code-foundry 1.46.4 → 1.46.5

package/.githooks/pre-commit

@@ -6,6 +6,46 @@ if [ -z "$(git diff --cached --name-only)" ]; then
   exit 0
 fi
 
+# core.hooksPath names a single directory, so pointing it at .githooks would
+# silence every machine-level hook behind it: secret guards, git-lfs, signing.
+# Chain to the machine-level pre-commit when one exists. The target is
+# discovered at run time — never baked into this committed file — from the
+# repository's previous hooks directory (recorded by sync), then the global
+# hooksPath, then the checkout's default hooks directory. The machine hook
+# runs first so cheap secret guards reject before the heavier project gate.
+machine_hook() {
+  hook_name="$1"
+  for dir in \
+    "$(git config --get code-foundry.previousHooksPath 2>/dev/null || true)" \
+    "$(git config --global --get core.hooksPath 2>/dev/null || true)" \
+    "$(git rev-parse --git-common-dir 2>/dev/null || printf '.git')/hooks"
+  do
+    case "$dir" in
+      '' | .githooks | ./.githooks | */.githooks) continue ;;
+    esac
+    candidate="$dir/$hook_name"
+    if [ -f "$candidate" ] && ! [ "$candidate" -ef "$0" ]; then
+      printf '%s' "$candidate"
+      return 0
+    fi
+  done
+  return 1
+}
+
+if [ -z "${CODE_FOUNDRY_HOOK_CHAIN:-}" ]; then
+  if machine="$(machine_hook pre-commit)"; then
+    # The marker travels through the machine hook into anything it delegates
+    # back to: a guard that chains to .githooks/pre-commit (a mutual-delegation
+    # pair) re-enters this hook, sees the marker, and runs the gate instead of
+    # chaining again — machine policy once, project policy once, no loop.
+    if [ -x "$machine" ]; then
+      CODE_FOUNDRY_HOOK_CHAIN=1 "$machine" "$@" || exit $?
+    else
+      CODE_FOUNDRY_HOOK_CHAIN=1 sh "$machine" "$@" || exit $?
+    fi
+  fi
+fi
+
 # Prefer a runtime the repository already depends on. A repository opts into
 # the gate by depending on code-foundry; one that does not keeps the
 # whitespace guard and stays offline. Nothing is fetched at commit time.

package/.gitignore

@@ -78,3 +78,8 @@ mise.local.toml
 mise.local.lock
 .mise.local.lock
 *.code-workspace
+
+# Machine-local git hook delegates written by Code Foundry sync; only the
+# committed pre-commit gate is tracked.
+.githooks/*
+!.githooks/pre-commit

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.46.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.4...v1.46.5) (2026-10-08)
+
+
+### Bug Fixes
+
+* **sync:** chain machine-level hooks instead of silencing them ([#747](https://github.com/0xPlayerOne/code-foundry/issues/747)) ([7fcad52](https://github.com/0xPlayerOne/code-foundry/commit/7fcad52d400dbb2aaa9ba46c0c76f14e8d63f660)), closes [#690](https://github.com/0xPlayerOne/code-foundry/issues/690)
+
 ## [1.46.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.3...v1.46.4) (2026-10-08)
 
 
@@ -133,16 +140,9 @@
 
 * **release:** budget the package without the changelog and ship recent history only ([#708](https://github.com/0xPlayerOne/code-foundry/issues/708)) ([ab365e0](https://github.com/0xPlayerOne/code-foundry/commit/ab365e0910472c3596429adc86a1c8f3e19730f9))
 
-## [1.44.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.43.2...v1.44.0) (2026-10-03)
-
-
-### Features
-
-* **pre-commit:** make the commit gate change-aware ([#702](https://github.com/0xPlayerOne/code-foundry/issues/702)) ([f5bca91](https://github.com/0xPlayerOne/code-foundry/commit/f5bca91c177b30b99f5d62287255d191617b4788))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 239 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 240 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/CONFIGURATION.md

@@ -201,6 +201,27 @@ exists on disk. Task scripts that declare dependencies of their own, such as a
 Turborepo `typecheck` task with `dependsOn: ["^build"]`, still run them; drop
 that dependency to keep type checks build-free.
 
