[WRONG BRANCH] fix(scripts): refuse installing repo hooks into configured shared core.hooksPath

[luvs01]

Motivation

• The hook installer previously resolved the hooks directory via git rev-parse --git-path hooks, which honors core.hooksPath and could install cwd-dependent pre-push hooks into a global/shared hooks directory, allowing arbitrary code execution and overwriting global hooks for unrelated repositories.
• The intent is to keep development hooks scoped to this repository (and linked-worktree layouts) to avoid replacing shared policy hooks or causing other repositories to execute our prepush script.

Description

• Add an early check that runs git config --get core.hooksPath and fails closed when core.hooksPath is configured, preventing installation into a potentially shared hooks directory; the installer still supports repository-local and linked-worktree hooks when core.hooksPath is unset (scripts/setup-hooks.ts).
• Keep resolving the repository-local hooks dir with git rev-parse --path-format=absolute --git-path hooks for linked worktrees and non-standard layouts after the core.hooksPath guard.
• Add a focused regression test that configures a shared hooksPath, runs the installer, and asserts the installer refuses to modify the shared hooks and leaves existing hooks unchanged (tests/setup-hooks.test.ts).
• Update documentation to state that setup installs hooks into this repository's hooks directory and that setup refuses to replace hooks when core.hooksPath redirects them (CONTRIBUTING.md).

Testing

• Ran bun test tests/setup-hooks.test.ts and the new test passed (1 pass, 0 fail).
• Ran bun run typecheck (bun x tsc --noEmit) and it passed.
• Ran bun run privacy:scan and it passed.
• Ran git diff --check and there were no whitespace or patch issues.
• Ran the broader bun run prepush / full test suite for context; the focused changes and checks passed, while two unrelated CI-sensitive tests (tests/cli-help.test.ts) observed pre-existing environment-dependent failures not caused by this change.

---

Codex Task

Summary by CodeRabbit

• Bug Fixes

  • Prevented hook installation when Git is configured to use a potentially shared hooks directory.
  • Preserved existing hooks when installation is blocked.
  • Added support for repository-local and linked-worktree hook directories.

• Documentation

  • Updated setup guidance to explain linked-worktree support and safety checks.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

📝 Walkthrough

Walkthrough

The hook setup script now refuses installation when core.hooksPath is configured, supports repository-local and linked-worktree Git directories, and documents the behavior. Tests verify the error, exit code, and preservation of an existing hook.

Changes

Git hook safety

Layer / File(s)	Summary
Validate and document hook installation scripts/setup-hooks.ts, tests/setup-hooks.test.ts, CONTRIBUTING.md	The script rejects configured core.hooksPath values and unexpected Git inspection failures. The test verifies exit code 1, the error message, and preservation of an existing hook. Documentation describes linked-worktree support and the bun run prepush command.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: lidge-jun

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: refusing repository hook installation when a shared core.hooksPath is configured.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/propose-fix-for-vulnerability-in-hooks-setup

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 479a5f6d3c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Escape the generated hooks path for Git config

On Windows, hooksDirectory contains backslashes (typically C:\Users\...), and interpolating it verbatim into the config makes sequences such as \U invalid to Git's config parser. Consequently, git config --get exits with a parse error, the script emits could not inspect instead of the expected refusal message, and this new test fails the Windows suite. Write the value using git config --file ... core.hooksPath ..., or normalize/escape the path before writing it.

AGENTS.md reference: AGENTS.md:L136-L137

Useful? React with 👍 / 👎.