fix: harden fish gtrconfig trust helpers

Author: helizaga

lib/commands/init.sh

@@ -182,14 +182,15 @@ end
 
 function __FUNC___hooks_current_content_hash
   set -l _gtr_config_file "$argv[1]"
-  set -l _gtr_hook_defs (git config -f "$_gtr_config_file" --get-regexp '^hooks\.|^defaults\.editor$|^defaults\.ai$' 2>/dev/null)
-  test $status -eq 0; or return 1
-  printf '%s\n' "$_gtr_hook_defs" | shasum -a 256 | cut -d' ' -f1
+  set -l _gtr_hook_defs (git config -f "$_gtr_config_file" --get-regexp '^hooks\.|^defaults\.editor$|^defaults\.ai$' 2>/dev/null | shasum -a 256 | cut -d' ' -f1)
+  test $pipestatus[1] -eq 0; or return 1
+  test -n "$_gtr_hook_defs"; or return 1
+  printf '%s\n' "$_gtr_hook_defs"
 end
 
 function __FUNC___hooks_repo_root
   set -l _gtr_config_file "$argv[1]"
-  cd (dirname "$_gtr_config_file") 2>/dev/null; and pwd -P
+  command sh -c 'cd "$1" 2>/dev/null && pwd -P' sh (dirname "$_gtr_config_file")
 end
 
 function __FUNC___hooks_canonical_config_path

tests/init.bats

@@ -110,6 +110,71 @@ printf '\n'
 SCRIPT
 }
 
+run_generated_fish_gtrconfig_post_cd_hooks() {
+  local trust_state="$1"
+  local root repo wt xdg init_file
+
+  root=$(mktemp -d)
+  repo="$root/repo"
+  wt="$root/wt"
+  xdg="$root/xdg"
+  init_file="$root/gtr.fish"
+
+  git init --quiet "$repo"
+  git -C "$repo" config user.name "Test User"
+  git -C "$repo" config user.email "test@example.com"
+  git -C "$repo" commit --allow-empty -m "init" --quiet
+  git -C "$repo" worktree add --quiet "$wt" -b feature
+
+  cat > "$repo/.gtrconfig" <<'CFG'
+[hooks]
+  postCd = pwd > "$WORKTREE_PATH/hook-pwd"
+  postCd = echo second >> "$WORKTREE_PATH/hook-order"
+[defaults]
+  ai = codex
+CFG
+
+  cmd_init fish > "$init_file"
+
+  if [ "$trust_state" = "trusted" ]; then
+    (
+      export XDG_CONFIG_HOME="$xdg"
+      # shellcheck disable=SC1091
+      . "$PROJECT_ROOT/lib/hooks.sh"
+      _hooks_mark_trusted "$repo/.gtrconfig"
+    )
+  fi
+
+  XDG_CONFIG_HOME="$xdg" fish -c '
+    source "$argv[1]"
+    set -l wt "$argv[2]"
+    set -l root "$argv[3]"
+
+    cd /
+    gtr_run_post_cd_hooks "$wt" > "$root/stdout" 2> "$root/stderr"
+    set -l rc $status
+
+    printf "RC=%s\n" "$rc"
+    printf "PWD=%s\n" "$PWD"
+    printf "WT=%s\n" "$wt"
+    if test -f "$wt/hook-pwd"
+      printf "HOOK_PWD=%s\n" (cat "$wt/hook-pwd")
+    else
+      printf "HOOK_PWD=<missing>\n"
+    end
+    if test -f "$wt/hook-order"
+      printf "HOOK_ORDER=%s\n" (paste -sd, "$wt/hook-order")
+    else
+      printf "HOOK_ORDER=<missing>\n"
+    end
+    printf "STDERR=%s\n" (cat "$root/stderr")
+  ' -- "$init_file" "$wt" "$root"
+  local rc=$?
+
+  rm -rf "$root"
+  return "$rc"
+}
+
 require_runtime_shell() {
   local shell_name="$1"
 
@@ -320,6 +385,41 @@ require_runtime_shell() {
   [ "$output" = "/tmp/repo" ]
 }
 
+@test "fish generated postCd skips untrusted gtrconfig hooks without changing cwd" {
+  require_runtime_shell fish
+
+  run run_generated_fish_gtrconfig_post_cd_hooks untrusted
+
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"RC=0"* ]]
+  [[ "$output" == *"HOOK_PWD=<missing>"* ]]
+  [[ "$output" == *"HOOK_ORDER=<missing>"* ]]
+  [[ "$output" == *"STDERR=gtr: Untrusted .gtrconfig hooks skipped"* ]]
+
+  local pwd_line wt_line
+  pwd_line=$(printf '%s\n' "$output" | sed -n 's/^PWD=//p')
+  wt_line=$(printf '%s\n' "$output" | sed -n 's/^WT=//p')
+  [ "$pwd_line" = "$wt_line" ]
+}
+
+@test "fish generated postCd trusts multi-entry gtrconfig hooks without changing cwd" {
+  require_runtime_shell fish
+
+  run run_generated_fish_gtrconfig_post_cd_hooks trusted
+
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"RC=0"* ]]
+  [[ "$output" == *"HOOK_ORDER=second"* ]]
+  [[ "$output" == *"STDERR="* ]]
+
+  local pwd_line wt_line hook_pwd_line
+  pwd_line=$(printf '%s\n' "$output" | sed -n 's/^PWD=//p')
+  wt_line=$(printf '%s\n' "$output" | sed -n 's/^WT=//p')
+  hook_pwd_line=$(printf '%s\n' "$output" | sed -n 's/^HOOK_PWD=//p')
+  [ "$pwd_line" = "$wt_line" ]
+  [ "$hook_pwd_line" = "$wt_line" ]
+}
+
 # ── new --cd wrapper support ────────────────────────────────────────────────
 
 @test "bash output intercepts new --cd and strips flag before delegating" {