+### Machine-level hook chaining
+
+`core.hooksPath` names a single directory, so enabling `.githooks` would
+silence every hook in the machine's own hooks directory: secret guards,
+git-lfs, signing. Sync chains instead of replacing. The generated
+`.githooks/pre-commit` discovers a machine-level `pre-commit` at run time —
+from the hooks directory sync replaced (recorded as the
+`code-foundry.previousHooksPath` repository config), then the global
+`core.hooksPath`, then the checkout's default hooks directory — and runs it
+before the gate, so a cheap secret guard rejects before the heavier project
+checks. The committed hook stays machine-independent; the target is resolved
+on the machine that runs it.
+
+Hook names this repository does not own (`post-checkout`, `pre-push`,
+`commit-msg`, and the other client-side hooks) get delegating stubs in
+`.githooks` when a machine-level counterpart exists, which is what keeps
+git-lfs working after sync. Stubs are machine-local, gitignored, rewritten on
+every sync, and removed once the machine hook they mirrored disappears.
+`code-foundry doctor` warns when a machine-level pre-commit exists but the
+installed hook predates chaining.
+
 ## Release and branch policy
 
 | Key                       | Values                                                                           | Purpose                                                                 |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.46.4",
+  "version": "1.46.5",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/doctor.mjs

@@ -1,7 +1,7 @@
 // @ts-check
 
-import { existsSync, readFileSync, readdirSync } from 'node:fs'
-import { join, resolve } from 'node:path'
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
+import { join, resolve, isAbsolute } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { includesValue, readConfig } from '../lib/config.mjs'
 import { recommendRunners, resolveProfile } from '../lib/profile.mjs'
@@ -53,6 +53,29 @@ export function doctor(root, options = {}) {
       warn(
         '.githooks/pre-commit does not delegate to the Code Foundry gate; run `npx code-foundry sync`'
       )
+    // core.hooksPath shadows every machine-level hook behind it (secret
+    // guards, git-lfs). The generated hook chains to the machine's pre-commit
+    // when sync recorded one, so a machine hook without the chain marker in
+    // the installed hook is exactly the silent-disable bug chaining exists to
+    // prevent.
+    const hookText = existsSync(hookFile) ? readFileSync(hookFile, 'utf8') : ''
+    const machineDirs = [
+      git(target, ['config', '--get', 'code-foundry.previousHooksPath']),
+      git(target, ['config', '--global', '--get', 'core.hooksPath']),
+      `${git(target, ['rev-parse', '--git-common-dir']) || '.git'}/hooks`,
+    ].filter((dir) => dir && dir !== '.githooks' && dir !== './.githooks')
+    const machinePreCommit = machineDirs.some((dir) => {
+      const candidate = isAbsolute(dir) ? join(dir, 'pre-commit') : join(target, dir, 'pre-commit')
+      try {
+        return statSync(candidate).isFile()
+      } catch {
+        return false
+      }
+    })
+    if (machinePreCommit && !hookText.includes('machine_hook'))
+      warn(
+        'A machine-level pre-commit exists but the installed hook does not chain to it; run `npx code-foundry sync`'
+      )
   }
   if (
     ['rust', 'python', 'solidity'].some((language) =>

package/src/commands/sync.mjs

@@ -7,9 +7,10 @@ import {
   readdirSync,
   readFileSync,
   rmSync,
+  statSync,
   writeFileSync,
 } from 'node:fs'
-import { dirname, join, resolve } from 'node:path'
+import { dirname, isAbsolute, join, resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import {
   detectLanguages,
@@ -550,7 +551,17 @@ function synchronize(options) {
     existsSync(join(target, '.githooks/pre-commit'))
   ) {
     chmodSync(join(target, '.githooks/pre-commit'), 0o755)
+    // core.hooksPath names a single directory, so pointing it at .githooks
+    // would silence every machine-level hook behind it (secret guards,
+    // git-lfs, signing). Record what is being replaced so the generated
+    // hooks can chain back to it, then delegate the hook names this
+    // repository does not own.
+    const previousHooksPath = gitOutput(target, ['config', '--get', 'core.hooksPath'])
+    if (previousHooksPath && previousHooksPath !== '.githooks') {
+      git(target, ['config', 'code-foundry.previousHooksPath', previousHooksPath])
+    }
     git(target, ['config', 'core.hooksPath', '.githooks'])
+    syncMachineHookDelegates(target, previousHooksPath)
   }
   console.log(`${changed.length} baseline file(s) differ.`)
   if (overlays.custom_workflows === 'preserve') {
@@ -1848,6 +1859,138 @@ function git(target, args) {
   spawnSync('git', args, { cwd: target, stdio: 'ignore' })
 }
 
