javi-forge 1.6.0 → 1.7.0

package/ci-local/hooks/pre-push

@@ -4,15 +4,19 @@
 # =============================================================================
 # Requires: npm install -g javi-forge
 # To skip:  git push --no-verify
+# Target:   ~3 minutes when Docker is running. Elapsed time logged below.
 # =============================================================================
 
 set -e
 
+_start=$SECONDS
+
 if docker info &>/dev/null; then
     echo "PRE-PUSH: Running full CI simulation..."
     javi-forge ci || {
+        _elapsed=$((SECONDS - _start))
         echo ""
-        echo "CI FAILED — Push aborted. Fix the issues above before pushing."
+        echo "CI FAILED after ${_elapsed}s — Push aborted. Fix the issues above before pushing."
         echo "To skip: git push --no-verify"
         exit 1
     }
@@ -20,9 +24,16 @@ else
     echo "PRE-PUSH: ⚠ Docker not running — running quick checks only (lint + typecheck)"
     echo "  Start Docker for full CI (security scan, Docker tests)"
     javi-forge ci --quick --no-docker --no-security --no-ci-ghagga || {
+        _elapsed=$((SECONDS - _start))
         echo ""
-        echo "Quick checks FAILED — Push aborted. Fix the issues above before pushing."
+        echo "Quick checks FAILED after ${_elapsed}s — Push aborted. Fix the issues above before pushing."
         echo "To skip: git push --no-verify"
         exit 1
     }
 fi
+
+_elapsed=$((SECONDS - _start))
+echo "PRE-PUSH: ${_elapsed}s (target: 180s)"
+if [ "$_elapsed" -gt 300 ]; then
+    echo "  WARNING: pre-push took ${_elapsed}s, well over the 180s target."
+fi

