ordinary paths. Other `--git-path` names and symlinked metadata leaves retain CLI resolution; a general resolver must handle config/environment overrides, common/private storage and canonical targets. `Repository.modules_path()` means `.gitmodules`, not the `modules` storage directory. |
-| GIX-23 | Missing API | No hook lookup or execution API is bound in GixPython 0.1.0. The removed absence fast path read config through Gix but used Python `os.stat()` to declare success. | Bind native hook lookup with configured/default path, linked-worktree, missing/nonexecutable-hook and diagnostic semantics, plus execution where needed. Until then all managed hook calls use Git, including `--ignore-missing` no-ops. A Python filesystem check is not a Gix implementation. |
+| GIX-23 | Missing API | No hook lookup or execution API is bound in GixPython 0.1.0. The removed absence fast path read config through Gix but used Python `os.stat()` to declare success. | Bind native hook lookup with configured/default path, linked-worktree, missing/nonexecutable-hook and diagnostic semantics, plus execution where needed. Until then all managed hook calls use Git, including `--ignore-missing` no-ops, preceded by a Git discovery/ownership check that removes only `Repo`'s automatic environment bindings. Each valid hook request therefore makes two CLI calls. Explicit caller overrides retain Git's behavior. A Python filesystem check is not a Gix implementation. |
 | GIX-24 | Bug | In both object formats, `new_commit_as()` accepts a blob as the tree or a parent where `git commit-tree` rejects it. Tree-editor `upsert()`/`write()` accepts object IDs whose actual kinds disagree with blob/tree/gitlink modes; `git mktree --missing` rejects all three tested mismatches. `edit_references_as()` accepts a blob target under `refs/heads/`, rejected by `git update-ref`. | Provide checked commit/tree construction and reference edits, at least in Git-strict mode. Match Git's kind and direct-branch target validation before writing and under the required ref locks, including its distinct handling of symbolic aliases. Existing `_commit_tree`, `_write_tree` and `_update_ref` guards query Gix headers and select CLI on invalid inputs; they do not replace Gix writes with Python. |
 | GIX-25 | Bug; missing API | After `git symbolic-ref refs/heads/dangling refs/heads/missing`, `Repository.references().all()` enumerates the dangling name, while `git for-each-ref --format=%(refname)` omits it. Valid symbolic aliases must remain present. Both SHA-1 and SHA-256 probes reproduce this difference. | Expose Git-compatible enumeration with the same dangling-reference and diagnostic behavior, retaining the raw iterator for callers that need it. `_for_each_ref` forces Gix to resolve symbolic targets and falls back to Git on failure; keep that fallback until a compatible Gix API/mode is verified. |
 | GIX-26 | Bug; missing API | `dangerously_push_entry(IndexStat(), oid, 0, 0o120000, b".gitmodules")`, followed by `sort_entries()`, `verify_entries()` and `write()`, succeeds and retains the unsafe symlink. Protected Git `update-index -z --index-info` ignores it with exit 0 and `Ignoring path .gitmodules`; protected `read-tree` rejects it. The native fresh `index_from_tree` also rejects it. | A Git-strict checked index batch editor that validates names/modes, preserves metadata and reports rejected records. `verify_entries()` verifies ordering, not pathname safety. All private-index edits use Git with `core.protectHFS=true` and `core.protectNTFS=true`, followed by requested-entry readback; no Python dictionary reconstruction or native dangerous insertion remains. |
@@ -916,6 +916,17 @@ identify the historical fixture where needed.
 | GIX-30 | Bug (open) | GixPython 0.2.0 `Commit.decode()` reports `encoding=None` when `encoding ISO-8859-1` follows `x-extra value`; Git 2.54.0 selects `ISO-8859-1` and renders Latin-1 identity/message bytes correctly. Gix retains `(b"encoding", b"ISO-8859-1")` in `extra_headers`, but its encoding field disagrees with Git. The `late-latin1` read-only `commit.sh` fixture in `test_deserialization_declared_encoding` reproduces this and asserts the fallback. | Recognize encoding headers in Git-compatible order. `object_metadata()` conservatively retains CLI when an encoding appears in `extra_headers`; it does not select the header in Python. Keep this bug open until an upstream fix or compatible mode is verified. |
 | GIX-31 | Bug (open) | GixPython 0.2.0 `Commit.decode()` rejects commit headers containing a CR-only or tab-only line with `object parsing failed, at gix-object/src/commit/decode.rs:20`. Git 2.54.0 accepts both objects with `fsck --strict`, continues through their header block and renders the later Latin-1 declaration and message correctly. A space-only continuation line decodes natively but retains the late encoding declaration in `extra_headers` (GIX-30). `test_deserialization_headers_end_at_empty_line` reproduces all three using the `commit.sh whitespace-headers` fixtures and checks Git's projection. | Accept Git-compatible header lines and end headers only at an empty line. The existing `object_metadata()` native decoder diagnostics fallback retains Git for CR/tab inputs; the existing GIX-30 fallback covers the space input. Neither fallback closes these bugs. |
 
