Install hooks by copying into .git/hooks instead of core.hooksPath

Linking core.hooksPath to the tracked, sandbox-writable .githooks/ let a
sandboxed command rewrite a hook that git commit/push then run unsandboxed.
Copies in .git/hooks can't be changed from the sandbox. This also keeps
existing .git/hooks scripts working and lets npm install succeed outside a
git checkout. pre-merge-commit now names itself in errors; hook tests clean
up, ignore GIT_* env and cover the installer; docs state what each layer
does and doesn't stop.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/hooks.test.js

@@ -1,28 +1,37 @@
-import { test } from "node:test";
+import { test, after } from "node:test";
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
-import { mkdtempSync } from "node:fs";
+import { mkdtempSync, rmSync, cpSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 
-const HOOKS = fileURLToPath(new URL("../.githooks/", import.meta.url));
+const ROOT = fileURLToPath(new URL("../", import.meta.url));
+const HOOKS = join(ROOT, ".githooks");
 const SHA = "1".repeat(40);
 const ZERO = "0".repeat(40);
 
-function prePush(...lines) {
-  return spawnSync("sh", [join(HOOKS, "pre-push"), "origin", "git@example:repo.git"], {
-    input: lines.map((l) => l + "\n").join(""),
-    encoding: "utf8",
-  });
-}
+// Run git and the hooks without inheriting GIT_DIR & co, e.g. when tests run from inside a hook.
+const env = Object.fromEntries(Object.entries(process.env).filter(([k]) => !k.startsWith("GIT_")));
+const run = (cmd, args, opts = {}) => spawnSync(cmd, args, { env, encoding: "utf8", ...opts });
+
+const dirs = [];
+after(() => dirs.forEach((d) => rmSync(d, { recursive: true, force: true })));
 
 function repoOn(branch) {
   const dir = mkdtempSync(join(tmpdir(), "todo-hooks-"));
-  spawnSync("git", ["init", "-q", "-b", branch, dir]);
+  dirs.push(dir);
+  const init = run("git", ["init", "-q", "-b", branch, dir]);
+  assert.equal(init.status, 0, `git init failed: ${init.stderr}`);
   return dir;
 }
 
+function prePush(...lines) {
+  return run("sh", [join(HOOKS, "pre-push"), "origin", "git@example:repo.git"], {
+    input: lines.map((l) => l + "\n").join(""),
+  });
+}
+
 for (const [label, line] of [
   ["an update", `refs/heads/fix/x ${SHA} refs/heads/main ${SHA}`],
   ["a new ref", `refs/heads/fix/x ${SHA} refs/heads/main ${ZERO}`],
@@ -46,10 +55,30 @@ test("pre-push allows other branches, including ones named like main", () => {
 });
 
 for (const hook of ["pre-commit", "pre-merge-commit"]) {
-  test(`${hook} rejects main and allows other branches`, () => {
-    const onMain = spawnSync("sh", [join(HOOKS, hook)], { cwd: repoOn("main"), encoding: "utf8" });
+  test(`${hook} rejects main, names itself, and allows other branches`, () => {
+    const onMain = run("sh", [join(HOOKS, hook)], { cwd: repoOn("main") });
     assert.equal(onMain.status, 1);
-    assert.match(onMain.stderr, /committing on main is not allowed/);
-    assert.equal(spawnSync("sh", [join(HOOKS, hook)], { cwd: repoOn("fix/x") }).status, 0);
+    assert.match(onMain.stderr, new RegExp(`^${hook}: committing on main is not allowed`));
+    assert.equal(run("sh", [join(HOOKS, hook)], { cwd: repoOn("fix/x") }).status, 0);
   });
 }
+
+test("install-hooks copies every hook into .git/hooks as an executable", () => {
+  const repo = repoOn("fix/x");
+  cpSync(join(ROOT, "scripts"), join(repo, "scripts"), { recursive: true });
+  cpSync(HOOKS, join(repo, ".githooks"), { recursive: true });
+  const res = run("sh", [join(repo, "scripts", "install-hooks.sh")]);
+  assert.equal(res.status, 0, res.stderr);
+  for (const hook of ["pre-push", "pre-commit", "pre-merge-commit"]) {
+    assert.ok(statSync(join(repo, ".git", "hooks", hook)).mode & 0o100, `${hook} is not executable`);
+  }
+});
+
+test("install-hooks skips cleanly outside a git checkout", () => {
+  const dir = mkdtempSync(join(tmpdir(), "todo-hooks-"));
+  dirs.push(dir);
+  cpSync(join(ROOT, "scripts"), join(dir, "scripts"), { recursive: true });
+  const res = run("sh", [join(dir, "scripts", "install-hooks.sh")], { env: { ...env, GIT_CEILING_DIRECTORIES: tmpdir() } });
+  assert.equal(res.status, 0);
+  assert.match(res.stderr, /not a git checkout; skipping/);
+});