code-foundry 1.46.4 → 1.46.6

package/.githooks/pre-commit

@@ -6,6 +6,46 @@ if [ -z "$(git diff --cached --name-only)" ]; then
   exit 0
 fi
 
+# core.hooksPath names a single directory, so pointing it at .githooks would
+# silence every machine-level hook behind it: secret guards, git-lfs, signing.
+# Chain to the machine-level pre-commit when one exists. The target is
+# discovered at run time — never baked into this committed file — from the
+# repository's previous hooks directory (recorded by sync), then the global
+# hooksPath, then the checkout's default hooks directory. The machine hook
+# runs first so cheap secret guards reject before the heavier project gate.
+machine_hook() {
+  hook_name="$1"
+  for dir in \
+    "$(git config --get code-foundry.previousHooksPath 2>/dev/null || true)" \
+    "$(git config --global --get core.hooksPath 2>/dev/null || true)" \
+    "$(git rev-parse --git-common-dir 2>/dev/null || printf '.git')/hooks"
+  do
+    case "$dir" in
+      '' | .githooks | ./.githooks | */.githooks) continue ;;
+    esac
+    candidate="$dir/$hook_name"
+    if [ -f "$candidate" ] && ! [ "$candidate" -ef "$0" ]; then
+      printf '%s' "$candidate"
+      return 0
+    fi
+  done
+  return 1
+}
+
+if [ -z "${CODE_FOUNDRY_HOOK_CHAIN:-}" ]; then
+  if machine="$(machine_hook pre-commit)"; then
+    # The marker travels through the machine hook into anything it delegates
+    # back to: a guard that chains to .githooks/pre-commit (a mutual-delegation
+    # pair) re-enters this hook, sees the marker, and runs the gate instead of
+    # chaining again — machine policy once, project policy once, no loop.
+    if [ -x "$machine" ]; then
+      CODE_FOUNDRY_HOOK_CHAIN=1 "$machine" "$@" || exit $?
+    else
+      CODE_FOUNDRY_HOOK_CHAIN=1 sh "$machine" "$@" || exit $?
+    fi
+  fi
+fi
+
 # Prefer a runtime the repository already depends on. A repository opts into
 # the gate by depending on code-foundry; one that does not keeps the
 # whitespace guard and stays offline. Nothing is fetched at commit time.

package/.gitignore

@@ -78,3 +78,8 @@ mise.local.toml
 mise.local.lock
 .mise.local.lock
 *.code-workspace
+
+# Machine-local git hook delegates written by Code Foundry sync; only the
+# committed pre-commit gate is tracked.
+.githooks/*
+!.githooks/pre-commit

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.46.6](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.5...v1.46.6) (2026-10-08)
+
+
+### Bug Fixes
+
+* **pre-commit:** build before lint and type-check when the gate opts in ([#748](https://github.com/0xPlayerOne/code-foundry/issues/748)) ([f56454f](https://github.com/0xPlayerOne/code-foundry/commit/f56454f313a1a5b802b8a17b09d850902de1ba55)), closes [#691](https://github.com/0xPlayerOne/code-foundry/issues/691)
+
+## [1.46.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.4...v1.46.5) (2026-10-08)
+
+
+### Bug Fixes
+
+* **sync:** chain machine-level hooks instead of silencing them ([#747](https://github.com/0xPlayerOne/code-foundry/issues/747)) ([7fcad52](https://github.com/0xPlayerOne/code-foundry/commit/7fcad52d400dbb2aaa9ba46c0c76f14e8d63f660)), closes [#690](https://github.com/0xPlayerOne/code-foundry/issues/690)
+
 ## [1.46.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.3...v1.46.4) (2026-10-08)
 
 
@@ -126,23 +140,9 @@
 
 * **ci:** cancel only superseded pull-request runs in managed workflows ([#710](https://github.com/0xPlayerOne/code-foundry/issues/710)) ([f5fead6](https://github.com/0xPlayerOne/code-foundry/commit/f5fead677c032d253f2e1a2a256da4f207ddfa2a))
 