package/ci-local/install.ps1

@@ -0,0 +1,367 @@
+# =============================================================================
+# CI-LOCAL: Installation Script (PowerShell)
+# =============================================================================
+# Mirror of ci-local/install.sh for Windows / PowerShell users.
+#
+# Usage:
+#   .\install.ps1
+#
+# Behaviour MUST match install.sh. Diff against the bash version on every
+# change. Test on real Windows + WSL + macOS pwsh before tagging a release.
+# =============================================================================
+
+#Requires -Version 7.2
+[CmdletBinding()]
+param()
+
+# Defense-in-depth: #Requires is parsed by some hosts AFTER the script body.
+# 7.2 is the minimum because FileSystemInfo.ResolveLinkTarget($true) is .NET 6+,
+# which shipped with pwsh 7.2. Earlier pwsh 7.x runs on .NET 5 and the method
+# is absent — the symlink check would silently fall back to no-op.
+if ($PSVersionTable.PSEdition -ne 'Core' -or $PSVersionTable.PSVersion -lt [Version]'7.2') {
+    Write-Host 'ERROR: ci-local install.ps1 requires PowerShell 7.2+ (pwsh).' -ForegroundColor Red
+    Write-Host "Detected: $($PSVersionTable.PSEdition) $($PSVersionTable.PSVersion)" -ForegroundColor Yellow
+    Write-Host 'Install: https://github.com/PowerShell/PowerShell/releases' -ForegroundColor Cyan
+    exit 1
+}
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+$ScriptDir  = Split-Path -Parent $PSCommandPath
+$ProjectDir = Split-Path -Parent $ScriptDir
+
+# ─── Symlink-safe path resolver ────────────────────────────────────
+# Defined inline (NOT in lib/common.psm1) because we need it BEFORE the
+# module is loaded — Import-Module on a hostile symlink would already
+# execute the attacker's code. Audit round 4 PoC verified.
+# Fails closed: any exception aborts the script.
+#
+# DEFENSE — alias / function shadowing (round 5):
+# PowerShell command resolution is Alias > Function > Cmdlet. A
+# pre-existing GLOBAL alias of the same name would beat our local
+# function. Remove any prior binding before defining, and verify the
+# resolved Get-Command points to OUR script file.
+Remove-Item Alias:Resolve-RealPath    -Force -ErrorAction SilentlyContinue
+Remove-Item Function:Resolve-RealPath -Force -ErrorAction SilentlyContinue
+function Resolve-RealPath([string]$P) {
+    if ([string]::IsNullOrEmpty($P)) {
+        throw "Resolve-RealPath: empty path"
+    }
+    $item = Get-Item -LiteralPath $P -Force -ErrorAction Stop
+    $target = $item.ResolveLinkTarget($true)
+    if ($target) {
+        # ResolveLinkTarget($true) is platform-inconsistent for dangling
+        # links: Linux throws on the call above, but Windows returns a
+        # FileSystemInfo whose .Exists is false. Treat both the same.
+        if (-not $target.Exists) {
+            throw "Resolve-RealPath: dangling symlink target $($target.FullName)"
+        }
+        return $target.FullName
+    }
+    return $item.FullName
+}
+$_rr = Get-Command Resolve-RealPath -ErrorAction SilentlyContinue
+if (-not $_rr -or $_rr.CommandType -ne 'Function' -or $_rr.ScriptBlock.File -ne $PSCommandPath) {
+    Write-Host 'ERROR: Resolve-RealPath is shadowed by an external command' -ForegroundColor Red
+    if ($_rr) {
+        Write-Host "  Resolved to: $($_rr.CommandType) at $($_rr.ScriptBlock.File)" -ForegroundColor Yellow
+    }
+    exit 1
+}
+Remove-Variable _rr
+
+# Find the shared library (mirrors install.sh's source order).
+$libPath = Join-Path $ScriptDir '..' 'lib' 'common.psm1'
+if (-not (Test-Path -LiteralPath $libPath -PathType Leaf)) {
+    Write-Host "ERROR: lib/common.psm1 not found at $libPath" -ForegroundColor Red
+    Write-Host "Copy lib/ alongside ci-local/ (see README)." -ForegroundColor Yellow
+    exit 1
+}
+
+# SECURITY: validate the module BEFORE importing. A hostile symlink runs
+# attacker code at user privilege as soon as Import-Module evaluates it.
+# Round 4 (2026-05-17) PoC verified the same hijack on install.sh side.
+try {
+    $libReal     = Resolve-RealPath $libPath
+    $projectReal = Resolve-RealPath $ProjectDir
+} catch {
+    Write-Host "ERROR: could not resolve lib/common.psm1 or project root: $($_.Exception.Message)" -ForegroundColor Red
+    exit 1
+}
+$sep = [System.IO.Path]::DirectorySeparatorChar
+if (-not ($libReal.Equals($projectReal, [StringComparison]::OrdinalIgnoreCase) -or
