code-foundry 1.46.3 → 1.46.5

package/.githooks/pre-commit

@@ -6,6 +6,46 @@ if [ -z "$(git diff --cached --name-only)" ]; then
   exit 0
 fi
 
+# core.hooksPath names a single directory, so pointing it at .githooks would
+# silence every machine-level hook behind it: secret guards, git-lfs, signing.
+# Chain to the machine-level pre-commit when one exists. The target is
+# discovered at run time — never baked into this committed file — from the
+# repository's previous hooks directory (recorded by sync), then the global
+# hooksPath, then the checkout's default hooks directory. The machine hook
+# runs first so cheap secret guards reject before the heavier project gate.
+machine_hook() {
+  hook_name="$1"
+  for dir in \
+    "$(git config --get code-foundry.previousHooksPath 2>/dev/null || true)" \
+    "$(git config --global --get core.hooksPath 2>/dev/null || true)" \
+    "$(git rev-parse --git-common-dir 2>/dev/null || printf '.git')/hooks"
+  do
+    case "$dir" in
+      '' | .githooks | ./.githooks | */.githooks) continue ;;
+    esac
+    candidate="$dir/$hook_name"
+    if [ -f "$candidate" ] && ! [ "$candidate" -ef "$0" ]; then
+      printf '%s' "$candidate"
+      return 0
+    fi
+  done
+  return 1
+}
+
+if [ -z "${CODE_FOUNDRY_HOOK_CHAIN:-}" ]; then
+  if machine="$(machine_hook pre-commit)"; then
+    # The marker travels through the machine hook into anything it delegates
+    # back to: a guard that chains to .githooks/pre-commit (a mutual-delegation
+    # pair) re-enters this hook, sees the marker, and runs the gate instead of
+    # chaining again — machine policy once, project policy once, no loop.
+    if [ -x "$machine" ]; then
+      CODE_FOUNDRY_HOOK_CHAIN=1 "$machine" "$@" || exit $?
+    else
+      CODE_FOUNDRY_HOOK_CHAIN=1 sh "$machine" "$@" || exit $?
+    fi
+  fi
+fi
+
 # Prefer a runtime the repository already depends on. A repository opts into
 # the gate by depending on code-foundry; one that does not keeps the
 # whitespace guard and stays offline. Nothing is fetched at commit time.

package/.github/workflows/release.yml

@@ -447,6 +447,9 @@ jobs:
           # when it validated, github.token after fallback. The token value
           # lives only in this masked env expression, never in step outputs.
           AUTO_MERGE: ${{ steps.credentials.outputs.auto_merge }}
+          # Read Actions ownership with the workflow credential, not an
+          # automation token that may only have release/PR write permissions.
+          VALIDATION_TOKEN: ${{ github.token }}
           GH_TOKEN: ${{ steps.credentials.outputs.token_source == 'configured' && (secrets.CODE_FOUNDRY_TOKEN) || github.token }}
         run: |
           set -euo pipefail
@@ -464,12 +467,87 @@ jobs:
           fi
 