-## [1.44.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.0...v1.44.1) (2026-10-03)
-
-
-### Bug Fixes
-
-* **release:** budget the package without the changelog and ship recent history only ([#708](https://github.com/0xPlayerOne/code-foundry/issues/708)) ([ab365e0](https://github.com/0xPlayerOne/code-foundry/commit/ab365e0910472c3596429adc86a1c8f3e19730f9))
-
-## [1.44.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.43.2...v1.44.0) (2026-10-03)
-
-
-### Features
-
-* **pre-commit:** make the commit gate change-aware ([#702](https://github.com/0xPlayerOne/code-foundry/issues/702)) ([f5bca91](https://github.com/0xPlayerOne/code-foundry/commit/f5bca91c177b30b99f5d62287255d191617b4788))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 239 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 241 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/CONFIGURATION.md

@@ -131,7 +131,7 @@ See [Merge queue validation](merge-queues.md) before enabling it.
 | `coverage_minimum`                        | `0`–`100`                                            | Minimum percentage; defaults to `80`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `coverage_metrics`                        | `lines`, `functions`, `branches`, `statements`       | Metrics checked by the coverage gate.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `coverage_report`                         | comma-separated repository paths                     | Istanbul JSON summary or LCOV evidence files.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `pre_commit_build`                        | `true`, `false`                                      | Run the project's build in the local pre-commit gate. Defaults to `false`; see [Pre-commit gate](#pre-commit-gate).                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `pre_commit_build`                        | `true`, `false`                                      | Run the project's build in the local pre-commit gate, before lint and type-check (mirroring CI's ordering). Defaults to `false`; see [Pre-commit gate](#pre-commit-gate).                                                                                                                                                                                                                                                                                                                                                                             |
 | `filter_<task>`                           | comma-separated repository path globs                | Skip a lane when no changed path matches; see [Lane path filters](#lane-path-filters).                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | `rust_sccache`                            | `true`, `false`                                      | Install sccache and wrap rustc so compile artifacts survive manifest/lockfile churn.                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | `rust_nextest`                            | `true`, `false`                                      | Install cargo-nextest and prefer `cargo nextest run` over `cargo test` in Rust test lanes.                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
@@ -194,13 +194,38 @@ gate is change-aware and never runs work for code the commit cannot affect:
   Clippy.
 - The build does not run at commit time; CI and explicit commands own it. Set
   `pre_commit_build: true` to run the `build` script (or `cargo build`) when
-  code is staged.
+  code is staged. The build then runs before lint and type-check — mirroring
+  CI's ordering — because those tasks read built package output. With the
+  build disabled, a lint or type-check failure that a fresh clone's missing
+  build output could explain is printed with a one-line note saying so instead
+  of a bare error.
 
 Tools read working-tree contents, so a partially staged file is checked as it
 exists on disk. Task scripts that declare dependencies of their own, such as a
 Turborepo `typecheck` task with `dependsOn: ["^build"]`, still run them; drop
 that dependency to keep type checks build-free.
 
+### Machine-level hook chaining
+
+`core.hooksPath` names a single directory, so enabling `.githooks` would
+silence every hook in the machine's own hooks directory: secret guards,
+git-lfs, signing. Sync chains instead of replacing. The generated
+`.githooks/pre-commit` discovers a machine-level `pre-commit` at run time —
+from the hooks directory sync replaced (recorded as the
+`code-foundry.previousHooksPath` repository config), then the global
+`core.hooksPath`, then the checkout's default hooks directory — and runs it
+before the gate, so a cheap secret guard rejects before the heavier project
+checks. The committed hook stays machine-independent; the target is resolved
+on the machine that runs it.
+
+Hook names this repository does not own (`post-checkout`, `pre-push`,
+`commit-msg`, and the other client-side hooks) get delegating stubs in
+`.githooks` when a machine-level counterpart exists, which is what keeps
+git-lfs working after sync. Stubs are machine-local, gitignored, rewritten on
+every sync, and removed once the machine hook they mirrored disappears.
+`code-foundry doctor` warns when a machine-level pre-commit exists but the
+installed hook predates chaining.
+
 ## Release and branch policy
 
 | Key                       | Values                                                                           | Purpose                                                                 |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.46.4",
+  "version": "1.46.6",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/doctor.mjs