+          $libReal.StartsWith($projectReal + $sep, [StringComparison]::OrdinalIgnoreCase))) {
+    Write-Host 'ERROR: lib/common.psm1 resolves outside the project root' -ForegroundColor Red
+    Write-Host "  LIB resolved:     $libReal" -ForegroundColor Yellow
+    Write-Host "  PROJECT resolved: $projectReal" -ForegroundColor Yellow
+    Write-Host 'Refusing to import. Investigate symlinks under lib/.' -ForegroundColor Yellow
+    exit 1
+}
+
+Import-Module $libPath -Force
+
+Write-Host '=== CI-LOCAL Installation ===' -ForegroundColor Cyan
+
+Push-Location -LiteralPath $ProjectDir
+try {
+
+    # ─── Verify javi-forge CLI is available ────────────────────────────
+    # The git hooks (pre-commit, pre-push) invoke `javi-forge ci ...`.
+    # Catch a missing CLI BEFORE configuring hooks so the user gets a
+    # clear error instead of a silent "command not found" on first commit.
+    if (-not (Test-CommandExists -Name 'javi-forge')) {
+        Write-Host 'ERROR: javi-forge CLI not found in PATH' -ForegroundColor Red
+        Write-Host ''
+        Write-Host 'The git hooks (pre-commit, pre-push) require the javi-forge CLI.'
+        Write-Host 'Install it globally:'
+        Write-Host '  npm install -g javi-forge' -ForegroundColor Cyan
+        Write-Host ''
+        Write-Host 'Or, if you are developing javi-forge itself, link the workspace:'
+        Write-Host '  pnpm link --global' -ForegroundColor Cyan
+        Write-Host ''
+        exit 1
+    }
+
+    # Resolve the binary path. Get-Command returns an ApplicationInfo whose
+    # .Source is the absolute path. Resolve any symlink chain via .Target
+    # (PowerShell 6+ exposes symlink Target on FileInfo).
+    $jfCmd  = Get-Command -Name 'javi-forge'
+    $jfPath = $jfCmd.Source
+    $jfReal = $jfPath
+    try {
+        $jfItem = Get-Item -LiteralPath $jfPath -Force -ErrorAction Stop
+        if ($jfItem.LinkType -eq 'SymbolicLink' -and $jfItem.Target) {
+            $target = $jfItem.Target
+            if ($target -is [array]) { $target = $target[0] }
+            if (-not [System.IO.Path]::IsPathRooted($target)) {
+                $target = Join-Path (Split-Path -Parent $jfPath) $target
+            }
+            $jfReal = [System.IO.Path]::GetFullPath($target)
+        }
+    } catch {
+        # If Get-Item fails (e.g. on platforms without symlink support), keep $jfPath.
+    }
+
+    $jfVersionOk     = $true
+    $jfVersionOutput = ''
+    try {
+        $jfVersionOutput = (& javi-forge --version 2>&1) -join "`n"
+        if ($LASTEXITCODE -ne 0) { $jfVersionOk = $false }
+    } catch {
+        $jfVersionOk     = $false
+        $jfVersionOutput = $_.Exception.Message
+    }
+
+    if ($jfVersionOk) {
+        if ($jfPath -eq $jfReal) {
+            Write-Host "javi-forge: $jfVersionOutput ($jfPath)" -ForegroundColor Green
+        } else {
+            Write-Host "javi-forge: $jfVersionOutput ($jfPath -> $jfReal)" -ForegroundColor Green
+        }
+    } else {
+        Write-Host "ERROR: javi-forge found at $jfPath but '--version' failed" -ForegroundColor Red
+        Write-Host "Output: $jfVersionOutput" -ForegroundColor Yellow
+        Write-Host 'Reinstall: npm install -g javi-forge' -ForegroundColor Cyan
+        exit 1
+    }
+
+    # Reject UNC / remote paths outright — a javi-forge symlinked to
+    # \\attacker\share passes the writable-cache check because none of the
+    # prefixes match. Two forms to handle:
+    #   \\server\share\path         → UNC (reject)
+    #   \\?\UNC\server\share\path   → extended-length UNC (reject)
+    #   \\?\C:\very\long\path       → extended-length LOCAL (allow)
+    if ($jfReal -like '\\\\?\\UNC\\*' -or
+        ($jfReal -like '\\\\*' -and -not ($jfReal -like '\\\\?\\*'))) {
+        Write-Host "ERROR: javi-forge resolves to a UNC / network path ($jfReal)." -ForegroundColor Red
+        Write-Host 'Refusing to wire hooks against a remote binary.' -ForegroundColor Yellow
+        exit 1
+    }
+
+    # Warn if the resolved path is in a writable / cache / temp location.
+    # Build the candidate list defensively: an empty env var would produce
+    # something like Join-Path '' 'npm-cache' = 'npm-cache', which then
+    # matches every path containing that substring (Opus-alt PoC).
+    function Test-IsAbsolutePath([string]$P) {
+        if ([string]::IsNullOrWhiteSpace($P)) { return $false }