+The PR #2306 regression exposed an adapter ownership-check bypass in both
+backends: `Repo`'s automatic `GIT_DIR` made Git 2.54.0 treat hook execution as
+explicitly selecting the repository, so it ran a hook where an ordinary
+`git commit` rejected dubious ownership. `run_commit_hook()` now asks Git to
+rediscover the repository from its original location before executing hooks.
+`test_pre_commit_hook_not_run_in_repository_git_refuses` uses Git's
+`GIT_TEST_ASSUME_DIFFERENT_OWNER` switch and verifies rejection, `safe.directory`
+exemptions and explicit command-environment behavior across ordinary, bare,
+linked, separate-directory and configured-worktree layouts. This fixes the
+adapter bug without claiming a native Gix trust check; GIX-23 remains open.
+
 The October 22 Windows Gix CI run on Git 2.56.0.windows.2, CPython 3.12.10,
 and GixPython 0.2.0 exposed an adapter failure in
 `test_ignored_items_reported_verbatim`: Python's path metadata lookup raises

git/index/fun.py

@@ -6,7 +6,7 @@
 from typing import TYPE_CHECKING, Tuple, Union, cast
 
 from git.cmd import Git
-from git.exc import GitCommandError, HookExecutionError
+from git.exc import GitCommandError, HookExecutionError, UnsafeOptionError
 from git.types import PathLike
 from .typ import BaseIndexEntry
 
@@ -27,10 +27,37 @@ def hook_path(name: str, git_dir: PathLike) -> str:
 
 
 def run_commit_hook(name: str, index: "IndexFile", *args: str) -> None:
-    """Run a Git commit hook, ignoring missing hooks."""
+    """Run a Git commit hook, ignoring missing hooks.
+
+    :raise GitCommandError: If Git rejects the repository before executing its hook.
+    """
     Git._check_operand(name, "hook name")
     if name not in ("pre-commit", "commit-msg", "post-commit"):
         raise ValueError("Only commit hooks are supported")
+    if any("\0" in arg for arg in Git._unpack_args(args)):
+        raise UnsafeOptionError("Git arguments cannot contain NUL bytes")
+    command = index.repo.git
+    # Repo's automatic GIT_DIR bypasses Git's discovery-time ownership check.
+    one_shot_options, command._git_options = command._git_options, ()
+    options = [*command._persistent_git_options, *one_shot_options]
+    discovery_env = {}
+    if (
+        "GIT_DIR" in command._repository_environment
+        and command.environment().get("GIT_DIR") == command._repository_environment["GIT_DIR"]
+        and not any(option == "-C" or option == "--git-dir" or option.startswith("--git-dir=") for option in options)
+    ):
+        options[:0] = ["-C", index.repo._discovery_path]
+        discovery_env = {
+            key: None
+            for key, value in command._repository_environment.items()
+            if command.environment().get(key) == value
+        }
+    command.execute(
+        [command.GIT_PYTHON_GIT_EXECUTABLE, *options, "rev-parse", "--git-dir"],
+        env=discovery_env,
+        _repository_redirected="-C" in options,
+    )
+    command._git_options = one_shot_options
     try:
         index.repo.git._call_process_safe(
             "hook",