           for pr in "${release_prs[@]}"; do
-            PR_DRAFT=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" --json isDraft --jq '.isDraft')
+            pr_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
+              --json isDraft,headRefOid,headRefName \
+              --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
+            read -r PR_DRAFT PR_HEAD PR_BRANCH <<< "$pr_state"
+            if [[ ! "$PR_DRAFT" =~ ^(true|false)$ || ! "$PR_HEAD" =~ ^[a-f0-9]{40}$ ]]; then
+              echo 'Unable to verify generated release PR state.' >&2
+              exit 1
+            fi
+            case "$PR_BRANCH" in
+              release-please--branches--main|release-please--branches--main--*) ;;
+              *) echo 'Release PR head left the generated namespace; refusing readiness mutation.' >&2; exit 1 ;;
+            esac
             if [ "$AUTO_MERGE" = true ]; then
               if [ "$PR_DRAFT" = false ]; then
-                # A Release Please PR can be updated while already ready. Reset
-                # it so ready_for_review always starts validation for the exact
-                # current release head.
+                # A ready head already receives synchronize validation. Preserve
+                # its live/completed owner instead of cancelling and reallocating
+                # CI every time another queued main release run prepares it.
+                runs=$(GH_TOKEN="$VALIDATION_TOKEN" gh api \
+                  "repos/$GITHUB_REPOSITORY/actions/runs" --method GET \
+                  -f event=pull_request -f head_sha="$PR_HEAD" -f per_page=100)
+                validation=$(jq -er --arg head "$PR_HEAD" --arg branch "$PR_BRANCH" \
+                  --arg repo "$GITHUB_REPOSITORY" '
+                  def active: .status == "queued" or .status == "in_progress" or
+                    .status == "waiting" or .status == "pending" or .status == "requested";
+                  def valid_run:
+                    type == "object" and
+                    (.id | type == "number" and . > 0 and floor == .) and
+                    (.run_attempt | type == "number" and . >= 1 and floor == .) and
+                    (.head_sha | type == "string" and test("^[a-f0-9]{40}$")) and
+                    (.head_branch | type == "string" and length > 0) and
+                    (.event | type == "string" and length > 0) and
+                    (.repository | type == "object") and
+                    (.repository.full_name | type == "string" and length > 0) and
+                    (.path | type == "string" and length > 0) and
+                    ((active and has("conclusion") and .conclusion == null) or
+                     (.status == "completed" and
+                      (.conclusion == "success" or .conclusion == "failure" or
+                       .conclusion == "timed_out" or .conclusion == "action_required" or
+                       .conclusion == "cancelled" or .conclusion == "skipped" or
+                       .conclusion == "neutral")));
+                  if (.workflow_runs | type) != "array" or
+                     (.total_count | type) != "number" then
+                    error("Invalid validation owner response")
+                  elif .total_count != (.workflow_runs | length) then
+                    error("Incomplete validation owner response")
+                  elif any(.workflow_runs[]; valid_run | not) then
+                    error("Invalid validation run identity or state")
+                  else
+                    [.workflow_runs[] | (.path | split("@")[0]) as $workflow | select(
+                      .head_sha == $head and .head_branch == $branch and
+                      .event == "pull_request" and .repository.full_name == $repo and
+                      ($workflow == ".github/workflows/validation.yml" or
+                       $workflow == ".github/workflows/validation_self-ci.yml")
+                    )] | sort_by(.id) | last |
+                    if . == null then "missing"
+                    elif active or (.status == "completed" and .conclusion == "success") then "owned"
+                    elif .status == "completed" and
+                         (.conclusion == "failure" or .conclusion == "timed_out" or
+                          .conclusion == "action_required") then "failed"
+                    elif .status == "completed" and
+                         (.conclusion == "cancelled" or .conclusion == "skipped" or
+                          .conclusion == "neutral") then "missing"
+                    else error("Unconfirmed validation owner state") end
+                  end' <<< "$runs")
+                fresh_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
+                  --json isDraft,headRefOid,headRefName \
+                  --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
+                if [ "$fresh_state" != "$pr_state" ]; then
+                  echo 'Release PR state changed during validation lookup; refusing a stale readiness mutation.' >&2
+                  exit 1
+                fi
+                if [ "$validation" = owned ]; then
+                  echo "Release PR #$pr already has current-head validation; preserving readiness."
+                  continue
+                fi
+                if [ "$validation" = failed ]; then
+                  echo "Current-head validation failed for release PR #$pr; resolve or explicitly retry it before release." >&2
+                  exit 1
+                fi
+                # A missing, cancelled or skipped owner still needs the existing
+                # explicit ready_for_review transition with the validated token.
                 gh pr ready --undo "$pr" --repo "$GITHUB_REPOSITORY"
               fi
               gh pr ready "$pr" --repo "$GITHUB_REPOSITORY"

package/.gitignore

@@ -78,3 +78,8 @@ mise.local.toml
 mise.local.lock
 .mise.local.lock
 *.code-workspace
+
+# Machine-local git hook delegates written by Code Foundry sync; only the
+# committed pre-commit gate is tracked.
+.githooks/*
+!.githooks/pre-commit

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.46.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.4...v1.46.5) (2026-10-08)
+
+
+### Bug Fixes
+
+* **sync:** chain machine-level hooks instead of silencing them ([#747](https://github.com/0xPlayerOne/code-foundry/issues/747)) ([7fcad52](https://github.com/0xPlayerOne/code-foundry/commit/7fcad52d400dbb2aaa9ba46c0c76f14e8d63f660)), closes [#690](https://github.com/0xPlayerOne/code-foundry/issues/690)
+
+## [1.46.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.3...v1.46.4) (2026-10-08)
+
+
+### Bug Fixes
+
+* **release:** preserve current-head validation ownership ([#737](https://github.com/0xPlayerOne/code-foundry/issues/737)) ([aa8bfcf](https://github.com/0xPlayerOne/code-foundry/commit/aa8bfcfbfcd3c213d15ba9e1fbfb5c65ab8ddb6b))
+
 ## [1.46.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.2...v1.46.3) (2026-10-07)
 