+        try { return [System.IO.Path]::IsPathRooted($P) } catch { return $false }
+    }
+
+    $tempPaths = @('/tmp/', '/var/tmp/', '/dev/shm/')
+    foreach ($candidate in @(
+        (Join-Path $HOME '.cache'),
+        (Join-Path $HOME '.npm/_npx'),
+        (Join-Path $HOME '.pnpm-store')
+    )) {
+        if (Test-IsAbsolutePath $candidate) { $tempPaths += $candidate }
+    }
+    if (Test-IsAbsolutePath $env:TEMP)         { $tempPaths += $env:TEMP }
+    if (Test-IsAbsolutePath $env:LOCALAPPDATA) { $tempPaths += (Join-Path $env:LOCALAPPDATA 'npm-cache') }
+    if (Test-IsAbsolutePath $env:APPDATA)      { $tempPaths += (Join-Path $env:APPDATA 'npm') }
+
+    foreach ($p in $tempPaths) {
+        if ([string]::IsNullOrWhiteSpace($p)) { continue }
+        if ($jfReal.StartsWith($p, [StringComparison]::OrdinalIgnoreCase)) {
+            Write-Host "WARNING: javi-forge resolves to a writable/cache directory ($jfReal)." -ForegroundColor Yellow
+            Write-Host 'Caches can be overwritten by package installs — prefer a stable global location.' -ForegroundColor Yellow
+            break
+        }
+    }
+
+    # ─── Configure git hooks ──────────────────────────────────────────
+    Write-Host '[1/2] Configuring git hooks...' -ForegroundColor Yellow
+
+    # Detect competing hook managers BEFORE we touch core.hooksPath.
+    if (Test-Path -LiteralPath '.husky' -PathType Container) {
+        Write-Host 'WARNING: husky detected (.husky/). ci-local will override its hooks via core.hooksPath.' -ForegroundColor Yellow
+        Write-Host "If you want to keep husky: 'pnpm remove husky' first, OR back out of this install." -ForegroundColor Yellow
+    }
+    if ((Test-Path -LiteralPath 'lefthook.yml' -PathType Leaf) -or
+        (Test-Path -LiteralPath 'lefthook.yaml' -PathType Leaf)) {
+        Write-Host 'WARNING: lefthook detected. ci-local will override its hooks via core.hooksPath.' -ForegroundColor Yellow
+    }
+
+    # Backup existing .git/hooks/ files BEFORE we redirect hooksPath.
+    $existingHooks = (& git config --get core.hooksPath 2>$null) -join ''
+    if ($existingHooks -and $existingHooks -ne 'ci-local/hooks' -and $existingHooks -ne '.ci-local/hooks') {
+        Write-Host "WARNING: existing core.hooksPath was $existingHooks. It will be replaced." -ForegroundColor Yellow
+    }
+    foreach ($hook in 'pre-commit', 'commit-msg', 'pre-push') {
+        $hookPath = ".git/hooks/$hook"
+        $bakPath  = "$hookPath.bak"
+        if ((Test-Path -LiteralPath $hookPath -PathType Leaf) -and
+            (-not (Test-Path -LiteralPath $bakPath -PathType Leaf))) {
+            $size = (Get-Item -LiteralPath $hookPath).Length
+            if ($size -gt 0) {
+                Copy-Item -LiteralPath $hookPath -Destination $bakPath -Force
+                Write-Host "  Backed up existing $hookPath -> $bakPath" -ForegroundColor Yellow
+            }
+        }
+    }
+
+
+    # Compute hooksPath RELATIVE to the project root so the same install.ps1
+    # works whether the dir is "ci-local" (dev checkout) or ".ci-local"
+    # (user's project after copying via install instructions).
+    $hooksDir = Join-Path $ScriptDir 'hooks'
+
+    # SECURITY: reject hooksPath that escapes the project root. If
+    # ci-local/hooks is a symlink/junction pointing outside the project,
+    # GetRelativePath returns "../../../somewhere/evil" and every future
+    # commit executes whatever lives there. Audit round 3 caught this.
+    #
+    # Resolve-RealPath is defined at top level (BEFORE Import-Module) so we
+    # can reuse it here for the hooks-dir check. It fails closed — any
+    # exception aborts instead of falling back to GetFullPath which does
+    # not follow symlinks (the original fallback opened a hole flagged by
+    # audit round 4).
+    try {
+        $hooksAbs   = Resolve-RealPath $hooksDir
+        $projectAbs = Resolve-RealPath $ProjectDir
+    } catch {
+        Write-Host "ERROR: could not resolve hooks dir or project root: $($_.Exception.Message)" -ForegroundColor Red
+        exit 1
+    }
+    if (-not ($hooksAbs.Equals($projectAbs, [StringComparison]::OrdinalIgnoreCase) -or
+              $hooksAbs.StartsWith($projectAbs + $sep, [StringComparison]::OrdinalIgnoreCase))) {
+        Write-Host 'ERROR: hooks directory resolves outside the project root' -ForegroundColor Red
