fix(hooks): install pre-commit from versioned template to core.hooksPath

Follow-up to e5ba2f1. The active pre-commit hook is resolved via
`git config core.hooksPath` (= .git-hooks/), NOT .git/hooks/. The previous
e5ba2f1 wired Phase 1b into the wrong live file and into a stale embedded
heredoc in install-git-hooks.sh.

.git-hooks/ is .gitignore'd ON PURPOSE: the active hook copy stays local and is
never committed, keeping hook contents out of this PUBLIC repo (no secret-leak
risk). So we do NOT track .git-hooks/; instead the installer regenerates it from
the single versioned source of truth.

## Change
- scripts/install-git-hooks.sh rewritten (v3.2.0): installs from
  scripts/pre-commit-template.sh into the directory resolved from
  core.hooksPath (defaulting to .git-hooks and setting it if unset). Removes the
  drifted embedded heredoc — one source of truth now (the template, which
  already carries Phase 1b: PreToolUse permissionDecision allow|deny|ask guard).

## Validation
- Installer regenerates .git-hooks/pre-commit identical to the template
  (Phase 1b present); core.hooksPath preserved as .git-hooks.
- Secret-scanned the staged change; .git-hooks confirmed gitignored (uncommittable).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: alfredolopez80

scripts/install-git-hooks.sh

@@ -1,94 +1,63 @@
 #!/bin/bash
 # install-git-hooks.sh - Install git hooks for multi-agent-ralph-loop
-# VERSION: 2.57.3
+# VERSION: 3.2.0
+#
+# Installs the pre-commit hook from the SINGLE versioned source of truth
+# (scripts/pre-commit-template.sh) into the active hooks directory resolved from
+# `git config core.hooksPath`.
+#
+# This repo uses core.hooksPath=.git-hooks, which is .gitignored — the active
+# hook copy is LOCAL ONLY and is never committed. That is deliberate: it keeps
+# hook contents out of the PUBLIC repo (no risk of leaking machine-specific or
+# sensitive data). The committed source of truth is the template; run this
+# script after cloning to (re)generate the active hook locally.
+#
+# Replaces the previous embedded-heredoc approach (which had drifted to an old
+# version and missed Phase 1b). One source of truth now: the template.
 #
 # Usage:
 #   ./scripts/install-git-hooks.sh
-#
-# This installs the pre-commit hook that validates Claude Code hook JSON formats
 
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
-HOOKS_DIR="$PROJECT_DIR/.git/hooks"
+TEMPLATE="$SCRIPT_DIR/pre-commit-template.sh"
 
 echo "Installing git hooks for multi-agent-ralph-loop..."
 
-# Create hooks directory if it doesn't exist
-mkdir -p "$HOOKS_DIR"
-
-# Create pre-commit hook
-cat > "$HOOKS_DIR/pre-commit" << 'HOOK_EOF'
-#!/bin/bash
-# pre-commit hook for multi-agent-ralph-loop
-# VERSION: 2.57.3
-# Purpose: Validate hook JSON formats before commit
-#
-# CRITICAL FORMAT RULES (per official Claude Code docs):
-# - PostToolUse/PreToolUse/UserPromptSubmit: {"continue": true/false}
-# - Stop hooks ONLY: {"decision": "approve"/"block"}
-# - The string "continue" is NEVER valid for the "decision" field
-
-set -uo pipefail
-
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[0;33m'
-NC='\033[0m'
-
-STAGED_HOOKS=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.claude/hooks/.*\.(sh|py)$' || true)
-
-if [[ -z "$STAGED_HOOKS" ]]; then
-    exit 0
+if [[ ! -f "$TEMPLATE" ]]; then
+    echo "ERROR: missing template: $TEMPLATE" >&2
+    exit 1
 fi
 
-echo -e "${YELLOW}Pre-commit: Validating Claude Code hook JSON formats${NC}"
-
-ERRORS=0
-
-for hook_file in $STAGED_HOOKS; do
-    [[ ! -f "$hook_file" ]] && continue
-
-    hook_name=$(basename "$hook_file")
-
-    # CRITICAL: "decision": "continue" is NEVER valid
-    if grep -qE '"decision":\s*"continue"' "$hook_file"; then
-        echo -e "${RED}✗ $hook_name: Uses invalid {\"decision\": \"continue\"}${NC}"
-        ((ERRORS++))
-        continue
-    fi
-
-    echo -e "${GREEN}✓ $hook_name${NC}"
-done
-
-# Phase 1b: PreToolUse permissionDecision enum guard (allow|deny|ask, never "block").
-# Regression guard for the "(root): Invalid input" hook error.
-PD_CHECK="$(git rev-parse --show-toplevel 2>/dev/null)/scripts/check-pretooluse-permission-decision.sh"
-if [[ -n "$STAGED_HOOKS" && -x "$PD_CHECK" ]]; then
-    if ! "$PD_CHECK" > /dev/null 2>&1; then
-        echo -e "${RED}✗ Invalid permissionDecision (use \"deny\", not \"block\")${NC}"
-        echo "  Run: $PD_CHECK"
-        ((ERRORS++))
-    fi
+# Resolve the active hooks path. Honor an existing core.hooksPath; otherwise
+# adopt the repo convention (.git-hooks) and set it so git actually uses it.
+HOOKS_PATH="$(git -C "$PROJECT_DIR" config --get core.hooksPath 2>/dev/null || true)"
+if [[ -z "$HOOKS_PATH" ]]; then
+    HOOKS_PATH=".git-hooks"
+    git -C "$PROJECT_DIR" config core.hooksPath "$HOOKS_PATH"
+    echo "  core.hooksPath set to $HOOKS_PATH"
 fi
 
-if [[ $ERRORS -gt 0 ]]; then
-    echo -e "${RED}COMMIT BLOCKED: $ERRORS hook(s) have invalid JSON format${NC}"
-    echo "Reference: tests/HOOK_FORMAT_REFERENCE.md"
-    exit 1
-fi
+# Resolve to an absolute directory (core.hooksPath may be relative to repo root).
+case "$HOOKS_PATH" in
+    /*) HOOKS_DIR="$HOOKS_PATH" ;;
+    *)  HOOKS_DIR="$PROJECT_DIR/$HOOKS_PATH" ;;
+esac
 
-exit 0
-HOOK_EOF
+mkdir -p "$HOOKS_DIR"
 
-chmod +x "$HOOKS_DIR/pre-commit"
+# Install from the single source of truth. The template already includes
+# Phase 1b (PreToolUse permissionDecision guard: allow|deny|ask, never "block").
+install -m 0755 "$TEMPLATE" "$HOOKS_DIR/pre-commit"
 
-echo "✓ pre-commit hook installed"
+echo "✓ pre-commit installed → $HOOKS_DIR/pre-commit"
+echo "  source: scripts/pre-commit-template.sh"
+echo "  active core.hooksPath: $(git -C "$PROJECT_DIR" config --get core.hooksPath)"
 echo ""
 echo "Git hooks installed successfully!"
-echo ""
-echo "The pre-commit hook will validate Claude Code hook JSON formats"
-echo "before each commit to prevent format errors."
+echo "The pre-commit hook validates Claude Code hook JSON formats (incl. the"
+echo "PreToolUse permissionDecision enum) before each commit."
 echo ""
 echo "Reference: tests/HOOK_FORMAT_REFERENCE.md"