From e8143d5757dc440873a4a9fc260d8532459e4e55 Mon Sep 17 00:00:00 2001
From: Silo Server Migration <noreply@silo-server.invalid>
Date: Mon, 25 May 2026 00:27:29 -0400
Subject: [PATCH] chore: tighten local-path-leak guard scope and tooling

- Narrow the worktree-id/T3-path check to docs/superpowers/specs and
  docs/superpowers/plans. Scanning the whole repo flagged any
  legitimate reference to .t3/worktrees or t3code-<hex> (fixtures,
  example configs) and would block unrelated commits.
- Switch the pre-commit hook shebang to bash and call the check via
  an absolute path derived from git rev-parse so the hook works
  regardless of the cwd git happens to invoke it from.
- install-hooks now warns when it overwrites an existing
  core.hooksPath rather than silently clobbering a custom setup.
- Add make verify-local-paths to the AGENTS.md pre-MR checklist so
  contributors run it explicitly even when --no-verify is used.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .githooks/pre-commit              | 8 +++++---
 AGENTS.md                         | 1 +
 Makefile                          | 4 ++++
 scripts/check-local-path-leaks.sh | 2 +-
 4 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/.githooks/pre-commit b/.githooks/pre-commit
index ee5b75b9..d22600a2 100755
--- a/.githooks/pre-commit
+++ b/.githooks/pre-commit
@@ -1,4 +1,6 @@
-#!/usr/bin/env sh
-set -eu
+#!/usr/bin/env bash
+set -euo pipefail
 
-scripts/check-local-path-leaks.sh --cached
+# Resolve via git toplevel so the hook works from any cwd (e.g., when
+# git invokes hooks from within a non-root subdirectory).
+"$(git rev-parse --show-toplevel)/scripts/check-local-path-leaks.sh" --cached
diff --git a/AGENTS.md b/AGENTS.md
index b604f99f..a72adb36 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -58,6 +58,7 @@ Run before opening a merge request:
 
 - `cd web && pnpm run lint`
 - `cd web && pnpm run format:check`
+- `make verify-local-paths`
 
 For local services, start PostgreSQL and Redis with `docker compose up -d postgres redis`.
 
diff --git a/Makefile b/Makefile
index 9edb443f..32cff7f3 100644
--- a/Makefile
+++ b/Makefile
@@ -49,6 +49,10 @@ verify-local-paths:
 
 # Install repo-local git hooks for this checkout/worktree.
 install-hooks:
+	@existing="$$(git config --local core.hooksPath 2>/dev/null || true)"; \
+	if [ -n "$$existing" ] && [ "$$existing" != ".githooks" ]; then \
+		echo "warning: overwriting existing local core.hooksPath ($$existing) with .githooks"; \
+	fi
 	git config core.hooksPath .githooks
 
 # Fetch and build the pinned Jellyfin Web bundle
diff --git a/scripts/check-local-path-leaks.sh b/scripts/check-local-path-leaks.sh
index 0847660f..f4b57808 100755
--- a/scripts/check-local-path-leaks.sh
+++ b/scripts/check-local-path-leaks.sh
@@ -51,7 +51,7 @@ check_pattern() {
 check_pattern \
 	"T3 worktree path or generated worktree id" \
 	"(${t3_worktree_dir}|/Users/[^[:space:]]*/${t3_worktree_dir}/|${t3_worktree_id_prefix}[0-9a-f]{8})" \
-	.
+	docs/superpowers/specs docs/superpowers/plans
 
 check_pattern \
 	"absolute local filesystem path in generated superpowers docs" \