Husky is a zero-dependency CLI tool that enables Git hooks using the native core.hooksPath feature introduced in Git 2.9. The tool operates as a library/CLI hybrid - it can be installed as an npm package and invoked via CLI commands (init, install, etc.) or imported programmatically. The architecture is intentionally minimal: bin.js handles CLI entry points, index.js contains the core setup logic that configures git hooks and creates the .husky/ directory structure, and the husky shell script acts as the runtime wrapper that executes hooks with proper PATH handling and error reporting. The tool modifies git configuration (core.hooksPath) to point to .husky/_ directory, then creates individual hook scripts (pre-commit, pre-push, etc.) that delegate to the main husky runner. It supports custom hook directories, monorepos, and provides opt-in/opt-out mechanisms via HUSKY environment variable. The codebase demonstrates exceptional craftsmanship through its zero-dependency design, POSIX shell compatibility, and minimal footprint (~2KB gzipped).
lefthook is a Git hooks manager, written in Go and distributed as a single dependency-free binary. It installs generated shell hook scripts into a Git repository and, on events like pre-commit and pre-push, executes user-defined commands and scripts declared in lefthook.yml (YAML/JSON/TOML/JSONC are supported). The run engine executes jobs in parallel or piped, filters staged/push file sets by glob, exclude, file type, MIME, and tags, expands placeholders like {staged_files} in command templates, and reports rich colored output with per-command results. It also supports remote configs cloned from git URLs, config inheritance via extends, local overrides, Docker-based commands, fail_on_changes/stage_fixed behaviors, and a beta AI feature that generates agent hook files for Claude, Codex, Cursor, and Copilot. Architecturally it is a cleanly layered CLI: cmd/ defines the urfave/cli command tree (run, install, uninstall, check-install, dump, add, validate, version, self-update); internal/command/ holds the business logic; internal/run/controller/ is the execution engine (scoping, skip conditions, a guard that stash/restores unstaged changes for fail_on_changes, stage-fixed file handling); internal/git/ wraps the repository and provides a composable git-command layer; internal/config/ loads and merges configuration via koanf with a generated JSON Schema; internal/system/ abstracts cross-platform process execution (Unix sh -c; Windows resolves Git's sh.exe). Packaging spans npm, RubyGems, PyPI, PHP, Homebrew, Scoop, AUR, and Linux repositories. Quality signals are strong: extensive unit tests, a large testscript-based integration suite running on Linux/macOS/Windows, a fast release cadence, and use of modern Go (iterators, slices/maps helpers). Maintenance is active: recent commits, triaged issues, zero Dependabot alerts. The main long-term risks are duplicated schema files that must stay in sync, a beta AI integration, and a large bash-heavy packaging matrix; none of these detract from the core engine, which is well-abstracted and contains genuinely reusable components.
The Entire CLI (`entire`) is a production-grade command-line tool that integrates AI coding agents (Claude Code, Codex, Gemini CLI, Cursor, Copilot, OpenCode, Factory AI Droid, Pi) with Git workflows. It captures session transcripts, token usage, file changes, and agent prompts as git-backed checkpoints, enabling traceability, review, and collaboration on AI-assisted development. The CLI provides commands for session management (`session`, `resume`, `clean`), checkpoint inspection (`checkpoint list`, `checkpoint policy`), multi-agent code review (`review`, `investigate`), authentication (`auth`, `login`), and project management (`project`, `grant`). It operates as a git remote helper (`git-remote-entire`) for pushing/pulling checkpoint data via the Entire data plane. Architecturally, the system is a modular Go CLI built on Cobra, with pluggable backends for checkpoint storage (git-refs and git-branch) and agent integration. Each agent has a dedicated package under `cmd/entire/cli/agent/` that implements hooks, transcript parsing, and lifecycle management. Security is a first-class concern: file operations use `os.Root` to prevent symlink escapes (`osroot`), session IDs are validated against path traversal (`validation`), and a configurable redaction pipeline strips secrets from transcripts (`redact`). The system uses OpenAPI-generated client code (`internal/coreapi`) for control plane communication and supports multi-region deployment via cross-jurisdictional HTTP clients. The codebase demonstrates high craftsmanship with clean package boundaries, extensive test coverage (unit, integration, e2e, and benchmarks), and well-documented interfaces for extensibility. Reusable components include atomic JSON file writing, cross-platform process management (`execx`), advisory file locking (`flock`), and process liveness detection (`proclive`). The review subsystem provides a framework for multi-agent code review with structured findings, which could be adapted for other automated review workflows. While the codebase is well-maintained and actively developed, the tight coupling to many agent-specific formats and the dual checkpoint backend add maintenance surface area and complexity.