+        Write-Host "  HOOKS_DIR resolved to: $hooksAbs" -ForegroundColor Yellow
+        Write-Host "  PROJECT_DIR:           $projectAbs" -ForegroundColor Yellow
+        Write-Host 'Refusing to set core.hooksPath. Investigate symlinks/junctions under ci-local/.' -ForegroundColor Yellow
+        exit 1
+    }
+
+    try {
+        $hooksRel = [System.IO.Path]::GetRelativePath($projectAbs, $hooksAbs)
+    } catch {
+        $hooksRel = $hooksDir
+    }
+    # Normalize separators to forward slashes (git config uses POSIX paths).
+    $hooksRel = $hooksRel -replace '\\', '/'
+
+    & git config core.hooksPath $hooksRel
+    if ($LASTEXITCODE -ne 0) {
+        Write-Host 'ERROR: failed to set core.hooksPath. Are you inside a git repo?' -ForegroundColor Red
+        exit 1
+    }
+    Write-Host "hooksPath = $hooksRel" -ForegroundColor Green
+
+    # Make hooks executable. Different OS, different model:
+    #   - macOS / Linux / WSL: chmod 0755 — POSIX bits, what git expects.
+    #   - Windows native NTFS: chmod is a no-op; lock the ACL via icacls so
+    #     only the current user can rewrite the hooks between commits.
+    if (Test-CommandExists -Name 'chmod') {
+        Get-ChildItem -LiteralPath $hooksDir -File -ErrorAction SilentlyContinue |
+            ForEach-Object { & chmod 0755 $_.FullName }
+        Get-ChildItem -LiteralPath $ScriptDir -Filter '*.sh' -File -ErrorAction SilentlyContinue |
+            ForEach-Object { & chmod 0755 $_.FullName }
+    }
+    if ($IsWindows -and (Test-CommandExists -Name 'icacls')) {
+        # Restrict hooks dir to current user (F = full, OI/CI = inherit to
+        # files/subfolders). /inheritance:r drops any permissive parent ACL.
+        #
+        # Use the current user's SID rather than $env:USERNAME — usernames
+        # with spaces ("John Doe") or domain prefixes ("CONTOSO\jdoe")
+        # break the SDDL principal syntax; SIDs are unambiguous. Falls
+        # back to USERNAME only if the SID lookup fails.
+        $principal = $null
+        try {
+            $principal = ([System.Security.Principal.WindowsIdentity]::GetCurrent()).User.Value
+        } catch {
+            $principal = $env:USERNAME
+        }
+        if (-not $principal -or $principal -notmatch '^[\w\-\\:]+$') {
+            Write-Host 'WARNING: could not derive a safe principal for icacls; skipping ACL hardening.' -ForegroundColor Yellow
+        } else {
+            try {
+                & icacls $hooksDir /inheritance:r /grant:r "${principal}:(OI)(CI)F" *> $null
+                if ($LASTEXITCODE -ne 0) {
+                    Write-Host "WARNING: icacls on $hooksDir returned $LASTEXITCODE" -ForegroundColor Yellow
+                }
+            } catch {
+                Write-Host "WARNING: icacls failed: $($_.Exception.Message)" -ForegroundColor Yellow
+            }
+        }
+    }
+    Write-Host 'Done' -ForegroundColor Green
+
+    # ─── Dependency check ─────────────────────────────────────────────
+    Write-Host '[2/2] Checking dependencies...' -ForegroundColor Yellow
+
+    $dockerOk = $false
+    if (Test-CommandExists -Name 'docker') {
+        try {
+            & docker info *> $null
+            if ($LASTEXITCODE -eq 0) { $dockerOk = $true }
+        } catch { }
+    }
+    if ($dockerOk) {
+        Write-Host 'Docker: available' -ForegroundColor Green
+    } else {
+        Write-Host 'Docker: not running (required for pre-push CI)' -ForegroundColor Yellow
+    }
+
+    if (Test-CommandExists -Name 'semgrep') {
+        Write-Host 'Semgrep: installed (native)' -ForegroundColor Green
+    } elseif ($dockerOk) {
+        Write-Host 'Semgrep: available via Docker (returntocorp/semgrep)' -ForegroundColor Green
+    } else {
+        Write-Host 'Semgrep: not available (install semgrep or Docker)' -ForegroundColor Yellow
+    }
+
+    Write-Host ''
+    Write-Host 'Setup complete!' -ForegroundColor Green
+    Write-Host ''
+    Write-Host 'Hooks enabled:'
+    Write-Host '  - pre-commit: AI check + lint + security'
+    Write-Host '  - commit-msg: Block AI attribution (best-effort)'
+    Write-Host '  - pre-push:   CI simulation in Docker'
+    Write-Host ''
+    Write-Host 'NOTE: git hooks are bash scripts. On Windows they run via the'
+    Write-Host 'MSYS2 bash bundled with Git for Windows. WSL is also supported.'
+    Write-Host ''
+
+} finally {
+    Pop-Location
+}

