fix: validate object types when loading binary SHAs

[Byron]

Tasks

This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.

• refackiew

---

Everything below this line was generated by Codex GPT-6.

Created by Codex on behalf of Byron. Byron will review before this is ready to merge.

Fixes #2254.

Commit(repo, tag.binsha).tree now raises a ValueError identifying the SHA, its actual type, and the expected type before parsing tag data as a commit. The shared check also covers trees, tags, blobs, object size/streams, and raw tree traversal. Validation happens on first data access, preserving lazy constructors and placeholder objects. Rejected streams are drained so subsequent git cat-file reads remain usable even while an exception retains its traceback.

The related audit found two more cases: IndexFile.new() converted binary SHAs to their Python string representation, and submodule diffs wrapped commit SHAs in Blob objects. Index creation now accepts binary SHAs and hexadecimal bytes alongside strings and trees; submodule diffs use IndexObject entries while retaining access to the submodule's commit data.

Existing object, index, and submodule diff tests were extended in place, including mixed binary/hex/tree arguments. No new test functions were added.

Validation:

• 227 affected tests passed, with 2 skips, across the suite run and the staged-file test's rerun with init.defaultBranch=master. Commit signing was disabled only for test commands.
• The extended object and index tests failed before the fix. The issue reproduction and valid binary-SHA operations were also checked with both GitCmdObjectDB and GitDB.
• Ruff lint/format checks, mypy (46 source files), and basedpyright passed. The now-obsolete index assignment diagnostic was removed from the type-checking baseline.
• Codex review of ca55dbf found no actionable regressions.

Git behavior reference: d38352cd43ab9745686d697872408bc3249a153f in the local Git checkout; the commit, tree, and tag readers check object types before parsing their contents.

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved stream-safety, type-normalization, and added-submodule diff issues require fixes.

Review effort: Lite
Findings: 4 · 1

Open (5)

• Drain unread payload after object type mismatch · New
• Drain OStream after failed object type assertion · New
• Drain rejected GitCmdObjectDB streams before re-raising · New
• Normalize object type representations before comparison · New
• Select submodule repository for added gitlinks · New

What changed in this PR

Adds lazy Git object-type validation, binary SHA support for index creation, and improved submodule diff handling.

Changes:

• Validates object types before parsing or streaming.
• Accepts binary and hexadecimal SHAs in IndexFile.new().
• Uses IndexObject for submodule diff entries and extends tests.

File	Summary
test/​test_index.py	Tests binary SHA and type handling.
test/​test_diff.py	Tests submodule diff behavior.
test/​test_commit.py	Updates commit stream tests.
test/​test_base.py	Tests object validation.
git/​objects/​util.py	Implements shared type checking.
git/​objects/​tree.py	Validates tree loading.
git/​objects/​tag.py	Validates tag loading.
git/​objects/​fun.py	Validates tree traversal.
git/​objects/​commit.py	Validates commit loading.
git/​objects/​base.py	Adds lazy object validation.
git/​index/​base.py	Supports binary SHA inputs.
git/​diff.py	Handles submodule commits as index objects.
.basedpyright/​baseline.json	Removes an obsolete diagnostic.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved object-type, raw tree traversal, and submodule repository-selection issues block approval.

Review effort: Lite
Findings: 1

Open (1)

• Normalize ODB object type before comparing or formatting · New

Resolved since last review (5)

• Normalize object type representations before comparison
• Drain rejected GitCmdObjectDB streams before re-raising
• Drain OStream after failed object type assertion
• Drain unread payload after object type mismatch
• Select submodule repository for added gitlinks

[Copilot]

Copilot review overview

🟡 Changes recommended

Three moderate unresolved issues remain in object validation, tree traversal, and added gitlink handling.

Review effort: Lite
Findings: 2

Open (2)

• Validate binary SHA is a tree before recursive merge traversal · New
• Validate object type before direct commit, tree, and tag parsing · New

Resolved since last review (1)

• Normalize ODB object type before comparing or formatting