code-foundry 1.39.1 → 1.39.2

package/.githooks/pre-commit

@@ -1,4 +1,13 @@
 #!/usr/bin/env sh
+# Generated by Code Foundry — see src/commands/sync.mjs.
 set -eu
 
+if [ -z "$(git diff --cached --name-only)" ]; then
+  exit 0
+fi
+
+if command -v npx >/dev/null 2>&1 && npx --yes code-foundry@__VERSION__ pre-commit; then
+  exit 0
+fi
+
 git diff --cached --check

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.39.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.39.1...v1.39.2) (2026-10-01)
+
+
+### Bug Fixes
+
+* **hooks:** delegate the generated pre-commit hook to the runtime ([#684](https://github.com/0xPlayerOne/code-foundry/issues/684)) ([5d9a571](https://github.com/0xPlayerOne/code-foundry/commit/5d9a5714aeff0d48397e3be51b22e08395bfb5ce))
+
 ## [1.39.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.39.0...v1.39.1) (2026-10-01)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.39.1",
+  "version": "1.39.2",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/cli.mjs

@@ -271,6 +271,16 @@ async function main() {
     } catch (error) {
       fail(error instanceof Error ? error.message : String(error))
     }
+  } else if (command === 'pre-commit') {
+    // The generated `.githooks/pre-commit` calls this. Without a CLI entry
+    // point the language-aware gate in runtime-core is unreachable from a hook.
+    try {
+      process.chdir(target)
+      const { preCommit } = await import('./runtime-core.mjs')
+      preCommit()
+    } catch (error) {
+      fail(error instanceof Error ? error.message : String(error))
+    }
   } else fail(`unknown command: ${command}`)
 }
 

package/src/commands/doctor.mjs

@@ -40,6 +40,20 @@ export function doctor(root, options = {}) {
   }
   const hooks = git(target, ['config', '--get', 'core.hooksPath'])
   if (hooks !== '.githooks') warn('Git hooks are not enabled; run `npx code-foundry init`')
+  // A correctly enabled hook that enforces nothing is the failure this check
+  // could not see: the generated template used to be the whitespace guard
+  // alone while the real gate sat unused in the runtime. Reading only the
+  // hooksPath reports success for a hook that does nothing.
+  if (hooks === '.githooks') {
+    const hookFile = join(target, '.githooks/pre-commit')
+    if (!existsSync(hookFile)) warn('No .githooks/pre-commit found; run `npx code-foundry sync`')
+    else if (
+      !/code-foundry[@\w./-]*\s+(?:--yes\s+)?pre-commit/.test(readFileSync(hookFile, 'utf8'))
+    )
+      warn(
+        '.githooks/pre-commit does not delegate to the Code Foundry gate; run `npx code-foundry sync`'
+      )
+  }
   if (
     ['rust', 'python', 'solidity'].some((language) =>
       profile.languages.split(',').includes(language)

package/src/commands/sync.mjs

@@ -260,6 +260,9 @@ function synchronize(options) {
     if (file === 'LICENSE' && license !== 'preserve' && license !== 'none') continue
     if (file === '.github/CODEOWNERS' && existsSync(destination)) continue
     let content = readFileSync(sourceFile)
+    if (file === '.githooks/pre-commit') {
+      content = Buffer.from(renderHook(sourceFile, source))
+    }
     if (file === 'release-please-config.json') {
       content = Buffer.from(renderReleaseConfig(target, sourceFile))
     }
@@ -586,6 +589,20 @@ function renderReleaseConfig(target, sourceFile) {
   return `${JSON.stringify(mergeReleaseConfig(target, sourceFile), null, 2)}\n`
 }
 