@@ -1,7 +1,7 @@
 // @ts-check
 
-import { existsSync, readFileSync, readdirSync } from 'node:fs'
-import { join, resolve } from 'node:path'
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
+import { join, resolve, isAbsolute } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { includesValue, readConfig } from '../lib/config.mjs'
 import { recommendRunners, resolveProfile } from '../lib/profile.mjs'
@@ -53,6 +53,29 @@ export function doctor(root, options = {}) {
       warn(
         '.githooks/pre-commit does not delegate to the Code Foundry gate; run `npx code-foundry sync`'
       )
+    // core.hooksPath shadows every machine-level hook behind it (secret
+    // guards, git-lfs). The generated hook chains to the machine's pre-commit
+    // when sync recorded one, so a machine hook without the chain marker in
+    // the installed hook is exactly the silent-disable bug chaining exists to
+    // prevent.
+    const hookText = existsSync(hookFile) ? readFileSync(hookFile, 'utf8') : ''
+    const machineDirs = [
+      git(target, ['config', '--get', 'code-foundry.previousHooksPath']),
+      git(target, ['config', '--global', '--get', 'core.hooksPath']),
+      `${git(target, ['rev-parse', '--git-common-dir']) || '.git'}/hooks`,
+    ].filter((dir) => dir && dir !== '.githooks' && dir !== './.githooks')
+    const machinePreCommit = machineDirs.some((dir) => {
+      const candidate = isAbsolute(dir) ? join(dir, 'pre-commit') : join(target, dir, 'pre-commit')
+      try {
+        return statSync(candidate).isFile()
+      } catch {
+        return false
+      }
+    })
+    if (machinePreCommit && !hookText.includes('machine_hook'))
+      warn(
+        'A machine-level pre-commit exists but the installed hook does not chain to it; run `npx code-foundry sync`'
+      )
   }
   if (
     ['rust', 'python', 'solidity'].some((language) =>

package/src/commands/sync.mjs

@@ -7,9 +7,10 @@ import {
   readdirSync,
   readFileSync,
   rmSync,
+  statSync,
   writeFileSync,
 } from 'node:fs'
-import { dirname, join, resolve } from 'node:path'
+import { dirname, isAbsolute, join, resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import {
   detectLanguages,
@@ -550,7 +551,17 @@ function synchronize(options) {
     existsSync(join(target, '.githooks/pre-commit'))
   ) {
     chmodSync(join(target, '.githooks/pre-commit'), 0o755)
+    // core.hooksPath names a single directory, so pointing it at .githooks
+    // would silence every machine-level hook behind it (secret guards,
+    // git-lfs, signing). Record what is being replaced so the generated
+    // hooks can chain back to it, then delegate the hook names this
+    // repository does not own.
+    const previousHooksPath = gitOutput(target, ['config', '--get', 'core.hooksPath'])
+    if (previousHooksPath && previousHooksPath !== '.githooks') {
+      git(target, ['config', 'code-foundry.previousHooksPath', previousHooksPath])
+    }
     git(target, ['config', 'core.hooksPath', '.githooks'])
+    syncMachineHookDelegates(target, previousHooksPath)
   }
   console.log(`${changed.length} baseline file(s) differ.`)
   if (overlays.custom_workflows === 'preserve') {
@@ -1848,6 +1859,138 @@ function git(target, args) {
   spawnSync('git', args, { cwd: target, stdio: 'ignore' })
 }
 
