fix(remote): reject option-shaped update targets

`Remote.update()` also crosses an internal Git command boundary: Git's
`remote update` parses options, then forwards the remaining operands to
`fetch --multiple` without an option terminator. A leading-dash remote
name can therefore change the requested operation or its target set.

Reject such names before dispatch. Document at `_call_process()` why
high-level wrappers must protect operands, while the low-level runner
must continue supporting deliberately positional options. Shell quoting
does not affect Git's own option parsing. Add an unreleased changelog entry.

Git reference: `builtin/remote.c:update()` at Git commit
`12cb6293d6288865c1a133cf22accbaf99d13eb6` constructs the internal fetch
command without preserving `--`.

Validation: three new rejection cases failed before the fix. Positional,
remote, and command tests pass 160 cases with one skip, excluding the
previously reproduced baseline fetch failure in `TestRemote.test_base`.
Ruff 0.16.5 lint and formatting checks pass for all eight changed Python
files, and `git diff --check` passes.

Author: codex

doc/source/changes.rst

@@ -16,6 +16,9 @@ Unreleased
 * Preserve leading-dash filenames in ``IndexFile.move()`` and ``Repo.ignored()``.
   Move operands can no longer enable overwrites or disable ``dry_run=True``.
 
+* Reject option-shaped remote names in ``Remote.update()`` before Git can
+  interpret them as options to an internal fetch.
+
 3.1.63
 ======
 

git/cmd.py

@@ -1795,6 +1795,12 @@ def _call_process(
             This allows your commands to call git more conveniently, as ``None`` is
             realized as non-existent.
 
+            Positional arguments may intentionally contain command options. Higher-level
+            APIs must separate their operands with ``--`` where the Git command supports
+            it, or reject option-shaped operands where Git reparses them internally (for
+            example, ``pull`` and ``remote update``). Shell quoting cannot prevent Git
+            from interpreting a leading-dash argument as an option.
+
         :param kwargs:
             Contains key-values for the following:
 

git/remote.py

@@ -871,6 +871,9 @@ def update(self, **kwargs: Any) -> "Remote":
         :return:
             self
         """
+        # Like pull, remote update forwards operands to fetch without `--`.
+        if self.name.startswith("-"):
+            raise UnsafeOptionError("Remote names used by update must not start with '-'.")
         scmd = "update"
         kwargs["insert_kwargs_after"] = scmd
         self.repo.git.remote(scmd, self.name, **kwargs)

test/test_positional_args.py

@@ -118,3 +118,12 @@ def test_move_cannot_override_dry_run(tmp_path):
         repo.index.move(["--no-dry-run", "source", "destination"], dry_run=True)
     assert (tmp_path / "source").read_text() == "source"
     assert not (tmp_path / "destination").exists()
+
+
+@pytest.mark.parametrize("name", ["--prune", "--all", "--upload-pack=helper"])
+def test_remote_update_rejects_option_shaped_name(tmp_path, name):
+    repo = Repo.init(tmp_path)
+    with mock.patch.object(Git, "_call_process", side_effect=AssertionError("Git must not run")) as run:
+        with pytest.raises(UnsafeOptionError):
+            Remote(repo, name).update()
+        run.assert_not_called()