hk install --global omits --staged; HK_STASH=git defeats pkl stash policy

[Distortedlogic]

Summary

hk install --global writes hook.hk-pre-commit.command without --staged. Any consumer that relies on hk.pkl hooks["pre-commit"].stash = "none" can have that invariant silently defeated by HK_STASH=git env var (or --stash git CLI flag), because there is no --staged on the resolved command line to force staged-only mode.

Version

• hk 1.48.0
• git 2.54.0

Reproduction

1. Fresh box. hk install --global. Confirm:

   $ git config --global --get hook.hk-pre-commit.command
   test "${HK:-1}" = "0" || hk run pre-commit --from-hook

   (no --staged).

2. Any consumer repo with hk.pkl:

   hooks {
     ["pre-commit"] {
       fix = true
       stash = "none"
       steps { … }
     }
   }

3. Probe:

   $ printf 'staged\n' > s.txt && git add s.txt
   $ printf 'unstaged\n' > u.txt
   $ HK_STASH=git git commit -m probe
   … stash – Stashed unstaged changes (1 file) …

   hk stashes despite stash = "none" in the consumer config. The env override wins.

Expected

Either:

• hk install --global includes --staged on the pre-commit hook by default (so hooks default to staged-only mode); or
• stash = "none" in the pkl-level hooks[...].stash is authoritative and cannot be overridden by HK_STASH env / --stash CLI (a strict or final semantics on the pkl field); or
• hk.stash from git-config (which hk config explain stash claims to read) is actually consulted at pre-commit time (it currently isn't; see companion issue).

Impact

Any fleet-wide stash = "none" policy is defense-in-depth only. The load-bearing guard is --staged on the command hk itself writes into ~/.gitconfig, so end users have to hand-patch hook.hk-pre-commit.command after hk install --global to enforce the policy their hk.pkl declares.

Suggested minimal fix

Change hk install --global (and the local equivalent) to emit:

test "${HK:-1}" = "0" || hk run pre-commit --from-hook --staged "$@"

Alternatively, thread a hk config key (e.g. hk.default-pre-commit-mode = staged) that both hk install and hk run consult.

[jdx]

Opened a ready-for-review PR for this in #1043: #1043

The PR adds --staged to generated pre-commit hook commands for both config-based installs and legacy shims, while leaving other hook events unchanged. It also adds coverage for the global install and legacy shim command output.

Validation run:

• cargo test --bin hk cli::install::tests
• mise run test:bats test/install_global.bats
• mise run test:bats test/install_creates_git_hooks.bats

Reported-by credit is included in the commit/PR body.

This comment was generated by Codex.