@skyf0xx/hedgehog 4.2.0 → 4.2.2

package/README.md

@@ -68,6 +68,19 @@ Every dependency is explicit, so Hedgehog knows which tasks can run in parallel.
 
 Agents fan out to give you great outcomes at **faster speeds**.
 
+## Deterministic Code Generation
+
+Where a piece of code has one correct shape, Hedgehog generates it instead of asking the AI to write it freehand.
+
+![Deterministic code generation](https://raw.githubusercontent.com/skyf0xx/hedgehog/master/docs/images/deterministic.png)
+
+- **Generators over freehand**: schemas, boilerplate, and scaffolding come from generators that create the code
+- **Faster**: no reasoning required to produce a known shape
+- **More correct**: the same input always produces the same, tested output
+- **Fewer tokens**: nothing spent generating code that a template already covers
+
+The AI is reserved for the parts a generator can't cover.
+
 ## What Hedgehog builds
 
 ### Full-stack applications
@@ -138,6 +151,13 @@ npx @skyf0xx/hedgehog init
 
 Then open your coding agent and describe what you want to build.
 
+The golden cores print a `pnpm install` step as part of their next steps.
+On a fresh project with no warm pnpm store, that first install can take
+several minutes — it's pulling a full monorepo toolchain (Nx, webpack,
+sass-embedded, Playwright, etc.) and, on first commit, running the commit
+gate against the whole workspace. A quiet stretch of output during that
+step is expected, not a hang.
+
 ### Coding agents
 
 Hedgehog installs for **Claude Code** by default. Add a host flag to

package/bin/cli.mjs

@@ -504,6 +504,18 @@ async function init({ force, core, explicitCore, host = DEFAULT_HOST, hostOnly =
     // runs the whole workspace (see lefthook.yml), so expect it to take
     // as long as a full typecheck/lint/test — that is the gate working.
     console.log(`  1. ${bold('pnpm install')}`);
+    console.log(
+      dim('     First run can take several minutes — full dependency install plus'),
+    );
+    console.log(dim('     the commit gate running against the whole workspace. This is'));
+    console.log(dim('     expected; let it finish rather than treating a quiet stretch as stuck.'));
+    console.log(
+      dim('     If an agent is running this: tell the user up front that first install'),
+    );
+    console.log(
+      dim('     can take several minutes and why, then check on progress every ~30s'),
+    );
+    console.log(dim('     instead of polling tightly or narrating the wait.'));
     console.log(`  2. ${bold('git add -A && git commit -m "chore: install Hedgehog"')}`);
     console.log(`  3. Open ${HOSTS[host].label} and describe what you want to build.`);
   } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyf0xx/hedgehog",
-  "version": "4.2.0",
+  "version": "4.2.2",
   "description": "Install the Hedgehog build discipline (agents + skills) into a repo, for Claude Code, Cursor, or Gemini CLI.",
   "type": "module",
   "repository": {
@@ -44,4 +44,4 @@
     "hedgehog"
   ],
   "license": "MIT"
-}
+}

package/src/agents/backend-eng.md

@@ -34,10 +34,19 @@ build exactly what its ALLOWED SCOPE names, one layer at a time, gated by
 Use `nx-run-tasks` (build/lint/test/typecheck), `nx-workspace` (inspecting
 project/target config), `nx-generate` (scaffolding a new library/app), and
 `link-workspace-packages` (wiring a new package into a consumer) as
-needed. A layer's first-arrival package shell (`contract`, `repository`,
-`service`) is a generator call, not a hand-copy of a sibling package —
-`hedgehog-loop`'s "First arrival in a package" section names the exact
-command and tags for each.
+needed.
+
+**Every layer you own starts from its generator in `tools/generators/`** —
+one per layer (`schema`, `contract`, `repository`, `service`,
+`controller`), each landing that layer's package shell, `nx.tags`,
+port-discipline file suffixes, Nest module/controller pair, and barrel
+wiring in one step. The claimed packet's LAYER SHAPE section prints the
+exact command for the layer you're on; `hedgehog-loop`'s "Scaffolding a
+layer" section owns the full flag contract and the workspace wiring a new
+package needs. Generate first, then author this entity's delta — the field
+list and its types, and the business rules below — on top. A hand-copy of
+a sibling module is the drift `hedgehog verify`'s lint step then has to
+catch.
 
