fix(agents): chain AGENTS git hooks to global core.hooksPath #58

2026-06-18T02:41:54Z

rootiest commented

2026-06-18 02:41:54 +00:00

Summary

agents-init sets a local core.hooksPath = .agents-tools/hooks in every AGENTS sub-repo to wire up the version-increment hooks. Since git honors only one core.hooksPath, this silently shadowed the user's global hooks (~/.git/hooks — ggshield secret scanning + Git LFS auto-tracking), which never ran on commits in AGENTS repos.

This makes each committed hook shim, after running version-bump, chain (exec) to the global/system core.hooksPath hook of the same name. So in AGENTS repos the order is now: version increment → global hooks (ggshield, LFS, etc.).

Changes

scripts/agents-tools/hooks/pre-commit — runs version-bump precommit, then execs the global/system pre-commit if present.
scripts/agents-tools/hooks/prepare-commit-msg — runs version-bump prepmsg, then execs the global/system prepare-commit-msg if present.
scripts/agents-tools/version-bump — bumped agents-tools-version marker 1 → 2 so existing AGENTS repos auto-refresh their shims on next agents-init.
functions/agents-init.fish + docs/fish-config.md — documented the chaining behavior.

Design notes

Reads git config --global core.hooksPath (falls back to --system); no hardcoded paths, so the committed shims stay portable. Repos/machines with no global hook simply exit 0.
exec means the chained global hook's exit status becomes the commit gate — so ggshield can still block a commit. version-bump remains non-blocking (guarded exit 0).
No tracked AGENTS copy to update — AGENTS/.agents-tools/ is generated/gitignored; the live copy was refreshed to v2 and verified.

Manual Verification

In an existing AGENTS sub-repo, run agents-init and confirm it reports Updated AGENTS/.agents-tools/ (v1 → v2).
Confirm AGENTS/.agents-tools/hooks/pre-commit and prepare-commit-msg now carry agents-tools-version: 2.
Make a commit inside an AGENTS sub-repo and confirm: (a) AGENTS/.version still bumps, (b) the commit subject still gets (vX.Y.Z) appended, and (c) the global ggshield scan output appears (Checking staged changes for secrets/PII...).
Stage a >100 MB file in an AGENTS repo and confirm Git LFS auto-tracks it (global LFS hook step runs).
On a machine with no global core.hooksPath, confirm commits still succeed (shim exits 0, no error).

## Summary `agents-init` sets a **local** `core.hooksPath = .agents-tools/hooks` in every AGENTS sub-repo to wire up the version-increment hooks. Since git honors only one `core.hooksPath`, this silently **shadowed the user's global hooks** (`~/.git/hooks` — ggshield secret scanning + Git LFS auto-tracking), which never ran on commits in AGENTS repos. This makes each committed hook shim, **after** running `version-bump`, chain (`exec`) to the global/system `core.hooksPath` hook of the same name. So in AGENTS repos the order is now: version increment → global hooks (ggshield, LFS, etc.). ## Changes - `scripts/agents-tools/hooks/pre-commit` — runs `version-bump precommit`, then execs the global/system `pre-commit` if present. - `scripts/agents-tools/hooks/prepare-commit-msg` — runs `version-bump prepmsg`, then execs the global/system `prepare-commit-msg` if present. - `scripts/agents-tools/version-bump` — bumped `agents-tools-version` marker `1 → 2` so existing AGENTS repos auto-refresh their shims on next `agents-init`. - `functions/agents-init.fish` + `docs/fish-config.md` — documented the chaining behavior. ## Design notes - Reads `git config --global core.hooksPath` (falls back to `--system`); no hardcoded paths, so the committed shims stay portable. Repos/machines with no global hook simply `exit 0`. - `exec` means the chained global hook's exit status becomes the commit gate — so ggshield can still block a commit. `version-bump` remains non-blocking (guarded `exit 0`). - No tracked AGENTS copy to update — `AGENTS/.agents-tools/` is generated/gitignored; the live copy was refreshed to v2 and verified. ## Manual Verification - [x] In an existing AGENTS sub-repo, run `agents-init` and confirm it reports `Updated AGENTS/.agents-tools/ (v1 → v2)`. - [x] Confirm `AGENTS/.agents-tools/hooks/pre-commit` and `prepare-commit-msg` now carry `agents-tools-version: 2`. - [x] Make a commit inside an AGENTS sub-repo and confirm: (a) `AGENTS/.version` still bumps, (b) the commit subject still gets `(vX.Y.Z)` appended, **and** (c) the global ggshield scan output appears (`Checking staged changes for secrets/PII...`). - [x] Stage a >100 MB file in an AGENTS repo and confirm Git LFS auto-tracks it (global LFS hook step runs). - [x] On a machine with no global `core.hooksPath`, confirm commits still succeed (shim exits 0, no error).

rootiest added 1 commit 2026-06-18 02:41:55 +00:00

fix(agents): chain AGENTS git hooks to global core.hooksPath c3e39b7a96

The local core.hooksPath override set by agents-init shadowed the user's
global hooks (ggshield, Git LFS) since git honors only one hooksPath. Each
shim now execs the global/system hook of the same name after running
version-bump, so global hooks still run after version increment. Bumped the
agents-tools version marker to 2 so existing AGENTS repos refresh.

rootiest merged commit fdd0733b3f into main

2026-06-18 02:45:12 +00:00

rootiest deleted branch fix-agents-hooks-chain-global

2026-06-18 02:45:13 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: rootiest/fish-config#58