fix(hooks): check the whole codebase as staged in pre-commit

[paustint]

Summary

• The pre-commit hook now checks a snapshot of the index across the whole codebase. It used to pass staged paths to oxfmt and oxlint, which then read the working tree, so a file formatted on disk but never re-staged could slip through and unstaged edits could block a clean commit. commit -a and commit <path> are covered too, because git points GIT_INDEX_FILE at the right index.
• The hook header now names all four repos that share it, so every copy is byte-identical. This mirrors chore: adopt oxfmt and oxlint with a pre-commit hook simple-xml#19.
• checkout-index runs with --ignore-skip-worktree-bits, so files hidden by a sparse checkout or git update-index --skip-worktree are checked too. simple-xml gets the same change in fix(hooks): export skip-worktree entries into the pre-commit snapshot simple-xml#20, which keeps all four copies byte-identical.
• AGENTS.md describes the new behavior.

No CHANGELOG entry, since nothing under src/ changed.

Test plan

• Hook passes on a clean index, matching npm run format:check and npm run lint
• Hook blocks an unformatted file staged under src/
• Hook blocks a staged, unformatted file marked skip-worktree and removed from disk
• Hook removes its temporary snapshot afterwards

[Copilot]

🟡 Changes recommended

A relative TMPDIR prevents the temporary snapshot from being removed.

1 open finding

• Relative TMPDIR leaves temporary snapshot behind on cleanup · New

What changed in this PR

Updates the pre-commit hook to validate the complete staged index snapshot rather than working-tree files.

Changes:

• Checks formatting and linting in a temporary index snapshot.
• Documents the updated hook behavior and shared repositories.

File	Description
.githooks/​pre-commit	Creates and validates the staged snapshot.
AGENTS.md	Documents whole-codebase index checking.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

The repository-sharing guidance in AGENTS.md still contradicts the new four-repository contract.

1 open finding

• Relative TMPDIR leaves temporary snapshot behind on cleanup

Previously missed (1)

In code that hasn't changed since last review

Update AGENTS.md for the four-repository hook contract

.githooks/​pre-commit:10

Please also update AGENTS.md:113-116: it still says this hook is shared only with soql-parser-js and instructs contributors to sync only those two copies. That contradicts this new four-repository contract and can let the simple-excel and simple-xml copies drift during future changes.

🧠 Review effort: Balanced

[paustint]

Went through Copilot's suppressed (low-confidence) comment — it was valid:

• AGENTS.md:113-116 — fixed, the sharing note now names simple-excel and simple-xml alongside soql-parser-js, matching the hook header. All three sibling repos carry the same six files.

[Copilot]

🟢 Approval recommended

The snapshot handling, cleanup, and failure propagation match the intended behavior, with no unresolved findings.

0 open findings

1 resolved since last review

• Relative TMPDIR leaves temporary snapshot behind on cleanup

🧠 Review effort: Balanced