git/repo/base.py

@@ -375,6 +375,7 @@ def __init__(
             checkout = checkout_probe._call_process_safe("rev_parse", "--show-toplevel")
 
         self.git_dir = git_dir
+        self._discovery_path = git_dir if candidate == curpath else curpath
         probe.update_environment(GIT_DIR=git_dir)
         try:
             if native is not NotImplemented:

test/test_gix_backend.py

@@ -342,18 +342,18 @@ def test_hooks_retain_cli_even_when_missing(repo):
                     run_commit_hook(name, current.index)
             with pytest.raises(UnsafeOptionError, match="NUL"):
                 run_commit_hook("commit-msg", repo.index, "message\0path")
-            assert cli.call_count == 6
-        assert _backend.statistics().get(("Git.execute", "CLI process"), 0) == count + 6
+            assert cli.call_count == 12
+        assert _backend.statistics().get(("Git.execute", "CLI process"), 0) == count + 12
         hook = Path(repo.common_dir, "hooks", "pre-commit")
         hook.parent.mkdir(exist_ok=True)
         hook.write_text("present, even without executable permission")
         with patch.object(Git, "execute", return_value="") as cli:
             run_commit_hook("pre-commit", linked.index)
-            cli.assert_called_once()
+            assert cli.call_count == 2
         repo.git.config("core.hooksPath", "custom-hooks")
         with patch.object(Git, "execute", return_value="") as cli:
             run_commit_hook("post-commit", repo.index)
-            cli.assert_called_once()
+            assert cli.call_count == 2
 
 
 @pytest.mark.parametrize("config_variant", ["normal", "duplicate", "include"])

test/test_index.py

@@ -16,7 +16,7 @@
 import ddt
 import pytest
 
-from git import NULL_TREE, BlobFilter, Diff, Git, IndexFile, Object, Tree
+from git import NULL_TREE, BlobFilter, Diff, Git, IndexFile, Object, Repo, Tree
 from git.diff import NULL_TREE_SHA
 from git.exc import (
     CheckoutError,
@@ -1189,6 +1189,86 @@ def test_pre_commit_hook_outside_worktree(self):
             output = Path(repo.working_dir, "outside-hook-output.txt").read_text(encoding="utf-8")
             self.assertEqual(output, "ran outside hook\n")
 
