fix(hlcc): persist sandbox-compatible shared mode

server-tools/hololake-code-channel/jd-candidate/hlcc-bootstrap.py

@@ -482,8 +482,9 @@ def seed_fifth_domain_channel(binary: pathlib.Path) -> str:
 
 def configure_shared_channel_repository(
     repository: pathlib.Path = CHANNEL_REPOSITORY_PATH,
+    generated_hook: pathlib.Path | None = None,
 ) -> str:
-    """Use Git's native shared-repository mode instead of a post-receive chmod."""
+    """Use sandbox-compatible native sharing instead of post-receive chmod."""
     if not repository.is_dir():
         raise RuntimeError("channel repository path unavailable")
 
@@ -494,7 +495,7 @@ def configure_shared_channel_repository(
             str(repository),
             "config",
             "core.sharedRepository",
-            "group",
+            "0660",
         ],
         check=True,
         capture_output=True,
@@ -513,7 +514,7 @@ def configure_shared_channel_repository(
         capture_output=True,
         text=True,
     ).stdout.strip()
-    if configured not in {"1", "group"}:
+    if configured != "0660":
         raise RuntimeError("shared repository configuration verification failed")
 
     obsolete_hook = (
@@ -530,6 +531,23 @@ def configure_shared_channel_repository(
             raise RuntimeError("obsolete sharing hook identity mismatch")
         obsolete_hook.unlink()
 
+    generated_hook = generated_hook or (
+        STATE_ROOT / "data" / "data" / "home" / "hooks" / "post-receive"
+    )
+    if not generated_hook.is_file() or generated_hook.is_symlink():
+        raise RuntimeError("generated post-receive hook path unavailable")
+    generated_text = generated_hook.read_text(encoding="utf-8")
+    unsafe_test = 'if [ $(basename "${hook}") != "gitea" ]; then'
+    safe_test = 'if [ "$(basename "${hook}")" != "gitea" ]; then'
+    if unsafe_test in generated_text:
+        generated_hook.write_text(
+            generated_text.replace(unsafe_test, safe_test, 1),
+            encoding="utf-8",
+        )
+        generated_hook.chmod(0o700)
+    elif safe_test not in generated_text:
+        raise RuntimeError("generated post-receive hook identity mismatch")
+
     return "configured"