ggshield is a production-grade CLI tool for detecting hardcoded secrets in code, git history, Docker images, PyPI packages, archives, and AI coding assistant interactions. It integrates with the GitGuardian API to scan for 500+ secret types, supporting both SaaS and self-hosted instances. The tool is designed for developers and CI/CD pipelines, offering git hooks (pre-commit, pre-push, pre-receive), a plugin system for extensibility, and AI agent hooks for Claude Code, Cursor, Copilot, Codex, Vibe, and Kiro. It also includes HMSL (Has My Secret Leaked) for checking secret exposure via cryptographic queries, honeytoken management, and machine-level setup for comprehensive security coverage. The architecture is a hybrid Python/Rust CLI built with Click. The Python codebase is organized into three layers: `cmd` (CLI commands), `core` (shared infrastructure like config, scan, cache, client, UI, plugin system), and `verticals` (domain logic for secret scanning, AI, HMSL, honeytokens). A Rust native component (`ggshield-hook`) handles AI hook scanning for performance, while a Rust dispatcher delegates non-hook commands to the Python launcher. The plugin system supports dynamic command registration with sigstore signature verification. Configuration is YAML-based with versioned schemas and global/local merging. Key entry points include `ggshield/__main__.py` (CLI root), `ggshield/cmd/secret/scan/` (scan subcommands), `ggshield/cmd/auth/login.py` (authentication), `ggshield/cmd/machine/setup.py` (one-shot protection), and `rust/dispatcher/src/main.rs` (Rust binary). External dependencies include the GitGuardian API (py-gitguardian), keyring for credential storage, and platform-specific utilities for notifications and machine ID derivation. The codebase demonstrates strong engineering practices with lazy command loading, output handler strategy pattern, cache abstractions, and comprehensive test coverage (80%+).
The `pre-commit` npm package automatically installs and manages git pre-commit hooks for Node.js projects. When installed as a devDependency, its `install.js` script locates the project's `.git` directory (including submodules and linked worktrees) and writes a shell wrapper into `.git/hooks/pre-commit`. Upon commit, that wrapper executes a crafted bash script (`hook`) that resolves the `pre-commit` package path via Node's `require.resolve` (supporting Yarn Plug'n'Play), then runs `index.js`. The `Hook` class in `index.js` reads the project's `package.json`, normalizes the `pre-commit`/`precommit` configuration into an ordered list of npm scripts, and executes them sequentially using `cross-spawn`. If any script fails with a non-zero exit code, the commit is aborted with a clear error message. The tool gracefully handles missing packages (exits 0 to avoid blocking commits), environment quirks (emacs/magit's `GIT_LITERAL_PATHSPECS`, SourceTree's path issues), and provides backup/restore of existing hooks. This is a single-purpose utility library with a clean Node.js core and a well-tested bash wrapper.
prove_it is a config-driven hook framework specifically designed for Claude Code, an AI coding assistant. It intercepts lifecycle events (SessionStart, PreToolUse, PostToolUse, Stop, TaskCompleted) and git hooks (pre-commit, pre-push) to run configurable verification tasks. These tasks include shell scripts, AI agent reviews (using Claude subprocesses), and environment variable injection. The tool enforces code quality by blocking or approving AI actions based on pass/fail results, preventing premature completion of tasks. Architecture-wise, prove_it is a Node.js CLI tool (≥18) with a modular design: config loading from layered JSON files, condition evaluation (`when`) for gating tasks, git-backed churn tracking, template expansion, and session state management. The dispatcher module handles all hook events, evaluates conditions, runs tasks synchronously or asynchronously, and returns structured responses to Claude Code. A sophisticated appeal system allows developers to override AI reviewer failures via a backchannel mechanism. The codebase demonstrates strong software engineering practices: extensive unit and integration tests (using node:test), clean functional modules, and a clear separation of concerns. Key reusable patterns include the layered config merging algorithm, the template engine with conditional blocks, and the condition evaluation system with AND/OR semantics. While the tool is tightly coupled to Claude Code's hook API (introducing ecosystem drift risk), its internal architecture is well-crafted and could serve as a reference for building similar verification frameworks. The project is actively maintained with frequent releases (v0.72.0), comprehensive documentation, and real-world example projects. Its quality is solid but not exceptional due to the inherent complexity of the config surface and the reliance on external AI services. The tool effectively solves the problem of AI overconfidence in code generation by forcing verification steps to pass before progress can be made.
Pipelight is a Rust-based CLI tool for defining and running automation pipelines. It allows users to create pipelines using TOML, YAML, HCL, or TypeScript configurations, trigger them via git hooks or file system changes, and monitor their execution. The architecture follows a modular design with separate crates for CLI parsing, workflow execution, configuration casting, process management, and utilities. Key features include process detachment for background execution, output capture for post-execution inspection, git hook integration, and file watching capabilities. The project demonstrates strong engineering practices with comprehensive error handling, cross-platform considerations, and thoughtful UX design for terminal interactions.
This repository is a curated collection of Git hook examples, organized by hook type (pre-commit, commit-msg, pre-push, etc.). Each hook type directory contains a README explaining the hook's purpose and one or more example shell scripts that demonstrate how to implement the hook for common tasks such as linting, branch protection, and commit message validation. The repository does not contain a runnable application but serves as a reference for developers looking to implement Git hooks in their projects. The example scripts are self-contained, written in POSIX shell or Bash, and rely only on standard Unix tools and Git commands, making them easy to adapt to various projects. While the hooks are simple, they illustrate practical patterns for enforcing code quality, preventing dangerous operations, and integrating with issue trackers. The repository is maintained with occasional updates, and the examples are relevant to current Git usage. The scripts are designed to be copied directly into a project's .git/hooks directory with minimal modification, often requiring only customization of variables like branch names or regex patterns.