fix: install lefthook hooks at repo level, not a global core.hooksPath

[Dani Akash (DaniAkash)]

Problem

bun install was overwriting a developer's global git hooks. On a machine with a global core.hooksPath configured, running bun install replaced the hooks in that global directory with this project's lefthook hooks (backing up the originals as .mintbak), which then made these hooks run in every repository on the machine.

Root cause

lefthook was listed in trustedDependencies, which lets bun run the lefthook package's postinstall. That postinstall runs:

lefthook install -f

The -f flag means "proceed even if core.hooksPath is set". So instead of installing into the repo's own .git/hooks, it force-installs into whatever core.hooksPath resolves to. When a developer has a global core.hooksPath, that is their global hooks directory, and it gets overwritten on every install.

Without -f, lefthook install already does the right thing: it declines and prints guidance when core.hooksPath points somewhere external, rather than clobbering it.

Fix

• Remove lefthook from trustedDependencies (in the monorepo root and in apps/app) so bun no longer runs the forced lefthook install -f.
• Add a repo postinstall that runs lefthook install without -f:
  • No global core.hooksPath set (the common case): installs into the repo's own .git/hooks, exactly as before.
  • Global core.hooksPath set: lefthook declines instead of overwriting it; the || true guard keeps bun install from failing.

Net effect: hooks are still installed automatically at the repo level, and the project can no longer touch a contributor's global hooks.

Validation

• Both edited package.json files parse as valid JSON.
• lefthook install with -f writes into an external core.hooksPath; without -f it refuses and leaves it untouched (exit 1, guarded to 0 by || true).
• Confirmed on a machine with a global core.hooksPath: the new postinstall command leaves the global hooks directory byte-for-byte untouched.
• Confirmed bun install runs the root postinstall script.

Impact on contributors

None for the common setup (no global core.hooksPath): hooks continue to auto-install into .git/hooks. Contributors who intentionally use a global core.hooksPath will no longer have it overwritten; if they want this repo's hooks, they can opt in explicitly (e.g. bunx lefthook install --force after pointing core.hooksPath at the repo).

[greptile-apps]

Greptile Summary

This PR prevents Lefthook's forced dependency postinstall from overwriting external Git hook directories.

• Removes Lefthook from Bun's trusted dependencies at both workspace and app levels.
• Adds a guarded workspace-root postinstall that invokes lefthook install without force.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking gap for contributors who install dependencies through the documented app-local workflow.

Root installs avoid modifying external Git hook directories as intended, but app-local installs no longer invoke any Lefthook installer and therefore silently omit repository hooks.

Files Needing Attention: packages/browseros-agent/apps/app/package.json

Important Files Changed

Filename	Overview
packages/browseros-agent/package.json	Replaces Lefthook's trusted dependency lifecycle with a non-forced, guarded root postinstall.
packages/browseros-agent/apps/app/package.json	Removes Lefthook trust but leaves the documented app-local install flow without automatic repository hook installation.

Prompt To Fix All With AI

### Issue 1
packages/browseros-agent/apps/app/package.json:113-115
**App-local installs omit hooks**

The documented `apps/app`-local `bun install` path does not run the new workspace-root `postinstall`; removing Lefthook from this package's trusted dependencies therefore leaves those contributors without the repository's commit-message, formatting, and branch-name hooks.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix: install lefthook hooks at repo leve..." | Re-trigger Greptile}

[github-actions]

❌ Tests failed — 4/2467 failed

Suite	Passed	Failed	Skipped
✅ agent	359/359	0	0
✅ build	34/34	0	0
✅ claw-app	297/297	0	0
❌ claw-mcp	107/109	2	0
✅ claw-onboard	87/87	0	0
✅ claw-server-rust-quality	passed	0	0
❌ claw-server-rust	482/483	1	0
✅ server-agent	313/313	0	0
✅ server-api	170/170	0	0
✅ server-browser	10/10	0	0
✅ server-integration	10/10	0	0
✅ server-lib	299/300	0	1
✅ server-root	38/41	0	3
❌ server-tools	253/254	1	0

passed = ran successfully but emits no JUnit counts (a lint/format gate).

Failed tests

• claw-mcp — Rust /mcp conformance > transport: tools/list exposes the full catalog including run
• claw-mcp — Rust /mcp conformance > windows: activate focuses the target window
• server-tools — registerBrowserTools > registers the compact browser tool surface

View workflow run