From a59f9f456929b2a46ace36a4d40065ee8c37ae19 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20Jerci=C5=84ski?= <lukasz@jercin.ski>
Date: Thu, 2 Jul 2026 16:28:38 +0200
Subject: [PATCH] chore: sync hardened commit-msg hook

---
 .githooks/commit-msg | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.githooks/commit-msg b/.githooks/commit-msg
index 721581a..a8a29d3 100755
--- a/.githooks/commit-msg
+++ b/.githooks/commit-msg
@@ -1,2 +1,7 @@
 #!/usr/bin/env bash
-npx -y conventional-commit-msg "$1"
\ No newline at end of file
+# `@latest` + explicit `--package` dodge two npm footguns: an inherited
+# npm_config_package (agent wrappers like axexec/axrun set it, hijacking
+# `npx -y` into exit 127), and local-root shadowing — without the version,
+# `npm exec` resolves the conventional-commit-msg repo's own package and the
+# bin is "not found", breaking the hook in that repo after prepare wires it up.
+npm exec --yes --package=conventional-commit-msg@latest -- conventional-commit-msg "$1"