package/ci-local/install.sh

@@ -8,18 +8,164 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
 
-# Source shared library for colors
-source "$SCRIPT_DIR/../lib/common.sh"
+# ─── Required tools (fail-closed) ──────────────────────────────────
+# realpath is load-bearing for the symlink-traversal checks below. If it's
+# missing, the fallback used to silently return unresolved paths, which let
+# a hostile symlink slip past. Audit round 4 (2026-05-17) PoC verified.
+if ! command -v realpath >/dev/null 2>&1; then
+    printf 'ERROR: realpath is required for ci-local install (symlink checks).\n' >&2
+    printf '  Linux/WSL: install coreutils\n' >&2
+    printf '  macOS:     brew install coreutils, then add gnubin to PATH\n' >&2
+    exit 1
+fi
+
+# ─── SECURITY: validate lib/common.sh BEFORE sourcing it ───────────
+# Sourcing a hostile symlink runs attacker code at user privilege BEFORE
+# any traversal check could fire. Round 4 PoC verified this on bash and
+# PowerShell. Resolve the lib path and abort if it escapes the project.
+LIB_FILE="$SCRIPT_DIR/../lib/common.sh"
+if [ ! -f "$LIB_FILE" ]; then
+    printf 'ERROR: lib/common.sh not found at %s\n' "$LIB_FILE" >&2
+    exit 1
+fi
+# realpath was hard-required above — failures here are unexpected, so let
+# set -e propagate them instead of swallowing with `|| true`.
+LIB_REAL=$(realpath "$LIB_FILE")
+PROJECT_REAL=$(realpath "$PROJECT_DIR")
+case "$LIB_REAL" in
+    "$PROJECT_REAL"|"$PROJECT_REAL"/*) ;;
+    *)
+        printf 'ERROR: lib/common.sh resolves outside the project root:\n' >&2
+        printf '  LIB resolved:     %s\n' "$LIB_REAL" >&2
+        printf '  PROJECT resolved: %s\n' "$PROJECT_REAL" >&2
+        printf 'Refusing to source. Investigate symlinks under lib/.\n' >&2
+        exit 1
+        ;;
+esac
+
+# Source the RESOLVED path, not the original. Round 5 flagged a TOCTOU:
+# between the realpath check and the source, an attacker could swap the
+# symlink target. Sourcing $LIB_REAL eliminates that window.
+source "$LIB_REAL"
 
 echo -e "${CYAN}=== CI-LOCAL Installation ===${NC}"
 
 cd "$PROJECT_DIR"
 