 ## Core Responsibilities
 
@@ -98,24 +107,29 @@ command and tags for each.
    `complete` — no need to re-derive that by hand. Cross-module FK
    targets should already have their own schema landed (the packet's
    dependencies guarantee this); check before writing the FK column.
-2. Build exactly one layer, matching the packet's ALLOWED SCOPE. Run
-   typecheck, lint, and test yourself as a sanity check before reporting
-   back — necessary, not sufficient. If this layer also has to create the
-   package it lands in (the first module through `contract` creates
-   `packages/contracts`), its shell files sit outside the packet's ALLOWED
-   SCOPE and `hedgehog verify` will leave them uncommitted — stop and say
-   so before building, so the scope can be widened for this one task
+2. Build exactly one layer, matching the packet's ALLOWED SCOPE: run its
+   generator, then author this entity's delta. Run typecheck, lint, and
+   test yourself as a sanity check before reporting back — necessary, not
+   sufficient. If this layer also has to create the package it lands in
+   (the first module through `contract` creates `packages/contracts`), the
+   shell files its generator lands sit outside the packet's ALLOWED SCOPE
+   and `hedgehog verify` will leave them uncommitted — stop and say so
+   before building, so the scope can be widened for this one task
    (`hedgehog-loop`, "First arrival in a package"). Don't build against a
-   scope you already know won't commit your work. That section also owns
-   the workspace wiring a new package needs (`pnpm install`, `pnpm nx
-   sync`, and its own `chore(workspace):` commit) — follow it rather than
-   leaving the package unlinked for a later layer to trip over.
+   scope you already know won't commit your work. If the layer wires a new
+   or newly-linked package into the workspace, run `pnpm install` and
+   `pnpm nx sync` yourself (`hedgehog-loop`, "Scaffolding a layer") and
+   name the shared files that changed (typically `pnpm-lock.yaml`, root
+   `tsconfig.json`) in your report — the orchestrating session commits
+   them separately, since you report but never commit (next step).
 3. **Report the work as done; do not commit it yourself.** Per the build
    graph's design, an agent reporting success never moves a task — only
    `hedgehog verify <task-id>`'s passing exit code does. It checks your
    changes against the packet's ALLOWED SCOPE, re-runs the real
    verification command, and on a pass writes the commit (the packet's
-   exact Conventional Commit message) itself.
+   exact Conventional Commit message) itself. Any shared workspace files
+   you flagged in step 2 are a separate commit the orchestrating session
+   makes before dispatching `hedgehog verify`, not something you commit.
 4. One layer at a time — never start the next layer before
    `hedgehog verify` reports the current one `complete`.
 5. Once `hedgehog verify` reports the `controller` layer (and any bundled

package/src/agents/front-end-eng.md

@@ -32,9 +32,20 @@ before the next starts.
 Use `nx-run-tasks` (build/lint/test/typecheck), `nx-workspace` (inspecting
 project/target config), `nx-generate` (scaffolding a new library/app), and
 `link-workspace-packages` (wiring a new package into a consumer) as
-needed. The `hook` layer's first-arrival package shell is a generator
-call, not a hand-copy of a sibling package — `hedgehog-loop`'s "First
-arrival in a package" section names the exact command and tags.
+needed.
+
+**Both layers you own start from their generator in `tools/generators/`** —
+`hook` lands `packages/hooks`'s shell, `nx.tags`, the query hook set, and
+its barrel wiring; `screen` lands the route, the screen component wired to
+that hook, and its test file. The claimed packet's LAYER SHAPE section
+prints the exact command for the layer you're on; `hedgehog-loop`'s
+"Scaffolding a layer" section owns the full flag contract and the
+workspace wiring a new package needs. Generate first, then author this
+entity's delta on top. The `screen` generator is skeleton-only by
+design — placeholders for the list, filter shell, empty state, and form,
+with layout, information hierarchy, and interaction pattern left to
+`ux-planner`'s rationale and your build, so no two modules' screens come
+out identical before anyone decided they should.
 