+/**
+ * The hook runs `npx code-foundry@<version>` on every commit, so the version
+ * is substituted at generation time rather than resolved at run time. A
+ * mutable dist-tag there would let any publish under that tag run code on
+ * every developer's machine at commit time; pinning means the gate a
+ * repository received is the gate that generated it.
+ *
+ * @param {string} sourceFile the template path
+ * @param {string} sourceRoot the package root that carries package.json
+ */
+function renderHook(sourceFile, sourceRoot) {
+  return readFileSync(sourceFile, 'utf8').replaceAll('__VERSION__', readPackageVersion(sourceRoot))
+}
+
 /** @param {string} file @param {string} languages @param {string} features @param {Record<string, string>} config */
 function shouldInclude(file, languages, features, config) {
   if (file === 'ruff.toml') return includesValue(languages, 'python')

package/src/runtime-core.mjs

@@ -7,9 +7,11 @@ import {
   mkdirSync,
   readdirSync,
   readFileSync,
+  realpathSync,
   writeFileSync,
 } from 'node:fs'
 import { resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
 import { spawnSync } from 'node:child_process'
 import { detectPackageManager, resolveProfile } from './lib/profile.mjs'
 import { configured, readConfig } from './lib/config.mjs'
@@ -1165,7 +1167,15 @@ function printProfile(command) {
   writeOutput('npm_publish', config.npm_publish ?? 'false')
 }
 
-function preCommit() {
+/**
+ * The local commit gate.
+ *
+ * Exported so the generated `.githooks/pre-commit` can reach it: the hook is
+ * what turns this into an actual gate, and it used to run the whitespace
+ * check alone. The generated hook is the consumer-visible contract, so keep
+ * the two in step.
+ */
+export function preCommit() {
   const changed = capture('git', ['diff', '--cached', '--name-only'])
   if (!changed) return
   const check = spawnSync('git', ['diff', '--cached', '--check'], { cwd: root, stdio: 'inherit' })
@@ -1173,6 +1183,10 @@ function preCommit() {
   if (/\.(js|jsx|ts|tsx|json|md|mdx|yml|yaml)$/.test(changed)) {
     ci('format')
     ci('lint')
+    // Type errors are the fastest check that still needs a full toolchain, and
+    // the most common reason a green-looking commit fails CI later. Run it
+    // here while the dependency graph is warm.
+    ci('type_check')
   }
   if (/\.rs$|(^|\/)Cargo\.toml$/.test(changed)) {
     run('cargo', ['fmt', '--check'])
@@ -1184,16 +1198,34 @@ function preCommit() {
   }
 }
 
-const [area, task, ecosystem] = process.argv.slice(2)
-try {
-  if (area === 'ci') ci(task)
-  else if (area === 'security') security(task, ecosystem)
-  else if (area === 'codeql') codeql()
-  else if (area === 'profile') printProfile(task)
-  else if (area === 'validation') validation(task)
-  else if (area === 'pre-commit') preCommit()
-  else throw new Error(`Unknown runtime command: ${area || '(missing)'}`)
-} catch (error) {
-  console.error(error instanceof Error ? error.message : String(error))
-  process.exitCode = 1
+// Only dispatch when this module is the process entry point. The CLI imports
+// `preCommit` from here, and an unguarded dispatch would read argv and run the
+// gate a second time on import.
+const invokedDirectly =
+  process.argv[1] !== undefined &&
+  realpathSafe(process.argv[1]) === realpathSafe(fileURLToPath(import.meta.url))
+
+/** @param {string} p @returns {string} */
+function realpathSafe(p) {
+  try {
+    return realpathSync(p)
+  } catch {
+    return p
+  }
+}
+
+if (invokedDirectly) {
+  const [area, task, ecosystem] = process.argv.slice(2)
+  try {
+    if (area === 'ci') ci(task)
+    else if (area === 'security') security(task, ecosystem)
+    else if (area === 'codeql') codeql()
+    else if (area === 'profile') printProfile(task)
+    else if (area === 'validation') validation(task)
+    else if (area === 'pre-commit') preCommit()
+    else throw new Error(`Unknown runtime command: ${area || '(missing)'}`)
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error))
+    process.exitCode = 1
+  }
 }

package/src/templates/gitignore

@@ -72,6 +72,9 @@ pnpm-debug.log*
 .fleet/
 .opencode/
 .kluster/
+.zcode/
+.kiro/
+.goose/
 .direnv/
 .envrc
 .vercel/