+/** @param {string} target @param {string[]} args @returns {string} */
+function gitOutput(target, args) {
+  const result = spawnSync('git', args, { cwd: target, encoding: 'utf8' })
+  return result.status === 0 ? (result.stdout ?? '').trim() : ''
+}
+
+/**
+ * Hook names git runs on the client that Code Foundry does not own. When one
+ * of these exists in a machine-level hooks directory, sync writes a
+ * delegating stub for it so enabling `core.hooksPath=.githooks` keeps the
+ * machine's hooks (git-lfs, secret scanners) firing.
+ */
+const MACHINE_DELEGATED_HOOKS = [
+  'applypatch-msg',
+  'commit-msg',
+  'prepare-commit-msg',
+  'post-applypatch',
+  'post-checkout',
+  'post-commit',
+  'post-merge',
+  'post-rewrite',
+  'pre-applypatch',
+  'pre-auto-gc',
+  'pre-rebase',
+  'pre-push',
+  'reference-transaction',
+  'sendemail-validate',
+  'post-index-change',
+]
+
+/**
+ * The hooks directories a machine-level hook may live in, in the order the
+ * generated hooks probe them: the repository hooks path sync just replaced,
+ * then the global one, then the checkout's default directory. Relative values
+ * resolve against the repository root, matching git's own semantics.
+ *
+ * @param {string} target @param {string} previousHooksPath @returns {string[]}
+ */
+function machineHooksDirectories(target, previousHooksPath) {
+  return [
+    previousHooksPath,
+    gitOutput(target, ['config', '--global', '--get', 'core.hooksPath']),
+    `${gitOutput(target, ['rev-parse', '--git-common-dir']) || '.git'}/hooks`,
+  ].flatMap((dir) => {
+    if (!dir || dir === '.githooks' || dir === './.githooks') return []
+    return [isAbsolute(dir) ? dir : join(target, dir)]
+  })
+}
+
+/**
+ * The delegating stub for one machine-level hook name. Self-contained: the
+ * machine's hooks directories are re-probed at run time so the committed
+ * templates never bake in machine-specific paths.
+ *
+ * @param {string} name
+ */
+const machineDelegateStub = (name) => `#!/usr/bin/env sh
+# Generated by Code Foundry — delegates ${name} to the machine-level hook so
+# enabling .githooks keeps secret guards, git-lfs, and other machine hooks
+# working. Discovery mirrors .githooks/pre-commit; rerun sync after changing
+# the machine's hooks.
+set -eu
+machine_hook() {
+  hook_name="$1"
+  for dir in \\
+    "$(git config --get code-foundry.previousHooksPath 2>/dev/null || true)" \\
+    "$(git config --global --get core.hooksPath 2>/dev/null || true)" \\
+    "$(git rev-parse --git-common-dir 2>/dev/null || printf '.git')/hooks"
+  do
+    case "$dir" in
+      '' | .githooks | ./.githooks | */.githooks) continue ;;
+    esac
+    candidate="$dir/$hook_name"
+    if [ -f "$candidate" ] && ! [ "$candidate" -ef "$0" ]; then
+      printf '%s' "$candidate"
+      return 0
+    fi
+  done
+  return 1
+}
+if [ -n "\${CODE_FOUNDRY_HOOK_CHAIN:-}" ]; then
+  exit 0
+fi
+if machine="$(machine_hook ${name})"; then
+  # The marker makes a machine hook that delegates back to .githooks settle
+  # here instead of looping.
+  if [ -x "$machine" ]; then
+    CODE_FOUNDRY_HOOK_CHAIN=1 exec "$machine" "$@"
+  else
+    CODE_FOUNDRY_HOOK_CHAIN=1 exec sh "$machine" "$@"
+  fi
+fi
+exit 0
+`
+
+/**
+ * Write delegating stubs into .githooks for every machine-level hook this
+ * repository does not own, and remove stubs the machine no longer backs. The
+ * stubs are machine-local (gitignored): they are rewritten on every sync and
+ * only ever removed when their content carries this generator's marker.
+ *
+ * @param {string} target @param {string} previousHooksPath
+ */
+function syncMachineHookDelegates(target, previousHooksPath) {
+  const directories = machineHooksDirectories(target, previousHooksPath)
+  /** @param {string} name */
+  const machineHook = (name) => {
+    for (const dir of directories) {
+      const candidate = join(dir, name)
+      try {
+        if (statSync(candidate).isFile()) return candidate
+      } catch {
+        // Absent from this directory; keep probing.
+      }
+    }
+    return null
+  }
+  mkdirSync(join(target, '.githooks'), { recursive: true })
+  for (const name of MACHINE_DELEGATED_HOOKS) {
+    const stubPath = join(target, '.githooks', name)
+    if (machineHook(name)) {
+      writeFileSync(stubPath, machineDelegateStub(name))
+      chmodSync(stubPath, 0o755)
+    } else if (
+      existsSync(stubPath) &&
+      readFileSync(stubPath, 'utf8').includes('Generated by Code Foundry')
+    ) {
+      rmSync(stubPath)
+    }
+  }
+}
+
 /** @param {string} file @param {Buffer|string} content @param {boolean} dryRun */
 function writeOrReport(file, content, dryRun) {
   if (dryRun) {