+    def test_pre_commit_hook_not_run_in_repository_git_refuses(self):
+        for layout in ("regular", "bare", "linked", "separate", "configured"):
+            # Linked worktree registrations contain absolute paths.
+            with self.subTest(layout=layout), fixture_repo(
+                "hook-ownership.sh",
+                layout,
+                write=True,
+                execute=layout == "linked",
+                subdir="metadata" if layout == "configured" else "repo",
+            ) as repo:
+                output = Path(repo.working_dir, "output.txt")
+                discovery = repo.git_dir if layout == "configured" else repo.working_dir
+                baseline_output = Path(discovery, "output.txt")
+                baseline = Git(discovery)
+                # Reset any configured exemptions, as in Git's t0033-safe-directory.sh.
+                with mock.patch.dict(
+                    os.environ,
+                    {
+                        "GIT_TEST_ASSUME_DIFFERENT_OWNER": "1",
+                        "GIT_CONFIG_COUNT": "1",
+                        "GIT_CONFIG_KEY_0": "safe.directory",
+                        "GIT_CONFIG_VALUE_0": "",
+                    },
+                ):
+                    if layout == "regular":
+                        with self.assertRaisesRegex(GitCommandError, "dubious ownership"):
+                            baseline.commit("--allow-empty", "--no-gpg-sign", "-m", "Git refuses this repository")
+                        self.assertFalse(output.exists())
+                        with self.assertRaisesRegex(GitCommandError, "dubious ownership"):
+                            repo.index.commit("Git refuses this repository")
+                        self.assertFalse(output.exists())
+                    with self.assertRaises(GitCommandError):
+                        baseline.hook("run", "pre-commit")
+                    self.assertFalse(baseline_output.exists())
+                    with self.assertRaisesRegex(GitCommandError, "dubious ownership"):
+                        run_commit_hook("pre-commit", repo.index)
+                    self.assertFalse(output.exists())
+
+                    for environment in (
+                        {"GIT_CONFIG_VALUE_0": str(discovery)},
+                        {"GIT_DIR": str(repo.git_dir), "GIT_WORK_TREE": str(repo.working_dir)},
+                    ):
+                        with baseline.custom_environment(**environment), repo.git.custom_environment(**environment):
+                            baseline.hook("run", "pre-commit")
+                            expected = baseline_output.read_text(encoding="utf-8")
+                            baseline_output.unlink()
+                            run_commit_hook("pre-commit", repo.index)
+                            self.assertEqual(output.read_text(encoding="utf-8"), expected)
+                            output.unlink()
+
+    def test_commit_hook_preserves_explicit_repository_selection(self):
+        for selection in ("one-shot", "persistent", "environment", "git-dir-option"):
+            with self.subTest(selection=selection), fixture_repo("hook-ownership.sh", "regular", write=True) as repo:
+                with Repo(repo.git_dir) as metadata:
+                    index = metadata.index
+                    baseline = Git(metadata.working_dir)
+                    metadata.git.version_info
+                    environment = {"GIT_DIR": ".git"} if selection == "environment" else {}
+                    with baseline.custom_environment(**environment), metadata.git.custom_environment(**environment):
+                        for command in (baseline, metadata.git):
+                            if selection == "one-shot":
+                                command(C=".git")
+                            elif selection == "persistent":
+                                command.set_persistent_git_options(C=".git")
+                            elif selection == "git-dir-option":
+                                command(git_dir=".git")
+                        output = Path(repo.git_dir if selection in ("one-shot", "persistent") else repo.working_dir)
+                        output /= "output.txt"
+                        baseline.hook("run", "pre-commit")
+                        expected = output.read_text(encoding="utf-8")
+                        output.unlink()
+                        run_commit_hook("pre-commit", index)
+                        self.assertEqual(output.read_text(encoding="utf-8"), expected)
+
+                    metadata.git.set_persistent_git_options()
+                    metadata.git(C="missing")
+                    with self.assertRaises(GitCommandError):
+                        run_commit_hook("pre-commit", index)
+                    self.assertEqual(metadata.git.rev_parse("--git-dir"), str(metadata.git_dir))
+
     def test_pre_commit_hook_fail(self):
         with fixture_repo("index.sh", "hook-fail", write=True) as repo:
             with self.assertRaises(HookExecutionError) as caught:

tests/fixtures/hook-ownership.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -eu
+
+case "$1" in
+    bare)
+        git init --bare --initial-branch=master repo
+        hooks=repo/hooks
+        ;;
+    linked)
+        git init --initial-branch=master main
+        git -C main -c commit.gpgsign=false commit --allow-empty -m initial
+        git -C main worktree add -b linked ../repo
+        hooks=main/.git/hooks
+        ;;
+    separate)
+        git init --initial-branch=master --separate-git-dir=metadata repo
+        printf 'gitdir: ../metadata\n' >repo/.git
+        hooks=metadata/hooks
+        ;;
+    configured)
+        git init --initial-branch=master repo
+        git -C repo config core.worktree ../repo
+        mv repo/.git metadata
+        hooks=metadata/hooks
+        ;;
+    regular)
+        git init --initial-branch=master repo
+        hooks=repo/.git/hooks
+        ;;
+    *) exit 1 ;;
+esac
+printf "#!/usr/bin/env sh\necho 'ran hook' >output.txt\n" >"$hooks/pre-commit"
+chmod +x "$hooks/pre-commit"