 If the screen step calls for animation or motion — entrances, sequencing,
 scroll-driven effects, drag, SVG/morph effects — use GSAP, loading the
@@ -93,18 +104,24 @@ don't reach for a second one.
    no such confirmation, stop — you're being asked to build Phase B
    early.
 2. Build the hook against the contract client, matching the packet's
-   ALLOWED SCOPE. Run typecheck, lint, and test yourself as a sanity
-   check before reporting back — necessary, not sufficient. On the first
-   module through this layer, the hook also creates `packages/hooks`, and
-   that package's shell sits outside the packet's ALLOWED SCOPE —
-   `hedgehog verify` would leave it uncommitted. Stop and say so before
-   building, so the scope can be widened for this one task
-   (`hedgehog-loop`, "First arrival in a package") — that section also
-   owns the workspace wiring the new package needs.
+   ALLOWED SCOPE: run its generator, then author this entity's delta. Run
+   typecheck, lint, and test yourself as a sanity check before reporting
+   back — necessary, not sufficient. On the first module through this
+   layer, the hook also creates `packages/hooks`, and that package's shell
+   sits outside the packet's ALLOWED SCOPE — `hedgehog verify` would leave
+   it uncommitted. Stop and say so before building, so the scope can be
+   widened for this one task (`hedgehog-loop`, "First arrival in a
+   package"); run `pnpm install` and `pnpm nx sync` yourself
+   (`hedgehog-loop`, "Scaffolding a layer") to wire the new package into
+   the workspace, and name the shared files that changed (typically
+   `pnpm-lock.yaml`, root `tsconfig.json`) in your report — the
+   orchestrating session commits them separately (next step).
 3. **Report the work as done; do not commit it yourself.** Only
    `hedgehog verify <task-id>`'s passing exit code moves the task to
    `complete` and writes the commit (the packet's exact Conventional
-   Commit message).
+   Commit message). Any shared workspace files you flagged in step 2 are a
+   separate commit the orchestrating session makes before dispatching
+   `hedgehog verify`, not something you commit.
 4. Build the screen consuming the hook the same way — packet, build,
    report, `hedgehog verify`.
 5. One layer at a time — `hook` fully `complete` before the `screen`

package/src/db/next.mjs

@@ -241,14 +241,50 @@ export function taskStatusLine(task) {
 // — printing it in the packet turns that failure into a pre-flight fact
 // instead of something `nx lint` teaches the agent after the fact. Keyed
 // by layer id, not module, since the shape is the same for every module.
+//
+// `scaffold` is the same kind of fact one step earlier: the generator in
+// `tools/generators/` every layer starts from (hedgehog-loop, "Scaffolding
+// a layer", which owns the flag contract these lines instantiate). It sits
+// here rather than in RELEVANT RULES because that section is per-intent —
+// identical across every layer of an intent, by plan.mjs's requirement
+// linkage — while the command differs per layer, which is exactly what
+// LAYER SHAPE already keys on.
 const FULL_STACK_APP_LAYER_TAGS = {
-  schema: { tags: ['scope:db', 'type:adapter'], dependsOnTags: [] },
-  contract: { tags: ['scope:contracts', 'type:contract'], dependsOnTags: ['type:adapter', 'type:util'] },
-  repository: { tags: ['scope:{module}', 'type:adapter'], dependsOnTags: ['type:adapter', 'type:contract', 'type:util'] },
-  service: { tags: ['scope:{module}', 'type:service'], dependsOnTags: ['type:adapter', 'type:contract', 'type:util'] },
-  controller: { tags: ['scope:api'], dependsOnTags: ['type:adapter', 'type:service', 'type:contract', 'type:util'] },
-  hook: { tags: ['scope:hooks', 'type:hook'], dependsOnTags: ['type:contract', 'type:util'] },
-  screen: { tags: ['scope:web'], dependsOnTags: ['scope:contracts', 'scope:hooks', 'scope:shared', 'type:util'] },
+  schema: {
+    tags: ['scope:db', 'type:adapter'],
+    dependsOnTags: [],
+    scaffold: "nx g ./tools/generators:schema --module={module} --fields='<name:type,...>'",
+  },
+  contract: {
+    tags: ['scope:contracts', 'type:contract'],
+    dependsOnTags: ['type:adapter', 'type:util'],
+    scaffold: "nx g ./tools/generators:contract --module={module} --fields='<the schema layer's list>'",
+  },
+  repository: {
+    tags: ['scope:{module}', 'type:adapter'],
+    dependsOnTags: ['type:adapter', 'type:contract', 'type:util'],
+    scaffold: 'nx g ./tools/generators:repository --module={module}',
+  },
+  service: {
+    tags: ['scope:{module}', 'type:service'],
+    dependsOnTags: ['type:adapter', 'type:contract', 'type:util'],
+    scaffold: 'nx g ./tools/generators:service --module={module}',
+  },
+  controller: {
+    tags: ['scope:api'],
+    dependsOnTags: ['type:adapter', 'type:service', 'type:contract', 'type:util'],
+    scaffold: "nx g ./tools/generators:controller --module={module} --fields='<the schema layer's list>'",
+  },
+  hook: {
+    tags: ['scope:hooks', 'type:hook'],
+    dependsOnTags: ['type:contract', 'type:util'],
+    scaffold: 'nx g ./tools/generators:hook --module={module} [--toggleField=<boolField>]',
+  },
+  screen: {
+    tags: ['scope:web'],
+    dependsOnTags: ['scope:contracts', 'scope:hooks', 'scope:shared', 'type:util'],
+    scaffold: 'nx g ./tools/generators:screen --module={module}   (skeleton only — UX is yours)',
+  },
 };
 