 
@@ -126,23 +140,9 @@
 
 * **release:** budget the package without the changelog and ship recent history only ([#708](https://github.com/0xPlayerOne/code-foundry/issues/708)) ([ab365e0](https://github.com/0xPlayerOne/code-foundry/commit/ab365e0910472c3596429adc86a1c8f3e19730f9))
 
-## [1.44.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.43.2...v1.44.0) (2026-10-03)
-
-
-### Features
-
-* **pre-commit:** make the commit gate change-aware ([#702](https://github.com/0xPlayerOne/code-foundry/issues/702)) ([f5bca91](https://github.com/0xPlayerOne/code-foundry/commit/f5bca91c177b30b99f5d62287255d191617b4788))
-
-## [1.43.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.43.1...v1.43.2) (2026-10-03)
-
-
-### Bug Fixes
-
-* require candidate asset qualification before stable promotion ([#705](https://github.com/0xPlayerOne/code-foundry/issues/705)) ([f42e4f5](https://github.com/0xPlayerOne/code-foundry/commit/f42e4f5fb063ea22fa25791a13c75c90d41bf17a))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 238 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 240 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/CONFIGURATION.md

@@ -201,6 +201,27 @@ exists on disk. Task scripts that declare dependencies of their own, such as a
 Turborepo `typecheck` task with `dependsOn: ["^build"]`, still run them; drop
 that dependency to keep type checks build-free.
 
+### Machine-level hook chaining
+
+`core.hooksPath` names a single directory, so enabling `.githooks` would
+silence every hook in the machine's own hooks directory: secret guards,
+git-lfs, signing. Sync chains instead of replacing. The generated
+`.githooks/pre-commit` discovers a machine-level `pre-commit` at run time —
+from the hooks directory sync replaced (recorded as the
+`code-foundry.previousHooksPath` repository config), then the global
+`core.hooksPath`, then the checkout's default hooks directory — and runs it
+before the gate, so a cheap secret guard rejects before the heavier project
+checks. The committed hook stays machine-independent; the target is resolved
+on the machine that runs it.
+
+Hook names this repository does not own (`post-checkout`, `pre-push`,
+`commit-msg`, and the other client-side hooks) get delegating stubs in
+`.githooks` when a machine-level counterpart exists, which is what keeps
+git-lfs working after sync. Stubs are machine-local, gitignored, rewritten on
+every sync, and removed once the machine hook they mirrored disappears.
+`code-foundry doctor` warns when a machine-level pre-commit exists but the
+installed hook predates chaining.
+
 ## Release and branch policy
 
 | Key                       | Values                                                                           | Purpose                                                                 |

package/docs/WORKFLOWS.md

@@ -82,6 +82,23 @@ to run generated gates for drafts. Cloudflare callers use their equivalent
 `draft-protection: false` input. These opt-outs do not remove Draft Guard or
 draft-PR automation; they only allow the protected gates to run for drafts.
 
+Generated release PR preparation preserves a ready head when the canonical
+generated `.github/workflows/validation.yml` (or Code Foundry
+`validation_self-ci.yml`) pull-request run for that exact head, branch, and
+repository is the newest matching run and is active or successful. API workflow
+paths may include a Git ref suffix; ownership compares the canonical filename.
+The workflow credential reads Actions ownership; the validated automation credential still performs readiness writes.
+A newer failed qualification blocks release preparation until it is resolved or
+explicitly retried. Missing, cancelled, or skipped validation still receives the
+explicit draft/ready transition; a new draft receives its first readiness event.
+An unavailable or malformed ownership response, an incomplete Actions page, or a
+PR state change during the lookup fails before mutation. An older live run cannot
+mask a newer failed qualification. Invalid automation credentials retain the
+manual draft fallback. This changes readiness only: release creation, qualification,
+tag publication, and branch-policy-gated exact-head merging still run through
+the existing release pipeline. Consumers must adopt the fixed reusable workflow
+pin before they receive this behavior; older pins still reset ready heads.
+
 ## Billing pause
 
 Code Foundry consumers can stop all generated jobs from allocating GitHub-hosted

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.46.3",
+  "version": "1.46.5",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/doctor.mjs