package/src/lib/pre-commit.mjs

@@ -98,6 +98,25 @@ export function preCommitBuildEnabled(value) {
   return resolved === 'true'
 }
 
+/**
+ * The one-line explanation printed when lint or type-check fails while the
+ * commit-time build is disabled. CI builds before those tasks, so a fresh
+ * clone can fail the gate against an unmodified tree — a bare ENOENT trains
+ * `--no-verify` unless the gate names the actual problem.
+ *
+ * @param {{ build: boolean, buildScript: boolean, packageManager: string | null }} options
+ * @returns {string | undefined} The hint, or undefined when it cannot apply.
+ */
+export function freshCloneBuildHint({ build, buildScript, packageManager }) {
+  if (build || !buildScript) return undefined
+  const runner = packageManager ?? 'npm'
+  return (
+    `note: these checks may be reading missing build output on a fresh clone; ` +
+    `run "${runner} run build" once, or set pre_commit_build: true in ` +
+    `.github/code-foundry.yml to build before lint and type-check`
+  )
+}
+
 /**
  * Split a file list so one tool invocation never exceeds the platform's
  * argument-length limit on very large commits.

package/src/runtime-core.mjs

@@ -25,6 +25,7 @@ import {
   parseStagedFiles,
   planPreCommit,
   preCommitBuildEnabled,
+  freshCloneBuildHint,
 } from './lib/pre-commit.mjs'
 import { runNodePackagePerformance } from './lib/node-package-performance.mjs'
 import {
@@ -428,16 +429,20 @@ function commandExists(command) {
   return spawnSync(command, ['--version'], { stdio: 'ignore' }).status === 0
 }
 
-/** @param {string} command @param {string[]} [args] @param {Record<string, unknown>} [options] */
+/** @param {string} command @param {string[]} [args] @param {{ onFailure?: string }} [options] */
 function run(command, args = [], options = {}) {
+  const { onFailure, ...spawnOptions } = options
   const result = spawnSync(command, args, {
     cwd: root,
     stdio: 'inherit',
     env: process.env,
-    ...options,
+    ...spawnOptions,
   })
   if (result.error) throw result.error
-  if (result.status !== 0) process.exit(result.status ?? 1)
+  if (result.status !== 0) {
+    if (onFailure) console.error(onFailure)
+    process.exit(result.status ?? 1)
+  }
 }
 
 // pip-audit can report its clean result with a non-zero status when the
@@ -494,28 +499,28 @@ function packageCommand(args) {
   }
 }
 
-/** @param {string[]} names */
-function runScript(names) {
+/** @param {string[]} names @param {{ onFailure?: string }} [options] */
+function runScript(names, options = {}) {
   const name = names.find((candidate) => hasScript(candidate))
   if (!name) return false
   const [manager, args] = packageCommand(['run', name])
   if (!manager) return false
-  run(manager, args)
+  run(manager, args, options)
   return true
 }
 
-/** @param {string} tool @param {string[]} [args] */
-function runTool(tool, args = []) {
+/** @param {string} tool @param {string[]} [args] @param {{ onFailure?: string }} [options] */
+function runTool(tool, args = [], options = {}) {
   if (['ruff', 'pytest', 'pylint'].includes(tool)) {
     const venvTool = resolve(root, `.venv/bin/${tool}`)
-    if (existsSync(venvTool)) return run(venvTool, args)
+    if (existsSync(venvTool)) return run(venvTool, args, options)
   }
   const [manager] = packageCommand([])
-  if (manager === 'bun') return run('bunx', ['--no-install', tool, ...args])
-  if (manager === 'pnpm') return run('pnpm', ['exec', tool, ...args])
-  if (manager === 'yarn') return run('yarn', ['exec', tool, ...args])
-  if (manager === 'npm') return run('npx', ['--no-install', tool, ...args])
-  return run(tool, args)
+  if (manager === 'bun') return run('bunx', ['--no-install', tool, ...args], options)
+  if (manager === 'pnpm') return run('pnpm', ['exec', tool, ...args], options)
+  if (manager === 'yarn') return run('yarn', ['exec', tool, ...args], options)
+  if (manager === 'npm') return run('npx', ['--no-install', tool, ...args], options)
+  return run(tool, args, options)
 }
 
