Files
coder/scripts/githooks/post-checkout
Mathias Fredriksson dd34e3d3c2 fix(scripts/githooks): prevent agents from bypassing git hooks (#22825)
Agents hit short shell timeouts on `git commit` (~13s) before
`make pre-commit` finishes (~20s warm), then disable hooks via
`git config core.hooksPath /dev/null`. This bypasses all local checks
and, because it writes to shared `.git/config`, silently disables hooks
for every other worktree too.

Add explicit timing guidance to AGENTS.md, and write worktree-scoped
`core.hooksPath` in post-checkout, pre-commit, and pre-push hooks to
make the bypass ineffective.
2026-03-09 12:51:44 +02:00

14 lines
689 B
Bash
Executable File

#!/usr/bin/env bash
# Shield this worktree against shared config hooksPath poisoning.
# Worktree-scoped config overrides the shared .git/config, so even if
# another worktree runs `git config core.hooksPath /dev/null`, this
# worktree continues to use the correct hooks.
#
# This hook runs on `git worktree add` and `git checkout`/`git switch`.
# Only needed in linked worktrees where shared config can be poisoned
# by another worktree. Skipped in the main checkout to avoid errors
# when extensions.worktreeConfig is not set (e.g. fresh clones).
if [[ "$(git rev-parse --git-dir)" != "$(git rev-parse --git-common-dir)" ]]; then
git config --worktree core.hooksPath scripts/githooks
fi