@@ -1,7 +1,7 @@
 // @ts-check
 
-import { existsSync, readFileSync, readdirSync } from 'node:fs'
-import { join, resolve } from 'node:path'
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
+import { join, resolve, isAbsolute } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { includesValue, readConfig } from '../lib/config.mjs'
 import { recommendRunners, resolveProfile } from '../lib/profile.mjs'
@@ -53,6 +53,29 @@ export function doctor(root, options = {}) {
       warn(
         '.githooks/pre-commit does not delegate to the Code Foundry gate; run `npx code-foundry sync`'
       )
+    // core.hooksPath shadows every machine-level hook behind it (secret
+    // guards, git-lfs). The generated hook chains to the machine's pre-commit
+    // when sync recorded one, so a machine hook without the chain marker in
+    // the installed hook is exactly the silent-disable bug chaining exists to
+    // prevent.
+    const hookText = existsSync(hookFile) ? readFileSync(hookFile, 'utf8') : ''
+    const machineDirs = [
+      git(target, ['config', '--get', 'code-foundry.previousHooksPath']),
+      git(target, ['config', '--global', '--get', 'core.hooksPath']),
+      `${git(target, ['rev-parse', '--git-common-dir']) || '.git'}/hooks`,
+    ].filter((dir) => dir && dir !== '.githooks' && dir !== './.githooks')
+    const machinePreCommit = machineDirs.some((dir) => {
+      const candidate = isAbsolute(dir) ? join(dir, 'pre-commit') : join(target, dir, 'pre-commit')
+      try {
+        return statSync(candidate).isFile()
+      } catch {
+        return false
+      }
+    })
+    if (machinePreCommit && !hookText.includes('machine_hook'))
+      warn(
+        'A machine-level pre-commit exists but the installed hook does not chain to it; run `npx code-foundry sync`'
+      )
   }
   if (
     ['rust', 'python', 'solidity'].some((language) =>

package/src/commands/sync.mjs

@@ -7,9 +7,10 @@ import {
   readdirSync,
   readFileSync,
   rmSync,
+  statSync,
   writeFileSync,
 } from 'node:fs'
-import { dirname, join, resolve } from 'node:path'
+import { dirname, isAbsolute, join, resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import {
   detectLanguages,
@@ -550,7 +551,17 @@ function synchronize(options) {
     existsSync(join(target, '.githooks/pre-commit'))
   ) {
     chmodSync(join(target, '.githooks/pre-commit'), 0o755)
+    // core.hooksPath names a single directory, so pointing it at .githooks
+    // would silence every machine-level hook behind it (secret guards,
+    // git-lfs, signing). Record what is being replaced so the generated
+    // hooks can chain back to it, then delegate the hook names this
+    // repository does not own.
+    const previousHooksPath = gitOutput(target, ['config', '--get', 'core.hooksPath'])
+    if (previousHooksPath && previousHooksPath !== '.githooks') {
+      git(target, ['config', 'code-foundry.previousHooksPath', previousHooksPath])
+    }
     git(target, ['config', 'core.hooksPath', '.githooks'])
+    syncMachineHookDelegates(target, previousHooksPath)
   }
   console.log(`${changed.length} baseline file(s) differ.`)
   if (overlays.custom_workflows === 'preserve') {
@@ -1848,6 +1859,138 @@ function git(target, args) {
   spawnSync('git', args, { cwd: target, stdio: 'ignore' })
 }
 