 // A LAYER SHAPE section for full-stack-app tasks only (`coreId ===
@@ -267,10 +303,12 @@ function layerShapeLines(task, coreId) {
   } else {
     lines.push(`  may depend on tags:     ${shape.dependsOnTags.join(', ')}`);
   }
+  lines.push(`  scaffold from:          ${shape.scaffold.replace('{module}', task.module)}`);
   lines.push(
     "  Confirm against packages/config/eslint-base.js's depConstraints before",
     "  writing an import — a mismatch here is a pre-flight fact, not a lint",
-    '  failure to discover later.',
+    '  failure to discover later. Start from the generator and author only',
+    "  this entity's delta on top of what it lands.",
   );
   return lines;
 }

package/src/golden-cores/full-stack-app/apps/api/package.json

@@ -4,8 +4,25 @@
   "private": true,
   "nx": {
     "targets": {
+      "generate-feature-modules": {
+        "executor": "nx:run-commands",
+        "cache": true,
+        "inputs": [
+          "{projectRoot}/src/app/*/*.module.ts"
+        ],
+        "outputs": [
+          "{projectRoot}/src/app/feature-modules.ts"
+        ],
+        "options": {
+          "command": "node tools/generate-feature-modules.cjs",
+          "cwd": "{workspaceRoot}"
+        }
+      },
       "build": {
         "executor": "nx:run-commands",
+        "dependsOn": [
+          "generate-feature-modules"
+        ],
         "options": {
           "command": "webpack-cli build",
           "env": {
@@ -91,7 +108,8 @@
     "tslib": "^2.3.0",
     "nestjs-pino": "^4.6.1",
     "pino-http": "^11.0.0",
-    "config": "workspace:*"
+    "config": "workspace:*",
+    "db": "workspace:*"
   },
   "devDependencies": {
     "@nestjs/testing": "^11.0.0"

package/src/golden-cores/full-stack-app/apps/api/src/app/app.module.spec.ts

@@ -0,0 +1,15 @@
+import { Test } from '@nestjs/testing';
+import { describe, expect, it } from 'vitest';
+import { AppModule } from './app.module';
+
+describe('AppModule', () => {
+  it('compiles with the health check controller wired', async () => {
+    const moduleRef = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    expect(moduleRef).toBeDefined();
+
+    await moduleRef.close();
+  });
+});

package/src/golden-cores/full-stack-app/apps/api/src/app/app.module.ts

@@ -1,9 +1,14 @@
 import { Module } from '@nestjs/common';
 import { LoggerModule } from 'nestjs-pino';
 import { HealthController } from './health.controller';
+// Generated by tools/generate-feature-modules.cjs (see that file's header)
+// from every apps/api/src/app/*/*.module.ts on disk — never hand-edited,
+// so no domain module's controller task ever edits this file or
+// app.module.ts itself to register.
+import { featureModules } from './feature-modules';
 
