[PATCH] promisor-remote: fix crash without a repository

[Christian Couder <christian.couder@gmail.com>]

When `git ls-remote` is run outside a repo with some promisor remote
related config options that make it write to its config, namely:

  - "promisor.acceptFromServerUrl", which makes it auto-create a
    remote, or
  - "promisor.acceptFromServer" with "promisor.storeFields", which
    makes it store fields,

it crashes in configure_auto_promisor_remote() or store_one_field(), as
the `repo` argument passed to these functions has its `gitdir` member
set to NULL.

This has been happening since 3e20258d11 (promisor-remote: allow a
client to store fields, 2026-02-16) for the `storeFields` case, and
since 7a56394fc6 (promisor-remote: auto-configure unknown remotes,
2026-05-27) for the auto-creation case.

Let's fix that by checking if `repo->gitdir` is NULL at the beginning
of filter_promisor_remote() and returning from it right away in that
case. It doesn't make sense to further process the promisor remote
advertisement as `git ls-remote` currently has no use for promisor
remotes anyway.

Note that `git ls-remote` seems to be the only command that can run
outside a repo and still process the "promisor-remote" capability
advertised by the server, as sending the `ls-refs` protocol v2
command makes it call send_capabilities(), which processes that
advertisement.

Let's also add tests in t5710 for both cases where a crash happened.

Signed-off-by: Christian Couder <christian.couder@gmail.com>
---

This is a fix for another bug found during the NVIDIA hackathon
following the Gerrit User Summit 2026.

 promisor-remote.c                     |  7 +++++-
 t/t5710-promisor-remote-capability.sh | 31 +++++++++++++++++++++++++++
 2 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/promisor-remote.c b/promisor-remote.c
index 316d9950aa..9c405847bb 100644
--- a/promisor-remote.c
+++ b/promisor-remote.c
@@ -1310,9 +1310,14 @@ static void filter_promisor_remote(struct repository *repo,
 	struct store_info *store_info = NULL;
 	struct string_list_item *item;
 	bool reload_config = false;
-	enum accept_promisor accept = accept_from_server(repo);
+	enum accept_promisor accept;
 	struct string_list accept_urls = STRING_LIST_INIT_DUP;
 
+	if (!repo->gitdir)
+		return;
+
+	accept = accept_from_server(repo);
+
 	/* Load and validate the acceptFromServerUrl config */
 	load_accept_from_server_url(repo, &accept_urls);
 
diff --git a/t/t5710-promisor-remote-capability.sh b/t/t5710-promisor-remote-capability.sh
index 463e9e00b0..50a73ec8b0 100755
--- a/t/t5710-promisor-remote-capability.sh
+++ b/t/t5710-promisor-remote-capability.sh
@@ -813,6 +813,37 @@ test_expect_success "clone with invalid promisor.acceptFromServerUrl" '
 	initialize_server 1 "$oid"
 '
 
+test_expect_success "ls-remote without a repo doesn't auto-configure" '
+	git -C server config promisor.advertise true &&
+
+	nongit git -c promisor.acceptFromServerUrl="$ENCODED_TRASH_DIRECTORY_URL/*" \
+		ls-remote "$TRASH_DIRECTORY_URL/server" >out 2>&1 &&
+
+	# Refs are properly listed
+	test_grep "refs/heads/" out &&
+
+	# No remote is configured
+	test_grep ! "Auto-creating" out
+'
+
+test_expect_success "ls-remote without a repo doesn't store fields" '
+	git -C server config promisor.advertise true &&
+	test_config -C server promisor.sendFields token &&
+	test_config -C server remote.lop.token "fooBar" &&
+
+	nongit git -c promisor.acceptFromServer=All \
+		-c promisor.storeFields=token \
+		-c remote.lop.promisor=true \
+		-c remote.lop.url="$TRASH_DIRECTORY_URL/lop" \
+		ls-remote "$TRASH_DIRECTORY_URL/server" >out 2>&1 &&
+
+	# Refs are properly listed
+	test_grep "refs/heads/" out &&
+
+	# No field is stored
+	test_grep ! "Storing new token" out
+'
+
 test_expect_success "clone with promisor.sendFields" '
 	git -C server config promisor.advertise true &&
 	test_when_finished "rm -rf client" &&

base-commit: 1891de46f79dc444a47db1c87bd0c8c76b5463f2
-- 
2.56.0