+# 0. Verify javi-forge CLI is available (required by hooks)
+# The git hooks (pre-commit, pre-push) invoke `javi-forge ci ...`.
+# If the CLI is missing, hooks fail silently with "command not found".
+# Catch this BEFORE configuring hooks so the user gets a clear error.
+if ! command -v javi-forge >/dev/null 2>&1; then
+    echo -e "${RED}ERROR: javi-forge CLI not found in PATH${NC}"
+    echo -e ""
+    echo -e "The git hooks (pre-commit, pre-push) require the javi-forge CLI."
+    echo -e "Install it globally:"
+    echo -e "  ${CYAN}npm install -g javi-forge${NC}"
+    echo -e ""
+    echo -e "Or, if you are developing javi-forge itself, link the workspace:"
+    echo -e "  ${CYAN}pnpm link --global${NC}"
+    echo -e ""
+    exit 1
+fi
+
+# Log resolved path. The hooks will trust whatever PATH gives them at commit
+# time — surface the binary location so the user catches a hijack early.
+# readlink -f resolves any symlink chain so a symlink trick (~/.local/bin
+# pointing to /tmp/evil) doesn't escape the writable-path warning below.
+JAVI_FORGE_PATH=$(command -v javi-forge)
+JAVI_FORGE_REAL=$(readlink -f "$JAVI_FORGE_PATH" 2>/dev/null || printf "%s" "$JAVI_FORGE_PATH")
+JAVI_FORGE_VERSION_OUTPUT=$(javi-forge --version 2>&1) && JAVI_FORGE_VERSION_OK=1 || JAVI_FORGE_VERSION_OK=0
+
+if [ "$JAVI_FORGE_VERSION_OK" -eq 1 ]; then
+    if [ "$JAVI_FORGE_PATH" = "$JAVI_FORGE_REAL" ]; then
+        echo -e "${GREEN}javi-forge: ${JAVI_FORGE_VERSION_OUTPUT} (${JAVI_FORGE_PATH})${NC}"
+    else
+        echo -e "${GREEN}javi-forge: ${JAVI_FORGE_VERSION_OUTPUT} (${JAVI_FORGE_PATH} -> ${JAVI_FORGE_REAL})${NC}"
+    fi
+else
+    echo -e "${RED}ERROR: javi-forge found at ${JAVI_FORGE_PATH} but '--version' failed${NC}"
+    echo -e "${YELLOW}Output: ${JAVI_FORGE_VERSION_OUTPUT}${NC}"
+    echo -e "Reinstall: ${CYAN}npm install -g javi-forge${NC}"
+    exit 1
+fi
+
+# Warn if the RESOLVED (post-symlink) path is in a writable-by-many or temp
+# location. Audit (2026-05-17) flagged additional locations beyond /tmp:
+# user-controlled caches and globals can be hijacked by a malicious package.
+case "$JAVI_FORGE_REAL" in
+    /tmp/*|/var/tmp/*|/dev/shm/*)
+        echo -e "${YELLOW}WARNING: javi-forge resolves to a temp directory (${JAVI_FORGE_REAL}).${NC}"
+        echo -e "${YELLOW}This is unusual and may indicate a compromised install.${NC}"
+        ;;
+    "$HOME"/.cache/*|"$HOME"/.npm/_npx/*|"$HOME"/.pnpm-store/*)
+        echo -e "${YELLOW}WARNING: javi-forge resolves to a cache directory (${JAVI_FORGE_REAL}).${NC}"
+        echo -e "${YELLOW}Caches can be overwritten by package installs — prefer a stable global location.${NC}"
+        ;;
+esac
+
 # 1. Configurar git hooks
 echo -e "${YELLOW}[1/2] Configuring git hooks...${NC}"
-git config core.hooksPath .ci-local/hooks
-chmod +x "$SCRIPT_DIR/hooks/"* 2>/dev/null || true
-chmod +x "$SCRIPT_DIR/"*.sh 2>/dev/null || true
+
+# Detect competing hook managers BEFORE we touch core.hooksPath. Setting
+# our path would silently override theirs and break expected behaviour.
+if [ -d ".husky" ]; then
+    echo -e "${YELLOW}WARNING: husky detected (.husky/). ci-local will override its hooks via core.hooksPath.${NC}"
+    echo -e "${YELLOW}If you want to keep husky: 'pnpm remove husky' first, OR back out of this install.${NC}"
+fi
+if [ -f "lefthook.yml" ] || [ -f "lefthook.yaml" ]; then
+    echo -e "${YELLOW}WARNING: lefthook detected. ci-local will override its hooks via core.hooksPath.${NC}"
+fi
+
+# Backup any existing .git/hooks/ files BEFORE we redirect hooksPath. The
+# user can restore them via './uninstall.sh --restore-backups'. We move
+# instead of copy so a future install does not double-back-up.
+EXISTING_HOOKSPATH=$(git config --get core.hooksPath 2>/dev/null || echo "")
+if [ -n "$EXISTING_HOOKSPATH" ] && [ "$EXISTING_HOOKSPATH" != "ci-local/hooks" ] && [ "$EXISTING_HOOKSPATH" != ".ci-local/hooks" ]; then
+    echo -e "${YELLOW}WARNING: existing core.hooksPath was ${EXISTING_HOOKSPATH}.${NC}"
+    echo -e "${YELLOW}It will be replaced. The previous value can be restored manually.${NC}"
+fi
+for hook in pre-commit commit-msg pre-push; do
+    if [ -f ".git/hooks/$hook" ] && [ -s ".git/hooks/$hook" ] && [ ! -f ".git/hooks/$hook.bak" ]; then
+        cp ".git/hooks/$hook" ".git/hooks/$hook.bak"
+        echo -e "${YELLOW}  Backed up existing .git/hooks/$hook → .git/hooks/$hook.bak${NC}"
+    fi
+done
+
+# Compute hooksPath relative to the project root so this works whether the
+# directory is "ci-local" (development checkout) or ".ci-local" (user's
+# project, after copying via the install instructions).
+HOOKS_DIR="$SCRIPT_DIR/hooks"
+
+# SECURITY: reject hooksPath that escapes the project root. If $SCRIPT_DIR or
+# $SCRIPT_DIR/hooks is a symlink pointing outside the project, realpath
+# resolves through it and emits "../../tmp/evil/hooks". Setting that as
+# core.hooksPath means every future commit executes whatever lives there.
+# realpath is guaranteed above so no fallback is needed.
+HOOKS_ABS=$(realpath "$HOOKS_DIR")
+case "$HOOKS_ABS" in
+    "$PROJECT_REAL"|"$PROJECT_REAL"/*) ;;
+    *)
+        echo -e "${RED}ERROR: hooks directory resolves outside the project root${NC}"
+        echo -e "${YELLOW}  HOOKS_DIR resolved to: $HOOKS_ABS${NC}"
+        echo -e "${YELLOW}  PROJECT_DIR:           $PROJECT_REAL${NC}"
+        echo -e "${YELLOW}Refusing to set core.hooksPath. Investigate symlinks under ci-local/.${NC}"
+        exit 1
+        ;;
+esac
+HOOKS_REL=$(realpath --relative-to="$PROJECT_DIR" "$HOOKS_DIR")
+
+git config core.hooksPath "$HOOKS_REL"
+echo -e "${GREEN}hooksPath = $HOOKS_REL${NC}"
+# Explicit 0755 (and only when files exist) — owner rwx, group/others rx.
+# Avoids group-writable hooks AND avoids passing a literal "*" to chmod
+# when the glob expands to nothing.
+shopt -s nullglob
+hook_files=("$HOOKS_DIR"/* "$SCRIPT_DIR"/*.sh)
+if [ ${#hook_files[@]} -gt 0 ]; then
+    chmod 0755 "${hook_files[@]}"
+fi
+shopt -u nullglob
 echo -e "${GREEN}Done${NC}"
 
