code-foundry 1.39.1 → 1.39.3

package/.githooks/pre-commit

@@ -1,4 +1,20 @@
 #!/usr/bin/env sh
+# Generated by Code Foundry — see src/commands/sync.mjs.
 set -eu
 
+if [ -z "$(git diff --cached --name-only)" ]; then
+  exit 0
+fi
+
+# Prefer a runtime the repository already depends on. A repository opts into
+# the gate by depending on code-foundry; one that does not keeps the
+# whitespace guard and stays offline. Nothing is fetched at commit time.
+if [ -x node_modules/.bin/code-foundry ]; then
+  exec node_modules/.bin/code-foundry pre-commit
+fi
+
+if [ -f src/runtime.mjs ]; then
+  exec node src/runtime.mjs pre-commit
+fi
+
 git diff --cached --check

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.39.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.39.2...v1.39.3) (2026-10-01)
+
+
+### Bug Fixes
+
+* **hooks:** run the gate from a local dependency, not npx ([#688](https://github.com/0xPlayerOne/code-foundry/issues/688)) ([d256b69](https://github.com/0xPlayerOne/code-foundry/commit/d256b69b8f89f0041a01c53cc51af32fe582b5dc))
+
+## [1.39.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.39.1...v1.39.2) (2026-10-01)
+
+
+### Bug Fixes
+
+* **hooks:** delegate the generated pre-commit hook to the runtime ([#684](https://github.com/0xPlayerOne/code-foundry/issues/684)) ([5d9a571](https://github.com/0xPlayerOne/code-foundry/commit/5d9a5714aeff0d48397e3be51b22e08395bfb5ce))
+
 ## [1.39.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.39.0...v1.39.1) (2026-10-01)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.39.1",
+  "version": "1.39.3",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/cli.mjs

@@ -271,6 +271,16 @@ async function main() {
     } catch (error) {
       fail(error instanceof Error ? error.message : String(error))
     }
+  } else if (command === 'pre-commit') {
+    // The generated `.githooks/pre-commit` calls this. Without a CLI entry
+    // point the language-aware gate in runtime-core is unreachable from a hook.
+    try {
+      process.chdir(target)
+      const { preCommit } = await import('./runtime-core.mjs')
+      preCommit()
+    } catch (error) {
+      fail(error instanceof Error ? error.message : String(error))
+    }
   } else fail(`unknown command: ${command}`)
 }
 

package/src/commands/doctor.mjs

@@ -40,6 +40,20 @@ export function doctor(root, options = {}) {
   }
   const hooks = git(target, ['config', '--get', 'core.hooksPath'])
   if (hooks !== '.githooks') warn('Git hooks are not enabled; run `npx code-foundry init`')
+  // A correctly enabled hook that enforces nothing is the failure this check
+  // could not see: the generated template used to be the whitespace guard
+  // alone while the real gate sat unused in the runtime. Reading only the
+  // hooksPath reports success for a hook that does nothing.
+  if (hooks === '.githooks') {
+    const hookFile = join(target, '.githooks/pre-commit')
+    if (!existsSync(hookFile)) warn('No .githooks/pre-commit found; run `npx code-foundry sync`')
+    else if (
+      !/code-foundry[@\w./-]*\s+(?:--yes\s+)?pre-commit/.test(readFileSync(hookFile, 'utf8'))
+    )
+      warn(
+        '.githooks/pre-commit does not delegate to the Code Foundry gate; run `npx code-foundry sync`'
+      )
+  }
   if (
     ['rust', 'python', 'solidity'].some((language) =>
       profile.languages.split(',').includes(language)

package/src/runtime-core.mjs

@@ -7,9 +7,11 @@ import {
   mkdirSync,
   readdirSync,
   readFileSync,
+  realpathSync,
   writeFileSync,
 } from 'node:fs'
 import { resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
 import { spawnSync } from 'node:child_process'
 import { detectPackageManager, resolveProfile } from './lib/profile.mjs'
 import { configured, readConfig } from './lib/config.mjs'
@@ -1165,7 +1167,15 @@ function printProfile(command) {
   writeOutput('npm_publish', config.npm_publish ?? 'false')
 }
 
-function preCommit() {
+/**
+ * The local commit gate.
+ *
+ * Exported so the generated `.githooks/pre-commit` can reach it: the hook is
+ * what turns this into an actual gate, and it used to run the whitespace
+ * check alone. The generated hook is the consumer-visible contract, so keep
+ * the two in step.
+ */
+export function preCommit() {
   const changed = capture('git', ['diff', '--cached', '--name-only'])
   if (!changed) return
   const check = spawnSync('git', ['diff', '--cached', '--check'], { cwd: root, stdio: 'inherit' })
@@ -1173,6 +1183,10 @@ function preCommit() {
   if (/\.(js|jsx|ts|tsx|json|md|mdx|yml|yaml)$/.test(changed)) {
     ci('format')
     ci('lint')
+    // Type errors are the fastest check that still needs a full toolchain, and
+    // the most common reason a green-looking commit fails CI later. Run it
+    // here while the dependency graph is warm.
+    ci('type_check')
   }
   if (/\.rs$|(^|\/)Cargo\.toml$/.test(changed)) {
     run('cargo', ['fmt', '--check'])
@@ -1184,16 +1198,34 @@ function preCommit() {
   }
 }
 
-const [area, task, ecosystem] = process.argv.slice(2)
-try {
-  if (area === 'ci') ci(task)
-  else if (area === 'security') security(task, ecosystem)
-  else if (area === 'codeql') codeql()
-  else if (area === 'profile') printProfile(task)
-  else if (area === 'validation') validation(task)
-  else if (area === 'pre-commit') preCommit()
-  else throw new Error(`Unknown runtime command: ${area || '(missing)'}`)
-} catch (error) {
-  console.error(error instanceof Error ? error.message : String(error))
-  process.exitCode = 1
+// Only dispatch when this module is the process entry point. The CLI imports
+// `preCommit` from here, and an unguarded dispatch would read argv and run the
+// gate a second time on import.
+const invokedDirectly =
+  process.argv[1] !== undefined &&
+  realpathSafe(process.argv[1]) === realpathSafe(fileURLToPath(import.meta.url))
+
+/** @param {string} p @returns {string} */
+function realpathSafe(p) {
+  try {
+    return realpathSync(p)
+  } catch {
+    return p
+  }
+}
+
+if (invokedDirectly) {
+  const [area, task, ecosystem] = process.argv.slice(2)
+  try {
+    if (area === 'ci') ci(task)
+    else if (area === 'security') security(task, ecosystem)
+    else if (area === 'codeql') codeql()
+    else if (area === 'profile') printProfile(task)
+    else if (area === 'validation') validation(task)
+    else if (area === 'pre-commit') preCommit()
+    else throw new Error(`Unknown runtime command: ${area || '(missing)'}`)
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error))
+    process.exitCode = 1
+  }
 }

package/src/templates/gitignore

@@ -72,6 +72,9 @@ pnpm-debug.log*
 .fleet/
 .opencode/
 .kluster/
+.zcode/
+.kiro/
+.goose/
 .direnv/
 .envrc
 .vercel/