+/** @param {string} target @param {string[]} args @returns {string} */
+function gitOutput(target, args) {
+  const result = spawnSync('git', args, { cwd: target, encoding: 'utf8' })
+  return result.status === 0 ? (result.stdout ?? '').trim() : ''
+}
+
+/**
+ * Hook names git runs on the client that Code Foundry does not own. When one
+ * of these exists in a machine-level hooks directory, sync writes a
+ * delegating stub for it so enabling `core.hooksPath=.githooks` keeps the
+ * machine's hooks (git-lfs, secret scanners) firing.
+ */
+const MACHINE_DELEGATED_HOOKS = [
+  'applypatch-msg',
+  'commit-msg',
+  'prepare-commit-msg',
+  'post-applypatch',
+  'post-checkout',
+  'post-commit',
+  'post-merge',
+  'post-rewrite',
+  'pre-applypatch',
+  'pre-auto-gc',
+  'pre-rebase',
+  'pre-push',
+  'reference-transaction',
+  'sendemail-validate',
+  'post-index-change',
+]
+
+/**
+ * The hooks directories a machine-level hook may live in, in the order the
+ * generated hooks probe them: the repository hooks path sync just replaced,
+ * then the global one, then the checkout's default directory. Relative values
+ * resolve against the repository root, matching git's own semantics.
+ *
+ * @param {string} target @param {string} previousHooksPath @returns {string[]}
+ */
+function machineHooksDirectories(target, previousHooksPath) {
+  return [
+    previousHooksPath,
+    gitOutput(target, ['config', '--global', '--get', 'core.hooksPath']),
+    `${gitOutput(target, ['rev-parse', '--git-common-dir']) || '.git'}/hooks`,
+  ].flatMap((dir) => {
+    if (!dir || dir === '.githooks' || dir === './.githooks') return []
+    return [isAbsolute(dir) ? dir : join(target, dir)]
+  })
+}
+
+/**
+ * The delegating stub for one machine-level hook name. Self-contained: the
+ * machine's hooks directories are re-probed at run time so the committed
+ * templates never bake in machine-specific paths.
+ *
+ * @param {string} name
+ */
+const machineDelegateStub = (name) => `#!/usr/bin/env sh
+# Generated by Code Foundry — delegates ${name} to the machine-level hook so
+# enabling .githooks keeps secret guards, git-lfs, and other machine hooks
+# working. Discovery mirrors .githooks/pre-commit; rerun sync after changing
+# the machine's hooks.
+set -eu
+machine_hook() {
+  hook_name="$1"
+  for dir in \\
+    "$(git config --get code-foundry.previousHooksPath 2>/dev/null || true)" \\
+    "$(git config --global --get core.hooksPath 2>/dev/null || true)" \\
+    "$(git rev-parse --git-common-dir 2>/dev/null || printf '.git')/hooks"
+  do
+    case "$dir" in
+      '' | .githooks | ./.githooks | */.githooks) continue ;;
+    esac
+    candidate="$dir/$hook_name"
+    if [ -f "$candidate" ] && ! [ "$candidate" -ef "$0" ]; then
+      printf '%s' "$candidate"
+      return 0
+    fi
+  done
+  return 1
+}
+if [ -n "\${CODE_FOUNDRY_HOOK_CHAIN:-}" ]; then
+  exit 0
+fi
+if machine="$(machine_hook ${name})"; then
+  # The marker makes a machine hook that delegates back to .githooks settle
+  # here instead of looping.
+  if [ -x "$machine" ]; then
+    CODE_FOUNDRY_HOOK_CHAIN=1 exec "$machine" "$@"
+  else
+    CODE_FOUNDRY_HOOK_CHAIN=1 exec sh "$machine" "$@"
+  fi
+fi
+exit 0
+`
+
+/**
+ * Write delegating stubs into .githooks for every machine-level hook this
+ * repository does not own, and remove stubs the machine no longer backs. The
+ * stubs are machine-local (gitignored): they are rewritten on every sync and
+ * only ever removed when their content carries this generator's marker.
+ *
+ * @param {string} target @param {string} previousHooksPath
+ */
+function syncMachineHookDelegates(target, previousHooksPath) {
+  const directories = machineHooksDirectories(target, previousHooksPath)
+  /** @param {string} name */
+  const machineHook = (name) => {
+    for (const dir of directories) {
+      const candidate = join(dir, name)
+      try {
+        if (statSync(candidate).isFile()) return candidate
+      } catch {
+        // Absent from this directory; keep probing.
+      }
+    }
+    return null
+  }
+  mkdirSync(join(target, '.githooks'), { recursive: true })
+  for (const name of MACHINE_DELEGATED_HOOKS) {
+    const stubPath = join(target, '.githooks', name)
+    if (machineHook(name)) {
+      writeFileSync(stubPath, machineDelegateStub(name))
+      chmodSync(stubPath, 0o755)
+    } else if (
+      existsSync(stubPath) &&
+      readFileSync(stubPath, 'utf8').includes('Generated by Code Foundry')
+    ) {
+      rmSync(stubPath)
+    }
+  }
+}
+
 /** @param {string} file @param {Buffer|string} content @param {boolean} dryRun */
 function writeOrReport(file, content, dryRun) {
   if (dryRun) {

package/src/templates/gitignore

@@ -83,3 +83,8 @@ mise.local.toml
 mise.local.lock
 .mise.local.lock
 *.code-workspace
+
+# Machine-local git hook delegates written by Code Foundry sync; only the
+# committed pre-commit gate is tracked.
+.githooks/*
+!.githooks/pre-commit