chore: add lefthook pre-commit hook for oxfmt

[erickteowarang]

Summary

Add a pre-commit hook that runs oxfmt on staged source files, preventing pnpm fmt:check failures from surfacing in CI for changes that weren't formatted locally before the commit.

Uses lefthook to match the tooling already in use across other Tailor repos.

Changes

• package.json — adds lefthook@2.1.6 as a root devDependency and a prepare script (lefthook install) so contributors get the hook on pnpm install.
• lefthook.yml — pre-commit config running pnpm exec oxfmt on staged files matching:

  *.{ts,tsx,js,jsx,mjs,cjs,json,jsonc,md,mdx,yaml,yml,css,html}
  

  (the extensions oxfmt actually formats across the workspace today). stage_fixed: true re-stages files that the formatter rewrites, so the formatted output lands in the commit.
• pnpm-workspace.yaml — declares lefthook: false under allowBuilds. Lefthook's npm package ships a postinstall hook installer, but we intentionally let the root prepare script handle that, so the dep-side script stays disabled (consistent with the workspace's strict supply-chain policy).
• pnpm-lock.yaml — adds the lefthook subtree (+10/-7 packages, mostly platform-specific binary wrappers).

Notes for reviewers

• The install needs narrow --trust-policy-exclude flags for semver@6.3.1, reselect@5.1.1, and @swc/core@1.12.11. These are pre-existing trustPolicy: no-downgrade tripwires (earlier published versions had provenance attestations, current ones don't); unrelated to this change.
• The resulting lockfile passes pnpm install --frozen-lockfile cleanly, so CI is unaffected.
• No changeset — this is internal tooling and doesn't change @tailor-platform/app-shell's public surface.
• Branch was rebased onto current main and force-pushed; an earlier husky/lint-staged commit was dropped from history in favour of this single lefthook commit.

Test plan

• pnpm fmt:check passes against the new lockfile
• Smoke test: malformatted JSON staged, hook fires, oxfmt reformats and re-stages the formatted content
• The lefthook-setup commit itself was gatekept by the freshly-installed hook (oxfmt ran against its own staged files), proving the hook is wired correctly

[erickteowarang]

@copilot can you help me resolve the branch conflict in pnpm-lock.yaml

[Copilot]

Pull request overview

Adds local pre-commit automation so staged files are formatted with oxfmt before committing, reducing CI failures caused by unformatted changes.

Changes:

• Add husky + lint-staged dev dependencies and a prepare script to install hooks on pnpm install.
• Configure lint-staged to run oxfmt for common source/document formats.
• Update lockfile to include the new toolchain (and reflect dependency re-resolution).

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
package.json	Adds husky/lint-staged, wires prepare, and defines the lint-staged file matcher to run oxfmt.
.husky/pre-commit	Introduces the pre-commit hook entrypoint that triggers lint-staged.
pnpm-lock.yaml	Captures dependency graph changes from adding husky and lint-staged (plus related re-resolution).

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

Comments suppressed due to low confidence (1)

.husky/pre-commit:2

• .husky/pre-commit is missing a shebang / Husky wrapper. Git executes hooks as standalone executables; without a shebang (and typically Husky’s _/husky.sh bootstrap), this hook will fail with an “exec format error” on POSIX systems and won’t run lint-staged. Add the standard Husky hook header and ensure the hook file is executable in git.

pnpm exec lint-staged

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

@copilot can you help me resolve the branch conflict in pnpm-lock.yaml

Resolved in 5cb7977 by merging origin/main into this branch and fixing the pnpm-lock.yaml conflict via lockfile regeneration (pnpm install --lockfile-only with the existing trust-policy excludes). The branch is now mergeable.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@tailor-platform/app-shell@274

npm i https://pkg.pr.new/@tailor-platform/app-shell-sdk-plugin@274

npm i https://pkg.pr.new/@tailor-platform/app-shell-vite-plugin@274

commit: 5cb7977

[erickteowarang]

@copilot I've updated it to use lefthook instead, can you verify if this new approach will work?

[Copilot]

@copilot I've updated it to use lefthook instead, can you verify if this new approach will work?

Yes — I verified the lefthook approach on commit f3e272a and it works.

• prepare installs hooks (lefthook install) and .git/hooks/pre-commit is correctly wired.
• lefthook.yml pre-commit command runs pnpm exec oxfmt {staged_files} with stage_fixed: true.
• I ran a smoke test with a staged malformed JSON file; lefthook run pre-commit reformatted it and the formatted content was re-staged.
• Validation passed: pnpm install --frozen-lockfile, pnpm type-check, pnpm lint, pnpm test, and pnpm fmt.

I also checked recent branch workflows — no failing CI runs for this head SHA.