 function install() {
@@ -1193,9 +1198,11 @@ function runToolOnFiles(tool, args, files) {
  *
  * The gate is change-aware: it formats and lints only staged files, runs the
  * project's type-check command only when typed sources or compiler config are
- * staged, and never builds unless `pre_commit_build: true` opts back in. The
- * full suite still runs in CI. Tools see working-tree contents, so a partially
- * staged file is checked as it exists on disk.
+ * staged, and never builds unless `pre_commit_build: true` opts back in — in
+ * which case the build runs before lint and type-check, mirroring CI's
+ * ordering, because those tasks read built package output. The full suite
+ * still runs in CI. Tools see working-tree contents, so a partially staged
+ * file is checked as it exists on disk.
  */
 export function preCommit() {
   const staged = parseStagedFiles(
@@ -1225,9 +1232,22 @@ export function preCommit() {
       runScript(['format:check', 'format', 'fmt'])
     }
   }
+  // Mirror CI's prerequisite ordering: lint, boundary, and type-check tasks
+  // read built package output, so the opt-in build runs before them. Format
+  // stays first for the fastest feedback on the most common failure. Without
+  // the opt-in, a failure that CI (which builds first) cannot reproduce gets
+  // the one-line explanation instead of training `--no-verify`.
+  if (plan.build) ci('build')
+  const buildHint = freshCloneBuildHint({
+    build: plan.build,
+    buildScript: hasScript('build'),
+    packageManager: packageCommand([])[0],
+  })
+
   if (js && (plan.lintAll || plan.lintFiles.length)) {
     if (plan.lintAll) {
-      if (!runScript(['lint']) && hasOxlintSetup()) runTool('oxlint', ['--deny-warnings'])
+      if (!runScript(['lint'], { onFailure: buildHint }) && hasOxlintSetup())
+        runTool('oxlint', ['--deny-warnings'])
     } else if (hasOxlintSetup()) {
       runToolOnFiles(
         'oxlint',
@@ -1241,8 +1261,11 @@ export function preCommit() {
   if (js && plan.typeCheck) {
     // Use the project's own command so project references, workspaces, and
     // path aliases resolve exactly as they do in CI.
-    const scripted = runScript(['type-check', 'typecheck', 'type:check'])
-    if (!scripted && existsSync(resolve(root, 'tsconfig.json'))) runTool('tsc', ['--noEmit'])
+    const scripted = runScript(['type-check', 'typecheck', 'type:check'], {
+      onFailure: buildHint,
+    })
+    if (!scripted && existsSync(resolve(root, 'tsconfig.json')))
+      runTool('tsc', ['--noEmit'], { onFailure: buildHint })
   }
   if (plan.rust) {
     run('cargo', ['fmt', '--check'])
@@ -1255,7 +1278,6 @@ export function preCommit() {
     runToolOnFiles('ruff', ['format', '--check', '--force-exclude'], plan.pythonFiles)
     runToolOnFiles('ruff', ['check', '--force-exclude'], plan.pythonFiles)
   }
-  if (plan.build) ci('build')
 }
 
 // Only dispatch when this module is the process entry point. The CLI imports

package/src/templates/gitignore

@@ -83,3 +83,8 @@ mise.local.toml
 mise.local.lock
 .mise.local.lock
 *.code-workspace
+
+# Machine-local git hook delegates written by Code Foundry sync; only the
+# committed pre-commit gate is tracked.
+.githooks/*
+!.githooks/pre-commit