 # 2. Verificar dependencias

package/ci-local/uninstall.ps1

@@ -0,0 +1,85 @@
+# =============================================================================
+# CI-LOCAL: Uninstall Script (PowerShell)
+# =============================================================================
+# Mirror of ci-local/uninstall.sh for Windows / PowerShell users.
+#
+# Usage:
+#   .\uninstall.ps1                       # only unset core.hooksPath
+#   .\uninstall.ps1 -RestoreBackups       # also restore .bak hooks
+#   .\uninstall.ps1 -Purge                # also rm -rf ci-local/ + lib/
+# =============================================================================
+
+#Requires -Version 7.2
+[CmdletBinding()]
+param(
+    [switch]$RestoreBackups,
+    [switch]$Purge
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+$ScriptDir  = Split-Path -Parent $PSCommandPath
+$ProjectDir = Split-Path -Parent $ScriptDir
+
+Push-Location -LiteralPath $ProjectDir
+try {
+
+    Write-Host '=== CI-LOCAL Uninstall ===' -ForegroundColor Cyan
+
+    # 1. Unset core.hooksPath if set
+    Write-Host '[1/3] Removing core.hooksPath...' -ForegroundColor Yellow
+    $current = (& git config --get core.hooksPath 2>$null) -join ''
+    if ($current) {
+        & git config --unset core.hooksPath
+        Write-Host "Removed hooksPath = $current" -ForegroundColor Green
+    } else {
+        Write-Host 'No core.hooksPath was set; nothing to remove' -ForegroundColor Yellow
+    }
+
+    # 2. Restore .bak hooks if requested
+    Write-Host '[2/3] Restoring hook backups...' -ForegroundColor Yellow
+    if ($RestoreBackups) {
+        $restored = 0
+        foreach ($hook in 'pre-commit', 'commit-msg', 'pre-push') {
+            $bak = ".git/hooks/$hook.bak"
+            if (Test-Path -LiteralPath $bak -PathType Leaf) {
+                Move-Item -LiteralPath $bak -Destination ".git/hooks/$hook" -Force
+                Write-Host "Restored .git/hooks/$hook" -ForegroundColor Green
+                $restored++
+            }
+        }
+        if ($restored -eq 0) {
+            Write-Host 'No .bak hooks found to restore' -ForegroundColor Yellow
+        }
+    } else {
+        Write-Host 'Skipped (pass -RestoreBackups to enable)' -ForegroundColor Yellow
+    }
+
+    # 3. Purge ci-local/ if requested
+    Write-Host '[3/3] Purging ci-local/ directory...' -ForegroundColor Yellow
+    if ($Purge) {
+        if (Test-Path -LiteralPath '.ci-local' -PathType Container) {
+            Remove-Item -LiteralPath '.ci-local' -Recurse -Force
+            Write-Host 'Removed .ci-local/' -ForegroundColor Green
+        }
+        # Refuse to delete our own working directory.
+        if (Test-Path -LiteralPath 'ci-local' -PathType Container) {
+            $thisScriptDir = (Get-Item -LiteralPath $ScriptDir).FullName
+            $ciLocalDir    = (Get-Item -LiteralPath (Join-Path $ProjectDir 'ci-local')).FullName
+            if ($thisScriptDir -eq $ciLocalDir) {
+                Write-Host 'WARNING: ci-local/ contains THIS uninstall script.' -ForegroundColor Yellow
+                Write-Host 'Refusing to delete it. Remove manually after this script exits.' -ForegroundColor Yellow
+            }
+        }
+    } else {
+        Write-Host 'Skipped (pass -Purge to delete directories)' -ForegroundColor Yellow
+    }
+
+    Write-Host ''
+    Write-Host 'Uninstall complete!' -ForegroundColor Green
+    Write-Host ''
+
+} finally {
+    Pop-Location
+}