+/** @param {string} target @param {string[]} args @returns {string} */
+function gitOutput(target, args) {
+  const result = spawnSync('git', args, { cwd: target, encoding: 'utf8' })
+  return result.status === 0 ? (result.stdout ?? '').trim() : ''
+}
+
+/**
+ * Hook names git runs on the client that Code Foundry does not own. When one
+ * of these exists in a machine-level hooks directory, sync writes a
+ * delegating stub for it so enabling `core.hooksPath=.githooks` keeps the
+ * machine's hooks (git-lfs, secret scanners) firing.
+ */
+const MACHINE_DELEGATED_HOOKS = [
+  'applypatch-msg',
+  'commit-msg',
+  'prepare-commit-msg',
+  'post-applypatch',
+  'post-checkout',
+  'post-commit',
+  'post-merge',
+  'post-rewrite',
+  'pre-applypatch',
+  'pre-auto-gc',
+  'pre-rebase',
+  'pre-push',
+  'reference-transaction',
+  'sendemail-validate',
+  'post-index-change',
+]
+
+/**
+ * The hooks directories a machine-level hook may live in, in the order the
+ * generated hooks probe them: the repository hooks path sync just replaced,
+ * then the global one, then the checkout's default directory. Relative values
+ * resolve against the repository root, matching git's own semantics.
+ *
+ * @param {string} target @param {string} previousHooksPath @returns {string[]}
+ */
+function machineHooksDirectories(target, previousHooksPath) {
+  return [
+    previousHooksPath,
+    gitOutput(target, ['config', '--global', '--get', 'core.hooksPath']),
+    `${gitOutput(target, ['rev-parse', '--git-common-dir']) || '.git'}/hooks`,
+  ].flatMap((dir) => {
+    if (!dir || dir === '.githooks' || dir === './.githooks') return []
+    return [isAbsolute(dir) ? dir : join(target, dir)]
+  })
+}
+
+/**
+ * The delegating stub for one machine-level hook name. Self-contained: the
+ * machine's hooks directories are re-probed at run time so the committed
+ * templates never bake in machine-specific paths.
+ *
+ * @param {string} name
+ */
+const machineDelegateStub = (name) => `#!/usr/bin/env sh
+# Generated by Code Foundry — delegates ${name} to the machine-level hook so
+# enabling .githooks keeps secret guards, git-lfs, and other machine hooks
+# working. Discovery mirrors .githooks/pre-commit; rerun sync after changing
+# the machine's hooks.
+set -eu
+machine_hook() {
+  hook_name="$1"
+  for dir in \\
+    "$(git config --get code-foundry.previousHooksPath 2>/dev/null || true)" \\
+    "$(git config --global --get core.hooksPath 2>/dev/null || true)" \\
+    "$(git rev-parse --git-common-dir 2>/dev/null || printf '.git')/hooks"
+  do
+    case "$dir" in
+      '' | .githooks | ./.githooks | */.githooks) continue ;;
+    esac
+    candidate="$dir/$hook_name"
+    if [ -f "$candidate" ] && ! [ "$candidate" -ef "$0" ]; then
+      printf '%s' "$candidate"
+      return 0
+    fi
+  done
+  return 1
+}
+if [ -n "\${CODE_FOUNDRY_HOOK_CHAIN:-}" ]; then
+  exit 0
+fi
+if machine="$(machine_hook ${name})"; then
+  # The marker makes a machine hook that delegates back to .githooks settle
+  # here instead of looping.
+  if [ -x "$machine" ]; then
+    CODE_FOUNDRY_HOOK_CHAIN=1 exec "$machine" "$@"
+  else
+    CODE_FOUNDRY_HOOK_CHAIN=1 exec sh "$machine" "$@"
+  fi
+fi
+exit 0
+`
+
+/**
+ * Write delegating stubs into .githooks for every machine-level hook this
+ * repository does not own, and remove stubs the machine no longer backs. The
+ * stubs are machine-local (gitignored): they are rewritten on every sync and
+ * only ever removed when their content carries this generator's marker.
+ *
+ * @param {string} target @param {string} previousHooksPath
+ */
+function syncMachineHookDelegates(target, previousHooksPath) {
+  const directories = machineHooksDirectories(target, previousHooksPath)
+  /** @param {string} name */
+  const machineHook = (name) => {
+    for (const dir of directories) {
+      const candidate = join(dir, name)
+      try {
+        if (statSync(candidate).isFile()) return candidate
+      } catch {
+        // Absent from this directory; keep probing.
+      }
+    }
+    return null
+  }
+  mkdirSync(join(target, '.githooks'), { recursive: true })
+  for (const name of MACHINE_DELEGATED_HOOKS) {
+    const stubPath = join(target, '.githooks', name)
+    if (machineHook(name)) {
+      writeFileSync(stubPath, machineDelegateStub(name))
+      chmodSync(stubPath, 0o755)
+    } else if (
+      existsSync(stubPath) &&
+      readFileSync(stubPath, 'utf8').includes('Generated by Code Foundry')
+    ) {
+      rmSync(stubPath)
+    }
+  }
+}
+
 /** @param {string} file @param {Buffer|string} content @param {boolean} dryRun */
 function writeOrReport(file, content, dryRun) {
   if (dryRun) {

package/src/templates/gitignore

@@ -83,3 +83,8 @@ mise.local.toml
 mise.local.lock
 .mise.local.lock
 *.code-workspace
+
+# Machine-local git hook delegates written by Code Foundry sync; only the
+# committed pre-commit gate is tracked.
+.githooks/*
+!.githooks/pre-commit