 @Module({
-  imports: [LoggerModule.forRoot()],
+  imports: [LoggerModule.forRoot(), ...featureModules],
   controllers: [HealthController],
   providers: [],
 })

package/src/golden-cores/full-stack-app/apps/api/src/app/feature-modules.ts

@@ -0,0 +1,8 @@
+// GENERATED FILE — do not hand-edit. Regenerated by
+// tools/generate-feature-modules.cjs (the generate-feature-modules Nx
+// target, which test and build depend on) from every
+// apps/api/src/app/*/*.module.ts file on disk. A module directory's
+// controller layer only ever creates its own *.module.ts inside its own
+// directory — never edits this file.
+
+export const featureModules = [];

package/src/golden-cores/full-stack-app/apps/api/tsconfig.app.json

@@ -14,6 +14,9 @@
   "references": [
     {
       "path": "../../packages/config/tsconfig.lib.json"
+    },
+    {
+      "path": "../../packages/db/tsconfig.lib.json"
     }
   ]
 }

package/src/golden-cores/full-stack-app/apps/api/tsconfig.json

@@ -5,6 +5,9 @@
   "references": [
     {
       "path": "./tsconfig.app.json"
+    },
+    {
+      "path": "./tsconfig.spec.json"
     }
   ]
 }

package/src/golden-cores/full-stack-app/apps/api/tsconfig.spec.json

@@ -0,0 +1,36 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "./out-tsc/vitest",
+    "types": [
+      "vitest/globals",
+      "vitest/importMeta",
+      "vite/client",
+      "node",
+      "vitest"
+    ],
+    "experimentalDecorators": true,
+    "emitDecoratorMetadata": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": [
+    "vite.config.ts",
+    "vite.config.mts",
+    "vitest.config.ts",
+    "vitest.config.mts",
+    "src/**/*.test.ts",
+    "src/**/*.spec.ts",
+    "src/**/*.test.tsx",
+    "src/**/*.spec.tsx",
+    "src/**/*.test.js",
+    "src/**/*.spec.js",
+    "src/**/*.test.jsx",
+    "src/**/*.spec.jsx",
+    "src/**/*.d.ts"
+  ],
+  "references": [
+    {
+      "path": "./tsconfig.app.json"
+    }
+  ]
+}

package/src/golden-cores/full-stack-app/apps/api/vitest.config.mts

@@ -0,0 +1,18 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig(() => ({
+  root: __dirname,
+  cacheDir: '../../node_modules/.vite/apps/api',
+  test: {
+    name: 'api',
+    watch: false,
+    globals: true,
+    environment: 'node',
+    include: ['{src,tests}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
+    reporters: ['default'],
+    coverage: {
+      reportsDirectory: './test-output/vitest/coverage',
+      provider: 'v8' as const,
+    },
+  },
+}));

package/src/golden-cores/full-stack-app/apps/web/src/components/theme-toggle.spec.tsx

@@ -0,0 +1,20 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, expect, it } from 'vitest';
+import { ThemeToggle } from './theme-toggle';
+
+describe('ThemeToggle', () => {
+  it('renders a toggle button and flips the document theme class on click', async () => {
+    const user = userEvent.setup();
+    render(<ThemeToggle />);
+
+    const toggle = screen.getByRole('button', { name: /toggle theme/i });
+    expect(toggle).toBeInTheDocument();
+
+    await user.click(toggle);
+    expect(document.documentElement.classList.contains('dark')).toBe(true);
+
+    await user.click(toggle);
+    expect(document.documentElement.classList.contains('dark')).toBe(false);
+  });
+});

package/src/golden-cores/full-stack-app/apps/web/src/test-setup.ts

@@ -0,0 +1 @@
+import '@testing-library/jest-dom/vitest';

