code-foundry 1.39.2 → 1.39.3

package/.githooks/pre-commit

@@ -6,8 +6,15 @@ if [ -z "$(git diff --cached --name-only)" ]; then
   exit 0
 fi
 
-if command -v npx >/dev/null 2>&1 && npx --yes code-foundry@__VERSION__ pre-commit; then
-  exit 0
+# Prefer a runtime the repository already depends on. A repository opts into
+# the gate by depending on code-foundry; one that does not keeps the
+# whitespace guard and stays offline. Nothing is fetched at commit time.
+if [ -x node_modules/.bin/code-foundry ]; then
+  exec node_modules/.bin/code-foundry pre-commit
+fi
+
+if [ -f src/runtime.mjs ]; then
+  exec node src/runtime.mjs pre-commit
 fi
 
 git diff --cached --check

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.39.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.39.2...v1.39.3) (2026-10-01)
+
+
+### Bug Fixes
+
+* **hooks:** run the gate from a local dependency, not npx ([#688](https://github.com/0xPlayerOne/code-foundry/issues/688)) ([d256b69](https://github.com/0xPlayerOne/code-foundry/commit/d256b69b8f89f0041a01c53cc51af32fe582b5dc))
+
 ## [1.39.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.39.1...v1.39.2) (2026-10-01)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.39.2",
+  "version": "1.39.3",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -260,9 +260,6 @@ function synchronize(options) {
     if (file === 'LICENSE' && license !== 'preserve' && license !== 'none') continue
     if (file === '.github/CODEOWNERS' && existsSync(destination)) continue
     let content = readFileSync(sourceFile)
-    if (file === '.githooks/pre-commit') {
-      content = Buffer.from(renderHook(sourceFile, source))
-    }
     if (file === 'release-please-config.json') {
       content = Buffer.from(renderReleaseConfig(target, sourceFile))
     }
@@ -589,20 +586,6 @@ function renderReleaseConfig(target, sourceFile) {
   return `${JSON.stringify(mergeReleaseConfig(target, sourceFile), null, 2)}\n`
 }
 
-/**
- * The hook runs `npx code-foundry@<version>` on every commit, so the version
- * is substituted at generation time rather than resolved at run time. A
- * mutable dist-tag there would let any publish under that tag run code on
- * every developer's machine at commit time; pinning means the gate a
- * repository received is the gate that generated it.
- *
- * @param {string} sourceFile the template path
- * @param {string} sourceRoot the package root that carries package.json
- */
-function renderHook(sourceFile, sourceRoot) {
-  return readFileSync(sourceFile, 'utf8').replaceAll('__VERSION__', readPackageVersion(sourceRoot))
-}
-
 /** @param {string} file @param {string} languages @param {string} features @param {Record<string, string>} config */
 function shouldInclude(file, languages, features, config) {
   if (file === 'ruff.toml') return includesValue(languages, 'python')