package/src/golden-cores/full-stack-app/apps/web/tsconfig.json

@@ -41,8 +41,11 @@
     "node_modules",
     "jest.config.ts",
     "jest.config.cts",
+    "src/test-setup.ts",
     "src/**/*.spec.ts",
     "src/**/*.test.ts",
+    "src/**/*.spec.tsx",
+    "src/**/*.test.tsx",
     ".next",
     "eslint.config.js",
     "eslint.config.cjs",
@@ -51,6 +54,9 @@
   "references": [
     {
       "path": "../../packages/config"
+    },
+    {
+      "path": "./tsconfig.spec.json"
     }
   ]
 }

package/src/golden-cores/full-stack-app/apps/web/tsconfig.spec.json

@@ -0,0 +1,37 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "./out-tsc/vitest",
+    "jsx": "preserve",
+    "types": [
+      "vitest/globals",
+      "vitest/importMeta",
+      "vite/client",
+      "node",
+      "vitest",
+      "@testing-library/jest-dom"
+    ],
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": [
+    "vite.config.ts",
+    "vite.config.mts",
+    "vitest.config.ts",
+    "vitest.config.mts",
+    "src/test-setup.ts",
+    "src/**/*.test.ts",
+    "src/**/*.spec.ts",
+    "src/**/*.test.tsx",
+    "src/**/*.spec.tsx",
+    "src/**/*.test.js",
+    "src/**/*.spec.js",
+    "src/**/*.test.jsx",
+    "src/**/*.spec.jsx",
+    "src/**/*.d.ts"
+  ],
+  "references": [
+    {
+      "path": "../../packages/config"
+    }
+  ]
+}

package/src/golden-cores/full-stack-app/apps/web/vitest.config.mts

@@ -0,0 +1,27 @@
+import { defineConfig } from 'vitest/config';
+import react from '@vitejs/plugin-react';
+import { fileURLToPath } from 'node:url';
+
+export default defineConfig(() => ({
+  root: __dirname,
+  cacheDir: '../../node_modules/.vite/apps/web',
+  plugins: [react()],
+  resolve: {
+    alias: {
+      '@': fileURLToPath(new URL('./src', import.meta.url)),
+    },
+  },
+  test: {
+    name: 'web',
+    watch: false,
+    globals: true,
+    environment: 'jsdom',
+    setupFiles: ['./src/test-setup.ts'],
+    include: ['{src,tests}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
+    reporters: ['default'],
+    coverage: {
+      reportsDirectory: './test-output/vitest/coverage',
+      provider: 'v8' as const,
+    },
+  },
+}));

package/src/golden-cores/full-stack-app/nx.json

@@ -6,7 +6,10 @@
     },
     "test": {
       "cache": true,
-      "dependsOn": ["^build"]
+      "dependsOn": ["^build", "generate-feature-modules"]
+    },
+    "typecheck": {
+      "dependsOn": ["generate-feature-modules"]
     },
     "lint": {
       "cache": true

package/src/golden-cores/full-stack-app/package.json

@@ -29,12 +29,16 @@
     "@swc/cli": "~0.8.1",
     "@swc/core": "~1.15.5",
     "@swc/helpers": "~0.5.18",
+    "@testing-library/jest-dom": "^7.0.1",
+    "@testing-library/react": "^16.3.2",
+    "@testing-library/user-event": "^14.6.4",
     "@types/node": "^22.0.0",
     "@types/pg": "^8.20.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@typescript-eslint/eslint-plugin": "^8.65.0",
     "@typescript-eslint/parser": "^8.65.0",
+    "@vitejs/plugin-react": "^6.0.5",
     "@vitest/coverage-v8": "~4.1.0",
     "drizzle-kit": "^0.31.10",
     "drizzle-zod": "^0.8.3",
@@ -45,6 +49,7 @@
     "eslint-plugin-playwright": "^1.6.2",
     "eslint-plugin-react": "^7.35.0",
     "eslint-plugin-react-hooks": "5.0.0",
+    "jsdom": "^30.0.1",
     "lefthook": "^2.1.10",
     "nx": "23.1.0",
     "prettier": "~3.6.2",
@@ -74,6 +79,9 @@
     "zod": "^4.4.3"
   },
   "pnpm": {
+    "onlyBuiltDependencies": [
+      "lefthook"
+    ],
     "overrides": {
       "esbuild": "0.25.12",
       "axios": "^1.18.0",